deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Windows Kernel Time of Check Time of Use LPE in AuthzBasepCopyoutInternalSecurityAttributes
Type: exploit
Path: modules/exploits/windows/local/cve_2024_30088_authz_basep.rb
Platform: win
Disclosure date: 2024-06-11
References: URL-https://github.com/tykawaii98/CVE-2024-30088, CVE-2024-30038
Targets: Windows x64

Description:
CVE-2024-30088 is a Windows Kernel Elevation of Privilege Vulnerability which affects many recent versions of Windows 10,
          Windows 11 and Windows Server 2022.

          The vulnerability exists inside the function called `AuthzBasepCopyoutInternalSecurityAttributes` specifically when
          the kernel copies the `_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION` of the current token object to user mode. When the
          kernel preforms the copy of the `SecurityAttributesList`, it sets up the list of the SecurityAttribute's structure
          directly to the user supplied pointed. It then calls `RtlCopyUnicodeString` and
          `AuthzBasepCopyoutInternalSecurityAttributeValues` to copy out the names and values of the `SecurityAttribute` leading
          to multiple Time Of Check Time Of Use (TOCTOU) vulnerabilities in the function.

Check method (fingerprinting):
return Exploit::CheckCode::Safe('Non Windows systems are not affected') unless session.platform == 'windows'

    version = get_version_info
    return Exploit::CheckCode::Appears("Version detected: #{version}. Revision number detected: #{version.revision_number}") if target_compatible?(version)

    CheckCode::Safe("Version detected: #{version}. Revision number detected: #{version.revision_number}.")
  end
Metasploit Module: Windows Manage Memory Payload Injection
Type: exploit
Path: modules/exploits/windows/local/payload_inject.rb
Disclosure date: 2011-10-12

Description:
This module will inject a payload into memory of a process.  If a payload
          isn't selected, then it'll default to a reverse x86 TCP meterpreter.  If the PID
          datastore option isn't specified, then it'll inject into notepad.exe instead.
Metasploit Module: Microsoft Spooler Local Privilege Elevation Vulnerability
Type: exploit
Path: modules/exploits/windows/local/cve_2020_1337_printerdemon.rb
Platform: win
Disclosure date: 2019-11-04
References: CVE-2020-1337, URL-https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1337, URL-https://github.com/sailay1996/cve-2020-1337-poc, URL-https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/
Targets: Automatic

Description:
This exploit leverages a file write vulnerability in the print spooler service
          which will restart if stopped.  Because the service cannot be stopped long
          enough to remove the dll, there is no way to remove the dll once
          it is loaded by the service.  Essentially, on default settings, this module
          adds a permanent elevated backdoor.

Check method (fingerprinting):
version = get_version_info
    vprint_status("OS version: #{version}")
    return Exploit::CheckCode::Appears("Version #{version} appears vulnerable") if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1909)

    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: AppXSvc Hard Link Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/appxsvc_hard_link_privesc.rb
Platform: win
Disclosure date: 2019-04-09
References: CVE-2019-0841, URL-https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/, URL-https://googleprojectzero.blogspot.com/2015/12/between-rock-and-hard-link.html, URL-https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html, URL-https://0x00-0x00.github.io/research/2019/05/30/Coding-a-reliable-CVE-2019-0841-Bypass.html

Description:
There exists a privilege escalation vulnerability for
          Windows 10 builds prior to build 17763. Due to the AppXSvc's
          improper handling of hard links, a user can gain full
          privileges over a SYSTEM-owned file. The user can then utilize
          the new file to execute code as SYSTEM.

          This module employs a technique using the Diagnostics Hub Standard
          Collector Service (DiagHub) which was discovered by James Forshaw to
          load and execute a DLL as SYSTEM.

