#!/usr/bin/env python3
"""CVE-2026-1731 检测脚本 - BeyondTrust RS/PRA RCE"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check(target):
    """检测 BeyondTrust RS/PRA 管理界面暴露"""
    urls = [
        f"https://{target}/apigateway/",
        f"https://{target}/login/login",
        f"https://{target}/",
    ]
    for url in urls:
        try:
            r = requests.get(url, verify=False, timeout=10, allow_redirects=True)
            if r.status_code in (200, 301, 302, 403):
                if "BeyondTrust" in r.text or "BeyondSecure" in r.text or "beyondtrust" in r.text.lower():
                    return True
        except Exception:
            continue
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2026-1731 BeyondTrust RCE")

id: CVE-2026-1731

info:
  name: BeyondTrust Remote Support/PRA 远程代码执行
  author: x7peeps
  severity: critical
  description: BeyondTrust Remote Support和Privileged Remote Access存在CVSS 9.9的远程代码执行漏洞
  reference:
    - https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
  classification:
    cvss-score: 9.9
    cve-id: CVE-2026-1731
  tags: cve,cve2026,beyondtrust,remote-support,pra,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/login/login"
      - "{{BaseURL}}/"
    matchers:
      - type: word
        words:
          - "BeyondTrust"
          - "BeyondSecure"
          - "Remote Support"
        condition: or

#!/usr/bin/env python3
"""CVE-2026-40138/40139 检测脚本 - BeyondTrust 多漏洞组合"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check(target):
    """检测 BeyondTrust 服务暴露"""
    try:
        r = requests.get(f"https://{target}/apigateway/login", verify=False, timeout=10)
        if r.status_code in (200, 401, 403):
            return True
    except Exception:
        pass
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2026-40138/40139 BeyondTrust 多漏洞")

id: CVE-2026-40138

info:
  name: BeyondTrust RS/PRA 多漏洞组合
  author: x7peeps
  severity: critical
  description: BeyondTrust RS/PRA存在多个CVSS 9.2 Critical漏洞，组合利用可达完全接管
  reference:
    - https://www.beyondtrust.com/trust-center/security-advisories/bt26-03
  classification:
    cvss-score: 9.2
    cve-id: CVE-2026-40138
  tags: cve,cve2026,beyondtrust,rs,pra,multi-vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/login/login"
    matchers:
      - type: word
        words:
          - "BeyondTrust"

#!/usr/bin/env python3
"""CVE-2025-5309 检测脚本 - BeyondTrust SSTI"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check_ssti(target):
    """通过注入模板语法检测 SSTI 是否存在"""
    payloads = [
        "{{7*7}}",
        "${7*7}",
        "<%= 7*7 %>",
    ]
    for payload in payloads:
        try:
            url = f"https://{target}/apigateway/search?q={payload}"
            r = requests.get(url, verify=False, timeout=10)
            if "49" in r.text:
                return True
        except Exception:
            continue
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check_ssti(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2025-5309 BeyondTrust SSTI")

id: CVE-2025-5309

info:
  name: BeyondTrust RS/PRA 服务器端模板注入
  author: x7peeps
  severity: high
  description: BeyondTrust Remote Support和PRA存在SSTI漏洞，可导致远程代码执行
  reference:
    - https://www.beyondtrust.com/trust-center/security-advisories/bt25-04
  classification:
    cvss-score: 8.6
    cve-id: CVE-2025-5309
  tags: cve,cve2025,beyondtrust,ssti,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/login/login"
    matchers:
      - type: word
        words:
          - "BeyondTrust"

#!/usr/bin/env python3
"""CVE-2025-0217 / CVE-2024-12356 检测 - BeyondTrust 认证绕过+命令注入"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check_auth_bypass(target):
    """检测 CVE-2025-0217 认证绕过"""
    paths = ["/apigateway/api/auth", "/api/v2/auth", "/login/action"]
    for path in paths:
        try:
            r = requests.get(f"https://{target}{path}", verify=False, timeout=10)
            if r.status_code in (200, 401) and "token" in r.text.lower():
                return True
        except Exception:
            continue
    return False

def check_cmd_injection(target):
    """检测 CVE-2024-12356 命令注入端点"""
    paths = ["/apigateway/api/config", "/api/v2/support/restart"]
    for path in paths:
        try:
            r = requests.get(f"https://{target}{path}", verify=False, timeout=10)
            if r.status_code in (200, 400, 405):
                return True
        except Exception:
            continue
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    auth_bypass = check_auth_bypass(sys.argv[1])
    print(f"[{'+' if auth_bypass else '-'}] {sys.argv[1]} - CVE-2025-0217 认证绕过")
    cmd_inj = check_cmd_injection(sys.argv[1])
    print(f"[{'+' if cmd_inj else '-'}] {sys.argv[1]} - CVE-2024-12356 命令注入")

