{"id":13845548,"url":"https://github.com/luck-ying/Library-POC","last_synced_at":"2025-07-12T02:32:03.557Z","repository":{"id":38320148,"uuid":"350038638","full_name":"luck-ying/Library-POC","owner":"luck-ying","description":"基于Pocsuite3、goby编写的漏洞poc\u0026exp存档","archived":false,"fork":false,"pushed_at":"2024-04-12T07:08:35.000Z","size":1451,"stargazers_count":824,"open_issues_count":0,"forks_count":190,"subscribers_count":31,"default_branch":"master","last_synced_at":"2024-08-05T17:44:42.700Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/luck-ying.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2021-03-21T15:27:57.000Z","updated_at":"2024-08-05T10:31:17.000Z","dependencies_parsed_at":"2023-01-28T08:46:06.688Z","dependency_job_id":"d9e24885-3c80-40a2-979d-56b69c07155a","html_url":"https://github.com/luck-ying/Library-POC","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luck-ying%2FLibrary-POC","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luck-ying%2FLibrary-POC/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luck-ying%2FLibrary-POC/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luck-ying%2FLibrary-POC/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/luck-ying","download_url":"https://codeload.github.com/luck-ying/Library-POC/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225784783,"owners_count":17523702,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:03:28.079Z","updated_at":"2024-11-21T18:32:18.354Z","avatar_url":"https://github.com/luck-ying.png","language":"Python","funding_links":[],"categories":["Python","LLM分析过程"],"sub_categories":[],"readme":"# 目录列表\n1. 2021/3/22 F5 BIG-IP REC(CVE-2021-22986)poc\u0026exp\n2. 2021/3/23 Weblogic LDAP 远程代码执行漏洞 CVE-2021-2109\n3. 2021/3/23 MessageSolution 企业邮件归档管理系统 EEA 存在信息泄露漏洞（CNVD-2021-10543） \n4. 2021/3/24 Apache OFBiz  远程代码执行(2021-26295) \n5. 2021/4/1  VMware vRealize Operations Manager SSRF漏洞 CVE-2021-21975\n6. [2021hvv漏洞](2021hvv漏洞)\n7. 2021/4/10 好视通视频会议系统任意文件下载 CNVD-2020-62437\n8. 2021/4/11 致远OA任意用户登录+文件上传\n9. 2021/6/13 HiBOS酒店宽带运营系统远程命令执行漏洞\n11. 2021/6/25 友点CMS 登录绕过 =\u003cV9.1\n12. 2021/6/25 eyouCMS 登录绕过\n## pocsuite3 POC\n1. 2021/08/05 H3C SecParh堡垒机 data_provider.php RCE\n2. 2021/08/12 ClickHouse数据库 8123端口的未授权访问\n3. 2021/08/12 Ivanti Avalanche打印机管理系统任意文件下载\n4. 2021/08/21 深圳市西迪特科技有限公司 西迪特 WiFi Web管理系统 RCE\n5. 