deardaniel/secdata-raw huggingface dataset:
Metasploit Module: CA Unified Infrastructure Management Nimsoft 7.80 - Remote Buffer Overflow
Type: exploit
Path: modules/exploits/windows/nimsoft/nimcontroller_bof.rb
Platform: win
Disclosure date: 2020-02-05
References: CVE-2020-8010, CVE-2020-8012, URL-https://support.broadcom.com/external/content/release-announcements/CA20200205-01-Security-Notice-for-CA-Unified-Infrastructure-Management/7832
Targets: Windows Universal (x64) - v7.80.3132

Description:
This module exploits a buffer overflow within the CA Unified Infrastructure Management nimcontroller.
          The vulnerability occurs in the robot (controller) component when sending a specially crafted directory_list
          probe.

          Technically speaking the target host must also be vulnerable to CVE-2020-8010 in order to reach the
          directory_list probe.

Check method (fingerprinting):
connect

    sock.put(generate_probe('get_info', ['interfaces=0']))
    response = sock.get_once(4096)

    unless response
      return CheckCode::Unknown('No response was returned from the target.')
    end

    list_check = -1

    begin
      if target['Version'].in? response
        print_status("Version #{target['Version']} detected, sending directory_list probe")
        sock.put(generate_probe('directory_list', ["directory=#{datastore['DIRECTORY']}", 'detail=1']))
        list_check = parse_listing(sock.get_once(4096), datastore['DIRECTORY'])
      end
    ensure
      disconnect
    end

    if list_check == 0
      return CheckCode::Appears('Nimsoft NimController directory listing detected')
    else
      return CheckCode::Safe('Nimsoft NimController directory listing not detected')
    end
  end
Metasploit Module: Windows Escalate Service Permissions Local Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/service_permissions.rb
Disclosure date: 2012-10-15
References: URL-https://itm4n.github.io/windows-registry-rpceptmapper-eop/, URL-https://birkep.github.io/posts/Windows-LPE/, CVE-2025-21293

Description:
This module attempts to exploit existing administrative privileges to obtain
          a SYSTEM session. If directly creating a service fails, this module will inspect
          existing services to look for insecure configuration, file or registry permissions that may
          be hijacked. It will then attempt to restart the replaced service to run the
          payload. This will result in a new session when this succeeds.
Metasploit Module: Windows Access Mode Mismatch LPE in ks.sys
Type: exploit
Path: modules/exploits/windows/local/cve_2024_35250_ks_driver.rb
Platform: win
Disclosure date: 2024-06-11
References: URL-https://github.com/varwara/CVE-2024-35250, URL-https://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/, URL-https://googleprojectzero.blogspot.com/2019/03/windows-kernel-logic-bug-class-access.html, CVE-2024-35250
Targets: Windows x64

Description:
The ks.sys driver on Windows is one of the core components of Kernel Streaming and is installed by default.
          There exists a LPE in this driver which can be exploited on many recent versions of Windows 10,
          Windows 11, Windows Server 2022.

Check method (fingerprinting):
version = get_version_info
    begin
      return Exploit::CheckCode::Appears("ks.sys is present, Windows Version detected: #{version}") if target_compatible?(version)
    rescue VulnerableDriverNotPresent, TargetNot64BitWindows => e
      return Exploit::CheckCode::Safe("#{e.class}: #{e.message}")
    end

    CheckCode::Safe("Version detected: #{version}")
  end
Metasploit Module: Service Tracing Privilege Elevation Vulnerability
Type: exploit
Path: modules/exploits/windows/local/cve_2020_0668_service_tracing.rb
Platform: win
Disclosure date: 2020-02-11
References: CVE-2020-0668, URL-https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop/, URL-https://github.com/itm4n/SysTracingPoc, URL-https://github.com/RedCursorSecurityConsulting/CVE-2020-0668, URL-https://attackerkb.com/assessments/ea5921d4-6046-4a3b-963f-08e8bde1762a, URL-https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html
Targets: Windows x64

