deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Windows Escalate UAC Protection Bypass (Via dot net profiler)
Type: exploit
Path: modules/exploits/windows/local/bypassuac_dotnet_profiler.rb
Platform: win
Disclosure date: 2017-03-17
References: URL-https://seclists.org/fulldisclosure/2017/Jul/11, URL-https://offsec.provadys.com/UAC-bypass-dotnet.html
Targets: Windows x64

Description:
Microsoft Windows allows for the automatic loading of a profiling COM object during
          the launch of a CLR process based on certain environment variables ostensibly to
          monitor execution.  In this case, we abuse the profiler by pointing to a payload DLL
          that will be launched as the profiling thread.  This thread will run at the permission
          level of the calling process, so an auto-elevating process will launch the DLL with
          elevated permissions.  In this case, we use gpedit.msc as the auto-elevated CLR
          process, but others would work, too.

Check method (fingerprinting):
if is_uac_enabled?
      Exploit::CheckCode::Appears('Target appears vulnerable')
    else
      Exploit::CheckCode::Safe('Target is not vulnerable')
    end
  end
Metasploit Module: Micro Focus Operations Bridge Manager / Reporter Local Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/microfocus_operations_privesc.rb
Platform: win
Disclosure date: 2020-10-28
References: URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBM.md, URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBR.md, CVE-2020-11858, CVE-2020-11855, ZDI-20-1326, ZDI-20-1217

Description:
This module exploits an incorrectly permissioned folder in Micro Focus Operations Bridge
          Manager and Operations Bridge Reporter.
          An unprivileged user (such as Guest) can drop a JSP file in an exploded WAR directory and
          then access it without authentication by making a request to the OBM / OBR server.
          This will result in automatic code execution as SYSTEM. This module has been tested on
          OBM 2020.05 and OBR 10.40, but it should work out of the box on earlier versions too.
          Note that it is only exploitable on Windows installations.
Metasploit Module: Windows Escalate UAC Execute RunAs
Type: exploit
Path: modules/exploits/windows/local/ask.rb
Platform: win
Disclosure date: 2012-01-03

Description:
This module will attempt to elevate execution level using
          the ShellExecute undocumented RunAs flag to bypass low
          UAC settings.
Metasploit Module: Windows ClientCopyImage Win32k Exploit
Type: exploit
Path: modules/exploits/windows/local/ms15_051_client_copy_image.rb
Platform: win
Disclosure date: 2015-05-12
References: CVE-2015-1701, MSB-MS15-051, URL-https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html, URL-https://github.com/hfiref0x/CVE-2015-1701, URL-https://technet.microsoft.com/library/security/MS15-051
Targets: Windows x86, Windows x64

Description:
This module exploits improper object handling in the win32k.sys kernel mode driver.
            This module has been tested on vulnerable builds of Windows 7 x64 and x86, and
            Windows 2008 R2 SP1 x64.

Check method (fingerprinting):
# Windows XP SP3 (32-bit)                      5.1.2600.6514 (Works)
    # Windows Server 2003 Standard SP2 (32-bit)    5.2.3790.5445 (Works)
    # Windows Server 2008 Enterprise SP2 (32-bit)  6.0.6002.18005 (Does not work)
    # Windows 7 SP1 (64-bit)                       6.1.7601.17514 (Works)
    # Windows 7 SP1 (64-bit)                       6.1.7601.17535 (Works)
    # Windows 7 SP1 (32-bit)                       6.1.7601.17514 (Works)
    # Windows 7 SP1 (32-bit)                       6.1.7601.18388 (Works)
    # Windows Server 2008 R2 (64-bit) SP1          6.1.7601.17514 (Works)
    # Windows Server 2008 R2 (64-bit) SP1          6.1.7601.18105 (Works)

    unless session.platform == 'windows'
      return Exploit::CheckCode::Unknown('Unable to determine target state')
    end

    file_path = expand_path('%windir%') << '\\system32\\win32k.sys'
    major, minor, build, revision, branch = file_version(file_path)
    vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")

    return Exploit::CheckCode::Safe("Build #{build} is not vulnerable") if build > 7601

    return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable")
  end
Metasploit Module: Microsoft Error Reporting Local Privilege Elevation Vulnerability
Type: exploit
Path: modules/exploits/windows/local/win_error_cve_2023_36874.rb
Platform: win
Disclosure date: 2023-07-11
References: CVE-2023-36874, URL-https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/, URL-https://github.com/Wh04m1001/CVE-2023-36874, URL-https://github.com/Octoberfest7/CVE-2023-36874_BOF
Targets: Automatic