2021/08/25 [SPON IP网络对讲广播系统 多个漏洞](SPON_IP网络对讲广播系统)\n6. 2021/09/03 [CVE-2021-26084：Confluence OGNL 注入漏洞](Atlassian_Confluence)\n7. 2021/10/07 [Apache HTTP服务目录遍历 (CVE-2021-41773)](Apache)\n8. 2021/10/21 [网御星云多个漏洞](网御星云)\n9. 2021/10/25 [天问物业ERP系统文件上传](天问物业ERP系统)\n10. 2021/10/26 [iRDM4000智慧站房越权](iRDM4000智慧站房)\n11. 2021/11/15 [H5S视频平台信息泄露](H5S视频平台)\n12. 2021/11/15 [杭州法源软件](杭州法源软件)\n13. 2021/11/15 [孚盟云](孚盟云)\n14. 2021/11/15 [Apache Druid](Apache)\n15. 2021/11/22 [Metabase](Metabase)\n16. 2021/11/29 [Weaver](Weaver)\n17. 2021/12/27 [Sapido路由器](Sapido)\n18. 2021/12/27 [Gerapy](Gerapy)\n19. 2021/12/27 [Apache_ShenYu_Admin](Apache_ShenYu_Admin)\n20. 2021/12/29 [Apache/Apache_APISIX_Dashboard](Apache/Apache_APISIX_Dashboard)\n21. 2022/03/09 [TerraMaster_TOS_RCE](TerraMaster_TOS)\n22. 2022/04/01 [spring-cloud-function-rce](spring/spring-cloud-function-rce)\n23. 2022/05/05 [EQ企业管理系统SQL注入](EQ企业管理系统)\n24. 2022/05/11 [F5_BIG-IP_login-bypass-CVE-2022-1388](F5-BIG-IP)\n25. 2022/05/14 [Zyxel USG FLEX RCE CVE-2022-30525](Zyxel)\n26. 2022/06/07 [Atlassian Confluence 远程代码执行漏洞](Atlassian_Confluence)\n27. 2022/06/24 [Webgrind 1.5版本文件读取](Webgrind)\n28. 2022/06/27 [Apache CouchDB 3.2.1 RCE CVE-2022-24706](Apache/Apache_CouchDB)\n29. 2022/07/17 [Landray-OA-Treexml-Rce](蓝凌OA) \n30. 2022/07/17 [Crestron设备账号密码泄露-CVE-2022-23178](Crestron)\n31. 2022/07/20 [SolarView-Compact-6.00目录遍历( CVE-2022-29298)](SolarView)\n32. 2022/07/20 [zhixiangOA_msg.aspx_sql](致翔OA)\n32. 2022/07/20 [zhixiangOA_msglog.aspx_sql](致翔OA)\n33. 2022/07/28 [CHIYU-指纹机默认口令](CHIYU-指纹机)\n34. 2022/08/29 [Zimbra任意文件上传漏洞（CVE-2022-27925）](Zimbra/CVE-2022-27925-路径穿越导致RCE.py)\n35. 2022/09/23 [畅捷通T+任意文件上传-CNVD-2022-60632](畅捷通/畅捷通T+任意文件上传-CNVD-2022-60632)\n36. 2022/11/03 [Atlassian Bitbucket 命令注入漏洞 CVE-2022-36804:](Atlassian-Bitbucket/Atlassian_Bitbucket_archive_RCE_CVE_2022_36804.py)\n37. 2022/12/13 [ThinkPHP 6.0.0-6.0.13 多语言功能远程代码执行漏洞](thinkphp/Thinkphp-multi-language-rce.py)\n38. 2023/02/23 [禅道系统权限绕过与命令执行漏洞](zentao-禅道/zentao_rce_.py)\n39. 2023/02/23 [TVT数码科技 NVMS-1000任意文件读取](TVT数码科技-NVMS-1000/TVT数码科技-NVMS-1000任意文件读取.py)\n40. 2023/04/07 [极限OA video_file.php 任意文件读取](极限OA/极限OA_video_file.php_任意文件读取.py)\n41. 2023/04/11 [Joomla_未授权访问_CVE-2023-23752](/Joomla/Joomla_unauthorized_CVE-2023-23752.py)\n42. 2023/05/24 [瑞友天翼应用虚拟化系统 sql注入](瑞友天翼应用虚拟化系统)\n43. 2023/06/16 [华夏erp敏感信息泄露](华夏erp/华夏erp账号密码泄露.py)\n44. 