PT-2017-18534

Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180 Description An issue was discovered that allows SSRF attacks. The problem arises from a regular expression, intended to match local https URLs, lacking an initial ^ character. This affects the...

CVE-2017-8794: Server-Side Request Forgery (SSRF)

An issue was discovered on Accellion FTA devices before FTA912180. Because a regular expression intended to match local https URLs lacks an initial ^ character, courier/web/1000@/wmProgressval.html allows SSRF attacks with a file:///etc/passwdhttps:// URL pattern...

Wordpress Membership Simplified v1.58 Plugin - Arbitrary File Download Exploit

Exploit for php platform in category web applications import requests import string import random from urlparse import urlparse print "---------------------------------------------------------------------" print "Wordpress Plugin Membership Simplified v1.58 - Arbitrary File Download\nDiscovery:...

Kodi 17.1 Local File Inclusion

Exploit Title: Kodi - Local File Inclusion Date: 12 February 2017 Exploit Author: Eric Flokstra Vendor Homepage: https://kodi.tv/ Software Link: https://kodi.tv/download/ Version: Kodi version 17.1 Krypton, Chorus version 2.4.2 Tested on: Linux CVE: CVE-2017-5982 Kodi formerly XBMC is a free and...

PT-2016-3473

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.9.1 Description An issue was discovered where the file /.vnc/sesman $username passwd is created when successfully logging in using RDP into an xrdp session. The content of this file is the equivalent of the user's...

Linux/x86 - /bin/bash -c Arbitrary Command Execution Shellcode (72 bytes)

/ ;author: Filippo "zinzloun" Bersani ;date: 16/12/2016 ;version: 1.0 ;X86 Assembly/NASM Syntax ;tested on: Linux OpenSuse001 2.6.34-12-desktop 32bit ; Linux ubuntu 3.13.0-100-generic 147precise1-Ubuntu 32bit ; Linux bb32 4.4.0-45-generic 32bit ;72 bytes ;description: executes arbitrary command...

Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)

// // This exploit uses the pokemon exploit of the dirtycow vulnerability // as a base and automatically generates a new passwd line. // The user will be prompted for the new password when the binary is run. // The original /etc/passwd file is then backed up to /tmp/passwd.bak // and overwrites t...

Linux Kernel Dirty COW PTRACE_POKEDATA Privilege Escalation

// // This exploit uses the pokemon exploit as a base and automatically // generates a new passwd line. The original /etc/passwd is then // backed up to /tmp/passwd.bak and overwritten with the new line. // The user will be prompted for the new password when the binary is run. // After running th...

Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)

// EDB-Note: Compile: g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil // EDB-Note: Recommended way to run: ./dcow -s Will automatically do "echo 0 /proc/sys/vm/dirtywritebackcentisecs" // // ----------------------------------------------------------------- // Copyright C 2016...

File Containment Vulnerability in Salient Smart DNS

RealEase Intelligent DNS Management System is a set of intelligent DNS, domain name management and wide-area load balancing solutions for Internet enterprises, medium and large websites and universities. A file inclusion vulnerability exists in the /index.php?-dautoprependfile%3d/etc/passwd/ and...

Unikrn: Urgent: Server side template injection via Smarty template allows for RCE

Hi All, I've found an issue which has allowed me to execute filegetcontents and extract your /etc/passwd file. Description It appears as though you are using smarty on the backend for templating. Entering a malicious payload as my firstname, lastname and nickname and then inviting a user to join...

Arbitrary File Containment Vulnerability in VoIP Operation Support System of Kunshi Network Technology Co.

The VoIP operation support system of Kunshi Network Technology Co., Ltd. is a support system for small and medium-sized VoIP operation business. The product suffers from an arbitrary file inclusion vulnerability, which can be exploited by an attacker to read sensitive files such as the service...

JVC IP-Camera VN-T216VPRU - Local File Disclosure

JVC IP-Camera VN-T216VPRU - Local File Disclosure 1. Advisory Information ======================================== Title : JVC IP-Camera VN-T216VPRU Local File Inclusion Vendor Homepage : http://pro.jvc.com/ Remotely Exploitable : Yes Tested on Camera types : VN-T216VPRU Product References :...

JVC IP-Camera VN-T216VPRU - Local File Disclosure

Advisory Information ======================================== Title : JVC IP-Camera VN-T216VPRU Local File Inclusion Vendor Homepage : http://pro.jvc.com/ Remotely Exploitable : Yes Tested on Camera types : VN-T216VPRU Product References :...

Arbitrary File Read Vulnerability in Video Conferencing System of Tangqiao Technology (Hangzhou) Co.

Tangqiao Technology Hangzhou Co., Ltd. is the world's leading provider of converged video communication cloud services, video conferencing system is a remote collaborative video software. The product has an arbitrary file reading vulnerability, which can be exploited by an attacker to read server...

Linux/x86-64 - /etc/passwd File Sender Shellcode (164 bytes)

/ Title : Linux x8664 /etc/passwd file sender shellcode Date : 28-06-2016 Author : Roziul Hasan Khan Shifat Tested On : Ubuntu 14.04 LTS x8664 / / Disassembly of section .text: 0000000000400080 : 400080: 48 31 c0 xor %rax,%rax 400083: b0 39 mov $0x39,%al 400085: 0f 05 syscall 400087: 99 cltd...

Linux x86_64 /etc/passwd File Sender Shellcode

Linux x8664 /etc/passwd File Sender Shellcode. Shellcode exploit for linx86-64 platform / Title : Linux x8664 /etc/passwd file sender shellcode Date : 28-06-2016 Author : Roziul Hasan Khan Shifat Tested On : Ubuntu 14.04 LTS x8664 / / Disassembly of section .text: 0000000000400080 : 400080: 48 31...

AirOS NanoStation M2 5.6-beta - Multiple Vulnerabilities

Exploit for cgi platform in category web applications AirOS NanoStation M2 v5.6-beta Arbitrary File Download & Remote Command Execution Tested on: XM.v5.6-beta5.24359.141008.1753 - Build: 2435 Linux Awesome 2.6.32.63 1 Wed Oct 8 17:54:30 EEST 2014 mips unknown Date: May 30, 2016 Informer: Pablo...

Ubiquiti airOS Arbitrary File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ubiquiti airOS Arbitrary File Upload', 'Description' = %q This module exploits a pre-auth file upload to install a new root user to /etc/passwd an...

Linux/x86-64 - Read /etc/passwd Shellcode (65 bytes)

/ --------------------------------------------------------------------------------------------------- Linux/x8664 - Read /etc/passwd - 65 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa Sad-Gamaya | Tamaso Maa Jyotir-Gamaya | Mrtyor-Maa Amrtam Gamaya | Om Shaantih...