deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Ricoh Driver Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/ricoh_driver_privesc.rb
Platform: win
Disclosure date: 2020-01-22
References: CVE-2019-19363, URL-https://www.pentagrid.ch/en/blog/local-privilege-escalation-in-ricoh-printer-drivers-for-windows-cve-2019-19363/
Targets: Windows

Description:
Various Ricoh printer drivers allow escalation of
          privileges on Windows systems.

          For vulnerable drivers, a low-privileged user can
          read/write files within the `RICOH_DRV` directory
          and its subdirectories.

          `PrintIsolationHost.exe`, a Windows process running
          as NT AUTHORITY\SYSTEM, loads driver-specific DLLs
          during the installation of a printer. A user can
          elevate to SYSTEM by writing a malicious DLL to
          the vulnerable driver directory and adding a new
          printer with a vulnerable driver.

          This module leverages the `prnmngr.vbs` script
          to add and delete printers. Multiple runs of this
          module may be required given successful exploitation
          is time-sensitive.

Check method (fingerprinting):
@driver_path = ''
    dir_name = 'C:\\ProgramData\\RICOH_DRV'

    return CheckCode::Safe('No Ricoh driver directory found') unless directory?(dir_name)

    driver_names = dir(dir_name)

    return CheckCode::Detected('Detected Ricoh driver directory, but no installed drivers') unless driver_names.length

    vulnerable = false
    driver_names.each do |driver_name|
      full_path = "#{dir_name}\\#{driver_name}\\_common\\dlz"
      next unless directory?(full_path)

      @driver_path = full_path

      res = cmd_exec("icacls \"#{@driver_path}\"")
      next unless res.include?('Everyone:')
      next unless res.match(/\(F\)/)

      vulnerable = true
      break
    end

    return CheckCode::Detected('Ricoh driver directory does not have full permissions') unless vulnerable

    vprint_status("Vulnerable driver directory: #{@driver_path}")
    CheckCode::Appears('Ricoh driver directory has full permissions')
  end
Metasploit Module: Windows Escalate UAC Protection Bypass (Via COM Handler Hijack)
Type: exploit
Path: modules/exploits/windows/local/bypassuac_comhijack.rb
Platform: win
Disclosure date: 1900-01-01
References: URL-https://wikileaks.org/ciav7p1/cms/page_13763373.html, URL-https://github.com/FuzzySecurity/Defcon25/Defcon25_UAC-0day-All-Day_v1.2.pdf

Description:
This module will bypass Windows UAC by creating COM handler registry entries in the
          HKCU hive. When certain high integrity processes are loaded, these registry entries
          are referenced resulting in the process loading user-controlled DLLs. These DLLs
          contain the payloads that result in elevated sessions. Registry key modifications
          are cleaned up after payload invocation.

          This module requires the architecture of the payload to match the OS, but the
          current low-privilege Meterpreter session architecture can be different. If
          specifying EXE::Custom your DLL should call ExitProcess() after starting your
          payload in a separate process.

          This module invokes the target binary via cmd.exe on the target. Therefore if
          cmd.exe access is restricted, this module will not run correctly.

Check method (fingerprinting):
version_info = get_version_info
    vprint_status("System OS Detected: #{version_info.product_name}")
    # return CheckCode::Safe('UAC is not enabled') unless is_uac_enabled?
    if version_info.build_number.between?(::Msf::WindowsVersion::Win7_SP0, ::Msf::WindowsVersion::Win10_1903)
      return CheckCode::Appears("#{version_info.product_name} appears vulnerable")
    end

    return CheckCode::Safe("#{version_info.product_name} is not vulnerable")
  end
Metasploit Module: MS16-016 mrxdav.sys WebDav Local Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/ms16_016_webdav.rb
Platform: win
Disclosure date: 2016-02-09
References: CVE-2016-0051, MSB-MS16-016

Description:
This module exploits the vulnerability in mrxdav.sys described by MS16-016.  The module will spawn
            a process on the target system and elevate its privileges to NT AUTHORITY\SYSTEM before executing
            the specified payload within the context of the elevated process.

