deardaniel/secdata-raw huggingface dataset:
Metasploit Module: VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/virtual_box_guest_additions.rb
Platform: win
Disclosure date: 2014-07-15
References: CVE-2014-2477, URL-https://www.korelogic.com/Resources/Advisories/KL-001-2014-001.txt

Description:
A vulnerability within the VBoxGuest driver allows an attacker to inject memory they
            control into an arbitrary location they define. This can be used by an attacker to
            overwrite HalDispatchTable+0x4 and execute arbitrary code by subsequently calling
            NtQueryIntervalProfile on Windows XP SP3 systems. This has been tested with VBoxGuest
            Additions up to 4.3.10r93012.

Check method (fingerprinting):
if sysinfo['Architecture'] == ARCH_X64
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    handle = open_device('\\\\.\\vboxguest', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
    if handle.nil?
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    session.railgun.kernel32.CloseHandle(handle)

    version = get_version_info
    if version != Msf::WindowsVersion::XP_SP3
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end

    file_path = get_env('WINDIR') << '\\system32\\drivers\\vboxguest.sys'
    unless file?(file_path)
      return Exploit::CheckCode::Unknown('Unable to determine target state')
    end

    major, minor, build, revision, branch = file_version(file_path)
    vprint_status("vboxguest.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")

    unless (major == 4)
      return Exploit::CheckCode::Safe("Revision #{revision} is not vulnerable")
    end

    case minor
    when 0
      return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable") if build < 26
    when 1
      return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable") if build < 34
    when 2
      return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable") if build < 26
    when 3
      return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable") if build < 12
    end

    return Exploit::CheckCode::Safe("Revi
Metasploit Module: MS16-032 Secondary Logon Handle Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb
Disclosure date: 2016-03-21
References: MSB-MS16-032, CVE-2016-0099, URL-https://twitter.com/FuzzySec/status/[PII_REDACTED]42612736, URL-https://googleprojectzero.blogspot.co.uk/2016/03/exploiting-leaked-thread-handle.html
Targets: Windows x86, Windows x64

Description:
This module exploits the lack of sanitization of standard handles in Windows' Secondary
          Logon Service.  The vulnerability is known to affect versions of Windows 7-10 and 2k8-2k12
          32 and 64 bit.  This module will only work against those versions of Windows with
          Powershell 2.0 or later and systems with two or more CPU cores.

Check method (fingerprinting):
unless session.platform == 'windows'
      # Non-Windows systems are definitely not affected.
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    res = psh_exec 'if($([System.Environment]::ProcessorCount) -gt 1) { echo("true") }'
    unless res.include? 'true'
      vprint_error 'Target system has an insufficient number of processor cores'
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    Exploit::CheckCode::Detected('Windows session with multiple CPU cores detected')
  end
Metasploit Module: Lenovo Diagnostics Driver IOCTL memmove
Type: exploit
Path: modules/exploits/windows/local/cve_2022_3699_lenovo_diagnostics_driver.rb
Platform: win
Disclosure date: 2022-11-09
References: CVE-2022-3699, URL-https://github.com/alfarom256/CVE-2022-3699/
Targets: Windows x64

Description:
Incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to
            issue device IOCTLs to perform arbitrary physical/virtual memory read/write.

Check method (fingerprinting):
unless session.platform == 'windows'
      # Non-Windows systems are definitely not affected.
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    handle = open_device('\\\\.\\LenovoDiagnosticsDriver', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
    if handle.nil?
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    session.railgun.kernel32.CloseHandle(handle)
    CheckCode::Appears('Target appears vulnerable')
  end
Metasploit Module: SMBv3 Compression Buffer Overflow
Type: exploit
Path: modules/exploits/windows/local/cve_2020_0796_smbghost.rb
Platform: win
Disclosure date: 2020-03-13
References: CVE-2020-0796, URL-https://github.com/danigargu/CVE-2020-0796, URL-https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/adv200005
Targets: Windows 10 x86, Windows 10 v1903-1909 x64

Description:
A vulnerability exists within the Microsoft Server Message Block 3.1.1 (SMBv3) protocol that can be leveraged to
            execute code on a vulnerable server. This local exploit implementation leverages this flaw to elevate itself
            before injecting a payload into winlogon.exe.