2023/06/16 [Openfire身份认证绕过_CVE-2023-32315](Openfire/Openfire身份认证绕过_CVE-2023-32315_poc.py)\n45. 2023/09/19 [JumpServer未授权访问漏洞-CVE-2023-42442](JumpServer/JumpServer未授权访问漏洞-CVE-2023-42442.py)\n46. 2023/09/19 [用友时空KSOA_common_dept_deptid_sql注入](用友/用友时空KSOA_common_dept_deptid_sql注入.py)\n47. 2023/09/19 [用友时空KSOA_servlet_imagefield_sKeyvalue_sql注入](用友/用友时空KSOA_servlet_imagefield_sKeyvalue_sql注入.py)\n48. 2023/10/07 [用友移动系统管理_maportal_appmanager_init_appname_sql注入](用友/用友移动系统管理_maportal_appmanager_init_appname_sql注入.py)\n49. 2023/10/07 [用友移动系统管理_maportal_usermanager_init_ucode_sql注入](用友/用友移动系统管理_maportal_usermanager_init_ucode_sql注入.py)\n50. 2023/10/07 [用友GPR-U8_u8qx_slbmbygr_gsdm_sql注入](用友/用友GPR-U8_u8qx_slbmbygr_gsdm_sql注入.py)\n51. 2023/10/08 [深信服NGAF防火墙任意文件读取漏洞](深信服/深信服NGAF防火墙任意文件读取漏洞.py)\n52. 2023/10/11 [通达OA11.10_REINSTATEMENT_ID_后台sql注入](/通达OA/通达OA11.10_REINSTATEMENT_ID_后台sql注入.py)\n53. 2023/10/11 [通达OA11.9前台sql注入](/通达OA/通达OA11.9前台sql注入.py)\n54. 2023/10/11 [通达OA2017_RELATIVES_ID_后台sql注入](/通达OA/通达OA2017_RELATIVES_ID_后台sql注入.py)\n55. 2023/10/11 [广联达Linkworks_msgbroadcastuploadfile.aspx后台文件上传漏洞](/广达联/广联达Linkworks_msgbroadcastuploadfile.aspx后台文件上传漏洞.py)\n56. 2023/10/11 [广联达_Linkworks_GetIMDictionary_SQL注入漏洞](/广达联/广联达_Linkworks_GetIMDictionary_SQL注入漏洞.py)\n57. 2023/10/11 [H3C_IMC_dynamiccontent.properties.xhtm命令执行](/H3C/H3C_IMC_dynamiccontent.properties.xhtm命令执行.py)\n58. 2023/10/11 [jeecgboot_field_sql](/jeecg-boot/jeecgboot_field_sql.py)\n59. 2023/10/11 [jeecgboot_qurestSql_sql](/jeecg-boot/jeecgboot_qurestSql_sql.py)\n60. 2023/10/11 [jeecgboot_getDictItemsByTable_sql](/jeecg-boot/jeecgboot_getDictItemsByTable_sql.py)\n61. 2023/10/18 [金山终端安全系统V9.0SQL注入漏洞](/金山终端安全系统/金山终端安全系统V9.0SQL注入漏洞.py)\n62. 2023/11/16 [浙大恩特客户资源管理系统任意文件上传](/浙大恩特客户资源管理系统/浙大恩特客户资源管理系统任意文件上传_entphone.py)\n63. 2023/11/19 [用友U8-cloud_RegisterServlet_sql注入](用友/用友U8-cloud_RegisterServlet_sql注入.py)\n64. 2023/12/14 [i-doc-view_url文件读取漏洞](i-doc-view/i-doc-view_url文件读取漏洞.py)\n65. 2023/12/14 [网神SecGate3600防火墙authManageSet.cgi_信息泄露](网神SecGate/网神SecGate3600防火墙authManageSet.cgi_信息泄露.py)\n66. 2023/12/14 [网神SecGate3600防火墙cgi-bin_index.cgi_默认口令.py](网神SecGate/网神SecGate3600防火墙cgi-bin_index.cgi_默认口令.py)\n67. 2023/12/14 [泛微-云桥e-Bridge_taste_addTaste_mobile_sql时间盲注](/Weaver/泛微-云桥e-Bridge_taste_addTaste_mobile_sql注入.py)\n68. 2023/12/19 [致远M3远程代码执行漏洞](致远OA/致远M3远程代码执行漏洞.py)\n69. 