Check method (fingerprinting):
version = get_version_info
    if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1803)
      return CheckCode::Appears("Version #{version} appears vulnerable")
    elsif version.build_number >= Msf::WindowsVersion::Win10_InitialRelease
      return CheckCode::Detected("Version #{version} detected but not confirmed vulnerable")
    end

    return CheckCode::Unknown('Unable to determine target state')
  end
Metasploit Module: MS13-097 Registry Symlink IE Sandbox Escape
Type: exploit
Path: modules/exploits/windows/local/ms13_097_ie_registry_symlink.rb
Disclosure date: 2013-12-10
References: CVE-2013-5045, MSB-MS13-097, BID-64115, URL-https://github.com/tyranid/IE11SandboxEscapes

Description:
This module exploits a vulnerability in Internet Explorer Sandbox which allows to
          escape the Enhanced Protected Mode and execute code with Medium Integrity. The
          vulnerability exists in the IESetProtectedModeRegKeyOnly function from the ieframe.dll
          component, which can be abused to force medium integrity IE to user influenced keys.
          By using registry symlinks it's possible force IE to add a policy entry in the registry
          and finally bypass Enhanced Protected Mode.
Metasploit Module: Panda Security PSEvents Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/panda_psevents.rb
Disclosure date: 2016-06-27
References: CVE-2025-34109, EDB-40020, URL-http://www.security-assessment.com/files/documents/advisory/Panda%20Security%20-%20Privilege%20Escalation.pdf, URL-http://www.pandasecurity.com/uk/support/card?id=100053
Targets: Windows x86, Windows x64

Description:
PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges.
          When run, it checks a user writable folder for certain DLL files, and if any are found
          they are automatically run.
          Vulnerable Products:
          Panda Global Protection 2016 (<=16.1.2)
          Panda Antivirus Pro 2016 (<=16.1.2)
          Panda Small Business Protection (<=16.1.2)
          Panda Internet Security 2016 (<=16.1.2)

Check method (fingerprinting):
if directory?(get_path)
      print_good('Vuln path exists')
      CheckCode::Appears('Target appears vulnerable')
    else
      vprint_error("#{get_path} doesn't exist on target")
      CheckCode::Safe('Target is not vulnerable')
    end
  end
Metasploit Module: Windows 10 UAC Protection Bypass Via Windows Store (WSReset.exe) and Registry
Type: exploit
Path: modules/exploits/windows/local/bypassuac_windows_store_reg.rb
Platform: win
Disclosure date: 2019-02-19
References: URL-https://www.activecyber.us/activelabs/windows-uac-bypass, URL-https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html, URL-https://github.com/sailay1996/UAC_bypass_windows_store

Description:
This module exploits a flaw in the WSReset.exe file associated with the Windows
          Store.  This binary has autoelevate privs, and it will run a binary file
          contained in a low-privilege registry location.  By placing a link to
          the binary in the registry location, WSReset.exe will launch the binary as
          a privileged user.

Check method (fingerprinting):
version = get_version_info
    if version.build_number >= Msf::WindowsVersion::Win10_InitialRelease && !version.windows_server? && is_uac_enabled? && exists?('C:\\Windows\\System32\\WSReset.exe')
      return CheckCode::Appears("Version #{version} appears vulnerable")
    end

    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: MS14-002 Microsoft Windows ndproxy.sys Local Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/ms_ndproxy.rb
Platform: win
Disclosure date: 2013-11-27

Description:
This module exploits a flaw in the ndproxy.sys driver on Windows XP SP3 and Windows 2003
            SP2 systems, exploited in the wild in November, 2013. The vulnerability exists while
            processing an IO Control Code 0x8fff23c8 or 0x8fff23cc, where user provided input is used
            to access an array unsafely, and the value is used to perform a call, leading to a NULL
            pointer dereference which is exploitable on both Windows XP and Windows 2003 systems. This
            module has been tested successfully on Windows XP SP3 and Windows 2003 SP2. In order to
            work the service "Routing and Remote Access" must be running on the target system.

Check method (fingerprinting):
if sysinfo['Architecture'] == ARCH_X64
      vprint_error 'Running against 64-bit systems is not supported'
      return CheckCode::Safe('Target is not vulnerable')
    end

    handle = open_device('\\\\.\\NDProxy', 0x0, 0x0, 0x3)
    return Exploit::CheckCode::Safe('Target is not vulnerable') if handle.nil?