Description:
This module leverages a trusted file overwrite with a DLL hijacking
          vulnerability to gain SYSTEM-level access on vulnerable Windows 10 x64
          targets.
Metasploit Module: Novell Client 4.91 SP4 nwfs.sys Local Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/novell_client_nwfs.rb
Platform: win
Disclosure date: 2008-06-26
References: CVE-2008-3158, OSVDB-46578, BID-30001

Description:
This module exploits a flaw in the nwfs.sys driver to overwrite data in kernel
            space. The corruption occurs while handling ioctl requests with code 0x1438BB,
            where a 0x00000009 dword is written to an arbitrary address. An entry within the
            HalDispatchTable is overwritten in order to execute arbitrary code when
            NtQueryIntervalProfile is called. The module has been tested successfully on
            Windows XP SP3 with Novell Client 4.91 SP4.
Metasploit Module: Windscribe WindscribeService Named Pipe Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/windscribe_windscribeservice_priv_esc.rb
Platform: win
Disclosure date: 2018-05-24
References: CVE-2018-11479, URL-http://blog.emingh.com/2018/05/windscribe-vpn-privilege-escalation.html, URL-https://pastebin.com/eLG3dpYK

Description:
The Windscribe VPN client application for Windows makes use of a
          Windows service `WindscribeService.exe` which exposes a named pipe
          `\.\pipe\WindscribeService` allowing execution of programs with
          elevated privileges.

          Windscribe versions prior to 1.82 do not validate user-supplied
          program names, allowing execution of arbitrary commands as SYSTEM.

          This module has been tested successfully on Windscribe versions
          1.80 and 1.81 on Windows 7 SP1 (x64).

Check method (fingerprinting):
service = 'WindscribeService'

    unless service_exists? service
      return CheckCode::Safe("Service '#{service}' does not exist")
    end

    CheckCode::Detected('Target service detected')
  end
Metasploit Module: MS14-070 Windows tcpip!SetAddrOptions NULL Pointer Dereference
Type: exploit
Path: modules/exploits/windows/local/ms14_070_tcpip_ioctl.rb
Platform: win
Disclosure date: 2014-11-11
References: CVE-2014-4076, MSB-MS14-070, OSVDB-114532, URL-https://blog.korelogic.com/blog/2015/01/28/2k3_tcpip_setaddroptions_exploit_dev, URL-https://www.korelogic.com/Resources/Advisories/KL-001-2015-001.txt

Description:
A vulnerability within the Microsoft TCP/IP protocol driver tcpip.sys
            can allow a local attacker to trigger a NULL pointer dereference by using a
            specially crafted IOCTL. This flaw can be abused to elevate privileges to
            SYSTEM.

Check method (fingerprinting):
if sysinfo["Architecture"] == ARCH_X64
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    handle = open_device('\\\\.\\tcp', 0, 'FILE_SHARE_READ', 'OPEN_EXISTING')
    return Exploit::CheckCode::Safe('Target is not vulnerable') unless handle

    session.railgun.kernel32.CloseHandle(handle)

    file_path = get_env('WINDIR') << "\\system32\\drivers\\tcpip.sys"
    unless file?(file_path)
      return Exploit::CheckCode::Unknown('Unable to determine target state')
    end

    major, minor, build, revision, branch = file_version(file_path)
    vprint_status("tcpip.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")

    if ("#{major}.#{minor}.#{build}" == "5.2.3790" && revision < 5440)
      return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable")
    end

    return Exploit::CheckCode::Safe("Revision #{revision} is not vulnerable")
  end
Metasploit Module: Win32k ConsoleControl Offset Confusion
Type: exploit
Path: modules/exploits/windows/local/cve_2022_21882_win32k.rb
Platform: win
Disclosure date: 2021-02-09
References: CVE-2021-1732, URL-https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/, URL-https://github.com/KaLendsi/CVE-2021-1732-Exploit, URL-https://attackerkb.com/assessments/1a332300-7ded-419b-b717-9bf03ca2a14e, URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1732, URL-https://www.fuzzysecurity.com/tutorials/expDev/22.html, URL-https://www.geoffchappell.com/studies/windows/win32/user32/structs/wnd/index.htm, URL-https://byteraptors.github.io/windows/exploitation/2020/06/03/exploitingcve2019-1458.html, URL-https://www.trendmicro.com/en_us/research/16/l/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild.html, CVE-2022-21882
Targets: Windows 10 v1803-21H2 x64

Description:
A vulnerability exists within win32k that can be leveraged by an attacker to escalate privileges to those of
            NT AUTHORITY\SYSTEM. The flaw exists in how the WndExtra field of a window can be manipulated into being
            treated as an offset despite being populated by an attacker-controlled value. This can be leveraged to
            achieve an out of bounds write operation, eventually leading to privilege escalation.

