Microsoft Edge Chakra Incorrect Scope Handling

Microsoft Edge: Chakra: Incorrect scope handling CVE-2018-0774 PoC: function funcarg = function printfunc; // SetHasOwnLocalInClosure should be called for the param scope in the PostVisitFunction function. printfunc; function func ; Chakra fails to distinguish whether the function is referenced i...

Microsoft Edge Chakra - AsmJSByteCodeGenerator::EmitCall Out-of-Bounds Read

Microsoft Edge Chakra - AsmJSByteCodeGenerator::EmitCall Out-of-Bounds Read / AsmJSByteCodeGenerator::EmitCall which is used to emit call insturctions doesn't check if an array identifier is used as callee. The method handles those invalid calls in the same way it handles valid calls such as...

Belkin N600DB Wireless Router - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: Belkin N600DB Wireless Router | Multiple Vulnerabilities Date: 16/01/2018 Exploit Author: Wadeek Hardware Version: F9K1102as v3 Firmware Version: 3.04.11 Vendor Homepage:...

Microsoft Edge Chakra JIT - Stack-to-Heap Copy

Microsoft Edge Chakra JIT - Stack-to-Heap Copy / If variables don't escape the scope, the variables can be allocated to the stack. However, there are some situations, such as when a bailout happens or accessing to arguments containing stack-allocated variables, where those variables should not...

MikroTik RouterOS < 6.38.5 RCE

!/usr/bin/env python2 Mikrotik Chimay Red Stack Clash Exploit by wsxarcher based on BigNerd95 POC tested on RouterOS 6.38.4 x86 ASLR enabled on libs only DEP enabled import socket, time, sys, struct from pwn import import ropgadget ASTSTACKSIZE = 0x20000 stack size per thread 128 KB SKIPSPACE =...

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes (2)

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes 2 / Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to issue 1310 . PoC: / // Enable the flag using '\n'.repeat0x1000 evalfunction f with function printf; ; ; +...

Microsoft Edge Chakra JIT - Out-of-Bounds Write

// Here's the PoC demonstrating OOB write. function optarr, start, end for let i = start; i end; i++ if i === 10 i += 0; // -- a arri = 2.3023e-320; function main let arr = new Array100; arr.fill1.1; for let i = 0; i 1000; i++ optarr, 0, 3; optarr, 0, 100000; main; / What happens here is as...

Yelp: ClickJacking on IMPORTANT Functions of Yelp

SUMMARY: Few Important function of yelp.com are vulnerable to ClickJacking Attack. DESCRIPTION: Please have an Introduction about the vulnerability Type: https://en.wikipedia.org/wiki/Clickjacking ClikcJacking is similar to CSRF with just an extra involvement of the victim to click somewhere on t...

Magento Connect T1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Document Title: =============== Magento Connect T1 - Claim Persistent Vulnerability Vulnerability Class: ==================== Cross Site Scripting - Persistent Current Estimated Price: ======================== 1.000a! - 2.000a! Product & Servi...

Denial of Service

Overview Affected versions of mqtt do not properly handle PUBLISH packets returning from the server, leading to a Denial of Service condition. The vulnerability is completely mitigated if the only connected servers are trusted, guaranteed not to be under the control of a malicious actor. Proof of...

Uber: ubernycmarketplace.com is vulnerable to the Heartbleed Bug

The Heartbleed Bug was a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. This allows attackers to eavesdrop on communications, stea...

Taxi Booking Script 1.0 Cross Site Scripting

Exploit Title: Taxi Booking Script v1.0 - Cross-site Scripting XSS Date: 11.01.2018 Vendor Homepage: https://www.phpjabbers.com/taxi-booking-script/ Software Link: Demo: http://demo.phpjabbers.com/1515648238792/index.php?controller=pjAdminUsers&action=pjActionIndex&err=AU01 Version: 1.0 Category:...

Microsoft Windows SMB Server (v1/v2) - Mount Point Arbitrary Device Open Privilege Escalation

Windows: SMB Server v1 and v2 Mount Point Arbitrary Device Open EoP Platform: Windows 10 1703 and 1709 seems the same on 7 and 8.1 but not extensively tested Class: Elevation of Privilege Summary: The SMB server driver srv.sys and srv2.sys don't check the destination of a NTFS mount point when...

Microsoft Windows SMB Server (v1v2) - Mount Point Arbitrary Device Open Privilege Escalation

Microsoft Windows SMB Server v1v2 - Mount Point Arbitrary Device Open Privilege Escalation Windows: SMB Server v1 and v2 Mount Point Arbitrary Device Open EoP Platform: Windows 10 1703 and 1709 seems the same on 7 and 8.1 but not extensively tested Class: Elevation of Privilege Summary: The SMB...

Microsoft Windows - NTFS OwnerMandatory Label Privilege Bypass

Microsoft Windows - NTFS OwnerMandatory Label Privilege Bypass / Windows: NTFS Owner/Mandatory Label Privilege Bypass EoP Platform: Windows 10 1709 not tested 8.1 Update 2 or Windows 7 Class: Elevation of Privilege Summary: When creating a new file on an NTFS drive it’s possible to circumvent...

Microsoft Windows SMB Server (v1 and v2) - Mount Point Arbitrary Device Open Privilege Escalation Ex

Exploit for windows platform in category dos / poc Windows: SMB Server v1 and v2 Mount Point Arbitrary Device Open EoP Platform: Windows 10 1703 and 1709 seems the same on 7 and 8.1 but not extensively tested Class: Elevation of Privilege Summary: The SMB server driver srv.sys and srv2.sys don't...

Yawcam 0.6.0 Directory Traversal Vulnerability

Exploit for windows platform in category remote exploits Directory traversal vulnerability in Yawcam webcam server ========================================================= Overview -------- Affected Versions: Yawcam 0.2.6 through 0.6.0 Patched Versions: Yawcam 0.6.1 Vendor: Yawcam Vendor URL:...

Microsoft Edge Chakra JIT asm.js Out-Of-Bounds Read

Microsoft Edge: Chakra: OOB read in asm.js CVE-2017-11911 Here's a snippet of AsmJSByteCodeGenerator::EmitAsmJsFunctionBody. AsmJsVar initSource = nullptr; if decl-sxVar.pnodeInit-nop == knopName AsmJsSymbol initSym = mCompiler-LookupIdentifierdecl-sxVar.pnodeInit-name, mFunction; if...

Microsoft Edge Chakra JIT - Lowerer::LowerSetConcatStrMultiItem Missing Integer Overflow Check

Exploit for windows platform in category dos / poc / The method "Lowerer::LowerSetConcatStrMultiItem" is used to generate machine code to concatenate strings. Here's a snippet of the method. void Lowerer::LowerSetConcatStrMultiItemIR::Instr instr ... IR::IndirOpnd dstLength =...

HPE iMC - dbman 'RestartDB' Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HPE iMC dbman RestartDB Unauthenticated RCE', 'Description' = %q This module exploits a remote command execution vulnerablity in Hewlett Packard...