Check method (fingerprinting):
if session.platform != 'windows'
      # Non-Windows systems are definitely not affected.
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    version = get_version_info
    vprint_status("Windows Build Number = #{version.build_number}")
    # see https://docs.microsoft.com/en-us/windows/release-information/
    unless version.build_number.between?(Msf::WindowsVersion::Win10_1903, Msf::WindowsVersion::Win10_1909)
      print_error('The exploit only supports Windows 10 versions 1903 - 1909')
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end

    disable_compression = registry_getvaldata('HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters', 'DisableCompression')
    if !disable_compression.nil? && disable_compression != 0
      print_error('The exploit requires compression to be enabled')
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end

    CheckCode::Appears("Version #{version} appears vulnerable")
  end
Metasploit Module: Windows Net-NTLMv2 Reflection DCOM/RPC (Juicy)
Type: exploit
Path: modules/exploits/windows/local/ms16_075_reflection_juicy.rb
Platform: win
Disclosure date: 2016-01-16
References: MSB-MS16-075, CVE-2016-3225, URL-http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113/, URL-https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/, URL-https://github.com/breenmachine/RottenPotatoNG, URL-https://decoder.cloud/2017/12/23/the-lonely-potato/, URL-https://ohpe.it/juicy-potato/

Description:
This module utilizes the Net-NTLMv2 reflection between DCOM/RPC
            to achieve a SYSTEM handle for elevation of privilege.
            It requires a CLSID string.
            Windows 10 after version 1803, (April 2018 update, build 17134) and all
            versions of Windows Server 2019 are not vulnerable.

Check method (fingerprinting):
privs = client.sys.config.getprivs
    # Fast fails
    if !privs.include?('SeImpersonatePrivilege')
      print_bad('Target session is missing the SeImpersonatePrivilege.')
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
    version = get_version_info
    unless version.build_number.between?(Msf::WindowsVersion::Server2008_R2_SP0, Msf::WindowsVersion::Win10_1803)
      print_bad("System not vulnerable (#{version.product_name})")
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
    print_good("Target appears to be vulnerable (#{version.product_name})")
    return Exploit::CheckCode::Appears("Version #{version} appears vulnerable")
  end
Metasploit Module: Powershell Payload Execution
Type: exploit
Path: modules/exploits/windows/local/ps_persist.rb
Disclosure date: 2012-08-14

Description:
This module generates a dynamic executable on the session host using .NET templates.
          Code is pulled from C# templates and impregnated with a payload before being
          sent to a modified PowerShell session with .NET 4 loaded. The compiler builds
          the executable (standard or Windows service) in memory and produces a binary
          which can be started/installed and downloaded for later use. After compilation the
          PoweShell session can also sign the executable if provided a path the a .pfx formatted
          certificate.
Metasploit Module: Persistent Payload in Windows Volume Shadow Copy
Type: exploit
Path: modules/exploits/windows/local/vss_persistence.rb
Platform: win
Disclosure date: 2011-10-21
Authors: Jedediah Rodriguez <Jedi.rodriguez[at]gmail.com>
References: URL-https://web.archive.org/web/[PII_REDACTED]2952/https://securityweekly.com/2011/11/02/safely-dumping-hashes-from-liv/, URL-http://www.irongeek.com/i.php?page=videos/hack3rcon2/tim-tomes-and-mark-baggett-lurking-in-the-shadows

Description:
This module will attempt to create a persistent payload in a new volume shadow copy. This is
          based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. This module has
          been tested successfully on Windows 7. In order to achieve persistence through the RUNKEY
          option, the user should need password in order to start session on the target machine.
Metasploit Module: Microsoft Windows NtUserMNDragOver Local Privilege Elevation
Type: exploit
Path: modules/exploits/windows/local/ntusermndragover.rb
Platform: win
Disclosure date: 2019-03-12
References: CVE-2019-0808, URL-https://github.com/exodusintel/CVE-2019-0808, URL-https://github.com/ze0r/cve-2019-0808-poc, URL-http://blogs.360.cn/post/RootCause_CVE-2019-0808_EN.html, URL-https://blog.exodusintel.com/2019/05/17/windows-within-windows/
Targets: Windows 7 x86

Description:
This module exploits a NULL pointer dereference vulnerability in
          MNGetpItemFromIndex(), which is reachable via a NtUserMNDragOver() system call.