2024/02/23 [用友U8C-AppPhoneServletService-SQL注入](用友/用友U8C-AppPhoneServletService-SQL注入.py)\n70. 2024/02/23 [用友U8C-KeyWordReportQuery-SQL注入](用友/用友U8C-KeyWordReportQuery-SQL注入.py)\n71. 2024/02/23 [用友U8C-ReportDetailDataQuery-SQL注入](用友/用友U8C-ReportDetailDataQuery-SQL注入.py)\n72. 2024/02/23 [用友U8C-ArchiveVerify-SQL注入](用友/用友U8C-ArchiveVerify-SQL注入.py)\n73. 2024/04/12 [Ruijie锐捷乐享智能运维管理平台SQL注入](ruijie/Ruijie锐捷乐享智能运维管理平台SQL注入.py)\n74. 2024/04/12 [泰博云平台solr接口SSRF](泰博云平台/泰博云平台solr接口SSRF.py)\n75. 2024/04/12 [新视窗新一代物业管理系统RegisterManager任意文件上传](新视窗新一代物业管理系统/新视窗新一代物业管理系统RegisterManager任意文件上传.py)\n76. 2024/04/12 [润尼尔虚拟仿真实验室系统FileUploadServlet任意文件上传](润尼尔虚拟仿真实验室系统/润尼尔虚拟仿真实验室系统FileUploadServlet任意文件上传.py)\n77. 2024/04/12 [H3C用户自助服务平台dynamiccontent_properties_xhtml](H3C/H3C用户自助服务平台dynamiccontent_properties_xhtml.py)\n## 2022 HW\n1. 2022/07/28 [用友-KSOA-前台任意文件上传](用友/用友-KSOA-前台任意文件上传)\n2. 2022/07/28 [天融信上网行为管理系统static_convert.php命令执行](topsec/天融信上网行为管理系统命令执行)\n3. 2022/07/29 [泛微eoffice10前台任意文件上传](Weaver/泛微eoffice10前台任意文件上传.py)\n4. 2022/07/29 [zentao-禅道SQL注入漏洞（CNVD-2022-42853）](zentao-禅道/zentao_sql_injection_CNVD-2022-42853.py)\n5. 2022/07/29 [明御waf登录绕过](明御waf/Ming_Royal_WAF-Login_Bypass.py)\n6. 2022/08/04 [绿盟下一代防火墙 resourse.php 任意文件上传漏洞](绿盟/nsfocus_NGFW_resourse.php_arbitrary_file_upload.py)\n\n## 2023 HW\n1. [企望制造ERP_comboxstore.action远程命令执行漏洞](/2023HW/2023.8.13/企望制造ERP_comboxstore.action远程命令执行漏洞.py)\n2. [大华智慧园区综合管理平台getFaceCapture_SQL注入漏洞](/2023HW/2023.8.13/大华智慧园区综合管理平台getFaceCapture_SQL注入漏洞.py)\n3. [大华智慧园区综合管理平台video任意文件上传漏洞](/2023HW/2023.8.13/大华智慧园区综合管理平台video任意文件上传漏洞.py)\n4. [腾讯私有化企业微信agentinfo信息泄露](/2023HW/2023.8.13/腾讯私有化企业微信agentinfo信息泄露.py)\n5. [KubePi_JwtSigKey_登陆绕过漏洞CVE-2023-22463](/2023HW/2023.8.14/KubePi_JwtSigKey_登陆绕过漏洞CVE-2023-22463.py)\n6. [启明星辰4A统一安全管控平台getMaster.do信息泄漏漏洞](/2023HW/2023.8.14/启明星辰4A统一安全管控平台getMaster.do信息泄漏漏洞.py)\n7. [大华智慧园区综合管理平台user_getUserInfoByUserName.action账号密码泄漏漏洞](/2023HW/2023.8.14/大华智慧园区综合管理平台user_getUserInfoByUserName.action账号密码泄漏漏洞.py)\n8. [飞企互联FE业务协作平台ShowImageServlet任意文件读取漏洞](/2023HW/2023.8.14/飞企互联FE业务协作平台ShowImageServlet任意文件读取漏洞.py)\n9. [OfficeWeb365_SaveDraw任意文件上传漏洞](/2023HW/2023.8.15/OfficeWeb365_SaveDraw任意文件上传漏洞.py)\n10. [安恒明御安全网关aaa_portal_auth_local_submit远程命令执行漏洞](/2023HW/2023.8.15/安恒明御安全网关aaa_portal_auth_local_submit远程命令执行漏洞.py)\n11. [帆软报表channel反序列化远程命令执行漏洞](/