id: CVE-2024-12356

info:
  name: BeyondTrust RS/PRA 命令注入
  author: x7peeps
  severity: critical
  description: BeyondTrust Remote Support和PRA存在命令注入漏洞，可实现远程代码执行
  reference:
    - https://www.beyondtrust.com/trust-center/security-advisories/bt24-10
  classification:
    cvss-score: 9.8
    cve-id: CVE-2024-12356
  tags: cve,cve2024,beyondtrust,command-injection,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/login/login"
    matchers:
      - type: word
        words:
          - "BeyondTrust"

#!/usr/bin/env python3
"""CVE-2025-66374 检测辅助 - CyberArk EPM 权限提升"""
import subprocess
import sys

def check():
    """检测本地是否安装了 CyberArk EPM Agent"""
    try:
        result = subprocess.run(
            ['sc', 'query', 'EPMAgent'],
            capture_output=True, text=True, timeout=5
        )
        if 'RUNNING' in result.stdout or 'STOPPED' in result.stdout:
            return True
    except Exception:
        pass
    return False

if __name__ == "__main__":
    result = check()
    print(f"[{'+' if result else '-'}] CyberArk EPM Agent - CVE-2025-66374 权限提升")

id: CVE-2025-66374

info:
  name: CyberArk EPM 管理任务策略权限提升
  author: x7peeps
  severity: high
  description: CyberArk Endpoint Privilege Manager Agent存在管理任务策略权限提升漏洞
  reference:
    - https://stack.watch/vuln/CVE-2025-66374/
  classification:
    cvss-score: 7.8
    cve-id: CVE-2025-66374
  tags: cve,cve2025,cyberark,epm,privilege-escalation

tcp:
  - host:
      - "{{Hostname}}"
    port: 18581
    inputs:
      - data: "GET /health HTTP/1.1\r\nHost: {{Hostname}}\r\n\r\n"
        read: 1024
    matchers:
      - type: word
        words:
          - "cyberark"
          - "EPM"
        condition: or
        case-insensitive: true

#!/usr/bin/env python3
"""CVE-2025-49831 检测辅助 - Secrets Manager 网络劫持"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check(target):
    """检测 Secrets Manager API 暴露"""
    try:
        r = requests.get(f"https://{target}/api/authn/login", verify=False, timeout=10)
        if r.status_code in (200, 401, 403, 404):
            return True
    except Exception:
        pass
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2025-49831 Secrets Manager 网络劫持")

id: CVE-2025-49831

info:
  name: CyberArk Secrets Manager 网络请求错误路由
  author: x7peeps
  severity: high
  description: CyberArk Secrets Manager自托管版本存在网络请求错误路由漏洞，可导致认证请求被重定向到恶意服务器
  reference:
    - https://stack.watch/vuln/CVE-2025-49831/
  classification:
    cve-id: CVE-2025-49831
  tags: cve,cve2025,cyberark,secrets-manager,network-hijack

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/authn/login"
    matchers:
      - type: status
        status:
          - 401
          - 403

#!/usr/bin/env python3
"""CVE-2025-49830 检测辅助 - Conjur YAML 文件包含"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def check(target):
    """检测 Conjur API 暴露"""
    try:
        r = requests.get(f"https://{target}/api/authn/login", verify=False, timeout=10)
        if r.status_code in (200, 401, 403):
            return True
    except Exception:
        pass
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = check(sys.argv[1])
    print(f"[{'+' if result else '-'}] {sys.argv[1]} - CVE-2025-49830 Conjur YAML文件包含")

id: CVE-2025-49830

info:
  name: CyberArk Conjur YAML策略文件包含
  author: x7peeps
  severity: high
  description: CyberArk Conjur/Secrets Manager策略解析器存在YAML文件包含漏洞
  reference:
    - https://stack.watch/vuln/CVE-2025-49830/
  classification:
    cve-id: CVE-2025-49830
  tags: cve,cve2025,cyberark,conjur,yaml,file-inclusion

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/authn/login"
    matchers:
      - type: status
        status:
          - 401
          - 403

