deardaniel/secdata-raw huggingface dataset:
Metasploit Module: MS15-001 Microsoft Windows NtApphelpCacheControl Improper Authorization Check
Type: exploit
Path: modules/exploits/windows/local/ntapphelpcachecontrol.rb
Platform: win
Disclosure date: 2014-09-30
References: MSB-MS15-001, CVE-2015-0002, OSVDB-116497, EDB-35661, URL-https://code.google.com/p/google-security-research/issues/detail?id=118

Description:
On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys)
            allows application compatibility data to be cached for quick reuse when new processes are
            created. A normal user can query the cache but cannot add new cached entries as the
            operation is restricted to administrators. This is checked in the function
            AhcVerifyAdminContext.

            This function has a vulnerability where it doesn't correctly check the impersonation token
            of the caller to determine if the user is an administrator. It reads the caller's
            impersonation token using PsReferenceImpersonationToken and then does a comparison between
            the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level
            of the token so it's possible to get an identify token on your thread from a local system
            process and bypass this check.

            This module currently only affects Windows 8 and Windows 8.1, and requires access to
            C:\Windows\System\ComputerDefaults.exe (although this can be improved).

Check method (fingerprinting):
version = get_version_info
    if version.build_number.between?(Msf::WindowsVersion::Win8, Msf::WindowsVersion::Win81)
      return Exploit::CheckCode::Detected("Version #{version} detected but not confirmed vulnerable")
    end

    Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Ancillary Function Driver (AFD) for WinSock Elevation of Privilege
Type: exploit
Path: modules/exploits/windows/local/cve_2023_21768_afd_lpe.rb
Platform: win
Disclosure date: 2023-01-10
References: CVE-2023-21768, URL-https://github.com/xforcered/Windows_LPE_AFD_CVE-2023-21768, URL-https://github.com/yardenshafir/IoRingReadWritePrimitive
Targets: Windows 11 22H2 x64

Description:
A vulnerability exists in the Windows Ancillary Function Driver for Winsock
            (`afd.sys`) can be leveraged by an attacker to escalate privileges to those of
            NT AUTHORITY\SYSTEM. Due to a flaw in `AfdNotifyRemoveIoCompletion`, it is
            possible to create an arbitrary kernel Write-Where primitive, which can be used
            to manipulate internal I/O ring structures and achieve local privilege
            escalation.

            This exploit only supports Windows 11 22H2 up to build 22621.963 (patched in
            January 2023 updates).

Check method (fingerprinting):
unless session.platform == 'windows'
      return Exploit::CheckCode::Safe('Only Windows systems are affected')
    end

    major, minor, build, revision, _branch = file_version('C:\\Windows\\System32\\ntoskrnl.exe')
    vprint_status("Windows Build Number = #{build}.#{revision}")

    unless major == 6 && minor == 2 && build == 22621
      return CheckCode::Safe('The exploit only supports Windows 11 22H2')
    end

    if revision > 963
      return CheckCode::Safe("This Windows host seems to be patched (build 22621.#{revision})")
    end

    CheckCode::Appears("Revision #{revision} appears vulnerable")
  end
Metasploit Module: Windows SYSTEM Escalation via KiTrap0D
Type: exploit
Path: modules/exploits/windows/local/ms10_015_kitrap0d.rb
Platform: win
Disclosure date: 2010-01-19
References: CVE-2010-0232, OSVDB-61854, MSB-MS10-015, EDB-11199, URL-https://seclists.org/fulldisclosure/2010/Jan/341
Targets: Windows 2K SP4 - Windows 7 (x86)

Description:
This module will create a new session with SYSTEM privileges via the
          KiTrap0D exploit by Tavis Ormandy. If the session in use is already
          elevated then the exploit will not run. The module relies on kitrap0d.x86.dll,
          and is not supported on x64 editions of Windows.