Check method (fingerprinting):
if sysinfo["Architecture"] == ARCH_X64
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    Exploit::CheckCode::Detected('32-bit target detected')
  end
Metasploit Module: Windows TrackPopupMenuEx Win32k NULL Page
Type: exploit
Path: modules/exploits/windows/local/ms13_081_track_popup_menu.rb
Platform: win
Disclosure date: 2013-10-08
References: CVE-2013-3881, OSVDB-98212, BID-62830, MSB-MS13-081, URL-http://endgame.com/news/microsoft-win32k-null-page-vulnerability-technical-analysis.html, URL-http://immunityproducts.blogspot.com/2013/11/exploiting-cve-2013-3881-win32k-null.html

Description:
This module exploits a vulnerability in win32k.sys where under
            specific conditions TrackPopupMenuEx will pass a NULL pointer to
            the MNEndMenuState procedure. This module has been tested
            successfully on Windows 7 SP0 and Windows 7 SP1.

Check method (fingerprinting):
if session.platform != 'windows'
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    file_path = expand_path('%windir%') << '\\system32\\win32k.sys'
    major, minor, build, revision, branch = file_version(file_path)
    vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")

    case build
    when 7600
      return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable")
    when 7601
      return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable") if revision <= 18126
    when 9200
      return Exploit::CheckCode::Safe("Revision #{revision} is not vulnerable")
    end
    return Exploit::CheckCode::Unknown('Unable to determine target state')
  end
Metasploit Module: Windows UAC Protection Bypass (Via FodHelper Registry Key)
Type: exploit
Path: modules/exploits/windows/local/bypassuac_fodhelper.rb
Platform: win
Disclosure date: 2017-05-12
References: URL-https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/, URL-https://github.com/winscripting/UAC-bypass/blob/master/FodhelperBypass.ps1, URL-https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
Targets: Windows x86, Windows x64

Description:
This module will bypass Windows 10 UAC by hijacking a special key in the Registry under
          the current user hive, and inserting a custom command that will get invoked when
          the Windows fodhelper.exe application is launched. It will spawn a second shell that has the UAC
          flag turned off.

          This module modifies a registry key, but cleans up the key once the payload has
          been invoked.

          The module does not require the architecture of the payload to match the OS. If
          specifying EXE::Custom your DLL should call ExitProcess() after starting your
          payload in a separate process.

Check method (fingerprinting):
version = get_version_info
    if version.build_number >= Msf::WindowsVersion::Win10_InitialRelease && !version.windows_server? && is_uac_enabled?
      Exploit::CheckCode::Appears("Version #{version} appears vulnerable")
    else
      Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end
Metasploit Module: Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)
Type: exploit
Path: modules/exploits/windows/local/bypassuac_vbs.rb
Disclosure date: 2015-08-22
References: URL-http://seclist.us/uac-bypass-vulnerability-in-the-windows-script-host.html, URL-https://github.com/Vozzie/uacscript
Targets: Automatic

Description:
This module will bypass Windows UAC by utilizing the missing .manifest on the script host
          cscript/wscript.exe binaries.
Metasploit Module: Microsoft Windows ALPC Task Scheduler Local Privilege Elevation
Type: exploit
Path: modules/exploits/windows/local/alpc_taskscheduler.rb
Platform: win
Disclosure date: 2018-08-27
References: CVE-2018-8440, URL-https://github.com/SandboxEscaper/randomrepo/
Targets: Windows 10 x64

Description:
On vulnerable versions of Windows the alpc endpoint method SchRpcSetSecurity implemented
          by the task scheduler service can be used to write arbitrary DACLs to `.job` files located
          in `c:\windows\tasks` because the scheduler does not use impersonation when checking this
          location. Since users can create files in the `c:\windows\tasks` folder, a hardlink can be
          created to a file the user has read access to. After creating a hardlink, the vulnerability
          can be triggered to set the DACL on the linked file.

          WARNING:
          The PrintConfig.dll (%windir%\system32\driverstor\filerepository\prnms003*) on the target host
          will be overwritten when the exploit runs.

          This module has been tested against Windows 10 Pro x64.
Metasploit Module: Dell DBUtil_2_3.sys IOCTL memmove
Type: exploit
Path: modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb
Platform: win
Disclosure date: 2021-05-04
References: CVE-2021-21551, URL-https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/, URL-https://www.dell.com/support/kbdoc/ro-ro/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability
Targets: Windows x64

Description:
The DBUtil_2_3.sys driver distributed by Dell exposes an unprotected IOCTL interface that can be abused by
            an attacker read and write kernel-mode memory.