            This flaw was originally identified as CVE-2021-1732 and was patched by Microsoft on February 9th, 2021.
            In early 2022, a technique to bypass the patch was identified and assigned CVE-2022-21882. The root cause is
            is the same for both vulnerabilities. This exploit combines the patch bypass with the original exploit to
            function on a wider range of Windows 10 targets.

Check method (fingerprinting):
if session.platform != 'windows'
      # Non-Windows systems are definitely not affected.
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    version = get_version_info
    vprint_status("Windows Build Number = #{version.product_name}")
    if version.build_number.between?(Msf::WindowsVersion::Win10_1803, Msf::WindowsVersion::Win10_21H2)
      CheckCode::Appears("Version #{version} appears vulnerable")
    elsif version.build_number == Msf::WindowsVersion::Server2022 || version.build_number == Msf::WindowsVersion::Win11_21H2
      CheckCode::Detected("May be vulnerable, but exploit not tested on #{version.product_name}")
    else
      print_error('Vulnerability only present on Windows 10 versions 1803 - 21H2, Windows 11 21H2, Server 2019 and Server 2022')
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end
Metasploit Module: Background Intelligent Transfer Service Arbitrary File Move Privilege Elevation Vulnerability
Type: exploit
Path: modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb
Platform: win
Disclosure date: 2020-03-10
References: CVE-2020-0787, URL-https://itm4n.github.io/cve-2020-0787-windows-bits-eop/, URL-https://github.com/itm4n/BitsArbitraryFileMove, URL-https://attackerkb.com/assessments/e61cfec0-d766-4e7e-89f7-5aad2460afb8, URL-https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html, URL-https://itm4n.github.io/usodllloader-part1/, URL-https://itm4n.github.io/usodllloader-part2/
Targets: Windows DLL Dropper

Description:
This module exploits CVE-2020-0787, an arbitrary file move vulnerability in outdated versions of the
          Background Intelligent Transfer Service (BITS), to overwrite C:\Windows\System32\WindowsCoreDeviceInfo.dll
          with a malicious DLL containing the attacker's payload.

          To achieve code execution as the SYSTEM user, the Update Session Orchestrator service is then started, which
          will result in the malicious WindowsCoreDeviceInfo.dll being run with SYSTEM privileges due to a DLL hijacking
          issue within the Update Session Orchestrator Service.

          Note that presently this module only works on Windows 10 and Windows Server 2016 and later as the
          Update Session Orchestrator Service was only introduced in Windows 10. Note that only Windows 10 has been tested,
          so your mileage may vary on Windows Server 2016 and later.

Check method (fingerprinting):
sysinfo_value = sysinfo['OS']
    if sysinfo_value !~ /windows/i
      # Non-Windows systems are definitely not affected.
      return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!')
    end

    # see https://docs.microsoft.com/en-us/windows/release-information/
    version = get_version_info
    unless version.build_number.between?(Msf::WindowsVersion::Server2008_SP0, Msf::WindowsVersion::Win10_1909)
      return CheckCode::Safe('Target is not running a vulnerable version of Windows!')
    end

