From 445b0796143441cd0fed8ee2befcacade2ef2ef5 Mon Sep 17 00:00:00 2001
From: J4vaovo <128683738+j4vaovo@users.noreply.github.com>
Date: Wed, 14 Jun 2023 00:10:15 +0800
Subject: [PATCH] Create apache-rocketmq-broker-unauth.yaml

---
 network/apache-rocketmq-broker-unauth.yaml | 24 ++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 network/apache-rocketmq-broker-unauth.yaml

diff --git a/network/apache-rocketmq-broker-unauth.yaml b/network/apache-rocketmq-broker-unauth.yaml
new file mode 100644
index 0000000000..29dc432482
--- /dev/null
+++ b/network/apache-rocketmq-broker-unauth.yaml
@@ -0,0 +1,24 @@
+id: apache-rocketmq-broker-unauth
+
+info:
+  name: Rocketmq - Unauthenticated Access
+  author: j4vaovo
+  severity: high
+  description: Rocketmq Unauthenticated Access.
+  reference:
+  tags: network,rocketmq,unauth
+
+network:
+  - inputs:
+      - data: "000000c9000000b17b22636f6465223a32352c226578744669656c6473223a7b224163636573734b6579223a22726f636b65746d7132222c225369676e6174757265223a222b7a6452645575617a6953516b4855557164727477673146386a6b3d227d2c22666c6167223a302c226c616e6775616765223a224a415641222c226f7061717565223a302c2273657269616c697a655479706543757272656e74525043223a224a534f4e222c2276657273696f6e223a3433337d746573745f6b65793d746573745f76616c75650a0a"
+        type: hex
+
+    host:
+      - "{{Hostname}}"
+      - "{{Host}}:10911"
+    read-size: 2048
+
+    matchers:
+      - type: word
+        words:
+          - "serializeTypeCurrentRPC"