Check method (fingerprinting):
if session.platform != 'windows'
      # Non-Windows systems are definitely not affected.
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    handle = open_device('\\\\.\\dbutil_2_3', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
    if handle.nil?
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    session.railgun.kernel32.CloseHandle(handle)
    CheckCode::Appears('Target appears vulnerable')
  end
Metasploit Module: Novell Client 2 SP3 nicm.sys Local Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/novell_client_nicm.rb
Platform: win
Disclosure date: 2013-05-22
References: CVE-2013-3956, OSVDB-93718, URL-http://www.novell.com/support/kb/doc.php?id=7012497, URL-http://pastebin.com/GB4iiEwR

Description:
This module exploits a flaw in the nicm.sys driver to execute arbitrary code in
            kernel space. The vulnerability occurs while handling ioctl requests with code
            0x143B6B, where a user provided pointer is used as function pointer. The module
            has been tested successfully on Windows 7 SP1 with Novell Client 2 SP3.

Check method (fingerprinting):
handle = open_device('\\\\.\\nicm')
    if handle.nil?
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    session.railgun.kernel32.CloseHandle(handle)
    return Exploit::CheckCode::Detected('Target service detected')
  end
Metasploit Module: Canon Driver Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/canon_driver_privesc.rb
Platform: win
Disclosure date: 2021-08-07
References: CVE-2021-38085
Targets: Windows

Description:
Canon TR150 print drivers versions 3.71.2.10 and below allow local users to read/write files
          within the "CanonBJ" directory and its subdirectories. By overwriting the DLL at
          C:\ProgramData\CanonBJ\IJPrinter\CNMWINDOWS\Canon TR150 series\LanguageModules\040C\CNMurGE.dll
          with a malicious DLL at the right time whilst running the C:\Windows\System32\Printing_Admin_Scripts\en-US\prnmngr.vbs
          script to install a new printer, a timing issue can be exploited to cause the PrintIsolationHost.exe program,
          which runs as NT AUTHORITY\SYSTEM, to successfully load the malicious DLL. Successful exploitation
          will grant attackers code execution as the NT AUTHORITY\SYSTEM user.

          This module leverages the prnmngr.vbs script
          to add and delete printers. Multiple runs of this
          module may be required given successful exploitation
          is time-sensitive.

Check method (fingerprinting):
@driver_path = ''
    dir_name = 'C:\\ProgramData\\CanonBJ\\IJPrinter\\CNMWINDOWS\\Canon TR150 series'

    return CheckCode::Safe('No Canon TR150 driver directory found') unless directory?(dir_name)

    language_dirs = dir(dir_name)

    return CheckCode::Detected("Detected Canon driver directory, but no language files. Its likely the driver is installed but a printer hasn't been added yet") unless language_dirs.length

    @driver_path = dir_name
    @driver_path.concat('\\LanguageModules\\040C')
    res = cmd_exec("icacls \"#{@driver_path}\"")
    vulnerable = res.match(/\\Users:(?:\(I\))?\(OI\)\(CI\)\(F\)/)

    return CheckCode::Safe("#{@driver_path} directory does not exist or does not grant Users full permissions") unless vulnerable

    vprint_status("Vulnerable language driver directory: #{@driver_path}")
    CheckCode::Appears('Canon language driver directory grants Users full permissions')
  end
Metasploit Module: Windows AlwaysInstallElevated MSI
Type: exploit
Path: modules/exploits/windows/local/always_install_elevated.rb
Disclosure date: 2010-03-18
References: URL-http://www.greyhathacker.net/?p=185, URL-http://msdn.microsoft.com/en-us/library/aa367561(VS.85).aspx, URL-http://rewtdance.blogspot.co.uk/2013/03/metasploit-msi-payload-generation.html

Description:
This module checks the AlwaysInstallElevated registry keys which dictates if
            .MSI files should be installed with elevated privileges (NT AUTHORITY\SYSTEM).
            The generated .MSI file has an embedded executable which is extracted and run
            by the installer. After execution the .MSI file intentionally fails installation
            (by calling some invalid VBS) to prevent it being registered on the system.
            By running this with the /quiet argument the error will not be seen by the user.