#!/usr/bin/env python3
"""CVE-2024-39708 检测辅助 - Delinea DLL搜索顺序劫持"""
import os
import sys
import subprocess

def check():
    """检测 Delinea Privilege Manager Agent 是否安装"""
    paths = [
        r"C:\Program Files\Thycotic\Agents\Agent",
        r"C:\Program Files\Delinea\Privilege Manager\Agent",
    ]
    for path in paths:
        if os.path.exists(path):
            return True

    temp_path = r"C:\Windows\Temp\Arellia\AmsAgent"
    if os.path.exists(temp_path):
        return True

    return False

def check_weak_dacls():
    """检查 Temp 目录中的 Arellia 目录权限"""
    target_dir = r"C:\Windows\Temp\Arellia"
    if os.path.exists(target_dir):
        try:
            result = subprocess.run(
                ['icacls', target_dir],
                capture_output=True, text=True, timeout=5
            )
            if 'Users' in result.stdout and ':(OI)(CI)' in result.stdout:
                return True
        except Exception:
            pass
    return False

if __name__ == "__main__":
    installed = check()
    print(f"[{'+' if installed else '-'}] Delinea Privilege Manager - CVE-2024-39708 DLL劫持")
    if installed:
        weak = check_weak_dacls()
        print(f"[{'+' if weak else '-'}] 弱 DACL 目录权限: {'存在' if weak else '未发现'}")

id: CVE-2024-39708

info:
  name: Delinea Privilege Manager DLL搜索顺序劫持
  author: x7peeps
  severity: high
  description: Delinea Privilege Manager for Windows存在DLL搜索顺序劫持漏洞，可实现本地SYSTEM权限提升
  reference:
    - https://www.cyberark.com/resources/threat-research-blog/identity-crisis-the-curious-case-of-a-delinea-local-privilege-escalation-vulnerability
  classification:
    cve-id: CVE-2024-39708
    cwe-id: CWE-427
  tags: cve,cve2024,delinea,thycotic,privilege-manager,dll-hijack,privilege-escalation

tcp:
  - host:
      - "{{Hostname}}"
    port: 5806
    inputs:
      - data: ""
        read: 512
    matchers:
      - type: binary
        binary:
          - "44656c696e6561"

#!/usr/bin/env python3
"""CVE-2023-32784 检测辅助 - KeePass 主密码内存恢复"""
import subprocess
import sys
import os

def check():
    """检测 KeePass 是否在运行"""
    try:
        result = subprocess.run(
            ['tasklist', '/FI', 'IMAGENAME eq KeePass.exe'],
            capture_output=True, text=True, timeout=5
        )
        if 'KeePass.exe' in result.stdout:
            return True
    except Exception:
        pass

    # 检查 KeePass 安装
    keepass_paths = [
        os.path.expandvars(r"%ProgramFiles%\KeePass Password Safe"),
        os.path.expandvars(r"%LocalAppData%\KeePass Password Safe"),
        os.path.expandvars(r"%ProgramFiles(x86)%\KeePass Password Safe"),
    ]
    for path in keepass_paths:
        if os.path.exists(path):
            return True
    return False

if __name__ == "__main__":
    result = check()
    print(f"[{'+' if result else '-'}] KeePass - CVE-2023-32784 主密码内存恢复")

id: CVE-2023-32784

info:
  name: KeePass 主密码内存恢复
  author: x7peeps
  severity: medium
  description: KeePass 2.x存在主密码内存恢复漏洞，攻击者可通过内存转储恢复密码
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-32784
  classification:
    cve-id: CVE-2023-32784
  tags: cve,cve2023,keepass,password-recovery,memory

tcp:
  - host:
      - "{{Hostname}}"
    port: 1337
    inputs:
      - data: ""
        read: 256
    matchers:
      - type: binary
        binary:
          - "4b656550617373"

#!/usr/bin/env python3
"""CVE-2023-32785/32786 检测辅助 - KeePass 密码片段泄露"""
import os
import sys

def check_recent_files():
    """检查 KeePass 最近数据库文件路径"""
    recent_files_path = os.path.expandvars(
        r"%APPDATA%\KeePass\KeePass.config.xml"
    )
    if os.path.exists(recent_files_path):
        try:
            with open(recent_files_path, 'r') as f:
                content = f.read()
                if 'KdbxFile' in content or 'RecentFile' in content:
                    return True
        except Exception:
            pass
    return False

if __name__ == "__main__":
    result = check_recent_files()
    print(f"[{'+' if result else '-'}] KeePass - CVE-2023-32785/32786 密码片段泄露")

id: CVE-2023-32785

info:
  name: KeePass 密码片段泄露
  author: x7peeps
  severity: medium
  description: KeePass密码片段和XML导出格式存在密码泄露风险
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-32785
  classification:
    cve-id: CVE-2023-32785
  tags: cve,cve2023,keepass,password-leak

tcp:
  - host:
      - "{{Hostname}}"
    port: 1337
    inputs:
      - data: ""
        read: 256
    matchers:
      - type: binary
        binary:
          - "4b656550617373"