Description:
This module takes advantage of a bug in the way Windows error reporting opens the report
          parser.  If you open a report, Windows uses a relative path to locate the rendering program.
          By creating a specific alternate directory structure, we can coerce Windows into opening an
          arbitrary executable as SYSTEM.
          If the current user is a local admin, the system will attempt impersonation and the exploit will
          fail.

Check method (fingerprinting):
# This only appears to work on 22H2, but likely will work elsewhere if we figure out the function pointers.
    version = get_version_info
    vprint_status("OS version: #{version}")
    return Exploit::CheckCode::Appears("Version #{version} appears vulnerable") if version.build_number == Msf::WindowsVersion::Win10_22H2

    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Windows WMI Receive Notification Exploit
Type: exploit
Path: modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb
Platform: win
Disclosure date: 2015-12-04
References: CVE-2016-0040, MSB-MS16-014, URL-https://github.com/de7ec7ed/CVE-2016-0040, URL-https://github.com/Rootkitsmm/cve-2016-0040, URL-https://technet.microsoft.com/en-us/library/security/ms16-014.aspx
Targets: Windows 7 SP0/SP1

Description:
This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl.
          This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64.

Check method (fingerprinting):
# Windows 7 SP0/SP1 (64-bit)

    unless session.platform == 'windows'
      return Exploit::CheckCode::Unknown('Unable to determine target state')
    end

    version = get_version_info
    vprint_status("OS Version: #{version.product_name}")

    return Exploit::CheckCode::Safe("Version #{version} is not vulnerable") unless version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) && version.workstation?

    return Exploit::CheckCode::Appears("Version #{version} appears vulnerable")
  end
Metasploit Module: Microsoft UPnP Local Privilege Elevation Vulnerability
Type: exploit
Path: modules/exploits/windows/local/comahawk.rb
Platform: win
Disclosure date: 2019-11-12
References: CVE-2019-1322, CVE-2019-1405, EDB-47684, URL-https://github.com/apt69/COMahawk, URL-https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/november/cve-2019-1405-and-cve-2019-1322-elevation-to-system-via-the-upnp-device-host-service-and-the-update-orchestrator-service/, URL-https://fortiguard.com/threat-signal-report/3243/new-proof-of-concept-combining-cve-2019-1322-and-cve-2019-1405-developed-1
Targets: Windows x64

Description:
This exploit uses two vulnerabilities to execute a command as an elevated user.
          The first (CVE-2019-1405) uses the UPnP Device Host Service to elevate to
          NT AUTHORITY\LOCAL SERVICE
          The second (CVE-2019-1322) leverages the Update Orchestrator Service to
          elevate from NT AUTHORITY\LOCAL SERVICE to NT AUTHORITY\SYSTEM.
Metasploit Module: Windows TrackPopupMenu Win32k NULL Pointer Dereference
Type: exploit
Path: modules/exploits/windows/local/ms14_058_track_popup_menu.rb
Platform: win
Disclosure date: 2014-10-14
References: CVE-2014-4113, OSVDB-113167, BID-70364, MSB-MS14-058, URL-http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113/
Targets: Windows x86, Windows x64

Description:
This module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability
            can be triggered through the use of TrackPopupMenu. Under special conditions, the
            NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary
            code execution. This module has been tested successfully on Windows XP SP3, Windows
            2003 SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1 and Windows
            2008 R2 SP1 64 bits.

