{"uuid": "1d82672c-9ddc-4d86-b856-30ad3d87f9c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14882", "type": "seen", "source": "https://t.me/hacking_Attack/55269", "content": "Kali Linux Tutorials\nMelody : A Transparent Internet Sensor Built For Threat Intelligence\n\nMelody is a transparent internet sensor built for threat intelligence and supported by a detection rule framework which allows you to tag packets of interest for further analysis and threat monitoring. FeaturesHere are some key features of Melody :\n\n* Transparent capture\n* Write detection rules and tag specific packets to analyze them at scale\n* Mock vulnerable websites using the builtin HTTP/S server\n* Supports the main internet protocols over IPv4 and IPv6\n* Handles log rotation for you : Melody is designed to run forever on the smallest VPS\n* Minimal configuration required\n* Standalone mode : configure Melody using only the CLI\n* Easily scalable :\n* Statically compiled binary\n* Up-to-date Docker image WishlistSince I have to focus on other projects right now, I can\u2019t put much time in Melody\u2019s development.\n\nThere is a lot of rom for improvement though, so here are some features that I\u2019d like to implement someday :\n\n* Dedicated helper program to create, test and manage rules\u00a0-> Check Meloctl in cmd/meloctl* Centralized rules management\n* Per port mock application Use casesInternet facing sensor* Extract trends and patterns from Internet\u2019s noise\n* Index malicious activity, exploitation attempts and targeted scanners\n* Monitor emerging threats exploitation\n* Keep an eye on specific threats Stream analysis* Build a background noise profile to make targeted attacks stand out\n* Replay captures to tag malicious packets in a suspicious stream QuickstartTL;DRReleaseGet the latest release at https://github.com/bonjourmalware/melody/releases.\n\nmake install # Set default outfacing interface\nmake cap # Set network capabilities to start Melody without elevated privileges\nmake certs # Make self signed certs for the HTTPS fileserver\nmake enable_all_rules # Enable the default rules\nmake service # Create a systemd service to restart the program automatically and launch it at startup\nsudo systemctl stop melody # Stop the service while we\u2019re configuring it\n\nUpdate the filter.bpffile to filter out unwanted packets\n\nsudo systemctl start melody # Start Melody\nsudo systemctl status melody # Check that Melody is running\n\nThe logs should start to pile up in /opt/melody/logs/melody.ndjson.\n\ntail -f /opt/melody/logs/melody.ndjson # | jq\n\nFrom source\n\ngit clone https://github.com/bonjourmalware/melody /opt/melody\ncd /opt/melody\nmake build\n\nThen continue with the steps from the\u00a0release\u00a0TL;DR. Dockermake certs # Make self signed certs for the HTTPS fileserver\nmake enable_all_rules # Enable the default rules\nmkdir -p /opt/melody/logs\ncd /opt/melody/\ndocker pull bonjourmalware/melody:latest\nMELODY_CLI=\u201d\u201d # Put your CLI options here. Example : export MELODY_CLI=\u201d-s -i \u2018lo\u2019 -F \u2018dst port 5555\u2019 -o \u2018server.http.port: 5555\u2032\u201d\ndocker run \\\n\u2013net=host \\\n-e \u201cMELODY_CLI=$MELODY_CLI\u201d \\\n\u2013mount type=bind,source=\u201d$(pwd)/filter.bpf\u201d,target=/app/filter.bpf,readonly \\\n\u2013mount type=bind,source=\u201d$(pwd)/config.yml\u201d,target=/app/config.yml,readonly \\\n\u2013mount type=bind,source=\u201d$(pwd)/var\u201d,target=/app/var,readonly \\\n\u2013mount type=bind,source=\u201d$(pwd)/rules\u201d,target=/app/rules,readonly \\\n\u2013mount type=bind,source=\u201d$(pwd)/logs\u201d,target=/app/logs/ \\\nbonjourmalware/melody RulesExampleCVE-2020-14882 Oracle Weblogic Server RCE:\nlayer: http\nmeta:\nid: 3e1d86d8-fba6-4e15-8c74-941c3375fd3e\nversion: 1.0\nauthor: BonjourMalware\nstatus: stable\ncreated: 2020/11/07\nmodified: 2020/20/07\ndescription: \u201cChecking or trying to exploit CVE-2020-14882\u201d\nreferences:\n\u2013 \u201chttps://nvd.nist.gov/vuln/detail/CVE-2020-14882\u201d\nmatch:\nhttp.uri:\nstartswith|any|nocase:\n\u2013 \u201c/console/css/\u201d\n\u2013 \u201c/console/images\u201d\ncontains|any|nocase:\n\u2013 \u201cconsole.portal\u201d\n\u2013 \u201cconsolejndi.portal?test_handle=\u201d\ntags:\ncve: \u201ccve-2020-14882\u201d\nvendor: \u201coracl[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:48.184600Z"}