Create unauth-ztp-ping.yaml

Creates a template that can detect ZyXEL ZTP (Zero Touch Provisioning) interfaces that lack any authentication checks.
Authentication checks were added in the fixes for CVE-2023-28771

http/vulnerabilities/zyxel/unauth-ztp-ping.yaml

@@ -0,0 +1,33 @@
+id: unauth-ztp-ping
+
+info:
+  name: ZyXEL USG ZTP Lack of Authentication
+  description: |
+    Make a ZyXEL USG with ZTP support, pre CVE-2023-28771 patch, do a DNS lookup by asking it to make an ICMP request.
+    This template can be used to detect hosts potentially vulnerable to CVE-2023-28771, CVE-2022-30525, and other issues, without actually exploiting the vulnerability.
+  reference:
+    - https://www.fullspectrum.dev/the-hunt-for-cve-2023-28771-friends-part-2-fingerprinting-handler/
+    - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls?ref=fullspectrum.dev
+  metadata:
+    verified: "true"
+  author: dmartyn
+  severity: medium
+  tags: misconfig,unauth,zyxel,ztp
+
+requests:
+  - raw:
+      - | # try resolve
+        POST /ztp/cgi-bin/handler HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
+        Content-Type: application/json
+        Connection: close
+
+        {"command":"ping","dest":"{{interactsh-url}}"}
+
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the DNS Interaction
+        words:
+          - "dns"