Check method (fingerprinting):
install_elevated = "AlwaysInstallElevated"
    installer = "SOFTWARE\\Policies\\Microsoft\\Windows\\Installer"
    hkcu = "HKEY_CURRENT_USER\\#{installer}"
    hklm = "HKEY_LOCAL_MACHINE\\#{installer}"

    local_machine_value = registry_getvaldata(hklm, install_elevated)

    if local_machine_value.nil?
      vprint_error("#{hklm}\\#{install_elevated} does not exist or is not accessible.")
      return Msf::Exploit::CheckCode::Safe('Target is not vulnerable')
    elsif local_machine_value == 0
      vprint_error("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
      return Msf::Exploit::CheckCode::Safe('Target is not vulnerable')
    else
      vprint_good("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
      current_user_value = registry_getvaldata(hkcu, install_elevated)
    end

    if current_user_value.nil?
      vprint_error("#{hkcu}\\#{install_elevated} does not exist or is not accessible.")
      return Msf::Exploit::CheckCode::Safe('Target is not vulnerable')
    elsif current_user_value == 0
      vprint_error("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
      return Msf::Exploit::CheckCode::Safe('Target is not vulnerable')
    else
      vprint_good("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
      return Msf::Exploit::CheckCode::Vulnerable('Target is vulnerable')
    end
  end
Metasploit Module: MS15-078 Microsoft Windows Font Driver Buffer Overflow
Type: exploit
Path: modules/exploits/windows/local/ms15_078_atmfd_bof.rb
Platform: win
Disclosure date: 2015-07-11
References: CVE-2015-2426, CVE-2015-2433, MSB-MS15-078, MSB-MS15-080, URL-https://github.com/vlad902/hacking-team-windows-kernel-lpe, URL-https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/september/exploiting-cve-2015-2426-and-how-i-ported-it-to-a-recent-windows-8.1-64-bit/, URL-https://code.google.com/p/google-security-research/issues/detail?id=369, URL-https://code.google.com/p/google-security-research/issues/detail?id=480

Description:
This module exploits a pool based buffer overflow in the atmfd.dll driver when parsing
            a malformed font. The vulnerability was exploited by the hacking team and disclosed in
            the July data leak. This module has been tested successfully on vulnerable builds of
            Windows 8.1 x64.

Check method (fingerprinting):
# We have tested only windows 8.1
    version = get_version_info
    unless version.build_number != Msf::WindowsVersion::Win81 && !version.windows_server?
      return Exploit::CheckCode::Unknown('Unable to determine target state')
    end

    # We have tested only 64 bits
    if sysinfo['Architecture'] != ARCH_X64
      return Exploit::CheckCode::Unknown('Unable to determine target state')
    end

    atmfd = atmfd_version
    # atmfd 5.1.2.238 => Works
    unless atmfd && Rex::Version.new(atmfd) <= Rex::Version.new('5.1.2.243')
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end

    # win32k.sys 6.3.9600.17393 => Works
    @win32k = win32k_version

    unless @win32k && WIN32K_VERSIONS.include?(@win32k)
      return Exploit::CheckCode::Detected("Version #{version} detected but not confirmed vulnerable")
    end

    # ntoskrnl.exe 6.3.9600.17415 => Works
    @ntoskrnl = ntoskrnl_version

    unless @ntoskrnl && NT_VERSIONS.include?(@ntoskrnl)
      return Exploit::CheckCode::Unknown('Unable to determine target state')
    end

    Exploit::CheckCode::Appears("Version #{version} appears vulnerable")
  end
Metasploit Module: Microsoft Windows DrawIconEx OOB Write Local Privilege Elevation
Type: exploit
Path: modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb
Platform: win
Disclosure date: 2020-02-20
References: CVE-2020-1054, URL-https://cpr-zero.checkpoint.com/vulns/cprid-2153/, URL-https://0xeb-bp.com/blog/2020/06/15/cve-2020-1054-analysis.html, URL-https://github.com/DreamoneOnly/2020-1054/blob/master/x64_src/main.cpp, URL-https://github.com/KaLendsi/CVE-2020-1054/blob/master/CVE-2020-1054/exploit.cpp, URL-https://github.com/Iamgublin/CVE-2020-1054/blob/master/ConsoleApplication4.cpp
Targets: Windows 7 x64

Description:
This module exploits CVE-2020-1054, an out of bounds write reachable from DrawIconEx
          within win32k. The out of bounds write can be used to overwrite the pvbits of a
          SURFOBJ. By utilizing this vulnerability to execute controlled writes to kernel
          memory, an attacker can gain arbitrary code execution as the SYSTEM user.

          This module has been tested against a fully updated Windows 7 x64 SP1. Offsets
          within the exploit code may need to be adjusted to work with other versions of
          Windows.

