Merge pull request #7174 from dm-ct/patch-1

Create unauth-ztp-ping.yaml

http/vulnerabilities/zyxel/unauth-ztp-ping.yaml

@@ -0,0 +1,43 @@
+id: unauth-ztp-ping
+
+info:
+  name: Unauthenticated ZyXEL USG ZTP - Detect
+  author: dmartyn
+  severity: high
+  description: |
+    Make a ZyXEL USG with ZTP support, pre CVE-2023-28771 patch, do a DNS lookup by asking it to make an ICMP request.
+    This template can be used to detect hosts potentially vulnerable to CVE-2023-28771, CVE-2022-30525, and other issues, without actually exploiting the vulnerability.
+  reference:
+    - https://www.fullspectrum.dev/the-hunt-for-cve-2023-28771-friends-part-2-fingerprinting-handler/
+    - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls
+  metadata:
+    verified: "true"
+    shodan-query: title:"USG FLEX"
+  tags: misconfig,unauth,zyxel,ztp,rce,oast
+
+http:
+  - raw:
+      - |
+        POST /ztp/cgi-bin/handler HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"command":"ping","dest":"{{interactsh-url}}"}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: body
+        words:
+          - "message"
+          - "result"
+        condition: and
+
+      - type: status
+        status:
+          - 200