Check method (fingerprinting):
if session.platform != 'windows'
      # Non-Windows systems are definitely not affected.
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    file_path = expand_path('%windir%') << '\\system32\\win32k.sys'
    major, minor, build, revision, branch = file_version(file_path)
    vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")

    # Neither target suports Windows 8 or 8.1
    return Exploit::CheckCode::Safe("Build #{build} is not vulnerable") if build == 9200
    return Exploit::CheckCode::Safe("Build #{build} is not vulnerable") if build == 9600

    return Exploit::CheckCode::Appears("Revision #{revision} appears vulnerable") if [2600, 3790, 7600, 7601].include?(build)

    return Exploit::CheckCode::Unknown('Unable to determine target state')
  end
Metasploit Module: MS13-005 HWND_BROADCAST Low to Medium Integrity Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
Disclosure date: 2012-11-27
References: CVE-2013-0008, MSB-MS13-005, OSVDB-88966, URL-http://blog.cmpxchg8b.com/2013/02/a-few-years-ago-while-working-on.html
Targets: Windows x86, Windows x64

Description:
Due to a problem with isolating window broadcast messages in the Windows kernel,
          an attacker can broadcast commands from a lower Integrity Level process to a
          higher Integrity Level process, thereby effecting a privilege escalation. This
          issue affects Windows Vista, 7, 8, Server 2008, Server 2008 R2, Server 2012, and
          RT. Note that spawning a command prompt with the shortcut key combination Win+Shift+#
          does not work in Vista, so the attacker will have to check if the user is already
          running a command prompt and set SPAWN_PROMPT false.

          Three exploit techniques are available with this module. The WEB technique will
          execute a powershell encoded payload from a Web location.  The FILE technique
          will drop an executable to the file system, set it to medium integrity and execute
          it. The TYPE technique will attempt to execute a powershell encoded payload directly
          from the command line, but may take some time to complete.
Metasploit Module: CVE-2020-1170 Cloud Filter Arbitrary File Creation EOP
Type: exploit
Path: modules/exploits/windows/local/cve_2020_17136.rb
Platform: win
Disclosure date: 2020-03-10
References: CVE-2020-17136, URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=2082, URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17136
Targets: Windows DLL Dropper

Description:
The Cloud Filter driver, cldflt.sys, on Windows 10 v1803 and later, prior to the December
          2020 updates, did not set the IO_FORCE_ACCESS_CHECK or OBJ_FORCE_ACCESS_CHECK flags when
          calling FltCreateFileEx() and FltCreateFileEx2() within its HsmpOpCreatePlaceholders()
          function with attacker controlled input. This meant that files were created with
          KernelMode permissions, thereby bypassing any security checks that would otherwise
          prevent a normal user from being able to create files in directories
          they don't have permissions to create files in.

          This module abuses this vulnerability to perform a DLL hijacking attack against the
          Microsoft Storage Spaces SMP service, which grants the attacker code execution as the
          NETWORK SERVICE user. Users are strongly encouraged to set the PAYLOAD option to one
          of the Meterpreter payloads, as doing so will allow them to subsequently escalate their
          new session from NETWORK SERVICE to SYSTEM by using Meterpreter's "getsystem" command
          to perform RPCSS Named Pipe Impersonation and impersonate the SYSTEM user.

Check method (fingerprinting):
if session.platform != 'windows'
      # Non-Windows systems are definitely not affected.
      return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!')
    end

    version = get_version_info

    # Build numbers taken from https://www.qualys.com/research/security-alerts/2020-03-10/microsoft/
    if version.build_number == Msf::WindowsVersion::Win10_20H2 && version.revision_number.between?(0, 684)
      return CheckCode::Appears('A vulnerable Windows 10 20H2 build was detected!')
    elsif version.build_number == Msf::WindowsVersion::Win10_2004 && version.revision_number.between?(0, 684)
      return CheckCode::Appears('A vulnerable Windows 10 20H1 build was detected!')
    elsif version.build_number == Msf::WindowsVersion::Win10_1909 && version.revision_number.between?(0, 1255)
      return CheckCode::Appears('A vulnerable Windows 10 v1909 build was detected!')
    elsif version.build_number == Msf::WindowsVersion::Win10_1903 && version.revision_number.between?(0, 1255)
      return CheckCode::Appears('A vulnerable Windows 10 v1903 build was detected!')
    elsif version.build_number == Msf::WindowsVersion::Win10_1809 && version.revision_number.between?(0, 1636)
      return CheckCode::Appears('A vulnerable Windows 10 v1809 build was detected!')
    elsif version.build_number == Msf::WindowsVersion::Win10_1803 && version.revision_number.between?(0, 1901)
      return CheckCode::Appears('A vulnerable Windows 10 v1803 build was de
Metasploit Module: Nvidia (nvsvc) Display Driver Service Local Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/nvidia_nvsvc.rb
Platform: win
Disclosure date: 2012-12-25
References: CVE-2013-0109, OSVDB-88745, URL-http://nvidia.custhelp.com/app/answers/detail/a_id/3288

Description:
The named pipe, \pipe\nsvr, has a NULL DACL allowing any authenticated user to
            interact with the service. It contains a stacked based buffer overflow as a result
            of a memmove operation. Note the slight spelling differences: the executable is 'nvvsvc.exe',
            the service name is 'nvsvc', and the named pipe is 'nsvr'.

