Sploitus

Exploit for CVE-2021-43798

kitploit · 2026-09-03

Exploit Code

MARKDOWN16 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-BOUQUETS-AI-CVE-2021-43798
# CVE-2021-43798

A batch verification script written in Golang, with 48 built-in verifications  
Too many people write it in Python, so I'm trying to learn Golang

# Usage

Save the URL addresses as url.txt, then run `go run CVE-2021-43798.go` in the current directory. Vulnerable addresses will be saved to test.txt ![](https://hellohy.top/wp-content/uploads/2022/01/image-35-1024x580.png)

# Exploitation

After confirming the vulnerability exists, access var/lib/grafana/grafana.db to download this database file and open the user table ![](https://hellohy.top/wp-content/uploads/2022/01/image-32-1024x245.png) The password is salted, so it generally cannot be cracked (the salt is used to protect short passwords from being exposed by rainbow tables, i.e., the collision salt is a random value. The encryption formula is roughly md5 (md5 (passwd)+salt), and the cracking difficulty increases exponentially with each additional character)  
It was found that when the login is admin, the password is usually also admin  
Just log in, but remember to change the IP or log in from a virtual machine, as detailed records will be kept in the backend  
![](https://hellohy.top/wp-content/uploads/2022/01/image-33-1024x179.png)