diff --git a/http/vulnerabilities/other/elasticsearch5-log4j-rce.yaml b/http/vulnerabilities/other/elasticsearch5-log4j-rce.yaml index f6417374ef..5005ae8723 100644 --- a/http/vulnerabilities/other/elasticsearch5-log4j-rce.yaml +++ b/http/vulnerabilities/other/elasticsearch5-log4j-rce.yaml @@ -47,23 +47,21 @@ http: - type: regex part: interactsh_request regex: - - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${:-{{rand1}}}${:-{{rand2}}}.${hostName} in output + extractors: - type: kval kval: - - interactsh_ip # Print remote interaction IP in output + - type: regex group: 2 regex: - - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print injection point in output part: interactsh_request - type: regex group: 1 regex: - - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${:-{{rand1}}}${:-{{rand2}}}.${hostName} in output part: interactsh_request # digest: 490a0046304402202c2aa3734b820d1cdf46c00bfd0686cada76c22739cff13609d749c5626088cf022046178b3ce407d34b4428105e1729946ff4ce5fe052242780227e35bc13980da7:922c64590222798bb761d5b6d8e72950