          The NULL pointer dereference occurs because the xxxMNFindWindowFromPoint()
          function does not effectively check the validity of the tagPOPUPMENU
          objects it processes before passing them on to MNGetpItemFromIndex(),
          where the NULL pointer dereference will occur.

          This module has been tested against Windows 7 x86 SP0 and SP1. Offsets
          within the solution may need to be adjusted to work with other versions
          of Windows, such as Windows Server 2008.

Check method (fingerprinting):
if session.platform != 'windows'
      # Non-Windows systems are definitely not affected.
      return CheckCode::Safe('Target is not vulnerable')
    end

    version = get_version_info

    vprint_status("OS version: #{version}")
    # see https://docs.microsoft.com/en-us/windows/release-information/
    unless version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) && version.workstation?
      print_error('The exploit only supports Windows 7 versions 7600 and 7601')
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end

    path = expand_path('%WINDIR%\\system32\\win32k.sys')
    _major, _minor, _build, revision, _brand = file_version(path)
    return CheckCode::Safe("Revision #{revision} is not vulnerable") if revision >= 24387

    CheckCode::Appears("Revision #{revision} appears vulnerable")
  end
Metasploit Module: Lexmark Driver Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/lexmark_driver_privesc.rb
Platform: win
Disclosure date: 2021-07-15
References: CVE-2021-35449, URL-http://support.lexmark.com/index?page=content&id=TE953, URL-https://github.com/jacob-baines/concealed_position, URL-https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20presentations/Jacob%20Baines%20-%20Bring%20Your%20Own%20Print%20Driver%20Vulnerability.pdf
Targets: Windows

Description:
Various Lexmark Universal Printer drivers as listed at advisory TE953
          allow low-privileged authenicated users to elevate their privileges to
          SYSTEM on affected Windows systems by modifying the XML file at
          C:\ProgramData\<driver name>\Universal Color Laser.gdl
          to replace the DLL path to unires.dll with a malicious DLL path.

          When C:\Windows\System32\Printing_Admin_Scripts\en-US\prnmngr.vbs is
          then used to add the printer to the affected system, PrintIsolationHost.exe,
          a Windows process running as NT AUTHORITY\SYSTEM, will inspect the
          C:\ProgramData\<driver name>\Universal Color Laser.gdl file and will
          load the malicious DLL from the path specified in the file. This which will
          result in the malicious DLL executing as NT AUTHORITY\SYSTEM.

          Once this module is finished, it will use the prnmngr.vbs script
          to remove the printer it added.

Check method (fingerprinting):
res = cmd_exec('pnputil.exe /enum-drivers')
    m = res.scan(%r{Published Name:     ([^.]*\.inf)\r\nOriginal Name:      lmu.*?.inf\r\nProvider Name:      Lexmark International\r\nClass Name:         Printers\r\nClass GUID:         {4d36e979-e325-11ce-bfc1-08002be10318}\r\nDriver Version:     (\d+)/\d+/(\d+) \d+\.\d+\.\d+\.\d+}m)

    return CheckCode::Safe('No Lexmark print drivers in the driver store') if m.empty?