Check method (fingerprinting):
if session.platform != 'windows'
      # Non-Windows systems are definitely not affected.
      return CheckCode::Safe('Target is not vulnerable')
    end

    file_path = expand_path('%WINDIR%\\system32\\win32k.sys')
    major, minor, build, revision, branch = file_version(file_path)
    vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")

    build_num_gemversion = Rex::Version.new("#{major}.#{minor}.#{build}.#{revision}")
    if (build_num_gemversion >= Rex::Version.new('6.1.7600.0')) && (build_num_gemversion < Rex::Version.new('6.1.7601.24542')) # Windows 7 SP1
      @xleft_offset = 0x900
      @oob_offset = 0x238
      return CheckCode::Appears("Revision #{revision} appears vulnerable")
    elsif (build_num_gemversion >= Rex::Version.new('6.1.7600.0')) && (build_num_gemversion < Rex::Version.new('6.1.7601.24553')) # Windows 7 SP1 with patches
      @xleft_offset = 0x8c0
      @oob_offset = 0x240
      return CheckCode::Appears("Revision #{revision} appears vulnerable")
    else
      return CheckCode::Safe("No target for win32k.sys version #{build_num_gemversion}")
    end
  end
Metasploit Module: NSClient++ 0.5.2.35 - Privilege escalation
Type: exploit
Path: modules/exploits/windows/local/nscp_pe.rb
Platform: %w[windows
Disclosure date: 2020-10-20
References: CVE-2025-34078, EDB-48360, EDB-46802
Targets: Windows

Description:
This module allows an attacker with an unprivileged windows account to gain admin access on windows system and start a shell.
          For this module to work, both the NSClient++ web interface  and `ExternalScripts` features must be enabled.
          You must also know where the NSClient config file is, as it is used to read the admin password which is stored in clear text.

Check method (fingerprinting):
datastore['RHOST'] = session.session_host
    pwd, web_server_enabled = leak_info
    if pwd.nil?
      CheckCode::Unknown('Admin password not found in config file')
    elsif !web_server_enabled
      CheckCode::Safe('NSClient web interface is disabled')
    else
      token = get_auth_token(pwd)
      if token.nil?
        CheckCode::Unknown('Unable to get an authentication token, maybe the target is safe')
      elsif external_scripts_feature_enabled?(token)
        CheckCode::Vulnerable('External scripts feature enabled !')
      else
        CheckCode::Safe('External scripts feature disabled !')
      end
    end
  end
Metasploit Module: Windows Cloud File Mini Filer Driver Heap Overflow
Type: exploit
Path: modules/exploits/windows/local/cve_2024_30085_cloud_files.rb
Platform: win
Disclosure date: 2024-12-19
References: CVE-2024-30085, URL-https://attackerkb.com/topics/EHiwxpT2Dp/cve-2024-30085, URL-https://ssd-disclosure.com/ssd-advisory-cldflt-heap-based-overflow-pe/, URL-https://starlabs.sg/blog/2024/all-i-want-for-christmas-is-a-cve-2024-30085-exploit/
Targets: Windows x64

Description:
This module exploits the Windows Cloud Files Mini FIlter Driver cldflt.sys on Windows workstation versions
          10_1809 through 11_23H2 and Windows server versions 2022 to 22_23H2.

Check method (fingerprinting):
version = get_version_info
    vprint_status("OS version: #{version}")
    vprint_status("OS revision: #{version.revision_number}")
    return Exploit::CheckCode::Appears("Version #{version} appears vulnerable") if target_compatible?(version)

    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: MS11-080 AfdJoinLeaf Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/ms11_080_afdjoinleaf.rb
Platform: win
Disclosure date: 2011-11-30

Description:
This module exploits a flaw in the AfdJoinLeaf function of the
            afd.sys driver to overwrite data in kernel space.  An address
            within the HalDispatchTable is overwritten and when triggered
            with a call to NtQueryIntervalProfile will execute shellcode.

            This module will elevate itself to SYSTEM, then inject the payload
            into another SYSTEM process before restoring its own token to
            avoid causing system instability.
Metasploit Module: PXE Exploit Server
Type: exploit
Path: modules/exploits/windows/local/pxeexploit.rb
Platform: win
Disclosure date: Aug 05 2011

Description:
This module provides a PXE server, running a DHCP and TFTP server.
        The default configuration loads a linux kernel and initrd into memory that
        reads the hard drive; placing the payload on the hard drive of any Windows
        partition seen.

        Note: the displayed IP address of a target is the address this DHCP server
        handed out, not the "normal" IP address the host uses.