            This exploit automatically targets nvvsvc.exe versions dated Nov 3 2011, Aug 30 2012, and Dec 1 2012.
            It has been tested on Windows 7 64-bit against nvvsvc.exe dated Dec 1 2012.

Check method (fingerprinting):
vuln_hashes = [
      '43f91595049de14c4b61d1e76436164f',
      '3947ad5d03e6abcce037801162fdb90d',
      '3341d2c91989bc87c3c0baa97c27253b'
    ]

    if session.platform == 'windows'
      svc = service_info 'nvsvc'
      if svc && svc[:display] =~ (/NVIDIA/i)
        vprint_good("Found service '#{svc[:display]}'")

        begin
          if is_running?
            vprint_good('Service is running')
          else
            vprint_error('Service is not running!')
          end
        rescue RuntimeError
          vprint_error('Unable to retrieve service status')
          return Exploit::CheckCode::Unknown('Unable to determine target state')
        end

        path = svc[:path].gsub('"', '').strip
        if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86
          path.gsub!('system32', 'sysnative')
        end

        begin
          hash = client.fs.file.md5(path).unpack('H*').first
        rescue Rex::Post::Meterpreter::RequestError => e
          print_error("Error checking file hash: #{e}")
          return Exploit::CheckCode::Detected("Unable to verify file hash: #{e}")
        end

        if vuln_hashes.include?(hash)
          vprint_good("Hash '#{hash}' is listed as vulnerable")
          return Exploit::CheckCode::Vulnerable('Target is vulnerable')
        else
          vprint_status("Hash '#{hash}' is not recorded as vulnerable")
          return Exploit::CheckCode::Detected('Target service detected')
        end
      else
        return
Metasploit Module: Microsoft Windows Uninitialized Variable Local Privilege Elevation
Type: exploit
Path: modules/exploits/windows/local/cve_2019_1458_wizardopium.rb
Platform: win
Disclosure date: 2019-12-10
References: CVE-2019-1458, URL-https://github.com/unamer/CVE-2019-1458, URL-https://github.com/piotrflorczyk/cve-2019-1458_POC, URL-https://securelist.com/windows-0-day-exploit-cve-2019-1458-used-in-operation-wizardopium/95432/, URL-https://googleprojectzero.blogspot.com/p/rca-cve-2019-1458.html
Targets: Windows 7 x64

Description:
This module exploits CVE-2019-1458, an arbitrary pointer dereference vulnerability
          within win32k which occurs due to an uninitalized variable, which allows user mode attackers
          to write a limited amount of controlled data to an attacker controlled address
          in kernel memory. By utilizing this vulnerability to execute controlled writes
          to kernel memory, an attacker can gain arbitrary code execution
          as the SYSTEM user.

          This module has been tested against Windows 7 x64 SP1. Offsets within the
          exploit code may need to be adjusted to work with other versions of Windows.
          The exploit can only be triggered once against the target and can cause the
          target machine to reboot when the session is terminated.

Check method (fingerprinting):
if session.platform != 'windows'
      # Non-Windows systems are definitely not affected.
      return CheckCode::Safe('Target is not vulnerable')
    end

    file_path = expand_path('%WINDIR%\\system32\\win32k.sys')
    major, minor, build, revision, branch = file_version(file_path)
    vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")

    build_num_gemversion = Rex::Version.new("#{major}.#{minor}.#{build}.#{revision}")