    # known vulnerable drivers
    driver_list = ['Lexmark Universal v2', 'Lexmark Universal v2 XL', 'Lexmark Printer Software G2', 'Lexmark Printer Software G2 XL']
    found_drivers = []

    for path in m
      print_status("Lexmark driver published at #{path[0]}")
      inf_text = read_file("C:\\Windows\\inf\\#{path[0]}")
      for driver in driver_list
        if inf_text.include?(driver)
          found_drivers.push(driver)
        end
      end
    end

    return CheckCode::Safe('None of the Lexmark drivers in the driver store are known to be vulnerable') if found_drivers.empty?

    found_drivers = found_drivers.uniq
    print_status("Found #{found_drivers.length} possible options:")
    for driver in found_drivers
      print_status("\t#{driver}")
    end

    # select driver to exploit
    @drvr_name = datastore['DRIVERNAME']
    if @drvr_name.empty?
      @drvr_name = found_drivers[0]
      print_status("No user provided DRIVERNAME. Defaulting to \"#{@drvr_name}\"")
    else
      return CheckCode::Safe('The user specified driver is not in the driver s
Metasploit Module: Windows Escalate UAC Protection Bypass (In Memory Injection) abusing WinSXS
Type: exploit
Path: modules/exploits/windows/local/bypassuac_injection_winsxs.rb
Disclosure date: 2017-04-06
References: URL-https://github.com/L3cr0f/DccwBypassUAC
Targets: Windows x86, Windows x64

Description:
This module will bypass Windows UAC by utilizing the trusted publisher
          certificate through process injection. It will spawn a second shell that
          has the UAC flag turned off by abusing the way "WinSxS" works in Windows
          systems. This module uses the Reflective DLL Injection technique to drop
          only the DLL payload binary instead of three seperate binaries in the
          standard technique. However, it requires the correct architecture to be
          selected, (use x64 for SYSWOW64 systems also).
Metasploit Module: GOG GalaxyClientService Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/gog_galaxyclientservice_privesc.rb
Platform: win
Disclosure date: 2020-04-28
References: URL-https://www.positronsecurity.com/blog/2020-04-28-gog-galaxy-client-local-privilege-escalation/, CVE-2020-7352
Targets: Windows (Dropper)

Description:
This module will send arbitrary file_paths to the GOG GalaxyClientService, which will be executed
          with SYSTEM privileges (verified on GOG Galaxy Client v1.2.62 and v2.0.12; prior versions are
          also likely affected).

Check method (fingerprinting):
log_path = expand_path('%PROGRAMDATA%\\GOG.com\\Galaxy\\logs\\GalaxyClientService.log')
    service_path = expand_path('%PROGRAMFILES(x86)%\\GOG Galaxy\\GalaxyClientService.exe')

    return CheckCode::Safe('Galaxy Client Service not found') unless file_exist?(service_path)
    return CheckCode::Detected('Unable to determine version') unless file_exist?(log_path)

    log_data = read_file(log_path)
    unless log_data && /Application\s+version:\s+(?<ver_no>\d+\.\d+\.\d+\.\d*\.*)/ =~ log_data
      return CheckCode::Detected('Unable to determine version from log file')
    end

    return CheckCode::Detected('Galaxy Client version not found') unless ver_no

    version = Rex::Version.new(ver_no)

    return CheckCode::Appears("Vulnerable version found: #{ver_no}") if version < Rex::Version.new('2.0.13')

    CheckCode::Detected("Galaxy Client version #{ver_no} not vulnerable")
  end
Metasploit Module: Windows Net-NTLMv2 Reflection DCOM/RPC
Type: exploit
Path: modules/exploits/windows/local/ms16_075_reflection.rb
Platform: win
Disclosure date: 2016-01-16
References: MSB-MS16-075, CVE-2016-3225, URL-http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113/, URL-https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/, URL-https://github.com/breenmachine/RottenPotatoNG
Targets: Windows x86, Windows x64

Description:
Module utilizes the Net-NTLMv2 reflection between DCOM/RPC
            to achieve a SYSTEM handle for elevation of privilege. Currently the module
            does not spawn as SYSTEM, however once achieving a shell, one can easily
            use incognito to impersonate the token.

Check method (fingerprinting):
privs = client.sys.config.getprivs
    if privs.include?('SeImpersonatePrivilege')
      return Exploit::CheckCode::Appears('Target appears vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: CVE-2022-21999 SpoolFool Privesc
Type: exploit
Path: modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb
Platform: win
Disclosure date: 2022-02-08
References: URL-https://research.ifcr.dk/spoolfool-windows-print-spooler-privilege-escalation-cve-2022-22718-bf7752b68d81, CVE-2022-21999
Targets: Auto

Description:
The Windows Print Spooler has a privilege escalation vulnerability that
          can be leveraged to achieve code execution as SYSTEM.