Check method (fingerprinting):
# Validate platform architecture
    if sysinfo['Architecture'] == ARCH_X64
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    # Validate OS version
    version = get_version_info
    unless version.build_number.between?(Msf::WindowsVersion::Win2000, Msf::WindowsVersion::Win7_SP1)
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end

    return Exploit::CheckCode::Detected("Version #{version} detected but not confirmed vulnerable")
  end
Metasploit Module: Windows Escalate UAC Protection Bypass (Via Shell Open Registry Key)
Type: exploit
Path: modules/exploits/windows/local/bypassuac_sdclt.rb
Platform: win
Disclosure date: 2017-03-17
References: URL-https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/, URL-https://github.com/enigma0x3/Misc-PowerShell-Stuff/blob/master/Invoke-SDCLTBypass.ps1, URL-https://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass
Targets: Windows x64

Description:
This module will bypass Windows UAC by hijacking a special key in the Registry under
          the current user hive, and inserting a custom command that will get invoked when
          Window backup and restore is launched. It will spawn a second shell that has the UAC
          flag turned off.

          This module modifies a registry key, but cleans up the key once the payload has
          been invoked.

Check method (fingerprinting):
version = get_version_info
    if version.build_number >= Msf::WindowsVersion::Vista_SP0 && is_uac_enabled?
      Exploit::CheckCode::Appears("Version #{version} appears vulnerable")
    else
      Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end
Metasploit Module: WebEx Local Service Permissions Exploit
Type: exploit
Path: modules/exploits/windows/local/webexec.rb
Disclosure date: 2018-10-09
References: URL-https://webexec.org, CVE-2018-15442
Targets: Windows x86, Windows x64

Description:
This module exploits a flaw in the 'webexservice' Windows service, which runs as SYSTEM,
          can be used to run arbitrary commands locally, and can be started by limited users in
          default installations.

Check method (fingerprinting):
unless service_exists?(@service_name)
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    srv_info = service_info(@service_name)

    vprint_status(srv_info.to_s)

    case START_TYPE[srv_info[:starttype]]
    when 'Disabled'
      vprint_error("Service startup is Disabled, so will be unable to exploit unless account has correct permissions...")
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    when 'Manual'
      vprint_error("Service startup is Manual, so will be unable to exploit unless account has correct permissions...")
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    when 'Auto'
      vprint_good("Service is set to Automatically start...")
    end

    if check_search_path
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    return Exploit::CheckCode::Appears('Target appears vulnerable')
  end
Metasploit Module: Microsoft Spooler Local Privilege Elevation Vulnerability
Type: exploit
Path: modules/exploits/windows/local/cve_2020_1048_printerdemon.rb
Platform: win
Disclosure date: 2019-11-04
References: CVE-2020-1048, URL-https://windows-internals.com/printdemon-cve-2020-1048/
Targets: Automatic

Description:
This exploit leverages a file write vulnerability in the print spooler service
          which will restart if stopped.  Because the service cannot be stopped long
          enough to remove the dll, there is no way to remove the dll once
          it is loaded by the service.  Essentially, on default settings, this module
          adds a permanent elevated backdoor.

Check method (fingerprinting):
version = get_version_info

    vprint_status("OS version: #{version}")
    return Exploit::CheckCode::Appears("Version #{version} appears vulnerable") if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1909)

    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/ppr_flatten_rec.rb
Platform: win
Disclosure date: 2013-05-15
References: CVE-2013-3660, EDB-25912, OSVDB-93539, MSB-MS13-053, URL-https://seclists.org/fulldisclosure/2013/May/91

Description:
This module exploits a vulnerability on EPATHOBJ::pprFlattenRec due to the usage
            of uninitialized data which allows to corrupt memory. At the moment, the module has
            been tested successfully on Windows XP SP3, Windows 2003 SP1, and Windows 7 SP1.