    session.railgun.kernel32.CloseHandle(handle)

    version = get_version_info
    if version.build_number == Msf::WindowsVersion::XP_SP3 ||
       version.build_number == Msf::WindowsVersion::Server2003_SP2
      return Exploit::CheckCode::Appears("Version #{version} appears vulnerable")
    elsif version.xp_or_2003?
      return Exploit::CheckCode::Detected("Version #{version} detected but not confirmed vulnerable")
    else
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end
Metasploit Module: Windows Escalate UAC Protection Bypass (Via SilentCleanup)
Type: exploit
Path: modules/exploits/windows/local/bypassuac_silentcleanup.rb
Platform: win
Disclosure date: 2019-02-24
References: URL-https://tyranidslair.blogspot.com/2017/05/exploiting-environment-variables-in.html, URL-https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup/, URL-https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/, URL-https://forums.hak5.org/topic/45439-powershell-real-uac-bypass/

Description:
There's a task in Windows Task Scheduler called "SilentCleanup" which, while it's executed as Users, automatically runs with elevated privileges.
          When it runs, it executes the file %windir%\system32\cleanmgr.exe. Since it runs as Users, and we can control user's environment variables,
          %windir% (normally pointing to C:\Windows) can be changed to point to whatever we want, and it'll run as admin.
Metasploit Module: Powershell Remoting Remote Command Execution
Type: exploit
Path: modules/exploits/windows/local/powershell_remoting.rb
Disclosure date: 1999-01-01
References: CVE-1999-0504, OSVDB-3106
Targets: Automatic

Description:
This module uses Powershell Remoting (TCP 47001) to inject payloads on target machines.
          If RHOSTS are specified, it will try to resolve the IPs to hostnames, otherwise
          use a HOSTFILE to supply a list of known hostnames.
Metasploit Module: IKE and AuthIP IPsec Keyring Modules Service (IKEEXT) Missing DLL
Type: exploit
Path: modules/exploits/windows/local/ikeext_service.rb
Disclosure date: 2012-10-09
References: URL-https://www.htbridge.com/advisory/HTB23108, URL-https://www.htbridge.com/vulnerability/uncontrolled-search-path-element.html
Targets: Windows x86, Windows x64

Description:
This module exploits a missing DLL loaded by the 'IKE and AuthIP Keyring Modules'
          (IKEEXT) service which runs as SYSTEM, and starts automatically in default
          installations of Vista-Win8. It requires an insecure bin path to plant the DLL payload.

Check method (fingerprinting):
if !service_exists?(@service_name)
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    srv_info = service_info(@service_name)

    vprint_status(srv_info.to_s)

    case START_TYPE[srv_info[:starttype]]
    when 'Disabled'
      vprint_error("Service startup is Disabled, so will be unable to exploit unless account has correct permissions...")
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    when 'Manual'
      vprint_error("Service startup is Manual, so will be unable to exploit unless account has correct permissions...")
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    when 'Auto'
      vprint_good("Service is set to Automatically start...")
    end

    if check_search_path
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    return Exploit::CheckCode::Appears('Target appears vulnerable')
  end
Metasploit Module: Windows UAC Protection Bypass (Via Slui File Handler Hijack)
Type: exploit
Path: modules/exploits/windows/local/bypassuac_sluihijack.rb
Platform: win
Disclosure date: 2018-01-15
References: URL-https://github.com/bytecode-77/slui-file-handler-hijack-privilege-escalation, URL-https://github.com/gushmazuko/WinBypass/blob/master/SluiHijackBypass.ps1
Targets: Windows x86, Windows x64

Description:
This module will bypass UAC on Windows 8-10 by hijacking a special key in the Registry under
          the Current User hive, and inserting a custom command that will get invoked when any binary
          (.exe) application is launched. But slui.exe is an auto-elevated binary that is vulnerable
          to file handler hijacking. When we run slui.exe with changed Registry key
          (HKCU:\Software\Classes\exefile\shell\open\command), it will run our custom command as Admin
          instead of slui.exe.

          The module modifies the registry in order for this exploit to work. The modification is
          reverted once the exploitation attempt has finished.

          The module does not require the architecture of the payload to match the OS. If
          specifying EXE::Custom your DLL should call ExitProcess() after starting the
          payload in a different process.

