bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
exploit-db-mirror/exploits/multiple/local/48231.md
Offensive Security 85cdf30cea DB: 2020-03-19 
7 changes to exploits/shellcodes

NetBackup 7.0 - 'NetBackup INET Daemon' Unquoted Service Path
Microsoft VSCode Python Extension - Code Execution
VMWare Fusion - Local Privilege Escalation

Microtik SSH Daemon 6.44.3 - Denial of Service (PoC)

Netlink GPON Router 1.0.11 - Remote Code Execution

Windows\x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes)
2020-03-19 05:01:49 +00:00

1 KiB
Raw Blame History

VSCode Python Extension Code Execution

This repository contains the Proof-of-Concept of a code execution vulnerability discovered in the Visual Studio Code Python extension.

TL;DR: VScode may use code from a virtualenv found in the project folders without asking the user, for things such as formatting, autocompletion, etc. This insecure design leads to arbitrary code execution by simply cloning and opening a malicious Python repository.

You can read more about this vulnerability on our blog: https://blog.doyensec.com/2020/03/16/vscode_codeexec.html.

HowTo

  • Clone the 'malicious' repository with git clone https://github.com/doyensec/VSCode_PoC_Oct2019.git
  • Add the cloned repo to a VSCode workspace on macOS. Note that the vulnerability affects all platforms, but the PoC is executing Calculator.app
  • Open test.py in VScode

Download ~ https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/48231.zip