{"uuid": "ec6265bc-a6fe-4172-a427-dd9fa0f75a93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-41773", "type": "seen", "source": "https://gist.github.com/tcqjkdgsip/8db44bdd9c473dafcbfb4030b8351361", "content": "```ini\n; nuclei \u6a21\u677f\u4e2d\u5e38\u89c1\u7684 requests \u5757\u7ed3\u6784\uff0c\u7528\u4e8e\u5bf9\u6bd4 HTTP \u63a2\u6d4b\u7c7b\u5de5\u5177\u7684 DSL \u8bbe\u8ba1\n[id: cve-2021-41773-apache-path-traversal]\n\n[http]\n  method = GET\n  path = [\"/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd\"]\n  headers = { User-Agent = \"nuclei-custom-scan\" }\n  matchers-condition = and\n  matchers = [\n    { type = regex, regex = [\"root:.*:0:0:\"] },\n    { type = status, status = [200] }\n  ]\n  redirects = false\n  max-redirects = 3\n```\n\n\u4e0a\u9762\u8fd9\u6bb5 ini \u4e0d\u662f\u4e3a\u4e86\u771f\u8dd1 nuclei\uff0c\u800c\u662f\u628a\u5b83\u7684\u6a21\u677f\u7ec4\u7ec7\u65b9\u5f0f\u538b\u7f29\u6210\u914d\u7f6e\u89c6\u89d2\u2014\u2014\u5982\u679c\u4f60\u60f3\u81ea\u5df1\u6413\u4e00\u4e2a\u53ef\u7ef4\u62a4\u7684 PoC \u96c6\u5408\uff0c\u5148\u60f3\u6e05\u695a\u5339\u914d\u903b\u8f91\u548c\u91cd\u5b9a\u5411\u7b56\u7565\uff0c\u6bd4\u5e93\u9009\u8c01\u90fd\u91cd\u8981\u3002\n\n# \u626b\u63cf\u5668\u9009\u578b\uff1anuclei\u3001xray \u4e0e\u81ea\u7814\u63a2\u6d4b\u5668\u7684\u53d6\u820d\n\n\u5927\u8303\u56f4\u5916\u90e8\u8d44\u4ea7\u505a\u6307\u7eb9\u8bc6\u522b\u65f6\uff0c\u5de5\u5177\u9009\u578b\u66f4\u50cf\u662f\u5728**\u8986\u76d6\u5e7f\u5ea6\u3001\u8bef\u62a5\u53ef\u63a7\u6027\u3001\u53ef\u7f16\u7a0b\u7a0b\u5ea6**\u4e09\u8005\u95f4\u505a\u6743\u8861\u3002\u6211\u8bd5\u8fc7\u628a\u540c\u4e00\u6279 C \u6bb5\u5206\u522b\u5582\u7ed9 nuclei\u3001xray \u548c\u4e00\u4e2a\u57fa\u4e8e aiohttp \u81ea\u7814\u7684\u5c0f\u63a2\u6d4b\u5668\uff0c\u5dee\u5f02\u6bd4\u6587\u6863\u4e0a\u5199\u7684\u660e\u663e\u5f97\u591a\u3002\n\n## \u73af\u5883\u51c6\u5907\u4e0e\u6210\u719f\u65b9\u6848\n\n\u5982\u679c\u53ea\u662f\u5feb\u901f\u9a8c\u8bc1\uff0c\u62ff\u73b0\u6210\u5f15\u64ce\u8d77\u6b65\u6bd4\u81ea\u7814\u7701\u4e8b\u3002\u4f9d\u8d56\u5c42\u9762\u57fa\u672c\u5c31\u662f Go \u5de5\u5177\u94fe\u52a0\u89c4\u5219\u4ed3\u5e93\uff0c\u6216\u8005 Python \u73af\u5883\u52a0\u5f02\u6b65\u8bf7\u6c42\u5e93\u3002\n\n```bash\ngo install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest\nnuclei -update-templates\n# xray \u9700\u8981\u5728\u5b98\u65b9\u6e20\u9053\u4e0b\u8f7d\u4e0e\u76ee\u6807\u5e73\u53f0\u5339\u914d\u7684\u4e8c\u8fdb\u5236\n./xray webscan --basic-crawler https://target.example --json-output out.json\n```\n\nnuclei \u7684\u6a21\u677f\u4f53\u7cfb\u66f4\u5403\u793e\u533a\u6d3b\u8dc3\u5ea6\uff0cxray \u7684\u88ab\u52a8\u626b\u63cf\u548c\u53cd\u8fde\u5e73\u53f0\u5728\u771f\u5b9e\u5bf9\u6297\u4e2d\u66f4\u987a\u624b\uff0c\u4f46\u4e24\u8005\u7684\u63d2\u4ef6\u6269\u5c55\u6210\u672c\u90fd\u4e0d\u4f4e\u3002\u5982\u679c\u4f60\u7684\u573a\u666f\u9700\u8981\u628a\u5339\u914d\u903b\u8f91\u5d4c\u8fdb\u81ea\u5df1\u7684\u6d41\u91cf\u7ba1\u9053\uff0c\u81ea\u7814\u90a3\u90e8\u5206\u4ef7\u503c\u624d\u663e\u73b0\u51fa\u6765\u2014\u2014\u8fd9\u4e5f\u662f\u6211\u6700\u540e\u9009\u62e9\u6df7\u5408\u65b9\u6848\u7684\u539f\u56e0\u3002\n\n## \u8fdb\u9636\u7528\u6cd5\uff1a\u628a\u5339\u914d\u903b\u8f91\u62bd\u51fa\u6765\n\n\u771f\u6b63\u62c9\u5f00\u5dee\u8ddd\u7684\u5176\u5b9e\u662f\u54cd\u5e94\u5904\u7406\u73af\u8282\u3002\u4e0b\u9762\u8fd9\u4e2a