Check method (fingerprinting):
if session.platform == 'windows'
      file_path = session.sys.config.getenv('windir') << '\\system32\\win32k.sys'
      major, minor, build, revision, branch = file_version(file_path)
      vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision}")

      # WinXP x86 - 5.1.2600.6404
      # WinXP/2003 5.2.3790.5174
      # WinVista/2k8 - 6.0.6002.18861 / 6.0.6002.23132
      # Win72k8R2 -  6.1.7601.18176 / 6.1.7601.22348
      # Win8/2012 - 6.2.9200.16627 / 6.2.9200.20732
      case build
      when 2600
        return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable") if revision < 6404
      when 3790
        return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable") if revision < 5174
      when 6000
        return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable")
      when 6001
        return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable")
      when 6002
        if branch == 18
          return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable") if revision < 18861
        elsif revision < 23132
          return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable")
        end
      when 7600
        return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable")
      when 7601
        if branch == 18
          return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable") if revision < 18176
Metasploit Module: PsExec via Current User Token
Type: exploit
Path: modules/exploits/windows/local/current_user_psexec.rb
Disclosure date: 1999-01-01
References: CVE-1999-0504, OSVDB-3106, URL-http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

Description:
This module uploads an executable file to the victim system, creates
          a share containing that executable, creates a remote service on each
          target system using a UNC path to that file, and finally starts the
          service(s).

          The result is similar to psexec but with the added benefit of using
          the session's current authentication token instead of having to know
          a password or hash.
Metasploit Module: Windows Escalate UAC Protection Bypass (Via Eventvwr Registry Key)
Type: exploit
Path: modules/exploits/windows/local/bypassuac_eventvwr.rb
Platform: win
Disclosure date: 2016-08-15
References: URL-https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/, URL-https://github.com/enigma0x3/Misc-PowerShell-Stuff/blob/master/Invoke-EventVwrBypass.ps1
Targets: Windows x86, Windows x64

Description:
This module will bypass Windows UAC by hijacking a special key in the Registry under
          the current user hive, and inserting a custom command that will get invoked when
          the Windows Event Viewer is launched. It will spawn a second shell that has the UAC
          flag turned off.

          This module modifies a registry key, but cleans up the key once the payload has
          been invoked.

          The module does not require the architecture of the payload to match the OS. If
          specifying EXE::Custom your DLL should call ExitProcess() after starting your
          payload in a separate process.

Check method (fingerprinting):
version = get_version_info
    if version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win10_1607)
      Exploit::CheckCode::Appears("Version #{version} appears vulnerable")
    else
      Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end
Metasploit Module: AppLocker Execution Prevention Bypass
Type: exploit
Path: modules/exploits/windows/local/applocker_bypass.rb
Disclosure date: 2015-08-03
References: URL-https://gist.github.com/subTee/fac6af078937dda81e57

Description:
This module will generate a .NET service executable on the target and utilize
          InstallUtil to run the payload bypassing the AppLocker protection.

          Currently only the InstallUtil method is provided, but future methods can be
          added easily.
Metasploit Module: MS14-009 .NET Deployment Service IE Sandbox Escape
Type: exploit
Path: modules/exploits/windows/local/ms14_009_ie_dfsvc.rb
Disclosure date: 2014-02-11
References: CVE-2014-0257, MSB-MS14-009, BID-65417, URL-https://github.com/tyranid/IE11SandboxEscapes

Description:
This module abuses a process creation policy in Internet Explorer's sandbox, specifically
          in the .NET Deployment Service (dfsvc.exe), which allows the attacker to escape the
          Enhanced Protected Mode, and execute code with Medium Integrity.

Check method (fingerprinting):
unless file_exist?("#{get_env("windir")}\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe")
      return Exploit::CheckCode::Unknown('Unable to determine target state')
    end

    net_version = get_net_version

    if net_version.empty?
      return Exploit::CheckCode::Unknown('Unable to determine target state')
    end

    unless file_exist?("#{get_env("windir")}\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll")
      return Exploit::CheckCode::Detected('mscorlib.dll not found, unable to verify patch status')
    end

    mscorlib_version = get_mscorlib_version

    if Rex::Version.new(mscorlib_version) >= Rex::Version.new(NET_VERSIONS[net_version]["mscorlib"])
      return Exploit::CheckCode::Safe("Mscorlib version #{mscorlib_version} is not vulnerable")
    end

    Exploit::CheckCode::Appears("Mscorlib version #{mscorlib_version} appears vulnerable")
  end
Metasploit Module: Windows Unquoted Service Path Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/unquoted_service_path.rb
Disclosure date: 2001-10-25
References: URL-http://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx, URL-http://www.microsoft.com/learning/en/us/book.aspx?id=5957&locale=en-us, URL-https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae

Description:
This module exploits a logic flaw due to how the lpApplicationName parameter
          is handled.  When the lpApplicationName contains a space, the file name is
          ambiguous.  Take this file path as example: C:\program files\hello.exe;
          The Windows API will try to interpret this as two possible paths:
          C:\program.exe, and C:\program files\hello.exe, and then execute all of them.
          To some software developers, this is an unexpected behavior, which becomes a
          security problem if an attacker is able to place a malicious executable in one
          of these unexpected paths, sometimes escalate privileges if run as SYSTEM.
          Some software such as OpenVPN 2.1.1, OpenSSH Server 5, and others have the
          same problem.

          The offensive technique is also described in Writing Secure Code (2nd Edition),
          Chapter 23, in the section "Calling Processes Security" on page 676.

          This technique was previously called Trusted Service Path, but is more commonly
          known as Unquoted Service Path.

          The service exploited won't start until the payload written to disk is removed.

Check method (fingerprinting):
services = enum_vuln_services.map { |srv| srv['name'] }
    if services.empty?
      return CheckCode::Safe('Target is not vulnerable')
    end

    CheckCode::Vulnerable("Vulnerable services: #{services.join(', ')}")
  end

  ###
  # This function uses a loop to go from the longest potential path (most likely with write access), to shortest.
  # >> fpath = 'C:\\Program Files\\A Subfolder\\B Subfolder\\C Subfolder\\SomeExecutable.exe'
  # >> fpath = fpath.split(' ')[0...-1]
  # >> fpath.reverse.each { |x| puts fpath[0..fpath.index(x)].join(' ')}
  # C:\Program Files\A Subfolder\B Subfolder\C
  # C:\Program Files\A Subfolder\B
  # C:\Program Files\A
  # C:\Program
  ###
Metasploit Module: Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)
Type: exploit
Path: modules/exploits/windows/local/ms13_053_schlamperei.rb
Platform: win
Disclosure date: 2013-12-01
References: CVE-2013-1300, MSB-MS13-053, URL-https://labs.mwrinfosecurity.com/blog/2013/09/06/mwr-labs-pwn2own-2013-write-up---kernel-exploit/

Description:
This module leverages a kernel pool overflow in Win32k which allows local privilege escalation.
            The kernel shellcode nulls the ACL for the winlogon.exe process (a SYSTEM process).
            This allows any unprivileged process to freely migrate to winlogon.exe, achieving
            privilege escalation. This exploit was used in pwn2own 2013 by MWR to break out of chrome's sandbox.
            NOTE: when a meterpreter session started by this exploit exits, winlogin.exe is likely to crash.

Check method (fingerprinting):
unless session.platform == 'windows'
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    file_path = expand_path('%windir%') << '\\system32\\win32k.sys'
    major, minor, build, revision, branch = file_version(file_path)
    vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")

    case build
    when 7600
      return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable")
    when 7601
      if branch == 18
        return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable") if revision < 18176
      elsif revision < 22348
        return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable")
      end
    end
    return Exploit::CheckCode::Safe("Revision #{revision} is not vulnerable")
  end
Metasploit Module: Druva inSync inSyncCPHwnet64.exe RPC Type 5 Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/druva_insync_insynccphwnet64_rcp_type_5_priv_esc.rb
Disclosure date: 2020-02-25
References: CVE-2019-3999, CVE-2020-5752, EDB-48400, EDB-48505, EDB-49211, URL-https://www.tenable.com/security/research/tra-2020-12, URL-https://www.tenable.com/security/research/tra-2020-34, URL-https://github.com/tenable/poc/blob/master/druva/inSync/druva_win_cphwnet64.py, URL-https://www.matteomalvica.com/blog/2020/05/21/lpe-path-traversal/

Description:
Druva inSync client for Windows exposes a network service on TCP
            port 6064 on the local network interface. inSync versions 6.6.3
            and prior do not properly validate user-supplied program paths
            in RPC type 5 messages, allowing execution of arbitrary commands
            as SYSTEM.

