[GitHub] cve-scanner

Rce

Type

N/A

CVSS Score

Views

Anonymous

Author

Description

# RCE CVE (≧9.0) scanner

# cve-scanner

Fingerprint-driven blind testing CVE scanner: first identify Web / service fingerprints, only run CVE/vulnerability exp mapped to hit components, fall back to full blind testing when unable to identify application fingerprints. Automatically detect targets and verify real command execution (RCE).
**All target environments use real Docker images, no mocks.**

---

## Fingerprint-driven workflow

```
target ──► fingerprint.Detect()
│
├─ Hit application fingerprint (WebLogic/Tomcat/Struts2/Spring/Shiro/ActiveMQ/...)
│ └─► Only execute CVE exp mapped to that component (+ generic information disclosure detection)
│
├─ Only hit weak Web service fingerprint (nginx/Apache/PHP/Node.js)
│ └─► Treat as unidentified, execute full exp blind testing
│
└─ No fingerprint hit
└─► Full exp blind testing
```

### Secondary fingerprint expansion during collection

All exp requests go through the same collector (`internal/capture`):

1. First-round `fingerprint.Detect()` (`bb` as `QuickDetect`) obtains baseline fingerprint;
2. Each exp / probe response undergoes re-fingerprinting (`fingerprint.ObserveResponse`);
3. When new components appear beyond baseline (e.g., WebLogic / Struts2 / Shiro / Tomcat exposed in subsequent exp responses but not detected on first access), immediately merge into fingerprint and continue executing exp mapped to that component; executed probes are deduplicated by `ran` set;
4. Both `bb` and `scan` follow this workflow; `scan` collection results are simultaneously the payload source for smuggling replay.

### Smuggling replay after zero success (second pass)

When `bb` completes normal scanning with **0 findings**, and `scan` globally has **0 PASS (no real command echo)**, automatically enter second pass:

1. Collector has already recorded every exp request (method / path / headers / body) actually sent this round and direct responses;
2. For each target, first confirm CL.TE / TE.CL channel using limited TE obfuscation combinations;
3. Replay all collected payloads through the channel one by one (deduplicate by request, no longer limit count);
4. Smuggling response shows RCE features absent in direct response → `CRITICAL`; only confirm channel and successful delivery → `HIGH`;
5. Smuggling responses likewise undergo fingerprinting: if new components are exposed, supplement with exp mapped to that component.

Support http/https; auto-skip if no payload for replay (e.g., only ran GET probes). `scan` mode already integrated with same collector, smuggling replay results written to result file with `CVE=SMUGGLING-REPLAY`.

Built-in fingerprint library references matching methods from webanalyze / Wappalyzer (response headers, Server, Set-Cookie, title, body features + deep detection of WebLogic Console / Tomcat Manager / Actuator / Nacos / Metabase / GeoServer / OFBiz / Solr), pure standard library implementation, no third-party dependencies. Component → CVE mapping see [internal/fingerprint/cve_map.go](internal/fingerprint/cve_map.go).

View fingerprints separately:

```bash
./cve-scanner fp -t http://127.0.0.1:7001
./cve-scanner fp -t http://127.0.0.1:8161 -json
```

---

## Supported vulnerabilities

| CVE | Component | Protocol | CVSS | Affected versions | Port | id | whoami | hostname | pwd |
|-----|-----------|----------|------|------------------|------|-----|--------|----------|-----|
| [CVE-2026-70748](docs/CVE-2026-70748.md) | Oracle WebLogic Server | T3/IIOP | 9.8 | 12.2.1.4, 14.1.1.0 | 7

Translated to English from Chinese. Show original · see the source links.

Original (Chinese):

RCE CVE（≧9.0） scanner

# cve-scanner

指纹驱动的盲测 CVE 扫描器：先识别 Web / 服务指纹，命中组件只跑该组件映射的 CVE/漏洞 exp，
识别不到应用指纹时回退全量盲测。自动检测目标并验证真实命令执行（RCE）。
**全部靶场使用真实 Docker 镜像，无 mock。**

---

## 指纹驱动流程

```
target ──► fingerprint.Detect()
│
├─ 命中应用指纹（WebLogic/Tomcat/Struts2/Spring/Shiro/ActiveMQ/...）
│ └─► 只执行该组件映射的 CVE exp（+ 通用泄露探测）
│
├─ 仅命中 Web 服务弱指纹（nginx/Apache/PHP/Node.js）
│ └─► 视为未识别，执行全量 exp 盲测
│
└─ 未命中任何指纹
└─► 全量 exp 盲测
```

### 采集中途的指纹二次扩展

所有 exp 请求都经过同一个采集器（`internal/capture`）：

1. 首轮 `fingerprint.Detect()`（`bb` 为 `QuickDetect`）得到 baseline 指纹；
2. 每条 exp / 探测响应都会被重新做一次指纹匹配（`fingerprint.ObserveResponse`）；
3. 出现 baseline 之外的新组件（例如首次访问没识别到、但后续 exp 响应暴露的
WebLogic / Struts2 / Shiro / Tomcat 等），立即合并进指纹并继续执行该组件映射的
exp；已执行过的探测由 `ran` 集合去重；
4. `bb` 与 `scan` 都走这套流程；`scan` 的采集结果同时是走私回放的 payload 来源。

### 零成功后的走私回放（第二遍）

`bb` 正常扫描完且 **0 findings**、`scan` 全局 **0 个 PASS（无真实命令回显）** 时，自动进入第二遍：

1. 采集器已记录本轮实际发送的每个 exp 请求（method / path / headers / body）及直连响应；
2. 对每个目标先用限定的 TE 混淆组合确认 CL.TE / TE.CL 通道；
3. 把采集到的 payload **全部**经通道逐条重放一次（按请求去重，不再限制条数）；
4. 走私响应出现直连响应中没有的 RCE 特征 → `CRITICAL`；仅确认通道并成功投递 → `HIGH`；
5. 走私响应同样会被指纹识别：若暴露了新组件，再补跑该组件映射的 exp。

支持 http/https；无 payload 可回放（如只跑了 GET 探测）则自动跳过。`scan` 模式已接入
同一采集器，走私回放结果以 `CVE=SMUGGLING-REPLAY` 写入结果文件。

内置指纹库参考 webanalyze / Wappalyzer 的匹配方式（响应头、Server、Set-Cookie、title、
body 特征 + WebLogic Console / Tomcat Manager / Actuator / Nacos / Metabase / GeoServer /
OFBiz / Solr 深度探测），纯标准库实现，无第三方依赖。组件 → CVE 映射见
[internal/fingerprint/cve_map.go](internal/fingerprint/cve_map.go)。

单独查看指纹：

```bash
./cve-scanner fp -t http://127.0.0.1:7001
./cve-scanner fp -t http://127.0.0.1:8161 -json
```

---

## 支持漏洞

| CVE | 组件 | 协议 | CVSS | 受影响版本 | 端口 | id | whoami | hostname | pwd |
|-----|------|------|------|-----------|------|-----|--------|----------|-----|
| [CVE-2026-70748](docs/CVE-2026-70748.md) | Oracle WebLogic Server | T3/IIOP | 9.8 | 12.2.1.4, 14.1.1.0 | 7

References

https://github.com/hktalent/cve-scanner

[GitHub] cve-scanner

Description

References

Community Rating

Quick Actions

Related Exploits