TypeScript \u7247\u6bb5\u662f\u6211\u7528\u6765\u505a diff \u5339\u914d\u7684\u6838\u5fc3\uff0c\u601d\u8def\u662f\u5148\u5f52\u4e00\u5316\u518d\u6bd4\u5bf9\uff0c\u907f\u514d\u56e0\u4e3a\u65f6\u95f4\u6233\u548c\u968f\u673a token \u5bfc\u81f4\u8bef\u62a5\u3002\n\n```typescript\nexport function normalizeBody(raw: string): string {\n  return raw\n    .replace(/\\b[0-9a-f]{32}\\b/gi, \"TOKEN\")          // \u53bb MD5 \u7c7b\u6307\u7eb9\n    .replace(/\\d{4}-\\d{2}-\\d{2}T[\\d:.]+Z?/g, \"TIME\") // \u53bb ISO \u65f6\u95f4\n    .replace(/\\s+/g, \" \")\n    .trim();\n}\nexport function isLikelySame(a: string, b: string): boolean {\n  return normalizeBody(a) === normalizeBody(b);\n}\n```\n\n\u5173\u952e\u5728\u7b2c\u4e00\u4e2a replace \u7528 `g` \u548c `i` \u53cc\u6807\u5fd7\u8986\u76d6\u5927\u5c0f\u5199\u4e0e\u5168\u90e8\u51fa\u73b0\uff0c\u7b2c\u4e8c\u4e2a\u6b63\u5219\u4e13\u95e8\u5904\u7406 ISO \u65f6\u95f4\u683c\u5f0f\uff0c\u4e24\u8005\u53e0\u52a0\u80fd\u780d\u6389\u5927\u534a\u566a\u97f3\u3002\n\n## Pitfalls\n\n\u51e0\u4e2a\u8e29\u8fc7\u7684\u5751\u3002xray \u7684 POC \u8bed\u6cd5\u548c nuclei \u4e0d\u4e92\u901a\uff0c\u540c\u4e00\u6f0f\u6d1e\u8981\u7ef4\u62a4\u4e24\u5957\u89c4\u5219\uff1bnuclei \u5728 `-rate-limit` \u62c9\u9ad8\u540e\u6f0f\u62a5\u7387\u4f1a\u660e\u663e\u4e0a\u5347\uff0c\u5185\u7f51\u5feb\u626b\u548c\u516c\u7f51\u6162\u626b\u5fc5\u987b\u5206\u6279\uff1b\u81ea\u7814\u63a2\u6d4b\u5668\u6700\u5927\u7684\u98ce\u9669\u4e0d\u662f\u6027\u80fd\uff0c\u800c\u662f**\u5e76\u53d1\u4e0b\u7684 DNS \u7f13\u5b58\u548c TLS \u4f1a\u8bdd\u590d\u7528**\u6ca1\u5904\u7406\u597d\uff0c\u4f1a\u76f4\u63a5\u628a\u7ed3\u679c\u5e26\u504f\u3002\u66f4\u7cfb\u7edf\u7684\u5de5\u5177\u8fb9\u754c\u8ba8\u8bba\u53ef\u4ee5\u53c2\u8003 \u7c73\u5170\u5a31\u4e50 \u6574\u7406\u7684\u5b89\u5168\u5de5\u5177\u6a2a\u5411\u8d44\u6599\uff0c\u867d\u7136\u5b9a\u4f4d\u504f\u793e\u533a\uff0c\u4f46\u5bf9\u9009\u578b\u7ef4\u5ea6\u7f57\u5217\u5f97\u6bd4\u8f83\u5168\u3002\n\n## \u5c0f\u7ed3\u4e0e\u5ef6\u4f38\n\n\u6ca1\u6709\u4e00\u628a\u4f1e\u80fd\u76d6\u4f4f\u6240\u6709\u6218\u573a\u3002\u8d44\u4ea7\u9762\u8981\u5927\u5c31\u4e0a nuclei \u52a0\u793e\u533a\u6a21\u677f\uff0c\u8ffd\u6c42\u4f4e\u8bef\u62a5\u7684\u6df1\u6316\u5c31\u53e0 xray \u88ab\u52a8\uff0c\u9700\u8981\u8ddf\u4e1a\u52a1\u903b\u8f91\u8026\u5408\u7684\u90e8\u5206\u7559\u7ed9\u81ea\u7814\u3002\u6211\u7684\u5efa\u8bae\u662f\u628a\u4e09\u8005\u5f53\u6210\u6d41\u6c34\u7ebf\u7684\u4e0d\u540c\u9636\u6bb5\uff0c\u800c\u4e0d\u662f\u4e92\u65a5\u7684\u7ade\u54c1\u2014\u2014\u5148\u8dd1\u5e7f\u5ea6\uff0c\u518d\u7528 diff \u903b\u8f91\u6536\u7a84\uff0c\u6700\u540e\u4eba\u5de5\u786e\u8ba4\uff0c\u8fd9\u6761\u94fe\u8def\u76ee\u524d\u6700\u7a33\u3002\n", "creation_timestamp": "2026-09-20T02:18:30.312082Z"}