            This module has been tested successfully on inSync versions
            6.5.2r99097 and 6.6.3r102156 on Windows 7 SP1 (x64).

Check method (fingerprinting):
service = 'inSyncCPHService'

    unless service_exists?(service)
      return CheckCode::Safe("Service '#{service}' does not exist.")
    end

    CheckCode::Detected("Service '#{service}' exists.")
  end
Metasploit Module: Docker-Credential-Wincred.exe Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/docker_credential_wincred.rb
Platform: win
Disclosure date: 2019-07-05
References: CVE-2019-15752, URL-https://medium.com/@morgan.henry.roman/elevation-of-privilege-in-docker-for-windows-2fd8450b478e

Description:
This exploit leverages a vulnerability in docker desktop
          community editions prior to 2.1.0.1 where an attacker can write
          a payload to a lower-privileged area to be executed
          automatically by the docker user at login.

Check method (fingerprinting):
if docker_version <= Rex::Version.new('18.09.0')
      return CheckCode::Appears('Target appears vulnerable')
    end

    CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Razer Synapse rzpnk.sys ZwOpenProcess
Type: exploit
Path: modules/exploits/windows/local/razer_zwopenprocess.rb
Platform: win
Disclosure date: 2017-03-22
Authors: Spencer McIntyre
References: CVE-2017-9769, URL-https://warroom.securestate.com/cve-2017-9769/
Targets: Windows x64

Description:
A vulnerability exists in the latest version of Razer Synapse
          (v2.20.15.1104 as of the day of disclosure) which can be leveraged
          locally by a malicious application to elevate its privileges to those of
          NT_AUTHORITY\SYSTEM. The vulnerability lies in a specific IOCTL handler
          in the rzpnk.sys driver that passes a PID specified by the user to
          ZwOpenProcess. This can be issued by an application to open a handle to
          an arbitrary process with the necessary privileges to allocate, read and
          write memory in the specified process.

          This exploit leverages this vulnerability to open a handle to the
          winlogon process (which runs as NT_AUTHORITY\SYSTEM) and infect it by
          installing a hook to execute attacker controlled shellcode. This hook is
          then triggered on demand by calling user32!LockWorkStation(), resulting
          in the attacker's payload being executed with the privileges of the
          infected winlogon process. In order for the issued IOCTL to work, the
          RazerIngameEngine.exe process must not be running. This exploit will
          check if it is, and attempt to kill it as necessary.

          The vulnerable software can be found here:
          https://www.razerzone.com/synapse/. No Razer hardware needs to be
          connected in order to leverage this vulnerability.

          This exploit is not opsec-safe due to the user being logged out as part
          of the exploitation process.

Check method (fingerprinting):
# Validate that the driver has been loaded and that
    # the version is the same as the one expected
    client.sys.config.getdrivers.each do |d|
      if d[:basename].downcase == 'rzpnk.sys'
        expected_checksum = 'b4598c05d[PII_REDACTED]e25933fff42b0'
        target_checksum = client.fs.file.md5(d[:filename])

        if expected_checksum == Rex::Text.to_hex(target_checksum, '')
          return Exploit::CheckCode::Appears('Target appears vulnerable')
        else
          return Exploit::CheckCode::Detected('Target service detected')
        end
      end
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability
Type: exploit
Path: modules/exploits/windows/local/mov_ss.rb
Platform: win
Disclosure date: 2018-05-08
References: CVE-2018-8897, EDB-44697, BID-104071, URL-https://github.com/can1357/CVE-2018-8897/, URL-https://blog.can.ac/2018/05/11/arbitrary-code-execution-at-ring-0-using-cve-2018-8897/
Targets: Windows x64

Description:
This module exploits a vulnerability in a statement in the system programming guide
          of the Intel 64 and IA-32 architectures software developer's manual being mishandled
          in various operating system kerneles, resulting in unexpected behavior for #DB
          excpetions that are deferred by MOV SS or POP SS.

          This module will upload the pre-compiled exploit and use it to execute the final
          payload in order to gain remote code execution.