          The `SpoolDirectory`, a configuration setting that holds the path that
          a printer's spooled jobs are sent to, is writable for all users, and it can
          be configured via `SetPrinterDataEx()` provided the caller has the
          `PRINTER_ACCESS_ADMINISTER` permission. If the `SpoolDirectory` path does not
          exist, it will be created once the print spooler reinitializes.

          Calling `SetPrinterDataEx()` with the `CopyFiles\` registry key will load the
          dll passed in as the `pData` argument, meaning that writing a dll to the `SpoolDirectory`
          location can be loaded by the print spooler.

          Using a directory junction and UNC path for the `SpoolDirectory`, the exploit
          writes a payload to `C:\Windows\System32\spool\drivers\x64\4` and loads it
          by calling `SetPrinterDataEx()`, resulting in code execution as SYSTEM.

Check method (fingerprinting):
unless session.platform == 'windows'
      return CheckCode::Safe('This module only supports Windows targets.')
    end

    version = get_version_info

    if version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1)
      return CheckCode::Safe('Windows 7 is technically vulnerable, though it requires a reboot.')
    elsif version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_21H2) ||
          version.build_number == Msf::WindowsVersion::Server2022 ||
          version.build_number == Msf::WindowsVersion::Win11_21H2
      return CheckCode::Appears("Version #{version} appears vulnerable")
    end

    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Windows Capcom.sys Kernel Execution Exploit (x64 only)
Type: exploit
Path: modules/exploits/windows/local/capcom_sys_exec.rb
Platform: win
Disclosure date: 1999-01-01
References: URL-https://twitter.com/TheWack0lian/status/[PII_REDACTED]62245124
Targets: Windows x64

Description:
This module abuses the Capcom.sys kernel driver's function that allows for an
            arbitrary function to be executed in the kernel from user land. This function
            purposely disables SMEP prior to invoking a function given by the caller.
            This has been tested on Windows 7, 8.1, 10 (x64) and Windows 11 (x64) upto build 22000.194.
            Note that builds after 22000.194 contain deny lists that prevent this driver from loading.

Check method (fingerprinting):
return Exploit::CheckCode::Unknown('Unable to determine target state') unless session.platform == 'windows'

    version = get_version_info
    if version.build_number < Msf::WindowsVersion::Win7_SP0 || version.windows_server?
      return Exploit::CheckCode::Unknown('Unable to determine target state')
    end

    # These versions of Windows 11 come built in with a driver block list preventing loading of capcom.sys
    if version.build_number > Rex::Version.new('10.0.22000.194')
      return Exploit::CheckCode::Safe('Target contains a block list which prevents the vulnerable driver from being loaded!')
    end

    if sysinfo['Architecture'] != ARCH_X64
      return Exploit::CheckCode::Safe("System architecture #{sysinfo['Architecture']} is not supported; only x64 targets are vulnerable to this exploit")
    end

    # Validate that the driver has been loaded and that
    # the version is the same as the one expected
    client.sys.config.getdrivers.each do |d|
      next unless d[:basename].downcase == 'capcom.sys'

      expected_checksum = '73c98438ac64a68e88b7b0afd11ba140'
      target_checksum = client.fs.file.md5(d[:filename])

      if expected_checksum == Rex::Text.to_hex(target_checksum, '')
        return Exploit::CheckCode::Appears("Version #{version} appears vulnerable")
      end
    end

    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Authenticated WMI Exec via Powershell
Type: exploit
Path: modules/exploits/windows/local/ps_wmi_exec.rb
Disclosure date: 2012-08-19
Authors: RageLtMan <rageltman[at]sempervictus>

Description:
This module uses WMI execution to launch a payload instance on a remote machine.
          In order to avoid AV detection, all execution is performed in memory via psh-net
          encoded payload. Persistence option can be set to keep the payload looping while
          a handler is present to receive it. By default the module runs as the current
          process owner. The module can be configured with credentials for the remote host
          with which to launch the process.