🔥 POC-bomber

🦄 POC bomber is a vulnerability detection/exploitation tool designed to quickly gain permissions on target servers by leveraging a large number of high-impact vulnerability POCs/EXPs

This project collects various high-impact vulnerabilities from the internet, such as RCE · arbitrary file upload · deserialization · SQL injection, which can grant core server permissions. These POCs/EXPs are integrated into the POC bomber arsenal, using a large number of high-impact POCs to fuzz single or multiple targets, thereby quickly discovering vulnerable assets and gaining target server permissions. Applicable scenarios include but are not limited to:

1. Rapid targeting during HVV (Red/Blue team exercises)
2. Vulnerability asset mapping
3. Maintaining a personal vulnerability scanner

📝 Introduction

POC bomber's POCs support vulnerability detection for vulnerable components such as weblogic, tomcat, apache, jboss, nginx, struct2, thinkphp2x3x5x, spring, redis, jenkins, PHP language vulnerabilities, shiro, Fanwei OA, Zhiyuan OA, Tongda OA, etc. It supports calling dnslog platforms to detect RCE without echo (including log4j2 detection), supports single-target detection and batch detection. The program uses a high-concurrency thread pool, supports custom import of POCs/EXPs, and can generate vulnerability reports.
POC bomber uses verification mode by default to validate POCs. If the attack value in the returned result is True, you can add the parameter (--attack) to enter attack mode and directly call the EXP for exploitation (you need to specify the POC file name), achieving one-click getshell.

😄 Red Team Edition - RedTeam 3.0

The v3.0.0 version of POC-bomber features faster scanning efficiency, fixes lag caused by a single POC and various bugs, adds colored output and progress display, supports specifying a POC directory, and is suitable for the fast pace of HVV. It also adds some publicly disclosed POCs from 2022. It supports self-hosted dnslog servers. After configuring your own domain, you can use POCbomber to start a dnslog platform on a VPS for DNS out-of-band detection of certain vulnerabilities.

💻 Screenshots

🏆 Verification Mode

    python3 pocbomber.py -u http://xxx.xxx
    

image image

⚡️ Attack Mode

    python3 pocbomber.py -u http://xxx.xxx --poc="thinkphp2_rce.py" --attack
    

🔧 Installation

  git clone https://github.com/tr0uble-mAker/POC-bomber.git            
  cd POC-bomber
  pip install -r requirements.txt

🚀 Usage

    View usage:     python3 pocbomber.py
    
    Modes:
            Get POC/EXP info:   python3 pocbomber.py --show
            Single-target detection:        python3 pocbomber.py -u http://xxx.xxx.xx
            Batch detection:          python3 pocbomber.py -f url.txt -o report.txt 
            Specify POC detection:       python3 pocbomber.py -f url.txt --poc="thinkphp2_rce.py"
            EXP attack mode:       python3 pocbomber.py -u target_url --poc="specified_poc_file" --attack
    Parameters:
            -u  --url      Target URL
            -f  --file     Specify the target URL file   
            -o  --output   Specify the report output file (no report generated by default)
            -p  --poc      Specify one or multiple POCs for detection, pass the POC file name directly, separate multiple POCs with (,)
            -t  --thread   Specify the maximum number of concurrent threads in the thread pool (30 by default)
            --show         Display detailed POC/EXP information
            --attack       Use the EXP in the POC file to attack
            --dnslog       Use the dnslog platform to detect vulnerabilities without echo (dnslog is disabled by default, can be enabled in the configuration file)
            

🔆 Configuration File

  /inc/config.py   
  
      

⚠️ FAQ

1. The program can run directly without installing requirements.txt; it only depends on the requests third-party library. If other libraries cannot be installed, the program will still run, but some POCs may not be detectable.
2. Detection of the log4j2 command execution vulnerability: you need to add the --dnslog parameter.
3. Detection of vulnerabilities without echo uses the dnslog.cn platform by default and is disabled by default. To enable it, go to the configuration file and set the dnslog_flag switch to True.
4. You need to specify a POC to use the --attack attack mode.

📁 Directory Structure:

  +--------- poc_bomber.py (Launches POC-bomber)
  | 
  +--------- inc (Contains core files supporting the POC-bomber framework)
  |
  \--------- pocs(POC storage list)----------- framework(Contains framework vulnerability POCs)
                                  |
                                  |------ middleware(Contains middleware vulnerability POCs)
                                  |
                                  |------ ports(Contains common port vulnerability and host service vulnerability POCs)
                                  |
                                   \----- webs(Contains common web page vulnerability POCs)
  
  

📖 POC Writing Rules

POC bomber supports custom POCs.
All POCs must be written in Python 3 and have verify and attack (not mandatory) functions for verification and attack respectively.

👻 The vulnerability verification function (verify) should satisfy the following conditions:

1. The function name is verify, and the parameter receives the target URL.

2. The function returns the result in the form of a dictionary and must have two key-value pairs: name and vulnerable. name describes the vulnerability name, and vulnerable indicates whether the vulnerability exists via True and False states.

3. If the vulnerability exists, set the value of vulnerable in the returned dictionary to True, and add the target URL, vulnerability exploitation-related web pages, and other information.

4. Use the try method to attempt verification. When using requests and other methods to send data packets, set a timeout to avoid the POC hanging.

   root@kitploit:~

    def verify(url):                        
        relsult = {                                            
            'name': 'Thinkphp5 5.0.22/5.1.29 Remote Code Execution Vulnerability',                          
            'vulnerable': False，
            'attack'： False，        # If there is an EXP supporting attack mode, set the value of attack to True
        }              
        try:                    
            ......        
            (Use any method to detect the vulnerability)             
            ......
            if vulnerability exists:
                relsult['vulnerable'] = True     # Set the value of vulnerable in relsult to True
                relsult['url'] = url             # Return the verified URL
                relust['xxxxx'] = 'xxxxx'        # You can add information such as the source related to this vulnerability   
                ......           
                return relsult     # Return relsult with the vulnerable value set to True                   
            else:  # Vulnerability does not exist           
                return relsult    # If the vulnerability does not exist, return relsult with the vulnerable value set to False
   
        execpt:
            return relsult
   

If there is an EXP, you can write the attack function as the EXP attack function.

🎃 The vulnerability attack function (attack) should satisfy the following conditions:

1. The function name is attack, and the parameter receives the target URL.

2. Write the EXP code in the try block to perform the attack; it can interactively communicate with the user.

3. After writing, set the attack value in the dictionary returned by the vulnerability's verify function to True.

4. Return True after a successful attack; return False if it fails for other reasons.

   root@kitploit:~

    def attack(url):    
      try:            
          ........................................            
            Attack code (execute commands, reverse shell, upload trojans, etc.)             
          ........................................
          return True
      except:               
          return False    
                  
                  
   

After writing, place the POC anywhere under the /pocs directory and it will be called recursively!

The project is continuously updated. Contributions of POCs from all masters are welcome to build cybersecurity together!
If you have any questions, feel free to leave a message on issues: https://github.com/tr0uble-mAker/POC-bomber/issues
Contact: [email protected]

Disclaimer

This tool is only intended for legally authorized enterprise security construction activities. If you need to test the usability of this tool, please set up your own target environment. When using this tool for detection, you should ensure that the behavior complies with local laws and regulations, and that you have obtained sufficient authorization. Do not scan unauthorized targets. If you engage in any illegal behavior while using this tool, you must bear the corresponding consequences yourself. We shall not bear any legal or joint liability.