[GitHub] cve-scanner

Rce

Type

N/A

CVSS Score

Views

Anonymous

Author

Description

# RCE CVE (≧9.0) scanner

## cve-scanner

Fingerprint-driven blind testing CVE scanner: first identify Web/service fingerprints, hit components only run CVE/vulnerability exp mapped to that component, fall back to full blind testing when unable to identify application fingerprints. Automatically detects targets and verifies real command execution (RCE).
**All targets use real Docker images, no mocks.**

---

## Fingerprint-Driven Process

```
target ──► fingerprint.Detect()
│
├─ Hit application fingerprint (WebLogic/Tomcat/Struts2/Spring/Shiro/ActiveMQ/...)
│ └─► Only execute CVE exp mapped to that component (+ generic information disclosure detection)
│
├─ Hit only weak Web service fingerprint (nginx/Apache/PHP/Node.js)
│ └─► Treated as unidentified, execute full exp blind testing
│
└─ No fingerprint matched
└─► Full exp blind testing
```

### Secondary Fingerprint Extension During Collection

All exp requests go through the same collector (`internal/capture`):

1. First round `fingerprint.Detect()` (`bb` is `QuickDetect`) gets baseline fingerprint;
2. Each exp/detection response is re-fingerprinted (`fingerprint.ObserveResponse`);
3. When new components appear outside baseline (e.g., WebLogic/Struts2/Shiro/Tomcat exposed in subsequent exp responses but not detected on first access), immediately merge into fingerprint and continue executing exp mapped to that component; executed detections are deduplicated by `ran` set;
4. Both `bb` and `scan` follow this process; `scan` collection results are also the payload source for smuggling replay.

### Smuggling Replay After Zero Success (Second Pass)

When `bb` completes normal scanning with **0 findings** and `scan` globally has **0 PASS (no real command echo)**, automatically enter second pass:

1. Collector has recorded each exp request actually sent this round (method/path/headers/body) and direct response;
2. For each target, first confirm CL.TE/TE.CL channel with limited TE obfuscation combinations;
3. Replay all collected payloads once through channel by request (deduplicated, no longer limited by count);
4. Smuggling response shows RCE features not in direct response → `CRITICAL`; only confirms channel and successful delivery → `HIGH`;
5. Smuggling response also goes through fingerprint identification: if new component exposed, rerun exp mapped to that component.

Supports http/https; automatically skips if no payloads for replay (e.g., only ran GET detection). `scan` mode integrated with same collector, smuggling replay results written to result file as `CVE=SMUGGLING-REPLAY`.

Built-in fingerprint library references webanalyze/Wappalyzer matching methods (response headers, Server, Set-Cookie, title, body features + WebLogic Console/Tomcat Manager/Actuator/Nacos/Metabase/GeoServer/OFBiz/Solr deep detection), pure standard library implementation, no third-party dependencies. Component → CVE mapping see [internal/fingerprint/cve_map.go](internal/fingerprint/cve_map.go).

View fingerprints separately:

```bash
./cve-scanner fp -t http://127.0.0.1:7001
./cve-scanner fp -t http://127.0.0.1:8161 -json
```

---

## Supported Vulnerabilities

| CVE | Component | Protocol | CVSS | Affected Versions | Port | id | whoami | hostname | pwd |
|-----|-----------|----------|------|-------------------|------|-----|--------|----------|-----|
| [CVE-2026-70748](docs/CVE-2026-70748.md) | Oracle WebLogic Server | T3/IIOP | 9.8 | 12.2.1.4, 14.1.1.0 | 7

Translated to English from Chinese. Show original · see the source links.

Original (Chinese):

RCE CVE（≧9.0） scanner

# cve-scanner

指纹驱动的盲测 CVE 扫描器：先识别 Web / 服务指纹，命中组件只跑该组件映射的 CVE/漏洞 exp，
识别不到应用指纹时回退全量盲测。自动检测目标并验证真实命令执行（RCE）。
**全部靶场使用真实 Docker 镜像，无 mock。**

---

## 指纹驱动流程

```
target ──► fingerprint.Detect()
│
├─ 命中应用指纹（WebLogic/Tomcat/Struts2/Spring/Shiro/ActiveMQ/...）
│ └─► 只执行该组件映射的 CVE exp（+ 通用泄露探测）
│
├─ 仅命中 Web 服务弱指纹（nginx/Apache/PHP/Node.js）
│ └─► 视为未识别，执行全量 exp 盲测
│
└─ 未命中任何指纹
└─► 全量 exp 盲测
```

### 采集中途的指纹二次扩展

所有 exp 请求都经过同一个采集器（`internal/capture`）：

1. 首轮 `fingerprint.Detect()`（`bb` 为 `QuickDetect`）得到 baseline 指纹；
2. 每条 exp / 探测响应都会被重新做一次指纹匹配（`fingerprint.ObserveResponse`）；
3. 出现 baseline 之外的新组件（例如首次访问没识别到、但后续 exp 响应暴露的
WebLogic / Struts2 / Shiro / Tomcat 等），立即合并进指纹并继续执行该组件映射的
exp；已执行过的探测由 `ran` 集合去重；
4. `bb` 与 `scan` 都走这套流程；`scan` 的采集结果同时是走私回放的 payload 来源。

### 零成功后的走私回放（第二遍）

`bb` 正常扫描完且 **0 findings**、`scan` 全局 **0 个 PASS（无真实命令回显）** 时，自动进入第二遍：

1. 采集器已记录本轮实际发送的每个 exp 请求（method / path / headers / body）及直连响应；
2. 对每个目标先用限定的 TE 混淆组合确认 CL.TE / TE.CL 通道；
3. 把采集到的 payload **全部**经通道逐条重放一次（按请求去重，不再限制条数）；
4. 走私响应出现直连响应中没有的 RCE 特征 → `CRITICAL`；仅确认通道并成功投递 → `HIGH`；
5. 走私响应同样会被指纹识别：若暴露了新组件，再补跑该组件映射的 exp。

支持 http/https；无 payload 可回放（如只跑了 GET 探测）则自动跳过。`scan` 模式已接入
同一采集器，走私回放结果以 `CVE=SMUGGLING-REPLAY` 写入结果文件。

内置指纹库参考 webanalyze / Wappalyzer 的匹配方式（响应头、Server、Set-Cookie、title、
body 特征 + WebLogic Console / Tomcat Manager / Actuator / Nacos / Metabase / GeoServer /
OFBiz / Solr 深度探测），纯标准库实现，无第三方依赖。组件 → CVE 映射见
[internal/fingerprint/cve_map.go](internal/fingerprint/cve_map.go)。

单独查看指纹：

```bash
./cve-scanner fp -t http://127.0.0.1:7001
./cve-scanner fp -t http://127.0.0.1:8161 -json
```

---

## 支持漏洞

| CVE | 组件 | 协议 | CVSS | 受影响版本 | 端口 | id | whoami | hostname | pwd |
|-----|------|------|------|-----------|------|-----|--------|----------|-----|
| [CVE-2026-70748](docs/CVE-2026-70748.md) | Oracle WebLogic Server | T3/IIOP | 9.8 | 12.2.1.4, 14.1.1.0 | 7

References

https://github.com/hktalent/cve-scanner

[GitHub] cve-scanner

Description

References

Community Rating

Quick Actions

Related Exploits