Check method (fingerprinting):
version = get_version_info
    if version.build_number.between?(Msf::WindowsVersion::Win8, Msf::WindowsVersion::Win10_1909)
      CheckCode::Appears("Version #{version} appears vulnerable")
    else
      CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end
Metasploit Module: AdobeCollabSync Buffer Overflow Adobe Reader X Sandbox Bypass
Type: exploit
Path: modules/exploits/windows/local/adobe_sandbox_adobecollabsync.rb
Platform: win
Disclosure date: 2013-05-14
References: CVE-2013-2730, OSVDB-93355, URL-http://blog.binamuse.com/2013/05/adobe-reader-x-collab-sandbox-bypass.html

Description:
This module exploits a vulnerability on Adobe Reader X Sandbox. The
            vulnerability is due to a sandbox rule allowing a Low Integrity AcroRd32.exe
            process to write register values which can be used to trigger a buffer overflow on
            the AdobeCollabSync component, allowing to achieve Medium Integrity Level
            privileges from a Low Integrity AcroRd32.exe process. This module has been tested
            successfully on Adobe Reader X 10.1.4 over Windows 7 SP1.

Check method (fingerprinting):
@addresses = {}
    acrord32 = session.railgun.kernel32.GetModuleHandleA("AcroRd32.exe")
    @addresses['AcroRd32.exe'] = acrord32["return"]
    if @addresses['AcroRd32.exe'] == 0
      return Msf::Exploit::CheckCode::Unknown('Unable to determine target state')
    elsif check_trigger
      return Msf::Exploit::CheckCode::Vulnerable('Target is vulnerable')
    else
      return Msf::Exploit::CheckCode::Detected('AcroRd32.exe process found, but target does not match the expected vulnerable build')
    end
  end
Metasploit Module: Windows Escalate UAC Protection Bypass (In Memory Injection)
Type: exploit
Path: modules/exploits/windows/local/bypassuac_injection.rb
Disclosure date: 2010-12-31
References: URL-http://www.trustedsec.com/december-2010/bypass-windows-uac/, URL-http://www.pretentiousname.com/misc/W7E_Source/win7_uac_poc_details.html
Targets: Windows x86, Windows x64

Description:
This module will bypass Windows UAC by utilizing the trusted publisher
          certificate through process injection. It will spawn a second shell that
          has the UAC flag turned off. This module uses the Reflective DLL Injection
          technique to drop only the DLL payload binary instead of three separate
          binaries in the standard technique. However, it requires the correct
          architecture to be selected, (use x64 for SYSWOW64 systems also).
          If specifying EXE::Custom your DLL should call ExitProcess() after starting
          your payload in a separate process.
Metasploit Module: MS14-062 Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/bthpan.rb
Platform: win
Disclosure date: 2014-07-18
References: MSB-MS14-062, CVE-2014-4971, URL-https://www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt, OSVDB-109387

Description:
A vulnerability within Microsoft Bluetooth Personal Area Networking module,
          BthPan.sys, can allow an attacker to inject memory controlled by the attacker
          into an arbitrary location. This can be used by an attacker to overwrite
          HalDispatchTable+0x4 and execute arbitrary code by subsequently calling
          NtQueryIntervalProfile.

Check method (fingerprinting):
# covers both native x64 and WOW64
    if sysinfo['Architecture'] == ARCH_X64
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    version = get_version_info
    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable") unless version.build_number == Msf::WindowsVersion::XP_SP3

    handle = open_device('\\\\.\\bthpan', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable") unless handle

    session.railgun.kernel32.CloseHandle(handle)

    return Exploit::CheckCode::Detected("Version #{version} detected but not confirmed vulnerable")
  end
Metasploit Module: Windows Escalate Task Scheduler XML Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/ms10_092_schelevator.rb
Platform: win
Disclosure date: 2010-09-13
References: OSVDB-68518, CVE-2010-3338, BID-44357, MSB-MS10-092, EDB-15589
Targets: Windows Vista / 7 / 2008 (Dropper), Windows Vista / 7 / 2008 (Command)

Description:
This module exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet.
            When processing task files, the Windows Task Scheduler only uses a CRC32
            checksum to validate that the file has not been tampered with. Also, In a default
            configuration, normal users can read and write the task files that they have
            created. By modifying the task file and creating a CRC32 collision, an attacker
            can execute arbitrary commands with SYSTEM privileges.