2023HW/2023.8.15/帆软报表channel反序列化远程命令执行漏洞.py)\n12. [新开普前置服务管理平台service.action远程命令执行漏洞](/2023HW/2023.8.15/新开普前置服务管理平台service.action远程命令执行漏洞.py)\n13. [明源云ERP系统接口管家ApiUpdate.ashx任意文件上传漏洞](/2023HW/2023.8.15/明源云ERP系统接口管家ApiUpdate.ashx任意文件上传漏洞.py)\n14. [深信服DC数据中心管理系统sangforindex_XML实体注入漏洞](/2023HW/2023.8.15/深信服DC数据中心管理系统sangforindex_XML实体注入漏洞.py)\n15. [致远OA_M1Server_userTokenService远程命令执行漏洞](/2023HW/2023.8.15/致远OA_M1Server_userTokenService远程命令执行漏洞.py)\n16. [金蝶OA云星空CommonFileServer任意文件读取漏洞](/2023HW/2023.8.15/金蝶OA云星空CommonFileServer任意文件读取漏洞.py)\n17. [HiKVISION综合安防管理平台files任意文件上传漏洞](/2023HW/2023.8.9/HiKVISION综合安防管理平台files任意文件上传漏洞.py)\n18. [HiKVISION综合安防管理平台report任意文件上传漏洞](/2023HW/2023.8.9/HiKVISION综合安防管理平台report任意文件上传漏洞.py)\n19. [汉得SRM_tomcat.jsp登陆绕过漏洞](/2023HW/2023.8.9/汉得SRM_tomcat.jsp登陆绕过漏洞.py)\n20. [深信服应用交付管理系统login远程命令执行漏洞](/2023HW/2023.8.9/深信服应用交付管理系统login远程命令执行漏洞.py)\n21. [用友-NC-Cloud远程代码执行](/2023HW/2023.8.9/用友-NC-Cloud远程代码执行.py)\n22. [用友移动管理系统uploadApk.do任意文件上传漏洞](/2023HW/2023.8.9/用友移动管理系统uploadApk.do任意文件上传漏洞.py)\n23. [网神SecGate3600防火墙obj_app_upfile任意文件上传漏洞](/2023HW/2023.8.9/网神SecGate3600防火墙obj_app_upfile任意文件上传漏洞.py)\n24. [辰信景云终端安全管理系统_login_SQL注入漏洞](/2023HW/2023.8.9/辰信景云终端安全管理系统_login_SQL注入漏洞.py)\n25. [LiveBOS_howImage.do任意文件读取漏洞](/2023HW/20238.16/LiveBOS_howImage.do任意文件读取漏洞.py)\n26. [亿赛通电子文档安全管理系统UploadFileFromClientServiceForClient任意文件上传漏洞](/2023HW/20238.16/亿赛通电子文档安全管理系统UploadFileFromClientServiceForClient任意文件上传漏洞.py)\n27. [深信服SG上网优化管理系统catjs.php任意文件读取漏洞](/2023HW/20238.16/深信服SG上网优化管理系统catjs.php任意文件读取漏洞.py)\n\n\n\n\n## Goby POC (仅适用于2.0之前的版本，2.0版本导入后会导致查询规则为空，导致poc匹配了所有资产，后面会新开一个仓库写2.0版本的poc)\n[Goby\u0026poc](Goby\u0026poc)\n\n# 使用需知\n由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，作者不为此承担任何责任。\n\nluck-ying 拥有对此库的修改和解释权，不得以任何方式将其用于商业目的。\n\nGoby \u0026 EXP 与 POC 仅仅只供对已授权的目标使用测试，对未授权目标的测试，本库不承担责任，均由本人自行承担\n\n![](wx.png)\n\n# 2022年6月15日开始 访问次数\n\n![Visitor Count](https://profile-counter.glitch.me/Library-POC/count.svg)\n\n## Stargazers over time\n\n[![Stargazers over time](https://starchart.cc/luck-ying/Library-POC.svg)](https://starchart.cc/luck-ying/Library-POC)\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fluck-ying%2FLibrary-POC","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fluck-ying%2FLibrary-POC","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fluck-ying%2FLibrary-POC/lists"}