diff --git a/modules/vulnerabilities/unix/http/lucee_rce/manifests/configure.pp b/modules/vulnerabilities/unix/http/lucee_rce/manifests/configure.pp index 41b29ec0d..fef6c3604 100644 --- a/modules/vulnerabilities/unix/http/lucee_rce/manifests/configure.pp +++ b/modules/vulnerabilities/unix/http/lucee_rce/manifests/configure.pp @@ -2,13 +2,14 @@ # Configuration for lucee with secgen # class lucee_rce::configure { - $leaked_filenames = ['flagtest'] ##$secgen_parameters['leaked_filenames'] - $strings_to_leak = ['this is a list of strings that are secrets / flags','another secret'] ##$secgen_parameters['strings_to_leak'] + $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file) + $leaked_filenames = $secgen_parameters['leaked_filenames'] + $strings_to_leak = $secgen_parameters['strings_to_leak'] Exec { path => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'] } ::secgen_functions::leak_files { 'lucee-flag-leak': - storage_directory => '/', + storage_directory => '/root', leaked_filenames => $leaked_filenames, strings_to_leak => $strings_to_leak, owner => 'root', diff --git a/modules/vulnerabilities/unix/http/lucee_rce/secgen_metadata.xml b/modules/vulnerabilities/unix/http/lucee_rce/secgen_metadata.xml index a352faf89..40150f204 100644 --- a/modules/vulnerabilities/unix/http/lucee_rce/secgen_metadata.xml +++ b/modules/vulnerabilities/unix/http/lucee_rce/secgen_metadata.xml @@ -13,7 +13,7 @@ http in_the_wild - user_rwx + root_rwx remote linux low @@ -23,43 +23,31 @@ leaked_filenames - 8888 + - + - + flag CVE-2021-21307 9.8 - - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Lucee Server - - Apache/LGPL - - https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md + AV:N/AC:L/Au:N/C:C/I:C/A:C + https://github.com/httpvoid/writeups/blob/main/Apple-RCE.md https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/lucee_admin_imgprocess_file_write.rb - - - visit - ip:8888 + Lucee Server + Apache/LGPL - services/unix/**check modules** - - - - services/unix/**add service file** + update \ No newline at end of file diff --git a/scenarios/examples/vulnerability_examples/lucee_rce.xml b/scenarios/examples/vulnerability_examples/lucee_rce.xml new file mode 100644 index 000000000..d27e05a2d --- /dev/null +++ b/scenarios/examples/vulnerability_examples/lucee_rce.xml @@ -0,0 +1,16 @@ + + + + + + lucee + + + + + + + + \ No newline at end of file