    # Build numbers taken from https://www.qualys.com/research/security-alerts/2019-12-10/microsoft/
    if (build_num_gemversion >= Rex::Version.new('6.0.6000.0')) && (build_num_gemversion < Rex::Version.new('6.0.6003.20692')) # Windows Vista and Windows Server 2008
      return CheckCode::Appears("Revision #{revision} appears vulnerable")
    elsif (build_num_gemversion >= Rex::Version.new('6.1.7600.0')) && (build_num_gemversion < Rex::Version.new('6.1.7601.24540')) # Windows 7 and Windows Server 2008 R2
      return CheckCode::Appears("Revision #{revision} appears vulnerable")
    elsif (build_num_gemversion >= Rex::Version.new('6.2.9200.0')) && (build_num_gemversion < Rex::Version.new('6.2.9200.22932')) # Windows 8 and Windows Server 2012
      return CheckCode::Appears("Revision #{revision} appears vulnerable")
    elsif (build_num_gemversion >= Rex::Version.new('6.3.9600.0')) && (build_num_gemversion < Rex::Version.new('6.3.9600.19574')) # Windows 8.1 and Windows Server 2012 R2
      return CheckCode::
Metasploit Module: Plantronics Hub SpokesUpdateService Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/plantronics_hub_spokesupdateservice_privesc.rb
Platform: win
Disclosure date: 2019-08-30
References: CVE-2019-15742, EDB-47845, URL-https://support.polycom.com/content/dam/polycom-support/global/documentation/plantronics-hub-local-privilege-escalation-vulnerability.pdf

Description:
The Plantronics Hub client application for Windows makes use of an
          automatic update service `SpokesUpdateService.exe` which automatically
          executes a file specified in the `MajorUpgrade.config` configuration
          file as SYSTEM. The configuration file is writable by all users by default.

          This module has been tested successfully on Plantronics Hub version 3.13.2
          on Windows 7 SP1 (x64).

Check method (fingerprinting):
service = 'PlantronicsUpdateService'

    unless service_exists? service
      return CheckCode::Safe("Service '#{service}' does not exist")
    end

    path = "#{session.sys.config.getenv('PROGRAMDATA')}\\Plantronics\\Spokes3G"

    unless exists? path
      return CheckCode::Safe("Directory '#{path}' does not exist")
    end

    CheckCode::Detected('Target service detected')
  end
Metasploit Module: Windows NtUserSetWindowFNID Win32k User Callback
Type: exploit
Path: modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb
Platform: win
Disclosure date: 2018-10-09
References: CVE-2018-8453, URL-https://github.com/ze0r/cve-2018-8453-exp, URL-https://mp.weixin.qq.com/s/ogKCo-Jp8vc7otXyu6fTig, URL-https://mp.weixin.qq.com/s/dcbUeegM0BqErtDufOXfoQ, URL-https://securelist.com/cve-2018-8453-used-in-targeted-attacks/88151/, URL-https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8453

Description:
An elevation of privilege vulnerability exists in Windows when the Win32k component
          fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability."
          This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows
          Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2,
          Windows 10, Windows 10 Servers.
          This module is tested against Windows 10 v1703 x86.
Metasploit Module: Windows SetImeInfoEx Win32k NULL Pointer Dereference
Type: exploit
Path: modules/exploits/windows/local/ms18_8120_win32k_privesc.rb
Platform: win
Disclosure date: 2018-05-09
References: BID-104034, CVE-2018-8120, URL-https://github.com/unamer/CVE-2018-8120, URL-https://github.com/bigric3/cve-2018-8120, URL-http://bigric3.blogspot.com/2018/05/cve-2018-8120-analysis-and-exploit.html, URL-https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120
Targets: Windows 7 x64, Windows 7 x86

Description:
This module exploits elevation of privilege vulnerability that exists in Windows 7 and 2008 R2
          when the Win32k component fails to properly handle objects in memory. An attacker who
          successfully exploited this vulnerability could run arbitrary code in kernel mode. An
          attacker could then install programs; view, change, or delete data; or create new
          accounts with full user rights.

          This module is tested against windows 7 x86, windows 7 x64 and windows server 2008 R2 standard x64.
Metasploit Module: Windows Escalate UAC Protection Bypass
Type: exploit
Path: modules/exploits/windows/local/bypassuac.rb
Disclosure date: 2010-12-31
References: URL-http://www.trustedsec.com/december-2010/bypass-windows-uac/
Targets: Windows x86, Windows x64

Description:
This module will bypass Windows UAC by utilizing the trusted publisher
          certificate through process injection. It will spawn a second shell that
          has the UAC flag turned off.