    # Build numbers taken from https://www.qualys.com/research/security-alerts/2020-03-10/microsoft/
    if version.build_number == Msf::WindowsVersion::Win10_1909 && version.revision_number.between?(0, 718)
      return CheckCode::Appears('Vulnerable Windows 10 v1909 build detected!')
    elsif version.build_number == Msf::WindowsVersion::Win10_1903 && version.revision_number.between?(0, 718)
      return CheckCode::Appears('Vulnerable Windows 10 v1903 build detected!')
    elsif version.build_number == Msf::WindowsVersion::Win10_1809 && version.revision_number.between?(0, 1097)
      return CheckCode::Appears('Vulnerable Windows 10 v1809 build detected!')
    elsif version.build_number == Msf::WindowsVersion::Win10_1803 && version.revision_number.between?(0, 1364)
      return CheckCode::Appears('Vulnerable Windows 10 v1803 build detected!')
    elsif version.build_number == Msf::WindowsVersion::Win10_1709 && version.revision_number.b
Metasploit Module: Windows Privilege Escalation via TokenMagic (UAC Bypass)
Type: exploit
Path: modules/exploits/windows/local/tokenmagic.rb
Platform: win
Disclosure date: 2017-05-25
References: URL-https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/UAC-TokenMagic.ps1, URL-https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-1.html, URL-https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-2.html, URL-https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-3.html
Targets: Automatic

Description:
This module leverages a UAC bypass (TokenMagic) in order to spawn a process/conduct a DLL
          hijacking attack to gain SYSTEM-level privileges. Windows 7 through Windows 10 1803
          are affected.

Check method (fingerprinting):
version = get_version_info

    vprint_status("OS: #{version.product_name}")
    # Service method has been tested on Windows 7, 8 and 10 (1803 and ealier)
    vulnerable_to_service = version.build_number.between?(Msf::WindowsVersion::Win7_SP1, Msf::WindowsVersion::Win10_1803)
    if datastore['METHOD'] =~ /service/i
      return Exploit::CheckCode::Appears("Version #{version} appears vulnerable") if vulnerable_to_service
    elsif version.build_number.between?(Msf::WindowsVersion::Win10_1703, Msf::WindowsVersion::Win10_1803)
      # DLL method has been tested on Windows 10 (1703 to 1803)
      return Exploit::CheckCode::Appears("Version #{version} appears vulnerable")
    elsif datastore['METHOD'] =~ /dll/i && vulnerable_to_service
      print_error("The current target is not vulnerable to the DLL hijacking technique. Please try setting METHOD to 'SERVICE' and then try again!")
    end
    Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Lenovo System Update Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/lenovo_systemupdate.rb
Platform: win
Disclosure date: 2015-04-12
References: OSVDB-121522, CVE-2015-2219, URL-http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf

Description:
The named pipe, \SUPipeServer, can be accessed by normal users to interact with the
            System update service. The service provides the possibility to execute arbitrary
            commands as SYSTEM if a valid security token is provided. This token can be generated
            by calling the GetSystemInfoData function in the DLL tvsutil.dll. Please, note that the
            System Update is stopped by default but can be started/stopped calling the Executable
            ConfigService.exe.

Check method (fingerprinting):
unless session.platform == 'windows'
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    svc = service_info('SUService')
    if svc && svc[:display] =~ /System Update/
      vprint_good("Found service '#{svc[:display]}'")
      return Exploit::CheckCode::Detected('Target service detected')
    else
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
  end
Metasploit Module: Windows Run Command As User
Type: exploit
Path: modules/exploits/windows/local/run_as.rb
Platform: win
Disclosure date: 1999-01-01
Authors: Kx499
References: URL-https://msdn.microsoft.com/en-us/library/windows/desktop/ms682431
Targets: Automatic

Description:
This module will login with the specified username/password and execute the
          supplied command as a hidden process. Output is not returned by default.
          Unless targeting a local user either set the DOMAIN, or specify a UPN user
          format (e.g. user@domain). This uses the CreateProcessWithLogonW WinAPI function.

          A custom command line can be sent instead of uploading an executable.
          APPLICAITON_NAME and COMMAND_LINE are passed to lpApplicationName and lpCommandLine
          respectively. See the MSDN documentation for how these two values interact.
Metasploit Module: Windows Management Instrumentation (WMI) Remote Command Execution
Type: exploit
Path: modules/exploits/windows/local/wmi.rb
Disclosure date: 1999-01-01
References: CVE-1999-0504, OSVDB-3106, URL-http://passing-the-hash.blogspot.co.uk/2013/07/WMIS-PowerSploit-Shells.html
Targets: Automatic

Description:
This module executes powershell on the remote host using the current
          user credentials or those supplied. Instead of using PSEXEC over TCP
          port 445 we use the WMIC command to start a Remote Procedure Call on
          TCP port 135 and an ephemeral port. Set ReverseListenerComm to tunnel
          traffic through that session.