            NOTE: Thanks to webDEViL for the information about disable/enable.

Check method (fingerprinting):
return CheckCode::Safe("Target OS #{session.platform} is not vulnerable") unless session.platform == 'windows'

    system_info = sysinfo
    return CheckCode::Unknown('Could not retrieve OS system information.') unless system_info

    [ 'Windows Vista', 'Windows 7', 'Windows 2008' ].each do |v|
      return CheckCode::Detected("Target OS #{system_info['OS']} matches a vulnerable version") if system_info['OS'].include?(v)
    end

    CheckCode::Safe("#{system_info['OS']} is not vulnerable")
  end
Metasploit Module: VirtualBox 3D Acceleration Virtual Machine Escape
Type: exploit
Path: modules/exploits/windows/local/virtual_box_opengl_escape.rb
Platform: win
Disclosure date: 2014-03-11
References: CVE-2014-0983, BID-66133, URL-http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities, URL-http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=publication&name=oracle_virtualbox_3d_acceleration

Description:
This module exploits a vulnerability in the 3D Acceleration support for VirtualBox. The
            vulnerability exists in the remote rendering of OpenGL-based 3D graphics. By sending a
            sequence of specially crafted rendering messages, a virtual machine can exploit an out
            of bounds array access to corrupt memory and escape to the host. This module has been
            tested successfully on Windows 7 SP1 (64 bits) as Host running Virtual Box 4.3.6.

Check method (fingerprinting):
handle = open_device
    if handle.nil?
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    session.railgun.kernel32.CloseHandle(handle)

    Exploit::CheckCode::Detected('Target service detected')
  end
Metasploit Module: Windows Command Shell Upgrade (Powershell)
Type: exploit
Path: modules/exploits/windows/local/powershell_cmd_upgrade.rb
Disclosure date: 1999-01-01

Description:
This module executes Powershell to upgrade a Windows Shell session
          to a full Meterpreter session.
Metasploit Module: iPass Mobile Client Service Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/ipass_launch_app.rb
Platform: win
Disclosure date: 2015-03-12
References: CVE-2015-0925, URL-https://www.mogwaisecurity.de/advisories/MSA-2015-03.txt

Description:
The named pipe, \IPEFSYSPCPIPE, can be accessed by normal users to interact
            with the iPass service. The service provides a LaunchAppSysMode command which
            allows to execute arbitrary commands as SYSTEM.

Check method (fingerprinting):
unless session.platform == 'windows'
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    svc = service_info('iPlatformService')
    if svc && svc[:display] =~ /iPlatformService/
      vprint_good("Found service '#{svc[:display]}'")
      if is_running?
        vprint_good('Service is running')
      else
        vprint_error('Service is not running!')
      end

      vprint_good('Opening named pipe...')
      handle = open_named_pipe('\\\\.\\pipe\\IPEFSYSPCPIPE')

      if handle.nil?
        vprint_error('\\\\.\\pipe\\IPEFSYSPCPIPE named pipe not found')
        return Exploit::CheckCode::Safe('Target is not vulnerable')
      else
        vprint_good('\\\\.\\pipe\\IPEFSYSPCPIPE found!')
        session.railgun.kernel32.CloseHandle(handle)
      end

      return Exploit::CheckCode::Vulnerable('Target is vulnerable')
    else
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
  end
Metasploit Module: Windows Update Orchestrator unchecked ScheduleWork call
Type: exploit
Path: modules/exploits/windows/local/cve_2020_1313_system_orchestrator.rb
Platform: win
Disclosure date: 2019-11-04
References: CVE-2020-1313, URL-https://github.com/irsl/CVE-2020-1313
Targets: Windows x64

Description:
This exploit uses access to the UniversalOrchestrator ScheduleWork API call
          which does not verify the caller's token before scheduling a job to be run
          as SYSTEM.  You cannot schedule something in a given time, so the payload will
          execute as system sometime in the next 24 hours.

Check method (fingerprinting):
version = get_version_info
    vprint_status("OS version: #{version}")
    if version.build_number.between?(Msf::WindowsVersion::Win10_1903, Msf::WindowsVersion::Win10_2004)
      return Exploit::CheckCode::Appears("Version #{version} appears vulnerable")
    else
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end