          The result is similar to psexec but with the added benefit of using
          the session's current authentication token instead of having to know
          a password or hash.

          The remote host must be configured to allow remote Windows Management
          Instrumentation.
Metasploit Module: Agnitum Outpost Internet Security Local Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/agnitum_outpost_acs.rb
Platform: win
Disclosure date: 2013-08-02
References: CVE-2013-10046, OSVDB-96208, EDB-27282

Description:
This module exploits a directory traversal vulnerability on Agnitum Outpost Internet
            Security 8.1. The vulnerability exists in the acs.exe component, allowing the user to load
            arbitrary DLLs through the acsipc_server named pipe, and finally execute arbitrary
            code with SYSTEM privileges. This module has been tested successfully on Windows 7 SP1 with
            Agnitum Outpost Internet Security 8.1 (32 bits and 64 bits versions).

Check method (fingerprinting):
handle = open_named_pipe("\\\\.\\pipe\\acsipc_server")
    if handle.nil?
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    session.railgun.kernel32.CloseHandle(handle)
    return Exploit::CheckCode::Detected('Target service detected')
  end
Metasploit Module: MS15-004 Microsoft Remote Desktop Services Web Proxy IE Sandbox Escape
Type: exploit
Path: modules/exploits/windows/local/ms15_004_tswbproxy.rb
Platform: win
Disclosure date: 2015-01-13
References: CVE-2015-0016, MSB-MS15-004, URL-http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-escaping-the-internet-explorer-sandbox/
Targets: Protected Mode (Windows 7) / 32 bits

Description:
This module abuses a process creation policy in Internet Explorer's
            sandbox; specifically, Microsoft's RemoteApp and Desktop Connections runtime
            proxy, TSWbPrxy.exe.  This vulnerability allows the attacker to escape the
            Protected Mode and execute code with Medium Integrity. At the moment, this
            module only bypass Protected Mode on Windows 7 SP1 and prior (32 bits). This
            module has been tested successfully on Windows 7 SP1 (32 bits) with IE 8 and IE
            11.

Check method (fingerprinting):
temp = get_env('WINDIR')
    dll_path = "#{temp}\\System32\\TSWbPrxy.exe"

    version = get_version_info

    unless version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Server2012_R2)
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end

    unless file_exist?(dll_path)
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end

    Exploit::CheckCode::Detected("Version #{version} detected but not confirmed vulnerable")
  end
Metasploit Module: LNK Code Execution Vulnerability
Type: exploit
Path: modules/exploits/windows/local/cve_2017_8464_lnk_lpe.rb
Platform: win
Disclosure date: 2017-06-13
References: CVE-2017-8464, URL-https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464, URL-http://www.vxjump.net/files/vuln_analysis/cve-2017-8464.txt, URL-https://msdn.microsoft.com/en-us/library/dd871305.aspx, URL-http://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm, URL-https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf
Targets: Windows x64, Windows x86

Description:
This module exploits a vulnerability in the handling of Windows Shortcut files (.LNK)
          that contain a dynamic icon, loaded from a malicious DLL.

          This vulnerability is a variant of MS15-020 (CVE-2015-0096). The created LNK file is
          similar except an additional SpecialFolderDataBlock is included. The folder ID set
          in this SpecialFolderDataBlock is set to the Control Panel. This is enough to bypass
          the CPL whitelist. This bypass can be used to trick Windows into loading an arbitrary
          DLL file.

          The PATH option must be an absolute path to a writeable directory which is indexed for
          searching. If no PATH is specified, the module defaults to %USERPROFILE%.

Check method (fingerprinting):
if session.sys.process['SearchIndexer.exe']
      return Exploit::CheckCode::Detected('Search Indexer process detected')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end